{"total":5462,"license":"CC-BY-4.0","licenseUrl":"https://creativecommons.org/licenses/by/4.0/","attribution":"AgentRules.org","rules":[{"id":"fastify-5-schema-compilers-encapsulation-production-standard","title":"Fastify 5 Schema Compilers & Encapsulation Production Standard","category":"backend","severity":"critical","description":"Fastify relies on lexical encapsulation contexts to sandbox decorators, hooks, and compiled validation/serialization schemas without memory leaks or cross-tenant bleed. In Fastify 5, misuse of global compilers or failing to encapsulate plugin boundaries causes compiled `fast-json-stringify` serializers and Ajv validators to either crash on duplicate IDs, leak private data across sibling scopes, or bypass JIT compilation optimizations. Production services must enforce strict encapsulation hierarchies and type-safe schema compilation across every routing subtree.","antiPatternHeadline":"Mutating global AJV/fast-json-stringify compilers or exposing route-level decorators and hooks across sibling plugin contexts without encapsulation boundaries.","stars_count":42,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastify","typescript","validation","security"],"exportEndpoints":{"claude":"/api/rules/fastify-5-schema-compilers-encapsulation-production-standard?format=claude","cursorMdc":"/api/rules/fastify-5-schema-compilers-encapsulation-production-standard?format=mdc","cursorrules":"/api/rules/fastify-5-schema-compilers-encapsulation-production-standard?format=cursor","windsurf":"/api/rules/fastify-5-schema-compilers-encapsulation-production-standard?format=windsurf","agents":"/api/rules/fastify-5-schema-compilers-encapsulation-production-standard?format=agents"}},{"id":"solidstart-1-0-server-functions-async-boundaries-production-standard","title":"SolidStart 1.0 Server Functions & Async Boundaries Production Standard","category":"frontend","severity":"critical","description":"SolidStart 1.0 relies on the Vinxi bundler to split `server$` closures into independent HTTP POST RPC endpoints. Direct lexical closure over client signals within `server$` scopes or failure to demarcate async boundaries with `<Suspense>` causes silent serialization failures, client-bundle secret leaks, and SSR hydration mismatches. Enforcing strict parameter passing, runtime input validation, and Solid async primitives maintains security and fine-grained reactivity across network boundaries.","antiPatternHeadline":"Closing over reactive client signals inside server$ RPCs or calling unvalidated server functions directly in reactive effects.","stars_count":119,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","solidstart","solidjs","rpc","async"],"exportEndpoints":{"claude":"/api/rules/solidstart-1-0-server-functions-async-boundaries-production-standard?format=claude","cursorMdc":"/api/rules/solidstart-1-0-server-functions-async-boundaries-production-standard?format=mdc","cursorrules":"/api/rules/solidstart-1-0-server-functions-async-boundaries-production-standard?format=cursor","windsurf":"/api/rules/solidstart-1-0-server-functions-async-boundaries-production-standard?format=windsurf","agents":"/api/rules/solidstart-1-0-server-functions-async-boundaries-production-standard?format=agents"}},{"id":"astro-5-actions-content-layer-production-standard","title":"Astro 5 Actions & Content Layer Production Standard","category":"frontend","severity":"critical","description":"Enforces strict type safety and architectural correctness for Astro 5 Server Actions and the zero-waterfall Content Layer API. Prevents runtime contract mismatches, hydration mismatches, and unhandled mutation exceptions across dynamic and prerendered boundaries. Failure to follow these patterns leads to silent data fetching waterfalls, build-time cache corruptions, and unhandled server action exceptions.","antiPatternHeadline":"Writing legacy Astro v4 content collection configurations and unvalidated server actions that throw generic Errors instead of ActionError.","stars_count":119,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","astro","content-layer","server-actions","typescript"],"exportEndpoints":{"claude":"/api/rules/astro-5-actions-content-layer-production-standard?format=claude","cursorMdc":"/api/rules/astro-5-actions-content-layer-production-standard?format=mdc","cursorrules":"/api/rules/astro-5-actions-content-layer-production-standard?format=cursor","windsurf":"/api/rules/astro-5-actions-content-layer-production-standard?format=windsurf","agents":"/api/rules/astro-5-actions-content-layer-production-standard?format=agents"}},{"id":"nuxt-4-nitro-server-engine-shared-directory-production-standard","title":"Nuxt 4 Nitro Server Engine & Shared Directory Production Standard","category":"frontend","severity":"critical","description":"Nuxt 4 enforces strict boundary segregation between client UI in the app/ directory, backend endpoints in server/, and universal contracts in shared/. Violating cross-boundary isolation or maintaining module-scoped state in Nitro server handlers causes catastrophic cross-request data corruption and hydration mismatches under concurrent production traffic. Architects must enforce request-isolated H3 event contexts, universal serialization schemas, and strict path-alias boundaries.","antiPatternHeadline":"Placing mutable module-level state in Nitro event handlers and importing server-only dependencies into client or shared directories.","stars_count":51,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nuxt","nitro","vue","ssr"],"exportEndpoints":{"claude":"/api/rules/nuxt-4-nitro-server-engine-shared-directory-production-standard?format=claude","cursorMdc":"/api/rules/nuxt-4-nitro-server-engine-shared-directory-production-standard?format=mdc","cursorrules":"/api/rules/nuxt-4-nitro-server-engine-shared-directory-production-standard?format=cursor","windsurf":"/api/rules/nuxt-4-nitro-server-engine-shared-directory-production-standard?format=windsurf","agents":"/api/rules/nuxt-4-nitro-server-engine-shared-directory-production-standard?format=agents"}},{"id":"svelte-5-runes-reactivity","title":"Svelte 5 Runes ($state, $derived, $effect) & Legacy Reactivity Elimination","category":"frontend","severity":"critical","description":"Production standard for Svelte 5. Mandates using modern Runes ($state, $derived, $effect) and strictly eliminates deprecated Svelte 3/4 reactive declarations ($: variable = ...) and mutable let bindings.","antiPatternHeadline":"AI writes deprecated $: reactive declarations or let count = 0 inside Svelte 5 components, failing to trigger the new signals-based reactivity engine.","stars_count":68,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["svelte","svelte-5","runes","frontend","reactivity"],"exportEndpoints":{"claude":"/api/rules/svelte-5-runes-reactivity?format=claude","cursorMdc":"/api/rules/svelte-5-runes-reactivity?format=mdc","cursorrules":"/api/rules/svelte-5-runes-reactivity?format=cursor","windsurf":"/api/rules/svelte-5-runes-reactivity?format=windsurf","agents":"/api/rules/svelte-5-runes-reactivity?format=agents"}},{"id":"bun-sqlite-wal-concurrency","title":"Bun Embedded SQLite WAL Mode & Transaction Synchronization Standard","category":"backend","severity":"critical","description":"Production database standard for bun:sqlite. Mandates enabling Write-Ahead Logging (PRAGMA journal_mode = WAL), busy timeouts, and using db.transaction() for atomic operations without lock starvation.","antiPatternHeadline":"AI opens bun:sqlite with default rollback journals and un-isolated batch inserts, triggering SQLITE_BUSY crashes under concurrent requests.","stars_count":68,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["bun","sqlite","database","backend","concurrency"],"exportEndpoints":{"claude":"/api/rules/bun-sqlite-wal-concurrency?format=claude","cursorMdc":"/api/rules/bun-sqlite-wal-concurrency?format=mdc","cursorrules":"/api/rules/bun-sqlite-wal-concurrency?format=cursor","windsurf":"/api/rules/bun-sqlite-wal-concurrency?format=windsurf","agents":"/api/rules/bun-sqlite-wal-concurrency?format=agents"}},{"id":"drizzle-orm-batch-transactions","title":"Drizzle ORM Batch API & Interactive Transaction Isolation Standard","category":"backend","severity":"critical","description":"Production database standard for Drizzle ORM (PostgreSQL & MySQL). Mandates using db.batch() over HTTP drivers to prevent round-trip waterfalls, explicit db.transaction() with serializable/read-committed isolation, and strictly avoids unawaited query promises.","antiPatternHeadline":"AI loops single insert queries over serverless HTTP DB drivers (Neon / PlanetScale), creating 20x network latency waterfalls and partial failure states.","stars_count":68,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["drizzle","drizzle-orm","database","typescript","postgres"],"exportEndpoints":{"claude":"/api/rules/drizzle-orm-batch-transactions?format=claude","cursorMdc":"/api/rules/drizzle-orm-batch-transactions?format=mdc","cursorrules":"/api/rules/drizzle-orm-batch-transactions?format=cursor","windsurf":"/api/rules/drizzle-orm-batch-transactions?format=windsurf","agents":"/api/rules/drizzle-orm-batch-transactions?format=agents"}},{"id":"temporal-io-deterministic-workflow","title":"Temporal.io Workflow Code Determinism & Side Effect Isolation Standard","category":"backend","severity":"critical","description":"Production standard for Temporal.io distributed orchestrations. Mandates strict determinism inside workflow functions, strictly prohibiting Math.random(), Date.now(), mutable global variables, or direct network/database calls outside Temporal Activities.","antiPatternHeadline":"AI calls Date.now() or fetch() directly inside a Temporal workflow function, causing non-deterministic replay crashes during worker upgrades.","stars_count":68,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["temporal","workflow","distributed-systems","determinism","microservices"],"exportEndpoints":{"claude":"/api/rules/temporal-io-deterministic-workflow?format=claude","cursorMdc":"/api/rules/temporal-io-deterministic-workflow?format=mdc","cursorrules":"/api/rules/temporal-io-deterministic-workflow?format=cursor","windsurf":"/api/rules/temporal-io-deterministic-workflow?format=windsurf","agents":"/api/rules/temporal-io-deterministic-workflow?format=agents"}},{"id":"tanstack-start-router-ssr-production-standard","title":"TanStack Start SSR: Type-Safe Search Validation, Granular Loader Dependencies, and Deferred Data Streaming","category":"frontend","severity":"critical","description":"Enforces strict type safety for URL search parameters via schema validators, prevents SSR render blocking through deferred streaming promises, and ensures loaders trigger re-executions only when declared dependencies mutate. Failing to adhere leads to TTFB degradation, hydration mismatch exceptions, and silent cache invalidation bugs in fullstack TanStack applications.","antiPatternHeadline":"Blocking SSR on non-critical queries and relying on untyped search params without loaderDeps","stars_count":53,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","tanstack-start","tanstack-router","ssr","streaming","type-safety","react"],"exportEndpoints":{"claude":"/api/rules/tanstack-start-router-ssr-production-standard?format=claude","cursorMdc":"/api/rules/tanstack-start-router-ssr-production-standard?format=mdc","cursorrules":"/api/rules/tanstack-start-router-ssr-production-standard?format=cursor","windsurf":"/api/rules/tanstack-start-router-ssr-production-standard?format=windsurf","agents":"/api/rules/tanstack-start-router-ssr-production-standard?format=agents"}},{"id":"react-19-action-hooks-useactionstate-production-standard","title":"React 19 Action Hooks & useActionState Production Standard & Concurrency Guardrail","category":"frontend","severity":"critical","description":"React 19 introduces native async Action transitions that manage pending states, concurrent updates, and optimistic rollbacks natively within the framework lifecycle. Reverting to legacy manual useState booleans for submission states introduces race conditions, breaks concurrent rendering boundaries, and bypasses automatic error boundaries. Modern production frontends must leverage useActionState, useOptimistic, and useFormStatus to ensure resilient, race-condition-free form lifecycles.","antiPatternHeadline":"Wrapping async form handlers in manual useState loading and error states instead of leveraging native React 19 Actions.","stars_count":53,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","useactionstate","forms","concurrency"],"exportEndpoints":{"claude":"/api/rules/react-19-action-hooks-useactionstate-production-standard?format=claude","cursorMdc":"/api/rules/react-19-action-hooks-useactionstate-production-standard?format=mdc","cursorrules":"/api/rules/react-19-action-hooks-useactionstate-production-standard?format=cursor","windsurf":"/api/rules/react-19-action-hooks-useactionstate-production-standard?format=windsurf","agents":"/api/rules/react-19-action-hooks-useactionstate-production-standard?format=agents"}},{"id":"next-js-15-server-actions-boundary-csrf-production-standard","title":"Next.js 15 Server Actions Boundary CSRF & Origin Validation Standard","category":"frontend","severity":"critical","description":"Next.js 15 Server Actions enforce built-in origin checks against the Host header, but multi-domain setups, reverse proxy misconfigurations, or unauthenticated action endpoints create severe CSRF and unauthorized state mutation vectors. Production actions must assert authenticated session identity, validate strict schemas, and configure experimental.serverActions.allowedOrigins to protect critical boundaries.","antiPatternHeadline":"Treating Server Actions as private client-only functions while omitting boundary session checks and reverse-proxy origin configurations.","stars_count":117,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs","security","csrf","server-actions"],"exportEndpoints":{"claude":"/api/rules/next-js-15-server-actions-boundary-csrf-production-standard?format=claude","cursorMdc":"/api/rules/next-js-15-server-actions-boundary-csrf-production-standard?format=mdc","cursorrules":"/api/rules/next-js-15-server-actions-boundary-csrf-production-standard?format=cursor","windsurf":"/api/rules/next-js-15-server-actions-boundary-csrf-production-standard?format=windsurf","agents":"/api/rules/next-js-15-server-actions-boundary-csrf-production-standard?format=agents"}},{"id":"valkey-8-0-threaded-io-cluster-failover-production-standard","title":"Valkey 8.0 Threaded I/O & Cluster Failover Production Standard & Concurrency Guardrail","category":"backend","severity":"critical","description":"Valkey 8.0 introduces dual-channel multi-threaded I/O to scale network throughput while preserving single-threaded execution atomicity. Clustered deployments must strictly handle MOVED/ASK redirects and slot hashing constraints during node failovers and shard migration. Failure to enforce slot co-locality via hash tags in multi-key operations and Lua scripts causes CROSSSLOT errors and catastrophic transactional rollback failures during cluster rebalancing.","antiPatternHeadline":"Executing un-hashed multi-key commands and Lua scripts across disparate nodes while failing to handle cluster redirects and transient failover states.","stars_count":91,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","valkey","redis","clustering","distributed-systems"],"exportEndpoints":{"claude":"/api/rules/valkey-8-0-threaded-io-cluster-failover-production-standard?format=claude","cursorMdc":"/api/rules/valkey-8-0-threaded-io-cluster-failover-production-standard?format=mdc","cursorrules":"/api/rules/valkey-8-0-threaded-io-cluster-failover-production-standard?format=cursor","windsurf":"/api/rules/valkey-8-0-threaded-io-cluster-failover-production-standard?format=windsurf","agents":"/api/rules/valkey-8-0-threaded-io-cluster-failover-production-standard?format=agents"}},{"id":"qwik-city-resumability-containerization-production-standard","title":"Qwik City Resumability & Containerization Production Standard","category":"frontend","severity":"critical","description":"Enforces Qwik's zero-hydration resumability model by strictly isolating lexical boundaries across Optimizer-split chunk closures. Prevents accidental closure captures, serialization bottlenecks, and eager code evaluation that degrade instant-on performance. Failure to maintain clean serializable boundaries introduces runtime de-opt failures, memory leaks, and massive client bundle bloat.","antiPatternHeadline":"Capturing non-serializable runtime instances inside '$' closures or eagerly importing heavy client modules without QRL boundaries.","stars_count":91,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","qwik","qwik-city","resumability","performance"],"exportEndpoints":{"claude":"/api/rules/qwik-city-resumability-containerization-production-standard?format=claude","cursorMdc":"/api/rules/qwik-city-resumability-containerization-production-standard?format=mdc","cursorrules":"/api/rules/qwik-city-resumability-containerization-production-standard?format=cursor","windsurf":"/api/rules/qwik-city-resumability-containerization-production-standard?format=windsurf","agents":"/api/rules/qwik-city-resumability-containerization-production-standard?format=agents"}},{"id":"vite-6-environment-api-multi-runtimes-production-standard","title":"Vite 6 Environment API & Multi-Runtimes Architecture Standard","category":"frontend","severity":"critical","description":"Vite 6 deprecates monolithic SSR transforms in favor of the Environment API, isolating module graphs and module runners across distinct runtimes (Node.js, Edge, workerd, and Client). Conflating environment module graphs or invoking deprecated APIs like `ssrLoadModule` causes cross-runtime state leakage, broken HMR transport boundaries, and unhandled execution crashes. Strict boundary isolation across `server.environments` MUST be enforced to guarantee deterministic compilation and Hot Module Replacement.","antiPatternHeadline":"Defaulting to legacy `ssrLoadModule` and accessing shared server transform caches across multi-runtime targets instead of scoped `DevEnvironment` instances.","stars_count":86,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","vite","ssr","hmr","multi-runtime"],"exportEndpoints":{"claude":"/api/rules/vite-6-environment-api-multi-runtimes-production-standard?format=claude","cursorMdc":"/api/rules/vite-6-environment-api-multi-runtimes-production-standard?format=mdc","cursorrules":"/api/rules/vite-6-environment-api-multi-runtimes-production-standard?format=cursor","windsurf":"/api/rules/vite-6-environment-api-multi-runtimes-production-standard?format=windsurf","agents":"/api/rules/vite-6-environment-api-multi-runtimes-production-standard?format=agents"}},{"id":"tanstack-start-router-ssr-streaming-standard","title":"TanStack Start & Router SSR: Type-Safe Search Validation, Loaders, and Deferred Streaming","category":"frontend","severity":"critical","description":"Enforces strict type safety and streaming invariants in TanStack Start and TanStack Router SSR applications. Mandates route-level search param schema validation via Zod/Valibot, prevents waterfall SSR blocking by requiring deferred streaming for non-critical dependencies, and enforces execution-boundary safety between loaders and server functions.","antiPatternHeadline":"Unvalidated search params with blocking SSR loaders that serialize entire component trees before initial stream flush.","stars_count":50,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","tanstack-start","tanstack-router","ssr","deferred-streaming","type-safe-search","zod"],"exportEndpoints":{"claude":"/api/rules/tanstack-start-router-ssr-streaming-standard?format=claude","cursorMdc":"/api/rules/tanstack-start-router-ssr-streaming-standard?format=mdc","cursorrules":"/api/rules/tanstack-start-router-ssr-streaming-standard?format=cursor","windsurf":"/api/rules/tanstack-start-router-ssr-streaming-standard?format=windsurf","agents":"/api/rules/tanstack-start-router-ssr-streaming-standard?format=agents"}},{"id":"surrealdb-2-0-live-queries-record-links-production-standard","title":"SurrealDB 2.0 Live Queries & Record Links Production Standard","category":"backend","severity":"critical","description":"SurrealDB 2.0 introduces strict RecordId types, an overhauled Rust engine, and push-based LIVE QUERY streaming over WebSockets. In production, unmanaged live queries cause persistent socket leaks and cluster memory exhaustion, while handling record links as arbitrary strings breaks transactional graph traversal and schema validation.","antiPatternHeadline":"Treating record IDs as raw interpolated strings and abandoning live query UUID subscriptions without deterministic teardown.","stars_count":43,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","surrealdb","websockets","graph-database"],"exportEndpoints":{"claude":"/api/rules/surrealdb-2-0-live-queries-record-links-production-standard?format=claude","cursorMdc":"/api/rules/surrealdb-2-0-live-queries-record-links-production-standard?format=mdc","cursorrules":"/api/rules/surrealdb-2-0-live-queries-record-links-production-standard?format=cursor","windsurf":"/api/rules/surrealdb-2-0-live-queries-record-links-production-standard?format=windsurf","agents":"/api/rules/surrealdb-2-0-live-queries-record-links-production-standard?format=agents"}},{"id":"duckdb-node-js-zero-copy-apache-arrow-ingest-production-standard","title":"DuckDB Node.js Zero-Copy Apache Arrow Ingest & Concurrency Standard","category":"backend","severity":"critical","description":"DuckDB in Node.js requires strict adherence to zero-copy memory boundaries when streaming Arrow IPC records and executing parallel analytical queries across connection pools. Naive JSON serialization, raw ArrayBuffer copies, or concurrent queries sharing a single un-pooled Connection instance trigger V8 heap exhaustion, memory leaks, or native segfaults. Production architectures must enforce worker-safe connection pooling, explicit Arrow RecordBatch streaming via C++ IPC bindings, and strictly bounded memory limits.","antiPatternHeadline":"Deserializing analytical query results into native V8 JavaScript objects or executing concurrent queries on a single un-pooled DuckDB Connection handle.","stars_count":67,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","duckdb","apache-arrow","olap","nodejs"],"exportEndpoints":{"claude":"/api/rules/duckdb-node-js-zero-copy-apache-arrow-ingest-production-standard?format=claude","cursorMdc":"/api/rules/duckdb-node-js-zero-copy-apache-arrow-ingest-production-standard?format=mdc","cursorrules":"/api/rules/duckdb-node-js-zero-copy-apache-arrow-ingest-production-standard?format=cursor","windsurf":"/api/rules/duckdb-node-js-zero-copy-apache-arrow-ingest-production-standard?format=windsurf","agents":"/api/rules/duckdb-node-js-zero-copy-apache-arrow-ingest-production-standard?format=agents"}},{"id":"valkey-8-0-threaded-io-cluster-failover-guardrails","title":"Valkey 8.0 Threaded I/O & Cluster Failover Production Standards","category":"backend","severity":"critical","description":"Valkey 8.0 leverages asynchronous multi-threaded I/O for socket read/write operations while preserving single-threaded execution for command mutations. In distributed cluster deployments, unhandled MOVED and ASK redirections during automatic master failovers cause cascading connection pool exhaustion and silent command drops. Furthermore, multi-key operations and Lua scripts execute atomically only when all involved keys map to the identical cluster hash slot via explicit hash tags.","antiPatternHeadline":"Executing cross-slot multi-key commands without hash tags while ignoring cluster failover redirects and socket pool saturation.","stars_count":86,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","valkey","redis","clustering","distributed-systems"],"exportEndpoints":{"claude":"/api/rules/valkey-8-0-threaded-io-cluster-failover-guardrails?format=claude","cursorMdc":"/api/rules/valkey-8-0-threaded-io-cluster-failover-guardrails?format=mdc","cursorrules":"/api/rules/valkey-8-0-threaded-io-cluster-failover-guardrails?format=cursor","windsurf":"/api/rules/valkey-8-0-threaded-io-cluster-failover-guardrails?format=windsurf","agents":"/api/rules/valkey-8-0-threaded-io-cluster-failover-guardrails?format=agents"}},{"id":"langgraph-2026-stateful-checkpointers-human-in-the-loop-production-standard","title":"LangGraph Stateful Checkpointers & Resilient Human-in-the-Loop Concurrency Guardrail","category":"backend","severity":"critical","description":"LangGraph production systems require durable checkpointers, deterministic thread scoping, and atomic human-in-the-loop (HITL) interrupt semantics to preserve workflow states across restarts and horizontal scaling. Relying on transient in-memory checkpointers or blocking asynchronous loops destroys state continuity and causes workflow deadlocks during deployments. Teams must mandate transactional state backends, native interrupt triggers, and schema-validated resumes within immutable channel reducers.","antiPatternHeadline":"Deploying ephemeral in-memory checkpointers in distributed environments and hijacking graph control with unpersisted manual prompts instead of native interrupt primitives.","stars_count":53,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","langgraph","checkpointers","human-in-the-loop","state-management"],"exportEndpoints":{"claude":"/api/rules/langgraph-2026-stateful-checkpointers-human-in-the-loop-production-standard?format=claude","cursorMdc":"/api/rules/langgraph-2026-stateful-checkpointers-human-in-the-loop-production-standard?format=mdc","cursorrules":"/api/rules/langgraph-2026-stateful-checkpointers-human-in-the-loop-production-standard?format=cursor","windsurf":"/api/rules/langgraph-2026-stateful-checkpointers-human-in-the-loop-production-standard?format=windsurf","agents":"/api/rules/langgraph-2026-stateful-checkpointers-human-in-the-loop-production-standard?format=agents"}},{"id":"litellm-proxy-load-balancing-fallback-routing-production-standard","title":"LiteLLM Proxy Load Balancing & Fallback Routing Production Standard","category":"backend","severity":"critical","description":"Production LiteLLM proxy deployments must maintain deterministic fallback topologies, bounded semantic cache lifecycles, and tenant-isolated token quota budgets across heterogeneous model providers. Without explicit circuit breaking and tier-aware load balancing, transient provider rate limits escalate into catastrophic cascading failures across upstream microservices. Reliable gateway architectures decouple client call-sites from provider-specific error formats by enforcing uniform retry budgets and distributed cache invalidation.","antiPatternHeadline":"Naive direct model invocations lacking circuit breakers, fallback groups, and budget bounds that crash downstream services on provider HTTP 429 bursts.","stars_count":77,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","litellm","proxy","load-balancing","llm-gateway"],"exportEndpoints":{"claude":"/api/rules/litellm-proxy-load-balancing-fallback-routing-production-standard?format=claude","cursorMdc":"/api/rules/litellm-proxy-load-balancing-fallback-routing-production-standard?format=mdc","cursorrules":"/api/rules/litellm-proxy-load-balancing-fallback-routing-production-standard?format=cursor","windsurf":"/api/rules/litellm-proxy-load-balancing-fallback-routing-production-standard?format=windsurf","agents":"/api/rules/litellm-proxy-load-balancing-fallback-routing-production-standard?format=agents"}},{"id":"tauri-2-0-mobile-ipc-permissions-scope-production-standard","title":"Tauri 2.0 Mobile IPC & Capabilities Permissions Matrix Standard","category":"mobile","severity":"critical","description":"Tauri v2 introduces a capability-driven permissions system replacing legacy v1 allowlists across iOS and Android runtimes. Failure to constrain IPC command handlers with typed schemas and explicit mobile capability definitions exposes native mobile OS surfaces to arbitrary code execution, permission leakage, and silent serialization failures. Production mobile deployments require strictly typed IPC boundary validation, granular capability scopes, and graceful permission degradation.","antiPatternHeadline":"Hallucinating deprecated Tauri v1 allowlists or executing unsanitized IPC commands across mobile webviews without capability scoping.","stars_count":106,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri","ipc","security","rust"],"exportEndpoints":{"claude":"/api/rules/tauri-2-0-mobile-ipc-permissions-scope-production-standard?format=claude","cursorMdc":"/api/rules/tauri-2-0-mobile-ipc-permissions-scope-production-standard?format=mdc","cursorrules":"/api/rules/tauri-2-0-mobile-ipc-permissions-scope-production-standard?format=cursor","windsurf":"/api/rules/tauri-2-0-mobile-ipc-permissions-scope-production-standard?format=windsurf","agents":"/api/rules/tauri-2-0-mobile-ipc-permissions-scope-production-standard?format=agents"}},{"id":"capacitor-7-native-bridge-biometric-auth-production-standard","title":"Capacitor 7 Native Bridge, Biometric Auth & Android 15 Lifecycle Production Standard","category":"mobile","severity":"critical","description":"Capacitor 7 enforces strict bridge lifecycle contracts, asynchronous native plugin interop, and mandatory Android 15 edge-to-edge window inset handling. Storing sensitive authentication tokens in unencrypted web storage or failing to bind biometric authentication directly to hardware-backed Keystore or Secure Enclave mechanisms compromises app integrity and causes fatal crash or viewport occlusion issues on modern mobile operating systems.","antiPatternHeadline":"Persisting biometrically gated tokens in plaintext Web Storage or CapacitorPreferences while ignoring Android 15 edge-to-edge safe area occlusion.","stars_count":70,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","biometrics","android15","security"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-native-bridge-biometric-auth-production-standard?format=claude","cursorMdc":"/api/rules/capacitor-7-native-bridge-biometric-auth-production-standard?format=mdc","cursorrules":"/api/rules/capacitor-7-native-bridge-biometric-auth-production-standard?format=cursor","windsurf":"/api/rules/capacitor-7-native-bridge-biometric-auth-production-standard?format=windsurf","agents":"/api/rules/capacitor-7-native-bridge-biometric-auth-production-standard?format=agents"}},{"id":"tanstack-start-ssr-streaming-search-params","title":"TanStack Start SSR Loader Invariants: Type-Safe Search Params & Deferred Streaming","category":"frontend","severity":"critical","description":"Enforces type-safe search parameter validation via explicit schemas, prevents SSR TTFB stalls by delegating non-critical data to deferred streaming promises, and guarantees server-only boundaries using TanStack Start server functions.","antiPatternHeadline":"Awaiting slow secondary data in SSR loaders and accessing raw, unvalidated search parameters.","stars_count":91,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","tanstack-router","tanstack-start","ssr","typescript","streaming"],"exportEndpoints":{"claude":"/api/rules/tanstack-start-ssr-streaming-search-params?format=claude","cursorMdc":"/api/rules/tanstack-start-ssr-streaming-search-params?format=mdc","cursorrules":"/api/rules/tanstack-start-ssr-streaming-search-params?format=cursor","windsurf":"/api/rules/tanstack-start-ssr-streaming-search-params?format=windsurf","agents":"/api/rules/tanstack-start-ssr-streaming-search-params?format=agents"}},{"id":"tailwind-v4-css-first-theme-directives","title":"Tailwind CSS v4 CSS-First Theme Directives and Dynamic Interpolation Guardrail","category":"frontend","severity":"critical","description":"Enforces modern Tailwind CSS v4 CSS-first configuration via pure @theme and @theme inline blocks, deprecating legacy tailwind.config.js/ts abstractions. Mandates native CSS custom properties with color-mix() runtime opacity interpolation instead of legacy RGB channel workarounds. Ensures token declarations follow v4 standard namespace conventions and CSS variable resolution across the build pipeline.","antiPatternHeadline":"Persisting legacy tailwind.config.js architecture and RGB-tuple opacity hacks in Tailwind CSS v4 environments","stars_count":91,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","tailwind-css","tailwind-v4","design-tokens","css-theme"],"exportEndpoints":{"claude":"/api/rules/tailwind-v4-css-first-theme-directives?format=claude","cursorMdc":"/api/rules/tailwind-v4-css-first-theme-directives?format=mdc","cursorrules":"/api/rules/tailwind-v4-css-first-theme-directives?format=cursor","windsurf":"/api/rules/tailwind-v4-css-first-theme-directives?format=windsurf","agents":"/api/rules/tailwind-v4-css-first-theme-directives?format=agents"}},{"id":"hono-jsx-edge-streaming-pipeline-standard","title":"Hono JSX Edge Streaming Pipelines and Non-Blocking Chunk Composition","category":"frontend","severity":"critical","description":"Enforces non-blocking chunk composition and zero-buffer streaming pipelines for Hono JSX on Cloudflare Workers and Deno edge runtimes. Prohibits full-document string serialization and post-flush HTTP header mutation while guaranteeing correct Suspense boundaries and stream-safe middleware chaining.","antiPatternHeadline":"Buffering Monolithic JSX Strings into Edge Memory and Attempting Post-Flush Response Header Mutation","stars_count":80,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","hono","hono-jsx","cloudflare-workers","streaming","edge-computing","suspense"],"exportEndpoints":{"claude":"/api/rules/hono-jsx-edge-streaming-pipeline-standard?format=claude","cursorMdc":"/api/rules/hono-jsx-edge-streaming-pipeline-standard?format=mdc","cursorrules":"/api/rules/hono-jsx-edge-streaming-pipeline-standard?format=cursor","windsurf":"/api/rules/hono-jsx-edge-streaming-pipeline-standard?format=windsurf","agents":"/api/rules/hono-jsx-edge-streaming-pipeline-standard?format=agents"}},{"id":"angular-19-signals-defer-views-standard","title":"Angular 19 Standalone Signals, LinkedSignals, and Defer Block Invariants","category":"frontend","severity":"critical","description":"Enforces Modern Angular 19 architectural standards by mandating signal inputs and linkedSignal for reactive derived mutable state, eliminating decorator-based inputs and manual synchronization side-effects in ngOnChanges or effects. Enforces strictly structured @defer blocks with minimum placeholder constraints to guarantee performance chunking and prevent cumulative layout shifts (CLS).","antiPatternHeadline":"Mutating internal signal state via ngOnChanges/effects and unconstrained @defer block usage causing layout shift","stars_count":42,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","angular","signals","linkedSignal","defer-views","performance"],"exportEndpoints":{"claude":"/api/rules/angular-19-signals-defer-views-standard?format=claude","cursorMdc":"/api/rules/angular-19-signals-defer-views-standard?format=mdc","cursorrules":"/api/rules/angular-19-signals-defer-views-standard?format=cursor","windsurf":"/api/rules/angular-19-signals-defer-views-standard?format=windsurf","agents":"/api/rules/angular-19-signals-defer-views-standard?format=agents"}},{"id":"react-router-7-hydration-single-fetch-guardrail","title":"React Router 7 Framework Mode Hydration, Typegen, and Single-Fetch Boundaries","category":"frontend","severity":"critical","description":"Enforces deterministic SSR-to-client hydration invariants in React Router 7 Framework Mode. Mandates strict adherence to Single Fetch promise streaming, generated route module typings, and explicit clientLoader execution policies to prevent rendering waterfalls and hydration drift.","antiPatternHeadline":"Uncontrolled clientLoader Execution and Deprecated defer() Usage Under Single Fetch","stars_count":114,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["react-router-7","remix","hydration","single-fetch","typegen","ssr","turbo-stream"],"exportEndpoints":{"claude":"/api/rules/react-router-7-hydration-single-fetch-guardrail?format=claude","cursorMdc":"/api/rules/react-router-7-hydration-single-fetch-guardrail?format=mdc","cursorrules":"/api/rules/react-router-7-hydration-single-fetch-guardrail?format=cursor","windsurf":"/api/rules/react-router-7-hydration-single-fetch-guardrail?format=windsurf","agents":"/api/rules/react-router-7-hydration-single-fetch-guardrail?format=agents"}},{"id":"tanstack-virtual-dynamic-measurement-saturation-guardrail","title":"TanStack Virtual 3.0 Dynamic Measurement, Scroll Containment, and DOM Saturation Guardrail","category":"frontend","severity":"critical","description":"Enforces strict industrial standards for TanStack Virtual 3.0 in massive datasets and dynamic tables. Mandates native ref-based element measurement via measureElement, strict containment of scroll margins to prevent viewport jitter, and hard limits on overscan to avoid catastrophic DOM node saturation.","antiPatternHeadline":"Unbounded Overscan, Manual getBoundingClientRect Layout Thrashing, and Index-Keyed Dynamic Rows","stars_count":92,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react","tanstack-virtual","performance","virtualization","dom-optimization"],"exportEndpoints":{"claude":"/api/rules/tanstack-virtual-dynamic-measurement-saturation-guardrail?format=claude","cursorMdc":"/api/rules/tanstack-virtual-dynamic-measurement-saturation-guardrail?format=mdc","cursorrules":"/api/rules/tanstack-virtual-dynamic-measurement-saturation-guardrail?format=cursor","windsurf":"/api/rules/tanstack-virtual-dynamic-measurement-saturation-guardrail?format=windsurf","agents":"/api/rules/tanstack-virtual-dynamic-measurement-saturation-guardrail?format=agents"}},{"id":"lexical-headless-engine-transforms-and-serialization-guardrails","title":"Lexical Headless Node Mutation, Selection Reconciliation, and Markdown Engine Guardrails","category":"frontend","severity":"critical","description":"Enforces architectural invariants within Meta Lexical headless document workflows and client-side editors. Prevents dirty node write corruptions, selection collapse regressions, and out-of-order transform loop recursion during headless Markdown and AST operations. Guarantees predictable reconciliation and clone-on-write integrity across server-side rendering and client editor states.","antiPatternHeadline":"Direct In-Place Node Property Mutation and Untracked Selection Reconciliation in Lexical Transforms","stars_count":111,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","lexical","rich-text","markdown","editor","ast","headless"],"exportEndpoints":{"claude":"/api/rules/lexical-headless-engine-transforms-and-serialization-guardrails?format=claude","cursorMdc":"/api/rules/lexical-headless-engine-transforms-and-serialization-guardrails?format=mdc","cursorrules":"/api/rules/lexical-headless-engine-transforms-and-serialization-guardrails?format=cursor","windsurf":"/api/rules/lexical-headless-engine-transforms-and-serialization-guardrails?format=windsurf","agents":"/api/rules/lexical-headless-engine-transforms-and-serialization-guardrails?format=agents"}},{"id":"valkey-threaded-io-cluster-failover-standard","title":"Valkey 8.0 Multi-Threaded I/O, Cluster Slot Pinning, and Failover Resilience","category":"backend","severity":"critical","description":"Enforces deterministic cluster hash tagging for multi-key atomic operations and Lua scripts to prevent CROSSSLOT execution failures in Valkey 8.0. Mandates dynamic cluster topology discovery, backpressure-aware connection pooling for threaded I/O, and automated retry mechanisms for MOVED and ASK redirects during cluster failovers.","antiPatternHeadline":"Unpinned Multi-Key Script Execution with Naive Single-Node Clients Failing During Failover Re-Sharding","stars_count":94,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","valkey","redis","clustering","concurrency","distributed-systems"],"exportEndpoints":{"claude":"/api/rules/valkey-threaded-io-cluster-failover-standard?format=claude","cursorMdc":"/api/rules/valkey-threaded-io-cluster-failover-standard?format=mdc","cursorrules":"/api/rules/valkey-threaded-io-cluster-failover-standard?format=cursor","windsurf":"/api/rules/valkey-threaded-io-cluster-failover-standard?format=windsurf","agents":"/api/rules/valkey-threaded-io-cluster-failover-standard?format=agents"}},{"id":"bun-sqlite-wal-s3-native-storage-standard","title":"Bun 1.2 SQLite WAL Concurrency & Native S3 Streaming Invariant","category":"backend","severity":"critical","description":"Enforces strict concurrency and zero-copy data flow standards for Bun 1.2 applications using native bun:sqlite and Bun.s3. Forbids executing asynchronous network I/O or S3 streaming within synchronous SQLite WAL transaction boundaries, mandates optimal WAL pragmas, and enforces end-to-end memory-efficient streaming.","antiPatternHeadline":"Interleaving Async S3 Network I/O Inside SQLite Write Transactions Causing Database Lock Starvation","stars_count":108,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","sqlite","s3","wal","concurrency","streaming"],"exportEndpoints":{"claude":"/api/rules/bun-sqlite-wal-s3-native-storage-standard?format=claude","cursorMdc":"/api/rules/bun-sqlite-wal-s3-native-storage-standard?format=mdc","cursorrules":"/api/rules/bun-sqlite-wal-s3-native-storage-standard?format=cursor","windsurf":"/api/rules/bun-sqlite-wal-s3-native-storage-standard?format=windsurf","agents":"/api/rules/bun-sqlite-wal-s3-native-storage-standard?format=agents"}},{"id":"axum-08-state-tower-resilience","title":"Axum 0.8 Type-Safe State Extractors & Tower Service Composition","category":"backend","severity":"critical","description":"Enforces strict type safety and architectural invariants for Axum 0.8 applications using Router::with_state, sub-state derivation via FromRef, and Tower middleware composition. Prohibits untyped Extension state sharing and unhandled extractor rejections that trigger server panics or unformatted 500 responses.","antiPatternHeadline":"Untyped Extension Injection and Unhandled Missing State Panics in Axum 0.8","stars_count":83,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tower","tokio"],"exportEndpoints":{"claude":"/api/rules/axum-08-state-tower-resilience?format=claude","cursorMdc":"/api/rules/axum-08-state-tower-resilience?format=mdc","cursorrules":"/api/rules/axum-08-state-tower-resilience?format=cursor","windsurf":"/api/rules/axum-08-state-tower-resilience?format=windsurf","agents":"/api/rules/axum-08-state-tower-resilience?format=agents"}},{"id":"tanstack-start-ssr-streaming-searchparams-production-standard","title":"TanStack Start SSR Loaders, Streaming Deferred Data, and Validated Search Params","category":"frontend","severity":"critical","description":"Enforces strict type-safety, streaming efficiency, and boundary isolation in TanStack Start and Fullstack TanStack Router. Requires declarative validation of search parameters via schema parsers, non-blocking SSR TTFB via explicit promise deferral with Suspense boundaries, and strict server/client boundary isolation using server functions.","antiPatternHeadline":"Blocking SSR TTFB via Cascading Loader Awaits and Unvalidated Runtime Search Param Parsing","stars_count":96,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","tanstack-start","tanstack-router","ssr","streaming","search-params","react"],"exportEndpoints":{"claude":"/api/rules/tanstack-start-ssr-streaming-searchparams-production-standard?format=claude","cursorMdc":"/api/rules/tanstack-start-ssr-streaming-searchparams-production-standard?format=mdc","cursorrules":"/api/rules/tanstack-start-ssr-streaming-searchparams-production-standard?format=cursor","windsurf":"/api/rules/tanstack-start-ssr-streaming-searchparams-production-standard?format=windsurf","agents":"/api/rules/tanstack-start-ssr-streaming-searchparams-production-standard?format=agents"}},{"id":"tailwind-v4-css-first-theme-production-standard","title":"Tailwind CSS v4 CSS-First Declarative Theme and Color Architecture Guardrails","category":"frontend","severity":"critical","description":"Tailwind CSS v4 replaces JavaScript-based configurations with native CSS-first declarations via `@theme` directives and standard CSS custom properties. Enforcing this invariant prevents silent build regressions, eliminates obsolete CSS opacity-channel string hacks, and unlocks native CSS color gamut interpolation (OKLCH) via dynamic `color-mix()`. Projects migrating to or initialized with v4 must strictly maintain styling configuration inside CSS boundary layers.","antiPatternHeadline":"Retaining legacy tailwind.config.js files, obsolete RGB tuple opacity workarounds, and deprecated PostCSS plugin pipelines in Tailwind CSS v4 builds.","stars_count":51,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","tailwindcss","tailwind-v4","css-architecture","oklch","web-performance"],"exportEndpoints":{"claude":"/api/rules/tailwind-v4-css-first-theme-production-standard?format=claude","cursorMdc":"/api/rules/tailwind-v4-css-first-theme-production-standard?format=mdc","cursorrules":"/api/rules/tailwind-v4-css-first-theme-production-standard?format=cursor","windsurf":"/api/rules/tailwind-v4-css-first-theme-production-standard?format=windsurf","agents":"/api/rules/tailwind-v4-css-first-theme-production-standard?format=agents"}},{"id":"angular-19-signals-linked-defer-architectural-guardrail","title":"Angular 19 Signal Primitives, linkedSignal Derivations, and Deferred Viewport Chunking","category":"frontend","severity":"critical","description":"Enforces modern Angular 19 standalone architecture using signal inputs, signal-based outputs, linkedSignal for resettable/derived state, and production-hardened @defer blocks. Prevents architectural anti-patterns such as writing to signals inside effects, using legacy decorator inputs, and defer blocks lacking layout stability constraints.","antiPatternHeadline":"Mutating Signals in Effects for State Sync and Naked @defer Directives Causing Cumulative Layout Shift (CLS)","stars_count":68,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","angular","signals","linkedSignal","defer-views","performance"],"exportEndpoints":{"claude":"/api/rules/angular-19-signals-linked-defer-architectural-guardrail?format=claude","cursorMdc":"/api/rules/angular-19-signals-linked-defer-architectural-guardrail?format=mdc","cursorrules":"/api/rules/angular-19-signals-linked-defer-architectural-guardrail?format=cursor","windsurf":"/api/rules/angular-19-signals-linked-defer-architectural-guardrail?format=windsurf","agents":"/api/rules/angular-19-signals-linked-defer-architectural-guardrail?format=agents"}},{"id":"rr7-framework-hydration-single-fetch-guardrail","title":"React Router 7 Framework Mode Hydration & Single-Fetch Architecture","category":"frontend","severity":"critical","description":"Enforces strict adherence to React Router 7 framework mode hydration contracts, single-fetch streaming semantics, and route module typegen. Prevents hydration mismatches, duplicate network waterfalls, and broken serialized state caused by legacy Remix primitives (such as json() or defer()) and misconfigured clientLoader boundaries.","antiPatternHeadline":"Bypassing Route Typegen and Mismanaging clientLoader Hydration Boundaries in React Router 7 Single-Fetch","stars_count":86,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-router-7","remix","hydration","single-fetch","typegen","streaming"],"exportEndpoints":{"claude":"/api/rules/rr7-framework-hydration-single-fetch-guardrail?format=claude","cursorMdc":"/api/rules/rr7-framework-hydration-single-fetch-guardrail?format=mdc","cursorrules":"/api/rules/rr7-framework-hydration-single-fetch-guardrail?format=cursor","windsurf":"/api/rules/rr7-framework-hydration-single-fetch-guardrail?format=windsurf","agents":"/api/rules/rr7-framework-hydration-single-fetch-guardrail?format=agents"}},{"id":"tanstack-virtual-windowing-performance-guardrail","title":"TanStack Virtual 3.0: Dynamic Measurement and DOM Containment Invariants","category":"frontend","severity":"critical","description":"Enforces deterministic virtualization mechanics in TanStack Virtual 3.0, mandating stable dynamic element measurement callbacks, strict CSS containment, and bounded overscan budgets. Prevents layout thrashing, scroll-drift jitter, and DOM node saturation in massive data grids.","antiPatternHeadline":"Unbounded Overscan, Re-measuring Layout Thrash, and Missing CSS Containment in Virtualized Lists","stars_count":96,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["tanstack-virtual","react","performance","dom-saturation","windowing"],"exportEndpoints":{"claude":"/api/rules/tanstack-virtual-windowing-performance-guardrail?format=claude","cursorMdc":"/api/rules/tanstack-virtual-windowing-performance-guardrail?format=mdc","cursorrules":"/api/rules/tanstack-virtual-windowing-performance-guardrail?format=cursor","windsurf":"/api/rules/tanstack-virtual-windowing-performance-guardrail?format=windsurf","agents":"/api/rules/tanstack-virtual-windowing-performance-guardrail?format=agents"}},{"id":"lexical-immutable-transforms-headless-serialization","title":"Lexical Immutable Node Transforms, Selection Reconciliation & Headless Serialization","category":"frontend","severity":"critical","description":"Enforces strict copy-on-write immutability via $getWritable() in Lexical node transforms, preserves deterministic selection reconciliation during structural AST updates, and ensures headless Markdown serialization executes without unmocked DOM dependencies in server and worker runtimes.","antiPatternHeadline":"Direct In-Place Node Mutation and DOM-Dependent Markdown Pipeline Execution in Headless Environments","stars_count":116,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","lexical","rich-text","ast","markdown","headless"],"exportEndpoints":{"claude":"/api/rules/lexical-immutable-transforms-headless-serialization?format=claude","cursorMdc":"/api/rules/lexical-immutable-transforms-headless-serialization?format=mdc","cursorrules":"/api/rules/lexical-immutable-transforms-headless-serialization?format=cursor","windsurf":"/api/rules/lexical-immutable-transforms-headless-serialization?format=windsurf","agents":"/api/rules/lexical-immutable-transforms-headless-serialization?format=agents"}},{"id":"biome-1-9-config-inheritance-vcs-deterministic-suppression","title":"Biome 1.9 Configuration Inheritance, VCS Integration, and Strict Rule Suppression","category":"frontend","severity":"critical","description":"Enforces deterministic Biome 1.9+ architecture across TypeScript workspaces by mandating centralized config inheritance, canonical Git VCS ignore integration, and strict, rationale-backed suppression comments. Eliminates configuration drift across monorepos and prevents unvetted static analysis bypasses.","antiPatternHeadline":"Ad-Hoc Tool Configuration Drift and Unjustified Naked Rule Suppressions","stars_count":77,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","biome","linter","formatter","tooling","monorepo"],"exportEndpoints":{"claude":"/api/rules/biome-1-9-config-inheritance-vcs-deterministic-suppression?format=claude","cursorMdc":"/api/rules/biome-1-9-config-inheritance-vcs-deterministic-suppression?format=mdc","cursorrules":"/api/rules/biome-1-9-config-inheritance-vcs-deterministic-suppression?format=cursor","windsurf":"/api/rules/biome-1-9-config-inheritance-vcs-deterministic-suppression?format=windsurf","agents":"/api/rules/biome-1-9-config-inheritance-vcs-deterministic-suppression?format=agents"}},{"id":"valkey-8-threaded-io-cluster-failover-standard","title":"Valkey 8.0 Threaded I/O, Cluster Routing, and Script Atomicity Guardrails","category":"backend","severity":"critical","description":"Enforces strict cluster-topology handling, deterministic hash-tag slot affinity for transactional scripts, and resilient backoff redirection protocols for Valkey 8.0 multi-threaded deployments. Prevents CROSSSLOT evaluation exceptions, slot discovery thundering herds during failovers, and socket contention during threaded I/O execution.","antiPatternHeadline":"Un-tagged multi-key Lua scripting and unhandled MOVED/ASK redirect storms during node failover.","stars_count":61,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","valkey","clustering","distributed-systems","concurrency","performance"],"exportEndpoints":{"claude":"/api/rules/valkey-8-threaded-io-cluster-failover-standard?format=claude","cursorMdc":"/api/rules/valkey-8-threaded-io-cluster-failover-standard?format=mdc","cursorrules":"/api/rules/valkey-8-threaded-io-cluster-failover-standard?format=cursor","windsurf":"/api/rules/valkey-8-threaded-io-cluster-failover-standard?format=windsurf","agents":"/api/rules/valkey-8-threaded-io-cluster-failover-standard?format=agents"}},{"id":"tanstack-router-ssr-streaming-search-params","title":"TanStack Start & Router SSR: Type-Safe Search Params and Deferred Streaming Invariants","category":"frontend","severity":"critical","description":"Enforces strict runtime schema validation for URL search parameters via standard validators, eliminates SSR blocking via deferred promise streaming, and mandates isomorphic loader boundaries to prevent hydration mismatches and degraded TTFB.","antiPatternHeadline":"Blocking full SSR response on non-critical promises and accessing untyped search params","stars_count":96,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","tanstack-router","tanstack-start","ssr","streaming","type-safety"],"exportEndpoints":{"claude":"/api/rules/tanstack-router-ssr-streaming-search-params?format=claude","cursorMdc":"/api/rules/tanstack-router-ssr-streaming-search-params?format=mdc","cursorrules":"/api/rules/tanstack-router-ssr-streaming-search-params?format=cursor","windsurf":"/api/rules/tanstack-router-ssr-streaming-search-params?format=windsurf","agents":"/api/rules/tanstack-router-ssr-streaming-search-params?format=agents"}},{"id":"hono-jsx-edge-streaming-pipeline-guardrails","title":"Hono JSX Edge Streaming Pipelines and Non-Buffering Lifecycle Invariants","category":"frontend","severity":"critical","description":"Mandates non-buffering edge SSR with Hono JSX via renderToReadableStream and atomic Suspense boundaries on Cloudflare Workers and Deno. Enforces immutable header freezing prior to stream initiation and deterministic abort signal propagation to eliminate runaway edge compute costs.","antiPatternHeadline":"Buffering JSX Renders with renderToString or Mutating Response Headers After Chunk Transmission","stars_count":95,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","hono","cloudflare-workers","deno","edge-streaming","jsx","suspense"],"exportEndpoints":{"claude":"/api/rules/hono-jsx-edge-streaming-pipeline-guardrails?format=claude","cursorMdc":"/api/rules/hono-jsx-edge-streaming-pipeline-guardrails?format=mdc","cursorrules":"/api/rules/hono-jsx-edge-streaming-pipeline-guardrails?format=cursor","windsurf":"/api/rules/hono-jsx-edge-streaming-pipeline-guardrails?format=windsurf","agents":"/api/rules/hono-jsx-edge-streaming-pipeline-guardrails?format=agents"}},{"id":"tanstack-virtual-3-windowing-performance-guardrail","title":"TanStack Virtual 3.0 Windowing Performance & Dynamic Containment Standard","category":"frontend","severity":"critical","description":"Enforces strict memory footprint containment and layout stability when rendering massive tabular datasets using TanStack Virtual 3.0. Mandates precise dynamic item measurement via ref callbacks, hardware-accelerated composite transforms over top/left positioning, and strict scroll margin containment to eliminate layout thrashing and DOM node saturation.","antiPatternHeadline":"Unmeasured Dynamic Row Heights with Top/Margin Positioning Triggering Infinite Re-measurement and DOM Blowup","stars_count":85,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","tanstack-virtual","react","performance","dom-virtualization"],"exportEndpoints":{"claude":"/api/rules/tanstack-virtual-3-windowing-performance-guardrail?format=claude","cursorMdc":"/api/rules/tanstack-virtual-3-windowing-performance-guardrail?format=mdc","cursorrules":"/api/rules/tanstack-virtual-3-windowing-performance-guardrail?format=cursor","windsurf":"/api/rules/tanstack-virtual-3-windowing-performance-guardrail?format=windsurf","agents":"/api/rules/tanstack-virtual-3-windowing-performance-guardrail?format=agents"}},{"id":"lexical-node-transforms-selection-reconciliation-standard","title":"Meta Lexical Immutable Transforms, Selection Reconciliation & Headless Markdown Engine Guardrails","category":"frontend","severity":"critical","description":"Governs structural node transforms, selection preservation, and headless markdown serialization in Meta Lexical. Enforces strict adherence to writable clone mechanics, transform loop prevention, and headless environment execution without DOM leaks or dangling selection references.","antiPatternHeadline":"Direct Node Mutation Outside getWritable(), Dangling Selection Crashes, and Recursive Transform Invalidation Loops","stars_count":75,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","lexical","rich-text","markdown","ast","react","state-reconciliation"],"exportEndpoints":{"claude":"/api/rules/lexical-node-transforms-selection-reconciliation-standard?format=claude","cursorMdc":"/api/rules/lexical-node-transforms-selection-reconciliation-standard?format=mdc","cursorrules":"/api/rules/lexical-node-transforms-selection-reconciliation-standard?format=cursor","windsurf":"/api/rules/lexical-node-transforms-selection-reconciliation-standard?format=windsurf","agents":"/api/rules/lexical-node-transforms-selection-reconciliation-standard?format=agents"}},{"id":"biome-1-9-monorepo-config-and-suppression-guardrail","title":"Deterministic Configuration Inheritance, VCS Integration, and Suppression Invariants in Biome 1.9","category":"frontend","severity":"critical","description":"Biome 1.9 relies on single-binary execution speed and strict configuration inheritance using the 'extends' array across workspaces. Mixing ESLint-style suppression directives, failing to enable VCS integration for ignore file honoring, or using malformed inline suppressions breaks deterministic linting across continuous integration pipelines.","antiPatternHeadline":"ESLint-Style Suppression Comments and Unanchored Biome Configurations Compromising CI Determinism","stars_count":76,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","biome","formatter","linter","tooling","monorepo"],"exportEndpoints":{"claude":"/api/rules/biome-1-9-monorepo-config-and-suppression-guardrail?format=claude","cursorMdc":"/api/rules/biome-1-9-monorepo-config-and-suppression-guardrail?format=mdc","cursorrules":"/api/rules/biome-1-9-monorepo-config-and-suppression-guardrail?format=cursor","windsurf":"/api/rules/biome-1-9-monorepo-config-and-suppression-guardrail?format=windsurf","agents":"/api/rules/biome-1-9-monorepo-config-and-suppression-guardrail?format=agents"}},{"id":"bun-sqlite-wal-s3-streaming-invariants","title":"Bun 1.2 Native SQLite WAL Concurrency & S3 Direct-Stream Pipeline Invariants","category":"backend","severity":"critical","description":"Enforces strict production invariants for Bun 1.2 embedded database and object storage operations. Mandates WAL-mode PRAGMA concurrency configuration, prepared statement lifecycle reuse in 'bun:sqlite', and zero-copy S3 streaming via 'Bun.s3' to prevent node heap buffer exhaustion.","antiPatternHeadline":"Buffering multi-megabyte payloads in process heap while executing un-indexed SQLite writes in rollback journal mode without statement preparation.","stars_count":110,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","bun-sqlite","s3","wal","zero-copy","typescript"],"exportEndpoints":{"claude":"/api/rules/bun-sqlite-wal-s3-streaming-invariants?format=claude","cursorMdc":"/api/rules/bun-sqlite-wal-s3-streaming-invariants?format=mdc","cursorrules":"/api/rules/bun-sqlite-wal-s3-streaming-invariants?format=cursor","windsurf":"/api/rules/bun-sqlite-wal-s3-streaming-invariants?format=windsurf","agents":"/api/rules/bun-sqlite-wal-s3-streaming-invariants?format=agents"}},{"id":"tanstack-start-ssr-streaming-searchparams-guardrail","title":"TanStack Start Fullstack SSR: Strict Search Param Validation and Deferred Streaming Invariants","category":"frontend","severity":"critical","description":"Enforces strict runtime validation of URL search parameters via schema validators in TanStack Router routes and mandates non-blocking SSR architectures through deferred promise streaming. Eliminates server-side rendering bottlenecks, hydration mismatches, and runtime type coercion vulnerabilities by strictly separating critical blocking loaders from deferred streaming promises wrapped in Suspense boundaries.","antiPatternHeadline":"Blocking Critical SSR TTFB with Sequential Async Loaders and Bypassing Route Search Param Validation","stars_count":71,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","tanstack-router","tanstack-start","ssr","search-params","streaming","performance"],"exportEndpoints":{"claude":"/api/rules/tanstack-start-ssr-streaming-searchparams-guardrail?format=claude","cursorMdc":"/api/rules/tanstack-start-ssr-streaming-searchparams-guardrail?format=mdc","cursorrules":"/api/rules/tanstack-start-ssr-streaming-searchparams-guardrail?format=cursor","windsurf":"/api/rules/tanstack-start-ssr-streaming-searchparams-guardrail?format=windsurf","agents":"/api/rules/tanstack-start-ssr-streaming-searchparams-guardrail?format=agents"}},{"id":"hono-jsx-edge-streaming-pipelines","title":"Hono JSX & Edge Middleware Non-Blocking Stream Composition Standard","category":"frontend","severity":"critical","description":"Enforces asynchronous chunked transfer rendering and non-blocking streaming execution using Hono JSX across Cloudflare Workers and Deno runtimes. Prevents memory exhaustion and excessive Time-to-First-Byte (TTFB) caused by buffering full JSX component trees before response transmission or executing heavy middleware operations inside streaming render lifecycles.","antiPatternHeadline":"Buffering full JSX component trees to strings before response flushing and executing blocking I/O inside downstream streaming callbacks","stars_count":80,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","hono","edge","streaming","cloudflare-workers","deno","jsx"],"exportEndpoints":{"claude":"/api/rules/hono-jsx-edge-streaming-pipelines?format=claude","cursorMdc":"/api/rules/hono-jsx-edge-streaming-pipelines?format=mdc","cursorrules":"/api/rules/hono-jsx-edge-streaming-pipelines?format=cursor","windsurf":"/api/rules/hono-jsx-edge-streaming-pipelines?format=windsurf","agents":"/api/rules/hono-jsx-edge-streaming-pipelines?format=agents"}},{"id":"react-router-v7-hydration-single-fetch-guardrails","title":"React Router 7 Framework Mode Hydration, Typegen, and Single-Fetch Invariants","category":"frontend","severity":"critical","description":"Enforces strict hydration contracts, accurate Route typegen definitions, and safe turbo-stream deserialization under React Router 7 Framework Mode. Prevents full client re-fetches during initial document load, eliminates hydration mismatch traps caused by improper clientLoader.hydrate configurations, and ensures robust deferred streaming boundaries across Single Fetch architectures.","antiPatternHeadline":"Bypassing Single Fetch Streaming with Unsafe clientLoader Re-executions and Raw Response Hydration Mismatches","stars_count":113,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-router-7","remix","hydration","single-fetch","typegen"],"exportEndpoints":{"claude":"/api/rules/react-router-v7-hydration-single-fetch-guardrails?format=claude","cursorMdc":"/api/rules/react-router-v7-hydration-single-fetch-guardrails?format=mdc","cursorrules":"/api/rules/react-router-v7-hydration-single-fetch-guardrails?format=cursor","windsurf":"/api/rules/react-router-v7-hydration-single-fetch-guardrails?format=windsurf","agents":"/api/rules/react-router-v7-hydration-single-fetch-guardrails?format=agents"}},{"id":"tanstack-virtual-3-windowing-performance-standard","title":"TanStack Virtual 3.0 Dynamic Measurement, Scroll Containment, and DOM Saturation Defense","category":"frontend","severity":"critical","description":"Mandates strict layout containment, stable key extraction, bounded overscan, and ref-based dynamic measurement in TanStack Virtual 3.0. Prevents catastrophic DOM node saturation, layout reflow thrashing, and scroll jitter in massive table and list implementations.","antiPatternHeadline":"Uncontained Dynamic Measurement and Index Keying Causing Reflow Thrashing and DOM Saturation","stars_count":86,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react","tanstack-virtual","performance","windowing","tables"],"exportEndpoints":{"claude":"/api/rules/tanstack-virtual-3-windowing-performance-standard?format=claude","cursorMdc":"/api/rules/tanstack-virtual-3-windowing-performance-standard?format=mdc","cursorrules":"/api/rules/tanstack-virtual-3-windowing-performance-standard?format=cursor","windsurf":"/api/rules/tanstack-virtual-3-windowing-performance-standard?format=windsurf","agents":"/api/rules/tanstack-virtual-3-windowing-performance-standard?format=agents"}},{"id":"lexical-node-transforms-and-headless-markdown-standards","title":"Meta Lexical Immutable Node Transforms, Selection Reconciliation, and Headless Markdown Serialization","category":"frontend","severity":"critical","description":"Enforces strict copy-on-write state mutability within editor updates, deterministic Lexical selection reconciliation during structural tree transforms, and DOM-independent headless Markdown serialization. Violating these invariants corrupts the double-buffered EditorState tree, breaks undo/redo history, and crashes headless environments.","antiPatternHeadline":"Direct In-Place Node Property Mutation and DOM-Dependent Headless Serialization","stars_count":55,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","lexical","rich-text","markdown","headless","state-management"],"exportEndpoints":{"claude":"/api/rules/lexical-node-transforms-and-headless-markdown-standards?format=claude","cursorMdc":"/api/rules/lexical-node-transforms-and-headless-markdown-standards?format=mdc","cursorrules":"/api/rules/lexical-node-transforms-and-headless-markdown-standards?format=cursor","windsurf":"/api/rules/lexical-node-transforms-and-headless-markdown-standards?format=windsurf","agents":"/api/rules/lexical-node-transforms-and-headless-markdown-standards?format=agents"}},{"id":"biome-config-inheritance-vcs-suppression-guardrails","title":"Biome 1.9 Unified Toolchain: Configuration Inheritance, VCS Integration, and Deterministic Suppression","category":"frontend","severity":"critical","description":"Enforces deterministic formatting and linting architecture using Biome 1.9 single-binary capabilities. Mandates explicit configuration inheritance, native Git VCS ignore binding to eliminate duplicate ignore lists, and strictly formatted rule suppression syntax with mandatory contextual justification.","antiPatternHeadline":"Fragmented Toolchain Configuration, Ignored VCS Boundaries, and Naked Rule Suppressions","stars_count":88,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","biome","linter","formatter","code-quality","vcs"],"exportEndpoints":{"claude":"/api/rules/biome-config-inheritance-vcs-suppression-guardrails?format=claude","cursorMdc":"/api/rules/biome-config-inheritance-vcs-suppression-guardrails?format=mdc","cursorrules":"/api/rules/biome-config-inheritance-vcs-suppression-guardrails?format=cursor","windsurf":"/api/rules/biome-config-inheritance-vcs-suppression-guardrails?format=windsurf","agents":"/api/rules/biome-config-inheritance-vcs-suppression-guardrails?format=agents"}},{"id":"go-chi-v5-middleware-graceful-shutdown","title":"Go Chi v5 Deterministic Middleware Hierarchy & Signal-Driven Graceful Shutdown","category":"backend","severity":"critical","description":"Enforces strict middleware sequencing, hierarchical sub-router boundary isolation, context-propagated timeout cancellation, and zero-downtime signal-driven HTTP server shutdown in Go Chi v5 services. Eliminates dropped in-flight requests during rolling deployments, unmanaged goroutine leaks, and middleware duplication across mounted subtrees.","antiPatternHeadline":"Uncontrolled Process Termination, Inverted Middleware Stacks, and Context-Blind Handler Execution","stars_count":50,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["go","golang","chi","middleware","graceful-shutdown","context-cancellation","concurrency"],"exportEndpoints":{"claude":"/api/rules/go-chi-v5-middleware-graceful-shutdown?format=claude","cursorMdc":"/api/rules/go-chi-v5-middleware-graceful-shutdown?format=mdc","cursorrules":"/api/rules/go-chi-v5-middleware-graceful-shutdown?format=cursor","windsurf":"/api/rules/go-chi-v5-middleware-graceful-shutdown?format=windsurf","agents":"/api/rules/go-chi-v5-middleware-graceful-shutdown?format=agents"}},{"id":"tanstack-start-ssr-loaders-deferred-streaming-guardrail","title":"TanStack Start SSR Loaders, Type-Safe Search Params, and Deferred Streaming Standard","category":"frontend","severity":"critical","description":"Enforces strict type-safety across SSR route loaders, search param validation schemas, and deferred data streaming in TanStack Start and TanStack Router. Eliminates server-side TTFB bottlenecks caused by un-deferred slow promises and prevents client-server hydration mismatches triggered by unvalidated URL state. Guarantees non-critical assets stream incrementally via React Suspense and TanStack Router's defer boundary.","antiPatternHeadline":"Awaiting Slow Auxiliary Data in Route Loaders and Consuming Raw URL Search Strings","stars_count":59,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","tanstack-start","tanstack-router","ssr","streaming","typescript"],"exportEndpoints":{"claude":"/api/rules/tanstack-start-ssr-loaders-deferred-streaming-guardrail?format=claude","cursorMdc":"/api/rules/tanstack-start-ssr-loaders-deferred-streaming-guardrail?format=mdc","cursorrules":"/api/rules/tanstack-start-ssr-loaders-deferred-streaming-guardrail?format=cursor","windsurf":"/api/rules/tanstack-start-ssr-loaders-deferred-streaming-guardrail?format=windsurf","agents":"/api/rules/tanstack-start-ssr-loaders-deferred-streaming-guardrail?format=agents"}},{"id":"hono-jsx-edge-streaming-pipeline-guardrail","title":"Hono JSX Edge Streaming Pipelines and Non-Blocking Middleware Invariants","category":"frontend","severity":"critical","description":"Enforces non-blocking response streaming patterns when rendering Hono JSX across Cloudflare Workers and Deno Deploy. Prevents edge CPU timeout and memory exhaustion by mandating native Suspense-driven stream composition, client abort signal binding, and non-buffering edge middleware transforms.","antiPatternHeadline":"Buffering JSX via renderToString or Consuming Response Bodies in Edge Middleware","stars_count":54,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["hono","jsx","cloudflare-workers","deno","streaming","edge-rendering","ttfb"],"exportEndpoints":{"claude":"/api/rules/hono-jsx-edge-streaming-pipeline-guardrail?format=claude","cursorMdc":"/api/rules/hono-jsx-edge-streaming-pipeline-guardrail?format=mdc","cursorrules":"/api/rules/hono-jsx-edge-streaming-pipeline-guardrail?format=cursor","windsurf":"/api/rules/hono-jsx-edge-streaming-pipeline-guardrail?format=windsurf","agents":"/api/rules/hono-jsx-edge-streaming-pipeline-guardrail?format=agents"}},{"id":"angular-19-signals-defer-production-standard","title":"Angular 19 Standalone Signals, LinkedSignal State Derivation, and @defer Viewport Invariants","category":"frontend","severity":"critical","description":"Enforces strict signal-based reactivity in Angular 19, mandating signal inputs, outputs, queries, and linkedSignal for mutable derived state while eliminating ngOnChanges and untyped @defer blocks. Ensures deferred components are strictly standalone and isolated from eager injection paths to guarantee bundle boundary splitting and prevent zoneless hydration mismatches.","antiPatternHeadline":"Mixing Zone.js ChangeDetectionStrategy.Default with ngOnChanges, untracked signal mutation in effects, and eagerly bundled non-standalone @defer viewports","stars_count":67,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","angular","angular19","signals","defer","zoneless","standalone"],"exportEndpoints":{"claude":"/api/rules/angular-19-signals-defer-production-standard?format=claude","cursorMdc":"/api/rules/angular-19-signals-defer-production-standard?format=mdc","cursorrules":"/api/rules/angular-19-signals-defer-production-standard?format=cursor","windsurf":"/api/rules/angular-19-signals-defer-production-standard?format=windsurf","agents":"/api/rules/angular-19-signals-defer-production-standard?format=agents"}},{"id":"react-router-v7-hydration-single-fetch-boundaries","title":"React Router 7 Framework Mode Hydration, Typegen, and Single-Fetch Invariants","category":"frontend","severity":"critical","description":"Enforces strict hydration safety, typegen alignment, and single-fetch boundaries across React Router 7 framework route modules. Prevents hydration mismatches, data waterfall duplication, and broken types caused by improper usage of clientLoader, HydrateFallback, and turbo-stream serialization boundaries.","antiPatternHeadline":"Bypassing Route Typegen, Misconfiguring clientLoader.hydrate, and Double Fetching over Single-Fetch Boundaries","stars_count":112,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-router-v7","remix","hydration","single-fetch","streaming"],"exportEndpoints":{"claude":"/api/rules/react-router-v7-hydration-single-fetch-boundaries?format=claude","cursorMdc":"/api/rules/react-router-v7-hydration-single-fetch-boundaries?format=mdc","cursorrules":"/api/rules/react-router-v7-hydration-single-fetch-boundaries?format=cursor","windsurf":"/api/rules/react-router-v7-hydration-single-fetch-boundaries?format=windsurf","agents":"/api/rules/react-router-v7-hydration-single-fetch-boundaries?format=agents"}},{"id":"tanstack-virtual-v3-dynamic-windowing-guardrails","title":"TanStack Virtual 3.0 Dynamic Windowing & Scroll Margin Containment Invariants","category":"frontend","severity":"critical","description":"Enforces strict DOM node containment, robust dynamic measurement, and hardware-accelerated transform positioning for TanStack Virtual 3.0. Prevents layout thrashing, scroll-jitter during asynchronous resizing, and DOM saturation when rendering datasets in excess of 100,000 rows. Mandates exact absolute offset styling, ref measurement bindings, and scroll margin synchronization across all high-density tables and lists.","antiPatternHeadline":"Unmeasured variable-height nodes rendered via flow layout top offsets causing sub-pixel jitter and DOM saturation","stars_count":78,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react","tanstack-virtual","performance","windowing","dom-containment"],"exportEndpoints":{"claude":"/api/rules/tanstack-virtual-v3-dynamic-windowing-guardrails?format=claude","cursorMdc":"/api/rules/tanstack-virtual-v3-dynamic-windowing-guardrails?format=mdc","cursorrules":"/api/rules/tanstack-virtual-v3-dynamic-windowing-guardrails?format=cursor","windsurf":"/api/rules/tanstack-virtual-v3-dynamic-windowing-guardrails?format=windsurf","agents":"/api/rules/tanstack-virtual-v3-dynamic-windowing-guardrails?format=agents"}},{"id":"lexical-immutable-transforms-reconciliation-standard","title":"Lexical Headless State Mutation, Node Transforms, and Selection Reconciliation Invariants","category":"frontend","severity":"critical","description":"Enforces strict immutability, node cloning semantics via $getWritableNode, and non-destructive headless selection reconciliation during Lexical editor transformations. Prevents state corruption, infinite reconciliation loops, and detached DOM/markdown serialization crashes when executing asynchronous or pipeline-driven state transitions.","antiPatternHeadline":"Direct In-Place Mutation of Read-Only Lexical Nodes and Selection Desynchronization in Transforms","stars_count":84,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","lexical","rich-text","headless","ast","markdown"],"exportEndpoints":{"claude":"/api/rules/lexical-immutable-transforms-reconciliation-standard?format=claude","cursorMdc":"/api/rules/lexical-immutable-transforms-reconciliation-standard?format=mdc","cursorrules":"/api/rules/lexical-immutable-transforms-reconciliation-standard?format=cursor","windsurf":"/api/rules/lexical-immutable-transforms-reconciliation-standard?format=windsurf","agents":"/api/rules/lexical-immutable-transforms-reconciliation-standard?format=agents"}},{"id":"biome-vcs-inheritance-suppression-guardrail","title":"Biome 1.9 Configuration Inheritance, VCS Integration, and Suppression Governance","category":"frontend","severity":"critical","description":"Enforces strict Biome 1.9 toolchain architectural standards across enterprise repositories and monorepos. Mandates automated Git VCS ignore synchronization, centralized configuration inheritance with overrides, and deterministic inline suppression syntax that requires explicit human justification.","antiPatternHeadline":"Fragmented tooling configs, unanchored ESLint-style disable pragmas, and missing VCS ignore integration that cause CI drift and non-deterministic formatting failures.","stars_count":59,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","biome","linter","formatter","monorepo","vcs"],"exportEndpoints":{"claude":"/api/rules/biome-vcs-inheritance-suppression-guardrail?format=claude","cursorMdc":"/api/rules/biome-vcs-inheritance-suppression-guardrail?format=mdc","cursorrules":"/api/rules/biome-vcs-inheritance-suppression-guardrail?format=cursor","windsurf":"/api/rules/biome-vcs-inheritance-suppression-guardrail?format=windsurf","agents":"/api/rules/biome-vcs-inheritance-suppression-guardrail?format=agents"}},{"id":"valkey-8-cluster-threaded-io-failover-standard","title":"Valkey 8.0 Multi-Threaded I/O, Cluster Slot Redirects, and Hash-Tag Script Atomicity","category":"backend","severity":"critical","description":"Enforces strict hash-tag slot pinning for atomic multi-key Lua/Functions and resilient MOVED/ASK cluster redirection handling in Valkey 8.0. Prevents CROSSSLOT runtime exceptions, connection thrashing during automated failovers, and false concurrency assumptions under multi-threaded I/O.","antiPatternHeadline":"Executing unpinned multi-key Lua scripts across cluster slots while mishandling MOVED/ASK redirects and failover state transitions.","stars_count":96,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","valkey","redis","clustering","concurrency","distributed-systems"],"exportEndpoints":{"claude":"/api/rules/valkey-8-cluster-threaded-io-failover-standard?format=claude","cursorMdc":"/api/rules/valkey-8-cluster-threaded-io-failover-standard?format=mdc","cursorrules":"/api/rules/valkey-8-cluster-threaded-io-failover-standard?format=cursor","windsurf":"/api/rules/valkey-8-cluster-threaded-io-failover-standard?format=windsurf","agents":"/api/rules/valkey-8-cluster-threaded-io-failover-standard?format=agents"}},{"id":"tailwind-v4-css-first-theme-directives-production-standard","title":"Tailwind CSS v4 CSS-First Theme Architecture and Color-Mix Invariants","category":"frontend","severity":"critical","description":"Tailwind CSS v4 eliminates the legacy JavaScript-based configuration pipeline (`tailwind.config.{js,ts}`) in favor of native `@theme` CSS blocks and modern CSS custom properties. Legacy alpha-hack substitutions (such as `<alpha-value>` and manual RGBA/HSLA tuple unpacking) are strictly deprecated in favor of native OKLCH/P3 color formats and modern CSS `color-mix()` alpha adjustments. Adhering to this standard prevents CSS engine de-optimizations, build-time compilation breakage, and runtime style leakage.","antiPatternHeadline":"Retaining legacy tailwind.config.js files with string-interpolated RGB tuples and <alpha-value> placeholders in Tailwind v4 projects","stars_count":42,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","tailwindcss","css","design-tokens","web-performance"],"exportEndpoints":{"claude":"/api/rules/tailwind-v4-css-first-theme-directives-production-standard?format=claude","cursorMdc":"/api/rules/tailwind-v4-css-first-theme-directives-production-standard?format=mdc","cursorrules":"/api/rules/tailwind-v4-css-first-theme-directives-production-standard?format=cursor","windsurf":"/api/rules/tailwind-v4-css-first-theme-directives-production-standard?format=windsurf","agents":"/api/rules/tailwind-v4-css-first-theme-directives-production-standard?format=agents"}},{"id":"angular-19-signals-linked-defer-invariants","title":"Angular 19 Signal Inputs, LinkedSignal State Derivation, and @defer Viewport Invariants","category":"frontend","severity":"critical","description":"Enforces strict reactive modeling using Angular 19 signal inputs and linkedSignal primitives while ensuring bundle splitting via proper @defer block composition. Prohibits legacy @Input decorators, imperative ngOnChanges synchronization, untyped linkedSignal state resets, and sub-optimal @defer blocks that leak heavy dependencies into the parent bundle.","antiPatternHeadline":"Imperative State Synchronization and Leaked Dependencies in Deferred Views","stars_count":88,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","angular-19","signals","linkedsignal","defer-views","performance"],"exportEndpoints":{"claude":"/api/rules/angular-19-signals-linked-defer-invariants?format=claude","cursorMdc":"/api/rules/angular-19-signals-linked-defer-invariants?format=mdc","cursorrules":"/api/rules/angular-19-signals-linked-defer-invariants?format=cursor","windsurf":"/api/rules/angular-19-signals-linked-defer-invariants?format=windsurf","agents":"/api/rules/angular-19-signals-linked-defer-invariants?format=agents"}},{"id":"lexical-immutable-node-transforms-and-serialization","title":"Lexical Headless Node Immutability, Transform Convergence, and Markdown Serialization Guardrails","category":"frontend","severity":"critical","description":"Lexical nodes represent immutable tree snapshots outside of transactional update scopes, requiring explicit writable cloning via $getWritable() and convergent transform guards. In headless environments, markdown serialization and selection reconciliation must operate strictly within read/update boundaries without triggering recursive transform cascades or relying on browser DOM globals.","antiPatternHeadline":"Mutating Lexical Nodes Directly Outside getWritable(), Triggering Infinite Transform Cascades, and Executing DOM-Tethered Markdown Serialization in Headless Contexts","stars_count":47,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","lexical","rich-text","headless","markdown","react"],"exportEndpoints":{"claude":"/api/rules/lexical-immutable-node-transforms-and-serialization?format=claude","cursorMdc":"/api/rules/lexical-immutable-node-transforms-and-serialization?format=mdc","cursorrules":"/api/rules/lexical-immutable-node-transforms-and-serialization?format=cursor","windsurf":"/api/rules/lexical-immutable-node-transforms-and-serialization?format=windsurf","agents":"/api/rules/lexical-immutable-node-transforms-and-serialization?format=agents"}},{"id":"biome-1-9-config-inheritance-vcs-suppression-standard","title":"Biome 1.9 Configuration Inheritance, Git VCS Integration, and Strict Rule Suppression","category":"frontend","severity":"critical","description":"Enforces Biome 1.9 architectural standards across monorepos and standalone frontend packages. Mandates explicit Git VCS integration to prevent redundant ignore drift, structured multi-layer configuration inheritance via extends, and deterministic inline rule suppression with mandatory explanatory justification tokens.","antiPatternHeadline":"Unanchored ignore glob divergence, legacy ESLint suppression comments, and naked biome-ignore directives lacking reason tokens.","stars_count":83,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","biome","linter","formatter","code-quality","monorepo"],"exportEndpoints":{"claude":"/api/rules/biome-1-9-config-inheritance-vcs-suppression-standard?format=claude","cursorMdc":"/api/rules/biome-1-9-config-inheritance-vcs-suppression-standard?format=mdc","cursorrules":"/api/rules/biome-1-9-config-inheritance-vcs-suppression-standard?format=cursor","windsurf":"/api/rules/biome-1-9-config-inheritance-vcs-suppression-standard?format=windsurf","agents":"/api/rules/biome-1-9-config-inheritance-vcs-suppression-standard?format=agents"}},{"id":"rr7-hydration-single-fetch-guardrails","title":"React Router 7 Framework Mode Hydration, Typegen, and Single-Fetch Invariants","category":"frontend","severity":"critical","description":"Enforces strict React Router 7 framework mode patterns: leveraging route-module typegen via ./+types imports, eliminating deprecated defer() calls in favor of native turbo-stream Single Fetch promises, and safeguarding clientLoader.hydrate execution boundaries against SSR hydration waterfalls and mismatch crashes.","antiPatternHeadline":"Using legacy defer(), manual route typing, or uncoordinated clientLoader.hydrate that triggers client-side re-fetch waterfalls and hydration mismatch bailouts.","stars_count":62,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-router-7","remix","hydration","single-fetch","streaming","typegen"],"exportEndpoints":{"claude":"/api/rules/rr7-hydration-single-fetch-guardrails?format=claude","cursorMdc":"/api/rules/rr7-hydration-single-fetch-guardrails?format=mdc","cursorrules":"/api/rules/rr7-hydration-single-fetch-guardrails?format=cursor","windsurf":"/api/rules/rr7-hydration-single-fetch-guardrails?format=windsurf","agents":"/api/rules/rr7-hydration-single-fetch-guardrails?format=agents"}},{"id":"tanstack-virtual-3-performance-guardrail","title":"TanStack Virtual 3.0 Windowing Performance: Dynamic Measurement and Node Containment","category":"frontend","severity":"critical","description":"Enforces strict DOM node containment, dynamic size measurement invariants, and scroll margin isolation when using @tanstack/react-virtual v3. Prevents layout thrashing, incorrect offset calculations, and DOM node saturation in infinite or massive tabular datasets. Mandates stable measurement refs and hardware-accelerated composite transformations for position translation.","antiPatternHeadline":"Unbounded Layout Thrashing via Naive Remeasurement and Position Offset Mutation in Virtualized Lists","stars_count":65,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react","tanstack-virtual","performance","virtualization","dom-optimization"],"exportEndpoints":{"claude":"/api/rules/tanstack-virtual-3-performance-guardrail?format=claude","cursorMdc":"/api/rules/tanstack-virtual-3-performance-guardrail?format=mdc","cursorrules":"/api/rules/tanstack-virtual-3-performance-guardrail?format=cursor","windsurf":"/api/rules/tanstack-virtual-3-performance-guardrail?format=windsurf","agents":"/api/rules/tanstack-virtual-3-performance-guardrail?format=agents"}},{"id":"lexical-node-transforms-and-headless-serialization-guardrail","title":"Lexical Immutable Node Transforms, Selection Invariants, and Headless Serialization","category":"frontend","severity":"critical","description":"Enforces Lexical editor state immutability, transform loop termination, and selection reconciliation safety. Prevents fatal editor crashes caused by direct node property mutations, non-idempotent node transforms, and uninitialized node schemas during headless markdown serialization.","antiPatternHeadline":"Direct Node Mutation Outside Writable Clones and Headless Serialization Failures","stars_count":52,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","lexical","rich-text","editor-state","headless","markdown"],"exportEndpoints":{"claude":"/api/rules/lexical-node-transforms-and-headless-serialization-guardrail?format=claude","cursorMdc":"/api/rules/lexical-node-transforms-and-headless-serialization-guardrail?format=mdc","cursorrules":"/api/rules/lexical-node-transforms-and-headless-serialization-guardrail?format=cursor","windsurf":"/api/rules/lexical-node-transforms-and-headless-serialization-guardrail?format=windsurf","agents":"/api/rules/lexical-node-transforms-and-headless-serialization-guardrail?format=agents"}},{"id":"biome-1-9-config-vcs-suppression-standard","title":"Biome 1.9 Configuration Inheritance, VCS Integration, and Strict Suppression Standard","category":"frontend","severity":"critical","description":"Enforces deterministic configuration inheritance, native Git VCS integration, and structured suppression syntax for Biome 1.9+. Prevents silent linter desynchronization, unverified rule overrides, and CI divergence caused by unanchored configurations or legacy ignore strategies.","antiPatternHeadline":"Unexplained suppressions, decoupled gitignores, and fractured monorepo inheritance trees in Biome 1.9","stars_count":45,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["biome","linter","formatter","tooling","monorepo","typescript"],"exportEndpoints":{"claude":"/api/rules/biome-1-9-config-vcs-suppression-standard?format=claude","cursorMdc":"/api/rules/biome-1-9-config-vcs-suppression-standard?format=mdc","cursorrules":"/api/rules/biome-1-9-config-vcs-suppression-standard?format=cursor","windsurf":"/api/rules/biome-1-9-config-vcs-suppression-standard?format=windsurf","agents":"/api/rules/biome-1-9-config-vcs-suppression-standard?format=agents"}},{"id":"bun-sqlite-wal-s3-native-storage","title":"Bun 1.2 Embedded SQLite WAL & S3 Native Zero-Copy Streaming Invariants","category":"backend","severity":"critical","description":"Enforces deterministic concurrency control and high-throughput zero-copy streaming when combining Bun 1.2's native bun:sqlite engine with Bun.s3 storage. Mandates WAL journal mode with synchronous normal settings, prepared statement reuse, and direct stream piping between SQLite BLOB reads/writes and native S3 multipart operations without intermediate in-memory buffering. Eliminates event loop blocking, file lock deadlocks, and Node.js wrapper overhead.","antiPatternHeadline":"Unbuffered in-memory reads, missing WAL journal configuration, and redundant AWS-SDK wrapping in Bun runtimes","stars_count":101,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","sqlite","s3","wal","zero-copy","streaming"],"exportEndpoints":{"claude":"/api/rules/bun-sqlite-wal-s3-native-storage?format=claude","cursorMdc":"/api/rules/bun-sqlite-wal-s3-native-storage?format=mdc","cursorrules":"/api/rules/bun-sqlite-wal-s3-native-storage?format=cursor","windsurf":"/api/rules/bun-sqlite-wal-s3-native-storage?format=windsurf","agents":"/api/rules/bun-sqlite-wal-s3-native-storage?format=agents"}},{"id":"axum-08-state-tower-resilience-standard","title":"Axum 0.8 Type-Safe State Composition and Tower Service Invariants","category":"backend","severity":"critical","description":"Enforces strict type safety and panic resilience across Axum 0.8 State extractors and Tower middleware stacks. Mandates compile-time substate extraction via FromRef, prevents router state decoupling panics, and guarantees zero unhandled rejection panics through CatchPanic layers and custom IntoResponse error boundaries.","antiPatternHeadline":"Runtime router panics and broken substate isolation caused by untyped state degradation, missing CatchPanic middleware, and unconstrained Tower layers.","stars_count":41,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tower","type-safety","error-handling"],"exportEndpoints":{"claude":"/api/rules/axum-08-state-tower-resilience-standard?format=claude","cursorMdc":"/api/rules/axum-08-state-tower-resilience-standard?format=mdc","cursorrules":"/api/rules/axum-08-state-tower-resilience-standard?format=cursor","windsurf":"/api/rules/axum-08-state-tower-resilience-standard?format=windsurf","agents":"/api/rules/axum-08-state-tower-resilience-standard?format=agents"}},{"id":"tanstack-start-router-ssr-streaming-invariants","title":"TanStack Start SSR: Strict Search Params Validation, Loaders, and Deferred Streaming Invariants","category":"frontend","severity":"critical","description":"Enforces strict runtime validation for route search parameters using schema validators in validateSearch, mandates server functions (createServerFn) for data access, and requires non-blocking deferred streaming using defer() paired with React Suspense and Await. Prevents initial server-side TTFB degradation, hydration mismatch panics, and client bundle contamination.","antiPatternHeadline":"Blocking SSR TTFB via Direct Promise Awaits, Untyped Search Params, and Leaking Node APIs into Router Loaders","stars_count":42,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","tanstack-start","tanstack-router","ssr","streaming","type-safety"],"exportEndpoints":{"claude":"/api/rules/tanstack-start-router-ssr-streaming-invariants?format=claude","cursorMdc":"/api/rules/tanstack-start-router-ssr-streaming-invariants?format=mdc","cursorrules":"/api/rules/tanstack-start-router-ssr-streaming-invariants?format=cursor","windsurf":"/api/rules/tanstack-start-router-ssr-streaming-invariants?format=windsurf","agents":"/api/rules/tanstack-start-router-ssr-streaming-invariants?format=agents"}},{"id":"rr7-framework-mode-hydration-single-fetch-guardrail","title":"React Router 7 Framework Mode Hydration, Typegen, and Single-Fetch Invariants","category":"frontend","severity":"critical","description":"Enforces strict route module typegen contracts, Single Fetch turbo-stream serialization, and explicit clientLoader hydration lifecycle configurations in React Router 7 Framework Mode. Prevents hydration mismatches, double-fetching, and silent serialization failures when streaming deferred promises across SSR boundaries.","antiPatternHeadline":"Bypassing Typegen Route Context, Retaining Legacy JSON Responses, and Misconfiguring clientLoader Hydration Boundaries","stars_count":53,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-router-7","remix","hydration","typegen","single-fetch","streaming"],"exportEndpoints":{"claude":"/api/rules/rr7-framework-mode-hydration-single-fetch-guardrail?format=claude","cursorMdc":"/api/rules/rr7-framework-mode-hydration-single-fetch-guardrail?format=mdc","cursorrules":"/api/rules/rr7-framework-mode-hydration-single-fetch-guardrail?format=cursor","windsurf":"/api/rules/rr7-framework-mode-hydration-single-fetch-guardrail?format=windsurf","agents":"/api/rules/rr7-framework-mode-hydration-single-fetch-guardrail?format=agents"}},{"id":"tanstack-virtual-windowing-performance-standard","title":"TanStack Virtual 3.0 Dynamic Measurement, Scroll Containment, and DOM Saturation Guardrail","category":"frontend","severity":"critical","description":"Enforces strict memory and render invariants when windowing massive datasets using TanStack Virtual 3.0. Mandates dynamic element measurement via measureElement ref attachments, CSS containment for scroll containers, and zero-DOM-leak node recycling to prevent main thread blocking, layout thrashing, and browser paint degradation.","antiPatternHeadline":"Unmeasured Dynamic Rows, Layout Thrashing Without CSS Containment, and Inline Key Instability in Virtualized DOM","stars_count":80,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","tanstack-virtual","react","performance","virtualization","dom-optimization"],"exportEndpoints":{"claude":"/api/rules/tanstack-virtual-windowing-performance-standard?format=claude","cursorMdc":"/api/rules/tanstack-virtual-windowing-performance-standard?format=mdc","cursorrules":"/api/rules/tanstack-virtual-windowing-performance-standard?format=cursor","windsurf":"/api/rules/tanstack-virtual-windowing-performance-standard?format=windsurf","agents":"/api/rules/tanstack-virtual-windowing-performance-standard?format=agents"}},{"id":"lexical-node-transforms-and-headless-markdown-reconciliation","title":"Lexical Immutable Node Transforms, Selection Reconciliation, and Headless Markdown Serialization","category":"frontend","severity":"critical","description":"Lexical enforces strict immutability where node mutations must occur exclusively within active write transactions via getWritable() or mutator methods on clones. Headless markdown serialization and node transforms require complete node registry definitions and explicit selection offset re-anchoring to prevent detached node key corruptions, infinite transform loops, and server-side execution failures.","antiPatternHeadline":"Mutating Read-Only Lexical Nodes Outside Transactions or Deserializing Markdown in Unregistered Headless Editors","stars_count":78,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","lexical","rich-text","markdown","editor-state","immutability"],"exportEndpoints":{"claude":"/api/rules/lexical-node-transforms-and-headless-markdown-reconciliation?format=claude","cursorMdc":"/api/rules/lexical-node-transforms-and-headless-markdown-reconciliation?format=mdc","cursorrules":"/api/rules/lexical-node-transforms-and-headless-markdown-reconciliation?format=cursor","windsurf":"/api/rules/lexical-node-transforms-and-headless-markdown-reconciliation?format=windsurf","agents":"/api/rules/lexical-node-transforms-and-headless-markdown-reconciliation?format=agents"}},{"id":"biome-vcs-inheritance-suppression-standard","title":"Biome 1.9 Configuration Inheritance, VCS Integration, and Suppression Guardrails","category":"frontend","severity":"critical","description":"Enforces deterministic Biome 1.9 configuration governance across monorepos and standalone workspaces. Mandates explicit Git VCS integration with ignore-file synchronization, rigid schema inheritance via extends, and syntactically strict inline rule suppressions requiring mandatory human-readable justifications.","antiPatternHeadline":"Uncontrolled Lint Ingestion via Broken VCS Ignores and Justification-Free Rule Suppressions","stars_count":99,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","biome","linter","formatter","tooling"],"exportEndpoints":{"claude":"/api/rules/biome-vcs-inheritance-suppression-standard?format=claude","cursorMdc":"/api/rules/biome-vcs-inheritance-suppression-standard?format=mdc","cursorrules":"/api/rules/biome-vcs-inheritance-suppression-standard?format=cursor","windsurf":"/api/rules/biome-vcs-inheritance-suppression-standard?format=windsurf","agents":"/api/rules/biome-vcs-inheritance-suppression-standard?format=agents"}},{"id":"tanstack-start-ssr-loader-defer-standard","title":"TanStack Start SSR: Type-Safe Search Validation and Deferred Streaming Invariants","category":"frontend","severity":"critical","description":"Enforces strict type-safety across SSR loaders, search param schemas, and deferred data streaming in TanStack Start and TanStack Router. Prevents blocking SSR Time-to-First-Byte (TTFB) by mandating non-critical promise deferral via `defer()` and `<Await>`, while eliminating hydration mismatches and runtime crashes through schema-validated search parameters.","antiPatternHeadline":"Blocking SSR TTFB via Monolithic Awaited Loaders and Untyped Search Query Extraction","stars_count":117,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","tanstack-start","tanstack-router","ssr","streaming","zod","typescript"],"exportEndpoints":{"claude":"/api/rules/tanstack-start-ssr-loader-defer-standard?format=claude","cursorMdc":"/api/rules/tanstack-start-ssr-loader-defer-standard?format=mdc","cursorrules":"/api/rules/tanstack-start-ssr-loader-defer-standard?format=cursor","windsurf":"/api/rules/tanstack-start-ssr-loader-defer-standard?format=windsurf","agents":"/api/rules/tanstack-start-ssr-loader-defer-standard?format=agents"}},{"id":"hono-jsx-edge-streaming-pipeline-invariants","title":"Hono JSX Edge Streaming & Non-Buffering Middleware Pipeline Guardrails","category":"frontend","severity":"critical","description":"Enforces zero-buffering edge rendering architectures using Hono JSX and renderToReadableStream on Cloudflare Workers and Deno runtimes. Prevents severe TTFB degradation, memory bloat from in-memory string accumulation, and unhandled chunk failures during mid-flight streaming responses.","antiPatternHeadline":"Awaiting asynchronous JSX component trees inside memory-buffering helpers instead of streaming readable chunks with Suspense boundaries.","stars_count":113,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","hono","cloudflare-workers","deno","jsx-streaming","edge-computing"],"exportEndpoints":{"claude":"/api/rules/hono-jsx-edge-streaming-pipeline-invariants?format=claude","cursorMdc":"/api/rules/hono-jsx-edge-streaming-pipeline-invariants?format=mdc","cursorrules":"/api/rules/hono-jsx-edge-streaming-pipeline-invariants?format=cursor","windsurf":"/api/rules/hono-jsx-edge-streaming-pipeline-invariants?format=windsurf","agents":"/api/rules/hono-jsx-edge-streaming-pipeline-invariants?format=agents"}},{"id":"tanstack-virtual-dynamic-measurement-guardrail","title":"TanStack Virtual 3.0 Dynamic Windowing & Node Containment Standard","category":"frontend","severity":"critical","description":"Mandates deterministic dynamic element measurement, hardware-accelerated transforms, and bounded overscan configurations in TanStack Virtual 3.0. Enforces strict containment of scrollable bounds and explicit node measuring via data-index to eliminate DOM node saturation, layout thrashing, and scroll jitter in high-density tables.","antiPatternHeadline":"Unbounded Overscan and Dynamic Sizing Without Node Measurement Containment Causing Forced Reflows","stars_count":55,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","tanstack-virtual","performance","virtualization","react","typescript"],"exportEndpoints":{"claude":"/api/rules/tanstack-virtual-dynamic-measurement-guardrail?format=claude","cursorMdc":"/api/rules/tanstack-virtual-dynamic-measurement-guardrail?format=mdc","cursorrules":"/api/rules/tanstack-virtual-dynamic-measurement-guardrail?format=cursor","windsurf":"/api/rules/tanstack-virtual-dynamic-measurement-guardrail?format=windsurf","agents":"/api/rules/tanstack-virtual-dynamic-measurement-guardrail?format=agents"}},{"id":"lexical-node-transforms-headless-serialization","title":"Lexical Immutable Transforms, Selection Reconciliation & Headless Markdown Engine","category":"frontend","severity":"critical","description":"Enforces strict immutability semantics via Lexical's copy-on-write node lifecycle, deterministic transform convergence to avoid infinite reconciliation loops, and DOM-independent headless Markdown serialization. Guarantees selection stability and prevents editor state corruption during headless background execution and client-side rich text updates.","antiPatternHeadline":"Direct In-Place Node Mutation, Unbounded Transform Recalculation, and DOM-Dependent Headless Serialization","stars_count":96,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","lexical","rich-text","headless-editor","markdown-serialization","editor-state"],"exportEndpoints":{"claude":"/api/rules/lexical-node-transforms-headless-serialization?format=claude","cursorMdc":"/api/rules/lexical-node-transforms-headless-serialization?format=mdc","cursorrules":"/api/rules/lexical-node-transforms-headless-serialization?format=cursor","windsurf":"/api/rules/lexical-node-transforms-headless-serialization?format=windsurf","agents":"/api/rules/lexical-node-transforms-headless-serialization?format=agents"}},{"id":"valkey-8-cluster-slot-routing-atomicity","title":"Valkey 8.0 Cluster Hash Tagging, Redirection Handling, and Non-Blocking Scripting","category":"backend","severity":"critical","description":"Valkey 8.0 multi-threaded I/O parallelizes socket read/write processing across I/O threads but maintains single-threaded execution semantics for data mutability and cluster slot routing across nodes (slots 0-16383). Developers must enforce explicit hash tagging for multi-key atomicity, strictly declare all keys in Lua or Function execution to prevent cross-slot deadlocks, and implement resilient MOVED and ASK redirection handlers with slot cache invalidation during cluster failover.","antiPatternHeadline":"Cross-Slot Lua Execution and Unhandled Failover Redirections Inducing Stalled I/O Pipelines","stars_count":87,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","valkey","clustering","failover","lua-scripting","distributed-caching"],"exportEndpoints":{"claude":"/api/rules/valkey-8-cluster-slot-routing-atomicity?format=claude","cursorMdc":"/api/rules/valkey-8-cluster-slot-routing-atomicity?format=mdc","cursorrules":"/api/rules/valkey-8-cluster-slot-routing-atomicity?format=cursor","windsurf":"/api/rules/valkey-8-cluster-slot-routing-atomicity?format=windsurf","agents":"/api/rules/valkey-8-cluster-slot-routing-atomicity?format=agents"}},{"id":"tanstack-start-ssr-streaming-and-search-params-standard","title":"TanStack Start SSR Loaders, Streaming Deferred Data, and Validated Search Invariants","category":"frontend","severity":"critical","description":"Enforces strict type safety for URL search parameters via schema validation, prevents blocking SSR render waterfalls, and mandates deferred streaming patterns for non-critical loader data. Eliminates hydration mismatches, search parameter injection bugs, and high TTFB in TanStack Start applications.","antiPatternHeadline":"Unvalidated Search Params and Blocking SSR Waterfalls via Awaited Non-Critical Loader Data","stars_count":49,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","tanstack-start","tanstack-router","ssr","search-params","streaming"],"exportEndpoints":{"claude":"/api/rules/tanstack-start-ssr-streaming-and-search-params-standard?format=claude","cursorMdc":"/api/rules/tanstack-start-ssr-streaming-and-search-params-standard?format=mdc","cursorrules":"/api/rules/tanstack-start-ssr-streaming-and-search-params-standard?format=cursor","windsurf":"/api/rules/tanstack-start-ssr-streaming-and-search-params-standard?format=windsurf","agents":"/api/rules/tanstack-start-ssr-streaming-and-search-params-standard?format=agents"}},{"id":"lexical-node-transforms-and-headless-reconciliation","title":"Lexical Immutable Node Transforms, Selection Preservation, and Headless Serialization","category":"frontend","severity":"critical","description":"Lexical nodes in EditorState are strictly immutable; direct property modifications corrupt the AST snapshot and break time-travel debugging. All node mutations must occur via node.getWritable() within atomic editor.update() blocks, transforms must maintain idempotence to prevent infinite reconciliation cascades, and headless serialization must register explicit node schemas to avoid runtime desynchronization.","antiPatternHeadline":"Mutating Lexical Nodes Without getWritable() and Retaining Node References Across Editor States","stars_count":44,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","lexical","rich-text","immutability","headless","markdown"],"exportEndpoints":{"claude":"/api/rules/lexical-node-transforms-and-headless-reconciliation?format=claude","cursorMdc":"/api/rules/lexical-node-transforms-and-headless-reconciliation?format=mdc","cursorrules":"/api/rules/lexical-node-transforms-and-headless-reconciliation?format=cursor","windsurf":"/api/rules/lexical-node-transforms-and-headless-reconciliation?format=windsurf","agents":"/api/rules/lexical-node-transforms-and-headless-reconciliation?format=agents"}},{"id":"biome-1-9-config-inheritance-vcs-suppression","title":"Biome 1.9 Configuration Inheritance, VCS Synchronization, and Deterministic Suppression Standards","category":"frontend","severity":"critical","description":"Enforces strict architecture for Biome 1.9 across monorepos and frontend packages. Mandates clean configuration inheritance via 'extends', native Git VCS integration to eliminate redundant ignore files, and deterministic, fully justified inline suppression syntax.","antiPatternHeadline":"Mixing legacy ESLint/Prettier suppression comments, duplicate file ignore lists, and unanchored Biome rule suppressions without justification.","stars_count":51,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","biome","tooling","linter","formatter","typescript"],"exportEndpoints":{"claude":"/api/rules/biome-1-9-config-inheritance-vcs-suppression?format=claude","cursorMdc":"/api/rules/biome-1-9-config-inheritance-vcs-suppression?format=mdc","cursorrules":"/api/rules/biome-1-9-config-inheritance-vcs-suppression?format=cursor","windsurf":"/api/rules/biome-1-9-config-inheritance-vcs-suppression?format=windsurf","agents":"/api/rules/biome-1-9-config-inheritance-vcs-suppression?format=agents"}},{"id":"svelte5-runes-reactivity-snippets-guardrail","title":"Svelte 5 Runes State Preservation, Pure Derivations, and Snippet Composition","category":"frontend","severity":"critical","description":"Enforces Svelte 5 runes architecture across components and module state. Prohibits breaking reactive proxy bindings via premature destructuring, disallows using $effect for pure synchronous state derivation, mandates snippets over deprecated slot projections, and restricts runes to .svelte and .svelte.ts execution boundaries.","antiPatternHeadline":"Destructuring Reactive Proxies, Misusing $effect for Synchronous Computations, and Legacy Slot Patterns","stars_count":95,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","state-management","typescript"],"exportEndpoints":{"claude":"/api/rules/svelte5-runes-reactivity-snippets-guardrail?format=claude","cursorMdc":"/api/rules/svelte5-runes-reactivity-snippets-guardrail?format=mdc","cursorrules":"/api/rules/svelte5-runes-reactivity-snippets-guardrail?format=cursor","windsurf":"/api/rules/svelte5-runes-reactivity-snippets-guardrail?format=windsurf","agents":"/api/rules/svelte5-runes-reactivity-snippets-guardrail?format=agents"}},{"id":"rr7-framework-hydration-single-fetch","title":"React Router 7 Framework Hydration, Typegen Route Modules, and Single-Fetch Boundaries","category":"frontend","severity":"critical","description":"In React Router 7 Framework Mode with Single Fetch enabled, route data streaming and client hydration require strict synchronization between server loaders, client loaders, and generated type boundaries. Violating Single Fetch serialization invariants, omitting route module typegen, or misconfiguring clientLoader.hydrate triggers critical DOM mismatch errors, broken navigation transitions, and Turbostream deserialization panics.","antiPatternHeadline":"Bypassing Route Typegen and Misconfiguring clientLoader.hydrate During Single-Fetch Hydration","stars_count":83,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-router-7","remix","hydration","streaming","single-fetch","typegen"],"exportEndpoints":{"claude":"/api/rules/rr7-framework-hydration-single-fetch?format=claude","cursorMdc":"/api/rules/rr7-framework-hydration-single-fetch?format=mdc","cursorrules":"/api/rules/rr7-framework-hydration-single-fetch?format=cursor","windsurf":"/api/rules/rr7-framework-hydration-single-fetch?format=windsurf","agents":"/api/rules/rr7-framework-hydration-single-fetch?format=agents"}},{"id":"lexical-node-transforms-headless-serialization-guardrails","title":"Lexical Immutable Node Transforms, Selection Reconciliation, and Headless Markdown Serialization","category":"frontend","severity":"critical","description":"Enforces strict adherence to Meta Lexical copy-on-write immutability semantics, idempotent node transforms, and DOM-independent headless Markdown serialization. Violating these invariants produces infinite transform cascade loops, corrupted editor state trees, and runtime exceptions during headless SSR or background execution.","antiPatternHeadline":"Direct In-Memory Node Mutation, Non-Idempotent Transform Loops, and DOM-Dependent Headless Serialization","stars_count":68,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","lexical","rich-text","markdown","headless","typescript"],"exportEndpoints":{"claude":"/api/rules/lexical-node-transforms-headless-serialization-guardrails?format=claude","cursorMdc":"/api/rules/lexical-node-transforms-headless-serialization-guardrails?format=mdc","cursorrules":"/api/rules/lexical-node-transforms-headless-serialization-guardrails?format=cursor","windsurf":"/api/rules/lexical-node-transforms-headless-serialization-guardrails?format=windsurf","agents":"/api/rules/lexical-node-transforms-headless-serialization-guardrails?format=agents"}},{"id":"biome-v1-9-monorepo-config-and-suppression-guardrail","title":"Biome 1.9 Deterministic Configuration Inheritance, VCS Integration, and Structured Suppressions","category":"frontend","severity":"critical","description":"Enforces strict configuration inheritance via the 'extends' resolution schema, mandatory Git VCS integration with ignorefile honoring, and deterministic inline suppression comment syntax in Biome 1.9. Disallows deprecated ESLint-style suppressions and unanchored root-level overrides in monorepo workspaces.","antiPatternHeadline":"Unpinned Configuration Drift, ESLint Suppression Remnants, and Untracked File Linter Failures","stars_count":115,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","biome","linter","formatter","tooling","monorepo"],"exportEndpoints":{"claude":"/api/rules/biome-v1-9-monorepo-config-and-suppression-guardrail?format=claude","cursorMdc":"/api/rules/biome-v1-9-monorepo-config-and-suppression-guardrail?format=mdc","cursorrules":"/api/rules/biome-v1-9-monorepo-config-and-suppression-guardrail?format=cursor","windsurf":"/api/rules/biome-v1-9-monorepo-config-and-suppression-guardrail?format=windsurf","agents":"/api/rules/biome-v1-9-monorepo-config-and-suppression-guardrail?format=agents"}},{"id":"tailwind-v4-css-first-theme-guardrail","title":"Tailwind CSS v4 CSS-First Configuration & Modern Theme Directives","category":"frontend","severity":"critical","description":"Tailwind CSS v4 fully deprecates JavaScript configuration files (tailwind.config.js/ts) in favor of the CSS-first @theme directive and native CSS custom properties. Frontend codebases must declare theme variables, custom fonts, container breakpoints, and color palettes using standard @theme blocks and CSS color-mix() functional notation. Mixing legacy JS configuration patterns or obsolete opacity-suffix workarounds breaks CSS compilation and tree-shaking invariants in Oxide-based pipelines.","antiPatternHeadline":"Retaining tailwind.config.js and Using Legacy CSS-in-JS Utility Hacks in Tailwind v4","stars_count":113,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","tailwind-css","css","styling","design-tokens","vite"],"exportEndpoints":{"claude":"/api/rules/tailwind-v4-css-first-theme-guardrail?format=claude","cursorMdc":"/api/rules/tailwind-v4-css-first-theme-guardrail?format=mdc","cursorrules":"/api/rules/tailwind-v4-css-first-theme-guardrail?format=cursor","windsurf":"/api/rules/tailwind-v4-css-first-theme-guardrail?format=windsurf","agents":"/api/rules/tailwind-v4-css-first-theme-guardrail?format=agents"}},{"id":"angular-19-signals-linked-signal-defer-views","title":"Angular 19 Signal Primitives, LinkedSignal State Derivation, and @defer Viewport Guardrails","category":"frontend","severity":"critical","description":"Enforces modern Angular 19 reactive primitives by forbidding legacy @Input decorators and manual synchronization effects. Requires signal inputs, linkedSignal for local mutable state derived from upstream inputs, and production-grade @defer viewport chunking with mandatory minimum placeholder dimensions to eliminate layout shifts and hydration waterfalls.","antiPatternHeadline":"Legacy @Input/ngOnChanges coupling, effect-based state synchronization, and unbuffered @defer blocks","stars_count":50,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","angular","angular19","signals","linked-signal","defer-views","performance"],"exportEndpoints":{"claude":"/api/rules/angular-19-signals-linked-signal-defer-views?format=claude","cursorMdc":"/api/rules/angular-19-signals-linked-signal-defer-views?format=mdc","cursorrules":"/api/rules/angular-19-signals-linked-signal-defer-views?format=cursor","windsurf":"/api/rules/angular-19-signals-linked-signal-defer-views?format=windsurf","agents":"/api/rules/angular-19-signals-linked-signal-defer-views?format=agents"}},{"id":"tanstack-virtual-v3-dynamic-windowing-standard","title":"TanStack Virtual 3.0 Dynamic Windowing and Containment Standard","category":"frontend","severity":"critical","description":"Enforces strict virtual DOM containment, hardware-accelerated transform positioning, and deterministic measurement caching for TanStack Virtual 3.0. Prevents layout thrashing, DOM node saturation, and measurement cache eviction in high-frequency, dynamic-height tabular datasets.","antiPatternHeadline":"Dynamic element measurement without data-index anchors, unmemoized getItemKey, and missing CSS layout containment causing catastrophic reflow loops.","stars_count":85,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react","tanstack-virtual","performance","windowing","tables"],"exportEndpoints":{"claude":"/api/rules/tanstack-virtual-v3-dynamic-windowing-standard?format=claude","cursorMdc":"/api/rules/tanstack-virtual-v3-dynamic-windowing-standard?format=mdc","cursorrules":"/api/rules/tanstack-virtual-v3-dynamic-windowing-standard?format=cursor","windsurf":"/api/rules/tanstack-virtual-v3-dynamic-windowing-standard?format=windsurf","agents":"/api/rules/tanstack-virtual-v3-dynamic-windowing-standard?format=agents"}},{"id":"lexical-immutable-transforms-and-headless-markdown-serialization","title":"Lexical Node Immutability, Transform Idempotency, and Headless Markdown Serialization","category":"frontend","severity":"critical","description":"Lexical nodes are strictly immutable outside an active EditorUpdate lifecycle and must be modified exclusively via node.getWritable() or node-specific mutation APIs. Node transforms must remain strictly idempotent to prevent infinite reconciliation loops, and headless markdown serialisation must execute inside explicit editorState read contexts with fully registered node schemas.","antiPatternHeadline":"Direct Node Mutation, Non-Idempotent Transforms, and Unscoped Headless Markdown Serialisation","stars_count":101,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","lexical","rich-text","markdown","headless","state-management"],"exportEndpoints":{"claude":"/api/rules/lexical-immutable-transforms-and-headless-markdown-serialization?format=claude","cursorMdc":"/api/rules/lexical-immutable-transforms-and-headless-markdown-serialization?format=mdc","cursorrules":"/api/rules/lexical-immutable-transforms-and-headless-markdown-serialization?format=cursor","windsurf":"/api/rules/lexical-immutable-transforms-and-headless-markdown-serialization?format=windsurf","agents":"/api/rules/lexical-immutable-transforms-and-headless-markdown-serialization?format=agents"}},{"id":"biome-1-9-monorepo-vcs-suppression-guardrails","title":"Biome 1.9 Configuration Inheritance, VCS Integration, and Deterministic Rule Suppression","category":"frontend","severity":"critical","description":"Enforces strict configuration schema inheritance via `extends`, deterministic Git-backed ignore semantics, and canonical Biome 1.9 suppression comment syntax. Eliminates silent linter bypassing, conflicting nested formatting rules, and redundant CI parsing passes across modern TypeScript monorepos.","antiPatternHeadline":"Ad-Hoc Suppressions, Unanchored Root Configs, and Git-Ignored File Drift","stars_count":115,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","biome","linter","formatter","tooling","typescript"],"exportEndpoints":{"claude":"/api/rules/biome-1-9-monorepo-vcs-suppression-guardrails?format=claude","cursorMdc":"/api/rules/biome-1-9-monorepo-vcs-suppression-guardrails?format=mdc","cursorrules":"/api/rules/biome-1-9-monorepo-vcs-suppression-guardrails?format=cursor","windsurf":"/api/rules/biome-1-9-monorepo-vcs-suppression-guardrails?format=windsurf","agents":"/api/rules/biome-1-9-monorepo-vcs-suppression-guardrails?format=agents"}},{"id":"tanstack-start-router-ssr-streaming-production-standard","title":"TanStack Start SSR Loaders, Deferred Streaming, and Validated Search Parameters","category":"frontend","severity":"critical","description":"Enforces strict type safety and streaming resilience across TanStack Start routes by mandating runtime search parameter validation, isolating fast path data from slow path promises using defer(), and preventing blocking SSR waterfalls. Guarantees hydration consistency and optimal Time-to-First-Byte (TTFB) under fullstack SSR.","antiPatternHeadline":"Blocking full-page SSR with un-deferred slow data fetching and unvalidated runtime search params","stars_count":50,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","tanstack-router","tanstack-start","ssr","streaming","type-safety"],"exportEndpoints":{"claude":"/api/rules/tanstack-start-router-ssr-streaming-production-standard?format=claude","cursorMdc":"/api/rules/tanstack-start-router-ssr-streaming-production-standard?format=mdc","cursorrules":"/api/rules/tanstack-start-router-ssr-streaming-production-standard?format=cursor","windsurf":"/api/rules/tanstack-start-router-ssr-streaming-production-standard?format=windsurf","agents":"/api/rules/tanstack-start-router-ssr-streaming-production-standard?format=agents"}},{"id":"lexical-node-transforms-selection-reconciliation","title":"Lexical Immutable Node Transforms, Selection Preservation, and Headless Serialization Standard","category":"frontend","severity":"critical","description":"Enforces strict immutability boundaries across Meta Lexical document pipelines by mandating mutations via node.getWritable() inside transactional editor updates, preventing infinite transform reconciliation cascades with idempotent state checks, and ensuring deterministic headless markdown serialization without DOM dependencies.","antiPatternHeadline":"Direct In-Place Node Mutation, Unguarded Transform Loops, and DOM-Dependent Headless Serialization","stars_count":55,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","lexical","rich-text","ast","markdown-serialization","editor-state"],"exportEndpoints":{"claude":"/api/rules/lexical-node-transforms-selection-reconciliation?format=claude","cursorMdc":"/api/rules/lexical-node-transforms-selection-reconciliation?format=mdc","cursorrules":"/api/rules/lexical-node-transforms-selection-reconciliation?format=cursor","windsurf":"/api/rules/lexical-node-transforms-selection-reconciliation?format=windsurf","agents":"/api/rules/lexical-node-transforms-selection-reconciliation?format=agents"}},{"id":"biome-v1-9-config-inheritance-vcs-suppression-guardrail","title":"Biome 1.9 Configuration Inheritance, VCS Integration, and Deterministic Suppression Standard","category":"frontend","severity":"critical","description":"Enforces strict schema conformance in Biome 1.9 across monorepo inheritance hierarchies, activates native Git VCS integration to eliminate formatting drift on untracked artifacts, and mandates deterministic, rationale-backed inline rule suppression syntax. Prevents broken config cascading, dead ESLint suppressions, and unanchored ignore comments.","antiPatternHeadline":"Ghost Toolchain Drift via Broken Biome Inheritance, Blind File Processing, and Reasonless Suppressions","stars_count":50,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","biome","biomejs","toolchain","linter","formatter","monorepo"],"exportEndpoints":{"claude":"/api/rules/biome-v1-9-config-inheritance-vcs-suppression-guardrail?format=claude","cursorMdc":"/api/rules/biome-v1-9-config-inheritance-vcs-suppression-guardrail?format=mdc","cursorrules":"/api/rules/biome-v1-9-config-inheritance-vcs-suppression-guardrail?format=cursor","windsurf":"/api/rules/biome-v1-9-config-inheritance-vcs-suppression-guardrail?format=windsurf","agents":"/api/rules/biome-v1-9-config-inheritance-vcs-suppression-guardrail?format=agents"}},{"id":"valkey-8-threaded-io-cluster-failover","title":"Valkey 8.0 Threaded I/O Configuration, Cluster Failover, and Lua Slot Invariants","category":"backend","severity":"critical","description":"Enforces strict cluster routing, hash-tag slot alignment, and resilient connection pooling under Valkey 8.0 multi-threaded I/O architectures. Guarantees atomic Lua script execution across cluster shards while preventing unhandled MOVED/ASK redirect storms and failover split-brain writes.","antiPatternHeadline":"Executing untagged multi-key operations and unhandled MOVED/ASK redirects across Valkey cluster shards.","stars_count":84,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","valkey","clustering","lua","distributed-cache","high-availability"],"exportEndpoints":{"claude":"/api/rules/valkey-8-threaded-io-cluster-failover?format=claude","cursorMdc":"/api/rules/valkey-8-threaded-io-cluster-failover?format=mdc","cursorrules":"/api/rules/valkey-8-threaded-io-cluster-failover?format=cursor","windsurf":"/api/rules/valkey-8-threaded-io-cluster-failover?format=windsurf","agents":"/api/rules/valkey-8-threaded-io-cluster-failover?format=agents"}},{"id":"hono-jsx-edge-streaming-pipeline","title":"Hono JSX Edge Streaming Pipelines and Non-Buffering Middleware Invariants","category":"frontend","severity":"critical","description":"Mandates true non-blocking stream composition in Hono JSX edge runtimes on Cloudflare Workers and Deno. Enforces the use of renderToReadableStream with Suspense boundaries, strict middleware header immutability before stream initiation, and memory-safe stream error propagation.","antiPatternHeadline":"Buffering Full JSX Trees into Edge Worker Heap and Mutating Headers Mid-Stream","stars_count":96,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","hono","jsx","streaming","edge","cloudflare-workers","deno"],"exportEndpoints":{"claude":"/api/rules/hono-jsx-edge-streaming-pipeline?format=claude","cursorMdc":"/api/rules/hono-jsx-edge-streaming-pipeline?format=mdc","cursorrules":"/api/rules/hono-jsx-edge-streaming-pipeline?format=cursor","windsurf":"/api/rules/hono-jsx-edge-streaming-pipeline?format=windsurf","agents":"/api/rules/hono-jsx-edge-streaming-pipeline?format=agents"}},{"id":"rr7-framework-hydration-single-fetch-standard","title":"React Router 7 Framework Mode Hydration & Single-Fetch Boundaries","category":"frontend","severity":"critical","description":"Governs hydration integrity, single-fetch streaming contracts, and route module typegen in React Router 7 Framework Mode. Mandates native turbo-stream promise passing over legacy defer wrappers, explicit clientLoader.hydrate execution flags, and generated Route type constraints.","antiPatternHeadline":"Using legacy Remix defer() wrappers, un-hydrated clientLoaders, and un-typed route exports that cause client-server serialization desynchronization and hydration mismatches.","stars_count":82,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-router-7","hydration","streaming","single-fetch","typegen"],"exportEndpoints":{"claude":"/api/rules/rr7-framework-hydration-single-fetch-standard?format=claude","cursorMdc":"/api/rules/rr7-framework-hydration-single-fetch-standard?format=mdc","cursorrules":"/api/rules/rr7-framework-hydration-single-fetch-standard?format=cursor","windsurf":"/api/rules/rr7-framework-hydration-single-fetch-standard?format=windsurf","agents":"/api/rules/rr7-framework-hydration-single-fetch-standard?format=agents"}},{"id":"biome-config-vcs-suppression-standard","title":"Biome 1.9 Configuration Inheritance, VCS Integration, and Explicit Rule Suppression","category":"frontend","severity":"critical","description":"Enforces deterministic Biome 1.9 configuration architecture across monorepos and isolated services. Mandates strict schema pinning, full VCS ignore delegation to avoid dual-configuration drift, and explicit, documented inline suppressions matching Biome's exact grammar.","antiPatternHeadline":"Fragmented configs, redundant ignore files, and unannotated or ESLint-style rule suppressions.","stars_count":85,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["biome","linter","formatter","tooling","frontend","typescript"],"exportEndpoints":{"claude":"/api/rules/biome-config-vcs-suppression-standard?format=claude","cursorMdc":"/api/rules/biome-config-vcs-suppression-standard?format=mdc","cursorrules":"/api/rules/biome-config-vcs-suppression-standard?format=cursor","windsurf":"/api/rules/biome-config-vcs-suppression-standard?format=windsurf","agents":"/api/rules/biome-config-vcs-suppression-standard?format=agents"}},{"id":"bun-sqlite-wal-s3-native-standard","title":"Bun 1.2 Embedded SQLite WAL & S3 Native Zero-Copy Streaming Invariants","category":"backend","severity":"critical","description":"Enforces high-throughput architectural patterns using Bun 1.2 native bun:sqlite and Bun.s3. Mandates strict WAL mode configuration with synchronous NORMAL pragmas, zero-copy buffer queries, and streaming multipart uploads directly via Bun.s3 client to prevent event loop starvation and heap bloat.","antiPatternHeadline":"Blocking disk I/O via default DELETE journal mode and buffering S3 payloads entirely in RAM","stars_count":76,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","sqlite","s3","wal","streaming","zero-copy"],"exportEndpoints":{"claude":"/api/rules/bun-sqlite-wal-s3-native-standard?format=claude","cursorMdc":"/api/rules/bun-sqlite-wal-s3-native-standard?format=mdc","cursorrules":"/api/rules/bun-sqlite-wal-s3-native-standard?format=cursor","windsurf":"/api/rules/bun-sqlite-wal-s3-native-standard?format=windsurf","agents":"/api/rules/bun-sqlite-wal-s3-native-standard?format=agents"}},{"id":"angular-19-signals-defer-guardrail","title":"Angular 19 Signals Architecture and Declarative Defer View Boundaries","category":"frontend","severity":"critical","description":"Enforces strict Angular 19 reactive primitives by prohibiting legacy Zone.js patterns and manual lifecycle synchronization. Mandates signal inputs, linkedSignal for resettable mutable state derivations, and strictly paired @defer blocks with deterministic placeholder and error boundaries. Guarantees reactive isolation and optimal incremental hydration.","antiPatternHeadline":"Mixing Zone-driven decorators, mutable input copies, and unguarded defer blocks","stars_count":61,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","angular","signals","angular19","defer-views","zoneless"],"exportEndpoints":{"claude":"/api/rules/angular-19-signals-defer-guardrail?format=claude","cursorMdc":"/api/rules/angular-19-signals-defer-guardrail?format=mdc","cursorrules":"/api/rules/angular-19-signals-defer-guardrail?format=cursor","windsurf":"/api/rules/angular-19-signals-defer-guardrail?format=windsurf","agents":"/api/rules/angular-19-signals-defer-guardrail?format=agents"}},{"id":"biome-vcs-inheritance-suppression-guardrails","title":"Biome 1.9 Deterministic Configuration, VCS Integration, and Suppression Protocol","category":"frontend","severity":"critical","description":"Mandates deterministic single-binary linting and formatting via Biome 1.9 configuration standards. Enforces native VCS ignore file inheritance, strict JSON schema validation, and structured inline suppression syntax with mandatory explanations to eliminate configuration drift and unvetted rule bypasses.","antiPatternHeadline":"Unanchored Biome Configuration, Redundant Ignore Lists, and Unexplained Suppression Comments","stars_count":114,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","biome","linter","formatter","tooling","typescript"],"exportEndpoints":{"claude":"/api/rules/biome-vcs-inheritance-suppression-guardrails?format=claude","cursorMdc":"/api/rules/biome-vcs-inheritance-suppression-guardrails?format=mdc","cursorrules":"/api/rules/biome-vcs-inheritance-suppression-guardrails?format=cursor","windsurf":"/api/rules/biome-vcs-inheritance-suppression-guardrails?format=windsurf","agents":"/api/rules/biome-vcs-inheritance-suppression-guardrails?format=agents"}},{"id":"tanstack-start-ssr-streaming-search-params-standard","title":"TanStack Start Invariants: Type-Safe Search Params, Server Functions, and Deferred Streaming","category":"frontend","severity":"critical","description":"Mandates strict schema-validated search parameters, isolated server functions via createServerFn, and explicit stream deferral via defer() and Await for non-critical loader promises in TanStack Start SSR. Violating these patterns degrades Time to First Byte (TTFB), causes hydration mismatches, and risks leaking server secrets to the client bundle.","antiPatternHeadline":"Blocking TTFB via Monolithic Loaders and Bypassing Search Param Schema Validation","stars_count":94,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["tanstack-router","tanstack-start","ssr","streaming","search-params","typescript"],"exportEndpoints":{"claude":"/api/rules/tanstack-start-ssr-streaming-search-params-standard?format=claude","cursorMdc":"/api/rules/tanstack-start-ssr-streaming-search-params-standard?format=mdc","cursorrules":"/api/rules/tanstack-start-ssr-streaming-search-params-standard?format=cursor","windsurf":"/api/rules/tanstack-start-ssr-streaming-search-params-standard?format=windsurf","agents":"/api/rules/tanstack-start-ssr-streaming-search-params-standard?format=agents"}},{"id":"tanstack-virtual-v3-dynamic-measurement-and-containment","title":"TanStack Virtual 3.0 Dynamic Windowing, Measurement Containment, and DOM Node Management","category":"frontend","severity":"critical","description":"Enforces strict DOM node containment, layout thrashing prevention, and correct dynamic height measuring patterns when using TanStack Virtual v3. Mandates accurate ref attachments, CSS containment isolation, and proper scroll margins to prevent recursive recalculations and browser frame drops in massive virtualized tables.","antiPatternHeadline":"Attaching Dynamic Measurement Callbacks Without Layout Containment Causing Forced Reflow Loops and Node Bloat","stars_count":105,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","tanstack-virtual","virtualization","react","performance","layout-containment"],"exportEndpoints":{"claude":"/api/rules/tanstack-virtual-v3-dynamic-measurement-and-containment?format=claude","cursorMdc":"/api/rules/tanstack-virtual-v3-dynamic-measurement-and-containment?format=mdc","cursorrules":"/api/rules/tanstack-virtual-v3-dynamic-measurement-and-containment?format=cursor","windsurf":"/api/rules/tanstack-virtual-v3-dynamic-measurement-and-containment?format=windsurf","agents":"/api/rules/tanstack-virtual-v3-dynamic-measurement-and-containment?format=agents"}},{"id":"lexical-immutable-node-transforms-and-serialization-guardrails","title":"Lexical Immutable Node Transforms, Selection Reconciliation, and Headless Markdown Serialization","category":"frontend","severity":"critical","description":"Enforces strict immutability, selection reconciliation, and node registry completeness across Meta Lexical document pipelines. Prevents direct AST mutations without write locks, eliminates cursor jumping during batched node transforms, and guarantees lossless headless Markdown serialization.","antiPatternHeadline":"Mutating Unlocked Lexical Nodes, Dropping Active Selections, and Running Headless Markdown Transforms Without Registered Nodes","stars_count":63,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","lexical","rich-text","markdown","headless","typescript"],"exportEndpoints":{"claude":"/api/rules/lexical-immutable-node-transforms-and-serialization-guardrails?format=claude","cursorMdc":"/api/rules/lexical-immutable-node-transforms-and-serialization-guardrails?format=mdc","cursorrules":"/api/rules/lexical-immutable-node-transforms-and-serialization-guardrails?format=cursor","windsurf":"/api/rules/lexical-immutable-node-transforms-and-serialization-guardrails?format=windsurf","agents":"/api/rules/lexical-immutable-node-transforms-and-serialization-guardrails?format=agents"}},{"id":"biome-vcs-config-deterministic-suppression-standard","title":"Biome 1.9 Configuration Inheritance, VCS Integration, and Explicit Rule Suppression Guardrail","category":"frontend","severity":"critical","description":"Enforces deterministic configuration patterns in Biome 1.9+, mandating native VCS integration via git ignore files, explicit configuration inheritance overrides, and strictly reasoned inline rule suppressions. Prevents CI/CD drift caused by unversioned ignore lists, unreasoned disable comments, and fragmented toolchain execution.","antiPatternHeadline":"Unanchored ignores, fragmented linter configurations, and unreasoned inline rule suppressions bypassing CI deterministic checks.","stars_count":102,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","biome","linter","formatter","tooling","ci-cd"],"exportEndpoints":{"claude":"/api/rules/biome-vcs-config-deterministic-suppression-standard?format=claude","cursorMdc":"/api/rules/biome-vcs-config-deterministic-suppression-standard?format=mdc","cursorrules":"/api/rules/biome-vcs-config-deterministic-suppression-standard?format=cursor","windsurf":"/api/rules/biome-vcs-config-deterministic-suppression-standard?format=windsurf","agents":"/api/rules/biome-vcs-config-deterministic-suppression-standard?format=agents"}},{"id":"hono-jsx-edge-stream-pipeline-guardrail","title":"Hono JSX Edge Streaming Pipelines and Non-Buffering Middleware Invariant","category":"frontend","severity":"critical","description":"Enforces non-buffering, progressive chunked HTML streaming using Hono JSX and Suspense across Cloudflare Workers and Deno edge runtimes. Prevents edge TTFB degradation, out-of-memory worker terminates, and invalid post-flush header mutation in downstream middleware pipelines.","antiPatternHeadline":"Buffering JSX to String and Mutating Response Headers Post-Stream Flush in Edge Middleware","stars_count":111,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","hono","hono-jsx","cloudflare-workers","edge-streaming","deno"],"exportEndpoints":{"claude":"/api/rules/hono-jsx-edge-stream-pipeline-guardrail?format=claude","cursorMdc":"/api/rules/hono-jsx-edge-stream-pipeline-guardrail?format=mdc","cursorrules":"/api/rules/hono-jsx-edge-stream-pipeline-guardrail?format=cursor","windsurf":"/api/rules/hono-jsx-edge-stream-pipeline-guardrail?format=windsurf","agents":"/api/rules/hono-jsx-edge-stream-pipeline-guardrail?format=agents"}},{"id":"valkey-8-cluster-slot-atomicity-failover","title":"Valkey 8.0 Cluster Hash Tagging, Redirection & Failover Invariants","category":"backend","severity":"critical","description":"Valkey 8.0 leverages multi-threaded I/O for socket processing while enforcing single-threaded command determinism across 16,384 cluster slots. Distributed systems targeting Valkey Cluster MUST enforce hash tagging for multi-key operations and Lua scripts to prevent CROSSSLOT errors, and MUST handle MOVED/ASK redirections with managed topology refreshes during master failover.","antiPatternHeadline":"Un-tagged Multi-Key Operations and Unbounded Redirection Failures During Cluster Failover","stars_count":91,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","valkey","cluster","distributed-caching","redis-compatible","high-availability"],"exportEndpoints":{"claude":"/api/rules/valkey-8-cluster-slot-atomicity-failover?format=claude","cursorMdc":"/api/rules/valkey-8-cluster-slot-atomicity-failover?format=mdc","cursorrules":"/api/rules/valkey-8-cluster-slot-atomicity-failover?format=cursor","windsurf":"/api/rules/valkey-8-cluster-slot-atomicity-failover?format=windsurf","agents":"/api/rules/valkey-8-cluster-slot-atomicity-failover?format=agents"}},{"id":"tanstack-virtual-3-windowing-performance","title":"TanStack Virtual 3.0 Dynamic Measurement, Scroll Containment, and DOM Saturation Guardrails","category":"frontend","severity":"critical","description":"Enforces strict performance invariants for TanStack Virtual 3.0 in high-density tables and lists. Prevents layout thrashing, DOM node saturation, and measurement jitter by requiring continuous measurement containment, transform-based positioning, and explicit scroll margin offsets. Mandates non-reactive scroll containers, stable item keys, and proper teardown of resize observers.","antiPatternHeadline":"Uncontained Dynamic Layout Thrashing and Render-Time Item Measurement Cascades","stars_count":62,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react","tanstack-virtual","performance","windowing","dom-optimization"],"exportEndpoints":{"claude":"/api/rules/tanstack-virtual-3-windowing-performance?format=claude","cursorMdc":"/api/rules/tanstack-virtual-3-windowing-performance?format=mdc","cursorrules":"/api/rules/tanstack-virtual-3-windowing-performance?format=cursor","windsurf":"/api/rules/tanstack-virtual-3-windowing-performance?format=windsurf","agents":"/api/rules/tanstack-virtual-3-windowing-performance?format=agents"}},{"id":"lexical-headless-transform-reconciliation-standard","title":"Lexical Immutable Node Transforms, Headless Serialization, and Selection Reconciliation","category":"frontend","severity":"critical","description":"Enforces Lexical double-buffered EditorState immutability invariants by strictly requiring node.getWritable() inside active update batches, idempotent transform hooks to prevent infinite cascade loops, and isomorphic node registration for headless serialization.","antiPatternHeadline":"Direct In-Place Node Property Mutation and Unbounded Transform Loops in Lexical Pipelines","stars_count":98,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","lexical","rich-text","headless","ast","serialization"],"exportEndpoints":{"claude":"/api/rules/lexical-headless-transform-reconciliation-standard?format=claude","cursorMdc":"/api/rules/lexical-headless-transform-reconciliation-standard?format=mdc","cursorrules":"/api/rules/lexical-headless-transform-reconciliation-standard?format=cursor","windsurf":"/api/rules/lexical-headless-transform-reconciliation-standard?format=windsurf","agents":"/api/rules/lexical-headless-transform-reconciliation-standard?format=agents"}},{"id":"axum-0-8-state-tower-guardrails","title":"Axum 0.8 Type-Safe State Extractors & Tower Middleware Invariants","category":"backend","severity":"critical","description":"Enforces Axum 0.8 compile-time type-safe state access via FromRef sub-states rather than fallible dynamic Extension extractors. Mandates defensive Tower middleware ordering with CatchPanicLayer and structured custom rejection handlers to ensure zero unhandled panics or degraded error telemetry.","antiPatternHeadline":"Dynamic Extension Extraction and Unprotected Tower Pipelines Yielding Runtime Panics","stars_count":71,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tower","tokio","type-safety","middleware"],"exportEndpoints":{"claude":"/api/rules/axum-0-8-state-tower-guardrails?format=claude","cursorMdc":"/api/rules/axum-0-8-state-tower-guardrails?format=mdc","cursorrules":"/api/rules/axum-0-8-state-tower-guardrails?format=cursor","windsurf":"/api/rules/axum-0-8-state-tower-guardrails?format=windsurf","agents":"/api/rules/axum-0-8-state-tower-guardrails?format=agents"}},{"id":"react-router-7-hydration-single-fetch-guardrails","title":"React Router 7 Framework Mode Hydration & Single-Fetch Boundaries","category":"frontend","severity":"critical","description":"Enforces architectural invariants for React Router 7 framework mode hydration, strictly governing typegen route module typing, turbo-stream single-fetch data boundaries, and clientLoader hydration lifecycles. Prevents hydration mismatches, unhandled streaming promise rejections, and invalid clientLoader cache collisions.","antiPatternHeadline":"Bypassing Route Module Typegen, Returning Legacy json() Wrappers in Single Fetch, and Misconfiguring clientLoader.hydrate","stars_count":64,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-router-7","remix","hydration","single-fetch","typegen","typescript"],"exportEndpoints":{"claude":"/api/rules/react-router-7-hydration-single-fetch-guardrails?format=claude","cursorMdc":"/api/rules/react-router-7-hydration-single-fetch-guardrails?format=mdc","cursorrules":"/api/rules/react-router-7-hydration-single-fetch-guardrails?format=cursor","windsurf":"/api/rules/react-router-7-hydration-single-fetch-guardrails?format=windsurf","agents":"/api/rules/react-router-7-hydration-single-fetch-guardrails?format=agents"}},{"id":"tanstack-virtual-v3-measurement-containment-standard","title":"TanStack Virtual 3.0 Dynamic Measurement, Scroll Containment, and DOM Saturation Defense","category":"frontend","severity":"critical","description":"Enforces strict DOM node count containment, deterministic dynamic element measurement, and layout shift mitigation when virtualizing large datasets using @tanstack/react-virtual v3. Mandates non-blocking resize observation, ref-based measurement attachment, and hardware-accelerated transforms to prevent forced synchronous reflows and memory leaks in enterprise grid tables.","antiPatternHeadline":"Unmeasured Dynamic Rows with Layout Shifts, Missing Ref Attachments, and Excessive Overscan DOM Node Saturation","stars_count":58,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","tanstack-virtual","react","performance","virtualization","dom-node-containment"],"exportEndpoints":{"claude":"/api/rules/tanstack-virtual-v3-measurement-containment-standard?format=claude","cursorMdc":"/api/rules/tanstack-virtual-v3-measurement-containment-standard?format=mdc","cursorrules":"/api/rules/tanstack-virtual-v3-measurement-containment-standard?format=cursor","windsurf":"/api/rules/tanstack-virtual-v3-measurement-containment-standard?format=windsurf","agents":"/api/rules/tanstack-virtual-v3-measurement-containment-standard?format=agents"}},{"id":"lexical-headless-engine-transforms-and-serialization","title":"Lexical Headless State Immutability, Node Transforms, and Markdown Serialization Guardrails","category":"frontend","severity":"critical","description":"Enforces strict immutability patterns in Meta Lexical node transforms, safe selection reconciliation during state updates, and deterministic AST-based headless markdown serialization. Prevents infinite transform loops, silent state desynchronization, and corrupted text selections in client and server-side document pipelines.","antiPatternHeadline":"Mutating Lexical Nodes Directly Outside getWritable(), Triggering Unbounded Transform Loops, or Serializing Non-Normalized ASTs Headless","stars_count":45,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","lexical","rich-text","ast","headless","typescript"],"exportEndpoints":{"claude":"/api/rules/lexical-headless-engine-transforms-and-serialization?format=claude","cursorMdc":"/api/rules/lexical-headless-engine-transforms-and-serialization?format=mdc","cursorrules":"/api/rules/lexical-headless-engine-transforms-and-serialization?format=cursor","windsurf":"/api/rules/lexical-headless-engine-transforms-and-serialization?format=windsurf","agents":"/api/rules/lexical-headless-engine-transforms-and-serialization?format=agents"}},{"id":"axum-08-state-tower-service-invariants","title":"Axum 0.8 Type-Safe State Extractors and Resilient Tower Middleware Stack","category":"backend","severity":"critical","description":"Enforces strict type safety and subtyping for Axum 0.8 State extractors using FromRef, paired with panic-free Tower middleware composition. Mandates CatchPanicLayer boundary encapsulation, explicit error conversion into Response types, and zero unhandled extractor mismatches at compile time.","antiPatternHeadline":"Monolithic Untyped State Extraction with Fragile Middleware Ordering and Unhandled Panic Rejections","stars_count":50,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tower","middleware","concurrency"],"exportEndpoints":{"claude":"/api/rules/axum-08-state-tower-service-invariants?format=claude","cursorMdc":"/api/rules/axum-08-state-tower-service-invariants?format=mdc","cursorrules":"/api/rules/axum-08-state-tower-service-invariants?format=cursor","windsurf":"/api/rules/axum-08-state-tower-service-invariants?format=windsurf","agents":"/api/rules/axum-08-state-tower-service-invariants?format=agents"}},{"id":"go-chi-v5-middleware-graceful-shutdown-standard","title":"Chi v5 Router Composition, Context Cancellation, and Graceful Shutdown","category":"backend","severity":"critical","description":"Enforces deterministic HTTP server lifecycles, sub-router isolation, and context-cancellation propagation in Go Chi v5 microservices. Mandates signal-driven shutdown deadlines with http.ErrServerClosed handling and prevents goroutine or database connection leaks across downstream I/O boundaries.","antiPatternHeadline":"Unbounded HTTP servers lacking SIGTERM shutdown deadlines and ignoring request context cancellation in sub-router handlers.","stars_count":73,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","chi","http","concurrency","graceful-shutdown"],"exportEndpoints":{"claude":"/api/rules/go-chi-v5-middleware-graceful-shutdown-standard?format=claude","cursorMdc":"/api/rules/go-chi-v5-middleware-graceful-shutdown-standard?format=mdc","cursorrules":"/api/rules/go-chi-v5-middleware-graceful-shutdown-standard?format=cursor","windsurf":"/api/rules/go-chi-v5-middleware-graceful-shutdown-standard?format=windsurf","agents":"/api/rules/go-chi-v5-middleware-graceful-shutdown-standard?format=agents"}},{"id":"tailwind-v4-css-first-theme-directives-standard","title":"Tailwind CSS v4 CSS-First Architecture & @theme Directive Enforcement","category":"frontend","severity":"critical","description":"Tailwind CSS v4 replaces JavaScript-based configuration (tailwind.config.js) with native CSS-first configuration via @theme blocks and CSS variables. Developers must configure tokens directly in stylesheets using standard CSS semantics and modern color functions (e.g., oklch, color-mix) rather than deprecated JavaScript configuration objects or legacy opacity hacks.","antiPatternHeadline":"Configuring Tailwind tokens in tailwind.config.js or using legacy v3 alpha-value CSS variable interpolation hacks","stars_count":96,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","tailwind-v4","css","design-tokens","theme"],"exportEndpoints":{"claude":"/api/rules/tailwind-v4-css-first-theme-directives-standard?format=claude","cursorMdc":"/api/rules/tailwind-v4-css-first-theme-directives-standard?format=mdc","cursorrules":"/api/rules/tailwind-v4-css-first-theme-directives-standard?format=cursor","windsurf":"/api/rules/tailwind-v4-css-first-theme-directives-standard?format=windsurf","agents":"/api/rules/tailwind-v4-css-first-theme-directives-standard?format=agents"}},{"id":"hono-jsx-edge-stream-pipelines","title":"Hono JSX Edge Streaming Pipelines and Non-Blocking Middleware Guards","category":"frontend","severity":"critical","description":"Enforces non-blocking, memory-bounded chunked streaming architectures for Hono JSX applications running on Cloudflare Workers and Deno Deploy. Prohibits full-response buffering in edge middleware, mandates proper use of `streamText` and `renderToReadableStream`, and ensures backpressure handling across nested async JSX suspense boundaries.","antiPatternHeadline":"Buffering whole HTML payloads in middleware or using synchronous JSX rendering for I/O-bound edge components","stars_count":61,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","hono","jsx","streaming","cloudflare-workers","deno","edge"],"exportEndpoints":{"claude":"/api/rules/hono-jsx-edge-stream-pipelines?format=claude","cursorMdc":"/api/rules/hono-jsx-edge-stream-pipelines?format=mdc","cursorrules":"/api/rules/hono-jsx-edge-stream-pipelines?format=cursor","windsurf":"/api/rules/hono-jsx-edge-stream-pipelines?format=windsurf","agents":"/api/rules/hono-jsx-edge-stream-pipelines?format=agents"}},{"id":"lexical-immutable-transforms-headless-serialization-standard","title":"Lexical Immutable Transforms, Selection Invariants, and Headless Serialization","category":"frontend","severity":"critical","description":"Enforces strict node immutability, safe writable cloning, and loop-invariant node transforms in Meta Lexical. Mandates resilient selection preservation during AST reconciliation and guarantees deterministic, crash-safe headless markdown serialization across worker and SSR runtimes.","antiPatternHeadline":"Direct In-Memory Node Mutation, Unguarded Transform Recursion, and Headless Selection Null-Pointers","stars_count":66,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","lexical","rich-text","ast","headless","markdown","serialization"],"exportEndpoints":{"claude":"/api/rules/lexical-immutable-transforms-headless-serialization-standard?format=claude","cursorMdc":"/api/rules/lexical-immutable-transforms-headless-serialization-standard?format=mdc","cursorrules":"/api/rules/lexical-immutable-transforms-headless-serialization-standard?format=cursor","windsurf":"/api/rules/lexical-immutable-transforms-headless-serialization-standard?format=windsurf","agents":"/api/rules/lexical-immutable-transforms-headless-serialization-standard?format=agents"}},{"id":"rust-axum-state-and-tower-composition","title":"Axum 0.8 Type-Safe State Sub-typing and Tower Panic Boundary Invariants","category":"backend","severity":"critical","description":"Enforce compile-time type-safe state injection via Axum's FromRef pattern across nested routers and guarantee zero unhandled runtime panics using Tower CatchPanicLayer middleware. Handlers must consume state via cloned aggregates or derived sub-states, and must never rely on process-terminating unwraps or loose dynamic state containers.","antiPatternHeadline":"Nested Routers Missing FromRef Implementations and Naked Tower Middleware Stacks Leaking Panics","stars_count":56,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["rust","axum","tower","backend","type-safety","async"],"exportEndpoints":{"claude":"/api/rules/rust-axum-state-and-tower-composition?format=claude","cursorMdc":"/api/rules/rust-axum-state-and-tower-composition?format=mdc","cursorrules":"/api/rules/rust-axum-state-and-tower-composition?format=cursor","windsurf":"/api/rules/rust-axum-state-and-tower-composition?format=windsurf","agents":"/api/rules/rust-axum-state-and-tower-composition?format=agents"}},{"id":"lexical-node-transforms-and-headless-reconciliation-standard","title":"Lexical Immutable Node Transforms, Selection Reconciliation, and Headless Markdown Serialization Guardrails","category":"frontend","severity":"critical","description":"Lexical enforces strict editor state immutability via clone-on-write dirty-tracking mechanisms. Mutating node properties without $getWritable(), bypassing node replacement registrations during transforms, or modifying tree structures without explicitly reconciling active RangeSelection leads to DOM synchronization failure and document corruption. In headless server-side contexts, executing markdown serialization without properly registering registered custom node schemas inside an isolated headless instance creates divergent AST outputs and runtime memory leaks.","antiPatternHeadline":"Direct In-Place Node Property Mutation, Unreconciled Range Selection Collapsing, and DOM-Leaking Headless Serialization","stars_count":83,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","lexical","rich-text","headless-editor","markdown","immutability"],"exportEndpoints":{"claude":"/api/rules/lexical-node-transforms-and-headless-reconciliation-standard?format=claude","cursorMdc":"/api/rules/lexical-node-transforms-and-headless-reconciliation-standard?format=mdc","cursorrules":"/api/rules/lexical-node-transforms-and-headless-reconciliation-standard?format=cursor","windsurf":"/api/rules/lexical-node-transforms-and-headless-reconciliation-standard?format=windsurf","agents":"/api/rules/lexical-node-transforms-and-headless-reconciliation-standard?format=agents"}},{"id":"biome-configuration-vcs-suppression-guardrail","title":"Deterministic Biome 1.9 Configuration Inheritance, VCS Sync, and Rule Suppression","category":"frontend","severity":"critical","description":"Enforces strict configuration architecture, deterministic VCS integration, and explanatory suppression syntax for Biome 1.9 in enterprise monorepos. Mandates the use of Biome's native VCS ignore resolution to eliminate drift between Git and Biome, enforces structured suppression syntax with mandatory human-readable justifications, and standardizes configuration inheritance across package boundaries.","antiPatternHeadline":"Leaking Legacy ESLint Suppressions, Bypassing VCS Ignore Synchronization, and Using Unjustified Biome Suppressions","stars_count":79,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","biome","linter","formatter","monorepo","code-quality"],"exportEndpoints":{"claude":"/api/rules/biome-configuration-vcs-suppression-guardrail?format=claude","cursorMdc":"/api/rules/biome-configuration-vcs-suppression-guardrail?format=mdc","cursorrules":"/api/rules/biome-configuration-vcs-suppression-guardrail?format=cursor","windsurf":"/api/rules/biome-configuration-vcs-suppression-guardrail?format=windsurf","agents":"/api/rules/biome-configuration-vcs-suppression-guardrail?format=agents"}},{"id":"react-router-7-hydration-single-fetch-boundaries","title":"React Router 7 Framework Mode Hydration, Typegen & Single-Fetch Guardrails","category":"frontend","severity":"critical","description":"Enforces strict data boundaries, serialization invariants, and typegen alignment in React Router 7 framework mode. Prevents hydration mismatches and broken streaming pipelines caused by misconfigured clientLoader.hydrate flags, unhandled non-deferred promises in single-fetch mode, and manual route loader typing.","antiPatternHeadline":"Bypassing Route Typegen, Misconfiguring clientLoader.hydrate, and Leaking Raw Promises across Single-Fetch Boundaries","stars_count":89,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-router-v7","remix","hydration","single-fetch","streaming"],"exportEndpoints":{"claude":"/api/rules/react-router-7-hydration-single-fetch-boundaries?format=claude","cursorMdc":"/api/rules/react-router-7-hydration-single-fetch-boundaries?format=mdc","cursorrules":"/api/rules/react-router-7-hydration-single-fetch-boundaries?format=cursor","windsurf":"/api/rules/react-router-7-hydration-single-fetch-boundaries?format=windsurf","agents":"/api/rules/react-router-7-hydration-single-fetch-boundaries?format=agents"}},{"id":"lexical-node-transforms-and-headless-serialization-invariants","title":"Lexical Immutable Node Transforms, Selection Reconciliation, and Headless Serialization","category":"frontend","severity":"critical","description":"Enforces architectural invariants in Meta Lexical engines, requiring absolute node immutability via getWritable(), strictly idempotent node transform loops to prevent reconciliation cascades, and isomorphic transformer registration in headless markdown pipelines.","antiPatternHeadline":"Mutating Lexical nodes outside getWritable, triggering infinite transform cascades, or running headless serialization without matching node schemas.","stars_count":49,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","lexical","rich-text","markdown","react","typescript"],"exportEndpoints":{"claude":"/api/rules/lexical-node-transforms-and-headless-serialization-invariants?format=claude","cursorMdc":"/api/rules/lexical-node-transforms-and-headless-serialization-invariants?format=mdc","cursorrules":"/api/rules/lexical-node-transforms-and-headless-serialization-invariants?format=cursor","windsurf":"/api/rules/lexical-node-transforms-and-headless-serialization-invariants?format=windsurf","agents":"/api/rules/lexical-node-transforms-and-headless-serialization-invariants?format=agents"}},{"id":"tanstack-start-router-ssr-streaming-guardrail","title":"TanStack Start & Fullstack Router SSR: Type-Safe Search Params & Deferred Data Streaming","category":"frontend","severity":"critical","description":"Enforces strict type safety and streaming invariants in TanStack Start and TanStack Router fullstack SSR applications. Mandates runtime validation for search parameters using Zod/Valibot schemas, distinguishes non-critical promises using `defer()` wrapped in `<Await>` boundaries, and forbids direct loader client waterfalls or non-serializable SSR state leakage.","antiPatternHeadline":"Unvalidated search params with blocking SSR waterfalls and raw promise leaks in loaders","stars_count":114,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","tanstack-start","tanstack-router","ssr","streaming","search-params","typescript"],"exportEndpoints":{"claude":"/api/rules/tanstack-start-router-ssr-streaming-guardrail?format=claude","cursorMdc":"/api/rules/tanstack-start-router-ssr-streaming-guardrail?format=mdc","cursorrules":"/api/rules/tanstack-start-router-ssr-streaming-guardrail?format=cursor","windsurf":"/api/rules/tanstack-start-router-ssr-streaming-guardrail?format=windsurf","agents":"/api/rules/tanstack-start-router-ssr-streaming-guardrail?format=agents"}},{"id":"hono-jsx-edge-stream-pipeline-standard","title":"Hono JSX Edge Streaming Pipelines and Non-Blocking Chunk Composition","category":"frontend","severity":"critical","description":"Mandates asynchronous streaming of Hono JSX using renderToReadableStream across edge runtimes like Cloudflare Workers and Deno. Enforces immutable header commitment prior to stream dispatch and requires encapsulated Suspense error boundaries to prevent edge process termination during streaming chunk failures.","antiPatternHeadline":"Buffering Full Async JSX Trees in Edge Memory or Mutating HTTP Headers Post-Stream Initiation","stars_count":56,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","hono","jsx","streaming","cloudflare-workers","edge"],"exportEndpoints":{"claude":"/api/rules/hono-jsx-edge-stream-pipeline-standard?format=claude","cursorMdc":"/api/rules/hono-jsx-edge-stream-pipeline-standard?format=mdc","cursorrules":"/api/rules/hono-jsx-edge-stream-pipeline-standard?format=cursor","windsurf":"/api/rules/hono-jsx-edge-stream-pipeline-standard?format=windsurf","agents":"/api/rules/hono-jsx-edge-stream-pipeline-standard?format=agents"}},{"id":"tanstack-virtual-dynamic-measurement-containment","title":"TanStack Virtual 3.0 Dynamic Measurement and Layout Containment Standard","category":"frontend","severity":"critical","description":"Enforces strict DOM node containment, GPU-accelerated absolute transforms, and non-thrashing dynamic element measurement for @tanstack/react-virtual 3.0. Prevents catastrophic layout recalculations and main-thread freezing in high-density tables and lists with variable-height cells.","antiPatternHeadline":"Dynamic Element Re-rendering with Uncontained Offsets and Inline Height Recalculation Thrashing","stars_count":88,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react","tanstack-virtual","virtualization","performance"],"exportEndpoints":{"claude":"/api/rules/tanstack-virtual-dynamic-measurement-containment?format=claude","cursorMdc":"/api/rules/tanstack-virtual-dynamic-measurement-containment?format=mdc","cursorrules":"/api/rules/tanstack-virtual-dynamic-measurement-containment?format=cursor","windsurf":"/api/rules/tanstack-virtual-dynamic-measurement-containment?format=windsurf","agents":"/api/rules/tanstack-virtual-dynamic-measurement-containment?format=agents"}},{"id":"axum-0-8-state-tower-resilience","title":"Axum 0.8 Type-Safe State, Tower Middleware Invariants, and Panic Isolation","category":"backend","severity":"critical","description":"Mandates type-safe State and FromRef extraction over dynamic Extensions, strictly enforces extractor parameter ordering where body-consuming extractors must be terminal, and guarantees zero unhandled connection drops via Tower CatchPanicLayer and typed rejections.","antiPatternHeadline":"Untyped runtime extensions, inverted handler extractor ordering, and missing panic layers that terminate HTTP connections abruptly.","stars_count":76,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tower","middleware","async"],"exportEndpoints":{"claude":"/api/rules/axum-0-8-state-tower-resilience?format=claude","cursorMdc":"/api/rules/axum-0-8-state-tower-resilience?format=mdc","cursorrules":"/api/rules/axum-0-8-state-tower-resilience?format=cursor","windsurf":"/api/rules/axum-0-8-state-tower-resilience?format=windsurf","agents":"/api/rules/axum-0-8-state-tower-resilience?format=agents"}},{"id":"react-router-7-framework-hydration-single-fetch","title":"React Router 7 Framework Mode: Hydration, ClientLoader Streaming, and Single-Fetch Typegen Guardrails","category":"frontend","severity":"critical","description":"Enforces single-fetch data semantics, automatic turbo-stream promise streaming, and explicit clientLoader hydration boundaries in React Router 7 framework mode. Prohibits legacy Remix json()/defer() response wrappers and untyped loader signatures, eliminating hydration mismatches, double-fetching, and serialization breakage.","antiPatternHeadline":"Using Legacy json()/defer() Wrappers, Untyped Route Signatures, and Misconfigured clientLoader Hydration Boundaries","stars_count":92,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-router-7","remix","hydration","single-fetch","typegen","streaming"],"exportEndpoints":{"claude":"/api/rules/react-router-7-framework-hydration-single-fetch?format=claude","cursorMdc":"/api/rules/react-router-7-framework-hydration-single-fetch?format=mdc","cursorrules":"/api/rules/react-router-7-framework-hydration-single-fetch?format=cursor","windsurf":"/api/rules/react-router-7-framework-hydration-single-fetch?format=windsurf","agents":"/api/rules/react-router-7-framework-hydration-single-fetch?format=agents"}},{"id":"lexical-node-transforms-selection-headless-serialization","title":"Lexical Immutable Node Transforms, Selection Reconciliation, and Headless Serialization Guardrails","category":"frontend","severity":"critical","description":"Enforces strict immutability invariants during Lexical node transformations, guarantees selection point reconciliation during node replacement, and prevents silent state drops in headless Markdown serialization pipelines by enforcing node registration symmetry.","antiPatternHeadline":"Direct Node Mutation, Stale Selection Pointer Desynchronization, and Unregistered Headless Markdown Transformers","stars_count":107,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","lexical","rich-text","markdown","react","headless-editor"],"exportEndpoints":{"claude":"/api/rules/lexical-node-transforms-selection-headless-serialization?format=claude","cursorMdc":"/api/rules/lexical-node-transforms-selection-headless-serialization?format=mdc","cursorrules":"/api/rules/lexical-node-transforms-selection-headless-serialization?format=cursor","windsurf":"/api/rules/lexical-node-transforms-selection-headless-serialization?format=windsurf","agents":"/api/rules/lexical-node-transforms-selection-headless-serialization?format=agents"}},{"id":"hono-jsx-edge-streaming-pipeline-production-standard","title":"Mandating Chunked Suspense Streaming & Non-Buffering Hono JSX at the Edge","category":"frontend","severity":"critical","description":"Enforces non-buffering, asynchronous chunked rendering using Hono JSX and edge stream pipelines across Cloudflare Workers and Deno. Eliminates edge runtime memory exhaustion (OOM) and catastrophic Time-to-First-Byte (TTFB) latency caused by synchronous tree buffering and un-suspended async edge components.","antiPatternHeadline":"Buffering Asynchronous JSX In-Memory via Synchronous renderToString() at the Edge","stars_count":83,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","hono","edge-computing","cloudflare-workers","deno","jsx-streaming","suspense"],"exportEndpoints":{"claude":"/api/rules/hono-jsx-edge-streaming-pipeline-production-standard?format=claude","cursorMdc":"/api/rules/hono-jsx-edge-streaming-pipeline-production-standard?format=mdc","cursorrules":"/api/rules/hono-jsx-edge-streaming-pipeline-production-standard?format=cursor","windsurf":"/api/rules/hono-jsx-edge-streaming-pipeline-production-standard?format=windsurf","agents":"/api/rules/hono-jsx-edge-streaming-pipeline-production-standard?format=agents"}},{"id":"react-router-7-hydration-typegen-single-fetch-guardrail","title":"React Router 7 Framework Mode Hydration, Typegen & Single-Fetch Invariants","category":"frontend","severity":"critical","description":"Enforces strict hydration boundaries, Single Fetch TurboStream serialization, and native Route Typegen contracts in React Router 7 framework mode. Prevents hydration mismatches, double-fetch cascades, broken promise streaming, and legacy Remix migration regressions.","antiPatternHeadline":"Bypassing Route Typegen, Misconfiguring clientLoader Hydration Flags, and Using Deprecated defer() in React Router 7","stars_count":52,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-router-7","hydration","streaming","single-fetch","typegen","remix"],"exportEndpoints":{"claude":"/api/rules/react-router-7-hydration-typegen-single-fetch-guardrail?format=claude","cursorMdc":"/api/rules/react-router-7-hydration-typegen-single-fetch-guardrail?format=mdc","cursorrules":"/api/rules/react-router-7-hydration-typegen-single-fetch-guardrail?format=cursor","windsurf":"/api/rules/react-router-7-hydration-typegen-single-fetch-guardrail?format=windsurf","agents":"/api/rules/react-router-7-hydration-typegen-single-fetch-guardrail?format=agents"}},{"id":"tanstack-virtual-dynamic-measurement-saturation-prevention","title":"TanStack Virtual 3.0 Invariants: Dynamic Measurement, Data-Index Binding, and DOM Containment","category":"frontend","severity":"critical","description":"Enforces strict DOM node containment, dynamic height measurement invariants, and GPU-composited positioning for TanStack Virtual 3.0. Prevents layout thrashing, infinite measurement cycles, and DOM node saturation in massive multi-thousand-row tables. Mandates deterministic data-index attribution and hardware-accelerated transform offsets.","antiPatternHeadline":"Missing data-index Attribute on Dynamic Measurement Nodes Inducing Measurement Thrashing and DOM Node Saturation","stars_count":84,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","tanstack-virtual","performance","react","virtualization"],"exportEndpoints":{"claude":"/api/rules/tanstack-virtual-dynamic-measurement-saturation-prevention?format=claude","cursorMdc":"/api/rules/tanstack-virtual-dynamic-measurement-saturation-prevention?format=mdc","cursorrules":"/api/rules/tanstack-virtual-dynamic-measurement-saturation-prevention?format=cursor","windsurf":"/api/rules/tanstack-virtual-dynamic-measurement-saturation-prevention?format=windsurf","agents":"/api/rules/tanstack-virtual-dynamic-measurement-saturation-prevention?format=agents"}},{"id":"biome-1-9-monorepo-config-and-suppression-standard","title":"Biome 1.9 Configuration Inheritance, VCS Integration, and Explicit Suppression Standards","category":"frontend","severity":"critical","description":"Enforces strict configuration inheritance via the `extends` key, deterministic Git-aware VCS resolution, and mandatory explanations for all inline rule suppressions in Biome 1.9+. Prevents divergent formatting and linting discrepancies across monorepo package boundaries while ensuring legacy ESLint suppression comments are rejected.","antiPatternHeadline":"Fragmented Package Configs, Legacy ESLint Suppressions, and Git-Blind Biome CLI Runs","stars_count":67,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","biome","formatter","linter","tooling","monorepo"],"exportEndpoints":{"claude":"/api/rules/biome-1-9-monorepo-config-and-suppression-standard?format=claude","cursorMdc":"/api/rules/biome-1-9-monorepo-config-and-suppression-standard?format=mdc","cursorrules":"/api/rules/biome-1-9-monorepo-config-and-suppression-standard?format=cursor","windsurf":"/api/rules/biome-1-9-monorepo-config-and-suppression-standard?format=windsurf","agents":"/api/rules/biome-1-9-monorepo-config-and-suppression-standard?format=agents"}},{"id":"tanstack-start-ssr-loaders-deferred-guardrail","title":"TanStack Start SSR: Strict Type-Safe Search, Loader Isolation, and Deferred Data Streaming","category":"frontend","severity":"critical","description":"Enforces strict type-safe search parameter validation, selective SSR data deferral via streaming, and explicit dependency tracking across TanStack Start routes. Prevents severe SSR Time-to-First-Byte (TTFB) degradation caused by un-deferred secondary fetches and eliminates hydration mismatches from untracked search param state.","antiPatternHeadline":"Monolithic Blocking SSR Loaders with Untyped Search Params and Stale Dependency State","stars_count":107,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","tanstack-start","tanstack-router","ssr","streaming","typescript","zod"],"exportEndpoints":{"claude":"/api/rules/tanstack-start-ssr-loaders-deferred-guardrail?format=claude","cursorMdc":"/api/rules/tanstack-start-ssr-loaders-deferred-guardrail?format=mdc","cursorrules":"/api/rules/tanstack-start-ssr-loaders-deferred-guardrail?format=cursor","windsurf":"/api/rules/tanstack-start-ssr-loaders-deferred-guardrail?format=windsurf","agents":"/api/rules/tanstack-start-ssr-loaders-deferred-guardrail?format=agents"}},{"id":"lexical-immutable-transforms-selection-reconciliation","title":"Lexical Node Immutability, Transform Idempotency, and Headless Markdown Serialization","category":"frontend","severity":"critical","description":"Enforces Lexical's copy-on-write immutability invariants during editor updates, requires idempotent transform guards to prevent infinite update cascades, and ensures safe selection preservation and isomorphic headless serialization.","antiPatternHeadline":"Direct In-Place Node Mutation, Unguarded Transform Recursion, and Headless Selection Collapsing","stars_count":112,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","lexical","rich-text","immutability","markdown","headless"],"exportEndpoints":{"claude":"/api/rules/lexical-immutable-transforms-selection-reconciliation?format=claude","cursorMdc":"/api/rules/lexical-immutable-transforms-selection-reconciliation?format=mdc","cursorrules":"/api/rules/lexical-immutable-transforms-selection-reconciliation?format=cursor","windsurf":"/api/rules/lexical-immutable-transforms-selection-reconciliation?format=windsurf","agents":"/api/rules/lexical-immutable-transforms-selection-reconciliation?format=agents"}},{"id":"biome-vcs-deterministic-suppression-standard","title":"Biome 1.9 Configuration Inheritance, VCS Integration, and Deterministic Rule Suppression","category":"frontend","severity":"critical","description":"Enforces strict configuration inheritance patterns, Git VCS integration, and deterministic rule suppression syntax under Biome 1.9. Disallows legacy ESLint/Prettier suppression comments and untyped Biome ignores without explicit justification, ensuring reproducibility across local and CI environments.","antiPatternHeadline":"Ad-Hoc Suppressions, Leaked Ignored Files, and Broken Monorepo Configuration Overrides","stars_count":97,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","biome","linter","formatter","tooling","typescript"],"exportEndpoints":{"claude":"/api/rules/biome-vcs-deterministic-suppression-standard?format=claude","cursorMdc":"/api/rules/biome-vcs-deterministic-suppression-standard?format=mdc","cursorrules":"/api/rules/biome-vcs-deterministic-suppression-standard?format=cursor","windsurf":"/api/rules/biome-vcs-deterministic-suppression-standard?format=windsurf","agents":"/api/rules/biome-vcs-deterministic-suppression-standard?format=agents"}},{"id":"valkey-cluster-failover-threaded-io-guardrail","title":"Valkey 8.0 Threaded I/O Topology, Slot Routing & Lua Atomicity Standard","category":"backend","severity":"critical","description":"Enforces strict hash-tag slot locality for multi-key commands and Lua scripts across Valkey 8.0 clusters. Mandates resilient handling of MOVED and ASK redirection topologies during automatic node failovers and configures non-blocking cluster connection pools to prevent event-loop thread starvation under asynchronous threaded I/O workloads.","antiPatternHeadline":"Executing untagged cross-slot multi-key Lua scripts and naive reconnect loops on MOVED/ASK cluster failovers","stars_count":48,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","valkey","redis","clustering","concurrency","distributed-systems"],"exportEndpoints":{"claude":"/api/rules/valkey-cluster-failover-threaded-io-guardrail?format=claude","cursorMdc":"/api/rules/valkey-cluster-failover-threaded-io-guardrail?format=mdc","cursorrules":"/api/rules/valkey-cluster-failover-threaded-io-guardrail?format=cursor","windsurf":"/api/rules/valkey-cluster-failover-threaded-io-guardrail?format=windsurf","agents":"/api/rules/valkey-cluster-failover-threaded-io-guardrail?format=agents"}},{"id":"angular-19-signals-defer-guardrails","title":"Angular 19 Signal Primitives, linkedSignal State Derivation, and @defer Viewport Guardrails","category":"frontend","severity":"critical","description":"Enforces modern Angular 19 reactive architectures by replacing side-effecting input synchronization with linkedSignal, and mandating non-collapsing placeholders on @defer viewport blocks to eliminate Cumulative Layout Shift (CLS) and deferred chunk loading cascades.","antiPatternHeadline":"Using effect() for Input State Mirroring and Unbounded @defer Blocks Lacking Sized Placeholders","stars_count":77,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","angular-19","signals","linkedSignal","defer-views","performance"],"exportEndpoints":{"claude":"/api/rules/angular-19-signals-defer-guardrails?format=claude","cursorMdc":"/api/rules/angular-19-signals-defer-guardrails?format=mdc","cursorrules":"/api/rules/angular-19-signals-defer-guardrails?format=cursor","windsurf":"/api/rules/angular-19-signals-defer-guardrails?format=windsurf","agents":"/api/rules/angular-19-signals-defer-guardrails?format=agents"}},{"id":"tanstack-virtual-3-windowing-performance-production-standard","title":"TanStack Virtual 3.0 Dynamic Measurement, Containment, and Node Saturation Guardrails","category":"frontend","severity":"critical","description":"Mandates strict containment of DOM node saturation, idempotent dynamic element measurement, and GPU-composited positioning for TanStack Virtual 3.0. Enforces stabilized item keys, bounded overscan thresholds, and strict isolation of layout recalculations in massive data grids.","antiPatternHeadline":"Unbounded Dynamic Layout Thrashing via Naive Measurements and DOM Node Saturation","stars_count":53,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react","tanstack-virtual","performance","windowing"],"exportEndpoints":{"claude":"/api/rules/tanstack-virtual-3-windowing-performance-production-standard?format=claude","cursorMdc":"/api/rules/tanstack-virtual-3-windowing-performance-production-standard?format=mdc","cursorrules":"/api/rules/tanstack-virtual-3-windowing-performance-production-standard?format=cursor","windsurf":"/api/rules/tanstack-virtual-3-windowing-performance-production-standard?format=windsurf","agents":"/api/rules/tanstack-virtual-3-windowing-performance-production-standard?format=agents"}},{"id":"lexical-headless-transform-selection-reconciliation","title":"Lexical Node Mutation Immutability, Transform Loop Prevention, and Headless Markdown Serialization","category":"frontend","severity":"critical","description":"Enforces strict copy-on-write node immutability via getWritable(), prevents infinite transform cycles through idempotent dirty-checking, and mandates explicit node registry definitions for headless Lexical markdown serialization pipelines.","antiPatternHeadline":"Directly Mutating Read-Only Node Instances, Triggering Unbounded Transform Cascades, and Headless Markdown Serialization Failures Due to Incomplete Node Registries","stars_count":65,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","lexical","rich-text","headless","markdown","ast"],"exportEndpoints":{"claude":"/api/rules/lexical-headless-transform-selection-reconciliation?format=claude","cursorMdc":"/api/rules/lexical-headless-transform-selection-reconciliation?format=mdc","cursorrules":"/api/rules/lexical-headless-transform-selection-reconciliation?format=cursor","windsurf":"/api/rules/lexical-headless-transform-selection-reconciliation?format=windsurf","agents":"/api/rules/lexical-headless-transform-selection-reconciliation?format=agents"}},{"id":"valkey-cluster-threaded-io-failover-standard","title":"Valkey 8.0 Cluster Topologies, Multi-Threaded I/O, and Cross-Slot Lua Atomicity","category":"backend","severity":"critical","description":"Enforces strict cluster-aware client configurations, explicit hash tagging for multi-key Lua scripts, and robust handling of MOVED/ASK redirections under Valkey 8.0's multi-threaded I/O engine. Prevents silent data corruption, cross-slot transaction aborts, and connection storms during automated cluster failovers.","antiPatternHeadline":"Executing un-tagged multi-key Lua operations on un-clustered clients during failover topology transitions","stars_count":63,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","valkey","redis","clustering","distributed-systems","concurrency"],"exportEndpoints":{"claude":"/api/rules/valkey-cluster-threaded-io-failover-standard?format=claude","cursorMdc":"/api/rules/valkey-cluster-threaded-io-failover-standard?format=mdc","cursorrules":"/api/rules/valkey-cluster-threaded-io-failover-standard?format=cursor","windsurf":"/api/rules/valkey-cluster-threaded-io-failover-standard?format=windsurf","agents":"/api/rules/valkey-cluster-threaded-io-failover-standard?format=agents"}},{"id":"tanstack-start-ssr-search-params-deferred-streaming","title":"TanStack Router SSR Loader Invariants: Validated Search Params and Deferred Streaming","category":"frontend","severity":"critical","description":"Enforces strict runtime schema validation for search parameters, explicit dependency tracking via loaderDeps, and non-blocking SSR streaming via TanStack Router defer(). Prevents server-side TTFB degradation, hydration state mismatches, and cache invalidation failures in fullstack TanStack Start architectures.","antiPatternHeadline":"Blocking SSR TTFB with monolithic loader promises and accessing unvalidated search params without loaderDeps","stars_count":95,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","tanstack-router","tanstack-start","ssr","search-params","streaming"],"exportEndpoints":{"claude":"/api/rules/tanstack-start-ssr-search-params-deferred-streaming?format=claude","cursorMdc":"/api/rules/tanstack-start-ssr-search-params-deferred-streaming?format=mdc","cursorrules":"/api/rules/tanstack-start-ssr-search-params-deferred-streaming?format=cursor","windsurf":"/api/rules/tanstack-start-ssr-search-params-deferred-streaming?format=windsurf","agents":"/api/rules/tanstack-start-ssr-search-params-deferred-streaming?format=agents"}},{"id":"lexical-node-transforms-headless-serialization-guardrail","title":"Lexical Node Immutability, Selection Reconciliation, and Headless Serialization Architecture","category":"frontend","severity":"critical","description":"Enforces strict copy-on-write immutability using node.getWritable() within editor.update() contexts, guarantees selection reconciliation across headless and browser runtimes, and prevents infinite transform cascades during markdown serialization. Violating these invariants produces corrupted EditorState trees, reconciliation desyncs, and fatal crashes in headless Node.js SSR environments.","antiPatternHeadline":"Direct Node Mutation, Unsafe Selection Dereferencing, and Unregistered Node Serialization in Headless Transforms","stars_count":85,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","lexical","rich-text","ast-transforms","headless","markdown"],"exportEndpoints":{"claude":"/api/rules/lexical-node-transforms-headless-serialization-guardrail?format=claude","cursorMdc":"/api/rules/lexical-node-transforms-headless-serialization-guardrail?format=mdc","cursorrules":"/api/rules/lexical-node-transforms-headless-serialization-guardrail?format=cursor","windsurf":"/api/rules/lexical-node-transforms-headless-serialization-guardrail?format=windsurf","agents":"/api/rules/lexical-node-transforms-headless-serialization-guardrail?format=agents"}},{"id":"tanstack-start-ssr-loader-streaming-standard","title":"TanStack Start SSR Loaders, Streaming Invariants, and Type-Safe Search Params","category":"frontend","severity":"critical","description":"Mandates strict schema validation via validateSearch, intentional separation of critical vs deferred SSR data via defer(), and explicit loaderDeps mapping. Prevents severe TTFB latency degradation, client-server hydration mismatch, and unsynchronized route transitions.","antiPatternHeadline":"Degrading SSR TTFB with monolithic non-deferred loaders and fetching search-dependent data via client useEffect hooks","stars_count":94,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","tanstack-start","tanstack-router","ssr","streaming","type-safety"],"exportEndpoints":{"claude":"/api/rules/tanstack-start-ssr-loader-streaming-standard?format=claude","cursorMdc":"/api/rules/tanstack-start-ssr-loader-streaming-standard?format=mdc","cursorrules":"/api/rules/tanstack-start-ssr-loader-streaming-standard?format=cursor","windsurf":"/api/rules/tanstack-start-ssr-loader-streaming-standard?format=windsurf","agents":"/api/rules/tanstack-start-ssr-loader-streaming-standard?format=agents"}},{"id":"bun-12-sqlite-wal-s3-native-storage-standard","title":"Bun 1.2 Embedded SQLite WAL Concurrency & Native S3 Zero-Copy Streaming Standard","category":"backend","severity":"critical","description":"Enforces strict production invariants for Bun 1.2 runtime storage primitives: SQLite WAL mode with non-blocking concurrent readers, zero-copy query execution via bun:sqlite prepared statements, and direct multipart streaming transfers using Bun.s3 native client without intermediate memory buffering.","antiPatternHeadline":"Memory-Buffered S3 Transfers, Unprepared Statements, and Exclusive Locking SQLite Mode in Bun 1.2","stars_count":43,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["bun","sqlite","s3","wal","zero-copy","streaming","concurrency"],"exportEndpoints":{"claude":"/api/rules/bun-12-sqlite-wal-s3-native-storage-standard?format=claude","cursorMdc":"/api/rules/bun-12-sqlite-wal-s3-native-storage-standard?format=mdc","cursorrules":"/api/rules/bun-12-sqlite-wal-s3-native-storage-standard?format=cursor","windsurf":"/api/rules/bun-12-sqlite-wal-s3-native-storage-standard?format=windsurf","agents":"/api/rules/bun-12-sqlite-wal-s3-native-storage-standard?format=agents"}},{"id":"svelte-5-runes-reactive-state-and-snippets-standard","title":"Svelte 5 Runes Reactive State, Snippets, and Effects Invariant Standard","category":"frontend","severity":"critical","description":"Enforces deterministic, fine-grained reactivity in Svelte 5 by strictly mandating universal runes syntax ($state, $derived, $effect, $props) and snippets over legacy Svelte 3/4 runtime paradigms. Prevents state desynchronization caused by proxy destructuring, impure derived calculations, and uncontrolled effect cycles.","antiPatternHeadline":"Destructuring fine-grained reactive state proxies, abusing $effect for derived computations, and relying on legacy slot syntax.","stars_count":100,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","snippets","reactivity"],"exportEndpoints":{"claude":"/api/rules/svelte-5-runes-reactive-state-and-snippets-standard?format=claude","cursorMdc":"/api/rules/svelte-5-runes-reactive-state-and-snippets-standard?format=mdc","cursorrules":"/api/rules/svelte-5-runes-reactive-state-and-snippets-standard?format=cursor","windsurf":"/api/rules/svelte-5-runes-reactive-state-and-snippets-standard?format=windsurf","agents":"/api/rules/svelte-5-runes-reactive-state-and-snippets-standard?format=agents"}},{"id":"angular-19-signals-linked-defer-views","title":"Angular 19 Signal-Based Reactivity, linkedSignal State, and @defer View Chunking Guardrails","category":"frontend","severity":"critical","description":"Angular 19 enforces strict zoneless-ready primitives requiring signal inputs (`input()`, `input.required()`), explicit state derivation via `linkedSignal()`, and granular chunking via template `@defer` blocks. Bypassing these primitives with legacy `@Input()` decorators, imperative `ngOnChanges` state syncing, or monolithic non-deferred component hierarchies degrades change detection performance, risks stale state synchronization bugs, and inflates initial bundle sizes.","antiPatternHeadline":"Imperative State Syncing via ngOnChanges and Monolithic View Bundling Without @defer","stars_count":88,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","angular","angular19","signals","linkedsignal","defer-views","zoneless"],"exportEndpoints":{"claude":"/api/rules/angular-19-signals-linked-defer-views?format=claude","cursorMdc":"/api/rules/angular-19-signals-linked-defer-views?format=mdc","cursorrules":"/api/rules/angular-19-signals-linked-defer-views?format=cursor","windsurf":"/api/rules/angular-19-signals-linked-defer-views?format=windsurf","agents":"/api/rules/angular-19-signals-linked-defer-views?format=agents"}},{"id":"rr7-framework-hydration-single-fetch-invariants","title":"React Router 7 Framework Mode Hydration & Single-Fetch Boundaries","category":"frontend","severity":"critical","description":"Enforces architectural constraints for React Router 7 framework mode hydration, clientLoader caching, and Single Fetch data boundaries. Prevents client-server state desynchronization, double-fetching waterfalls, hydration mismatches, and broken route typegen contracts.","antiPatternHeadline":"Bypassing Typegen Contracts and Misconfiguring clientLoader Hydration in React Router 7 Single-Fetch","stars_count":93,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-router-7","remix","hydration","single-fetch","turbo-stream","typescript"],"exportEndpoints":{"claude":"/api/rules/rr7-framework-hydration-single-fetch-invariants?format=claude","cursorMdc":"/api/rules/rr7-framework-hydration-single-fetch-invariants?format=mdc","cursorrules":"/api/rules/rr7-framework-hydration-single-fetch-invariants?format=cursor","windsurf":"/api/rules/rr7-framework-hydration-single-fetch-invariants?format=windsurf","agents":"/api/rules/rr7-framework-hydration-single-fetch-invariants?format=agents"}},{"id":"lexical-node-transforms-and-headless-serialization","title":"Lexical Immutable Node Transforms, Selection Preservation, and Headless Markdown Serialization","category":"frontend","severity":"critical","description":"Lexical editor states are strictly immutable snapshots where node mutations must occur exclusively via write transforms inside an active editor.update() boundary. Retaining node instances across closures, mutating properties without $getWritable(), or running headless markdown conversions without discrete synchronous state updates causes silent document corruption, dropped selections, and desynchronized AST outputs.","antiPatternHeadline":"Stale Node Reference Mutation and Unregistered Headless Markdown Deserialization","stars_count":91,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","lexical","rich-text","editor","markdown","headless"],"exportEndpoints":{"claude":"/api/rules/lexical-node-transforms-and-headless-serialization?format=claude","cursorMdc":"/api/rules/lexical-node-transforms-and-headless-serialization?format=mdc","cursorrules":"/api/rules/lexical-node-transforms-and-headless-serialization?format=cursor","windsurf":"/api/rules/lexical-node-transforms-and-headless-serialization?format=windsurf","agents":"/api/rules/lexical-node-transforms-and-headless-serialization?format=agents"}},{"id":"biome-configuration-vcs-suppression-standards","title":"Biome 1.9 Config Inheritance, VCS Integration, and Strict Suppression Syntax","category":"frontend","severity":"critical","description":"Enforces deterministic Biome 1.9 configuration standards across repositories. Mandates explicit schema declarations, unified VCS ignore sync via `vcs.clientKind`, modular configuration inheritance, and structurally justified inline rule suppressions.","antiPatternHeadline":"Unjustified inline suppressions, legacy ESLint directives, and desynced ignore files causing CI/local divergence","stars_count":101,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","biome","linter","formatter","tooling","vcs"],"exportEndpoints":{"claude":"/api/rules/biome-configuration-vcs-suppression-standards?format=claude","cursorMdc":"/api/rules/biome-configuration-vcs-suppression-standards?format=mdc","cursorrules":"/api/rules/biome-configuration-vcs-suppression-standards?format=cursor","windsurf":"/api/rules/biome-configuration-vcs-suppression-standards?format=windsurf","agents":"/api/rules/biome-configuration-vcs-suppression-standards?format=agents"}},{"id":"lexical-immutable-node-transforms-headless-serialization","title":"Lexical Immutable Node Transforms, Selection Reconciliation, and Headless Serialization","category":"frontend","severity":"critical","description":"Enforces Lexical's copy-on-write immutability contracts, deterministic node transform dirty-checking, safe selection reconciliation, and headless markdown pipeline execution. Violating these invariants causes silent state desynchronization, infinite transform loops, and server-side DOM crashes in headless environments.","antiPatternHeadline":"Mutating Lexical Node Internals Without getWritable() and Unchecked Headless Transform Recursion","stars_count":95,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","lexical","rich-text","headless-editor","markdown-serialization"],"exportEndpoints":{"claude":"/api/rules/lexical-immutable-node-transforms-headless-serialization?format=claude","cursorMdc":"/api/rules/lexical-immutable-node-transforms-headless-serialization?format=mdc","cursorrules":"/api/rules/lexical-immutable-node-transforms-headless-serialization?format=cursor","windsurf":"/api/rules/lexical-immutable-node-transforms-headless-serialization?format=windsurf","agents":"/api/rules/lexical-immutable-node-transforms-headless-serialization?format=agents"}},{"id":"rust-axum-0-8-state-tower-resilience-standard","title":"Rust Axum 0.8 Strict State Extraction & Tower Middleware Resilience","category":"backend","severity":"critical","description":"Enforces compile-time type-safe state extraction via Axum 0.8 State and FromRef sub-states while prohibiting untyped Extension-based dependency injection. Mandates deterministic Tower middleware ordering featuring outer CatchPanicLayer, structured TraceLayer, and typed custom rejections to eliminate unhandled panics and silent TCP connection terminations.","antiPatternHeadline":"Untyped Extension Injection, Inverted Middleware Layering, and Panic-Induced Client Disconnections","stars_count":98,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tower","middleware","error-handling"],"exportEndpoints":{"claude":"/api/rules/rust-axum-0-8-state-tower-resilience-standard?format=claude","cursorMdc":"/api/rules/rust-axum-0-8-state-tower-resilience-standard?format=mdc","cursorrules":"/api/rules/rust-axum-0-8-state-tower-resilience-standard?format=cursor","windsurf":"/api/rules/rust-axum-0-8-state-tower-resilience-standard?format=windsurf","agents":"/api/rules/rust-axum-0-8-state-tower-resilience-standard?format=agents"}},{"id":"lexical-node-transforms-selection-headless-markdown-guardrail","title":"Lexical Immutable Node Transforms, Selection Reconciliation, and Headless Serialization","category":"frontend","severity":"critical","description":"Enforces strict Lexical node mutation invariants using writable node proxies inside update boundaries, guarantees idempotent node transforms to prevent infinite reconcile cascades, preserves DOM/editor selection continuity during structural shifts, and ensures headless Markdown serialization runs deterministically without DOM leaks.","antiPatternHeadline":"Mutating Stale Lexical Node References, Unguarded Recursive Transforms, and Selection Corruption in Headless Pipelines","stars_count":88,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","lexical","rich-text","markdown","headless-editor","typescript"],"exportEndpoints":{"claude":"/api/rules/lexical-node-transforms-selection-headless-markdown-guardrail?format=claude","cursorMdc":"/api/rules/lexical-node-transforms-selection-headless-markdown-guardrail?format=mdc","cursorrules":"/api/rules/lexical-node-transforms-selection-headless-markdown-guardrail?format=cursor","windsurf":"/api/rules/lexical-node-transforms-selection-headless-markdown-guardrail?format=windsurf","agents":"/api/rules/lexical-node-transforms-selection-headless-markdown-guardrail?format=agents"}},{"id":"go-chi-middleware-routing-graceful-shutdown","title":"Chi v5 Context-Aware Middleware Chaining, Safe Route Mounting, and Signal-Driven Graceful Shutdown","category":"backend","severity":"critical","description":"Enforces deterministic Chi v5 middleware execution order, strict request context propagation to prevent zombie goroutines, safe sub-router mounting, and non-blocking signal-driven HTTP server shutdown. Guarantees that in-flight requests cleanly drain during deployments without data corruption or abrupt socket drops.","antiPatternHeadline":"Unbounded Context Execution, Hard Process Halts, and Leaked In-Flight Connections in Chi Web Services","stars_count":107,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","chi","middleware","graceful-shutdown","context","concurrency"],"exportEndpoints":{"claude":"/api/rules/go-chi-middleware-routing-graceful-shutdown?format=claude","cursorMdc":"/api/rules/go-chi-middleware-routing-graceful-shutdown?format=mdc","cursorrules":"/api/rules/go-chi-middleware-routing-graceful-shutdown?format=cursor","windsurf":"/api/rules/go-chi-middleware-routing-graceful-shutdown?format=windsurf","agents":"/api/rules/go-chi-middleware-routing-graceful-shutdown?format=agents"}},{"id":"tanstack-start-ssr-streaming-and-params-standard","title":"TanStack Start SSR: Guardrails for Type-Safe Search Params and Deferred Streaming","category":"frontend","severity":"critical","description":"Mandates strict schema validation for route search parameters and enforces non-blocking deferred streaming for slow SSR operations. Eliminates server render timeouts, hydration mismatches, and unvalidated URL parameter injection in fullstack TanStack applications.","antiPatternHeadline":"Blocking SSR on slow secondary dependencies and consuming unvalidated search parameters directly from raw URL state.","stars_count":95,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","tanstack-start","tanstack-router","ssr","search-params","streaming"],"exportEndpoints":{"claude":"/api/rules/tanstack-start-ssr-streaming-and-params-standard?format=claude","cursorMdc":"/api/rules/tanstack-start-ssr-streaming-and-params-standard?format=mdc","cursorrules":"/api/rules/tanstack-start-ssr-streaming-and-params-standard?format=cursor","windsurf":"/api/rules/tanstack-start-ssr-streaming-and-params-standard?format=windsurf","agents":"/api/rules/tanstack-start-ssr-streaming-and-params-standard?format=agents"}},{"id":"tailwind-v4-css-first-theme-guardrails","title":"Tailwind CSS v4 CSS-First Theme Directives & Variable Invariants","category":"frontend","severity":"critical","description":"Tailwind CSS v4 fully replaces legacy JavaScript-based configuration (`tailwind.config.js`) with native CSS-first configuration via `@import \"tailwindcss\";` and `@theme` blocks. Invariants mandate defining theme tokens directly as CSS custom properties within `@theme` blocks and leveraging native CSS color-mix() interpolation rather than deprecated string-substitution `<alpha-value>` functional wrappers.","antiPatternHeadline":"Defining legacy tailwind.config.js configurations, using deprecated @config directives, or relying on rgba()/opacity function hacks instead of native @theme CSS variables.","stars_count":91,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","tailwindcss-v4","css","design-tokens","performance"],"exportEndpoints":{"claude":"/api/rules/tailwind-v4-css-first-theme-guardrails?format=claude","cursorMdc":"/api/rules/tailwind-v4-css-first-theme-guardrails?format=mdc","cursorrules":"/api/rules/tailwind-v4-css-first-theme-guardrails?format=cursor","windsurf":"/api/rules/tailwind-v4-css-first-theme-guardrails?format=windsurf","agents":"/api/rules/tailwind-v4-css-first-theme-guardrails?format=agents"}},{"id":"angular-19-signals-defer-views","title":"Angular 19 Signal Primitives, Linked Signals, and @defer Template Chunking","category":"frontend","severity":"critical","description":"Enforces modern Angular 19 reactive architectures by requiring signal inputs and linkedSignal for derived mutable state, while prohibiting ngOnChanges and manual synchronizations. Mandates explicit @defer blocks with viewport triggers, minimum durations, and error/placeholder fallbacks for non-critical template subtrees to optimize bundle chunking and Core Web Vitals.","antiPatternHeadline":"Mutating state via ngOnChanges/effects and omitting @defer blocks on below-the-fold dependencies.","stars_count":42,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","angular","angular19","signals","linkedSignal","defer-views","performance"],"exportEndpoints":{"claude":"/api/rules/angular-19-signals-defer-views?format=claude","cursorMdc":"/api/rules/angular-19-signals-defer-views?format=mdc","cursorrules":"/api/rules/angular-19-signals-defer-views?format=cursor","windsurf":"/api/rules/angular-19-signals-defer-views?format=windsurf","agents":"/api/rules/angular-19-signals-defer-views?format=agents"}},{"id":"biome-config-vcs-suppression-invariants","title":"Biome 1.9 Configuration Inheritance, VCS Integration, and Strict Suppression Governance","category":"frontend","severity":"critical","description":"Enforces deterministic configuration inheritance, strict VCS integration, and reasoned rule suppression for Biome 1.9 toolchains. Prevents configuration drift across monorepos, eliminates redundant filesystem traversals by synchronizing Biome with Git ignore trees, and mandates actionable rationale on all inline lint waivers.","antiPatternHeadline":"Fragmented Configurations, Redundant Ignore Traversal, and Unexplained Silent Suppressions","stars_count":81,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","biome","linter","formatter","tooling","vcs"],"exportEndpoints":{"claude":"/api/rules/biome-config-vcs-suppression-invariants?format=claude","cursorMdc":"/api/rules/biome-config-vcs-suppression-invariants?format=mdc","cursorrules":"/api/rules/biome-config-vcs-suppression-invariants?format=cursor","windsurf":"/api/rules/biome-config-vcs-suppression-invariants?format=windsurf","agents":"/api/rules/biome-config-vcs-suppression-invariants?format=agents"}},{"id":"valkey-8-cluster-threaded-io-production-standard","title":"Valkey 8.0 Multi-Threaded I/O, Slot Redirection, and Lua Atomicity Standard","category":"backend","severity":"critical","description":"Enforces strict cluster-aware client configuration, hash-tag slot alignment, and non-blocking command execution for Valkey 8.0 deployments. Guarantees zero-downtime cluster topology transitions during failovers while preventing CROSSSLOT errors and event-loop thread starvation under asynchronous threaded I/O workloads.","antiPatternHeadline":"Dynamic Key Generation in Lua Scripts and Static Cluster Topologies Causing CROSSSLOT Exceptions and Dropped Failover Traffic","stars_count":44,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","valkey","redis","clustering","concurrency","performance"],"exportEndpoints":{"claude":"/api/rules/valkey-8-cluster-threaded-io-production-standard?format=claude","cursorMdc":"/api/rules/valkey-8-cluster-threaded-io-production-standard?format=mdc","cursorrules":"/api/rules/valkey-8-cluster-threaded-io-production-standard?format=cursor","windsurf":"/api/rules/valkey-8-cluster-threaded-io-production-standard?format=windsurf","agents":"/api/rules/valkey-8-cluster-threaded-io-production-standard?format=agents"}},{"id":"tanstack-virtual-dynamic-measurement-and-containment","title":"TanStack Virtual 3.0 Dynamic Measurement, Scroll Containment, and DOM Saturation Guardrails","category":"frontend","severity":"critical","description":"Enforces deterministic element measurement, ref-bound layout stabilization, and multi-dimensional windowing containment for TanStack Virtual 3.0. Prevents catastrophic layout thrashing, infinite measurement oscillation loops, and DOM node saturation in high-density data tables.","antiPatternHeadline":"Layout Thrashing, Infinite Resize Loops, and Memory Exhaustion via Naive Dynamic Measurement and Unbounded Column Rendering","stars_count":76,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","tanstack-virtual","virtualization","react","performance","table"],"exportEndpoints":{"claude":"/api/rules/tanstack-virtual-dynamic-measurement-and-containment?format=claude","cursorMdc":"/api/rules/tanstack-virtual-dynamic-measurement-and-containment?format=mdc","cursorrules":"/api/rules/tanstack-virtual-dynamic-measurement-and-containment?format=cursor","windsurf":"/api/rules/tanstack-virtual-dynamic-measurement-and-containment?format=windsurf","agents":"/api/rules/tanstack-virtual-dynamic-measurement-and-containment?format=agents"}},{"id":"biome-v1-9-config-vcs-suppression-standard","title":"Biome 1.9 Configuration Inheritance, VCS Integration, and Explicit Rule Suppression Guardrails","category":"frontend","severity":"critical","description":"Enforces strict configuration architecture in Biome 1.9 across monorepos and standalone repositories. Mandates explicit Git VCS integration to prevent parsing build outputs, centralized schema inheritance via `extends`, and fully qualified inline rule suppressions with mandatory justification strings.","antiPatternHeadline":"Ignoring VCS boundary definitions and using legacy or unexplained suppression comments that bypass CI safety guarantees","stars_count":63,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","biome","linter","formatter","typescript","monorepo"],"exportEndpoints":{"claude":"/api/rules/biome-v1-9-config-vcs-suppression-standard?format=claude","cursorMdc":"/api/rules/biome-v1-9-config-vcs-suppression-standard?format=mdc","cursorrules":"/api/rules/biome-v1-9-config-vcs-suppression-standard?format=cursor","windsurf":"/api/rules/biome-v1-9-config-vcs-suppression-standard?format=windsurf","agents":"/api/rules/biome-v1-9-config-vcs-suppression-standard?format=agents"}},{"id":"bun-1-2-sqlite-wal-s3-streaming-standard","title":"Bun 1.2 Embedded SQLite WAL Concurrency & S3 Zero-Copy Streaming Invariants","category":"backend","severity":"critical","description":"Enforces non-blocking embedded database and object storage patterns in Bun 1.2+. Mandates Write-Ahead Logging (WAL) with strict busy timeouts and prepared statements for 'bun:sqlite', alongside zero-allocation ReadableStream piping for Bun S3 native clients to prevent event-loop stalls and out-of-memory heap panics.","antiPatternHeadline":"Buffering S3 payloads entirely in Node.js memory buffers and executing ad-hoc un-journaled bun:sqlite queries without WAL pragma locks.","stars_count":43,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","bun-sqlite","s3","wal","zero-copy","streaming"],"exportEndpoints":{"claude":"/api/rules/bun-1-2-sqlite-wal-s3-streaming-standard?format=claude","cursorMdc":"/api/rules/bun-1-2-sqlite-wal-s3-streaming-standard?format=mdc","cursorrules":"/api/rules/bun-1-2-sqlite-wal-s3-streaming-standard?format=cursor","windsurf":"/api/rules/bun-1-2-sqlite-wal-s3-streaming-standard?format=windsurf","agents":"/api/rules/bun-1-2-sqlite-wal-s3-streaming-standard?format=agents"}},{"id":"lexical-headless-transforms-and-serialization-guardrails","title":"Lexical Immutable Node Mutation, Selection Reconciliation, and Headless Serialization Invariants","category":"frontend","severity":"critical","description":"Enforces Lexical's clone-on-write immutability contract, preventing silent editor state corruption, infinite transform loops, and selection reconciliation failures. Mandates explicit node registration in headless pipelines and strictly forbids direct property assignment or unverified DOM/selection access during headless markdown serialization.","antiPatternHeadline":"Direct In-Place Node Property Mutation and Unregistered Headless Transforms","stars_count":118,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","lexical","rich-text","serialization","markdown","immutability"],"exportEndpoints":{"claude":"/api/rules/lexical-headless-transforms-and-serialization-guardrails?format=claude","cursorMdc":"/api/rules/lexical-headless-transforms-and-serialization-guardrails?format=mdc","cursorrules":"/api/rules/lexical-headless-transforms-and-serialization-guardrails?format=cursor","windsurf":"/api/rules/lexical-headless-transforms-and-serialization-guardrails?format=windsurf","agents":"/api/rules/lexical-headless-transforms-and-serialization-guardrails?format=agents"}},{"id":"biome-config-inheritance-vcs-suppression-standard","title":"Biome 1.9 Configuration Inheritance, VCS Integration, and Suppression Guardrails","category":"frontend","severity":"critical","description":"Enforces architectural compliance for Biome 1.9 tooling setups across monorepos and standalone repositories. Mandates deterministic VCS-aware ignore tracking, disciplined configuration inheritance hierarchies, and mandatory justification comments for all inline rule suppressions.","antiPatternHeadline":"Unjustified Bare Rule Suppressions, VCS-Ignored File Leaks, and Monorepo Config Drift","stars_count":110,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","biome","linter","formatter","tooling","dx"],"exportEndpoints":{"claude":"/api/rules/biome-config-inheritance-vcs-suppression-standard?format=claude","cursorMdc":"/api/rules/biome-config-inheritance-vcs-suppression-standard?format=mdc","cursorrules":"/api/rules/biome-config-inheritance-vcs-suppression-standard?format=cursor","windsurf":"/api/rules/biome-config-inheritance-vcs-suppression-standard?format=windsurf","agents":"/api/rules/biome-config-inheritance-vcs-suppression-standard?format=agents"}},{"id":"tanstack-virtual-v3-dynamic-measurement-guardrail","title":"TanStack Virtual 3.0 Dynamic Windowing & Scroll Containment Standard","category":"frontend","severity":"critical","description":"Enforces strict virtualizer lifecycle management in TanStack Virtual 3.0 for massive, dynamic datasets. Prevents DOM node saturation, layout thrashing, and sub-pixel jitter by mandating accurate ref dynamic measurement callbacks, scroll margin isolation, and GPU-accelerated CSS transform positioning.","antiPatternHeadline":"Uncontained Dynamic Row Measurements Inducing Infinite Resize Loops and Layout Thrashing","stars_count":53,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react","tanstack-virtual","performance","dom-virtualization"],"exportEndpoints":{"claude":"/api/rules/tanstack-virtual-v3-dynamic-measurement-guardrail?format=claude","cursorMdc":"/api/rules/tanstack-virtual-v3-dynamic-measurement-guardrail?format=mdc","cursorrules":"/api/rules/tanstack-virtual-v3-dynamic-measurement-guardrail?format=cursor","windsurf":"/api/rules/tanstack-virtual-v3-dynamic-measurement-guardrail?format=windsurf","agents":"/api/rules/tanstack-virtual-v3-dynamic-measurement-guardrail?format=agents"}},{"id":"lexical-node-transforms-and-headless-serialization-production-standard","title":"Lexical Headless Node Transforms, Selection Reconciliation, and Markdown Serialization Guardrail","category":"frontend","severity":"critical","description":"Enforces strict Lexical AST immutability semantics, idempotent node transforms, and safe headless serialization. Mandates clone-on-write access via node.getWritable() inside update closures, deterministic selection preservation during AST reconciliation, and explicit node registration for headless markdown pipelines without DOM dependencies.","antiPatternHeadline":"Direct node property mutation and unconstrained transform loops in headless markdown serialization","stars_count":104,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","lexical","rich-text","headless","ast","markdown"],"exportEndpoints":{"claude":"/api/rules/lexical-node-transforms-and-headless-serialization-production-standard?format=claude","cursorMdc":"/api/rules/lexical-node-transforms-and-headless-serialization-production-standard?format=mdc","cursorrules":"/api/rules/lexical-node-transforms-and-headless-serialization-production-standard?format=cursor","windsurf":"/api/rules/lexical-node-transforms-and-headless-serialization-production-standard?format=windsurf","agents":"/api/rules/lexical-node-transforms-and-headless-serialization-production-standard?format=agents"}},{"id":"biome-config-inheritance-vcs-suppression","title":"Biome 1.9 Monorepo Configuration, VCS Integration, and Deterministic Suppression Standards","category":"frontend","severity":"critical","description":"Enforces strict configuration architecture in Biome 1.9+, establishing centralized workspace inheritance, automated Git-driven VCS ignore synchronization, and validated deterministic inline suppression syntax. Prevents toolchain fragmentation, divergent ignore sets, and silent lint-rule circumvention across monorepos.","antiPatternHeadline":"Fragmented multi-tool ignore drift, orphaned nested configurations, and opaque rule suppressions without explicit justification.","stars_count":88,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","biome","linter","formatter","tooling","monorepo"],"exportEndpoints":{"claude":"/api/rules/biome-config-inheritance-vcs-suppression?format=claude","cursorMdc":"/api/rules/biome-config-inheritance-vcs-suppression?format=mdc","cursorrules":"/api/rules/biome-config-inheritance-vcs-suppression?format=cursor","windsurf":"/api/rules/biome-config-inheritance-vcs-suppression?format=windsurf","agents":"/api/rules/biome-config-inheritance-vcs-suppression?format=agents"}},{"id":"angular-19-standalone-signals-defer-views","title":"Angular 19 Standalone Signals, Linked Signals, and Defer View Invariants","category":"frontend","severity":"critical","description":"Enforces Modern Angular 19 reactivity and lazy-loading standards by mandating signal inputs, linkedSignal for resettable derivations, and strictly partitioned @defer blocks with minimum rendering thresholds. Prohibits legacy decorator inputs, manual ngOnChanges synchronization, and untracked side-effects in computed signals.","antiPatternHeadline":"Mixing Legacy ngOnChanges with Signal Inputs and Unbounded @defer Blocks Without Viewport Placeholders","stars_count":64,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["angular-19","signals","linked-signal","defer-views","standalone","change-detection"],"exportEndpoints":{"claude":"/api/rules/angular-19-standalone-signals-defer-views?format=claude","cursorMdc":"/api/rules/angular-19-standalone-signals-defer-views?format=mdc","cursorrules":"/api/rules/angular-19-standalone-signals-defer-views?format=cursor","windsurf":"/api/rules/angular-19-standalone-signals-defer-views?format=windsurf","agents":"/api/rules/angular-19-standalone-signals-defer-views?format=agents"}},{"id":"lexical-node-transforms-selection-headless-guardrail","title":"Lexical Immutable Node Transforms, Selection Reconciliation, and Headless Serialization","category":"frontend","severity":"critical","description":"Enforces strict clone-on-write immutability via $getWritable() within Lexical editor updates, prevents infinite node transform cascades, guarantees selection reconciliation, and ensures headless Markdown serialization executes deterministically without browser DOM dependencies.","antiPatternHeadline":"Direct Node Property Mutation, Cascading Transform Loops, and DOM-Tethered Headless Serialization","stars_count":113,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","lexical","rich-text","editor-state","serialization","headless"],"exportEndpoints":{"claude":"/api/rules/lexical-node-transforms-selection-headless-guardrail?format=claude","cursorMdc":"/api/rules/lexical-node-transforms-selection-headless-guardrail?format=mdc","cursorrules":"/api/rules/lexical-node-transforms-selection-headless-guardrail?format=cursor","windsurf":"/api/rules/lexical-node-transforms-selection-headless-guardrail?format=windsurf","agents":"/api/rules/lexical-node-transforms-selection-headless-guardrail?format=agents"}},{"id":"biome-1-9-monorepo-inheritance-vcs-guardrails","title":"Deterministic Biome 1.9 Monorepo Inheritance, VCS Integration, and Explicit Rule Suppression","category":"frontend","severity":"critical","description":"Biome 1.9 replaces traditional multi-tool JavaScript/TypeScript toolchains with a high-performance single-binary engine. In production monorepos, engineers must enforce root configuration inheritance using exact relative extends paths, integrate native VCS ignore hooks to eliminate duplicate ignore manifests, and mandate structured, deterministic suppression comments containing both rule names and mandatory rationale.","antiPatternHeadline":"Fragmented multi-tier ESLint/Prettier configs, divergent gitignore patterns, and naked linter suppressions","stars_count":91,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","biome","biomejs","linter","formatter","monorepo","typescript"],"exportEndpoints":{"claude":"/api/rules/biome-1-9-monorepo-inheritance-vcs-guardrails?format=claude","cursorMdc":"/api/rules/biome-1-9-monorepo-inheritance-vcs-guardrails?format=mdc","cursorrules":"/api/rules/biome-1-9-monorepo-inheritance-vcs-guardrails?format=cursor","windsurf":"/api/rules/biome-1-9-monorepo-inheritance-vcs-guardrails?format=windsurf","agents":"/api/rules/biome-1-9-monorepo-inheritance-vcs-guardrails?format=agents"}},{"id":"valkey-8-threaded-io-cluster-resilience","title":"Valkey 8.0 Threaded I/O, Slot Redirection, and Lua Atomicity Guardrails","category":"backend","severity":"critical","description":"Valkey 8.0 employs an asymmetric dual-channel threaded I/O engine where socket parsing runs in parallel while command execution remains strictly single-threaded per shard. Distributed cluster deployments must enforce explicit hash-tag slot affinity on multi-key operations and handle ASK/MOVED redirection gracefully during node failover to prevent pipeline thrashing and slot corruption.","antiPatternHeadline":"Executing un-hashed multi-key Lua scripts and naive pipelines without slot-refresh backoff during cluster failovers.","stars_count":66,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","valkey","redis-cluster","caching","distributed-systems","lua"],"exportEndpoints":{"claude":"/api/rules/valkey-8-threaded-io-cluster-resilience?format=claude","cursorMdc":"/api/rules/valkey-8-threaded-io-cluster-resilience?format=mdc","cursorrules":"/api/rules/valkey-8-threaded-io-cluster-resilience?format=cursor","windsurf":"/api/rules/valkey-8-threaded-io-cluster-resilience?format=windsurf","agents":"/api/rules/valkey-8-threaded-io-cluster-resilience?format=agents"}},{"id":"bun-sqlite-wal-s3-streaming-standard","title":"Bun 1.2 SQLite WAL Concurrency & S3 Zero-Copy Streaming Standard","category":"backend","severity":"critical","description":"Mandates production configuration for Bun 1.2's native bun:sqlite engine using Write-Ahead Logging (WAL), busy timeout resiliency, and zero-copy iteration. Enforces direct kernel-level streaming for S3 native storage via Bun.s3 without intermediate heap memory buffering.","antiPatternHeadline":"Blocking In-Memory SQLite Contention & Heap-Exhausting S3 Buffering","stars_count":110,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","sqlite","s3","wal","zero-copy","streaming"],"exportEndpoints":{"claude":"/api/rules/bun-sqlite-wal-s3-streaming-standard?format=claude","cursorMdc":"/api/rules/bun-sqlite-wal-s3-streaming-standard?format=mdc","cursorrules":"/api/rules/bun-sqlite-wal-s3-streaming-standard?format=cursor","windsurf":"/api/rules/bun-sqlite-wal-s3-streaming-standard?format=windsurf","agents":"/api/rules/bun-sqlite-wal-s3-streaming-standard?format=agents"}},{"id":"bun-1-2-sqlite-wal-s3-native-storage-standard","title":"Bun 1.2 Embedded SQLite WAL Concurrency & Native S3 Zero-Copy Streaming Standard","category":"backend","severity":"critical","description":"Enforces high-throughput, memory-safe data operations in Bun 1.2 using bun:sqlite with Write-Ahead Logging (WAL) and Bun's native S3 Client. Mandates zero-copy statement execution via bun:sqlite typed queries and precludes buffering unbounded binary streams in memory by leveraging Bun.s3 native multipart streaming.","antiPatternHeadline":"Buffering Out-of-Process SQLite Bindings in Memory & Buffering Entire S3 Blobs as Node Buffers","stars_count":72,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["bun","sqlite","s3","wal","zero-copy","streaming","concurrency"],"exportEndpoints":{"claude":"/api/rules/bun-1-2-sqlite-wal-s3-native-storage-standard?format=claude","cursorMdc":"/api/rules/bun-1-2-sqlite-wal-s3-native-storage-standard?format=mdc","cursorrules":"/api/rules/bun-1-2-sqlite-wal-s3-native-storage-standard?format=cursor","windsurf":"/api/rules/bun-1-2-sqlite-wal-s3-native-storage-standard?format=windsurf","agents":"/api/rules/bun-1-2-sqlite-wal-s3-native-storage-standard?format=agents"}},{"id":"tanstack-start-router-ssr-deferred-params-guardrail","title":"TanStack Start SSR: Type-Safe Search Validation, Loader Dependencies, and Deferred Streaming","category":"frontend","severity":"critical","description":"Enforces strict validation of search parameters via standard schema parsers, mandatory `loaderDeps` declarations for search-dependent queries, and explicit deferred streaming via `defer()` for non-critical SSR data. Prevents SSR waterfall blocking and eliminates client-server hydration mismatch bugs.","antiPatternHeadline":"Unvalidated Search Params, Missing loaderDeps, and Monolithic Blocking SSR Loaders","stars_count":41,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","tanstack-router","tanstack-start","ssr","typescript","streaming"],"exportEndpoints":{"claude":"/api/rules/tanstack-start-router-ssr-deferred-params-guardrail?format=claude","cursorMdc":"/api/rules/tanstack-start-router-ssr-deferred-params-guardrail?format=mdc","cursorrules":"/api/rules/tanstack-start-router-ssr-deferred-params-guardrail?format=cursor","windsurf":"/api/rules/tanstack-start-router-ssr-deferred-params-guardrail?format=windsurf","agents":"/api/rules/tanstack-start-router-ssr-deferred-params-guardrail?format=agents"}},{"id":"hono-jsx-edge-stream-pipeline-invariants","title":"Hono JSX Edge Streaming Pipelines and Non-Buffering Middleware Invariants","category":"frontend","severity":"critical","description":"Enforces non-blocking, zero-buffering HTML streaming architecture for Hono JSX on Cloudflare Workers and Deno runtimes. Mandates renderToReadableStream with Suspense boundaries to minimize TTFB, preventing edge V8 isolate memory exhaustion and unhandled stream termination errors.","antiPatternHeadline":"Buffering JSX Trees via renderToString and Blocking Edge Pipelines on Synchronous Middleware","stars_count":76,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","hono","hono-jsx","cloudflare-workers","deno","edge-streaming","suspense"],"exportEndpoints":{"claude":"/api/rules/hono-jsx-edge-stream-pipeline-invariants?format=claude","cursorMdc":"/api/rules/hono-jsx-edge-stream-pipeline-invariants?format=mdc","cursorrules":"/api/rules/hono-jsx-edge-stream-pipeline-invariants?format=cursor","windsurf":"/api/rules/hono-jsx-edge-stream-pipeline-invariants?format=windsurf","agents":"/api/rules/hono-jsx-edge-stream-pipeline-invariants?format=agents"}},{"id":"valkey-8-threaded-io-cluster-invariants","title":"Valkey 8.0 Threaded I/O, Cluster Slot Redirects, and Multi-Key Scripting","category":"backend","severity":"critical","description":"Enforces strict production invariants for Valkey 8.0 deployments utilizing multi-threaded I/O, automated cluster failover, and atomic scripting. Mandates hash-tagging for multi-key atomicity, zero-drift MOVED and ASK redirect topology refreshes, and I/O pool configuration tuned to eliminate main-thread starvation.","antiPatternHeadline":"Executing un-tagged multi-key Lua scripts and executing blind retries on MOVED/ASK redirects during failover.","stars_count":85,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["valkey","backend","clustering","threaded-io","lua-scripting","distributed-systems"],"exportEndpoints":{"claude":"/api/rules/valkey-8-threaded-io-cluster-invariants?format=claude","cursorMdc":"/api/rules/valkey-8-threaded-io-cluster-invariants?format=mdc","cursorrules":"/api/rules/valkey-8-threaded-io-cluster-invariants?format=cursor","windsurf":"/api/rules/valkey-8-threaded-io-cluster-invariants?format=windsurf","agents":"/api/rules/valkey-8-threaded-io-cluster-invariants?format=agents"}},{"id":"rust-axum-state-tower-panic-resilience","title":"Rust Axum 0.8 Compile-Time State Extraction and Tower Middleware Invariants","category":"backend","severity":"critical","description":"Mandate compile-time type-safe state injection using Axum 0.8 State and FromRef traits instead of runtime Extension extractors. Enforce deterministic Tower middleware ordering via ServiceBuilder with CatchPanicLayer and customized rejection types to eliminate unhandled connection drops.","antiPatternHeadline":"Runtime Panics from Untyped Extension Extractors, Unhandled Panics Crashing HTTP Connections, and Broken Middleware Stacks","stars_count":86,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tower","middleware","concurrency"],"exportEndpoints":{"claude":"/api/rules/rust-axum-state-tower-panic-resilience?format=claude","cursorMdc":"/api/rules/rust-axum-state-tower-panic-resilience?format=mdc","cursorrules":"/api/rules/rust-axum-state-tower-panic-resilience?format=cursor","windsurf":"/api/rules/rust-axum-state-tower-panic-resilience?format=windsurf","agents":"/api/rules/rust-axum-state-tower-panic-resilience?format=agents"}},{"id":"valkey-8-threaded-io-cluster-topology-guardrail","title":"Valkey 8.0 Threaded I/O, Slot Redirect Handling, and Hash Tag Atomicity Standard","category":"backend","severity":"critical","description":"Enforces architectural patterns for Valkey 8.0 cluster topologies, multi-threaded I/O management, and multi-key script execution. Eliminates CROSSSLOT execution failures, cascading failover loops, and thread pool starvation by mandating hash tags, dual-phase redirection handling (MOVED vs. ASK), and non-blocking transaction designs.","antiPatternHeadline":"Unpartitioned Cross-Slot Multi-Key Operations with Naive Redirect Handling Under Multi-Threaded I/O","stars_count":76,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","valkey","cluster","caching","concurrency","distributed-systems"],"exportEndpoints":{"claude":"/api/rules/valkey-8-threaded-io-cluster-topology-guardrail?format=claude","cursorMdc":"/api/rules/valkey-8-threaded-io-cluster-topology-guardrail?format=mdc","cursorrules":"/api/rules/valkey-8-threaded-io-cluster-topology-guardrail?format=cursor","windsurf":"/api/rules/valkey-8-threaded-io-cluster-topology-guardrail?format=windsurf","agents":"/api/rules/valkey-8-threaded-io-cluster-topology-guardrail?format=agents"}},{"id":"rust-axum-0-8-state-tower-guardrails","title":"Axum 0.8 Type-Safe State Extractors & Resilient Tower Middleware Composition","category":"backend","severity":"critical","description":"Enforces Axum 0.8 idioms for type-safe state extraction via FromRef and State<T>, deterministic Tower ServiceBuilder middleware sequencing, and mandatory CatchPanicLayer integration. Prevents runtime state-resolution panics, dropped connections, and silent request body consumption errors.","antiPatternHeadline":"Runtime Extension extraction failures, inverted Tower middleware order, and unhandled handler panics causing connection drops","stars_count":81,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tower","tokio","concurrency"],"exportEndpoints":{"claude":"/api/rules/rust-axum-0-8-state-tower-guardrails?format=claude","cursorMdc":"/api/rules/rust-axum-0-8-state-tower-guardrails?format=mdc","cursorrules":"/api/rules/rust-axum-0-8-state-tower-guardrails?format=cursor","windsurf":"/api/rules/rust-axum-0-8-state-tower-guardrails?format=windsurf","agents":"/api/rules/rust-axum-0-8-state-tower-guardrails?format=agents"}},{"id":"tanstack-virtual-v3-windowing-performance-guardrail","title":"TanStack Virtual 3.0 Dynamic Windowing and DOM Containment Standard","category":"frontend","severity":"critical","description":"Enforces deterministic rendering invariants for TanStack Virtual 3.0 in massive datasets. Mandates hardware-accelerated transforms, bounded overscan, stable keying via getItemKey, and strict measureElement lifecycle bindings to eliminate ResizeObserver thrashing, layout jitter, and DOM node saturation.","antiPatternHeadline":"Dynamic Measure Feedback Loops, Unbounded Overscan Saturation, and Top-Offset Layout Thrashing","stars_count":102,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","tanstack-virtual","react","virtualization","performance","dom-containment"],"exportEndpoints":{"claude":"/api/rules/tanstack-virtual-v3-windowing-performance-guardrail?format=claude","cursorMdc":"/api/rules/tanstack-virtual-v3-windowing-performance-guardrail?format=mdc","cursorrules":"/api/rules/tanstack-virtual-v3-windowing-performance-guardrail?format=cursor","windsurf":"/api/rules/tanstack-virtual-v3-windowing-performance-guardrail?format=windsurf","agents":"/api/rules/tanstack-virtual-v3-windowing-performance-guardrail?format=agents"}},{"id":"axum-0-8-type-safe-state-and-tower-composition","title":"Axum 0.8 Type-Safe State Extraction, Tower Middleware Composition & Panic Guardrails","category":"backend","severity":"critical","description":"Mandates compile-time type-safe state extraction via Axum 0.8's State extractor and FromRef pattern, eliminating runtime Extension panics. Enforces deterministic Tower ServiceBuilder layer ordering and boundary-level panic interception to ensure zero unhandled connection drops.","antiPatternHeadline":"Runtime Panics via Fallible Extension Extractors & Dropped Connections from Inverted Tower Layers","stars_count":113,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["rust","axum","tower","middleware","async","type-safety","backend"],"exportEndpoints":{"claude":"/api/rules/axum-0-8-type-safe-state-and-tower-composition?format=claude","cursorMdc":"/api/rules/axum-0-8-type-safe-state-and-tower-composition?format=mdc","cursorrules":"/api/rules/axum-0-8-type-safe-state-and-tower-composition?format=cursor","windsurf":"/api/rules/axum-0-8-type-safe-state-and-tower-composition?format=windsurf","agents":"/api/rules/axum-0-8-type-safe-state-and-tower-composition?format=agents"}},{"id":"tanstack-virtual-v3-dynamic-windowing-guardrail","title":"TanStack Virtual 3.0 Dynamic Measurement and DOM Containment Standard","category":"frontend","severity":"critical","description":"Enforces deterministic DOM virtualization using TanStack Virtual 3.0 with dynamic element measurement and hardware-accelerated positioning. Prevents layout thrashing, DOM node saturation, and measurement feedback loops in massive data tables by constraining overscan thresholds and stabilizing element ref attachments.","antiPatternHeadline":"Unbounded overscan, layout-invalidating inline offsets, and missing measurement attributes causing catastrophic DOM saturation","stars_count":88,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","tanstack-virtual","virtualization","performance","react","tables"],"exportEndpoints":{"claude":"/api/rules/tanstack-virtual-v3-dynamic-windowing-guardrail?format=claude","cursorMdc":"/api/rules/tanstack-virtual-v3-dynamic-windowing-guardrail?format=mdc","cursorrules":"/api/rules/tanstack-virtual-v3-dynamic-windowing-guardrail?format=cursor","windsurf":"/api/rules/tanstack-virtual-v3-dynamic-windowing-guardrail?format=windsurf","agents":"/api/rules/tanstack-virtual-v3-dynamic-windowing-guardrail?format=agents"}},{"id":"lexical-node-transforms-and-headless-serialization-standard","title":"Lexical Node Immutability, Transform Convergence, and Headless Serialization Invariants","category":"frontend","severity":"critical","description":"Mandates strict copy-on-write immutability using node.getWritable() inside active editor update boundaries, enforces transform idempotency to prevent reconciliation cycle blowouts, and guarantees node registry parity between headless markdown serializers and interactive editor runtimes.","antiPatternHeadline":"Direct In-Place Node Mutation and Desynchronized Headless Node Registries Causing State Corruption","stars_count":100,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","lexical","rich-text","editor","markdown","headless"],"exportEndpoints":{"claude":"/api/rules/lexical-node-transforms-and-headless-serialization-standard?format=claude","cursorMdc":"/api/rules/lexical-node-transforms-and-headless-serialization-standard?format=mdc","cursorrules":"/api/rules/lexical-node-transforms-and-headless-serialization-standard?format=cursor","windsurf":"/api/rules/lexical-node-transforms-and-headless-serialization-standard?format=windsurf","agents":"/api/rules/lexical-node-transforms-and-headless-serialization-standard?format=agents"}},{"id":"biome-1-9-monorepo-config-and-suppression-guardrails","title":"Deterministic Biome 1.9 Inheritance, VCS-Aware Formatting, and Rule Suppressions","category":"frontend","severity":"critical","description":"Enforces strict configuration inheritance across monorepo boundaries in Biome 1.9, mandating Git-backed VCS integration for incremental CI passes and strict inline suppression syntax with mandatory human-readable justification. Prevents silent drift between formatting and linting engines while eliminating unverified blanket suppression comments.","antiPatternHeadline":"Fragmented multi-tool configuration drift with undocumented blanket lint suppressions and non-VCS aware CI runs","stars_count":72,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","biome","linter","formatter","monorepo","vcs"],"exportEndpoints":{"claude":"/api/rules/biome-1-9-monorepo-config-and-suppression-guardrails?format=claude","cursorMdc":"/api/rules/biome-1-9-monorepo-config-and-suppression-guardrails?format=mdc","cursorrules":"/api/rules/biome-1-9-monorepo-config-and-suppression-guardrails?format=cursor","windsurf":"/api/rules/biome-1-9-monorepo-config-and-suppression-guardrails?format=windsurf","agents":"/api/rules/biome-1-9-monorepo-config-and-suppression-guardrails?format=agents"}},{"id":"axum-08-state-tower-resilience-guardrail","title":"Axum 0.8 Type-Safe State Extraction, Tower Middleware Ordering, and Panic Boundary Invariants","category":"backend","severity":"critical","description":"Enforces compile-time type-safe state extraction via Axum 0.8's State and FromRef traits instead of runtime Extension lookups. Mandates strict Tower ServiceBuilder middleware ordering with CatchPanicLayer, TimeoutLayer, and TraceLayer to prevent runtime panics, dropped connections, and untyped state degradation.","antiPatternHeadline":"Runtime panics from missing request extensions, misordered Tower layers dropping traces, and unhandled extractor rejections","stars_count":44,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["rust","axum","tower","backend","middleware","resilience"],"exportEndpoints":{"claude":"/api/rules/axum-08-state-tower-resilience-guardrail?format=claude","cursorMdc":"/api/rules/axum-08-state-tower-resilience-guardrail?format=mdc","cursorrules":"/api/rules/axum-08-state-tower-resilience-guardrail?format=cursor","windsurf":"/api/rules/axum-08-state-tower-resilience-guardrail?format=windsurf","agents":"/api/rules/axum-08-state-tower-resilience-guardrail?format=agents"}},{"id":"go-chi-v5-middleware-graceful-shutdown-production-standard","title":"Go Chi v5 Middleware Isolation, Context Cancellation, and Signal-Driven Graceful Shutdown","category":"backend","severity":"critical","description":"Mandates deterministic HTTP lifecycle management in Go Chi v5 services through isolated sub-router middleware stacks, strict r.Context() propagation to downstream I/O, and non-blocking OS signal-trapping graceful shutdown. Prevents dropped in-flight requests, detached context goroutine leaks, and middleware leakage across sibling sub-routes.","antiPatternHeadline":"Synchronous Server Blocking, Context Abandonment, and Leaky Sub-Router Middleware Hierarchies","stars_count":119,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","chi","concurrency","graceful-shutdown","context-propagation"],"exportEndpoints":{"claude":"/api/rules/go-chi-v5-middleware-graceful-shutdown-production-standard?format=claude","cursorMdc":"/api/rules/go-chi-v5-middleware-graceful-shutdown-production-standard?format=mdc","cursorrules":"/api/rules/go-chi-v5-middleware-graceful-shutdown-production-standard?format=cursor","windsurf":"/api/rules/go-chi-v5-middleware-graceful-shutdown-production-standard?format=windsurf","agents":"/api/rules/go-chi-v5-middleware-graceful-shutdown-production-standard?format=agents"}},{"id":"tanstack-start-ssr-streaming-search-invariants","title":"TanStack Start SSR: Type-Safe Search Validation and Deferred Streaming Architecture","category":"frontend","severity":"critical","description":"Enforces strict type safety for route search parameters using schema validators and mandates non-blocking SSR hydration through TanStack Router's deferred streaming. Prevents Time-To-First-Byte (TTFB) degradation and client-server hydration mismatches by decoupling critical route data from non-critical async promises.","antiPatternHeadline":"Blocking SSR Hydration on Secondary Promises and Parsing Raw Search Params","stars_count":94,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","tanstack-start","tanstack-router","ssr","streaming","type-safety","zod"],"exportEndpoints":{"claude":"/api/rules/tanstack-start-ssr-streaming-search-invariants?format=claude","cursorMdc":"/api/rules/tanstack-start-ssr-streaming-search-invariants?format=mdc","cursorrules":"/api/rules/tanstack-start-ssr-streaming-search-invariants?format=cursor","windsurf":"/api/rules/tanstack-start-ssr-streaming-search-invariants?format=windsurf","agents":"/api/rules/tanstack-start-ssr-streaming-search-invariants?format=agents"}},{"id":"rr7-framework-hydration-single-fetch-guardrails","title":"React Router 7 Framework Mode Hydration, Typegen, and Single-Fetch Boundaries","category":"frontend","severity":"critical","description":"Enforces architectural invariants in React Router 7 (RR7) Framework Mode by strictly managing Single Fetch serialization, route module typegen, and clientLoader hydration contracts. Prevents hydration mismatches, broken deferred stream resolutions, and type regressions caused by mixing deprecated Remix patterns with modern React Router 7 primitives.","antiPatternHeadline":"Mixing legacy Remix JSON/defer utilities with React Router 7 Single Fetch and misconfiguring clientLoader.hydrate boundaries","stars_count":58,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-router-7","remix","hydration","single-fetch","streaming","typegen"],"exportEndpoints":{"claude":"/api/rules/rr7-framework-hydration-single-fetch-guardrails?format=claude","cursorMdc":"/api/rules/rr7-framework-hydration-single-fetch-guardrails?format=mdc","cursorrules":"/api/rules/rr7-framework-hydration-single-fetch-guardrails?format=cursor","windsurf":"/api/rules/rr7-framework-hydration-single-fetch-guardrails?format=windsurf","agents":"/api/rules/rr7-framework-hydration-single-fetch-guardrails?format=agents"}},{"id":"lexical-node-transforms-and-serialization-guardrails","title":"Lexical Headless Node Mutability, Selection Reconciliation, and Markdown Engine Guardrails","category":"frontend","severity":"critical","description":"Enforces strict immutability patterns, selection preservation, and headless state reconciliation across Meta Lexical document pipelines. Prevents direct mutation of LexicalNode instances outside writable editor states and guarantees deterministic Markdown import/export without DOM dependencies. Mandates atomic transforms and safe clone operations to prevent state corruption and infinite transform loops.","antiPatternHeadline":"Direct node property mutation outside writable transactions, unhandled selection collapse during transforms, and DOM-dependent headless Markdown serialization.","stars_count":60,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","lexical","rich-text","markdown","state-management","typescript"],"exportEndpoints":{"claude":"/api/rules/lexical-node-transforms-and-serialization-guardrails?format=claude","cursorMdc":"/api/rules/lexical-node-transforms-and-serialization-guardrails?format=mdc","cursorrules":"/api/rules/lexical-node-transforms-and-serialization-guardrails?format=cursor","windsurf":"/api/rules/lexical-node-transforms-and-serialization-guardrails?format=windsurf","agents":"/api/rules/lexical-node-transforms-and-serialization-guardrails?format=agents"}},{"id":"biome-1-9-monorepo-vcs-suppression-guardrail","title":"Biome 1.9 Monorepo Configuration Inheritance, VCS Integration, and Suppression Standards","category":"frontend","severity":"critical","description":"Enforces strict configuration inheritance via the 'extends' array, deterministic Git VCS integration for dirty-file parsing, and mandatory machine-readable suppression comments with explicit reasoning in Biome 1.9+. Prevents CI/CD drift, phantom formatting conflicts, and unreviewed lint bypasses across monorepo architectures.","antiPatternHeadline":"Fragmented Prettier/ESLint Legacy Overlaps, Broken Monorepo Extends, and Arbitrary Lint Suppression","stars_count":68,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","biome","linting","formatting","monorepo","vcs","git"],"exportEndpoints":{"claude":"/api/rules/biome-1-9-monorepo-vcs-suppression-guardrail?format=claude","cursorMdc":"/api/rules/biome-1-9-monorepo-vcs-suppression-guardrail?format=mdc","cursorrules":"/api/rules/biome-1-9-monorepo-vcs-suppression-guardrail?format=cursor","windsurf":"/api/rules/biome-1-9-monorepo-vcs-suppression-guardrail?format=windsurf","agents":"/api/rules/biome-1-9-monorepo-vcs-suppression-guardrail?format=agents"}},{"id":"tanstack-start-ssr-streaming-search-params-guardrail","title":"TanStack Start SSR: Type-Safe Search Validation, Non-Blocking Deferred Streaming, and Server Hydration","category":"frontend","severity":"critical","description":"Enforces schema-driven URL state validation via validateSearch and prevents SSR Time-To-First-Byte (TTFB) bottlenecks by mandating deferred streaming for non-critical promises. Requires the use of defer() with Suspense and Await components while maintaining end-to-end type safety between server functions and client hydration.","antiPatternHeadline":"Blocking Server Render on Non-Critical Secondary Data and Bypassing Router Search Validation","stars_count":96,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["tanstack-router","tanstack-start","ssr","streaming","search-params","zod","performance"],"exportEndpoints":{"claude":"/api/rules/tanstack-start-ssr-streaming-search-params-guardrail?format=claude","cursorMdc":"/api/rules/tanstack-start-ssr-streaming-search-params-guardrail?format=mdc","cursorrules":"/api/rules/tanstack-start-ssr-streaming-search-params-guardrail?format=cursor","windsurf":"/api/rules/tanstack-start-ssr-streaming-search-params-guardrail?format=windsurf","agents":"/api/rules/tanstack-start-ssr-streaming-search-params-guardrail?format=agents"}},{"id":"valkey-8-threaded-io-cluster-failover-invariants","title":"Valkey 8.0 Threaded I/O, Slot Redirects, and Cross-Slot Script Atomicity Standard","category":"backend","severity":"critical","description":"Enforces architectural invariants for Valkey 8.0 deployments, mandating explicit hash-tag slot pinning for multi-key commands and Lua/function scripts, client-side resilience against MOVED and ASK redirection storms during topology failovers, and optimal threaded I/O configuration to avoid thread contention.","antiPatternHeadline":"Executing un-bracketed multi-key Lua scripts alongside unthrottled MOVED/ASK redirect retry loops during cluster failovers.","stars_count":83,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","valkey","redis-cluster","lua-atomicity","high-performance","threaded-io"],"exportEndpoints":{"claude":"/api/rules/valkey-8-threaded-io-cluster-failover-invariants?format=claude","cursorMdc":"/api/rules/valkey-8-threaded-io-cluster-failover-invariants?format=mdc","cursorrules":"/api/rules/valkey-8-threaded-io-cluster-failover-invariants?format=cursor","windsurf":"/api/rules/valkey-8-threaded-io-cluster-failover-invariants?format=windsurf","agents":"/api/rules/valkey-8-threaded-io-cluster-failover-invariants?format=agents"}},{"id":"rust-axum-0-8-state-tower-guardrail","title":"Axum 0.8 Type-Safe State Sub-Extraction, Tower Layer Ordering, and Zero-Panic Rejections","category":"backend","severity":"critical","description":"Enforces strict type-safe state extraction via FromRef, disciplined Tower middleware layer ordering, and resilient panic suppression in Axum 0.8 applications. Eliminates executor thread termination and ensures custom extractors resolve failures into deterministic, typed HTTP responses.","antiPatternHeadline":"Monolithic state cloning, inverted Tower layer execution order, and unhandled extractor panics crashing async executor tasks","stars_count":71,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tower","tokio","type-safety"],"exportEndpoints":{"claude":"/api/rules/rust-axum-0-8-state-tower-guardrail?format=claude","cursorMdc":"/api/rules/rust-axum-0-8-state-tower-guardrail?format=mdc","cursorrules":"/api/rules/rust-axum-0-8-state-tower-guardrail?format=cursor","windsurf":"/api/rules/rust-axum-0-8-state-tower-guardrail?format=windsurf","agents":"/api/rules/rust-axum-0-8-state-tower-guardrail?format=agents"}},{"id":"tanstack-start-ssr-streaming-search-params-production-standard","title":"TanStack Start SSR Loaders, Streaming Deferred Data, and Validated Search Params","category":"frontend","severity":"critical","description":"Enforces strict type-safety, non-blocking SSR streaming, and isomorphic isolation in TanStack Start and Fullstack TanStack Router. Requires structural schema validation for all search params, explicit deferred promise wrapping for non-critical SSR data to optimize TTFB, and strict RPC boundary isolation using createServerFn to eliminate server-only secret leaks.","antiPatternHeadline":"Unvalidated search params, blocking non-critical SSR loaders, and leaking server logic in client route bundles","stars_count":43,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","tanstack-start","tanstack-router","ssr","streaming","type-safety","zod"],"exportEndpoints":{"claude":"/api/rules/tanstack-start-ssr-streaming-search-params-production-standard?format=claude","cursorMdc":"/api/rules/tanstack-start-ssr-streaming-search-params-production-standard?format=mdc","cursorrules":"/api/rules/tanstack-start-ssr-streaming-search-params-production-standard?format=cursor","windsurf":"/api/rules/tanstack-start-ssr-streaming-search-params-production-standard?format=windsurf","agents":"/api/rules/tanstack-start-ssr-streaming-search-params-production-standard?format=agents"}},{"id":"rr7-hydration-single-fetch-streaming-boundary","title":"React Router 7 Framework Mode Hydration & Single-Fetch Stream Guardrail","category":"frontend","severity":"critical","description":"Enforces architectural constraints for React Router 7 Framework Mode hydration boundaries, single-fetch streaming semantics, and route module typegen. Prevents dual-fetch hydration waterfalls, unhandled turbo-stream promise serialization mismatches, and broken clientLoader hydration lifecycles.","antiPatternHeadline":"Bypassing Route Typegen and Misconfiguring clientLoader Hydration Lifecycles with Single Fetch","stars_count":64,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-router-7","remix","hydration","streaming","single-fetch","typegen"],"exportEndpoints":{"claude":"/api/rules/rr7-hydration-single-fetch-streaming-boundary?format=claude","cursorMdc":"/api/rules/rr7-hydration-single-fetch-streaming-boundary?format=mdc","cursorrules":"/api/rules/rr7-hydration-single-fetch-streaming-boundary?format=cursor","windsurf":"/api/rules/rr7-hydration-single-fetch-streaming-boundary?format=windsurf","agents":"/api/rules/rr7-hydration-single-fetch-streaming-boundary?format=agents"}},{"id":"tanstack-virtual-windowing-performance-production-standard","title":"TanStack Virtual 3.0: Dynamic Measurement Invariants and DOM Containment Guardrails","category":"frontend","severity":"critical","description":"Enforces strict virtualizer lifecycle integrity, dynamic element measurement via ref callbacks with stable identity keys, and CSS containment in TanStack Virtual v3. Prevents catastrophic layout thrashing, scroll-jitter loops from dynamic heights, and DOM node saturation in massive tables.","antiPatternHeadline":"Index-Keyed Dynamic Element Measurement and Unbounded Table Row Virtualization","stars_count":62,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","tanstack-virtual","performance","react","virtualization","dom-optimization"],"exportEndpoints":{"claude":"/api/rules/tanstack-virtual-windowing-performance-production-standard?format=claude","cursorMdc":"/api/rules/tanstack-virtual-windowing-performance-production-standard?format=mdc","cursorrules":"/api/rules/tanstack-virtual-windowing-performance-production-standard?format=cursor","windsurf":"/api/rules/tanstack-virtual-windowing-performance-production-standard?format=windsurf","agents":"/api/rules/tanstack-virtual-windowing-performance-production-standard?format=agents"}},{"id":"biome-config-vcs-suppression-standards","title":"Biome 1.9 Configuration Inheritance, VCS Integration, and Explicit Suppression Standards","category":"frontend","severity":"critical","description":"Enforces deterministic Biome 1.9 configuration standards across monorepos and standalone repositories. Mandates centralized configuration inheritance, direct VCS gitignore binding to prevent split-brain ignore states, and strictly documented suppression comments requiring rule-specific rationale.","antiPatternHeadline":"Fragmented Per-Package Configurations, Unsynchronized Git Ignores, and Bare Unjustified Suppressions","stars_count":48,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","biome","linter","formatter","monorepo","tooling","vcs"],"exportEndpoints":{"claude":"/api/rules/biome-config-vcs-suppression-standards?format=claude","cursorMdc":"/api/rules/biome-config-vcs-suppression-standards?format=mdc","cursorrules":"/api/rules/biome-config-vcs-suppression-standards?format=cursor","windsurf":"/api/rules/biome-config-vcs-suppression-standards?format=windsurf","agents":"/api/rules/biome-config-vcs-suppression-standards?format=agents"}},{"id":"axum-0-8-state-tower-resilience-standard","title":"Axum 0.8 Type-Safe State Architecture, Substates, and Tower Middleware Resilience","category":"backend","severity":"critical","description":"Enforces compile-time type-safe dependency injection via Axum 0.8 State and FromRef substate extraction, preventing runtime type misses from Extension. Mandates fault-tolerant Tower Service layers featuring CatchPanicLayer and custom rejection types to eliminate unhandled panics and silent connection drops.","antiPatternHeadline":"Dynamic runtime Extension extraction and unhandled panic propagation without Tower CatchPanic layers.","stars_count":98,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tower","state-management","resilience"],"exportEndpoints":{"claude":"/api/rules/axum-0-8-state-tower-resilience-standard?format=claude","cursorMdc":"/api/rules/axum-0-8-state-tower-resilience-standard?format=mdc","cursorrules":"/api/rules/axum-0-8-state-tower-resilience-standard?format=cursor","windsurf":"/api/rules/axum-0-8-state-tower-resilience-standard?format=windsurf","agents":"/api/rules/axum-0-8-state-tower-resilience-standard?format=agents"}},{"id":"svelte-5-runes-reactive-state-guardrails","title":"Svelte 5 Fine-Grained Reactivity and Snippet Architecture Standard","category":"frontend","severity":"critical","description":"Mandates strict adherence to Svelte 5 runes architecture ($state, $derived, $props, $effect, and snippets), strictly prohibiting legacy Svelte 3/4 patterns ($:, export let, <slot>). Enforces precise reactive dependency tracking, prevents infinite render loops from effect-driven derivations, and ensures snippet-based component composition.","antiPatternHeadline":"Mutating State Inside Effects and Retaining Legacy Svelte 3/4 Reactive Declarations ($:, export let, slots)","stars_count":89,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","typescript","reactive-programming"],"exportEndpoints":{"claude":"/api/rules/svelte-5-runes-reactive-state-guardrails?format=claude","cursorMdc":"/api/rules/svelte-5-runes-reactive-state-guardrails?format=mdc","cursorrules":"/api/rules/svelte-5-runes-reactive-state-guardrails?format=cursor","windsurf":"/api/rules/svelte-5-runes-reactive-state-guardrails?format=windsurf","agents":"/api/rules/svelte-5-runes-reactive-state-guardrails?format=agents"}},{"id":"tanstack-start-ssr-streaming-params-standard","title":"TanStack Start Type-Safe Search Params, SSR Loaders, and Deferred Streaming Guardrail","category":"frontend","severity":"critical","description":"Enforces strict validation of search parameters via schema parsers, non-blocking SSR execution via deferred streaming with Suspense and Await, and proper hydration boundaries in TanStack Start routes. Prevents hydration mismatches, TTFB bottlenecks caused by unstreamed async loaders, and runtime parameter injection vulnerabilities.","antiPatternHeadline":"Awaiting non-critical data in synchronous SSR loaders without streaming, while parsing search parameters unsafely without route-level schema validation.","stars_count":44,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","tanstack-start","tanstack-router","ssr","search-params","streaming"],"exportEndpoints":{"claude":"/api/rules/tanstack-start-ssr-streaming-params-standard?format=claude","cursorMdc":"/api/rules/tanstack-start-ssr-streaming-params-standard?format=mdc","cursorrules":"/api/rules/tanstack-start-ssr-streaming-params-standard?format=cursor","windsurf":"/api/rules/tanstack-start-ssr-streaming-params-standard?format=windsurf","agents":"/api/rules/tanstack-start-ssr-streaming-params-standard?format=agents"}},{"id":"rr7-hydration-single-fetch-streaming-invariants","title":"React Router 7 Framework Mode Hydration and Single-Fetch Data Boundaries","category":"frontend","severity":"critical","description":"Enforces strict hydration safety, typegen contract conformance, and single-fetch boundaries in React Router 7 framework mode. Prevents hydration mismatches and streaming race conditions by mandating turbo-stream native primitives, explicit clientLoader.hydrate execution policies, and route module type bindings from generated ./+types artefacts.","antiPatternHeadline":"Bypassing Typegen Contracts and Misconfiguring clientLoader Hydration Boundaries in React Router 7","stars_count":97,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-router-7","hydration","single-fetch","streaming","typegen"],"exportEndpoints":{"claude":"/api/rules/rr7-hydration-single-fetch-streaming-invariants?format=claude","cursorMdc":"/api/rules/rr7-hydration-single-fetch-streaming-invariants?format=mdc","cursorrules":"/api/rules/rr7-hydration-single-fetch-streaming-invariants?format=cursor","windsurf":"/api/rules/rr7-hydration-single-fetch-streaming-invariants?format=windsurf","agents":"/api/rules/rr7-hydration-single-fetch-streaming-invariants?format=agents"}},{"id":"lexical-headless-transforms-selection-reconciliation","title":"Lexical Headless Transforms, Selection Invariants, and Markdown Serialization Guardrail","category":"frontend","severity":"critical","description":"Enforces strict idempotency and immutability rules within Meta Lexical node transforms, selection reconciliation cycles, and headless Markdown serialization pipelines. Eliminates infinite transform loops caused by un-guarded dirty flags, caret jumping from naive selection clobbering, and hydration crashes in DOM-less environments.","antiPatternHeadline":"Mutating Un-cloned Nodes, Non-Idempotent Transform Loops, and Selection Dropping in Headless Lexical Pipelines","stars_count":47,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","lexical","rich-text","markdown","headless","state-management"],"exportEndpoints":{"claude":"/api/rules/lexical-headless-transforms-selection-reconciliation?format=claude","cursorMdc":"/api/rules/lexical-headless-transforms-selection-reconciliation?format=mdc","cursorrules":"/api/rules/lexical-headless-transforms-selection-reconciliation?format=cursor","windsurf":"/api/rules/lexical-headless-transforms-selection-reconciliation?format=windsurf","agents":"/api/rules/lexical-headless-transforms-selection-reconciliation?format=agents"}},{"id":"biome-config-vcs-deterministic-suppression","title":"Biome 1.9 Monorepo Inheritance, VCS Boundary, and Rule Suppression Standard","category":"frontend","severity":"critical","description":"Enforces deterministic configuration patterns for Biome 1.9 across monorepos and isolated services. Mandates native VCS integration to guarantee build boundary consistency with Git, explicit monorepo inheritance trees via extends, and deterministic inline rule suppression requiring non-empty rationale clauses.","antiPatternHeadline":"Leaking Untracked Artifacts via Missing VCS Integrations and Unjustified Suppression Comments","stars_count":47,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","biome","linter","formatter","tooling","typescript"],"exportEndpoints":{"claude":"/api/rules/biome-config-vcs-deterministic-suppression?format=claude","cursorMdc":"/api/rules/biome-config-vcs-deterministic-suppression?format=mdc","cursorrules":"/api/rules/biome-config-vcs-deterministic-suppression?format=cursor","windsurf":"/api/rules/biome-config-vcs-deterministic-suppression?format=windsurf","agents":"/api/rules/biome-config-vcs-deterministic-suppression?format=agents"}},{"id":"valkey-8-threaded-io-cluster-failover-guardrail","title":"Valkey 8.0 Cluster Topology, Cross-Slot Atomicity, and Threaded I/O Invariants","category":"backend","severity":"critical","description":"Enforces strict hash-tag slot alignment for multi-key commands and Lua functions in Valkey 8.0 clusters, prevents event loop starvation under Threaded I/O configurations, and guarantees robust dynamic slot cache invalidation during cluster failovers.","antiPatternHeadline":"Unhashed multi-key Lua executions causing CROSSSLOT errors and unhandled MOVED/ASK redirect thrashing during failover","stars_count":55,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","valkey","redis","clustering","caching","distributed-systems"],"exportEndpoints":{"claude":"/api/rules/valkey-8-threaded-io-cluster-failover-guardrail?format=claude","cursorMdc":"/api/rules/valkey-8-threaded-io-cluster-failover-guardrail?format=mdc","cursorrules":"/api/rules/valkey-8-threaded-io-cluster-failover-guardrail?format=cursor","windsurf":"/api/rules/valkey-8-threaded-io-cluster-failover-guardrail?format=windsurf","agents":"/api/rules/valkey-8-threaded-io-cluster-failover-guardrail?format=agents"}},{"id":"react-router-7-hydration-typegen-boundaries","title":"React Router 7 Framework Mode Hydration, Typegen, and Single-Fetch Boundaries","category":"frontend","severity":"critical","description":"Enforces strict type safety and architectural invariants for React Router 7 Framework Mode (formerly Remix). Requires utilizing generated route module types (+types), leveraging Single Fetch turbo-stream serialization without legacy json() wrappers, and strictly managing clientLoader hydration lifecycles to prevent flash-of-unstyled-content (FOUC) and hydration mismatches.","antiPatternHeadline":"Bypassing route typegen, returning manual json() responses, and uncoordinated clientLoader hydration without Fallbacks","stars_count":57,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-router-7","remix","hydration","typegen","single-fetch"],"exportEndpoints":{"claude":"/api/rules/react-router-7-hydration-typegen-boundaries?format=claude","cursorMdc":"/api/rules/react-router-7-hydration-typegen-boundaries?format=mdc","cursorrules":"/api/rules/react-router-7-hydration-typegen-boundaries?format=cursor","windsurf":"/api/rules/react-router-7-hydration-typegen-boundaries?format=windsurf","agents":"/api/rules/react-router-7-hydration-typegen-boundaries?format=agents"}},{"id":"biome-1-9-config-inheritance-vcs-suppression-guardrail","title":"Biome 1.9 Configuration Inheritance, VCS Integration, and Strict Suppression Syntax","category":"frontend","severity":"critical","description":"Enforces deterministic Biome 1.9 single-binary linter and formatter configuration standards across monorepo and standalone codebases. Mandates centralized configuration inheritance via extends, strict VCS ignore integration to prevent artifact pollution, and strictly formatted inline suppression comments with mandatory explanatory rationales.","antiPatternHeadline":"Configuration Drift, Phantom VCS Linting, and Naked Inline Rule Suppressions","stars_count":97,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","biome","linter","formatter","tooling","typescript"],"exportEndpoints":{"claude":"/api/rules/biome-1-9-config-inheritance-vcs-suppression-guardrail?format=claude","cursorMdc":"/api/rules/biome-1-9-config-inheritance-vcs-suppression-guardrail?format=mdc","cursorrules":"/api/rules/biome-1-9-config-inheritance-vcs-suppression-guardrail?format=cursor","windsurf":"/api/rules/biome-1-9-config-inheritance-vcs-suppression-guardrail?format=windsurf","agents":"/api/rules/biome-1-9-config-inheritance-vcs-suppression-guardrail?format=agents"}},{"id":"tanstack-start-ssr-streaming-and-typesafe-search-params","title":"TanStack Start SSR Deferred Streaming & Type-Safe Search Validation Standard","category":"frontend","severity":"critical","description":"Enforces strict type-safe search parameter validation schemas and non-blocking SSR data streaming in TanStack Start routes. Prohibits blocking TTFB with un-deferred secondary data and forbids untyped query access or manual search string manipulation.","antiPatternHeadline":"Awaiting Slow I/O in Root Loaders & Consuming Untyped Search Params","stars_count":92,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","tanstack-start","tanstack-router","ssr","streaming","search-params","zod"],"exportEndpoints":{"claude":"/api/rules/tanstack-start-ssr-streaming-and-typesafe-search-params?format=claude","cursorMdc":"/api/rules/tanstack-start-ssr-streaming-and-typesafe-search-params?format=mdc","cursorrules":"/api/rules/tanstack-start-ssr-streaming-and-typesafe-search-params?format=cursor","windsurf":"/api/rules/tanstack-start-ssr-streaming-and-typesafe-search-params?format=windsurf","agents":"/api/rules/tanstack-start-ssr-streaming-and-typesafe-search-params?format=agents"}},{"id":"axum-state-extractor-tower-pipeline-standard","title":"Rust Axum 0.8 Type-Safe State Extraction & Tower Resiliency Pipeline","category":"backend","severity":"critical","description":"Enforces compile-time type-safe state extraction via Axum 0.8 FromRef traits, strict sequential extractor ordering with terminal body consumption, and deterministic Tower middleware ordering with explicit panic recovery boundaries to eliminate dropped socket connections.","antiPatternHeadline":"Dynamic Extension injection, premature body extraction, and naked Tower pipelines causing runtime panics and connection drops.","stars_count":73,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tower","middleware","concurrency"],"exportEndpoints":{"claude":"/api/rules/axum-state-extractor-tower-pipeline-standard?format=claude","cursorMdc":"/api/rules/axum-state-extractor-tower-pipeline-standard?format=mdc","cursorrules":"/api/rules/axum-state-extractor-tower-pipeline-standard?format=cursor","windsurf":"/api/rules/axum-state-extractor-tower-pipeline-standard?format=windsurf","agents":"/api/rules/axum-state-extractor-tower-pipeline-standard?format=agents"}},{"id":"rust-axum-0-8-state-tower-resilience","title":"Axum 0.8 Modular State Extraction and Tower Panic Isolation","category":"backend","severity":"critical","description":"Enforces strict type-safe state modularization using axum 0.8 FromRef extractors and resilient Tower middleware chaining. Mandates fail-safe Tower Service composition with CatchPanicLayer and structured IntoResponse rejections to prevent silent connection termination.","antiPatternHeadline":"Monolithic state coupling with legacy Extension extractors and missing Tower panic boundaries.","stars_count":102,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tower","state-management","resilience"],"exportEndpoints":{"claude":"/api/rules/rust-axum-0-8-state-tower-resilience?format=claude","cursorMdc":"/api/rules/rust-axum-0-8-state-tower-resilience?format=mdc","cursorrules":"/api/rules/rust-axum-0-8-state-tower-resilience?format=cursor","windsurf":"/api/rules/rust-axum-0-8-state-tower-resilience?format=windsurf","agents":"/api/rules/rust-axum-0-8-state-tower-resilience?format=agents"}},{"id":"tanstack-start-ssr-loader-deferred-streaming","title":"TanStack Start Type-Safe Search Params & Deferred SSR Streaming Invariants","category":"frontend","severity":"critical","description":"Enforces strict type safety for route search parameters, deterministic SSR loaders, and deferred streaming patterns in TanStack Start and Fullstack Router. Prevents blocking SSR server responses with slow network calls, eliminates client-side hydration mismatches caused by unvalidated query strings, and mandates standard deferred promise handling using the Await component.","antiPatternHeadline":"Blocking SSR TTFB with sequential loader awaits and unvalidated client-side search parameter parsing.","stars_count":44,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","tanstack-start","tanstack-router","ssr","streaming","typescript","hydration"],"exportEndpoints":{"claude":"/api/rules/tanstack-start-ssr-loader-deferred-streaming?format=claude","cursorMdc":"/api/rules/tanstack-start-ssr-loader-deferred-streaming?format=mdc","cursorrules":"/api/rules/tanstack-start-ssr-loader-deferred-streaming?format=cursor","windsurf":"/api/rules/tanstack-start-ssr-loader-deferred-streaming?format=windsurf","agents":"/api/rules/tanstack-start-ssr-loader-deferred-streaming?format=agents"}},{"id":"valkey-cluster-failover-multithread-io-standard","title":"Valkey 8.0 Cluster Topology, Slot Redirects, and Lua Atomicity Guardrails","category":"backend","severity":"critical","description":"Enforces strict cluster slot affinity using hash tags across multi-key operations and Lua scripts in Valkey 8.0, paired with topology-aware connection lifecycle management. Prevents runtime CROSSSLOT errors, stale replica reads during cluster failover elections, and pipeline starvation under multi-threaded I/O loads.","antiPatternHeadline":"Cross-Slot Lua Execution and Unhandled MOVED/ASK Redirects During Valkey Cluster Failover","stars_count":100,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","valkey","distributed-systems","clustering","lua","caching"],"exportEndpoints":{"claude":"/api/rules/valkey-cluster-failover-multithread-io-standard?format=claude","cursorMdc":"/api/rules/valkey-cluster-failover-multithread-io-standard?format=mdc","cursorrules":"/api/rules/valkey-cluster-failover-multithread-io-standard?format=cursor","windsurf":"/api/rules/valkey-cluster-failover-multithread-io-standard?format=windsurf","agents":"/api/rules/valkey-cluster-failover-multithread-io-standard?format=agents"}},{"id":"tanstack-router-ssr-loader-search-streaming-guardrail","title":"TanStack Start SSR: Strict Search Validation, Deferred Streaming, and Server Function Boundaries","category":"frontend","severity":"critical","description":"Mandates strict schema validation via validateSearch for all URL search parameters, isolates critical vs non-critical SSR payloads using defer() with Suspense/Await for non-blocking TTFB, and enforces server-only execution boundaries with createServerFn.","antiPatternHeadline":"Halting SSR Time-to-First-Byte with un-deferred slow promises and reading unvalidated raw search parameters across isomorphic boundaries.","stars_count":75,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","tanstack-router","tanstack-start","ssr","streaming","search-params","typescript"],"exportEndpoints":{"claude":"/api/rules/tanstack-router-ssr-loader-search-streaming-guardrail?format=claude","cursorMdc":"/api/rules/tanstack-router-ssr-loader-search-streaming-guardrail?format=mdc","cursorrules":"/api/rules/tanstack-router-ssr-loader-search-streaming-guardrail?format=cursor","windsurf":"/api/rules/tanstack-router-ssr-loader-search-streaming-guardrail?format=windsurf","agents":"/api/rules/tanstack-router-ssr-loader-search-streaming-guardrail?format=agents"}},{"id":"rust-axum-08-state-tower-resilience","title":"Rust Axum 0.8 Type-Safe State Extractors and Tower Middleware Composition","category":"backend","severity":"critical","description":"Enforces compile-time type-safe dependency injection via Axum 0.8 State and FromRef traits while guaranteeing panic-free Tower middleware composition. Prohibits untyped Extension state passing and mandates exhaustive IntoResponse rejection handling across all boundary extractors and service layers.","antiPatternHeadline":"Untyped Extension Passing, Monolithic State Coupling, and Unhandled Tower Service Panics","stars_count":54,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["rust","axum","tower","backend","type-safety","middleware"],"exportEndpoints":{"claude":"/api/rules/rust-axum-08-state-tower-resilience?format=claude","cursorMdc":"/api/rules/rust-axum-08-state-tower-resilience?format=mdc","cursorrules":"/api/rules/rust-axum-08-state-tower-resilience?format=cursor","windsurf":"/api/rules/rust-axum-08-state-tower-resilience?format=windsurf","agents":"/api/rules/rust-axum-08-state-tower-resilience?format=agents"}},{"id":"svelte-5-runes-reactivity-snippets-guardrail","title":"Svelte 5 Runes Reactive State & Snippets Architectural Standard","category":"frontend","severity":"critical","description":"Enforces deterministic, fine-grained reactivity using Svelte 5 Runes ($state, $derived, $effect, and $props) while deprecating legacy Svelte 3/4 reactive syntax ($:, let bindings, export let, and slot elements). Prevents reactive proxy de-structuring and guarantees pure, side-effect-free derivations with idiomatic snippet-based rendering.","antiPatternHeadline":"Mixing legacy Svelte 3/4 reactivity with Runes, de-structuring $state proxies, and causing cyclical side effects via $effect for derived calculations.","stars_count":90,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte","svelte5","runes","reactivity","typescript"],"exportEndpoints":{"claude":"/api/rules/svelte-5-runes-reactivity-snippets-guardrail?format=claude","cursorMdc":"/api/rules/svelte-5-runes-reactivity-snippets-guardrail?format=mdc","cursorrules":"/api/rules/svelte-5-runes-reactivity-snippets-guardrail?format=cursor","windsurf":"/api/rules/svelte-5-runes-reactivity-snippets-guardrail?format=windsurf","agents":"/api/rules/svelte-5-runes-reactivity-snippets-guardrail?format=agents"}},{"id":"biome-v1-9-monorepo-vcs-suppression-guardrail","title":"Biome 1.9 Monorepo Configuration Inheritance, VCS Integration, and Suppression Standards","category":"frontend","severity":"critical","description":"Enforces strict configuration inheritance across monorepo packages, enables Git VCS integration to prevent format checking untracked/ignored assets, and mandates explicit deterministic inline suppression syntax with explanatory justifications. Prevents CI drift and broken linting passes in production repositories utilizing Biome 1.9+.","antiPatternHeadline":"Fragmented rootless configs, missing VCS ignore integration, and justification-less ESLint-style rule suppression","stars_count":62,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","biome","tooling","linting","formatting","monorepo"],"exportEndpoints":{"claude":"/api/rules/biome-v1-9-monorepo-vcs-suppression-guardrail?format=claude","cursorMdc":"/api/rules/biome-v1-9-monorepo-vcs-suppression-guardrail?format=mdc","cursorrules":"/api/rules/biome-v1-9-monorepo-vcs-suppression-guardrail?format=cursor","windsurf":"/api/rules/biome-v1-9-monorepo-vcs-suppression-guardrail?format=windsurf","agents":"/api/rules/biome-v1-9-monorepo-vcs-suppression-guardrail?format=agents"}},{"id":"lexical-node-transforms-selection-serialization","title":"Lexical Engine Invariants: Immutability, Transform Cycles, and Headless Serialization","category":"frontend","severity":"critical","description":"Enforces Lexical rich text core architecture constraints: strict node immutability through `getWritable()`, cycle-free node transforms, robust selection reconciliation, and fully registered node schemas in headless Markdown serialization pipelines.","antiPatternHeadline":"Bypassing getWritable(), triggering infinite transform loops, and omitting required nodes in headless serialization contexts","stars_count":93,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","lexical","rich-text","markdown","headless-cms"],"exportEndpoints":{"claude":"/api/rules/lexical-node-transforms-selection-serialization?format=claude","cursorMdc":"/api/rules/lexical-node-transforms-selection-serialization?format=mdc","cursorrules":"/api/rules/lexical-node-transforms-selection-serialization?format=cursor","windsurf":"/api/rules/lexical-node-transforms-selection-serialization?format=windsurf","agents":"/api/rules/lexical-node-transforms-selection-serialization?format=agents"}},{"id":"biome-vcs-inheritance-suppression-standards","title":"Biome 1.9 Configuration Inheritance, VCS Integration, and Suppression Governance","category":"frontend","severity":"critical","description":"Enforces deterministic Biome 1.9 configurations across single-repo and monorepo architectures. Mandates explicit VCS Git ignore inheritance, strict JSON schema validation, deterministic extends resolution, and audit-compliant rule suppression syntax requiring fully-qualified rule names and documented justifications.","antiPatternHeadline":"Ad-Hoc File Globbing, Broken Git Ignore Inheritance, and Bare Rule Suppressions","stars_count":60,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","biome","tooling","linting","formatting","git"],"exportEndpoints":{"claude":"/api/rules/biome-vcs-inheritance-suppression-standards?format=claude","cursorMdc":"/api/rules/biome-vcs-inheritance-suppression-standards?format=mdc","cursorrules":"/api/rules/biome-vcs-inheritance-suppression-standards?format=cursor","windsurf":"/api/rules/biome-vcs-inheritance-suppression-standards?format=windsurf","agents":"/api/rules/biome-vcs-inheritance-suppression-standards?format=agents"}},{"id":"valkey-8-cluster-failover-io-threading-guardrails","title":"Valkey 8.0 Cluster Topology, Failover Redirection, and Multi-Key Script Invariants","category":"backend","severity":"critical","description":"Enforces strict production invariants for Valkey 8.0 clusters utilizing asynchronous multi-threaded I/O, hash-tagged atomic multi-key Lua scripts, and resilient slot topology refresh handling on MOVED and ASK cluster redirects during failover.","antiPatternHeadline":"Executing un-tagged multi-key operations or blocking Lua scripts under threaded I/O while mishandling cluster slot migrations and failover redirections.","stars_count":68,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","valkey","redis","clustering","distributed-systems","lua"],"exportEndpoints":{"claude":"/api/rules/valkey-8-cluster-failover-io-threading-guardrails?format=claude","cursorMdc":"/api/rules/valkey-8-cluster-failover-io-threading-guardrails?format=mdc","cursorrules":"/api/rules/valkey-8-cluster-failover-io-threading-guardrails?format=cursor","windsurf":"/api/rules/valkey-8-cluster-failover-io-threading-guardrails?format=windsurf","agents":"/api/rules/valkey-8-cluster-failover-io-threading-guardrails?format=agents"}},{"id":"valkey-8-cluster-failover-io-threading","title":"Valkey 8.0 Threaded I/O Topology, Hash Tags, and Failover Guardrails","category":"backend","severity":"critical","description":"Enforces strict key hash-tagging for multi-key operations and atomic Lua scripts, alongside cluster-aware client configuration for Valkey 8.0 threaded I/O deployments. Prevents CROSSSLOT runtime exceptions, pipeline stalls, unhandled MOVED/ASK redirect storms, and connection pool exhaustion during master failovers.","antiPatternHeadline":"Executing un-tagged multi-key Lua scripts via non-clustered clients without backoff-resilient MOVED/ASK redirection handling.","stars_count":56,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","valkey","redis","cluster","concurrency","distributed-systems"],"exportEndpoints":{"claude":"/api/rules/valkey-8-cluster-failover-io-threading?format=claude","cursorMdc":"/api/rules/valkey-8-cluster-failover-io-threading?format=mdc","cursorrules":"/api/rules/valkey-8-cluster-failover-io-threading?format=cursor","windsurf":"/api/rules/valkey-8-cluster-failover-io-threading?format=windsurf","agents":"/api/rules/valkey-8-cluster-failover-io-threading?format=agents"}},{"id":"tanstack-start-type-safe-ssr-streaming-production-standard","title":"TanStack Start SSR Loaders, Type-Safe Search Params, and Deferred Streaming Standard","category":"frontend","severity":"critical","description":"Enforces strict type safety for URL search params, prevents SSR-blocking data waterfalls through deferred promise streaming, and eliminates client-server hydration mismatches in TanStack Start. Prohibits direct access to window.location or unvalidated search params during server-side renders and requires non-critical async loader data to be deferred via defer() and consumed with Suspense and Await.","antiPatternHeadline":"Blocking Critical SSR with Un-deferred Async Loaders and Unvalidated Raw Search Parameter Access","stars_count":109,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","tanstack-start","tanstack-router","ssr","streaming","search-params","typescript"],"exportEndpoints":{"claude":"/api/rules/tanstack-start-type-safe-ssr-streaming-production-standard?format=claude","cursorMdc":"/api/rules/tanstack-start-type-safe-ssr-streaming-production-standard?format=mdc","cursorrules":"/api/rules/tanstack-start-type-safe-ssr-streaming-production-standard?format=cursor","windsurf":"/api/rules/tanstack-start-type-safe-ssr-streaming-production-standard?format=windsurf","agents":"/api/rules/tanstack-start-type-safe-ssr-streaming-production-standard?format=agents"}},{"id":"biome-vcs-inheritance-suppression-production-standard","title":"Deterministic Biome 1.9 Configuration Inheritance, VCS Sync, and Suppression Compliance","category":"frontend","severity":"critical","description":"Standardizes Biome 1.9 single-binary integration across monorepos and isolated repositories. Enforces strict Git-backed VCS ignore propagation, modular configuration inheritance via `extends`, and strictly justified, fully qualified `biome-ignore` comment suppressions. Prevents silent unformatted code commits, fragmented lint configurations, and unexplained rule overrides.","antiPatternHeadline":"Fragmented configs, bypassed Git-ignore alignment, and naked unexplained inline suppressions.","stars_count":68,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","biome","linter","formatter","tooling","vcs"],"exportEndpoints":{"claude":"/api/rules/biome-vcs-inheritance-suppression-production-standard?format=claude","cursorMdc":"/api/rules/biome-vcs-inheritance-suppression-production-standard?format=mdc","cursorrules":"/api/rules/biome-vcs-inheritance-suppression-production-standard?format=cursor","windsurf":"/api/rules/biome-vcs-inheritance-suppression-production-standard?format=windsurf","agents":"/api/rules/biome-vcs-inheritance-suppression-production-standard?format=agents"}},{"id":"tanstack-start-ssr-streaming-params","title":"TanStack Start SSR Invariants: Type-Safe Search Validation, Streaming Deferrals, and Loader Dependency Tracking","category":"frontend","severity":"critical","description":"Enforce strict schema validation on URL search parameters via validateSearch, prevent server-side TTFB bottlenecks by mandating defer() streaming for non-critical data, and guarantee deterministic hydration through explicit loaderDeps tracking across TanStack Start routes.","antiPatternHeadline":"Blocking SSR TTFB via Monolithic Loaders and Runtime Deserialization Failures via Unvalidated Search Params","stars_count":64,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["tanstack-start","tanstack-router","ssr","typescript","zod","streaming"],"exportEndpoints":{"claude":"/api/rules/tanstack-start-ssr-streaming-params?format=claude","cursorMdc":"/api/rules/tanstack-start-ssr-streaming-params?format=mdc","cursorrules":"/api/rules/tanstack-start-ssr-streaming-params?format=cursor","windsurf":"/api/rules/tanstack-start-ssr-streaming-params?format=windsurf","agents":"/api/rules/tanstack-start-ssr-streaming-params?format=agents"}},{"id":"biome-1-9-config-vcs-suppression-guardrails","title":"Biome 1.9 Configuration Inheritance, VCS Integration, and Strict Suppression","category":"frontend","severity":"critical","description":"Mandates deterministic monorepo configuration via Biome 1.9 extends syntax, binds discovery directly to Git VCS ignore manifests to eliminate filesystem desync, and requires fully justified inline suppression syntax. Prevents unanchored artifact scanning, legacy ESLint directive leakage, and silent suppression debt.","antiPatternHeadline":"Unanchored Artifact Traversals, Zombie ESLint Directives, and Unjustified Biome Suppressions","stars_count":69,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","biome","linter","formatter","tooling","typescript"],"exportEndpoints":{"claude":"/api/rules/biome-1-9-config-vcs-suppression-guardrails?format=claude","cursorMdc":"/api/rules/biome-1-9-config-vcs-suppression-guardrails?format=mdc","cursorrules":"/api/rules/biome-1-9-config-vcs-suppression-guardrails?format=cursor","windsurf":"/api/rules/biome-1-9-config-vcs-suppression-guardrails?format=windsurf","agents":"/api/rules/biome-1-9-config-vcs-suppression-guardrails?format=agents"}},{"id":"valkey-8-cluster-threaded-io-failover","title":"Valkey 8.0 Cluster Topology Routing, Hash Tagging, and Threaded I/O Guardrails","category":"backend","severity":"critical","description":"Enforces strict hash tag partition alignment ({tag}) for atomic Lua scripts and multi-key operations in Valkey 8.0 clusters, alongside deterministic cluster redirect handling (MOVED/ASK) with exponential backoff. Precludes CROSSSLOT exceptions, uncoordinated failover reconnect loops, and unbuffered pipeline degradation in threaded I/O environments.","antiPatternHeadline":"Executing un-tagged multi-key Lua scripts and naive reconnect handling during Valkey cluster failovers.","stars_count":111,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","valkey","cluster","distributed-systems","lua","caching"],"exportEndpoints":{"claude":"/api/rules/valkey-8-cluster-threaded-io-failover?format=claude","cursorMdc":"/api/rules/valkey-8-cluster-threaded-io-failover?format=mdc","cursorrules":"/api/rules/valkey-8-cluster-threaded-io-failover?format=cursor","windsurf":"/api/rules/valkey-8-cluster-threaded-io-failover?format=windsurf","agents":"/api/rules/valkey-8-cluster-threaded-io-failover?format=agents"}},{"id":"tanstack-virtual-3-windowing-performance-guardrails","title":"TanStack Virtual 3.0 Windowing Performance: Dynamic Measurement & DOM Saturation Guardrail","category":"frontend","severity":"critical","description":"Mandates deterministic element measurement, GPU-accelerated transforms, and strict overscan boundaries in TanStack Virtual v3. Prevents layout thrashing, ResizeObserver recursion loops, and DOM node saturation in high-frequency, massive tabular structures.","antiPatternHeadline":"Unbounded Overscan, Top-Offset Reflows, and Direct DOM Re-measurement Thrashing","stars_count":88,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","tanstack-virtual","react","windowing","performance","dom-saturation"],"exportEndpoints":{"claude":"/api/rules/tanstack-virtual-3-windowing-performance-guardrails?format=claude","cursorMdc":"/api/rules/tanstack-virtual-3-windowing-performance-guardrails?format=mdc","cursorrules":"/api/rules/tanstack-virtual-3-windowing-performance-guardrails?format=cursor","windsurf":"/api/rules/tanstack-virtual-3-windowing-performance-guardrails?format=windsurf","agents":"/api/rules/tanstack-virtual-3-windowing-performance-guardrails?format=agents"}},{"id":"rust-axum-08-state-tower-guardrails","title":"Rust Axum 0.8 Type-Safe State Extraction and Tower Middleware Invariants","category":"backend","severity":"critical","description":"Mandates compile-time type-safe application state sharing in Axum 0.8 using FromRef and State extractors instead of untyped extensions. Enforces resilient Tower middleware pipelines ordered with panic boundaries, tracing, and deterministic error-to-response transformations to guarantee zero uncaught panic rejections.","antiPatternHeadline":"Untyped Extension Injections and Fragile Tower Pipeline Ordering Causing Unhandled Handler Panics","stars_count":41,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["rust","axum","tower","backend","concurrency","type-safety"],"exportEndpoints":{"claude":"/api/rules/rust-axum-08-state-tower-guardrails?format=claude","cursorMdc":"/api/rules/rust-axum-08-state-tower-guardrails?format=mdc","cursorrules":"/api/rules/rust-axum-08-state-tower-guardrails?format=cursor","windsurf":"/api/rules/rust-axum-08-state-tower-guardrails?format=windsurf","agents":"/api/rules/rust-axum-08-state-tower-guardrails?format=agents"}},{"id":"valkey-8-threaded-io-cluster-topology-standard","title":"Valkey 8.0 Threaded I/O Topology Refresh, Hash Slot Affinity, and Script Atomicity Guardrails","category":"backend","severity":"critical","description":"Enforces strict cluster slot affinity, dynamic topology discovery, and non-blocking transaction patterns for Valkey 8.0 deployments. Guarantees zero CROSSSLOT script aborts, deterministic client failover during master re-elections, and prevents head-of-line blocking under multi-threaded socket I/O configurations.","antiPatternHeadline":"Executing un-hashed multi-key Lua scripts against naive single-node clients during Valkey cluster failovers.","stars_count":116,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["valkey","redis","clustering","concurrency","distributed-systems","lua","performance"],"exportEndpoints":{"claude":"/api/rules/valkey-8-threaded-io-cluster-topology-standard?format=claude","cursorMdc":"/api/rules/valkey-8-threaded-io-cluster-topology-standard?format=mdc","cursorrules":"/api/rules/valkey-8-threaded-io-cluster-topology-standard?format=cursor","windsurf":"/api/rules/valkey-8-threaded-io-cluster-topology-standard?format=windsurf","agents":"/api/rules/valkey-8-threaded-io-cluster-topology-standard?format=agents"}},{"id":"lexical-immutable-transforms-and-headless-serialization","title":"Lexical Immutable Node Transforms, Selection Reconciliation, and Headless Serialization Standard","category":"frontend","severity":"critical","description":"Enforces strict compliance with Meta Lexical's copy-on-write architecture, node reconciliation lifecycle, and headless execution boundaries. Prohibits direct node property mutations and state-crossing selection access while mandating comprehensive node registry parity in headless markdown serialization pipelines to prevent editor state desynchronization and data loss.","antiPatternHeadline":"Mutating Lexical Nodes Directly and Executing Headless Serialization with Incomplete Node Registries","stars_count":73,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","lexical","rich-text","headless","ast-reconciliation","markdown"],"exportEndpoints":{"claude":"/api/rules/lexical-immutable-transforms-and-headless-serialization?format=claude","cursorMdc":"/api/rules/lexical-immutable-transforms-and-headless-serialization?format=mdc","cursorrules":"/api/rules/lexical-immutable-transforms-and-headless-serialization?format=cursor","windsurf":"/api/rules/lexical-immutable-transforms-and-headless-serialization?format=windsurf","agents":"/api/rules/lexical-immutable-transforms-and-headless-serialization?format=agents"}},{"id":"go-chi-v5-structured-middleware-graceful-shutdown","title":"Chi v5 Context-Aware Middleware Sequencing and Graceful Server Lifecycle","category":"backend","severity":"critical","description":"Enforces strict ordering of Chi v5 middleware stacks, deterministic request context propagation, and signal-driven HTTP graceful shutdown with bounded drain intervals. Prevents goroutine leaks, unhandled context cancellations across sub-routers, and abrupt connection termination under deployment rollouts.","antiPatternHeadline":"Unordered Global Middleware, Ignoring Request Contexts in Downstream Handlers, and Abrupt Process Termination via log.Fatal","stars_count":53,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","chi-v5","graceful-shutdown","middleware","context-propagation"],"exportEndpoints":{"claude":"/api/rules/go-chi-v5-structured-middleware-graceful-shutdown?format=claude","cursorMdc":"/api/rules/go-chi-v5-structured-middleware-graceful-shutdown?format=mdc","cursorrules":"/api/rules/go-chi-v5-structured-middleware-graceful-shutdown?format=cursor","windsurf":"/api/rules/go-chi-v5-structured-middleware-graceful-shutdown?format=windsurf","agents":"/api/rules/go-chi-v5-structured-middleware-graceful-shutdown?format=agents"}},{"id":"biome-config-vcs-deterministic-suppression-standard","title":"Biome 1.9 VCS-Aware Configuration Inheritance and Deterministic Suppression Standards","category":"frontend","severity":"critical","description":"Mandates strict Biome 1.9 configuration architecture utilizing deterministic inheritance hierarchies, native Git VCS integration to prevent ignore drift, and syntactically validated rule suppression comments with mandatory explanatory justifications. Eliminates inconsistent formatting passes across CI/CD pipelines and unanchored rule overrides in monorepo workspaces.","antiPatternHeadline":"Unanchored Legacy Suppressions and Missing VCS-Ignore Bindings Causing Monorepo Drift","stars_count":73,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","biome","linter","formatter","tooling"],"exportEndpoints":{"claude":"/api/rules/biome-config-vcs-deterministic-suppression-standard?format=claude","cursorMdc":"/api/rules/biome-config-vcs-deterministic-suppression-standard?format=mdc","cursorrules":"/api/rules/biome-config-vcs-deterministic-suppression-standard?format=cursor","windsurf":"/api/rules/biome-config-vcs-deterministic-suppression-standard?format=windsurf","agents":"/api/rules/biome-config-vcs-deterministic-suppression-standard?format=agents"}},{"id":"rust-axum-08-state-tower-service-invariants","title":"Axum 0.8 Type-Safe State Extraction and Tower Middleware Invariants","category":"backend","severity":"critical","description":"Enforce strict compile-time state safety in Axum 0.8 using type-safe State extractors and modular FromRef sub-states instead of dynamic Extension containers. Mandate deterministic Tower middleware stack ordering with CatchPanicLayer and ServiceBuilder to guarantee zero unhandled panics or silent connection drops.","antiPatternHeadline":"Relying on Dynamic Extensions, Monolithic AppState Coupling, and Omitting CatchPanicLayer in Tower Middleware Stacks","stars_count":81,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tower","state-management"],"exportEndpoints":{"claude":"/api/rules/rust-axum-08-state-tower-service-invariants?format=claude","cursorMdc":"/api/rules/rust-axum-08-state-tower-service-invariants?format=mdc","cursorrules":"/api/rules/rust-axum-08-state-tower-service-invariants?format=cursor","windsurf":"/api/rules/rust-axum-08-state-tower-service-invariants?format=windsurf","agents":"/api/rules/rust-axum-08-state-tower-service-invariants?format=agents"}},{"id":"tanstack-start-ssr-streaming-and-search-params","title":"TanStack Start SSR Streaming, Loader Deferral, and Type-Safe Search Params","category":"frontend","severity":"critical","description":"Enforces strict validation of URL search parameters via standard schema parsers, guarantees non-blocking server-side streaming via defer() and React Suspense, and mandates explicit loaderDeps tracking to eliminate hydration mismatches, TTFB regressions, and stale data fetches in TanStack Start and Fullstack Router.","antiPatternHeadline":"Blocking Critical SSR TTFB with Un-deferred Promises and Reading Unvalidated Search Params","stars_count":117,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","tanstack-start","tanstack-router","ssr","streaming","search-params","zod"],"exportEndpoints":{"claude":"/api/rules/tanstack-start-ssr-streaming-and-search-params?format=claude","cursorMdc":"/api/rules/tanstack-start-ssr-streaming-and-search-params?format=mdc","cursorrules":"/api/rules/tanstack-start-ssr-streaming-and-search-params?format=cursor","windsurf":"/api/rules/tanstack-start-ssr-streaming-and-search-params?format=windsurf","agents":"/api/rules/tanstack-start-ssr-streaming-and-search-params?format=agents"}},{"id":"postgres-17-failover-slots-replication-buffers","title":"PostgreSQL 17 Logical Replication Failover Slots & Memory Buffer Invariants","category":"backend","severity":"critical","description":"PostgreSQL 17 introduces native logical replication slot failover synchronization across physical standbys, requiring explicit failover flag enablement and coordinated synchronized_standby_slots configuration. Applications managing logical streaming consumers must guard against unconstrained WAL retention by enforcing max_slot_wal_keep_size alongside bounded logical_decoding_work_mem to prevent primary disk exhaustion and shared_buffers pollution. Failure to enforce these invariants leads to broken consumer streams post-failover or catastrophic WAL accumulation.","antiPatternHeadline":"Unsynchronized Logical Slots without WAL Keep Limits Inducing Failover Loss and WAL Disk Saturation","stars_count":112,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql-17","logical-replication","failover-slots","shared-buffers","cdc"],"exportEndpoints":{"claude":"/api/rules/postgres-17-failover-slots-replication-buffers?format=claude","cursorMdc":"/api/rules/postgres-17-failover-slots-replication-buffers?format=mdc","cursorrules":"/api/rules/postgres-17-failover-slots-replication-buffers?format=cursor","windsurf":"/api/rules/postgres-17-failover-slots-replication-buffers?format=windsurf","agents":"/api/rules/postgres-17-failover-slots-replication-buffers?format=agents"}},{"id":"chromadb-hnsw-tenant-isolated-filtering","title":"ChromaDB 0.6+ Multi-Tenant Namespaces and HNSW Metadata Filter Optimization","category":"backend","severity":"critical","description":"ChromaDB 0.6+ mandates strict tenant and database namespace isolation at the client and collection tier instead of monolithic collection filtering. Executing high-selectivity tenant filters against an unpartitioned shared HNSW graph causes query recall collapse, filter thrashing, and potential data leakage across tenant boundaries.","antiPatternHeadline":"Monolithic Shared Collection with Soft Tenant Filtering and Unindexed HNSW Traversal","stars_count":55,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","chromadb","hnsw","vector-search","multi-tenancy","metadata-filtering"],"exportEndpoints":{"claude":"/api/rules/chromadb-hnsw-tenant-isolated-filtering?format=claude","cursorMdc":"/api/rules/chromadb-hnsw-tenant-isolated-filtering?format=mdc","cursorrules":"/api/rules/chromadb-hnsw-tenant-isolated-filtering?format=cursor","windsurf":"/api/rules/chromadb-hnsw-tenant-isolated-filtering?format=windsurf","agents":"/api/rules/chromadb-hnsw-tenant-isolated-filtering?format=agents"}},{"id":"drizzle-038-prepared-statements-pooling-standard","title":"Drizzle ORM 0.38 Prepared Statement Lifecycle & Pool Saturation Guardrails","category":"backend","severity":"critical","description":"Enforces strict lifecycle management for Drizzle ORM prepared statements across pooled connections, preventing named-statement collisions and pool exhaustion in relational queries. Requires transaction-scoped execution tokens, explicit error isolation for deterministic rollbacks, and explicit pool exhaustion backpressure policies.","antiPatternHeadline":"Global Unparameterized Prepared Statements Causing PgBouncer Collisions and Connection Pool Starvation","stars_count":54,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","drizzle-orm","postgresql","pgbouncer","connection-pooling","transactions"],"exportEndpoints":{"claude":"/api/rules/drizzle-038-prepared-statements-pooling-standard?format=claude","cursorMdc":"/api/rules/drizzle-038-prepared-statements-pooling-standard?format=mdc","cursorrules":"/api/rules/drizzle-038-prepared-statements-pooling-standard?format=cursor","windsurf":"/api/rules/drizzle-038-prepared-statements-pooling-standard?format=windsurf","agents":"/api/rules/drizzle-038-prepared-statements-pooling-standard?format=agents"}},{"id":"tanstack-start-ssr-streaming-type-safe-params","title":"TanStack Start SSR Loaders, Deferred Streaming, and Validated Search Params","category":"frontend","severity":"critical","description":"Enforces strict type safety and non-blocking SSR architecture in TanStack Start and TanStack Router. Mandates schema-driven search parameter validation via validateSearch, deferred streaming via defer() for slow IO, and server-side isolation using createServerFn to eliminate hydration mismatches, data waterfalls, and bundle pollution.","antiPatternHeadline":"Unvalidated URL Search Params, Blocking Full-Page SSR Waterfalls, and Leaking Node APIs in Route Loaders","stars_count":67,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","tanstack-router","tanstack-start","ssr","deferred-streaming","search-params","type-safety"],"exportEndpoints":{"claude":"/api/rules/tanstack-start-ssr-streaming-type-safe-params?format=claude","cursorMdc":"/api/rules/tanstack-start-ssr-streaming-type-safe-params?format=mdc","cursorrules":"/api/rules/tanstack-start-ssr-streaming-type-safe-params?format=cursor","windsurf":"/api/rules/tanstack-start-ssr-streaming-type-safe-params?format=windsurf","agents":"/api/rules/tanstack-start-ssr-streaming-type-safe-params?format=agents"}},{"id":"react-router-v7-framework-hydration-single-fetch","title":"React Router 7 Framework Mode: Hydration, Single Fetch, and Route Module Typegen Invariants","category":"frontend","severity":"critical","description":"In React Router 7 Framework Mode, data boundaries rely on Single Fetch architecture backed by turbo-stream serialization and auto-generated route module typegen. Violating hydration lifecycle invariants—such as wrapping naked data returns in legacy Response objects, neglecting clientLoader.hydrate execution semantics, or discarding generated Route types—triggers hydration mismatches, tears down streaming boundaries, and breaks isomorphic rendering.","antiPatternHeadline":"Bypassing Single Fetch Wire Serialization and Misconfiguring clientLoader.hydrate Lifecycle Boundaries","stars_count":90,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-router-7","remix","hydration","streaming","single-fetch","typegen"],"exportEndpoints":{"claude":"/api/rules/react-router-v7-framework-hydration-single-fetch?format=claude","cursorMdc":"/api/rules/react-router-v7-framework-hydration-single-fetch?format=mdc","cursorrules":"/api/rules/react-router-v7-framework-hydration-single-fetch?format=cursor","windsurf":"/api/rules/react-router-v7-framework-hydration-single-fetch?format=windsurf","agents":"/api/rules/react-router-v7-framework-hydration-single-fetch?format=agents"}},{"id":"biome-config-vcs-suppression-governance","title":"Biome 1.9 Monorepo Inheritance, VCS Integration, and Strict Rule Suppression Standard","category":"frontend","severity":"critical","description":"Enforces deterministic Biome 1.9 configuration architecture across monorepos using strict extends inheritance, native Git VCS integration to prevent dirty state drift, and mandatory contextual explanation syntax for inline lint suppressions. Eliminates CI cache invalidation, processing of untracked assets, and unreviewed quality bypasses.","antiPatternHeadline":"Unanchored Biome configuration omitting VCS integration and using justification-free rule suppressions or obsolete ESLint directives.","stars_count":118,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","biome","linter","formatter","monorepo","vcs"],"exportEndpoints":{"claude":"/api/rules/biome-config-vcs-suppression-governance?format=claude","cursorMdc":"/api/rules/biome-config-vcs-suppression-governance?format=mdc","cursorrules":"/api/rules/biome-config-vcs-suppression-governance?format=cursor","windsurf":"/api/rules/biome-config-vcs-suppression-governance?format=windsurf","agents":"/api/rules/biome-config-vcs-suppression-governance?format=agents"}},{"id":"tanstack-start-router-ssr-streaming-params","title":"TanStack Start SSR: Strict Search Param Validation & Deferred Streaming Invariants","category":"frontend","severity":"critical","description":"Mandates strict schema-validated search params via validateSearch, prohibits SSR TTFB blocking by enforcing defer() for non-critical loader promises, and guarantees deterministic hydration across server and client boundaries.","antiPatternHeadline":"Blocking SSR TTFB with sequential awaits and parsing raw unvalidated search params in route loaders","stars_count":85,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","tanstack-router","tanstack-start","ssr","hydration","streaming"],"exportEndpoints":{"claude":"/api/rules/tanstack-start-router-ssr-streaming-params?format=claude","cursorMdc":"/api/rules/tanstack-start-router-ssr-streaming-params?format=mdc","cursorrules":"/api/rules/tanstack-start-router-ssr-streaming-params?format=cursor","windsurf":"/api/rules/tanstack-start-router-ssr-streaming-params?format=windsurf","agents":"/api/rules/tanstack-start-router-ssr-streaming-params?format=agents"}},{"id":"rr7-hydration-single-fetch-boundaries","title":"React Router 7 Framework Mode Hydration & Single-Fetch Data Boundaries","category":"frontend","severity":"critical","description":"Enforces strict architectural boundaries for React Router 7 Framework Mode, governing typegen route modules, Single Fetch streaming contracts, and clientLoader execution lifecycles. Prevents hydration mismatches, double-fetching loops, and serialization bugs caused by legacy Remix primitives and unflagged client hydration loaders.","antiPatternHeadline":"Using legacy Remix json/defer APIs or unflagged clientLoader implementations that trigger hydration desync and streaming bottlenecks.","stars_count":119,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-router-7","remix","hydration","single-fetch","streaming","typegen"],"exportEndpoints":{"claude":"/api/rules/rr7-hydration-single-fetch-boundaries?format=claude","cursorMdc":"/api/rules/rr7-hydration-single-fetch-boundaries?format=mdc","cursorrules":"/api/rules/rr7-hydration-single-fetch-boundaries?format=cursor","windsurf":"/api/rules/rr7-hydration-single-fetch-boundaries?format=windsurf","agents":"/api/rules/rr7-hydration-single-fetch-boundaries?format=agents"}},{"id":"postgres17-logical-replication-buffers-standard","title":"PostgreSQL 17 Failover Slots, Logical Streaming, and Memory Buffer Invariants","category":"backend","severity":"critical","description":"Enforces strict failover synchronization for logical replication slots introduced in PostgreSQL 17 alongside bounded WAL retention and explicit streaming modes. Guarantees memory buffer isolation by constraining logical_decoding_work_mem and shared_buffers to prevent disk spillover and out-of-memory cascades during large transactional streams.","antiPatternHeadline":"Unsynchronized Logical Slots Without Failover Control and Unbounded WAL Retention","stars_count":63,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql17","replication","database-architecture","failover-slots","shared-buffers"],"exportEndpoints":{"claude":"/api/rules/postgres17-logical-replication-buffers-standard?format=claude","cursorMdc":"/api/rules/postgres17-logical-replication-buffers-standard?format=mdc","cursorrules":"/api/rules/postgres17-logical-replication-buffers-standard?format=cursor","windsurf":"/api/rules/postgres17-logical-replication-buffers-standard?format=windsurf","agents":"/api/rules/postgres17-logical-replication-buffers-standard?format=agents"}},{"id":"pg17-logical-replication-failover-buffers-standard","title":"PostgreSQL 17 Failover Slot Synchronization, Streaming Decoding, and Memory Invariants","category":"backend","severity":"critical","description":"PostgreSQL 17 introduces native logical replication slot synchronization (`sync_replication_slots`) and failover-enabled logical slots (`failover = true`). Failure to configure failover slots alongside bounded `max_slot_wal_keep_size`, adequate `logical_decoding_work_mem`, and streaming transaction parameters leads to unmitigated WAL exhaustion, catastrophic failover data duplication, and buffer pool eviction under high write volume.","antiPatternHeadline":"Unsynchronized Unbounded Logical Replication Slots Spilling to Disk and Exhausting WAL on Failover","stars_count":67,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql-17","logical-replication","ha-failover","shared-buffers","wal-retention"],"exportEndpoints":{"claude":"/api/rules/pg17-logical-replication-failover-buffers-standard?format=claude","cursorMdc":"/api/rules/pg17-logical-replication-failover-buffers-standard?format=mdc","cursorrules":"/api/rules/pg17-logical-replication-failover-buffers-standard?format=cursor","windsurf":"/api/rules/pg17-logical-replication-failover-buffers-standard?format=windsurf","agents":"/api/rules/pg17-logical-replication-failover-buffers-standard?format=agents"}},{"id":"valkey-8-cluster-threaded-io-failover-invariants","title":"Valkey 8.0 Multi-Threaded I/O, Hash Slot Affinity, and Failover Topology Invariants","category":"backend","severity":"critical","description":"Enforces strict hash-tag slot affinity for Lua scripts and multi-key transactions in Valkey 8.0, preventing CROSSSLOT errors across cluster shards. Mandates automated cluster topology refresh and backoff strategies during failovers and slot migrations (handling MOVED and ASK redirects), while guaranteeing compatibility with Valkey 8.0 multi-threaded I/O bounds.","antiPatternHeadline":"Executing Untagged Multi-Key Operations and Failing to Refresh Topology on Failover Slot Redirects","stars_count":103,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","valkey","cluster","failover","lua","cache","performance"],"exportEndpoints":{"claude":"/api/rules/valkey-8-cluster-threaded-io-failover-invariants?format=claude","cursorMdc":"/api/rules/valkey-8-cluster-threaded-io-failover-invariants?format=mdc","cursorrules":"/api/rules/valkey-8-cluster-threaded-io-failover-invariants?format=cursor","windsurf":"/api/rules/valkey-8-cluster-threaded-io-failover-invariants?format=windsurf","agents":"/api/rules/valkey-8-cluster-threaded-io-failover-invariants?format=agents"}},{"id":"postgres-17-logical-replication-failover-and-buffer-invariants","title":"PostgreSQL 17 Logical Replication Failover Slots & Memory Buffer Standards","category":"backend","severity":"critical","description":"Standardizes the programmatic management of PostgreSQL 17 logical replication slots and memory buffers in high-availability topologies. Mandates the use of PG17 failover-enabled slots synchronized across physical standbys, explicit max_slot_wal_keep_size bounding, and calibrated logical_decoding_work_mem to prevent primary node crashes and split-brain data streams.","antiPatternHeadline":"Unsynchronized Logical Slots Lacking Failover Flags and Unbounded WAL Retention","stars_count":100,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql-17","logical-replication","high-availability","memory-tuning"],"exportEndpoints":{"claude":"/api/rules/postgres-17-logical-replication-failover-and-buffer-invariants?format=claude","cursorMdc":"/api/rules/postgres-17-logical-replication-failover-and-buffer-invariants?format=mdc","cursorrules":"/api/rules/postgres-17-logical-replication-failover-and-buffer-invariants?format=cursor","windsurf":"/api/rules/postgres-17-logical-replication-failover-and-buffer-invariants?format=windsurf","agents":"/api/rules/postgres-17-logical-replication-failover-and-buffer-invariants?format=agents"}},{"id":"react-router-7-hydration-typegen-boundary","title":"React Router 7 Framework Mode Hydration & Single-Fetch Route Module Invariants","category":"frontend","severity":"critical","description":"Enforces strict typegen-driven route module contracts, deterministic SSR hydration boundaries, and correct clientLoader.hydrate execution flags under React Router 7 Single Fetch mode. Prevents hydration mismatches, double-fetching cascades, and runtime promise resolution failures across turbo-stream boundaries.","antiPatternHeadline":"Bypassing Typegen Route Modules and Mishandling clientLoader.hydrate During Single-Fetch Hydration","stars_count":74,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-router-7","remix","hydration","single-fetch","typegen"],"exportEndpoints":{"claude":"/api/rules/react-router-7-hydration-typegen-boundary?format=claude","cursorMdc":"/api/rules/react-router-7-hydration-typegen-boundary?format=mdc","cursorrules":"/api/rules/react-router-7-hydration-typegen-boundary?format=cursor","windsurf":"/api/rules/react-router-7-hydration-typegen-boundary?format=windsurf","agents":"/api/rules/react-router-7-hydration-typegen-boundary?format=agents"}},{"id":"biome-config-vcs-deterministic-suppression-guardrail","title":"Biome 1.9 Configuration Inheritance, VCS Synchronization, and Deterministic Suppression Standards","category":"frontend","severity":"critical","description":"Enforces deterministic configuration topology, native Git VCS boundary synchronization, and strictly justified inline suppressions across Biome 1.9 workspaces. Prevents configuration drift across monorepos, unindexed build artifact parsing, and silent quality regressions caused by legacy comment directives or unjustified suppressions.","antiPatternHeadline":"Legacy Comment Pragmas, Desynchronized VCS Ignores, and Unjustified Inline Suppressions","stars_count":102,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","biome","linter","formatter","vcs-integration","code-quality"],"exportEndpoints":{"claude":"/api/rules/biome-config-vcs-deterministic-suppression-guardrail?format=claude","cursorMdc":"/api/rules/biome-config-vcs-deterministic-suppression-guardrail?format=mdc","cursorrules":"/api/rules/biome-config-vcs-deterministic-suppression-guardrail?format=cursor","windsurf":"/api/rules/biome-config-vcs-deterministic-suppression-guardrail?format=windsurf","agents":"/api/rules/biome-config-vcs-deterministic-suppression-guardrail?format=agents"}},{"id":"tanstack-virtual-3-performance-guardrails","title":"TanStack Virtual 3.0 Dynamic Measurement and DOM Saturation Containment","category":"frontend","severity":"critical","description":"Enforces strict DOM and layout containment rules for TanStack Virtual 3.0 virtualizers handling massive datasets with dynamic dimensions. Mandates correct usage of measureElement ref callbacks, scroll margins, overscan limits, and CSS contain properties to eliminate layout thrashing and DOM node explosion. Prevents recursive remeasurement cascades and jitter during fast momentum scrolling in high-density tables and lists.","antiPatternHeadline":"Unbounded overscan and uncontained dynamic element measurement triggering infinite reflow loops and DOM saturation","stars_count":79,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","tanstack-virtual","virtualization","performance","dom-containment","layout-thrashing"],"exportEndpoints":{"claude":"/api/rules/tanstack-virtual-3-performance-guardrails?format=claude","cursorMdc":"/api/rules/tanstack-virtual-3-performance-guardrails?format=mdc","cursorrules":"/api/rules/tanstack-virtual-3-performance-guardrails?format=cursor","windsurf":"/api/rules/tanstack-virtual-3-performance-guardrails?format=windsurf","agents":"/api/rules/tanstack-virtual-3-performance-guardrails?format=agents"}},{"id":"biome-1-9-monorepo-vcs-deterministic-suppression","title":"Deterministic Biome 1.9 Monorepo Configuration, VCS Scoping, and Suppression Invariants","category":"frontend","severity":"critical","description":"Enforces strict configuration inheritance patterns, Git VCS-aware file targeting, and deterministic inline suppression syntax in Biome 1.9. Prevents divergence between root workspace policies and leaf package overrides, eliminates untracked file linting churn, and mandates explanatory justification for all lint bypasses.","antiPatternHeadline":"Ad-hoc ESLint-style suppressions, broken monorepo config inheritance, and CI-breaking untracked file formatting loops.","stars_count":83,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","biome","formatter","linter","monorepo","vcs"],"exportEndpoints":{"claude":"/api/rules/biome-1-9-monorepo-vcs-deterministic-suppression?format=claude","cursorMdc":"/api/rules/biome-1-9-monorepo-vcs-deterministic-suppression?format=mdc","cursorrules":"/api/rules/biome-1-9-monorepo-vcs-deterministic-suppression?format=cursor","windsurf":"/api/rules/biome-1-9-monorepo-vcs-deterministic-suppression?format=windsurf","agents":"/api/rules/biome-1-9-monorepo-vcs-deterministic-suppression?format=agents"}},{"id":"tanstack-start-router-ssr-data-guardrails","title":"TanStack Start & Router SSR: Type-Safe Search Params, Loaders, and Deferred Streaming Invariants","category":"frontend","severity":"critical","description":"Enforces strict type safety and streaming invariants in TanStack Start and TanStack Router fullstack applications. Mandates the use of runtime-validated search params via Zod or ArkType, ensures critical layout data blocks initial SSR while non-critical data is wrapped in defer() with Suspense/Await boundaries, and prevents client-side state desynchronization and waterfall roundtrips.","antiPatternHeadline":"Bypassing validateSearch, blocking SSR streams with slow queries, or fetching non-deferred loader data imperatively inside useEffect","stars_count":104,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","tanstack-router","tanstack-start","ssr","streaming","type-safety"],"exportEndpoints":{"claude":"/api/rules/tanstack-start-router-ssr-data-guardrails?format=claude","cursorMdc":"/api/rules/tanstack-start-router-ssr-data-guardrails?format=mdc","cursorrules":"/api/rules/tanstack-start-router-ssr-data-guardrails?format=cursor","windsurf":"/api/rules/tanstack-start-router-ssr-data-guardrails?format=windsurf","agents":"/api/rules/tanstack-start-router-ssr-data-guardrails?format=agents"}},{"id":"lexical-node-transforms-and-headless-markdown-engine","title":"Lexical State Immutability, Selection Reconciliation, and Headless Serialization","category":"frontend","severity":"critical","description":"Enforces strict Lexical clone-on-write immutability via editor transactions, prevents selection desynchronization during AST node transformations, and guarantees isomorphic headless serialization without DOM dependencies. Failure to observe Lexical transactional semantics causes infinite reconciliation loops, corrupt undo/redo stacks, and headless execution crashes.","antiPatternHeadline":"Mutating Lexical AST nodes directly without clone-on-write semantics and executing headless serialization with DOM-bound transformers","stars_count":55,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","lexical","rich-text","editor","markdown","headless"],"exportEndpoints":{"claude":"/api/rules/lexical-node-transforms-and-headless-markdown-engine?format=claude","cursorMdc":"/api/rules/lexical-node-transforms-and-headless-markdown-engine?format=mdc","cursorrules":"/api/rules/lexical-node-transforms-and-headless-markdown-engine?format=cursor","windsurf":"/api/rules/lexical-node-transforms-and-headless-markdown-engine?format=windsurf","agents":"/api/rules/lexical-node-transforms-and-headless-markdown-engine?format=agents"}},{"id":"svelte-5-runes-reactive-state-and-snippets","title":"Svelte 5 Runes Reactivity and Snippet Composition Standards","category":"frontend","severity":"critical","description":"Enforces strict architectural boundaries for Svelte 5 runes ($state, $derived, $effect, and $props), preventing reactivity loss via object destructuring and cyclic cascades. Mandates type-safe snippet composition over deprecated slot systems and restricts $effect to non-reactive DOM/external synchronization.","antiPatternHeadline":"Destructuring Reactive Proxies and Executing Impure State Mutations Inside $derived or $effect","stars_count":107,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["svelte","svelte-5","runes","frontend","reactivity","typescript"],"exportEndpoints":{"claude":"/api/rules/svelte-5-runes-reactive-state-and-snippets?format=claude","cursorMdc":"/api/rules/svelte-5-runes-reactive-state-and-snippets?format=mdc","cursorrules":"/api/rules/svelte-5-runes-reactive-state-and-snippets?format=cursor","windsurf":"/api/rules/svelte-5-runes-reactive-state-and-snippets?format=windsurf","agents":"/api/rules/svelte-5-runes-reactive-state-and-snippets?format=agents"}},{"id":"lexical-node-transforms-and-selection-reconciliation","title":"Lexical Immutable Node Transforms, Selection Invariants, and Headless Markdown Serialization","category":"frontend","severity":"critical","description":"Lexical enforces an immutable copy-on-write model where node mutations are strictly restricted to writable clones inside active editor updates. Mutating node properties directly, bypassing `$getSelection()` normalization during reconciliation, or leaking DOM/layout dependencies into headless Markdown serialization leads to broken undo/redo stacks, infinite transform cascades, and catastrophic SSR crashes.","antiPatternHeadline":"Direct In-Place Node Property Mutation and DOM-Dependent Headless Serialization","stars_count":77,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","lexical","rich-text","ast","headless","react"],"exportEndpoints":{"claude":"/api/rules/lexical-node-transforms-and-selection-reconciliation?format=claude","cursorMdc":"/api/rules/lexical-node-transforms-and-selection-reconciliation?format=mdc","cursorrules":"/api/rules/lexical-node-transforms-and-selection-reconciliation?format=cursor","windsurf":"/api/rules/lexical-node-transforms-and-selection-reconciliation?format=windsurf","agents":"/api/rules/lexical-node-transforms-and-selection-reconciliation?format=agents"}},{"id":"hono-jsx-edge-stream-pipeline-guardrails","title":"Hono JSX Edge Streaming Pipeline & Lifecycle Invariants","category":"frontend","severity":"critical","description":"Enforces non-blocking chunked HTML streaming using Hono JSX and Suspense across edge middleware pipelines on Cloudflare Workers and Deno. Prevents synchronous DOM buffering, downstream response header mutations after chunk dispatch, and unhandled stream cancellations on client disconnect.","antiPatternHeadline":"Synchronous JSX Buffering and Post-Flush Header Mutation in Edge Pipelines","stars_count":60,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","hono","jsx","streaming","edge","cloudflare-workers","deno"],"exportEndpoints":{"claude":"/api/rules/hono-jsx-edge-stream-pipeline-guardrails?format=claude","cursorMdc":"/api/rules/hono-jsx-edge-stream-pipeline-guardrails?format=mdc","cursorrules":"/api/rules/hono-jsx-edge-stream-pipeline-guardrails?format=cursor","windsurf":"/api/rules/hono-jsx-edge-stream-pipeline-guardrails?format=windsurf","agents":"/api/rules/hono-jsx-edge-stream-pipeline-guardrails?format=agents"}},{"id":"react-router-7-framework-hydration-single-fetch-production-standard","title":"React Router 7 Framework Mode: Hydration, Typegen, and Single-Fetch Boundaries","category":"frontend","severity":"critical","description":"Enforces strict architectural boundaries for React Router 7 framework mode hydration, single-fetch streaming, and virtual type generation. Prevents hydration mismatches, double-fetching cascades, and runtime crashes caused by unhandled streaming promises or improperly configured clientLoader hydration flags.","antiPatternHeadline":"Bypassing Single-Fetch turbo-stream invariants via legacy defer(), misconfigured clientLoader.hydrate flags, and naked promise consumption during hydration.","stars_count":45,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-router-7","remix","single-fetch","hydration","streaming","typescript"],"exportEndpoints":{"claude":"/api/rules/react-router-7-framework-hydration-single-fetch-production-standard?format=claude","cursorMdc":"/api/rules/react-router-7-framework-hydration-single-fetch-production-standard?format=mdc","cursorrules":"/api/rules/react-router-7-framework-hydration-single-fetch-production-standard?format=cursor","windsurf":"/api/rules/react-router-7-framework-hydration-single-fetch-production-standard?format=windsurf","agents":"/api/rules/react-router-7-framework-hydration-single-fetch-production-standard?format=agents"}},{"id":"tanstack-virtual-dynamic-measurement-saturation-standard","title":"TanStack Virtual 3.0 Dynamic Measurement and DOM Saturation Containment","category":"frontend","severity":"critical","description":"Enforces strict architectural invariants for TanStack Virtual 3.0 when virtualizing variable-height tabular datasets and infinite feeds. Prevents DOM node saturation, scroll jitter, and cascading layout recalculation cycles by mandating composite GPU-layer positioning, deterministic ref-based dynamic element measurement, and bound scroll margins.","antiPatternHeadline":"Unkeyed virtual items, top-offset layout thrashing, and uncontained dynamic element re-measurement loops causing frame drops and DOM explosion.","stars_count":63,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","tanstack-virtual","react","performance","dom-optimization","virtualization"],"exportEndpoints":{"claude":"/api/rules/tanstack-virtual-dynamic-measurement-saturation-standard?format=claude","cursorMdc":"/api/rules/tanstack-virtual-dynamic-measurement-saturation-standard?format=mdc","cursorrules":"/api/rules/tanstack-virtual-dynamic-measurement-saturation-standard?format=cursor","windsurf":"/api/rules/tanstack-virtual-dynamic-measurement-saturation-standard?format=windsurf","agents":"/api/rules/tanstack-virtual-dynamic-measurement-saturation-standard?format=agents"}},{"id":"biome-configuration-vcs-suppression-standard","title":"Biome 1.9 Unified Toolchain: Configuration Inheritance, VCS Synchronization, and Deterministic Suppression","category":"frontend","severity":"critical","description":"Enforces architectural standardization for Biome 1.9, mandating VCS-driven ignore synchronization, monorepo configuration inheritance via extends, and deterministic inline suppressions requiring explicit explanatory rationale. Prevents configuration drift, unignored vendor artifacts, and silent quality regressions.","antiPatternHeadline":"Fragmented lint configurations with silent inline bypasses and desynchronized VCS ignore rules.","stars_count":114,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","biome","linter","formatter","monorepo","toolchain"],"exportEndpoints":{"claude":"/api/rules/biome-configuration-vcs-suppression-standard?format=claude","cursorMdc":"/api/rules/biome-configuration-vcs-suppression-standard?format=mdc","cursorrules":"/api/rules/biome-configuration-vcs-suppression-standard?format=cursor","windsurf":"/api/rules/biome-configuration-vcs-suppression-standard?format=windsurf","agents":"/api/rules/biome-configuration-vcs-suppression-standard?format=agents"}},{"id":"valkey-8-cluster-topology-threaded-io-guardrail","title":"Valkey 8.0 Threaded I/O, Slot Pinning, and Cluster Failover Standards","category":"backend","severity":"critical","description":"Enforces strict architectural boundaries for Valkey 8.0 cluster topologies utilizing asynchronous multi-threaded I/O. Mandates mandatory hash-tag pinning for multi-key commands and atomic Lua scripts, deterministic handling of MOVED and ASK cluster redirects with exponential backoff and jitter, and prevents cluster topology refresh stampedes during primary failover events.","antiPatternHeadline":"Unpinned Multi-Key Script Execution with Naive Slot Refresh Stampedes","stars_count":65,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","valkey","clustering","redis-compatible","concurrency","high-availability"],"exportEndpoints":{"claude":"/api/rules/valkey-8-cluster-topology-threaded-io-guardrail?format=claude","cursorMdc":"/api/rules/valkey-8-cluster-topology-threaded-io-guardrail?format=mdc","cursorrules":"/api/rules/valkey-8-cluster-topology-threaded-io-guardrail?format=cursor","windsurf":"/api/rules/valkey-8-cluster-topology-threaded-io-guardrail?format=windsurf","agents":"/api/rules/valkey-8-cluster-topology-threaded-io-guardrail?format=agents"}},{"id":"hono-jsx-edge-stream-pipelines-standard","title":"Hono JSX Edge Streaming Pipeline & Chunked Context Preservation Standard","category":"frontend","severity":"critical","description":"Enforces non-blocking, chunked edge rendering using Hono JSX streaming primitives (`renderToReadableStream`) with correct Transfer-Encoding and Content-Type negotiation. Eliminates full-buffer DOM serialization, unhandled stream backpressure stalls, and downstream middleware stream consumption deadlocks on Cloudflare Workers and Deno runtimes.","antiPatternHeadline":"Buffering Asynchronous JSX Subtrees and Consuming Uncloned ReadableStreams in Edge Middleware","stars_count":60,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","hono","hono-jsx","streaming","edge","cloudflare-workers","deno"],"exportEndpoints":{"claude":"/api/rules/hono-jsx-edge-stream-pipelines-standard?format=claude","cursorMdc":"/api/rules/hono-jsx-edge-stream-pipelines-standard?format=mdc","cursorrules":"/api/rules/hono-jsx-edge-stream-pipelines-standard?format=cursor","windsurf":"/api/rules/hono-jsx-edge-stream-pipelines-standard?format=windsurf","agents":"/api/rules/hono-jsx-edge-stream-pipelines-standard?format=agents"}},{"id":"tanstack-virtual-windowing-performance","title":"TanStack Virtual 3.0 Dynamic Windowing and DOM Saturation Invariants","category":"frontend","severity":"critical","description":"Enforces strict virtual DOM containment, dynamic height measurement invariants, and GPU-accelerated rendering rules for TanStack Virtual 3.0. Prevents severe main-thread locking, layout thrashing, and memory leakage caused by uncontained dynamic measurements and overscan misconfigurations in high-density tables.","antiPatternHeadline":"Unmemoized Dynamic Measurement Callbacks, Layout Thrashing, and Excessive Overscan Saturation","stars_count":70,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react","tanstack-virtual","performance","virtualization","dom-optimization"],"exportEndpoints":{"claude":"/api/rules/tanstack-virtual-windowing-performance?format=claude","cursorMdc":"/api/rules/tanstack-virtual-windowing-performance?format=mdc","cursorrules":"/api/rules/tanstack-virtual-windowing-performance?format=cursor","windsurf":"/api/rules/tanstack-virtual-windowing-performance?format=windsurf","agents":"/api/rules/tanstack-virtual-windowing-performance?format=agents"}},{"id":"biome-configuration-inheritance-suppression-standards","title":"Biome 1.9 Config Inheritance, VCS Integration, and Suppression Governance","category":"frontend","severity":"critical","description":"Enforces deterministic Biome 1.9 configuration architecture utilizing declarative inheritance (`extends`), rigorous VCS ignore-file synchronization (`vcs.useIgnoreFile`), and strictly documented suppression comments. Eliminates configuration drift across monorepo workspaces and prevents undocumented linter escapes in production TypeScript codebases.","antiPatternHeadline":"Fragmented multi-config drift, unlinked VCS ignore rules, and naked suppression directives lacking rationale","stars_count":60,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","biome","linter","formatter","tooling","typescript"],"exportEndpoints":{"claude":"/api/rules/biome-configuration-inheritance-suppression-standards?format=claude","cursorMdc":"/api/rules/biome-configuration-inheritance-suppression-standards?format=mdc","cursorrules":"/api/rules/biome-configuration-inheritance-suppression-standards?format=cursor","windsurf":"/api/rules/biome-configuration-inheritance-suppression-standards?format=windsurf","agents":"/api/rules/biome-configuration-inheritance-suppression-standards?format=agents"}},{"id":"tanstack-virtual-v3-windowing-performance-standard","title":"TanStack Virtual 3.0 Dynamic Windowing, Layout Thrashing, and Scroll Isolation","category":"frontend","severity":"critical","description":"Enforces strict DOM node containment, dynamic size measurement caching, and scroll margin stabilization when virtualizing massive datasets with TanStack Virtual v3. Prevents layout thrashing, erratic scroll jitter, and catastrophic DOM node saturation through rigorous use of key extractors, ref measurement attachments, and CSS transform-based positioning.","antiPatternHeadline":"Unmemoized dynamic measurements and inline style positioning triggering browser reflow storms and scroll desynchronization.","stars_count":78,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","tanstack-virtual","virtualization","performance","react","dom-optimization"],"exportEndpoints":{"claude":"/api/rules/tanstack-virtual-v3-windowing-performance-standard?format=claude","cursorMdc":"/api/rules/tanstack-virtual-v3-windowing-performance-standard?format=mdc","cursorrules":"/api/rules/tanstack-virtual-v3-windowing-performance-standard?format=cursor","windsurf":"/api/rules/tanstack-virtual-v3-windowing-performance-standard?format=windsurf","agents":"/api/rules/tanstack-virtual-v3-windowing-performance-standard?format=agents"}},{"id":"lexical-immutable-transforms-and-headless-markdown-reconciliation","title":"Lexical Immutable Node Transforms, Selection Reconciliation, and Headless Markdown Engine Standards","category":"frontend","severity":"critical","description":"Mandates strict immutability semantics via getWritable() within Lexical editor updates, guards against recursive transform cascades, preserves selection invariants during destructive AST operations, and ensures headless serialization environments initialize identical node registries without browser DOM reliance.","antiPatternHeadline":"Direct Node Mutation, Unbounded Transform Cascades, and Stale Selection Invalidation in Headless Serializers","stars_count":118,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","lexical","rich-text","headless-editor","markdown-serialization","immutability"],"exportEndpoints":{"claude":"/api/rules/lexical-immutable-transforms-and-headless-markdown-reconciliation?format=claude","cursorMdc":"/api/rules/lexical-immutable-transforms-and-headless-markdown-reconciliation?format=mdc","cursorrules":"/api/rules/lexical-immutable-transforms-and-headless-markdown-reconciliation?format=cursor","windsurf":"/api/rules/lexical-immutable-transforms-and-headless-markdown-reconciliation?format=windsurf","agents":"/api/rules/lexical-immutable-transforms-and-headless-markdown-reconciliation?format=agents"}},{"id":"pg17-logical-replication-failover-buffer-invariants","title":"PostgreSQL 17 Logical Replication Failover Slots & Memory Buffer Invariants","category":"backend","severity":"critical","description":"Enforces PostgreSQL 17 native failover-enabled logical replication slot architecture, synchronized standby configuration, bounded WAL retention, and deterministic shared_buffers/logical_decoding_work_mem allocation. Prevents silent replication loss during physical primary failovers and eliminates cascading WAL disk exhaustion under high subscriber lag.","antiPatternHeadline":"Creating Unmanaged Logical Slots Without Failover Support or WAL Retention Bounds","stars_count":95,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","replication","pg17","infrastructure","database"],"exportEndpoints":{"claude":"/api/rules/pg17-logical-replication-failover-buffer-invariants?format=claude","cursorMdc":"/api/rules/pg17-logical-replication-failover-buffer-invariants?format=mdc","cursorrules":"/api/rules/pg17-logical-replication-failover-buffer-invariants?format=cursor","windsurf":"/api/rules/pg17-logical-replication-failover-buffer-invariants?format=windsurf","agents":"/api/rules/pg17-logical-replication-failover-buffer-invariants?format=agents"}},{"id":"chromadb-06-hnsw-metadata-filtering-tenant-sharding","title":"ChromaDB 0.6 HNSW Filter Optimization & Tenant-Isolated Sharding Guardrail","category":"backend","severity":"critical","description":"Enforces strict tenant isolation, optimal metadata indexing, and post-filter recall guarantees in ChromaDB 0.6+. Prevents catastrophic HNSW graph traversal exhaustion caused by pre-filtering high-cardinality multi-tenant workloads within a single global collection.","antiPatternHeadline":"Global Single-Collection Multi-Tenancy with Inefficient Pre-Filtering Exhaustion","stars_count":70,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","chromadb","hnsw","vector-db","tenancy","embeddings"],"exportEndpoints":{"claude":"/api/rules/chromadb-06-hnsw-metadata-filtering-tenant-sharding?format=claude","cursorMdc":"/api/rules/chromadb-06-hnsw-metadata-filtering-tenant-sharding?format=mdc","cursorrules":"/api/rules/chromadb-06-hnsw-metadata-filtering-tenant-sharding?format=cursor","windsurf":"/api/rules/chromadb-06-hnsw-metadata-filtering-tenant-sharding?format=windsurf","agents":"/api/rules/chromadb-06-hnsw-metadata-filtering-tenant-sharding?format=agents"}},{"id":"tanstack-start-router-ssr-deferred-params","title":"TanStack Start & Router SSR: Type-Safe Search Params, Loaders, and Deferred Streaming","category":"frontend","severity":"critical","description":"Mandates strict schema validation for route search parameters and non-blocking SSR via deferred streaming for secondary network requests. Prevents SSR blocking waterfalls, unvalidated URL state tampering, and hydration mismatches in TanStack Start applications.","antiPatternHeadline":"Awaiting slow secondary data in root loaders and accessing untyped search params directly from location state.","stars_count":74,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","tanstack-start","tanstack-router","ssr","search-params","deferred-streaming","typescript"],"exportEndpoints":{"claude":"/api/rules/tanstack-start-router-ssr-deferred-params?format=claude","cursorMdc":"/api/rules/tanstack-start-router-ssr-deferred-params?format=mdc","cursorrules":"/api/rules/tanstack-start-router-ssr-deferred-params?format=cursor","windsurf":"/api/rules/tanstack-start-router-ssr-deferred-params?format=windsurf","agents":"/api/rules/tanstack-start-router-ssr-deferred-params?format=agents"}},{"id":"lexical-immutable-transforms-and-headless-reconciliation","title":"Lexical Immutable Transforms, Selection Reconciliation, and Headless Serialization","category":"frontend","severity":"critical","description":"Enforce Lexical document state immutability, atomic node transformations, and caret reconciliation across headless and browser contexts. Direct node property mutations, unmapped node replacements, and missing nodes in headless editor registrations lead to irrecoverable selection collapses and silent editor state corruption.","antiPatternHeadline":"Mutating Lexical Nodes Directly and Dropping Selection During Unregistered Headless Serialization","stars_count":94,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","lexical","rich-text","immutability","markdown","headless"],"exportEndpoints":{"claude":"/api/rules/lexical-immutable-transforms-and-headless-reconciliation?format=claude","cursorMdc":"/api/rules/lexical-immutable-transforms-and-headless-reconciliation?format=mdc","cursorrules":"/api/rules/lexical-immutable-transforms-and-headless-reconciliation?format=cursor","windsurf":"/api/rules/lexical-immutable-transforms-and-headless-reconciliation?format=windsurf","agents":"/api/rules/lexical-immutable-transforms-and-headless-reconciliation?format=agents"}},{"id":"valkey-8-cluster-failover-threaded-io-standard","title":"Valkey 8.0 Threaded I/O, Cluster Slot Redirects, and Lua Atomicity","category":"backend","severity":"critical","description":"Enforces strict hash tagging for cross-key atomicity, zero-downtime cluster topology refresh during failovers, and non-blocking execution limits under Valkey 8.0 multi-threaded I/O. Prevents CROSSSLOT command rejections, network thread starvation, and stale replica reads during cluster node rebalancing.","antiPatternHeadline":"Executing un-tagged multi-key Lua scripts and naive reconnect loops during cluster slot migration or failover","stars_count":74,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","valkey","redis-compatible","cluster","lua","distributed-systems","high-availability"],"exportEndpoints":{"claude":"/api/rules/valkey-8-cluster-failover-threaded-io-standard?format=claude","cursorMdc":"/api/rules/valkey-8-cluster-failover-threaded-io-standard?format=mdc","cursorrules":"/api/rules/valkey-8-cluster-failover-threaded-io-standard?format=cursor","windsurf":"/api/rules/valkey-8-cluster-failover-threaded-io-standard?format=windsurf","agents":"/api/rules/valkey-8-cluster-failover-threaded-io-standard?format=agents"}},{"id":"bun-sqlite-wal-s3-native-streaming","title":"Bun 1.2 Embedded SQLite WAL Concurrency and Native S3 Streaming Invariants","category":"backend","severity":"critical","description":"Enforces production-grade concurrency invariants for Bun 1.2 embedded bun:sqlite with Write-Ahead Logging (WAL) and native zero-copy S3 streaming storage. Prevents database lock starvation (SQLITE_BUSY), unbounded heap consumption during object storage transfers, and unescaped SQL execution.","antiPatternHeadline":"Unconfigured SQLite Rollback Journals with In-Memory S3 File Buffering","stars_count":66,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","sqlite","s3","streaming","wal","zero-copy"],"exportEndpoints":{"claude":"/api/rules/bun-sqlite-wal-s3-native-streaming?format=claude","cursorMdc":"/api/rules/bun-sqlite-wal-s3-native-streaming?format=mdc","cursorrules":"/api/rules/bun-sqlite-wal-s3-native-streaming?format=cursor","windsurf":"/api/rules/bun-sqlite-wal-s3-native-streaming?format=windsurf","agents":"/api/rules/bun-sqlite-wal-s3-native-streaming?format=agents"}},{"id":"lexical-immutable-node-transforms-and-headless-markdown-guardrail","title":"Lexical Immutable Node Transforms, Selection Reconciliation, and Headless Serialization","category":"frontend","severity":"critical","description":"Mandates strict compliance with Lexical's copy-on-write AST model via getWritable(), boundary isolation in read/update transactions, selection reconciliation across batch transforms, and exhaustive node registration for headless markdown serialization.","antiPatternHeadline":"Direct node property mutation, unshielded recursive transforms, or missing headless node registrations breaking AST reconciliation.","stars_count":106,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","lexical","rich-text","ast","headless","markdown","typescript"],"exportEndpoints":{"claude":"/api/rules/lexical-immutable-node-transforms-and-headless-markdown-guardrail?format=claude","cursorMdc":"/api/rules/lexical-immutable-node-transforms-and-headless-markdown-guardrail?format=mdc","cursorrules":"/api/rules/lexical-immutable-node-transforms-and-headless-markdown-guardrail?format=cursor","windsurf":"/api/rules/lexical-immutable-node-transforms-and-headless-markdown-guardrail?format=windsurf","agents":"/api/rules/lexical-immutable-node-transforms-and-headless-markdown-guardrail?format=agents"}},{"id":"valkey-8-cluster-io-failover-standard","title":"Valkey 8.0 Threaded I/O Topology Caching, Hash Tagging, and Failover Resilience","category":"backend","severity":"critical","description":"Enforces strict hash-tag slot pinning for multi-key transactions and Lua scripts, explicit topology refresh pipelines for MOVED/ASK redirects during node failovers, and non-blocking command execution to prevent stalling Valkey 8.0 threaded I/O buffers.","antiPatternHeadline":"Executing unpinned multi-key Lua scripts without cluster hash tags and failing to invalidate slot topology on MOVED/ASK cluster redirects.","stars_count":61,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","valkey","redis","cluster","lua","distributed-systems","performance"],"exportEndpoints":{"claude":"/api/rules/valkey-8-cluster-io-failover-standard?format=claude","cursorMdc":"/api/rules/valkey-8-cluster-io-failover-standard?format=mdc","cursorrules":"/api/rules/valkey-8-cluster-io-failover-standard?format=cursor","windsurf":"/api/rules/valkey-8-cluster-io-failover-standard?format=windsurf","agents":"/api/rules/valkey-8-cluster-io-failover-standard?format=agents"}},{"id":"tanstack-start-ssr-streaming-guardrail","title":"TanStack Start & Router: Type-Safe Search, SSR Loaders, and Deferred Streaming","category":"frontend","severity":"critical","description":"Enforces strict type safety for URL search params via schema validation, mandates non-blocking SSR via TanStack Router's defer API for slow data, and guarantees reactive loader refetches using loaderDeps. Prevents SSR waterfall freezes, hydration mismatches, and stale route-state synchronization bugs.","antiPatternHeadline":"Blocking SSR with monolithic awaits, unvalidated search params, and missing loaderDeps","stars_count":48,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","tanstack-router","tanstack-start","ssr","deferred-streaming","zod","type-safety"],"exportEndpoints":{"claude":"/api/rules/tanstack-start-ssr-streaming-guardrail?format=claude","cursorMdc":"/api/rules/tanstack-start-ssr-streaming-guardrail?format=mdc","cursorrules":"/api/rules/tanstack-start-ssr-streaming-guardrail?format=cursor","windsurf":"/api/rules/tanstack-start-ssr-streaming-guardrail?format=windsurf","agents":"/api/rules/tanstack-start-ssr-streaming-guardrail?format=agents"}},{"id":"tanstack-virtual-dynamic-measurement-saturation","title":"TanStack Virtual 3.0 Dynamic Measurement and DOM Saturation Invariants","category":"frontend","severity":"critical","description":"Governs virtualized table and list rendering with @tanstack/react-virtual v3. Enforces stable dynamic node measurement contracts, constrained overscan margins, and hardware-accelerated positioning to eliminate layout thrashing and DOM node saturation.","antiPatternHeadline":"Unanchored dynamic item measurement, unbounded overscan, and layout-thrashing style mutations in massive virtualized tables.","stars_count":74,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","tanstack-virtual","virtualization","react","performance","dom-optimization"],"exportEndpoints":{"claude":"/api/rules/tanstack-virtual-dynamic-measurement-saturation?format=claude","cursorMdc":"/api/rules/tanstack-virtual-dynamic-measurement-saturation?format=mdc","cursorrules":"/api/rules/tanstack-virtual-dynamic-measurement-saturation?format=cursor","windsurf":"/api/rules/tanstack-virtual-dynamic-measurement-saturation?format=windsurf","agents":"/api/rules/tanstack-virtual-dynamic-measurement-saturation?format=agents"}},{"id":"axum-0-8-state-extractors-tower-service-guardrail","title":"Axum 0.8 Type-Safe State Extractors & Tower Service Composition","category":"backend","severity":"critical","description":"Mandate compile-time type-safe state injection using Axum 0.8 `State` extractors with modular `FromRef` derivations instead of fallback runtime `Extension` layers. Enforce robust Tower middleware ordering via `ServiceBuilder` with properly configured `CatchPanicLayer` to prevent unhandled thread panics from dropping TCP connections without RFC-compliant HTTP error responses.","antiPatternHeadline":"Using Untyped Extension Extractors with Misordered Tower Layers Causing Silent 500s and Connection Resets on Panic","stars_count":50,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tower","middleware","concurrency"],"exportEndpoints":{"claude":"/api/rules/axum-0-8-state-extractors-tower-service-guardrail?format=claude","cursorMdc":"/api/rules/axum-0-8-state-extractors-tower-service-guardrail?format=mdc","cursorrules":"/api/rules/axum-0-8-state-extractors-tower-service-guardrail?format=cursor","windsurf":"/api/rules/axum-0-8-state-extractors-tower-service-guardrail?format=windsurf","agents":"/api/rules/axum-0-8-state-extractors-tower-service-guardrail?format=agents"}},{"id":"chromadb-0-6-hnsw-filtering-multitenancy","title":"ChromaDB 0.6 HNSW Filter Optimization and Tenant Isolation Standard","category":"backend","severity":"critical","description":"Enforces strict tenant isolation, optimal HNSW index utilization, and structured metadata filtering semantics for ChromaDB 0.6.x. Eliminates unindexed full-collection post-filtering scans and tenant crosstalk vulnerabilities by enforcing dedicated collection sharding or prefixed deterministic namespaces combined with valid boolean metadata filter trees. Guarantees that query operations pass strict typing validations and avoid runtime unhandled exceptions during approximate nearest neighbor graph traversals.","antiPatternHeadline":"Global Single-Collection Querying with Post-Hoc Dynamic Metadata Filtering Across Tenants","stars_count":59,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","chromadb","vector-database","hnsw","multitenancy","metadata-filtering"],"exportEndpoints":{"claude":"/api/rules/chromadb-0-6-hnsw-filtering-multitenancy?format=claude","cursorMdc":"/api/rules/chromadb-0-6-hnsw-filtering-multitenancy?format=mdc","cursorrules":"/api/rules/chromadb-0-6-hnsw-filtering-multitenancy?format=cursor","windsurf":"/api/rules/chromadb-0-6-hnsw-filtering-multitenancy?format=windsurf","agents":"/api/rules/chromadb-0-6-hnsw-filtering-multitenancy?format=agents"}},{"id":"svelte-5-runes-reactivity-snippets-standard","title":"Svelte 5 Runes Reactive State, Derived Tracking, and Snippet Composition Invariants","category":"frontend","severity":"critical","description":"Svelte 5 replaces legacy compile-time variable instrumentation with runtime fine-grained reactive proxies governed by runes ($state, $derived, $effect, $props). Developers must never simulate computed state using side-effectful $effect synchronization, never destructure $state objects into plain local primitives, and eliminate legacy slots in favor of typed snippet closures.","antiPatternHeadline":"Simulating Computed State with $effect and Severing Reactivity via Proxy Destructuring","stars_count":106,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","reactivity","snippets","typescript"],"exportEndpoints":{"claude":"/api/rules/svelte-5-runes-reactivity-snippets-standard?format=claude","cursorMdc":"/api/rules/svelte-5-runes-reactivity-snippets-standard?format=mdc","cursorrules":"/api/rules/svelte-5-runes-reactivity-snippets-standard?format=cursor","windsurf":"/api/rules/svelte-5-runes-reactivity-snippets-standard?format=windsurf","agents":"/api/rules/svelte-5-runes-reactivity-snippets-standard?format=agents"}},{"id":"tanstack-virtual-dynamic-measurement-standard","title":"TanStack Virtual 3.0 Dynamic Measurement and DOM Saturation Invariants","category":"frontend","severity":"critical","description":"Enforces strict DOM node containment and precise dynamic dimension tracking in TanStack Virtual 3.0 to prevent layout thrashing, scroll jitter, and memory exhaustion in ultra-high-density data tables. Mandates transform-based virtualization, bounded overscan margins, and deterministic element measurement hooks.","antiPatternHeadline":"Unbounded overscan with synchronous layout thrashing and top-offset reflows in dynamic virtualized tables","stars_count":101,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react","tanstack-virtual","performance","windowing","dom-optimization"],"exportEndpoints":{"claude":"/api/rules/tanstack-virtual-dynamic-measurement-standard?format=claude","cursorMdc":"/api/rules/tanstack-virtual-dynamic-measurement-standard?format=mdc","cursorrules":"/api/rules/tanstack-virtual-dynamic-measurement-standard?format=cursor","windsurf":"/api/rules/tanstack-virtual-dynamic-measurement-standard?format=windsurf","agents":"/api/rules/tanstack-virtual-dynamic-measurement-standard?format=agents"}},{"id":"biome-1-9-monorepo-vcs-deterministic-suppression-standard","title":"Biome 1.9 Configuration Inheritance, VCS Integration, and Deterministic Rule Suppression","category":"frontend","severity":"critical","description":"Standardizes Biome 1.9 configuration hierarchies across monorepos and standalone repositories by enforcing strict extends semantics, native VCS ignore integration, and deterministic inline suppression syntax. Prevents configuration drift, unformatted git diff churn, and undocumented rule bypasses by demanding explanatory suppression comments with explicit rule targets.","antiPatternHeadline":"Unpinned Config Inheritance, Disconnected Git Ignored Lists, and Bare Non-Explanatory Suppression Comments","stars_count":112,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","biome","linter","formatter","monorepo","tooling"],"exportEndpoints":{"claude":"/api/rules/biome-1-9-monorepo-vcs-deterministic-suppression-standard?format=claude","cursorMdc":"/api/rules/biome-1-9-monorepo-vcs-deterministic-suppression-standard?format=mdc","cursorrules":"/api/rules/biome-1-9-monorepo-vcs-deterministic-suppression-standard?format=cursor","windsurf":"/api/rules/biome-1-9-monorepo-vcs-deterministic-suppression-standard?format=windsurf","agents":"/api/rules/biome-1-9-monorepo-vcs-deterministic-suppression-standard?format=agents"}},{"id":"axum-0-8-state-tower-resilience-production-standard","title":"Axum 0.8 Type-Safe State Subtyping, Tower Middleware Ordering, and Panic Catching","category":"backend","severity":"critical","description":"Enforces type-safe state extraction using Axum 0.8's FromRef trait for modular sub-routers, strict Tower ServiceBuilder middleware sequencing, and mandatory CatchPanicLayer integration. Prevents runtime routing panics, state extraction mismatches, and unhandled thread panics dropping active client connections without structured HTTP 500 telemetry.","antiPatternHeadline":"Dynamic Extension-based state injections and unordered Tower middleware stacks lacking panic safety boundaries.","stars_count":49,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tower","tokio","concurrency"],"exportEndpoints":{"claude":"/api/rules/axum-0-8-state-tower-resilience-production-standard?format=claude","cursorMdc":"/api/rules/axum-0-8-state-tower-resilience-production-standard?format=mdc","cursorrules":"/api/rules/axum-0-8-state-tower-resilience-production-standard?format=cursor","windsurf":"/api/rules/axum-0-8-state-tower-resilience-production-standard?format=windsurf","agents":"/api/rules/axum-0-8-state-tower-resilience-production-standard?format=agents"}},{"id":"tanstack-virtual-dynamic-measurement-production-standard","title":"TanStack Virtual 3.0 Dynamic Measurement, Transform Containment, and DOM Saturation Prevention","category":"frontend","severity":"critical","description":"Enforces strict architectural guardrails for TanStack Virtual 3.0 in massive datasets with dynamic heights. Mandates hardware-accelerated transform positioning over layout-triggering top offsets, dynamic node registration via measureElement with data-index attributes, and aggressive overscan constraints to prevent DOM node saturation and recursive layout thrashing.","antiPatternHeadline":"Layout Thrashing via Top-Offset Positioning, Missing Measurement Indices, and Unbounded Overscan Saturation","stars_count":70,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react","tanstack-virtual","performance","virtualization","dom-optimization"],"exportEndpoints":{"claude":"/api/rules/tanstack-virtual-dynamic-measurement-production-standard?format=claude","cursorMdc":"/api/rules/tanstack-virtual-dynamic-measurement-production-standard?format=mdc","cursorrules":"/api/rules/tanstack-virtual-dynamic-measurement-production-standard?format=cursor","windsurf":"/api/rules/tanstack-virtual-dynamic-measurement-production-standard?format=windsurf","agents":"/api/rules/tanstack-virtual-dynamic-measurement-production-standard?format=agents"}},{"id":"postgres-17-logical-replication-buffer-governance","title":"PostgreSQL 17 Failover Slot Sync, Logical Decoding Buffers, and WAL Safeguards","category":"backend","severity":"critical","description":"Enforces PostgreSQL 17 logical replication invariants: enabling native slot failover synchronization across physical standbys, enforcing explicit logical_decoding_work_mem boundaries to govern shared buffer interactions, and mandating finite max_slot_wal_keep_size limits to eliminate catastrophic primary node disk exhaustion.","antiPatternHeadline":"Deploying Unsynchronized Logical Slots with Uncapped WAL Retention and Unbounded Decoding Buffers","stars_count":50,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql-17","logical-replication","failover-slots","shared-buffers","database-reliability"],"exportEndpoints":{"claude":"/api/rules/postgres-17-logical-replication-buffer-governance?format=claude","cursorMdc":"/api/rules/postgres-17-logical-replication-buffer-governance?format=mdc","cursorrules":"/api/rules/postgres-17-logical-replication-buffer-governance?format=cursor","windsurf":"/api/rules/postgres-17-logical-replication-buffer-governance?format=windsurf","agents":"/api/rules/postgres-17-logical-replication-buffer-governance?format=agents"}},{"id":"chromadb-hnsw-metadata-filtering-tenant-isolation","title":"ChromaDB 0.6 HNSW Filtering, Multi-Tenant Namespaces, and Shard Architecture","category":"backend","severity":"critical","description":"Enforces strict tenant namespace isolation and calibrated HNSW graph indexing for ChromaDB 0.6+. Prevents catastrophic recall drop caused by graph candidate exhaustion during metadata pre-filtering by mandating tenant/database client scoping, metadata index alignment, and dynamic search_ef compensation.","antiPatternHeadline":"Global Monolith Collections with Blind Metadata Filtering and Uncalibrated HNSW Traversal","stars_count":71,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","chromadb","hnsw","vector-search","multi-tenancy","performance"],"exportEndpoints":{"claude":"/api/rules/chromadb-hnsw-metadata-filtering-tenant-isolation?format=claude","cursorMdc":"/api/rules/chromadb-hnsw-metadata-filtering-tenant-isolation?format=mdc","cursorrules":"/api/rules/chromadb-hnsw-metadata-filtering-tenant-isolation?format=cursor","windsurf":"/api/rules/chromadb-hnsw-metadata-filtering-tenant-isolation?format=windsurf","agents":"/api/rules/chromadb-hnsw-metadata-filtering-tenant-isolation?format=agents"}},{"id":"rr7-framework-mode-hydration-single-fetch","title":"React Router 7 Framework Mode Hydration & Single-Fetch Boundaries","category":"frontend","severity":"critical","description":"Enforces single-fetch serialization boundaries, deterministic SSR hydration, and auto-generated route module typings in React Router 7 Framework Mode. Prohibits legacy Remix response primitives (`json()`, `defer()`) and ensures un-awaited streaming promises and `clientLoader.hydrate` flags maintain type safety and avoid hydration waterfalls.","antiPatternHeadline":"Legacy Response Serialization, Unchecked clientLoader Overrides, and Manual Route Prop Typing","stars_count":66,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-router-7","remix","hydration","single-fetch","typegen"],"exportEndpoints":{"claude":"/api/rules/rr7-framework-mode-hydration-single-fetch?format=claude","cursorMdc":"/api/rules/rr7-framework-mode-hydration-single-fetch?format=mdc","cursorrules":"/api/rules/rr7-framework-mode-hydration-single-fetch?format=cursor","windsurf":"/api/rules/rr7-framework-mode-hydration-single-fetch?format=windsurf","agents":"/api/rules/rr7-framework-mode-hydration-single-fetch?format=agents"}},{"id":"axum-0-8-state-tower-production-standard","title":"Rust Axum 0.8 Type-Safe State Extraction & Resilient Tower Middleware Stack","category":"backend","severity":"critical","description":"Enforces compile-time verified sub-state extraction using Axum 0.8's FromRef pattern instead of runtime-panicking Extension extractors. Mandates strictly ordered Tower ServiceBuilder middleware stacks with CatchPanicLayer and custom rejection types to eliminate silent dropouts and unhandled connection terminations.","antiPatternHeadline":"Fragile Runtime Extension Extractors and Unprotected Tower Middleware Panic Crashes","stars_count":68,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tower","tokio","error-handling"],"exportEndpoints":{"claude":"/api/rules/axum-0-8-state-tower-production-standard?format=claude","cursorMdc":"/api/rules/axum-0-8-state-tower-production-standard?format=mdc","cursorrules":"/api/rules/axum-0-8-state-tower-production-standard?format=cursor","windsurf":"/api/rules/axum-0-8-state-tower-production-standard?format=windsurf","agents":"/api/rules/axum-0-8-state-tower-production-standard?format=agents"}},{"id":"lexical-immutable-node-transforms-and-headless-serialization","title":"Lexical Immutable Node Transforms, Selection Reconciliation, and Headless Markdown Serialization","category":"frontend","severity":"critical","description":"Enforces Lexical's immutable document update cycle by requiring writable node cloning via $node.getWritable(), preventing infinite transform loops through dirty checking, preserving selection state during reconciliation, and mandating complete node schema registration during headless markdown conversions.","antiPatternHeadline":"Mutating Lexical nodes without getWritable(), causing runaway transform loops or corrupted headless markdown output.","stars_count":102,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","lexical","rich-text","headless","markdown","react"],"exportEndpoints":{"claude":"/api/rules/lexical-immutable-node-transforms-and-headless-serialization?format=claude","cursorMdc":"/api/rules/lexical-immutable-node-transforms-and-headless-serialization?format=mdc","cursorrules":"/api/rules/lexical-immutable-node-transforms-and-headless-serialization?format=cursor","windsurf":"/api/rules/lexical-immutable-node-transforms-and-headless-serialization?format=windsurf","agents":"/api/rules/lexical-immutable-node-transforms-and-headless-serialization?format=agents"}},{"id":"valkey-8-cluster-failover-io-threading-guardrail","title":"Valkey 8.0 Threaded I/O, Cluster Slot Routing, and Hash-Tag Script Atomicity","category":"backend","severity":"critical","description":"Enforces strict cluster-aware patterns in Valkey 8.0 deployments, mandating explicit hash tags ({...}) for all multi-key operations and Lua scripts to prevent CROSSSLOT exceptions. Demands cluster client topologies with automated slot-refresh triggers upon MOVED/ASK redirects and prevents main-thread stalls by keeping Lua operations strictly O(1) amidst multi-threaded I/O.","antiPatternHeadline":"Executing un-hashed multi-key Lua scripts and naive reconnect loops during cluster failovers and socket migrations.","stars_count":96,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","valkey","clustering","failover","threaded-io","lua-atomicity"],"exportEndpoints":{"claude":"/api/rules/valkey-8-cluster-failover-io-threading-guardrail?format=claude","cursorMdc":"/api/rules/valkey-8-cluster-failover-io-threading-guardrail?format=mdc","cursorrules":"/api/rules/valkey-8-cluster-failover-io-threading-guardrail?format=cursor","windsurf":"/api/rules/valkey-8-cluster-failover-io-threading-guardrail?format=windsurf","agents":"/api/rules/valkey-8-cluster-failover-io-threading-guardrail?format=agents"}},{"id":"axum-0-8-state-and-tower-resilience","title":"Axum 0.8 Sub-State Extraction, Tower Ordering, and Panic Resilience Guardrail","category":"backend","severity":"critical","description":"Enforces type-safe sub-state extraction using Axum 0.8's FromRef trait, prevents application crashes via tower-http CatchPanicLayer integration, and guarantees deterministic Tower middleware execution order. Mandates custom error rejections implementing IntoResponse across all extractors to eliminate unformatted plain-text 400/422 failures.","antiPatternHeadline":"Global Arc-bloated state extraction, unshielded panics crashing HTTP worker runtimes, and inverted Tower layer ordering.","stars_count":112,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tower","state-management","middleware","panic-handling"],"exportEndpoints":{"claude":"/api/rules/axum-0-8-state-and-tower-resilience?format=claude","cursorMdc":"/api/rules/axum-0-8-state-and-tower-resilience?format=mdc","cursorrules":"/api/rules/axum-0-8-state-and-tower-resilience?format=cursor","windsurf":"/api/rules/axum-0-8-state-and-tower-resilience?format=windsurf","agents":"/api/rules/axum-0-8-state-and-tower-resilience?format=agents"}},{"id":"postgres-17-logical-replication-failover-and-buffer-management","title":"PostgreSQL 17 Logical Replication Failover Slots & Memory Buffer Invariants","category":"backend","severity":"critical","description":"Mandates PostgreSQL 17 failover-enabled logical replication slots across physical standby topologies, deterministic WAL retention bounds, and dedicated decoding memory buffers. Prevents silent subscriber invalidation during primary-standby failovers, unbounded disk exhaustion, and backend OOM termination under high-throughput logical streaming.","antiPatternHeadline":"Creating unmanaged logical replication slots without failover synchronization and leaving WAL keep limits unconstrained.","stars_count":70,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","postgres-17","logical-replication","failover-slots","shared-buffers"],"exportEndpoints":{"claude":"/api/rules/postgres-17-logical-replication-failover-and-buffer-management?format=claude","cursorMdc":"/api/rules/postgres-17-logical-replication-failover-and-buffer-management?format=mdc","cursorrules":"/api/rules/postgres-17-logical-replication-failover-and-buffer-management?format=cursor","windsurf":"/api/rules/postgres-17-logical-replication-failover-and-buffer-management?format=windsurf","agents":"/api/rules/postgres-17-logical-replication-failover-and-buffer-management?format=agents"}},{"id":"biome-vcs-deterministic-suppression-guardrail","title":"Biome 1.9 Configuration Inheritance, VCS Integration, and Suppression Standards","category":"frontend","severity":"critical","description":"Enforces strict configuration architecture in Biome 1.9 setups, ensuring deterministic monorepo inheritance via 'extends', native VCS-aware formatting and linting, and exact suppression comment syntax with explicit justifications. Prevents configuration drift, unformatted git diff pollution, and non-actionable suppression debt across polyrepo and monorepo environments.","antiPatternHeadline":"Ad-Hoc Suppressions Without Explanation, Git-Unaware Lint Runs, and Fragmented Non-Inherited Biome Configurations","stars_count":94,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","biome","linter","formatter","tooling","monorepo"],"exportEndpoints":{"claude":"/api/rules/biome-vcs-deterministic-suppression-guardrail?format=claude","cursorMdc":"/api/rules/biome-vcs-deterministic-suppression-guardrail?format=mdc","cursorrules":"/api/rules/biome-vcs-deterministic-suppression-guardrail?format=cursor","windsurf":"/api/rules/biome-vcs-deterministic-suppression-guardrail?format=windsurf","agents":"/api/rules/biome-vcs-deterministic-suppression-guardrail?format=agents"}},{"id":"biome-configuration-inheritance-and-deterministic-suppression","title":"Biome 1.9 Invariant Configuration Inheritance, VCS Synchronization, and Deterministic Rule Suppression","category":"frontend","severity":"critical","description":"Enforces strict configuration inheritance across monorepo boundaries using Biome 1.9 extends mechanisms, ensures native Git ignore synchronization via VCS settings, and mandates deterministic, explanation-backed suppression comment syntax. Prevents configuration drift, unformatted vendor leaks, and silent lint exemptions across TypeScript and React codebases.","antiPatternHeadline":"Fragmented Rootless Configurations, Ignored VCS Boundaries, and Naked ESLint-Style Rule Disables","stars_count":67,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","biome","linting","formatting","monorepo","vcs"],"exportEndpoints":{"claude":"/api/rules/biome-configuration-inheritance-and-deterministic-suppression?format=claude","cursorMdc":"/api/rules/biome-configuration-inheritance-and-deterministic-suppression?format=mdc","cursorrules":"/api/rules/biome-configuration-inheritance-and-deterministic-suppression?format=cursor","windsurf":"/api/rules/biome-configuration-inheritance-and-deterministic-suppression?format=windsurf","agents":"/api/rules/biome-configuration-inheritance-and-deterministic-suppression?format=agents"}},{"id":"lexical-node-transform-selection-reconciliation-standard","title":"Lexical State Immutability, Selection Reconciliation, and Headless Serialization Guardrails","category":"frontend","severity":"critical","description":"Mandates strict isolation of Lexical node mutations via getWritable() within editor.update() transactions, prevents cyclic transform cascades, and guarantees safe headless DOM-independent serialization to prevent editor state corruption and selection collapse.","antiPatternHeadline":"Direct In-Place Node Mutation and Unbounded Transform Recursion Across Headless Editor States","stars_count":83,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","lexical","rich-text","editor-state","markdown","headless"],"exportEndpoints":{"claude":"/api/rules/lexical-node-transform-selection-reconciliation-standard?format=claude","cursorMdc":"/api/rules/lexical-node-transform-selection-reconciliation-standard?format=mdc","cursorrules":"/api/rules/lexical-node-transform-selection-reconciliation-standard?format=cursor","windsurf":"/api/rules/lexical-node-transform-selection-reconciliation-standard?format=windsurf","agents":"/api/rules/lexical-node-transform-selection-reconciliation-standard?format=agents"}},{"id":"axum-0-8-state-tower-resilience-guardrail","title":"Axum 0.8 State Extraction and Tower Middleware Stack Production Invariants","category":"backend","severity":"critical","description":"Mandates type-safe state injection via Axum 0.8 State extractors and FromRef modular sub-state derivation while strictly prohibiting untyped Extension usage for application context. Enforces deterministic Tower ServiceBuilder layer sequencing and mandatory CatchPanicLayer boundaries to guarantee zero unhandled thread panics across async runtimes.","antiPatternHeadline":"Untyped runtime Extension extraction coupled with unstructured Tower middleware ordering that drops panic barriers and leaks internal faults.","stars_count":55,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tower","middleware","safety"],"exportEndpoints":{"claude":"/api/rules/axum-0-8-state-tower-resilience-guardrail?format=claude","cursorMdc":"/api/rules/axum-0-8-state-tower-resilience-guardrail?format=mdc","cursorrules":"/api/rules/axum-0-8-state-tower-resilience-guardrail?format=cursor","windsurf":"/api/rules/axum-0-8-state-tower-resilience-guardrail?format=windsurf","agents":"/api/rules/axum-0-8-state-tower-resilience-guardrail?format=agents"}},{"id":"lexical-headless-engine-transforms-and-serialization-standard","title":"Lexical Headless Node Mutability, Selection Reconciliation, and Markdown Serialization Guardrails","category":"frontend","severity":"critical","description":"Enforces immutable clone semantics via getWritable() during EditorState mutations, prevents selection collapse during asynchronous headless reconciliations, and guarantees bidirectional fidelity during headless Markdown serialization and deserialization.","antiPatternHeadline":"Mutating frozen Lexical nodes directly, bypassing getWritable(), or driving headless serialization outside editor.read/editor.update cycles.","stars_count":80,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","lexical","rich-text","editor","typescript","markdown","headless"],"exportEndpoints":{"claude":"/api/rules/lexical-headless-engine-transforms-and-serialization-standard?format=claude","cursorMdc":"/api/rules/lexical-headless-engine-transforms-and-serialization-standard?format=mdc","cursorrules":"/api/rules/lexical-headless-engine-transforms-and-serialization-standard?format=cursor","windsurf":"/api/rules/lexical-headless-engine-transforms-and-serialization-standard?format=windsurf","agents":"/api/rules/lexical-headless-engine-transforms-and-serialization-standard?format=agents"}},{"id":"valkey-8-io-threads-cluster-failover-standard","title":"Valkey 8.0 Multi-Threaded I/O, Cluster Failover, and Slot Atomicity Standard","category":"backend","severity":"critical","description":"Enforces strict cluster routing invariants and non-blocking multi-threaded I/O compatibility in Valkey 8.0. Mandates hash-tagging for multi-key Lua scripts to prevent CROSSSLOT errors, enforces non-blocking client topology refresh on MOVED/ASK redirects during master failover, and protects threaded I/O pipelines from long-running command stalls.","antiPatternHeadline":"Executing un-hashed multi-key scripts across Valkey cluster slots and ignoring MOVED/ASK topology reconfigurations during failover","stars_count":85,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","valkey","redis","distributed-systems","failover","clustering","caching"],"exportEndpoints":{"claude":"/api/rules/valkey-8-io-threads-cluster-failover-standard?format=claude","cursorMdc":"/api/rules/valkey-8-io-threads-cluster-failover-standard?format=mdc","cursorrules":"/api/rules/valkey-8-io-threads-cluster-failover-standard?format=cursor","windsurf":"/api/rules/valkey-8-io-threads-cluster-failover-standard?format=windsurf","agents":"/api/rules/valkey-8-io-threads-cluster-failover-standard?format=agents"}},{"id":"tanstack-start-router-ssr-loader-guards","title":"Strict Type-Safe Search Params, SSR Loaders, and Deferred Streaming in TanStack Start","category":"frontend","severity":"critical","description":"Enforces complete type safety across search parameters with Zod validation, prevents SSR waterfall bottlenecks by decoupling critical hydration data from deferred promises via `defer()`, and mandates strict boundary management with `Await` components. Forbids unvalidated search params and blocking SSR loaders for non-critical downstream data.","antiPatternHeadline":"Unvalidated search params leaking any-types, non-deferred SSR blocking promises, and waterfall loaders.","stars_count":111,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","tanstack-start","tanstack-router","ssr","typescript","zod"],"exportEndpoints":{"claude":"/api/rules/tanstack-start-router-ssr-loader-guards?format=claude","cursorMdc":"/api/rules/tanstack-start-router-ssr-loader-guards?format=mdc","cursorrules":"/api/rules/tanstack-start-router-ssr-loader-guards?format=cursor","windsurf":"/api/rules/tanstack-start-router-ssr-loader-guards?format=windsurf","agents":"/api/rules/tanstack-start-router-ssr-loader-guards?format=agents"}},{"id":"axum-08-state-tower-service-guardrail","title":"Axum 0.8 Substate Extraction, Tower Middleware Composition & CatchPanic Enforcement","category":"backend","severity":"critical","description":"Enforces Axum 0.8 compile-time type-safe substate extraction via `FromRef`, strict Tower layer ordering via `ServiceBuilder`, and boundary panic containment. Eliminates runtime dynamic extractor failures and unhandled thread panics dropping raw TCP streams.","antiPatternHeadline":"Untyped Dynamic Extensions and Unordered Tower Middleware Causing Silent Panics and Runtime Extraction Failures","stars_count":63,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tower","middleware","async"],"exportEndpoints":{"claude":"/api/rules/axum-08-state-tower-service-guardrail?format=claude","cursorMdc":"/api/rules/axum-08-state-tower-service-guardrail?format=mdc","cursorrules":"/api/rules/axum-08-state-tower-service-guardrail?format=cursor","windsurf":"/api/rules/axum-08-state-tower-service-guardrail?format=windsurf","agents":"/api/rules/axum-08-state-tower-service-guardrail?format=agents"}},{"id":"pg17-logical-replication-failover-memory-invariants","title":"PostgreSQL 17 Logical Failover Slots and Shared Buffer Invariants","category":"backend","severity":"critical","description":"Enforces architectural guardrails for PostgreSQL 17 streaming logical replication and memory buffer allocation. Mandates the use of PG17 native failover-enabled logical slots with standby synchronization, bounded WAL retention limits, and strict memory budgeting between shared_buffers and logical_decoding_work_mem.","antiPatternHeadline":"Creating Unsynchronized Logical Replication Slots Without Failover Flags or Bounded WAL Retention","stars_count":51,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql-17","logical-replication","ha-architecture","database-reliability"],"exportEndpoints":{"claude":"/api/rules/pg17-logical-replication-failover-memory-invariants?format=claude","cursorMdc":"/api/rules/pg17-logical-replication-failover-memory-invariants?format=mdc","cursorrules":"/api/rules/pg17-logical-replication-failover-memory-invariants?format=cursor","windsurf":"/api/rules/pg17-logical-replication-failover-memory-invariants?format=windsurf","agents":"/api/rules/pg17-logical-replication-failover-memory-invariants?format=agents"}},{"id":"postgres-17-logical-replication-buffer-invariants","title":"PostgreSQL 17 Failover Slot Sync, Streaming Decoding, and Buffer Invariants","category":"backend","severity":"critical","description":"Enforces PostgreSQL 17 logical replication and memory architecture guardrails across database orchestrators and migration scripts. Mandates failover-enabled replication slots synchronized to physical standbys, enforces controlled streaming modes to eliminate disk spillage during logical decoding, and guarantees strict bounds on shared_buffers, logical_decoding_work_mem, and max_slot_wal_keep_size to prevent primary cluster exhaustion.","antiPatternHeadline":"Unsynchronized Unbounded Logical Replication Slots Causing WAL Exhaustion and Failover Data Loss","stars_count":61,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql-17","logical-replication","high-availability","memory-tuning","database-reliability"],"exportEndpoints":{"claude":"/api/rules/postgres-17-logical-replication-buffer-invariants?format=claude","cursorMdc":"/api/rules/postgres-17-logical-replication-buffer-invariants?format=mdc","cursorrules":"/api/rules/postgres-17-logical-replication-buffer-invariants?format=cursor","windsurf":"/api/rules/postgres-17-logical-replication-buffer-invariants?format=windsurf","agents":"/api/rules/postgres-17-logical-replication-buffer-invariants?format=agents"}},{"id":"biome-v1-9-config-inheritance-vcs-suppression","title":"Biome 1.9 Monorepo Inheritance, VCS Integration, and Strict Suppression Syntax","category":"frontend","severity":"critical","description":"Enforces architectural standards for Biome 1.9 configurations across workspaces. Mandates native VCS ignore synchronization, deterministic monorepo configuration inheritance, and strictly attributed suppression syntax with mandatory rationale.","antiPatternHeadline":"Fragmented root configurations with redundant ignore lists, missing VCS links, and unattributed inline suppressions.","stars_count":44,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","biome","linter","formatter","monorepo","vcs"],"exportEndpoints":{"claude":"/api/rules/biome-v1-9-config-inheritance-vcs-suppression?format=claude","cursorMdc":"/api/rules/biome-v1-9-config-inheritance-vcs-suppression?format=mdc","cursorrules":"/api/rules/biome-v1-9-config-inheritance-vcs-suppression?format=cursor","windsurf":"/api/rules/biome-v1-9-config-inheritance-vcs-suppression?format=windsurf","agents":"/api/rules/biome-v1-9-config-inheritance-vcs-suppression?format=agents"}},{"id":"tanstack-start-ssr-streaming-loader-standard","title":"TanStack Start & Router SSR: Type-Safe Search, Parallel Loaders, and Deferred Streaming","category":"frontend","severity":"critical","description":"Enforces strict type safety and optimal hydration performance across TanStack Start and Fullstack Router SSR architectures. Requires validation schemas for all search parameters, explicit loader dependency tracking via loaderDeps, and non-blocking TTFB through deferred streaming with Await and Suspense. Eliminates hydration mismatches, waterfall fetches, and untyped query string parsing across isomorphic boundaries.","antiPatternHeadline":"Blocking SSR TTFB with non-critical awaits, omitting loaderDeps for search params, and using unvalidated raw query strings.","stars_count":47,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","tanstack-router","tanstack-start","ssr","streaming","type-safety","loaders"],"exportEndpoints":{"claude":"/api/rules/tanstack-start-ssr-streaming-loader-standard?format=claude","cursorMdc":"/api/rules/tanstack-start-ssr-streaming-loader-standard?format=mdc","cursorrules":"/api/rules/tanstack-start-ssr-streaming-loader-standard?format=cursor","windsurf":"/api/rules/tanstack-start-ssr-streaming-loader-standard?format=windsurf","agents":"/api/rules/tanstack-start-ssr-streaming-loader-standard?format=agents"}},{"id":"svelte-5-runes-reactivity-and-snippets","title":"Svelte 5 Runes Reactivity, Snippets, and Props Invariants","category":"frontend","severity":"critical","description":"Enforces fine-grained reactivity and component composition standards using Svelte 5 runes ($state, $derived, $props, $effect) and snippets. Prevents reactivity loss caused by props destructuring, eliminates circular re-renders from effect-based state synchronization, and deprecates legacy Svelte 3/4 stores and slot idioms.","antiPatternHeadline":"Destructuring $props(), Mutating $derived, Synchronizing State via $effect, and Using Legacy Slots","stars_count":64,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","snippets","typescript","reactivity"],"exportEndpoints":{"claude":"/api/rules/svelte-5-runes-reactivity-and-snippets?format=claude","cursorMdc":"/api/rules/svelte-5-runes-reactivity-and-snippets?format=mdc","cursorrules":"/api/rules/svelte-5-runes-reactivity-and-snippets?format=cursor","windsurf":"/api/rules/svelte-5-runes-reactivity-and-snippets?format=windsurf","agents":"/api/rules/svelte-5-runes-reactivity-and-snippets?format=agents"}},{"id":"biome-configuration-inheritance-suppression-standard","title":"Biome 1.9 Configuration Inheritance, VCS Integration, and Strict Rule Suppression","category":"frontend","severity":"critical","description":"Enforces strict configuration architecture for Biome 1.9+ across monorepos and standalone repositories. Mandates native VCS ignore file integration to prevent linting build artifacts, centralized configuration inheritance via the 'extends' array, and deterministic, documented inline suppression comments.","antiPatternHeadline":"Duplicated Root Configs, Missing VCS Bindings, and Naked Legacy ESLint Suppression Comments","stars_count":114,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","biome","linter","formatter","tooling","typescript"],"exportEndpoints":{"claude":"/api/rules/biome-configuration-inheritance-suppression-standard?format=claude","cursorMdc":"/api/rules/biome-configuration-inheritance-suppression-standard?format=mdc","cursorrules":"/api/rules/biome-configuration-inheritance-suppression-standard?format=cursor","windsurf":"/api/rules/biome-configuration-inheritance-suppression-standard?format=windsurf","agents":"/api/rules/biome-configuration-inheritance-suppression-standard?format=agents"}},{"id":"rust-axum-0-8-state-tower-service-safety","title":"Axum 0.8 Type-Safe State Extractors & Tower Middleware Invariants","category":"backend","severity":"critical","description":"Enforces Axum 0.8 compile-time type-safe State and Substate extraction via FromRef, strict Tower ServiceBuilder middleware ordering with CatchPanicLayer, and zero unhandled panic rejections across HTTP handler boundaries.","antiPatternHeadline":"Fragile untyped extensions, substate type-mismatch compilation panics, and unshielded middleware stacks","stars_count":71,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["rust","axum","tower","backend","concurrency","error-handling"],"exportEndpoints":{"claude":"/api/rules/rust-axum-0-8-state-tower-service-safety?format=claude","cursorMdc":"/api/rules/rust-axum-0-8-state-tower-service-safety?format=mdc","cursorrules":"/api/rules/rust-axum-0-8-state-tower-service-safety?format=cursor","windsurf":"/api/rules/rust-axum-0-8-state-tower-service-safety?format=windsurf","agents":"/api/rules/rust-axum-0-8-state-tower-service-safety?format=agents"}},{"id":"biome-1-9-vcs-inheritance-suppression-standards","title":"Biome 1.9 Configuration Inheritance, VCS Integration, and Strict Suppression Governance","category":"frontend","severity":"critical","description":"Enforces deterministic standards for Biome 1.9+ setups across modern frontend codebases and monorepos. Mandates active Git VCS integration with ignorefile synchronization, schema-validated config inheritance via 'extends', and strictly documented inline suppressions requiring explicit rule names and actionable explanations.","antiPatternHeadline":"Unsynchronized Git ignores, duplicated monorepo configurations, and unanchored or reasonless inline suppressions.","stars_count":45,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","biome","tooling","linter","formatter","monorepo"],"exportEndpoints":{"claude":"/api/rules/biome-1-9-vcs-inheritance-suppression-standards?format=claude","cursorMdc":"/api/rules/biome-1-9-vcs-inheritance-suppression-standards?format=mdc","cursorrules":"/api/rules/biome-1-9-vcs-inheritance-suppression-standards?format=cursor","windsurf":"/api/rules/biome-1-9-vcs-inheritance-suppression-standards?format=windsurf","agents":"/api/rules/biome-1-9-vcs-inheritance-suppression-standards?format=agents"}},{"id":"postgres-17-logical-replication-failover-slot-buffer-guardrail","title":"PostgreSQL 17 Failover Slot Synchronization and Memory Buffer Guardrails","category":"backend","severity":"critical","description":"Enforces failover-enabled logical replication slots and synchronized standby slot coordination introduced in PostgreSQL 17 to prevent subscriber dropouts during physical failover. Mandates explicit allocation boundaries for logical_decoding_work_mem, max_slot_wal_keep_size, and shared_buffers to prevent buffer cache pollution and catastrophic WAL disk exhaustion.","antiPatternHeadline":"Creating Legacy Non-Failover Logical Slots with Unbounded WAL Retention and Unpinned Buffer Memory","stars_count":105,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql-17","logical-replication","failover-slots","shared-buffers","wal-retention"],"exportEndpoints":{"claude":"/api/rules/postgres-17-logical-replication-failover-slot-buffer-guardrail?format=claude","cursorMdc":"/api/rules/postgres-17-logical-replication-failover-slot-buffer-guardrail?format=mdc","cursorrules":"/api/rules/postgres-17-logical-replication-failover-slot-buffer-guardrail?format=cursor","windsurf":"/api/rules/postgres-17-logical-replication-failover-slot-buffer-guardrail?format=windsurf","agents":"/api/rules/postgres-17-logical-replication-failover-slot-buffer-guardrail?format=agents"}},{"id":"chromadb-v06-hnsw-filter-tenant-sharding","title":"ChromaDB 0.6 Multi-Tenant Isolation and HNSW Filter Optimization","category":"backend","severity":"critical","description":"Enforces tenant-scoped collection partitioning and HNSW index calibration in ChromaDB 0.6+. Eliminates cross-tenant data leakage risks and prevents catastrophic vector recall collapse caused by global soft-filtering over monolithic collections.","antiPatternHeadline":"Global Multi-Tenant Monolith with Post-Query Metadata Filtering","stars_count":102,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","chromadb","hnsw","vector-database","multi-tenancy","performance"],"exportEndpoints":{"claude":"/api/rules/chromadb-v06-hnsw-filter-tenant-sharding?format=claude","cursorMdc":"/api/rules/chromadb-v06-hnsw-filter-tenant-sharding?format=mdc","cursorrules":"/api/rules/chromadb-v06-hnsw-filter-tenant-sharding?format=cursor","windsurf":"/api/rules/chromadb-v06-hnsw-filter-tenant-sharding?format=windsurf","agents":"/api/rules/chromadb-v06-hnsw-filter-tenant-sharding?format=agents"}},{"id":"postgres-17-logical-replication-memory-failover-invariants","title":"PostgreSQL 17 Failover Slot Synchronization, Streaming Decoding, and Memory Sizing Guardrails","category":"backend","severity":"critical","description":"Enforces strict production standards for PostgreSQL 17 logical replication topologies. Mandates the use of PG17 native failover-enabled logical slots, parallel streaming decoding, bounded WAL retention limits, and isolated logical_decoding_work_mem sizing to avoid primary node WAL disk exhaustion and catastrophic split-brain during standby promotion.","antiPatternHeadline":"Unsynchronized Logical Replication Slots with Unbounded WAL Retention and Unstreamed Large Transactions","stars_count":105,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql-17","logical-replication","failover-slots","memory-tuning","database-reliability"],"exportEndpoints":{"claude":"/api/rules/postgres-17-logical-replication-memory-failover-invariants?format=claude","cursorMdc":"/api/rules/postgres-17-logical-replication-memory-failover-invariants?format=mdc","cursorrules":"/api/rules/postgres-17-logical-replication-memory-failover-invariants?format=cursor","windsurf":"/api/rules/postgres-17-logical-replication-memory-failover-invariants?format=windsurf","agents":"/api/rules/postgres-17-logical-replication-memory-failover-invariants?format=agents"}},{"id":"tanstack-virtual-v3-windowing-performance-production-standard","title":"TanStack Virtual 3.0 Dynamic Windowing & Layout Containment Invariant","category":"frontend","severity":"critical","description":"Enforces strict DOM node containment, GPU-accelerated absolute transforms, and robust dynamic height measurement mechanics in TanStack Virtual 3.0. Prevents layout thrashing, scrollbar jitter, and memory saturation in high-throughput enterprise data grids by mandating hardware-accelerated transforms, data-index hooks, and bounded overscan constraints.","antiPatternHeadline":"Uncontained Layout Reflows, Jittery Measurements, and Excessive Overscan in Virtualized Tables","stars_count":58,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","tanstack-virtual","performance","virtualization","react","dom-containment"],"exportEndpoints":{"claude":"/api/rules/tanstack-virtual-v3-windowing-performance-production-standard?format=claude","cursorMdc":"/api/rules/tanstack-virtual-v3-windowing-performance-production-standard?format=mdc","cursorrules":"/api/rules/tanstack-virtual-v3-windowing-performance-production-standard?format=cursor","windsurf":"/api/rules/tanstack-virtual-v3-windowing-performance-production-standard?format=windsurf","agents":"/api/rules/tanstack-virtual-v3-windowing-performance-production-standard?format=agents"}},{"id":"biome-1-9-config-vcs-suppression-guardrail","title":"Biome 1.9 Configuration Inheritance, VCS Integration, and Explicit Rule Suppression Standards","category":"frontend","severity":"critical","description":"Standardizes Biome 1.9 adoption across enterprise codebases by enforcing native VCS ignore-file integration, deterministic configuration inheritance (`extends`), and strict, documented rule suppressions. Prevents configuration drift, eliminates duplicate ignore files, and forbids opaque rule bypasses.","antiPatternHeadline":"Ghost Ignores, Divergent Package Configs, and Undocumented ESLint-Style Lint Suppressions","stars_count":47,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","biome","linter","formatter","tooling","vcs"],"exportEndpoints":{"claude":"/api/rules/biome-1-9-config-vcs-suppression-guardrail?format=claude","cursorMdc":"/api/rules/biome-1-9-config-vcs-suppression-guardrail?format=mdc","cursorrules":"/api/rules/biome-1-9-config-vcs-suppression-guardrail?format=cursor","windsurf":"/api/rules/biome-1-9-config-vcs-suppression-guardrail?format=windsurf","agents":"/api/rules/biome-1-9-config-vcs-suppression-guardrail?format=agents"}},{"id":"biome-v1-9-config-vcs-suppression-guardrails","title":"Biome 1.9 Configuration Inheritance, VCS Integration, and Deterministic Suppression","category":"frontend","severity":"critical","description":"Enforces architectural standards for Biome 1.9+ in single-package and monorepo codebases. Mandates centralized configuration inheritance, native VCS gitignore resolution, and strictly formatted suppression comments with mandatory human-readable justifications.","antiPatternHeadline":"Legacy ESLint Disables, Broken Monorepo Inheritance, and Ignored VCS Desync","stars_count":74,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","biome","biomejs","linter","formatter","monorepo","typescript"],"exportEndpoints":{"claude":"/api/rules/biome-v1-9-config-vcs-suppression-guardrails?format=claude","cursorMdc":"/api/rules/biome-v1-9-config-vcs-suppression-guardrails?format=mdc","cursorrules":"/api/rules/biome-v1-9-config-vcs-suppression-guardrails?format=cursor","windsurf":"/api/rules/biome-v1-9-config-vcs-suppression-guardrails?format=windsurf","agents":"/api/rules/biome-v1-9-config-vcs-suppression-guardrails?format=agents"}},{"id":"rust-axum-08-state-extractors-tower-service-guardrail","title":"Rust Axum 0.8 Type-Safe State Extractors & Tower Service Invariants","category":"backend","severity":"critical","description":"Enforces compile-time type-safe dependency injection via Axum 0.8 State extractors with FromRef composition and Tower ServiceBuilder layers. Mandates zero-panic resilience through CatchPanicLayer and structured custom rejections across all HTTP boundaries.","antiPatternHeadline":"Runtime Extension Panics and Missing CatchPanicLayer Tower Boundaries","stars_count":82,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["rust","axum","tower","backend","concurrency","error-handling"],"exportEndpoints":{"claude":"/api/rules/rust-axum-08-state-extractors-tower-service-guardrail?format=claude","cursorMdc":"/api/rules/rust-axum-08-state-extractors-tower-service-guardrail?format=mdc","cursorrules":"/api/rules/rust-axum-08-state-extractors-tower-service-guardrail?format=cursor","windsurf":"/api/rules/rust-axum-08-state-extractors-tower-service-guardrail?format=windsurf","agents":"/api/rules/rust-axum-08-state-extractors-tower-service-guardrail?format=agents"}},{"id":"bun-1-2-sqlite-wal-s3-native-storage","title":"Bun 1.2 Embedded SQLite WAL Concurrency & S3 Multipart Stream Guardrails","category":"backend","severity":"critical","description":"Enforces high-throughput, low-latency architecture using Bun 1.2's native `bun:sqlite` engine and native `Bun.s3` client. Guarantees non-blocking WAL-mode concurrency, zero-copy buffer queries, robust checkpointing, and unbuffered backpressure-governed multipart stream uploads directly between storage tiers.","antiPatternHeadline":"Blocking disk I/O with standard Node wrappers, unbuffered in-memory S3 uploads, and default SQLite rollback journals causing concurrency deadlocks.","stars_count":53,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","bun:sqlite","s3","wal","streams"],"exportEndpoints":{"claude":"/api/rules/bun-1-2-sqlite-wal-s3-native-storage?format=claude","cursorMdc":"/api/rules/bun-1-2-sqlite-wal-s3-native-storage?format=mdc","cursorrules":"/api/rules/bun-1-2-sqlite-wal-s3-native-storage?format=cursor","windsurf":"/api/rules/bun-1-2-sqlite-wal-s3-native-storage?format=windsurf","agents":"/api/rules/bun-1-2-sqlite-wal-s3-native-storage?format=agents"}},{"id":"svelte-5-runes-reactivity-snippets-invariants","title":"Svelte 5 Runes: Reactive State Proxies, Derived Tracking, and Snippet Composition","category":"frontend","severity":"critical","description":"Svelte 5 introduces fine-grained reactive proxies via runes ($state, $derived, $props, $effect) and replaces slots with explicit snippets. Legacy Svelte 3/4 reactivity paradigms ($:, export let, <slot />) and reactive destructuring violate signal graph propagation, creating broken reactive boundaries and hydration mismatches.","antiPatternHeadline":"Destructuring Reactive Proxies, Using $effect for Synchronous Computations, and Mixing Legacy Svelte 4 Reactivity","stars_count":112,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","typescript","snippets","fine-grained-reactivity"],"exportEndpoints":{"claude":"/api/rules/svelte-5-runes-reactivity-snippets-invariants?format=claude","cursorMdc":"/api/rules/svelte-5-runes-reactivity-snippets-invariants?format=mdc","cursorrules":"/api/rules/svelte-5-runes-reactivity-snippets-invariants?format=cursor","windsurf":"/api/rules/svelte-5-runes-reactivity-snippets-invariants?format=windsurf","agents":"/api/rules/svelte-5-runes-reactivity-snippets-invariants?format=agents"}},{"id":"lexical-node-transforms-selection-headless-invariants","title":"Lexical Immutable Node Transforms, Selection Reconciliation & Headless Serialization","category":"frontend","severity":"critical","description":"Enforces Lexical's copy-on-write immutability paradigm via node.getWritable(), guarantees idempotent node transforms to eliminate infinite render cascades, and mandates deterministic headless Markdown serialization without DOM dependency leaks.","antiPatternHeadline":"Direct In-Memory Node Mutation, Unguarded Node Transform Loops, and DOM-Dependent Headless Serialization","stars_count":81,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","lexical","rich-text","headless-editor","markdown","react"],"exportEndpoints":{"claude":"/api/rules/lexical-node-transforms-selection-headless-invariants?format=claude","cursorMdc":"/api/rules/lexical-node-transforms-selection-headless-invariants?format=mdc","cursorrules":"/api/rules/lexical-node-transforms-selection-headless-invariants?format=cursor","windsurf":"/api/rules/lexical-node-transforms-selection-headless-invariants?format=windsurf","agents":"/api/rules/lexical-node-transforms-selection-headless-invariants?format=agents"}},{"id":"biome-1-9-configuration-vcs-suppression-standards","title":"Biome 1.9 Deterministic Configuration Inheritance, VCS Anchoring, and Suppression Standards","category":"frontend","severity":"critical","description":"Biome 1.9 requires strict configuration inheritance hierarchies across monorepos, authoritative VCS ignore alignment, and deterministic, reason-mandated suppression syntax. Inconsistent root anchoring leads to silent file skips and CI divergence, while ad-hoc suppression syntax creates unmonitored code quality debt.","antiPatternHeadline":"Unanchored Monorepo Extends, Missing VCS Git Anchoring, and Unexplained Suppression Pragmas","stars_count":54,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","biome","linter","formatter","tooling","typescript"],"exportEndpoints":{"claude":"/api/rules/biome-1-9-configuration-vcs-suppression-standards?format=claude","cursorMdc":"/api/rules/biome-1-9-configuration-vcs-suppression-standards?format=mdc","cursorrules":"/api/rules/biome-1-9-configuration-vcs-suppression-standards?format=cursor","windsurf":"/api/rules/biome-1-9-configuration-vcs-suppression-standards?format=windsurf","agents":"/api/rules/biome-1-9-configuration-vcs-suppression-standards?format=agents"}},{"id":"tanstack-start-ssr-search-params-deferred-loaders","title":"TanStack Start SSR: Strict Search Param Validation, Non-Blocking Deferred Streaming, and Hydration Boundaries","category":"frontend","severity":"critical","description":"Enforces schema-validated search parameters, non-blocking SSR execution using `defer()`, and strict `<Await>` boundary consumption in TanStack Start and TanStack Router fullstack applications. Prevents severe TTFB bottlenecks caused by waterfall loader promises and eliminates hydration mismatches arising from untyped query string parsing.","antiPatternHeadline":"Blocking Critical SSR TTFB on Slow Secondary Queries and Reading Untyped Query Parameters","stars_count":56,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["tanstack-router","tanstack-start","ssr","search-params","deferred-streaming","hydration","zod"],"exportEndpoints":{"claude":"/api/rules/tanstack-start-ssr-search-params-deferred-loaders?format=claude","cursorMdc":"/api/rules/tanstack-start-ssr-search-params-deferred-loaders?format=mdc","cursorrules":"/api/rules/tanstack-start-ssr-search-params-deferred-loaders?format=cursor","windsurf":"/api/rules/tanstack-start-ssr-search-params-deferred-loaders?format=windsurf","agents":"/api/rules/tanstack-start-ssr-search-params-deferred-loaders?format=agents"}},{"id":"postgres-17-logical-replication-memory-guardrails","title":"PostgreSQL 17 Failover Slot Synchronization & Buffer Tuning Invariants","category":"backend","severity":"critical","description":"Enforces PostgreSQL 17 failover-enabled logical replication slot configurations and validates synchronized standby slots to prevent replication invalidation upon node promotion. Guarantees memory safety by decoupling logical decoding allocations from shared_buffers, tuning logical_decoding_work_mem to prevent disk spilling, and setting max_slot_wal_keep_size boundaries.","antiPatternHeadline":"Unsynchronized failover-disabled logical slots and unbounded logical memory allocation leading to failover data loss and shared_buffers eviction storms","stars_count":117,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","logical-replication","postgres-17","database-tuning"],"exportEndpoints":{"claude":"/api/rules/postgres-17-logical-replication-memory-guardrails?format=claude","cursorMdc":"/api/rules/postgres-17-logical-replication-memory-guardrails?format=mdc","cursorrules":"/api/rules/postgres-17-logical-replication-memory-guardrails?format=cursor","windsurf":"/api/rules/postgres-17-logical-replication-memory-guardrails?format=windsurf","agents":"/api/rules/postgres-17-logical-replication-memory-guardrails?format=agents"}},{"id":"biome-config-inheritance-vcs-suppression-guardrail","title":"Biome 1.9 Deterministic Configuration, VCS Sync, and Rule Suppression Guardrail","category":"frontend","severity":"critical","description":"Enforces strict configuration inheritance across monorepo boundaries, automated Git VCS ignore synchronization, and fully-qualified rule suppression syntax in Biome 1.9. Prevents silent lint drifts, duplicated ignore rule maintenance, and unanchored comment suppressions that mask security vulnerabilities and regressions.","antiPatternHeadline":"Unanchored Suppressions, Desynchronized Git Ignores, and Fractured Biome Configurations","stars_count":103,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","biome","linter","formatter","monorepo","git-integration"],"exportEndpoints":{"claude":"/api/rules/biome-config-inheritance-vcs-suppression-guardrail?format=claude","cursorMdc":"/api/rules/biome-config-inheritance-vcs-suppression-guardrail?format=mdc","cursorrules":"/api/rules/biome-config-inheritance-vcs-suppression-guardrail?format=cursor","windsurf":"/api/rules/biome-config-inheritance-vcs-suppression-guardrail?format=windsurf","agents":"/api/rules/biome-config-inheritance-vcs-suppression-guardrail?format=agents"}},{"id":"biome-1-9-config-inheritance-and-suppression-guardrails","title":"Biome 1.9 Configuration Inheritance, VCS Alignment, and Deterministic Suppression","category":"frontend","severity":"critical","description":"Enforces strict Biome 1.9 configuration architecture across mono- and poly-repositories. Mandates deterministic configuration inheritance via relative extends, automatic Git-ignore synchronization through vcs configuration blocks, and syntactically validated inline rule suppressions with mandatory justification clauses.","antiPatternHeadline":"Fragmented monorepo formatting, Git-divergent linting passes, and unreasoned or legacy ESLint/Prettier suppression comments.","stars_count":54,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","biome","typescript","linter","formatter","ci-cd"],"exportEndpoints":{"claude":"/api/rules/biome-1-9-config-inheritance-and-suppression-guardrails?format=claude","cursorMdc":"/api/rules/biome-1-9-config-inheritance-and-suppression-guardrails?format=mdc","cursorrules":"/api/rules/biome-1-9-config-inheritance-and-suppression-guardrails?format=cursor","windsurf":"/api/rules/biome-1-9-config-inheritance-and-suppression-guardrails?format=windsurf","agents":"/api/rules/biome-1-9-config-inheritance-and-suppression-guardrails?format=agents"}},{"id":"tanstack-start-ssr-streaming-search-params-invariants","title":"TanStack Start SSR: Type-Safe Search Validation and Deferred Streaming Invariants","category":"frontend","severity":"critical","description":"Enforces strict type safety for URL search parameters via schema validation, non-blocking SSR loaders with deferred streaming for slow promises, and deterministic hydration boundaries in TanStack Start. Prevents SSR waterfall bottlenecks, query parameter injection vulnerabilities, and hydration mismatch crashes.","antiPatternHeadline":"Unvalidated URL Search Params, Monolithic Blocking Loaders, and Missing Deferred Suspense Boundaries","stars_count":84,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","tanstack-router","tanstack-start","ssr","streaming","type-safety"],"exportEndpoints":{"claude":"/api/rules/tanstack-start-ssr-streaming-search-params-invariants?format=claude","cursorMdc":"/api/rules/tanstack-start-ssr-streaming-search-params-invariants?format=mdc","cursorrules":"/api/rules/tanstack-start-ssr-streaming-search-params-invariants?format=cursor","windsurf":"/api/rules/tanstack-start-ssr-streaming-search-params-invariants?format=windsurf","agents":"/api/rules/tanstack-start-ssr-streaming-search-params-invariants?format=agents"}},{"id":"svelte-5-runes-reactivity-snippets-guardrails","title":"Svelte 5 Runes State Management, Pure Derivations, and Snippet Invariants","category":"frontend","severity":"critical","description":"Enforces Svelte 5 fine-grained reactivity architecture using runes ($state, $derived, $effect, $props) and snippets. Prevents legacy Svelte 3/4 reactive declaration syntax, anti-pattern state synchronization via effects, and slot-based composition leaks in production systems.","antiPatternHeadline":"Mutating State Inside $effect for Computed Values and Retaining Legacy Let/Slot Syntax","stars_count":80,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","state-management","snippets"],"exportEndpoints":{"claude":"/api/rules/svelte-5-runes-reactivity-snippets-guardrails?format=claude","cursorMdc":"/api/rules/svelte-5-runes-reactivity-snippets-guardrails?format=mdc","cursorrules":"/api/rules/svelte-5-runes-reactivity-snippets-guardrails?format=cursor","windsurf":"/api/rules/svelte-5-runes-reactivity-snippets-guardrails?format=windsurf","agents":"/api/rules/svelte-5-runes-reactivity-snippets-guardrails?format=agents"}},{"id":"valkey-8-cluster-threaded-io-guardrails","title":"Valkey 8.0 Multi-Threaded I/O, Cluster Slot Redirects, and Lua Atomicity Guardrails","category":"backend","severity":"critical","description":"Mandates deterministic hash-tag slot pinning, automated MOVED/ASK redirect recovery with topology refreshes, and non-blocking multi-key atomic primitives in Valkey 8.0. Prevents CROSSSLOT cluster execution aborts and eliminates main-thread lockups that bottleneck Valkey 8.0 multi-threaded socket I/O engines.","antiPatternHeadline":"Cross-slot multi-key atomic executions and manual cluster redirect bypass stalling Valkey 8.0 threaded I/O pipelines","stars_count":95,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","valkey","cluster","redis-compatible","concurrency","distributed-systems"],"exportEndpoints":{"claude":"/api/rules/valkey-8-cluster-threaded-io-guardrails?format=claude","cursorMdc":"/api/rules/valkey-8-cluster-threaded-io-guardrails?format=mdc","cursorrules":"/api/rules/valkey-8-cluster-threaded-io-guardrails?format=cursor","windsurf":"/api/rules/valkey-8-cluster-threaded-io-guardrails?format=windsurf","agents":"/api/rules/valkey-8-cluster-threaded-io-guardrails?format=agents"}},{"id":"tailwind-v4-css-first-theme-directives-guardrail","title":"Mandating Tailwind CSS v4 CSS-First Theme Directives and Native Color Interpolation","category":"frontend","severity":"critical","description":"Tailwind CSS v4 fully deprecates JavaScript-based configuration (`tailwind.config.js`) in favor of native CSS-first configuration via `@theme` directives and modern CSS variables. Engineering agents must enforce `@import \"tailwindcss\";`, replace legacy `@tailwind` directives, and map design tokens exclusively through CSS custom properties with native color space interpolation (OKLCH) instead of legacy hex-based opacity workarounds.","antiPatternHeadline":"Persisting tailwind.config.js and legacy @tailwind directives in Tailwind CSS v4 environments","stars_count":51,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","tailwind-css","css-first","theme-directives","design-tokens","oklch"],"exportEndpoints":{"claude":"/api/rules/tailwind-v4-css-first-theme-directives-guardrail?format=claude","cursorMdc":"/api/rules/tailwind-v4-css-first-theme-directives-guardrail?format=mdc","cursorrules":"/api/rules/tailwind-v4-css-first-theme-directives-guardrail?format=cursor","windsurf":"/api/rules/tailwind-v4-css-first-theme-directives-guardrail?format=windsurf","agents":"/api/rules/tailwind-v4-css-first-theme-directives-guardrail?format=agents"}},{"id":"biome-1-9-config-vcs-suppression-standards","title":"Biome 1.9 Configuration Inheritance, VCS Integration, and Suppression Governance","category":"frontend","severity":"critical","description":"Enforces deterministic Biome 1.9 configuration architecture utilizing native Git VCS ignore integration, monorepo config inheritance, and mandatory reasoned comment suppressions. Prevents untracked file pollution, rogue ignores, and configuration drift between local developer environments and CI pipelines.","antiPatternHeadline":"Unpinned Biome configurations omitting VCS ignore synchronization, legacy ESLint directives, and unreasoned rule suppressions.","stars_count":76,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["biome","linter","formatter","tooling","frontend","typescript"],"exportEndpoints":{"claude":"/api/rules/biome-1-9-config-vcs-suppression-standards?format=claude","cursorMdc":"/api/rules/biome-1-9-config-vcs-suppression-standards?format=mdc","cursorrules":"/api/rules/biome-1-9-config-vcs-suppression-standards?format=cursor","windsurf":"/api/rules/biome-1-9-config-vcs-suppression-standards?format=windsurf","agents":"/api/rules/biome-1-9-config-vcs-suppression-standards?format=agents"}},{"id":"biome-19-config-vcs-suppression-standard","title":"Biome 1.9 Deterministic Configuration Inheritance, VCS Integration, and Structured Suppression","category":"frontend","severity":"critical","description":"Enforces strict Biome 1.9 configuration standards across single-repository and monorepo architectures by requiring explicit Git VCS synchronization and deterministic configuration inheritance. Mandates machine-checkable, documented rationale for every lint rule suppression comment while eliminating redundant Prettier and ESLint legacy directives.","antiPatternHeadline":"Ad-hoc lint suppression without rationale, unlinked Git VCS ignore boundaries, and fragmented monolithic Biome configurations.","stars_count":76,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","biome","linter","formatter","typescript","vcs","ci-cd"],"exportEndpoints":{"claude":"/api/rules/biome-19-config-vcs-suppression-standard?format=claude","cursorMdc":"/api/rules/biome-19-config-vcs-suppression-standard?format=mdc","cursorrules":"/api/rules/biome-19-config-vcs-suppression-standard?format=cursor","windsurf":"/api/rules/biome-19-config-vcs-suppression-standard?format=windsurf","agents":"/api/rules/biome-19-config-vcs-suppression-standard?format=agents"}},{"id":"rust-axum-08-state-tower-resilience-standard","title":"Axum 0.8 Strict Type-Safe State Extraction and Tower Middleware Invariants","category":"backend","severity":"critical","description":"Enforces compile-time type safety for Axum 0.8 application state through the FromRef substate pattern, prevents connection dropping via explicit CatchPanicLayer and HandleErrorLayer integration, and forbids runtime extension lookups in favor of strongly typed State extractors.","antiPatternHeadline":"Dynamic Runtime Extension Lookups, Missing Panic Guards, and Unbounded Tower Error Propagation","stars_count":107,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tower","type-safety","async"],"exportEndpoints":{"claude":"/api/rules/rust-axum-08-state-tower-resilience-standard?format=claude","cursorMdc":"/api/rules/rust-axum-08-state-tower-resilience-standard?format=mdc","cursorrules":"/api/rules/rust-axum-08-state-tower-resilience-standard?format=cursor","windsurf":"/api/rules/rust-axum-08-state-tower-resilience-standard?format=windsurf","agents":"/api/rules/rust-axum-08-state-tower-resilience-standard?format=agents"}},{"id":"lexical-immutable-transform-headless-reconciliation","title":"Lexical Immutable Node Transforms, Selection Reconciliation, and Headless Serialization","category":"frontend","severity":"critical","description":"Meta Lexical operates on an immutable EditorState where nodes can only be mutated through explicit writable clones within active update batches. Failure to clone nodes via getWritable, unconstrained node transforms causing recursive reconciliation loops, and invoking DOM-dependent selection APIs in headless markdown pipelines cause silent state divergence and catastrophic server-side rendering crashes.","antiPatternHeadline":"Direct In-Memory Node Mutation, Infinite Transform Cascades, and DOM Selection Bleed in Headless Serialization","stars_count":68,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","lexical","rich-text","headless","markdown","immutability"],"exportEndpoints":{"claude":"/api/rules/lexical-immutable-transform-headless-reconciliation?format=claude","cursorMdc":"/api/rules/lexical-immutable-transform-headless-reconciliation?format=mdc","cursorrules":"/api/rules/lexical-immutable-transform-headless-reconciliation?format=cursor","windsurf":"/api/rules/lexical-immutable-transform-headless-reconciliation?format=windsurf","agents":"/api/rules/lexical-immutable-transform-headless-reconciliation?format=agents"}},{"id":"biome-config-inheritance-vcs-suppression-standards","title":"Biome 1.9 Configuration Inheritance, VCS Integration, and Deterministic Suppression","category":"frontend","severity":"critical","description":"Enforces architectural standards for Biome 1.9 single-binary linter and formatter adoption across standalone and monorepo codebases. Mandates explicit Git VCS integration to prevent duplicated ignore manifests, structured configuration inheritance via the extends key, and strict inline suppression comment formatting with mandatory explanatory justifications.","antiPatternHeadline":"Legacy ESLint/Prettier suppressions, unlinked .gitignore definitions, and undocumented inline biome-ignore declarations.","stars_count":116,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["biome","linter","formatter","tooling","frontend","monorepo"],"exportEndpoints":{"claude":"/api/rules/biome-config-inheritance-vcs-suppression-standards?format=claude","cursorMdc":"/api/rules/biome-config-inheritance-vcs-suppression-standards?format=mdc","cursorrules":"/api/rules/biome-config-inheritance-vcs-suppression-standards?format=cursor","windsurf":"/api/rules/biome-config-inheritance-vcs-suppression-standards?format=windsurf","agents":"/api/rules/biome-config-inheritance-vcs-suppression-standards?format=agents"}},{"id":"lexical-headless-transforms-and-serialization","title":"Lexical Copy-on-Write Node Mutation, Safe Transforms, and Headless Serialization","category":"frontend","severity":"critical","description":"Enforces strict copy-on-write immutability via node.getWritable() within active editor transactions, guarantees selection preservation, and ensures headless Markdown serialization runs in an isolated, fully registered headless environment.","antiPatternHeadline":"Bypassing Copy-on-Write with In-Place Node Mutation or Unbounded Transform Recursion","stars_count":99,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","lexical","rich-text","markdown","headless-editor","state-management"],"exportEndpoints":{"claude":"/api/rules/lexical-headless-transforms-and-serialization?format=claude","cursorMdc":"/api/rules/lexical-headless-transforms-and-serialization?format=mdc","cursorrules":"/api/rules/lexical-headless-transforms-and-serialization?format=cursor","windsurf":"/api/rules/lexical-headless-transforms-and-serialization?format=windsurf","agents":"/api/rules/lexical-headless-transforms-and-serialization?format=agents"}},{"id":"biome-1-9-config-inheritance-suppression-standard","title":"Biome 1.9 Deterministic Configuration, VCS Integration, and Suppression Standards","category":"frontend","severity":"critical","description":"Enforces strict configuration inheritance, native Git VCS integration, and deterministic rule suppression syntax under Biome 1.9. Eliminates file-tree desynchronization between gitignore and Biome formatters while preventing undocumented or legacy ESLint suppressions.","antiPatternHeadline":"Unanchored ESLint Suppressions, Missing Suppression Reasons, and Desynchronized Git Ignore Trees","stars_count":90,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","biome","tooling","formatter","linter","typescript"],"exportEndpoints":{"claude":"/api/rules/biome-1-9-config-inheritance-suppression-standard?format=claude","cursorMdc":"/api/rules/biome-1-9-config-inheritance-suppression-standard?format=mdc","cursorrules":"/api/rules/biome-1-9-config-inheritance-suppression-standard?format=cursor","windsurf":"/api/rules/biome-1-9-config-inheritance-suppression-standard?format=windsurf","agents":"/api/rules/biome-1-9-config-inheritance-suppression-standard?format=agents"}},{"id":"rr7-framework-hydration-data-boundary-standard","title":"React Router 7 Framework Mode Hydration, Typegen, and Single-Fetch Invariants","category":"frontend","severity":"critical","description":"Enforces strict typegen contracts, single-fetch streaming boundaries, and correct clientLoader hydration mechanics in React Router 7 Framework Mode. Eliminates double-fetch penalties, serialization drift across the turbo-stream wire protocol, and SSR hydration mismatches.","antiPatternHeadline":"Bypassing Route Typegen, Misusing clientLoader.hydrate, and Emitting Legacy Remix defer() Primitives","stars_count":41,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-router-7","hydration","single-fetch","typegen","streaming"],"exportEndpoints":{"claude":"/api/rules/rr7-framework-hydration-data-boundary-standard?format=claude","cursorMdc":"/api/rules/rr7-framework-hydration-data-boundary-standard?format=mdc","cursorrules":"/api/rules/rr7-framework-hydration-data-boundary-standard?format=cursor","windsurf":"/api/rules/rr7-framework-hydration-data-boundary-standard?format=windsurf","agents":"/api/rules/rr7-framework-hydration-data-boundary-standard?format=agents"}},{"id":"lexical-node-transforms-selection-headless-markdown-standard","title":"Lexical Immutable Node Transforms, Selection Reconciliation, and Headless Markdown Serialization","category":"frontend","severity":"critical","description":"Mandates strict compliance with Lexical's copy-on-write model via getWritable(), idempotent node transforms to prevent infinite reconciliation cascades, defensive selection reconciliation during structural tree operations, and complete node/transformer registration for headless markdown serialization.","antiPatternHeadline":"Mutating frozen Lexical nodes directly, triggering infinite transform cascades without state checks, and running headless markdown export without registered AST nodes.","stars_count":99,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","lexical","rich-text","markdown","headless","state-management"],"exportEndpoints":{"claude":"/api/rules/lexical-node-transforms-selection-headless-markdown-standard?format=claude","cursorMdc":"/api/rules/lexical-node-transforms-selection-headless-markdown-standard?format=mdc","cursorrules":"/api/rules/lexical-node-transforms-selection-headless-markdown-standard?format=cursor","windsurf":"/api/rules/lexical-node-transforms-selection-headless-markdown-standard?format=windsurf","agents":"/api/rules/lexical-node-transforms-selection-headless-markdown-standard?format=agents"}},{"id":"tanstack-router-start-ssr-streaming-invariants","title":"TanStack Start & Router: Enforcing Type-Safe Search Params, Loader Dependencies, and Deferred SSR Streaming","category":"frontend","severity":"critical","description":"Enforces strict type safety and performance invariants for TanStack Start and Router across SSR hydration boundaries. Mandates runtime-validated search parameters with fallback defaults, explicit reactive loader dependencies via loaderDeps, and non-blocking streaming for slow data paths using defer() and Suspense.","antiPatternHeadline":"Unvalidated Raw Search Params, Missing loaderDeps Triggering Stale SSR State, and Monolithic Await Blocking Server TTFB","stars_count":45,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","tanstack-router","tanstack-start","ssr","streaming","type-safety","zod"],"exportEndpoints":{"claude":"/api/rules/tanstack-router-start-ssr-streaming-invariants?format=claude","cursorMdc":"/api/rules/tanstack-router-start-ssr-streaming-invariants?format=mdc","cursorrules":"/api/rules/tanstack-router-start-ssr-streaming-invariants?format=cursor","windsurf":"/api/rules/tanstack-router-start-ssr-streaming-invariants?format=windsurf","agents":"/api/rules/tanstack-router-start-ssr-streaming-invariants?format=agents"}},{"id":"lexical-headless-engine-transforms-and-serialization-guardrail","title":"Lexical Immutable Transforms, Selection Preservation, and Headless Serialization","category":"frontend","severity":"critical","description":"Lexical relies on a dual-tree model where editor states are strictly immutable snapshots transformed exclusively via editor.update() transactions using writable node proxies ($getNodeByKey or .getWritable()). In headless and server-side contexts, markdown serialization, node transforms, and selection reconciliations must never mutate nodes outside an active update context or perform un-batched DOM-dependent operations, preventing memory leaks, corrupted historical branches, and collapsed selections.","antiPatternHeadline":"Mutating Lexical Nodes Directly Outside .getWritable() or Running Headless Transforms with DOM-Coupled Selection Methods","stars_count":89,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","lexical","rich-text","headless","serialization","react"],"exportEndpoints":{"claude":"/api/rules/lexical-headless-engine-transforms-and-serialization-guardrail?format=claude","cursorMdc":"/api/rules/lexical-headless-engine-transforms-and-serialization-guardrail?format=mdc","cursorrules":"/api/rules/lexical-headless-engine-transforms-and-serialization-guardrail?format=cursor","windsurf":"/api/rules/lexical-headless-engine-transforms-and-serialization-guardrail?format=windsurf","agents":"/api/rules/lexical-headless-engine-transforms-and-serialization-guardrail?format=agents"}},{"id":"valkey-cluster-failover-multithreaded-io-standard","title":"Valkey 8.0 Threaded I/O, Cluster Slot Routing, and Hash-Tag Atomicity Invariants","category":"backend","severity":"critical","description":"Enforces strict cluster-aware client configurations, explicit hash tag slot co-location for multi-key Lua scripts, and non-blocking multi-threaded I/O constraints in Valkey 8.0 deployments. Prevents unhandled MOVED/ASK redirect storms during replica promotion, cross-slot script runtime exceptions, and main thread execution freezes that degrade heartbeat detection.","antiPatternHeadline":"Unpinned Multi-Key Lua Execution and Unbounded Slot Refresh Storms During Cluster Failover","stars_count":47,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","valkey","redis","clustering","concurrency","distributed-systems"],"exportEndpoints":{"claude":"/api/rules/valkey-cluster-failover-multithreaded-io-standard?format=claude","cursorMdc":"/api/rules/valkey-cluster-failover-multithreaded-io-standard?format=mdc","cursorrules":"/api/rules/valkey-cluster-failover-multithreaded-io-standard?format=cursor","windsurf":"/api/rules/valkey-cluster-failover-multithreaded-io-standard?format=windsurf","agents":"/api/rules/valkey-cluster-failover-multithreaded-io-standard?format=agents"}},{"id":"tanstack-virtual-dynamic-measurement-scroll-containment","title":"TanStack Virtual 3.0 Dynamic Sizing and DOM Containment Architecture","category":"frontend","severity":"critical","description":"Enforces deterministic dynamic measurement, strict overscan limits, and scroll margin containment in TanStack Virtual 3.0. Eliminates DOM node saturation, layout thrashing, and subpixel scroll-jitter in dense, large-scale virtualized tables and lists.","antiPatternHeadline":"Unbounded Overscan and Broken Dynamic Measurement Causing Layout Thrashing and Scroll Desync","stars_count":106,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","tanstack-virtual","virtualization","react","performance"],"exportEndpoints":{"claude":"/api/rules/tanstack-virtual-dynamic-measurement-scroll-containment?format=claude","cursorMdc":"/api/rules/tanstack-virtual-dynamic-measurement-scroll-containment?format=mdc","cursorrules":"/api/rules/tanstack-virtual-dynamic-measurement-scroll-containment?format=cursor","windsurf":"/api/rules/tanstack-virtual-dynamic-measurement-scroll-containment?format=windsurf","agents":"/api/rules/tanstack-virtual-dynamic-measurement-scroll-containment?format=agents"}},{"id":"postgres-17-logical-replication-failover-memory-invariants","title":"PostgreSQL 17 Logical Replication Failover Slots & Memory Buffer Invariants","category":"backend","severity":"critical","description":"Mandates PostgreSQL 17 failover-enabled logical replication slots combined with synchronized standby slots to guarantee zero subscription loss upon physical replica promotion. Enforces strict logical_decoding_work_mem boundaries and bounded max_slot_wal_keep_size to prevent catastrophic WAL disk bloat and shared_buffers memory contention during high-throughput logical streaming.","antiPatternHeadline":"Unsynchronized Legacy Replication Slots and Unbounded WAL Retention Crashing Primaries","stars_count":85,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql-17","logical-replication","failover-slots","shared-buffers","wal-retention"],"exportEndpoints":{"claude":"/api/rules/postgres-17-logical-replication-failover-memory-invariants?format=claude","cursorMdc":"/api/rules/postgres-17-logical-replication-failover-memory-invariants?format=mdc","cursorrules":"/api/rules/postgres-17-logical-replication-failover-memory-invariants?format=cursor","windsurf":"/api/rules/postgres-17-logical-replication-failover-memory-invariants?format=windsurf","agents":"/api/rules/postgres-17-logical-replication-failover-memory-invariants?format=agents"}},{"id":"lexical-node-transforms-selection-reconciliation-headless","title":"Lexical Immutable Node Transforms, Selection Reconciliation & Headless Serialization Invariants","category":"frontend","severity":"critical","description":"Enforces strict compliance with Lexical's double-buffered copy-on-write immutability, deterministic selection reconciliation, and DOM-agnostic headless serialization. Mandates idempotent node transforms with loop guards, selection restoration across structural tree mutations, and isolation of DOM globals during headless Markdown transforms.","antiPatternHeadline":"Direct Node Mutation, Blind Selection Collapsing, and DOM-Dependent Headless Serialization","stars_count":73,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","lexical","rich-text","editor-state","markdown","headless"],"exportEndpoints":{"claude":"/api/rules/lexical-node-transforms-selection-reconciliation-headless?format=claude","cursorMdc":"/api/rules/lexical-node-transforms-selection-reconciliation-headless?format=mdc","cursorrules":"/api/rules/lexical-node-transforms-selection-reconciliation-headless?format=cursor","windsurf":"/api/rules/lexical-node-transforms-selection-reconciliation-headless?format=windsurf","agents":"/api/rules/lexical-node-transforms-selection-reconciliation-headless?format=agents"}},{"id":"rust-axum-state-tower-service-invariants","title":"Axum 0.8 Type-Safe State Extractors and Tower Middleware Invariants","category":"backend","severity":"critical","description":"Enforces compile-time verified state injection via Axum 0.8 State and FromRef patterns while prohibiting untyped Extension usage. Mandates structured Tower ServiceBuilder middleware composition with panic boundaries to eliminate unhandled panics and runtime injection failures.","antiPatternHeadline":"Runtime Panics via Untyped Extensions and Missing Tower CatchPanic Layer","stars_count":81,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tower","state-management","error-handling"],"exportEndpoints":{"claude":"/api/rules/rust-axum-state-tower-service-invariants?format=claude","cursorMdc":"/api/rules/rust-axum-state-tower-service-invariants?format=mdc","cursorrules":"/api/rules/rust-axum-state-tower-service-invariants?format=cursor","windsurf":"/api/rules/rust-axum-state-tower-service-invariants?format=windsurf","agents":"/api/rules/rust-axum-state-tower-service-invariants?format=agents"}},{"id":"valkey-8-cluster-topology-slot-atomicity","title":"Valkey 8.0 Multi-Threaded I/O, Topology Failover, and Cluster Script Invariants","category":"backend","severity":"critical","description":"Valkey 8.0 cluster architectures require strict hash-tag co-location for multi-key operations and scripts to prevent CROSSSLOT runtime failures. Applications must leverage cluster-aware connection pooling with automated slot cache invalidation on MOVED/ASK redirects to prevent connection thrashing and deadlocks during primary-replica failovers.","antiPatternHeadline":"Executing un-bracketed multi-key Lua scripts with static node clients against dynamic Valkey clusters","stars_count":109,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","valkey","clustering","distributed-systems","concurrency","io-threads"],"exportEndpoints":{"claude":"/api/rules/valkey-8-cluster-topology-slot-atomicity?format=claude","cursorMdc":"/api/rules/valkey-8-cluster-topology-slot-atomicity?format=mdc","cursorrules":"/api/rules/valkey-8-cluster-topology-slot-atomicity?format=cursor","windsurf":"/api/rules/valkey-8-cluster-topology-slot-atomicity?format=windsurf","agents":"/api/rules/valkey-8-cluster-topology-slot-atomicity?format=agents"}},{"id":"tanstack-virtual-windowing-containment-standard","title":"TanStack Virtual 3.0 Dynamic Measurement, Scroll Containment, and DOM Saturation Defense","category":"frontend","severity":"critical","description":"Enforces strict DOM node containment, dynamic size estimation bounds, and transform isolation for TanStack Virtual v3 in massive data tables. Prevents layout thrashing, incorrect cumulative scroll offsets, and continuous unmeasured re-renders by enforcing stable dynamic measurement callbacks, scroll margin isolation, and CSS layout containment.","antiPatternHeadline":"Dynamic Element Re-measurement Jitter and DOM Flooding via Missing Keys, Unstable Estimators, and Uncontained Scroll Offsets","stars_count":106,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react","tanstack-virtual","performance","virtualization","dom-containment"],"exportEndpoints":{"claude":"/api/rules/tanstack-virtual-windowing-containment-standard?format=claude","cursorMdc":"/api/rules/tanstack-virtual-windowing-containment-standard?format=mdc","cursorrules":"/api/rules/tanstack-virtual-windowing-containment-standard?format=cursor","windsurf":"/api/rules/tanstack-virtual-windowing-containment-standard?format=windsurf","agents":"/api/rules/tanstack-virtual-windowing-containment-standard?format=agents"}},{"id":"valkey-cluster-failover-threaded-io-guardrails","title":"Valkey 8.0 Threaded I/O Slot Pinning & Failover Invariants","category":"backend","severity":"critical","description":"Enforces strict hash-tag slot pinning for multi-key operations and Lua scripts while mandating automated MOVED/ASK redirect recovery in Valkey 8.0. Prevents CROSSSLOT exceptions, uncoordinated failover split-brains, and main-thread execution starvation across threaded I/O engine topologies.","antiPatternHeadline":"Unpinned Multi-Key Script Execution and Naive Non-Cluster Client Failover Routing","stars_count":104,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","valkey","redis","clustering","distributed-systems","performance"],"exportEndpoints":{"claude":"/api/rules/valkey-cluster-failover-threaded-io-guardrails?format=claude","cursorMdc":"/api/rules/valkey-cluster-failover-threaded-io-guardrails?format=mdc","cursorrules":"/api/rules/valkey-cluster-failover-threaded-io-guardrails?format=cursor","windsurf":"/api/rules/valkey-cluster-failover-threaded-io-guardrails?format=windsurf","agents":"/api/rules/valkey-cluster-failover-threaded-io-guardrails?format=agents"}},{"id":"tanstack-start-type-safe-search-and-streaming-ssr","title":"TanStack Start SSR: Type-Safe Search Validation, Loader Dependencies, and Deferred Streaming","category":"frontend","severity":"critical","description":"Enforces strict type-safe search parameter validation, declarative loader caching via loaderDeps, and non-blocking deferred streaming in TanStack Start and Fullstack Router SSR. Failure to declare search dependencies leads to stale client navigation and hydration divergence, while awaiting non-critical promises directly in SSR loaders destroys Time-to-First-Byte (TTFB).","antiPatternHeadline":"Accessing unvalidated search params, omitting loaderDeps on query-driven loaders, and blocking SSR TTFB with un-deferred slow promises.","stars_count":109,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","tanstack-router","tanstack-start","ssr","streaming","type-safety"],"exportEndpoints":{"claude":"/api/rules/tanstack-start-type-safe-search-and-streaming-ssr?format=claude","cursorMdc":"/api/rules/tanstack-start-type-safe-search-and-streaming-ssr?format=mdc","cursorrules":"/api/rules/tanstack-start-type-safe-search-and-streaming-ssr?format=cursor","windsurf":"/api/rules/tanstack-start-type-safe-search-and-streaming-ssr?format=windsurf","agents":"/api/rules/tanstack-start-type-safe-search-and-streaming-ssr?format=agents"}},{"id":"lexical-immutable-transforms-and-headless-serialization-production-standard","title":"Lexical Node Immutability, Transform Idempotency, and Headless Serialization Invariants","category":"frontend","severity":"critical","description":"Enforces immutable clone semantics via node.getWritable() strictly inside editor.update() transactions, prevents infinite reconciliation cycles in registered node transforms, and guarantees headless document serialization mirrors client-side node schemas without DOM runtime leakage.","antiPatternHeadline":"Mutating internal node properties directly, inducing recursive transform loops, and dropping custom nodes during headless serialization.","stars_count":53,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","lexical","rich-text","serialization","headless","typescript"],"exportEndpoints":{"claude":"/api/rules/lexical-immutable-transforms-and-headless-serialization-production-standard?format=claude","cursorMdc":"/api/rules/lexical-immutable-transforms-and-headless-serialization-production-standard?format=mdc","cursorrules":"/api/rules/lexical-immutable-transforms-and-headless-serialization-production-standard?format=cursor","windsurf":"/api/rules/lexical-immutable-transforms-and-headless-serialization-production-standard?format=windsurf","agents":"/api/rules/lexical-immutable-transforms-and-headless-serialization-production-standard?format=agents"}},{"id":"axum-0-8-type-safe-state-tower-service-guardrail","title":"Axum 0.8 Type-Safe State Sub-Extractors and Infallible Tower Middleware","category":"backend","severity":"critical","description":"Enforces compile-time type safety in Axum 0.8 by mandating State extractors with FromRef composition over untyped Extensions. Guarantees infallible Tower middleware stacks through structured CatchPanicLayer boundaries and deterministic IntoResponse error mapping.","antiPatternHeadline":"Runtime Extension Panics and Monolithic State Coupling Without CatchPanic Guardrails","stars_count":113,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tower","type-safety","async"],"exportEndpoints":{"claude":"/api/rules/axum-0-8-type-safe-state-tower-service-guardrail?format=claude","cursorMdc":"/api/rules/axum-0-8-type-safe-state-tower-service-guardrail?format=mdc","cursorrules":"/api/rules/axum-0-8-type-safe-state-tower-service-guardrail?format=cursor","windsurf":"/api/rules/axum-0-8-type-safe-state-tower-service-guardrail?format=windsurf","agents":"/api/rules/axum-0-8-type-safe-state-tower-service-guardrail?format=agents"}},{"id":"rr7-hydration-single-fetch-guardrail","title":"React Router 7 Framework Mode: Hydration Boundaries & Single-Fetch Invariants","category":"frontend","severity":"critical","description":"Enforces deterministic hydration and data synchronization across React Router 7 Framework Mode route boundaries. Eliminates hydration mismatches, double-fetch waterfalls, and serialization de-optimizations caused by legacy Remix abstractions, uncoordinated clientLoader execution, and unpinned typegen contracts.","antiPatternHeadline":"Bypassing Route Typegen and Mishandling clientLoader Hydration Under Single-Fetch Streaming","stars_count":44,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["react-router-7","remix","hydration","single-fetch","streaming","typegen"],"exportEndpoints":{"claude":"/api/rules/rr7-hydration-single-fetch-guardrail?format=claude","cursorMdc":"/api/rules/rr7-hydration-single-fetch-guardrail?format=mdc","cursorrules":"/api/rules/rr7-hydration-single-fetch-guardrail?format=cursor","windsurf":"/api/rules/rr7-hydration-single-fetch-guardrail?format=windsurf","agents":"/api/rules/rr7-hydration-single-fetch-guardrail?format=agents"}},{"id":"biome-configuration-inheritance-vcs-suppression","title":"Biome 1.9 Deterministic Configuration, VCS Integration, and Rule Suppression Guardrails","category":"frontend","severity":"critical","description":"Enforces strict configuration ergonomics, VCS-aware file resolution, and deterministic inline suppression syntax in Biome 1.9. Prevents unindexed artifact evaluation, broken monorepo inheritance trees, and unreasoned lint suppressions.","antiPatternHeadline":"Ignoring VCS ignore files, omitting pinned schemas, and applying bare or unstructured lint suppressions.","stars_count":101,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","biome","linter","formatter","tooling","vcs"],"exportEndpoints":{"claude":"/api/rules/biome-configuration-inheritance-vcs-suppression?format=claude","cursorMdc":"/api/rules/biome-configuration-inheritance-vcs-suppression?format=mdc","cursorrules":"/api/rules/biome-configuration-inheritance-vcs-suppression?format=cursor","windsurf":"/api/rules/biome-configuration-inheritance-vcs-suppression?format=windsurf","agents":"/api/rules/biome-configuration-inheritance-vcs-suppression?format=agents"}},{"id":"rr7-framework-hydration-single-fetch-boundary","title":"React Router 7 Framework Mode Hydration and Single-Fetch Typegen Boundary","category":"frontend","severity":"critical","description":"Enforces strict adherence to React Router 7 framework-mode data loading, hydration boundaries, and type generation. Prevents hydration mismatches, duplicate fetches, and broken streaming states caused by legacy Remix primitives (json, defer) and improper clientLoader.hydrate configurations under turbo-stream single-fetch.","antiPatternHeadline":"Legacy Remix v2 Primitives and Unsynchronized clientLoader Hydration in React Router 7 Single-Fetch","stars_count":95,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-router-7","remix","hydration","single-fetch","typescript"],"exportEndpoints":{"claude":"/api/rules/rr7-framework-hydration-single-fetch-boundary?format=claude","cursorMdc":"/api/rules/rr7-framework-hydration-single-fetch-boundary?format=mdc","cursorrules":"/api/rules/rr7-framework-hydration-single-fetch-boundary?format=cursor","windsurf":"/api/rules/rr7-framework-hydration-single-fetch-boundary?format=windsurf","agents":"/api/rules/rr7-framework-hydration-single-fetch-boundary?format=agents"}},{"id":"valkey-cluster-failover-atomicity-standard","title":"Valkey 8.0 Cluster Topology, Failover Resiliency, and Slot-Pinned Script Execution","category":"backend","severity":"critical","description":"Mandates explicit hash-tag pinning for multi-key operations and Lua scripts to guarantee atomicity and prevent CROSSSLOT errors in Valkey 8.0 clusters. Requires dynamic cluster topology refreshes with exponential backoff on MOVED/ASK redirects to prevent connection thrashing during failovers. Enforces non-blocking execution pipelines to fully leverage Valkey 8.0 threaded I/O capabilities.","antiPatternHeadline":"Unpinned Multi-Key Operations and Naive Redirect Handling Causing CROSSSLOT Aborts and Failover Cascades","stars_count":83,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","valkey","redis","clustering","caching","failover"],"exportEndpoints":{"claude":"/api/rules/valkey-cluster-failover-atomicity-standard?format=claude","cursorMdc":"/api/rules/valkey-cluster-failover-atomicity-standard?format=mdc","cursorrules":"/api/rules/valkey-cluster-failover-atomicity-standard?format=cursor","windsurf":"/api/rules/valkey-cluster-failover-atomicity-standard?format=windsurf","agents":"/api/rules/valkey-cluster-failover-atomicity-standard?format=agents"}},{"id":"postgres-17-logical-replication-failover-buffers-guardrail","title":"PostgreSQL 17 Logical Replication Failover Slot Synchronization & Buffer Isolation Guardrail","category":"backend","severity":"critical","description":"Mandates PostgreSQL 17 failover-enabled logical replication slots (`failover => true`) synchronized with physical standbys to prevent CDC divergence after HA failovers. Enforces explicit `logical_decoding_work_mem` boundaries to prevent logical decoding workers from exhausting `shared_buffers` and spilling unbounded change streams to disk, combined with strict `max_slot_wal_keep_size` limits to protect WAL partitions.","antiPatternHeadline":"Ephemeral Failover Slots with Unbounded WAL Decoders Spilling to Disk and Thrashing Shared Buffers","stars_count":47,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql-17","logical-replication","failover-slots","shared-buffers","database-architecture"],"exportEndpoints":{"claude":"/api/rules/postgres-17-logical-replication-failover-buffers-guardrail?format=claude","cursorMdc":"/api/rules/postgres-17-logical-replication-failover-buffers-guardrail?format=mdc","cursorrules":"/api/rules/postgres-17-logical-replication-failover-buffers-guardrail?format=cursor","windsurf":"/api/rules/postgres-17-logical-replication-failover-buffers-guardrail?format=windsurf","agents":"/api/rules/postgres-17-logical-replication-failover-buffers-guardrail?format=agents"}},{"id":"tanstack-virtual-v3-dynamic-windowing-performance-standard","title":"TanStack Virtual 3.0 Dynamic Windowing & Scroll Margin Invariants","category":"frontend","severity":"critical","description":"Enforces strict DOM node containment, dynamic measurement synchronization, and GPU-composited coordinate positioning in TanStack Virtual 3.0. Prevents layout thrashing, scroll jumping, and main-thread saturation across high-frequency mutations and massive data sets. Mandates stable element keys, memoized measurement callbacks, and calibrated overscan limits.","antiPatternHeadline":"Index-keyed measurement desynchronization and layout-thrashing positioning in dynamic virtualized tables.","stars_count":119,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","tanstack-virtual","react","windowing","performance","layout-stability"],"exportEndpoints":{"claude":"/api/rules/tanstack-virtual-v3-dynamic-windowing-performance-standard?format=claude","cursorMdc":"/api/rules/tanstack-virtual-v3-dynamic-windowing-performance-standard?format=mdc","cursorrules":"/api/rules/tanstack-virtual-v3-dynamic-windowing-performance-standard?format=cursor","windsurf":"/api/rules/tanstack-virtual-v3-dynamic-windowing-performance-standard?format=windsurf","agents":"/api/rules/tanstack-virtual-v3-dynamic-windowing-performance-standard?format=agents"}},{"id":"pg17-logical-replication-failover-slots-buffer-guardrail","title":"PostgreSQL 17 Logical Replication Failover Slots & Memory Buffer Invariants","category":"backend","severity":"critical","description":"Enforces strict configuration and programmatic management of PostgreSQL 17 logical failover slots, standby synchronization, and memory-bounded decoding buffers. Prevents silent replication breakage during physical node failover, disk exhaustion via runaway WAL retention, and OOM kills by mandating synchronized slots, explicit WAL limits, and bounded logical decoding memory.","antiPatternHeadline":"Creating Unsynchronized Logical Replication Slots Without Failover Support or WAL Retention Caps","stars_count":42,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql-17","logical-replication","failover-slots","shared-buffers","wal-retention"],"exportEndpoints":{"claude":"/api/rules/pg17-logical-replication-failover-slots-buffer-guardrail?format=claude","cursorMdc":"/api/rules/pg17-logical-replication-failover-slots-buffer-guardrail?format=mdc","cursorrules":"/api/rules/pg17-logical-replication-failover-slots-buffer-guardrail?format=cursor","windsurf":"/api/rules/pg17-logical-replication-failover-slots-buffer-guardrail?format=windsurf","agents":"/api/rules/pg17-logical-replication-failover-slots-buffer-guardrail?format=agents"}},{"id":"tanstack-start-ssr-streaming-loader-guardrails-production-standard","title":"TanStack Start SSR Loaders, Type-Safe Search Validation, and Deferred Data Invariants","category":"frontend","severity":"critical","description":"Mandates strict architectural standards for TanStack Start and TanStack Router fullstack SSR pipelines. Enforces schema-validated search params using runtime validators, prevents SSR TTFB blocking by obligating defer() for non-critical promises, and guarantees deterministic cache invalidation via explicit loaderDeps declarations.","antiPatternHeadline":"Blocking Critical SSR Streams with Un-deferred Async Loaders and Untyped Search Param Leaks","stars_count":52,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","tanstack-start","tanstack-router","ssr","streaming","type-safety","zod"],"exportEndpoints":{"claude":"/api/rules/tanstack-start-ssr-streaming-loader-guardrails-production-standard?format=claude","cursorMdc":"/api/rules/tanstack-start-ssr-streaming-loader-guardrails-production-standard?format=mdc","cursorrules":"/api/rules/tanstack-start-ssr-streaming-loader-guardrails-production-standard?format=cursor","windsurf":"/api/rules/tanstack-start-ssr-streaming-loader-guardrails-production-standard?format=windsurf","agents":"/api/rules/tanstack-start-ssr-streaming-loader-guardrails-production-standard?format=agents"}},{"id":"tanstack-virtual-v3-dynamic-windowing-performance","title":"TanStack Virtual 3.0 Dynamic Measurement and DOM Containment Architecture","category":"frontend","severity":"critical","description":"Enforces zero-layout-shift dynamic measurement, CSS layout containment, and hardware-accelerated positioning in TanStack Virtual 3.0 implementations. Prevents catastrophic DOM node saturation, layout thrashing, and scroll jitter in massive dynamic tables.","antiPatternHeadline":"Layout-thrashing top/margin positioning, unbounded overscan, and uncontained dynamic measurement loops causing frame drops.","stars_count":56,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","tanstack-virtual","react","performance","virtualization","dom-optimization"],"exportEndpoints":{"claude":"/api/rules/tanstack-virtual-v3-dynamic-windowing-performance?format=claude","cursorMdc":"/api/rules/tanstack-virtual-v3-dynamic-windowing-performance?format=mdc","cursorrules":"/api/rules/tanstack-virtual-v3-dynamic-windowing-performance?format=cursor","windsurf":"/api/rules/tanstack-virtual-v3-dynamic-windowing-performance?format=windsurf","agents":"/api/rules/tanstack-virtual-v3-dynamic-windowing-performance?format=agents"}},{"id":"react-router-7-hydration-typegen-guardrails","title":"React Router 7 Framework Mode Hydration, Typegen, and Data Boundaries","category":"frontend","severity":"critical","description":"Enforces strict adherence to React Router 7 Framework Mode single-fetch architecture, generated route type boundaries, and streaming hydration invariants. Prevents hydration mismatches, data waterfall regressions, and broken SSR promise serialization caused by legacy Remix patterns.","antiPatternHeadline":"Bypassing Typegen with Deprecated json() Utilities and Misconfigured clientLoader.hydrate Triggers","stars_count":119,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-router-7","hydration","typegen","single-fetch","streaming"],"exportEndpoints":{"claude":"/api/rules/react-router-7-hydration-typegen-guardrails?format=claude","cursorMdc":"/api/rules/react-router-7-hydration-typegen-guardrails?format=mdc","cursorrules":"/api/rules/react-router-7-hydration-typegen-guardrails?format=cursor","windsurf":"/api/rules/react-router-7-hydration-typegen-guardrails?format=windsurf","agents":"/api/rules/react-router-7-hydration-typegen-guardrails?format=agents"}},{"id":"lexical-node-transforms-selection-headless-guardrails","title":"Lexical Immutable Node Transforms, Selection Reconciliation, and Headless Serialization","category":"frontend","severity":"critical","description":"Enforces Lexical's copy-on-write immutability semantics, ensuring node mutations always route through $getWritable() within transactional editor.update() scopes. Mandates comprehensive node registration for headless markdown pipelines and strict selection preservation during asynchronous and batch AST transforms.","antiPatternHeadline":"Bypassing Lexical copy-on-write clone cycles and executing uncontained transforms that break selection and headless serialization","stars_count":87,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","lexical","rich-text","editor-state","headless-cms","typescript"],"exportEndpoints":{"claude":"/api/rules/lexical-node-transforms-selection-headless-guardrails?format=claude","cursorMdc":"/api/rules/lexical-node-transforms-selection-headless-guardrails?format=mdc","cursorrules":"/api/rules/lexical-node-transforms-selection-headless-guardrails?format=cursor","windsurf":"/api/rules/lexical-node-transforms-selection-headless-guardrails?format=windsurf","agents":"/api/rules/lexical-node-transforms-selection-headless-guardrails?format=agents"}},{"id":"tanstack-router-ssr-loader-streaming-guardrails","title":"TanStack Start & Router: Invariant Search Validation, SSR Loaders, and Deferred Streaming","category":"frontend","severity":"critical","description":"Enforces strict runtime search param validation via Zod schemas, prevents SSR TTFB degradation through deterministic deferred data streaming, and mandates isomorphic server functions for full-stack data boundaries. Disallows unvalidated URL parsing, blocking non-critical promises in route loaders, and client-only state divergence during SSR hydration.","antiPatternHeadline":"Blocking SSR Hydration with Unvalidated Query Params and Synchronous Loader Waterfalls","stars_count":115,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","tanstack-router","tanstack-start","ssr","streaming","zod","type-safety"],"exportEndpoints":{"claude":"/api/rules/tanstack-router-ssr-loader-streaming-guardrails?format=claude","cursorMdc":"/api/rules/tanstack-router-ssr-loader-streaming-guardrails?format=mdc","cursorrules":"/api/rules/tanstack-router-ssr-loader-streaming-guardrails?format=cursor","windsurf":"/api/rules/tanstack-router-ssr-loader-streaming-guardrails?format=windsurf","agents":"/api/rules/tanstack-router-ssr-loader-streaming-guardrails?format=agents"}},{"id":"axum-0-8-state-tower-guardrail","title":"Axum 0.8 Modular Sub-State Extraction, CatchPanicLayer, and Tower ServiceBuilder","category":"backend","severity":"critical","description":"Enforces type-safe modular state extraction using Axum 0.8's FromRef pattern, deterministic Tower ServiceBuilder layer ordering, and mandatory CatchPanicLayer integration. Prevents monolithic state coupling, middleware execution inversion, and unhandled thread panics dropping HTTP connections without RFC 7807/JSON error responses.","antiPatternHeadline":"Monolithic State Passing, Inverted Tower Middleware Chains, and Unhandled Panic Dropouts","stars_count":54,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tower","state-management","error-handling"],"exportEndpoints":{"claude":"/api/rules/axum-0-8-state-tower-guardrail?format=claude","cursorMdc":"/api/rules/axum-0-8-state-tower-guardrail?format=mdc","cursorrules":"/api/rules/axum-0-8-state-tower-guardrail?format=cursor","windsurf":"/api/rules/axum-0-8-state-tower-guardrail?format=windsurf","agents":"/api/rules/axum-0-8-state-tower-guardrail?format=agents"}},{"id":"valkey-8-cluster-topology-lua-guardrails","title":"Valkey 8.0 Threaded I/O Cluster Failover and Lua Hash-Tagging Standard","category":"backend","severity":"critical","description":"Enforces strict hash-tag slot pinning for multi-key Lua scripts and resilient cluster topology refresh handling during Valkey 8.0 failovers. Prevents CROSSSLOT evaluation runtime errors and thundering herd connection deadlocks caused by unhandled MOVED/ASK redirects in high-throughput multi-threaded I/O environments.","antiPatternHeadline":"Executing un-hashed multi-key Lua scripts and lacking automated cluster slot refresh on MOVED/ASK redirects","stars_count":52,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","valkey","valkey-8","cluster","lua","threaded-io","failover"],"exportEndpoints":{"claude":"/api/rules/valkey-8-cluster-topology-lua-guardrails?format=claude","cursorMdc":"/api/rules/valkey-8-cluster-topology-lua-guardrails?format=mdc","cursorrules":"/api/rules/valkey-8-cluster-topology-lua-guardrails?format=cursor","windsurf":"/api/rules/valkey-8-cluster-topology-lua-guardrails?format=windsurf","agents":"/api/rules/valkey-8-cluster-topology-lua-guardrails?format=agents"}},{"id":"bun-sqlite-wal-s3-streaming-production-standard","title":"Bun 1.2 Embedded SQLite WAL Concurrency & Native S3 Zero-Copy Streaming","category":"backend","severity":"critical","description":"Enforces deterministic concurrency protocols for Bun 1.2 embedded SQLite databases alongside zero-copy streaming through Bun's native S3 client API. Mandates Write-Ahead Logging (WAL) pragmas to prevent lock contention and eliminates heap exhaustion by piping streaming payloads directly to object storage without intermediate buffer allocation.","antiPatternHeadline":"Unbounded Memory Buffering for S3 Uploads and Default SQLite Lock Contention","stars_count":73,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","sqlite","s3","performance","streaming"],"exportEndpoints":{"claude":"/api/rules/bun-sqlite-wal-s3-streaming-production-standard?format=claude","cursorMdc":"/api/rules/bun-sqlite-wal-s3-streaming-production-standard?format=mdc","cursorrules":"/api/rules/bun-sqlite-wal-s3-streaming-production-standard?format=cursor","windsurf":"/api/rules/bun-sqlite-wal-s3-streaming-production-standard?format=windsurf","agents":"/api/rules/bun-sqlite-wal-s3-streaming-production-standard?format=agents"}},{"id":"axum-08-state-extractors-tower-service-safety","title":"Axum 0.8 Type-Safe State Extractors & Tower Middleware Invariants","category":"backend","severity":"critical","description":"Mandate strict compile-time state propagation via Axum 0.8 State extractors with FromRef sub-state delegation instead of dynamically typed extensions. Enforce explicit panic isolation and deterministic Tower middleware composition to guarantee zero unhandled worker panics and seamless HTTP response conversion.","antiPatternHeadline":"Relying on dynamic Extension extractors and unordered Tower middleware leading to unhandled worker panics and runtime injection failures.","stars_count":44,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tower","middleware","type-safety"],"exportEndpoints":{"claude":"/api/rules/axum-08-state-extractors-tower-service-safety?format=claude","cursorMdc":"/api/rules/axum-08-state-extractors-tower-service-safety?format=mdc","cursorrules":"/api/rules/axum-08-state-extractors-tower-service-safety?format=cursor","windsurf":"/api/rules/axum-08-state-extractors-tower-service-safety?format=windsurf","agents":"/api/rules/axum-08-state-extractors-tower-service-safety?format=agents"}},{"id":"tanstack-start-router-ssr-loader-stream-standard","title":"TanStack Start SSR Loaders, Type-Safe Search Params & Deferred Streaming Invariants","category":"frontend","severity":"critical","description":"Enforces strict type safety for TanStack Router search parameters via schema validators, mandates selective SSR streaming via defer() for slow promises to optimize TTFB, and requires server functions (createServerFn) to isolate backend execution and prevent client bundle pollution.","antiPatternHeadline":"Blocking SSR with un-deferred loader waterfalls and unvalidated search parameters causing hydration mismatches","stars_count":119,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","tanstack-router","tanstack-start","ssr","streaming","typescript"],"exportEndpoints":{"claude":"/api/rules/tanstack-start-router-ssr-loader-stream-standard?format=claude","cursorMdc":"/api/rules/tanstack-start-router-ssr-loader-stream-standard?format=mdc","cursorrules":"/api/rules/tanstack-start-router-ssr-loader-stream-standard?format=cursor","windsurf":"/api/rules/tanstack-start-router-ssr-loader-stream-standard?format=windsurf","agents":"/api/rules/tanstack-start-router-ssr-loader-stream-standard?format=agents"}},{"id":"react-router-7-framework-mode-hydration","title":"React Router 7 Framework Mode Hydration & Single-Fetch Invariants","category":"frontend","severity":"critical","description":"Enforces strict conformance with React Router 7 Framework Mode single-fetch architecture, route module typegen, and turbo-stream hydration boundaries. Prevents hydration mismatches, broken deferred streaming pipelines, and clobbered server loader promises caused by legacy Remix abstractions.","antiPatternHeadline":"Invoking deprecated json()/defer() wrappers or executing clientLoader without preserving turbo-stream hydration boundaries","stars_count":86,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-router-7","remix","hydration","streaming","single-fetch","typegen"],"exportEndpoints":{"claude":"/api/rules/react-router-7-framework-mode-hydration?format=claude","cursorMdc":"/api/rules/react-router-7-framework-mode-hydration?format=mdc","cursorrules":"/api/rules/react-router-7-framework-mode-hydration?format=cursor","windsurf":"/api/rules/react-router-7-framework-mode-hydration?format=windsurf","agents":"/api/rules/react-router-7-framework-mode-hydration?format=agents"}},{"id":"biome-config-inheritance-and-deterministic-suppression","title":"Biome 1.9 Config Inheritance, VCS Alignment, and Deterministic Suppression","category":"frontend","severity":"critical","description":"Enforces strict Biome 1.9 single-binary linter and formatter architectural invariants across repositories and monorepos. Mandates native VCS ignore synchronization, relative configuration inheritance via 'extends', and deterministic suppression syntax with obligatory audit explanations.","antiPatternHeadline":"Fragmented monorepo configs, unlinked gitignore definitions, and reasonless or legacy ESLint suppression comments.","stars_count":70,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","biome","linter","formatter","tooling","typescript"],"exportEndpoints":{"claude":"/api/rules/biome-config-inheritance-and-deterministic-suppression?format=claude","cursorMdc":"/api/rules/biome-config-inheritance-and-deterministic-suppression?format=mdc","cursorrules":"/api/rules/biome-config-inheritance-and-deterministic-suppression?format=cursor","windsurf":"/api/rules/biome-config-inheritance-and-deterministic-suppression?format=windsurf","agents":"/api/rules/biome-config-inheritance-and-deterministic-suppression?format=agents"}},{"id":"tanstack-start-ssr-streaming-production-standard","title":"TanStack Start SSR Loaders, Type-Safe Search Params, and Deferred Streaming Standard","category":"frontend","severity":"critical","description":"Enforces strict validation on route search parameters and mandates disciplined partitioning between critical SSR loader data and non-critical deferred streams. Prevents hydration mismatches, client-side execution leaks in server functions, and Time-to-First-Byte (TTFB) degradation caused by un-deferred blocking promises.","antiPatternHeadline":"Blocking SSR with Un-deferred Async Operations and Consuming Raw Untyped Search Params","stars_count":89,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","tanstack-start","tanstack-router","ssr","streaming","type-safety"],"exportEndpoints":{"claude":"/api/rules/tanstack-start-ssr-streaming-production-standard?format=claude","cursorMdc":"/api/rules/tanstack-start-ssr-streaming-production-standard?format=mdc","cursorrules":"/api/rules/tanstack-start-ssr-streaming-production-standard?format=cursor","windsurf":"/api/rules/tanstack-start-ssr-streaming-production-standard?format=windsurf","agents":"/api/rules/tanstack-start-ssr-streaming-production-standard?format=agents"}},{"id":"rr7-hydration-single-fetch-streaming-guardrail","title":"React Router 7 Typegen Route Hydration and Single-Fetch Streaming Boundaries","category":"frontend","severity":"critical","description":"Enforces strict typegen module contracts, turbo-stream single-fetch data boundaries, and safe clientLoader hydration patterns in React Router 7 framework mode. Prevents hydration mismatches, double data fetching during hydration, and deprecated v2 defer/json abstractions.","antiPatternHeadline":"Using deprecated json()/defer() helpers and uncoordinated clientLoaders causing hydration waterfall flashes","stars_count":67,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-router-7","remix","hydration","streaming","single-fetch","typegen"],"exportEndpoints":{"claude":"/api/rules/rr7-hydration-single-fetch-streaming-guardrail?format=claude","cursorMdc":"/api/rules/rr7-hydration-single-fetch-streaming-guardrail?format=mdc","cursorrules":"/api/rules/rr7-hydration-single-fetch-streaming-guardrail?format=cursor","windsurf":"/api/rules/rr7-hydration-single-fetch-streaming-guardrail?format=windsurf","agents":"/api/rules/rr7-hydration-single-fetch-streaming-guardrail?format=agents"}},{"id":"biome-v1-9-config-inheritance-suppression-guardrail","title":"Deterministic Biome 1.9 Configuration Inheritance, VCS Integration, and Suppression Standards","category":"frontend","severity":"critical","description":"Enforces strict configuration schema compliance for Biome 1.9 single-binary toolchains across monorepo architectures. Prevents non-deterministic linting and formatting regressions by mandating native VCS integration, explicit extends resolution paths, and structured inline suppression syntax with explanatory justifications.","antiPatternHeadline":"Ad-hoc ESLint/Prettier Hybrid Drift, Loose Global Ignores, and Unjustified Suppression Comments","stars_count":104,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","biome","biomejs","linting","formatting","monorepo","typescript"],"exportEndpoints":{"claude":"/api/rules/biome-v1-9-config-inheritance-suppression-guardrail?format=claude","cursorMdc":"/api/rules/biome-v1-9-config-inheritance-suppression-guardrail?format=mdc","cursorrules":"/api/rules/biome-v1-9-config-inheritance-suppression-guardrail?format=cursor","windsurf":"/api/rules/biome-v1-9-config-inheritance-suppression-guardrail?format=windsurf","agents":"/api/rules/biome-v1-9-config-inheritance-suppression-guardrail?format=agents"}},{"id":"tanstack-start-ssr-loaders-deferred-streaming","title":"TanStack Start SSR Loaders, Search Schema Validation, and Deferred Streaming Invariants","category":"frontend","severity":"critical","description":"Enforce end-to-end type safety, deterministic SSR hydration, and non-blocking streaming in TanStack Start and TanStack Router applications. Mandate runtime search parameter validation via schema parsers, critical vs. non-critical data segregation using `defer()`, and strict prohibition of browser-specific globals inside universal route loaders.","antiPatternHeadline":"Unvalidated route search parameters, un-deferred secondary fetches blocking SSR TTFB, and client-only global access during SSR loader execution.","stars_count":67,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","tanstack-router","tanstack-start","ssr","streaming","type-safety","zod"],"exportEndpoints":{"claude":"/api/rules/tanstack-start-ssr-loaders-deferred-streaming?format=claude","cursorMdc":"/api/rules/tanstack-start-ssr-loaders-deferred-streaming?format=mdc","cursorrules":"/api/rules/tanstack-start-ssr-loaders-deferred-streaming?format=cursor","windsurf":"/api/rules/tanstack-start-ssr-loaders-deferred-streaming?format=windsurf","agents":"/api/rules/tanstack-start-ssr-loaders-deferred-streaming?format=agents"}},{"id":"tanstack-virtual-v3-dynamic-windowing","title":"TanStack Virtual 3.0 Dynamic Measurement, Scroll Containment, and DOM Anti-Saturation Standard","category":"frontend","severity":"critical","description":"Enforces strict DOM memory limits, stable element measurement lifecycles, and subpixel layout containment for TanStack Virtual v3 in high-density data grids. Prohibits unbounded overscanning, non-keyed virtual items, and unmeasured dynamic height mutations that destabilize scroll position or trigger ResizeObserver loops. Mandates explicit scroll margins, isolation of layout recalculations via CSS containment, and dynamic measurement through stable ref callbacks.","antiPatternHeadline":"Uncontained Dynamic Sizing, Naive Index Keys, and Unbounded Overscan in High-Frequency Virtualized Grids","stars_count":92,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","tanstack-virtual","react","performance","windowing","virtualization","dom-optimization"],"exportEndpoints":{"claude":"/api/rules/tanstack-virtual-v3-dynamic-windowing?format=claude","cursorMdc":"/api/rules/tanstack-virtual-v3-dynamic-windowing?format=mdc","cursorrules":"/api/rules/tanstack-virtual-v3-dynamic-windowing?format=cursor","windsurf":"/api/rules/tanstack-virtual-v3-dynamic-windowing?format=windsurf","agents":"/api/rules/tanstack-virtual-v3-dynamic-windowing?format=agents"}},{"id":"valkey-8-cluster-failover-io-standard","title":"Valkey 8.0 Threaded I/O Sharding, Hash-Tag Atomicity, and Failover Resilience","category":"backend","severity":"critical","description":"Enforces strict cluster slot pinning via hash tags for multi-key commands and atomic Lua scripts while configuring cluster topology auto-discovery and backoff retry logic. Prevents CROSSSLOT routing errors, pipeline stall during Valkey 8.0 threaded I/O processing, and service degradation during automated node failover.","antiPatternHeadline":"Cross-Slot Key Execution in Multi-Key Lua Scripts and Missing Cluster Redirection Backoff During Failover","stars_count":83,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","valkey","redis","clustering","distributed-systems","concurrency"],"exportEndpoints":{"claude":"/api/rules/valkey-8-cluster-failover-io-standard?format=claude","cursorMdc":"/api/rules/valkey-8-cluster-failover-io-standard?format=mdc","cursorrules":"/api/rules/valkey-8-cluster-failover-io-standard?format=cursor","windsurf":"/api/rules/valkey-8-cluster-failover-io-standard?format=windsurf","agents":"/api/rules/valkey-8-cluster-failover-io-standard?format=agents"}},{"id":"tanstack-start-ssr-streaming-guardrails-standard","title":"TanStack Start & Router SSR Type-Safe Search Params and Deferred Streaming Standard","category":"frontend","severity":"critical","description":"Enforces strict type safety and architectural invariants across TanStack Start and Fullstack Router SSR lifecycles. Mandates Zod-validated search params via validateSearch, non-blocking SSR TTFB through TanStack defer() streaming, and proper isolation of server-only execution boundaries with createServerFn. Eliminates hydration mismatches, blocking waterfalls, and memory leaks during SSR data hydration.","antiPatternHeadline":"Unvalidated Search Params, Render-Blocking SSR Waterfall Loaders, and Leaked Server Secrets in Client Hydration","stars_count":117,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","tanstack-start","tanstack-router","ssr","deferred-streaming","typescript","search-params"],"exportEndpoints":{"claude":"/api/rules/tanstack-start-ssr-streaming-guardrails-standard?format=claude","cursorMdc":"/api/rules/tanstack-start-ssr-streaming-guardrails-standard?format=mdc","cursorrules":"/api/rules/tanstack-start-ssr-streaming-guardrails-standard?format=cursor","windsurf":"/api/rules/tanstack-start-ssr-streaming-guardrails-standard?format=windsurf","agents":"/api/rules/tanstack-start-ssr-streaming-guardrails-standard?format=agents"}},{"id":"lexical-node-transforms-selection-and-headless-serialization","title":"Lexical Immutable Node Transforms, Selection Reconciliation, and Headless Serialization","category":"frontend","severity":"critical","description":"Enforces Lexical double-buffer immutability invariants during node transforms, prevents selection collapse during reconciliation, and guarantees deterministic headless Markdown serialization. Violations lead to corrupted EditorStates, out-of-sync DOM trees, SSR/Node runtime crashes, and cursor desynchronization.","antiPatternHeadline":"Direct In-Place Node Property Mutation and Window-Dependent Headless Serialization","stars_count":114,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","lexical","rich-text","markdown","headless","state-management"],"exportEndpoints":{"claude":"/api/rules/lexical-node-transforms-selection-and-headless-serialization?format=claude","cursorMdc":"/api/rules/lexical-node-transforms-selection-and-headless-serialization?format=mdc","cursorrules":"/api/rules/lexical-node-transforms-selection-and-headless-serialization?format=cursor","windsurf":"/api/rules/lexical-node-transforms-selection-and-headless-serialization?format=windsurf","agents":"/api/rules/lexical-node-transforms-selection-and-headless-serialization?format=agents"}},{"id":"rust-axum-state-tower-resilience","title":"Rust Axum 0.8 Type-Safe State Extractors & Tower Service Composition","category":"backend","severity":"critical","description":"Mandates compile-time verified application state extraction using Axum 0.8 State and FromRef sub-states, eliminating runtime untyped Extension lookups. Enforces strict Tower middleware layering order with mandatory panic-catching boundaries and deterministic error response mappings.","antiPatternHeadline":"Runtime state injection via Extension<T> and unprotected Tower middleware stacks causing silent connection drops on panics.","stars_count":97,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tower","state-management","middleware","reliability"],"exportEndpoints":{"claude":"/api/rules/rust-axum-state-tower-resilience?format=claude","cursorMdc":"/api/rules/rust-axum-state-tower-resilience?format=mdc","cursorrules":"/api/rules/rust-axum-state-tower-resilience?format=cursor","windsurf":"/api/rules/rust-axum-state-tower-resilience?format=windsurf","agents":"/api/rules/rust-axum-state-tower-resilience?format=agents"}},{"id":"pg17-logical-replication-failover-buffers","title":"PostgreSQL 17 Logical Failover Slots, Decoding Buffers, and Memory Invariants","category":"backend","severity":"critical","description":"Enforces strict PostgreSQL 17 logical replication configuration invariants, requiring synchronized failover replication slots across physical standby nodes and bounded WAL retention limits. Prevents primary crash cycles from uncontrolled disk exhaustion and WAL bloat by enforcing `max_slot_wal_keep_size`, `logical_decoding_work_mem` ceilings, and PG17 `failover = true` slot flags.","antiPatternHeadline":"Unsynchronized Unbounded Logical Replication Slots Causing Primary Disk Exhaustion and Standby Dropouts","stars_count":47,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","postgres-17","replication","high-availability","wal-retention"],"exportEndpoints":{"claude":"/api/rules/pg17-logical-replication-failover-buffers?format=claude","cursorMdc":"/api/rules/pg17-logical-replication-failover-buffers?format=mdc","cursorrules":"/api/rules/pg17-logical-replication-failover-buffers?format=cursor","windsurf":"/api/rules/pg17-logical-replication-failover-buffers?format=windsurf","agents":"/api/rules/pg17-logical-replication-failover-buffers?format=agents"}},{"id":"tanstack-start-router-ssr-loader-search-params","title":"TanStack Start SSR Loaders, Streaming, and Type-Safe Search Params","category":"frontend","severity":"critical","description":"Mandates end-to-end type safety for search params using standard schema validators, enforces non-blocking SSR via TanStack Router deferred data streaming, and guarantees deterministic hydration parity across client and server boundaries.","antiPatternHeadline":"Unvalidated search parameters, non-deferred slow SSR loaders, and non-serializable loader payloads causing hydration failure.","stars_count":56,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","tanstack-router","tanstack-start","ssr","typescript","streaming"],"exportEndpoints":{"claude":"/api/rules/tanstack-start-router-ssr-loader-search-params?format=claude","cursorMdc":"/api/rules/tanstack-start-router-ssr-loader-search-params?format=mdc","cursorrules":"/api/rules/tanstack-start-router-ssr-loader-search-params?format=cursor","windsurf":"/api/rules/tanstack-start-router-ssr-loader-search-params?format=windsurf","agents":"/api/rules/tanstack-start-router-ssr-loader-search-params?format=agents"}},{"id":"rr7-framework-hydration-single-fetch-guard","title":"React Router 7 Framework Mode Hydration and Single-Fetch Typegen Boundary","category":"frontend","severity":"critical","description":"Enforces strict hydration boundaries, Single Fetch turbo-stream execution contracts, and official route-level typegen in React Router 7 Framework Mode. Prohibits deprecated Remix defer() primitives, uncoordinated clientLoader.hydrate overrides, and manual loader type assertions that cause hydration mismatch crashes and network waterfalls.","antiPatternHeadline":"Corrupting Single-Fetch Hydration via Legacy defer() Wrappers and Uncoordinated clientLoader Overrides","stars_count":99,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-router-7","remix","hydration","single-fetch","turbo-stream","typegen"],"exportEndpoints":{"claude":"/api/rules/rr7-framework-hydration-single-fetch-guard?format=claude","cursorMdc":"/api/rules/rr7-framework-hydration-single-fetch-guard?format=mdc","cursorrules":"/api/rules/rr7-framework-hydration-single-fetch-guard?format=cursor","windsurf":"/api/rules/rr7-framework-hydration-single-fetch-guard?format=windsurf","agents":"/api/rules/rr7-framework-hydration-single-fetch-guard?format=agents"}},{"id":"tanstack-virtual-v3-windowing-performance","title":"TanStack Virtual 3.0 Windowing Performance & Dynamic Measurement Guardrails","category":"frontend","severity":"critical","description":"Enforces strict DOM node containment, dynamic size measurement invariants, and scroll margin stabilization when virtualizing massive datasets with TanStack Virtual 3.0. Prevents forced reflow cascades, layout thrashing, incorrect virtual item caching, and DOM saturation across large tables and complex feed surfaces.","antiPatternHeadline":"Unmeasured Dynamic Row Resizing with Reactive Keys and Missing Absolute Containment","stars_count":58,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react","tanstack-virtual","virtualization","performance","dom-recycling"],"exportEndpoints":{"claude":"/api/rules/tanstack-virtual-v3-windowing-performance?format=claude","cursorMdc":"/api/rules/tanstack-virtual-v3-windowing-performance?format=mdc","cursorrules":"/api/rules/tanstack-virtual-v3-windowing-performance?format=cursor","windsurf":"/api/rules/tanstack-virtual-v3-windowing-performance?format=windsurf","agents":"/api/rules/tanstack-virtual-v3-windowing-performance?format=agents"}},{"id":"tanstack-router-ssr-loaders-deferred-streaming","title":"TanStack Start Type-Safe Search, SSR Loaders, and Deferred Streaming Invariants","category":"frontend","severity":"critical","description":"Enforces strict type-safe search parameter validation, parallel SSR route data fetching, and explicit promise deferral using defer() and <Await> boundaries in TanStack Start and Fullstack Router. Prevents TTFB degradation, hydration mismatches, client-server data leakage, and unhandled promise rejections during streaming SSR.","antiPatternHeadline":"Sequential SSR blocking waterfalls, unvalidated raw URL search access, and missing Suspense boundaries on deferred loader promises.","stars_count":93,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","tanstack-start","tanstack-router","ssr","streaming","type-safety","search-params"],"exportEndpoints":{"claude":"/api/rules/tanstack-router-ssr-loaders-deferred-streaming?format=claude","cursorMdc":"/api/rules/tanstack-router-ssr-loaders-deferred-streaming?format=mdc","cursorrules":"/api/rules/tanstack-router-ssr-loaders-deferred-streaming?format=cursor","windsurf":"/api/rules/tanstack-router-ssr-loaders-deferred-streaming?format=windsurf","agents":"/api/rules/tanstack-router-ssr-loaders-deferred-streaming?format=agents"}},{"id":"lexical-immutable-transforms-and-serialization-guardrails","title":"Lexical Immutable Transforms, Selection Reconciliation & Headless Serialization","category":"frontend","severity":"critical","description":"Lexical editor states are immutable directed acyclic graph (DAG) snapshots requiring strict transactional modifications via editor.update() and getWritable(). Flawed node transforms cause fatal infinite reconciliation loops and selection collapse, while headless markdown/SSR pipelines crash when custom AST transformers or node definitions fail to mirror browser runtime registries.","antiPatternHeadline":"Unbounded Node Transform Loops, Selection Nullification, and Unregistered Headless Serialization Drift","stars_count":89,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","lexical","rich-text","ast","markdown","headless","typescript"],"exportEndpoints":{"claude":"/api/rules/lexical-immutable-transforms-and-serialization-guardrails?format=claude","cursorMdc":"/api/rules/lexical-immutable-transforms-and-serialization-guardrails?format=mdc","cursorrules":"/api/rules/lexical-immutable-transforms-and-serialization-guardrails?format=cursor","windsurf":"/api/rules/lexical-immutable-transforms-and-serialization-guardrails?format=windsurf","agents":"/api/rules/lexical-immutable-transforms-and-serialization-guardrails?format=agents"}},{"id":"valkey-8-cluster-slot-redirect-script-atomicity","title":"Valkey 8.0 Multi-Threaded I/O, Hash-Tag Clustered Routing, and Failover Resilience","category":"backend","severity":"critical","description":"Enforces strict hash-tag slot affinity for all multi-key operations and Lua scripts in Valkey 8.0 clusters, preventing CROSSSLOT errors during node re-sharding. Mandates explicit MOVED and ASK redirect exponential-backoff handling and proscribes CPU-intensive or long-running blocking operations that stall Valkey 8.0 threaded I/O pipelines.","antiPatternHeadline":"Un-hashed Cross-Slot Lua Execution and Unhandled Failover Redirect Storms","stars_count":96,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","valkey","redis","cluster","lua","caching","concurrency"],"exportEndpoints":{"claude":"/api/rules/valkey-8-cluster-slot-redirect-script-atomicity?format=claude","cursorMdc":"/api/rules/valkey-8-cluster-slot-redirect-script-atomicity?format=mdc","cursorrules":"/api/rules/valkey-8-cluster-slot-redirect-script-atomicity?format=cursor","windsurf":"/api/rules/valkey-8-cluster-slot-redirect-script-atomicity?format=windsurf","agents":"/api/rules/valkey-8-cluster-slot-redirect-script-atomicity?format=agents"}},{"id":"lexical-node-transforms-headless-serialization-standard","title":"Lexical Immutable Transforms, Selection Reconciliation & Headless Markdown Serialization","category":"frontend","severity":"critical","description":"Enforces Lexical node immutability via getWritable state transitions, guarantees idempotent node transform cycles to avert infinite update loops, preserves selection reconciliation across DOM-free contexts, and mandates isomorphic schema registration for headless markdown pipelines.","antiPatternHeadline":"Mutating frozen LexicalNode references directly, invoking non-idempotent node transforms, and executing headless markdown serialization with mismatched node schemas or unchecked selections.","stars_count":92,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","lexical","rich-text","markdown","headless-cms","immutability"],"exportEndpoints":{"claude":"/api/rules/lexical-node-transforms-headless-serialization-standard?format=claude","cursorMdc":"/api/rules/lexical-node-transforms-headless-serialization-standard?format=mdc","cursorrules":"/api/rules/lexical-node-transforms-headless-serialization-standard?format=cursor","windsurf":"/api/rules/lexical-node-transforms-headless-serialization-standard?format=windsurf","agents":"/api/rules/lexical-node-transforms-headless-serialization-standard?format=agents"}},{"id":"biome-configuration-inheritance-and-deterministic-suppressions","title":"Biome 1.9 Configuration Inheritance, VCS Integration, and Deterministic Rule Suppressions","category":"frontend","severity":"critical","description":"Enforces strict Biome 1.9 configuration architecture across monorepos and standalone repositories. Mandates native VCS ignore file synchronization, explicit configuration inheritance hierarchies via extends, and deterministic, fully-qualified suppression comments with mandatory explanatory text.","antiPatternHeadline":"Unannotated inline bypasses, orphaned .gitignore parity drift, and legacy ESLint/Prettier directive bleed-through.","stars_count":107,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","biome","linter","formatter","tooling","typescript"],"exportEndpoints":{"claude":"/api/rules/biome-configuration-inheritance-and-deterministic-suppressions?format=claude","cursorMdc":"/api/rules/biome-configuration-inheritance-and-deterministic-suppressions?format=mdc","cursorrules":"/api/rules/biome-configuration-inheritance-and-deterministic-suppressions?format=cursor","windsurf":"/api/rules/biome-configuration-inheritance-and-deterministic-suppressions?format=windsurf","agents":"/api/rules/biome-configuration-inheritance-and-deterministic-suppressions?format=agents"}},{"id":"tanstack-start-ssr-deferred-streaming-and-search-params","title":"TanStack Start SSR Deferred Streaming & Type-Safe Search Params Standard","category":"frontend","severity":"critical","description":"Enforces strict type safety for URL search parameters via validateSearch schemas and non-blocking SSR execution via TanStack Router's defer and Await primitives. Prevents critical-path Time-To-First-Byte (TTFB) degradation and client-server hydration mismatches.","antiPatternHeadline":"Blocking Critical SSR Path with Un-deferred Loaders and Reading Untyped Search Params","stars_count":115,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","tanstack-router","tanstack-start","ssr","typescript","streaming"],"exportEndpoints":{"claude":"/api/rules/tanstack-start-ssr-deferred-streaming-and-search-params?format=claude","cursorMdc":"/api/rules/tanstack-start-ssr-deferred-streaming-and-search-params?format=mdc","cursorrules":"/api/rules/tanstack-start-ssr-deferred-streaming-and-search-params?format=cursor","windsurf":"/api/rules/tanstack-start-ssr-deferred-streaming-and-search-params?format=windsurf","agents":"/api/rules/tanstack-start-ssr-deferred-streaming-and-search-params?format=agents"}},{"id":"hono-jsx-edge-stream-pipelines-production-standard","title":"Hono JSX Non-Blocking Edge Streaming & Async Boundary Invariants","category":"frontend","severity":"critical","description":"Enforces non-blocking asynchronous JSX streaming pipelines and strict error boundary handling on edge runtimes (Cloudflare Workers, Deno). Preempts memory bloat, compute-limit exhaustion, and mid-flight stream terminations by mandating renderToReadableStream with async Suspense boundaries and pre-stream header finalization.","antiPatternHeadline":"Buffering Asynchronous JSX trees into in-memory strings or mutating HTTP headers after stream initialization on edge isolates.","stars_count":100,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","hono","jsx","streaming","cloudflare-workers","deno","edge-runtime","suspense"],"exportEndpoints":{"claude":"/api/rules/hono-jsx-edge-stream-pipelines-production-standard?format=claude","cursorMdc":"/api/rules/hono-jsx-edge-stream-pipelines-production-standard?format=mdc","cursorrules":"/api/rules/hono-jsx-edge-stream-pipelines-production-standard?format=cursor","windsurf":"/api/rules/hono-jsx-edge-stream-pipelines-production-standard?format=windsurf","agents":"/api/rules/hono-jsx-edge-stream-pipelines-production-standard?format=agents"}},{"id":"react-router-7-hydration-typegen-guardrail","title":"React Router 7 Framework Mode: Hydration, Single-Fetch, and Typegen Invariants","category":"frontend","severity":"critical","description":"Enforces strict adherence to React Router 7 framework mode data architecture, mandating typegen imports via './+types/', prohibiting legacy json() and defer() wrappers in single-fetch mode, and ensuring accurate clientLoader hydration synchronization to eliminate SSR hydration mismatches.","antiPatternHeadline":"Using Legacy json()/defer() Wrappers and Manual useLoaderData Generics with Unsynchronized clientLoader Hydration","stars_count":68,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-router-7","remix","hydration","single-fetch","typegen"],"exportEndpoints":{"claude":"/api/rules/react-router-7-hydration-typegen-guardrail?format=claude","cursorMdc":"/api/rules/react-router-7-hydration-typegen-guardrail?format=mdc","cursorrules":"/api/rules/react-router-7-hydration-typegen-guardrail?format=cursor","windsurf":"/api/rules/react-router-7-hydration-typegen-guardrail?format=windsurf","agents":"/api/rules/react-router-7-hydration-typegen-guardrail?format=agents"}},{"id":"axum-0-8-state-and-tower-composition","title":"Axum 0.8 Type-Safe State Extractors & Tower Service Composition","category":"backend","severity":"critical","description":"Mandates compile-time type-safe state injection via Axum 0.8's State extractor and FromRef sub-states instead of dynamic Extension lookups. Enforces strict Tower layer composition order with mandatory panic isolation boundaries to guarantee zero unhandled rejection crashes in production.","antiPatternHeadline":"Using dynamic Extensions or unisolated Tower layers causing runtime panic drops and state omission crashes","stars_count":101,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tower","state-management","reliability"],"exportEndpoints":{"claude":"/api/rules/axum-0-8-state-and-tower-composition?format=claude","cursorMdc":"/api/rules/axum-0-8-state-and-tower-composition?format=mdc","cursorrules":"/api/rules/axum-0-8-state-and-tower-composition?format=cursor","windsurf":"/api/rules/axum-0-8-state-and-tower-composition?format=windsurf","agents":"/api/rules/axum-0-8-state-and-tower-composition?format=agents"}},{"id":"react-router-7-hydration-typegen-standard","title":"React Router 7 Framework Mode Hydration, Typegen, and Single-Fetch Invariants","category":"frontend","severity":"critical","description":"Enforces strict architectural boundaries for React Router 7 Framework Mode applications using Single Fetch. Mandates the use of generated route module types (+types), prevents hydration mismatches across server-to-client loader transitions, and guarantees correct streaming deferred data consumption via turbo-stream serialization.","antiPatternHeadline":"Bypassing Route Typegen, Misconfiguring clientLoader.hydrate, and Returning Legacy JSON Responses in Single Fetch","stars_count":105,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-router-7","remix","hydration","single-fetch","typegen"],"exportEndpoints":{"claude":"/api/rules/react-router-7-hydration-typegen-standard?format=claude","cursorMdc":"/api/rules/react-router-7-hydration-typegen-standard?format=mdc","cursorrules":"/api/rules/react-router-7-hydration-typegen-standard?format=cursor","windsurf":"/api/rules/react-router-7-hydration-typegen-standard?format=windsurf","agents":"/api/rules/react-router-7-hydration-typegen-standard?format=agents"}},{"id":"valkey-8-threaded-io-cluster-failover-resilience","title":"Valkey 8.0 Threaded I/O, Cluster Slot Routing, and Script Invariants","category":"backend","severity":"critical","description":"Valkey 8.0 leverages enhanced multi-threaded I/O while maintaining a single-threaded command execution core, making operations vulnerable to cross-slot failures and unhandled cluster topology mutations. In distributed cluster deployments, any multi-key operation or Lua script execution without proper hash-tag alignment will trigger CROSSSLOT errors, while failover events without backoff-jittered slot-cache invalidation precipitate thundering herd failures. Applications MUST enforce deterministic hash-tagging, decouple I/O concurrency from blocking scripts, and handle MOVED/ASK redirections with rate-limited topology refreshes.","antiPatternHeadline":"Executing Non-Hash-Tagged Multi-Key Scripts and Unhedged Failover Connection Storms in Valkey Clusters","stars_count":74,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","valkey","clustering","distributed-systems","failover","lua"],"exportEndpoints":{"claude":"/api/rules/valkey-8-threaded-io-cluster-failover-resilience?format=claude","cursorMdc":"/api/rules/valkey-8-threaded-io-cluster-failover-resilience?format=mdc","cursorrules":"/api/rules/valkey-8-threaded-io-cluster-failover-resilience?format=cursor","windsurf":"/api/rules/valkey-8-threaded-io-cluster-failover-resilience?format=windsurf","agents":"/api/rules/valkey-8-threaded-io-cluster-failover-resilience?format=agents"}},{"id":"rr7-framework-mode-hydration-single-fetch-guardrails","title":"React Router 7 Framework Mode Hydration, Typegen, and Single-Fetch Invariants","category":"frontend","severity":"critical","description":"Mandates strict adherence to React Router v7 Framework Mode data hydration and Single Fetch protocol invariants. Enforces route module type safety via generated './+types/*' virtual imports, eliminates deprecated json()/defer() abstractions in favor of naked object streaming, and strictly governs clientLoader.hydrate execution boundaries to prevent hydration mismatch flashes and dual-roundtrip performance cliffs.","antiPatternHeadline":"Bypassing Route Typegen, Returning Legacy json()/defer() Helpers, and Misconfiguring clientLoader Hydration Lifecycles","stars_count":118,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-router-7","hydration","single-fetch","typegen","streaming"],"exportEndpoints":{"claude":"/api/rules/rr7-framework-mode-hydration-single-fetch-guardrails?format=claude","cursorMdc":"/api/rules/rr7-framework-mode-hydration-single-fetch-guardrails?format=mdc","cursorrules":"/api/rules/rr7-framework-mode-hydration-single-fetch-guardrails?format=cursor","windsurf":"/api/rules/rr7-framework-mode-hydration-single-fetch-guardrails?format=windsurf","agents":"/api/rules/rr7-framework-mode-hydration-single-fetch-guardrails?format=agents"}},{"id":"hono-jsx-edge-stream-pipeline-architecture","title":"Hono JSX Edge Streaming Pipelines & Non-Blocking Response Composition","category":"frontend","severity":"critical","description":"Mandates zero-buffer edge streaming for Hono JSX on Cloudflare Workers and Deno runtimes. Enforces non-blocking Time to First Byte (TTFB) chunk emission via Suspense and renderToReadableStream while preventing edge memory exhaustion and post-stream header mutation crashes.","antiPatternHeadline":"Full-Tree In-Memory HTML Buffering and Post-Stream Response Header Mutations","stars_count":110,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","hono","jsx","streaming","edge-computing","cloudflare-workers","deno"],"exportEndpoints":{"claude":"/api/rules/hono-jsx-edge-stream-pipeline-architecture?format=claude","cursorMdc":"/api/rules/hono-jsx-edge-stream-pipeline-architecture?format=mdc","cursorrules":"/api/rules/hono-jsx-edge-stream-pipeline-architecture?format=cursor","windsurf":"/api/rules/hono-jsx-edge-stream-pipeline-architecture?format=windsurf","agents":"/api/rules/hono-jsx-edge-stream-pipeline-architecture?format=agents"}},{"id":"axum-0-8-state-tower-panic-resilience","title":"Axum 0.8 Type-Safe State Extractors, Tower Middleware Ordering, and Panic Boundary Architecture","category":"backend","severity":"critical","description":"Mandates compile-time type-safe state injection via Axum 0.8 State and FromRef extractors, strictly forbidding untyped Extension usage. Enforces deterministic Tower ServiceBuilder layer execution order and requires CatchPanicLayer boundaries to guarantee zero connection-dropping unhandled panics.","antiPatternHeadline":"Dynamic runtime Extension extraction leading to unhandled runtime panics, inverted Tower middleware evaluation, and naked worker panics dropping HTTP sockets.","stars_count":88,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tower","middleware","safety"],"exportEndpoints":{"claude":"/api/rules/axum-0-8-state-tower-panic-resilience?format=claude","cursorMdc":"/api/rules/axum-0-8-state-tower-panic-resilience?format=mdc","cursorrules":"/api/rules/axum-0-8-state-tower-panic-resilience?format=cursor","windsurf":"/api/rules/axum-0-8-state-tower-panic-resilience?format=windsurf","agents":"/api/rules/axum-0-8-state-tower-panic-resilience?format=agents"}},{"id":"biome-configuration-vcs-and-suppression-standards","title":"Biome 1.9 Configuration Inheritance, VCS Integration, and Suppression Guardrail","category":"frontend","severity":"critical","description":"Enforces strict Biome 1.9 single-binary formatting and linting standards across frontend and monorepo codebases. Requires unified VCS ignore synchronization to prevent CI/local drift and mandates deterministic rule suppressions with mandatory justification reasons. Prohibits legacy ESLint/Prettier directive bleed and ensures deterministic configuration inheritance.","antiPatternHeadline":"Deploying unanchored ignore comments without explanations, lingering ESLint directives, or uncoupled VCS ignore configs in Biome environments.","stars_count":43,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","biome","linter","formatter","monorepo","typescript"],"exportEndpoints":{"claude":"/api/rules/biome-configuration-vcs-and-suppression-standards?format=claude","cursorMdc":"/api/rules/biome-configuration-vcs-and-suppression-standards?format=mdc","cursorrules":"/api/rules/biome-configuration-vcs-and-suppression-standards?format=cursor","windsurf":"/api/rules/biome-configuration-vcs-and-suppression-standards?format=windsurf","agents":"/api/rules/biome-configuration-vcs-and-suppression-standards?format=agents"}},{"id":"valkey-8-cluster-topology-slot-atomicity-standard","title":"Valkey 8.0 Threaded I/O, Cluster Slot Pinning, and Failover Architecture","category":"backend","severity":"critical","description":"Enforces strict cluster hash-tag pinning for multi-key operations and Lua scripts to prevent CROSSSLOT errors during Valkey 8.0 cluster failovers and resharding. Mandates resilient client topology caching, automated MOVED/ASK redirect recovery, and connection pooling calibrated to Valkey 8.0 threaded I/O throughput capabilities.","antiPatternHeadline":"Executing un-hashed multi-key Lua scripts and naive failover handling causing CROSSSLOT exceptions and cluster split-brain reads","stars_count":49,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","valkey","clustering","distributed-systems","failover","lua"],"exportEndpoints":{"claude":"/api/rules/valkey-8-cluster-topology-slot-atomicity-standard?format=claude","cursorMdc":"/api/rules/valkey-8-cluster-topology-slot-atomicity-standard?format=mdc","cursorrules":"/api/rules/valkey-8-cluster-topology-slot-atomicity-standard?format=cursor","windsurf":"/api/rules/valkey-8-cluster-topology-slot-atomicity-standard?format=windsurf","agents":"/api/rules/valkey-8-cluster-topology-slot-atomicity-standard?format=agents"}},{"id":"tanstack-start-ssr-streaming-search-params-invariant","title":"TanStack Start SSR: Type-Safe Search Params, Server Loaders, and Deferred Streaming","category":"frontend","severity":"critical","description":"Enforces strict type safety for URL search parameters via schema validators, prevents SSR waterfalls through non-blocking deferred streaming, and guarantees proper server-client boundary isolation using server functions in TanStack Start and Router.","antiPatternHeadline":"Untyped search param access, blocking SSR waterfalls, and leaking server execution into client bundles.","stars_count":79,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","tanstack-start","tanstack-router","ssr","streaming","search-params","typescript"],"exportEndpoints":{"claude":"/api/rules/tanstack-start-ssr-streaming-search-params-invariant?format=claude","cursorMdc":"/api/rules/tanstack-start-ssr-streaming-search-params-invariant?format=mdc","cursorrules":"/api/rules/tanstack-start-ssr-streaming-search-params-invariant?format=cursor","windsurf":"/api/rules/tanstack-start-ssr-streaming-search-params-invariant?format=windsurf","agents":"/api/rules/tanstack-start-ssr-streaming-search-params-invariant?format=agents"}},{"id":"valkey-8-cluster-slot-lua-atomicity-failover","title":"Valkey 8.0 Multi-Threaded I/O, Hash Slot Routing & Lua Atomicity Guardrails","category":"backend","severity":"critical","description":"Enforces strict hash-tag pinning for multi-key operations and Lua scripts in Valkey 8.0 clusters to prevent CROSSSLOT execution failures. Mandates non-blocking transactional script boundaries and resilient topology refresh configurations to safeguard Valkey 8.0 multi-threaded I/O pipelines during master failovers.","antiPatternHeadline":"Unpinned Cross-Slot Lua Scripts and Topology-Blind Retries Triggering Main-Thread Starvation and MOVED Storms","stars_count":96,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","valkey","redis","clustering","distributed-systems","lua"],"exportEndpoints":{"claude":"/api/rules/valkey-8-cluster-slot-lua-atomicity-failover?format=claude","cursorMdc":"/api/rules/valkey-8-cluster-slot-lua-atomicity-failover?format=mdc","cursorrules":"/api/rules/valkey-8-cluster-slot-lua-atomicity-failover?format=cursor","windsurf":"/api/rules/valkey-8-cluster-slot-lua-atomicity-failover?format=windsurf","agents":"/api/rules/valkey-8-cluster-slot-lua-atomicity-failover?format=agents"}},{"id":"biome-v1-9-inheritance-vcs-suppression-guardrail","title":"Biome 1.9 Configuration Inheritance, VCS Integration, and Suppression Guardrails","category":"frontend","severity":"critical","description":"Standardizes Biome 1.9 configuration architecture across monorepos and isolated services. Enforces explicit extends array resolution, native VCS git-client integration for dirty/staged formatting, and deterministic suppression syntax requiring mandatory technical justifications.","antiPatternHeadline":"Ad-Hoc Suppressions, Unanchored Root Configs, and Broken Monorepo Tooling Interop","stars_count":117,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","biome","linter","formatter","tooling","monorepo"],"exportEndpoints":{"claude":"/api/rules/biome-v1-9-inheritance-vcs-suppression-guardrail?format=claude","cursorMdc":"/api/rules/biome-v1-9-inheritance-vcs-suppression-guardrail?format=mdc","cursorrules":"/api/rules/biome-v1-9-inheritance-vcs-suppression-guardrail?format=cursor","windsurf":"/api/rules/biome-v1-9-inheritance-vcs-suppression-guardrail?format=windsurf","agents":"/api/rules/biome-v1-9-inheritance-vcs-suppression-guardrail?format=agents"}},{"id":"valkey-8-cluster-slot-redirect-and-lua-atomicity","title":"Valkey 8.0 Cluster Slot Routing, Failover Redirects, and Lua Atomicity Guardrails","category":"backend","severity":"critical","description":"Enforces strict hash-tag slot pinning for all multi-key operations and Lua scripts, paired with robust MOVED/ASK redirect handling and dynamic topology refreshes during Valkey 8.0 cluster failovers. Prevents CROSSSLOT runtime exceptions, socket stalls during threaded I/O parallel processing, and cascading failover dropouts.","antiPatternHeadline":"Executing unpinned multi-key Lua scripts without hash tags and omitting cluster redirect/topology refresh logic during failover.","stars_count":53,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","valkey","redis","distributed-systems","high-performance","concurrency"],"exportEndpoints":{"claude":"/api/rules/valkey-8-cluster-slot-redirect-and-lua-atomicity?format=claude","cursorMdc":"/api/rules/valkey-8-cluster-slot-redirect-and-lua-atomicity?format=mdc","cursorrules":"/api/rules/valkey-8-cluster-slot-redirect-and-lua-atomicity?format=cursor","windsurf":"/api/rules/valkey-8-cluster-slot-redirect-and-lua-atomicity?format=windsurf","agents":"/api/rules/valkey-8-cluster-slot-redirect-and-lua-atomicity?format=agents"}},{"id":"rust-axum-0-8-state-and-tower-middleware-invariants","title":"Axum 0.8 Type-Safe Sub-State Composition & Resilient Tower Middleware Ordering","category":"backend","severity":"critical","description":"Mandates compile-time type-safe FromRef sub-state extraction and deterministic Tower ServiceBuilder ordering in Axum 0.8 services. Prevents runtime extractor rejections, state type mismatches across modular sub-routers, and connection dropping from unhandled task panics.","antiPatternHeadline":"Relying on untyped Extension injection and unhandled panics instead of FromRef State and CatchPanicLayer composition.","stars_count":74,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tower","tokio","middleware","resilience"],"exportEndpoints":{"claude":"/api/rules/rust-axum-0-8-state-and-tower-middleware-invariants?format=claude","cursorMdc":"/api/rules/rust-axum-0-8-state-and-tower-middleware-invariants?format=mdc","cursorrules":"/api/rules/rust-axum-0-8-state-and-tower-middleware-invariants?format=cursor","windsurf":"/api/rules/rust-axum-0-8-state-and-tower-middleware-invariants?format=windsurf","agents":"/api/rules/rust-axum-0-8-state-and-tower-middleware-invariants?format=agents"}},{"id":"postgres-17-logical-replication-failover-buffer-invariants","title":"PostgreSQL 17 Logical Replication Failover Synchronization & Memory Buffer Invariants","category":"backend","severity":"critical","description":"Enforces strict PostgreSQL 17 logical replication topologies, requiring failover-enabled logical slots and physical standby synchronization via synchronized_standby_slots. Mandates deterministic memory allocations for shared_buffers and logical_decoding_work_mem to prevent disk spilling and out-of-memory cascading failures during replication stream decode.","antiPatternHeadline":"Creating un-synchronized logical slots lacking failover flags while under-allocating decoding memory buffers","stars_count":82,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres17","logical-replication","database-reliability","memory-buffers"],"exportEndpoints":{"claude":"/api/rules/postgres-17-logical-replication-failover-buffer-invariants?format=claude","cursorMdc":"/api/rules/postgres-17-logical-replication-failover-buffer-invariants?format=mdc","cursorrules":"/api/rules/postgres-17-logical-replication-failover-buffer-invariants?format=cursor","windsurf":"/api/rules/postgres-17-logical-replication-failover-buffer-invariants?format=windsurf","agents":"/api/rules/postgres-17-logical-replication-failover-buffer-invariants?format=agents"}},{"id":"tanstack-virtual-v3-dynamic-containment-guardrail","title":"TanStack Virtual 3.0 Dynamic Sizing & DOM Containment Standards","category":"frontend","severity":"critical","description":"Mandates zero-jitter dynamic element measurement, hardware-accelerated transforms, and bounded overscan budgets for TanStack Virtual v3 in high-density tables. Enforces strict viewport container isolation, stable item keying, and precise ref callback bindings to eliminate layout thrashing and DOM node saturation.","antiPatternHeadline":"Uncontained Dynamic Sizing with Non-Accelerated Offsets Leading to Scroll Jitter and DOM Saturation","stars_count":89,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","tanstack-virtual","react","virtualization","performance","dom-containment"],"exportEndpoints":{"claude":"/api/rules/tanstack-virtual-v3-dynamic-containment-guardrail?format=claude","cursorMdc":"/api/rules/tanstack-virtual-v3-dynamic-containment-guardrail?format=mdc","cursorrules":"/api/rules/tanstack-virtual-v3-dynamic-containment-guardrail?format=cursor","windsurf":"/api/rules/tanstack-virtual-v3-dynamic-containment-guardrail?format=windsurf","agents":"/api/rules/tanstack-virtual-v3-dynamic-containment-guardrail?format=agents"}},{"id":"axum-08-state-tower-production-standard","title":"Axum 0.8 Type-Safe State Extractors & Resilient Tower Middleware Stack Standard","category":"backend","severity":"critical","description":"Enforces compile-time verified state extraction using Axum 0.8 State extractors with modular FromRef implementations, eliminating unsafe runtime Extension lookups. Mandates deterministic Tower middleware composition with explicit panic boundaries and tracing layers to guarantee zero unhandled worker panics and complete observability.","antiPatternHeadline":"Runtime Extension Panics and Missing Tower Panic Boundaries","stars_count":46,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tower","async","type-safety"],"exportEndpoints":{"claude":"/api/rules/axum-08-state-tower-production-standard?format=claude","cursorMdc":"/api/rules/axum-08-state-tower-production-standard?format=mdc","cursorrules":"/api/rules/axum-08-state-tower-production-standard?format=cursor","windsurf":"/api/rules/axum-08-state-tower-production-standard?format=windsurf","agents":"/api/rules/axum-08-state-tower-production-standard?format=agents"}},{"id":"svelte-5-runes-reactivity-and-snippets-standard","title":"Svelte 5 Runes Invariant: Fine-Grained Reactivity and Snippet Composition","category":"frontend","severity":"critical","description":"Enforces architectural invariants for Svelte 5 runes ($state, $derived, $props, $effect) and snippet composition. Prevents reactivity severing caused by destructuring reactive proxies, completely eliminates legacy Svelte 3/4 reactivity paradigms (export let, $:, <slot />), and bans side-effect synchronization antipatterns in $effect.","antiPatternHeadline":"Reactivity severing through proxy destructuring and derived-state synchronization inside $effect","stars_count":96,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","reactivity","typescript"],"exportEndpoints":{"claude":"/api/rules/svelte-5-runes-reactivity-and-snippets-standard?format=claude","cursorMdc":"/api/rules/svelte-5-runes-reactivity-and-snippets-standard?format=mdc","cursorrules":"/api/rules/svelte-5-runes-reactivity-and-snippets-standard?format=cursor","windsurf":"/api/rules/svelte-5-runes-reactivity-and-snippets-standard?format=windsurf","agents":"/api/rules/svelte-5-runes-reactivity-and-snippets-standard?format=agents"}},{"id":"react-router-v7-framework-hydration-boundaries","title":"React Router 7 Framework Mode Hydration, Typegen, and Single-Fetch Invariants","category":"frontend","severity":"critical","description":"Enforces strict data boundaries, Single Fetch serialization, and typegen alignment in React Router 7 framework mode. Prevents hydration mismatches, double-fetching cascades, and clientLoader desynchronization when streaming deferred promises across SSR and client navigations.","antiPatternHeadline":"Bypassing Typegen Route Module Types and Misconfiguring clientLoader.hydrate with Defer Streams","stars_count":112,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-router-7","remix","hydration","single-fetch","typegen"],"exportEndpoints":{"claude":"/api/rules/react-router-v7-framework-hydration-boundaries?format=claude","cursorMdc":"/api/rules/react-router-v7-framework-hydration-boundaries?format=mdc","cursorrules":"/api/rules/react-router-v7-framework-hydration-boundaries?format=cursor","windsurf":"/api/rules/react-router-v7-framework-hydration-boundaries?format=windsurf","agents":"/api/rules/react-router-v7-framework-hydration-boundaries?format=agents"}},{"id":"biome-vcs-inheritance-suppression-guardrail-production-standard","title":"Biome 1.9 Configuration Inheritance, Native VCS Filtering, and Deterministic Rule Suppression","category":"frontend","severity":"critical","description":"Enforces strict Biome 1.9+ architectural standards across monorepos and frontend targets. Mandates deterministic configuration inheritance via canonical extends paths, native Git ignore integration using the VCS engine to eliminate dual-maintenance ignore lists, and syntax-compliant inline suppressions requiring fully-qualified rule names with human-readable rationale.","antiPatternHeadline":"Fragmented ignore arrays, missing VCS integration, and ambiguous or ESLint-legacy inline suppressions that cause CI drift.","stars_count":94,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","biome","linter","formatter","monorepo","vcs"],"exportEndpoints":{"claude":"/api/rules/biome-vcs-inheritance-suppression-guardrail-production-standard?format=claude","cursorMdc":"/api/rules/biome-vcs-inheritance-suppression-guardrail-production-standard?format=mdc","cursorrules":"/api/rules/biome-vcs-inheritance-suppression-guardrail-production-standard?format=cursor","windsurf":"/api/rules/biome-vcs-inheritance-suppression-guardrail-production-standard?format=windsurf","agents":"/api/rules/biome-vcs-inheritance-suppression-guardrail-production-standard?format=agents"}},{"id":"valkey-8-cluster-failover-multithreaded-io","title":"Valkey 8.0 Threaded I/O, Cluster Redirection, and Hash-Tagged Lua Atomicity","category":"backend","severity":"critical","description":"Enforce strict hash-tag slot isolation for multi-key transactions and Lua scripts within Valkey 8.0 cluster topologies. Mandate resilient MOVED/ASK redirect handling with automatic slot cache invalidation and backoff to survive replica-to-primary failovers without stalling Valkey's event loop or causing CROSSSLOT exceptions.","antiPatternHeadline":"Cross-Slot Execution Failures and Unhandled MOVED/ASK Redirect Storms During Failover","stars_count":74,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","valkey","clustering","distributed-systems","failover","lua"],"exportEndpoints":{"claude":"/api/rules/valkey-8-cluster-failover-multithreaded-io?format=claude","cursorMdc":"/api/rules/valkey-8-cluster-failover-multithreaded-io?format=mdc","cursorrules":"/api/rules/valkey-8-cluster-failover-multithreaded-io?format=cursor","windsurf":"/api/rules/valkey-8-cluster-failover-multithreaded-io?format=windsurf","agents":"/api/rules/valkey-8-cluster-failover-multithreaded-io?format=agents"}},{"id":"valkey-cluster-io-failover-production-standard","title":"Valkey 8.0 Threaded I/O Topology, Cluster Hash Tags, and Script Atomicity Guardrails","category":"backend","severity":"critical","description":"Enforces strict cluster slot routing invariants and non-blocking command safety under Valkey 8.0's multi-threaded I/O engine. Prevents CROSSSLOT evaluation exceptions during master failovers, eliminates split-brain script executions, and mandates hash-tagging alongside exponential backoff slot refreshes.","antiPatternHeadline":"Executing Cross-Slot Lua Scripts and Unbounded Cluster Reconnection Storms during Master Failover","stars_count":112,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","valkey","redis","cluster","distributed-systems","caching"],"exportEndpoints":{"claude":"/api/rules/valkey-cluster-io-failover-production-standard?format=claude","cursorMdc":"/api/rules/valkey-cluster-io-failover-production-standard?format=mdc","cursorrules":"/api/rules/valkey-cluster-io-failover-production-standard?format=cursor","windsurf":"/api/rules/valkey-cluster-io-failover-production-standard?format=windsurf","agents":"/api/rules/valkey-cluster-io-failover-production-standard?format=agents"}},{"id":"postgres-17-logical-replication-and-buffers-guardrail","title":"PostgreSQL 17 Failover Replication Slots, Streaming Decoding, and Memory Tuning Invariants","category":"backend","severity":"critical","description":"Enforces strict configuration and migration invariants for PostgreSQL 17 logical replication and shared buffer allocation. Requires failover slot synchronization across physical standby instances, streaming logical transaction decoding thresholds, and mathematically bounded buffer and work memory provisioning to prevent WAL disk exhaustion and out-of-memory cascading failures during subscriber failover.","antiPatternHeadline":"Unsynchronized Logical Slots, Unbounded In-Memory Decoding, and Overcommitted Shared Buffers Leading to WAL Starvation","stars_count":43,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql-17","logical-replication","memory-buffers","high-availability"],"exportEndpoints":{"claude":"/api/rules/postgres-17-logical-replication-and-buffers-guardrail?format=claude","cursorMdc":"/api/rules/postgres-17-logical-replication-and-buffers-guardrail?format=mdc","cursorrules":"/api/rules/postgres-17-logical-replication-and-buffers-guardrail?format=cursor","windsurf":"/api/rules/postgres-17-logical-replication-and-buffers-guardrail?format=windsurf","agents":"/api/rules/postgres-17-logical-replication-and-buffers-guardrail?format=agents"}},{"id":"valkey-8-cluster-threaded-io-failover-guardrails","title":"Valkey 8.0 Multi-Threaded I/O, Cluster Slot Pinning, and Failover Resilience","category":"backend","severity":"critical","description":"Enforces strict hash-tag pinning for multi-key operations and Lua scripts, explicit topology refresh intervals during cluster failover (MOVED/ASK redirects), and non-blocking multi-threaded I/O client integration in Valkey 8.0. Prevents runtime CROSSSLOT errors, split-brain command execution, and thread-pool exhaustion during primary-replica promotions.","antiPatternHeadline":"Unpinned Cross-Slot Lua Scripts and Static Node Connections Causing Failover Deadlocks and CROSSSLOT Exceptions","stars_count":60,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","valkey","valkey-8","redis-compatible","distributed-systems","cluster-failover","threaded-io"],"exportEndpoints":{"claude":"/api/rules/valkey-8-cluster-threaded-io-failover-guardrails?format=claude","cursorMdc":"/api/rules/valkey-8-cluster-threaded-io-failover-guardrails?format=mdc","cursorrules":"/api/rules/valkey-8-cluster-threaded-io-failover-guardrails?format=cursor","windsurf":"/api/rules/valkey-8-cluster-threaded-io-failover-guardrails?format=windsurf","agents":"/api/rules/valkey-8-cluster-threaded-io-failover-guardrails?format=agents"}},{"id":"biome-v1-9-config-vcs-deterministic-suppression","title":"Biome 1.9 Configuration Inheritance, VCS Integration, and Deterministic Rule Suppression","category":"frontend","severity":"critical","description":"Enforces deterministic configuration inheritance, native Git VCS boundary synchronization, and strictly justified inline suppressions in Biome 1.9. Prevents CI pipeline failures, configuration drift in monorepos, and silent suppression rot caused by legacy ESLint comment patterns.","antiPatternHeadline":"Applying Unjustified Legacy ESLint Suppressions and Misconfiguring Monorepo Biome VCS Inheritance","stars_count":113,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","biome","linter","formatter","monorepo","typescript"],"exportEndpoints":{"claude":"/api/rules/biome-v1-9-config-vcs-deterministic-suppression?format=claude","cursorMdc":"/api/rules/biome-v1-9-config-vcs-deterministic-suppression?format=mdc","cursorrules":"/api/rules/biome-v1-9-config-vcs-deterministic-suppression?format=cursor","windsurf":"/api/rules/biome-v1-9-config-vcs-deterministic-suppression?format=windsurf","agents":"/api/rules/biome-v1-9-config-vcs-deterministic-suppression?format=agents"}},{"id":"axum-0-8-type-safe-state-tower-service-guardrails","title":"Axum 0.8 Type-Safe State Extractors & Tower Middleware Production Guardrails","category":"backend","severity":"critical","description":"Enforces strict type-safe state extraction via Axum 0.8 State and FromRef patterns, eliminates runtime Extension panics, mandates outer-boundary CatchPanicLayer integration, and standardizes infallible Tower middleware composition.","antiPatternHeadline":"Untyped runtime Extension extraction, misordered Tower middleware layers, and unhandled panic drops.","stars_count":106,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tower","middleware","type-safety"],"exportEndpoints":{"claude":"/api/rules/axum-0-8-type-safe-state-tower-service-guardrails?format=claude","cursorMdc":"/api/rules/axum-0-8-type-safe-state-tower-service-guardrails?format=mdc","cursorrules":"/api/rules/axum-0-8-type-safe-state-tower-service-guardrails?format=cursor","windsurf":"/api/rules/axum-0-8-type-safe-state-tower-service-guardrails?format=windsurf","agents":"/api/rules/axum-0-8-type-safe-state-tower-service-guardrails?format=agents"}},{"id":"lexical-node-transforms-and-headless-serialization-guardrails","title":"Lexical Immutable Node Transforms, Selection Preservation, and Headless Serialization Invariants","category":"frontend","severity":"critical","description":"Enforces strict compliance with Meta Lexical's copy-on-write immutability, selection reconciliation invariants, and headless serialization execution contexts. Prevents infinite transform recursion, dirty state desynchronization, DOM selection collapse, and headless node registry mismatches.","antiPatternHeadline":"Mutating Lexical Nodes Directly, Unconditional Transform Recursion, and Unscoped Headless Serialization","stars_count":91,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","lexical","rich-text","markdown","headless-editor","typescript"],"exportEndpoints":{"claude":"/api/rules/lexical-node-transforms-and-headless-serialization-guardrails?format=claude","cursorMdc":"/api/rules/lexical-node-transforms-and-headless-serialization-guardrails?format=mdc","cursorrules":"/api/rules/lexical-node-transforms-and-headless-serialization-guardrails?format=cursor","windsurf":"/api/rules/lexical-node-transforms-and-headless-serialization-guardrails?format=windsurf","agents":"/api/rules/lexical-node-transforms-and-headless-serialization-guardrails?format=agents"}},{"id":"valkey-8-cluster-failover-threaded-io","title":"Valkey 8.0 Multi-Threaded I/O Hash Slot Integrity and Failover Invariants","category":"backend","severity":"critical","description":"Mandates strict hash-tag alignment for multi-key operations, atomic Lua key declarations, and proactive cluster topology reconciliation in Valkey 8.0. Prevents CROSSSLOT errors, pipeline corruption during node failovers, and latency degradation in multi-threaded I/O environments.","antiPatternHeadline":"Cross-Slot Key Access, Undeclared Dynamic Lua Keys, and Unhandled Cluster Failover Reconnection Storms","stars_count":53,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","valkey","redis","clustering","failover","caching","performance"],"exportEndpoints":{"claude":"/api/rules/valkey-8-cluster-failover-threaded-io?format=claude","cursorMdc":"/api/rules/valkey-8-cluster-failover-threaded-io?format=mdc","cursorrules":"/api/rules/valkey-8-cluster-failover-threaded-io?format=cursor","windsurf":"/api/rules/valkey-8-cluster-failover-threaded-io?format=windsurf","agents":"/api/rules/valkey-8-cluster-failover-threaded-io?format=agents"}},{"id":"tanstack-start-router-ssr-invariants","title":"TanStack Start & Router SSR: Type-Safe Search Params, Loaders, and Streaming Invariants","category":"frontend","severity":"critical","description":"Enforces strict type safety for search params via validation schemas, prohibits blocking SSR waterfalls by mandating deferred promise streaming for non-critical assets, and eliminates hydration mismatches in TanStack Start full-stack routes. Guarantees zero runtime search parameter divergence and deterministic server-side rendering execution.","antiPatternHeadline":"Unvalidated search params, blocking data waterfalls in SSR loaders, and raw client-side state reads during initial hydration.","stars_count":83,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","tanstack-start","tanstack-router","ssr","streaming","type-safety","react"],"exportEndpoints":{"claude":"/api/rules/tanstack-start-router-ssr-invariants?format=claude","cursorMdc":"/api/rules/tanstack-start-router-ssr-invariants?format=mdc","cursorrules":"/api/rules/tanstack-start-router-ssr-invariants?format=cursor","windsurf":"/api/rules/tanstack-start-router-ssr-invariants?format=windsurf","agents":"/api/rules/tanstack-start-router-ssr-invariants?format=agents"}},{"id":"lexical-headless-engine-transforms-and-reconciliation","title":"Lexical Headless Node Mutability, Transform Lifecycles, and Selection Invariants","category":"frontend","severity":"critical","description":"Enforces proper immutability semantics, node mutation lifecycles, and selection reconciliation within headless Lexical editor pipelines. Prohibits direct property mutation, external modifications outside editor.update closures, and unmanaged selection resets during headless markdown serialization and deserialization.","antiPatternHeadline":"Direct In-Place Node Property Mutation and Unmanaged Selection Collapse During Headless Transforms","stars_count":52,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","lexical","rich-text","editor","typescript","markdown","headless"],"exportEndpoints":{"claude":"/api/rules/lexical-headless-engine-transforms-and-reconciliation?format=claude","cursorMdc":"/api/rules/lexical-headless-engine-transforms-and-reconciliation?format=mdc","cursorrules":"/api/rules/lexical-headless-engine-transforms-and-reconciliation?format=cursor","windsurf":"/api/rules/lexical-headless-engine-transforms-and-reconciliation?format=windsurf","agents":"/api/rules/lexical-headless-engine-transforms-and-reconciliation?format=agents"}},{"id":"axum-state-extractor-tower-service-safety","title":"Axum 0.8 Type-Safe State Extraction & Tower Middleware Composition","category":"backend","severity":"critical","description":"Mandates compile-time type-safe state propagation via Axum 0.8 State extractors and FromRef sub-state delegation, forbidding untyped Extension injections. Enforces deterministic Tower ServiceBuilder middleware ordering with CatchPanicLayer boundaries to guarantee zero unhandled runtime panics and uniform error responses.","antiPatternHeadline":"Untyped runtime Extension extraction and unordered Tower middleware stacks causing MissingExtension panics and dropped HTTP connections.","stars_count":78,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["rust","axum","tower","backend","type-safety","concurrency"],"exportEndpoints":{"claude":"/api/rules/axum-state-extractor-tower-service-safety?format=claude","cursorMdc":"/api/rules/axum-state-extractor-tower-service-safety?format=mdc","cursorrules":"/api/rules/axum-state-extractor-tower-service-safety?format=cursor","windsurf":"/api/rules/axum-state-extractor-tower-service-safety?format=windsurf","agents":"/api/rules/axum-state-extractor-tower-service-safety?format=agents"}},{"id":"biome-vcs-suppression-deterministic-config","title":"Biome 1.9 Configuration Inheritance, VCS Integration, and Strict Deterministic Suppression","category":"frontend","severity":"critical","description":"Enforces strict Biome 1.9 configuration governance across monorepos and standalone repositories using schema pinning, declarative VCS ignore syncing, and deterministic rule suppression syntax. Mandates exact suppression target specifiers with required inline human rationales while forbidding legacy ESLint/Prettier annotations.","antiPatternHeadline":"Unexplained Global Lint Disables, Missing Git VCS Ignore Sync, and Legacy Linter Annotations","stars_count":49,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","biome","linter","formatter","tooling","typescript"],"exportEndpoints":{"claude":"/api/rules/biome-vcs-suppression-deterministic-config?format=claude","cursorMdc":"/api/rules/biome-vcs-suppression-deterministic-config?format=mdc","cursorrules":"/api/rules/biome-vcs-suppression-deterministic-config?format=cursor","windsurf":"/api/rules/biome-vcs-suppression-deterministic-config?format=windsurf","agents":"/api/rules/biome-vcs-suppression-deterministic-config?format=agents"}},{"id":"axum-0-8-state-extractors-tower-service-production-standard","title":"Axum 0.8 Type-Safe State Extraction, Tower Ordering, and Panic Boundaries","category":"backend","severity":"critical","description":"Enforces strict type safety for Axum 0.8 State extractors using FromRef, correct Tower ServiceBuilder layer sequencing, and mandatory CatchPanicLayer integration. Prevents compile-time state inference breakdowns, silent connection drops from unhandled panics, and state contamination across nested routers.","antiPatternHeadline":"Monolithic state cloning, inverted Tower layer ordering, and unhandled handler panics aborting TCP connections without HTTP 500 responses.","stars_count":89,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["rust","axum","tower","backend","concurrency","error-handling"],"exportEndpoints":{"claude":"/api/rules/axum-0-8-state-extractors-tower-service-production-standard?format=claude","cursorMdc":"/api/rules/axum-0-8-state-extractors-tower-service-production-standard?format=mdc","cursorrules":"/api/rules/axum-0-8-state-extractors-tower-service-production-standard?format=cursor","windsurf":"/api/rules/axum-0-8-state-extractors-tower-service-production-standard?format=windsurf","agents":"/api/rules/axum-0-8-state-extractors-tower-service-production-standard?format=agents"}},{"id":"rr7-hydration-single-fetch-typegen-standard","title":"React Router 7 Framework Mode: Hydration, ClientLoader Streaming, and Typegen Boundaries","category":"frontend","severity":"critical","description":"Enforces strict adherence to React Router 7 framework mode hydration invariants, including single-fetch data boundaries and typegen contracts. Prevents duplicate network waterfalls, turbo-stream hydration mismatches, and cache desynchronization caused by improper clientLoader hydration flags and decoupled types.","antiPatternHeadline":"Bypassing Route Module Typegen and Misconfiguring clientLoader.hydrate During Single-Fetch Streaming","stars_count":79,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-router-7","remix","hydration","single-fetch","typegen","streaming"],"exportEndpoints":{"claude":"/api/rules/rr7-hydration-single-fetch-typegen-standard?format=claude","cursorMdc":"/api/rules/rr7-hydration-single-fetch-typegen-standard?format=mdc","cursorrules":"/api/rules/rr7-hydration-single-fetch-typegen-standard?format=cursor","windsurf":"/api/rules/rr7-hydration-single-fetch-typegen-standard?format=windsurf","agents":"/api/rules/rr7-hydration-single-fetch-typegen-standard?format=agents"}},{"id":"tanstack-start-ssr-deferred-streaming-guardrail","title":"TanStack Start & Router SSR: Type-Safe Search Params & Deferred Data Streaming Invariants","category":"frontend","severity":"critical","description":"Enforces strict type safety and streaming invariants in TanStack Start and Fullstack TanStack Router. Mandates deterministic search parameter validation via schema adapters, prevents TTFB degradation by requiring non-critical loader data to be deferred via defer() and wrapped in Suspense/Await, and prohibits untyped client-side location parsing during SSR hydration.","antiPatternHeadline":"Blocking Critical Path TTFB with Un-deferred Async Loaders and Untyped Search Param Extraction","stars_count":113,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","tanstack-start","tanstack-router","ssr","search-params","streaming","performance"],"exportEndpoints":{"claude":"/api/rules/tanstack-start-ssr-deferred-streaming-guardrail?format=claude","cursorMdc":"/api/rules/tanstack-start-ssr-deferred-streaming-guardrail?format=mdc","cursorrules":"/api/rules/tanstack-start-ssr-deferred-streaming-guardrail?format=cursor","windsurf":"/api/rules/tanstack-start-ssr-deferred-streaming-guardrail?format=windsurf","agents":"/api/rules/tanstack-start-ssr-deferred-streaming-guardrail?format=agents"}},{"id":"biome-1-9-inheritance-vcs-suppression-standard","title":"Deterministic Configuration Inheritance, VCS Synchronization, and Rule Suppression in Biome 1.9","category":"frontend","severity":"critical","description":"Mandates explicit Biome 1.9 configuration architecture across monorepos using deterministic extends chains, guarantees file discovery synchronization via native VCS integration (vcs.useIgnoreFile), and enforces auditable, fully-qualified suppression comments with required explanations. Eliminates monorepo configuration drift, duplicate ignore matrices, and silent lint bypasses.","antiPatternHeadline":"Unanchored Ignore Lists, Legacy ESLint Directives, and Reason-Free Suppressions","stars_count":72,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","biome","tooling","linter","formatter","monorepo"],"exportEndpoints":{"claude":"/api/rules/biome-1-9-inheritance-vcs-suppression-standard?format=claude","cursorMdc":"/api/rules/biome-1-9-inheritance-vcs-suppression-standard?format=mdc","cursorrules":"/api/rules/biome-1-9-inheritance-vcs-suppression-standard?format=cursor","windsurf":"/api/rules/biome-1-9-inheritance-vcs-suppression-standard?format=windsurf","agents":"/api/rules/biome-1-9-inheritance-vcs-suppression-standard?format=agents"}},{"id":"valkey-8-threaded-io-cluster-failover-production-standard","title":"Valkey 8.0 Threaded I/O, Cluster Slot Pinning, and Failover Resilience","category":"backend","severity":"critical","description":"Valkey 8.0 scales network ingestion via threaded I/O while preserving single-threaded execution for commands and Lua scripts. Multi-key operations and script invocations across clustered nodes must strictly pin keys to identical slots via explicit hash tags, avoid blocking the main event loop, and configure client-side topology updates to gracefully handle MOVED/ASK redirects and automated master failovers without connection dropping or transaction corruption.","antiPatternHeadline":"Executing Cross-Slot Multi-Key Lua Scripts and Naive Client Topologies During Failover","stars_count":47,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","valkey","redis","clustering","distributed-systems","high-performance"],"exportEndpoints":{"claude":"/api/rules/valkey-8-threaded-io-cluster-failover-production-standard?format=claude","cursorMdc":"/api/rules/valkey-8-threaded-io-cluster-failover-production-standard?format=mdc","cursorrules":"/api/rules/valkey-8-threaded-io-cluster-failover-production-standard?format=cursor","windsurf":"/api/rules/valkey-8-threaded-io-cluster-failover-production-standard?format=windsurf","agents":"/api/rules/valkey-8-threaded-io-cluster-failover-production-standard?format=agents"}},{"id":"rust-axum-state-tower-resilience-guardrail","title":"Axum 0.8 Type-Safe State Subtyping & Tower Panic-Resilient Middleware Composition","category":"backend","severity":"critical","description":"Enforces Axum 0.8 compile-time type-safe state sharing using FromRef sub-states instead of dynamic Extensions, alongside resilient Tower middleware stacks. Mandates CatchPanicLayer boundary encapsulation, deterministic middleware execution ordering, and total elimination of unhandled extractor panics through explicit IntoResponse rejection handling.","antiPatternHeadline":"Relying on dynamic Extension extraction for shared state and omitting CatchPanicLayer or FromRef sub-state delegation in Axum routers","stars_count":84,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tower","middleware","concurrency"],"exportEndpoints":{"claude":"/api/rules/rust-axum-state-tower-resilience-guardrail?format=claude","cursorMdc":"/api/rules/rust-axum-state-tower-resilience-guardrail?format=mdc","cursorrules":"/api/rules/rust-axum-state-tower-resilience-guardrail?format=cursor","windsurf":"/api/rules/rust-axum-state-tower-resilience-guardrail?format=windsurf","agents":"/api/rules/rust-axum-state-tower-resilience-guardrail?format=agents"}},{"id":"axum-08-state-tower-panic-resilience-guardrail","title":"Axum 0.8 Type-Safe State Extractors & Tower Service Composition Guardrail","category":"backend","severity":"critical","description":"Enforces strict type safety and compile-time validation for State extractors alongside modular sub-state derivation using FromRef in Axum 0.8. Mandates explicit CatchPanic layers, proper Tower service layer ordering, and zero unhandled rejections to prevent silent connection termination or service starvation under panic conditions.","antiPatternHeadline":"Untyped Extensions, Missing FromRef Sub-state Derivation, and CatchPanic-less Tower Stacks","stars_count":113,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tower","state-management","error-handling"],"exportEndpoints":{"claude":"/api/rules/axum-08-state-tower-panic-resilience-guardrail?format=claude","cursorMdc":"/api/rules/axum-08-state-tower-panic-resilience-guardrail?format=mdc","cursorrules":"/api/rules/axum-08-state-tower-panic-resilience-guardrail?format=cursor","windsurf":"/api/rules/axum-08-state-tower-panic-resilience-guardrail?format=windsurf","agents":"/api/rules/axum-08-state-tower-panic-resilience-guardrail?format=agents"}},{"id":"biome-1-9-vcs-inheritance-suppression-guardrails","title":"Biome 1.9 Invariants: Configuration Inheritance, VCS Sync, and Deterministic Suppressions","category":"frontend","severity":"critical","description":"Enforces deterministic linting and formatting invariants for Biome 1.9 across monorepos and frontend packages. Requires explicit VCS integration with Git ignore parity, validated configuration inheritance graphs, and strictly reasoned inline suppression syntax adhering to the 'biome-ignore <category>/<rule>: <rationale>' standard.","antiPatternHeadline":"Unchecked artifact parsing from unlinked VCS ignores and unstructured, unreasoned inline suppressions.","stars_count":69,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","biome","biomejs","linter","formatter","monorepo","tooling"],"exportEndpoints":{"claude":"/api/rules/biome-1-9-vcs-inheritance-suppression-guardrails?format=claude","cursorMdc":"/api/rules/biome-1-9-vcs-inheritance-suppression-guardrails?format=mdc","cursorrules":"/api/rules/biome-1-9-vcs-inheritance-suppression-guardrails?format=cursor","windsurf":"/api/rules/biome-1-9-vcs-inheritance-suppression-guardrails?format=windsurf","agents":"/api/rules/biome-1-9-vcs-inheritance-suppression-guardrails?format=agents"}},{"id":"bun-sqlite-wal-s3-streaming","title":"Bun 1.2 SQLite WAL Concurrency and Native S3 Zero-Copy Streaming","category":"backend","severity":"critical","description":"Enforces high-throughput, low-latency data patterns in Bun 1.2 by configuring SQLite with Write-Ahead Logging (WAL) and proper busy timeouts, alongside native Bun S3 streaming primitives. Prevents connection starvation, SQLITE_BUSY deadlocks, and excessive heap memory allocation from in-memory stream buffering.","antiPatternHeadline":"Ad-Hoc Unprepared SQLite Queries with Default Rollback Journals and In-Memory S3 Buffering","stars_count":91,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","sqlite","s3","wal","performance"],"exportEndpoints":{"claude":"/api/rules/bun-sqlite-wal-s3-streaming?format=claude","cursorMdc":"/api/rules/bun-sqlite-wal-s3-streaming?format=mdc","cursorrules":"/api/rules/bun-sqlite-wal-s3-streaming?format=cursor","windsurf":"/api/rules/bun-sqlite-wal-s3-streaming?format=windsurf","agents":"/api/rules/bun-sqlite-wal-s3-streaming?format=agents"}},{"id":"tanstack-start-router-ssr-streaming-guardrails","title":"TanStack Start SSR Loaders, Type-Safe Search Params & Deferred Streaming","category":"frontend","severity":"critical","description":"Mandates runtime-validated search parameters via validateSearch, non-blocking SSR streaming via defer() for slow promises, and strict separation between critical SEO state and deferred client payloads. Prevents SSR waterfall bottlenecks, hydration mismatches, and untyped query injection in TanStack Start applications.","antiPatternHeadline":"Blocking Initial SSR Streams with Un-deferred Promises and Unvalidated Query Parameters","stars_count":70,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","tanstack-start","tanstack-router","ssr","streaming","type-safety","search-params"],"exportEndpoints":{"claude":"/api/rules/tanstack-start-router-ssr-streaming-guardrails?format=claude","cursorMdc":"/api/rules/tanstack-start-router-ssr-streaming-guardrails?format=mdc","cursorrules":"/api/rules/tanstack-start-router-ssr-streaming-guardrails?format=cursor","windsurf":"/api/rules/tanstack-start-router-ssr-streaming-guardrails?format=windsurf","agents":"/api/rules/tanstack-start-router-ssr-streaming-guardrails?format=agents"}},{"id":"valkey-threaded-io-cluster-failover-invariant","title":"Valkey 8.0 Threaded I/O Slot Hash-Tagging and Failover Invariants","category":"backend","severity":"critical","description":"Enforces strict hash-tag slot alignment for multi-key operations and atomic Lua scripts in Valkey 8.0 cluster mode. Prevents CROSSSLOT errors, main-thread starvation under threaded I/O, and connection drops during unhandled MOVED/ASK failover redirects.","antiPatternHeadline":"Executing un-hashed cross-slot Lua scripts and failing to handle cluster slot topology refreshes during failovers","stars_count":69,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","valkey","clustering","lua","distributed-systems","caching"],"exportEndpoints":{"claude":"/api/rules/valkey-threaded-io-cluster-failover-invariant?format=claude","cursorMdc":"/api/rules/valkey-threaded-io-cluster-failover-invariant?format=mdc","cursorrules":"/api/rules/valkey-threaded-io-cluster-failover-invariant?format=cursor","windsurf":"/api/rules/valkey-threaded-io-cluster-failover-invariant?format=windsurf","agents":"/api/rules/valkey-threaded-io-cluster-failover-invariant?format=agents"}},{"id":"rust-axum-08-state-tower-guardrail","title":"Axum 0.8 Strict Type-Safe State Extraction and Tower Middleware Invariants","category":"backend","severity":"critical","description":"Mandates compile-time verified dependency injection via Axum 0.8 State extractors with FromRef modular sub-state derivation. Enforces deterministic Tower Service layer ordering with CatchPanicLayer at the perimeter to guarantee zero unhandled runtime panic drops.","antiPatternHeadline":"Untyped Extension Passing, Missing FromRef Decompositions, and Unhandled Panic Connection Drops","stars_count":94,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["rust","axum","tower","middleware","type-safety","backend"],"exportEndpoints":{"claude":"/api/rules/rust-axum-08-state-tower-guardrail?format=claude","cursorMdc":"/api/rules/rust-axum-08-state-tower-guardrail?format=mdc","cursorrules":"/api/rules/rust-axum-08-state-tower-guardrail?format=cursor","windsurf":"/api/rules/rust-axum-08-state-tower-guardrail?format=windsurf","agents":"/api/rules/rust-axum-08-state-tower-guardrail?format=agents"}},{"id":"axum-08-state-extractors-tower-service","title":"Axum 0.8 Type-Safe State Extractors & Resilient Tower Middleware Ordering","category":"backend","severity":"critical","description":"Enforces strict Axum 0.8 compile-time state derivation through FromRef sub-states and infallible Tower middleware topologies. Prevents runtime extractor panics from legacy Extension<T> patterns and guarantees unhandled panic isolation via structured CatchPanicLayer ordering.","antiPatternHeadline":"Monolithic State Coupling and Inverted Tower Middleware Causing Extractor Mismatches and Panic Leaks","stars_count":85,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tower","middleware","concurrency"],"exportEndpoints":{"claude":"/api/rules/axum-08-state-extractors-tower-service?format=claude","cursorMdc":"/api/rules/axum-08-state-extractors-tower-service?format=mdc","cursorrules":"/api/rules/axum-08-state-extractors-tower-service?format=cursor","windsurf":"/api/rules/axum-08-state-extractors-tower-service?format=windsurf","agents":"/api/rules/axum-08-state-extractors-tower-service?format=agents"}},{"id":"chromadb-06-hnsw-embedding-filtering","title":"ChromaDB 0.6+ Multi-Tenant Partitioning, HNSW Tuning, and Structured Metadata Filtering","category":"backend","severity":"critical","description":"Enforces strict tenant isolation, optimal HNSW index construction parameters, and pre-filter query planning for ChromaDB 0.6+. Prevents post-query filter starvation, catastrophic memory exhaustion in monolithic collections, and tenant data leakage across shared vector spaces.","antiPatternHeadline":"Monolithic Multi-Tenant Collections with Unbounded Post-Query Metadata Filtering and Default HNSW Graph Topologies","stars_count":90,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","chromadb","hnsw","vector-databases","multitenancy","performance"],"exportEndpoints":{"claude":"/api/rules/chromadb-06-hnsw-embedding-filtering?format=claude","cursorMdc":"/api/rules/chromadb-06-hnsw-embedding-filtering?format=mdc","cursorrules":"/api/rules/chromadb-06-hnsw-embedding-filtering?format=cursor","windsurf":"/api/rules/chromadb-06-hnsw-embedding-filtering?format=windsurf","agents":"/api/rules/chromadb-06-hnsw-embedding-filtering?format=agents"}},{"id":"biome-1-9-monorepo-vcs-suppression-standard","title":"Biome 1.9 Configuration Inheritance, VCS Integration, and Suppression Governance","category":"frontend","severity":"critical","description":"Enforces strict configuration inheritance, Git-aware VCS boundary enforcement, and deterministic suppression syntax using Biome 1.9+. Prevents lint regressions across monorepos, invalid suppression comments, and untracked code formatting drifts by enforcing exact schema pinning and mandatory explanation keys in lint suppressions.","antiPatternHeadline":"Unpinned Biome Configurations, Missing VCS Boundaries, and Undocumented Global Comment Suppressions","stars_count":45,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","biome","linter","formatter","monorepo","vcs"],"exportEndpoints":{"claude":"/api/rules/biome-1-9-monorepo-vcs-suppression-standard?format=claude","cursorMdc":"/api/rules/biome-1-9-monorepo-vcs-suppression-standard?format=mdc","cursorrules":"/api/rules/biome-1-9-monorepo-vcs-suppression-standard?format=cursor","windsurf":"/api/rules/biome-1-9-monorepo-vcs-suppression-standard?format=windsurf","agents":"/api/rules/biome-1-9-monorepo-vcs-suppression-standard?format=agents"}},{"id":"react-router-v7-hydration-typegen-guardrail","title":"React Router 7 Framework Mode Hydration, Typegen & Data Boundary Invariants","category":"frontend","severity":"critical","description":"Enforces strict type safety and hydration boundaries in React Router 7 framework mode with Single Fetch enabled. Mandates the use of generated Route types from `./+types/*`, prohibits unawaited clientLoader overrides that break server-to-client streaming, and prevents hydration mismatches caused by leaking server-exclusive Single Fetch primitives into client bundles.","antiPatternHeadline":"Bypassing Route Typegen, Misconfiguring clientLoader.hydrate, and Breaking Single Fetch Stream Serialization","stars_count":97,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-router-7","remix","single-fetch","hydration","typegen"],"exportEndpoints":{"claude":"/api/rules/react-router-v7-hydration-typegen-guardrail?format=claude","cursorMdc":"/api/rules/react-router-v7-hydration-typegen-guardrail?format=mdc","cursorrules":"/api/rules/react-router-v7-hydration-typegen-guardrail?format=cursor","windsurf":"/api/rules/react-router-v7-hydration-typegen-guardrail?format=windsurf","agents":"/api/rules/react-router-v7-hydration-typegen-guardrail?format=agents"}},{"id":"svelte-5-runes-reactivity-snippets-invariant","title":"Svelte 5 Runes Reactivity, State Proxies, and Snippets Architecture","category":"frontend","severity":"critical","description":"Enforces proper utilization of Svelte 5 runes ($state, $derived, $effect, $props) and Snippets, preventing legacy Svelte 3/4 reactivity leaks. Guarantees signals and proxy integrity by prohibiting side-effect-driven state synchronization, proxy destructuring pitfalls, and obsolete slot mechanisms.","antiPatternHeadline":"Mutating State in Effects, Destructuring Proxy State, and Retaining Svelte 3/4 Legacy Patterns","stars_count":44,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte","svelte-5","runes","state-management","typescript"],"exportEndpoints":{"claude":"/api/rules/svelte-5-runes-reactivity-snippets-invariant?format=claude","cursorMdc":"/api/rules/svelte-5-runes-reactivity-snippets-invariant?format=mdc","cursorrules":"/api/rules/svelte-5-runes-reactivity-snippets-invariant?format=cursor","windsurf":"/api/rules/svelte-5-runes-reactivity-snippets-invariant?format=windsurf","agents":"/api/rules/svelte-5-runes-reactivity-snippets-invariant?format=agents"}},{"id":"biome-vcs-inheritance-deterministic-suppression-standard","title":"Biome 1.9 Configuration Inheritance, VCS Integration, and Strict Rule Suppression Standard","category":"frontend","severity":"critical","description":"Enforces deterministic formatting and linting architecture via Biome 1.9 single-binary tooling across enterprise monorepos. Mandates standardized VCS ignore synchronization, centralized configuration inheritance, and fully qualified, documented suppression comments. Eliminates configuration drift, unignored build artifact pollution, and undocumented lint bypasses in CI/CD pipelines.","antiPatternHeadline":"Ad-hoc ESLint-style suppressions, detached .gitignore parsing, and fragmented monorepo Biome configurations.","stars_count":101,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","biome","linter","formatter","monorepo","typescript"],"exportEndpoints":{"claude":"/api/rules/biome-vcs-inheritance-deterministic-suppression-standard?format=claude","cursorMdc":"/api/rules/biome-vcs-inheritance-deterministic-suppression-standard?format=mdc","cursorrules":"/api/rules/biome-vcs-inheritance-deterministic-suppression-standard?format=cursor","windsurf":"/api/rules/biome-vcs-inheritance-deterministic-suppression-standard?format=windsurf","agents":"/api/rules/biome-vcs-inheritance-deterministic-suppression-standard?format=agents"}},{"id":"lexical-node-transforms-and-reconciliation","title":"Lexical Immutable Node Transforms, Selection Reconciliation, and Headless Serialization","category":"frontend","severity":"critical","description":"Enforces strict immutability invariants, non-recursive node transforms, and deterministic selection restoration within Lexical document engines. Mandates explicit writable cloning via $getNodeByKey and getWritable() during editor updates and guarantees headless serialization pipelines initialize comprehensive node registries within isolated read closures.","antiPatternHeadline":"Mutating read-only Lexical nodes directly or triggering cascading transform loops with lost selection anchors during headless document processing.","stars_count":62,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","lexical","rich-text","headless","markdown","state-management"],"exportEndpoints":{"claude":"/api/rules/lexical-node-transforms-and-reconciliation?format=claude","cursorMdc":"/api/rules/lexical-node-transforms-and-reconciliation?format=mdc","cursorrules":"/api/rules/lexical-node-transforms-and-reconciliation?format=cursor","windsurf":"/api/rules/lexical-node-transforms-and-reconciliation?format=windsurf","agents":"/api/rules/lexical-node-transforms-and-reconciliation?format=agents"}},{"id":"rust-axum-08-state-tower-resilience-guardrail","title":"Axum 0.8 Safe State Extraction, Strict Middleware Sequencing, and Zero-Panic Invariants","category":"backend","severity":"critical","description":"Enforces compile-time type-safe state injection via Axum 0.8 FromRef sub-states, guarantees that consume-body extractors are placed strictly last in handler signatures, and mandates a standardized Tower ServiceBuilder stack equipped with CatchPanicLayer and explicit timeout handling to eliminate uncaught unwinds and dropped HTTP connections.","antiPatternHeadline":"Untyped runtime extensions, misordered consuming extractors, and missing Tower CatchPanicLayer causing silent connection termination.","stars_count":91,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["rust","axum","tower","backend","type-safety","resilience"],"exportEndpoints":{"claude":"/api/rules/rust-axum-08-state-tower-resilience-guardrail?format=claude","cursorMdc":"/api/rules/rust-axum-08-state-tower-resilience-guardrail?format=mdc","cursorrules":"/api/rules/rust-axum-08-state-tower-resilience-guardrail?format=cursor","windsurf":"/api/rules/rust-axum-08-state-tower-resilience-guardrail?format=windsurf","agents":"/api/rules/rust-axum-08-state-tower-resilience-guardrail?format=agents"}},{"id":"react-router-7-framework-hydration-boundaries","title":"React Router 7 Framework Hydration, Single Fetch, and Route Typegen Invariants","category":"frontend","severity":"critical","description":"Enforces architectural boundaries for React Router 7 Framework Mode, specifically governing single-fetch serialization, clientLoader hydration orchestration, and strict route module typegen consumption. Prevents double-fetching cascades, turbo-stream hydration mismatches, and broken client-side streaming topologies.","antiPatternHeadline":"Bypassing Route Typegen, Misusing clientLoader.hydrate Without serverLoader(), or Returning Legacy json()/defer() Under Single-Fetch","stars_count":51,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["react-router-7","remix","hydration","streaming","single-fetch","typegen","typescript"],"exportEndpoints":{"claude":"/api/rules/react-router-7-framework-hydration-boundaries?format=claude","cursorMdc":"/api/rules/react-router-7-framework-hydration-boundaries?format=mdc","cursorrules":"/api/rules/react-router-7-framework-hydration-boundaries?format=cursor","windsurf":"/api/rules/react-router-7-framework-hydration-boundaries?format=windsurf","agents":"/api/rules/react-router-7-framework-hydration-boundaries?format=agents"}},{"id":"tanstack-virtual-v3-windowing-performance-guardrails","title":"TanStack Virtual 3.0 Dynamic Measurement, Key Containment, and DOM Saturation Defense","category":"frontend","severity":"critical","description":"Mandates strict performance invariants for TanStack Virtual 3.0 in massive datasets and tables. Enforces stable key identification, sub-pixel composite transforms over layout-thrashing positioning, explicit dynamic element measurement contracts via data-index, and rigid bounds on overscan to prevent DOM node saturation and ResizeObserver loop limit exhaustion.","antiPatternHeadline":"Index-keyed dynamic row virtualization without data-index measurement contracts, unbounded overscan, and layout-thrashing top-offset positioning.","stars_count":71,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","tanstack-virtual","react","virtualization","performance","dom-optimization"],"exportEndpoints":{"claude":"/api/rules/tanstack-virtual-v3-windowing-performance-guardrails?format=claude","cursorMdc":"/api/rules/tanstack-virtual-v3-windowing-performance-guardrails?format=mdc","cursorrules":"/api/rules/tanstack-virtual-v3-windowing-performance-guardrails?format=cursor","windsurf":"/api/rules/tanstack-virtual-v3-windowing-performance-guardrails?format=windsurf","agents":"/api/rules/tanstack-virtual-v3-windowing-performance-guardrails?format=agents"}},{"id":"biome-v1-9-config-vcs-suppression-guardrail","title":"Biome 1.9 Configuration Inheritance, VCS Integration, and Suppression Guardrail","category":"frontend","severity":"critical","description":"Enforces strict configuration architecture for Biome v1.9+ across monorepos and standalone repositories. Prevents configuration drift by mandating deterministic extends arrays, strict git-backed VCS integration to respect ignore files, and exact inline suppression comment formatting with mandatory rationales.","antiPatternHeadline":"Unpinned Config Inheritance, Unlinked VCS Ignores, and Naked Inline Suppressions","stars_count":72,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","biome","linter","formatter","vcs","code-quality"],"exportEndpoints":{"claude":"/api/rules/biome-v1-9-config-vcs-suppression-guardrail?format=claude","cursorMdc":"/api/rules/biome-v1-9-config-vcs-suppression-guardrail?format=mdc","cursorrules":"/api/rules/biome-v1-9-config-vcs-suppression-guardrail?format=cursor","windsurf":"/api/rules/biome-v1-9-config-vcs-suppression-guardrail?format=windsurf","agents":"/api/rules/biome-v1-9-config-vcs-suppression-guardrail?format=agents"}},{"id":"valkey-8-cluster-io-atomicity-guardrail","title":"Valkey 8.0 Threaded I/O, Slot Redirect Handling, and Hash-Tagged Lua Atomicity","category":"backend","severity":"critical","description":"Enforces strict architectural invariants for Valkey 8.0 cluster topologies, preventing CROSSSLOT errors, main-thread event loop starvation under threaded I/O, and unhandled MOVED/ASK redirects during cluster node failovers. Mandates explicit curly brace hash tagging on all multi-key operations and atomic scripts, accompanied by topology-aware cluster client configurations.","antiPatternHeadline":"Executing Multi-Key Lua Scripts Without Hash Tags and Relying on Non-Cluster Clients During Failovers","stars_count":116,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","valkey","cluster","distributed-systems","caching","redis"],"exportEndpoints":{"claude":"/api/rules/valkey-8-cluster-io-atomicity-guardrail?format=claude","cursorMdc":"/api/rules/valkey-8-cluster-io-atomicity-guardrail?format=mdc","cursorrules":"/api/rules/valkey-8-cluster-io-atomicity-guardrail?format=cursor","windsurf":"/api/rules/valkey-8-cluster-io-atomicity-guardrail?format=windsurf","agents":"/api/rules/valkey-8-cluster-io-atomicity-guardrail?format=agents"}},{"id":"tanstack-start-ssr-streaming-search-validation","title":"Mandatory Type-Safe Search Validation, Non-Blocking SSR Loaders, and Deferred Streaming in TanStack Start","category":"frontend","severity":"critical","description":"Enforces strict type safety and streaming invariants across TanStack Start routes. Every route consuming URL search parameters must declare a runtime-validated schema via validateSearch, and loaders must partition critical SSR data from non-critical promises using defer() paired with Suspense boundaries to protect server TTFB and prevent hydration mismatches.","antiPatternHeadline":"Blocking Server Render Streams with Synchronous Loader Awaits and Untyped Query Parsing","stars_count":95,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","tanstack-router","tanstack-start","ssr","data-loading","zod","streaming"],"exportEndpoints":{"claude":"/api/rules/tanstack-start-ssr-streaming-search-validation?format=claude","cursorMdc":"/api/rules/tanstack-start-ssr-streaming-search-validation?format=mdc","cursorrules":"/api/rules/tanstack-start-ssr-streaming-search-validation?format=cursor","windsurf":"/api/rules/tanstack-start-ssr-streaming-search-validation?format=windsurf","agents":"/api/rules/tanstack-start-ssr-streaming-search-validation?format=agents"}},{"id":"tanstack-virtual-v3-performance-containment","title":"TanStack Virtual 3.0 Dynamic Windowing & Scroll Containment Standard","category":"frontend","severity":"critical","description":"Enforces strict DOM node containment, element measurement caching, and continuous scroll margin preservation for massive data grids using TanStack Virtual v3. Prevents layout thrashing, DOM node saturation, and measurement jitter during high-velocity scrolling by requiring deterministic item keys, CSS contain properties, and explicit scroll margin offsets. Mandates hardware-accelerated transform positioning over direct offset mutations.","antiPatternHeadline":"Uncached dynamic element re-measurements causing layout thrashing and DOM node explosion in continuous virtualization containers","stars_count":51,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","tanstack-virtual","performance","react","windowing","virtualization"],"exportEndpoints":{"claude":"/api/rules/tanstack-virtual-v3-performance-containment?format=claude","cursorMdc":"/api/rules/tanstack-virtual-v3-performance-containment?format=mdc","cursorrules":"/api/rules/tanstack-virtual-v3-performance-containment?format=cursor","windsurf":"/api/rules/tanstack-virtual-v3-performance-containment?format=windsurf","agents":"/api/rules/tanstack-virtual-v3-performance-containment?format=agents"}},{"id":"lexical-node-transforms-selection-serialization-standard","title":"Lexical Headless Engine: Immutable Node Transforms, Selection Invariants, and Markdown Serialization","category":"frontend","severity":"critical","description":"Lexical relies on an immutable double-buffered AST where node mutations require an active EditorState transaction via getWritable(). Violating node immutability, bypassing selection reconciliation after structural AST mutations, or executing headless Markdown serialization without registered node transformers triggers silent state desynchronization, infinite transform loops, and collapsed cursor bugs in headless and browser environments.","antiPatternHeadline":"Mutating Lexical AST Nodes Directly Outside getWritable() and Invoking Unsafe Headless Serialization Without Selection Restoration","stars_count":61,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","lexical","rich-text","ast-transforms","markdown-serialization","selection-reconciliation"],"exportEndpoints":{"claude":"/api/rules/lexical-node-transforms-selection-serialization-standard?format=claude","cursorMdc":"/api/rules/lexical-node-transforms-selection-serialization-standard?format=mdc","cursorrules":"/api/rules/lexical-node-transforms-selection-serialization-standard?format=cursor","windsurf":"/api/rules/lexical-node-transforms-selection-serialization-standard?format=windsurf","agents":"/api/rules/lexical-node-transforms-selection-serialization-standard?format=agents"}},{"id":"lexical-immutable-node-transforms-and-headless-markdown","title":"Lexical Immutable Node Transforms, Selection Reconciliation & Headless Serialization","category":"frontend","severity":"critical","description":"Enforces strict Lexical AST immutability invariants via this.getWritable() inside active update batches, prevents selection reconciliation collapse across asynchronous boundaries, and standardizes headless server-side markdown parsing and serialization without DOM leakages.","antiPatternHeadline":"Direct Node Property Mutation and Asynchronous Selection Leakage in Headless Pipelines","stars_count":88,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","lexical","rich-text","markdown","headless","ast"],"exportEndpoints":{"claude":"/api/rules/lexical-immutable-node-transforms-and-headless-markdown?format=claude","cursorMdc":"/api/rules/lexical-immutable-node-transforms-and-headless-markdown?format=mdc","cursorrules":"/api/rules/lexical-immutable-node-transforms-and-headless-markdown?format=cursor","windsurf":"/api/rules/lexical-immutable-node-transforms-and-headless-markdown?format=windsurf","agents":"/api/rules/lexical-immutable-node-transforms-and-headless-markdown?format=agents"}},{"id":"tanstack-start-ssr-loader-streaming-guardrail","title":"TanStack Start SSR Loaders, Type-Safe Search Params, and Deferred Streaming Standard","category":"frontend","severity":"critical","description":"Enforces strict type-safe search parameter validation using schema validators, mandates clear separation between critical render-blocking data and deferred streaming promises in SSR loaders, and isolates server operations via createServerFn. This prevents hydration mismatches, client-bundle server secret leaks, and severe TTFB degradation during server-side rendering.","antiPatternHeadline":"Blocking SSR pipelines with un-deferred waterfalls, unvalidated raw URL queries, and client-leaked server data fetching.","stars_count":108,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","tanstack-start","tanstack-router","ssr","streaming","zod"],"exportEndpoints":{"claude":"/api/rules/tanstack-start-ssr-loader-streaming-guardrail?format=claude","cursorMdc":"/api/rules/tanstack-start-ssr-loader-streaming-guardrail?format=mdc","cursorrules":"/api/rules/tanstack-start-ssr-loader-streaming-guardrail?format=cursor","windsurf":"/api/rules/tanstack-start-ssr-loader-streaming-guardrail?format=windsurf","agents":"/api/rules/tanstack-start-ssr-loader-streaming-guardrail?format=agents"}},{"id":"lexical-headless-transforms-and-selection-invariants","title":"Lexical Immutable Transforms, Selection Reconciliation & Headless Markdown Invariants","category":"frontend","severity":"critical","description":"Enforces strict immutability protocols, transform loop prevention, and selection-preserving node reconciliations across Lexical editor implementations. Guarantees deterministic serialization between headless server environments and interactive browser client states without DOM leakage or reconciliation crashes.","antiPatternHeadline":"Mutating Frozen Nodes Outside Writable Clones, Triggering Transform Feedback Loops, and Leaking DOM APIs into Headless Pipelines","stars_count":98,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","lexical","rich-text","editor-state","headless-cms","typescript"],"exportEndpoints":{"claude":"/api/rules/lexical-headless-transforms-and-selection-invariants?format=claude","cursorMdc":"/api/rules/lexical-headless-transforms-and-selection-invariants?format=mdc","cursorrules":"/api/rules/lexical-headless-transforms-and-selection-invariants?format=cursor","windsurf":"/api/rules/lexical-headless-transforms-and-selection-invariants?format=windsurf","agents":"/api/rules/lexical-headless-transforms-and-selection-invariants?format=agents"}},{"id":"rust-axum-08-state-tower-service-guardrail","title":"Rust Axum 0.8 Type-Safe State Extractors & Tower Service Invariants","category":"backend","severity":"critical","description":"Enforces type-safe state propagation using Axum 0.8 sub-states via axum::extract::FromRef, deterministic Tower ServiceBuilder middleware sequencing, and panic-resilient request pipelines with zero unhandled extractor rejections.","antiPatternHeadline":"Monolithic Untyped State Injection and Inverse Tower Middleware Stacking Causing Unhandled Panics and Compile Failure","stars_count":112,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tower","tokio","type-safety"],"exportEndpoints":{"claude":"/api/rules/rust-axum-08-state-tower-service-guardrail?format=claude","cursorMdc":"/api/rules/rust-axum-08-state-tower-service-guardrail?format=mdc","cursorrules":"/api/rules/rust-axum-08-state-tower-service-guardrail?format=cursor","windsurf":"/api/rules/rust-axum-08-state-tower-service-guardrail?format=windsurf","agents":"/api/rules/rust-axum-08-state-tower-service-guardrail?format=agents"}},{"id":"chromadb-0-6-hnsw-metadata-filtering-tenancy","title":"ChromaDB 0.6 HNSW Metadata Filtering and Multi-Tenant Isolation Standard","category":"backend","severity":"critical","description":"Enforces deterministic multi-tenant isolation, HNSW index parameter calibration, and structured boolean metadata filtering in ChromaDB 0.6+. Prevents catastrophic recall collapse resulting from sparse in-graph metadata filtering on monolithic vector collections and eliminates cross-tenant data leakage risks.","antiPatternHeadline":"Sparse In-Graph Metadata Post-Filtering on Monolithic Collections Causing HNSW Recall Collapse and Tenant Bleed","stars_count":80,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","chromadb","hnsw","vector-search","multi-tenancy","embeddings"],"exportEndpoints":{"claude":"/api/rules/chromadb-0-6-hnsw-metadata-filtering-tenancy?format=claude","cursorMdc":"/api/rules/chromadb-0-6-hnsw-metadata-filtering-tenancy?format=mdc","cursorrules":"/api/rules/chromadb-0-6-hnsw-metadata-filtering-tenancy?format=cursor","windsurf":"/api/rules/chromadb-0-6-hnsw-metadata-filtering-tenancy?format=windsurf","agents":"/api/rules/chromadb-0-6-hnsw-metadata-filtering-tenancy?format=agents"}},{"id":"lexical-node-transforms-and-headless-markdown-serialization","title":"Lexical Immutable Transforms, Selection Reconciliation, and Headless Markdown Serialization","category":"frontend","severity":"critical","description":"Enforces strict immutability semantics, correct node writable lifecycles, and headless selection-safe transforms within Meta Lexical. Prohibits out-of-context node mutations, infinite transform cascades, and DOM-dependent markdown serialization during headless or server-side workflows.","antiPatternHeadline":"Mutating Unwritable Lexical Nodes and Invoking DOM-Dependent Markdown Exporters in Headless Runtime Loops","stars_count":48,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","lexical","rich-text","markdown","serialization","headless","state-management"],"exportEndpoints":{"claude":"/api/rules/lexical-node-transforms-and-headless-markdown-serialization?format=claude","cursorMdc":"/api/rules/lexical-node-transforms-and-headless-markdown-serialization?format=mdc","cursorrules":"/api/rules/lexical-node-transforms-and-headless-markdown-serialization?format=cursor","windsurf":"/api/rules/lexical-node-transforms-and-headless-markdown-serialization?format=windsurf","agents":"/api/rules/lexical-node-transforms-and-headless-markdown-serialization?format=agents"}},{"id":"valkey-8-cluster-threaded-io-resilience","title":"Valkey 8.0 Cluster Slot Pinning, Lua Hash-Tagging, and Failover Resiliency","category":"backend","severity":"critical","description":"Mandates strict hash slot pinning via curly-brace hash tags for all multi-key operations and atomic Lua scripts in Valkey 8.0 Cluster deployments. Enforces production-grade cluster failover routing, requiring explicit topology refresh limits, exponential backoff on MOVED redirects, and ASKING preambles for slot migration to prevent failover cascading outages.","antiPatternHeadline":"Executing unpinned multi-key Lua scripts causing CROSSSLOT exceptions and unhandled cluster redirection cascades during replica promotion.","stars_count":92,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","valkey","caching","clustering","lua","high-availability"],"exportEndpoints":{"claude":"/api/rules/valkey-8-cluster-threaded-io-resilience?format=claude","cursorMdc":"/api/rules/valkey-8-cluster-threaded-io-resilience?format=mdc","cursorrules":"/api/rules/valkey-8-cluster-threaded-io-resilience?format=cursor","windsurf":"/api/rules/valkey-8-cluster-threaded-io-resilience?format=windsurf","agents":"/api/rules/valkey-8-cluster-threaded-io-resilience?format=agents"}},{"id":"valkey-8-cluster-io-atomicity-guardrails","title":"Valkey 8.0 Cluster Failover, Hash Slot Routing & Lua Atomicity Standard","category":"backend","severity":"critical","description":"Enforces strict cluster hash tagging, automated MOVED/ASK redirect handling, and non-blocking Lua scripts on Valkey 8.0. Guarantees atomic cross-command execution across multi-threaded I/O boundaries while preventing cluster routing failures and main-thread execution stalls during primary node failover.","antiPatternHeadline":"Un-tagged Multi-Key Lua Execution and Unhandled Cluster Redirects Causing CROSSSLOT Exceptions and Write Starvation During Failover","stars_count":54,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","valkey","cluster","lua","distributed-systems","high-performance"],"exportEndpoints":{"claude":"/api/rules/valkey-8-cluster-io-atomicity-guardrails?format=claude","cursorMdc":"/api/rules/valkey-8-cluster-io-atomicity-guardrails?format=mdc","cursorrules":"/api/rules/valkey-8-cluster-io-atomicity-guardrails?format=cursor","windsurf":"/api/rules/valkey-8-cluster-io-atomicity-guardrails?format=windsurf","agents":"/api/rules/valkey-8-cluster-io-atomicity-guardrails?format=agents"}},{"id":"react-router-v7-framework-hydration-single-fetch-production-standard","title":"React Router 7 Framework Mode Hydration and Single-Fetch Invariants","category":"frontend","severity":"critical","description":"Enforces strict typegen route module typing, turbo-stream native serialization, and explicit clientLoader hydration boundaries in React Router 7 Framework Mode. Prevents hydration mismatch bugs, duplicate network roundtrips, and stream serialization breakage caused by legacy Remix v2 patterns like json() wrappers and manual generic types.","antiPatternHeadline":"Unsafe clientLoader Hydration Overrides and Legacy json() Wrappers Breaking Single Fetch Serialization","stars_count":62,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-router","remix","hydration","single-fetch","typescript"],"exportEndpoints":{"claude":"/api/rules/react-router-v7-framework-hydration-single-fetch-production-standard?format=claude","cursorMdc":"/api/rules/react-router-v7-framework-hydration-single-fetch-production-standard?format=mdc","cursorrules":"/api/rules/react-router-v7-framework-hydration-single-fetch-production-standard?format=cursor","windsurf":"/api/rules/react-router-v7-framework-hydration-single-fetch-production-standard?format=windsurf","agents":"/api/rules/react-router-v7-framework-hydration-single-fetch-production-standard?format=agents"}},{"id":"valkey-8-cluster-failover-multithreaded-io-standard","title":"Valkey 8.0 Cluster Routing, Multi-Threaded I/O, and Atomic Script Invariants","category":"backend","severity":"critical","description":"Enforces strict cluster slot routing invariants, failover resilience, and deterministic cross-slot atomic script execution in Valkey 8.0. Prevents runtime CROSSSLOT errors, unbounded connection churn during master failovers, and latency regressions arising from uncoordinated multi-threaded I/O client configurations.","antiPatternHeadline":"Executing un-tagged multi-key Lua scripts and naive failover loops causing CROSSSLOT panics and cluster storm disconnects.","stars_count":75,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","valkey","redis-compatible","clustering","distributed-systems","concurrency"],"exportEndpoints":{"claude":"/api/rules/valkey-8-cluster-failover-multithreaded-io-standard?format=claude","cursorMdc":"/api/rules/valkey-8-cluster-failover-multithreaded-io-standard?format=mdc","cursorrules":"/api/rules/valkey-8-cluster-failover-multithreaded-io-standard?format=cursor","windsurf":"/api/rules/valkey-8-cluster-failover-multithreaded-io-standard?format=windsurf","agents":"/api/rules/valkey-8-cluster-failover-multithreaded-io-standard?format=agents"}},{"id":"hono-jsx-edge-stream-pipeline-standards","title":"Hono JSX Edge Streaming Pipeline & Response Composition Standards","category":"frontend","severity":"critical","description":"Enforces non-blocking HTTP streaming architectures when rendering Hono JSX across distributed edge runtimes (Cloudflare Workers, Deno). Mandates strict isolation of header mutations prior to stream emission, explicit Suspense boundary usage with renderToReadableStream, and deterministic propagation of client abort signals to prevent worker memory leaks.","antiPatternHeadline":"Buffering Dynamic JSX Trees In-Memory and Mutating Headers Post-Stream Initiation","stars_count":51,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","hono","jsx","edge-computing","cloudflare-workers","streaming"],"exportEndpoints":{"claude":"/api/rules/hono-jsx-edge-stream-pipeline-standards?format=claude","cursorMdc":"/api/rules/hono-jsx-edge-stream-pipeline-standards?format=mdc","cursorrules":"/api/rules/hono-jsx-edge-stream-pipeline-standards?format=cursor","windsurf":"/api/rules/hono-jsx-edge-stream-pipeline-standards?format=windsurf","agents":"/api/rules/hono-jsx-edge-stream-pipeline-standards?format=agents"}},{"id":"lexical-node-transforms-selection-headless-standard","title":"Lexical Immutable Node Transforms, Selection Reconciliation, and Headless Serialization","category":"frontend","severity":"critical","description":"Lexical enforces strict double-buffered immutability where nodes in an active EditorState are frozen and can only be modified through getWritable() within an update transaction. Violating transform idempotency causes catastrophic infinite reconciliation loops, while unmanaged selection points or DOM-dependent markdown transformers break headless pipelines and corrupt the document model.","antiPatternHeadline":"Mutating frozen LexicalNode instances directly or triggering infinite transform cycles during headless document reconciliation.","stars_count":56,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","lexical","rich-text","editor-state","headless-cms"],"exportEndpoints":{"claude":"/api/rules/lexical-node-transforms-selection-headless-standard?format=claude","cursorMdc":"/api/rules/lexical-node-transforms-selection-headless-standard?format=mdc","cursorrules":"/api/rules/lexical-node-transforms-selection-headless-standard?format=cursor","windsurf":"/api/rules/lexical-node-transforms-selection-headless-standard?format=windsurf","agents":"/api/rules/lexical-node-transforms-selection-headless-standard?format=agents"}},{"id":"biome-configuration-vcs-suppression-invariants","title":"Biome 1.9 Strict Configuration Inheritance, VCS Integration, and Explicit Rule Suppression Guardrails","category":"frontend","severity":"critical","description":"Mandate deterministic Biome 1.9 configuration architecture across monorepos and standalone repositories using JSONC schema validation, VCS-aware file resolution (`useIgnoreFile: true`), and strictly qualified suppression comments with mandatory explanatory rationale (`// biome-ignore group/rule: rationale`). Prevent configuration drift, CI linting discrepancies, and non-deterministic ignore behavior.","antiPatternHeadline":"Malformed In-Source Suppressions, Missing VCS-Aware Ignore Coupling, and Non-Standard Configuration Splitting","stars_count":59,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","biome","linter","formatter","tooling","vcs","typescript"],"exportEndpoints":{"claude":"/api/rules/biome-configuration-vcs-suppression-invariants?format=claude","cursorMdc":"/api/rules/biome-configuration-vcs-suppression-invariants?format=mdc","cursorrules":"/api/rules/biome-configuration-vcs-suppression-invariants?format=cursor","windsurf":"/api/rules/biome-configuration-vcs-suppression-invariants?format=windsurf","agents":"/api/rules/biome-configuration-vcs-suppression-invariants?format=agents"}},{"id":"svelte5-runes-reactivity-snippets-invariant","title":"Svelte 5 Runes Reactivity, State Encapsulation, and Snippets Invariant","category":"frontend","severity":"critical","description":"Enforces deterministic state synchronization and composability in Svelte 5 using the runes reactive engine ($state, $derived, $props, $effect) and snippets. Prohibits mixing legacy Svelte 3/4 reactivity paradigms (e.g., export let, $:, <slot />) and prevents reactivity breakage caused by primitive destructuring or mutating derived values.","antiPatternHeadline":"Mixing legacy Svelte 3/4 reactivity with Svelte 5 runes and breaking reactive proxies via primitive destructuring or derived mutations.","stars_count":44,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","reactivity","snippets","state-management"],"exportEndpoints":{"claude":"/api/rules/svelte5-runes-reactivity-snippets-invariant?format=claude","cursorMdc":"/api/rules/svelte5-runes-reactivity-snippets-invariant?format=mdc","cursorrules":"/api/rules/svelte5-runes-reactivity-snippets-invariant?format=cursor","windsurf":"/api/rules/svelte5-runes-reactivity-snippets-invariant?format=windsurf","agents":"/api/rules/svelte5-runes-reactivity-snippets-invariant?format=agents"}},{"id":"lexical-headless-transforms-and-serialization-invariants","title":"Lexical Immutable Node Transforms, Selection Reconciliation, and Headless Markdown Serialization Guardrails","category":"frontend","severity":"critical","description":"Lexical document state trees are strictly immutable outside transaction boundaries, requiring node mutations to route through atomic write buffers via getWritable() within editor updates. Headless markdown serialization and transform loops must maintain strict idempotency and registered node parity to prevent infinite dirty-cycle re-renders, cursor desynchronization, and server-side DOM leakage.","antiPatternHeadline":"Direct Node Mutation, Infinite Transform dirty Loops, and Unregistered Headless Markdown Deserialization","stars_count":87,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","lexical","rich-text","markdown","headless","state-reconciliation"],"exportEndpoints":{"claude":"/api/rules/lexical-headless-transforms-and-serialization-invariants?format=claude","cursorMdc":"/api/rules/lexical-headless-transforms-and-serialization-invariants?format=mdc","cursorrules":"/api/rules/lexical-headless-transforms-and-serialization-invariants?format=cursor","windsurf":"/api/rules/lexical-headless-transforms-and-serialization-invariants?format=windsurf","agents":"/api/rules/lexical-headless-transforms-and-serialization-invariants?format=agents"}},{"id":"lexical-immutable-transform-headless-reconciliation-standard","title":"Lexical Immutable Node Transforms, Selection Reconciliation, and Headless Serialization Standard","category":"frontend","severity":"critical","description":"Meta Lexical enforces strict immutability across EditorState lifecycles via copy-on-write structural sharing; mutating node instances directly without invoking `node.getWritable()` bypasses the dirty-node tracking queue and corrupts history reconciliation. Furthermore, triggering recursive `editor.update()` calls within registered node transforms induces infinite transform loops, while serializing markdown without an explicitly configured headless editor context leads to node stripping and corrupted AST reconstruction. All editor modifications must occur through writable proxies within update/transform boundaries, preserving selection indices across synthetic passes.","antiPatternHeadline":"Direct Lexical Node Mutation, Nested Transform Updates, and Unregistered Headless Serialization","stars_count":84,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","lexical","rich-text","immutability","headless","markdown","reconciliation"],"exportEndpoints":{"claude":"/api/rules/lexical-immutable-transform-headless-reconciliation-standard?format=claude","cursorMdc":"/api/rules/lexical-immutable-transform-headless-reconciliation-standard?format=mdc","cursorrules":"/api/rules/lexical-immutable-transform-headless-reconciliation-standard?format=cursor","windsurf":"/api/rules/lexical-immutable-transform-headless-reconciliation-standard?format=windsurf","agents":"/api/rules/lexical-immutable-transform-headless-reconciliation-standard?format=agents"}},{"id":"tanstack-start-ssr-loader-streaming-invariant","title":"TanStack Start SSR: Type-Safe Search Validation, Deferred Streaming, and Server Functions","category":"frontend","severity":"critical","description":"Enforces strict type-safe search param validation, non-blocking SSR data streaming, and safe server RPC execution in TanStack Start and Fullstack Router. Prevents blocking time-to-first-byte (TTFB), runtime type coercion crashes, hydration mismatches, and accidental leakage of server-only logic into client bundles.","antiPatternHeadline":"Blocking full-page SSR with sequential loader waterfalls and unvalidated search parameter parsing.","stars_count":42,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["tanstack-start","tanstack-router","ssr","streaming","search-params","zod","hydration"],"exportEndpoints":{"claude":"/api/rules/tanstack-start-ssr-loader-streaming-invariant?format=claude","cursorMdc":"/api/rules/tanstack-start-ssr-loader-streaming-invariant?format=mdc","cursorrules":"/api/rules/tanstack-start-ssr-loader-streaming-invariant?format=cursor","windsurf":"/api/rules/tanstack-start-ssr-loader-streaming-invariant?format=windsurf","agents":"/api/rules/tanstack-start-ssr-loader-streaming-invariant?format=agents"}},{"id":"axum-08-state-tower-guardrails","title":"Axum 0.8 Substate Derivation, Tower Layer Ordering, and Zero-Panic Invariants","category":"backend","severity":"critical","description":"Enforces type-safe modular substate extraction via axum::extract::FromRef, non-blocking asynchronous concurrency, strict Tower ServiceBuilder middleware ordering, and deterministic panic recovery to prevent connection resets and state-leak vulnerabilities in Axum 0.8 microservices.","antiPatternHeadline":"Monolithic state extraction with blocking standard mutexes and unhandled Tower panic drops causing connection resets and thread starvation.","stars_count":49,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tower","tokio","concurrency"],"exportEndpoints":{"claude":"/api/rules/axum-08-state-tower-guardrails?format=claude","cursorMdc":"/api/rules/axum-08-state-tower-guardrails?format=mdc","cursorrules":"/api/rules/axum-08-state-tower-guardrails?format=cursor","windsurf":"/api/rules/axum-08-state-tower-guardrails?format=windsurf","agents":"/api/rules/axum-08-state-tower-guardrails?format=agents"}},{"id":"rr7-hydration-single-fetch-streaming-standard","title":"React Router 7 Framework Mode: Hydration, Single-Fetch, and Route Typegen Invariants","category":"frontend","severity":"critical","description":"Enforces strict React Router 7 framework mode invariants across route module typegen, Single Fetch serialization boundaries, and clientLoader hydration lifecycles. Prevents hydration mismatches, broken turbo-stream serialization, and redundant network roundtrips caused by legacy Remix v2 primitives.","antiPatternHeadline":"Hydration mismatches, waterfall stalls, and broken serialization caused by legacy json/defer primitives and untyped clientLoader boundaries in React Router 7.","stars_count":42,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-router-7","remix","hydration","streaming","typegen","single-fetch"],"exportEndpoints":{"claude":"/api/rules/rr7-hydration-single-fetch-streaming-standard?format=claude","cursorMdc":"/api/rules/rr7-hydration-single-fetch-streaming-standard?format=mdc","cursorrules":"/api/rules/rr7-hydration-single-fetch-streaming-standard?format=cursor","windsurf":"/api/rules/rr7-hydration-single-fetch-streaming-standard?format=windsurf","agents":"/api/rules/rr7-hydration-single-fetch-streaming-standard?format=agents"}},{"id":"axum-08-state-tower-safety-guardrail","title":"Axum 0.8 Type-Safe State Subtyping, Fallback Layers, and Safe Extractor Composition","category":"backend","severity":"critical","description":"Enforces strict type safety and panic-free request lifecycle management for Rust Axum 0.8 and Tower ecosystems. Dictates compositional sub-state extraction via FromRef, prevents router-level runtime type mismatches, and mandates centralized, catch-panic Tower layer topologies. Guarantees that router nesting, middleware stacking, and custom extractors never cause runtime unhandled panics or silent state dropouts.","antiPatternHeadline":"Global Monolithic State Coupling with Unhandled Layer Panics and Untyped Extension Leaks","stars_count":110,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tower","state-management","type-safety"],"exportEndpoints":{"claude":"/api/rules/axum-08-state-tower-safety-guardrail?format=claude","cursorMdc":"/api/rules/axum-08-state-tower-safety-guardrail?format=mdc","cursorrules":"/api/rules/axum-08-state-tower-safety-guardrail?format=cursor","windsurf":"/api/rules/axum-08-state-tower-safety-guardrail?format=windsurf","agents":"/api/rules/axum-08-state-tower-safety-guardrail?format=agents"}},{"id":"nuxt-4-nitro-shared-directory-state-isolation","title":"Nuxt 4 Nitro Engine Isolation and Shared Directory Boundary Enforcement","category":"frontend","severity":"critical","description":"Enforces strict boundary separation between Nitro server execution, client hydration, and Nuxt 4's restructured app/ and shared/ directories. Prohibits global module-level mutable state in Nitro handlers to prevent cross-request SSR memory leaks and tenant data contamination.","antiPatternHeadline":"Cross-Request State Bleed and Illegal Module Imports Across Nitro Server and Client Boundaries","stars_count":80,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nuxt4","nitro","ssr","state-hydration","vue"],"exportEndpoints":{"claude":"/api/rules/nuxt-4-nitro-shared-directory-state-isolation?format=claude","cursorMdc":"/api/rules/nuxt-4-nitro-shared-directory-state-isolation?format=mdc","cursorrules":"/api/rules/nuxt-4-nitro-shared-directory-state-isolation?format=cursor","windsurf":"/api/rules/nuxt-4-nitro-shared-directory-state-isolation?format=windsurf","agents":"/api/rules/nuxt-4-nitro-shared-directory-state-isolation?format=agents"}},{"id":"solidstart-server-rpc-async-boundaries","title":"SolidStart 1.0 server$ RPC & Async Boundary Reactive Isolation Standard","category":"frontend","severity":"critical","description":"Enforces strict isolation between fine-grained reactive client signals and SolidStart 1.0 server$ RPC boundaries. Prevents signal serialization failures, hydration deadlocks, and silent reactivity loss across the wire by mandating cache(), createAsync, and explicit boundary serialization.","antiPatternHeadline":"Invoking server$ directly within createEffect or capturing reactive signals inside server$ closures","stars_count":72,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","solidstart","solidjs","rpc","reactivity","ssr"],"exportEndpoints":{"claude":"/api/rules/solidstart-server-rpc-async-boundaries?format=claude","cursorMdc":"/api/rules/solidstart-server-rpc-async-boundaries?format=mdc","cursorrules":"/api/rules/solidstart-server-rpc-async-boundaries?format=cursor","windsurf":"/api/rules/solidstart-server-rpc-async-boundaries?format=windsurf","agents":"/api/rules/solidstart-server-rpc-async-boundaries?format=agents"}},{"id":"nuxt4-nitro-shared-directory-isolation","title":"Nuxt 4 Nitro Server Engine & Shared Directory State Isolation Standard","category":"frontend","severity":"critical","description":"Enforces strict boundary isolation between Nuxt 4's app/, server/, and shared/ directories. Prohibits module-level mutable state in Nitro v2 server routes and Vue composables to prevent cross-request SSR state leaks and ensures zero-bleed isomorphic contracts.","antiPatternHeadline":"Leaking module-scoped mutable state across concurrent SSR requests and cross-importing Nitro server internals into Nuxt app context.","stars_count":93,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["nuxt","nuxt4","nitro","ssr","hydration","state-management"],"exportEndpoints":{"claude":"/api/rules/nuxt4-nitro-shared-directory-isolation?format=claude","cursorMdc":"/api/rules/nuxt4-nitro-shared-directory-isolation?format=mdc","cursorrules":"/api/rules/nuxt4-nitro-shared-directory-isolation?format=cursor","windsurf":"/api/rules/nuxt4-nitro-shared-directory-isolation?format=windsurf","agents":"/api/rules/nuxt4-nitro-shared-directory-isolation?format=agents"}},{"id":"solidstart-server-functions-async-boundaries-guardrail","title":"SolidStart 1.0 Server Functions (server$) and Fine-Grained Reactive Boundaries","category":"frontend","severity":"critical","description":"SolidStart 1.0 utilizes Vinxi-driven compilation to transform `server$` calls into JSON RPC endpoints, executing purely on the server while client-side signals remain isolated to the client runtime. Engineers must never close over client-side reactive primitives (signals, stores, memo hooks) inside `server$` bodies, nor expose unvalidated inputs across serialized RPC invocations. Furthermore, asynchronous server data transitions must be coordinated with `cache`, `createAsync`, and `Suspense` rather than embedding manual async effects inside component render scopes.","antiPatternHeadline":"Closing Over Client Signals in server$ Closures or Calling Async RPCs Inside Untracked Reactive Render Loops","stars_count":52,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","solidjs","solidstart","vinxi","server-functions","reactivity"],"exportEndpoints":{"claude":"/api/rules/solidstart-server-functions-async-boundaries-guardrail?format=claude","cursorMdc":"/api/rules/solidstart-server-functions-async-boundaries-guardrail?format=mdc","cursorrules":"/api/rules/solidstart-server-functions-async-boundaries-guardrail?format=cursor","windsurf":"/api/rules/solidstart-server-functions-async-boundaries-guardrail?format=windsurf","agents":"/api/rules/solidstart-server-functions-async-boundaries-guardrail?format=agents"}},{"id":"solidstart-server-functions-async-boundaries","title":"SolidStart 1.0 server$ RPC & Async Boundary Reactive Isolation","category":"frontend","severity":"critical","description":"Enforces strict structural boundaries between Solid's fine-grained client reactivity and SolidStart 1.0 Vinxi server$ RPC execution contexts. Eliminates closure captures across RPC boundaries, prevents direct raw server calls in tracking contexts, and mandates type-safe serialization with createAsync and query/cache primitives.","antiPatternHeadline":"Closing over client signals inside server$ functions and triggering un-cached RPCs in reactive tracking scopes","stars_count":112,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["solidstart","vinxi","signals","async-boundaries","server-functions","reactivity"],"exportEndpoints":{"claude":"/api/rules/solidstart-server-functions-async-boundaries?format=claude","cursorMdc":"/api/rules/solidstart-server-functions-async-boundaries?format=mdc","cursorrules":"/api/rules/solidstart-server-functions-async-boundaries?format=cursor","windsurf":"/api/rules/solidstart-server-functions-async-boundaries?format=windsurf","agents":"/api/rules/solidstart-server-functions-async-boundaries?format=agents"}},{"id":"nuxt4-nitro-shared-directory-isolation-standard","title":"Nuxt 4 Nitro Engine Boundary, Shared Directory Isolation, and SSR State Hydration Invariants","category":"frontend","severity":"critical","description":"Enforces strict architectural boundaries across Nuxt 4 app/, server/, and shared/ directories. Eliminates cross-request state pollution in Nitro v2 server handlers and guarantees deterministic SSR state hydration without runtime secret leaks.","antiPatternHeadline":"Cross-Request State Contamination, Server Leakage in Shared Directory, and Hydration Mismatches via Module-Scoped State","stars_count":82,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nuxt","nuxt4","nitro","ssr","vue","hydration"],"exportEndpoints":{"claude":"/api/rules/nuxt4-nitro-shared-directory-isolation-standard?format=claude","cursorMdc":"/api/rules/nuxt4-nitro-shared-directory-isolation-standard?format=mdc","cursorrules":"/api/rules/nuxt4-nitro-shared-directory-isolation-standard?format=cursor","windsurf":"/api/rules/nuxt4-nitro-shared-directory-isolation-standard?format=windsurf","agents":"/api/rules/nuxt4-nitro-shared-directory-isolation-standard?format=agents"}},{"id":"nuxt4-nitro-shared-ssr-isolation-guardrail","title":"Nuxt 4 Nitro Server Isolation, App Reorganization, and SSR Hydration Standard","category":"frontend","severity":"critical","description":"Enforces strict boundary separation between Nuxt 4 app/ runtime, Nitro server engine, and shared/ utilities. Prohibits global state pollution across concurrent SSR requests and eliminates cross-boundary imports between server and client domains.","antiPatternHeadline":"Global Node Module State Leaks Across SSR Requests and Cross-Boundary Nitro Module Imports","stars_count":83,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nuxt4","nitro","vue","ssr","typescript"],"exportEndpoints":{"claude":"/api/rules/nuxt4-nitro-shared-ssr-isolation-guardrail?format=claude","cursorMdc":"/api/rules/nuxt4-nitro-shared-ssr-isolation-guardrail?format=mdc","cursorrules":"/api/rules/nuxt4-nitro-shared-ssr-isolation-guardrail?format=cursor","windsurf":"/api/rules/nuxt4-nitro-shared-ssr-isolation-guardrail?format=windsurf","agents":"/api/rules/nuxt4-nitro-shared-ssr-isolation-guardrail?format=agents"}},{"id":"nuxt-4-nitro-shared-directory-ssr-isolation","title":"Nuxt 4 Nitro Server Engine & Shared Directory Architectural Isolation Guardrail","category":"frontend","severity":"critical","description":"Enforces strict boundary separation between Nuxt 4 app/ directory, Nitro server engine, and shared/ utilities. Prevents cross-context contamination, server-side memory leaks from module-scoped mutable state, and SSR hydration mismatches caused by non-serializable or un-isolated runtime references.","antiPatternHeadline":"Cross-boundary module imports and global state leakage across concurrent SSR requests in Nuxt 4/Nitro","stars_count":94,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["nuxt4","nitro","ssr","state-hydration","vue","architecture"],"exportEndpoints":{"claude":"/api/rules/nuxt-4-nitro-shared-directory-ssr-isolation?format=claude","cursorMdc":"/api/rules/nuxt-4-nitro-shared-directory-ssr-isolation?format=mdc","cursorrules":"/api/rules/nuxt-4-nitro-shared-directory-ssr-isolation?format=cursor","windsurf":"/api/rules/nuxt-4-nitro-shared-directory-ssr-isolation?format=windsurf","agents":"/api/rules/nuxt-4-nitro-shared-directory-ssr-isolation?format=agents"}},{"id":"nuxt4-nitro-shared-ssr-isolation","title":"Nuxt 4 Directory Boundaries and Nitro Cross-Request State Isolation","category":"frontend","severity":"critical","description":"Enforces architectural boundaries between Nuxt 4 app/, server/, and shared/ directories to eliminate cross-request memory contamination and hydration mismatches. Mandates pure runtime-agnostic code in shared/ and strictly isolates per-request state in Nitro handlers using H3 event context.","antiPatternHeadline":"Cross-Request State Contamination via Module-Level Nitro State and Invalid Shared Imports","stars_count":58,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["nuxt4","nitro","ssr","hydration","state-isolation","vue"],"exportEndpoints":{"claude":"/api/rules/nuxt4-nitro-shared-ssr-isolation?format=claude","cursorMdc":"/api/rules/nuxt4-nitro-shared-ssr-isolation?format=mdc","cursorrules":"/api/rules/nuxt4-nitro-shared-ssr-isolation?format=cursor","windsurf":"/api/rules/nuxt4-nitro-shared-ssr-isolation?format=windsurf","agents":"/api/rules/nuxt4-nitro-shared-ssr-isolation?format=agents"}},{"id":"solidstart-server-function-async-boundary-guardrail","title":"SolidStart 1.0 Server Functions and Async Boundary Reactive Invariants","category":"frontend","severity":"critical","description":"Enforces strict isolation boundaries for SolidStart 1.0 server$ RPC functions by prohibiting lexical capture of client signals and ensuring serializable parameter passing. Mandates the use of createAsync wrapped in Suspense boundaries to maintain fine-grained reactive synchronization across network boundaries without hydration mismatch or memory leaks.","antiPatternHeadline":"Lexically Capturing Client Signals Within server$ Closures and Calling Async RPCs Outside Solid Reactive Primitives","stars_count":98,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["solidstart","solidjs","server-functions","reactivity","async-boundaries","rpc"],"exportEndpoints":{"claude":"/api/rules/solidstart-server-function-async-boundary-guardrail?format=claude","cursorMdc":"/api/rules/solidstart-server-function-async-boundary-guardrail?format=mdc","cursorrules":"/api/rules/solidstart-server-function-async-boundary-guardrail?format=cursor","windsurf":"/api/rules/solidstart-server-function-async-boundary-guardrail?format=windsurf","agents":"/api/rules/solidstart-server-function-async-boundary-guardrail?format=agents"}},{"id":"nuxt4-nitro-shared-ssr-state-isolation","title":"Nuxt 4 Nitro Engine, Shared Directory Architecture, and SSR Hydration Isolation","category":"frontend","severity":"critical","description":"Nuxt 4 enforces strict separation between the Vue application runtime (app/), the Nitro server engine (server/), and isomorphic code (shared/). Module-level mutable singletons, cross-boundary lifecycle leakage, and improper SSR state hydration cause severe cross-request memory corruption, data leaks across concurrent tenant sessions, and irreversible hydration mismatches.","antiPatternHeadline":"Cross-Request State Poisoning via Module-Scope Variables in Nitro Handlers and Leaky Shared Boundaries","stars_count":106,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nuxt4","nitro","ssr","hydration","vue","security"],"exportEndpoints":{"claude":"/api/rules/nuxt4-nitro-shared-ssr-state-isolation?format=claude","cursorMdc":"/api/rules/nuxt4-nitro-shared-ssr-state-isolation?format=mdc","cursorrules":"/api/rules/nuxt4-nitro-shared-ssr-state-isolation?format=cursor","windsurf":"/api/rules/nuxt4-nitro-shared-ssr-state-isolation?format=windsurf","agents":"/api/rules/nuxt4-nitro-shared-ssr-state-isolation?format=agents"}},{"id":"solidstart-server-functions-async-boundary-guardrail","title":"SolidStart 1.0 Server Functions and Async Boundary Invariants","category":"frontend","severity":"critical","description":"Enforces strict isolation of reactive state and runtime boundaries across SolidStart server$ RPC calls and async primitives. Prevents client-side lexical scope leakage into server environments, serialization bugs, and broken fine-grained reactivity when bridging signals with asynchronous RPC executions.","antiPatternHeadline":"Capturing Reactive Signals Directly in server$ Lexical Closures or Destructuring Async Responses Outside Suspense Contexts","stars_count":70,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["solidstart","solidjs","server-functions","async-primitives","fine-grained-reactivity","rpc"],"exportEndpoints":{"claude":"/api/rules/solidstart-server-functions-async-boundary-guardrail?format=claude","cursorMdc":"/api/rules/solidstart-server-functions-async-boundary-guardrail?format=mdc","cursorrules":"/api/rules/solidstart-server-functions-async-boundary-guardrail?format=cursor","windsurf":"/api/rules/solidstart-server-functions-async-boundary-guardrail?format=windsurf","agents":"/api/rules/solidstart-server-functions-async-boundary-guardrail?format=agents"}},{"id":"nuxt4-nitro-shared-ssr-isolation-standard","title":"Nuxt 4 Directory Restructuring, Nitro Isolation, and SSR State Hydration Guardrails","category":"frontend","severity":"critical","description":"Enforces strict boundary separation between Nuxt 4 app/ frontend execution context, Nitro v2 server runtime, and the shared/ directory. Eliminates cross-request state pollution, server-side prototype leaks, and client bundle contamination by mandating per-request state instantiation and runtime-agnostic shared utilities.","antiPatternHeadline":"Global Mutable State in Nitro Handlers and Direct Server Import into Nuxt 4 App Code","stars_count":72,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nuxt4","nitro","ssr","vue3","state-hydration"],"exportEndpoints":{"claude":"/api/rules/nuxt4-nitro-shared-ssr-isolation-standard?format=claude","cursorMdc":"/api/rules/nuxt4-nitro-shared-ssr-isolation-standard?format=mdc","cursorrules":"/api/rules/nuxt4-nitro-shared-ssr-isolation-standard?format=cursor","windsurf":"/api/rules/nuxt4-nitro-shared-ssr-isolation-standard?format=windsurf","agents":"/api/rules/nuxt4-nitro-shared-ssr-isolation-standard?format=agents"}},{"id":"nuxt-4-nitro-shared-ssr-isolation-guardrail","title":"Nuxt 4 Nitro Server Engine & Shared State Isolation Standards","category":"frontend","severity":"critical","description":"Enforces strict boundary separation between Nuxt 4 app/, server/, and shared/ directories to prevent cross-request state contamination and SSR hydration leaks. Mandates per-request context isolation in Nitro v2 event handlers and strictly forbids module-level mutable state across universal modules.","antiPatternHeadline":"Cross-Request State Contamination via Global Nitro Variables and Server Leakage in Shared Directory","stars_count":83,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nuxt","nuxt4","nitro","ssr","hydration","vue"],"exportEndpoints":{"claude":"/api/rules/nuxt-4-nitro-shared-ssr-isolation-guardrail?format=claude","cursorMdc":"/api/rules/nuxt-4-nitro-shared-ssr-isolation-guardrail?format=mdc","cursorrules":"/api/rules/nuxt-4-nitro-shared-ssr-isolation-guardrail?format=cursor","windsurf":"/api/rules/nuxt-4-nitro-shared-ssr-isolation-guardrail?format=windsurf","agents":"/api/rules/nuxt-4-nitro-shared-ssr-isolation-guardrail?format=agents"}},{"id":"solidstart-server-rpc-async-boundary-guardrail","title":"SolidStart 1.0 Server Function Isolation & Async Boundary Invariants","category":"frontend","severity":"critical","description":"Enforces strict serialization and reactivity boundaries across SolidStart server$ RPC calls and client signals. Prohibits closing over client-side reactive state within server$ functions and mandates wrapping server invocations with createAsync to preserve fine-grained Suspense coordination.","antiPatternHeadline":"Closing Over Client Signals in server$ RPCs and Uncoordinated Async JSX Evaluation","stars_count":65,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","solidstart","solidjs","server-functions","reactivity","vinxi"],"exportEndpoints":{"claude":"/api/rules/solidstart-server-rpc-async-boundary-guardrail?format=claude","cursorMdc":"/api/rules/solidstart-server-rpc-async-boundary-guardrail?format=mdc","cursorrules":"/api/rules/solidstart-server-rpc-async-boundary-guardrail?format=cursor","windsurf":"/api/rules/solidstart-server-rpc-async-boundary-guardrail?format=windsurf","agents":"/api/rules/solidstart-server-rpc-async-boundary-guardrail?format=agents"}},{"id":"nuxt-4-nitro-shared-directory-isolation","title":"Nuxt 4 Nitro Server Engine Isolation & Shared Directory State Guardrails","category":"frontend","severity":"critical","description":"Nuxt 4 restructures application architecture by placing userland Vue code inside 'app/' while running server code via Nitro under 'server/'. Cross-boundary imports, direct Node.js runtime imports in the 'shared/' directory, and global module-level mutable state in Nitro handlers cause cross-request state pollution, SSR hydration mismatches, and build failures across non-Node deployment runtimes.","antiPatternHeadline":"Cross-Request State Contamination via Global Nitro Variables and Unsafe Shared Directory Runtime Imports","stars_count":112,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nuxt4","nitro","ssr","hydration","state-pollution","vue3"],"exportEndpoints":{"claude":"/api/rules/nuxt-4-nitro-shared-directory-isolation?format=claude","cursorMdc":"/api/rules/nuxt-4-nitro-shared-directory-isolation?format=mdc","cursorrules":"/api/rules/nuxt-4-nitro-shared-directory-isolation?format=cursor","windsurf":"/api/rules/nuxt-4-nitro-shared-directory-isolation?format=windsurf","agents":"/api/rules/nuxt-4-nitro-shared-directory-isolation?format=agents"}},{"id":"solidstart-server-rpc-async-boundary-invariants","title":"SolidStart 1.0 server$ RPC Serialization & Async Boundary Invariants","category":"frontend","severity":"critical","description":"Enforces rigid separation between SolidJS client reactive tracking scopes and SolidStart 1.0 server$ RPC functions. Mandates wrapping server RPC calls within createAsync or action primitives, preventing lexical closure over client signals inside server-bound functions and requiring explicit Suspense boundaries for all asynchronous resource states.","antiPatternHeadline":"Closing Over Reactive Signals in server$ Lexical Scopes or Executing Naked RPCs in Tracking Contexts","stars_count":64,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","solidstart","server-functions","signals","async-boundaries","ssr"],"exportEndpoints":{"claude":"/api/rules/solidstart-server-rpc-async-boundary-invariants?format=claude","cursorMdc":"/api/rules/solidstart-server-rpc-async-boundary-invariants?format=mdc","cursorrules":"/api/rules/solidstart-server-rpc-async-boundary-invariants?format=cursor","windsurf":"/api/rules/solidstart-server-rpc-async-boundary-invariants?format=windsurf","agents":"/api/rules/solidstart-server-rpc-async-boundary-invariants?format=agents"}},{"id":"nuxt4-nitro-shared-ssr-state-guardrail","title":"Nuxt 4 Nitro Server Engine Isolation and Shared Directory Hydration Standard","category":"frontend","severity":"critical","description":"Enforces strict isolation between Nitro v2 server execution contexts, the Nuxt 4 `app/` client directory, and the root `shared/` directory. Prevents catastrophic cross-request state pollution in Node/Worker runtimes and guarantees deterministic SSR hydration by eliminating global mutable singletons and unauthorized server import leakage.","antiPatternHeadline":"Global Module-Level State Pollution and Illegal Server-Client Import Leaks in Nuxt 4","stars_count":112,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nuxt4","nitro","ssr","hydration","state-pollution","vue"],"exportEndpoints":{"claude":"/api/rules/nuxt4-nitro-shared-ssr-state-guardrail?format=claude","cursorMdc":"/api/rules/nuxt4-nitro-shared-ssr-state-guardrail?format=mdc","cursorrules":"/api/rules/nuxt4-nitro-shared-ssr-state-guardrail?format=cursor","windsurf":"/api/rules/nuxt4-nitro-shared-ssr-state-guardrail?format=windsurf","agents":"/api/rules/nuxt4-nitro-shared-ssr-state-guardrail?format=agents"}},{"id":"solidstart-server-functions-async-boundaries-standard","title":"SolidStart 1.0 Server Functions (server$) & Async Reactive Boundaries","category":"frontend","severity":"critical","description":"Enforces strict isolation between SolidJS fine-grained client reactivity and SolidStart 1.0 server$ RPC serialization boundaries. Prohibits naked server invocations inside synchronous tracking scopes, accidental signal closure leaks into server execution contexts, and unhandled async streaming states across client-server transitions.","antiPatternHeadline":"Executing naked server$ RPCs inside reactive tracking scopes and passing reactive accessors into serialized payloads.","stars_count":93,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","solidstart","solidjs","server-functions","reactivity","async-boundaries"],"exportEndpoints":{"claude":"/api/rules/solidstart-server-functions-async-boundaries-standard?format=claude","cursorMdc":"/api/rules/solidstart-server-functions-async-boundaries-standard?format=mdc","cursorrules":"/api/rules/solidstart-server-functions-async-boundaries-standard?format=cursor","windsurf":"/api/rules/solidstart-server-functions-async-boundaries-standard?format=windsurf","agents":"/api/rules/solidstart-server-functions-async-boundaries-standard?format=agents"}},{"id":"solidstart-server-rpc-async-boundaries-standard","title":"SolidStart 1.0 Server Functions (server$) & Async Boundary Integrity","category":"frontend","severity":"critical","description":"Enforces strict isolation between client-side reactive tracking scopes and SolidStart 1.0 server$ RPC functions. Mandates explicit parameter serialization, createAsync wrapping, and deterministic Suspense boundaries to eliminate SSR-client hydration mismatches and illegal reactive closure escapes.","antiPatternHeadline":"Executing server$ RPCs inside client createEffect hooks or dereferencing reactive signals within server-executed function bodies.","stars_count":111,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","solidstart","solidjs","server-functions","reactivity","suspense"],"exportEndpoints":{"claude":"/api/rules/solidstart-server-rpc-async-boundaries-standard?format=claude","cursorMdc":"/api/rules/solidstart-server-rpc-async-boundaries-standard?format=mdc","cursorrules":"/api/rules/solidstart-server-rpc-async-boundaries-standard?format=cursor","windsurf":"/api/rules/solidstart-server-rpc-async-boundaries-standard?format=windsurf","agents":"/api/rules/solidstart-server-rpc-async-boundaries-standard?format=agents"}},{"id":"solidstart-server-rpc-async-boundary-standard","title":"Enforcing SolidStart 1.0 server$ RPC Isolation and createAsync Boundaries","category":"frontend","severity":"critical","description":"SolidStart server functions (`server$`) create isolated RPC endpoints that execute strictly on the server and must not capture client-side reactive scope closures. Reactive client signals consumed by server functions must be explicitly passed as serialized arguments, and all resulting async promises must resolve through `createAsync` or action utilities within `<Suspense>` boundaries to preserve fine-grained reactivity and prevent hydration mismatches.","antiPatternHeadline":"Capturing Client Signals in server$ Closures or Calling server$ Unwrapped in Reactive Tracking Scopes","stars_count":118,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","solidstart","solidjs","server-functions","createAsync","rpc"],"exportEndpoints":{"claude":"/api/rules/solidstart-server-rpc-async-boundary-standard?format=claude","cursorMdc":"/api/rules/solidstart-server-rpc-async-boundary-standard?format=mdc","cursorrules":"/api/rules/solidstart-server-rpc-async-boundary-standard?format=cursor","windsurf":"/api/rules/solidstart-server-rpc-async-boundary-standard?format=windsurf","agents":"/api/rules/solidstart-server-rpc-async-boundary-standard?format=agents"}},{"id":"solidstart-server-functions-and-async-boundaries","title":"SolidStart 1.0 Server Functions (`server$`) & Async Boundary Invariants","category":"frontend","severity":"critical","description":"Enforces strict isolation between client reactive signals and SolidStart 1.0 `server$` RPC functions across network boundaries. Prevents non-serializable closure captures, client-side secret leakage, and broken fine-grained reactivity when bridging `createResource` or async primitives with server-side executions.","antiPatternHeadline":"Capturing Reactive Client Signals in server$ Closures or Omitting createResource/Suspense Async Boundaries","stars_count":114,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["solidstart","solid-js","server-functions","rpc","async-boundaries","signals"],"exportEndpoints":{"claude":"/api/rules/solidstart-server-functions-and-async-boundaries?format=claude","cursorMdc":"/api/rules/solidstart-server-functions-and-async-boundaries?format=mdc","cursorrules":"/api/rules/solidstart-server-functions-and-async-boundaries?format=cursor","windsurf":"/api/rules/solidstart-server-functions-and-async-boundaries?format=windsurf","agents":"/api/rules/solidstart-server-functions-and-async-boundaries?format=agents"}},{"id":"solidstart-server-function-boundary-serialization","title":"SolidStart 1.0 server$ RPC Boundaries & Fine-Grained Reactive Decoupling","category":"frontend","severity":"critical","description":"Enforces strict isolation between client-side SolidJS fine-grained reactive scopes and Vinxi-compiled server$ RPC endpoints. Prevents closure state leakage, unhandled async tracking breaks, non-serializable boundary payloads, and SSR hydration mismatches across network edges.","antiPatternHeadline":"Closing over client reactive signals within server$ bodies and invoking async RPCs directly inside synchronous tracking computations.","stars_count":92,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","solidstart","solidjs","server-functions","reactivity","vinxi","rpc"],"exportEndpoints":{"claude":"/api/rules/solidstart-server-function-boundary-serialization?format=claude","cursorMdc":"/api/rules/solidstart-server-function-boundary-serialization?format=mdc","cursorrules":"/api/rules/solidstart-server-function-boundary-serialization?format=cursor","windsurf":"/api/rules/solidstart-server-function-boundary-serialization?format=windsurf","agents":"/api/rules/solidstart-server-function-boundary-serialization?format=agents"}},{"id":"nuxt4-nitro-shared-boundary-state-isolation","title":"Nuxt 4 Nitro Server Engine Boundaries, Shared Directory Purity, and SSR State Isolation","category":"frontend","severity":"critical","description":"Mandate strict runtime and directory isolation across Nuxt 4's app/, server/, and shared/ boundaries. Prevent catastrophic multi-tenant cross-request state pollution in Nitro route handlers and Nuxt SSR composables by eliminating module-level mutable state and restricting shared/ to stateless isomorphic logic.","antiPatternHeadline":"Multi-Tenant Data Leaks via Nitro Module-Level Globals and Impure Shared Directory Imports","stars_count":63,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nuxt","nuxt4","nitro","ssr","hydration","state-isolation"],"exportEndpoints":{"claude":"/api/rules/nuxt4-nitro-shared-boundary-state-isolation?format=claude","cursorMdc":"/api/rules/nuxt4-nitro-shared-boundary-state-isolation?format=mdc","cursorrules":"/api/rules/nuxt4-nitro-shared-boundary-state-isolation?format=cursor","windsurf":"/api/rules/nuxt4-nitro-shared-boundary-state-isolation?format=windsurf","agents":"/api/rules/nuxt4-nitro-shared-boundary-state-isolation?format=agents"}},{"id":"nuxt-4-nitro-shared-directory-architecture","title":"Nuxt 4 Nitro Engine Boundaries, Shared Directory Purity, and SSR State Isolation","category":"frontend","severity":"critical","description":"Enforces architectural boundary separation across Nuxt 4's app/ layer, Nitro v2 server engine (server/), and isomorphic domain directory (shared/). Prevents cross-request state pollution, runtime leakage between Vue and Nitro, and SSR state hydration vulnerabilities.","antiPatternHeadline":"Global Module-Level State Pollution and Illegal Boundary Cross-Imports in Nuxt 4","stars_count":118,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nuxt4","nitro","vue","ssr","hydration","state-isolation"],"exportEndpoints":{"claude":"/api/rules/nuxt-4-nitro-shared-directory-architecture?format=claude","cursorMdc":"/api/rules/nuxt-4-nitro-shared-directory-architecture?format=mdc","cursorrules":"/api/rules/nuxt-4-nitro-shared-directory-architecture?format=cursor","windsurf":"/api/rules/nuxt-4-nitro-shared-directory-architecture?format=windsurf","agents":"/api/rules/nuxt-4-nitro-shared-directory-architecture?format=agents"}},{"id":"nuxt-4-nitro-shared-ssr-isolation","title":"Nuxt 4 Nitro Server Engine, Shared Directory, and SSR State Isolation","category":"frontend","severity":"critical","description":"Enforces strict boundary isolation between Nuxt 4 client code in app/, Nitro v2 engine routes in server/, and universal utilities in shared/. Mandates per-request context isolation to eliminate multi-tenant cross-request state pollution and hydration mismatches during server-side rendering (SSR).","antiPatternHeadline":"Global Module-Level State in Nitro Handlers and Direct Server Module Leakage into Client Hydration","stars_count":116,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["nuxt4","nitro","ssr","state-hydration","vue","architecture"],"exportEndpoints":{"claude":"/api/rules/nuxt-4-nitro-shared-ssr-isolation?format=claude","cursorMdc":"/api/rules/nuxt-4-nitro-shared-ssr-isolation?format=mdc","cursorrules":"/api/rules/nuxt-4-nitro-shared-ssr-isolation?format=cursor","windsurf":"/api/rules/nuxt-4-nitro-shared-ssr-isolation?format=windsurf","agents":"/api/rules/nuxt-4-nitro-shared-ssr-isolation?format=agents"}},{"id":"vite-6-environment-api-multi-runtime-isolation","title":"Vite 6 Environment API Multi-Runtime Isolation and Scoped HMR Invariant","category":"frontend","severity":"critical","description":"Vite 6 establishes independent runtime environments (client, ssr, workerd, edge) each maintaining segregated module graphs, runners, and communication channels. Plugins and servers must use environment-scoped hooks (`this.environment`), explicit `ModuleRunner` instances, and isolated HMR channels rather than deprecated global module loaders or unified WebSocket broadcasts.","antiPatternHeadline":"Cross-Runtime Graph Contamination and Unscoped Global HMR in Vite 6 Multi-Environment Setups","stars_count":109,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","vite6","environment-api","module-runner","workerd","hmr"],"exportEndpoints":{"claude":"/api/rules/vite-6-environment-api-multi-runtime-isolation?format=claude","cursorMdc":"/api/rules/vite-6-environment-api-multi-runtime-isolation?format=mdc","cursorrules":"/api/rules/vite-6-environment-api-multi-runtime-isolation?format=cursor","windsurf":"/api/rules/vite-6-environment-api-multi-runtime-isolation?format=windsurf","agents":"/api/rules/vite-6-environment-api-multi-runtime-isolation?format=agents"}},{"id":"nuxt-4-nitro-shared-ssr-state-isolation","title":"Nuxt 4 Nitro Server Engine Isolation & Shared Directory State Guardrails","category":"frontend","severity":"critical","description":"Enforces strict boundary separation between Nuxt 4 app/, server/, and shared/ directories while preventing cross-request state pollution in Nitro v2 server engines. Mandates pure, runtime-agnostic code in shared/ and strictly isolates SSR state using request-bound context and useState hydration.","antiPatternHeadline":"Cross-Request SSR State Pollution & Boundary Contamination in Nuxt 4","stars_count":63,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nuxt","nuxt4","nitro","vue","ssr","state-hydration"],"exportEndpoints":{"claude":"/api/rules/nuxt-4-nitro-shared-ssr-state-isolation?format=claude","cursorMdc":"/api/rules/nuxt-4-nitro-shared-ssr-state-isolation?format=mdc","cursorrules":"/api/rules/nuxt-4-nitro-shared-ssr-state-isolation?format=cursor","windsurf":"/api/rules/nuxt-4-nitro-shared-ssr-state-isolation?format=windsurf","agents":"/api/rules/nuxt-4-nitro-shared-ssr-state-isolation?format=agents"}},{"id":"nuxt4-nitro-engine-and-shared-isolation","title":"Nuxt 4 Nitro Server Isolation and Shared Directory Boundary Governance","category":"frontend","severity":"critical","description":"Enforces strict boundary contracts across Nuxt 4's app/, server/, and shared/ directories, preventing cross-request state contamination in Nitro server handlers and hydration mismatches during SSR. Eliminates module-scoped mutable state on the server, restricts shared/ to runtime-agnostic isomorphic code, and mandates deterministic, scoped state hydration via useState.","antiPatternHeadline":"Module-Scoped Mutable State in Nitro Handlers and Cross-Boundary Pollution via Shared Directory","stars_count":110,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nuxt4","nitro","ssr","typescript","state-hydration","vue"],"exportEndpoints":{"claude":"/api/rules/nuxt4-nitro-engine-and-shared-isolation?format=claude","cursorMdc":"/api/rules/nuxt4-nitro-engine-and-shared-isolation?format=mdc","cursorrules":"/api/rules/nuxt4-nitro-engine-and-shared-isolation?format=cursor","windsurf":"/api/rules/nuxt4-nitro-engine-and-shared-isolation?format=windsurf","agents":"/api/rules/nuxt4-nitro-engine-and-shared-isolation?format=agents"}},{"id":"nuxt4-nitro-shared-directory-ssr-isolation","title":"Nuxt 4 Nitro Server Engine Architecture & SSR State Isolation Standard","category":"frontend","severity":"critical","description":"Enforces strict boundary separation across Nuxt 4's app/, server/, and shared/ directories while eliminating cross-request state pollution in Nitro event handlers and Vue SSR composables. Mandates request-scoped context, unstorage/H3 event context over module-level singletons, and useState over global refs to prevent concurrent tenant data leakage.","antiPatternHeadline":"Cross-Request State Contamination via Global Nitro Singletons and Illegal Directory Imports","stars_count":97,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["nuxt","nuxt4","nitro","vue","ssr","typescript","architecture"],"exportEndpoints":{"claude":"/api/rules/nuxt4-nitro-shared-directory-ssr-isolation?format=claude","cursorMdc":"/api/rules/nuxt4-nitro-shared-directory-ssr-isolation?format=mdc","cursorrules":"/api/rules/nuxt4-nitro-shared-directory-ssr-isolation?format=cursor","windsurf":"/api/rules/nuxt4-nitro-shared-directory-ssr-isolation?format=windsurf","agents":"/api/rules/nuxt4-nitro-shared-directory-ssr-isolation?format=agents"}},{"id":"solidstart-server-fn-boundary-guardrail","title":"SolidStart 1.0 Server Functions (server$) and Fine-Grained Reactive Async Boundaries","category":"frontend","severity":"critical","description":"Mandates strict serialization integrity, reactive decoupling, and proper async boundary usage when executing SolidStart 1.0 server$ RPC functions. Prevents reactive closure capture, non-serializable payload passing across Nitro RPC bridges, and unhandled async state during SSR hydration.","antiPatternHeadline":"Leaking Client Signals into Server Closures and Bypassing Suspense Hydration Boundaries","stars_count":93,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","solidstart","solidjs","server-functions","reactivity","suspense","async-boundaries"],"exportEndpoints":{"claude":"/api/rules/solidstart-server-fn-boundary-guardrail?format=claude","cursorMdc":"/api/rules/solidstart-server-fn-boundary-guardrail?format=mdc","cursorrules":"/api/rules/solidstart-server-fn-boundary-guardrail?format=cursor","windsurf":"/api/rules/solidstart-server-fn-boundary-guardrail?format=windsurf","agents":"/api/rules/solidstart-server-fn-boundary-guardrail?format=agents"}},{"id":"nuxt4-nitro-shared-ssr-state-isolation-standard","title":"Nuxt 4 Nitro Server Engine, Directory Restructure, and SSR State Isolation","category":"frontend","severity":"critical","description":"Enforces strict boundary isolation between Nuxt 4's app/ layer, server/ Nitro runtime, and shared/ utilities. Prohibits global mutable state in server routes and shared modules that trigger cross-request state pollution, and prevents client-server reactivity leakage during SSR hydration.","antiPatternHeadline":"Global Module-Level State in Nitro Handlers and Shared Modules Causing Cross-Request Data Leaks and Hydration Mismatches","stars_count":84,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["nuxt","nuxt4","nitro","vue","ssr","hydration","state-management"],"exportEndpoints":{"claude":"/api/rules/nuxt4-nitro-shared-ssr-state-isolation-standard?format=claude","cursorMdc":"/api/rules/nuxt4-nitro-shared-ssr-state-isolation-standard?format=mdc","cursorrules":"/api/rules/nuxt4-nitro-shared-ssr-state-isolation-standard?format=cursor","windsurf":"/api/rules/nuxt4-nitro-shared-ssr-state-isolation-standard?format=windsurf","agents":"/api/rules/nuxt4-nitro-shared-ssr-state-isolation-standard?format=agents"}},{"id":"nuxt4-nitro-shared-directory-guardrail","title":"Nuxt 4 App Restructuring, Nitro Isolation, and Hydration Invariant","category":"frontend","severity":"critical","description":"Enforces strict isolation between Nuxt 4's app/ directory structure, the shared/ directory, and Nitro server execution contexts. Prevents cross-request SSR state leakage via module-scope singletons and ensures clean contracts for Nitro event handlers and isomorphic code.","antiPatternHeadline":"Global Module Singletons Leaking Cross-Request SSR State & Boundary Violations Across Nuxt 4 Shared/App Directories","stars_count":103,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["nuxt","nuxt4","nitro","vue","ssr","state-hydration","typescript"],"exportEndpoints":{"claude":"/api/rules/nuxt4-nitro-shared-directory-guardrail?format=claude","cursorMdc":"/api/rules/nuxt4-nitro-shared-directory-guardrail?format=mdc","cursorrules":"/api/rules/nuxt4-nitro-shared-directory-guardrail?format=cursor","windsurf":"/api/rules/nuxt4-nitro-shared-directory-guardrail?format=windsurf","agents":"/api/rules/nuxt4-nitro-shared-directory-guardrail?format=agents"}},{"id":"nuxt4-nitro-engine-shared-state-isolation","title":"Nuxt 4 Nitro Server Architecture & Cross-Request State Isolation","category":"frontend","severity":"critical","description":"Enforces strict boundary separation between Nuxt 4's app/, server/, and shared/ directories while preventing cross-request state pollution during SSR. Mandates per-request context isolation in Nitro v2 event handlers and guarantees that client-server state hydration utilizes Nuxt-managed reactive primitives rather than module-scoped singletons.","antiPatternHeadline":"Cross-Request Memory Pollution via Module-Scope State and Leaky Nitro Boundary Imports","stars_count":90,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["nuxt","nuxt4","nitro","ssr","hydration","state-isolation","vue"],"exportEndpoints":{"claude":"/api/rules/nuxt4-nitro-engine-shared-state-isolation?format=claude","cursorMdc":"/api/rules/nuxt4-nitro-engine-shared-state-isolation?format=mdc","cursorrules":"/api/rules/nuxt4-nitro-engine-shared-state-isolation?format=cursor","windsurf":"/api/rules/nuxt4-nitro-engine-shared-state-isolation?format=windsurf","agents":"/api/rules/nuxt4-nitro-engine-shared-state-isolation?format=agents"}},{"id":"nuxt4-nitro-shared-boundary-ssr-isolation","title":"Nuxt 4 Directory Separation, Nitro Context Isolation, and SSR Hydration Safeguards","category":"frontend","severity":"critical","description":"Enforces strict architectural boundaries across Nuxt 4 directory layers (`app/`, `server/`, and `shared/`) while preventing multi-tenant cross-request state contamination in Nitro server engines. Eliminates hydration mismatches and secret leakage by restricting server-only modules and stateful closures during SSR execution.","antiPatternHeadline":"Module-Level Mutable State in Nitro Handlers and Cross-Boundary Node/Client Code Imports","stars_count":68,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nuxt4","nitro","ssr","hydration","vue"],"exportEndpoints":{"claude":"/api/rules/nuxt4-nitro-shared-boundary-ssr-isolation?format=claude","cursorMdc":"/api/rules/nuxt4-nitro-shared-boundary-ssr-isolation?format=mdc","cursorrules":"/api/rules/nuxt4-nitro-shared-boundary-ssr-isolation?format=cursor","windsurf":"/api/rules/nuxt4-nitro-shared-boundary-ssr-isolation?format=windsurf","agents":"/api/rules/nuxt4-nitro-shared-boundary-ssr-isolation?format=agents"}},{"id":"solidstart-server-rpc-async-boundaries-production-standard","title":"SolidStart 1.0 Server Function Serialization & Reactive Async Boundary Isolation","category":"frontend","severity":"critical","description":"Enforces strict boundary separation between client-side reactive graphs and Vinxi/Nitro server RPCs (server$, action, query/cache). Guarantees zero leakage of non-serializable signal accessors across the network wire, prevents hydration mismatches via mandatory Suspense boundaries on createAsync, and mandates isolated server-side request context handling.","antiPatternHeadline":"Capturing Client Reactive Signals in server$ Closures and Omitting Suspense on createAsync Boundaries","stars_count":72,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","solidstart","solidjs","rpc","server-functions","reactivity","hydration"],"exportEndpoints":{"claude":"/api/rules/solidstart-server-rpc-async-boundaries-production-standard?format=claude","cursorMdc":"/api/rules/solidstart-server-rpc-async-boundaries-production-standard?format=mdc","cursorrules":"/api/rules/solidstart-server-rpc-async-boundaries-production-standard?format=cursor","windsurf":"/api/rules/solidstart-server-rpc-async-boundaries-production-standard?format=windsurf","agents":"/api/rules/solidstart-server-rpc-async-boundaries-production-standard?format=agents"}},{"id":"solidstart-server-function-reactive-boundaries","title":"Enforce Strict RPC Parameter Boundaries and Reactive Async Primitives in SolidStart 1.0","category":"frontend","severity":"critical","description":"SolidStart 1.0 server functions compiled via Nitro/Vinxi extract RPC bodies into isolated server endpoints that have no access to client-side reactive graphs. Reactive primitives (signals, stores) must never be read inside 'use server' or server$ closures; instead, read signals inside tracking scopes (createAsync or createResource) and pass plain serializable primitives as arguments to server functions cached with the cache() wrapper.","antiPatternHeadline":"Accessing Client Signals Inside Server Closures and Bypassing createAsync Hydration Caches","stars_count":55,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","solidstart","solidjs","server-functions","reactivity","ssr"],"exportEndpoints":{"claude":"/api/rules/solidstart-server-function-reactive-boundaries?format=claude","cursorMdc":"/api/rules/solidstart-server-function-reactive-boundaries?format=mdc","cursorrules":"/api/rules/solidstart-server-function-reactive-boundaries?format=cursor","windsurf":"/api/rules/solidstart-server-function-reactive-boundaries?format=windsurf","agents":"/api/rules/solidstart-server-function-reactive-boundaries?format=agents"}},{"id":"nuxt4-nitro-shared-directory-architecture","title":"Nuxt 4 Nitro Server Engine Isolation and Shared Directory Invariants","category":"frontend","severity":"critical","description":"Nuxt 4 transitions to an explicit `app/` directory root and introduces the top-level `shared/` directory alongside the Nitro v2 engine. Un-isolated module-level state in Nitro event handlers or leaking client-side reactive state into server runtime scopes causes cross-request pollution and catastrophic SSR state hydration mismatches.","antiPatternHeadline":"Cross-Request State Leaks and Illegal Runtime Boundary Imports in Nuxt 4 / Nitro","stars_count":48,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["nuxt4","nitro","vue","ssr","architecture","typescript"],"exportEndpoints":{"claude":"/api/rules/nuxt4-nitro-shared-directory-architecture?format=claude","cursorMdc":"/api/rules/nuxt4-nitro-shared-directory-architecture?format=mdc","cursorrules":"/api/rules/nuxt4-nitro-shared-directory-architecture?format=cursor","windsurf":"/api/rules/nuxt4-nitro-shared-directory-architecture?format=windsurf","agents":"/api/rules/nuxt4-nitro-shared-directory-architecture?format=agents"}},{"id":"nuxt4-nitro-shared-state-isolation","title":"Nuxt 4 Nitro Server Engine Isolation & Shared Directory Boundary Enforcement","category":"frontend","severity":"critical","description":"Enforces strict boundary isolation between Nuxt 4's app/ directory, Nitro server runtime, and isomorphic shared/ directory. Prevents catastrophic cross-request state pollution in Nitro handlers and ensures client/server hydration parity without runtime capability leaks.","antiPatternHeadline":"Global Module-Level State in Nitro Handlers and Client/Server Leaks in the Shared Directory","stars_count":49,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nuxt","nuxt4","nitro","ssr","typescript","security"],"exportEndpoints":{"claude":"/api/rules/nuxt4-nitro-shared-state-isolation?format=claude","cursorMdc":"/api/rules/nuxt4-nitro-shared-state-isolation?format=mdc","cursorrules":"/api/rules/nuxt4-nitro-shared-state-isolation?format=cursor","windsurf":"/api/rules/nuxt4-nitro-shared-state-isolation?format=windsurf","agents":"/api/rules/nuxt4-nitro-shared-state-isolation?format=agents"}},{"id":"nuxt-4-nitro-shared-state-isolation","title":"Nuxt 4 Nitro Server Engine, Shared Directory, and SSR State Isolation","category":"frontend","severity":"critical","description":"Enforces strict boundary separation between Nuxt 4's app/ directory, Nitro server runtime, and shared/ isomorphic layer. Prevents cross-request state pollution, runtime leakage of server-only secrets into client hydrations, and invalid cross-domain module imports.","antiPatternHeadline":"Global Module-Level State in Nitro Handlers and Leakage of Server Logic via Shared Directory","stars_count":106,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nuxt4","nitro","ssr","vue3","hydration","state-pollution"],"exportEndpoints":{"claude":"/api/rules/nuxt-4-nitro-shared-state-isolation?format=claude","cursorMdc":"/api/rules/nuxt-4-nitro-shared-state-isolation?format=mdc","cursorrules":"/api/rules/nuxt-4-nitro-shared-state-isolation?format=cursor","windsurf":"/api/rules/nuxt-4-nitro-shared-state-isolation?format=windsurf","agents":"/api/rules/nuxt-4-nitro-shared-state-isolation?format=agents"}},{"id":"solidstart-server-rpc-reactive-boundaries","title":"SolidStart 1.0 Server RPC Serialization and Reactive Tracking Boundaries","category":"frontend","severity":"critical","description":"Mandate strict separation between client-side fine-grained reactivity and SolidStart 1.0 server$ and query RPC execution contexts. Signals and reactive accessors cannot cross RPC boundaries via closure capture or direct parameter binding; parameters must be passed as serializable values inside createAsync accessors to maintain reactive invalidation without breaking serialization or losing tracking.","antiPatternHeadline":"Capturing Client Signals in Server Function Closures or Passing Signal Accessors Directly to RPCs","stars_count":67,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","solidstart","server-functions","reactivity","rpc","serialization"],"exportEndpoints":{"claude":"/api/rules/solidstart-server-rpc-reactive-boundaries?format=claude","cursorMdc":"/api/rules/solidstart-server-rpc-reactive-boundaries?format=mdc","cursorrules":"/api/rules/solidstart-server-rpc-reactive-boundaries?format=cursor","windsurf":"/api/rules/solidstart-server-rpc-reactive-boundaries?format=windsurf","agents":"/api/rules/solidstart-server-rpc-reactive-boundaries?format=agents"}},{"id":"solidstart-server-functions-async-boundaries-production-standard","title":"SolidStart 1.0 Server Function Isolation & Async Reactive Boundary Standard","category":"frontend","severity":"critical","description":"Enforces strict boundaries between client reactive graphs and Vinxi/Nitro RPC server execution in SolidStart 1.0. Prevents closure leaks over reactive signals, guarantees serialization integrity across HTTP RPC barriers, and mandates Suspense-wrapped createAsync consumption to eliminate hydration mismatches.","antiPatternHeadline":"Capturing Reactive Client Signals Inside server$ Closures or Calling RPCs Without createAsync & Suspense Isolation","stars_count":115,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","solidstart","solidjs","server-functions","reactivity","suspense"],"exportEndpoints":{"claude":"/api/rules/solidstart-server-functions-async-boundaries-production-standard?format=claude","cursorMdc":"/api/rules/solidstart-server-functions-async-boundaries-production-standard?format=mdc","cursorrules":"/api/rules/solidstart-server-functions-async-boundaries-production-standard?format=cursor","windsurf":"/api/rules/solidstart-server-functions-async-boundaries-production-standard?format=windsurf","agents":"/api/rules/solidstart-server-functions-async-boundaries-production-standard?format=agents"}},{"id":"nuxt4-nitro-shared-ssr-state-guardrails","title":"Nuxt 4 Nitro Server Isolation, Shared Layer Contracts, and SSR State Hydration Guardrails","category":"frontend","severity":"critical","description":"Enforces strict architectural boundaries across the Nuxt 4 app/ directory, Nitro v2 server engine, and shared/ directory. Eliminates cross-request state pollution, server-side credential leakage in SSR payload hydration, and un-isolated module-level singletons in persistent worker runtimes.","antiPatternHeadline":"Cross-Request State Pollution via Module Singletons and Server Secrets Leaked in SSR Hydration","stars_count":41,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["nuxt4","nitro","vue","ssr","hydration","security","shared-directory"],"exportEndpoints":{"claude":"/api/rules/nuxt4-nitro-shared-ssr-state-guardrails?format=claude","cursorMdc":"/api/rules/nuxt4-nitro-shared-ssr-state-guardrails?format=mdc","cursorrules":"/api/rules/nuxt4-nitro-shared-ssr-state-guardrails?format=cursor","windsurf":"/api/rules/nuxt4-nitro-shared-ssr-state-guardrails?format=windsurf","agents":"/api/rules/nuxt4-nitro-shared-ssr-state-guardrails?format=agents"}},{"id":"solidstart-server-fn-boundary-isolation","title":"SolidStart 1.0 Server Function Boundary Isolation & Signal Tracking","category":"frontend","severity":"critical","description":"Mandates strict network and serialization boundary isolation for SolidStart 1.0 server$ functions and cache/createAsync primitives. Prevents client signal closure leakage into server boundaries, eliminates stale reactive closures, and guarantees deterministic hydration through mandatory Suspense boundaries.","antiPatternHeadline":"Closing over client signals inside server$ closures or omitting reactive accessor wrappers in createAsync","stars_count":91,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["solidstart","solidjs","server-functions","signals","async-boundaries","hydration"],"exportEndpoints":{"claude":"/api/rules/solidstart-server-fn-boundary-isolation?format=claude","cursorMdc":"/api/rules/solidstart-server-fn-boundary-isolation?format=mdc","cursorrules":"/api/rules/solidstart-server-fn-boundary-isolation?format=cursor","windsurf":"/api/rules/solidstart-server-fn-boundary-isolation?format=windsurf","agents":"/api/rules/solidstart-server-fn-boundary-isolation?format=agents"}},{"id":"nuxt4-nitro-shared-directory-ssr-isolation-standard","title":"Nuxt 4 Nitro Engine, Shared Directory, and SSR State Isolation","category":"frontend","severity":"critical","description":"Enforces strict boundary separation across Nuxt 4's app/, server/, and shared/ directory architecture. Eliminates multi-tenant cross-request state pollution in Nitro v2 event handlers and SSR composables, ensuring hydration safety and runtime-agnostic isomorphic code.","antiPatternHeadline":"Module-Level State Bleed and Cross-Boundary Runtime Contamination in Nuxt 4","stars_count":84,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nuxt4","nitro","ssr","vue","typescript","state-hydration"],"exportEndpoints":{"claude":"/api/rules/nuxt4-nitro-shared-directory-ssr-isolation-standard?format=claude","cursorMdc":"/api/rules/nuxt4-nitro-shared-directory-ssr-isolation-standard?format=mdc","cursorrules":"/api/rules/nuxt4-nitro-shared-directory-ssr-isolation-standard?format=cursor","windsurf":"/api/rules/nuxt4-nitro-shared-directory-ssr-isolation-standard?format=windsurf","agents":"/api/rules/nuxt4-nitro-shared-directory-ssr-isolation-standard?format=agents"}},{"id":"nuxt4-nitro-shared-directory-isolation-guardrail","title":"Nuxt 4 Nitro Isolation, Shared Directory Boundaries, and SSR State Hydration","category":"frontend","severity":"critical","description":"Enforces strict architectural isolation across Nuxt 4 app/, server/, and shared/ directory boundaries to prevent cross-request state pollution in Nitro and SSR hydration mismatches. Prohibits module-scoped state in Nitro route handlers and guarantees shared/ contains only runtime-agnostic, side-effect-free code devoid of server secrets or client-only APIs.","antiPatternHeadline":"Module-Level Nitro State Leakage and Shared Directory Secret Contamination Causing SSR Hydration Mismatches","stars_count":44,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nuxt4","nitro","ssr","hydration","state-pollution","vue3"],"exportEndpoints":{"claude":"/api/rules/nuxt4-nitro-shared-directory-isolation-guardrail?format=claude","cursorMdc":"/api/rules/nuxt4-nitro-shared-directory-isolation-guardrail?format=mdc","cursorrules":"/api/rules/nuxt4-nitro-shared-directory-isolation-guardrail?format=cursor","windsurf":"/api/rules/nuxt4-nitro-shared-directory-isolation-guardrail?format=windsurf","agents":"/api/rules/nuxt4-nitro-shared-directory-isolation-guardrail?format=agents"}},{"id":"nuxt4-nitro-shared-ssr-hydration-guardrail","title":"Nuxt 4 Directory Restructuring & Nitro Isolated State Guardrail","category":"frontend","severity":"critical","description":"Enforces strict boundary isolation across Nuxt 4's app/, server/, and shared/ directories, preventing cross-request state leakage in Nitro v2 server handlers. Mandates that universal utilities residing in shared/ remain side-effect free and client-safe, while ensuring SSR state hydration leverages unpolluted, request-scoped contexts.","antiPatternHeadline":"Global Mutable State Pollution in Nitro Handlers and Leaking Server Context via shared/","stars_count":71,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["nuxt4","nitro","vue","ssr","hydration","cross-request-state-leak"],"exportEndpoints":{"claude":"/api/rules/nuxt4-nitro-shared-ssr-hydration-guardrail?format=claude","cursorMdc":"/api/rules/nuxt4-nitro-shared-ssr-hydration-guardrail?format=mdc","cursorrules":"/api/rules/nuxt4-nitro-shared-ssr-hydration-guardrail?format=cursor","windsurf":"/api/rules/nuxt4-nitro-shared-ssr-hydration-guardrail?format=windsurf","agents":"/api/rules/nuxt4-nitro-shared-ssr-hydration-guardrail?format=agents"}},{"id":"nuxt4-nitro-shared-ssr-guardrails","title":"Nuxt 4 Nitro Server Engine, Shared Directory, and SSR State Isolation","category":"frontend","severity":"critical","description":"Enforces strict boundary separation between Nuxt 4's app/ directory, Nitro server runtime, and shared/ utilities. Prevents cross-request state pollution, runtime leakage of server-only primitives into client bundles, and un-isolated SSR state hydration bugs.","antiPatternHeadline":"Global Module-Level State in Nitro Handlers and Cross-Polluting Shared Directory Imports","stars_count":78,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nuxt4","nitro","ssr","hydration","typescript","vue"],"exportEndpoints":{"claude":"/api/rules/nuxt4-nitro-shared-ssr-guardrails?format=claude","cursorMdc":"/api/rules/nuxt4-nitro-shared-ssr-guardrails?format=mdc","cursorrules":"/api/rules/nuxt4-nitro-shared-ssr-guardrails?format=cursor","windsurf":"/api/rules/nuxt4-nitro-shared-ssr-guardrails?format=windsurf","agents":"/api/rules/nuxt4-nitro-shared-ssr-guardrails?format=agents"}},{"id":"solidstart-server-function-boundaries","title":"SolidStart 1.0 Server Function Serialization and Async Boundary Guardrails","category":"frontend","severity":"critical","description":"Enforces strict isolation between client reactive signal graphs and SolidStart 1.0 server$ RPC functions. Prevents bundling leaks, closure state corruption, and silent reactivity failures by requiring explicit serializable arguments, validation schemas, and createAsync tracking wrappers.","antiPatternHeadline":"Accessing Client Signals Directly in server$ Closures and Calling RPCs Without createAsync","stars_count":58,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","solidjs","solidstart","reactivity","rpc"],"exportEndpoints":{"claude":"/api/rules/solidstart-server-function-boundaries?format=claude","cursorMdc":"/api/rules/solidstart-server-function-boundaries?format=mdc","cursorrules":"/api/rules/solidstart-server-function-boundaries?format=cursor","windsurf":"/api/rules/solidstart-server-function-boundaries?format=windsurf","agents":"/api/rules/solidstart-server-function-boundaries?format=agents"}},{"id":"solidstart-server-rpc-signal-boundary","title":"SolidStart 1.0 server$ RPC Boundaries and Fine-Grained Reactive Isolation","category":"frontend","severity":"critical","description":"Enforces strict lexical and serialization boundaries when authoring SolidStart server$ RPCs and integrating them with fine-grained reactivity. Prohibits closing over client-side signals inside server functions and mandates explicit argument serialization, query/action wrapping, and Suspense boundary containment.","antiPatternHeadline":"Closing Over Client Signals Inside server$ Functions and Bypassing Suspense Boundaries","stars_count":113,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","solidstart","solidjs","server-functions","reactivity","suspense"],"exportEndpoints":{"claude":"/api/rules/solidstart-server-rpc-signal-boundary?format=claude","cursorMdc":"/api/rules/solidstart-server-rpc-signal-boundary?format=mdc","cursorrules":"/api/rules/solidstart-server-rpc-signal-boundary?format=cursor","windsurf":"/api/rules/solidstart-server-rpc-signal-boundary?format=windsurf","agents":"/api/rules/solidstart-server-rpc-signal-boundary?format=agents"}},{"id":"nuxt4-nitro-shared-directory-hydration-isolation","title":"Nuxt 4 Nitro Engine, Shared Directory Architecture, and SSR State Isolation","category":"frontend","severity":"critical","description":"Enforces strict boundaries in Nuxt 4 projects between the restructured app/ client workspace, Nitro v2 server/ engine, and shared/ isomorphic directory. Prevents cross-boundary leakage of server secrets into client bundles, stops module-level mutable state leaks across concurrent SSR requests, and guarantees deterministic client-side hydration.","antiPatternHeadline":"Cross-boundary module imports and un-isolated global server singletons causing SSR cross-request state pollution and hydration mismatches","stars_count":78,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["nuxt4","nitro","vue","ssr","hydration","typescript"],"exportEndpoints":{"claude":"/api/rules/nuxt4-nitro-shared-directory-hydration-isolation?format=claude","cursorMdc":"/api/rules/nuxt4-nitro-shared-directory-hydration-isolation?format=mdc","cursorrules":"/api/rules/nuxt4-nitro-shared-directory-hydration-isolation?format=cursor","windsurf":"/api/rules/nuxt4-nitro-shared-directory-hydration-isolation?format=windsurf","agents":"/api/rules/nuxt4-nitro-shared-directory-hydration-isolation?format=agents"}},{"id":"nuxt4-nitro-shared-ssr-boundary-isolation","title":"Nuxt 4 Nitro Server Engine, Shared Directory, and SSR State Isolation","category":"frontend","severity":"critical","description":"Mandates strict architectural separation across Nuxt 4's app/, server/, and shared/ directories to prevent server-side runtime leakage and cross-request state pollution (CRSP). Enforces isomorphic purity in shared/, request-scoped lifecycle handling in Nitro handlers, and SSR-safe state hydration via useState.","antiPatternHeadline":"Global Module-Level State Pollution and Cross-Boundary Runtime Leakage in Nuxt 4","stars_count":59,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nuxt4","nitro","vue","ssr","typescript"],"exportEndpoints":{"claude":"/api/rules/nuxt4-nitro-shared-ssr-boundary-isolation?format=claude","cursorMdc":"/api/rules/nuxt4-nitro-shared-ssr-boundary-isolation?format=mdc","cursorrules":"/api/rules/nuxt4-nitro-shared-ssr-boundary-isolation?format=cursor","windsurf":"/api/rules/nuxt4-nitro-shared-ssr-boundary-isolation?format=windsurf","agents":"/api/rules/nuxt4-nitro-shared-ssr-boundary-isolation?format=agents"}},{"id":"nuxt-4-nitro-shared-ssr-isolation-standard","title":"Nuxt 4 Nitro Server Engine & Shared Directory State Isolation Standard","category":"frontend","severity":"critical","description":"Enforces strict boundary isolation across Nuxt 4's app/ directory, Nitro server engine, and shared/ utilities. Prevents catastrophic cross-request state pollution during SSR hydration and ensures clean execution contexts between client, Nitro runtime, and shared code.","antiPatternHeadline":"Leaking Module-Level Mutable State Across Concurrent SSR Requests in Nitro Handlers and Shared Utilities","stars_count":52,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nuxt4","nitro","ssr","vue3","hydration","state-pollution"],"exportEndpoints":{"claude":"/api/rules/nuxt-4-nitro-shared-ssr-isolation-standard?format=claude","cursorMdc":"/api/rules/nuxt-4-nitro-shared-ssr-isolation-standard?format=mdc","cursorrules":"/api/rules/nuxt-4-nitro-shared-ssr-isolation-standard?format=cursor","windsurf":"/api/rules/nuxt-4-nitro-shared-ssr-isolation-standard?format=windsurf","agents":"/api/rules/nuxt-4-nitro-shared-ssr-isolation-standard?format=agents"}},{"id":"nuxt4-nitro-shared-directory-state-isolation","title":"Nuxt 4 Nitro Server Engine & Shared Directory State Isolation Standards","category":"frontend","severity":"critical","description":"Enforces strict architectural boundaries and execution context isolation in Nuxt 4, isolating Nitro server engine logic from the app/ directory via the root shared/ boundary. Prevents catastrophic cross-request state pollution during SSR hydration, illegal cross-boundary runtime imports, and leaks of server-only secrets into client bundles.","antiPatternHeadline":"Cross-Request SSR State Pollution via Nitro Module-Level Singletons and Direct App-to-Server Imports","stars_count":96,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["nuxt4","nitro","vue","ssr","typescript","hydration","state-management"],"exportEndpoints":{"claude":"/api/rules/nuxt4-nitro-shared-directory-state-isolation?format=claude","cursorMdc":"/api/rules/nuxt4-nitro-shared-directory-state-isolation?format=mdc","cursorrules":"/api/rules/nuxt4-nitro-shared-directory-state-isolation?format=cursor","windsurf":"/api/rules/nuxt4-nitro-shared-directory-state-isolation?format=windsurf","agents":"/api/rules/nuxt4-nitro-shared-directory-state-isolation?format=agents"}},{"id":"nuxt-4-nitro-shared-directory-guardrail","title":"Nuxt 4 Directory Restructuring, Nitro v2 Engine, and SSR State Isolation","category":"frontend","severity":"critical","description":"Nuxt 4 introduces a restructured root architecture consolidating frontend code into 'app/' alongside a dual-targeted 'shared/' directory and Nitro v2 runtime. Improper placement of server logic in shared directories or leaking cross-request state via module-scoped singletons on the Nitro engine causes severe security breaches and memory leaks across concurrent SSR sessions.","antiPatternHeadline":"Global SSR Singleton State Leakage and Cross-Context Contamination in Shared/Nitro Layers","stars_count":68,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["nuxt","nuxt4","nitro","vue","ssr","typescript"],"exportEndpoints":{"claude":"/api/rules/nuxt-4-nitro-shared-directory-guardrail?format=claude","cursorMdc":"/api/rules/nuxt-4-nitro-shared-directory-guardrail?format=mdc","cursorrules":"/api/rules/nuxt-4-nitro-shared-directory-guardrail?format=cursor","windsurf":"/api/rules/nuxt-4-nitro-shared-directory-guardrail?format=windsurf","agents":"/api/rules/nuxt-4-nitro-shared-directory-guardrail?format=agents"}},{"id":"solidstart-server-rpc-async-boundaries-guardrail","title":"SolidStart 1.0 Server Function Boundaries & Fine-Grained Reactive Serialization","category":"frontend","severity":"critical","description":"Enforces strict isolation between SolidJS fine-grained reactivity and SolidStart 1.0 server$ RPC boundaries. Prohibits capturing client-side signals inside server closures and mandates wrapping server queries inside query/cache and createAsync within Suspense boundaries to prevent hydration mismatches and broken tracking roots.","antiPatternHeadline":"Capturing reactive signal accessors inside server$ closures or invoking naked server RPC promises within reactive render bodies","stars_count":72,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","solidstart","solidjs","server-functions","reactivity","async-boundaries","vinxi"],"exportEndpoints":{"claude":"/api/rules/solidstart-server-rpc-async-boundaries-guardrail?format=claude","cursorMdc":"/api/rules/solidstart-server-rpc-async-boundaries-guardrail?format=mdc","cursorrules":"/api/rules/solidstart-server-rpc-async-boundaries-guardrail?format=cursor","windsurf":"/api/rules/solidstart-server-rpc-async-boundaries-guardrail?format=windsurf","agents":"/api/rules/solidstart-server-rpc-async-boundaries-guardrail?format=agents"}},{"id":"nuxt-4-nitro-shared-directory-isolation-standard","title":"Nuxt 4 Nitro Server Engine & Shared Directory Cross-Boundary Isolation","category":"frontend","severity":"critical","description":"Nuxt 4 formalizes the `app/` and `shared/` directory structures alongside Nitro v2 server routes. Shared code between Nitro and the Vue rendering engine must remain strictly stateless, pure, and free from runtime-specific globals, while client/server state hydration must occur exclusively through `useState` or context-isolated stores to avoid multi-tenant cross-request state pollution during SSR.","antiPatternHeadline":"Global Singletons in Nitro/Shared Directories and Leaking Server Context into SSR Hydration","stars_count":43,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["nuxt4","nitro","vue3","ssr","hydration","cross-request-state-pollution"],"exportEndpoints":{"claude":"/api/rules/nuxt-4-nitro-shared-directory-isolation-standard?format=claude","cursorMdc":"/api/rules/nuxt-4-nitro-shared-directory-isolation-standard?format=mdc","cursorrules":"/api/rules/nuxt-4-nitro-shared-directory-isolation-standard?format=cursor","windsurf":"/api/rules/nuxt-4-nitro-shared-directory-isolation-standard?format=windsurf","agents":"/api/rules/nuxt-4-nitro-shared-directory-isolation-standard?format=agents"}},{"id":"nuxt-4-nitro-shared-ssr-state-guardrail","title":"Nuxt 4 Directory Restructuring, Nitro Context & SSR State Isolation","category":"frontend","severity":"critical","description":"Enforces Nuxt 4 directory architecture (isolating application code inside `app/` and shared cross-runtime logic inside `shared/`), strict Nitro server-route context management, and per-request SSR state isolation. Prohibits global module-level mutable singletons and cross-boundary runtime contamination between Nitro server routes and Vue client code.","antiPatternHeadline":"Global Module-Level State Bleed and Invalid Directory Cross-Imports Across Nuxt 4 Runtimes","stars_count":100,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nuxt4","nitro","ssr","vue3","typescript"],"exportEndpoints":{"claude":"/api/rules/nuxt-4-nitro-shared-ssr-state-guardrail?format=claude","cursorMdc":"/api/rules/nuxt-4-nitro-shared-ssr-state-guardrail?format=mdc","cursorrules":"/api/rules/nuxt-4-nitro-shared-ssr-state-guardrail?format=cursor","windsurf":"/api/rules/nuxt-4-nitro-shared-ssr-state-guardrail?format=windsurf","agents":"/api/rules/nuxt-4-nitro-shared-ssr-state-guardrail?format=agents"}},{"id":"nuxt-4-nitro-engine-shared-state-isolation","title":"Nuxt 4 Nitro Engine Boundaries, Shared Directory Invariants, and SSR State Isolation","category":"frontend","severity":"critical","description":"Mandates strict architectural boundaries between Nuxt 4's `app/` presentation layer, Nitro `server/` runtime, and the universal `shared/` directory. Enforces request-scoped state encapsulation using `useState()` and `H3Event` context to prevent cross-request memory contamination and SSR hydration mismatches.","antiPatternHeadline":"Global Module-Level State Bleed in Nitro Handlers and Direct Client-Server Cross-Boundary Imports","stars_count":81,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["nuxt4","nitro","ssr-hydration","vue","typescript","architecture"],"exportEndpoints":{"claude":"/api/rules/nuxt-4-nitro-engine-shared-state-isolation?format=claude","cursorMdc":"/api/rules/nuxt-4-nitro-engine-shared-state-isolation?format=mdc","cursorrules":"/api/rules/nuxt-4-nitro-engine-shared-state-isolation?format=cursor","windsurf":"/api/rules/nuxt-4-nitro-engine-shared-state-isolation?format=windsurf","agents":"/api/rules/nuxt-4-nitro-engine-shared-state-isolation?format=agents"}},{"id":"nuxt4-nitro-shared-ssr-boundary-guardrail","title":"Nuxt 4 Nitro Engine Isolation and Shared Directory SSR Invariants","category":"frontend","severity":"critical","description":"Enforces strict execution-context isolation between Nuxt 4 app/, server/, and shared/ directories. Prohibits top-level mutable state in Nitro handlers to prevent cross-request tenant bleed and guarantees safe SSR hydration serialization.","antiPatternHeadline":"Cross-Request State Pollution via Top-Level Nitro Variables and Leaky Shared Directory Contexts","stars_count":109,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nuxt4","nitro","ssr","vue3","state-hydration","security"],"exportEndpoints":{"claude":"/api/rules/nuxt4-nitro-shared-ssr-boundary-guardrail?format=claude","cursorMdc":"/api/rules/nuxt4-nitro-shared-ssr-boundary-guardrail?format=mdc","cursorrules":"/api/rules/nuxt4-nitro-shared-ssr-boundary-guardrail?format=cursor","windsurf":"/api/rules/nuxt4-nitro-shared-ssr-boundary-guardrail?format=windsurf","agents":"/api/rules/nuxt4-nitro-shared-ssr-boundary-guardrail?format=agents"}},{"id":"nuxt4-nitro-shared-ssr-hydration-guardrails","title":"Nuxt 4 Directory Topology, Nitro State Isolation, and Shared Module Purity","category":"frontend","severity":"critical","description":"Enforces strict architectural boundaries across the Nuxt 4 app/, server/, and shared/ directory structure, preventing cross-request state pollution in Nitro v2 execution contexts. Guarantees pure platform-agnostic shared utilities and hydration-safe SSR state allocation.","antiPatternHeadline":"Cross-Request State Leakage in Nitro Handlers and Platform Contamination in Shared Directory","stars_count":44,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nuxt4","nitro","ssr","hydration","vue"],"exportEndpoints":{"claude":"/api/rules/nuxt4-nitro-shared-ssr-hydration-guardrails?format=claude","cursorMdc":"/api/rules/nuxt4-nitro-shared-ssr-hydration-guardrails?format=mdc","cursorrules":"/api/rules/nuxt4-nitro-shared-ssr-hydration-guardrails?format=cursor","windsurf":"/api/rules/nuxt4-nitro-shared-ssr-hydration-guardrails?format=windsurf","agents":"/api/rules/nuxt4-nitro-shared-ssr-hydration-guardrails?format=agents"}},{"id":"nuxt-4-nitro-shared-directory-ssr-isolation-standard","title":"Nuxt 4 Directory Restructuring, Nitro Route Handlers, and SSR State Isolation","category":"frontend","severity":"critical","description":"Nuxt 4 transitions all client application code into the app/ directory while Nitro server execution operates strictly under server/ and cross-runtime shared logic resides in shared/. Direct state mutation across runtime boundaries or module-level shared variables in Nitro handlers leads to cross-request state leakage, memory leaks, and SSR hydration mismatches.","antiPatternHeadline":"Cross-Request State Contamination via Global Nitro State and Legacy Root Directory Imports in Nuxt 4","stars_count":102,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nuxt","nuxt4","nitro","vue","ssr","typescript"],"exportEndpoints":{"claude":"/api/rules/nuxt-4-nitro-shared-directory-ssr-isolation-standard?format=claude","cursorMdc":"/api/rules/nuxt-4-nitro-shared-directory-ssr-isolation-standard?format=mdc","cursorrules":"/api/rules/nuxt-4-nitro-shared-directory-ssr-isolation-standard?format=cursor","windsurf":"/api/rules/nuxt-4-nitro-shared-directory-ssr-isolation-standard?format=windsurf","agents":"/api/rules/nuxt-4-nitro-shared-directory-ssr-isolation-standard?format=agents"}},{"id":"nuxt4-nitro-ssr-isolation-shared-boundaries","title":"Nuxt 4 Nitro Isolation, Shared Directory Boundaries, and SSR State Leak Prevention","category":"frontend","severity":"critical","description":"Enforces strict architectural separation between Nitro v2 server routes (server/), isomorphic contracts (shared/), and client application logic (app/) in Nuxt 4. Eliminates critical SSR cross-request state pollution and hydration mismatches caused by module-level mutable variables and illegal runtime imports.","antiPatternHeadline":"Cross-Request State Pollution via Module-Scoped State and Boundary Bleed Between Server, App, and Shared Directories","stars_count":48,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nuxt","nuxt4","nitro","ssr","vue","hydration","state-management"],"exportEndpoints":{"claude":"/api/rules/nuxt4-nitro-ssr-isolation-shared-boundaries?format=claude","cursorMdc":"/api/rules/nuxt4-nitro-ssr-isolation-shared-boundaries?format=mdc","cursorrules":"/api/rules/nuxt4-nitro-ssr-isolation-shared-boundaries?format=cursor","windsurf":"/api/rules/nuxt4-nitro-ssr-isolation-shared-boundaries?format=windsurf","agents":"/api/rules/nuxt4-nitro-ssr-isolation-shared-boundaries?format=agents"}},{"id":"nuxt4-nitro-shared-directory-ssr-isolation-guardrail","title":"Nuxt 4 Nitro Server Engine & Shared Directory SSR State Isolation Standard","category":"frontend","severity":"critical","description":"Nuxt 4 transitions the client application root to the app/ directory while leveraging shared/ for universal types and constants, requiring complete boundary isolation from the server/ Nitro runtime. Un-isolated global module-level state in Nitro event handlers or shared modules leaks across concurrent SSR request contexts, resulting in cross-tenant data corruption and security compromise.","antiPatternHeadline":"Global Module-Scope Mutable State Leakage in Nitro Handlers and Improper Nuxt 4 Directory Cross-Imports","stars_count":108,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nuxt4","nitro","ssr-hydration","cross-tenant-leak","vue"],"exportEndpoints":{"claude":"/api/rules/nuxt4-nitro-shared-directory-ssr-isolation-guardrail?format=claude","cursorMdc":"/api/rules/nuxt4-nitro-shared-directory-ssr-isolation-guardrail?format=mdc","cursorrules":"/api/rules/nuxt4-nitro-shared-directory-ssr-isolation-guardrail?format=cursor","windsurf":"/api/rules/nuxt4-nitro-shared-directory-ssr-isolation-guardrail?format=windsurf","agents":"/api/rules/nuxt4-nitro-shared-directory-ssr-isolation-guardrail?format=agents"}},{"id":"nuxt-4-nitro-shared-directory-isolation-guardrail","title":"Nuxt 4 Nitro Engine Isolation and Shared Directory Boundary Integrity","category":"frontend","severity":"critical","description":"Enforces architectural isolation between the Nuxt 4 client layer (app/), server runtime engine (server/), and universally shared code (shared/). Guarantees the prevention of cross-request state contamination in Nitro v2 event handlers and prevents leakage of server-only secrets or Node.js primitives into isomorphic shared modules.","antiPatternHeadline":"Module-Scope State Mutation in Nitro Handlers and Server-Boundary Leakage into Shared Layer","stars_count":103,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nuxt4","nitro","ssr","hydration","cross-request-state-pollution"],"exportEndpoints":{"claude":"/api/rules/nuxt-4-nitro-shared-directory-isolation-guardrail?format=claude","cursorMdc":"/api/rules/nuxt-4-nitro-shared-directory-isolation-guardrail?format=mdc","cursorrules":"/api/rules/nuxt-4-nitro-shared-directory-isolation-guardrail?format=cursor","windsurf":"/api/rules/nuxt-4-nitro-shared-directory-isolation-guardrail?format=windsurf","agents":"/api/rules/nuxt-4-nitro-shared-directory-isolation-guardrail?format=agents"}},{"id":"nuxt4-nitro-shared-directory-isolation-production-standard","title":"Nuxt 4 Nitro Server Architecture & Shared Directory Hydration Guardrail","category":"frontend","severity":"critical","description":"Enforces strict isolation across the Nuxt 4 directory topology (`app/`, `server/`, and `shared/`) to prevent SSR cross-request state pollution, Nitro runtime memory leaks, and hydration mismatches. Restricts the `shared/` directory to pure isomorphic code free from client- or server-specific side effects, and bans module-scoped mutable state in Nitro handlers and Vue composables.","antiPatternHeadline":"Leaking Cross-Request Tenant State via Nitro Module Globals and Impure Shared Imports","stars_count":73,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nuxt4","nitro","ssr","state-hydration","memory-leaks"],"exportEndpoints":{"claude":"/api/rules/nuxt4-nitro-shared-directory-isolation-production-standard?format=claude","cursorMdc":"/api/rules/nuxt4-nitro-shared-directory-isolation-production-standard?format=mdc","cursorrules":"/api/rules/nuxt4-nitro-shared-directory-isolation-production-standard?format=cursor","windsurf":"/api/rules/nuxt4-nitro-shared-directory-isolation-production-standard?format=windsurf","agents":"/api/rules/nuxt4-nitro-shared-directory-isolation-production-standard?format=agents"}},{"id":"solidstart-server-function-boundary-invariants","title":"SolidStart 1.0 server$ RPC Boundaries and Reactive Async Invariants","category":"frontend","severity":"critical","description":"Mandates strict isolation between SolidStart 1.0 server functions (server$) and client-side reactive scopes. Enforces explicit parameter serialization, prevents closure leaks of reactive signals into server boundaries, and requires createAsync or cache wrappers to prevent Suspense boundary drops and hydration mismatches.","antiPatternHeadline":"Closing over client signals inside server$ RPCs or calling raw server functions in synchronous tracking contexts.","stars_count":105,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","solidstart","solidjs","server-functions","reactivity","vinxi","async-boundaries"],"exportEndpoints":{"claude":"/api/rules/solidstart-server-function-boundary-invariants?format=claude","cursorMdc":"/api/rules/solidstart-server-function-boundary-invariants?format=mdc","cursorrules":"/api/rules/solidstart-server-function-boundary-invariants?format=cursor","windsurf":"/api/rules/solidstart-server-function-boundary-invariants?format=windsurf","agents":"/api/rules/solidstart-server-function-boundary-invariants?format=agents"}},{"id":"nuxt-4-nitro-shared-boundary-guardrail","title":"Nuxt 4 Nitro Engine & Shared Directory SSR Hydration Isolation","category":"frontend","severity":"critical","description":"Enforces strict boundary separation between Nuxt 4's app/, server/, and shared/ directories to prevent cross-request SSR state leaks and bundle contamination. Mandates request-scoped context isolation within Nitro v2 event handlers and strictly serializable, payload-safe contracts across the shared directory.","antiPatternHeadline":"Global Mutable State Leaks Across SSR Requests and Server-Only Context Spills into Shared Boundaries","stars_count":54,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["nuxt","nuxt4","nitro","ssr","typescript","vue"],"exportEndpoints":{"claude":"/api/rules/nuxt-4-nitro-shared-boundary-guardrail?format=claude","cursorMdc":"/api/rules/nuxt-4-nitro-shared-boundary-guardrail?format=mdc","cursorrules":"/api/rules/nuxt-4-nitro-shared-boundary-guardrail?format=cursor","windsurf":"/api/rules/nuxt-4-nitro-shared-boundary-guardrail?format=windsurf","agents":"/api/rules/nuxt-4-nitro-shared-boundary-guardrail?format=agents"}},{"id":"nuxt4-nitro-shared-ssr-isolation-production-standard","title":"Nuxt 4 Nitro Engine Isolation and Shared Directory SSR Hydration Guardrails","category":"frontend","severity":"critical","description":"Nuxt 4 establishes a strict architectural boundary by moving client application code into the 'app/' directory, isolating Nitro engine handlers in 'server/', and allowing shared isomorphic utilities solely through 'shared/'. Global or module-level variable declarations within Nitro handlers or shared utilities cause critical cross-request memory leaks and data pollution across concurrent SSR requests. This standard mandates strict request-scoped execution contexts, zero cross-boundary imports between 'app/' and 'server/', and deterministic hydration state isolation.","antiPatternHeadline":"Cross-Request State Leakage and Boundary Violations in Nuxt 4 Nitro and Shared Layers","stars_count":82,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nuxt4","nitro","ssr","hydration","vue3","cross-request-state-pollution"],"exportEndpoints":{"claude":"/api/rules/nuxt4-nitro-shared-ssr-isolation-production-standard?format=claude","cursorMdc":"/api/rules/nuxt4-nitro-shared-ssr-isolation-production-standard?format=mdc","cursorrules":"/api/rules/nuxt4-nitro-shared-ssr-isolation-production-standard?format=cursor","windsurf":"/api/rules/nuxt4-nitro-shared-ssr-isolation-production-standard?format=windsurf","agents":"/api/rules/nuxt4-nitro-shared-ssr-isolation-production-standard?format=agents"}},{"id":"solidstart-server-function-boundary-guardrail","title":"SolidStart 1.0 Server Function Serialization and Async Boundary Guardrail","category":"frontend","severity":"critical","description":"SolidStart 1.0 server$ functions execute exclusively in isolated server runtime environments, severing the lexical JavaScript scope across client and server boundaries. Passing reactive signal accessors, DOM references, or un-serializable objects into server functions corrupts RPC serialization and triggers client hydration divergence. All server function interactions must pass discrete, plain serializable primitives and be mediated via createAsync or cache primitives wrapped in Suspense and ErrorBoundary components.","antiPatternHeadline":"Leaking Reactive Closures into server$ RPCs and Invoking Server Functions Inside Raw Client Effects","stars_count":81,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","solidstart","vinxi","signals","suspense","server-functions"],"exportEndpoints":{"claude":"/api/rules/solidstart-server-function-boundary-guardrail?format=claude","cursorMdc":"/api/rules/solidstart-server-function-boundary-guardrail?format=mdc","cursorrules":"/api/rules/solidstart-server-function-boundary-guardrail?format=cursor","windsurf":"/api/rules/solidstart-server-function-boundary-guardrail?format=windsurf","agents":"/api/rules/solidstart-server-function-boundary-guardrail?format=agents"}},{"id":"solidstart-server-function-boundary-reactivity","title":"SolidStart 1.0 Server Function Boundary & Reactive Signal Invariants","category":"frontend","severity":"critical","description":"Enforces strict parameter serialization and reactivity separation across SolidStart 1.0 server$ RPC boundaries. Prevents runtime serialization failures, dead-code elimination leaks, and broken signal subscription graphs across client-server execution contexts.","antiPatternHeadline":"Implicit Client Signal Closures Inside server$ RPCs Causing Stale Serialization and Broken Fine-Grained Reactive Tracking","stars_count":44,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["solidstart","server-functions","reactivity","suspense","rpc","vinxi"],"exportEndpoints":{"claude":"/api/rules/solidstart-server-function-boundary-reactivity?format=claude","cursorMdc":"/api/rules/solidstart-server-function-boundary-reactivity?format=mdc","cursorrules":"/api/rules/solidstart-server-function-boundary-reactivity?format=cursor","windsurf":"/api/rules/solidstart-server-function-boundary-reactivity?format=windsurf","agents":"/api/rules/solidstart-server-function-boundary-reactivity?format=agents"}},{"id":"nuxt4-nitro-shared-boundary-guardrail","title":"Nuxt 4 Directory Boundaries, Nitro Request Context, and SSR State Isolation","category":"frontend","severity":"critical","description":"Enforces strict boundary isolation between Nuxt 4's app/ directory, Nitro server runtime, and shared/ utilities. Eliminates cross-request state pollution, module-scope SSR memory leaks, and invalid runtime cross-imports between Nitro event handlers and client components.","antiPatternHeadline":"Global Singletons in Nitro Handlers and Leaking Server Runtime Logic into app/ Components","stars_count":56,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nuxt4","nitro","ssr-hydration","state-isolation","architecture"],"exportEndpoints":{"claude":"/api/rules/nuxt4-nitro-shared-boundary-guardrail?format=claude","cursorMdc":"/api/rules/nuxt4-nitro-shared-boundary-guardrail?format=mdc","cursorrules":"/api/rules/nuxt4-nitro-shared-boundary-guardrail?format=cursor","windsurf":"/api/rules/nuxt4-nitro-shared-boundary-guardrail?format=windsurf","agents":"/api/rules/nuxt4-nitro-shared-boundary-guardrail?format=agents"}},{"id":"nuxt4-nitro-context-isolation-and-shared-boundaries","title":"Nuxt 4 Nitro SSR Request Isolation and Shared Directory Boundary Enforcement","category":"frontend","severity":"critical","description":"Enforces strict runtime boundary isolation between Nuxt 4 app/, server/, and shared/ directories while preventing cross-request state pollution in Nitro v2 server handlers. Mandates request-scoped context via event.context and hydration-safe SSR primitives via useState() to block concurrent memory leaks and credential bleed.","antiPatternHeadline":"Module-Scope Singleton State Leaking Across Nitro Requests and Secret Bleed Across Shared Boundaries","stars_count":58,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nuxt4","nitro","ssr","state-hydration","architecture","security"],"exportEndpoints":{"claude":"/api/rules/nuxt4-nitro-context-isolation-and-shared-boundaries?format=claude","cursorMdc":"/api/rules/nuxt4-nitro-context-isolation-and-shared-boundaries?format=mdc","cursorrules":"/api/rules/nuxt4-nitro-context-isolation-and-shared-boundaries?format=cursor","windsurf":"/api/rules/nuxt4-nitro-context-isolation-and-shared-boundaries?format=windsurf","agents":"/api/rules/nuxt4-nitro-context-isolation-and-shared-boundaries?format=agents"}},{"id":"solidstart-server-function-async-boundary-guardrails","title":"SolidStart 1.0 server$ RPC Serialization & Async Boundary Invariants","category":"frontend","severity":"critical","description":"Mandates strict isolation and explicit serialization boundaries for SolidStart 1.0 server$ RPCs and fine-grained client signals. Prevents closure leakage across the client/server network boundary, serialization failures, and broken SSR streaming by enforcing createAsync wrappers within Suspense boundaries.","antiPatternHeadline":"Closing over reactive client signals inside server$ RPC closures and executing untracked async operations outside createAsync","stars_count":96,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","solidstart","solidjs","server-functions","async-boundaries"],"exportEndpoints":{"claude":"/api/rules/solidstart-server-function-async-boundary-guardrails?format=claude","cursorMdc":"/api/rules/solidstart-server-function-async-boundary-guardrails?format=mdc","cursorrules":"/api/rules/solidstart-server-function-async-boundary-guardrails?format=cursor","windsurf":"/api/rules/solidstart-server-function-async-boundary-guardrails?format=windsurf","agents":"/api/rules/solidstart-server-function-async-boundary-guardrails?format=agents"}},{"id":"nuxt4-nitro-shared-state-isolation-standard","title":"Nuxt 4 Nitro Isolation, Shared Directory Boundaries, and SSR State Hydration","category":"frontend","severity":"critical","description":"Enforces strict architectural boundaries across Nuxt 4's app/, server/, and shared/ directories while preventing cross-request SSR state pollution. Mandates request-scoped context encapsulation in Nitro v2 event handlers and SSR-safe state management via useState to eliminate concurrent user data leakage.","antiPatternHeadline":"Global Module-Level State in Nitro Handlers and Leaky SSR Composables","stars_count":53,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["nuxt4","nitro","ssr","vue","state-hydration","security"],"exportEndpoints":{"claude":"/api/rules/nuxt4-nitro-shared-state-isolation-standard?format=claude","cursorMdc":"/api/rules/nuxt4-nitro-shared-state-isolation-standard?format=mdc","cursorrules":"/api/rules/nuxt4-nitro-shared-state-isolation-standard?format=cursor","windsurf":"/api/rules/nuxt4-nitro-shared-state-isolation-standard?format=windsurf","agents":"/api/rules/nuxt4-nitro-shared-state-isolation-standard?format=agents"}},{"id":"solidstart-server-function-async-boundaries","title":"SolidStart 1.0 Server Functions (server$) & Fine-Grained Async Invariants","category":"frontend","severity":"critical","description":"Enforces strict RPC boundary isolation, serializable argument contracts, and proper Suspense integration in SolidStart 1.0. Prevents client-server closure leakage, hydration deadlocks, and silent reactive de-opt when crossing network boundaries.","antiPatternHeadline":"Leaking Reactive Signal Closures into server$ RPCs and Executing Raw Server Promises Outside createAsync","stars_count":114,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","solidjs","solidstart","server-functions","reactivity","suspense"],"exportEndpoints":{"claude":"/api/rules/solidstart-server-function-async-boundaries?format=claude","cursorMdc":"/api/rules/solidstart-server-function-async-boundaries?format=mdc","cursorrules":"/api/rules/solidstart-server-function-async-boundaries?format=cursor","windsurf":"/api/rules/solidstart-server-function-async-boundaries?format=windsurf","agents":"/api/rules/solidstart-server-function-async-boundaries?format=agents"}},{"id":"nuxt4-nitro-shared-ssr-hydration-isolation","title":"Nuxt 4 Nitro Server Engine Isolation & Shared Directory State Guardrail","category":"frontend","severity":"critical","description":"Enforces strict boundary separation between Nuxt 4's app/ directory, Nitro server runtime, and shared/ utilities. Prevents cross-request state pollution in Nitro event handlers and eliminates SSR hydration mismatches caused by un-isolated state leaks, non-serializable payloads, and node-only imports in universal code.","antiPatternHeadline":"Global Module-Level State in Nitro Handlers and Leaking Server-Only Primitives via Shared Directory into App Hydration","stars_count":88,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nuxt4","nitro","vue","ssr","hydration","state-management"],"exportEndpoints":{"claude":"/api/rules/nuxt4-nitro-shared-ssr-hydration-isolation?format=claude","cursorMdc":"/api/rules/nuxt4-nitro-shared-ssr-hydration-isolation?format=mdc","cursorrules":"/api/rules/nuxt4-nitro-shared-ssr-hydration-isolation?format=cursor","windsurf":"/api/rules/nuxt4-nitro-shared-ssr-hydration-isolation?format=windsurf","agents":"/api/rules/nuxt4-nitro-shared-ssr-hydration-isolation?format=agents"}},{"id":"nuxt-4-nitro-shared-directory-isolation-production-standard","title":"Nuxt 4 App Directory Restructuring, Nitro v2 Boundaries, and SSR State Isolation","category":"frontend","severity":"critical","description":"Enforces strict boundary isolation between Nuxt 4 app/ runtime, Nitro v2 server runtime, and the shared/ directory. Eliminates cross-request state pollution during SSR hydration and prevents server-only secrets or Node.js primitives from leaking into client-accessible shared modules.","antiPatternHeadline":"Global Cross-Request State Leaks and Server Secret Bundling in Nuxt 4 Shared/ Modules","stars_count":60,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nuxt4","nitro","ssr","hydration","vue3","state-isolation"],"exportEndpoints":{"claude":"/api/rules/nuxt-4-nitro-shared-directory-isolation-production-standard?format=claude","cursorMdc":"/api/rules/nuxt-4-nitro-shared-directory-isolation-production-standard?format=mdc","cursorrules":"/api/rules/nuxt-4-nitro-shared-directory-isolation-production-standard?format=cursor","windsurf":"/api/rules/nuxt-4-nitro-shared-directory-isolation-production-standard?format=windsurf","agents":"/api/rules/nuxt-4-nitro-shared-directory-isolation-production-standard?format=agents"}},{"id":"nuxt4-nitro-engine-shared-dir-state-isolation","title":"Nuxt 4 Nitro Engine & Shared Directory State Isolation Standard","category":"frontend","severity":"critical","description":"Enforces strict isolation between the Nitro v2 server engine, universal client code inside the Nuxt 4 app/ directory, and isomorphic contracts in shared/. Guarantees zero cross-request state leakage, eliminates SSR hydration mismatches, and prevents runtime execution boundary contamination.","antiPatternHeadline":"Cross-Request State Contamination via Module-Level Singletons and Illicit Boundary Imports","stars_count":74,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nuxt","nuxt4","nitro","vue","ssr","hydration"],"exportEndpoints":{"claude":"/api/rules/nuxt4-nitro-engine-shared-dir-state-isolation?format=claude","cursorMdc":"/api/rules/nuxt4-nitro-engine-shared-dir-state-isolation?format=mdc","cursorrules":"/api/rules/nuxt4-nitro-engine-shared-dir-state-isolation?format=cursor","windsurf":"/api/rules/nuxt4-nitro-engine-shared-dir-state-isolation?format=windsurf","agents":"/api/rules/nuxt4-nitro-engine-shared-dir-state-isolation?format=agents"}},{"id":"solidstart-server-rpc-reactive-boundary-guardrail","title":"SolidStart Server Functions and Fine-Grained Async Boundary Invariants","category":"frontend","severity":"critical","description":"Enforces strict architectural boundaries between client-side fine-grained reactive signals and server-side execution via SolidStart 1.0 server$ RPCs. Eliminates hydration mismatches, accidental client closure leaks into server bundles, and non-reactive async waterfalls by mandating cache/action wrappers and explicit Suspense orchestration.","antiPatternHeadline":"Closing over client signals inside server$ functions or invoking raw server RPCs without reactive async boundaries.","stars_count":61,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","solidstart","solidjs","reactivity","server-functions","suspense"],"exportEndpoints":{"claude":"/api/rules/solidstart-server-rpc-reactive-boundary-guardrail?format=claude","cursorMdc":"/api/rules/solidstart-server-rpc-reactive-boundary-guardrail?format=mdc","cursorrules":"/api/rules/solidstart-server-rpc-reactive-boundary-guardrail?format=cursor","windsurf":"/api/rules/solidstart-server-rpc-reactive-boundary-guardrail?format=windsurf","agents":"/api/rules/solidstart-server-rpc-reactive-boundary-guardrail?format=agents"}},{"id":"nuxt4-nitro-shared-boundary-standard","title":"Nuxt 4 Nitro Engine, Shared Directory Boundaries, and SSR Isolation","category":"frontend","severity":"critical","description":"Enforces strict boundary isolation between Nuxt 4's app/ layer, server/ (Nitro engine), and shared/ directory. Prevents catastrophic cross-request SSR state contamination, server secret leakage to the client bundle, and illegal cross-boundary runtime imports.","antiPatternHeadline":"Global Mutable SSR Singletons & Leaking Nitro Server Context Across Shared Directory Boundaries","stars_count":82,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["nuxt","nuxt4","nitro","vue","ssr","architecture","security"],"exportEndpoints":{"claude":"/api/rules/nuxt4-nitro-shared-boundary-standard?format=claude","cursorMdc":"/api/rules/nuxt4-nitro-shared-boundary-standard?format=mdc","cursorrules":"/api/rules/nuxt4-nitro-shared-boundary-standard?format=cursor","windsurf":"/api/rules/nuxt4-nitro-shared-boundary-standard?format=windsurf","agents":"/api/rules/nuxt4-nitro-shared-boundary-standard?format=agents"}},{"id":"solidstart-server-function-reactivity-boundary","title":"SolidStart 1.0 Server Functions & Reactive Async Boundary Invariants","category":"frontend","severity":"critical","description":"Enforces strict isolation between client-side SolidJS signals and server-side RPC execution boundaries instantiated via server$, cache, or action. Signal accessors must never be embedded directly within server function closures, and server queries must be declared with createAsync using reactive accessor parameters to prevent hydration mismatches, serialization failures, and broken dependency tracking.","antiPatternHeadline":"Capturing Client Signals Directly in server$ Closures and Omitting createAsync Reactive Contexts","stars_count":59,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","solidstart","solidjs","server-functions","reactivity","suspense"],"exportEndpoints":{"claude":"/api/rules/solidstart-server-function-reactivity-boundary?format=claude","cursorMdc":"/api/rules/solidstart-server-function-reactivity-boundary?format=mdc","cursorrules":"/api/rules/solidstart-server-function-reactivity-boundary?format=cursor","windsurf":"/api/rules/solidstart-server-function-reactivity-boundary?format=windsurf","agents":"/api/rules/solidstart-server-function-reactivity-boundary?format=agents"}},{"id":"nuxt4-nitro-shared-ssr-state-boundary","title":"Nuxt 4 Nitro Server Engine Isolation & Shared Directory Boundary Enforcements","category":"frontend","severity":"critical","description":"Enforces strict architecture and runtime boundaries between Nuxt 4's app/ directory, Nitro server/ runtime, and the polymorphic shared/ directory. Prohibits module-scoped mutable state, cross-boundary runtime imports, and non-isolated server-side hydration traps that cause cross-request state pollution in production SSR.","antiPatternHeadline":"Module-Scoped Mutable Singletons and Cross-Boundary Runtime Leaks across Nuxt 4 app/, server/, and shared/ Directories","stars_count":52,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nuxt4","nitro","ssr","hydration","state-pollution","vue"],"exportEndpoints":{"claude":"/api/rules/nuxt4-nitro-shared-ssr-state-boundary?format=claude","cursorMdc":"/api/rules/nuxt4-nitro-shared-ssr-state-boundary?format=mdc","cursorrules":"/api/rules/nuxt4-nitro-shared-ssr-state-boundary?format=cursor","windsurf":"/api/rules/nuxt4-nitro-shared-ssr-state-boundary?format=windsurf","agents":"/api/rules/nuxt4-nitro-shared-ssr-state-boundary?format=agents"}},{"id":"vite6-environment-api-multi-runtime-isolation","title":"Vite 6 Environment API Isolation and Multi-Runtime HMR Synchronization","category":"frontend","severity":"critical","description":"Vite 6 replaces the legacy client/ssr dual-module graph with the Environment API to support isolated runtimes (Node, workerd, Edge). Developers and plugins must strictly route module transformations, module invalidations, and HMR events through scoped DevEnvironment instances and ModuleRunner transports rather than legacy root-server globals.","antiPatternHeadline":"Cross-Environment Module Graph Invalidation and Unscoped HMR Dispatching via Legacy Vite 5 APIs","stars_count":65,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["vite","vite-6","environment-api","module-runner","workerd","hmr","multi-runtime"],"exportEndpoints":{"claude":"/api/rules/vite6-environment-api-multi-runtime-isolation?format=claude","cursorMdc":"/api/rules/vite6-environment-api-multi-runtime-isolation?format=mdc","cursorrules":"/api/rules/vite6-environment-api-multi-runtime-isolation?format=cursor","windsurf":"/api/rules/vite6-environment-api-multi-runtime-isolation?format=windsurf","agents":"/api/rules/vite6-environment-api-multi-runtime-isolation?format=agents"}},{"id":"solidstart-server-fn-async-boundaries","title":"SolidStart 1.0 Server Functions (server$) & Fine-Grained Async Boundaries","category":"frontend","severity":"critical","description":"Enforces architectural boundaries for SolidStart 1.0 server$ RPCs, requiring createAsync/cache integration within Suspense boundaries. Prevents client signal closure leakage into server boundaries, serialization failures, and hydration mismatches caused by raw server calls in reactive scopes.","antiPatternHeadline":"Raw server$ Invocations in Reactive Scopes & Passing Non-Serializable Signal Accessors across RPC Boundaries","stars_count":75,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","solidstart","solidjs","server-functions","signals","reactivity","suspense"],"exportEndpoints":{"claude":"/api/rules/solidstart-server-fn-async-boundaries?format=claude","cursorMdc":"/api/rules/solidstart-server-fn-async-boundaries?format=mdc","cursorrules":"/api/rules/solidstart-server-fn-async-boundaries?format=cursor","windsurf":"/api/rules/solidstart-server-fn-async-boundaries?format=windsurf","agents":"/api/rules/solidstart-server-fn-async-boundaries?format=agents"}},{"id":"nuxt4-nitro-shared-state-isolation-guardrail","title":"Nuxt 4 Nitro Engine, Shared Directory Boundaries, and SSR State Isolation","category":"frontend","severity":"critical","description":"Enforces strict boundary isolation across Nuxt 4's app/, server/, and shared/ directories, preventing cross-request state contamination in Nitro server handlers and ensuring deterministic SSR hydration. Prohibits global mutable singletons across concurrent execution contexts and mandates serializable data transfer boundaries.","antiPatternHeadline":"Module-Level Mutable State in Server Routes and Shared Modules Leaking Cross-Request Tenant Data","stars_count":82,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nuxt4","nitro","ssr","vue","hydration","security"],"exportEndpoints":{"claude":"/api/rules/nuxt4-nitro-shared-state-isolation-guardrail?format=claude","cursorMdc":"/api/rules/nuxt4-nitro-shared-state-isolation-guardrail?format=mdc","cursorrules":"/api/rules/nuxt4-nitro-shared-state-isolation-guardrail?format=cursor","windsurf":"/api/rules/nuxt4-nitro-shared-state-isolation-guardrail?format=windsurf","agents":"/api/rules/nuxt4-nitro-shared-state-isolation-guardrail?format=agents"}},{"id":"nuxt4-nitro-server-shared-state-isolation","title":"Nuxt 4 Nitro Server Engine & Isolated SSR State Hydration","category":"frontend","severity":"critical","description":"Enforces strict architectural boundaries across Nuxt 4's app/, server/, and shared/ directories to eliminate cross-request state pollution in Nitro v2 runtimes. Mandates request-scoped context isolation using H3 event context and Nuxt useState to prevent sensitive data leaks between concurrent SSR executions.","antiPatternHeadline":"Module-Scoped Singleton State Leakage in Nitro Handlers and Contaminated Shared Directory Boundaries","stars_count":50,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nuxt4","nitro","ssr-hydration","vue3","typescript"],"exportEndpoints":{"claude":"/api/rules/nuxt4-nitro-server-shared-state-isolation?format=claude","cursorMdc":"/api/rules/nuxt4-nitro-server-shared-state-isolation?format=mdc","cursorrules":"/api/rules/nuxt4-nitro-server-shared-state-isolation?format=cursor","windsurf":"/api/rules/nuxt4-nitro-server-shared-state-isolation?format=windsurf","agents":"/api/rules/nuxt4-nitro-server-shared-state-isolation?format=agents"}},{"id":"nuxt4-nitro-shared-ssr-boundary-standard","title":"Nuxt 4 Nitro Server Engine, Shared Directory, and SSR State Isolation","category":"frontend","severity":"critical","description":"Enforce strict execution boundary separation across Nuxt 4 app/, server/, and shared/ directories while eradicating cross-request state pollution in Nitro v2 server engines and Vue SSR. Mandates request-bound event contexts in Nitro routes and useState/Pinia per-request lifecycle encapsulation in the app layer.","antiPatternHeadline":"Mutating Module-Scoped State in Nitro Handlers and Violating App/Server/Shared Directory Isolation","stars_count":79,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nuxt4","nitro","ssr","typescript","state-hydration"],"exportEndpoints":{"claude":"/api/rules/nuxt4-nitro-shared-ssr-boundary-standard?format=claude","cursorMdc":"/api/rules/nuxt4-nitro-shared-ssr-boundary-standard?format=mdc","cursorrules":"/api/rules/nuxt4-nitro-shared-ssr-boundary-standard?format=cursor","windsurf":"/api/rules/nuxt4-nitro-shared-ssr-boundary-standard?format=windsurf","agents":"/api/rules/nuxt4-nitro-shared-ssr-boundary-standard?format=agents"}},{"id":"solidstart-server-rpc-reactive-boundaries-standard","title":"SolidStart 1.0 Server RPCs & Fine-Grained Async Boundary Invariants","category":"frontend","severity":"critical","description":"Enforces strict boundary separation between client-side fine-grained reactivity and SolidStart 1.0 server$ RPC execution. Prohibits lexical closure leakage across the client/server threshold and mandates the use of query/action wrappers with createAsync to preserve Suspense streaming and prevent reactive fetch loops.","antiPatternHeadline":"Closing Over Client Reactive State Inside server$ RPCs and Invoking Uncached RPCs Directly in Reactive Tracking Scopes","stars_count":68,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","solidstart","solidjs","server-functions","reactivity","suspense"],"exportEndpoints":{"claude":"/api/rules/solidstart-server-rpc-reactive-boundaries-standard?format=claude","cursorMdc":"/api/rules/solidstart-server-rpc-reactive-boundaries-standard?format=mdc","cursorrules":"/api/rules/solidstart-server-rpc-reactive-boundaries-standard?format=cursor","windsurf":"/api/rules/solidstart-server-rpc-reactive-boundaries-standard?format=windsurf","agents":"/api/rules/solidstart-server-rpc-reactive-boundaries-standard?format=agents"}},{"id":"nuxt-4-nitro-shared-ssr-boundary-isolation","title":"Nuxt 4 Nitro Server Engine, Shared Directory Boundaries, and SSR State Isolation","category":"frontend","severity":"critical","description":"Enforce strict execution boundary isolation between Nuxt 4's app/, server/ (Nitro engine), and shared/ directory hierarchies. Prevent cross-request state contamination in concurrent SSR rendering and eliminate client/server module boundary leakage.","antiPatternHeadline":"Module-Scoped Mutable State in Nitro Handlers and Impure Cross-Boundary Imports in Nuxt 4 shared/","stars_count":61,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nuxt4","nitro","vue","ssr","hydration","state-isolation"],"exportEndpoints":{"claude":"/api/rules/nuxt-4-nitro-shared-ssr-boundary-isolation?format=claude","cursorMdc":"/api/rules/nuxt-4-nitro-shared-ssr-boundary-isolation?format=mdc","cursorrules":"/api/rules/nuxt-4-nitro-shared-ssr-boundary-isolation?format=cursor","windsurf":"/api/rules/nuxt-4-nitro-shared-ssr-boundary-isolation?format=windsurf","agents":"/api/rules/nuxt-4-nitro-shared-ssr-boundary-isolation?format=agents"}},{"id":"nuxt-4-nitro-shared-directory-ssr-state-isolation","title":"Nuxt 4 Nitro Server Engine, Shared Directory Boundaries, and SSR State Isolation","category":"frontend","severity":"critical","description":"Enforces strict architectural boundaries between Nuxt 4 app/, server/, and shared/ directories while preventing cross-request state leakage during SSR. Mandates per-request context isolation in Nitro v2 event handlers and SSR-safe reactive singletons via useState.","antiPatternHeadline":"Module-Level Shared State Leakage and Cross-Context Boundary Bleed in Nuxt 4","stars_count":51,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nuxt","nuxt4","nitro","ssr","vue3","typescript"],"exportEndpoints":{"claude":"/api/rules/nuxt-4-nitro-shared-directory-ssr-state-isolation?format=claude","cursorMdc":"/api/rules/nuxt-4-nitro-shared-directory-ssr-state-isolation?format=mdc","cursorrules":"/api/rules/nuxt-4-nitro-shared-directory-ssr-state-isolation?format=cursor","windsurf":"/api/rules/nuxt-4-nitro-shared-directory-ssr-state-isolation?format=windsurf","agents":"/api/rules/nuxt-4-nitro-shared-directory-ssr-state-isolation?format=agents"}},{"id":"solidstart-server-functions-async-boundary-standard","title":"SolidStart 1.0 Server Functions and Async Boundary Invariants","category":"frontend","severity":"critical","description":"Enforces strict RPC boundary isolation and reactive tracking decoupling when using SolidStart server$ functions. Mandates explicit parameter serialization, prevents lexical capture of client-side reactive signals within server closures, and enforces mandatory Suspense and ErrorBoundary wrapping for all async data-fetching primitives.","antiPatternHeadline":"Lexical Signal Leakage and Naked Execution in SolidStart Server RPCs","stars_count":65,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","solidstart","solidjs","server-functions","rpc","async-boundaries"],"exportEndpoints":{"claude":"/api/rules/solidstart-server-functions-async-boundary-standard?format=claude","cursorMdc":"/api/rules/solidstart-server-functions-async-boundary-standard?format=mdc","cursorrules":"/api/rules/solidstart-server-functions-async-boundary-standard?format=cursor","windsurf":"/api/rules/solidstart-server-functions-async-boundary-standard?format=windsurf","agents":"/api/rules/solidstart-server-functions-async-boundary-standard?format=agents"}},{"id":"solidstart-1-server-functions-async-boundaries","title":"SolidStart 1.0 Server Functions (server$) and Async Boundary Architecture","category":"frontend","severity":"critical","description":"Enforces strict isolation between client-side reactive signal scopes and Vinxi-compiled server$ RPC functions in SolidStart 1.0. Guarantees that async data pipelines crossing the network boundary are encapsulated in serializable contracts, driven through createAsync/query primitives, and guarded by explicit Suspense and ErrorBoundary components to eliminate hydration mismatch and stale closure panics.","antiPatternHeadline":"Leaking Reactive Signal Accessors into server$ Closures and Unbounded Async Execution Without Suspense","stars_count":116,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","solidjs","solidstart","vinxi","rpc","async-boundaries"],"exportEndpoints":{"claude":"/api/rules/solidstart-1-server-functions-async-boundaries?format=claude","cursorMdc":"/api/rules/solidstart-1-server-functions-async-boundaries?format=mdc","cursorrules":"/api/rules/solidstart-1-server-functions-async-boundaries?format=cursor","windsurf":"/api/rules/solidstart-1-server-functions-async-boundaries?format=windsurf","agents":"/api/rules/solidstart-1-server-functions-async-boundaries?format=agents"}},{"id":"nuxt4-nitro-directory-state-isolation","title":"Nuxt 4 Nitro SSR State Isolation and Shared Directory Boundary Enforcement","category":"frontend","severity":"critical","description":"Enforces Nuxt 4 architectural segregation across app/, server/, and shared/ directories while strictly eliminating cross-request state pollution in the Nitro engine. Mandates request-scoped lifecycle isolation in SSR routes and prevents runtime leakage of server-only secrets through isomorphic shared layers.","antiPatternHeadline":"Global Mutable Singletons in Nitro Handlers and Impure State Leakage Across Nuxt 4 Boundaries","stars_count":54,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["nuxt4","nitro","vue","ssr","state-hydration","security"],"exportEndpoints":{"claude":"/api/rules/nuxt4-nitro-directory-state-isolation?format=claude","cursorMdc":"/api/rules/nuxt4-nitro-directory-state-isolation?format=mdc","cursorrules":"/api/rules/nuxt4-nitro-directory-state-isolation?format=cursor","windsurf":"/api/rules/nuxt4-nitro-directory-state-isolation?format=windsurf","agents":"/api/rules/nuxt4-nitro-directory-state-isolation?format=agents"}},{"id":"nuxt-4-nitro-shared-ssr-state-isolation-standard","title":"Nuxt 4 Directory Architecture, Nitro Server Isolation, and SSR State Leak Prevention","category":"frontend","severity":"critical","description":"Nuxt 4 strictly enforces a segmented root directory structure where client code resides under app/, server utilities under server/, and universal code under shared/. Failing to isolate SSR execution context or leaking server-only dependencies into shared runtime spaces causes fatal cross-request state contamination, token leakage, and catastrophic client-server hydration divergence.","antiPatternHeadline":"Global Mutable State in Nitro Handlers and Illicit Cross-Boundary Imports between app/, server/, and shared/","stars_count":55,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nuxt4","nitro","ssr-hydration","cross-request-state-pollution","vue"],"exportEndpoints":{"claude":"/api/rules/nuxt-4-nitro-shared-ssr-state-isolation-standard?format=claude","cursorMdc":"/api/rules/nuxt-4-nitro-shared-ssr-state-isolation-standard?format=mdc","cursorrules":"/api/rules/nuxt-4-nitro-shared-ssr-state-isolation-standard?format=cursor","windsurf":"/api/rules/nuxt-4-nitro-shared-ssr-state-isolation-standard?format=windsurf","agents":"/api/rules/nuxt-4-nitro-shared-ssr-state-isolation-standard?format=agents"}},{"id":"vite6-environment-api-runtime-isolation","title":"Vite 6 Multi-Runtime Environment API and Per-Environment HMR Isolation","category":"frontend","severity":"critical","description":"Enforces strict isolation of execution contexts (workerd, node, edge, client) using Vite 6's Environment API and ModuleRunner architecture. Prohibits legacy Vite 5 SSR APIs, cross-environment runtime pollution, and un-scoped HMR event broadcasting across independent runtime boundary graphs.","antiPatternHeadline":"Leaking Node-specific APIs into edge/workerd environments and relying on legacy ssrLoadModule or root WebSocket broadcasting for SSR HMR.","stars_count":44,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","vite6","environment-api","multi-runtime","workerd","hmr"],"exportEndpoints":{"claude":"/api/rules/vite6-environment-api-runtime-isolation?format=claude","cursorMdc":"/api/rules/vite6-environment-api-runtime-isolation?format=mdc","cursorrules":"/api/rules/vite6-environment-api-runtime-isolation?format=cursor","windsurf":"/api/rules/vite6-environment-api-runtime-isolation?format=windsurf","agents":"/api/rules/vite6-environment-api-runtime-isolation?format=agents"}},{"id":"solidstart-server-fn-async-boundaries-standard","title":"SolidStart 1.0 Server Functions & Async Boundaries Invariant Standard","category":"frontend","severity":"critical","description":"Enforces strict boundary isolation and reactive lifecycles when using SolidStart server$ RPCs. Mandates that server functions remain pure, isolated compilation units that receive all client parameters via serialized inputs rather than client signal closures, and requires async data consumption to be routed through cache() and createAsync() inside Suspense boundaries to preserve fine-grained reactivity.","antiPatternHeadline":"Closing Over Client Signals in server$ Closures or Calling Bare RPCs in Tracking Scopes","stars_count":53,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","solidjs","solidstart","server-functions","signals","reactivity"],"exportEndpoints":{"claude":"/api/rules/solidstart-server-fn-async-boundaries-standard?format=claude","cursorMdc":"/api/rules/solidstart-server-fn-async-boundaries-standard?format=mdc","cursorrules":"/api/rules/solidstart-server-fn-async-boundaries-standard?format=cursor","windsurf":"/api/rules/solidstart-server-fn-async-boundaries-standard?format=windsurf","agents":"/api/rules/solidstart-server-fn-async-boundaries-standard?format=agents"}},{"id":"nuxt4-nitro-shared-directory-ssr-state-isolation","title":"Nuxt 4 Nitro Server Engine, Shared Directory Boundaries, and SSR State Isolation","category":"frontend","severity":"critical","description":"Enforces strict architectural boundaries across Nuxt 4 app/, server/, and shared/ directories while preventing cross-request state pollution in the Nitro v2 engine. Prohibits module-level mutable variables in server routes and mandates request-scoped context and isomorphic hydration primitives.","antiPatternHeadline":"Cross-Request State Contamination in Nitro Handlers and Leaked Client State in Nuxt 4 Shared Directory","stars_count":88,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nuxt","nuxt4","nitro","ssr","hydration","state-management"],"exportEndpoints":{"claude":"/api/rules/nuxt4-nitro-shared-directory-ssr-state-isolation?format=claude","cursorMdc":"/api/rules/nuxt4-nitro-shared-directory-ssr-state-isolation?format=mdc","cursorrules":"/api/rules/nuxt4-nitro-shared-directory-ssr-state-isolation?format=cursor","windsurf":"/api/rules/nuxt4-nitro-shared-directory-ssr-state-isolation?format=windsurf","agents":"/api/rules/nuxt4-nitro-shared-directory-ssr-state-isolation?format=agents"}},{"id":"nuxt4-nitro-shared-ssr-state-isolation-production-standard","title":"Nuxt 4 Nitro Server Engine Isolation & Shared Directory Hydration Guardrail","category":"frontend","severity":"critical","description":"Enforces strict architectural boundaries across the Nuxt 4 directory layout (app/, server/, and shared/) to prevent cross-request SSR state pollution and runtime hydration mismatches. Mandates request-scoped context within Nitro event handlers and restricts the shared/ layer to stateless, isomorphic code.","antiPatternHeadline":"Cross-Request State Leaks via Global Module Scope in Nitro Handlers and Isomorphic Boundary Violations in Nuxt 4 shared/","stars_count":118,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nuxt4","nitro","vue","ssr","state-hydration","architecture"],"exportEndpoints":{"claude":"/api/rules/nuxt4-nitro-shared-ssr-state-isolation-production-standard?format=claude","cursorMdc":"/api/rules/nuxt4-nitro-shared-ssr-state-isolation-production-standard?format=mdc","cursorrules":"/api/rules/nuxt4-nitro-shared-ssr-state-isolation-production-standard?format=cursor","windsurf":"/api/rules/nuxt4-nitro-shared-ssr-state-isolation-production-standard?format=windsurf","agents":"/api/rules/nuxt4-nitro-shared-ssr-state-isolation-production-standard?format=agents"}},{"id":"nuxt-4-nitro-shared-directory-ssr-isolation-guardrail","title":"Nuxt 4 Directory Restructuring, Nitro Isolation, and SSR State Leak Prevention","category":"frontend","severity":"critical","description":"Nuxt 4 introduces a restructured directory hierarchy where application code resides inside `app/` and shared cross-boundary utilities live in `shared/`. Nitro server runtime context must remain strictly isolated from Vue client runtimes, prohibiting global mutable module state in Nitro event handlers and ensuring SSR hydration payloads use serializable `useState` rather than top-level variables.","antiPatternHeadline":"Cross-Request State Contamination in Nitro and Leaking Server Singletons into Client Hydration","stars_count":50,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["nuxt","nuxt4","nitro","ssr","vue3","typescript","architecture"],"exportEndpoints":{"claude":"/api/rules/nuxt-4-nitro-shared-directory-ssr-isolation-guardrail?format=claude","cursorMdc":"/api/rules/nuxt-4-nitro-shared-directory-ssr-isolation-guardrail?format=mdc","cursorrules":"/api/rules/nuxt-4-nitro-shared-directory-ssr-isolation-guardrail?format=cursor","windsurf":"/api/rules/nuxt-4-nitro-shared-directory-ssr-isolation-guardrail?format=windsurf","agents":"/api/rules/nuxt-4-nitro-shared-directory-ssr-isolation-guardrail?format=agents"}},{"id":"solidstart-server-function-async-boundary-integrity","title":"SolidStart 1.0 server$ RPC Boundaries and Fine-Grained Reactive Tracking","category":"frontend","severity":"critical","description":"Enforce strict isolation between SolidJS fine-grained client signals and SolidStart 1.0 server$ RPC boundaries. Ensure server functions remain pure serializable RPCs that never capture lexical client scope, with all client-server data synchronization orchestrated strictly through query(), cache(), and createAsync() inside Suspense boundaries.","antiPatternHeadline":"Lexical Scope Capture and Manual Effect Fetching Across server$ RPC Boundaries","stars_count":68,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","solidstart","solidjs","rpc","reactivity","signals"],"exportEndpoints":{"claude":"/api/rules/solidstart-server-function-async-boundary-integrity?format=claude","cursorMdc":"/api/rules/solidstart-server-function-async-boundary-integrity?format=mdc","cursorrules":"/api/rules/solidstart-server-function-async-boundary-integrity?format=cursor","windsurf":"/api/rules/solidstart-server-function-async-boundary-integrity?format=windsurf","agents":"/api/rules/solidstart-server-function-async-boundary-integrity?format=agents"}},{"id":"solidstart-server-fn-async-boundary-guardrail","title":"SolidStart 1.0 Server Functions & Async Reactive Boundary Invariants","category":"frontend","severity":"critical","description":"Enforces strict isolation between client-side reactive signal graphs and SolidStart server$ RPC primitives. Prohibits lexical capture of reactive getters inside server closures, mandates JSON-serializable RPC parameter passing, and requires wrapping asynchronous data retrieval in createAsync within Suspense and ErrorBoundary contexts.","antiPatternHeadline":"Capturing Client Signals in server$ Closures or Calling RPCs Without createAsync & Suspense Boundaries","stars_count":111,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","solidstart","solidjs","server-functions","signals","hydration","suspense"],"exportEndpoints":{"claude":"/api/rules/solidstart-server-fn-async-boundary-guardrail?format=claude","cursorMdc":"/api/rules/solidstart-server-fn-async-boundary-guardrail?format=mdc","cursorrules":"/api/rules/solidstart-server-fn-async-boundary-guardrail?format=cursor","windsurf":"/api/rules/solidstart-server-fn-async-boundary-guardrail?format=windsurf","agents":"/api/rules/solidstart-server-fn-async-boundary-guardrail?format=agents"}},{"id":"solidstart-server-rpc-reactive-boundary","title":"SolidStart 1.0 Server Functions and Async Boundary Invariants","category":"frontend","severity":"critical","description":"Enforces strict isolation between client reactive tracking scopes and SolidStart server$ RPC execution contexts. Guarantees that server functions receive explicit, JSON-serializable parameters through createAsync or query primitives rather than capturing client signal accessors in server closures, ensuring deterministic SSR streaming and hydration.","antiPatternHeadline":"Closing Over Client Reactive Signals in server$ Handlers or Orchestrating RPCs via Untracked createEffect Lifecycles","stars_count":118,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","solidjs","solidstart","server-functions","rpc","reactivity","suspense"],"exportEndpoints":{"claude":"/api/rules/solidstart-server-rpc-reactive-boundary?format=claude","cursorMdc":"/api/rules/solidstart-server-rpc-reactive-boundary?format=mdc","cursorrules":"/api/rules/solidstart-server-rpc-reactive-boundary?format=cursor","windsurf":"/api/rules/solidstart-server-rpc-reactive-boundary?format=windsurf","agents":"/api/rules/solidstart-server-rpc-reactive-boundary?format=agents"}},{"id":"nuxt4-nitro-shared-ssr-state-isolation-nuxt-4-nitro-ser-617","title":"Nuxt 4 Directory Restructuring, Nitro Handlers, and SSR State Isolation","category":"frontend","severity":"critical","description":"Enforces strict boundary isolation across the Nuxt 4 app/ directory, Nitro server runtime, and shared/ isomorphic module layer. Precludes cross-request state pollution, improper hydration mismatches, and the leak of server secrets into client bundles through rigorous stateless handler construction and pure shared utilities.","antiPatternHeadline":"Global Mutable State Leaks Across Nitro Requests and Client Hydration Mismatches via Contaminated Shared Modules","stars_count":117,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nuxt4","nitro","ssr","state-isolation","shared-directory","vue"],"exportEndpoints":{"claude":"/api/rules/nuxt4-nitro-shared-ssr-state-isolation-nuxt-4-nitro-ser-617?format=claude","cursorMdc":"/api/rules/nuxt4-nitro-shared-ssr-state-isolation-nuxt-4-nitro-ser-617?format=mdc","cursorrules":"/api/rules/nuxt4-nitro-shared-ssr-state-isolation-nuxt-4-nitro-ser-617?format=cursor","windsurf":"/api/rules/nuxt4-nitro-shared-ssr-state-isolation-nuxt-4-nitro-ser-617?format=windsurf","agents":"/api/rules/nuxt4-nitro-shared-ssr-state-isolation-nuxt-4-nitro-ser-617?format=agents"}},{"id":"solidstart-server-rpc-async-boundaries-solidstart-1-0-s-917","title":"SolidStart 1.0 Server Functions (server$) & Fine-Grained Reactive Async Boundaries","category":"frontend","severity":"critical","description":"Enforces strict boundary isolation between SolidJS client-side fine-grained reactivity and SolidStart 1.0 server$ RPC boundaries. Mandates the use of createAsync and cache primitives, guarantees argument serializability across RPC boundaries, and requires explicit Suspense wrapping to prevent hydration tearing and RPC serialization failures.","antiPatternHeadline":"Invoking Raw server$ RPCs Directly in Reactive Accessors or Passing Non-Serializable Signal Getters Across the Wire","stars_count":64,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","solidstart","solidjs","rpc","signals","suspense"],"exportEndpoints":{"claude":"/api/rules/solidstart-server-rpc-async-boundaries-solidstart-1-0-s-917?format=claude","cursorMdc":"/api/rules/solidstart-server-rpc-async-boundaries-solidstart-1-0-s-917?format=mdc","cursorrules":"/api/rules/solidstart-server-rpc-async-boundaries-solidstart-1-0-s-917?format=cursor","windsurf":"/api/rules/solidstart-server-rpc-async-boundaries-solidstart-1-0-s-917?format=windsurf","agents":"/api/rules/solidstart-server-rpc-async-boundaries-solidstart-1-0-s-917?format=agents"}},{"id":"qwik-city-resumability-serialization-boundaries","title":"Qwik Resumability Invariants: Serializability Boundaries and Lazy QRL Execution","category":"frontend","severity":"critical","description":"Enforces zero-hydration resumability invariants by governing QRL ($) boundary serialization and preventing eager execution regressions. Capturing non-serializable instances across lexical scopes or overusing useVisibleTask$ destroys lazy-loading benefits and causes runtime serialization panics.","antiPatternHeadline":"Eager Component Execution and Non-Serializable Scope Leakage Across QRL Boundaries","stars_count":64,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","qwik","qwik-city","resumability","qrl","performance"],"exportEndpoints":{"claude":"/api/rules/qwik-city-resumability-serialization-boundaries?format=claude","cursorMdc":"/api/rules/qwik-city-resumability-serialization-boundaries?format=mdc","cursorrules":"/api/rules/qwik-city-resumability-serialization-boundaries?format=cursor","windsurf":"/api/rules/qwik-city-resumability-serialization-boundaries?format=windsurf","agents":"/api/rules/qwik-city-resumability-serialization-boundaries?format=agents"}},{"id":"vite6-environment-api-multi-runtime-isolation-vite-6-environme-300","title":"Vite 6 Multi-Runtime Environment API Isolation and HMR Scoping","category":"frontend","severity":"critical","description":"Vite 6 replaces the monolithic SSR architecture with the Environment API, providing isolated module graphs, runtime evaluators, and HMR communication per target runtime (e.g., client, Node.js SSR, Cloudflare workerd). Developers must strictly isolate runtime configurations, utilize runtime-specific ModuleRunner instances, and avoid cross-runtime module graph mutations or unscoped HMR broadcasts.","antiPatternHeadline":"Mutating Monolithic server.moduleGraph or Invoking Deprecated ssrLoadModule Across Heterogeneous Runtimes","stars_count":68,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","vite6","environment-api","ssr","hmr","workerd"],"exportEndpoints":{"claude":"/api/rules/vite6-environment-api-multi-runtime-isolation-vite-6-environme-300?format=claude","cursorMdc":"/api/rules/vite6-environment-api-multi-runtime-isolation-vite-6-environme-300?format=mdc","cursorrules":"/api/rules/vite6-environment-api-multi-runtime-isolation-vite-6-environme-300?format=cursor","windsurf":"/api/rules/vite6-environment-api-multi-runtime-isolation-vite-6-environme-300?format=windsurf","agents":"/api/rules/vite6-environment-api-multi-runtime-isolation-vite-6-environme-300?format=agents"}},{"id":"tanstack-start-ssr-streaming-invariants","title":"TanStack Start & Fullstack Router Type-Safe Search Params, Loader SSR, and Deferred Streaming","category":"frontend","severity":"critical","description":"Enforces strict type safety, predictable search parameter validation with schema parsers (Zod), and optimized full-stack SSR loader pipelines in TanStack Start. Prohibits blocking critical SSR waterfalls by mandating the defer utility with React Suspense for non-critical network requests, alongside structural router context isolation.","antiPatternHeadline":"Unvalidated search params, waterfalling non-critical SSR loaders, and unhandled deferred streaming hydration mismatches","stars_count":95,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","tanstack-start","tanstack-router","ssr","deferred-streaming","zod","type-safety"],"exportEndpoints":{"claude":"/api/rules/tanstack-start-ssr-streaming-invariants?format=claude","cursorMdc":"/api/rules/tanstack-start-ssr-streaming-invariants?format=mdc","cursorrules":"/api/rules/tanstack-start-ssr-streaming-invariants?format=cursor","windsurf":"/api/rules/tanstack-start-ssr-streaming-invariants?format=windsurf","agents":"/api/rules/tanstack-start-ssr-streaming-invariants?format=agents"}},{"id":"react-19-use-action-state-and-optimistic-guardrail","title":"React 19 Actions: Mandating useActionState, useOptimistic, and useFormStatus over Manual State Wrappers","category":"frontend","severity":"critical","description":"Enforces native React 19 Action primitives (useActionState, useOptimistic, useFormStatus) for mutations and async form submissions. Prohibits manual useState submit wrappers, manual loading states, and synthetic event prevention (e.preventDefault()) that disrupt concurrent transitions and break native progressive enhancement.","antiPatternHeadline":"Manual onSubmit State Orchestration with useState Pending/Error Flags and Imperative Rollbacks","stars_count":57,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","useActionState","useOptimistic","useFormStatus","forms","concurrent-react"],"exportEndpoints":{"claude":"/api/rules/react-19-use-action-state-and-optimistic-guardrail?format=claude","cursorMdc":"/api/rules/react-19-use-action-state-and-optimistic-guardrail?format=mdc","cursorrules":"/api/rules/react-19-use-action-state-and-optimistic-guardrail?format=cursor","windsurf":"/api/rules/react-19-use-action-state-and-optimistic-guardrail?format=windsurf","agents":"/api/rules/react-19-use-action-state-and-optimistic-guardrail?format=agents"}},{"id":"nextjs-15-server-actions-csrf-boundary","title":"Next.js 15 Server Actions Origin Validation and CSRF Boundary Enforcement","category":"frontend","severity":"critical","description":"Next.js 15 Server Actions expose public HTTP POST endpoints vulnerable to cross-origin abuse, host header spoofing behind reverse proxies, and unauthorized state mutation. Architects and developers must configure explicit `serverActions.allowedOrigins` in multi-domain or proxied deployments and enforce mandatory server-side authentication, origin verification, and schema validation inside every action body.","antiPatternHeadline":"Treating Server Actions as Protected Internal Methods Without Origin Allowlisting or In-Action Session Guards","stars_count":113,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs","server-actions","csrf","security","next15"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-server-actions-csrf-boundary?format=claude","cursorMdc":"/api/rules/nextjs-15-server-actions-csrf-boundary?format=mdc","cursorrules":"/api/rules/nextjs-15-server-actions-csrf-boundary?format=cursor","windsurf":"/api/rules/nextjs-15-server-actions-csrf-boundary?format=windsurf","agents":"/api/rules/nextjs-15-server-actions-csrf-boundary?format=agents"}},{"id":"fastify-5-schema-encapsulation-guardrails","title":"Fastify 5 Encapsulation Boundaries, Custom Compilers, and Route Scopes","category":"backend","severity":"critical","description":"Enforces boundary encapsulation in Fastify 5 to prevent schema contamination and hook leakage across plugin hierarchies. Mandates isolated route contexts for hooks and serializers while preserving safe centralized schema resolution via fast-json-stringify and Ajv.","antiPatternHeadline":"Leaking Route-Level Hooks and Schema Collisions Across Sibling Contexts via Misused fastify-plugin Hoisting","stars_count":73,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastify","fastify-5","validation","encapsulation","typebox"],"exportEndpoints":{"claude":"/api/rules/fastify-5-schema-encapsulation-guardrails?format=claude","cursorMdc":"/api/rules/fastify-5-schema-encapsulation-guardrails?format=mdc","cursorrules":"/api/rules/fastify-5-schema-encapsulation-guardrails?format=cursor","windsurf":"/api/rules/fastify-5-schema-encapsulation-guardrails?format=windsurf","agents":"/api/rules/fastify-5-schema-encapsulation-guardrails?format=agents"}},{"id":"surrealdb-2-live-queries-record-links-standard","title":"SurrealDB 2.0 Graph Relations, Record Linkage, and Live Subscription Lifecycle Management","category":"backend","severity":"critical","description":"Enforces typed RecordId instantiation, atomic graph relations (RELATE), and strict lifecycle management for SurrealDB 2.0 Live Queries. Prevents memory leaks from orphaned live query UUIDs and data corruption from untyped string-concatenated record links during WebSocket streaming.","antiPatternHeadline":"Leaking Live Query Subscriptions via Unkilled UUIDs and Corrupting Graph Relations with String-Interpolated IDs","stars_count":93,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["surrealdb","backend","websockets","graph-database","typescript"],"exportEndpoints":{"claude":"/api/rules/surrealdb-2-live-queries-record-links-standard?format=claude","cursorMdc":"/api/rules/surrealdb-2-live-queries-record-links-standard?format=mdc","cursorrules":"/api/rules/surrealdb-2-live-queries-record-links-standard?format=cursor","windsurf":"/api/rules/surrealdb-2-live-queries-record-links-standard?format=windsurf","agents":"/api/rules/surrealdb-2-live-queries-record-links-standard?format=agents"}},{"id":"duckdb-nodejs-zero-copy-arrow-ingest","title":"Zero-Copy Apache Arrow Ingest and Safe Connection Management in DuckDB Node.js","category":"backend","severity":"critical","description":"Enforces zero-copy Apache Arrow table hydration and query consumption when interacting with DuckDB in Node.js. Prevents event-loop starvation and OOM crashes caused by intermediate JavaScript object serialization of high-cardinality result sets. Mandates dedicated per-thread or isolated connection contexts to guarantee thread safety and memory reclamation during concurrent OLAP evaluations.","antiPatternHeadline":"Converting Large Arrow RecordBatches to Plain JavaScript Object Arrays with Shared DuckDB Connections","stars_count":71,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","duckdb","apache-arrow","olap","node-js","zero-copy","memory-management"],"exportEndpoints":{"claude":"/api/rules/duckdb-nodejs-zero-copy-arrow-ingest?format=claude","cursorMdc":"/api/rules/duckdb-nodejs-zero-copy-arrow-ingest?format=mdc","cursorrules":"/api/rules/duckdb-nodejs-zero-copy-arrow-ingest?format=cursor","windsurf":"/api/rules/duckdb-nodejs-zero-copy-arrow-ingest?format=windsurf","agents":"/api/rules/duckdb-nodejs-zero-copy-arrow-ingest?format=agents"}},{"id":"valkey-8-threaded-io-cluster-failover-standard-valkey-8-0-threa-935","title":"Valkey 8.0 Threaded I/O, Cluster Slot Redirects, and Hash-Tag Script Atomicity","category":"backend","severity":"critical","description":"Valkey 8.0 leverages an asymmetric multi-threaded I/O engine while retaining single-threaded core execution. In a clustered topology, all multi-key operations and Lua scripts must strictly isolate keys to a single hash slot via curly-brace hash tags, and client instances must implement dynamic topology refresh listeners to handle MOVED and ASK slot redirects transparently during failovers without socket pool exhaustion.","antiPatternHeadline":"Executing untagged multi-key Lua scripts and naive connection routing leading to CROSSSLOT errors and cluster failover blackouts.","stars_count":118,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","valkey","redis","clustering","concurrency","distributed-systems"],"exportEndpoints":{"claude":"/api/rules/valkey-8-threaded-io-cluster-failover-standard-valkey-8-0-threa-935?format=claude","cursorMdc":"/api/rules/valkey-8-threaded-io-cluster-failover-standard-valkey-8-0-threa-935?format=mdc","cursorrules":"/api/rules/valkey-8-threaded-io-cluster-failover-standard-valkey-8-0-threa-935?format=cursor","windsurf":"/api/rules/valkey-8-threaded-io-cluster-failover-standard-valkey-8-0-threa-935?format=windsurf","agents":"/api/rules/valkey-8-threaded-io-cluster-failover-standard-valkey-8-0-threa-935?format=agents"}},{"id":"langgraph-stateful-checkpointers-hitl-standard","title":"LangGraph Persistent Checkpointing and Resumable Human-in-the-Loop Orchestration","category":"backend","severity":"critical","description":"Enforces enterprise-grade state persistence, thread-safe checkpoints, and safe Human-in-the-Loop (HITL) workflows in LangGraph. Mandates durable checkpointer storage, idempotent node execution, and isolated post-approval side effects to prevent duplicate external actions during graph replay.","antiPatternHeadline":"Volatile In-Memory Checkpointing, Side-Effect Leaks Prior to Interrupts, and Thread Contamination","stars_count":52,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","langgraph","agents","human-in-the-loop","state-machine","checkpointer"],"exportEndpoints":{"claude":"/api/rules/langgraph-stateful-checkpointers-hitl-standard?format=claude","cursorMdc":"/api/rules/langgraph-stateful-checkpointers-hitl-standard?format=mdc","cursorrules":"/api/rules/langgraph-stateful-checkpointers-hitl-standard?format=cursor","windsurf":"/api/rules/langgraph-stateful-checkpointers-hitl-standard?format=windsurf","agents":"/api/rules/langgraph-stateful-checkpointers-hitl-standard?format=agents"}},{"id":"litellm-proxy-resilience-quota-routing","title":"LiteLLM Proxy Multi-Provider Failover, Semantic Cache TTLs, and Budget Routing","category":"backend","severity":"critical","description":"Enforces enterprise-grade resilience and financial governance across LiteLLM Proxy gateway integrations. Mandates deterministic model-tier fallback routing, bounded semantic cache TTLs with similarity thresholds, and strict upstream token budget enforcement to eliminate unmitigated failover loops and cascade billing overages.","antiPatternHeadline":"Unbounded Primary-Model Routing with Indefinite Semantic Caching and Unchecked Rate-Limit Exhaustion","stars_count":44,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","litellm","llm-gateway","resilience","caching","cost-governance"],"exportEndpoints":{"claude":"/api/rules/litellm-proxy-resilience-quota-routing?format=claude","cursorMdc":"/api/rules/litellm-proxy-resilience-quota-routing?format=mdc","cursorrules":"/api/rules/litellm-proxy-resilience-quota-routing?format=cursor","windsurf":"/api/rules/litellm-proxy-resilience-quota-routing?format=windsurf","agents":"/api/rules/litellm-proxy-resilience-quota-routing?format=agents"}},{"id":"postgres-17-logical-replication-failover-buffers-standard","title":"PostgreSQL 17 Failover Slot Synchronization and Memory Buffer Invariants","category":"backend","severity":"critical","description":"Enforces PostgreSQL 17 logical replication failover slot synchronization and precise memory allocation across streaming pipelines. Prevents catastrophic primary disk exhaustion from unmanaged WAL accumulation, consumer desynchronization on physical replica promotion, and out-of-memory crashes from unconstrained logical decoding buffers.","antiPatternHeadline":"Creating unmonitored logical replication slots without failover sync, max WAL retention limits, and bounded decoding memory","stars_count":58,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql-17","logical-replication","failover-slots","shared-buffers","wal-retention"],"exportEndpoints":{"claude":"/api/rules/postgres-17-logical-replication-failover-buffers-standard?format=claude","cursorMdc":"/api/rules/postgres-17-logical-replication-failover-buffers-standard?format=mdc","cursorrules":"/api/rules/postgres-17-logical-replication-failover-buffers-standard?format=cursor","windsurf":"/api/rules/postgres-17-logical-replication-failover-buffers-standard?format=windsurf","agents":"/api/rules/postgres-17-logical-replication-failover-buffers-standard?format=agents"}},{"id":"drizzle-orm-prepared-statements-pooling-standard","title":"Drizzle ORM 0.38 Prepared Statements, Connection Pool Sizing, and Transaction Isolation","category":"backend","severity":"critical","description":"Enforces strict connection pool lifecycle boundaries, parameter placeholder reuse in prepared statements, and lexical transaction handle isolation in Drizzle ORM 0.38+. Eliminates pool starvation, prepared statement cache thrashing, and uncommitted phantom state during failed transactional execution.","antiPatternHeadline":"Escaping Lexical Transaction Scopes and Constructing Dynamic Unparameterized Prepared Statements","stars_count":89,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","drizzle-orm","postgresql","connection-pooling","transactions","prepared-statements"],"exportEndpoints":{"claude":"/api/rules/drizzle-orm-prepared-statements-pooling-standard?format=claude","cursorMdc":"/api/rules/drizzle-orm-prepared-statements-pooling-standard?format=mdc","cursorrules":"/api/rules/drizzle-orm-prepared-statements-pooling-standard?format=cursor","windsurf":"/api/rules/drizzle-orm-prepared-statements-pooling-standard?format=windsurf","agents":"/api/rules/drizzle-orm-prepared-statements-pooling-standard?format=agents"}},{"id":"temporal-workflow-determinism-heartbeat-standard","title":"Temporal Deterministic Workflow Orchestration and Resilient Activity Lifecycle","category":"backend","severity":"critical","description":"Temporal workflows must be strictly deterministic to ensure replay safety during event history reconstruction. Long-running activities must define explicit heartbeat timeouts with periodic heartbeat emissions, and all workflow waiting states must use SDK non-blocking timers instead of native runtime timers.","antiPatternHeadline":"Non-Deterministic Workflow Logic, Native System Timers, and Unmonitored Long-Running Activities","stars_count":43,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","temporal","orchestration","distributed-systems","event-sourcing"],"exportEndpoints":{"claude":"/api/rules/temporal-workflow-determinism-heartbeat-standard?format=claude","cursorMdc":"/api/rules/temporal-workflow-determinism-heartbeat-standard?format=mdc","cursorrules":"/api/rules/temporal-workflow-determinism-heartbeat-standard?format=cursor","windsurf":"/api/rules/temporal-workflow-determinism-heartbeat-standard?format=windsurf","agents":"/api/rules/temporal-workflow-determinism-heartbeat-standard?format=agents"}},{"id":"kafka-3-9-kraft-idempotent-producer-standards","title":"Kafka 3.9 KRaft Metadata Quorum & Exactly-Once Idempotent Producer Invariants","category":"backend","severity":"critical","description":"Enforces strict configuration and runtime transactional semantics for Kafka 3.9 ZooKeeper-less (KRaft) metadata quorums. Guarantees message deduplication via idempotent producer settings and prevents split-brain partition states during controller leader elections and cooperative sticky consumer group rebalances.","antiPatternHeadline":"Non-idempotent producer configurations with blind retries and non-transactional commits causing data duplication during KRaft controller failover","stars_count":115,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","kafka","kraft","event-driven","distributed-systems","node-rdkafka","confluent"],"exportEndpoints":{"claude":"/api/rules/kafka-3-9-kraft-idempotent-producer-standards?format=claude","cursorMdc":"/api/rules/kafka-3-9-kraft-idempotent-producer-standards?format=mdc","cursorrules":"/api/rules/kafka-3-9-kraft-idempotent-producer-standards?format=cursor","windsurf":"/api/rules/kafka-3-9-kraft-idempotent-producer-standards?format=windsurf","agents":"/api/rules/kafka-3-9-kraft-idempotent-producer-standards?format=agents"}},{"id":"meilisearch-1-12-hybrid-search-tenant-tokens","title":"Meilisearch 1.12 Vector Hybrid Search Pagination, Scoped Tenant Tokens, and Typo Invariants","category":"backend","severity":"critical","description":"Enforces secure multi-tenant isolation, deterministic semantic search pagination, and strict typo-tolerance boundaries in Meilisearch 1.12+. Mandates cryptographic tenant token generation with embedded tenant filters, offset-to-limit pagination bounds for vector rankers, and disables typo-tolerance on high-entropy unique entity identifiers.","antiPatternHeadline":"Leaking Cross-Tenant Records via Unsigned Search Queries, Typo Corruption on IDs, and Silent Truncation in Vector Hybrid Pagination","stars_count":106,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","meilisearch","vector-search","multi-tenancy","security","embeddings"],"exportEndpoints":{"claude":"/api/rules/meilisearch-1-12-hybrid-search-tenant-tokens?format=claude","cursorMdc":"/api/rules/meilisearch-1-12-hybrid-search-tenant-tokens?format=mdc","cursorrules":"/api/rules/meilisearch-1-12-hybrid-search-tenant-tokens?format=cursor","windsurf":"/api/rules/meilisearch-1-12-hybrid-search-tenant-tokens?format=windsurf","agents":"/api/rules/meilisearch-1-12-hybrid-search-tenant-tokens?format=agents"}},{"id":"redis-7-4-hash-ttl-stream-pel-lifecycle","title":"Redis 7.4 Field-Level Hash TTL Invalidation and Stream PEL Retention Guardrails","category":"backend","severity":"critical","description":"Mandates deterministic key lifecycle management using Redis 7.4 per-field hash expiration (HEXPIRE/HPEXPIRE) to eliminate key-space fragmentation and expensive multi-key invalidations. Enforces strict idempotent processing and proactive Pending Entries List (PEL) reclamation (XAUTOCLAIM) for Redis Streams to prevent unbounded memory bloat and silent message drops under volatile eviction policies.","antiPatternHeadline":"Unbounded Consumer Group PEL Growth and Whole-Key Invalidation with Stale Hash Fields","stars_count":80,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","redis-7.4","hexpire","redis-streams","pel","cache-invalidation","memory-eviction"],"exportEndpoints":{"claude":"/api/rules/redis-7-4-hash-ttl-stream-pel-lifecycle?format=claude","cursorMdc":"/api/rules/redis-7-4-hash-ttl-stream-pel-lifecycle?format=mdc","cursorrules":"/api/rules/redis-7-4-hash-ttl-stream-pel-lifecycle?format=cursor","windsurf":"/api/rules/redis-7-4-hash-ttl-stream-pel-lifecycle?format=windsurf","agents":"/api/rules/redis-7-4-hash-ttl-stream-pel-lifecycle?format=agents"}},{"id":"tauri-v2-mobile-ipc-permissions-guardrail","title":"Tauri 2.0 Mobile IPC Isolation and Capabilities Permission Scoping","category":"mobile","severity":"critical","description":"Enforces strict capability permission boundaries, payload validation, and secure IPC invoke scoping for Tauri v2 Android and iOS environments. Prevents arbitrary IPC command execution, excessive native privilege granting, and deserialization vulnerabilities across the mobile webview-native boundary.","antiPatternHeadline":"Wildcard Permissions and Unsanitized Tauri v2 Mobile IPC Invocations","stars_count":58,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri-v2","ipc","permissions","capabilities","rust","security"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-mobile-ipc-permissions-guardrail?format=claude","cursorMdc":"/api/rules/tauri-v2-mobile-ipc-permissions-guardrail?format=mdc","cursorrules":"/api/rules/tauri-v2-mobile-ipc-permissions-guardrail?format=cursor","windsurf":"/api/rules/tauri-v2-mobile-ipc-permissions-guardrail?format=windsurf","agents":"/api/rules/tauri-v2-mobile-ipc-permissions-guardrail?format=agents"}},{"id":"capacitor-7-native-bridge-biometric-auth","title":"Capacitor 7 Native Bridge Invariants, Hardware Keystore, and Android 15 Edge-to-Edge","category":"mobile","severity":"critical","description":"Enforces strict lifecycle management for Capacitor 7 native bridges, hardware-backed Keystore/Secure Enclave token persistence, and Android 15 edge-to-edge layout constraints. Prevents memory leaks from uncleaned plugin listeners, token exposure in unencrypted WebStorage, and UI occlusions caused by mandatory window insets.","antiPatternHeadline":"Persisting Session Tokens in Web Storage and Leaking Capacitor Plugin Listeners Under Android 15 Insets","stars_count":111,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","biometrics","security","android-15","ios-keychain"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-native-bridge-biometric-auth?format=claude","cursorMdc":"/api/rules/capacitor-7-native-bridge-biometric-auth?format=mdc","cursorrules":"/api/rules/capacitor-7-native-bridge-biometric-auth?format=cursor","windsurf":"/api/rules/capacitor-7-native-bridge-biometric-auth?format=windsurf","agents":"/api/rules/capacitor-7-native-bridge-biometric-auth?format=agents"}},{"id":"react-native-076-bridgeless-turbomodules","title":"React Native 0.76+ Bridgeless TurboModule Specification and Thread-Safety Standard","category":"mobile","severity":"critical","description":"Enforces strict Codegen-backed TurboModule contracts in React Native 0.76+ New Architecture with Bridgeless Mode enabled. Prohibits legacy NativeModules bridge invocations, uncontrolled synchronous JSI execution on the main UI/Fabric render pipeline, and non-thread-safe C++ mutable state across JavaScript and native runtime threads.","antiPatternHeadline":"Invoking legacy NativeModules bridge or running blocking synchronous JSI methods on the Fabric UI commit path.","stars_count":74,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","react-native","turbomodules","jsi","bridgeless","fabric","codegen"],"exportEndpoints":{"claude":"/api/rules/react-native-076-bridgeless-turbomodules?format=claude","cursorMdc":"/api/rules/react-native-076-bridgeless-turbomodules?format=mdc","cursorrules":"/api/rules/react-native-076-bridgeless-turbomodules?format=cursor","windsurf":"/api/rules/react-native-076-bridgeless-turbomodules?format=windsurf","agents":"/api/rules/react-native-076-bridgeless-turbomodules?format=agents"}},{"id":"swift6-strict-concurrency-actor-reentrancy","title":"Swift 6 Strict Concurrency, Actor Reentrancy Guardrails, and Isolation Boundaries","category":"mobile","severity":"critical","description":"Enforces Swift 6 complete concurrency safety across iOS/macOS codebases. Mandates strict state verification before and after suspension points (`await`) to prevent actor reentrancy corruption, strictly enforces Sendable compliance across actor isolation domains, and prohibits cooperative thread pool starvation or unbounded background Tasks.","antiPatternHeadline":"Corrupting actor invariants across asynchronous suspension points and leaking non-Sendable mutable state into unconstrained Task boundaries","stars_count":119,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","swift","swift6","concurrency","actors","reentrancy","sendable","async-await"],"exportEndpoints":{"claude":"/api/rules/swift6-strict-concurrency-actor-reentrancy?format=claude","cursorMdc":"/api/rules/swift6-strict-concurrency-actor-reentrancy?format=mdc","cursorrules":"/api/rules/swift6-strict-concurrency-actor-reentrancy?format=cursor","windsurf":"/api/rules/swift6-strict-concurrency-actor-reentrancy?format=windsurf","agents":"/api/rules/swift6-strict-concurrency-actor-reentrancy?format=agents"}},{"id":"kotlin-k2-coroutine-scope-lifecycle-invariants","title":"Kotlin 2.0 K2 Coroutine Scope Disposal and Structured Concurrency","category":"mobile","severity":"critical","description":"Enforces strict structured concurrency in Jetpack Compose and ViewModel architectures under Kotlin 2.0 K2. Mandates explicit scope lifecycle management, prevents orphaned jobs across recompositions, enforces safe StateFlow sharing with SharingStarted.WhileSubscribed(5000), and eliminates GlobalScope and unconstrained CoroutineScope leaks.","antiPatternHeadline":"Unbounded Job Spawning, GlobalScope Leaks, and Active Flow Upstreams in Dead ViewModels or Detached Composables","stars_count":68,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin","coroutines","jetpack-compose","android","k2"],"exportEndpoints":{"claude":"/api/rules/kotlin-k2-coroutine-scope-lifecycle-invariants?format=claude","cursorMdc":"/api/rules/kotlin-k2-coroutine-scope-lifecycle-invariants?format=mdc","cursorrules":"/api/rules/kotlin-k2-coroutine-scope-lifecycle-invariants?format=cursor","windsurf":"/api/rules/kotlin-k2-coroutine-scope-lifecycle-invariants?format=windsurf","agents":"/api/rules/kotlin-k2-coroutine-scope-lifecycle-invariants?format=agents"}},{"id":"flutter-riverpod-codegen-reactivity-lifecycle","title":"Flutter 3.27 & Riverpod 2.6 Codegen, Reactivity Safety, and AutoDispose Invariants","category":"mobile","severity":"critical","description":"Enforces strict architectural boundaries for Riverpod 2.6 code generation within Flutter 3.27 projects. Mandates typed code-generated providers (@riverpod), explicitly manages AutoDispose lifecycles with ref.onDispose cancellation, and strictly prohibits invalid ref.watch invocations inside asynchronous execution blocks or event callbacks.","antiPatternHeadline":"Unsafe ref.watch Invocations in Async Closures and Unmanaged AutoDispose Network Thrashing","stars_count":61,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","flutter","riverpod","code-generation","dart","state-management"],"exportEndpoints":{"claude":"/api/rules/flutter-riverpod-codegen-reactivity-lifecycle?format=claude","cursorMdc":"/api/rules/flutter-riverpod-codegen-reactivity-lifecycle?format=mdc","cursorrules":"/api/rules/flutter-riverpod-codegen-reactivity-lifecycle?format=cursor","windsurf":"/api/rules/flutter-riverpod-codegen-reactivity-lifecycle?format=windsurf","agents":"/api/rules/flutter-riverpod-codegen-reactivity-lifecycle?format=agents"}},{"id":"expo-router-v4-dynamic-deep-linking-hydration","title":"Expo Router v4 Deep Linking and Splash Screen Hydration Synchronization","category":"mobile","severity":"critical","description":"Enforces deterministic root navigation hydration before dismissing splash screens and mandates type-safe dynamic deep link routing in Expo SDK 52 Router v4. Prevents race conditions where incoming universal links or scheme URIs attempt navigation actions before the root layout navigation state key resolves, resulting in dropped deep links, black screens, or default fallbacks.","antiPatternHeadline":"Premature Splash Dismissal and Unsynchronized Navigation During Deep Link Mount","stars_count":116,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["expo","expo-router","deep-linking","react-native","splash-screen","typed-routes"],"exportEndpoints":{"claude":"/api/rules/expo-router-v4-dynamic-deep-linking-hydration?format=claude","cursorMdc":"/api/rules/expo-router-v4-dynamic-deep-linking-hydration?format=mdc","cursorrules":"/api/rules/expo-router-v4-dynamic-deep-linking-hydration?format=cursor","windsurf":"/api/rules/expo-router-v4-dynamic-deep-linking-hydration?format=windsurf","agents":"/api/rules/expo-router-v4-dynamic-deep-linking-hydration?format=agents"}},{"id":"android-15-edge-to-edge-insets-production-standard","title":"Mandatory Android 15 Edge-to-Edge Layout, Insets Handling, and Predictive Back","category":"mobile","severity":"critical","description":"Android 15 (API level 35) enforces edge-to-edge layouts by default for applications targeting targetSdk 35, ignoring legacy window flags such as fitsSystemWindows=true on root decors. Failure to explicitly consume WindowInsetsCompat or Compose WindowInsets results in critical visual clipping beneath navigation bars, status bars, and display cutouts. In addition, applications must implement OnBackAnimationCallback or predictiveBackAnimation modifier to handle system back navigations without gesture conflicts.","antiPatternHeadline":"Relying on deprecated fitsSystemWindows attributes or hardcoded status/nav bar offsets on Android 15","stars_count":44,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","android","kotlin","jetpack-compose","window-insets","predictive-back","android-15"],"exportEndpoints":{"claude":"/api/rules/android-15-edge-to-edge-insets-production-standard?format=claude","cursorMdc":"/api/rules/android-15-edge-to-edge-insets-production-standard?format=mdc","cursorrules":"/api/rules/android-15-edge-to-edge-insets-production-standard?format=cursor","windsurf":"/api/rules/android-15-edge-to-edge-insets-production-standard?format=windsurf","agents":"/api/rules/android-15-edge-to-edge-insets-production-standard?format=agents"}},{"id":"swiftui-ios18-observation-swiftdata-guardrails","title":"SwiftUI iOS 18 Observation Framework & SwiftData Actor Confinement","category":"mobile","severity":"critical","description":"Enforces strict adherence to iOS 18 Observation framework migration patterns and SwiftData concurrency guarantees. Prohibits mixing Combine-based ObservableObject/Published patterns with the @Observable macro, prevents cross-actor ModelContext and PersistentModel access, and mandates chunked batch saves within dedicated ModelActor instances.","antiPatternHeadline":"Mixing ObservableObject with @Observable, Passing ModelContext Across Actor Boundaries, and Performing Unbatched Bulk SwiftData Writes","stars_count":112,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","ios","swift","swiftui","swiftdata","concurrency","observation"],"exportEndpoints":{"claude":"/api/rules/swiftui-ios18-observation-swiftdata-guardrails?format=claude","cursorMdc":"/api/rules/swiftui-ios18-observation-swiftdata-guardrails?format=mdc","cursorrules":"/api/rules/swiftui-ios18-observation-swiftdata-guardrails?format=cursor","windsurf":"/api/rules/swiftui-ios18-observation-swiftdata-guardrails?format=windsurf","agents":"/api/rules/swiftui-ios18-observation-swiftdata-guardrails?format=agents"}},{"id":"react-native-mmkv-synchronous-sandboxing-standard","title":"React Native MMKV Instance Sandboxing, Synchronous JSI Access, and Encryption Invariants","category":"mobile","severity":"critical","description":"Enforces synchronous JSI read/write operations and strict multi-instance sandboxing with hardware-keystore-backed encryption for react-native-mmkv. Prohibits wrapping MMKV calls in asynchronous microtasks, hardcoding cryptographic keys, and sharing a single un-namespaced storage instance across multi-tenant or domain boundaries.","antiPatternHeadline":"Treating MMKV as Asynchronous Storage, Using Default Global Instances Across Tenants, and Hardcoding Encryption Keys","stars_count":113,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","react-native","mmkv","jsi","security","performance","state-management"],"exportEndpoints":{"claude":"/api/rules/react-native-mmkv-synchronous-sandboxing-standard?format=claude","cursorMdc":"/api/rules/react-native-mmkv-synchronous-sandboxing-standard?format=mdc","cursorrules":"/api/rules/react-native-mmkv-synchronous-sandboxing-standard?format=cursor","windsurf":"/api/rules/react-native-mmkv-synchronous-sandboxing-standard?format=windsurf","agents":"/api/rules/react-native-mmkv-synchronous-sandboxing-standard?format=agents"}},{"id":"kmp-ktor-sqldelight-driver-concurrency-standard","title":"KMP Shared Network & Database: Ktor Concurrency, Driver Isolation, and SQLDelight Migrations","category":"mobile","severity":"critical","description":"Enforces strict native memory and concurrency safety across Kotlin Multiplatform targets using Ktor HTTP Client and SQLDelight. Eliminates thread-freezing violations, race conditions, driver resource leaks, and schema version drift between iOS and Android runtime boundaries.","antiPatternHeadline":"Global Unconfined Ktor Clients and Unmanaged Native SqlDriver Singletons Causing iOS Runtime Panics and Corrupted Schema Migrations","stars_count":113,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","ktor","sqldelight","coroutines","sqlite","ios-concurrency"],"exportEndpoints":{"claude":"/api/rules/kmp-ktor-sqldelight-driver-concurrency-standard?format=claude","cursorMdc":"/api/rules/kmp-ktor-sqldelight-driver-concurrency-standard?format=mdc","cursorrules":"/api/rules/kmp-ktor-sqldelight-driver-concurrency-standard?format=cursor","windsurf":"/api/rules/kmp-ktor-sqldelight-driver-concurrency-standard?format=windsurf","agents":"/api/rules/kmp-ktor-sqldelight-driver-concurrency-standard?format=agents"}},{"id":"openfga-rebac-graph-integrity-and-context-verification","title":"OpenFGA Graph Invariants: Cyclic Relation Prevention & Contextual Tuple Hardening","category":"security","severity":"critical","description":"Enforces strict directed acyclic graph (DAG) topology validation during relationship mutation writes and mandates strict server-side schema verification for ephemeral contextual tuples in OpenFGA evaluations. Prohibits persistent storage of ephemeral request attributes and guards against recursive relation loops causing graph expansion denial-of-service.","antiPatternHeadline":"Persisting Ephemeral Request State as Store Tuples and Unvalidated Cyclic Parent-Child Relationship Writes","stars_count":105,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","rebac","openfga","zanzibar","authorization","graph-algorithms"],"exportEndpoints":{"claude":"/api/rules/openfga-rebac-graph-integrity-and-context-verification?format=claude","cursorMdc":"/api/rules/openfga-rebac-graph-integrity-and-context-verification?format=mdc","cursorrules":"/api/rules/openfga-rebac-graph-integrity-and-context-verification?format=cursor","windsurf":"/api/rules/openfga-rebac-graph-integrity-and-context-verification?format=windsurf","agents":"/api/rules/openfga-rebac-graph-integrity-and-context-verification?format=agents"}},{"id":"webauthn-conditional-ui-assertion-verification","title":"WebAuthn Conditional UI Mediation, Nonce Atomicity, and Assertion Cryptographic Verification","category":"security","severity":"critical","description":"Enforces zero-trust cryptographic validation for FIDO2/WebAuthn Passkey authentication with Conditional UI autofill. Requires atomic single-use challenge consumption to eliminate replay attacks, strict RP ID hash and origin binding, authenticatorData flag verification (User Presence and User Verification), and monotonic signature counter enforcement to detect authenticator cloning.","antiPatternHeadline":"Stateless challenge verification, unverified origin/RP ID, and ignored signature counters permitting passkey replay and authenticator cloning attacks.","stars_count":81,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","fido2","passkeys","cryptography","conditional-ui","replay-prevention"],"exportEndpoints":{"claude":"/api/rules/webauthn-conditional-ui-assertion-verification?format=claude","cursorMdc":"/api/rules/webauthn-conditional-ui-assertion-verification?format=mdc","cursorrules":"/api/rules/webauthn-conditional-ui-assertion-verification?format=cursor","windsurf":"/api/rules/webauthn-conditional-ui-assertion-verification?format=windsurf","agents":"/api/rules/webauthn-conditional-ui-assertion-verification?format=agents"}},{"id":"sigstore-cosign-keyless-attestation-policy-standard","title":"Enforce Sigstore Keyless OIDC Attestation and Admission Controller Verification","category":"security","severity":"critical","description":"Enforces immutable supply-chain security using Sigstore Cosign keyless signing via ephemeral OIDC tokens issued by Fulcio and verified against the Rekor transparency log. Container workloads must be signed and attested at build time by digest, and admission controllers (such as Kyverno or Sigstore Policy Controller) must strictly validate the OIDC issuer and subject identity before allowing image execution.","antiPatternHeadline":"Bypassing transparency logs with static long-lived private keys or deploying unverified mutable image tags without admission control","stars_count":111,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","sigstore","cosign","supply-chain","kubernetes","kyverno","containers"],"exportEndpoints":{"claude":"/api/rules/sigstore-cosign-keyless-attestation-policy-standard?format=claude","cursorMdc":"/api/rules/sigstore-cosign-keyless-attestation-policy-standard?format=mdc","cursorrules":"/api/rules/sigstore-cosign-keyless-attestation-policy-standard?format=cursor","windsurf":"/api/rules/sigstore-cosign-keyless-attestation-policy-standard?format=windsurf","agents":"/api/rules/sigstore-cosign-keyless-attestation-policy-standard?format=agents"}},{"id":"vault-dynamic-db-credentials-rotation-guardrail","title":"HashiCorp Vault Ephemeral Database Credentials and Lease-Aware Connection Pool Lifecycle","category":"security","severity":"critical","description":"Production services interacting with relational datastores must consume short-lived ephemeral credentials issued dynamically by HashiCorp Vault with zero persistent root or shared credentials in configuration. Application connection pools must actively monitor lease TTLs, schedule proactive renewals before expiry, and gracefully drain and refresh database connection pools upon credential rotation without service downtime.","antiPatternHeadline":"Static Database Credentials and Non-Rotating Long-Lived Connection Pools Leading to Outages or Compromise","stars_count":89,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","vault","database","secrets-management","zero-trust","credential-rotation"],"exportEndpoints":{"claude":"/api/rules/vault-dynamic-db-credentials-rotation-guardrail?format=claude","cursorMdc":"/api/rules/vault-dynamic-db-credentials-rotation-guardrail?format=mdc","cursorrules":"/api/rules/vault-dynamic-db-credentials-rotation-guardrail?format=cursor","windsurf":"/api/rules/vault-dynamic-db-credentials-rotation-guardrail?format=windsurf","agents":"/api/rules/vault-dynamic-db-credentials-rotation-guardrail?format=agents"}},{"id":"owasp-llm01-indirect-injection-sandboxing","title":"OWASP LLM-01 Indirect Prompt Injection Sandboxing, Delimiter Escaping & Deterministic Intent Verification","category":"security","severity":"critical","description":"Untrusted text from RAG retrievals, web scrapers, and external APIs must be treated as untrusted user payload rather than prompt instructions. Applications must enforce rigorous XML tag sanitization, strict isolation within defined data boundaries, and secondary schema-driven deterministic verification before triggering downstream tool executions or state changes.","antiPatternHeadline":"Unsanitized RAG string interpolation directly executing privileged tool actions based on unverified LLM output.","stars_count":41,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","owasp-llm-01","prompt-injection","rag","sandboxing","llm-guardrails"],"exportEndpoints":{"claude":"/api/rules/owasp-llm01-indirect-injection-sandboxing?format=claude","cursorMdc":"/api/rules/owasp-llm01-indirect-injection-sandboxing?format=mdc","cursorrules":"/api/rules/owasp-llm01-indirect-injection-sandboxing?format=cursor","windsurf":"/api/rules/owasp-llm01-indirect-injection-sandboxing?format=windsurf","agents":"/api/rules/owasp-llm01-indirect-injection-sandboxing?format=agents"}},{"id":"spiffe-spire-x509-svid-rotation-guardrail","title":"SPIFFE/SPIRE Zero-Trust Workload Identity Attestation and Hot-Reloading","category":"security","severity":"critical","description":"Enforces strict validation, dynamic in-memory hot-reloading, and trust-bundle verification for SPIFFE X.509 SVIDs over short-lived mTLS connections. Prevents static certificate caching, filesystem secret leakage, and permissive Subject Alternative Name (SAN) validation in microservice workloads.","antiPatternHeadline":"Static SVID Loading and Wildcard DNS/SAN Trust Bypass","stars_count":73,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","spiffe","spire","zero-trust","mtls","svid"],"exportEndpoints":{"claude":"/api/rules/spiffe-spire-x509-svid-rotation-guardrail?format=claude","cursorMdc":"/api/rules/spiffe-spire-x509-svid-rotation-guardrail?format=mdc","cursorrules":"/api/rules/spiffe-spire-x509-svid-rotation-guardrail?format=cursor","windsurf":"/api/rules/spiffe-spire-x509-svid-rotation-guardrail?format=windsurf","agents":"/api/rules/spiffe-spire-x509-svid-rotation-guardrail?format=agents"}},{"id":"oauth2-dpop-replay-and-binding-verification-standard","title":"OAuth 2.1 DPoP Proof Validation, Nonce Enforcement, and Token Binding Verification","category":"security","severity":"critical","description":"Mandates strict RFC 9449 compliance for DPoP (Demonstrating Proof-of-Possession) verification across Authorization Servers and Resource Servers. Enforces asymmetric key thumbprint matching (jkt/cnf), cryptographic validation of DPoP proof headers and claims (typ, htm, htu, ath, nonce), and distributed jti cache tracking to prevent replay attacks within clock skew bounds.","antiPatternHeadline":"Bypassing DPoP Nonce Validation, Ignoring Access Token Hash (ath), or Accepting Unbound Bearer Tokens","stars_count":103,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","oauth2","dpop","rfc9449","replay-prevention","jwt"],"exportEndpoints":{"claude":"/api/rules/oauth2-dpop-replay-and-binding-verification-standard?format=claude","cursorMdc":"/api/rules/oauth2-dpop-replay-and-binding-verification-standard?format=mdc","cursorrules":"/api/rules/oauth2-dpop-replay-and-binding-verification-standard?format=cursor","windsurf":"/api/rules/oauth2-dpop-replay-and-binding-verification-standard?format=windsurf","agents":"/api/rules/oauth2-dpop-replay-and-binding-verification-standard?format=agents"}},{"id":"cilium-tetragon-process-threat-telemetry-guardrail","title":"Kernel-Level Tetragon eBPF Telemetry and Privilege Boundary Enforcement","category":"security","severity":"critical","description":"Enforce real-time kernel-space tracing and synchronous threat remediation using Cilium Tetragon TracingPolicies across Kubernetes workloads. Guardrails mandate in-kernel filtering for execution, namespace boundary crossing (setns/unshare), and capability acquisition to eliminate TOCTOU race conditions and user-space ring buffer flooding.","antiPatternHeadline":"Post-Execution Userspace Auditing and Unfiltered Ring Buffer Event Logging","stars_count":55,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","ebpf","tetragon","cilium","container-security","zero-trust","kubernetes"],"exportEndpoints":{"claude":"/api/rules/cilium-tetragon-process-threat-telemetry-guardrail?format=claude","cursorMdc":"/api/rules/cilium-tetragon-process-threat-telemetry-guardrail?format=mdc","cursorrules":"/api/rules/cilium-tetragon-process-threat-telemetry-guardrail?format=cursor","windsurf":"/api/rules/cilium-tetragon-process-threat-telemetry-guardrail?format=windsurf","agents":"/api/rules/cilium-tetragon-process-threat-telemetry-guardrail?format=agents"}},{"id":"jwt-es256-asymmetric-verification-revocation-standard","title":"Strict ES256 Asymmetric Key Verification, JWKS Cache Invalidation, and Distributed Token Revocation","category":"security","severity":"critical","description":"Enforces immutable cryptographic pinning to ECDSA P-256 (ES256) signature validation with robust JWKS key caching and rate-limiting. Mandates explicit verification of standard claims (iss, aud, exp, nbf) and enforces an atomic distributed blacklist lookup using a unique jti against a shared key-value store to support instantaneous token revocation.","antiPatternHeadline":"Algorithm Confusion, Uncached JWKS Lookups, and Stateless Zombie Tokens","stars_count":118,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","jwt","es256","jwks","ecdsa","redis","authentication"],"exportEndpoints":{"claude":"/api/rules/jwt-es256-asymmetric-verification-revocation-standard?format=claude","cursorMdc":"/api/rules/jwt-es256-asymmetric-verification-revocation-standard?format=mdc","cursorrules":"/api/rules/jwt-es256-asymmetric-verification-revocation-standard?format=cursor","windsurf":"/api/rules/jwt-es256-asymmetric-verification-revocation-standard?format=windsurf","agents":"/api/rules/jwt-es256-asymmetric-verification-revocation-standard?format=agents"}},{"id":"csp-level-3-strict-nonce-trusted-types","title":"Strict CSP L3 Nonce Injection, Strict-Dynamic, and Trusted Types Enforcement","category":"security","severity":"critical","description":"Enforces dynamic, cryptographically secure per-request nonce generation for Content Security Policy Level 3 compliance across all SSR/edge layers. Mandates the elimination of 'unsafe-inline' and 'unsafe-eval' via 'strict-dynamic' and prevents client-side DOM-XSS sinks by enforcing Trusted Types policies.","antiPatternHeadline":"Reusing static nonces, allowing 'unsafe-inline', or bypassing Trusted Types sanitization sinks","stars_count":114,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","csp","xss","trusted-types","ssr","headers"],"exportEndpoints":{"claude":"/api/rules/csp-level-3-strict-nonce-trusted-types?format=claude","cursorMdc":"/api/rules/csp-level-3-strict-nonce-trusted-types?format=mdc","cursorrules":"/api/rules/csp-level-3-strict-nonce-trusted-types?format=cursor","windsurf":"/api/rules/csp-level-3-strict-nonce-trusted-types?format=windsurf","agents":"/api/rules/csp-level-3-strict-nonce-trusted-types?format=agents"}},{"id":"slsa-level-3-cyclonedx-provenance-quarantine","title":"SLSA Level 3 Cryptographic Provenance, CycloneDX SBOM Generation, and Dependency Quarantine","category":"security","severity":"critical","description":"Enforces non-falsifiable SLSA Level 3 cryptographic build provenance and machine-readable CycloneDX Software Bill of Materials (SBOM) generation across all build and release pipelines. Mandates pre-deployment quarantine validation gates that verify in-toto/Cosign attestations, evaluate component hashes against official registries, and block unverified artifacts from execution environments.","antiPatternHeadline":"Deploying Untrusted Artifacts and Ephemeral Dependencies Without Non-Falsifiable SLSA Provenance and Machine-Readable SBOM Verification","stars_count":101,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","supply-chain","slsa-l3","cyclonedx","sbom","cosign","quarantine"],"exportEndpoints":{"claude":"/api/rules/slsa-level-3-cyclonedx-provenance-quarantine?format=claude","cursorMdc":"/api/rules/slsa-level-3-cyclonedx-provenance-quarantine?format=mdc","cursorrules":"/api/rules/slsa-level-3-cyclonedx-provenance-quarantine?format=cursor","windsurf":"/api/rules/slsa-level-3-cyclonedx-provenance-quarantine?format=windsurf","agents":"/api/rules/slsa-level-3-cyclonedx-provenance-quarantine?format=agents"}},{"id":"k8s-gateway-api-v1-canary-standard","title":"Kubernetes Gateway API v1 HTTPRoute Canary and ReferenceGrant Invariants","category":"devops","severity":"critical","description":"Enforces strict conformance to Kubernetes Gateway API v1 specifications during migration from legacy Ingress controllers. Mandates explicit ReferenceGrant resources for cross-namespace routing, strict relative integer weighting for HTTPRoute canary releases, and explicit backendRef port declarations.","antiPatternHeadline":"Cross-Namespace Ingress without ReferenceGrants and Unvalidated Canary Backend Splits","stars_count":86,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","kubernetes","gateway-api","httproute","canary","traffic-management"],"exportEndpoints":{"claude":"/api/rules/k8s-gateway-api-v1-canary-standard?format=claude","cursorMdc":"/api/rules/k8s-gateway-api-v1-canary-standard?format=mdc","cursorrules":"/api/rules/k8s-gateway-api-v1-canary-standard?format=cursor","windsurf":"/api/rules/k8s-gateway-api-v1-canary-standard?format=windsurf","agents":"/api/rules/k8s-gateway-api-v1-canary-standard?format=agents"}},{"id":"argocd-applicationset-matrix-governance-guardrail","title":"ArgoCD ApplicationSet Matrix Generator Invariants & Cascade Deletion Guards","category":"devops","severity":"critical","description":"Enforces strict structural constraints on ArgoCD ApplicationSet Matrix generators combining cluster selectors and Git directories. Prevents catastrophic multi-cluster cascade pruning, accidental secret exposure through parameter interpolation, and runaway Application CR explosion via explicit sync policies, preservation finalizers, and parameter validation.","antiPatternHeadline":"Unbounded Matrix Combinations with Default Cascade Pruning and Raw Secret Interpolation","stars_count":118,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","gitops","argocd","applicationsets","kubernetes","security"],"exportEndpoints":{"claude":"/api/rules/argocd-applicationset-matrix-governance-guardrail?format=claude","cursorMdc":"/api/rules/argocd-applicationset-matrix-governance-guardrail?format=mdc","cursorrules":"/api/rules/argocd-applicationset-matrix-governance-guardrail?format=cursor","windsurf":"/api/rules/argocd-applicationset-matrix-governance-guardrail?format=windsurf","agents":"/api/rules/argocd-applicationset-matrix-governance-guardrail?format=agents"}},{"id":"karpenter-disruption-and-topology-production-standard","title":"Karpenter Resilient Topology, Interruption Queue, and Consolidation Budget Standard","category":"devops","severity":"critical","description":"Enforces deterministic disruption budgets, multi-instance-type diversification, and event-driven SQS interruption queue handling across Karpenter NodePools and EC2NodeClasses. Eliminates cascading eviction loops, instance starvation, and availability downtime during AWS Spot rebalances and underutilized node consolidation.","antiPatternHeadline":"Restricting Spot NodePools to Single Instance Types with Uncapped Consolidation and Missing Interruption Queues","stars_count":40,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","karpenter","kubernetes","aws","spot-instances","infrastructure-as-code"],"exportEndpoints":{"claude":"/api/rules/karpenter-disruption-and-topology-production-standard?format=claude","cursorMdc":"/api/rules/karpenter-disruption-and-topology-production-standard?format=mdc","cursorrules":"/api/rules/karpenter-disruption-and-topology-production-standard?format=cursor","windsurf":"/api/rules/karpenter-disruption-and-topology-production-standard?format=windsurf","agents":"/api/rules/karpenter-disruption-and-topology-production-standard?format=agents"}},{"id":"otel-collector-processor-pipeline-safeguards","title":"OpenTelemetry Collector Processor Pipeline Order and Memory Guardrails","category":"devops","severity":"critical","description":"Mandates strict ordering and configuration of OpenTelemetry Collector processor pipelines. Enforces memory_limiter as the non-negotiable first processor to prevent process crashes, requires OTTL-driven PII redaction before persistence or sampling, and mandates dedicated pipeline tiers for tail-based sampling.","antiPatternHeadline":"Placing batch or sampling processors before memory limiters and exporting raw unredacted telemetry","stars_count":55,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","observability","otel","sre","security"],"exportEndpoints":{"claude":"/api/rules/otel-collector-processor-pipeline-safeguards?format=claude","cursorMdc":"/api/rules/otel-collector-processor-pipeline-safeguards?format=mdc","cursorrules":"/api/rules/otel-collector-processor-pipeline-safeguards?format=cursor","windsurf":"/api/rules/otel-collector-processor-pipeline-safeguards?format=windsurf","agents":"/api/rules/otel-collector-processor-pipeline-safeguards?format=agents"}},{"id":"caddy-on-demand-tls-rate-limiting","title":"Caddy 2 Hardened On-Demand TLS with Ask Endpoint Validation and HTTP/3 Proxying","category":"devops","severity":"critical","description":"Enforces secure On-Demand TLS configuration in Caddy 2 by mandating an authenticated internal 'ask' endpoint and edge rate limiting. Prevents Let's Encrypt Certificate Authority rate-limit exhaustion, disk exhaustion, and denial-of-service attacks driven by arbitrary SNI spoofing. Ensures proper HTTP/3 reverse proxy configuration with UDP 443 exposure and downstream connection sanitization.","antiPatternHeadline":"Unrestricted On-Demand TLS Without Ask Verification and Inadequate Rate Limiting","stars_count":76,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","caddy","tls","security","http3","rate-limiting"],"exportEndpoints":{"claude":"/api/rules/caddy-on-demand-tls-rate-limiting?format=claude","cursorMdc":"/api/rules/caddy-on-demand-tls-rate-limiting?format=mdc","cursorrules":"/api/rules/caddy-on-demand-tls-rate-limiting?format=cursor","windsurf":"/api/rules/caddy-on-demand-tls-rate-limiting?format=windsurf","agents":"/api/rules/caddy-on-demand-tls-rate-limiting?format=agents"}},{"id":"cilium-ebpf-wireguard-service-mesh-standard","title":"Cilium eBPF Mesh, WireGuard Transparent Encryption, and Hubble L7 Observability","category":"devops","severity":"critical","description":"Enforces a sidecar-free service mesh architecture utilizing kernel-level eBPF socket programs, strict pod-to-pod WireGuard encapsulation, and granular L7 Hubble observability. Prevents legacy iptables/kube-proxy bottlenecks, sidecar resource tax, MTU mismatch packet drops, and unencrypted cross-node data plane transit.","antiPatternHeadline":"Deploying invasive sidecar proxies alongside unencrypted node traffic and unoptimized eBPF host routing MTUs","stars_count":104,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","cilium","ebpf","wireguard","hubble","service-mesh","kubernetes","zero-trust"],"exportEndpoints":{"claude":"/api/rules/cilium-ebpf-wireguard-service-mesh-standard?format=claude","cursorMdc":"/api/rules/cilium-ebpf-wireguard-service-mesh-standard?format=mdc","cursorrules":"/api/rules/cilium-ebpf-wireguard-service-mesh-standard?format=cursor","windsurf":"/api/rules/cilium-ebpf-wireguard-service-mesh-standard?format=windsurf","agents":"/api/rules/cilium-ebpf-wireguard-service-mesh-standard?format=agents"}},{"id":"crossplane-composition-reconciliation-determinism","title":"Deterministic Crossplane Compositions & Controlled Reconciliation Invariants","category":"devops","severity":"critical","description":"Enforces strict determinism, declarative immutability, and state reconciliation invariants within Crossplane CompositeResourceDefinitions (XRDs) and Compositions. Mandates the use of explicit connection secret distribution, pipeline composition functions (v1beta1 Composition Functions) over legacy patch-and-transform engines, and explicit deletion policies to prevent resource orphan loops and drift.","antiPatternHeadline":"Unbounded patch-and-transform cycles with implicit deletion policies causing permanent drift and orphaned cloud resources","stars_count":112,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["crossplane","kubernetes","gitops","iac","cloud-infrastructure","control-plane"],"exportEndpoints":{"claude":"/api/rules/crossplane-composition-reconciliation-determinism?format=claude","cursorMdc":"/api/rules/crossplane-composition-reconciliation-determinism?format=mdc","cursorrules":"/api/rules/crossplane-composition-reconciliation-determinism?format=cursor","windsurf":"/api/rules/crossplane-composition-reconciliation-determinism?format=windsurf","agents":"/api/rules/crossplane-composition-reconciliation-determinism?format=agents"}},{"id":"docker-buildx-multiarch-cache-mounts","title":"Multi-Architecture Buildx Cache Partitioning and Bake Orchestration","category":"devops","severity":"critical","description":"Multi-platform Docker builds must partition BuildKit cache mounts and GitHub Actions GHA backend cache scopes by target architecture (TARGETARCH). Unpartitioned cache mounts across amd64 and arm64 result in cross-architecture binary poisoning, ABI corruption, and severe cache thrashing in CI pipelines.","antiPatternHeadline":"Global Unscoped Cache Mounts and Shared GHA Cache Scopes in Multi-Arch Builds","stars_count":57,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["docker","buildx","docker-bake","github-actions","multi-arch","devops","caching"],"exportEndpoints":{"claude":"/api/rules/docker-buildx-multiarch-cache-mounts?format=claude","cursorMdc":"/api/rules/docker-buildx-multiarch-cache-mounts?format=mdc","cursorrules":"/api/rules/docker-buildx-multiarch-cache-mounts?format=cursor","windsurf":"/api/rules/docker-buildx-multiarch-cache-mounts?format=windsurf","agents":"/api/rules/docker-buildx-multiarch-cache-mounts?format=agents"}},{"id":"terraform-ephemeral-values-state-encryption-production-standard","title":"Terraform 1.10 Ephemeral Variables, Plan Protection, and AWS KMS Native State Encryption","category":"devops","severity":"critical","description":"Enforces Terraform 1.10+ native state encryption and ephemeral value handling across all infrastructure code. Eliminates plain-text secret persistence in state files and plan artifacts by binding ephemeral variables directly to supported provider arguments and securing root-level state with native AWS KMS encryption blocks.","antiPatternHeadline":"Leaking Plain-Text Secrets into State and Plan Files Using Deprecated Sensitive Variables Instead of Ephemeral Attributes","stars_count":91,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","terraform","security","state-encryption","ephemeral-values","aws-kms"],"exportEndpoints":{"claude":"/api/rules/terraform-ephemeral-values-state-encryption-production-standard?format=claude","cursorMdc":"/api/rules/terraform-ephemeral-values-state-encryption-production-standard?format=mdc","cursorrules":"/api/rules/terraform-ephemeral-values-state-encryption-production-standard?format=cursor","windsurf":"/api/rules/terraform-ephemeral-values-state-encryption-production-standard?format=windsurf","agents":"/api/rules/terraform-ephemeral-values-state-encryption-production-standard?format=agents"}},{"id":"prometheus-native-histograms-otel-prw2","title":"Prometheus 3.0 Native Histograms and OTel Ingest Guardrails","category":"devops","severity":"critical","description":"Enforces Prometheus 3.0 sparse-bucket native histograms and OpenTelemetry ingestion standards. Mandates Prometheus Remote Write 2.0 streaming with memory-efficient deduplication to eliminate exponential time-series cardinality explosions and telemetry transport overhead.","antiPatternHeadline":"Emitting legacy static cumulative histogram buckets and uncompressed Remote Write 1.0 payloads causing telemetry OOMs and bucket quantization error","stars_count":118,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","prometheus","opentelemetry","metrics","observability","sre"],"exportEndpoints":{"claude":"/api/rules/prometheus-native-histograms-otel-prw2?format=claude","cursorMdc":"/api/rules/prometheus-native-histograms-otel-prw2?format=mdc","cursorrules":"/api/rules/prometheus-native-histograms-otel-prw2?format=cursor","windsurf":"/api/rules/prometheus-native-histograms-otel-prw2?format=windsurf","agents":"/api/rules/prometheus-native-histograms-otel-prw2?format=agents"}},{"id":"react-19-server-actions-optimistic-state-invariants","title":"React 19 Server Actions: Deterministic Optimistic State and Non-Blocking Rollbacks","category":"frontend","severity":"critical","description":"Enforces deterministic synchronization between client optimistic updates and React 19 Server Action resolution. Mandates pairing useOptimistic strictly with useActionState or startTransition to guarantee automatic, non-blocking rollbacks on server rejection and eliminate state tearing across concurrent mutations.","antiPatternHeadline":"Manual useState synchronization and untracked mutations bypassing React 19 Action transitions and rollback guarantees","stars_count":43,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["react19","server-actions","useOptimistic","useActionState","transitions","concurrency"],"exportEndpoints":{"claude":"/api/rules/react-19-server-actions-optimistic-state-invariants?format=claude","cursorMdc":"/api/rules/react-19-server-actions-optimistic-state-invariants?format=mdc","cursorrules":"/api/rules/react-19-server-actions-optimistic-state-invariants?format=cursor","windsurf":"/api/rules/react-19-server-actions-optimistic-state-invariants?format=windsurf","agents":"/api/rules/react-19-server-actions-optimistic-state-invariants?format=agents"}},{"id":"vite-6-environment-api-multi-runtime-ssr-boundary-isolation","title":"Vite 6 Environment API: Strict Boundary Isolation for Multi-Runtime SSR","category":"frontend","severity":"critical","description":"Enforces architectural boundary separation and module graph isolation across simultaneous edge, browser, and server runtime environments using the Vite 6 Environment API. Eliminates runtime leakage, dual-package hazard, and polluted module evaluation by mandating environment-specific module runners, explicit resolution conditions, and target-bound plugin pipelines.","antiPatternHeadline":"Shared Dev Server State Contamination & Unscoped SSR Module Resolution","stars_count":84,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["vite","vite-6","ssr","environment-api","module-runner","edge-runtime","workerd","node"],"exportEndpoints":{"claude":"/api/rules/vite-6-environment-api-multi-runtime-ssr-boundary-isolation?format=claude","cursorMdc":"/api/rules/vite-6-environment-api-multi-runtime-ssr-boundary-isolation?format=mdc","cursorrules":"/api/rules/vite-6-environment-api-multi-runtime-ssr-boundary-isolation?format=cursor","windsurf":"/api/rules/vite-6-environment-api-multi-runtime-ssr-boundary-isolation?format=windsurf","agents":"/api/rules/vite-6-environment-api-multi-runtime-ssr-boundary-isolation?format=agents"}},{"id":"axum-tower-concurrency-limits-loadshedding","title":"Axum 0.8 Deterministic Concurrency Limits & Transport Load Shedding","category":"backend","severity":"critical","description":"Enforces deterministic bounded concurrency and proactive HTTP 503 load shedding in Axum 0.8 applications using Tower middleware. Guarantees that overload conditions trigger explicit transport-level shedding with Retry-After headers rather than thread pool exhaustion or generic 500 server errors.","antiPatternHeadline":"Unbounded In-Flight Requests and Unhandled Tower BoxError Overloads Causing Cascading Failures","stars_count":95,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tower","concurrency","load-shedding","resilience"],"exportEndpoints":{"claude":"/api/rules/axum-tower-concurrency-limits-loadshedding?format=claude","cursorMdc":"/api/rules/axum-tower-concurrency-limits-loadshedding?format=mdc","cursorrules":"/api/rules/axum-tower-concurrency-limits-loadshedding?format=cursor","windsurf":"/api/rules/axum-tower-concurrency-limits-loadshedding?format=windsurf","agents":"/api/rules/axum-tower-concurrency-limits-loadshedding?format=agents"}},{"id":"openfga-zanzibar-rebac-guardrails","title":"OpenFGA Zanzibar ReBAC Invariants & High-Throughput Verification","category":"backend","severity":"critical","description":"Enforces deterministic graph evaluation and zero-divergence tuple synchronization in OpenFGA Zanzibar architectures. Mandates batch evaluations or ListObjects over iterative Check calls, strict transactional outbox delivery for tuple mutations, and explicit authorization model version pinning.","antiPatternHeadline":"N+1 Iterative Graph Checks and Direct Dual-Write Tuple Divergence","stars_count":65,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["openfga","zanzibar","rebac","authorization","distributed-systems","backend"],"exportEndpoints":{"claude":"/api/rules/openfga-zanzibar-rebac-guardrails?format=claude","cursorMdc":"/api/rules/openfga-zanzibar-rebac-guardrails?format=mdc","cursorrules":"/api/rules/openfga-zanzibar-rebac-guardrails?format=cursor","windsurf":"/api/rules/openfga-zanzibar-rebac-guardrails?format=windsurf","agents":"/api/rules/openfga-zanzibar-rebac-guardrails?format=agents"}},{"id":"capacitor-7-secure-enclave-passkey-bridge","title":"Hardware-Backed WebAuthn Attestation & Passkey Bridge Guardrail in Capacitor 7","category":"mobile","severity":"critical","description":"Mandates that all passkey registration and assertion flows within Capacitor 7 hybrid applications interface directly with native platform authenticators (iOS ASAuthorizationController backed by Secure Enclave, Android Credential Manager backed by StrongBox/TEE). Strictly prohibits software-based key emulation, client-side challenge synthesis, and insecure storage fallbacks like Capacitor Preferences or localStorage.","antiPatternHeadline":"Falling Back to Insecure Web Storage or Software Key Emulation on Passkey Bridge Failure","stars_count":93,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","webauthn","passkeys","secure-enclave","strongbox","fido2"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-secure-enclave-passkey-bridge?format=claude","cursorMdc":"/api/rules/capacitor-7-secure-enclave-passkey-bridge?format=mdc","cursorrules":"/api/rules/capacitor-7-secure-enclave-passkey-bridge?format=cursor","windsurf":"/api/rules/capacitor-7-secure-enclave-passkey-bridge?format=windsurf","agents":"/api/rules/capacitor-7-secure-enclave-passkey-bridge?format=agents"}},{"id":"tauri2-granular-capability-ipc-sandboxing","title":"Tauri 2.0 Granular Capability-Based IPC Sandboxing and Zero-Trust Window Isolation","category":"mobile","severity":"critical","description":"Enforces Tauri 2.0 granular capability architecture by eliminating broad ambient authority and wildcards in permissions. Requires explicit least-privilege capability manifests scoped strictly by webview window labels, remote endpoint origins, and validated command argument boundaries.","antiPatternHeadline":"Assigning global allowlists or wildcard capabilities to unsegmented mobile webviews","stars_count":43,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri-2","rust","ipc-security","capabilities","zero-trust"],"exportEndpoints":{"claude":"/api/rules/tauri2-granular-capability-ipc-sandboxing?format=claude","cursorMdc":"/api/rules/tauri2-granular-capability-ipc-sandboxing?format=mdc","cursorrules":"/api/rules/tauri2-granular-capability-ipc-sandboxing?format=cursor","windsurf":"/api/rules/tauri2-granular-capability-ipc-sandboxing?format=windsurf","agents":"/api/rules/tauri2-granular-capability-ipc-sandboxing?format=agents"}},{"id":"webauthn-l3-conditional-mediation-passkey-sync","title":"Mandatory WebAuthn L3 Conditional Mediation & Passkey Lifecycle Invariants","category":"security","severity":"critical","description":"Enforces W3C WebAuthn Level 3 conditional mediation ('conditional UI') across all public entry points to eliminate credential stuffing and adversary-in-the-middle phishing. Mandates cryptographically binding server-side challenge-response validation, strict RP ID origin scoping, AbortController lifecycle management for autofill requests, and inspection of backup eligibility and state flags (BE/BS) for synchronized passkeys.","antiPatternHeadline":"Modal-only credential requests without conditional autofill, missing AbortController cleanup, and unvalidated passkey sync backup flags.","stars_count":98,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","passkeys","fido2","conditional-mediation","authentication","appsec"],"exportEndpoints":{"claude":"/api/rules/webauthn-l3-conditional-mediation-passkey-sync?format=claude","cursorMdc":"/api/rules/webauthn-l3-conditional-mediation-passkey-sync?format=mdc","cursorrules":"/api/rules/webauthn-l3-conditional-mediation-passkey-sync?format=cursor","windsurf":"/api/rules/webauthn-l3-conditional-mediation-passkey-sync?format=windsurf","agents":"/api/rules/webauthn-l3-conditional-mediation-passkey-sync?format=agents"}},{"id":"cilium-tetragon-realtime-exploit-prevention","title":"Enforce In-Kernel Real-Time Exploit Prevention and Process Termination with Cilium Tetragon","category":"security","severity":"critical","description":"Cilium Tetragon TracingPolicies must execute synchronous in-kernel enforcement (such as Sigkill) directly inside eBPF hook handlers rather than relying on asynchronous userspace alerting. Real-time prevention stops memory corruption exploits, container escapes, and unauthorized binary executions before payload completion, eliminating the Time-of-Check to Time-of-Use (TOCTOU) vulnerability window inherent in passive monitoring.","antiPatternHeadline":"Relying on Asynchronous Userspace Event Logging and Post-Execution Audit Pipelines Instead of Synchronous In-Kernel eBPF Sigkill Enforcement","stars_count":78,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","ebpf","cilium","tetragon","zero-trust","runtime-security","kernel"],"exportEndpoints":{"claude":"/api/rules/cilium-tetragon-realtime-exploit-prevention?format=claude","cursorMdc":"/api/rules/cilium-tetragon-realtime-exploit-prevention?format=mdc","cursorrules":"/api/rules/cilium-tetragon-realtime-exploit-prevention?format=cursor","windsurf":"/api/rules/cilium-tetragon-realtime-exploit-prevention?format=windsurf","agents":"/api/rules/cilium-tetragon-realtime-exploit-prevention?format=agents"}},{"id":"nextjs-15-ppr-streaming-boundary-isolation","title":"Next.js 15 PPR Deterministic Static Shell and Dynamic Micro-Hole Isolation","category":"frontend","severity":"critical","description":"Enforces strict segregation between static shell prerendering and dynamic server runtime operations under Next.js 15 Partial Prerendering (PPR). Mandates fine-grained React Suspense boundaries around all dynamic segments (headers, cookies, searchParams, uncached data) to preserve edge-cached static shell delivery, sub-50ms Time to First Byte (TTFB), and eliminate unmount hydration waterfalls.","antiPatternHeadline":"Dynamic Scope Leakage Causing Premature Static Shell De-optimization and Full-Route Dynamic Bailout","stars_count":98,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs-15","ppr","react-server-components","streaming","suspense","performance"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-ppr-streaming-boundary-isolation?format=claude","cursorMdc":"/api/rules/nextjs-15-ppr-streaming-boundary-isolation?format=mdc","cursorrules":"/api/rules/nextjs-15-ppr-streaming-boundary-isolation?format=cursor","windsurf":"/api/rules/nextjs-15-ppr-streaming-boundary-isolation?format=windsurf","agents":"/api/rules/nextjs-15-ppr-streaming-boundary-isolation?format=agents"}},{"id":"vite-6-environment-api-multi-runtime-isolation-vite-6-environme-655","title":"Strict Runtime Boundary and Module Graph Isolation in Vite 6 Environment API","category":"frontend","severity":"critical","description":"Vite 6 introduces the Environment API to orchestrate disparate runtimes (e.g., client DOM, Node.js SSR, Edge Workers) within a unified dev server pipeline. When building multi-runtime systems, plugins and modules must strictly isolate their module graphs, transform hooks, and hot-module replacement (HMR) state to prevent runtime leaks, cross-environment variable bleeding, and server-side evaluation contamination during development and bundling.","antiPatternHeadline":"Cross-Environment Module Graph Contamination and Shared Plugin Instance State","stars_count":73,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["vite","vite-6","environment-api","ssr","edge-runtime","hmr","module-isolation"],"exportEndpoints":{"claude":"/api/rules/vite-6-environment-api-multi-runtime-isolation-vite-6-environme-655?format=claude","cursorMdc":"/api/rules/vite-6-environment-api-multi-runtime-isolation-vite-6-environme-655?format=mdc","cursorrules":"/api/rules/vite-6-environment-api-multi-runtime-isolation-vite-6-environme-655?format=cursor","windsurf":"/api/rules/vite-6-environment-api-multi-runtime-isolation-vite-6-environme-655?format=windsurf","agents":"/api/rules/vite-6-environment-api-multi-runtime-isolation-vite-6-environme-655?format=agents"}},{"id":"postgres-17-logical-replication-failover-slot-sync","title":"Postgres 17 Logical Replication Failover Slot Synchronization & HA Standby Alignment","category":"backend","severity":"critical","description":"Enforces failover-enabled logical replication slots and synchronized standby slot coordination introduced in PostgreSQL 17. Guarantees that physical standby replicas maintain synchronized logical decoding slots prior to failover, preventing message loss, slot invalidation, or re-consumption gaps across HA transitions.","antiPatternHeadline":"Unsynchronized Logical Slots and Unconstrained LSN Forwarding Without Physical Standby Alignment","stars_count":46,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","logical-replication","high-availability","database-migration"],"exportEndpoints":{"claude":"/api/rules/postgres-17-logical-replication-failover-slot-sync?format=claude","cursorMdc":"/api/rules/postgres-17-logical-replication-failover-slot-sync?format=mdc","cursorrules":"/api/rules/postgres-17-logical-replication-failover-slot-sync?format=cursor","windsurf":"/api/rules/postgres-17-logical-replication-failover-slot-sync?format=windsurf","agents":"/api/rules/postgres-17-logical-replication-failover-slot-sync?format=agents"}},{"id":"bun-zero-copy-ffi-worker-isolation-guardrail","title":"Bun 1.2 Zero-Copy FFI & Native Worker Thread Memory Safety Invariant","category":"backend","severity":"critical","description":"Enforces strict memory ownership, pointer lifecycle validation, and deterministic buffer pooling when passing high-throughput analytical buffers across Bun 1.2 C-ABI FFI and native Worker thread boundaries. Prevents silent heap corruption, use-after-free, and race conditions resulting from JavaScript garbage collection preempting native memory references.","antiPatternHeadline":"Unpinned Pointer Passing & Shared Mutable ArrayBuffer Transfer Across FFI Worker Boundaries","stars_count":109,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","ffi","memory-safety","workers","zero-copy"],"exportEndpoints":{"claude":"/api/rules/bun-zero-copy-ffi-worker-isolation-guardrail?format=claude","cursorMdc":"/api/rules/bun-zero-copy-ffi-worker-isolation-guardrail?format=mdc","cursorrules":"/api/rules/bun-zero-copy-ffi-worker-isolation-guardrail?format=cursor","windsurf":"/api/rules/bun-zero-copy-ffi-worker-isolation-guardrail?format=windsurf","agents":"/api/rules/bun-zero-copy-ffi-worker-isolation-guardrail?format=agents"}},{"id":"openfga-rebac-realtime-cache-invalidation","title":"OpenFGA Real-Time ReBAC Tuple Evaluation & Invalidation Caching Standard","category":"security","severity":"critical","description":"Enforces sub-millisecond fine-grained authorization evaluations while preventing stale permissions and TOCTOU vulnerabilities. Combines event-driven distributed cache invalidation via change-data-capture (CDC) or transactional outbox with OpenFGA contextual tuples for dynamic request attributes.","antiPatternHeadline":"Unbounded TTL Caching of Authorization Checks Without Graph-Aware Invalidation","stars_count":68,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","rebac","authorization","caching","distributed-systems"],"exportEndpoints":{"claude":"/api/rules/openfga-rebac-realtime-cache-invalidation?format=claude","cursorMdc":"/api/rules/openfga-rebac-realtime-cache-invalidation?format=mdc","cursorrules":"/api/rules/openfga-rebac-realtime-cache-invalidation?format=cursor","windsurf":"/api/rules/openfga-rebac-realtime-cache-invalidation?format=windsurf","agents":"/api/rules/openfga-rebac-realtime-cache-invalidation?format=agents"}},{"id":"webauthn-l3-passkeys-conditional-mediation-standard","title":"WebAuthn Level 3 Conditional Mediation & Hardware Attestation Invariants","category":"security","severity":"critical","description":"Enforces cryptographically rigorous FIDO2/WebAuthn Level 3 implementations across omnichannel entrypoints. Mandates client-side conditional UI mediation with explicit AbortController lifecycle management and server-side strict challenge-response verification against FIDO Metadata Service (MDS) hardware attestation roots, preventing credential stuffing, phishing, and replay attacks.","antiPatternHeadline":"Unvalidated Client Assertions with Ephemeral Nonce Leakage and Missing Conditional Autofill Cleanup","stars_count":45,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","fido2","passkeys","authentication","zero-trust"],"exportEndpoints":{"claude":"/api/rules/webauthn-l3-passkeys-conditional-mediation-standard?format=claude","cursorMdc":"/api/rules/webauthn-l3-passkeys-conditional-mediation-standard?format=mdc","cursorrules":"/api/rules/webauthn-l3-passkeys-conditional-mediation-standard?format=cursor","windsurf":"/api/rules/webauthn-l3-passkeys-conditional-mediation-standard?format=windsurf","agents":"/api/rules/webauthn-l3-passkeys-conditional-mediation-standard?format=agents"}},{"id":"ebpf-tetragon-kernel-anomaly-enforcement","title":"eBPF Tetragon In-Kernel Real-Time Syscall Anomaly and Escape Mitigation","category":"devops","severity":"critical","description":"Enforces synchronous in-kernel zero-trust security postures using Cilium Tetragon TracingPolicies with SIGKILL enforcement actions. Mandates that namespace boundary escapes, privilege escalations, and unapproved kernel sockets are intercepted and terminated directly within eBPF probe execution paths before reaching userland context. Prevents asynchronous race conditions where attackers execute arbitrary code or establish command-and-control channels prior to userland agent telemetry processing.","antiPatternHeadline":"Relying on Asynchronous Userland Telemetry or Audit-Only Filters for Container Escape and Socket Enforcements","stars_count":117,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","tetragon","kubernetes","security","runtime-defense","zero-trust"],"exportEndpoints":{"claude":"/api/rules/ebpf-tetragon-kernel-anomaly-enforcement?format=claude","cursorMdc":"/api/rules/ebpf-tetragon-kernel-anomaly-enforcement?format=mdc","cursorrules":"/api/rules/ebpf-tetragon-kernel-anomaly-enforcement?format=cursor","windsurf":"/api/rules/ebpf-tetragon-kernel-anomaly-enforcement?format=windsurf","agents":"/api/rules/ebpf-tetragon-kernel-anomaly-enforcement?format=agents"}},{"id":"opentelemetry-async-queue-context-propagation","title":"OpenTelemetry Trace Context and Baggage Propagation Across Asynchronous Task Queues","category":"devops","severity":"critical","description":"Enforces deterministic causal distributed tracing and transactional baggage preservation across asynchronous worker pools, task queues, and decentralized event boundaries. Mandates explicit W3C TraceContext and Baggage injection at enqueue time and root context extraction with span linking at execution time. Eliminates broken distributed causal graphs and context leakage across shared concurrency runtimes.","antiPatternHeadline":"Silent Context Severing and Blind Asynchronous Worker Execution","stars_count":103,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","distributed-tracing","w3c-trace-context","task-queues","observability"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-async-queue-context-propagation?format=claude","cursorMdc":"/api/rules/opentelemetry-async-queue-context-propagation?format=mdc","cursorrules":"/api/rules/opentelemetry-async-queue-context-propagation?format=cursor","windsurf":"/api/rules/opentelemetry-async-queue-context-propagation?format=windsurf","agents":"/api/rules/opentelemetry-async-queue-context-propagation?format=agents"}},{"id":"tauri-v2-capability-ipc-sandboxing","title":"Tauri 2.0 Capability-Based IPC Permission Sandboxing & Payload Boundary Enforcement","category":"mobile","severity":"critical","description":"Enforces granular, capability-driven IPC permission boundaries and strict payload schema validation across Tauri 2.0 mobile webview-native interfaces. Prevents privilege escalation and arbitrary command execution by isolating window identifiers, validating runtime payloads with Zod before bridge serialization, and eliminating broad plugin access scopes.","antiPatternHeadline":"Monolithic Wildcard Permission Grants and Unvalidated Runtime IPC Command Invocations","stars_count":61,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri-v2","ipc-security","capabilities","rust","sandboxing"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-capability-ipc-sandboxing?format=claude","cursorMdc":"/api/rules/tauri-v2-capability-ipc-sandboxing?format=mdc","cursorrules":"/api/rules/tauri-v2-capability-ipc-sandboxing?format=cursor","windsurf":"/api/rules/tauri-v2-capability-ipc-sandboxing?format=windsurf","agents":"/api/rules/tauri-v2-capability-ipc-sandboxing?format=agents"}},{"id":"capacitor-7-hardware-secure-enclave-biometric-binding","title":"Capacitor 7 Hardware-Backed Secure Enclave & StrongBox Biometric Binding","category":"mobile","severity":"critical","description":"Enforces zero-leakage cryptographic operations across Capacitor 7 bridges by anchoring authentication secrets strictly within hardware-isolated boundaries. Requires asymmetric key pairs generated inside iOS Secure Enclave or Android StrongBox with biometric access controls, performing challenge signing exclusively inside native silicon rather than surfacing raw tokens to the WebView memory space.","antiPatternHeadline":"Decoupled Local Biometric Verification Followed by Insecure Secret Retrieval in JavaScript Memory","stars_count":53,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor-7","secure-enclave","strongbox","biometrics","cryptography","keychain","zero-trust"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-hardware-secure-enclave-biometric-binding?format=claude","cursorMdc":"/api/rules/capacitor-7-hardware-secure-enclave-biometric-binding?format=mdc","cursorrules":"/api/rules/capacitor-7-hardware-secure-enclave-biometric-binding?format=cursor","windsurf":"/api/rules/capacitor-7-hardware-secure-enclave-biometric-binding?format=windsurf","agents":"/api/rules/capacitor-7-hardware-secure-enclave-biometric-binding?format=agents"}},{"id":"react-19-action-optimistic-mutation-boundaries","title":"Deterministic Rollbacks and Server Reconciliation via React 19 useActionState and useOptimistic","category":"frontend","severity":"critical","description":"Enforces strict mutation boundaries in React 19 by coupling useActionState with useOptimistic to ensure deterministic rollbacks and atomic server reconciliation without third-party state managers. Prevents client-server state divergence, unhandled rejected promises during transitions, and lost optimistic updates across concurrent transitions. Guarantees that actions remain pure async state machines where the authoritative server payload triggers automatic discard of transient optimistic state.","antiPatternHeadline":"Ad-Hoc Imperative Optimistic State Cloned via useState Leaking Inconsistent UI on Action Failure","stars_count":113,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","useOptimistic","useActionState","server-actions","state-management"],"exportEndpoints":{"claude":"/api/rules/react-19-action-optimistic-mutation-boundaries?format=claude","cursorMdc":"/api/rules/react-19-action-optimistic-mutation-boundaries?format=mdc","cursorrules":"/api/rules/react-19-action-optimistic-mutation-boundaries?format=cursor","windsurf":"/api/rules/react-19-action-optimistic-mutation-boundaries?format=windsurf","agents":"/api/rules/react-19-action-optimistic-mutation-boundaries?format=agents"}},{"id":"svelte-5-universal-runes-encapsulation-standard","title":"Svelte 5 Universal Runes Encapsulation & Reactivity Boundary Standard","category":"frontend","severity":"critical","description":"Enforces strict fine-grained reactivity boundaries in Svelte 5 by restricting universal runes ($state, $derived, $effect) to component contexts and explicit .svelte.ts module encapsulations. Prohibits global state mutation leaks, naked reactive primitives across module boundaries, and unencapsulated reactive destructuring that triggers unintended render cascades and memory retention.","antiPatternHeadline":"Exposing Raw Runes Across Shared TS Modules Causing Reactivity Bleed and Infinite Update Cycles","stars_count":108,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","reactivity","state-management","performance"],"exportEndpoints":{"claude":"/api/rules/svelte-5-universal-runes-encapsulation-standard?format=claude","cursorMdc":"/api/rules/svelte-5-universal-runes-encapsulation-standard?format=mdc","cursorrules":"/api/rules/svelte-5-universal-runes-encapsulation-standard?format=cursor","windsurf":"/api/rules/svelte-5-universal-runes-encapsulation-standard?format=windsurf","agents":"/api/rules/svelte-5-universal-runes-encapsulation-standard?format=agents"}},{"id":"postgres-17-async-io-cdc-replication-guardrails","title":"Postgres 17 Asynchronous I/O Tuning & CDC Logical Slot WAL Guardrails","category":"backend","severity":"critical","description":"Configures Postgres 17 native async I/O parameters for high-throughput vectorized operations while enforcing strict WAL-retention ceilings via max_slot_wal_keep_size on CDC replication streams. Prevents cluster-wide disk exhaustion outages caused by stalled downstream CDC consumers and ensures deterministic streaming reads across high-volume pipelines.","antiPatternHeadline":"Uncapped Logical Replication Slots and Unbounded CDC Lag Exhausting Node Storage","stars_count":61,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","postgres-17","cdc","wal-guardrail","async-io","logical-replication"],"exportEndpoints":{"claude":"/api/rules/postgres-17-async-io-cdc-replication-guardrails?format=claude","cursorMdc":"/api/rules/postgres-17-async-io-cdc-replication-guardrails?format=mdc","cursorrules":"/api/rules/postgres-17-async-io-cdc-replication-guardrails?format=cursor","windsurf":"/api/rules/postgres-17-async-io-cdc-replication-guardrails?format=windsurf","agents":"/api/rules/postgres-17-async-io-cdc-replication-guardrails?format=agents"}},{"id":"bun-1-2-worker-tenant-memory-isolation","title":"Bun 1.2 Multi-Tenant Worker Memory Isolation & Execution Quotas","category":"backend","severity":"critical","description":"Enforces strict heap budgets, thread-level WebWorker isolation, and execution CPU/memory quotas when running untrusted multi-tenant workloads in Bun 1.2. Prohibits in-process evaluation and ensures all worker instances are aggressively terminated via deterministic abort signals and heap bounds to prevent noisy-neighbor memory leakage.","antiPatternHeadline":"Executing untrusted tenant code within the primary process heap or unmetered, long-lived WebWorkers without hard termination ceilings.","stars_count":77,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","web-workers","multi-tenancy","memory-isolation","sandboxing"],"exportEndpoints":{"claude":"/api/rules/bun-1-2-worker-tenant-memory-isolation?format=claude","cursorMdc":"/api/rules/bun-1-2-worker-tenant-memory-isolation?format=mdc","cursorrules":"/api/rules/bun-1-2-worker-tenant-memory-isolation?format=cursor","windsurf":"/api/rules/bun-1-2-worker-tenant-memory-isolation?format=windsurf","agents":"/api/rules/bun-1-2-worker-tenant-memory-isolation?format=agents"}},{"id":"go-chi-opentelemetry-w3c-trace-propagation","title":"Go Chi OpenTelemetry W3C Trace Context and Baggage Propagation Invariant","category":"backend","severity":"critical","description":"Mandates deterministic W3C trace context (traceparent, tracestate) and baggage extraction/injection across Go Chi HTTP routing layers, downstream network calls, and concurrent Goroutine boundaries. Prohibits context severance caused by raw context.Background() usage in asynchronous operations or unpropagated outbound HTTP requests.","antiPatternHeadline":"Trace Context Severance via Unpropagated Goroutines and Raw Outbound HTTP Requests","stars_count":112,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","chi","opentelemetry","distributed-tracing","w3c-trace-context","goroutines"],"exportEndpoints":{"claude":"/api/rules/go-chi-opentelemetry-w3c-trace-propagation?format=claude","cursorMdc":"/api/rules/go-chi-opentelemetry-w3c-trace-propagation?format=mdc","cursorrules":"/api/rules/go-chi-opentelemetry-w3c-trace-propagation?format=cursor","windsurf":"/api/rules/go-chi-opentelemetry-w3c-trace-propagation?format=windsurf","agents":"/api/rules/go-chi-opentelemetry-w3c-trace-propagation?format=agents"}},{"id":"kmp-coroutine-cancellation-swift-interop","title":"Deterministic Coroutine Cancellation and Memory Cleanup Across Swift-Kotlin FFI Boundaries","category":"mobile","severity":"critical","description":"Enforces deterministic structured concurrency propagation and memory cleanup between Kotlin Coroutines and Swift Concurrency (async/await and Tasks). Unbridged cancellation leads to orphaned Kotlin Jobs, background CPU/battery drain, and memory leaks caused by circular references across the Objective-C runtime boundary.","antiPatternHeadline":"Orphaned Kotlin Jobs and Retain Cycles from Unbridged Swift Task Cancellation","stars_count":117,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kmp","kotlin-native","swift","coroutines","structured-concurrency"],"exportEndpoints":{"claude":"/api/rules/kmp-coroutine-cancellation-swift-interop?format=claude","cursorMdc":"/api/rules/kmp-coroutine-cancellation-swift-interop?format=mdc","cursorrules":"/api/rules/kmp-coroutine-cancellation-swift-interop?format=cursor","windsurf":"/api/rules/kmp-coroutine-cancellation-swift-interop?format=windsurf","agents":"/api/rules/kmp-coroutine-cancellation-swift-interop?format=agents"}},{"id":"tauri-v2-ipc-capability-scope-sandboxing","title":"Tauri 2.0 IPC Capability Sandboxing and Origin Verification Standard","category":"mobile","severity":"critical","description":"Mandates least-privilege IPC capability files, explicit permission scopes, and runtime origin verification across unified desktop and mobile webviews in Tauri 2.0. Prohibits global wildcard plugin permissions and requires strict window-to-capability bindings to eliminate cross-origin privilege escalation.","antiPatternHeadline":"Ambient IPC Exposure via Wildcard Capabilities and Missing Mobile Webview Origin Verification","stars_count":47,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri-2","security","ipc","sandboxing","capabilities","rust"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-ipc-capability-scope-sandboxing?format=claude","cursorMdc":"/api/rules/tauri-v2-ipc-capability-scope-sandboxing?format=mdc","cursorrules":"/api/rules/tauri-v2-ipc-capability-scope-sandboxing?format=cursor","windsurf":"/api/rules/tauri-v2-ipc-capability-scope-sandboxing?format=windsurf","agents":"/api/rules/tauri-v2-ipc-capability-scope-sandboxing?format=agents"}},{"id":"openfga-rebac-graph-auth-cache-invalidation-standard","title":"OpenFGA ReBAC Sub-Millisecond Graph Authorization and Cache Invalidation Invariant","category":"security","severity":"critical","description":"Enforces sub-millisecond OpenFGA relationship-based access control (ReBAC) evaluations while guaranteeing zero stale-graph traversals. Mandates strict fail-closed authorization boundaries, deterministic transactional tuple synchronization via transactional outbox patterns, request-scoped contextual tuples, and precise cache invalidation across distributed services.","antiPatternHeadline":"Stale Tuple Authorization Bypasses and Fail-Open Distributed In-Memory Caching","stars_count":52,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","rebac","authorization","cache-invalidation","zero-trust"],"exportEndpoints":{"claude":"/api/rules/openfga-rebac-graph-auth-cache-invalidation-standard?format=claude","cursorMdc":"/api/rules/openfga-rebac-graph-auth-cache-invalidation-standard?format=mdc","cursorrules":"/api/rules/openfga-rebac-graph-auth-cache-invalidation-standard?format=cursor","windsurf":"/api/rules/openfga-rebac-graph-auth-cache-invalidation-standard?format=windsurf","agents":"/api/rules/openfga-rebac-graph-auth-cache-invalidation-standard?format=agents"}},{"id":"webauthn-l3-passkey-attestation-downgrade-guardrail","title":"WebAuthn L3 Passkey Attestation & Credential Relay Downgrade Prevention","category":"security","severity":"critical","description":"Enforces strict W3C WebAuthn Level 3 server-side validation invariants, covering exact origin binding, RP ID validation, cryptographically random challenge lifecycles, and user-verification enforcement. Mandates synced-credential (backup state) inspection, attestation trust path validation, and counter-rollback detection to neutralize credential relay attacks and unauthorized fallback downgrades.","antiPatternHeadline":"Permissive Origin Parsing and Missing Authenticator Flags Permitting Man-in-the-Middle Relay and Downgrade","stars_count":114,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","passkeys","fido2","cryptography","zero-trust"],"exportEndpoints":{"claude":"/api/rules/webauthn-l3-passkey-attestation-downgrade-guardrail?format=claude","cursorMdc":"/api/rules/webauthn-l3-passkey-attestation-downgrade-guardrail?format=mdc","cursorrules":"/api/rules/webauthn-l3-passkey-attestation-downgrade-guardrail?format=cursor","windsurf":"/api/rules/webauthn-l3-passkey-attestation-downgrade-guardrail?format=windsurf","agents":"/api/rules/webauthn-l3-passkey-attestation-downgrade-guardrail?format=agents"}},{"id":"ebpf-kernel-tls-egress-enforcement-production-standard","title":"Zero-Overhead Kernel-Level TLS Socket Observability and Cryptographic Egress Guardrails","category":"devops","severity":"critical","description":"Enforces strict kernel-level egress control and TLS payload observability via eBPF sockops, cgroup socket address programs, and tracing policies without relying on high-overhead userspace proxy sidecars. Prohibits unredacted ring-buffer streaming of cryptographic credentials, unbounded userspace uprobe memory allocations, and socket connects that bypass kernel-level policy verifiers.","antiPatternHeadline":"Bypassing Kernel Socket Filters with Insecure Uprobe Scraping and Latency-Heavy Proxy Sidecars","stars_count":102,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","tls-inspection","sockops","security","egress-enforcement","cilium","tetragon"],"exportEndpoints":{"claude":"/api/rules/ebpf-kernel-tls-egress-enforcement-production-standard?format=claude","cursorMdc":"/api/rules/ebpf-kernel-tls-egress-enforcement-production-standard?format=mdc","cursorrules":"/api/rules/ebpf-kernel-tls-egress-enforcement-production-standard?format=cursor","windsurf":"/api/rules/ebpf-kernel-tls-egress-enforcement-production-standard?format=windsurf","agents":"/api/rules/ebpf-kernel-tls-egress-enforcement-production-standard?format=agents"}},{"id":"openfga-rebac-causal-consistency-zedtokens","title":"Mandatory ZedToken Causal Consistency Enforcement in OpenFGA ReBAC","category":"security","severity":"critical","description":"Distributed Relationship-Based Access Control (ReBAC) systems are vulnerable to Zanzibar's classic 'New Enemy' problem when mutations and authorization checks execute across asynchronously replicated data stores. Tuple writes modifying permissions must capture and propagate causal consistency tokens (ZedTokens or snapshot boundaries) to ensure downstream checks evaluate against at least as fresh a state snapshot. Omitting consistency constraints allows stale read-replica evaluations, resulting in critical authorization bypasses and privilege escalation after revocation events.","antiPatternHeadline":"Executing unconstrained eventual-consistency authorization checks after relationship tuple mutations","stars_count":74,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","zanzibar","rebac","authorization","distributed-systems"],"exportEndpoints":{"claude":"/api/rules/openfga-rebac-causal-consistency-zedtokens?format=claude","cursorMdc":"/api/rules/openfga-rebac-causal-consistency-zedtokens?format=mdc","cursorrules":"/api/rules/openfga-rebac-causal-consistency-zedtokens?format=cursor","windsurf":"/api/rules/openfga-rebac-causal-consistency-zedtokens?format=windsurf","agents":"/api/rules/openfga-rebac-causal-consistency-zedtokens?format=agents"}},{"id":"react-19-actions-optimistic-rollback-invariants","title":"React 19 Actions and Optimistic Mutation Rollback Invariants","category":"frontend","severity":"critical","description":"Standardizes transactional client-side rollbacks in React 19 using useActionState and useOptimistic within concurrent transition boundaries. Eliminates state drift, race conditions, and corrupted form lifecycles caused by ad-hoc catch-block rollbacks during asynchronous network failures.","antiPatternHeadline":"Manual catch-block state rollbacks and uncoordinated useState mutations during concurrent async actions","stars_count":48,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","actions","useOptimistic","useActionState","concurrency"],"exportEndpoints":{"claude":"/api/rules/react-19-actions-optimistic-rollback-invariants?format=claude","cursorMdc":"/api/rules/react-19-actions-optimistic-rollback-invariants?format=mdc","cursorrules":"/api/rules/react-19-actions-optimistic-rollback-invariants?format=cursor","windsurf":"/api/rules/react-19-actions-optimistic-rollback-invariants?format=windsurf","agents":"/api/rules/react-19-actions-optimistic-rollback-invariants?format=agents"}},{"id":"postgres-17-logical-replication-failover-slots","title":"PostgreSQL 17 Synchronized Logical Replication Failover Slots","category":"backend","severity":"critical","description":"Enforces failover-enabled logical replication slots and standby slot synchronization introduced in PostgreSQL 17. Guarantees that downstream CDC consumers, Debezium instances, and transactional outbox workers survive physical primary failover without silent data loss, split-brain LSN divergence, or massive duplicate event replays.","antiPatternHeadline":"Unsynchronized logical slots on HA clusters causing catastrophic event loss or missing outbox CDC feeds during primary failover.","stars_count":86,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql-17","logical-replication","failover-slots","cdc","outbox-pattern"],"exportEndpoints":{"claude":"/api/rules/postgres-17-logical-replication-failover-slots?format=claude","cursorMdc":"/api/rules/postgres-17-logical-replication-failover-slots?format=mdc","cursorrules":"/api/rules/postgres-17-logical-replication-failover-slots?format=cursor","windsurf":"/api/rules/postgres-17-logical-replication-failover-slots?format=windsurf","agents":"/api/rules/postgres-17-logical-replication-failover-slots?format=agents"}},{"id":"opentelemetry-ebpf-w3c-tracecontext-propagation","title":"OpenTelemetry eBPF Kernel Tracing with W3C TraceContext Invariants","category":"devops","severity":"critical","description":"Correlating kernel-level eBPF socket telemetry with distributed W3C TraceContext headers requires strict payload parsing, deterministic tail-latency trace reconstruction, and rigorous synchronization between userspace OpenTelemetry context injection and kprobe/uprobe hooks. Failure to maintain traceparent integrity across TCP/HTTP stream boundaries produces broken distributed traces, unmonitored drop rates, and kernel memory leaks in BPF ring buffers.","antiPatternHeadline":"Blind kernel packet snooping without W3C traceparent protocol boundaries or socket lifecycle correlation","stars_count":68,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","opentelemetry","tracing","w3c-trace-context","observability","linux-kernel"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-ebpf-w3c-tracecontext-propagation?format=claude","cursorMdc":"/api/rules/opentelemetry-ebpf-w3c-tracecontext-propagation?format=mdc","cursorrules":"/api/rules/opentelemetry-ebpf-w3c-tracecontext-propagation?format=cursor","windsurf":"/api/rules/opentelemetry-ebpf-w3c-tracecontext-propagation?format=windsurf","agents":"/api/rules/opentelemetry-ebpf-w3c-tracecontext-propagation?format=agents"}},{"id":"svelte-5-async-derived-effect-teardown","title":"Svelte 5 Runes Async Derived State & Effect Teardown Standard","category":"frontend","severity":"critical","description":"Enforces synchronous execution boundaries across Svelte 5 runes and mandates deterministic teardown with AbortController for asynchronous work initiated in $effect. Prevents silent memory leaks, orphaned network requests, and stale-state race conditions caused by async callbacks returning Promises instead of synchronous cleanup handlers.","antiPatternHeadline":"Async Callback Directly Passed to $effect and Async Functions in $derived.by","stars_count":44,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","state-management","concurrency","memory-leaks"],"exportEndpoints":{"claude":"/api/rules/svelte-5-async-derived-effect-teardown?format=claude","cursorMdc":"/api/rules/svelte-5-async-derived-effect-teardown?format=mdc","cursorrules":"/api/rules/svelte-5-async-derived-effect-teardown?format=cursor","windsurf":"/api/rules/svelte-5-async-derived-effect-teardown?format=windsurf","agents":"/api/rules/svelte-5-async-derived-effect-teardown?format=agents"}},{"id":"nextjs-server-action-taint-idempotency-production-standard","title":"Next.js 15 Server Action Taint Boundaries and Cryptographic Idempotency Guardrail","category":"backend","severity":"critical","description":"Enforces strict isolation between server-side domain entities and client-facing responses using React taint APIs, combined with distributed cryptographic idempotency enforcement. Prevents accidental server secret leakage across the serialization boundary and eliminates double-execution of non-idempotent business mutations.","antiPatternHeadline":"Leaking Untracked Internal Entities to Clients and Executing Mutating Actions Without Idempotency Locking","stars_count":45,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","nextjs","react-taint","server-actions","idempotency","security"],"exportEndpoints":{"claude":"/api/rules/nextjs-server-action-taint-idempotency-production-standard?format=claude","cursorMdc":"/api/rules/nextjs-server-action-taint-idempotency-production-standard?format=mdc","cursorrules":"/api/rules/nextjs-server-action-taint-idempotency-production-standard?format=cursor","windsurf":"/api/rules/nextjs-server-action-taint-idempotency-production-standard?format=windsurf","agents":"/api/rules/nextjs-server-action-taint-idempotency-production-standard?format=agents"}},{"id":"kmp-swift-coroutines-cancellation-invariants","title":"Kotlin Multiplatform Swift-Coroutines Interop Cancellation Invariants","category":"mobile","severity":"critical","description":"Enforces strict structured concurrency bridging between Kotlin Coroutines and Swift async/await concurrency models in Kotlin Multiplatform projects. Bridging layers must bind Swift Task cancellation tokens directly to Kotlin Job cancellation and avoid unbound GlobalScope allocations or untracked async wrappers. Failure to preserve bidirectional cancellation leads to zombie coroutines, thread pool exhaustion, memory leaks, and severe iOS UI freezes.","antiPatternHeadline":"Leaking zombie Kotlin Coroutine Jobs across the ObjC/Swift interop barrier when Swift async Tasks are cancelled.","stars_count":68,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","kmp","swift","coroutines","async-await","concurrency"],"exportEndpoints":{"claude":"/api/rules/kmp-swift-coroutines-cancellation-invariants?format=claude","cursorMdc":"/api/rules/kmp-swift-coroutines-cancellation-invariants?format=mdc","cursorrules":"/api/rules/kmp-swift-coroutines-cancellation-invariants?format=cursor","windsurf":"/api/rules/kmp-swift-coroutines-cancellation-invariants?format=windsurf","agents":"/api/rules/kmp-swift-coroutines-cancellation-invariants?format=agents"}},{"id":"webauthn-conditional-ui-passkey-attestation-guardrails","title":"Strict Origin, Challenge, and User Verification Guardrails for WebAuthn Conditional UI Passkeys","category":"security","severity":"critical","description":"Production implementations of WebAuthn Conditional UI (autofill passkeys) must enforce cryptographic challenge verification, exact origin and Relying Party (RP) ID matching, and mandatory User Verification (`uv=required`) across both client mediation requests and server assertion verifications. Failing to enforce strict origin binding or permitting `discouraged` user verification allows malicious reverse proxies or compromised browser sessions to conduct MitM phishing and bypass biometrics on multi-device synced passkeys.","antiPatternHeadline":"Permissive Origin Parsing and Weak User Verification in Autofill Passkey Assertion Handlers","stars_count":105,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","passkeys","conditional-ui","authentication","fido2"],"exportEndpoints":{"claude":"/api/rules/webauthn-conditional-ui-passkey-attestation-guardrails?format=claude","cursorMdc":"/api/rules/webauthn-conditional-ui-passkey-attestation-guardrails?format=mdc","cursorrules":"/api/rules/webauthn-conditional-ui-passkey-attestation-guardrails?format=cursor","windsurf":"/api/rules/webauthn-conditional-ui-passkey-attestation-guardrails?format=windsurf","agents":"/api/rules/webauthn-conditional-ui-passkey-attestation-guardrails?format=agents"}},{"id":"cilium-ebpf-ambient-wireguard-mesh","title":"Cilium eBPF Ambient Mesh and Transparent WireGuard Architectural Standard","category":"devops","severity":"critical","description":"Mandates strict kernel-level traffic redirection and transparent node-to-node WireGuard encryption via Cilium eBPF, eliminating user-space sidecar proxies and legacy iptables kube-proxy implementations. This invariant enforces socket-level short-circuiting (sockops) and native kernel cryptographic encapsulation to minimize p99 latency overhead and infrastructure compute saturation.","antiPatternHeadline":"Injecting User-Space Envoy Sidecars and Unencrypted Legacy iptables Kube-Proxy Implementations","stars_count":105,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","cilium","ebpf","wireguard","service-mesh","kubernetes","network-security"],"exportEndpoints":{"claude":"/api/rules/cilium-ebpf-ambient-wireguard-mesh?format=claude","cursorMdc":"/api/rules/cilium-ebpf-ambient-wireguard-mesh?format=mdc","cursorrules":"/api/rules/cilium-ebpf-ambient-wireguard-mesh?format=cursor","windsurf":"/api/rules/cilium-ebpf-ambient-wireguard-mesh?format=windsurf","agents":"/api/rules/cilium-ebpf-ambient-wireguard-mesh?format=agents"}},{"id":"react-19-server-actions-optimistic-rollback","title":"React 19 useActionState and useOptimistic Deterministic Rollback Guardrail","category":"frontend","severity":"critical","description":"Enforces deterministic client-side state reconciliation using React 19's useActionState and useOptimistic hooks during concurrent server action invocations. Eliminates phantom renders, race conditions, and desynchronized UI states caused by unhandled network drops or out-of-band local state manipulation.","antiPatternHeadline":"Ad-Hoc useState Mutation and Uncoordinated Optimistic UI during Server Action Execution","stars_count":93,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["react-19","server-actions","useActionState","useOptimistic","concurrency","frontend"],"exportEndpoints":{"claude":"/api/rules/react-19-server-actions-optimistic-rollback?format=claude","cursorMdc":"/api/rules/react-19-server-actions-optimistic-rollback?format=mdc","cursorrules":"/api/rules/react-19-server-actions-optimistic-rollback?format=cursor","windsurf":"/api/rules/react-19-server-actions-optimistic-rollback?format=windsurf","agents":"/api/rules/react-19-server-actions-optimistic-rollback?format=agents"}},{"id":"svelte5-runes-store-boundary-ownership-isolation","title":"Svelte 5 Runes: Signals-to-Store Boundary & Ownership Tree Isolation","category":"frontend","severity":"critical","description":"Enforces deterministic ownership tree isolation when bridging external event streams or legacy Svelte stores with Svelte 5 Runes. Prevents catastrophic memory leaks, orphaned reactive tracking roots, and cyclical cascading invalidations by mandating explicit lexical scoping, effect roots, and untracked boundary transitions.","antiPatternHeadline":"Unbounded Module-Level Effects and Cyclical Store-to-Rune Bidirectional Binding Leaks","stars_count":43,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["svelte5","runes","signals","reactivity","memory-leaks","state-machine"],"exportEndpoints":{"claude":"/api/rules/svelte5-runes-store-boundary-ownership-isolation?format=claude","cursorMdc":"/api/rules/svelte5-runes-store-boundary-ownership-isolation?format=mdc","cursorrules":"/api/rules/svelte5-runes-store-boundary-ownership-isolation?format=cursor","windsurf":"/api/rules/svelte5-runes-store-boundary-ownership-isolation?format=windsurf","agents":"/api/rules/svelte5-runes-store-boundary-ownership-isolation?format=agents"}},{"id":"axum-08-tower-service-draining-zero-downtime-handoff","title":"Axum 0.8 Tower Service Draining & Zero-Downtime Socket Handoff","category":"backend","severity":"critical","description":"Enforces deterministic graceful shutdown, Tower service-level connection draining, and socket file-descriptor inheritance in Axum 0.8. Guarantees zero dropped TCP connections, prevents mid-stream HTTP/2 frame truncation, and enables uncorrupted WebSocket/SSE termination during continuous deployment orchestrations. Mandates bounded drain deadlines with cancellation tokens to avoid hung container evictions.","antiPatternHeadline":"Abrupt Process Termination and Unbounded tokio::select Without In-Flight Connection Draining","stars_count":86,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tower","tokio","zero-downtime","networking"],"exportEndpoints":{"claude":"/api/rules/axum-08-tower-service-draining-zero-downtime-handoff?format=claude","cursorMdc":"/api/rules/axum-08-tower-service-draining-zero-downtime-handoff?format=mdc","cursorrules":"/api/rules/axum-08-tower-service-draining-zero-downtime-handoff?format=cursor","windsurf":"/api/rules/axum-08-tower-service-draining-zero-downtime-handoff?format=windsurf","agents":"/api/rules/axum-08-tower-service-draining-zero-downtime-handoff?format=agents"}},{"id":"fastapi-pydantic-v2-strict-serialization-guardrail","title":"FastAPI Pydantic V2 Strict Mode Ingestion and Rust-Backed Zero-Copy Schema Masking","category":"backend","severity":"critical","description":"Enforces Pydantic V2 strict validation across all FastAPI endpoint contracts to prevent loose type coercion exploits such as string-to-integer mutation and truthy boolean pollution. Mandates compiled Rust-core validation, optimized jsonable_encoder circumvention via model_dump(mode='json'), and explicit field exclusion projection to prevent CPU-bound event-loop starvation and accidental data exfiltration.","antiPatternHeadline":"Lax Type Coercion and CPU-Bound Serialization via Legacy jsonable_encoder and Permissive Pydantic V1 Configs","stars_count":75,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","pydantic-v2","rust","security","performance"],"exportEndpoints":{"claude":"/api/rules/fastapi-pydantic-v2-strict-serialization-guardrail?format=claude","cursorMdc":"/api/rules/fastapi-pydantic-v2-strict-serialization-guardrail?format=mdc","cursorrules":"/api/rules/fastapi-pydantic-v2-strict-serialization-guardrail?format=cursor","windsurf":"/api/rules/fastapi-pydantic-v2-strict-serialization-guardrail?format=windsurf","agents":"/api/rules/fastapi-pydantic-v2-strict-serialization-guardrail?format=agents"}},{"id":"bun-sqlite-wal-concurrency-isolation-production-standard","title":"Bun 1.2 Native SQLite WAL Isolation and Multi-Threaded Concurrency Guardrail","category":"backend","severity":"critical","description":"Mandates write-ahead logging (WAL), synchronous normal modes, tuned busy timeouts, and immediate transaction locking for Bun 1.2 native bun:sqlite multiplexing across clustered workers. Eliminates SQLITE_BUSY contention deadlocks, connection exhaustion, and dirty reads during concurrent read/write transactions across OS threads.","antiPatternHeadline":"Ad-Hoc Unsynchronized bun:sqlite Handles with Deferred Transactions across Bun Workers","stars_count":94,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","sqlite","wal","concurrency","workers"],"exportEndpoints":{"claude":"/api/rules/bun-sqlite-wal-concurrency-isolation-production-standard?format=claude","cursorMdc":"/api/rules/bun-sqlite-wal-concurrency-isolation-production-standard?format=mdc","cursorrules":"/api/rules/bun-sqlite-wal-concurrency-isolation-production-standard?format=cursor","windsurf":"/api/rules/bun-sqlite-wal-concurrency-isolation-production-standard?format=windsurf","agents":"/api/rules/bun-sqlite-wal-concurrency-isolation-production-standard?format=agents"}},{"id":"kmp-swift-export-direct-abi-contract","title":"KMP Swift-Export Direct ObjC-Free ABI Interop Contract","category":"mobile","severity":"critical","description":"Enforces direct Swift-Export ABI contracts in Kotlin Multiplatform to bypass legacy Objective-C header generation. Eliminates pointer degradation, retain/release ARC churn, and runtime type erasure caused by intermediate dynamic ObjC bridging.","antiPatternHeadline":"Bridging KMP via Legacy Objective-C Headers Causing Pointer Degradation and Dual-ARC Churn","stars_count":106,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kmp","kotlin-native","swift-export","ios","memory-management"],"exportEndpoints":{"claude":"/api/rules/kmp-swift-export-direct-abi-contract?format=claude","cursorMdc":"/api/rules/kmp-swift-export-direct-abi-contract?format=mdc","cursorrules":"/api/rules/kmp-swift-export-direct-abi-contract?format=cursor","windsurf":"/api/rules/kmp-swift-export-direct-abi-contract?format=windsurf","agents":"/api/rules/kmp-swift-export-direct-abi-contract?format=agents"}},{"id":"webauthn-l3-passkey-attestation-origin-binding","title":"WebAuthn Level 3 Passkey Attestation, Exact Origin Binding, and UV Enforcement","category":"security","severity":"critical","description":"Enforces strict W3C WebAuthn Level 3 verification invariants during passkey registration and assertion. Mandates exact match comparisons against expected fully qualified origins (FQDN, scheme, port), hardware-backed User Verification (UV flag) enforcement, monotonic sign counter validation, and single-use cryptographic challenge invalidation to eliminate Adversary-in-the-Middle (AitM) phishing and credential cloning.","antiPatternHeadline":"Accepting Spoofed Reverse-Proxy Origins, Regex Origin Wildcards, or Bypassing Hardware User Verification (UV)","stars_count":114,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","fido2","passkeys","authentication","cryptography","aitm-defense"],"exportEndpoints":{"claude":"/api/rules/webauthn-l3-passkey-attestation-origin-binding?format=claude","cursorMdc":"/api/rules/webauthn-l3-passkey-attestation-origin-binding?format=mdc","cursorrules":"/api/rules/webauthn-l3-passkey-attestation-origin-binding?format=cursor","windsurf":"/api/rules/webauthn-l3-passkey-attestation-origin-binding?format=windsurf","agents":"/api/rules/webauthn-l3-passkey-attestation-origin-binding?format=agents"}},{"id":"cilium-tetragon-ebpf-syscall-killswitch-invariants","title":"Cilium Tetragon eBPF Synchronous Kernel-Level System Call Kill-Switch Enforcement","category":"security","severity":"critical","description":"Enforces deterministic, in-kernel security kill-switch policies using Cilium Tetragon TracingPolicies to synchronously terminate unauthorized syscalls at the eBPF hook layer. Prevents post-execution race conditions by mandating Sigkill or Override action primitives on privileged syscall hooks (e.g., sys_enter, commit_creds) rather than asynchronous userspace alert pipelines. Eliminates zero-day privilege escalation and uncontained binary executions within production Kubernetes workloads.","antiPatternHeadline":"Asynchronous Userspace Alerting on Kernel Privilege Escalations Without Synchronous In-Kernel Sigkill/Override Actions","stars_count":84,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","ebpf","cilium","tetragon","kubernetes","runtime-security","linux-kernel"],"exportEndpoints":{"claude":"/api/rules/cilium-tetragon-ebpf-syscall-killswitch-invariants?format=claude","cursorMdc":"/api/rules/cilium-tetragon-ebpf-syscall-killswitch-invariants?format=mdc","cursorrules":"/api/rules/cilium-tetragon-ebpf-syscall-killswitch-invariants?format=cursor","windsurf":"/api/rules/cilium-tetragon-ebpf-syscall-killswitch-invariants?format=windsurf","agents":"/api/rules/cilium-tetragon-ebpf-syscall-killswitch-invariants?format=agents"}},{"id":"opentelemetry-genai-semantic-conventions-token-budgeting","title":"OpenTelemetry GenAI Semantic Convention Compliance & Distributed Token Budget Guardrails","category":"devops","severity":"critical","description":"Enforces strict conformance with OpenTelemetry GenAI Semantic Conventions across all LLM client calls, proxy pipelines, and multi-agent systems. Mandates standard attributes (system, model, token usage), context propagation across asynchronous boundaries via W3C Trace Context and Baggage, and pre-execution token budget validation to prevent cascading financial exhaustion.","antiPatternHeadline":"Ad-Hoc Uninstrumented LLM Invocations Without Distributed Trace Propagation or Pre-Execution Token Budget Bounds","stars_count":95,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","observability","genai","tracing","finops","token-budget"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-genai-semantic-conventions-token-budgeting?format=claude","cursorMdc":"/api/rules/opentelemetry-genai-semantic-conventions-token-budgeting?format=mdc","cursorrules":"/api/rules/opentelemetry-genai-semantic-conventions-token-budgeting?format=cursor","windsurf":"/api/rules/opentelemetry-genai-semantic-conventions-token-budgeting?format=windsurf","agents":"/api/rules/opentelemetry-genai-semantic-conventions-token-budgeting?format=agents"}},{"id":"vite-6-environment-api-runtime-isolation","title":"Vite 6 Environment API Multi-Runtime SSR Target Isolation","category":"devops","severity":"critical","description":"Enforces strict isolation of execution runtimes (client, node, edge/workerd) using Vite 6's Environment API. Eliminates polyfill cross-contamination, shared module graph pollution, and global scope leakage across heterogenous SSR compilation targets in a single pipeline.","antiPatternHeadline":"Global Module Graph Leakage and Polyfill Pollution Across Heterogeneous Runtimes","stars_count":70,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","vite6","ssr","environment-api","edge-runtime","bundling","cloudflare-workers"],"exportEndpoints":{"claude":"/api/rules/vite-6-environment-api-runtime-isolation?format=claude","cursorMdc":"/api/rules/vite-6-environment-api-runtime-isolation?format=mdc","cursorrules":"/api/rules/vite-6-environment-api-runtime-isolation?format=cursor","windsurf":"/api/rules/vite-6-environment-api-runtime-isolation?format=windsurf","agents":"/api/rules/vite-6-environment-api-runtime-isolation?format=agents"}},{"id":"react-19-server-action-optimistic-boundaries","title":"Deterministic Rollback and Schema Boundaries for React 19 useActionState and useOptimistic","category":"frontend","severity":"critical","description":"Enforces deterministic state synchronization between React 19 Server Actions, useActionState, and useOptimistic primitives. Mandates strict schema validation boundaries for action payloads and structured discriminated-union error responses to guarantee immediate, automatic rollback on server rejections without client-side state divergence.","antiPatternHeadline":"Unbounded Optimistic Mutation with Detached Imperative Rollbacks and Unvalidated Action Payloads","stars_count":109,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","server-actions","useActionState","useOptimistic","type-safety","zod"],"exportEndpoints":{"claude":"/api/rules/react-19-server-action-optimistic-boundaries?format=claude","cursorMdc":"/api/rules/react-19-server-action-optimistic-boundaries?format=mdc","cursorrules":"/api/rules/react-19-server-action-optimistic-boundaries?format=cursor","windsurf":"/api/rules/react-19-server-action-optimistic-boundaries?format=windsurf","agents":"/api/rules/react-19-server-action-optimistic-boundaries?format=agents"}},{"id":"svelte-5-runes-reactive-scope-isolation","title":"Svelte 5 Runes Reactive Scope Isolation Across Async Boundaries","category":"frontend","severity":"critical","description":"Enforces strict lexical encapsulation of $state and $derived runes across asynchronous micro-task boundaries to prevent reactive context detachment and memory leaks. Guarantees that async operations explicitly tie into lifecycle cancellation via AbortController and avoid capturing stale signal references across unmounted component trees.","antiPatternHeadline":"Capturing Reactive Runes in Asynchronous Continuations Without Teardown or Abort Mechanisms","stars_count":95,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","reactivity","memory-leaks","async"],"exportEndpoints":{"claude":"/api/rules/svelte-5-runes-reactive-scope-isolation?format=claude","cursorMdc":"/api/rules/svelte-5-runes-reactive-scope-isolation?format=mdc","cursorrules":"/api/rules/svelte-5-runes-reactive-scope-isolation?format=cursor","windsurf":"/api/rules/svelte-5-runes-reactive-scope-isolation?format=windsurf","agents":"/api/rules/svelte-5-runes-reactive-scope-isolation?format=agents"}},{"id":"axum-08-multi-phase-graceful-drain","title":"Axum 0.8 Multi-Phase Graceful Drain & Rolling Deployment Invariant","category":"backend","severity":"critical","description":"Enforces zero-downtime rolling deployments in Axum 0.8 by mandating a coordinated multi-phase drain lifecycle: load-balancer deregistration quiescence, bounded HTTP/1.1 and HTTP/2 stream completion, and ordered downstream connection pool termination.","antiPatternHeadline":"Immediate SIGTERM Termination Dropping Inflight Requests and Leaking Multiplexed HTTP/2 Streams","stars_count":105,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tokio","zero-downtime","kubernetes"],"exportEndpoints":{"claude":"/api/rules/axum-08-multi-phase-graceful-drain?format=claude","cursorMdc":"/api/rules/axum-08-multi-phase-graceful-drain?format=mdc","cursorrules":"/api/rules/axum-08-multi-phase-graceful-drain?format=cursor","windsurf":"/api/rules/axum-08-multi-phase-graceful-drain?format=windsurf","agents":"/api/rules/axum-08-multi-phase-graceful-drain?format=agents"}},{"id":"postgres-17-async-direct-io-json-table-projections","title":"PostgreSQL 17 Direct I/O Tuning & SQL:2023 JSON_TABLE Projections","category":"backend","severity":"critical","description":"Mandates the use of PostgreSQL 17 SQL:2023 standard JSON_TABLE projections for bulk event ingestion and configures asynchronous direct I/O (io_direct) for write-ahead log (WAL) and data writes. Eliminates client-tier JSON deserialization overhead, reduces Node/Go memory pressure, and prevents operating system buffer cache double-buffering during high-throughput ingest.","antiPatternHeadline":"Client-Side In-Memory JSON Shredding and Unbuffered JSONB Table Unnesting Under Buffered Disk I/O","stars_count":47,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql-17","direct-io","json-table","performance","event-ingestion","sql-2023"],"exportEndpoints":{"claude":"/api/rules/postgres-17-async-direct-io-json-table-projections?format=claude","cursorMdc":"/api/rules/postgres-17-async-direct-io-json-table-projections?format=mdc","cursorrules":"/api/rules/postgres-17-async-direct-io-json-table-projections?format=cursor","windsurf":"/api/rules/postgres-17-async-direct-io-json-table-projections?format=windsurf","agents":"/api/rules/postgres-17-async-direct-io-json-table-projections?format=agents"}},{"id":"bun-cluster-worker-sqlite-isolation","title":"Bun 1.2 Worker Cluster & Native SQLite WAL Multi-Tenant Memory Boundary Enforcement","category":"backend","severity":"critical","description":"Enforces strict memory isolation ceilings and tenant-segregated SQLite WAL boundaries across Bun 1.2 clustered worker threads. Guarantees zero cross-tenant shared-memory bleed, mitigates noisy-neighbor heap exhaustion, and prevents WAL shm lock contention in ultra-low-latency edge microservices.","antiPatternHeadline":"Cross-Tenant Shared SQLite Handles and Unbounded Worker Heap Allocation","stars_count":47,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","sqlite","multitenancy","cluster","isolation","wal"],"exportEndpoints":{"claude":"/api/rules/bun-cluster-worker-sqlite-isolation?format=claude","cursorMdc":"/api/rules/bun-cluster-worker-sqlite-isolation?format=mdc","cursorrules":"/api/rules/bun-cluster-worker-sqlite-isolation?format=cursor","windsurf":"/api/rules/bun-cluster-worker-sqlite-isolation?format=windsurf","agents":"/api/rules/bun-cluster-worker-sqlite-isolation?format=agents"}},{"id":"openfga-causality-consistency-token-invariants","title":"OpenFGA Causality Consistency Token & Strict Read-After-Write Guardrails","category":"security","severity":"critical","description":"Enforces strict causal consistency and token propagation in OpenFGA authorization checks to prevent the New Enemy Problem. Guarantees that permission revocations and access updates are immediately respected across distributed read replicas without authorization bypasses caused by replication lag.","antiPatternHeadline":"Stale Replica Evaluation via Default Consistency Checks After Relationship Mutation","stars_count":95,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","authorization","rebac","zanzibar","distributed-systems","consistency-tokens"],"exportEndpoints":{"claude":"/api/rules/openfga-causality-consistency-token-invariants?format=claude","cursorMdc":"/api/rules/openfga-causality-consistency-token-invariants?format=mdc","cursorrules":"/api/rules/openfga-causality-consistency-token-invariants?format=cursor","windsurf":"/api/rules/openfga-causality-consistency-token-invariants?format=windsurf","agents":"/api/rules/openfga-causality-consistency-token-invariants?format=agents"}},{"id":"webauthn-prf-client-key-derivation-standard","title":"Hardware-Bound Zero-Knowledge Key Derivation via WebAuthn PRF Extension","category":"security","severity":"critical","description":"Enforces strict cryptographic hygiene when using the WebAuthn Pseudo-Random Function (PRF) extension (hmac-secret) for zero-knowledge client-side encryption. Mandates domain-separated HKDF salt isolation, prevents PRF output transmission to relying parties, and ensures ephemerality of unpadded raw symmetric keys in browser memory.","antiPatternHeadline":"Directly Utilizing Raw PRF Outputs as Symmetric Cipher Keys or Leaking PRF Secrets to Relying Parties","stars_count":94,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","cryptography","prf-extension","zero-knowledge","hkdf"],"exportEndpoints":{"claude":"/api/rules/webauthn-prf-client-key-derivation-standard?format=claude","cursorMdc":"/api/rules/webauthn-prf-client-key-derivation-standard?format=mdc","cursorrules":"/api/rules/webauthn-prf-client-key-derivation-standard?format=cursor","windsurf":"/api/rules/webauthn-prf-client-key-derivation-standard?format=windsurf","agents":"/api/rules/webauthn-prf-client-key-derivation-standard?format=agents"}},{"id":"tauri-v2-ipc-permission-scoping-isolation","title":"Tauri 2.0 Mobile IPC Permission Scoping and Multi-Webview Isolation","category":"mobile","severity":"critical","description":"Enforces strict capability-based access control, granular IPC command allowlists, and origin isolation in Tauri 2.0 mobile applications. Prevents compromised third-party webview assets or remote webviews from escalating privileges into native Rust system APIs via unscoped wildcard permissions or unvalidated command invocations.","antiPatternHeadline":"Wildcard IPC Capabilities and Unscoped Command Invocation Across Webview Contexts","stars_count":44,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["tauri","mobile","security","ipc","rust","permissions"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-ipc-permission-scoping-isolation?format=claude","cursorMdc":"/api/rules/tauri-v2-ipc-permission-scoping-isolation?format=mdc","cursorrules":"/api/rules/tauri-v2-ipc-permission-scoping-isolation?format=cursor","windsurf":"/api/rules/tauri-v2-ipc-permission-scoping-isolation?format=windsurf","agents":"/api/rules/tauri-v2-ipc-permission-scoping-isolation?format=agents"}},{"id":"capacitor-7-native-bridge-thread-invariants","title":"Capacitor 7 Concurrent Native Bridge Thread Invariants","category":"mobile","severity":"critical","description":"Enforces strict offloading of high-frequency native telemetry and bi-directional hardware streaming away from the WebView main UI thread into dedicated native worker queues and Web Workers. Prevents main-thread micro-stutters and frame drops by establishing batched RingBuffers, asynchronous native dispatching, and zero-copy transfer protocols over Capacitor 7 bridge interfaces.","antiPatternHeadline":"Saturating WebView UI thread with synchronous unbatched native bridge event notifications","stars_count":70,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","performance","native-bridge","threading","web-workers"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-native-bridge-thread-invariants?format=claude","cursorMdc":"/api/rules/capacitor-7-native-bridge-thread-invariants?format=mdc","cursorrules":"/api/rules/capacitor-7-native-bridge-thread-invariants?format=cursor","windsurf":"/api/rules/capacitor-7-native-bridge-thread-invariants?format=windsurf","agents":"/api/rules/capacitor-7-native-bridge-thread-invariants?format=agents"}},{"id":"argo-rollouts-otel-promql-slo-invariants","title":"Argo Rollouts OpenTelemetry PromQL SLO Health Invariants","category":"devops","severity":"critical","description":"Enforces strict canary validation rules that prevent traffic shifting in Argo Rollouts without verifiable real-time SLO evaluations backed by OpenTelemetry Prometheus metrics. Mandates bounded PromQL rate calculations, division-by-zero protection, and minimum throughput thresholds before advancing canary ingress steps. Eliminates silent deployment failures caused by missing telemetry, uncalibrated thresholds, and blind traffic promotions.","antiPatternHeadline":"Blind Ingress Weight Progression Without Telemetry-Guarded Canary SLO Gates","stars_count":79,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","kubernetes","argo-rollouts","opentelemetry","promql","slo","canary-deployment"],"exportEndpoints":{"claude":"/api/rules/argo-rollouts-otel-promql-slo-invariants?format=claude","cursorMdc":"/api/rules/argo-rollouts-otel-promql-slo-invariants?format=mdc","cursorrules":"/api/rules/argo-rollouts-otel-promql-slo-invariants?format=cursor","windsurf":"/api/rules/argo-rollouts-otel-promql-slo-invariants?format=windsurf","agents":"/api/rules/argo-rollouts-otel-promql-slo-invariants?format=agents"}},{"id":"svelte-5-runes-reactive-graph-boundary-standard","title":"Svelte 5 Runes Reactive Graph Boundary & Signal Isolation Standard","category":"frontend","severity":"critical","description":"Enforces strict isolation of the Svelte 5 rune reactive dependency graph across component and module boundaries. Precludes deep-state leakage, cyclic signal dependencies, and uncontained micro-frontend re-renders by enforcing encapsulation of mutable $state, pure derived computations via $derived.by, and controlled boundary mutations using explicit accessors or getters.","antiPatternHeadline":"Leaking Raw $state Across Module Boundaries Causing Cascading Cross-Micro-Frontend Re-Renders and Graph Poisoning","stars_count":105,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["svelte","svelte-5","runes","reactivity","signals","micro-frontends","performance"],"exportEndpoints":{"claude":"/api/rules/svelte-5-runes-reactive-graph-boundary-standard?format=claude","cursorMdc":"/api/rules/svelte-5-runes-reactive-graph-boundary-standard?format=mdc","cursorrules":"/api/rules/svelte-5-runes-reactive-graph-boundary-standard?format=cursor","windsurf":"/api/rules/svelte-5-runes-reactive-graph-boundary-standard?format=windsurf","agents":"/api/rules/svelte-5-runes-reactive-graph-boundary-standard?format=agents"}},{"id":"nextjs-15-ppr-streaming-boundary-standard","title":"Next.js 15 PPR: Strict Suspense Boundary Decoupling for Static Shells","category":"frontend","severity":"critical","description":"Next.js 15 Partial Prerendering (PPR) requires dynamic APIs and uncached data fetches to be strictly sequestered behind explicit React Suspense boundaries. Invoking dynamic execution directly in page or layout shell components de-optimizes the entire route to dynamic on-demand SSR, destroying edge-cacheable static shell prerendering and ballooning Time to First Byte (TTFB).","antiPatternHeadline":"Accessing Dynamic APIs Directly in Page Shell Components, Collapsing Static PPR Prerendering","stars_count":94,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs15","ppr","suspense","streaming","react-server-components"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-ppr-streaming-boundary-standard?format=claude","cursorMdc":"/api/rules/nextjs-15-ppr-streaming-boundary-standard?format=mdc","cursorrules":"/api/rules/nextjs-15-ppr-streaming-boundary-standard?format=cursor","windsurf":"/api/rules/nextjs-15-ppr-streaming-boundary-standard?format=windsurf","agents":"/api/rules/nextjs-15-ppr-streaming-boundary-standard?format=agents"}},{"id":"axum-tokio-cancellation-backpressure-guardrail","title":"Axum 0.8 Tokio Cancellation Token & Bounded Backpressure Guardrail","category":"backend","severity":"critical","description":"Enforces deterministic cancellation and bounded queue backpressure across Axum 0.8 service pipelines using tokio_util::sync::CancellationToken and bounded Tokio mpsc channels. Prevents socket starvation, ghost resource consumption, and runaway compute when HTTP clients disconnect or downstream pipelines saturate.","antiPatternHeadline":"Unbounded Channel Spawning and Unguarded Long-Running Tasks Without Cancellation Checks","stars_count":62,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tokio","concurrency","async"],"exportEndpoints":{"claude":"/api/rules/axum-tokio-cancellation-backpressure-guardrail?format=claude","cursorMdc":"/api/rules/axum-tokio-cancellation-backpressure-guardrail?format=mdc","cursorrules":"/api/rules/axum-tokio-cancellation-backpressure-guardrail?format=cursor","windsurf":"/api/rules/axum-tokio-cancellation-backpressure-guardrail?format=windsurf","agents":"/api/rules/axum-tokio-cancellation-backpressure-guardrail?format=agents"}},{"id":"postgres-17-logical-replication-slot-failover","title":"PostgreSQL 17 Logical Replication Slot Failover Synchrony & Zero-Downtime Migration Standard","category":"backend","severity":"critical","description":"Enforces failover-enabled logical replication slots and synchronized standby slot topologies introduced in PostgreSQL 17. Guarantees downstream subscribers (e.g., Debezium, audit consumers, microservice outboxes) survive physical primary failover without silent message drops, LSN regression, or full table rebuilds.","antiPatternHeadline":"Unsynchronized Logical Slots and Unconfigured Standby Slot Promotion Leading to LSN Drift and Consumer Resync Loops","stars_count":111,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","replication","cdc","database","high-availability"],"exportEndpoints":{"claude":"/api/rules/postgres-17-logical-replication-slot-failover?format=claude","cursorMdc":"/api/rules/postgres-17-logical-replication-slot-failover?format=mdc","cursorrules":"/api/rules/postgres-17-logical-replication-slot-failover?format=cursor","windsurf":"/api/rules/postgres-17-logical-replication-slot-failover?format=windsurf","agents":"/api/rules/postgres-17-logical-replication-slot-failover?format=agents"}},{"id":"bun-multi-tenant-worker-heap-sandboxing","title":"Deterministic Heap-Capped Worker Isolation & Lifecycle Eviction in Bun 1.2","category":"backend","severity":"critical","description":"Enforces strict memory boundaries and tenant isolation for high-density multi-tenant workloads in Bun 1.2. Mandates deterministic per-tenant worker recycling based on post-execution heap inspection and strict memory limits, preventing out-of-memory (OOM) cascade failures across shared compute nodes.","antiPatternHeadline":"Unbounded In-Process Tenant Execution and Unmonitored Worker Reuse Leading to Host OOM Cascades","stars_count":48,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","workers","multi-tenant","memory-management","sandboxing"],"exportEndpoints":{"claude":"/api/rules/bun-multi-tenant-worker-heap-sandboxing?format=claude","cursorMdc":"/api/rules/bun-multi-tenant-worker-heap-sandboxing?format=mdc","cursorrules":"/api/rules/bun-multi-tenant-worker-heap-sandboxing?format=cursor","windsurf":"/api/rules/bun-multi-tenant-worker-heap-sandboxing?format=windsurf","agents":"/api/rules/bun-multi-tenant-worker-heap-sandboxing?format=agents"}},{"id":"kmp-swift-concurrency-memory-model-guardrail","title":"KMP to Swift Concurrency Bidirectional Memory and Cancellation Bridge","category":"mobile","severity":"critical","description":"Enforces deterministic threading, actor isolation, and cooperative cancellation between Kotlin Coroutines and Swift Concurrency. Eliminates memory leaks, cross-thread race conditions, and deadlocks arising from uncoordinated bridging between Kotlin/Native memory runtimes and Swift Tasks.","antiPatternHeadline":"Unconfined Suspend Bridging and Unbounded Main-Thread Blocking Across the KMP-Swift FFI Boundary","stars_count":115,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","swift","concurrency","coroutines","actors"],"exportEndpoints":{"claude":"/api/rules/kmp-swift-concurrency-memory-model-guardrail?format=claude","cursorMdc":"/api/rules/kmp-swift-concurrency-memory-model-guardrail?format=mdc","cursorrules":"/api/rules/kmp-swift-concurrency-memory-model-guardrail?format=cursor","windsurf":"/api/rules/kmp-swift-concurrency-memory-model-guardrail?format=windsurf","agents":"/api/rules/kmp-swift-concurrency-memory-model-guardrail?format=agents"}},{"id":"tauri-v2-mobile-capability-ipc-sandboxing","title":"Tauri 2.0 Mobile Capability-Based IPC Permission Sandboxing","category":"mobile","severity":"critical","description":"Enforces granular capability manifests and explicit permission sandboxing for Tauri 2.0 iOS and Android targets. Prevents WebView-to-native privilege escalation by isolating IPC commands, disabling wildcard permissions, and enforcing origin-bound native capabilities.","antiPatternHeadline":"Over-Privileged Wildcard IPC Permissions and Unscoped Native Commands in Mobile WebViews","stars_count":109,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri-2","security","ipc-sandboxing","rust"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-mobile-capability-ipc-sandboxing?format=claude","cursorMdc":"/api/rules/tauri-v2-mobile-capability-ipc-sandboxing?format=mdc","cursorrules":"/api/rules/tauri-v2-mobile-capability-ipc-sandboxing?format=cursor","windsurf":"/api/rules/tauri-v2-mobile-capability-ipc-sandboxing?format=windsurf","agents":"/api/rules/tauri-v2-mobile-capability-ipc-sandboxing?format=agents"}},{"id":"openfga-rebac-distributed-authorization-standard","title":"OpenFGA Distributed ReBAC Architecture and Contextual Evaluation Invariants","category":"security","severity":"critical","description":"Standardizes high-throughput, low-latency Relationship-Based Access Control (ReBAC) using OpenFGA across distributed microservices. Mandates atomic tuple synchronization via transactional outbox patterns, strict use of contextual tuples for ephemeral request states, and vector-evaluated batching to prevent N+1 authorization cascades and authorization drift.","antiPatternHeadline":"Synchronous Dual-Writes of Relationship Tuples and In-Loop Sequential OpenFGA Checks Causing Authorization Drift and Cascading Latency","stars_count":79,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","rebac","authorization","distributed-systems","zanzibar"],"exportEndpoints":{"claude":"/api/rules/openfga-rebac-distributed-authorization-standard?format=claude","cursorMdc":"/api/rules/openfga-rebac-distributed-authorization-standard?format=mdc","cursorrules":"/api/rules/openfga-rebac-distributed-authorization-standard?format=cursor","windsurf":"/api/rules/openfga-rebac-distributed-authorization-standard?format=windsurf","agents":"/api/rules/openfga-rebac-distributed-authorization-standard?format=agents"}},{"id":"ebpf-kernel-rasp-zero-overhead-egress-auditing","title":"Kernel-Space eBPF RASP and Non-Blocking Socket-Level Egress Enforcement","category":"security","severity":"critical","description":"Enforces deterministic, in-kernel security monitoring and egress authorization using eBPF LSM and socket hooks without user-space sidecar proxies. Mandates atomic ring-buffer event submission, bounded map lookups with verifier compliance, and synchronous kernel-level packet drops for policy violations before network stack traversal.","antiPatternHeadline":"User-Space Proxy Indirection and Unbounded Asynchronous eBPF Filtering Vulnerable to TOCTOU and CPU Starvation","stars_count":62,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","ebpf","linux-kernel","rasp","cgroup2","lsm","network-security"],"exportEndpoints":{"claude":"/api/rules/ebpf-kernel-rasp-zero-overhead-egress-auditing?format=claude","cursorMdc":"/api/rules/ebpf-kernel-rasp-zero-overhead-egress-auditing?format=mdc","cursorrules":"/api/rules/ebpf-kernel-rasp-zero-overhead-egress-auditing?format=cursor","windsurf":"/api/rules/ebpf-kernel-rasp-zero-overhead-egress-auditing?format=windsurf","agents":"/api/rules/ebpf-kernel-rasp-zero-overhead-egress-auditing?format=agents"}},{"id":"opentelemetry-baggage-semantic-sampling-standard","title":"OpenTelemetry Distributed Baggage & Tail-Based Sampling Standard","category":"devops","severity":"critical","description":"Mandates strict separation between transient span attributes and distributed W3C baggage, enforcing baggage hygiene to prevent header bloat and PII leakage across RPC boundaries. Pairs contextual baggage propagation with tail-based OpenTelemetry Collector sampling configurations to guarantee 100% trace capture for critical errors and high-tier tenants while suppressing routine high-volume spans.","antiPatternHeadline":"Overloading W3C Baggage with Unsanitized PII and Relying on Naive Head-Based Sampling for Error Paths","stars_count":96,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","observability","distributed-tracing","sampling"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-baggage-semantic-sampling-standard?format=claude","cursorMdc":"/api/rules/opentelemetry-baggage-semantic-sampling-standard?format=mdc","cursorrules":"/api/rules/opentelemetry-baggage-semantic-sampling-standard?format=cursor","windsurf":"/api/rules/opentelemetry-baggage-semantic-sampling-standard?format=windsurf","agents":"/api/rules/opentelemetry-baggage-semantic-sampling-standard?format=agents"}},{"id":"react-19-server-actions-optimistic-mutation-integrity","title":"React 19 Server Actions & Optimistic Mutation Serializability Guardrail","category":"frontend","severity":"critical","description":"Enforces deterministic state reconciliation, idempotency tracking, and transaction serializability across concurrent useOptimistic and useActionState invocations. Prevents UI state tearing, ghost mutations, and race conditions caused by non-monotonic response ordering in concurrent React 19 Server Actions.","antiPatternHeadline":"Unordered Optimistic State Mutation with Unbound Action Race Hazards and Silent Failure Drifts","stars_count":119,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react19","server-actions","use-optimistic","use-action-state","concurrency"],"exportEndpoints":{"claude":"/api/rules/react-19-server-actions-optimistic-mutation-integrity?format=claude","cursorMdc":"/api/rules/react-19-server-actions-optimistic-mutation-integrity?format=mdc","cursorrules":"/api/rules/react-19-server-actions-optimistic-mutation-integrity?format=cursor","windsurf":"/api/rules/react-19-server-actions-optimistic-mutation-integrity?format=windsurf","agents":"/api/rules/react-19-server-actions-optimistic-mutation-integrity?format=agents"}},{"id":"svelte-5-runes-reactivity-boundary-enforcement","title":"Svelte 5 Runes Reactivity Boundary and Signal Invariant Enforcement","category":"frontend","severity":"critical","description":"Establishes strict unidirectional signal-graph boundaries using Svelte 5 runes ($state, $derived, $effect, and untrack) to eliminate side-effect cascades, cyclic dependency loops, and untracked microtask mutations. Mandates that derived computations remain strictly pure and idempotently evaluable without mutating upstream or downstream state.","antiPatternHeadline":"Mutating reactive state inside $derived expressions or unbounded $effect cycles triggering reactivity graph thrashing","stars_count":43,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","reactivity","state-management","signals"],"exportEndpoints":{"claude":"/api/rules/svelte-5-runes-reactivity-boundary-enforcement?format=claude","cursorMdc":"/api/rules/svelte-5-runes-reactivity-boundary-enforcement?format=mdc","cursorrules":"/api/rules/svelte-5-runes-reactivity-boundary-enforcement?format=cursor","windsurf":"/api/rules/svelte-5-runes-reactivity-boundary-enforcement?format=windsurf","agents":"/api/rules/svelte-5-runes-reactivity-boundary-enforcement?format=agents"}},{"id":"axum-zero-copy-streaming-cancellation","title":"Axum 0.8 Zero-Copy Streaming & Cooperative Cancellation Guardrail","category":"backend","severity":"critical","description":"Enforces strict zero-copy chunk streaming and deterministic cooperative cancellation for Axum 0.8 backends over HTTP/2 and HTTP/3. Guarantees that client disconnects, QUIC stream resets, and downstream backpressure propagate upstream to immediately halt resource consumption without orphan tasks or unbounded buffering.","antiPatternHeadline":"Unbounded In-Memory Buffering and Orphaned Producer Loops on Client Disconnect","stars_count":45,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tokio","async-stream","zero-copy","http3"],"exportEndpoints":{"claude":"/api/rules/axum-zero-copy-streaming-cancellation?format=claude","cursorMdc":"/api/rules/axum-zero-copy-streaming-cancellation?format=mdc","cursorrules":"/api/rules/axum-zero-copy-streaming-cancellation?format=cursor","windsurf":"/api/rules/axum-zero-copy-streaming-cancellation?format=windsurf","agents":"/api/rules/axum-zero-copy-streaming-cancellation?format=agents"}},{"id":"postgres-17-outbox-pgvector-convergence","title":"Strict Linearizability for Postgres 17 Logical Replication Outbox & pgvector Convergence","category":"backend","severity":"critical","description":"Enforces strict linearizability and zero data loss between primary ACID entity transactions and downstream HNSW/IVFFlat vector embeddings. Mandates transactional outbox writes collocated within the primary transaction, consumed via Postgres 17 failover-capable logical replication slots (pg_create_logical_replication_slot with failover=true) and synchronized replication slots, completely eliminating dual-write split-brain anomalies and orphaned vector states.","antiPatternHeadline":"Dual-Writing to Vector Stores or Updating Embeddings In-Transaction Causing Tail Latency and Stale Out-of-Order Vectors","stars_count":57,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres-17","pgvector","logical-replication","outbox-pattern","linearizability"],"exportEndpoints":{"claude":"/api/rules/postgres-17-outbox-pgvector-convergence?format=claude","cursorMdc":"/api/rules/postgres-17-outbox-pgvector-convergence?format=mdc","cursorrules":"/api/rules/postgres-17-outbox-pgvector-convergence?format=cursor","windsurf":"/api/rules/postgres-17-outbox-pgvector-convergence?format=windsurf","agents":"/api/rules/postgres-17-outbox-pgvector-convergence?format=agents"}},{"id":"tauri-v2-capability-ipc-sandboxing-tauri-2-0-capabi-829","title":"Tauri 2.0 Capability-Based IPC Sandboxing and Least Privilege Enforcement","category":"mobile","severity":"critical","description":"Enforces strict capability-based access control (CBAC) for webview-to-core IPC bridges in Tauri 2.0 mobile applications. Eliminates privilege escalation across the native mobile boundary by prohibiting default wildcard permissions, requiring granular JSON/TOML capability files mapped directly to webview labels and mobile platform targets, and mandating input boundary sanitization before IPC dispatch.","antiPatternHeadline":"Monolithic Capability Wildcarding and Unscoped IPC Bridge Invocation","stars_count":105,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri","ipc","sandboxing","rust","security"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-capability-ipc-sandboxing-tauri-2-0-capabi-829?format=claude","cursorMdc":"/api/rules/tauri-v2-capability-ipc-sandboxing-tauri-2-0-capabi-829?format=mdc","cursorrules":"/api/rules/tauri-v2-capability-ipc-sandboxing-tauri-2-0-capabi-829?format=cursor","windsurf":"/api/rules/tauri-v2-capability-ipc-sandboxing-tauri-2-0-capabi-829?format=windsurf","agents":"/api/rules/tauri-v2-capability-ipc-sandboxing-tauri-2-0-capabi-829?format=agents"}},{"id":"kmp-swift-structured-concurrency-bridge","title":"Deterministic Kotlin Coroutine to Swift Structured Concurrency Bridge","category":"mobile","severity":"critical","description":"Enforces strict bidirectional cancellation propagation and lifecycle binding between Kotlin Coroutines and Swift Structured Concurrency. Prevents GCD worker thread-pool starvation and cross-runtime reference cycle memory leaks between Kotlin's GC and Swift ARC.","antiPatternHeadline":"Unmanaged Detached Task Bridging Leaking Zombie Coroutines and Native ARC Retain Cycles","stars_count":89,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kmp","kotlin-multiplatform","swift-concurrency","coroutines","ios"],"exportEndpoints":{"claude":"/api/rules/kmp-swift-structured-concurrency-bridge?format=claude","cursorMdc":"/api/rules/kmp-swift-structured-concurrency-bridge?format=mdc","cursorrules":"/api/rules/kmp-swift-structured-concurrency-bridge?format=cursor","windsurf":"/api/rules/kmp-swift-structured-concurrency-bridge?format=windsurf","agents":"/api/rules/kmp-swift-structured-concurrency-bridge?format=agents"}},{"id":"openfga-rebac-cdc-cache-invalidation-pipeline","title":"OpenFGA Transactional Log-Driven ReBAC Cache Invalidation & Consistency Pipeline","category":"security","severity":"critical","description":"Mandates that all distributed and local relationship-based access control (ReBAC) cache layers invalidate permissions strictly via transactional log streams (CDC/Outbox) using monotonically increasing sequence tokens. Prevents privilege escalation and stale authorization decisions by guaranteeing causal consistency and eliminating reliance on loose TTLs for privilege revocation.","antiPatternHeadline":"Dual-Write Invalidation or Static TTLs on Cached ReBAC Permission Evaluations","stars_count":75,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","rebac","cache-invalidation","cdc","kafka","redis"],"exportEndpoints":{"claude":"/api/rules/openfga-rebac-cdc-cache-invalidation-pipeline?format=claude","cursorMdc":"/api/rules/openfga-rebac-cdc-cache-invalidation-pipeline?format=mdc","cursorrules":"/api/rules/openfga-rebac-cdc-cache-invalidation-pipeline?format=cursor","windsurf":"/api/rules/openfga-rebac-cdc-cache-invalidation-pipeline?format=windsurf","agents":"/api/rules/openfga-rebac-cdc-cache-invalidation-pipeline?format=agents"}},{"id":"webauthn-prf-zk-key-derivation-guardrail","title":"Enforce Zero-Knowledge Client-Side Key Derivation via WebAuthn PRF Extensions","category":"security","severity":"critical","description":"Enforces strict zero-knowledge invariants for client-side cryptographic key derivation using WebAuthn Pseudo-Random Function (PRF) extensions. Mandates that raw PRF outputs and derived symmetric keys are isolated to client memory, processed through domain-separated HKDF, and stripped from network payloads prior to server transmission.","antiPatternHeadline":"Leaking PRF outputs to backend servers or using raw PRF material directly as symmetric keys without domain-separated HKDF.","stars_count":85,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","prf-extension","zero-knowledge","cryptography","webcrypto"],"exportEndpoints":{"claude":"/api/rules/webauthn-prf-zk-key-derivation-guardrail?format=claude","cursorMdc":"/api/rules/webauthn-prf-zk-key-derivation-guardrail?format=mdc","cursorrules":"/api/rules/webauthn-prf-zk-key-derivation-guardrail?format=cursor","windsurf":"/api/rules/webauthn-prf-zk-key-derivation-guardrail?format=windsurf","agents":"/api/rules/webauthn-prf-zk-key-derivation-guardrail?format=agents"}},{"id":"ebpf-zero-sidecar-mesh-traffic-steering-standard","title":"eBPF Socket-Layer Zero-Sidecar Traffic Steering and Policy Enforcement Standard","category":"devops","severity":"critical","description":"Enforces eBPF socket-layer (sockops/sk_msg) fast-path routing and in-kernel mutual authentication to bypass TCP/IP stack overhead and eliminate userspace proxy sidecar memory and latency penalties. Requires node-local or kernel-native processing where L7 proxying is deferred strictly to shared per-node envoy daemons only when explicit deep packet inspection is mandated.","antiPatternHeadline":"Injecting Userspace Sidecar Proxies with Loopback iptables REDIRECT for Pure Socket Workloads","stars_count":41,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","cilium","service-mesh","networking","kernel","zero-sidecar"],"exportEndpoints":{"claude":"/api/rules/ebpf-zero-sidecar-mesh-traffic-steering-standard?format=claude","cursorMdc":"/api/rules/ebpf-zero-sidecar-mesh-traffic-steering-standard?format=mdc","cursorrules":"/api/rules/ebpf-zero-sidecar-mesh-traffic-steering-standard?format=cursor","windsurf":"/api/rules/ebpf-zero-sidecar-mesh-traffic-steering-standard?format=windsurf","agents":"/api/rules/ebpf-zero-sidecar-mesh-traffic-steering-standard?format=agents"}},{"id":"otel-v1-28-tail-based-adaptive-sampling","title":"OpenTelemetry v1.28 Tail-Based Adaptive Sampling and Semantic Span Retention","category":"devops","severity":"critical","description":"Enforces 100% trace capture for anomalous, high-latency, and error-state spans using OpenTelemetry Collector tail-based sampling while dynamically downsampling nominal transactions. Mandates compliance with OpenTelemetry Semantic Conventions v1.28 HTTP/RPC attribute standards to avoid dropping critical failure telemetry during cost-optimization passes.","antiPatternHeadline":"Blind head-based probabilistic sampling dropping rare production anomalies and violating v1.28 semantic conventions","stars_count":49,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","observability","distributed-tracing","tail-sampling","collector"],"exportEndpoints":{"claude":"/api/rules/otel-v1-28-tail-based-adaptive-sampling?format=claude","cursorMdc":"/api/rules/otel-v1-28-tail-based-adaptive-sampling?format=mdc","cursorrules":"/api/rules/otel-v1-28-tail-based-adaptive-sampling?format=cursor","windsurf":"/api/rules/otel-v1-28-tail-based-adaptive-sampling?format=windsurf","agents":"/api/rules/otel-v1-28-tail-based-adaptive-sampling?format=agents"}},{"id":"react-19-useactionstate-optimistic-mutation-boundary","title":"React 19 useActionState & useOptimistic Mutation Boundary & Concurrent Rollback Guardrail","category":"frontend","severity":"critical","description":"Enforces strict mutation boundaries and transition scopes when pairing React 19 useActionState and useOptimistic. Prevents state tearing, unbounded memory retention, and stale closure race conditions during concurrent server-action dispatches in high-throughput enterprise applications.","antiPatternHeadline":"Mutating optimistic state outside active Transitions or maintaining synchronized state via effects leading to memory leaks and broken rollback semantics.","stars_count":45,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","useActionState","useOptimistic","concurrency","state-management"],"exportEndpoints":{"claude":"/api/rules/react-19-useactionstate-optimistic-mutation-boundary?format=claude","cursorMdc":"/api/rules/react-19-useactionstate-optimistic-mutation-boundary?format=mdc","cursorrules":"/api/rules/react-19-useactionstate-optimistic-mutation-boundary?format=cursor","windsurf":"/api/rules/react-19-useactionstate-optimistic-mutation-boundary?format=windsurf","agents":"/api/rules/react-19-useactionstate-optimistic-mutation-boundary?format=agents"}},{"id":"svelte-5-runes-reactive-proxy-isolation","title":"Svelte 5 Runes Fine-Grained Reactive Proxy Isolation and Boundary Enforcement","category":"frontend","severity":"critical","description":"Enforces strict boundary encapsulation for Svelte 5 reactive proxies created by $state() in complex, state-driven dashboards. Eliminates cross-component mutable proxy leaks, unbounded deep dependency graph traversal in effects, and memory leaks by mandating $state.raw(), $state.snapshot(), and encapsulated domain stores.","antiPatternHeadline":"Uncontained Cross-Component Reactive Proxy Passing and Deep Effect Signal Pollution","stars_count":105,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["svelte","svelte-5","runes","reactive-proxy","state-management","dashboard-architecture"],"exportEndpoints":{"claude":"/api/rules/svelte-5-runes-reactive-proxy-isolation?format=claude","cursorMdc":"/api/rules/svelte-5-runes-reactive-proxy-isolation?format=mdc","cursorrules":"/api/rules/svelte-5-runes-reactive-proxy-isolation?format=cursor","windsurf":"/api/rules/svelte-5-runes-reactive-proxy-isolation?format=windsurf","agents":"/api/rules/svelte-5-runes-reactive-proxy-isolation?format=agents"}},{"id":"pg17-memory-budgeting-worker-scaling-guardrail","title":"PostgreSQL 17 Memory Budgeting & Dynamic Worker Guardrail","category":"backend","severity":"critical","description":"Enforces deterministic work_mem allocation, dynamic shared memory (DSM) ceiling bounds, and capped parallel query worker execution paths in PostgreSQL 17. Eliminates container OOM kills triggered by unconstrained concurrent sorts, hash tables, and parallel partitioned index scans across multi-tenant workloads.","antiPatternHeadline":"Global Uncapped work_mem and Unbounded Parallel Worker Fan-Out Inducing Linux OOM Kills","stars_count":62,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","memory-management","database-performance","multi-tenant"],"exportEndpoints":{"claude":"/api/rules/pg17-memory-budgeting-worker-scaling-guardrail?format=claude","cursorMdc":"/api/rules/pg17-memory-budgeting-worker-scaling-guardrail?format=mdc","cursorrules":"/api/rules/pg17-memory-budgeting-worker-scaling-guardrail?format=cursor","windsurf":"/api/rules/pg17-memory-budgeting-worker-scaling-guardrail?format=windsurf","agents":"/api/rules/pg17-memory-budgeting-worker-scaling-guardrail?format=agents"}},{"id":"go-chi-context-lifecycle-goroutine-leak-prevention","title":"Go Chi Context Propagation & Deterministic Goroutine Lifecycle Invariant","category":"backend","severity":"critical","description":"Enforces strict context-tree inheritance and bounded goroutine lifecycles within Go Chi HTTP handlers. Eliminates unbounded goroutine accumulation and orphaned I/O operations caused by abrupt HTTP/3 client stream cancellations (QUIC RESET_STREAM) and connection drops under peak load.","antiPatternHeadline":"Spawning detached, unbounded goroutines or ignoring request context cancellation during client disconnect spikes","stars_count":56,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","chi","concurrency","goroutines","http3","context"],"exportEndpoints":{"claude":"/api/rules/go-chi-context-lifecycle-goroutine-leak-prevention?format=claude","cursorMdc":"/api/rules/go-chi-context-lifecycle-goroutine-leak-prevention?format=mdc","cursorrules":"/api/rules/go-chi-context-lifecycle-goroutine-leak-prevention?format=cursor","windsurf":"/api/rules/go-chi-context-lifecycle-goroutine-leak-prevention?format=windsurf","agents":"/api/rules/go-chi-context-lifecycle-goroutine-leak-prevention?format=agents"}},{"id":"fastapi-pydantic-v2-compiled-schema-validation-standard","title":"FastAPI & Pydantic v2 Compiled Schema Validation and Zero-Allocation Serialization Standard","category":"backend","severity":"critical","description":"Enforces strict Pydantic v2 TypeAdapter and SchemaSerializer compilation patterns in FastAPI endpoints to eliminate Python runtime reflection overhead. Eliminates silent data corruption caused by permissive type coercion and replaces naive jsonable_encoder serialization with compiled Rust-backed pydantic-core zero-allocation byte streams.","antiPatternHeadline":"Uncompiled Model Instantiation and Permissive Type Coercion in High-Throughput FastAPI Pipelines","stars_count":113,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","pydantic-v2","serialization","performance","rust-core"],"exportEndpoints":{"claude":"/api/rules/fastapi-pydantic-v2-compiled-schema-validation-standard?format=claude","cursorMdc":"/api/rules/fastapi-pydantic-v2-compiled-schema-validation-standard?format=mdc","cursorrules":"/api/rules/fastapi-pydantic-v2-compiled-schema-validation-standard?format=cursor","windsurf":"/api/rules/fastapi-pydantic-v2-compiled-schema-validation-standard?format=windsurf","agents":"/api/rules/fastapi-pydantic-v2-compiled-schema-validation-standard?format=agents"}},{"id":"capacitor-7-biometric-hardware-key-isolation-standard","title":"Capacitor 7 Hardware-Backed Biometric Key Isolation Standard","category":"mobile","severity":"critical","description":"Enforces asymmetric challenge-response authentication anchored in native Secure Enclave and Android KeyStore primitives to eliminate WebView bridge token sniffing. Mandates that cryptographic private keys and long-lived session secrets never enter JavaScript memory or standard persistent storage, restricting bridge communication strictly to ephemeral nonces and hardware-signed cryptographic assertions.","antiPatternHeadline":"Persisting Raw Bearer Tokens in JavaScript Storage and Relying on Boolean Biometric Checks","stars_count":58,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","security","biometrics","secure-enclave","keystore"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-biometric-hardware-key-isolation-standard?format=claude","cursorMdc":"/api/rules/capacitor-7-biometric-hardware-key-isolation-standard?format=mdc","cursorrules":"/api/rules/capacitor-7-biometric-hardware-key-isolation-standard?format=cursor","windsurf":"/api/rules/capacitor-7-biometric-hardware-key-isolation-standard?format=windsurf","agents":"/api/rules/capacitor-7-biometric-hardware-key-isolation-standard?format=agents"}},{"id":"openfga-rebac-depth-cycle-guardrail","title":"OpenFGA Graph Traversal Depth and Cyclic Relationship Defense Guardrail","category":"security","severity":"critical","description":"Enforces deterministic graph evaluation limits, cycle prevention invariants, and context-bound authorization checks within OpenFGA ReBAC implementations. Eliminates denial-of-service via nested relationship loops and prevents privilege escalation caused by unbounded transitive resolutions in multi-tenant architectures. Mandates explicit graph depth constraints, tuple write DAG validation, and fail-closed fallback mechanisms.","antiPatternHeadline":"Unbounded Self-Referential Hierarchy Traversal and Missing DAG Validation Causing Authorization DoS and Resolution Bypass","stars_count":86,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","rebac","graph-depth","cycle-prevention","multi-tenant"],"exportEndpoints":{"claude":"/api/rules/openfga-rebac-depth-cycle-guardrail?format=claude","cursorMdc":"/api/rules/openfga-rebac-depth-cycle-guardrail?format=mdc","cursorrules":"/api/rules/openfga-rebac-depth-cycle-guardrail?format=cursor","windsurf":"/api/rules/openfga-rebac-depth-cycle-guardrail?format=windsurf","agents":"/api/rules/openfga-rebac-depth-cycle-guardrail?format=agents"}},{"id":"webauthn-dual-attestation-synced-credentials","title":"WebAuthn Dual-Attestation Origin Binding and Replay Prevention Standard","category":"security","severity":"critical","description":"Mandates strict canonical RP origin binding, atomic challenge consumption, and multi-device synced credential flags verification (UP/UV/BE/BS) for WebAuthn passkey authentication. Enforces zero-trust cryptographic validation across multi-device enterprise cloud synchronizations to eliminate challenge replay attacks and origin spoofing.","antiPatternHeadline":"Accepting Unpinned Origins, Client-Provided Nonces, or Unverified Synced Credential Backup States","stars_count":60,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","fido2","passkeys","cryptography","attestation"],"exportEndpoints":{"claude":"/api/rules/webauthn-dual-attestation-synced-credentials?format=claude","cursorMdc":"/api/rules/webauthn-dual-attestation-synced-credentials?format=mdc","cursorrules":"/api/rules/webauthn-dual-attestation-synced-credentials?format=cursor","windsurf":"/api/rules/webauthn-dual-attestation-synced-credentials?format=windsurf","agents":"/api/rules/webauthn-dual-attestation-synced-credentials?format=agents"}},{"id":"tetragon-ebpf-syscall-enforcement-guardrail","title":"Cilium Tetragon eBPF Kernel-Space Syscall Threat Mitigation and Kill Enforcement","category":"devops","severity":"critical","description":"Mandates strict in-kernel eBPF syscall enforcement and synchronous termination using Cilium Tetragon TracingPolicies. Forbids passive, asynchronous user-space-only audit policies for high-severity container breakouts, privilege escalations, and unauthorized raw socket creation by enforcing immediate Sigkill actions directly inside the Linux kernel.","antiPatternHeadline":"Deploying Asynchronous Audit-Only eBPF Tracing Policies for High-Risk Kernel Escapes and Raw Socket Creation","stars_count":53,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","tetragon","kubernetes","security","zero-trust"],"exportEndpoints":{"claude":"/api/rules/tetragon-ebpf-syscall-enforcement-guardrail?format=claude","cursorMdc":"/api/rules/tetragon-ebpf-syscall-enforcement-guardrail?format=mdc","cursorrules":"/api/rules/tetragon-ebpf-syscall-enforcement-guardrail?format=cursor","windsurf":"/api/rules/tetragon-ebpf-syscall-enforcement-guardrail?format=windsurf","agents":"/api/rules/tetragon-ebpf-syscall-enforcement-guardrail?format=agents"}},{"id":"opentelemetry-profiling-exemplar-correlation-standard","title":"OpenTelemetry Continuous Profiling & Trace Exemplar Correlation Standard","category":"devops","severity":"critical","description":"Enforces strict bi-directional correlation between continuous CPU/memory profile samples (pprof/OTel profiling signal) and active OpenTelemetry distributed trace spans using span-context labels. Guarantees zero-overhead trace exemplar binding and precise call-tree attribution down to microsecond-level latency regressions across distributed services.","antiPatternHeadline":"Decoupled Wall-Clock Profilers and Uncorrelated Span Context Leading to Orphaned Call Stacks","stars_count":103,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","continuous-profiling","tracing","exemplars","pprof","observability"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-profiling-exemplar-correlation-standard?format=claude","cursorMdc":"/api/rules/opentelemetry-profiling-exemplar-correlation-standard?format=mdc","cursorrules":"/api/rules/opentelemetry-profiling-exemplar-correlation-standard?format=cursor","windsurf":"/api/rules/opentelemetry-profiling-exemplar-correlation-standard?format=windsurf","agents":"/api/rules/opentelemetry-profiling-exemplar-correlation-standard?format=agents"}},{"id":"next15-ppr-dynamic-boundary-isolation","title":"Next.js 15 PPR: Strict Boundary Isolation for Static Shells and Dynamic Streams","category":"frontend","severity":"critical","description":"Next.js 15 Partial Prerendering (PPR) mandates an impermeable architectural boundary between build-time static shells and runtime dynamic micro-streams. Accessing dynamic context—such as cookies(), headers(), dynamic route parameters, or uncached data queries—outside an explicit React Suspense boundary invalidates the static shell, degrading the route to fully dynamic server-side rendering and blocking initial Time to First Byte (TTFB). All dynamic operations must be strictly encapsulated into leaf Server Components wrapped in Suspense boundaries with deterministic fallbacks.","antiPatternHeadline":"Leaking Dynamic API Invocations to Page or Layout Roots Outside Suspense Boundaries","stars_count":77,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs","react19","ppr","performance","streaming"],"exportEndpoints":{"claude":"/api/rules/next15-ppr-dynamic-boundary-isolation?format=claude","cursorMdc":"/api/rules/next15-ppr-dynamic-boundary-isolation?format=mdc","cursorrules":"/api/rules/next15-ppr-dynamic-boundary-isolation?format=cursor","windsurf":"/api/rules/next15-ppr-dynamic-boundary-isolation?format=windsurf","agents":"/api/rules/next15-ppr-dynamic-boundary-isolation?format=agents"}},{"id":"rust-axum-zero-copy-streaming-guardrail","title":"Axum 0.8 Extractor-Driven Zero-Copy Multipart Streaming Invariants","category":"backend","severity":"critical","description":"Enforces strict zero-copy streaming invariants for high-throughput multipart ingestion in Rust Axum 0.8 services. Prohibits in-memory payload aggregation into vectors or intermediate buffers, mandating chunk-level direct piping to sinks via tokio_util and bounded backpressure extractors. Guarantees predictable, sub-megabyte resident set size (RSS) per connection during concurrent multi-gigabit payload transfers.","antiPatternHeadline":"Heap Buffer Accumulation via In-Memory Ingestion of Multipart Payloads (e.g., field.bytes().await or Vec<u8> Aggregation)","stars_count":106,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","streaming","zero-copy","tokio","memory-optimization"],"exportEndpoints":{"claude":"/api/rules/rust-axum-zero-copy-streaming-guardrail?format=claude","cursorMdc":"/api/rules/rust-axum-zero-copy-streaming-guardrail?format=mdc","cursorrules":"/api/rules/rust-axum-zero-copy-streaming-guardrail?format=cursor","windsurf":"/api/rules/rust-axum-zero-copy-streaming-guardrail?format=windsurf","agents":"/api/rules/rust-axum-zero-copy-streaming-guardrail?format=agents"}},{"id":"postgres-17-failover-replication-slots-cdc-integrity","title":"Postgres 17 Failover Replication Slots & Idempotent CDC Outbox Continuity","category":"backend","severity":"critical","description":"Enforces Postgres 17 failover-enabled logical replication slots and physical standby synchronization barriers for Transactional Outbox CDC pipelines. Prevents silent WAL truncation, event drops, and replay storms during primary failover and standby promotion by guaranteeing slot persistence across timeline switches.","antiPatternHeadline":"Creating un-synchronized legacy logical replication slots without failover flags and running un-hedged CDC tailing vulnerable to standby promotion data loss.","stars_count":43,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres-17","cdc","logical-replication","transactional-outbox","high-availability"],"exportEndpoints":{"claude":"/api/rules/postgres-17-failover-replication-slots-cdc-integrity?format=claude","cursorMdc":"/api/rules/postgres-17-failover-replication-slots-cdc-integrity?format=mdc","cursorrules":"/api/rules/postgres-17-failover-replication-slots-cdc-integrity?format=cursor","windsurf":"/api/rules/postgres-17-failover-replication-slots-cdc-integrity?format=windsurf","agents":"/api/rules/postgres-17-failover-replication-slots-cdc-integrity?format=agents"}},{"id":"bun-isolated-native-worker-pool-standard","title":"Bun 1.2 Isolated Native Worker Thread Topologies for Multi-Tenant Workloads","category":"backend","severity":"critical","description":"Enforces bounded, zero-copy native Worker thread pools in Bun 1.2 to isolate CPU-intensive multi-tenant execution. Mitigates JavaScriptCore (JSC) heap fragmentation, thread starvation, and event-loop blocking by requiring deterministic lifecycle management and Transferable Object ownership transfer.","antiPatternHeadline":"Ad-Hoc Worker Spawning with Deep-Cloned Payloads and Unbounded Lifecycles","stars_count":41,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","web-workers","multi-tenancy","performance","memory-management"],"exportEndpoints":{"claude":"/api/rules/bun-isolated-native-worker-pool-standard?format=claude","cursorMdc":"/api/rules/bun-isolated-native-worker-pool-standard?format=mdc","cursorrules":"/api/rules/bun-isolated-native-worker-pool-standard?format=cursor","windsurf":"/api/rules/bun-isolated-native-worker-pool-standard?format=windsurf","agents":"/api/rules/bun-isolated-native-worker-pool-standard?format=agents"}},{"id":"openfga-contextual-tuples-rebac-guardrail","title":"OpenFGA Ephemeral Contextual Tuples and Deterministic Batch Resolution Standard","category":"security","severity":"critical","description":"Mandates the utilization of in-flight contextual tuples for ephemeral authorization states and prohibits persisting transient access claims to the central OpenFGA store. Enforces deterministic sub-millisecond check latency by eliminating distributed N+1 graph traversal loops and mitigating privilege escalation through server-verified contextual facts.","antiPatternHeadline":"Persisting Transient Claims to Persistent Storage and Executing Iterative N+1 Check Traversal Loops","stars_count":45,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","rebac","authorization","zero-trust"],"exportEndpoints":{"claude":"/api/rules/openfga-contextual-tuples-rebac-guardrail?format=claude","cursorMdc":"/api/rules/openfga-contextual-tuples-rebac-guardrail?format=mdc","cursorrules":"/api/rules/openfga-contextual-tuples-rebac-guardrail?format=cursor","windsurf":"/api/rules/openfga-contextual-tuples-rebac-guardrail?format=windsurf","agents":"/api/rules/openfga-contextual-tuples-rebac-guardrail?format=agents"}},{"id":"webauthn-conditional-ui-origin-pinning","title":"Passkey WebAuthn Conditional UI with Origin Cryptographic Pinning","category":"security","severity":"critical","description":"Enforces strict implementation standards for WebAuthn Conditional UI (autofill) authentication and robust server-side cryptographic origin verification. Guarantees protection against reverse-proxy phishing and origin-spoofing attacks by pinning expected client origins and RP IDs against signed authenticator assertions.","antiPatternHeadline":"Trusting Client-Supplied Origin Headers or Omitting Conditional Mediation Checks in WebAuthn Workflows","stars_count":49,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","fido2","passkeys","authentication","cryptography"],"exportEndpoints":{"claude":"/api/rules/webauthn-conditional-ui-origin-pinning?format=claude","cursorMdc":"/api/rules/webauthn-conditional-ui-origin-pinning?format=mdc","cursorrules":"/api/rules/webauthn-conditional-ui-origin-pinning?format=cursor","windsurf":"/api/rules/webauthn-conditional-ui-origin-pinning?format=windsurf","agents":"/api/rules/webauthn-conditional-ui-origin-pinning?format=agents"}},{"id":"cilium-tetragon-kernel-enforcement-standard","title":"Cilium Tetragon In-Kernel Runtime Enforcement and Namespace Escape Prevention","category":"devops","severity":"critical","description":"Enforces sub-microsecond in-kernel detection and synchronous termination (SIGKILL) of unauthorized namespace escapes, privilege escalations, and binary executions using Cilium Tetragon TracingPolicies. Mandates deterministic matchArgs, matchBinaries, and synchronous SIGKILL actions within the eBPF hook rather than user-space post-facto audit logging.","antiPatternHeadline":"Passive User-Space Audit Logging for Kernel Exploits and Namespace Escapes","stars_count":111,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","cilium","tetragon","ebpf","security","kubernetes","runtime-security"],"exportEndpoints":{"claude":"/api/rules/cilium-tetragon-kernel-enforcement-standard?format=claude","cursorMdc":"/api/rules/cilium-tetragon-kernel-enforcement-standard?format=mdc","cursorrules":"/api/rules/cilium-tetragon-kernel-enforcement-standard?format=cursor","windsurf":"/api/rules/cilium-tetragon-kernel-enforcement-standard?format=windsurf","agents":"/api/rules/cilium-tetragon-kernel-enforcement-standard?format=agents"}},{"id":"opentelemetry-1-30-dynamic-tail-sampling","title":"OpenTelemetry 1.30+ SemConv Dynamic Tail-Sampling and Trace Preservation","category":"devops","severity":"critical","description":"Enforces strict OpenTelemetry Semantic Conventions 1.30+ attribute naming and multi-rule dynamic tail-sampling architectures. Guarantees 100% capture of spans with uncaught exceptions, error HTTP status codes, and P99.9 latency spikes while reducing distributed tracing ingestion costs by over 80%.","antiPatternHeadline":"Head-based uniform sampling paired with legacy SemConv attributes causing catastrophic observability blindspots.","stars_count":92,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","tail-sampling","tracing","observability","site-reliability"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-1-30-dynamic-tail-sampling?format=claude","cursorMdc":"/api/rules/opentelemetry-1-30-dynamic-tail-sampling?format=mdc","cursorrules":"/api/rules/opentelemetry-1-30-dynamic-tail-sampling?format=cursor","windsurf":"/api/rules/opentelemetry-1-30-dynamic-tail-sampling?format=windsurf","agents":"/api/rules/opentelemetry-1-30-dynamic-tail-sampling?format=agents"}},{"id":"tauri-v2-ipc-capability-scopes-mobile-standard","title":"Tauri 2.0 IPC Capability Scopes and Least-Privilege Webview Isolation","category":"mobile","severity":"critical","description":"Enforces Tauri 2.0 least-privilege capability manifests and strict IPC permission scoping across desktop and mobile WebViews. Prevents arbitrary file system access, unauthorized native API execution, and cross-origin privilege escalation by binding permissions to explicit window labels and path scopes.","antiPatternHeadline":"Unconstrained Capability Wildcards and Global Plugin Permissions in Tauri WebViews","stars_count":96,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri-2","security","ipc","rust","capabilities"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-ipc-capability-scopes-mobile-standard?format=claude","cursorMdc":"/api/rules/tauri-v2-ipc-capability-scopes-mobile-standard?format=mdc","cursorrules":"/api/rules/tauri-v2-ipc-capability-scopes-mobile-standard?format=cursor","windsurf":"/api/rules/tauri-v2-ipc-capability-scopes-mobile-standard?format=windsurf","agents":"/api/rules/tauri-v2-ipc-capability-scopes-mobile-standard?format=agents"}},{"id":"react-19-server-action-taint-boundary-protection","title":"Enforce React 19 Taint Boundaries for Server Actions and Client Tree Props","category":"frontend","severity":"critical","description":"Mandates compile-time isolation and runtime taint protections using React 19 taint APIs (experimental_taintObjectReference, experimental_taintUniqueValue) across Server Component boundaries and Server Action responses. Prohibits passing raw database records, sensitive environment variables, or cryptographically private tokens to Client Components.","antiPatternHeadline":"Returning Raw ORM Entities or Unsanitized Secrets from Server Actions Across the RSC Client Serialization Boundary","stars_count":106,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","server-actions","security","taint-api","rsc","nextjs"],"exportEndpoints":{"claude":"/api/rules/react-19-server-action-taint-boundary-protection?format=claude","cursorMdc":"/api/rules/react-19-server-action-taint-boundary-protection?format=mdc","cursorrules":"/api/rules/react-19-server-action-taint-boundary-protection?format=cursor","windsurf":"/api/rules/react-19-server-action-taint-boundary-protection?format=windsurf","agents":"/api/rules/react-19-server-action-taint-boundary-protection?format=agents"}},{"id":"svelte-5-universal-runes-ssr-memory-isolation","title":"Svelte 5 Universal Runes SSR Isolation and Memory Leak Prevention","category":"frontend","severity":"critical","description":"Enforces strict request-scoped lifecycle boundaries on Svelte 5 universal reactive runes ($state, $derived) within .svelte.ts modules. Prohibits module-level reactive singletons and unmanaged $effect.root allocations that persist across concurrent SSR requests and cause multi-tenant cross-contamination or memory exhaustion.","antiPatternHeadline":"Module-scoped universal runes persisting across concurrent SSR requests, causing data cross-contamination and heap leaks.","stars_count":104,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","ssr","memory-isolation","multi-tenancy"],"exportEndpoints":{"claude":"/api/rules/svelte-5-universal-runes-ssr-memory-isolation?format=claude","cursorMdc":"/api/rules/svelte-5-universal-runes-ssr-memory-isolation?format=mdc","cursorrules":"/api/rules/svelte-5-universal-runes-ssr-memory-isolation?format=cursor","windsurf":"/api/rules/svelte-5-universal-runes-ssr-memory-isolation?format=windsurf","agents":"/api/rules/svelte-5-universal-runes-ssr-memory-isolation?format=agents"}},{"id":"vite-6-environment-api-runtime-module-isolation","title":"Vite 6 Environment API Runtime Module Isolation and Cross-Graph Leakage Prevention","category":"frontend","severity":"critical","description":"Mandates strict environment boundary isolation in Vite 6 multi-runtime module graphs (Browser, Node.js, and workerd). Enforces environment-scoped plugin hooks, explicit resolution conditions, and runtime boundary guards to eliminate cross-environment module pollution and hydration failures.","antiPatternHeadline":"Leaking runtime-specific singletons, un-scoped plugin transforms, and incompatible native APIs across shared Vite 6 Environment graphs.","stars_count":109,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","vite","vite-6","environment-api","workerd","ssr","module-isolation"],"exportEndpoints":{"claude":"/api/rules/vite-6-environment-api-runtime-module-isolation?format=claude","cursorMdc":"/api/rules/vite-6-environment-api-runtime-module-isolation?format=mdc","cursorrules":"/api/rules/vite-6-environment-api-runtime-module-isolation?format=cursor","windsurf":"/api/rules/vite-6-environment-api-runtime-module-isolation?format=windsurf","agents":"/api/rules/vite-6-environment-api-runtime-module-isolation?format=agents"}},{"id":"postgres-17-failover-slot-synchronization-invariants","title":"Postgres 17 Logical Replication Failover Slot Synchronization & Zero-Loss CDC Guarantees","category":"backend","severity":"critical","description":"Enforces failover-enabled logical replication slots and synchronized standby invariants in Postgres 17+ to guarantee zero-data-loss Change Data Capture (CDC) during physical standby promotion. Mandates explicit failover slot registration, physical standby alignment via synchronized_standby_slots, and verified slot sync states during failover cutovers.","antiPatternHeadline":"Creating unflagged logical replication slots and dropping/recreating slots across node promotions, inducing silent CDC data loss.","stars_count":85,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres","cdc","replication","high-availability","distributed-systems"],"exportEndpoints":{"claude":"/api/rules/postgres-17-failover-slot-synchronization-invariants?format=claude","cursorMdc":"/api/rules/postgres-17-failover-slot-synchronization-invariants?format=mdc","cursorrules":"/api/rules/postgres-17-failover-slot-synchronization-invariants?format=cursor","windsurf":"/api/rules/postgres-17-failover-slot-synchronization-invariants?format=windsurf","agents":"/api/rules/postgres-17-failover-slot-synchronization-invariants?format=agents"}},{"id":"bun-worker-zero-copy-transfer-boundaries","title":"Bun 1.2 Clustered Worker Zero-Copy Transfer and Ownership Boundary Standards","category":"backend","severity":"critical","description":"Enforces strict memory ownership semantics and explicit zero-copy transfer lists when passing binary payloads across Bun 1.2 worker pools. Disallows implicit structured cloning of large TypedArrays and prevents use-after-transfer race conditions on detached ArrayBuffers.","antiPatternHeadline":"Implicit Structured Clone Memory Duplication and Post-Transfer Access on Detached Buffers","stars_count":70,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","workers","zero-copy","concurrency","performance"],"exportEndpoints":{"claude":"/api/rules/bun-worker-zero-copy-transfer-boundaries?format=claude","cursorMdc":"/api/rules/bun-worker-zero-copy-transfer-boundaries?format=mdc","cursorrules":"/api/rules/bun-worker-zero-copy-transfer-boundaries?format=cursor","windsurf":"/api/rules/bun-worker-zero-copy-transfer-boundaries?format=windsurf","agents":"/api/rules/bun-worker-zero-copy-transfer-boundaries?format=agents"}},{"id":"kmp-structured-concurrency-swift-bridge","title":"KMP Structured Concurrency & Swift async/await Bridge Guardrail","category":"mobile","severity":"critical","description":"Enforces strict bi-directional cancellation propagation and thread safety when bridging Kotlin Coroutines with Swift async/await primitives. Eliminates dangling coroutine executions, thread pool starvation, and unhandled CancellationException crashes across the Kotlin/Native Objective-C runtime boundary.","antiPatternHeadline":"Unbound Coroutine Invocation via Detached Swift Tasks Causing Thread Leaks","stars_count":96,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","swift","coroutines","structured-concurrency","ios"],"exportEndpoints":{"claude":"/api/rules/kmp-structured-concurrency-swift-bridge?format=claude","cursorMdc":"/api/rules/kmp-structured-concurrency-swift-bridge?format=mdc","cursorrules":"/api/rules/kmp-structured-concurrency-swift-bridge?format=cursor","windsurf":"/api/rules/kmp-structured-concurrency-swift-bridge?format=windsurf","agents":"/api/rules/kmp-structured-concurrency-swift-bridge?format=agents"}},{"id":"tauri-v2-mobile-ipc-capability-scoping-guardrail","title":"Tauri 2.0 Mobile IPC Capability Scoping & Webview Origin Isolation","category":"mobile","severity":"critical","description":"Enforce zero-trust IPC isolation in Tauri 2.0 mobile applications by cryptographically constraining native plugin access to explicitly defined webview origins through capability manifests. Unrestricted wildcards in permissions, missing origin bindings, or global plugin invocations introduce arbitrary code execution vectors on iOS and Android targets.","antiPatternHeadline":"Wildcard Capability Manifests Allowing Arbitrary Native OS Plugin Execution Across Untrusted Mobile Webview Origins","stars_count":90,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri-2","ipc-security","capabilities","origin-isolation","rust"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-mobile-ipc-capability-scoping-guardrail?format=claude","cursorMdc":"/api/rules/tauri-v2-mobile-ipc-capability-scoping-guardrail?format=mdc","cursorrules":"/api/rules/tauri-v2-mobile-ipc-capability-scoping-guardrail?format=cursor","windsurf":"/api/rules/tauri-v2-mobile-ipc-capability-scoping-guardrail?format=windsurf","agents":"/api/rules/tauri-v2-mobile-ipc-capability-scoping-guardrail?format=agents"}},{"id":"webauthn-prf-zk-key-derivation-security","title":"Zero-Knowledge Hardware Key Derivation via WebAuthn PRF Extension","category":"security","severity":"critical","description":"Enforces cryptographic and memory-safety invariants for client-side encryption key derivation using the WebAuthn PRF (Pseudo-Random Function) extension. Ensures authenticators derive zero-knowledge symmetric keys without persisting raw seeds, PRF outputs, or master keys to client storage, and mandates HKDF-SHA256 expansion with domain separation.","antiPatternHeadline":"Persisting Derived PRF Secrets in Web Storage or Using Raw PRF Outputs Directly Without HKDF Domain Separation","stars_count":76,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","prf-extension","zero-knowledge","cryptography","passkeys"],"exportEndpoints":{"claude":"/api/rules/webauthn-prf-zk-key-derivation-security?format=claude","cursorMdc":"/api/rules/webauthn-prf-zk-key-derivation-security?format=mdc","cursorrules":"/api/rules/webauthn-prf-zk-key-derivation-security?format=cursor","windsurf":"/api/rules/webauthn-prf-zk-key-derivation-security?format=windsurf","agents":"/api/rules/webauthn-prf-zk-key-derivation-security?format=agents"}},{"id":"ebpf-tetragon-syscall-sandbox-enforcement","title":"In-Kernel Container Escape Prevention via Tetragon Syscall Interception","category":"security","severity":"critical","description":"Mandates in-kernel synchronous enforcement of container isolation boundaries using Tetragon TracingPolicies. Prevents container runtime escape vectors—such as unauthorized namespace switching (setns), filesystem remounting, and kernel module/BPF injection—by executing kernel-level signal termination (Sigkill) before syscall completion rather than relying on user-space telemetry or post-facto alerting.","antiPatternHeadline":"Relying on Passive Asynchronous Audit Logging for Namespace Switching Syscalls Without In-Kernel Sigkill Action","stars_count":106,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","ebpf","tetragon","kubernetes","container-security","zero-trust","syscalls"],"exportEndpoints":{"claude":"/api/rules/ebpf-tetragon-syscall-sandbox-enforcement?format=claude","cursorMdc":"/api/rules/ebpf-tetragon-syscall-sandbox-enforcement?format=mdc","cursorrules":"/api/rules/ebpf-tetragon-syscall-sandbox-enforcement?format=cursor","windsurf":"/api/rules/ebpf-tetragon-syscall-sandbox-enforcement?format=windsurf","agents":"/api/rules/ebpf-tetragon-syscall-sandbox-enforcement?format=agents"}},{"id":"otel-w3c-baggage-sanitization-exemplar-binding","title":"Deterministic W3C Baggage Sanitization and Metric Exemplar Binding Standard","category":"devops","severity":"critical","description":"Enforces strict allowlisting, size caps, and redaction on incoming/outgoing W3C Baggage headers while preventing metric cardinality explosion. Ensures high-cardinality contextual attributes propagated via Baggage are bound strictly to Metric Exemplars rather than converted into metric dimensions.","antiPatternHeadline":"Unbounded Baggage Header Propagation and Ingress Baggage-to-Metric Dimension Leakage","stars_count":76,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","observability","distributed-tracing","w3c-baggage","metrics"],"exportEndpoints":{"claude":"/api/rules/otel-w3c-baggage-sanitization-exemplar-binding?format=claude","cursorMdc":"/api/rules/otel-w3c-baggage-sanitization-exemplar-binding?format=mdc","cursorrules":"/api/rules/otel-w3c-baggage-sanitization-exemplar-binding?format=cursor","windsurf":"/api/rules/otel-w3c-baggage-sanitization-exemplar-binding?format=windsurf","agents":"/api/rules/otel-w3c-baggage-sanitization-exemplar-binding?format=agents"}},{"id":"react-19-server-action-origin-crypto-binding","title":"React 19 Server Action Cryptographic Binding and Strict Origin Verification","category":"frontend","severity":"critical","description":"Enforces strict origin validation and cryptographically signed server closures across React 19 Server Actions. Eliminates unauthorized direct RPC invocation and CSRF mutations by mandating same-origin verification, session-derived state over mutable client arguments, and tamper-proof closure binding.","antiPatternHeadline":"Exposing Unauthenticated Direct RPC Endpoints via Unbounded Server Actions and Missing Origin Checks","stars_count":67,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react19","server-actions","csrf","app-router","security"],"exportEndpoints":{"claude":"/api/rules/react-19-server-action-origin-crypto-binding?format=claude","cursorMdc":"/api/rules/react-19-server-action-origin-crypto-binding?format=mdc","cursorrules":"/api/rules/react-19-server-action-origin-crypto-binding?format=cursor","windsurf":"/api/rules/react-19-server-action-origin-crypto-binding?format=windsurf","agents":"/api/rules/react-19-server-action-origin-crypto-binding?format=agents"}},{"id":"nextjs15-ppr-taint-boundary-isolation","title":"Next.js 15 PPR Dynamic Taint Boundary and Secret Isolation Guardrail","category":"frontend","severity":"critical","description":"Enforces strict runtime isolation between statically prerendered PPR shells and dynamic server execution contexts in Next.js 15. Mandates the use of React Server Component taint APIs (`experimental_taintObjectReference`, `experimental_taintUniqueValue`) and explicit Suspense dynamic boundaries to prevent auth credentials, tenant contexts, and server secrets from leaking into client bundles or static build caches.","antiPatternHeadline":"Baking dynamic runtime credentials or untainted tenant sessions into prerendered static streaming shells","stars_count":90,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs15","react-server-components","ppr","taint-analysis","security"],"exportEndpoints":{"claude":"/api/rules/nextjs15-ppr-taint-boundary-isolation?format=claude","cursorMdc":"/api/rules/nextjs15-ppr-taint-boundary-isolation?format=mdc","cursorrules":"/api/rules/nextjs15-ppr-taint-boundary-isolation?format=cursor","windsurf":"/api/rules/nextjs15-ppr-taint-boundary-isolation?format=windsurf","agents":"/api/rules/nextjs15-ppr-taint-boundary-isolation?format=agents"}},{"id":"axum-tokio-cancellation-token-lifecycle-scoping","title":"Axum 0.8 Tokio CancellationToken Distributed Lifecycle Scoping","category":"backend","severity":"critical","description":"Mandates explicit, hierarchical cancellation trees using Tokio CancellationToken across Axum 0.8 request pipelines. Enforces deterministic cancellation propagation through database transactions, external HTTP calls, and background workers upon client disconnection or SIGTERM pod termination.","antiPatternHeadline":"Detached Spawning and Unscoped Async Pipelines Leaking DB Pool Connections on HTTP Aborts","stars_count":50,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tokio","concurrency","cancellation-token","lifecycle"],"exportEndpoints":{"claude":"/api/rules/axum-tokio-cancellation-token-lifecycle-scoping?format=claude","cursorMdc":"/api/rules/axum-tokio-cancellation-token-lifecycle-scoping?format=mdc","cursorrules":"/api/rules/axum-tokio-cancellation-token-lifecycle-scoping?format=cursor","windsurf":"/api/rules/axum-tokio-cancellation-token-lifecycle-scoping?format=windsurf","agents":"/api/rules/axum-tokio-cancellation-token-lifecycle-scoping?format=agents"}},{"id":"fastapi-sse-client-disconnect-backpressure","title":"FastAPI Async Generator SSE Disconnect Detection and Upstream Backpressure Invariant","category":"backend","severity":"critical","description":"Requires all FastAPI Server-Sent Events (SSE) and StreamingResponse async generators to actively poll ASGI disconnect state via `request.is_disconnected()` or monitor underlying transport signals. Failing to detect disconnects causes orphaned upstream database/API subscriptions, memory leaks, and worker event-loop starvation when clients drop connections midway.","antiPatternHeadline":"Orphaned Infinite Async Generators Consuming Upstream Streams After Client HTTP Disconnection","stars_count":44,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","sse","asyncio","backpressure","asgi"],"exportEndpoints":{"claude":"/api/rules/fastapi-sse-client-disconnect-backpressure?format=claude","cursorMdc":"/api/rules/fastapi-sse-client-disconnect-backpressure?format=mdc","cursorrules":"/api/rules/fastapi-sse-client-disconnect-backpressure?format=cursor","windsurf":"/api/rules/fastapi-sse-client-disconnect-backpressure?format=windsurf","agents":"/api/rules/fastapi-sse-client-disconnect-backpressure?format=agents"}},{"id":"pg17-hnsw-memory-boundary-enclaves","title":"PostgreSQL 17 Pgvector HNSW Indexing Memory Boundary Enclaves","category":"backend","severity":"critical","description":"Enforces deterministic memory boundaries and scalar quantization enclaves during pgvector HNSW index builds on PostgreSQL 17. Prevents Linux cgroup OOM killer panics by mathematically budgeting session-scoped maintenance_work_mem against vector dimensionality, maximum graph out-degrees (m), and parallel maintenance workers.","antiPatternHeadline":"Unbounded HNSW Graph Materialization with Default maintenance_work_mem and Full-Precision Float32 Vectors","stars_count":81,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","pgvector","hnsw","memory-safety","vector-databases"],"exportEndpoints":{"claude":"/api/rules/pg17-hnsw-memory-boundary-enclaves?format=claude","cursorMdc":"/api/rules/pg17-hnsw-memory-boundary-enclaves?format=mdc","cursorrules":"/api/rules/pg17-hnsw-memory-boundary-enclaves?format=cursor","windsurf":"/api/rules/pg17-hnsw-memory-boundary-enclaves?format=windsurf","agents":"/api/rules/pg17-hnsw-memory-boundary-enclaves?format=agents"}},{"id":"kmp-swift-export-structured-concurrency-bridge","title":"Kotlin Multiplatform 2.1 Swift Export Structured Concurrency Invariants","category":"mobile","severity":"critical","description":"Enforces deterministic bidirectional lifecycle and cancellation binding between Apple Swift Structured Concurrency (Task trees) and Kotlin Native Coroutine Jobs under Kotlin 2.1 Swift Export. Eliminates cross-runtime ARC-to-GC memory leaks, dangling coroutine scopes, and thread-pool exhaustion caused by unpropagated task cancellations across the FFI boundary.","antiPatternHeadline":"Dangling Kotlin Coroutine Jobs and Leaked Continuations from Unpropagated Swift Task Cancellation","stars_count":88,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","swift","coroutines","concurrency","ios","memory-management"],"exportEndpoints":{"claude":"/api/rules/kmp-swift-export-structured-concurrency-bridge?format=claude","cursorMdc":"/api/rules/kmp-swift-export-structured-concurrency-bridge?format=mdc","cursorrules":"/api/rules/kmp-swift-export-structured-concurrency-bridge?format=cursor","windsurf":"/api/rules/kmp-swift-export-structured-concurrency-bridge?format=windsurf","agents":"/api/rules/kmp-swift-export-structured-concurrency-bridge?format=agents"}},{"id":"webauthn-l3-device-bound-origin-attestation","title":"WebAuthn L3 Device-Bound Passkey Origin Binding & Attestation Invariant","category":"security","severity":"critical","description":"Mandates strict origin validation, RP ID isolation, and authenticator data flag verification (BE=0, BS=0) during WebAuthn Level 3 registration and authentication ceremonies. Enforces FIDO Metadata Service (MDS3) attestation certificate path validation to block subdomain impersonation and non-device-bound credential synchronization in high-assurance environments.","antiPatternHeadline":"Lax Subdomain Origin Validation and Ignored Backup Flags Permitting Multi-Device Credential Hijacking","stars_count":42,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","fido2","passkeys","attestation","origin-binding"],"exportEndpoints":{"claude":"/api/rules/webauthn-l3-device-bound-origin-attestation?format=claude","cursorMdc":"/api/rules/webauthn-l3-device-bound-origin-attestation?format=mdc","cursorrules":"/api/rules/webauthn-l3-device-bound-origin-attestation?format=cursor","windsurf":"/api/rules/webauthn-l3-device-bound-origin-attestation?format=windsurf","agents":"/api/rules/webauthn-l3-device-bound-origin-attestation?format=agents"}},{"id":"cosign-rekor-ephemeral-oidc-admission-invariants","title":"Cosign 2.4 Rekor Ephemeral OIDC Attestation Admission Guardrail","category":"security","severity":"critical","description":"Mandates strict zero-trust container admission verification using Cosign 2.4 keyless OIDC signatures verified against Rekor transparency log proofs. Requires immutable digest pinning (sha256), explicit certificate identity (Subject Alternative Name) and issuer constraints, and cryptographically verified in-toto SLSA provenance attestations prior to workload scheduling.","antiPatternHeadline":"Admitting Mutable Tags with Bypassed Rekor Verification or Unconstrained OIDC Certificate Identities","stars_count":86,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","cosign","sigstore","rekor","oidc","supply-chain","kubernetes-admission"],"exportEndpoints":{"claude":"/api/rules/cosign-rekor-ephemeral-oidc-admission-invariants?format=claude","cursorMdc":"/api/rules/cosign-rekor-ephemeral-oidc-admission-invariants?format=mdc","cursorrules":"/api/rules/cosign-rekor-ephemeral-oidc-admission-invariants?format=cursor","windsurf":"/api/rules/cosign-rekor-ephemeral-oidc-admission-invariants?format=windsurf","agents":"/api/rules/cosign-rekor-ephemeral-oidc-admission-invariants?format=agents"}},{"id":"istio-ambient-ztunnel-zero-trust-enforcement-production-standard","title":"Istio Ambient Mode Ztunnel Kernel Redirection & STRICT mTLS Policy Enforcement","category":"devops","severity":"critical","description":"Mandates the declarative configuration of Istio Ambient Mesh utilizing node-level Ztunnel proxies via eBPF/CNI packet redirection over port 15008 (HBONE). Eliminates sidecar container injection while enforcing strict cryptographic zero-trust identity verification via PeerAuthentication at Layer 4. Prevents unauthenticated plaintext bypasses and misconfigured waypoint proxy delegations in dense workload topologies.","antiPatternHeadline":"Plaintext Traffic Leakage via Incomplete Ambient Namespace Tagging and Permissive mTLS Policies","stars_count":66,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","istio","ambient-mesh","ztunnel","ebpf","mtls","zero-trust","hbone","kubernetes"],"exportEndpoints":{"claude":"/api/rules/istio-ambient-ztunnel-zero-trust-enforcement-production-standard?format=claude","cursorMdc":"/api/rules/istio-ambient-ztunnel-zero-trust-enforcement-production-standard?format=mdc","cursorrules":"/api/rules/istio-ambient-ztunnel-zero-trust-enforcement-production-standard?format=cursor","windsurf":"/api/rules/istio-ambient-ztunnel-zero-trust-enforcement-production-standard?format=windsurf","agents":"/api/rules/istio-ambient-ztunnel-zero-trust-enforcement-production-standard?format=agents"}},{"id":"otel-collector-tail-sampling-memory-guardrail","title":"Mandatory Pre-Processor Memory Limiting and Deterministic Routing for Tail-Based Trace Sampling","category":"devops","severity":"critical","description":"Tail-based sampling buffers complete trace trees within a sliding evaluation window, introducing critical vulnerability to OOM termination during traffic bursts. This guardrail mandates strict processor ordering with `memory_limiter` placed first, upstream `trace_id` load-balanced routing, and tiered sampling policies that preserve 100% of errors and latency anomalies while downsampling healthy traffic.","antiPatternHeadline":"Unbounded Tail Sampling Buffering Without Memory Limiter Precedence Causing Silent Dropped Traces and OOM Kills","stars_count":67,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","observability","distributed-tracing","sre","kubernetes"],"exportEndpoints":{"claude":"/api/rules/otel-collector-tail-sampling-memory-guardrail?format=claude","cursorMdc":"/api/rules/otel-collector-tail-sampling-memory-guardrail?format=mdc","cursorrules":"/api/rules/otel-collector-tail-sampling-memory-guardrail?format=cursor","windsurf":"/api/rules/otel-collector-tail-sampling-memory-guardrail?format=windsurf","agents":"/api/rules/otel-collector-tail-sampling-memory-guardrail?format=agents"}},{"id":"nextjs-15-ppr-boundary-isolation-standard","title":"Next.js 15 Partial Prerendering (PPR) Boundary Isolation & Static Shell Guarantees","category":"frontend","severity":"critical","description":"Enforces strict segregation between static build-time edge shells and dynamic streaming micro-boundaries in Next.js 15 applications using React 19. Awaiting dynamic I/O primitives (cookies, headers, searchParams, uncached fetch) outside of an explicit React Suspense boundary de-optimizes the entire route segment to full SSR, eliminating edge TTFB advantages.","antiPatternHeadline":"Leaking Dynamic Accessors to Route Shells Causing Full-Route Dynamic De-Optimization","stars_count":44,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs-15","react-19","ppr","performance","edge","rsc"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-ppr-boundary-isolation-standard?format=claude","cursorMdc":"/api/rules/nextjs-15-ppr-boundary-isolation-standard?format=mdc","cursorrules":"/api/rules/nextjs-15-ppr-boundary-isolation-standard?format=cursor","windsurf":"/api/rules/nextjs-15-ppr-boundary-isolation-standard?format=windsurf","agents":"/api/rules/nextjs-15-ppr-boundary-isolation-standard?format=agents"}},{"id":"svelte-5-universal-runes-microfrontend-contract","title":"Svelte 5 Universal Runes Reactive State and Micro-Frontend Boundary Guardrail","category":"frontend","severity":"critical","description":"Enforces fine-grained signal reactivity via Svelte 5 universal runes ($state, $derived, $effect) across module boundaries and micro-frontend envelopes. Guarantees that internal proxy-wrapped state mutations remain encapsulated and are bridged to external foreign frameworks (React, Vue, Web Components) through explicit snapshots or readonly getter protocols rather than leaking raw reactive proxies across boundaries.","antiPatternHeadline":"Leaking Svelte 5 Deep Reactive Proxies Across Framework Boundaries and Bypassing Universal Module Contracts","stars_count":56,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","micro-frontends","signals","state-management"],"exportEndpoints":{"claude":"/api/rules/svelte-5-universal-runes-microfrontend-contract?format=claude","cursorMdc":"/api/rules/svelte-5-universal-runes-microfrontend-contract?format=mdc","cursorrules":"/api/rules/svelte-5-universal-runes-microfrontend-contract?format=cursor","windsurf":"/api/rules/svelte-5-universal-runes-microfrontend-contract?format=windsurf","agents":"/api/rules/svelte-5-universal-runes-microfrontend-contract?format=agents"}},{"id":"axum-08-streaming-tower-backpressure-invariants","title":"Axum 0.8 Zero-Copy Streaming and Tower Layer Backpressure Invariants","category":"backend","severity":"critical","description":"Enforces strict backpressure propagation and zero-copy byte slicing across Axum 0.8 routes and Tower middleware layers. Prevents catastrophic memory amplification under high-concurrency I/O by prohibiting unbounded body materialization into memory. Guarantees deterministic O(1) allocation overhead during asynchronous pipeline forwarding.","antiPatternHeadline":"Unbounded Eager Body Materialization and Backpressure Dropping in Tower Middleware","stars_count":98,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tower","tokio","zero-copy","streaming"],"exportEndpoints":{"claude":"/api/rules/axum-08-streaming-tower-backpressure-invariants?format=claude","cursorMdc":"/api/rules/axum-08-streaming-tower-backpressure-invariants?format=mdc","cursorrules":"/api/rules/axum-08-streaming-tower-backpressure-invariants?format=cursor","windsurf":"/api/rules/axum-08-streaming-tower-backpressure-invariants?format=windsurf","agents":"/api/rules/axum-08-streaming-tower-backpressure-invariants?format=agents"}},{"id":"pg17-failover-logical-slot-synchronization","title":"PostgreSQL 17 Native Failover Slot Synchronization for Zero-Downtime CDC Continuity","category":"backend","severity":"critical","description":"Mandates PostgreSQL 17 native logical failover slots and physical standby synchronization for change-data-capture (CDC) pipelines. Prevents catastrophic LSN divergence, stream recreations, and data loss during physical standby promotion by enforcing failover-enabled logical slots and physical standby slot coordination.","antiPatternHeadline":"Creating uncoordinated logical slots on primary nodes without failover enablement or standby slot dependencies.","stars_count":118,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql17","cdc","logical-replication","high-availability"],"exportEndpoints":{"claude":"/api/rules/pg17-failover-logical-slot-synchronization?format=claude","cursorMdc":"/api/rules/pg17-failover-logical-slot-synchronization?format=mdc","cursorrules":"/api/rules/pg17-failover-logical-slot-synchronization?format=cursor","windsurf":"/api/rules/pg17-failover-logical-slot-synchronization?format=windsurf","agents":"/api/rules/pg17-failover-logical-slot-synchronization?format=agents"}},{"id":"openfga-rebac-mesh-drift-prevention","title":"OpenFGA ReBAC Mesh Edge Authorization and Dual-Write Drift Guardrail","category":"security","severity":"critical","description":"Enforces edge-evaluated OpenFGA authorization checks and transactional relationship tuple synchronization across distributed services. Eliminates authorization drift by preventing ad-hoc SQL privilege checks in downstream microservices and requiring transactional outbox patterns for OpenFGA write-tuple ingestion.","antiPatternHeadline":"Ad-Hoc SQL Role Checks and Dual-Write Tuple Desynchronization","stars_count":119,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","rebac","openfga","authorization","edge-mesh"],"exportEndpoints":{"claude":"/api/rules/openfga-rebac-mesh-drift-prevention?format=claude","cursorMdc":"/api/rules/openfga-rebac-mesh-drift-prevention?format=mdc","cursorrules":"/api/rules/openfga-rebac-mesh-drift-prevention?format=cursor","windsurf":"/api/rules/openfga-rebac-mesh-drift-prevention?format=windsurf","agents":"/api/rules/openfga-rebac-mesh-drift-prevention?format=agents"}},{"id":"webauthn-prf-zk-client-encryption","title":"Hardware-Bound Zero-Knowledge Encryption via WebAuthn PRF Extension","category":"security","severity":"critical","description":"Enforces strict cryptographic handling when utilizing the WebAuthn Pseudo-Random Function (PRF) extension (`eval` / `evalByCredential`) to derive hardware-bound client-side symmetric keys. Mandates that derived PRF outputs are never transmitted over the network or persisted in plain text, requiring immediate one-way HKDF expansion into AES-GCM-256 keys with distinct domain-separated salts. Ensures proper fallback handling and runtime capability detection across authenticators to prevent plaintext data leakage.","antiPatternHeadline":"Persisting raw PRF outputs, transmitting them across network boundaries, or reusing symmetric derivation inputs without HKDF domain separation","stars_count":91,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","prf-extension","zero-knowledge","cryptography","aes-gcm","hkdf"],"exportEndpoints":{"claude":"/api/rules/webauthn-prf-zk-client-encryption?format=claude","cursorMdc":"/api/rules/webauthn-prf-zk-client-encryption?format=mdc","cursorrules":"/api/rules/webauthn-prf-zk-client-encryption?format=cursor","windsurf":"/api/rules/webauthn-prf-zk-client-encryption?format=windsurf","agents":"/api/rules/webauthn-prf-zk-client-encryption?format=agents"}},{"id":"ebpf-tetragon-kernel-enforcement-guardrail","title":"Deterministic Kernel-Level TracingPolicy Enforcement with In-Kernel Tetragon Kill Actions","category":"devops","severity":"critical","description":"Enforces sub-millisecond container runtime quarantine through Tetragon TracingPolicy definitions by mandating synchronous in-kernel Sigkill actions rather than asynchronous post-execution alerting. Eliminates time-of-check to time-of-use (TOCTOU) exploitation windows by pinning enforcement hooks to tracepoints or kprobes targeting binary executions, sensitive kernel namespace traversal, and privilege escalation primitives.","antiPatternHeadline":"Relying on Asynchronous User-Space Audit Logging or Post-Execution Webhook Signals for Malicious Container Quarantine","stars_count":112,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","tetragon","security","kubernetes","runtime-security"],"exportEndpoints":{"claude":"/api/rules/ebpf-tetragon-kernel-enforcement-guardrail?format=claude","cursorMdc":"/api/rules/ebpf-tetragon-kernel-enforcement-guardrail?format=mdc","cursorrules":"/api/rules/ebpf-tetragon-kernel-enforcement-guardrail?format=cursor","windsurf":"/api/rules/ebpf-tetragon-kernel-enforcement-guardrail?format=windsurf","agents":"/api/rules/ebpf-tetragon-kernel-enforcement-guardrail?format=agents"}},{"id":"opentelemetry-w3c-trace-context-baggage-governance-production-standard","title":"OpenTelemetry W3C TraceContext and Baggage Contract Governance","category":"devops","severity":"critical","description":"Enforces deterministic extraction, propagation, and injection of W3C TraceContext (traceparent, tracestate) and Baggage headers across polyglot microservice boundaries. Eliminates broken distributed trace graphs, missing tenant isolation contexts, and ad-hoc header anti-patterns across asynchronous boundaries and outbound transports.","antiPatternHeadline":"Ad-Hoc Header Stripping, Context Severance, and Unpropagated Async Trace Graphs","stars_count":84,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","distributed-tracing","w3c-tracecontext","baggage","observability"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-w3c-trace-context-baggage-governance-production-standard?format=claude","cursorMdc":"/api/rules/opentelemetry-w3c-trace-context-baggage-governance-production-standard?format=mdc","cursorrules":"/api/rules/opentelemetry-w3c-trace-context-baggage-governance-production-standard?format=cursor","windsurf":"/api/rules/opentelemetry-w3c-trace-context-baggage-governance-production-standard?format=windsurf","agents":"/api/rules/opentelemetry-w3c-trace-context-baggage-governance-production-standard?format=agents"}},{"id":"kmp-deterministic-state-engine-sync","title":"Deterministic KMP State Machine Synchronization with SQLDelight Offline Stores","category":"mobile","severity":"critical","description":"Enforces strict mathematical determinism across Kotlin Multiplatform shared state engines interfacing with transactional SQLite persistence (e.g., SQLDelight) and Coroutine/Flow state bridges. Prevents race conditions, state divergence, non-atomic database mutations, and non-thread-safe native memory leaks across iOS (Native), Android (JVM), and Web (Wasm/JS).","antiPatternHeadline":"Non-Atomic Side-Effects and Race Conditions in Multiplatform State Machine Transitions","stars_count":68,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kmp","kotlin-multiplatform","sqldelight","state-machine","coroutines","concurrency"],"exportEndpoints":{"claude":"/api/rules/kmp-deterministic-state-engine-sync?format=claude","cursorMdc":"/api/rules/kmp-deterministic-state-engine-sync?format=mdc","cursorrules":"/api/rules/kmp-deterministic-state-engine-sync?format=cursor","windsurf":"/api/rules/kmp-deterministic-state-engine-sync?format=windsurf","agents":"/api/rules/kmp-deterministic-state-engine-sync?format=agents"}},{"id":"capacitor-7-biometric-secure-enclave-isolation","title":"Capacitor 7 Biometric Hardware Key Vault & Secure Enclave Isolation","category":"mobile","severity":"critical","description":"Guarantees hybrid web-view runtimes never store cryptographic keys, refresh tokens, or raw session credentials inside WebStorage, IndexedDB, or memory-leaked JS closures. Mandates offloading all cryptographic signing, token persistence, and biometric challenges directly to the native iOS Secure Enclave (Keychain kSecAccessControlBiometryAny) and Android KeyStore (KeyProperties.PURPOSE_SIGN / PURPOSE_DECRYPT with setUserAuthenticationRequired) via hardened Capacitor 7 native bridges.","antiPatternHeadline":"Persisting Sensitive OAuth Credentials or Cryptographic Secrets in Insecure WebStorage APIs","stars_count":58,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","security","secure-enclave","biometrics","keychain","keystore"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-biometric-secure-enclave-isolation?format=claude","cursorMdc":"/api/rules/capacitor-7-biometric-secure-enclave-isolation?format=mdc","cursorrules":"/api/rules/capacitor-7-biometric-secure-enclave-isolation?format=cursor","windsurf":"/api/rules/capacitor-7-biometric-secure-enclave-isolation?format=windsurf","agents":"/api/rules/capacitor-7-biometric-secure-enclave-isolation?format=agents"}},{"id":"svelte-5-runes-raw-state-boundary-standard","title":"Svelte 5 Runes Raw State Boundary Standard for High-Frequency Telemetry","category":"frontend","severity":"critical","description":"Enforces the mandatory application of $state.raw over deep $state proxies for high-frequency telemetry streams, WebSockets, and real-time dashboard data feeds in Svelte 5. Deep proxy wrapping on sub-second data ingress causes catastrophic garbage collection churn and UI frame drops. High-frequency state must treat payload objects as immutable structures updated via atomic reference reassignment.","antiPatternHeadline":"Wrapping High-Frequency Ingress Payloads in Recursive Deep-Reactive $state Proxies","stars_count":92,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte","svelte5","runes","performance","telemetry","websockets"],"exportEndpoints":{"claude":"/api/rules/svelte-5-runes-raw-state-boundary-standard?format=claude","cursorMdc":"/api/rules/svelte-5-runes-raw-state-boundary-standard?format=mdc","cursorrules":"/api/rules/svelte-5-runes-raw-state-boundary-standard?format=cursor","windsurf":"/api/rules/svelte-5-runes-raw-state-boundary-standard?format=windsurf","agents":"/api/rules/svelte-5-runes-raw-state-boundary-standard?format=agents"}},{"id":"nextjs-15-ppr-dynamicio-boundary-invariant","title":"Next.js 15 PPR & DynamicIO Deterministic Boundary Guardrail","category":"frontend","severity":"critical","description":"Enforces strict structural boundaries between static prerender shells and dynamic streaming Suspense holes under Next.js 15 Partial Prerendering (PPR) and DynamicIO. Isolates dynamic API calls (cookies, headers, searchParams, uncached I/O) within explicit React Suspense boundaries to eliminate silent static bailouts and request cache poisoning.","antiPatternHeadline":"Leaking Un-Suspended Request-Time APIs into Static Prerender Shells","stars_count":69,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs15","ppr","react-server-components","dynamic-io","suspense","performance"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-ppr-dynamicio-boundary-invariant?format=claude","cursorMdc":"/api/rules/nextjs-15-ppr-dynamicio-boundary-invariant?format=mdc","cursorrules":"/api/rules/nextjs-15-ppr-dynamicio-boundary-invariant?format=cursor","windsurf":"/api/rules/nextjs-15-ppr-dynamicio-boundary-invariant?format=windsurf","agents":"/api/rules/nextjs-15-ppr-dynamicio-boundary-invariant?format=agents"}},{"id":"bun-worker-zero-copy-ipc-standard","title":"Bun 1.2 Zero-Copy Worker Thread IPC Standard","category":"backend","severity":"critical","description":"Enforces strict zero-copy Inter-Process Communication (IPC) across Bun native Worker threads using transferable ArrayBuffers and SharedArrayBuffers with Atomics. Eliminates JavaScriptCore (JSC) structured clone serialization overhead and memory copying on CPU-bound payloads. Guarantees deterministic, sub-millisecond execution times for parallel backend workloads.","antiPatternHeadline":"Implicit Structured Clone Serialization of Large TypedArrays and JSON Objects Across Bun Worker Boundaries","stars_count":116,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","workers","multithreading","zero-copy","performance","ipc"],"exportEndpoints":{"claude":"/api/rules/bun-worker-zero-copy-ipc-standard?format=claude","cursorMdc":"/api/rules/bun-worker-zero-copy-ipc-standard?format=mdc","cursorrules":"/api/rules/bun-worker-zero-copy-ipc-standard?format=cursor","windsurf":"/api/rules/bun-worker-zero-copy-ipc-standard?format=windsurf","agents":"/api/rules/bun-worker-zero-copy-ipc-standard?format=agents"}},{"id":"postgres-17-sql-json-table-optimization-invariants","title":"Postgres 17 SQL/JSON JSON_TABLE Optimization & Memory Invariants","category":"backend","severity":"critical","description":"Enforces strict query planning invariants and memory bounds when projecting JSON/JSONB payloads into relational tabular formats using Postgres 17 JSON_TABLE. Mandates precise SQL/JSON path evaluation, typed column projection with strict error handling, and the prevention of unindexed full-table nested scans or memory bloat caused by unbounded path expansion. Guarantees queries retain index-driven scan paths and work_mem compliance.","antiPatternHeadline":"Unbounded JSON_TABLE Path Projections with Implicit Type Casts and Silent Error Fallbacks","stars_count":112,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres","sql-json","json-table","performance","database-design"],"exportEndpoints":{"claude":"/api/rules/postgres-17-sql-json-table-optimization-invariants?format=claude","cursorMdc":"/api/rules/postgres-17-sql-json-table-optimization-invariants?format=mdc","cursorrules":"/api/rules/postgres-17-sql-json-table-optimization-invariants?format=cursor","windsurf":"/api/rules/postgres-17-sql-json-table-optimization-invariants?format=windsurf","agents":"/api/rules/postgres-17-sql-json-table-optimization-invariants?format=agents"}},{"id":"go-synctest-virtual-clock-concurrency-standard","title":"Go 1.24 synctest Virtual Clock Concurrency & Lease Invariants","category":"backend","severity":"critical","description":"Mandates deterministic verification of asynchronous workflows, distributed lease expirations, and HTTP timeouts using Go 1.24 testing/synctest. Eliminates flaky wall-clock sleeps, ensures instant synthetic time advancement, and enforces strict bubble boundary isolation to prevent untracked goroutine leaks in Go Chi microservices.","antiPatternHeadline":"Non-Deterministic Wall-Clock Sleep Polling and Unbounded Goroutine Leaks in Asynchronous Tests","stars_count":113,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","concurrency","synctest","testing","chi"],"exportEndpoints":{"claude":"/api/rules/go-synctest-virtual-clock-concurrency-standard?format=claude","cursorMdc":"/api/rules/go-synctest-virtual-clock-concurrency-standard?format=mdc","cursorrules":"/api/rules/go-synctest-virtual-clock-concurrency-standard?format=cursor","windsurf":"/api/rules/go-synctest-virtual-clock-concurrency-standard?format=windsurf","agents":"/api/rules/go-synctest-virtual-clock-concurrency-standard?format=agents"}},{"id":"capacitor-7-webauthn-prf-storage-invariants","title":"Capacitor 7 Hardware-Backed WebAuthn PRF Invariant","category":"mobile","severity":"critical","description":"Enforces client-side deterministic key derivation via WebAuthn Pseudo-Random Function (PRF) extensions in Capacitor 7 hybrid applications. Mandates that local encryption keys are transiently derived on-demand from secure hardware authenticators without ever persisting raw master secrets or encryption keys in WebView storage, secure storage plugins, or client-side disk caches.","antiPatternHeadline":"Persisting Raw Symmetric Encryption Keys in Local Storage or Keystore Plugins","stars_count":56,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor-7","webauthn","prf-extension","cryptography","zero-knowledge"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-webauthn-prf-storage-invariants?format=claude","cursorMdc":"/api/rules/capacitor-7-webauthn-prf-storage-invariants?format=mdc","cursorrules":"/api/rules/capacitor-7-webauthn-prf-storage-invariants?format=cursor","windsurf":"/api/rules/capacitor-7-webauthn-prf-storage-invariants?format=windsurf","agents":"/api/rules/capacitor-7-webauthn-prf-storage-invariants?format=agents"}},{"id":"kmp-kotlin-2-1-swift-export-memory-ownership","title":"Kotlin 2.1 Direct Swift Export Memory Ownership & ARC/GC Boundary Standard","category":"mobile","severity":"critical","description":"Prevents cross-runtime retain cycles and runtime deadlocks across Apple ARC and Kotlin/Native GC during Kotlin 2.1 Direct Swift Export. Mandates explicit ownership contracts, non-retaining delegate patterns, and deterministic dispatch isolation across foreign function boundaries.","antiPatternHeadline":"Bidirectional Strong Retain Cycles and Blocking Swift Finalizers Across ARC-GC Boundaries","stars_count":105,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kmp","kotlin-native","swift","memory-management","arc"],"exportEndpoints":{"claude":"/api/rules/kmp-kotlin-2-1-swift-export-memory-ownership?format=claude","cursorMdc":"/api/rules/kmp-kotlin-2-1-swift-export-memory-ownership?format=mdc","cursorrules":"/api/rules/kmp-kotlin-2-1-swift-export-memory-ownership?format=cursor","windsurf":"/api/rules/kmp-kotlin-2-1-swift-export-memory-ownership?format=windsurf","agents":"/api/rules/kmp-kotlin-2-1-swift-export-memory-ownership?format=agents"}},{"id":"webauthn-l3-device-bound-attestation-step-up","title":"WebAuthn Level 3 Device-Bound Attestation Step-Up Enforcement","category":"security","severity":"critical","description":"Mandates cryptographic verification of hardware-bound security keys during privileged tenant operations to mitigate account takeover via compromised cloud-synced passkey ecosystems. Step-up verification for administrative actions must strictly enforce non-backupable authenticator flags (BE=0, BS=0) and validate hardware attestation certificates.","antiPatternHeadline":"Permitting Synced Multi-Device Passkeys to Authorize Privileged Tenant Mutations","stars_count":92,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","fido2","passkeys","zero-trust","attestation"],"exportEndpoints":{"claude":"/api/rules/webauthn-l3-device-bound-attestation-step-up?format=claude","cursorMdc":"/api/rules/webauthn-l3-device-bound-attestation-step-up?format=mdc","cursorrules":"/api/rules/webauthn-l3-device-bound-attestation-step-up?format=cursor","windsurf":"/api/rules/webauthn-l3-device-bound-attestation-step-up?format=windsurf","agents":"/api/rules/webauthn-l3-device-bound-attestation-step-up?format=agents"}},{"id":"sigstore-fulcio-rekor-ephemeral-attestation-admission-standard","title":"Zero-Static-Key Container Attestation via Sigstore Fulcio-Rekor Admission Policy","category":"security","severity":"critical","description":"Enforces zero-static-key container provenance verification at the Kubernetes admission layer using short-lived Fulcio X.509 OIDC certificates and append-only Rekor transparency log proofs. Prohibits static long-lived asymmetric keys, unpinned OIDC issuer identities, and admission policies that fail open or skip Rekor inclusion verification (SET/SCT validation). Mandates strict validation of cryptographic subject alternative names (SAN), issuer URI claims, and in-toto provenance attestations before workload scheduling.","antiPatternHeadline":"Validating signatures using static public keys, unanchored OIDC issuers, or unverified Rekor transparency log entries in admission webhooks","stars_count":108,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","sigstore","fulcio","rekor","cosign","kubernetes","admission-controller","supply-chain"],"exportEndpoints":{"claude":"/api/rules/sigstore-fulcio-rekor-ephemeral-attestation-admission-standard?format=claude","cursorMdc":"/api/rules/sigstore-fulcio-rekor-ephemeral-attestation-admission-standard?format=mdc","cursorrules":"/api/rules/sigstore-fulcio-rekor-ephemeral-attestation-admission-standard?format=cursor","windsurf":"/api/rules/sigstore-fulcio-rekor-ephemeral-attestation-admission-standard?format=windsurf","agents":"/api/rules/sigstore-fulcio-rekor-ephemeral-attestation-admission-standard?format=agents"}},{"id":"otel-genai-semantic-conventions-exemplar-invariant","title":"OpenTelemetry GenAI Semantic Conventions and Exemplar Trace Invariant","category":"devops","severity":"critical","description":"Enforces strict compliance with OpenTelemetry GenAI Semantic Conventions across federated LLM routing gateways and proxy layers. Guarantees immutable propagation of W3C trace context, standardized gen_ai.* metric naming, and explicit exemplar linkage between financial token cost metrics and active spans for SLA audits.","antiPatternHeadline":"Fragmented Ad-Hoc Metric Payloads and Broken W3C Exemplar Linkage in Gateway Dispatchers","stars_count":91,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","genai","observability","distributed-tracing","llm-gateway"],"exportEndpoints":{"claude":"/api/rules/otel-genai-semantic-conventions-exemplar-invariant?format=claude","cursorMdc":"/api/rules/otel-genai-semantic-conventions-exemplar-invariant?format=mdc","cursorrules":"/api/rules/otel-genai-semantic-conventions-exemplar-invariant?format=cursor","windsurf":"/api/rules/otel-genai-semantic-conventions-exemplar-invariant?format=windsurf","agents":"/api/rules/otel-genai-semantic-conventions-exemplar-invariant?format=agents"}},{"id":"react19-optimistic-action-rollback-boundaries","title":"React 19 Concurrent Optimistic Mutation and Rollback Boundary Isolation","category":"frontend","severity":"critical","description":"Enforces strict transactional state containment and deterministic error boundary contracts across useActionState and useOptimistic during concurrent transition interruptions. Mandates explicit reconciliation identifiers and prevents unhandled server action rejections from desynchronizing UI trees or corrupting optimistic queues.","antiPatternHeadline":"Unbounded Optimistic State Mutations with Leaked Transition Errors and Ghost State Inconsistencies","stars_count":43,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","useOptimistic","useActionState","concurrency","error-boundaries"],"exportEndpoints":{"claude":"/api/rules/react19-optimistic-action-rollback-boundaries?format=claude","cursorMdc":"/api/rules/react19-optimistic-action-rollback-boundaries?format=mdc","cursorrules":"/api/rules/react19-optimistic-action-rollback-boundaries?format=cursor","windsurf":"/api/rules/react19-optimistic-action-rollback-boundaries?format=windsurf","agents":"/api/rules/react19-optimistic-action-rollback-boundaries?format=agents"}},{"id":"svelte5-runes-proxy-sandboxing","title":"Svelte 5 Runes Universal Reactive Proxy Sandboxing & Memory Boundary Isolation","category":"frontend","severity":"critical","description":"Enforces strict boundary encapsulation when passing Svelte 5 `$state` deep proxies across asynchronous boundaries like Web Workers, XState machines, or IndexedDB storage engines. Prevents silent proxy detachment, prototype serialization corruption, and unbounded memory leaks by requiring explicit structured cloning via `$state.snapshot()` and raw proxy sandboxing.","antiPatternHeadline":"Leaking Svelte 5 $state Proxies Directly into PostMessage, Structured Clone, or External Finite State Machine Contexts","stars_count":109,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["svelte5","runes","state-management","web-workers","reactivity","memory-leak"],"exportEndpoints":{"claude":"/api/rules/svelte5-runes-proxy-sandboxing?format=claude","cursorMdc":"/api/rules/svelte5-runes-proxy-sandboxing?format=mdc","cursorrules":"/api/rules/svelte5-runes-proxy-sandboxing?format=cursor","windsurf":"/api/rules/svelte5-runes-proxy-sandboxing?format=windsurf","agents":"/api/rules/svelte5-runes-proxy-sandboxing?format=agents"}},{"id":"openfga-zanzibar-bounded-consistency-guardrail","title":"OpenFGA Zanzibar Bounded Consistency & Tuple Token Invariant","category":"security","severity":"critical","description":"Enforces strict causal token propagation and bounded consistency constraints during OpenFGA check evaluations across distributed ReBAC clusters. Prevents the 'New Enemy' vulnerability and split-brain authorization bugs caused by evaluating stale replica caches immediately after permission mutations or revocations. Mandates explicit consistency preferences and atomic contextual tuple inclusion for point-in-time authorization decisions.","antiPatternHeadline":"Performing unbounded eventual consistency checks following permission mutations, enabling unauthorized access via stale replica evaluation.","stars_count":102,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","rebac","zanzibar","authorization","consistency-tokens","distributed-systems"],"exportEndpoints":{"claude":"/api/rules/openfga-zanzibar-bounded-consistency-guardrail?format=claude","cursorMdc":"/api/rules/openfga-zanzibar-bounded-consistency-guardrail?format=mdc","cursorrules":"/api/rules/openfga-zanzibar-bounded-consistency-guardrail?format=cursor","windsurf":"/api/rules/openfga-zanzibar-bounded-consistency-guardrail?format=windsurf","agents":"/api/rules/openfga-zanzibar-bounded-consistency-guardrail?format=agents"}},{"id":"tauri-v2-capability-multi-webview-ipc-sandboxing","title":"Tauri 2.0 Capability-Based Multi-Webview IPC Sandboxing & Origin Isolation","category":"mobile","severity":"critical","description":"Enforces strict, least-privilege capability manifests and remote origin isolation across multi-webview Tauri 2.0 architectures on mobile and desktop runtimes. Eliminates cross-window privilege escalation by preventing wildcard window targeting and scoping OS-level IPC commands to isolated webview contexts.","antiPatternHeadline":"Wildcard Window IPC Capabilities Permitting Cross-Context Privilege Escalation","stars_count":97,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri-v2","ipc-security","capabilities","sandboxing"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-capability-multi-webview-ipc-sandboxing?format=claude","cursorMdc":"/api/rules/tauri-v2-capability-multi-webview-ipc-sandboxing?format=mdc","cursorrules":"/api/rules/tauri-v2-capability-multi-webview-ipc-sandboxing?format=cursor","windsurf":"/api/rules/tauri-v2-capability-multi-webview-ipc-sandboxing?format=windsurf","agents":"/api/rules/tauri-v2-capability-multi-webview-ipc-sandboxing?format=agents"}},{"id":"pg17-hnsw-directio-concurrent-reindexing","title":"Postgres 17 Concurrent Direct I/O HNSW Vector Indexing Guardrails","category":"backend","severity":"critical","description":"Governs shared memory buffer allocation, session-scoped maintenance work memory, and WAL generation thresholds during concurrent high-dimensional HNSW vector index builds. Prevents backend connection stalls and replication lag caused by unthrottled I/O and shared buffer churn during pgvector index creation or re-indexing in PostgreSQL 17.","antiPatternHeadline":"Global maintenance_work_mem escalation and unthrottled CONCURRENTLY index builds exhausting shared buffers and stalling connection pools.","stars_count":84,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres","pgvector","hnsw","database-migration","performance"],"exportEndpoints":{"claude":"/api/rules/pg17-hnsw-directio-concurrent-reindexing?format=claude","cursorMdc":"/api/rules/pg17-hnsw-directio-concurrent-reindexing?format=mdc","cursorrules":"/api/rules/pg17-hnsw-directio-concurrent-reindexing?format=cursor","windsurf":"/api/rules/pg17-hnsw-directio-concurrent-reindexing?format=windsurf","agents":"/api/rules/pg17-hnsw-directio-concurrent-reindexing?format=agents"}},{"id":"fastapi-pydantic-v2-nonblocking-validator-guardrail","title":"FastAPI & Pydantic V2 Non-Blocking Event-Loop Validator Invariant","category":"backend","severity":"critical","description":"Pydantic V2 validators execute synchronously during HTTP payload deserialization before the route handler is invoked. Performing synchronous I/O, network calls, or blocking operations inside field or model validators blocks the asyncio event loop directly or exhausts AnyIO worker threadpools under load, causing catastrophic request queuing and API starvation.","antiPatternHeadline":"Performing Synchronous Blocking I/O or Heavy Compute Inside Pydantic V2 Validators","stars_count":117,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["fastapi","pydantic-v2","asyncio","anyio","concurrency","backend"],"exportEndpoints":{"claude":"/api/rules/fastapi-pydantic-v2-nonblocking-validator-guardrail?format=claude","cursorMdc":"/api/rules/fastapi-pydantic-v2-nonblocking-validator-guardrail?format=mdc","cursorrules":"/api/rules/fastapi-pydantic-v2-nonblocking-validator-guardrail?format=cursor","windsurf":"/api/rules/fastapi-pydantic-v2-nonblocking-validator-guardrail?format=windsurf","agents":"/api/rules/fastapi-pydantic-v2-nonblocking-validator-guardrail?format=agents"}},{"id":"cilium-ebpf-kernel-identity-l7-mtls-production-standard","title":"Cilium eBPF Kernel-Level Identity-Aware L7 Transparent mTLS Enforcement","category":"devops","severity":"critical","description":"Enforces sidecarless, kernel-space workload isolation and mutual TLS by binding cryptographic SPIFFE identities directly to Cilium eBPF socket maps (sockops) and transparent handshake listeners. Prohibits per-pod user-space proxy injection (Istio/Linkerd sidecars) to eliminate CPU and latency taxes while guaranteeing strict, non-bypassable L7 policy enforcement at the kernel-to-node-proxy boundary.","antiPatternHeadline":"Bypassing Kernel Socket Maps via Heavy User-Space Sidecars and Unauthenticated Cleartext Host Endpoints","stars_count":77,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","cilium","ebpf","mtls","spiffe","kubernetes","zero-trust"],"exportEndpoints":{"claude":"/api/rules/cilium-ebpf-kernel-identity-l7-mtls-production-standard?format=claude","cursorMdc":"/api/rules/cilium-ebpf-kernel-identity-l7-mtls-production-standard?format=mdc","cursorrules":"/api/rules/cilium-ebpf-kernel-identity-l7-mtls-production-standard?format=cursor","windsurf":"/api/rules/cilium-ebpf-kernel-identity-l7-mtls-production-standard?format=windsurf","agents":"/api/rules/cilium-ebpf-kernel-identity-l7-mtls-production-standard?format=agents"}},{"id":"webauthn-prf-client-side-key-derivation-guardrail","title":"Mandate HKDF Domain Separation and Zero-Knowledge Invariants for WebAuthn PRF Key Derivation","category":"security","severity":"critical","description":"WebAuthn PRF (Pseudo-Random Function) extension derives deterministic symmetric key material directly inside hardware authenticators for client-side encryption. Applications must strictly mandate HKDF-SHA-256 expansion with domain separation on the PRF output, verify authenticator extension support before cryptographic operations, and never allow the raw authenticator output to be utilized directly as a cipher key or transmitted to servers.","antiPatternHeadline":"Direct Cipher Instantiation with Raw PRF Output Lacking HKDF Domain Separation and Secure Buffer Zeroization","stars_count":72,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","prf","passkeys","cryptography","zero-knowledge","hkdf"],"exportEndpoints":{"claude":"/api/rules/webauthn-prf-client-side-key-derivation-guardrail?format=claude","cursorMdc":"/api/rules/webauthn-prf-client-side-key-derivation-guardrail?format=mdc","cursorrules":"/api/rules/webauthn-prf-client-side-key-derivation-guardrail?format=cursor","windsurf":"/api/rules/webauthn-prf-client-side-key-derivation-guardrail?format=windsurf","agents":"/api/rules/webauthn-prf-client-side-key-derivation-guardrail?format=agents"}},{"id":"vite-6-rolldown-environment-api-ssr-module-isolation","title":"Deterministic Environment Module Isolation & Dual-Package Boundary Guardrail","category":"devops","severity":"critical","description":"Enforces complete module graph partitioning and prevents dual-package hazards across client, SSR, and edge runtimes via the Vite 6 / Rolldown Environment API. Guarantees that server-only bindings, platform primitives, and dual ESM/CJS runtime singletons remain strictly isolated within designated execution boundaries without cross-graph pollution or invalid runtime shims.","antiPatternHeadline":"Cross-Environment Graph Leakage and Dual-Package Singleton Collisions via Monolithic Vite Configs","stars_count":70,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","vite6","rolldown","ssr","environment-api","dual-package-hazard","module-isolation"],"exportEndpoints":{"claude":"/api/rules/vite-6-rolldown-environment-api-ssr-module-isolation?format=claude","cursorMdc":"/api/rules/vite-6-rolldown-environment-api-ssr-module-isolation?format=mdc","cursorrules":"/api/rules/vite-6-rolldown-environment-api-ssr-module-isolation?format=cursor","windsurf":"/api/rules/vite-6-rolldown-environment-api-ssr-module-isolation?format=windsurf","agents":"/api/rules/vite-6-rolldown-environment-api-ssr-module-isolation?format=agents"}},{"id":"capacitor-7-hardware-keystore-bridge-boundary","title":"Capacitor 7 Hardware Key-Store Bridge Boundary and Cryptographic Isolation","category":"mobile","severity":"critical","description":"Enforces strict isolation between Capacitor 7 Webview contexts and native hardware security modules (Secure Enclave on iOS, AndroidKeyStore on Android). Mandates that raw cryptographic keys and sensitive authentication refresh tokens never cross the JavaScript bridge, requiring hardware-backed asymmetric signing operations and cryptographic attestation directly in native space to prevent unauthorized Webview script injection exploitation.","antiPatternHeadline":"Exposing Raw Cryptographic Material or Unsigned Auth Payloads across the Hybrid JavaScript Bridge","stars_count":62,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","secure-enclave","android-keystore","cryptography","biometrics"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-hardware-keystore-bridge-boundary?format=claude","cursorMdc":"/api/rules/capacitor-7-hardware-keystore-bridge-boundary?format=mdc","cursorrules":"/api/rules/capacitor-7-hardware-keystore-bridge-boundary?format=cursor","windsurf":"/api/rules/capacitor-7-hardware-keystore-bridge-boundary?format=windsurf","agents":"/api/rules/capacitor-7-hardware-keystore-bridge-boundary?format=agents"}},{"id":"react-19-actions-optimistic-rollback-standard","title":"React 19 Server Actions and useOptimistic Deterministic Rollback Standard","category":"frontend","severity":"critical","description":"Enforces strict atomicity and deterministic rollback patterns when handling asynchronous Server Actions in React 19. Prohibits manual state synchronization, stale closure variable captures during async pauses, and unhandled Server Action rejections that corrupt optimistic UI representations.","antiPatternHeadline":"Manual State Synchronization and Stale Closure Mutation During Async Server Action Rejections","stars_count":42,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","useOptimistic","server-actions","state-management"],"exportEndpoints":{"claude":"/api/rules/react-19-actions-optimistic-rollback-standard?format=claude","cursorMdc":"/api/rules/react-19-actions-optimistic-rollback-standard?format=mdc","cursorrules":"/api/rules/react-19-actions-optimistic-rollback-standard?format=cursor","windsurf":"/api/rules/react-19-actions-optimistic-rollback-standard?format=windsurf","agents":"/api/rules/react-19-actions-optimistic-rollback-standard?format=agents"}},{"id":"svelte-5-runes-reactive-boundary-isolation-pattern","title":"Svelte 5 Runes Reactive Boundary Isolation and Pure Derivation Standard","category":"frontend","severity":"critical","description":"Enforces deterministic, fine-grained reactivity boundaries in Svelte 5 utilizing explicit $state and pure $derived.by runes. Prohibits cross-component shared state mutation leaks, bidirectional prop mutation anti-patterns, and implicit side-effects inside reactive derivations.","antiPatternHeadline":"Mutating Shared External State Inside Complex Derivations or Leaking Mutable $state Proxies Across Component Boundaries","stars_count":66,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","state-management","reactivity"],"exportEndpoints":{"claude":"/api/rules/svelte-5-runes-reactive-boundary-isolation-pattern?format=claude","cursorMdc":"/api/rules/svelte-5-runes-reactive-boundary-isolation-pattern?format=mdc","cursorrules":"/api/rules/svelte-5-runes-reactive-boundary-isolation-pattern?format=cursor","windsurf":"/api/rules/svelte-5-runes-reactive-boundary-isolation-pattern?format=windsurf","agents":"/api/rules/svelte-5-runes-reactive-boundary-isolation-pattern?format=agents"}},{"id":"fastapi-lifespan-taskgroup-concurrency-guardrail","title":"FastAPI Lifespan Asyncio TaskGroup Structured Concurrency Guardrail","category":"backend","severity":"critical","description":"Enforces Python 3.12+ structured concurrency patterns in FastAPI applications using asyncio.TaskGroup within the lifespan context manager. Prevents dangling background coroutines, ContextVar cross-request contamination, and unhandled task crashes during ASGI graceful shutdown sequences.","antiPatternHeadline":"Fire-and-forget asyncio.create_task() spawned during application lifespan without TaskGroup bounds or cooperative cancellation","stars_count":100,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","python","fastapi","asyncio","structured-concurrency","uvicorn"],"exportEndpoints":{"claude":"/api/rules/fastapi-lifespan-taskgroup-concurrency-guardrail?format=claude","cursorMdc":"/api/rules/fastapi-lifespan-taskgroup-concurrency-guardrail?format=mdc","cursorrules":"/api/rules/fastapi-lifespan-taskgroup-concurrency-guardrail?format=cursor","windsurf":"/api/rules/fastapi-lifespan-taskgroup-concurrency-guardrail?format=windsurf","agents":"/api/rules/fastapi-lifespan-taskgroup-concurrency-guardrail?format=agents"}},{"id":"bun-postgres-zero-copy-streaming-standard","title":"Bun 1.2 Native PostgreSQL Zero-Copy Binary Streaming Protocol Guardrail","category":"backend","severity":"critical","description":"Enforces Bun 1.2 native SQL streaming abstractions and zero-copy byte pipeline handoffs for high-volume analytical workloads. Prohibits intermediate JavaScript object materialization and text-encoding roundtrips to prevent heap pressure, garbage collection latency spikes, and process crashes on multi-gigabyte payloads.","antiPatternHeadline":"In-Memory Result Materialization and Serialization of Analytical Result Sets","stars_count":110,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","postgresql","zero-copy","streaming","memory-management"],"exportEndpoints":{"claude":"/api/rules/bun-postgres-zero-copy-streaming-standard?format=claude","cursorMdc":"/api/rules/bun-postgres-zero-copy-streaming-standard?format=mdc","cursorrules":"/api/rules/bun-postgres-zero-copy-streaming-standard?format=cursor","windsurf":"/api/rules/bun-postgres-zero-copy-streaming-standard?format=windsurf","agents":"/api/rules/bun-postgres-zero-copy-streaming-standard?format=agents"}},{"id":"tauri-v2-mobile-ipc-capability-scoping-standard","title":"Tauri 2.0 Mobile IPC Capability Scoping and Payload Validation Standard","category":"mobile","severity":"critical","description":"Enforces zero-trust isolation between mobile WebViews and native Rust runtimes under Tauri 2.0. Mandates granular capability scoping via capability files and strict bidirectional schema validation to prevent privilege escalation from compromised WebView contexts.","antiPatternHeadline":"Wildcard Capability Grants and Untyped IPC Invocation with Unsanitized Structs","stars_count":42,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri","ipc","security","rust","typescript"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-mobile-ipc-capability-scoping-standard?format=claude","cursorMdc":"/api/rules/tauri-v2-mobile-ipc-capability-scoping-standard?format=mdc","cursorrules":"/api/rules/tauri-v2-mobile-ipc-capability-scoping-standard?format=cursor","windsurf":"/api/rules/tauri-v2-mobile-ipc-capability-scoping-standard?format=windsurf","agents":"/api/rules/tauri-v2-mobile-ipc-capability-scoping-standard?format=agents"}},{"id":"kmp-swift-interop-concurrent-mutation-guardrail","title":"Kotlin Multiplatform Swift Interop Concurrent Mutation and ABI Memory Safety","category":"mobile","severity":"critical","description":"Prevents SIGSEGV native memory corruption, race conditions, and reference counting deadlocks across the Kotlin/Native and Swift Objective-C ABI boundary under aggressive background concurrency. Mandates strict value-type bridging or thread-confined isolation using Swift actors and Kotlin StateFlow to avoid concurrent mutation of shared ObjC-bridged heap pointers. Enforces thread-safe lifecycle containment to prevent deallocation races during asynchronous dispatch.","antiPatternHeadline":"Directly Mutating Kotlin/Native Shared Mutable Objects Across Concurrent Swift GCD Queues or Async Tasks","stars_count":45,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","swift","concurrency","memory-safety","interop"],"exportEndpoints":{"claude":"/api/rules/kmp-swift-interop-concurrent-mutation-guardrail?format=claude","cursorMdc":"/api/rules/kmp-swift-interop-concurrent-mutation-guardrail?format=mdc","cursorrules":"/api/rules/kmp-swift-interop-concurrent-mutation-guardrail?format=cursor","windsurf":"/api/rules/kmp-swift-interop-concurrent-mutation-guardrail?format=windsurf","agents":"/api/rules/kmp-swift-interop-concurrent-mutation-guardrail?format=agents"}},{"id":"openfga-contextual-tuple-rebac-consistency","title":"OpenFGA 0.6 Contextual Tuple ReBAC Transactional Consistency Guardrail","category":"security","severity":"critical","description":"Enforces strict transactional consistency in OpenFGA 0.6+ relationship-based authorization checks across distributed microservice boundaries. Mandates the use of contextual tuples and calibrated consistency preferences during mutation lifecycles to eliminate read-after-write authorization race conditions and Time-of-Check to Time-of-Use (TOCTOU) security bypasses.","antiPatternHeadline":"Stale ReBAC Evaluation Due to Asynchronous Tuple Ingestion Lag","stars_count":101,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","rebac","authorization","distributed-systems","concurrency"],"exportEndpoints":{"claude":"/api/rules/openfga-contextual-tuple-rebac-consistency?format=claude","cursorMdc":"/api/rules/openfga-contextual-tuple-rebac-consistency?format=mdc","cursorrules":"/api/rules/openfga-contextual-tuple-rebac-consistency?format=cursor","windsurf":"/api/rules/openfga-contextual-tuple-rebac-consistency?format=windsurf","agents":"/api/rules/openfga-contextual-tuple-rebac-consistency?format=agents"}},{"id":"pq-mlkem-hybrid-tls13-transport-invariant","title":"Post-Quantum ML-KEM Hybrid TLS 1.3 Microservice Transport Standard","category":"security","severity":"critical","description":"Enforces post-quantum hybrid key encapsulation (NIST FIPS 203 ML-KEM combined with X25519) on all internal east-west microservice transport connections. Prevents 'Harvest Now, Decrypt Later' (HNDL) adversaries from capturing classical ephemeral Diffie-Hellman handshakes across internal fabrics to decrypt retroactively. Mandates strict TLS 1.3 negotiation with dual-kem groups and explicit rejection of legacy classical-only cipher suites.","antiPatternHeadline":"Transport configurations permitting classical-only ECDHE or legacy TLS protocols vulnerable to quantum surveillance capture","stars_count":93,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","post-quantum","fips-203","ml-kem","tls-1-3","zero-trust","cryptography"],"exportEndpoints":{"claude":"/api/rules/pq-mlkem-hybrid-tls13-transport-invariant?format=claude","cursorMdc":"/api/rules/pq-mlkem-hybrid-tls13-transport-invariant?format=mdc","cursorrules":"/api/rules/pq-mlkem-hybrid-tls13-transport-invariant?format=cursor","windsurf":"/api/rules/pq-mlkem-hybrid-tls13-transport-invariant?format=windsurf","agents":"/api/rules/pq-mlkem-hybrid-tls13-transport-invariant?format=agents"}},{"id":"cilium-ebpf-xdp-zero-allocation-mitigator-standard","title":"Cilium eBPF XDP Zero-Allocation Ingress Mitigator Standard","category":"devops","severity":"critical","description":"Enforces pre-stack zero-allocation packet filtering at the native XDP driver layer to thwart high-PPS L4 volumetric floods before Linux kernel sk_buff allocation. Mandates strict direct packet access bounds checks against data_end, deterministic branchless parsing, and lockless per-CPU map primitives to guarantee line-rate mitigation without softirq starvation.","antiPatternHeadline":"Deferring Ingress Mitigation to TC or Socket Layer Causing sk_buff Memory Exhaustion","stars_count":75,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","cilium","xdp","ddos-mitigation","kernel","networking"],"exportEndpoints":{"claude":"/api/rules/cilium-ebpf-xdp-zero-allocation-mitigator-standard?format=claude","cursorMdc":"/api/rules/cilium-ebpf-xdp-zero-allocation-mitigator-standard?format=mdc","cursorrules":"/api/rules/cilium-ebpf-xdp-zero-allocation-mitigator-standard?format=cursor","windsurf":"/api/rules/cilium-ebpf-xdp-zero-allocation-mitigator-standard?format=windsurf","agents":"/api/rules/cilium-ebpf-xdp-zero-allocation-mitigator-standard?format=agents"}},{"id":"otel-collector-tail-sampling-tracestate-retention","title":"OpenTelemetry Collector Tail-Based Sampling and TraceState Retention Guardrail","category":"devops","severity":"critical","description":"Enforces deterministic tail-based sampling policies within OpenTelemetry Collector deployments to preserve complete distributed trace lineages exhibiting errors, high latency, or explicit sampling markers. Mandates proper traceID-based load-balancing and W3C TraceState preservation to prevent fractured trace graphs and corrupted downstream context propagation across microservice boundaries.","antiPatternHeadline":"Fragmented Trace Topologies and Lost Root Lineages Due to Naive Head Sampling or Unpartitioned Tail Sampling","stars_count":45,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","observability","distributed-tracing","tail-sampling","tracestate"],"exportEndpoints":{"claude":"/api/rules/otel-collector-tail-sampling-tracestate-retention?format=claude","cursorMdc":"/api/rules/otel-collector-tail-sampling-tracestate-retention?format=mdc","cursorrules":"/api/rules/otel-collector-tail-sampling-tracestate-retention?format=cursor","windsurf":"/api/rules/otel-collector-tail-sampling-tracestate-retention?format=windsurf","agents":"/api/rules/otel-collector-tail-sampling-tracestate-retention?format=agents"}},{"id":"react19-server-actions-idempotency-rollback-boundaries","title":"React 19 Server Actions Idempotency Keys and Optimistic Rollback Snapshots","category":"frontend","severity":"critical","description":"Enforces strict boundary isolation between React 19 optimistic UI mutations and server-side execution. Mandates cryptographically unique idempotency keys per user-initiated mutation and deterministic rollback state snapshots to prevent split-brain UI states, out-of-order resolution, and duplicate server mutations during network partitions.","antiPatternHeadline":"Unkeyed Server Action Execution with Non-Deterministic Optimistic Drift","stars_count":93,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","server-actions","optimistic-ui","idempotency","distributed-state"],"exportEndpoints":{"claude":"/api/rules/react19-server-actions-idempotency-rollback-boundaries?format=claude","cursorMdc":"/api/rules/react19-server-actions-idempotency-rollback-boundaries?format=mdc","cursorrules":"/api/rules/react19-server-actions-idempotency-rollback-boundaries?format=cursor","windsurf":"/api/rules/react19-server-actions-idempotency-rollback-boundaries?format=windsurf","agents":"/api/rules/react19-server-actions-idempotency-rollback-boundaries?format=agents"}},{"id":"svelte-5-runes-memory-scoping-root-effect-teardown","title":"Svelte 5 Universal Runes Memory Scoping and Root Effect Teardown","category":"frontend","severity":"critical","description":"Enforces strict memory boundary management and explicit root effect disposal for Svelte 5 universal runes instantiated outside component lifecycles. Guarantees that reactive closures in long-lived client contexts, service modules, and micro-frontend hosts do not retain detached DOM nodes or leak heap across view transitions.","antiPatternHeadline":"Unmanaged $effect.root Instantiations and Leaked Universal Reactive Closures Across View Transitions","stars_count":40,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","memory-management","micro-frontends","reactivity"],"exportEndpoints":{"claude":"/api/rules/svelte-5-runes-memory-scoping-root-effect-teardown?format=claude","cursorMdc":"/api/rules/svelte-5-runes-memory-scoping-root-effect-teardown?format=mdc","cursorrules":"/api/rules/svelte-5-runes-memory-scoping-root-effect-teardown?format=cursor","windsurf":"/api/rules/svelte-5-runes-memory-scoping-root-effect-teardown?format=windsurf","agents":"/api/rules/svelte-5-runes-memory-scoping-root-effect-teardown?format=agents"}},{"id":"capacitor-7-native-bridge-rpc-buffer-marshalling","title":"Capacitor 7 Type-Safe Native RPC and Zero-Copy Buffer Marshalling","category":"mobile","severity":"critical","description":"Enforces compile-time and runtime type safety on all Capacitor 7 native bridge invocations while eliminating binary-to-base64 serialization overhead. Prevents IPC injection vulnerabilities, JavaScriptCore heap exhaustion, and UI thread blocking across the WebKit/Blink-to-native boundary.","antiPatternHeadline":"Untyped Base64 Marshalling and Unvalidated IPC Payloads across Native Execution Boundaries","stars_count":54,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","ios","android","ipc","performance","security"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-native-bridge-rpc-buffer-marshalling?format=claude","cursorMdc":"/api/rules/capacitor-7-native-bridge-rpc-buffer-marshalling?format=mdc","cursorrules":"/api/rules/capacitor-7-native-bridge-rpc-buffer-marshalling?format=cursor","windsurf":"/api/rules/capacitor-7-native-bridge-rpc-buffer-marshalling?format=windsurf","agents":"/api/rules/capacitor-7-native-bridge-rpc-buffer-marshalling?format=agents"}},{"id":"openfga-rebac-cdc-invalidation-pipeline","title":"Zero-Stale ReBAC Cache Invalidation with CDC & Consistency Tokens","category":"security","severity":"critical","description":"Enforces zero-stale authorization evaluations in OpenFGA ReBAC architectures operating under sub-10ms SLOs. Mandates deterministic CDC invalidation pipelines and consistency token propagation across collaborative permission mutations to eliminate privilege retention vulnerabilities caused by replication lag and uncoordinated caches.","antiPatternHeadline":"Uncoordinated TTL Caching and Blind Tuple Writes Permitting Stale Permission Bypasses","stars_count":86,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","rebac","cdc","authorization","cache-invalidation","zanzibar"],"exportEndpoints":{"claude":"/api/rules/openfga-rebac-cdc-invalidation-pipeline?format=claude","cursorMdc":"/api/rules/openfga-rebac-cdc-invalidation-pipeline?format=mdc","cursorrules":"/api/rules/openfga-rebac-cdc-invalidation-pipeline?format=cursor","windsurf":"/api/rules/openfga-rebac-cdc-invalidation-pipeline?format=windsurf","agents":"/api/rules/openfga-rebac-cdc-invalidation-pipeline?format=agents"}},{"id":"oauth21-dpop-rfc9449-binding-replay-guard","title":"Enforce RFC 9449 DPoP Sender-Constrained Token Binding & Replay Guards","category":"security","severity":"critical","description":"Mandates strict RFC 9449 Demonstrating Proof-of-Possession (DPoP) verification across zero-trust ingress boundaries to prevent token exfiltration and replay attacks. Ingress services must cryptographically bind access tokens to client-held asymmetric keys via thumbprint verification (cnf.jkt), validate proof claims (htm, htu, ath, iat), and enforce atomic JTI deduplication using a centralized distributed replay cache.","antiPatternHeadline":"Accepting Unbound Bearer Tokens or Incomplete DPoP Proofs Without Atomic Replay Cache and Access Token Hash Binding","stars_count":100,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","oauth2","dpop","rfc9449","jwt","zero-trust","cryptography"],"exportEndpoints":{"claude":"/api/rules/oauth21-dpop-rfc9449-binding-replay-guard?format=claude","cursorMdc":"/api/rules/oauth21-dpop-rfc9449-binding-replay-guard?format=mdc","cursorrules":"/api/rules/oauth21-dpop-rfc9449-binding-replay-guard?format=cursor","windsurf":"/api/rules/oauth21-dpop-rfc9449-binding-replay-guard?format=windsurf","agents":"/api/rules/oauth21-dpop-rfc9449-binding-replay-guard?format=agents"}},{"id":"fastapi-python313-nogil-extension-isolation","title":"FastAPI Free-Threaded (Python 3.13 nogil) Concurrency & Extension Isolation","category":"backend","severity":"critical","description":"Enforces strict memory safety and isolation invariants for FastAPI running on Python 3.13 free-threaded builds (nogil). Direct access to legacy, non-thread-safe C-extensions and unsynchronized shared mutable state within free-threaded workers induces silent memory corruption and SIGSEGV faults.","antiPatternHeadline":"Executing non-nogil-verified C-extensions and unsynchronized shared mutable state in free-threaded FastAPI threadpools","stars_count":95,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","python","fastapi","nogil","concurrency","thread-safety","python-3-13"],"exportEndpoints":{"claude":"/api/rules/fastapi-python313-nogil-extension-isolation?format=claude","cursorMdc":"/api/rules/fastapi-python313-nogil-extension-isolation?format=mdc","cursorrules":"/api/rules/fastapi-python313-nogil-extension-isolation?format=cursor","windsurf":"/api/rules/fastapi-python313-nogil-extension-isolation?format=windsurf","agents":"/api/rules/fastapi-python313-nogil-extension-isolation?format=agents"}},{"id":"pg17-failover-slot-logical-replication-ha","title":"PostgreSQL 17 Failover Slot Synchronization & Logical Replication HA Guardrail","category":"backend","severity":"critical","description":"Enforces seamless zero-loss, minimal-duplicate logical decoding across physical replica failovers using Postgres 17 failover slot synchronization. Mandates failover: true on logical slots, standby slot synchronization via pg_sync_replication_slots(), and two-phase commit tracking. Prevents data divergence, silent slot invalidation, and runaway WAL bloat during planned switchovers and uncoordinated primary crashes.","antiPatternHeadline":"Unsynchronized Logical Slots Causing Stream Eviction, Catastrophic WAL Gaps, or Massive Stream Replays Post-Promotion","stars_count":70,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql-17","logical-replication","failover-slots","high-availability","event-sourcing","wal"],"exportEndpoints":{"claude":"/api/rules/pg17-failover-slot-logical-replication-ha?format=claude","cursorMdc":"/api/rules/pg17-failover-slot-logical-replication-ha?format=mdc","cursorrules":"/api/rules/pg17-failover-slot-logical-replication-ha?format=cursor","windsurf":"/api/rules/pg17-failover-slot-logical-replication-ha?format=windsurf","agents":"/api/rules/pg17-failover-slot-logical-replication-ha?format=agents"}},{"id":"go-1-24-context-cancellation-zero-alloc-ring-buffer","title":"Go 1.24 Context Cancellation Propagation & Zero-Allocation Ring Buffers","category":"backend","severity":"critical","description":"Enforces strict context cancellation tree propagation alongside zero-allocation lock-free ring buffer telemetry under sustained HTTP proxy load. Prevents orphan goroutine leaks, heap escape churn, and tail-latency degradation by leveraging Go 1.24 context.AfterFunc, context.WithoutCancel, and cacheline-padded atomic circular arrays.","antiPatternHeadline":"Orphaned Goroutine Leakage and GC Pause Spikes via Unbound Channels and Escaping Closures","stars_count":101,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","concurrency","performance","networking","latency"],"exportEndpoints":{"claude":"/api/rules/go-1-24-context-cancellation-zero-alloc-ring-buffer?format=claude","cursorMdc":"/api/rules/go-1-24-context-cancellation-zero-alloc-ring-buffer?format=mdc","cursorrules":"/api/rules/go-1-24-context-cancellation-zero-alloc-ring-buffer?format=cursor","windsurf":"/api/rules/go-1-24-context-cancellation-zero-alloc-ring-buffer?format=windsurf","agents":"/api/rules/go-1-24-context-cancellation-zero-alloc-ring-buffer?format=agents"}},{"id":"tetragon-ebpf-syscall-ringbuffer-invariants","title":"Tetragon eBPF Synchronous Namespace Containment and Ring-Buffer Flow Invariants","category":"devops","severity":"critical","description":"Enforces deterministic, synchronous kernel-space enforcement using Tetragon TracingPolicies rather than asynchronous userspace audit consumers. Guarantees zero-loss telemetry under extreme I/O saturation by configuring dedicated BPF perf/ring buffer sizing, per-CPU memory reservation, and mandatory synchronous SIGKILL/kprobe action responses on container escape attempts.","antiPatternHeadline":"Asynchronous Userspace Filtering and Unbounded BPF Event Buffers Causing Event Drops and Escape Window","stars_count":43,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","tetragon","security","kernel","kubernetes"],"exportEndpoints":{"claude":"/api/rules/tetragon-ebpf-syscall-ringbuffer-invariants?format=claude","cursorMdc":"/api/rules/tetragon-ebpf-syscall-ringbuffer-invariants?format=mdc","cursorrules":"/api/rules/tetragon-ebpf-syscall-ringbuffer-invariants?format=cursor","windsurf":"/api/rules/tetragon-ebpf-syscall-ringbuffer-invariants?format=windsurf","agents":"/api/rules/tetragon-ebpf-syscall-ringbuffer-invariants?format=agents"}},{"id":"wasi-02-component-sandbox-fuel-quota-standard","title":"WASI 0.2 Component Sandboxing with Strict Fuel Budgeting and Linear Memory Limits","category":"devops","severity":"critical","description":"Host runtimes embedding untrusted WASI 0.2 components must enforce deterministic execution via fuel metering and strict linear memory growth limits through a custom ResourceLimiter. Unbounded component instances can exhaust host microVM memory pages and starve CPU threads, leading to host-level OOM kills and denial of service across co-located tenants.","antiPatternHeadline":"Instantiating untrusted WASI components with default engine configs and unbounded memory growth","stars_count":43,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","wasm","wasi","wasmtime","sandboxing","security","edge-computing"],"exportEndpoints":{"claude":"/api/rules/wasi-02-component-sandbox-fuel-quota-standard?format=claude","cursorMdc":"/api/rules/wasi-02-component-sandbox-fuel-quota-standard?format=mdc","cursorrules":"/api/rules/wasi-02-component-sandbox-fuel-quota-standard?format=cursor","windsurf":"/api/rules/wasi-02-component-sandbox-fuel-quota-standard?format=windsurf","agents":"/api/rules/wasi-02-component-sandbox-fuel-quota-standard?format=agents"}},{"id":"react-19-server-actions-useoptimistic-reconciliation","title":"Deterministic Rollback Semantics and Optimistic Reconciliation in React 19","category":"frontend","severity":"critical","description":"Governs state reconciliation across concurrent Server Actions and React 19 useOptimistic projections. Guarantees deterministic rollbacks, prevents visual tearing from out-of-order async resolutions, and enforces immutable transition pipelines.","antiPatternHeadline":"Unsequenced Out-of-Order Optimistic Mutations and Ad-Hoc Rollback State Causing UI Tearing","stars_count":115,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","useOptimistic","server-actions","concurrency","state-reconciliation"],"exportEndpoints":{"claude":"/api/rules/react-19-server-actions-useoptimistic-reconciliation?format=claude","cursorMdc":"/api/rules/react-19-server-actions-useoptimistic-reconciliation?format=mdc","cursorrules":"/api/rules/react-19-server-actions-useoptimistic-reconciliation?format=cursor","windsurf":"/api/rules/react-19-server-actions-useoptimistic-reconciliation?format=windsurf","agents":"/api/rules/react-19-server-actions-useoptimistic-reconciliation?format=agents"}},{"id":"fastapi-lifespan-taskgroup-cancellation-standard","title":"FastAPI Lifespan Structured Concurrency & TaskGroup Graceful Cancellation","category":"backend","severity":"critical","description":"Enforces deterministic structured concurrency within FastAPI lifespan contexts using Python 3.11+ TaskGroups or AnyIO task groups. Prevents unhandled dangling coroutines, post-teardown execution against closed connection pools, and unorderly process termination across multi-worker ASGI environments during SIGTERM/SIGINT events.","antiPatternHeadline":"Unscoped fire-and-forget asyncio.create_task calls causing worker shutdown corruption and orphaned coroutines","stars_count":116,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","asyncio","python","taskgroup","concurrency","lifespan"],"exportEndpoints":{"claude":"/api/rules/fastapi-lifespan-taskgroup-cancellation-standard?format=claude","cursorMdc":"/api/rules/fastapi-lifespan-taskgroup-cancellation-standard?format=mdc","cursorrules":"/api/rules/fastapi-lifespan-taskgroup-cancellation-standard?format=cursor","windsurf":"/api/rules/fastapi-lifespan-taskgroup-cancellation-standard?format=windsurf","agents":"/api/rules/fastapi-lifespan-taskgroup-cancellation-standard?format=agents"}},{"id":"openfga-rebac-graph-coherency-bounded-traversal","title":"OpenFGA ReBAC Graph Evaluation and Cache Coherency Guardrails","category":"security","severity":"critical","description":"Enforces bounded traversal depth, strict cycle detection, and consistency-token validation during Relationship-Based Access Control (ReBAC) graph evaluations at scale. Prevents authorization bypasses caused by stale cache replication lag and eliminates denial-of-service vulnerabilities driven by unbounded recursive graph expansion.","antiPatternHeadline":"Unbounded ReBAC graph expansion with stale or unversioned distributed cache reads permitting unauthorized access after permission revocation.","stars_count":88,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","rebac","zanzibar","cache-coherency","graph-traversal"],"exportEndpoints":{"claude":"/api/rules/openfga-rebac-graph-coherency-bounded-traversal?format=claude","cursorMdc":"/api/rules/openfga-rebac-graph-coherency-bounded-traversal?format=mdc","cursorrules":"/api/rules/openfga-rebac-graph-coherency-bounded-traversal?format=cursor","windsurf":"/api/rules/openfga-rebac-graph-coherency-bounded-traversal?format=windsurf","agents":"/api/rules/openfga-rebac-graph-coherency-bounded-traversal?format=agents"}},{"id":"webauthn-l3-prf-deterministic-vaulting-security","title":"WebAuthn Level 3 PRF Zero-Knowledge Deterministic Key Vaulting Standard","category":"security","severity":"critical","description":"Enforces strict client-side isolation and rigorous cryptographic derivation standards for WebAuthn Level 3 PRF (Pseudo-Random Function) extensions. Protects zero-knowledge client architectures by forbidding server-bound transmission of PRF outputs, mandating HKDF domain separation, and enforcing non-exportable CryptoKey lifecycle handling.","antiPatternHeadline":"Exposing Raw Authenticator PRF Outputs to Servers or Omitting Cryptographic HKDF Context Binding","stars_count":83,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","passkeys","prf-extension","zero-knowledge","webcrypto","key-vaulting"],"exportEndpoints":{"claude":"/api/rules/webauthn-l3-prf-deterministic-vaulting-security?format=claude","cursorMdc":"/api/rules/webauthn-l3-prf-deterministic-vaulting-security?format=mdc","cursorrules":"/api/rules/webauthn-l3-prf-deterministic-vaulting-security?format=cursor","windsurf":"/api/rules/webauthn-l3-prf-deterministic-vaulting-security?format=windsurf","agents":"/api/rules/webauthn-l3-prf-deterministic-vaulting-security?format=agents"}},{"id":"pg17-json-table-memory-bounds-streaming","title":"PostgreSQL 17 JSON_TABLE Memory Bounds and Streaming Projection Invariants","category":"backend","severity":"critical","description":"Enforces strict memory ceilings, bounded path evaluations, and deterministic cardinality controls when projecting JSONB payloads using PostgreSQL 17 JSON_TABLE. Eliminates backend work_mem exhaustion, temp file disk spills, and query planner degradation caused by unbounded document materialization and lax nested array evaluations.","antiPatternHeadline":"Unbounded JSON_TABLE Projections with Lax Path Expansions and Unconstrained Document Materialization","stars_count":90,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","json-table","sql-json","performance","memory-management","query-optimization"],"exportEndpoints":{"claude":"/api/rules/pg17-json-table-memory-bounds-streaming?format=claude","cursorMdc":"/api/rules/pg17-json-table-memory-bounds-streaming?format=mdc","cursorrules":"/api/rules/pg17-json-table-memory-bounds-streaming?format=cursor","windsurf":"/api/rules/pg17-json-table-memory-bounds-streaming?format=windsurf","agents":"/api/rules/pg17-json-table-memory-bounds-streaming?format=agents"}},{"id":"bun-worker-sharedarraybuffer-zero-copy-concurrency","title":"Bun 1.2 Clustered Worker Zero-Copy SharedBuffer Invariants","category":"backend","severity":"critical","description":"Mandates zero-copy shared memory architectures using SharedArrayBuffer and Atomics for Bun 1.2 worker thread pools processing high-bandwidth I/O. Eliminates Structured Clone serialization overhead, V8/JSC heap churn, and cross-thread garbage collection pressure during concurrent stream processing.","antiPatternHeadline":"Structured-Clone Serialization Bottlenecks and Unsynchronized Buffer Mutation Across Worker Pools","stars_count":65,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","concurrency","sharedarraybuffer","workers","zero-copy","atomics"],"exportEndpoints":{"claude":"/api/rules/bun-worker-sharedarraybuffer-zero-copy-concurrency?format=claude","cursorMdc":"/api/rules/bun-worker-sharedarraybuffer-zero-copy-concurrency?format=mdc","cursorrules":"/api/rules/bun-worker-sharedarraybuffer-zero-copy-concurrency?format=cursor","windsurf":"/api/rules/bun-worker-sharedarraybuffer-zero-copy-concurrency?format=windsurf","agents":"/api/rules/bun-worker-sharedarraybuffer-zero-copy-concurrency?format=agents"}},{"id":"ebpf-tetragon-in-path-enforcement-production-standard","title":"eBPF Tetragon In-Path Execution Termination and Namespace Isolation Guardrail","category":"devops","severity":"critical","description":"Enforces synchronous, kernel-space process termination via Tetragon TracingPolicies using SIGKILL (Sigkill action) at the sys_enter probe point for prohibited syscalls and namespace escapes. Eliminates reliance on asynchronous user-space audit daemons that allow race conditions and post-exploit persistence before user-space alerting takes place.","antiPatternHeadline":"Post-Exploitation User-Space Audit Lag Allowing Syscall Execution Completion","stars_count":116,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","tetragon","security","linux-kernel","kubernetes","cgroups"],"exportEndpoints":{"claude":"/api/rules/ebpf-tetragon-in-path-enforcement-production-standard?format=claude","cursorMdc":"/api/rules/ebpf-tetragon-in-path-enforcement-production-standard?format=mdc","cursorrules":"/api/rules/ebpf-tetragon-in-path-enforcement-production-standard?format=cursor","windsurf":"/api/rules/ebpf-tetragon-in-path-enforcement-production-standard?format=windsurf","agents":"/api/rules/ebpf-tetragon-in-path-enforcement-production-standard?format=agents"}},{"id":"cmp-skiko-rendering-thread-decoupling","title":"Compose Multiplatform Skiko Rendering Thread Decoupling Standard","category":"mobile","severity":"critical","description":"Enforces strict isolation between Compose snapshot state mutations, heavy data transformations, and Skiko's hardware vsync render dispatch loop (CADisplayLink on iOS and Choreographer on Android). Prevents hitching, dropped frames, and Skia draw command bottlenecks by deferring heavy calculations off the main rendering path and restricting drawing blocks to pure Skiko operations.","antiPatternHeadline":"Executing Non-Visual State Computation, Blocking Layout Logic, or Heavy Math Inside Compose Draw Phases and Direct Skiko Render Passes","stars_count":97,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","compose-multiplatform","skiko","rendering-pipeline","performance","kotlin"],"exportEndpoints":{"claude":"/api/rules/cmp-skiko-rendering-thread-decoupling?format=claude","cursorMdc":"/api/rules/cmp-skiko-rendering-thread-decoupling?format=mdc","cursorrules":"/api/rules/cmp-skiko-rendering-thread-decoupling?format=cursor","windsurf":"/api/rules/cmp-skiko-rendering-thread-decoupling?format=windsurf","agents":"/api/rules/cmp-skiko-rendering-thread-decoupling?format=agents"}},{"id":"react-19-server-actions-optimistic-isolation","title":"React 19 Server Actions Optimistic State Isolation & Sequence Invariance","category":"frontend","severity":"critical","description":"Enforces deterministic state isolation when interleaving React 19 useActionState and useOptimistic during high-frequency concurrent mutations. Prevents UI tearing and out-of-order state reconciliation in collaborative workspaces by tethering optimistic updates strictly to canonical server action base state. Eliminates synchronization race conditions by strictly disallowing intermediate useState synchronization layers.","antiPatternHeadline":"Leaking unversioned local state buffers across useOptimistic boundaries during rapid concurrent Server Action executions","stars_count":81,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","server-actions","useOptimistic","useActionState","concurrency"],"exportEndpoints":{"claude":"/api/rules/react-19-server-actions-optimistic-isolation?format=claude","cursorMdc":"/api/rules/react-19-server-actions-optimistic-isolation?format=mdc","cursorrules":"/api/rules/react-19-server-actions-optimistic-isolation?format=cursor","windsurf":"/api/rules/react-19-server-actions-optimistic-isolation?format=windsurf","agents":"/api/rules/react-19-server-actions-optimistic-isolation?format=agents"}},{"id":"svelte-5-runes-boundary-signal-leakage-prevention","title":"Svelte 5 Universal Runes Boundary & Signal Leakage Prevention","category":"frontend","severity":"critical","description":"Enforces strict boundary encapsulation between Svelte 5 fine-grained reactive signals ($state, $derived, $effect) and external un-tracked DOM cycles or universal runtime singletons. Eliminates memory leaks and uncollected component subtrees caused by escaped reactive closures and unmanaged effect roots.","antiPatternHeadline":"Escaping Reactive Signal Graphs into Long-Lived DOM Handlers and Uncontained Universal Modules","stars_count":110,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","signals","memory-leaks","reactivity"],"exportEndpoints":{"claude":"/api/rules/svelte-5-runes-boundary-signal-leakage-prevention?format=claude","cursorMdc":"/api/rules/svelte-5-runes-boundary-signal-leakage-prevention?format=mdc","cursorrules":"/api/rules/svelte-5-runes-boundary-signal-leakage-prevention?format=cursor","windsurf":"/api/rules/svelte-5-runes-boundary-signal-leakage-prevention?format=windsurf","agents":"/api/rules/svelte-5-runes-boundary-signal-leakage-prevention?format=agents"}},{"id":"pg17-logical-replication-failover-slot-sync","title":"PostgreSQL 17 Logical Replication Failover Slot Synchronization and Zero-Lag Subscriber Migration","category":"backend","severity":"critical","description":"PostgreSQL 17 introduces native logical replication failover slot synchronization (`sync_replication_slots` and `failover = true`). When orchestrating high-availability database clusters, downstream subscribers must never point to logical replication slots that are unmanaged by physical standbys, nor fail over without verifying `synchronized_standby_slots` on the primary and slot confirmation on the promoted node to prevent data loss or duplicate stream processing.","antiPatternHeadline":"Creating un-synchronized logical slots or performing subscriber cutover without validating slot LSN advancement across physical replicas","stars_count":46,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql-17","logical-replication","failover-slots","high-availability"],"exportEndpoints":{"claude":"/api/rules/pg17-logical-replication-failover-slot-sync?format=claude","cursorMdc":"/api/rules/pg17-logical-replication-failover-slot-sync?format=mdc","cursorrules":"/api/rules/pg17-logical-replication-failover-slot-sync?format=cursor","windsurf":"/api/rules/pg17-logical-replication-failover-slot-sync?format=windsurf","agents":"/api/rules/pg17-logical-replication-failover-slot-sync?format=agents"}},{"id":"bun-deterministic-native-addon-queue-standard","title":"Bun 1.2 Native Addon Boundary & Deterministic Async Queue Standard","category":"backend","severity":"critical","description":"Enforces deterministic backpressure and thread isolation when executing C++ native addons (Node-API/Bun FFI) alongside high-throughput TypeScript edge workers in Bun 1.2. Prevents JavaScriptCore (JSC) microtask starvation, event-loop lag, and unmanaged native memory heap thrashing by mandating off-main-thread execution and bounded queue scheduling.","antiPatternHeadline":"Executing blocking C++ FFI bindings synchronously on the main thread inside concurrent microtask chains, starving JSC event-loop ticks.","stars_count":98,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["bun","typescript","native-addons","ffi","concurrency","backend","event-loop"],"exportEndpoints":{"claude":"/api/rules/bun-deterministic-native-addon-queue-standard?format=claude","cursorMdc":"/api/rules/bun-deterministic-native-addon-queue-standard?format=mdc","cursorrules":"/api/rules/bun-deterministic-native-addon-queue-standard?format=cursor","windsurf":"/api/rules/bun-deterministic-native-addon-queue-standard?format=windsurf","agents":"/api/rules/bun-deterministic-native-addon-queue-standard?format=agents"}},{"id":"openfga-rebac-realtime-invalidation-standard","title":"OpenFGA ReBAC Real-Time Transactional Cache Invalidation Guardrail","category":"security","severity":"critical","description":"Enforces strict transactional synchronization and cluster-wide invalidation semantics between OpenFGA tuple mutations and distributed evaluation caches. Mitigates stale privilege escalation and race conditions by banning uncoordinated TTL-based policy caching and fire-and-forget invalidation. Mandates transactional outbox or distributed broadcast barriers to achieve deterministic, sub-millisecond cache evictions across all evaluation nodes.","antiPatternHeadline":"Unsynchronized TTL-Only Caching and Fire-and-Forget Tuple Revocation","stars_count":86,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","rebac","authorization","cache-invalidation","distributed-systems"],"exportEndpoints":{"claude":"/api/rules/openfga-rebac-realtime-invalidation-standard?format=claude","cursorMdc":"/api/rules/openfga-rebac-realtime-invalidation-standard?format=mdc","cursorrules":"/api/rules/openfga-rebac-realtime-invalidation-standard?format=cursor","windsurf":"/api/rules/openfga-rebac-realtime-invalidation-standard?format=windsurf","agents":"/api/rules/openfga-rebac-realtime-invalidation-standard?format=agents"}},{"id":"webauthn-l3-hardware-attestation-device-bound-assertion","title":"Mandatory WebAuthn L3 Hardware Attestation and Device-Bound Cryptographic Assertion","category":"security","severity":"critical","description":"Enforces strict FIDO2/WebAuthn Level 3 hardware attestation verification and requires User Presence (UP) and User Verification (UV) flags on all device-bound assertions. Rejects passkey registrations lacking verified direct/enterprise hardware-backed cryptographic roots (TPM, Apple Secure Enclave, Android StrongBox) and binds the resulting authenticated sessions to ephemeral TLS-channel or client-data token binding to neutralize Adversary-in-the-Middle (AitM) session hijacking.","antiPatternHeadline":"Accepting 'none' attestation, ignoring hardware root trust anchors, or verifying WebAuthn assertions without strict challenge, origin, and UV/UP flag enforcement","stars_count":76,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","passkeys","fido2","cryptography","hardware-security","aitm-defense"],"exportEndpoints":{"claude":"/api/rules/webauthn-l3-hardware-attestation-device-bound-assertion?format=claude","cursorMdc":"/api/rules/webauthn-l3-hardware-attestation-device-bound-assertion?format=mdc","cursorrules":"/api/rules/webauthn-l3-hardware-attestation-device-bound-assertion?format=cursor","windsurf":"/api/rules/webauthn-l3-hardware-attestation-device-bound-assertion?format=windsurf","agents":"/api/rules/webauthn-l3-hardware-attestation-device-bound-assertion?format=agents"}},{"id":"kmp-arc-retain-cycle-elimination-native-ios","title":"Kotlin Multiplatform ARC Retain-Cycle Elimination in Native iOS Runtimes","category":"mobile","severity":"critical","description":"Enforces strict boundary lifecycle decoupling between Swift ARC and Kotlin/Native garbage-collected runtimes. Bidirectional cross-runtime strong references prevent deallocation across runtime boundaries, creating permanent memory leaks and triggering iOS jetsam background termination crashes.","antiPatternHeadline":"Bidirectional Strong Bridging Between Swift ARC Delegates and Kotlin/Native Observables","stars_count":109,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kmp","kotlin-native","ios","swift","arc","memory-management"],"exportEndpoints":{"claude":"/api/rules/kmp-arc-retain-cycle-elimination-native-ios?format=claude","cursorMdc":"/api/rules/kmp-arc-retain-cycle-elimination-native-ios?format=mdc","cursorrules":"/api/rules/kmp-arc-retain-cycle-elimination-native-ios?format=cursor","windsurf":"/api/rules/kmp-arc-retain-cycle-elimination-native-ios?format=windsurf","agents":"/api/rules/kmp-arc-retain-cycle-elimination-native-ios?format=agents"}},{"id":"tauri-2-hardened-ipc-protocol-guardrails","title":"Tauri 2.0 Hardened IPC Protocol and Strict Schema Enforcement","category":"mobile","severity":"critical","description":"Enforces a zero-trust boundary between mobile WebViews and the native Rust core in Tauri 2.0 applications. Mandates compile-time generated type contracts and strict Serde deserialization to eliminate Remote Code Execution (RCE), command injection, and arbitrary memory mutation vectors. Requires complete prohibition of unconstrained payload passing and untyped invoke channels.","antiPatternHeadline":"Unvalidated Raw String and Untyped Object Passing Over WebView-to-Rust IPC Channels","stars_count":71,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri-v2","ipc-security","rust","specta","appsec"],"exportEndpoints":{"claude":"/api/rules/tauri-2-hardened-ipc-protocol-guardrails?format=claude","cursorMdc":"/api/rules/tauri-2-hardened-ipc-protocol-guardrails?format=mdc","cursorrules":"/api/rules/tauri-2-hardened-ipc-protocol-guardrails?format=cursor","windsurf":"/api/rules/tauri-2-hardened-ipc-protocol-guardrails?format=windsurf","agents":"/api/rules/tauri-2-hardened-ipc-protocol-guardrails?format=agents"}},{"id":"opentelemetry-ebpf-continuous-context-propagation-standard","title":"OpenTelemetry eBPF Kernel-Space Continuous Context Propagation Invariants","category":"devops","severity":"critical","description":"Enforces deterministic W3C trace context propagation and network topology discovery via eBPF kernel probes without runtime SDK overhead. Guards against context severance at user-space TLS encryption boundaries, thread scheduler asynchronous hops, and duplicate traceparent injection collisions.","antiPatternHeadline":"Fragmented Distributed Traces and Context Severance Caused by Uncoordinated TLS Socket Probing and Manual Header Mutation","stars_count":87,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","ebpf","distributed-tracing","observability","linux-kernel","beyla"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-ebpf-continuous-context-propagation-standard?format=claude","cursorMdc":"/api/rules/opentelemetry-ebpf-continuous-context-propagation-standard?format=mdc","cursorrules":"/api/rules/opentelemetry-ebpf-continuous-context-propagation-standard?format=cursor","windsurf":"/api/rules/opentelemetry-ebpf-continuous-context-propagation-standard?format=windsurf","agents":"/api/rules/opentelemetry-ebpf-continuous-context-propagation-standard?format=agents"}},{"id":"k8s-gateway-api-v1-2-canary-shifting","title":"Kubernetes Gateway API v1.2 Progressive Canary Traffic Shifting Standards","category":"devops","severity":"critical","description":"Standardizes vendor-agnostic Layer 7 progressive canary traffic shifting using Kubernetes Gateway API v1.2 specifications. Mandates explicit backend weights, standardized timeouts, zero proprietary ingress annotations, and deterministic rollback targets across hybrid multi-cloud clusters.","antiPatternHeadline":"Proprietary Ingress Annotations and Unweighted Backend Switches Causing Traffic Drops and Broken Rollbacks","stars_count":41,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","kubernetes","gateway-api","canary-deployment","progressive-delivery","traffic-management"],"exportEndpoints":{"claude":"/api/rules/k8s-gateway-api-v1-2-canary-shifting?format=claude","cursorMdc":"/api/rules/k8s-gateway-api-v1-2-canary-shifting?format=mdc","cursorrules":"/api/rules/k8s-gateway-api-v1-2-canary-shifting?format=cursor","windsurf":"/api/rules/k8s-gateway-api-v1-2-canary-shifting?format=windsurf","agents":"/api/rules/k8s-gateway-api-v1-2-canary-shifting?format=agents"}},{"id":"react19-server-component-tainted-object-boundary","title":"React 19 Server Component Tainted Object Invariant","category":"frontend","severity":"critical","description":"Enforces strict boundary isolation for sensitive server-side payloads using React 19 experimental taint APIs. Guarantees that raw database models, authorization secrets, and sensitive tokens cannot be serialized and passed across the Server-to-Client component boundary, mandating explicit projection to client-safe Data Transfer Objects (DTOs).","antiPatternHeadline":"Passing Untainted Raw Server Entities or Secrets Directly Across the RSC Serialization Boundary","stars_count":70,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react19","rsc","security","taint-api","nextjs"],"exportEndpoints":{"claude":"/api/rules/react19-server-component-tainted-object-boundary?format=claude","cursorMdc":"/api/rules/react19-server-component-tainted-object-boundary?format=mdc","cursorrules":"/api/rules/react19-server-component-tainted-object-boundary?format=cursor","windsurf":"/api/rules/react19-server-component-tainted-object-boundary?format=windsurf","agents":"/api/rules/react19-server-component-tainted-object-boundary?format=agents"}},{"id":"fastapi-lifespan-taskgroup-structured-concurrency","title":"FastAPI Lifespan Structured Concurrency with Python 3.12+ TaskGroup","category":"backend","severity":"critical","description":"Enforces strict structured concurrency within FastAPI application lifespans using Python 3.12+ asyncio.TaskGroup and ASGI state propagation. Eliminates leaked zombie coroutines, dropped telemetry/event batches, and non-deterministic SIGTERM teardowns during container orchestration draining.","antiPatternHeadline":"Unbounded asyncio.create_task in FastAPI routes/events leading to orphaned coroutines on SIGTERM shutdown","stars_count":71,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","python","fastapi","asyncio","structured-concurrency","uvicorn"],"exportEndpoints":{"claude":"/api/rules/fastapi-lifespan-taskgroup-structured-concurrency?format=claude","cursorMdc":"/api/rules/fastapi-lifespan-taskgroup-structured-concurrency?format=mdc","cursorrules":"/api/rules/fastapi-lifespan-taskgroup-structured-concurrency?format=cursor","windsurf":"/api/rules/fastapi-lifespan-taskgroup-structured-concurrency?format=windsurf","agents":"/api/rules/fastapi-lifespan-taskgroup-structured-concurrency?format=agents"}},{"id":"pgvector-08-hnsw-partitioned-maintenance-standard","title":"pgvector 0.8 HNSW Partitioned Indexing and Parallel Worker Configuration Standard","category":"backend","severity":"critical","description":"Enforces strict partition-aligned HNSW indexing, deterministic parallel index creation, and maintenance work memory allocations for pgvector 0.8+ on PostgreSQL 17. Unpartitioned global HNSW indexes on multi-million row datasets exhaust shared buffers and cause catastrophic tail latency spikes (p99 > 4000ms) during concurrent writes and background vacuuming.","antiPatternHeadline":"Global Unpartitioned HNSW Vector Indexing with Default Worker and Memory Configuration","stars_count":119,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","pgvector","hnsw","database-migrations","performance"],"exportEndpoints":{"claude":"/api/rules/pgvector-08-hnsw-partitioned-maintenance-standard?format=claude","cursorMdc":"/api/rules/pgvector-08-hnsw-partitioned-maintenance-standard?format=mdc","cursorrules":"/api/rules/pgvector-08-hnsw-partitioned-maintenance-standard?format=cursor","windsurf":"/api/rules/pgvector-08-hnsw-partitioned-maintenance-standard?format=windsurf","agents":"/api/rules/pgvector-08-hnsw-partitioned-maintenance-standard?format=agents"}},{"id":"bun-websocket-backpressure-drain-guardrail","title":"Bun 1.2 Native WebSocket Backpressure & Drain Guardrail","category":"backend","severity":"critical","description":"Enforces strict backpressure monitoring and zero-allocation drain lifecycle handling on Bun native WebSockets. Mandates buffer bounds checking and consumer eviction via getBufferedAmount() to prevent edge runtime OOM crashes during asymmetric pub/sub fan-outs.","antiPatternHeadline":"Blind socket fan-out broadcasting without drain handlers or buffered amount limits, causing unbounded buffer accumulation and SIGKILL OOMs.","stars_count":64,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","websockets","performance","memory-leak","backpressure"],"exportEndpoints":{"claude":"/api/rules/bun-websocket-backpressure-drain-guardrail?format=claude","cursorMdc":"/api/rules/bun-websocket-backpressure-drain-guardrail?format=mdc","cursorrules":"/api/rules/bun-websocket-backpressure-drain-guardrail?format=cursor","windsurf":"/api/rules/bun-websocket-backpressure-drain-guardrail?format=windsurf","agents":"/api/rules/bun-websocket-backpressure-drain-guardrail?format=agents"}},{"id":"tauri2-mobile-ipc-capability-scoping-production-standard","title":"Tauri 2.0 IPC Capability Scoping & Granular Permission Manifest Guardrail","category":"mobile","severity":"critical","description":"Enforces strict compile-time capability isolation and explicit JSON permission manifests across all Tauri 2.0 multi-webview mobile architectures. Prevents cross-webview privilege escalation and remote code execution by ensuring non-trusted contexts and secondary remote webviews cannot access native platform APIs through wildcard IPC bridges.","antiPatternHeadline":"Over-Privileged Wildcard Capabilities Exposing Native APIs to Untrusted Mobile Webviews","stars_count":46,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri-2","ipc-security","capabilities","zero-trust"],"exportEndpoints":{"claude":"/api/rules/tauri2-mobile-ipc-capability-scoping-production-standard?format=claude","cursorMdc":"/api/rules/tauri2-mobile-ipc-capability-scoping-production-standard?format=mdc","cursorrules":"/api/rules/tauri2-mobile-ipc-capability-scoping-production-standard?format=cursor","windsurf":"/api/rules/tauri2-mobile-ipc-capability-scoping-production-standard?format=windsurf","agents":"/api/rules/tauri2-mobile-ipc-capability-scoping-production-standard?format=agents"}},{"id":"capacitor-7-bridge-lifecycle-suspension-invariant","title":"Capacitor 7 Native Bridge Lifecycle Barrier & Background Suspension Invariant","category":"mobile","severity":"critical","description":"Enforces deterministic transactional synchronization of asynchronous native bridge queues prior to OS-level process suspension. Prevents WebKit IPC message pipe truncation, broken Promise resolutions, and memory snapshot desynchronization across iOS 18 aggressive suspension and Android 15 cached app freezing.","antiPatternHeadline":"Unbounded Fire-and-Forget Native Bridge Dispatches During App Background Transitions","stars_count":72,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor7","ios18","android15","lifecycle","background-fetch","native-bridge"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-bridge-lifecycle-suspension-invariant?format=claude","cursorMdc":"/api/rules/capacitor-7-bridge-lifecycle-suspension-invariant?format=mdc","cursorrules":"/api/rules/capacitor-7-bridge-lifecycle-suspension-invariant?format=cursor","windsurf":"/api/rules/capacitor-7-bridge-lifecycle-suspension-invariant?format=windsurf","agents":"/api/rules/capacitor-7-bridge-lifecycle-suspension-invariant?format=agents"}},{"id":"spiffe-spire-workload-attestation-mtls-rotation","title":"Zero-Trust Ephemeral Workload Attestation via SPIFFE/SPIRE Workload API & Dynamic mTLS Rotation","category":"security","severity":"critical","description":"Enforces dynamic, cryptographic workload identity using the SPIFFE Workload API over Unix Domain Sockets to obtain short-lived X.509 SVIDs and SPIFFE trust bundles. Mandates streaming SVID auto-rotation directly into TLS handshake listeners to eliminate static API tokens, long-lived certificates on disk, and service restarts during credential rollover.","antiPatternHeadline":"Persisting static certificates or API tokens on disk and failing to dynamically stream X.509 SVID rotations via the Workload API.","stars_count":93,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","spiffe","spire","zero-trust","mtls","x509-svid","cryptography"],"exportEndpoints":{"claude":"/api/rules/spiffe-spire-workload-attestation-mtls-rotation?format=claude","cursorMdc":"/api/rules/spiffe-spire-workload-attestation-mtls-rotation?format=mdc","cursorrules":"/api/rules/spiffe-spire-workload-attestation-mtls-rotation?format=cursor","windsurf":"/api/rules/spiffe-spire-workload-attestation-mtls-rotation?format=windsurf","agents":"/api/rules/spiffe-spire-workload-attestation-mtls-rotation?format=agents"}},{"id":"k8s-gateway-v1-2-cross-namespace-policy-attachment-standard","title":"Kubernetes Gateway API v1.2 Cross-Namespace Policy Attachment and TLS Isolation","category":"devops","severity":"critical","description":"Enforces strict tenant boundary isolation across Kubernetes Gateway API v1.2 resources by requiring explicit ReferenceGrant objects for all cross-namespace route and secret attachments. Mandates hierarchical TLS termination invariants at the Gateway listener level to block unauthorized edge hostname hijacking and route overrides by untrusted tenant namespaces.","antiPatternHeadline":"Attaching cross-namespace HTTPRoutes or referencing tenant Secrets without an explicit ReferenceGrant and bounded listener allowedRoutes.","stars_count":92,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","kubernetes","gateway-api","security","tls","rbac"],"exportEndpoints":{"claude":"/api/rules/k8s-gateway-v1-2-cross-namespace-policy-attachment-standard?format=claude","cursorMdc":"/api/rules/k8s-gateway-v1-2-cross-namespace-policy-attachment-standard?format=mdc","cursorrules":"/api/rules/k8s-gateway-v1-2-cross-namespace-policy-attachment-standard?format=cursor","windsurf":"/api/rules/k8s-gateway-v1-2-cross-namespace-policy-attachment-standard?format=windsurf","agents":"/api/rules/k8s-gateway-v1-2-cross-namespace-policy-attachment-standard?format=agents"}},{"id":"otel-w3c-baggage-mutation-guardrail","title":"OpenTelemetry W3C Baggage Mutation and Cardinality Guardrail","category":"devops","severity":"critical","description":"Enforces deterministic validation, strict allowlisting, and byte-budget ceilings on W3C Baggage propagation across distributed tracing contexts. Prevents high-cardinality payloads, sensitive telemetry leakage, and collector memory exhaustion caused by unbounded downstream header amplification.","antiPatternHeadline":"Unrestricted runtime injection of dynamic, high-cardinality baggage metadata across W3C distributed trace contexts","stars_count":94,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","distributed-tracing","observability","w3c-trace-context","cardinality-control"],"exportEndpoints":{"claude":"/api/rules/otel-w3c-baggage-mutation-guardrail?format=claude","cursorMdc":"/api/rules/otel-w3c-baggage-mutation-guardrail?format=mdc","cursorrules":"/api/rules/otel-w3c-baggage-mutation-guardrail?format=cursor","windsurf":"/api/rules/otel-w3c-baggage-mutation-guardrail?format=windsurf","agents":"/api/rules/otel-w3c-baggage-mutation-guardrail?format=agents"}},{"id":"react-19-server-actions-idempotency-optimistic-boundaries","title":"React 19 Server Actions Idempotency Keys and Optimistic State Rollback Invariants","category":"frontend","severity":"critical","description":"Enforces strict client-generated UUIDv7 or nanoid idempotency tokens for all mutating React 19 Server Actions, coupled with non-blocking useOptimistic state bindings. Guarantees deterministic rollback upon action failure, prevents dual execution under network retries, and eliminates UI drift across concurrent distributed transitions.","antiPatternHeadline":"Non-Idempotent Server Action Submissions with Blocking or Un-Rollbackable Optimistic State","stars_count":81,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","server-actions","use-optimistic","idempotency","distributed-systems"],"exportEndpoints":{"claude":"/api/rules/react-19-server-actions-idempotency-optimistic-boundaries?format=claude","cursorMdc":"/api/rules/react-19-server-actions-idempotency-optimistic-boundaries?format=mdc","cursorrules":"/api/rules/react-19-server-actions-idempotency-optimistic-boundaries?format=cursor","windsurf":"/api/rules/react-19-server-actions-idempotency-optimistic-boundaries?format=windsurf","agents":"/api/rules/react-19-server-actions-idempotency-optimistic-boundaries?format=agents"}},{"id":"pg17-pooled-rls-partition-invariants","title":"PostgreSQL 17 Transaction-Pooled RLS and Declarative Partition Invariants","category":"backend","severity":"critical","description":"Enforces deterministic multi-tenant isolation under high-throughput PgBouncer transaction pooling and PostgreSQL 17 declarative partitioning. Mandates transaction-local context parameterization (`SET LOCAL`), mandatory `FORCE ROW LEVEL SECURITY` across parent and partition tables, and composite partition-key primary index integrity to guarantee zero cross-tenant bleeding and prevent bypasses during partition pruning or logical replication streaming.","antiPatternHeadline":"Leaking Tenant Context via Session-Scoped Variables and Unenforced Partition RLS Under Transaction Pooling","stars_count":100,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql-17","row-level-security","pgbouncer","declarative-partitioning","multi-tenancy"],"exportEndpoints":{"claude":"/api/rules/pg17-pooled-rls-partition-invariants?format=claude","cursorMdc":"/api/rules/pg17-pooled-rls-partition-invariants?format=mdc","cursorrules":"/api/rules/pg17-pooled-rls-partition-invariants?format=cursor","windsurf":"/api/rules/pg17-pooled-rls-partition-invariants?format=windsurf","agents":"/api/rules/pg17-pooled-rls-partition-invariants?format=agents"}},{"id":"bun-zero-copy-worker-stream-backpressure","title":"Zero-Copy Byte-Stream Serialization and Backpressure Guardrails for Bun 1.2 Worker Pools","category":"backend","severity":"critical","description":"Mandates explicit ownership transfers using ArrayBuffer transfer lists and strict backpressure propagation via ReadableStream and TransformStream over native Bun 1.2 multithreaded worker boundaries. Eliminates high-frequency structured clone CPU penalties, buffer duplication spikes, and unbounded heap exhaustion under stream contention.","antiPatternHeadline":"Unbounded ArrayBuffer Structured Cloning and Lost Backpressure Across Native Worker Boundaries","stars_count":83,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","zero-copy","worker-threads","streams","backpressure","performance"],"exportEndpoints":{"claude":"/api/rules/bun-zero-copy-worker-stream-backpressure?format=claude","cursorMdc":"/api/rules/bun-zero-copy-worker-stream-backpressure?format=mdc","cursorrules":"/api/rules/bun-zero-copy-worker-stream-backpressure?format=cursor","windsurf":"/api/rules/bun-zero-copy-worker-stream-backpressure?format=windsurf","agents":"/api/rules/bun-zero-copy-worker-stream-backpressure?format=agents"}},{"id":"go-chi5-context-propagation-graceful-drain","title":"Go Chi 5 Structured Context Propagation, Request Budgeting, and Graceful Concurrency Drain","category":"backend","severity":"critical","description":"Enforces strict context cancellation inheritance, timeout budgeting via Chi middleware, and robust worker drain coordination during rolling deployment OS signals. Prevents orphaned goroutines, detached context anti-patterns, and mid-flight connection resets on SIGTERM.","antiPatternHeadline":"Detaching context with context.Background() in Chi handlers and uncoordinated goroutine execution during SIGTERM shutdowns","stars_count":112,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","chi","concurrency","context","graceful-shutdown","goroutines"],"exportEndpoints":{"claude":"/api/rules/go-chi5-context-propagation-graceful-drain?format=claude","cursorMdc":"/api/rules/go-chi5-context-propagation-graceful-drain?format=mdc","cursorrules":"/api/rules/go-chi5-context-propagation-graceful-drain?format=cursor","windsurf":"/api/rules/go-chi5-context-propagation-graceful-drain?format=windsurf","agents":"/api/rules/go-chi5-context-propagation-graceful-drain?format=agents"}},{"id":"capacitor7-biometric-enclave-ipc-sandboxing","title":"Capacitor 7 Biometric Enclave Bridging & Secure IPC Sandboxing Standard","category":"mobile","severity":"critical","description":"Mandates hardware-backed cryptographic challenge signing across native Capacitor 7 IPC bridges, completely isolating biometric execution and key material from the WebView DOM. Prevents origin-spoofing and DOM-level injection exploits by eliminating naive boolean authentication flags and enforcing strict WebView scheme and origin verification.","antiPatternHeadline":"Trusting DOM-Level Boolean Auth Flags and Exposing Cryptographic Secrets Over Unvalidated Native IPC Bridges","stars_count":78,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["capacitor","mobile","security","biometrics","secure-enclave","ipc-hardening","webview-sandboxing"],"exportEndpoints":{"claude":"/api/rules/capacitor7-biometric-enclave-ipc-sandboxing?format=claude","cursorMdc":"/api/rules/capacitor7-biometric-enclave-ipc-sandboxing?format=mdc","cursorrules":"/api/rules/capacitor7-biometric-enclave-ipc-sandboxing?format=cursor","windsurf":"/api/rules/capacitor7-biometric-enclave-ipc-sandboxing?format=windsurf","agents":"/api/rules/capacitor7-biometric-enclave-ipc-sandboxing?format=agents"}},{"id":"openfga-zanzibar-cache-invalidation-invariants","title":"OpenFGA Zanzibar ReBAC Cache Synchronization & Consistency Token Invariants","category":"security","severity":"critical","description":"Prevents authorization bypass and stale permission windows (the 'New Enemy' problem) during rapid ReBAC relationship mutations. Mandates that distributed check caching strictly pairs with transactional tuple invalidation, versioned generation keys, or consistency token propagation rather than uncoordinated static TTLs.","antiPatternHeadline":"Uncoordinated Fixed-TTL Check Caching Allowing Revoked Access During Rapid Mutations","stars_count":83,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","rebac","zanzibar","caching","authorization"],"exportEndpoints":{"claude":"/api/rules/openfga-zanzibar-cache-invalidation-invariants?format=claude","cursorMdc":"/api/rules/openfga-zanzibar-cache-invalidation-invariants?format=mdc","cursorrules":"/api/rules/openfga-zanzibar-cache-invalidation-invariants?format=cursor","windsurf":"/api/rules/openfga-zanzibar-cache-invalidation-invariants?format=windsurf","agents":"/api/rules/openfga-zanzibar-cache-invalidation-invariants?format=agents"}},{"id":"webauthn-fido2-device-bound-attestation-invariants","title":"FIDO2 / WebAuthn Device-Bound Attestation and Step-Up Invariants","category":"security","severity":"critical","description":"Enforces strict origin validation, cryptographically random single-use ephemeral challenges, monotonic signature counter tracking for clone detection, and hardware-attested user verification for high-privilege step-up operations. Prevents credential phishing, replay attacks, token cloning, and cross-origin relay vulnerabilities.","antiPatternHeadline":"Accepting Untrusted Origins, Reusing Challenges, or Bypassing Monotonic SignCount Checks","stars_count":118,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","fido2","passkeys","cryptography","authentication","zero-trust"],"exportEndpoints":{"claude":"/api/rules/webauthn-fido2-device-bound-attestation-invariants?format=claude","cursorMdc":"/api/rules/webauthn-fido2-device-bound-attestation-invariants?format=mdc","cursorrules":"/api/rules/webauthn-fido2-device-bound-attestation-invariants?format=cursor","windsurf":"/api/rules/webauthn-fido2-device-bound-attestation-invariants?format=windsurf","agents":"/api/rules/webauthn-fido2-device-bound-attestation-invariants?format=agents"}},{"id":"ebpf-cilium-zero-trust-socket-l7-policy-invariants","title":"Cilium eBPF Kernel-Level L7 Inspection and Sidecarless mTLS Invariants","category":"devops","severity":"critical","description":"Enforces deterministic, socket-layer L7 egress filtering and kernel-level SPIFFE/SPIRE mutual authentication via Cilium eBPF sockops and sock_msg programs. Eliminates latency-intensive userspace Envoy sidecars while guaranteeing zero-trust fail-closed egress boundaries and cryptographic workload identity verification.","antiPatternHeadline":"Unvalidated L3/L4 Wildcard Egress Fallbacks and Unauthenticated Sidecarless Socket Bypasses","stars_count":79,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","cilium","zero-trust","mtls","kubernetes","network-policy"],"exportEndpoints":{"claude":"/api/rules/ebpf-cilium-zero-trust-socket-l7-policy-invariants?format=claude","cursorMdc":"/api/rules/ebpf-cilium-zero-trust-socket-l7-policy-invariants?format=mdc","cursorrules":"/api/rules/ebpf-cilium-zero-trust-socket-l7-policy-invariants?format=cursor","windsurf":"/api/rules/ebpf-cilium-zero-trust-socket-l7-policy-invariants?format=windsurf","agents":"/api/rules/ebpf-cilium-zero-trust-socket-l7-policy-invariants?format=agents"}},{"id":"opentelemetry-w3c-context-propagation-sampling-budget-standard","title":"OpenTelemetry W3C Distributed Context Propagation and Sampling Invariant Standard","category":"devops","severity":"critical","description":"Codifies mandatory W3C distributed trace context and baggage propagation across all asynchronous boundaries, RPC boundaries, and message queues. Enforces Parent-Based Ratio Head Sampling combined with Collector-level Tail-Based Sampling to prevent telemetry egress budget explosion while preserving 100% of anomalous and error spans.","antiPatternHeadline":"Orphaned Async Trace Islands and Egress Budget Blowouts via Unpropagated Context and Naive Head Sampling","stars_count":96,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","distributed-tracing","observability","w3c-trace-context","tail-sampling","cost-governance"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-w3c-context-propagation-sampling-budget-standard?format=claude","cursorMdc":"/api/rules/opentelemetry-w3c-context-propagation-sampling-budget-standard?format=mdc","cursorrules":"/api/rules/opentelemetry-w3c-context-propagation-sampling-budget-standard?format=cursor","windsurf":"/api/rules/opentelemetry-w3c-context-propagation-sampling-budget-standard?format=windsurf","agents":"/api/rules/opentelemetry-w3c-context-propagation-sampling-budget-standard?format=agents"}},{"id":"svelte-5-runes-lifecycle-boundary-invariant","title":"Svelte 5 Runes Universal Reactivity & Deep Mutation Boundary Standard","category":"frontend","severity":"critical","description":"Enforces strict state ownership, cleanup boundaries, and async lifecycle containment in Svelte 5 fine-grained reactivity. Prevents microtask race conditions, stale proxy mutations post-unmount, and uncontrolled proxy overhead on non-reactive external structures.","antiPatternHeadline":"Unbounded Async Mutations & Leaked Effect Proxies Across Svelte 5 Rune Boundaries","stars_count":63,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["svelte","svelte-5","runes","reactivity","lifecycle","frontend"],"exportEndpoints":{"claude":"/api/rules/svelte-5-runes-lifecycle-boundary-invariant?format=claude","cursorMdc":"/api/rules/svelte-5-runes-lifecycle-boundary-invariant?format=mdc","cursorrules":"/api/rules/svelte-5-runes-lifecycle-boundary-invariant?format=cursor","windsurf":"/api/rules/svelte-5-runes-lifecycle-boundary-invariant?format=windsurf","agents":"/api/rules/svelte-5-runes-lifecycle-boundary-invariant?format=agents"}},{"id":"vite6-rolldown-chunk-isolation-treeshaking","title":"Vite 6 & Rolldown: Deterministic Chunk Isolation and Pure Tree-Shaking","category":"frontend","severity":"critical","description":"Enforces strict module boundary isolation, explicit tree-shaking annotations, and deterministic chunk distribution for Vite 6 powered by Rolldown. Eliminates circular dependency deadlocks and barrel file cascades to guarantee sub-50ms hot module replacement (HMR) and zero-vendor dead-code leakage in Rust-native build pipelines.","antiPatternHeadline":"Monolithic Barrel Re-Exports and Unmarked Side-Effects Poisoning Rolldown Module Invalidation Graph","stars_count":72,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["vite6","rolldown","tree-shaking","hmr","bundle-optimization","frontend-architecture"],"exportEndpoints":{"claude":"/api/rules/vite6-rolldown-chunk-isolation-treeshaking?format=claude","cursorMdc":"/api/rules/vite6-rolldown-chunk-isolation-treeshaking?format=mdc","cursorrules":"/api/rules/vite6-rolldown-chunk-isolation-treeshaking?format=cursor","windsurf":"/api/rules/vite6-rolldown-chunk-isolation-treeshaking?format=windsurf","agents":"/api/rules/vite6-rolldown-chunk-isolation-treeshaking?format=agents"}},{"id":"axum-08-zero-allocation-extractor-pipeline","title":"Axum 0.8 Zero-Allocation Request Extractor Pipeline","category":"backend","severity":"critical","description":"Enforces strict zero-allocation extraction patterns in Axum 0.8 request pipelines to eliminate intermediate heap buffers and prevent multi-gigabit throughput degradation. Guarantees compile-time lifetime safety and bound constraints across contiguous raw network byte buffers.","antiPatternHeadline":"Heap-Cloning Deserializers and Unbounded Intermediate Buffers in High-Throughput Request Paths","stars_count":61,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","zero-copy","performance","memory-management"],"exportEndpoints":{"claude":"/api/rules/axum-08-zero-allocation-extractor-pipeline?format=claude","cursorMdc":"/api/rules/axum-08-zero-allocation-extractor-pipeline?format=mdc","cursorrules":"/api/rules/axum-08-zero-allocation-extractor-pipeline?format=cursor","windsurf":"/api/rules/axum-08-zero-allocation-extractor-pipeline?format=windsurf","agents":"/api/rules/axum-08-zero-allocation-extractor-pipeline?format=agents"}},{"id":"go-chi-structured-concurrency-cancellation","title":"Go 1.24 Chi Context-Bound Structured Concurrency & Graceful Cancellation","category":"backend","severity":"critical","description":"Enforces strict hierarchical context derivation, explicit lifetime containment, and bounded timeout propagation across concurrent fan-outs within Go 1.24 Chi HTTP routing pipelines. Prevents orphan goroutines, descriptor leaks, and distributed cascading failures by requiring all sub-tasks to bind to request context lifecycle signals.","antiPatternHeadline":"Detached Goroutine Spawning and Context-Agnostic Channel Blocking","stars_count":77,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","chi","concurrency","goroutines","errgroup","context"],"exportEndpoints":{"claude":"/api/rules/go-chi-structured-concurrency-cancellation?format=claude","cursorMdc":"/api/rules/go-chi-structured-concurrency-cancellation?format=mdc","cursorrules":"/api/rules/go-chi-structured-concurrency-cancellation?format=cursor","windsurf":"/api/rules/go-chi-structured-concurrency-cancellation?format=windsurf","agents":"/api/rules/go-chi-structured-concurrency-cancellation?format=agents"}},{"id":"postgres-17-memory-tuning-index-pinning-guardrail","title":"Postgres 17 Workload-Adaptive Memory Tuning & High-Concurrency Index Pinning","category":"backend","severity":"critical","description":"Prevents catastrophic transaction ID (TXID) wraparound outages and query plan degradation across multi-terabyte transactional datasets. Enforces Postgres 17 radix-tree vacuum memory utilization, adaptive WAL checkpoint smoothing, and deterministic buffer pinning of mission-critical indexes via pg_prewarm to protect shared buffer hit rates under concurrent write spikes.","antiPatternHeadline":"Unbounded Autovacuum Degradation, Missing Buffer Pinning, and Premature WAL Flush Storms Under High Concurrency","stars_count":90,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql-17","database-performance","wal-checkpointing","txid-wraparound","pg-prewarm"],"exportEndpoints":{"claude":"/api/rules/postgres-17-memory-tuning-index-pinning-guardrail?format=claude","cursorMdc":"/api/rules/postgres-17-memory-tuning-index-pinning-guardrail?format=mdc","cursorrules":"/api/rules/postgres-17-memory-tuning-index-pinning-guardrail?format=cursor","windsurf":"/api/rules/postgres-17-memory-tuning-index-pinning-guardrail?format=windsurf","agents":"/api/rules/postgres-17-memory-tuning-index-pinning-guardrail?format=agents"}},{"id":"capacitor-7-hardware-vault-security-enclave-guardrail","title":"Capacitor 7 Secure Enclave & Hardware Keystore Vault Interface Invariants","category":"mobile","severity":"critical","description":"Mandates that all cryptographic private keys, biometric-bound secrets, and high-entropy authentication tokens are strictly sequestered within platform hardware security modules (Apple Secure Enclave and Android StrongBox/KeyStore) rather than standard WebView storage. In Capacitor 7 hybrid environments, access must be mediated via verified native hardware-backed vault bridges enforcing device authentication, key non-exportability, and zeroization of in-memory payloads.","antiPatternHeadline":"Persisting Refresh Tokens, Master Cryptographic Keys, or PII in Unencrypted Web Storage or Software-Only Keyrings","stars_count":56,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","security","ios-secure-enclave","android-strongbox","cryptography"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-hardware-vault-security-enclave-guardrail?format=claude","cursorMdc":"/api/rules/capacitor-7-hardware-vault-security-enclave-guardrail?format=mdc","cursorrules":"/api/rules/capacitor-7-hardware-vault-security-enclave-guardrail?format=cursor","windsurf":"/api/rules/capacitor-7-hardware-vault-security-enclave-guardrail?format=windsurf","agents":"/api/rules/capacitor-7-hardware-vault-security-enclave-guardrail?format=agents"}},{"id":"webauthn-l3-passkey-cryptographic-origin-attestation","title":"Strict WebAuthn Level 3 Passkey Cryptographic Origin and Monotonic State Attestation","category":"security","severity":"critical","description":"Enforces deterministic validation of WebAuthn Level 3 assertions, requiring exact origin matching, atomic challenge revocation, user verification enforcement, and monotonic signature counter validation. Prevents cross-origin credential harvesting, authenticator cloning, and assertion replay attacks across federated microservices.","antiPatternHeadline":"Lax Origin Validation, Ignored SignCount Monotonicity, and Client-Supplied RP ID Trust","stars_count":118,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","fido2","passkeys","cryptography","zero-trust","authentication"],"exportEndpoints":{"claude":"/api/rules/webauthn-l3-passkey-cryptographic-origin-attestation?format=claude","cursorMdc":"/api/rules/webauthn-l3-passkey-cryptographic-origin-attestation?format=mdc","cursorrules":"/api/rules/webauthn-l3-passkey-cryptographic-origin-attestation?format=cursor","windsurf":"/api/rules/webauthn-l3-passkey-cryptographic-origin-attestation?format=windsurf","agents":"/api/rules/webauthn-l3-passkey-cryptographic-origin-attestation?format=agents"}},{"id":"spiffe-spire-ephemeral-mtls-attestation-standard","title":"Mandate SPIFFE/SPIRE Workload Attestation and Ephemeral X.509-SVID mTLS","category":"security","severity":"critical","description":"Enforces dynamic, kernel-attested workload identities via SPIRE Workload API Unix Domain Sockets, forbidding long-lived credentials, static API secrets, and unverified TLS peer certificates. Mandates continuous SVID rotation in memory and strict SPIFFE ID SAN validation on all inter-service communication.","antiPatternHeadline":"Bypassing Workload Attestation via Static Secrets or Skipping SPIFFE ID Peer Verification in TLS Handshakes","stars_count":94,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","spiffe","spire","mtls","zero-trust","workload-attestation","cryptography"],"exportEndpoints":{"claude":"/api/rules/spiffe-spire-ephemeral-mtls-attestation-standard?format=claude","cursorMdc":"/api/rules/spiffe-spire-ephemeral-mtls-attestation-standard?format=mdc","cursorrules":"/api/rules/spiffe-spire-ephemeral-mtls-attestation-standard?format=cursor","windsurf":"/api/rules/spiffe-spire-ephemeral-mtls-attestation-standard?format=windsurf","agents":"/api/rules/spiffe-spire-ephemeral-mtls-attestation-standard?format=agents"}},{"id":"ebpf-continuous-profiling-telemetry","title":"eBPF Continuous Profiling & Zero-Overhead L7 Telemetry Invariants","category":"devops","severity":"critical","description":"Enforces architectural and binary compilation invariants required for non-invasive, out-of-band eBPF continuous profiling and L7 kernel socket tracing. Guarantees frame pointer preservation, dwarf debug symbol availability, and socket buffer visibility to eliminate reliance on userspace sidecars or bytecode re-instrumentation.","antiPatternHeadline":"Stripping Frame Pointers and Relying on Heavyweight Userspace Envoy/Proxy Sidecars","stars_count":84,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","continuous-profiling","telemetry","linux-kernel","observability"],"exportEndpoints":{"claude":"/api/rules/ebpf-continuous-profiling-telemetry?format=claude","cursorMdc":"/api/rules/ebpf-continuous-profiling-telemetry?format=mdc","cursorrules":"/api/rules/ebpf-continuous-profiling-telemetry?format=cursor","windsurf":"/api/rules/ebpf-continuous-profiling-telemetry?format=windsurf","agents":"/api/rules/ebpf-continuous-profiling-telemetry?format=agents"}},{"id":"k8s-v132-cel-admission-policy-enforcement","title":"In-Tree CEL ValidatingAdmissionPolicy Enforcement for Kubernetes v1.32","category":"devops","severity":"critical","description":"Enforces Kubernetes v1.32 in-tree ValidatingAdmissionPolicy and ValidatingAdmissionPolicyBinding APIs over legacy out-of-tree validating webhooks. In-tree Common Expression Language (CEL) admission rules compile directly within the kube-apiserver binary, eliminating network latency, mutual TLS failure cascades, and bootstrap deadlocks. This standard guarantees deterministic, zero-dependency policy enforcement across all cluster-scoped and namespaced workloads.","antiPatternHeadline":"Deploying Out-of-Tree Webhooks for Syntactic Invariants Causing API Server Outages","stars_count":95,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","kubernetes","cel","security","admission-control","infrastructure-as-code"],"exportEndpoints":{"claude":"/api/rules/k8s-v132-cel-admission-policy-enforcement?format=claude","cursorMdc":"/api/rules/k8s-v132-cel-admission-policy-enforcement?format=mdc","cursorrules":"/api/rules/k8s-v132-cel-admission-policy-enforcement?format=cursor","windsurf":"/api/rules/k8s-v132-cel-admission-policy-enforcement?format=windsurf","agents":"/api/rules/k8s-v132-cel-admission-policy-enforcement?format=agents"}},{"id":"nextjs-15-ppr-dynamic-io-boundary-isolation","title":"Strict Suspense Boundary Isolation for Next.js 15 Dynamic I/O and PPR","category":"frontend","severity":"critical","description":"Enforces compile-time and runtime isolation of dynamic asynchronous operations behind React Suspense boundaries in Next.js 15. Prevents dynamic I/O leaks—such as uncached database queries, headers(), cookies(), or unresolved searchParams—from poisoning the root static prerender shell and degrading initial Time to First Byte (TTFB).","antiPatternHeadline":"Unenclosed Asynchronous Dynamic I/O Poisoning the Static Prerender Shell","stars_count":45,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs15","ppr","dynamic-io","suspense","streaming","react-server-components"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-ppr-dynamic-io-boundary-isolation?format=claude","cursorMdc":"/api/rules/nextjs-15-ppr-dynamic-io-boundary-isolation?format=mdc","cursorrules":"/api/rules/nextjs-15-ppr-dynamic-io-boundary-isolation?format=cursor","windsurf":"/api/rules/nextjs-15-ppr-dynamic-io-boundary-isolation?format=windsurf","agents":"/api/rules/nextjs-15-ppr-dynamic-io-boundary-isolation?format=agents"}},{"id":"tanstack-query-v5-offline-mutation-queuing-deduplication","title":"TanStack Query v5: Bounded Serialized Mutation Queuing and Idempotency Guardrail","category":"frontend","severity":"critical","description":"Enforces strict mutation idempotency and deterministic serial execution for offline-capable frontend clients using TanStack Query v5. Prevents out-of-order replays, duplicate resource creation, and poison-pill queue blockages during network transitions via mutation scopes, client-side idempotency keys, and bounded storage.","antiPatternHeadline":"Unscoped, Non-Idempotent Mutation Replay Causing Race Conditions and Duplicate Writes on Network Recovery","stars_count":67,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","tanstack-query","offline-first","idempotency","concurrency","typescript"],"exportEndpoints":{"claude":"/api/rules/tanstack-query-v5-offline-mutation-queuing-deduplication?format=claude","cursorMdc":"/api/rules/tanstack-query-v5-offline-mutation-queuing-deduplication?format=mdc","cursorrules":"/api/rules/tanstack-query-v5-offline-mutation-queuing-deduplication?format=cursor","windsurf":"/api/rules/tanstack-query-v5-offline-mutation-queuing-deduplication?format=windsurf","agents":"/api/rules/tanstack-query-v5-offline-mutation-queuing-deduplication?format=agents"}},{"id":"bun-websocket-hibernation-native-memory-pinning","title":"Bun 1.2 WebSocket Hibernation & Zero-Heap Connection Pinning","category":"backend","severity":"critical","description":"Enforces zero-heap WebSocket lifecycle patterns in Bun 1.2+ by offloading idle socket state to native kernel structures (epoll/kqueue) through native pub/sub topics and transient descriptors. Eliminates multi-gigabyte JavaScriptCore heap degradation across high-fanout deployments by prohibiting persistent JavaScript socket references and unbounded closure captures.","antiPatternHeadline":"Retaining ServerWebSocket references in heap collections or closures, defeating native kernel hibernation","stars_count":114,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","websockets","memory-management","high-concurrency","systems-programming"],"exportEndpoints":{"claude":"/api/rules/bun-websocket-hibernation-native-memory-pinning?format=claude","cursorMdc":"/api/rules/bun-websocket-hibernation-native-memory-pinning?format=mdc","cursorrules":"/api/rules/bun-websocket-hibernation-native-memory-pinning?format=cursor","windsurf":"/api/rules/bun-websocket-hibernation-native-memory-pinning?format=windsurf","agents":"/api/rules/bun-websocket-hibernation-native-memory-pinning?format=agents"}},{"id":"temporal-workflow-determinism-replay-verification","title":"Temporal Core Deterministic Workflow Replay & State Machine Verification","category":"backend","severity":"critical","description":"Enforces strict determinism constraints within Temporal workflow definitions to eliminate non-deterministic event history divergence and workflow state corruption during replay and continuous deployment cycles. Mandates workflow-safe runtime primitives, isolation of side effects within activities, and explicit version gating with workflow patching APIs.","antiPatternHeadline":"Non-Deterministic Workflow Mutation and State Corruption via Native Runtime Primitives and Unversioned Control Flow","stars_count":48,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","temporal","distributed-systems","event-sourcing","durable-execution","deterministic-replay"],"exportEndpoints":{"claude":"/api/rules/temporal-workflow-determinism-replay-verification?format=claude","cursorMdc":"/api/rules/temporal-workflow-determinism-replay-verification?format=mdc","cursorrules":"/api/rules/temporal-workflow-determinism-replay-verification?format=cursor","windsurf":"/api/rules/temporal-workflow-determinism-replay-verification?format=windsurf","agents":"/api/rules/temporal-workflow-determinism-replay-verification?format=agents"}},{"id":"tokio-cooperative-budgeting-blocking-offload-guardrails","title":"Tokio 1.40 Cooperative Task Budgeting & Blocking Offload Guardrails","category":"backend","severity":"critical","description":"Enforces strict cooperative scheduling and blocking isolation in Tokio 1.40 runtimes to prevent executor thread starvation. Guarantees long-running computational or synchronous I/O operations are offloaded to dedicated threadpools while unbounded async loops yield control via cooperative budget checks.","antiPatternHeadline":"Starving Tokio Worker Threads with Synchronous I/O, Rayon in Task Contexts, and Unbounded Yield-Free Async Loops","stars_count":99,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","tokio","async","concurrency","performance"],"exportEndpoints":{"claude":"/api/rules/tokio-cooperative-budgeting-blocking-offload-guardrails?format=claude","cursorMdc":"/api/rules/tokio-cooperative-budgeting-blocking-offload-guardrails?format=mdc","cursorrules":"/api/rules/tokio-cooperative-budgeting-blocking-offload-guardrails?format=cursor","windsurf":"/api/rules/tokio-cooperative-budgeting-blocking-offload-guardrails?format=windsurf","agents":"/api/rules/tokio-cooperative-budgeting-blocking-offload-guardrails?format=agents"}},{"id":"jetpack-compose-strong-skipping-stability-guardrails","title":"Jetpack Compose 1.8 Strong Skipping Mode and Parameter Stability Boundaries","category":"mobile","severity":"critical","description":"Enforces compiler-level memoization guarantees under Jetpack Compose 1.8 Strong Skipping Mode by isolating unstable external models behind Immutable value wrappers or stable UI state adapters. Prevents structural equality check failures (`equals()` mismatch) and catastrophic recomposition cascades across complex screen hierarchies. Mandates explicit stability annotations, persistent collection primitives, and lambda memoization contracts across all public composable signatures.","antiPatternHeadline":"Passing Unannotated Third-Party Models and Raw Collections into Composables Under Strong Skipping Mode","stars_count":63,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","android","jetpack-compose","kotlin","performance","compiler"],"exportEndpoints":{"claude":"/api/rules/jetpack-compose-strong-skipping-stability-guardrails?format=claude","cursorMdc":"/api/rules/jetpack-compose-strong-skipping-stability-guardrails?format=mdc","cursorrules":"/api/rules/jetpack-compose-strong-skipping-stability-guardrails?format=cursor","windsurf":"/api/rules/jetpack-compose-strong-skipping-stability-guardrails?format=windsurf","agents":"/api/rules/jetpack-compose-strong-skipping-stability-guardrails?format=agents"}},{"id":"capacitor-biometric-secure-keystore-isolation","title":"Capacitor 7 Biometric-Bound Secure KeyStore Cryptographic Isolation","category":"mobile","severity":"critical","description":"Enforces hardware-backed cryptographic key isolation in Capacitor 7 hybrid applications via iOS Secure Enclave and Android Hardware KeyStore. Mandates that authentication tokens, refresh credentials, and cryptographic signing keys remain inaccessible to the inspectable WebKit web view sandbox, unencrypted SQLite, and local web storage. Restricts secret persistence strictly to biometrically gated native keychain primitives with zero-persistence memory buffers.","antiPatternHeadline":"Leaking Long-Lived Credentials into Inspectable WebKit Web Storage or Unencrypted Capacitor Preferences","stars_count":43,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","biometrics","keychain","secure-enclave","keystore","security"],"exportEndpoints":{"claude":"/api/rules/capacitor-biometric-secure-keystore-isolation?format=claude","cursorMdc":"/api/rules/capacitor-biometric-secure-keystore-isolation?format=mdc","cursorrules":"/api/rules/capacitor-biometric-secure-keystore-isolation?format=cursor","windsurf":"/api/rules/capacitor-biometric-secure-keystore-isolation?format=windsurf","agents":"/api/rules/capacitor-biometric-secure-keystore-isolation?format=agents"}},{"id":"oauth2-dpop-rfc9449-sender-constrained-attestation","title":"OAuth 2.1 RFC 9449 DPoP Sender-Constrained Ephemeral Key Attestation Guardrail","category":"security","severity":"critical","description":"Enforces strict sender-constrained token validation via Demonstrating Proof-of-Possession (RFC 9449) across all authenticated network boundaries. Every outbound request to protected resources must generate and attach a cryptographically bound, ephemeral asymmetric proof-of-possession JWT matching the exact HTTP method, canonicalized URI, access token hash (ath), and server-issued nonce. Prevents bearer token exfiltration, token reuse attacks, and session hijacking by invalidating captured access tokens without possession of the non-extractable client private key.","antiPatternHeadline":"Transmitting Unconstrained Bearer Tokens or Emitting Malformed DPoP Proofs with Reused Nonces and Non-Canonical URIs","stars_count":103,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","oauth2","dpop","rfc9449","cryptography","zero-trust","jwt","subtle-crypto"],"exportEndpoints":{"claude":"/api/rules/oauth2-dpop-rfc9449-sender-constrained-attestation?format=claude","cursorMdc":"/api/rules/oauth2-dpop-rfc9449-sender-constrained-attestation?format=mdc","cursorrules":"/api/rules/oauth2-dpop-rfc9449-sender-constrained-attestation?format=cursor","windsurf":"/api/rules/oauth2-dpop-rfc9449-sender-constrained-attestation?format=windsurf","agents":"/api/rules/oauth2-dpop-rfc9449-sender-constrained-attestation?format=agents"}},{"id":"openfga-consistent-tuple-cache-pipelining","title":"OpenFGA 1.6 Consistent Tuple Evaluation & Cache Pipelining Guardrails","category":"security","severity":"critical","description":"Enforces strong consistency invariants and cache-pipelining controls across distributed OpenFGA 1.6 relationship-based access control (ReBAC) evaluations. Prevents authorization bypass and the New Enemy Problem by forbidding static-TTL caching of raw Check responses and mandating consistency tokens, contextual tuple evaluation, and deterministic invalidation pipelining on relation mutations.","antiPatternHeadline":"Stale ReBAC Cache Reads and Unbounded TTL Authorization Bypass During Tuple Revocations","stars_count":81,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","rebac","authorization","distributed-systems","cache-consistency"],"exportEndpoints":{"claude":"/api/rules/openfga-consistent-tuple-cache-pipelining?format=claude","cursorMdc":"/api/rules/openfga-consistent-tuple-cache-pipelining?format=mdc","cursorrules":"/api/rules/openfga-consistent-tuple-cache-pipelining?format=cursor","windsurf":"/api/rules/openfga-consistent-tuple-cache-pipelining?format=windsurf","agents":"/api/rules/openfga-consistent-tuple-cache-pipelining?format=agents"}},{"id":"cilium-ebpf-l7-mutual-attestation","title":"Cilium eBPF L7 Zero-Trust Transparent Mutual Attestation and Policy Enforcement","category":"devops","severity":"critical","description":"Enforces kernel-level mutual authentication, cryptographic identity verification, and strict Layer 7 egress authorization using Cilium eBPF and SPIRE without injecting userspace Envoy sidecars. This eliminates sidecar memory consumption, CPU context-switching overhead, and kernel-to-userspace TCP socket splicing while preserving zero-trust guarantees.","antiPatternHeadline":"Deploying heavyweight sidecar proxies for mTLS and egress filtering instead of kernel-space eBPF transparent attestation.","stars_count":59,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","cilium","ebpf","zero-trust","spire","kubernetes","mtls","security"],"exportEndpoints":{"claude":"/api/rules/cilium-ebpf-l7-mutual-attestation?format=claude","cursorMdc":"/api/rules/cilium-ebpf-l7-mutual-attestation?format=mdc","cursorrules":"/api/rules/cilium-ebpf-l7-mutual-attestation?format=cursor","windsurf":"/api/rules/cilium-ebpf-l7-mutual-attestation?format=windsurf","agents":"/api/rules/cilium-ebpf-l7-mutual-attestation?format=agents"}},{"id":"vite6-environment-runtime-isolation","title":"Vite 6 Environment API Deterministic Runtime Boundary Isolation","category":"frontend","severity":"critical","description":"Enforces deterministic module resolution boundaries and isolated module graphs across distinct Vite 6 execution contexts (browser, Node.js SSR, and edge/workerd runtimes). Prevents runtime leakage, cross-environment cache contamination, and invalid export condition resolution in multi-target architectures.","antiPatternHeadline":"Global Resolution Bleed and Cross-Runtime Module Graph Contamination","stars_count":62,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["vite","vite-6","environment-api","ssr","edge","module-resolution"],"exportEndpoints":{"claude":"/api/rules/vite6-environment-runtime-isolation?format=claude","cursorMdc":"/api/rules/vite6-environment-runtime-isolation?format=mdc","cursorrules":"/api/rules/vite6-environment-runtime-isolation?format=cursor","windsurf":"/api/rules/vite6-environment-runtime-isolation?format=windsurf","agents":"/api/rules/vite6-environment-runtime-isolation?format=agents"}},{"id":"postgres-17-zero-lock-partition-pruning-guardrail","title":"Postgres 17 Zero-Lock DDL Invariants and Microsecond Partition Pruning","category":"backend","severity":"critical","description":"Enforces strict DDL migration patterns and query structures in PostgreSQL 17 to eliminate table-level ExclusiveLocks on high-throughput ledgers. Guarantees run-time and compile-time partition pruning using immutable routing keys while avoiding lock-queue starvation via explicit timeout backoffs.","antiPatternHeadline":"Unbounded AccessExclusiveLock Acquisition and Dynamic Partition Filter Degeneration","stars_count":112,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres-17","database-migration","partitioning","concurrency"],"exportEndpoints":{"claude":"/api/rules/postgres-17-zero-lock-partition-pruning-guardrail?format=claude","cursorMdc":"/api/rules/postgres-17-zero-lock-partition-pruning-guardrail?format=mdc","cursorrules":"/api/rules/postgres-17-zero-lock-partition-pruning-guardrail?format=cursor","windsurf":"/api/rules/postgres-17-zero-lock-partition-pruning-guardrail?format=windsurf","agents":"/api/rules/postgres-17-zero-lock-partition-pruning-guardrail?format=agents"}},{"id":"go-chi-context-deadline-goroutine-leak-guardrails","title":"Go Chi Context Deadline Propagation and Goroutine Leak Prevention","category":"backend","severity":"critical","description":"Enforces strict HTTP request context propagation, deterministic timeout boundaries, and leak-free concurrency in go-chi microservices. Prohibits detached background goroutines that outlive request scopes without structured cancellation, preventing thread exhaustion, connection pool starvation, and file descriptor leaks.","antiPatternHeadline":"Detaching Goroutines from Request Lifecycles Without Cancellation Channels or Resource Drainage","stars_count":72,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","chi","concurrency","goroutines","context"],"exportEndpoints":{"claude":"/api/rules/go-chi-context-deadline-goroutine-leak-guardrails?format=claude","cursorMdc":"/api/rules/go-chi-context-deadline-goroutine-leak-guardrails?format=mdc","cursorrules":"/api/rules/go-chi-context-deadline-goroutine-leak-guardrails?format=cursor","windsurf":"/api/rules/go-chi-context-deadline-goroutine-leak-guardrails?format=windsurf","agents":"/api/rules/go-chi-context-deadline-goroutine-leak-guardrails?format=agents"}},{"id":"kmp-deterministic-state-engine-invariants","title":"KMP Deterministic Unidirectional State Engine and Side-Effect Isolation","category":"mobile","severity":"critical","description":"Cross-platform state divergence occurs when business logic, asynchronous side effects, and state mutations are intertwined with platform threading models. In Kotlin Multiplatform (KMP), all core domain state transitions must be strictly pure, mathematical reducers running over immutable state data structures, while asynchronous operations are modeled exclusively as declarative side-effect commands executed on isolated effect handlers.","antiPatternHeadline":"Impure In-Reducer Side Effects and Mutable Platform-Specific Concurrency Divergence","stars_count":118,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","mvi","state-machine","coroutines"],"exportEndpoints":{"claude":"/api/rules/kmp-deterministic-state-engine-invariants?format=claude","cursorMdc":"/api/rules/kmp-deterministic-state-engine-invariants?format=mdc","cursorrules":"/api/rules/kmp-deterministic-state-engine-invariants?format=cursor","windsurf":"/api/rules/kmp-deterministic-state-engine-invariants?format=windsurf","agents":"/api/rules/kmp-deterministic-state-engine-invariants?format=agents"}},{"id":"tauri-v2-ipc-capability-sandboxing-guardrail","title":"Tauri 2.0 Mobile IPC Capability Sandboxing & Privilege Escalation Guardrail","category":"mobile","severity":"critical","description":"Enforces Tauri 2.0 granular capability definitions and compile-time Access Control Lists (ACLs) to mitigate webview-to-native privilege escalation. Guarantees that every IPC invoke call maps to an explicitly scoped capability manifest, forbidding global allowlists and unvalidated command execution across mobile webview boundaries.","antiPatternHeadline":"Pervasive IPC Permission Grants and Wildcard Capability Mapping","stars_count":92,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri","security","ipc","rust","capabilities"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-ipc-capability-sandboxing-guardrail?format=claude","cursorMdc":"/api/rules/tauri-v2-ipc-capability-sandboxing-guardrail?format=mdc","cursorrules":"/api/rules/tauri-v2-ipc-capability-sandboxing-guardrail?format=cursor","windsurf":"/api/rules/tauri-v2-ipc-capability-sandboxing-guardrail?format=windsurf","agents":"/api/rules/tauri-v2-ipc-capability-sandboxing-guardrail?format=agents"}},{"id":"webauthn-enterprise-attestation-origin-binding-invariants","title":"WebAuthn Enterprise Attestation and Strict Origin Binding Invariants","category":"security","severity":"critical","description":"Enforces cryptographically validated hardware attestation, exact origin matching, and monotonic counter verification across all WebAuthn and Passkey flows. Eliminates credential stuffing, phishing, and authenticator cloning by validating clientDataJSON against server-bound single-use challenges and verifying FIDO2 enterprise metadata chains.","antiPatternHeadline":"Accepting 'none' attestation, loose origin regexes, or unverified authenticator counters in enterprise FIDO2 ceremonies","stars_count":64,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","fido2","passkeys","cryptography","zero-trust","authentication"],"exportEndpoints":{"claude":"/api/rules/webauthn-enterprise-attestation-origin-binding-invariants?format=claude","cursorMdc":"/api/rules/webauthn-enterprise-attestation-origin-binding-invariants?format=mdc","cursorrules":"/api/rules/webauthn-enterprise-attestation-origin-binding-invariants?format=cursor","windsurf":"/api/rules/webauthn-enterprise-attestation-origin-binding-invariants?format=windsurf","agents":"/api/rules/webauthn-enterprise-attestation-origin-binding-invariants?format=agents"}},{"id":"cilium-ebpf-tetragon-runtime-enforcement","title":"Kernel-Level eBPF Cilium Service Mesh & Tetragon Runtime Guardrail","category":"devops","severity":"critical","description":"Mandates sidecar-free service mesh architecture leveraging Cilium eBPF for L7 traffic routing and Tetragon TracingPolicies for un-bypassable kernel-level syscall runtime enforcement. Eliminates user-space proxy latency and resource bloat while securing execution vectors directly inside the Linux kernel.","antiPatternHeadline":"Relying on User-Space Sidecar Proxies and Auditd/Seccomp Bypassable Daemon Monitoring","stars_count":59,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","cilium","tetragon","kubernetes","runtime-security","zero-trust"],"exportEndpoints":{"claude":"/api/rules/cilium-ebpf-tetragon-runtime-enforcement?format=claude","cursorMdc":"/api/rules/cilium-ebpf-tetragon-runtime-enforcement?format=mdc","cursorrules":"/api/rules/cilium-ebpf-tetragon-runtime-enforcement?format=cursor","windsurf":"/api/rules/cilium-ebpf-tetragon-runtime-enforcement?format=windsurf","agents":"/api/rules/cilium-ebpf-tetragon-runtime-enforcement?format=agents"}},{"id":"opentelemetry-w3c-trace-context-baggage-propagation","title":"Mandatory W3C Trace Context and Baggage Propagation Across Asynchronous Boundaries","category":"devops","severity":"critical","description":"Enforces strict extraction and injection of W3C Trace Context (traceparent, tracestate) and OpenTelemetry Baggage across asynchronous event brokers, background queues, and ephemeral micro-runtimes. Guarantees unbroken causal distributed telemetry and eliminates silent contextual leaks that break multi-tenant boundary isolation and request attribution.","antiPatternHeadline":"Firing Disconnected Async Tasks or Queue Messages Without Explicit W3C Context Carrier Injection","stars_count":106,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","tracing","distributed-systems","observability","microservices"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-w3c-trace-context-baggage-propagation?format=claude","cursorMdc":"/api/rules/opentelemetry-w3c-trace-context-baggage-propagation?format=mdc","cursorrules":"/api/rules/opentelemetry-w3c-trace-context-baggage-propagation?format=cursor","windsurf":"/api/rules/opentelemetry-w3c-trace-context-baggage-propagation?format=windsurf","agents":"/api/rules/opentelemetry-w3c-trace-context-baggage-propagation?format=agents"}},{"id":"svelte-5-runes-reactivity-invariants","title":"Svelte 5 Runes State Architecture, Derived Tracking, and Snippet Composition","category":"frontend","severity":"critical","description":"Enforces deterministic reactivity paradigms in Svelte 5 by mandating fine-grained runes ($state, $derived, $props, $effect) and snippet composition while eliminating legacy Svelte 3/4 semantics ($: labels, export let, <slot />). Prohibits state mutation loops within reactive tracking contexts and mandates unidirectional data derivation to prevent ghost renders, signal desynchronization, and memory leaks.","antiPatternHeadline":"Mutating State Inside $effect Instead of $derived and Persisting Legacy Slot/Export Bindings","stars_count":116,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","state-management","reactivity"],"exportEndpoints":{"claude":"/api/rules/svelte-5-runes-reactivity-invariants?format=claude","cursorMdc":"/api/rules/svelte-5-runes-reactivity-invariants?format=mdc","cursorrules":"/api/rules/svelte-5-runes-reactivity-invariants?format=cursor","windsurf":"/api/rules/svelte-5-runes-reactivity-invariants?format=windsurf","agents":"/api/rules/svelte-5-runes-reactivity-invariants?format=agents"}},{"id":"react-19-server-actions-serialization-isolation","title":"React 19 Server Actions Boundary Isolation & State Serialization Standard","category":"frontend","severity":"critical","description":"Enforces rigid boundary isolation for React 19 Server Actions and action state transitions across the client-server boundary. Prevents Flight protocol serialization crashes, closure memory leaks, and credential leakage by mandating explicit Data Transfer Object (DTO) projection and prohibiting non-serializable references in action closures and return states.","antiPatternHeadline":"Leaking Sensitive Server State and Unserializable References via Unbounded Server Action Closures","stars_count":84,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react19","server-actions","serialization","security","useActionState","dto"],"exportEndpoints":{"claude":"/api/rules/react-19-server-actions-serialization-isolation?format=claude","cursorMdc":"/api/rules/react-19-server-actions-serialization-isolation?format=mdc","cursorrules":"/api/rules/react-19-server-actions-serialization-isolation?format=cursor","windsurf":"/api/rules/react-19-server-actions-serialization-isolation?format=windsurf","agents":"/api/rules/react-19-server-actions-serialization-isolation?format=agents"}},{"id":"postgres-17-streaming-io-failover-slots","title":"PostgreSQL 17 Streaming I/O Optimization and Synchronized Logical Replication Failover","category":"backend","severity":"critical","description":"PostgreSQL 17 introduces vectorized streaming I/O read-ahead alongside native logical replication slot synchronization across physical standbys. Production architectures must enforce failover-enabled logical slots and streaming I/O configurations to guarantee zero data loss and prevent subscriber desynchronization during primary failovers.","antiPatternHeadline":"Creating unmanaged logical replication slots without failover synchronization and ignoring PG17 streaming I/O block controls","stars_count":116,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql-17","logical-replication","streaming-io","high-availability","zero-downtime"],"exportEndpoints":{"claude":"/api/rules/postgres-17-streaming-io-failover-slots?format=claude","cursorMdc":"/api/rules/postgres-17-streaming-io-failover-slots?format=mdc","cursorrules":"/api/rules/postgres-17-streaming-io-failover-slots?format=cursor","windsurf":"/api/rules/postgres-17-streaming-io-failover-slots?format=windsurf","agents":"/api/rules/postgres-17-streaming-io-failover-slots?format=agents"}},{"id":"fastapi-lifespan-pydantic-v2-serialization-production-standard","title":"FastAPI Structured Lifespans and Pydantic V2 Zero-Copy Deserialization Invariants","category":"backend","severity":"critical","description":"Enforces modern FastAPI async lifespan context managers over deprecated startup/shutdown events to guarantee deterministic resource teardown. Mandates Pydantic V2 compiled Rust parsing (validate_json/TypeAdapter) directly on raw request payloads to eliminate event-loop blocking and memory allocation bottlenecks under high-concurrency microservice workloads.","antiPatternHeadline":"Blocking Python Event Loops with Deprecated Startup Hooks and V1-Style Python-Space JSON Deserialization","stars_count":49,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","pydantic-v2","asyncio","performance","rust"],"exportEndpoints":{"claude":"/api/rules/fastapi-lifespan-pydantic-v2-serialization-production-standard?format=claude","cursorMdc":"/api/rules/fastapi-lifespan-pydantic-v2-serialization-production-standard?format=mdc","cursorrules":"/api/rules/fastapi-lifespan-pydantic-v2-serialization-production-standard?format=cursor","windsurf":"/api/rules/fastapi-lifespan-pydantic-v2-serialization-production-standard?format=windsurf","agents":"/api/rules/fastapi-lifespan-pydantic-v2-serialization-production-standard?format=agents"}},{"id":"kmp-native-memory-swift-concurrency-interop","title":"KMP Native Memory Isolation & Swift 6 Structured Concurrency Bridging","category":"mobile","severity":"critical","description":"Governs thread-safe bidirectional state sharing and structured concurrency interop between Kotlin Coroutines and Swift 6 Sendable actors without GC pressure or main-thread hitching. Enforces SKIE/Swift-export bridging protocols, non-leaking cancellation token handlers, and immutable boundary transfer to satisfy strict Swift 6 concurrency invariants alongside Kotlin Native's Garbage Collector.","antiPatternHeadline":"Bridging raw Kotlin Coroutine Flows and Shared State directly into Swift without Sendable wrappers, explicit scope lifetime management, and freeze/copy boundary invariants.","stars_count":80,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","swift6","concurrency","ios","native-memory"],"exportEndpoints":{"claude":"/api/rules/kmp-native-memory-swift-concurrency-interop?format=claude","cursorMdc":"/api/rules/kmp-native-memory-swift-concurrency-interop?format=mdc","cursorrules":"/api/rules/kmp-native-memory-swift-concurrency-interop?format=cursor","windsurf":"/api/rules/kmp-native-memory-swift-concurrency-interop?format=windsurf","agents":"/api/rules/kmp-native-memory-swift-concurrency-interop?format=agents"}},{"id":"tauri-2-dynamic-ipc-capability-sandboxing","title":"Tauri 2.0 Dynamic IPC Capability Sandboxing & Permission Scoping","category":"mobile","severity":"critical","description":"Enforces zero-trust IPC sandboxing between untrusted WebViews and native Rust runtimes on iOS, Android, and desktop targets in Tauri 2.0. Mandates granular ACL permission files, strictly typed IPC schemas, and platform-conditional capability scoping to prevent remote code execution and unauthorized native OS access via compromised frontend contexts.","antiPatternHeadline":"Wildcard Default IPC Permissions and Dynamic Raw Commands Exposing Native OS Interfaces","stars_count":73,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri-2","security","ipc","sandboxing","rust"],"exportEndpoints":{"claude":"/api/rules/tauri-2-dynamic-ipc-capability-sandboxing?format=claude","cursorMdc":"/api/rules/tauri-2-dynamic-ipc-capability-sandboxing?format=mdc","cursorrules":"/api/rules/tauri-2-dynamic-ipc-capability-sandboxing?format=cursor","windsurf":"/api/rules/tauri-2-dynamic-ipc-capability-sandboxing?format=windsurf","agents":"/api/rules/tauri-2-dynamic-ipc-capability-sandboxing?format=agents"}},{"id":"openfga-rebac-outbox-cache-invalidation-guardrail","title":"OpenFGA Distributed ReBAC Decision Caching & Outbox Invalidation","category":"security","severity":"critical","description":"Mandates strict deterministic keying for local OpenFGA decision caching alongside transactional outbox-driven CDC tuple invalidation. Prevents authorization bypasses and New Enemy Problem vulnerabilities caused by stale edge-evaluated Zanzibar relationship tuples.","antiPatternHeadline":"Naive TTL caching of OpenFGA checks coupled with fire-and-forget tuple invalidation","stars_count":117,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","rebac","zanzibar","caching","outbox","cache-invalidation"],"exportEndpoints":{"claude":"/api/rules/openfga-rebac-outbox-cache-invalidation-guardrail?format=claude","cursorMdc":"/api/rules/openfga-rebac-outbox-cache-invalidation-guardrail?format=mdc","cursorrules":"/api/rules/openfga-rebac-outbox-cache-invalidation-guardrail?format=cursor","windsurf":"/api/rules/openfga-rebac-outbox-cache-invalidation-guardrail?format=windsurf","agents":"/api/rules/openfga-rebac-outbox-cache-invalidation-guardrail?format=agents"}},{"id":"webauthn-origin-binding-attestation-guardrail","title":"Strict WebAuthn/FIDO2 Origin Binding, Attestation, and Replay Protection","category":"security","severity":"critical","description":"Enforces strict cryptographic verification of WebAuthn and FIDO2 passkey assertions and registrations. Guarantees immutable clientDataJSON origin validation, exact challenge-response replay matching with single-use eviction, RP ID boundary enforcement, and authenticator counter regression checks to defeat reverse-proxy adversary-in-the-middle (AiTM) phishing.","antiPatternHeadline":"Trusting Client-Supplied Origins, Non-Atomic Challenges, or Skipping Cryptographic Counter & Origin Verification","stars_count":87,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","fido2","passkeys","cryptography","aitm-phishing"],"exportEndpoints":{"claude":"/api/rules/webauthn-origin-binding-attestation-guardrail?format=claude","cursorMdc":"/api/rules/webauthn-origin-binding-attestation-guardrail?format=mdc","cursorrules":"/api/rules/webauthn-origin-binding-attestation-guardrail?format=cursor","windsurf":"/api/rules/webauthn-origin-binding-attestation-guardrail?format=windsurf","agents":"/api/rules/webauthn-origin-binding-attestation-guardrail?format=agents"}},{"id":"tetragon-kernel-security-enforcement","title":"Tetragon eBPF Kernel-Level Security Enforcement & Socket Tracing Guardrail","category":"devops","severity":"critical","description":"Enforces deterministic, in-kernel threat neutralization using Cilium Tetragon TracingPolicies rather than audit-only user-space agents. Requires explicit synchronous SIGKILL/Override action enforcement on unauthorized kernel syscalls, namespace escapes, and raw socket egress while avoiding asynchronous userspace race conditions (TOCTOU).","antiPatternHeadline":"Audit-Only Telemetry or Post-Execution User-Space Killing of Malicious Syscalls","stars_count":41,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["ebpf","tetragon","security","devops","kubernetes","cilium"],"exportEndpoints":{"claude":"/api/rules/tetragon-kernel-security-enforcement?format=claude","cursorMdc":"/api/rules/tetragon-kernel-security-enforcement?format=mdc","cursorrules":"/api/rules/tetragon-kernel-security-enforcement?format=cursor","windsurf":"/api/rules/tetragon-kernel-security-enforcement?format=windsurf","agents":"/api/rules/tetragon-kernel-security-enforcement?format=agents"}},{"id":"vite6-environment-api-multi-runtime-isolation-vite-6-environme-118","title":"Vite 6 Environment API Multi-Runtime Pipeline Isolation","category":"devops","severity":"critical","description":"Architects strictly isolated compilation graphs and Hot Module Replacement (HMR) transports across heterogeneous runtimes (Workerd, Node.js, Bun, and Browser) within Vite 6. Prevents runtime pollution, leaked globals, and dual-package hazards by enforcing per-environment build, runner, and resolution boundary configurations.","antiPatternHeadline":"Global Resolution Leaking and Legacy ssrLoadModule Cross-Contamination Across Heterogeneous Target Runtimes","stars_count":99,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","vite6","environment-api","workerd","runtime-isolation","hmr"],"exportEndpoints":{"claude":"/api/rules/vite6-environment-api-multi-runtime-isolation-vite-6-environme-118?format=claude","cursorMdc":"/api/rules/vite6-environment-api-multi-runtime-isolation-vite-6-environme-118?format=mdc","cursorrules":"/api/rules/vite6-environment-api-multi-runtime-isolation-vite-6-environme-118?format=cursor","windsurf":"/api/rules/vite6-environment-api-multi-runtime-isolation-vite-6-environme-118?format=windsurf","agents":"/api/rules/vite6-environment-api-multi-runtime-isolation-vite-6-environme-118?format=agents"}},{"id":"react-19-server-actions-optimistic-state-invariant","title":"React 19 Transactional Server Actions & Optimistic State Synchronization Guardrail","category":"frontend","severity":"critical","description":"Enforces deterministic state reconciliation and optimistic rollbacks across progressive hydration boundaries using React 19 primitives (useActionState, useOptimistic, startTransition). Prevents race conditions, state tearing, and phantom mutations during concurrent asynchronous Server Action dispatches.","antiPatternHeadline":"Uncoordinated Manual Optimistic State Mutation with Unbound Async Dispatches Causing Concurrent UI Tearing","stars_count":79,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","server-actions","use-optimistic","use-action-state","concurrency"],"exportEndpoints":{"claude":"/api/rules/react-19-server-actions-optimistic-state-invariant?format=claude","cursorMdc":"/api/rules/react-19-server-actions-optimistic-state-invariant?format=mdc","cursorrules":"/api/rules/react-19-server-actions-optimistic-state-invariant?format=cursor","windsurf":"/api/rules/react-19-server-actions-optimistic-state-invariant?format=windsurf","agents":"/api/rules/react-19-server-actions-optimistic-state-invariant?format=agents"}},{"id":"svelte-5-runes-ssr-reactive-memory-isolation","title":"Svelte 5 Runes SSR Reactive Scope Isolation and Cross-Request Leak Prevention","category":"frontend","severity":"critical","description":"Declaring module-scoped `$state()` or reactive rune proxies in Svelte 5 causes catastrophic state bleeding and memory leaks across concurrent SSR request threads. In server runtimes (Node.js, Bun, Cloudflare Workers), module scope is shared across all concurrent executions, meaning global reactive state exposes authenticated user data across requests. Engineers must quarantine reactive runes inside per-request component trees via Svelte Context or request-bound state factory instances.","antiPatternHeadline":"Exporting Singleton `$state` Proxies in Module Scope During Server-Side Rendering","stars_count":97,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","ssr","memory-isolation","security"],"exportEndpoints":{"claude":"/api/rules/svelte-5-runes-ssr-reactive-memory-isolation?format=claude","cursorMdc":"/api/rules/svelte-5-runes-ssr-reactive-memory-isolation?format=mdc","cursorrules":"/api/rules/svelte-5-runes-ssr-reactive-memory-isolation?format=cursor","windsurf":"/api/rules/svelte-5-runes-ssr-reactive-memory-isolation?format=windsurf","agents":"/api/rules/svelte-5-runes-ssr-reactive-memory-isolation?format=agents"}},{"id":"pg17-logical-failover-slots-streaming-io-standard","title":"PostgreSQL 17 Managed Logical Failover Slots & Streaming I/O Synchronization","category":"backend","severity":"critical","description":"Enforces deterministic zero-data-loss failover synchronization across read replicas using PostgreSQL 17 native failover slots (`failover = true`) bound to `synchronized_standby_slots`. Simultaneously optimizes the replication ingestion pipeline via Postgres 17 direct block streaming I/O and vectorized read prefetching (`io_combine_limit`), preventing worker stall during high-throughput WAL replay.","antiPatternHeadline":"Creating Unmanaged Logical Replication Slots Without Standby Synchronization and Default I/O Concurrency","stars_count":65,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql-17","logical-replication","failover-slots","streaming-io","zero-data-loss","ha"],"exportEndpoints":{"claude":"/api/rules/pg17-logical-failover-slots-streaming-io-standard?format=claude","cursorMdc":"/api/rules/pg17-logical-failover-slots-streaming-io-standard?format=mdc","cursorrules":"/api/rules/pg17-logical-failover-slots-streaming-io-standard?format=cursor","windsurf":"/api/rules/pg17-logical-failover-slots-streaming-io-standard?format=windsurf","agents":"/api/rules/pg17-logical-failover-slots-streaming-io-standard?format=agents"}},{"id":"bun-websocket-hibernation-buffer-pool-standard","title":"Bun 1.2 Zero-Copy WebSocket Hibernation & Buffer Pool Standard","category":"backend","severity":"critical","description":"Enforces Bun 1.2's kernel-level WebSocket hibernation engine and zero-copy binary streaming protocols across all real-time services. Prohibits stateful V8 closure references to ServerWebSocket instances, mandating topic-based pub/sub offloading and pooled ArrayBuffer allocations to maintain microsecond tail latency under millions of concurrent idle connections.","antiPatternHeadline":"Retaining Persistent ServerWebSocket References and Unpooled Buffer Allocations","stars_count":58,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","websockets","buffer-pool","zero-copy","hibernation","performance"],"exportEndpoints":{"claude":"/api/rules/bun-websocket-hibernation-buffer-pool-standard?format=claude","cursorMdc":"/api/rules/bun-websocket-hibernation-buffer-pool-standard?format=mdc","cursorrules":"/api/rules/bun-websocket-hibernation-buffer-pool-standard?format=cursor","windsurf":"/api/rules/bun-websocket-hibernation-buffer-pool-standard?format=windsurf","agents":"/api/rules/bun-websocket-hibernation-buffer-pool-standard?format=agents"}},{"id":"openfga-rebac-cache-invalidation-invariant","title":"OpenFGA Real-Time Tuple Invariant & Atomic Cache Invalidation Standard","category":"security","severity":"critical","description":"Enforces strict monotonic authorization consistency across distributed OpenFGA ReBAC evaluation paths and localized low-latency caching tiers. Mandates transactional outbox mutation patterns paired with atomic cache invalidation to prevent stale authorization grants (authorization drift) caused by out-of-order writes or un-invalidated graph traversals. Guarantees sub-millisecond zero-trust check evaluations without sacrificing access revocation consistency.","antiPatternHeadline":"Decoupled Asynchronous OpenFGA Writes with Uncoordinated Redis TTL Caching Permitting Revoked Access Grants","stars_count":109,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","rebac","authorization","cache-invalidation","redis","zero-trust"],"exportEndpoints":{"claude":"/api/rules/openfga-rebac-cache-invalidation-invariant?format=claude","cursorMdc":"/api/rules/openfga-rebac-cache-invalidation-invariant?format=mdc","cursorrules":"/api/rules/openfga-rebac-cache-invalidation-invariant?format=cursor","windsurf":"/api/rules/openfga-rebac-cache-invalidation-invariant?format=windsurf","agents":"/api/rules/openfga-rebac-cache-invalidation-invariant?format=agents"}},{"id":"webauthn-level3-conditional-ui-assertion-guardrail","title":"WebAuthn Level 3 Conditional UI & Device-Bound Assertion Invariant Guardrail","category":"security","severity":"critical","description":"Enforces strict WebAuthn Level 3 conditional UI orchestration and server-side device-bound passkey assertion verification. Prevents race conditions and credential hijacking by mandating AbortController-managed autofill mediation, user-verification enforcement, and cryptographic validation of authenticatorData flags.","antiPatternHeadline":"Unmanaged Conditional UI Autofill Collisions and Flawed User Verification Enforcement in Passkey Assertions","stars_count":73,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","passkeys","fido2","conditional-ui","authentication","cryptography"],"exportEndpoints":{"claude":"/api/rules/webauthn-level3-conditional-ui-assertion-guardrail?format=claude","cursorMdc":"/api/rules/webauthn-level3-conditional-ui-assertion-guardrail?format=mdc","cursorrules":"/api/rules/webauthn-level3-conditional-ui-assertion-guardrail?format=cursor","windsurf":"/api/rules/webauthn-level3-conditional-ui-assertion-guardrail?format=windsurf","agents":"/api/rules/webauthn-level3-conditional-ui-assertion-guardrail?format=agents"}},{"id":"kmp-swift-concurrency-actor-isolation-boundary","title":"Kotlin Multiplatform to Swift 6 Concurrency and Actor Isolation Boundary","category":"mobile","severity":"critical","description":"Enforces deterministic actor isolation and thread-safe bridging when mapping Kotlin Coroutines and StateFlow to Swift 6 async/await. Eliminates data races, UI thread starvation, and off-main mutations by binding Swift consumer wrappers strictly to @MainActor tasks and enforcing explicit cancellation hooks across the Obj-C runtime boundary.","antiPatternHeadline":"Unconstrained Kotlin completion handlers mutating SwiftUI state across foreign thread pools","stars_count":45,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","swift-concurrency","ios","coroutines","stateflow"],"exportEndpoints":{"claude":"/api/rules/kmp-swift-concurrency-actor-isolation-boundary?format=claude","cursorMdc":"/api/rules/kmp-swift-concurrency-actor-isolation-boundary?format=mdc","cursorrules":"/api/rules/kmp-swift-concurrency-actor-isolation-boundary?format=cursor","windsurf":"/api/rules/kmp-swift-concurrency-actor-isolation-boundary?format=windsurf","agents":"/api/rules/kmp-swift-concurrency-actor-isolation-boundary?format=agents"}},{"id":"ebpf-ambient-mesh-kernel-l7-enforcement","title":"eBPF Ambient Mesh and Kernel-Level L7 Policy Enforcement Standard","category":"devops","severity":"critical","description":"Enforces sidecarless architectural integrity by migrating L4/L7 routing, mTLS identity verification, and DDoS packet mitigation directly into the Linux kernel using eBPF programs (TC/XDP and sockops). Eliminates user-space proxy overhead while guaranteeing deterministic network policy enforcement, strict kernel verification compliance, and cryptographic identity attestation across ambient mesh workloads.","antiPatternHeadline":"Injecting User-Space Proxy Sidecars and Handling L7 Flow Parsing in Unbounded XDP Contexts","stars_count":89,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","service-mesh","ambient-mesh","cilium","xdp","tc","mtls","l7-policy"],"exportEndpoints":{"claude":"/api/rules/ebpf-ambient-mesh-kernel-l7-enforcement?format=claude","cursorMdc":"/api/rules/ebpf-ambient-mesh-kernel-l7-enforcement?format=mdc","cursorrules":"/api/rules/ebpf-ambient-mesh-kernel-l7-enforcement?format=cursor","windsurf":"/api/rules/ebpf-ambient-mesh-kernel-l7-enforcement?format=windsurf","agents":"/api/rules/ebpf-ambient-mesh-kernel-l7-enforcement?format=agents"}},{"id":"slsa-l4-hermetic-keyless-signature-guardrail","title":"SLSA Level 4 Hermetic Build and Keyless Ephemeral Signature Invariant","category":"devops","severity":"critical","description":"Enforces strict SLSA Build Level 3/4 compliance by mandating network-isolated, hermetic compilation pipelines and non-forgeable provenance. Replaces persistent build-agent credentials and static signing keys with OIDC-federated ephemeral Fulcio certificates, Rekor transparency log attestations, and cryptographic container digest immutability.","antiPatternHeadline":"Non-Hermetic Runtime Ingestion with Static Long-Lived Cryptographic Signing Keys","stars_count":54,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["slsa-l4","supply-chain-security","cosign","fulcio","rekor","hermetic-builds","sigstore"],"exportEndpoints":{"claude":"/api/rules/slsa-l4-hermetic-keyless-signature-guardrail?format=claude","cursorMdc":"/api/rules/slsa-l4-hermetic-keyless-signature-guardrail?format=mdc","cursorrules":"/api/rules/slsa-l4-hermetic-keyless-signature-guardrail?format=cursor","windsurf":"/api/rules/slsa-l4-hermetic-keyless-signature-guardrail?format=windsurf","agents":"/api/rules/slsa-l4-hermetic-keyless-signature-guardrail?format=agents"}},{"id":"nextjs-15-ppr-dynamic-hole-isolation","title":"Next.js 15 PPR Dynamic Hole Isolation and Static Shell Determinism","category":"frontend","severity":"critical","description":"Enforces strict isolation of dynamic runtime operations inside localized React Suspense boundaries under Next.js 15 Partial Prerendering (PPR). Prevents dynamic bailouts (headers, cookies, searchParams, un-cached data queries) from leaking upward and de-optimizing edge-cacheable static shell generation into fully dynamic SSR passes. Guarantees deterministic Time-To-First-Byte (TTFB) at edge Points of Presence (POPs) by mandating non-dynamic layouts and strict dynamic hole sandboxing.","antiPatternHeadline":"Unbounded Dynamic Access Leaking Across Layout Hierarchies Causing Static Shell De-optimization","stars_count":40,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs","react","ppr","partial-prerendering","suspense","performance"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-ppr-dynamic-hole-isolation?format=claude","cursorMdc":"/api/rules/nextjs-15-ppr-dynamic-hole-isolation?format=mdc","cursorrules":"/api/rules/nextjs-15-ppr-dynamic-hole-isolation?format=cursor","windsurf":"/api/rules/nextjs-15-ppr-dynamic-hole-isolation?format=windsurf","agents":"/api/rules/nextjs-15-ppr-dynamic-hole-isolation?format=agents"}},{"id":"vite6-environment-api-runtime-decoupling","title":"Vite 6 Environment API: Multi-Runtime Module Decoupling and Graph Isolation","category":"frontend","severity":"critical","description":"Enforces strict boundary isolation and dedicated compilation graphs across client, Node.js, and workerd/edge runtimes using the Vite 6 Environment API. Prevents runtime-specific polyfill bleeding, Node.js built-in leakage into edge/browser bundles, and illegal cross-environment module graph invalidations in hybrid SSR architectures.","antiPatternHeadline":"Monolithic ModuleGraph Sharing and Legacy SSR Flag Branching Leaking Runtime Globals","stars_count":116,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["vite6","environment-api","workerd","edge","ssr","module-graph","runtime-isolation"],"exportEndpoints":{"claude":"/api/rules/vite6-environment-api-runtime-decoupling?format=claude","cursorMdc":"/api/rules/vite6-environment-api-runtime-decoupling?format=mdc","cursorrules":"/api/rules/vite6-environment-api-runtime-decoupling?format=cursor","windsurf":"/api/rules/vite6-environment-api-runtime-decoupling?format=windsurf","agents":"/api/rules/vite6-environment-api-runtime-decoupling?format=agents"}},{"id":"axum-tower-graceful-drain-concurrency-production-standard","title":"Axum 0.8 Tower Graceful Draining & Concurrency-Limit Isolation","category":"backend","severity":"critical","description":"Enforces strict concurrency bounding and deterministic connection draining in Axum 0.8 / Tower HTTP services. Prevents thread starvation and rolling-deployment connection blackholes by decoupling TCP accept loops from bounded task pools and enforcing hard deadlines on inflight request completion during SIGTERM.","antiPatternHeadline":"Unbounded TCP connection ingestion with open-ended graceful shutdown causing Kubernetes pod termination timeouts and cascading thread pool exhaustion","stars_count":54,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tower","tokio","concurrency"],"exportEndpoints":{"claude":"/api/rules/axum-tower-graceful-drain-concurrency-production-standard?format=claude","cursorMdc":"/api/rules/axum-tower-graceful-drain-concurrency-production-standard?format=mdc","cursorrules":"/api/rules/axum-tower-graceful-drain-concurrency-production-standard?format=cursor","windsurf":"/api/rules/axum-tower-graceful-drain-concurrency-production-standard?format=windsurf","agents":"/api/rules/axum-tower-graceful-drain-concurrency-production-standard?format=agents"}},{"id":"fastapi-python313-nogil-shared-state-invariant","title":"FastAPI Python 3.13 Free-Threaded (No-GIL) Shared-State Thread-Safety Guardrail","category":"backend","severity":"critical","description":"Enforces strict thread-safety and concurrency invariants in FastAPI applications deployed on Python 3.13 free-threaded (PEP 703) runtimes. Strictly eliminates unshielded mutable in-memory singletons and race conditions across OS thread pools and asynchronous event loops while maximizing true multi-core parallel execution.","antiPatternHeadline":"Unprotected In-Memory Shared Mutable State Across Free-Threaded Worker Pools","stars_count":112,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","python313","no-gil","multithreading","concurrency"],"exportEndpoints":{"claude":"/api/rules/fastapi-python313-nogil-shared-state-invariant?format=claude","cursorMdc":"/api/rules/fastapi-python313-nogil-shared-state-invariant?format=mdc","cursorrules":"/api/rules/fastapi-python313-nogil-shared-state-invariant?format=cursor","windsurf":"/api/rules/fastapi-python313-nogil-shared-state-invariant?format=windsurf","agents":"/api/rules/fastapi-python313-nogil-shared-state-invariant?format=agents"}},{"id":"bun-zero-copy-sharedarraybuffer-ipc-clustering","title":"Bun 1.2 Zero-Copy SharedArrayBuffer IPC & Worker Clustering Standard","category":"backend","severity":"critical","description":"Enforces zero-copy inter-process and inter-worker communication across Bun 1.2 worker clusters using SharedArrayBuffer and Atomics synchronization primitives. Eliminates structured-cloning overhead, garbage collector thrashing, and sub-millisecond latency spikes in high-throughput multi-core workloads.","antiPatternHeadline":"Serializing High-Frequency Payloads via Structured Clone postMessage Across Bun Workers","stars_count":85,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","sharedarraybuffer","atomics","multithreading","ipc","performance"],"exportEndpoints":{"claude":"/api/rules/bun-zero-copy-sharedarraybuffer-ipc-clustering?format=claude","cursorMdc":"/api/rules/bun-zero-copy-sharedarraybuffer-ipc-clustering?format=mdc","cursorrules":"/api/rules/bun-zero-copy-sharedarraybuffer-ipc-clustering?format=cursor","windsurf":"/api/rules/bun-zero-copy-sharedarraybuffer-ipc-clustering?format=windsurf","agents":"/api/rules/bun-zero-copy-sharedarraybuffer-ipc-clustering?format=agents"}},{"id":"kmp-skie-swift-structured-concurrency-bridge","title":"KMP SKIE Bidirectional Cooperative Concurrency & Task Cancellation","category":"mobile","severity":"critical","description":"Enforces strict cooperative cancellation semantics and lifecycle binding across the Kotlin Multiplatform (KMP) Coroutine and Swift async/await runtime boundary using SKIE. Guarantees that Swift structured task cancellations propagate downward into Kotlin Job cancellation without unhandled CancellationExceptions, and that Kotlin cancellation propagates upward to Swift without orphan background work.","antiPatternHeadline":"Silent Thread Leaks and Broken Task Propagation Across the KMP-Swift Concurrency Barrier","stars_count":95,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kmp","kotlin-multiplatform","skie","swift","concurrency","coroutines","ios"],"exportEndpoints":{"claude":"/api/rules/kmp-skie-swift-structured-concurrency-bridge?format=claude","cursorMdc":"/api/rules/kmp-skie-swift-structured-concurrency-bridge?format=mdc","cursorrules":"/api/rules/kmp-skie-swift-structured-concurrency-bridge?format=cursor","windsurf":"/api/rules/kmp-skie-swift-structured-concurrency-bridge?format=windsurf","agents":"/api/rules/kmp-skie-swift-structured-concurrency-bridge?format=agents"}},{"id":"capacitor-secure-enclave-crypto-bridge-guardrail","title":"Capacitor 7 Secure Hardware Enclave Cryptographic Bridge Invariant","category":"mobile","severity":"critical","description":"Enforces non-extractable, biometric-gated hardware key generation and cryptographic operations executing directly within the iOS Secure Enclave (kSecAttrAccessControlUserPresence / SecureElement) and Android Keystore (KeyProperties.PURPOSE_SIGN with StrongBox/TEE backing). Private key material, raw seeds, and decrypted secret payloads MUST NEVER traverse the Capacitor JavaScript-to-Native bridge or reside in volatile V8/WebKit heap memory.","antiPatternHeadline":"Bridge-Transiting Cryptographic Keys and In-Memory Software Signing in Capacitor WebViews","stars_count":61,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","security","cryptography","ios","android"],"exportEndpoints":{"claude":"/api/rules/capacitor-secure-enclave-crypto-bridge-guardrail?format=claude","cursorMdc":"/api/rules/capacitor-secure-enclave-crypto-bridge-guardrail?format=mdc","cursorrules":"/api/rules/capacitor-secure-enclave-crypto-bridge-guardrail?format=cursor","windsurf":"/api/rules/capacitor-secure-enclave-crypto-bridge-guardrail?format=windsurf","agents":"/api/rules/capacitor-secure-enclave-crypto-bridge-guardrail?format=agents"}},{"id":"webauthn-prf-conditional-mediation-key-derivation","title":"Deterministic Zero-Knowledge Key Derivation via WebAuthn PRF and Conditional Mediation","category":"security","severity":"critical","description":"Enforces strict cryptographic boundaries when using the WebAuthn PRF (Pseudo-Random Function) extension with conditional mediation for end-to-end encryption. Guarantees that authenticator-derived seeds are never transmitted to relying party servers, are isolated per security domain, and are processed strictly through HKDF before cipher instantiation.","antiPatternHeadline":"Exposing Raw Authenticator PRF Outputs to Relying Party Servers or Reusing Unsalted PRF Roots Directly as Symmetric Cipher Keys","stars_count":93,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","prf-extension","passkeys","cryptography","zero-knowledge"],"exportEndpoints":{"claude":"/api/rules/webauthn-prf-conditional-mediation-key-derivation?format=claude","cursorMdc":"/api/rules/webauthn-prf-conditional-mediation-key-derivation?format=mdc","cursorrules":"/api/rules/webauthn-prf-conditional-mediation-key-derivation?format=cursor","windsurf":"/api/rules/webauthn-prf-conditional-mediation-key-derivation?format=windsurf","agents":"/api/rules/webauthn-prf-conditional-mediation-key-derivation?format=agents"}},{"id":"sigstore-cosign-keyless-slsa3-provenance-guardrail","title":"Sigstore Cosign Ephemeral Keyless Provenance and SLSA-3 Admission Pinning","category":"security","severity":"critical","description":"Enforces cryptographically verifiable, keyless container signing and SLSA-3 provenance validation via OIDC workload identity (Fulcio/Rekor) at admission control. Prohibits static private key-based Cosign workflows and unverified mutable image tags in production deployments to eliminate CI/CD secret exfiltration and image tampering vectors.","antiPatternHeadline":"Trusting unverified container tags or using static Cosign private keys stored in CI secrets instead of workload identity OIDC and Rekor transparency checks.","stars_count":112,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","sigstore","cosign","slsa-3","supply-chain","kyverno","kubernetes"],"exportEndpoints":{"claude":"/api/rules/sigstore-cosign-keyless-slsa3-provenance-guardrail?format=claude","cursorMdc":"/api/rules/sigstore-cosign-keyless-slsa3-provenance-guardrail?format=mdc","cursorrules":"/api/rules/sigstore-cosign-keyless-slsa3-provenance-guardrail?format=cursor","windsurf":"/api/rules/sigstore-cosign-keyless-slsa3-provenance-guardrail?format=windsurf","agents":"/api/rules/sigstore-cosign-keyless-slsa3-provenance-guardrail?format=agents"}},{"id":"cilium-tetragon-ebpf-namespace-guardrail","title":"Cilium Tetragon eBPF Synchronous Kernel Namespace Escape Mitigation","category":"devops","severity":"critical","description":"Monitors ring-0 syscall transitions (such as sys_enter_setns and sys_enter_unshare) to synchronously terminate unauthorized process namespace tampering or container breakout attempts prior to userspace return. Mandates proactive in-kernel Sigkill actions within Tetragon TracingPolicies rather than asynchronous userspace alert pipelines. Prevents host privilege escalation and time-of-check to time-of-use (TOCTOU) container boundary escapes across Kubernetes worker nodes.","antiPatternHeadline":"Asynchronous Userspace Auditing of Namespace Mutation Syscalls Without In-Kernel Sigkill Enforcement","stars_count":116,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","tetragon","cilium","kubernetes","kernel-security","zero-trust"],"exportEndpoints":{"claude":"/api/rules/cilium-tetragon-ebpf-namespace-guardrail?format=claude","cursorMdc":"/api/rules/cilium-tetragon-ebpf-namespace-guardrail?format=mdc","cursorrules":"/api/rules/cilium-tetragon-ebpf-namespace-guardrail?format=cursor","windsurf":"/api/rules/cilium-tetragon-ebpf-namespace-guardrail?format=windsurf","agents":"/api/rules/cilium-tetragon-ebpf-namespace-guardrail?format=agents"}},{"id":"svelte-5-state-raw-deep-proxy-isolation","title":"Svelte 5 $state.raw Deep Proxy Isolation for High-Frequency State","category":"frontend","severity":"critical","description":"Enforces immutable reference tracking via Svelte 5 '$state.raw' for high-frequency telemetry, large collections, and canvas/WebGL render buffers. Using standard deep reactive '$state' on volatile datasets creates hundreds of recursive Proxy instances per frame, triggering severe garbage collection churn and micro-task scheduler saturation.","antiPatternHeadline":"Wrapping high-frequency telemetry streams, large arrays, or canvas frame buffers in deeply reactive '$state' proxies.","stars_count":56,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","state-raw","performance","canvas","telemetry"],"exportEndpoints":{"claude":"/api/rules/svelte-5-state-raw-deep-proxy-isolation?format=claude","cursorMdc":"/api/rules/svelte-5-state-raw-deep-proxy-isolation?format=mdc","cursorrules":"/api/rules/svelte-5-state-raw-deep-proxy-isolation?format=cursor","windsurf":"/api/rules/svelte-5-state-raw-deep-proxy-isolation?format=windsurf","agents":"/api/rules/svelte-5-state-raw-deep-proxy-isolation?format=agents"}},{"id":"nextjs-15-distributed-cache-tag-invalidation-boundary","title":"Next.js 15 Distributed Cache Tag Invalidation Boundary","category":"frontend","severity":"critical","description":"Mandates deterministic compound cache key topology and synchronized multi-region invalidation boundaries when utilizing Next.js 15's 'use cache', 'cacheTag', and 'cacheLife' APIs. Prevents stale edge node divergence and regional split-brain reads across geo-distributed deployments by enforcing namespaced, compound cache tags and distributed cache consistency.","antiPatternHeadline":"Unscoped Global Tags and In-Memory Revalidation in Multi-Region Distributed Clusters","stars_count":64,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs","use-cache","cache-invalidation","multi-region","distributed-systems"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-distributed-cache-tag-invalidation-boundary?format=claude","cursorMdc":"/api/rules/nextjs-15-distributed-cache-tag-invalidation-boundary?format=mdc","cursorrules":"/api/rules/nextjs-15-distributed-cache-tag-invalidation-boundary?format=cursor","windsurf":"/api/rules/nextjs-15-distributed-cache-tag-invalidation-boundary?format=windsurf","agents":"/api/rules/nextjs-15-distributed-cache-tag-invalidation-boundary?format=agents"}},{"id":"fastapi-lifespan-async-resource-teardown","title":"FastAPI Lifespan Context Manager Async Resource Teardown and Worker Drain","category":"backend","severity":"critical","description":"Enforces deterministic resource lifecycle management using FastAPI's asynccontextmanager lifespan protocol instead of deprecated @app.on_event handlers. Guarantees structured teardown of async connection pools, active task queues, and external clients within a protected try/finally block during SIGTERM or application termination.","antiPatternHeadline":"Leaking unclosed connection pools and dropping active in-flight worker tasks via legacy @app.on_event handlers","stars_count":49,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","asyncio","lifespan","resource-management","python"],"exportEndpoints":{"claude":"/api/rules/fastapi-lifespan-async-resource-teardown?format=claude","cursorMdc":"/api/rules/fastapi-lifespan-async-resource-teardown?format=mdc","cursorrules":"/api/rules/fastapi-lifespan-async-resource-teardown?format=cursor","windsurf":"/api/rules/fastapi-lifespan-async-resource-teardown?format=windsurf","agents":"/api/rules/fastapi-lifespan-async-resource-teardown?format=agents"}},{"id":"go-chi-context-cancellation-deadline-propagation","title":"Go Chi Context Cancellation & Strict Deadline Propagation","category":"backend","severity":"critical","description":"Enforces strict downstream context propagation, client disconnect detection, and boundary timeouts across Go Chi HTTP middleware and handlers. Prevents orphaned goroutine leaks, uncancelable long-running transactions, and database pool starvation during premature client termination.","antiPatternHeadline":"Discarding r.Context() or spawning background goroutines with context.Background() in HTTP middleware pipelines","stars_count":99,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","chi","concurrency","goroutines","context"],"exportEndpoints":{"claude":"/api/rules/go-chi-context-cancellation-deadline-propagation?format=claude","cursorMdc":"/api/rules/go-chi-context-cancellation-deadline-propagation?format=mdc","cursorrules":"/api/rules/go-chi-context-cancellation-deadline-propagation?format=cursor","windsurf":"/api/rules/go-chi-context-cancellation-deadline-propagation?format=windsurf","agents":"/api/rules/go-chi-context-cancellation-deadline-propagation?format=agents"}},{"id":"pg17-stat-io-direct-io-memory-guardrail","title":"PostgreSQL 17 pg_stat_io Telemetry and Cache Double-Buffering Guardrail","category":"backend","severity":"critical","description":"Establishes automated telemetry thresholds on PostgreSQL 17 pg_stat_io metrics to identify and prevent OS page cache double-buffering and shared buffer eviction storms during high-concurrency analytical and streaming workloads. Mandates automated rate-of-change tripwires on bulkread and normal I/O contexts alongside cursor-constrained streaming in application services.","antiPatternHeadline":"Unmonitored Bulk Ingestion and Analytics Inducing OS Page Cache Double-Buffering and Buffer Thrashing","stars_count":112,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","pg-stat-io","performance","memory-management","database"],"exportEndpoints":{"claude":"/api/rules/pg17-stat-io-direct-io-memory-guardrail?format=claude","cursorMdc":"/api/rules/pg17-stat-io-direct-io-memory-guardrail?format=mdc","cursorrules":"/api/rules/pg17-stat-io-direct-io-memory-guardrail?format=cursor","windsurf":"/api/rules/pg17-stat-io-direct-io-memory-guardrail?format=windsurf","agents":"/api/rules/pg17-stat-io-direct-io-memory-guardrail?format=agents"}},{"id":"webauthn-prf-deterministic-key-derivation-guardrail","title":"WebAuthn PRF Deterministic Key Derivation & Zero-Knowledge Storage Invariant","category":"security","severity":"critical","description":"Enforces strict cryptographic domain separation and ephemeral memory confinement when utilizing the WebAuthn Pseudo-Random Function (PRF) extension. Raw PRF outputs must never be transmitted to backends, persisted unencrypted, or used directly as encryption keys without HKDF expansion into non-extractable WebCrypto keys.","antiPatternHeadline":"Exposing Raw Authenticator PRF Outputs or Using PRF Bytes Directly as Symmetric Keys Without Domain-Separated HKDF Expansion","stars_count":53,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","prf","cryptography","zero-knowledge","webcrypto","hkdf"],"exportEndpoints":{"claude":"/api/rules/webauthn-prf-deterministic-key-derivation-guardrail?format=claude","cursorMdc":"/api/rules/webauthn-prf-deterministic-key-derivation-guardrail?format=mdc","cursorrules":"/api/rules/webauthn-prf-deterministic-key-derivation-guardrail?format=cursor","windsurf":"/api/rules/webauthn-prf-deterministic-key-derivation-guardrail?format=windsurf","agents":"/api/rules/webauthn-prf-deterministic-key-derivation-guardrail?format=agents"}},{"id":"tauri-v2-capabilities-matrix-ipc-isolation-standard","title":"Tauri 2.0 Capabilities Matrix IPC Isolation Standard","category":"security","severity":"critical","description":"Enforces granular, cryptographically bound capability matrices and strict IPC scope limitations across distinct webview windows in Tauri 2.0 architectures. Prohibits global command enablement, wildcard file system or shell scopes, and undocumented invoke boundaries to prevent remote code execution through compromised renderers.","antiPatternHeadline":"Monolithic Global IPC Exposure with Wildcard Capability Grants","stars_count":62,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","tauri","ipc","rust","capabilities","zero-trust"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-capabilities-matrix-ipc-isolation-standard?format=claude","cursorMdc":"/api/rules/tauri-v2-capabilities-matrix-ipc-isolation-standard?format=mdc","cursorrules":"/api/rules/tauri-v2-capabilities-matrix-ipc-isolation-standard?format=cursor","windsurf":"/api/rules/tauri-v2-capabilities-matrix-ipc-isolation-standard?format=windsurf","agents":"/api/rules/tauri-v2-capabilities-matrix-ipc-isolation-standard?format=agents"}},{"id":"kmp-swift-arc-reference-boundary","title":"Kotlin Multiplatform Swift Interop Strong Reference Boundary Guardrail","category":"mobile","severity":"critical","description":"Defines strict weak-reference semantics, scope termination lifecycles, and delegate decoupling across the Kotlin/Native ARC boundary to Apple Swift runtimes. Cross-language object graphs crossing this foreign function interface (FFI) lack unified cycle collectors, causing silent, non-reclaimable multi-megabyte retain cycles if strong references loop across runtimes.","antiPatternHeadline":"Cross-Boundary Strong Retain Cycles Between Swift Delegates and Kotlin State Observers","stars_count":77,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","swift","memory-leaks","arc","garbage-collection"],"exportEndpoints":{"claude":"/api/rules/kmp-swift-arc-reference-boundary?format=claude","cursorMdc":"/api/rules/kmp-swift-arc-reference-boundary?format=mdc","cursorrules":"/api/rules/kmp-swift-arc-reference-boundary?format=cursor","windsurf":"/api/rules/kmp-swift-arc-reference-boundary?format=windsurf","agents":"/api/rules/kmp-swift-arc-reference-boundary?format=agents"}},{"id":"capacitor-7-bridge-integrity-origin-attestation","title":"Capacitor 7 Native Bridge Origin Attestation and Secure Scheme Hardening","category":"mobile","severity":"critical","description":"Enforces strict origin validation, explicit custom schemes, and restrictive Content Security Policies across the Capacitor 7 JavaScript-to-Native bridge. Prevents untrusted remote contexts and injected scripts from accessing high-privilege native device plugins via window.Capacitor.toNative. Mandates hardened server configuration and verified navigation boundaries to eliminate privilege escalation vectors.","antiPatternHeadline":"Wildcard Navigation Whitelisting and Insecure Scheme Binding Exposing Native APIs to Untrusted Origins","stars_count":84,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","security","bridge-integrity","csp","origin-attestation"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-bridge-integrity-origin-attestation?format=claude","cursorMdc":"/api/rules/capacitor-7-bridge-integrity-origin-attestation?format=mdc","cursorrules":"/api/rules/capacitor-7-bridge-integrity-origin-attestation?format=cursor","windsurf":"/api/rules/capacitor-7-bridge-integrity-origin-attestation?format=windsurf","agents":"/api/rules/capacitor-7-bridge-integrity-origin-attestation?format=agents"}},{"id":"opentelemetry-otlp-arrow-stream-ingestion-production-standard","title":"OpenTelemetry OTLP/Arrow Columnar Stream Ingestion Standard","category":"devops","severity":"critical","description":"Mandates the use of Apache Arrow columnar serialization for high-volume collector-to-collector and gateway-to-backend OpenTelemetry pipelines. Enforcing OTLP/Arrow eliminates row-by-row Protobuf unmarshaling overhead, amortizes schema metadata across record batches, and reduces telemetry egress bandwidth and serialization CPU costs by 60% to 80% under sustained load.","antiPatternHeadline":"Transporting High-Volume OTLP via Row-Based Protobuf Between Aggregation Collectors","stars_count":59,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","apache-arrow","otlp-arrow","observability","grpc","performance-engineering"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-otlp-arrow-stream-ingestion-production-standard?format=claude","cursorMdc":"/api/rules/opentelemetry-otlp-arrow-stream-ingestion-production-standard?format=mdc","cursorrules":"/api/rules/opentelemetry-otlp-arrow-stream-ingestion-production-standard?format=cursor","windsurf":"/api/rules/opentelemetry-otlp-arrow-stream-ingestion-production-standard?format=windsurf","agents":"/api/rules/opentelemetry-otlp-arrow-stream-ingestion-production-standard?format=agents"}},{"id":"nextjs-15-ppr-dynamic-hole-streaming-isolation","title":"Next.js 15 Partial Prerendering (PPR) Dynamic Hole Streaming Isolation","category":"frontend","severity":"critical","description":"Next.js 15 Partial Prerendering requires strict boundary separation between static prerendered shells and dynamic runtime execution. Invoking dynamic APIs (e.g., cookies(), headers(), searchParams, or uncached database reads) in a route component without wrapping it in an explicit React Suspense boundary invalidates the prerendered shell and forces full-route server-side rendering de-optimization.","antiPatternHeadline":"Calling dynamic request-time APIs directly in root layouts or page components without Suspense containment, de-optimizing the static shell into full SSR.","stars_count":97,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs15","ppr","react-suspense","streaming","performance"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-ppr-dynamic-hole-streaming-isolation?format=claude","cursorMdc":"/api/rules/nextjs-15-ppr-dynamic-hole-streaming-isolation?format=mdc","cursorrules":"/api/rules/nextjs-15-ppr-dynamic-hole-streaming-isolation?format=cursor","windsurf":"/api/rules/nextjs-15-ppr-dynamic-hole-streaming-isolation?format=windsurf","agents":"/api/rules/nextjs-15-ppr-dynamic-hole-streaming-isolation?format=agents"}},{"id":"tanstack-router-preload-cache-invalidation-invariants","title":"TanStack Router Preload Cache Synchronization and Mutation Invalidation Standards","category":"frontend","severity":"critical","description":"Enforces deterministic loader cache lifecycles, abort signal propagation, and synchronous route invalidation across rapid client transitions in TanStack Router. Prevents race conditions and stale-data read anomalies caused by asynchronous preloads competing with concurrent mutations or fast navigational switches.","antiPatternHeadline":"Unsynchronized In-Flight Route Preloads Overwriting Fresh Mutation State and Creating Stale Loader Anomalies","stars_count":103,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","tanstack-router","typescript","react","cache-invalidation","routing"],"exportEndpoints":{"claude":"/api/rules/tanstack-router-preload-cache-invalidation-invariants?format=claude","cursorMdc":"/api/rules/tanstack-router-preload-cache-invalidation-invariants?format=mdc","cursorrules":"/api/rules/tanstack-router-preload-cache-invalidation-invariants?format=cursor","windsurf":"/api/rules/tanstack-router-preload-cache-invalidation-invariants?format=windsurf","agents":"/api/rules/tanstack-router-preload-cache-invalidation-invariants?format=agents"}},{"id":"bun-tcp-backpressure-drain-invariants","title":"Bun 1.2 TCP Zero-Copy Backpressure and Socket Drain Lifecycle Enforcement","category":"backend","severity":"critical","description":"Mandates strict handling of TCP socket backpressure in Bun 1.2+ runtimes by evaluating socket.write() return codes and synchronizing with the asynchronous drain lifecycle. Bypassing backpressure checks during high-throughput streams causes unmanaged native heap accumulation in Bun worker runtimes, leading to silent latency degradation and resident set size (RSS) out-of-memory crashes.","antiPatternHeadline":"Unchecked Fire-and-Forget Streaming Over TCP Sockets Without Drain Lifecycle Flow Control","stars_count":59,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","tcp","backpressure","networking","zero-copy","memory-leak"],"exportEndpoints":{"claude":"/api/rules/bun-tcp-backpressure-drain-invariants?format=claude","cursorMdc":"/api/rules/bun-tcp-backpressure-drain-invariants?format=mdc","cursorrules":"/api/rules/bun-tcp-backpressure-drain-invariants?format=cursor","windsurf":"/api/rules/bun-tcp-backpressure-drain-invariants?format=windsurf","agents":"/api/rules/bun-tcp-backpressure-drain-invariants?format=agents"}},{"id":"go-range-over-func-early-exit-cleanup","title":"Go 1.24 Push Iterator Early-Exit and Goroutine Leak Prevention","category":"backend","severity":"critical","description":"Enforces strict termination and resource cleanup invariants in Go 1.24 range-over-func push iterators (iter.Seq and iter.Seq2). Yield calls returning false indicate downstream consumer breaks, requiring immediate cessation of traversal, deterministic lock releases, and active cancellation of associated producer goroutines.","antiPatternHeadline":"Ignoring yield() return values or failing to propagate cancellation to concurrent worker goroutines during iterator breaks.","stars_count":64,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["go","concurrency","iterators","range-over-func","backend","goroutine-leaks"],"exportEndpoints":{"claude":"/api/rules/go-range-over-func-early-exit-cleanup?format=claude","cursorMdc":"/api/rules/go-range-over-func-early-exit-cleanup?format=mdc","cursorrules":"/api/rules/go-range-over-func-early-exit-cleanup?format=cursor","windsurf":"/api/rules/go-range-over-func-early-exit-cleanup?format=windsurf","agents":"/api/rules/go-range-over-func-early-exit-cleanup?format=agents"}},{"id":"kmp-swift-async-cancellation-bridge-guardrail","title":"Kotlin Multiplatform Swift Async Cancellation Bridge Invariant","category":"mobile","severity":"critical","description":"Exporting Kotlin suspend functions directly to Swift via default Kotlin/Native Objective-C bridges creates Swift async calls that do not propagate cooperative cancellation backward to the Kotlin runtime. When an iOS Swift Task is cancelled, the underlying Kotlin CoroutineScope/Job remains active, creating orphaned background executions, thread starvation, and persistent memory leaks. All cross-boundary async invocations must bind Swift Task cancellation handlers directly to Kotlin Job cancellation tokens or utilize robust compiler plugin abstractions (such as SKIE or KMP-NativeCoroutines).","antiPatternHeadline":"Unbridged Kotlin Suspend Invocation via Default Swift Concurrency Bridging","stars_count":57,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kmp","kotlin-multiplatform","swift","concurrency","coroutines","memory-leaks"],"exportEndpoints":{"claude":"/api/rules/kmp-swift-async-cancellation-bridge-guardrail?format=claude","cursorMdc":"/api/rules/kmp-swift-async-cancellation-bridge-guardrail?format=mdc","cursorrules":"/api/rules/kmp-swift-async-cancellation-bridge-guardrail?format=cursor","windsurf":"/api/rules/kmp-swift-async-cancellation-bridge-guardrail?format=windsurf","agents":"/api/rules/kmp-swift-async-cancellation-bridge-guardrail?format=agents"}},{"id":"tauri-v2-granular-ipc-sandboxing","title":"Tauri 2.0 Window-Scoped Capability and Granular IPC Command Sandboxing","category":"security","severity":"critical","description":"Enforce strict window-scoped capability mapping and granular command permissions in Tauri 2.0 to prevent privilege escalation via frontend DOM injection. All IPC commands must be explicitly registered within designated capability files restricted to specific window labels, remote domains, or webview instances. Wildcard permission grants or global command exposure across untrusted contexts violate the principle of least privilege and expose native OS operations to XSS exploitation.","antiPatternHeadline":"Global Unsandboxed IPC Commands and Over-Permissive Capability Scopes Exposing Native OS Execution","stars_count":90,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","tauri","rust","ipc","sandboxing","capabilities"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-granular-ipc-sandboxing?format=claude","cursorMdc":"/api/rules/tauri-v2-granular-ipc-sandboxing?format=mdc","cursorrules":"/api/rules/tauri-v2-granular-ipc-sandboxing?format=cursor","windsurf":"/api/rules/tauri-v2-granular-ipc-sandboxing?format=windsurf","agents":"/api/rules/tauri-v2-granular-ipc-sandboxing?format=agents"}},{"id":"wasi-0-2-capability-restricted-wit-host-bindings","title":"Enforce Least-Privilege WIT Capability Sandboxing in WASI 0.2 Host Runtimes","category":"security","severity":"critical","description":"Untrusted guest WebAssembly components must execute within strictly attenuated capability domains defined by explicit WebAssembly Interface Type (WIT) contracts. Host runtimes must never expose blanket WASI 0.2 interfaces, ambient host sockets, or uncontained filesystem handles through WasiCtxBuilder. All host bindings must enforce resource tables, capability attenuation, and virtualized memory/network boundaries to prevent guest privilege escalation.","antiPatternHeadline":"Exposing Ambient Host Capabilities or Inherited WASI CLI Worlds to Untrusted Components","stars_count":41,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","wasm","wasi","wit","component-model","wasmtime","sandbox"],"exportEndpoints":{"claude":"/api/rules/wasi-0-2-capability-restricted-wit-host-bindings?format=claude","cursorMdc":"/api/rules/wasi-0-2-capability-restricted-wit-host-bindings?format=mdc","cursorrules":"/api/rules/wasi-0-2-capability-restricted-wit-host-bindings?format=cursor","windsurf":"/api/rules/wasi-0-2-capability-restricted-wit-host-bindings?format=windsurf","agents":"/api/rules/wasi-0-2-capability-restricted-wit-host-bindings?format=agents"}},{"id":"ebpf-xdp-l4-ingress-kernel-bypass-rate-limiting-guardrail","title":"eBPF/XDP Layer-4 Ingress Kernel-Bypass Rate-Limiting Guardrail","category":"devops","severity":"critical","description":"Offloading L4 connection tracking and volumetric packet filtering to the eBPF XDP hook eliminates kernel network stack overhead and CPU starvation during ingress volumetric bursts. Software systems must leverage driver-mode or native XDP with per-CPU BPF maps and lockless token-bucket rate limiters prior to sk_buff allocation. Failure to decouple rate limiting from the sk_buff allocation pipeline leaves infrastructure vulnerable to softirq saturation and kernel-level denial of service.","antiPatternHeadline":"Processing Layer-4 Rate-Limiting in User Space or Standard iptables/Netfilter Sk_buff Pipeline","stars_count":80,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","xdp","networking","ddos-mitigation","kernel-bypass","performance"],"exportEndpoints":{"claude":"/api/rules/ebpf-xdp-l4-ingress-kernel-bypass-rate-limiting-guardrail?format=claude","cursorMdc":"/api/rules/ebpf-xdp-l4-ingress-kernel-bypass-rate-limiting-guardrail?format=mdc","cursorrules":"/api/rules/ebpf-xdp-l4-ingress-kernel-bypass-rate-limiting-guardrail?format=cursor","windsurf":"/api/rules/ebpf-xdp-l4-ingress-kernel-bypass-rate-limiting-guardrail?format=windsurf","agents":"/api/rules/ebpf-xdp-l4-ingress-kernel-bypass-rate-limiting-guardrail?format=agents"}},{"id":"otel-baggage-sanitization-tenant-boundary","title":"OpenTelemetry W3C Baggage Sanitization and Tenant Boundary Invariant","category":"devops","severity":"critical","description":"Cross-boundary asynchronous message broker boundaries require strict sanitization and schema validation of W3C baggage entries. Propagating raw, unvalidated baggage headers leads to cross-tenant context pollution, silent PII exfiltration into distributed telemetry backends, and trace context corruption across isolation perimeters.","antiPatternHeadline":"Blind Propagation of Untrusted W3C Baggage Across Async Broker Boundaries","stars_count":100,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","security","multi-tenancy","tracing","kafka"],"exportEndpoints":{"claude":"/api/rules/otel-baggage-sanitization-tenant-boundary?format=claude","cursorMdc":"/api/rules/otel-baggage-sanitization-tenant-boundary?format=mdc","cursorrules":"/api/rules/otel-baggage-sanitization-tenant-boundary?format=cursor","windsurf":"/api/rules/otel-baggage-sanitization-tenant-boundary?format=windsurf","agents":"/api/rules/otel-baggage-sanitization-tenant-boundary?format=agents"}},{"id":"nextjs-15-ppr-streaming-fallback-invariants","title":"Next.js 15 PPR Static Shell Isolation & Streaming Fallback Invariants","category":"frontend","severity":"critical","description":"Enforces strict isolation between static prerendered page shells and dynamic runtime components in Next.js 15 Partial Prerendering (PPR). Mandates deterministic dimensional reservation via static fallback skeletons wrapped in React Suspense boundaries to eliminate layout shifts, waterfalls, and dynamic bailout de-optimizations during static analysis.","antiPatternHeadline":"Uncontained Dynamic Operations Leaking Into Static Shells and Dynamic Skeletons Causing PPR De-optimization","stars_count":93,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs15","ppr","react-suspense","streaming","layout-shift","server-components"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-ppr-streaming-fallback-invariants?format=claude","cursorMdc":"/api/rules/nextjs-15-ppr-streaming-fallback-invariants?format=mdc","cursorrules":"/api/rules/nextjs-15-ppr-streaming-fallback-invariants?format=cursor","windsurf":"/api/rules/nextjs-15-ppr-streaming-fallback-invariants?format=windsurf","agents":"/api/rules/nextjs-15-ppr-streaming-fallback-invariants?format=agents"}},{"id":"fastapi-python313-freethreaded-concurrency-isolation","title":"Free-Threaded Python 3.13 Concurrency Isolation and Safe Shared Memory Standard","category":"backend","severity":"critical","description":"Enforces strict thread-safe request context isolation and synchronization primitives for FastAPI microservices running under free-threaded Python 3.13 (PEP 703). Prevents data races, torn reads, and cross-thread memory corruption caused by concurrent mutations to unsynchronized module-level state, standard collections, and shared object pools.","antiPatternHeadline":"Unsynchronized Global State Mutation and Context Bleed Under Free-Threaded Execution","stars_count":103,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","python3.13","nogil","concurrency","thread-safety","asyncio"],"exportEndpoints":{"claude":"/api/rules/fastapi-python313-freethreaded-concurrency-isolation?format=claude","cursorMdc":"/api/rules/fastapi-python313-freethreaded-concurrency-isolation?format=mdc","cursorrules":"/api/rules/fastapi-python313-freethreaded-concurrency-isolation?format=cursor","windsurf":"/api/rules/fastapi-python313-freethreaded-concurrency-isolation?format=windsurf","agents":"/api/rules/fastapi-python313-freethreaded-concurrency-isolation?format=agents"}},{"id":"go-arena-allocation-chi-gateway","title":"Deterministic Go 1.24 Arena Lifecycle Management in Chi Gateway Pipelines","category":"backend","severity":"critical","description":"Enforces strict request-scoped arena allocation lifecycles using `arena.NewArena()` within Chi HTTP middleware. Prevents memory corruption, premature free panic vulnerabilities, and use-after-free bugs caused by arena-allocated pointers leaking past the HTTP request-response cycle into long-lived goroutines or global sync pools in 100k+ RPS workloads.","antiPatternHeadline":"Leaking Request-Scoped Arena References to Asynchronous Goroutines and Global Contexts","stars_count":70,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","golang","memory-management","arena-allocator","chi-router","garbage-collection","high-throughput"],"exportEndpoints":{"claude":"/api/rules/go-arena-allocation-chi-gateway?format=claude","cursorMdc":"/api/rules/go-arena-allocation-chi-gateway?format=mdc","cursorrules":"/api/rules/go-arena-allocation-chi-gateway?format=cursor","windsurf":"/api/rules/go-arena-allocation-chi-gateway?format=windsurf","agents":"/api/rules/go-arena-allocation-chi-gateway?format=agents"}},{"id":"capacitor-7-hardware-key-attestation-standard","title":"Capacitor 7 Hardware-Backed Key Attestation & Enclave Binding Standard","category":"mobile","severity":"critical","description":"Enforces non-exportable, hardware-enclave cryptographic key pairs (Apple Secure Enclave and Android StrongBox/TEE) for Capacitor 7 hybrid mobile applications. Mandates backend server-nonce attestation verification and hardware-backed signing to eliminate token replay, device impersonation, and memory-dump tampering.","antiPatternHeadline":"Generating Software-Synthesized Cryptographic Keys in the WebView or Storing Unattested Credentials in LocalStorage","stars_count":61,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","security","cryptography","secure-enclave","android-keystore","hardware-attestation"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-hardware-key-attestation-standard?format=claude","cursorMdc":"/api/rules/capacitor-7-hardware-key-attestation-standard?format=mdc","cursorrules":"/api/rules/capacitor-7-hardware-key-attestation-standard?format=cursor","windsurf":"/api/rules/capacitor-7-hardware-key-attestation-standard?format=windsurf","agents":"/api/rules/capacitor-7-hardware-key-attestation-standard?format=agents"}},{"id":"kmp-compose-native-thread-isolation-guardrail","title":"Compose Multiplatform Native Thread Isolation & Lock-Free State Confinement","category":"mobile","severity":"critical","description":"Enforces strict thread confinement and deterministic lock-free mutations across Kotlin Multiplatform (JVM and Darwin) runtimes. Prevents UI thread stalls, Darwin Grand Central Dispatch deadlocks, and Snapshot State desynchronization by strictly isolating background mutations from Compose Snapshot state.","antiPatternHeadline":"Mutating Shared Snapshot State from Background Dispatchers or Unconfined Native Threads","stars_count":99,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kmp","compose-multiplatform","kotlin","coroutines","darwin","concurrency"],"exportEndpoints":{"claude":"/api/rules/kmp-compose-native-thread-isolation-guardrail?format=claude","cursorMdc":"/api/rules/kmp-compose-native-thread-isolation-guardrail?format=mdc","cursorrules":"/api/rules/kmp-compose-native-thread-isolation-guardrail?format=cursor","windsurf":"/api/rules/kmp-compose-native-thread-isolation-guardrail?format=windsurf","agents":"/api/rules/kmp-compose-native-thread-isolation-guardrail?format=agents"}},{"id":"webauthn-prf-zero-knowledge-derivation","title":"WebAuthn PRF Client-Side Zero-Knowledge Symmetric Key Derivation Standard","category":"security","severity":"critical","description":"Enforces strict client-side symmetric key derivation from hardware authenticators using the WebAuthn prf extension. Guarantees raw PRF outputs and derived encryption keys never leave the client runtime or transit over the network. Requires HKDF key separation with explicit domain contexts before performing WebCrypto operations on sensitive payloads.","antiPatternHeadline":"Transmitting raw PRF outputs, server-side derivation, or un-isolated key reuse across encryption contexts","stars_count":106,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","prf","cryptography","zero-knowledge","passkeys","webcrypto"],"exportEndpoints":{"claude":"/api/rules/webauthn-prf-zero-knowledge-derivation?format=claude","cursorMdc":"/api/rules/webauthn-prf-zero-knowledge-derivation?format=mdc","cursorrules":"/api/rules/webauthn-prf-zero-knowledge-derivation?format=cursor","windsurf":"/api/rules/webauthn-prf-zero-knowledge-derivation?format=windsurf","agents":"/api/rules/webauthn-prf-zero-knowledge-derivation?format=agents"}},{"id":"slsa-l4-sigstore-keyless-provenance-guardrail","title":"SLSA Level 4 Hermetic Build Provenance and Sigstore Keyless Admission Verification","category":"security","severity":"critical","description":"Enforces SLSA Level 4 build compliance and Sigstore keyless cryptographic verification across deployment pipelines and cluster admission webhooks. Guarantees that container images and artifacts are built in hermetically isolated, ephemeral environments with non-forgeable in-toto attestations backed by Fulcio ephemeral certificates and Rekor transparency log proofs. Blocks unverified or tampered binaries, mutable container tags, and static long-lived private keys from cluster execution.","antiPatternHeadline":"Admitting Artifacts via Mutable Tags or Static Signatures Without Rekor and Hermetic Attestation","stars_count":68,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","slsa-level-4","sigstore","cosign","supply-chain","kubernetes","rekor","in-toto"],"exportEndpoints":{"claude":"/api/rules/slsa-l4-sigstore-keyless-provenance-guardrail?format=claude","cursorMdc":"/api/rules/slsa-l4-sigstore-keyless-provenance-guardrail?format=mdc","cursorrules":"/api/rules/slsa-l4-sigstore-keyless-provenance-guardrail?format=cursor","windsurf":"/api/rules/slsa-l4-sigstore-keyless-provenance-guardrail?format=windsurf","agents":"/api/rules/slsa-l4-sigstore-keyless-provenance-guardrail?format=agents"}},{"id":"k8s-gateway-api-v1-2-cross-namespace-delegation-invariants","title":"Kubernetes Gateway API v1.2 Cross-Namespace Route Delegation and ReferenceGrant Guardrails","category":"devops","severity":"critical","description":"Enforces strict organizational boundary isolation, deterministic route attachment, and explicit ReferenceGrant declarations for Gateway API v1.2 in shared multi-tenant enterprise clusters. Prevents unauthorized cross-namespace route hijacking, unintended hostname collisions, and rogue backend referencing by mandating bidirectional consent between infrastructure owners and application development teams. Requires precise `allowedRoutes` scoping on Gateway listeners and explicit `ReferenceGrant` objects for cross-namespace service forwarding.","antiPatternHeadline":"Permissive Gateway AllowedRoutes and Unguarded Cross-Namespace Service Referencing Allowing Route Hijacking","stars_count":76,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","kubernetes","gateway-api","security","multi-tenancy","networking"],"exportEndpoints":{"claude":"/api/rules/k8s-gateway-api-v1-2-cross-namespace-delegation-invariants?format=claude","cursorMdc":"/api/rules/k8s-gateway-api-v1-2-cross-namespace-delegation-invariants?format=mdc","cursorrules":"/api/rules/k8s-gateway-api-v1-2-cross-namespace-delegation-invariants?format=cursor","windsurf":"/api/rules/k8s-gateway-api-v1-2-cross-namespace-delegation-invariants?format=windsurf","agents":"/api/rules/k8s-gateway-api-v1-2-cross-namespace-delegation-invariants?format=agents"}},{"id":"opentofu-client-side-state-encryption-kms-rotation","title":"OpenTofu 1.9 Client-Side State Encryption with KMS Key Rotation Standard","category":"devops","severity":"critical","description":"Enforces OpenTofu 1.9+ client-side state encryption using multi-layer key provider configurations with managed AWS KMS/GCP KMS/Azure Key Vault envelopes. Guarantees zero-plaintext leakage across decentralized GitOps pipelines, remote backends (S3, GCS, Blob), local caches, and plan files. Mandates automated fallback rotation schemas to allow cryptographic key migration without service downtime or state locking deadlocks.","antiPatternHeadline":"Unencrypted State Storage or Hardcoded Cipher Passphrases in Remote Backends and Plan Artifacts","stars_count":117,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentofu","security","kms","state-encryption","gitops","iac"],"exportEndpoints":{"claude":"/api/rules/opentofu-client-side-state-encryption-kms-rotation?format=claude","cursorMdc":"/api/rules/opentofu-client-side-state-encryption-kms-rotation?format=mdc","cursorrules":"/api/rules/opentofu-client-side-state-encryption-kms-rotation?format=cursor","windsurf":"/api/rules/opentofu-client-side-state-encryption-kms-rotation?format=windsurf","agents":"/api/rules/opentofu-client-side-state-encryption-kms-rotation?format=agents"}},{"id":"svelte5-runes-universal-reactivity-isolation","title":"Svelte 5 Runes: Universal Reactivity Isolation & Cross-Request SSR Leak Prevention","category":"frontend","severity":"critical","description":"Enforces strict encapsulation of Svelte 5 rune primitives ($state, $derived) and explicit lifecycle termination ($effect.root) inside per-request contexts. Prevents catastrophic multi-tenant state bleed and memory retention hazards across concurrent requests in long-lived Node.js and Edge SSR runtimes.","antiPatternHeadline":"Module-Scoped $state Singletons Leaking User Data Across Concurrent SSR Sessions","stars_count":96,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["svelte5","runes","ssr","edge-runtime","reactivity-isolation","concurrency"],"exportEndpoints":{"claude":"/api/rules/svelte5-runes-universal-reactivity-isolation?format=claude","cursorMdc":"/api/rules/svelte5-runes-universal-reactivity-isolation?format=mdc","cursorrules":"/api/rules/svelte5-runes-universal-reactivity-isolation?format=cursor","windsurf":"/api/rules/svelte5-runes-universal-reactivity-isolation?format=windsurf","agents":"/api/rules/svelte5-runes-universal-reactivity-isolation?format=agents"}},{"id":"react-19-resource-pre-orchestration-metadata-guardrail","title":"React 19 Document Metadata and Resource Pre-orchestration Standard","category":"frontend","severity":"critical","description":"Enforces React 19 native document metadata hoisting and deterministic resource pre-orchestration using stylesheet precedence and react-dom preloading APIs. Prevents Cumulative Layout Shift (CLS) and Flash of Unstyled Content (FOUC) caused by non-deterministic asset injection in asynchronous streaming SSR pipelines. Guarantees deduplication across concurrent Suspense boundaries by strictly delegating asset lifecycle management to the React runtime.","antiPatternHeadline":"Imperative DOM Head Injection and Unprecedenced Link Tags in Streaming Suspense Boundaries","stars_count":97,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["react19","streaming-ssr","web-vitals","resource-hints","layout-stability"],"exportEndpoints":{"claude":"/api/rules/react-19-resource-pre-orchestration-metadata-guardrail?format=claude","cursorMdc":"/api/rules/react-19-resource-pre-orchestration-metadata-guardrail?format=mdc","cursorrules":"/api/rules/react-19-resource-pre-orchestration-metadata-guardrail?format=cursor","windsurf":"/api/rules/react-19-resource-pre-orchestration-metadata-guardrail?format=windsurf","agents":"/api/rules/react-19-resource-pre-orchestration-metadata-guardrail?format=agents"}},{"id":"postgres-17-logical-replication-failover-control","title":"Postgres 17 Synchronized Logical Replication Slot Failover Protocol","category":"backend","severity":"critical","description":"Enforces Postgres 17 native failover-enabled logical replication slots and synchronized standby slot topologies across high-availability clusters. Guarantees that physical standby nodes maintain synchronized logical replication slot state (confirmed_flush_lsn) prior to cluster failovers. Eliminates message data loss, catastrophic duplicate streaming replays, and downstream consumer corruption during automated Patroni or Kubernetes orchestrator promotions.","antiPatternHeadline":"Provisioning Logical Replication Slots Without Failover Capabilities and Uncoordinated Physical Standby Promotion","stars_count":88,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres-17","logical-replication","high-availability","cdc","data-pipelines"],"exportEndpoints":{"claude":"/api/rules/postgres-17-logical-replication-failover-control?format=claude","cursorMdc":"/api/rules/postgres-17-logical-replication-failover-control?format=mdc","cursorrules":"/api/rules/postgres-17-logical-replication-failover-control?format=cursor","windsurf":"/api/rules/postgres-17-logical-replication-failover-control?format=windsurf","agents":"/api/rules/postgres-17-logical-replication-failover-control?format=agents"}},{"id":"bun-websocket-hibernation-engine","title":"Bun 1.2 High-Density WebSocket Epoll Hibernation Architecture","category":"backend","severity":"critical","description":"Enforces Bun's native C++ epoll/kqueue WebSocket hibernation runtime lifecycle to sustain millions of concurrent edge connections. Prohibits JavaScript closures, event-emitter bindings, and long-lived heap object references per socket that defeat the V8/JSC GC reclamation during idle states. Mandates strictly typed native `ws.data` payloads and pub/sub topic routing to maintain sub-kilobyte memory footprints per connection.","antiPatternHeadline":"Attaching State to Closures or Event Handlers Defeating Native Socket Hibernation","stars_count":117,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","websockets","epoll","performance","networking"],"exportEndpoints":{"claude":"/api/rules/bun-websocket-hibernation-engine?format=claude","cursorMdc":"/api/rules/bun-websocket-hibernation-engine?format=mdc","cursorrules":"/api/rules/bun-websocket-hibernation-engine?format=cursor","windsurf":"/api/rules/bun-websocket-hibernation-engine?format=windsurf","agents":"/api/rules/bun-websocket-hibernation-engine?format=agents"}},{"id":"capacitor-7-hardware-keystore-isolation","title":"Hardware-Attested Key Isolation & Cryptographic Signing in Capacitor 7","category":"mobile","severity":"critical","description":"Enforces strict cryptographic key residency within native Android StrongBox Keymaster and iOS Secure Enclave chips across Capacitor 7 bridges. Mandates that asymmetric key pairs are generated on-chip, private keys remain permanently non-exportable, and the WebView interface only transfers digests, public keys, and cryptographic attestations.","antiPatternHeadline":"Bridging Raw Key Material or Software-Emulating Key Storage Across Capacitor WebView Interfaces","stars_count":50,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","ios","android","secure-enclave","strongbox","cryptography","security"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-hardware-keystore-isolation?format=claude","cursorMdc":"/api/rules/capacitor-7-hardware-keystore-isolation?format=mdc","cursorrules":"/api/rules/capacitor-7-hardware-keystore-isolation?format=cursor","windsurf":"/api/rules/capacitor-7-hardware-keystore-isolation?format=windsurf","agents":"/api/rules/capacitor-7-hardware-keystore-isolation?format=agents"}},{"id":"swift6-strict-concurrency-hybrid-bridge-isolation","title":"Swift 6 Strict Concurrency Domain Isolation in Hybrid Multiplatform Bridges","category":"mobile","severity":"critical","description":"Enforces compile-time data race elimination and cross-actor isolation barriers when bridging multiplatform shared memory engines (Rust, C++, KMP) to native mobile UI runtimes. Prohibits unsafe pointer leakage, indiscriminate @unchecked Sendable annotations, and non-isolated boundary callbacks into MainActor UI threads.","antiPatternHeadline":"Leaking Raw FFI Pointers and Unsynchronized Bridged State Directly Across Native Actor Domains","stars_count":66,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","swift6","concurrency","ffi","actors","memory-safety"],"exportEndpoints":{"claude":"/api/rules/swift6-strict-concurrency-hybrid-bridge-isolation?format=claude","cursorMdc":"/api/rules/swift6-strict-concurrency-hybrid-bridge-isolation?format=mdc","cursorrules":"/api/rules/swift6-strict-concurrency-hybrid-bridge-isolation?format=cursor","windsurf":"/api/rules/swift6-strict-concurrency-hybrid-bridge-isolation?format=windsurf","agents":"/api/rules/swift6-strict-concurrency-hybrid-bridge-isolation?format=agents"}},{"id":"wasm-wasi-p2-capability-sandboxing-standard","title":"WASI 0.2 Component Model Capability Sandboxing & Zero Ambient Authority Standard","category":"security","severity":"critical","description":"Untrusted third-party WebAssembly components must execute within strict WASI 0.2 (Preview 2) capability-attenuated boundaries with zero ambient authority. All guest-to-host interactions must be restricted to explicit, typed WebAssembly Interface Type (WIT) contracts without inheriting host environment variables, unconstrained network sockets, or raw filesystem handles. Host runtimes must explicitly attenuate capabilities using virtualized descriptors, deterministic resource ceilings, and epoch interruption.","antiPatternHeadline":"Ambient System Authority Leakage via Unattenuated WASI Host Imports","stars_count":89,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webassembly","wasi-0.2","component-model","sandboxing","capability-security","rust"],"exportEndpoints":{"claude":"/api/rules/wasm-wasi-p2-capability-sandboxing-standard?format=claude","cursorMdc":"/api/rules/wasm-wasi-p2-capability-sandboxing-standard?format=mdc","cursorrules":"/api/rules/wasm-wasi-p2-capability-sandboxing-standard?format=cursor","windsurf":"/api/rules/wasm-wasi-p2-capability-sandboxing-standard?format=windsurf","agents":"/api/rules/wasm-wasi-p2-capability-sandboxing-standard?format=agents"}},{"id":"otel-exemplar-continuous-profiling-correlation-standard","title":"Mandatory Bi-directional OTel Exemplar Sampling and Continuous Profiling Correlation","category":"devops","severity":"critical","description":"Enforces deterministic, bi-directional linkage between high-percentile latency metric exemplars, distributed traces, and continuous CPU profiling frames (via eBPF or runtime engine sampling). Eliminates wall-clock guesswork by guaranteeing every P99 latency outlier metric directly links to a root trace span, which synchronously propagates trace and span IDs to the profiling agent stack frames.","antiPatternHeadline":"Blind Latency Spikes: Uncorrelated Metric Exemplars and Decoupled Wall-Clock Profiling","stars_count":70,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","continuous-profiling","exemplars","ebpf","performance"],"exportEndpoints":{"claude":"/api/rules/otel-exemplar-continuous-profiling-correlation-standard?format=claude","cursorMdc":"/api/rules/otel-exemplar-continuous-profiling-correlation-standard?format=mdc","cursorrules":"/api/rules/otel-exemplar-continuous-profiling-correlation-standard?format=cursor","windsurf":"/api/rules/otel-exemplar-continuous-profiling-correlation-standard?format=windsurf","agents":"/api/rules/otel-exemplar-continuous-profiling-correlation-standard?format=agents"}},{"id":"valkey8-numa-shard-affinity-invariants","title":"Valkey 8 Multi-Threaded Shard Affinity and NUMA Socket Invariants","category":"devops","severity":"critical","description":"Enforces strict CPU core pinning and memory allocation locality for Valkey 8 multi-threaded I/O engines and cluster shard instances. Cross-NUMA node memory hops incur severe interconnect bus saturation and L3 cache thrashing, degrading ultra-low-latency in-memory operations by an order of magnitude.","antiPatternHeadline":"Unpinned Multi-Threaded Valkey Instances Crossing NUMA Domains and Socket Interconnects","stars_count":60,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","valkey","numa","performance","linux","kernel","affinity"],"exportEndpoints":{"claude":"/api/rules/valkey8-numa-shard-affinity-invariants?format=claude","cursorMdc":"/api/rules/valkey8-numa-shard-affinity-invariants?format=mdc","cursorrules":"/api/rules/valkey8-numa-shard-affinity-invariants?format=cursor","windsurf":"/api/rules/valkey8-numa-shard-affinity-invariants?format=windsurf","agents":"/api/rules/valkey8-numa-shard-affinity-invariants?format=agents"}},{"id":"nextjs-15-dynamic-io-ppr-boundaries","title":"Enforce Next.js 15 Dynamic I/O Isolation and Deterministic PPR Boundaries","category":"frontend","severity":"critical","description":"Prevents catastrophic prerender de-optimizations and cascading I/O waterfalls in Next.js 15 with Partial Prerendering (PPR) and Dynamic I/O enabled. Mandates that all uncached dynamic operations are strictly encapsulated within React Suspense boundaries, preventing dynamic state from poisoning the static shell.","antiPatternHeadline":"Leaking Uncached Dynamic Operations into Static Shells Collapsing PPR into Dynamic SSR","stars_count":82,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs","react-server-components","dynamic-io","ppr","suspense","performance"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-dynamic-io-ppr-boundaries?format=claude","cursorMdc":"/api/rules/nextjs-15-dynamic-io-ppr-boundaries?format=mdc","cursorrules":"/api/rules/nextjs-15-dynamic-io-ppr-boundaries?format=cursor","windsurf":"/api/rules/nextjs-15-dynamic-io-ppr-boundaries?format=windsurf","agents":"/api/rules/nextjs-15-dynamic-io-ppr-boundaries?format=agents"}},{"id":"kmp-compose-skiko-surface-concurrency-isolation","title":"KMP Compose Skiko Render Surface Concurrency Isolation","category":"mobile","severity":"critical","description":"Enforces strict temporal decoupling between concurrent reactive state emissions and hardware-synced Skiko rendering surfaces across iOS (CADisplayLink/MetalLayer) and Android (Choreographer/SurfaceView). Prevents main-thread frame pacing anomalies, surface tearing, and mutex deadlocks by isolating hot state transformations to dedicated confinement dispatchers before sampling on the platform render loop.","antiPatternHeadline":"Direct In-Band State Mutation and Unconfined Recomposition on the Hardware VSync Thread","stars_count":88,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","compose-multiplatform","skiko","metal","surfaceview","concurrency"],"exportEndpoints":{"claude":"/api/rules/kmp-compose-skiko-surface-concurrency-isolation?format=claude","cursorMdc":"/api/rules/kmp-compose-skiko-surface-concurrency-isolation?format=mdc","cursorrules":"/api/rules/kmp-compose-skiko-surface-concurrency-isolation?format=cursor","windsurf":"/api/rules/kmp-compose-skiko-surface-concurrency-isolation?format=windsurf","agents":"/api/rules/kmp-compose-skiko-surface-concurrency-isolation?format=agents"}},{"id":"oauth-2-1-dpop-token-binding-nonce-rotation-standard","title":"OAuth 2.1 RFC 9449 DPoP Token Binding and Replay-Resistant Nonce Rotation","category":"security","severity":"critical","description":"Enforces strict RFC 9449 Demonstrating Proof-of-Possession (DPoP) at the application and transport layers. Mandates cryptographic binding of access and refresh tokens to ephemeral client-side private keys via thumbprint (jkt) and access token hash (ath) verification. Guarantees zero-trust replay resistance by enforcing server-directed DPoP-Nonce rotation and eliminating fallback to bearer authorization.","antiPatternHeadline":"Unbound Bearer Token Exfiltration and Replayable Static DPoP Proofs","stars_count":100,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","oauth2","dpop","rfc9449","cryptography","web-crypto","zero-trust"],"exportEndpoints":{"claude":"/api/rules/oauth-2-1-dpop-token-binding-nonce-rotation-standard?format=claude","cursorMdc":"/api/rules/oauth-2-1-dpop-token-binding-nonce-rotation-standard?format=mdc","cursorrules":"/api/rules/oauth-2-1-dpop-token-binding-nonce-rotation-standard?format=cursor","windsurf":"/api/rules/oauth-2-1-dpop-token-binding-nonce-rotation-standard?format=windsurf","agents":"/api/rules/oauth-2-1-dpop-token-binding-nonce-rotation-standard?format=agents"}},{"id":"tetragon-ebpf-namespace-boundary-invariant","title":"Tetragon eBPF Real-Time Process and Namespace Boundary Enforcement","category":"security","severity":"critical","description":"Enforces synchronous eBPF kernel-level detection and SIGKILL termination for container namespace escape attempts and unauthorized Linux capability escalations. Restricts execution to deterministic process hierarchies and forbids runtime modification of security-sensitive syscall signatures at the kernel boundary.","antiPatternHeadline":"Relying on Asynchronous User-Space Auditing or Permissive Syscall Filters for Namespace and Capability Security","stars_count":83,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","ebpf","tetragon","kubernetes","runtime-security","linux-kernel"],"exportEndpoints":{"claude":"/api/rules/tetragon-ebpf-namespace-boundary-invariant?format=claude","cursorMdc":"/api/rules/tetragon-ebpf-namespace-boundary-invariant?format=mdc","cursorrules":"/api/rules/tetragon-ebpf-namespace-boundary-invariant?format=cursor","windsurf":"/api/rules/tetragon-ebpf-namespace-boundary-invariant?format=windsurf","agents":"/api/rules/tetragon-ebpf-namespace-boundary-invariant?format=agents"}},{"id":"axum-tower-buffering-backpressure-guardrail","title":"Axum 0.8 Tower Service Buffering and Adaptive Backpressure Standard","category":"backend","severity":"critical","description":"Enforces strict bounds on Tower Service Buffers and mandates proactive load shedding and concurrency limits in Axum 0.8 middleware stacks. Prevents unbounded request queuing, memory exhaustion, and async runtime thread starvation by ensuring downstream saturation sheds load via cooperative backpressure and explicit HTTP 503/429 status codes.","antiPatternHeadline":"Unbounded Tower buffer layers combined with unconstrained task spawning that exhausts Tokio runtime worker threads during downstream saturation.","stars_count":107,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tokio","tower","concurrency","backpressure"],"exportEndpoints":{"claude":"/api/rules/axum-tower-buffering-backpressure-guardrail?format=claude","cursorMdc":"/api/rules/axum-tower-buffering-backpressure-guardrail?format=mdc","cursorrules":"/api/rules/axum-tower-buffering-backpressure-guardrail?format=cursor","windsurf":"/api/rules/axum-tower-buffering-backpressure-guardrail?format=windsurf","agents":"/api/rules/axum-tower-buffering-backpressure-guardrail?format=agents"}},{"id":"fastapi-anyio-structured-concurrency-cancellation","title":"FastAPI AnyIO Structured Concurrency & TaskGroup Cancellation Standard","category":"backend","severity":"critical","description":"Enforces strict structured concurrency in FastAPI using AnyIO task groups and explicit cancellation scopes bound to client disconnect lifecycles. Prevents orphaned background coroutines, CPU starvation, and connection pool exhaustion by guaranteeing that unhandled client terminations immediately propagate cancellation through hierarchical task trees while shielding critical cleanup routines.","antiPatternHeadline":"Spawning unbound coroutines via asyncio.create_task and ignoring client disconnect events","stars_count":99,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["fastapi","anyio","structured-concurrency","python","asyncio","backend"],"exportEndpoints":{"claude":"/api/rules/fastapi-anyio-structured-concurrency-cancellation?format=claude","cursorMdc":"/api/rules/fastapi-anyio-structured-concurrency-cancellation?format=mdc","cursorrules":"/api/rules/fastapi-anyio-structured-concurrency-cancellation?format=cursor","windsurf":"/api/rules/fastapi-anyio-structured-concurrency-cancellation?format=windsurf","agents":"/api/rules/fastapi-anyio-structured-concurrency-cancellation?format=agents"}},{"id":"postgres-17-async-direct-io-buffer-pinning-standard","title":"PostgreSQL 17 Asynchronous Direct I/O and Vectorized Buffer Pinning Standard","category":"backend","severity":"critical","description":"Enforces architectural patterns for PostgreSQL 17 asynchronous streaming read pipelines and direct I/O orchestration to eradicate Linux kernel page-cache double-buffering and tail latency spikes. Ensures analytical queries, sequential scans, and bulk ingestion operations leverage vectorized multi-block buffer pinning and bypass OS buffer layers safely.","antiPatternHeadline":"Unbuffered synchronous table scans thrashing OS page cache and inducing severe double-buffering lock contention","stars_count":106,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","postgres-17","aio","direct-io","database-performance","storage-engine"],"exportEndpoints":{"claude":"/api/rules/postgres-17-async-direct-io-buffer-pinning-standard?format=claude","cursorMdc":"/api/rules/postgres-17-async-direct-io-buffer-pinning-standard?format=mdc","cursorrules":"/api/rules/postgres-17-async-direct-io-buffer-pinning-standard?format=cursor","windsurf":"/api/rules/postgres-17-async-direct-io-buffer-pinning-standard?format=windsurf","agents":"/api/rules/postgres-17-async-direct-io-buffer-pinning-standard?format=agents"}},{"id":"pgvector-halfvec-hnsw-memory-guardrail","title":"pgvector 0.8+ Halfvec Quantized HNSW Index Memory Footprint Guardrail","category":"backend","severity":"critical","description":"Enforces 16-bit scalar quantization (halfvec) on PostgreSQL pgvector 0.8+ HNSW indexes to reduce index working set memory footprint by 50% and prevent out-of-memory (OOM) kernel panics at hyper-scale. Mandates maintenance_work_mem budget bounds during index construction, iterative re-ranking pipelines against full-precision vectors when required by recall SLAs, and strict validation of operator classes.","antiPatternHeadline":"Building Standard 32-bit Float HNSW Indexes at Scale Causing Memory Exhaustion and Node Crashes","stars_count":84,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres","pgvector","database","vector-search","performance"],"exportEndpoints":{"claude":"/api/rules/pgvector-halfvec-hnsw-memory-guardrail?format=claude","cursorMdc":"/api/rules/pgvector-halfvec-hnsw-memory-guardrail?format=mdc","cursorrules":"/api/rules/pgvector-halfvec-hnsw-memory-guardrail?format=cursor","windsurf":"/api/rules/pgvector-halfvec-hnsw-memory-guardrail?format=windsurf","agents":"/api/rules/pgvector-halfvec-hnsw-memory-guardrail?format=agents"}},{"id":"bun-ffi-shared-memory-lifetime-guardrail","title":"Bun 1.2 Native C-FFI ArrayBuffer Shared-Memory Lifetime Guardrail","category":"backend","severity":"critical","description":"Enforces deterministic ownership contracts and explicit disposal lifecycles when exchanging zero-copy off-heap buffers between Bun's JavaScriptCore runtime and native C/Rust libraries via bun:ffi. Eliminates use-after-free bugs, dangling pointer reads, and fatal double-free corruptions caused by garbage collection uncoordination.","antiPatternHeadline":"Accessing raw native pointers as untracked ArrayBuffers without deterministic pinning or explicit disposal tracking","stars_count":83,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","ffi","memory-safety","zero-copy","arraybuffer","rust"],"exportEndpoints":{"claude":"/api/rules/bun-ffi-shared-memory-lifetime-guardrail?format=claude","cursorMdc":"/api/rules/bun-ffi-shared-memory-lifetime-guardrail?format=mdc","cursorrules":"/api/rules/bun-ffi-shared-memory-lifetime-guardrail?format=cursor","windsurf":"/api/rules/bun-ffi-shared-memory-lifetime-guardrail?format=windsurf","agents":"/api/rules/bun-ffi-shared-memory-lifetime-guardrail?format=agents"}},{"id":"opentelemetry-w3c-baggage-bounded-propagation-guardrail","title":"OpenTelemetry W3C Baggage Bounded Propagation & Trace-State Guardrail","category":"devops","severity":"critical","description":"Enforces strict payload bounding, key allowlisting, and sanitization for W3C Baggage and tracestate headers across distributed RPC boundaries. Prevents HTTP 431 header bloat outages, distributed denial-of-service vectors, and tenant credential leaks in multi-hop microservice topologies.","antiPatternHeadline":"Unbounded, Unfiltered Baggage Propagation Leading to Header Bloat and Sensitive Data Exfiltration","stars_count":116,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","distributed-tracing","w3c-baggage","security","observability"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-w3c-baggage-bounded-propagation-guardrail?format=claude","cursorMdc":"/api/rules/opentelemetry-w3c-baggage-bounded-propagation-guardrail?format=mdc","cursorrules":"/api/rules/opentelemetry-w3c-baggage-bounded-propagation-guardrail?format=cursor","windsurf":"/api/rules/opentelemetry-w3c-baggage-bounded-propagation-guardrail?format=windsurf","agents":"/api/rules/opentelemetry-w3c-baggage-bounded-propagation-guardrail?format=agents"}},{"id":"svelte-5-runes-mutation-isolation-boundaries","title":"Svelte 5 Runes Fine-Grained Reactive State & Deep Mutation Isolation","category":"frontend","severity":"critical","description":"Enforces strict isolation boundaries around Svelte 5 $state proxies to eliminate microfrontend state tearing, infinite cyclic re-render loops, and untracked cross-boundary mutations. Requires explicit read/write separation via $state.snapshot, strict $state.raw for external payload exchanges, and mandatory untrack() encapsulation in effects.","antiPatternHeadline":"Leaking Deep $state Proxies Across Boundaries and Triggering Cascading Reactive Loops via Implicit Effect Reads","stars_count":112,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","microfrontends","reactivity","state-management"],"exportEndpoints":{"claude":"/api/rules/svelte-5-runes-mutation-isolation-boundaries?format=claude","cursorMdc":"/api/rules/svelte-5-runes-mutation-isolation-boundaries?format=mdc","cursorrules":"/api/rules/svelte-5-runes-mutation-isolation-boundaries?format=cursor","windsurf":"/api/rules/svelte-5-runes-mutation-isolation-boundaries?format=windsurf","agents":"/api/rules/svelte-5-runes-mutation-isolation-boundaries?format=agents"}},{"id":"tauri2-scoped-capabilities-ipc-sandboxing","title":"Tauri 2.0 Scoped Capabilities Matrix & Zero-Trust IPC Sandboxing","category":"mobile","severity":"critical","description":"Enforces least-privilege IPC boundaries in Tauri 2.0 mobile architectures via declarative capability manifests and strict runtime payload validation. Eliminates arbitrary native code execution and path traversal by disallowing wildcard permissions, segregating webview contexts, and strictly constraining filesystem and system plugin access to cryptographically validated or sandboxed device scopes.","antiPatternHeadline":"Pervasive Wildcard Plugin Permissions and Unscoped Native Commands Exposing Mobile Shell/Storage to XSS Privilege Escalation","stars_count":41,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri-2","security","ipc-sandboxing","rust","capabilities"],"exportEndpoints":{"claude":"/api/rules/tauri2-scoped-capabilities-ipc-sandboxing?format=claude","cursorMdc":"/api/rules/tauri2-scoped-capabilities-ipc-sandboxing?format=mdc","cursorrules":"/api/rules/tauri2-scoped-capabilities-ipc-sandboxing?format=cursor","windsurf":"/api/rules/tauri2-scoped-capabilities-ipc-sandboxing?format=windsurf","agents":"/api/rules/tauri2-scoped-capabilities-ipc-sandboxing?format=agents"}},{"id":"bun-als-worker-context-preservation","title":"Bun 1.2 AsyncLocalStorage Context Preservation and Tenant Isolation Across Native Worker Threads","category":"backend","severity":"critical","description":"Enforces deterministic serialization, boundary transport, and safe re-hydration of AsyncLocalStorage context across Bun 1.2 native Worker threads. Guarantees zero trace context loss and eliminates catastrophic cross-tenant credential or telemetry bleeding caused by mutable worker pools and implicit thread boundaries.","antiPatternHeadline":"Implicit Async Context Assumption Across postMessage Thread Boundaries Causing Telemetry Evaporation and Tenant Impersonation","stars_count":61,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","asynclocalstorage","worker-threads","multi-tenancy","telemetry","edge"],"exportEndpoints":{"claude":"/api/rules/bun-als-worker-context-preservation?format=claude","cursorMdc":"/api/rules/bun-als-worker-context-preservation?format=mdc","cursorrules":"/api/rules/bun-als-worker-context-preservation?format=cursor","windsurf":"/api/rules/bun-als-worker-context-preservation?format=windsurf","agents":"/api/rules/bun-als-worker-context-preservation?format=agents"}},{"id":"openfga-contextual-tuple-rebac-guardrail","title":"OpenFGA 1.6 In-Memory Contextual Tuples and Concurrent ReBAC Evaluation","category":"security","severity":"critical","description":"Enforces zero-storage-drift authorization decisions by mandating OpenFGA 1.6 contextual tuples and typed runtime context for ephemeral state evaluation. Prevents persistent tuple store pollution and read-after-write synchronization races while maintaining sub-10ms p99 latency through bounded concurrent check evaluations.","antiPatternHeadline":"Persisting Ephemeral Session Tuples to the Datastore Prior to Authorization Checks","stars_count":59,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","rebac","authorization","concurrency","latency"],"exportEndpoints":{"claude":"/api/rules/openfga-contextual-tuple-rebac-guardrail?format=claude","cursorMdc":"/api/rules/openfga-contextual-tuple-rebac-guardrail?format=mdc","cursorrules":"/api/rules/openfga-contextual-tuple-rebac-guardrail?format=cursor","windsurf":"/api/rules/openfga-contextual-tuple-rebac-guardrail?format=windsurf","agents":"/api/rules/openfga-contextual-tuple-rebac-guardrail?format=agents"}},{"id":"fastapi-async-stream-pydantic-v2-bounded-memory","title":"FastAPI Async Stream Chunking & Pydantic V2 Memory-Bounded Deserialization","category":"backend","severity":"critical","description":"Enforces bounded memory usage during large multipart or streaming uploads in FastAPI by mandating chunked async ingestion and streaming deserialization. Eliminates denial-of-service vulnerabilities caused by unbounded heap allocation from eager `UploadFile.read()` or monolithic `request.body()` validation in Pydantic V2.","antiPatternHeadline":"Monolithic Eager Upload Buffering and Unbounded In-Memory JSON Parsing","stars_count":115,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","pydantic-v2","asyncio","streaming","security"],"exportEndpoints":{"claude":"/api/rules/fastapi-async-stream-pydantic-v2-bounded-memory?format=claude","cursorMdc":"/api/rules/fastapi-async-stream-pydantic-v2-bounded-memory?format=mdc","cursorrules":"/api/rules/fastapi-async-stream-pydantic-v2-bounded-memory?format=cursor","windsurf":"/api/rules/fastapi-async-stream-pydantic-v2-bounded-memory?format=windsurf","agents":"/api/rules/fastapi-async-stream-pydantic-v2-bounded-memory?format=agents"}},{"id":"cmp-shared-accessibility-semantics-bridge","title":"Compose Multiplatform Shared Accessibility Semantics & Platform-Native A11y Bridge","category":"mobile","severity":"critical","description":"Enforces deterministic declarative-to-native accessibility mapping across Compose Multiplatform (Android AccessibilityNodeInfo and iOS UIAccessibilityElement/NSAccessibilityElement). Ensures semantics trees are explicitly merged, roles and state descriptions are bound to platform-safe actions, and custom interactive nodes eliminate screen-reader desynchronization and focus trapping across platforms.","antiPatternHeadline":"Ad-Hoc Gesture Handling Without Semantic Node Merging and Platform A11y Action Bridging","stars_count":61,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","compose-multiplatform","accessibility","a11y","kotlin","talkback","voiceover"],"exportEndpoints":{"claude":"/api/rules/cmp-shared-accessibility-semantics-bridge?format=claude","cursorMdc":"/api/rules/cmp-shared-accessibility-semantics-bridge?format=mdc","cursorrules":"/api/rules/cmp-shared-accessibility-semantics-bridge?format=cursor","windsurf":"/api/rules/cmp-shared-accessibility-semantics-bridge?format=windsurf","agents":"/api/rules/cmp-shared-accessibility-semantics-bridge?format=agents"}},{"id":"go-chi-context-cancellation-goroutine-lifetime","title":"Go Chi Context-Aware Goroutine Lifetime & Stream Drain Invariant","category":"backend","severity":"critical","description":"Enforces deterministic goroutine termination and channel cancellation tied directly to request contexts within Go Chi HTTP services. Guarantees that client-initiated disconnects, QUIC stream resets, and HTTP/3 transport cancellations immediately tear down spawned worker routines and cleanly unblock pending channel transmissions to prevent cumulative memory and descriptor leaks.","antiPatternHeadline":"Unbounded Goroutine Spawning and Unmonitored Channel Operations Leading to Resource Leaks on Aborted HTTP/3 Streams","stars_count":96,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["go","chi","concurrency","goroutines","http3","quic","memory-leaks"],"exportEndpoints":{"claude":"/api/rules/go-chi-context-cancellation-goroutine-lifetime?format=claude","cursorMdc":"/api/rules/go-chi-context-cancellation-goroutine-lifetime?format=mdc","cursorrules":"/api/rules/go-chi-context-cancellation-goroutine-lifetime?format=cursor","windsurf":"/api/rules/go-chi-context-cancellation-goroutine-lifetime?format=windsurf","agents":"/api/rules/go-chi-context-cancellation-goroutine-lifetime?format=agents"}},{"id":"spiffe-spire-x509-svid-workload-attestation","title":"SPIFFE/SPIRE Workload Identity X.509 Short-Lived SVID Attestation Standard","category":"security","severity":"critical","description":"Enforces zero-trust workload authentication via dynamic, kernel-attested SPIFFE/SPIRE Workload API Unix Domain Sockets, eliminating static secrets and long-lived credentials. Requires all microservice network transports to establish mTLS using short-lived X.509 SVIDs that rotate autonomously in-memory with strict SPIFFE ID Subject Alternative Name (SAN) verification.","antiPatternHeadline":"Bypassing SPIRE Workload API via Static File Mounts, Pre-Shared API Keys, or Unvalidated TLS Peer SANs","stars_count":42,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","spiffe","spire","zero-trust","mtls","x509-svid","workload-identity"],"exportEndpoints":{"claude":"/api/rules/spiffe-spire-x509-svid-workload-attestation?format=claude","cursorMdc":"/api/rules/spiffe-spire-x509-svid-workload-attestation?format=mdc","cursorrules":"/api/rules/spiffe-spire-x509-svid-workload-attestation?format=cursor","windsurf":"/api/rules/spiffe-spire-x509-svid-workload-attestation?format=windsurf","agents":"/api/rules/spiffe-spire-x509-svid-workload-attestation?format=agents"}},{"id":"ebpf-sockmap-l7-proxy-bypass-standard","title":"eBPF SOCKMAP Socket-Level L7 Proxy Bypass and Acceleration Invariants","category":"devops","severity":"critical","description":"Enforces strict kernel-level architectural controls for eBPF SOCKMAP/SOCKHASH socket redirection to bypass the host TCP/IP stack for local proxy and inter-pod communications. Requires explicit 4-tuple connection validation, bidirectional map insertion, TLS termination awareness, and resilient fallback mechanisms to standard veth stack processing upon socket state teardown.","antiPatternHeadline":"Blind sock_hash redirection causing silent TCP state divergence, broken TLS handshakes, and hung connections","stars_count":89,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","networking","kernel","cgroup","sockmap","envoy"],"exportEndpoints":{"claude":"/api/rules/ebpf-sockmap-l7-proxy-bypass-standard?format=claude","cursorMdc":"/api/rules/ebpf-sockmap-l7-proxy-bypass-standard?format=mdc","cursorrules":"/api/rules/ebpf-sockmap-l7-proxy-bypass-standard?format=cursor","windsurf":"/api/rules/ebpf-sockmap-l7-proxy-bypass-standard?format=windsurf","agents":"/api/rules/ebpf-sockmap-l7-proxy-bypass-standard?format=agents"}},{"id":"opentelemetry-w3c-baggage-boundary-limiting-standard","title":"OpenTelemetry W3C Baggage Boundary Filtering & Amplification Guardrail","category":"devops","severity":"critical","description":"Enforces strict boundary filtering, size-capping, and character validation on OpenTelemetry W3C Baggage headers across ingress and egress boundaries. Mitigates downstream header amplification attacks (HTTP 431 exploits), sensitive context leakage, and delimiter injection vulnerabilities by mandating explicit key allowlists and hard memory limits.","antiPatternHeadline":"Unbounded Propagation of Raw W3C Baggage Injecting Sensitive Context and Triggering HTTP 431 Denial-of-Service","stars_count":77,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","security","observability","distributed-tracing","w3c-baggage","api-security"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-w3c-baggage-boundary-limiting-standard?format=claude","cursorMdc":"/api/rules/opentelemetry-w3c-baggage-boundary-limiting-standard?format=mdc","cursorrules":"/api/rules/opentelemetry-w3c-baggage-boundary-limiting-standard?format=cursor","windsurf":"/api/rules/opentelemetry-w3c-baggage-boundary-limiting-standard?format=windsurf","agents":"/api/rules/opentelemetry-w3c-baggage-boundary-limiting-standard?format=agents"}},{"id":"svelte-5-runes-effect-teardown-reconciliation","title":"Svelte 5 Runes Signal-DOM Deterministic Teardown & Lifecycle Reconciliation","category":"frontend","severity":"critical","description":"Enforces deterministic teardown of fine-grained reactive $effect graphs and asynchronous execution chains during rapid client-side transitions in Svelte 5. Prevents detached DOM nodes, stale signal emissions, and catastrophic memory leaks caused by lingering async closures capturing component runes across route unmount boundaries.","antiPatternHeadline":"Dangling Async Runes Closures Retaining Detached DOM and Uncollected Reactive Graphs","stars_count":115,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["svelte5","runes","signals","memory-leaks","lifecycle","frontend","dom-reconciliation"],"exportEndpoints":{"claude":"/api/rules/svelte-5-runes-effect-teardown-reconciliation?format=claude","cursorMdc":"/api/rules/svelte-5-runes-effect-teardown-reconciliation?format=mdc","cursorrules":"/api/rules/svelte-5-runes-effect-teardown-reconciliation?format=cursor","windsurf":"/api/rules/svelte-5-runes-effect-teardown-reconciliation?format=windsurf","agents":"/api/rules/svelte-5-runes-effect-teardown-reconciliation?format=agents"}},{"id":"pg17-streaming-io-failover-slot-sync","title":"Postgres 17 Streaming I/O Optimization and Native Failover Slot Synchronization","category":"backend","severity":"critical","description":"Mandates PostgreSQL 17 native logical replication failover slot synchronization and streaming I/O engine configuration for cross-region distributed topologies. Guarantees zero data loss and sub-second cutover by strictly enforcing synchronized_standby_slots, failover-enabled logical slots, and streaming I/O buffer invariants.","antiPatternHeadline":"Unsynchronized Logical Replication Slots and Unbounded I/O Inducing Data Loss During Standby Promotion","stars_count":105,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql-17","replication","high-availability","database-reliability"],"exportEndpoints":{"claude":"/api/rules/pg17-streaming-io-failover-slot-sync?format=claude","cursorMdc":"/api/rules/pg17-streaming-io-failover-slot-sync?format=mdc","cursorrules":"/api/rules/pg17-streaming-io-failover-slot-sync?format=cursor","windsurf":"/api/rules/pg17-streaming-io-failover-slot-sync?format=windsurf","agents":"/api/rules/pg17-streaming-io-failover-slot-sync?format=agents"}},{"id":"openfga-rebac-cdc-consistency-guardrail","title":"OpenFGA ReBAC Tuple Consistency via Transactional CDC and Invalidation","category":"security","severity":"critical","description":"Mandates that OpenFGA relationship tuple mutations and permission cache invalidations are strictly derived from transactional outbox events processed via Debezium Change Data Capture (CDC). Direct dual-writes to both the relational datastore and OpenFGA API are forbidden to prevent authorization split-brain and stale access control bypasses.","antiPatternHeadline":"Dual-Writing Application State and OpenFGA Relationship Tuples Outside Transactional CDC","stars_count":80,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","rebac","openfga","cdc","debezium","cache-invalidation","transactional-outbox"],"exportEndpoints":{"claude":"/api/rules/openfga-rebac-cdc-consistency-guardrail?format=claude","cursorMdc":"/api/rules/openfga-rebac-cdc-consistency-guardrail?format=mdc","cursorrules":"/api/rules/openfga-rebac-cdc-consistency-guardrail?format=cursor","windsurf":"/api/rules/openfga-rebac-cdc-consistency-guardrail?format=windsurf","agents":"/api/rules/openfga-rebac-cdc-consistency-guardrail?format=agents"}},{"id":"go-124-synctest-virtual-clock-concurrency-invariant","title":"Go 1.24 synctest Virtual Clock Concurrency Verification Invariant","category":"backend","severity":"critical","description":"Mandates that all multi-goroutine state machines, backoff retries, and lock contention pathways undergo deterministic virtual clock verification via Go 1.24 testing/synctest bubbles prior to release. Prohibits wall-clock time.Sleep synchronization in concurrent tests, enforcing instant simulated time advancement and provable race/deadlock isolation.","antiPatternHeadline":"Flaky Wall-Clock Sleep and Arbitrary Threshold Waiting in Concurrent State Testing","stars_count":113,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","concurrency","synctest","goroutines","virtual-clock"],"exportEndpoints":{"claude":"/api/rules/go-124-synctest-virtual-clock-concurrency-invariant?format=claude","cursorMdc":"/api/rules/go-124-synctest-virtual-clock-concurrency-invariant?format=mdc","cursorrules":"/api/rules/go-124-synctest-virtual-clock-concurrency-invariant?format=cursor","windsurf":"/api/rules/go-124-synctest-virtual-clock-concurrency-invariant?format=windsurf","agents":"/api/rules/go-124-synctest-virtual-clock-concurrency-invariant?format=agents"}},{"id":"ebpf-tetragon-namespace-integrity-guardrail","title":"Tetragon Synchronous Kernel Namespace Lockdown and In-Kernel SIGKILL Enforcement","category":"security","severity":"critical","description":"Enforces synchronous kernel-space process termination via eBPF Tetragon TracingPolicies for unauthorized namespace manipulation and capability acquisition. Prevents container breakout and privilege escalation by executing immediate in-kernel SIGKILL actions prior to syscall completion, eliminating asynchronous userspace notification latency windows.","antiPatternHeadline":"Asynchronous Userspace Alerting on Namespace Mutation Enabling Exploitation Before Remediation","stars_count":113,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","ebpf","tetragon","kubernetes","container-escape","kernel-security"],"exportEndpoints":{"claude":"/api/rules/ebpf-tetragon-namespace-integrity-guardrail?format=claude","cursorMdc":"/api/rules/ebpf-tetragon-namespace-integrity-guardrail?format=mdc","cursorrules":"/api/rules/ebpf-tetragon-namespace-integrity-guardrail?format=cursor","windsurf":"/api/rules/ebpf-tetragon-namespace-integrity-guardrail?format=windsurf","agents":"/api/rules/ebpf-tetragon-namespace-integrity-guardrail?format=agents"}},{"id":"otel-baggage-tenant-attribution-standard","title":"OpenTelemetry Baggage-Driven Multi-Tenant Resource Attribution Standard","category":"devops","severity":"critical","description":"Mandates tamper-resistant injection, verification, and extraction of OpenTelemetry W3C Baggage and TraceContext headers across asynchronous message brokers (e.g., Kafka, RabbitMQ, SQS). Ensures tenant identification, tiering, and cost-center metadata survive asynchronous boundaries for deterministic downstream cost allocation and fair-share rate limiting. Prevents unmetered orphan worker execution and downstream billing leakage.","antiPatternHeadline":"Unpropagated Broker Messages Causing Tenant Telemetry Severance and Downstream Cost Leaks","stars_count":67,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","distributed-tracing","multi-tenancy","finops","message-brokers"],"exportEndpoints":{"claude":"/api/rules/otel-baggage-tenant-attribution-standard?format=claude","cursorMdc":"/api/rules/otel-baggage-tenant-attribution-standard?format=mdc","cursorrules":"/api/rules/otel-baggage-tenant-attribution-standard?format=cursor","windsurf":"/api/rules/otel-baggage-tenant-attribution-standard?format=windsurf","agents":"/api/rules/otel-baggage-tenant-attribution-standard?format=agents"}},{"id":"capacitor7-delta-update-dual-ed25519-keystore-invariant","title":"Capacitor 7 Dual-Ed25519 Native Keystore Delta Verification Invariant","category":"mobile","severity":"critical","description":"Enforces mandatory native-layer dual asymmetric Ed25519 cryptographic signature verification against immutable hardware-backed trust anchors (iOS Secure Enclave / Keychain and Android KeyStore) prior to uncompressing, applying, or staging dynamic Capacitor 7 web asset delta hot-patches. Prevents Remote Code Execution (RCE) and rogue bundle substitution resulting from compromised CI/CD credentials, malicious CDNs, or runtime JavaScript inspection bypasses.","antiPatternHeadline":"Applying Dynamic Hot-Patches via Single-Key JavaScript Verification or Unverified File System Extraction","stars_count":118,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","ed25519","cryptography","keystore","secure-enclave","ota-updates"],"exportEndpoints":{"claude":"/api/rules/capacitor7-delta-update-dual-ed25519-keystore-invariant?format=claude","cursorMdc":"/api/rules/capacitor7-delta-update-dual-ed25519-keystore-invariant?format=mdc","cursorrules":"/api/rules/capacitor7-delta-update-dual-ed25519-keystore-invariant?format=cursor","windsurf":"/api/rules/capacitor7-delta-update-dual-ed25519-keystore-invariant?format=windsurf","agents":"/api/rules/capacitor7-delta-update-dual-ed25519-keystore-invariant?format=agents"}},{"id":"compose-ios-cadisplaylink-cadence-sync","title":"Compose Multiplatform iOS CADisplayLink & ProMotion VSync Cadence Synchronization","category":"mobile","severity":"critical","description":"Enforces rigid synchronization between Skiko's Metal rendering pipeline and iOS CADisplayLink VSync pulses. Prevents continuous unthrottled GPU render loops and frame pacing jitter by binding redraw invalidations strictly to ProMotion refresh rate targets and on-demand dirty state transitions.","antiPatternHeadline":"Free-Running Dispatch Loops and Unsynchronized VSync Invalidation in Skiko Metal ViewControllers","stars_count":85,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","compose-multiplatform","kotlin-multiplatform","cadisplaylink","skiko","ios","metal"],"exportEndpoints":{"claude":"/api/rules/compose-ios-cadisplaylink-cadence-sync?format=claude","cursorMdc":"/api/rules/compose-ios-cadisplaylink-cadence-sync?format=mdc","cursorrules":"/api/rules/compose-ios-cadisplaylink-cadence-sync?format=cursor","windsurf":"/api/rules/compose-ios-cadisplaylink-cadence-sync?format=windsurf","agents":"/api/rules/compose-ios-cadisplaylink-cadence-sync?format=agents"}},{"id":"bun-zero-copy-tcp-reuseport-handoff-standard","title":"Bun 1.2 Zero-Copy TCP Socket Re-Binding and SO_REUSEPORT Handoff Standard","category":"backend","severity":"critical","description":"Mandates kernel-level SO_REUSEPORT socket configuration and zero-copy TCP buffer lifecycles in Bun 1.2 microservices during rolling deployments. Prevents TCP reset (RST) spikes, port-binding contention, and in-flight zero-copy buffer eviction during blue/green process replacements. Enforces non-destructive socket drainage and strict dual-process overlap until health-probe convergence.","antiPatternHeadline":"EADDRINUSE collisions and abruptly dropped TCP connections from premature teardown without SO_REUSEPORT socket handoffs.","stars_count":107,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","tcp","sockets","zero-copy","networking","high-availability"],"exportEndpoints":{"claude":"/api/rules/bun-zero-copy-tcp-reuseport-handoff-standard?format=claude","cursorMdc":"/api/rules/bun-zero-copy-tcp-reuseport-handoff-standard?format=mdc","cursorrules":"/api/rules/bun-zero-copy-tcp-reuseport-handoff-standard?format=cursor","windsurf":"/api/rules/bun-zero-copy-tcp-reuseport-handoff-standard?format=windsurf","agents":"/api/rules/bun-zero-copy-tcp-reuseport-handoff-standard?format=agents"}},{"id":"pqc-ml-kem-tls13-hybrid-standard","title":"Post-Quantum ML-KEM TLS 1.3 Hybrid Key Exchange Enforcement","category":"security","severity":"critical","description":"Enforces mandatory hybrid post-quantum key encapsulation (ML-KEM / Kyber combined with classical ECDH) across all edge ingress load balancers and reverse proxies. Prevents 'Harvest Now, Decrypt Later' (HNDL) adversaries from capturing classical TLS sessions today to decrypt retroactively via Shor's algorithm on cryptanalytically relevant quantum computers.","antiPatternHeadline":"Deploying Classical-Only ECDH/RSA Key Exchange Vulnerable to Harvest-Now-Decrypt-Later Threat Models","stars_count":62,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","post-quantum","ml-kem","kyber","tls-1-3","cryptography","fips-203","infrastructure"],"exportEndpoints":{"claude":"/api/rules/pqc-ml-kem-tls13-hybrid-standard?format=claude","cursorMdc":"/api/rules/pqc-ml-kem-tls13-hybrid-standard?format=mdc","cursorrules":"/api/rules/pqc-ml-kem-tls13-hybrid-standard?format=cursor","windsurf":"/api/rules/pqc-ml-kem-tls13-hybrid-standard?format=windsurf","agents":"/api/rules/pqc-ml-kem-tls13-hybrid-standard?format=agents"}},{"id":"postgres-17-streaming-io-failover-slot-invariants","title":"Postgres 17 Streaming I/O & Failover Slot Invariants","category":"backend","severity":"critical","description":"Enforces deterministic replication slot failover synchronization and vectorized streaming I/O bounds in PostgreSQL 17 topologies. Prevents unbounded WAL retention spirals, logical subscriber invalidation across node promotions, and unthrottled streaming read/write saturation during zero-downtime cluster transitions.","antiPatternHeadline":"Unsynchronized Logical Slots and Unbounded WAL Retention Leading to Cascading Cluster Exhaustion on Failover","stars_count":55,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres","postgres-17","replication","high-availability","database-reliability"],"exportEndpoints":{"claude":"/api/rules/postgres-17-streaming-io-failover-slot-invariants?format=claude","cursorMdc":"/api/rules/postgres-17-streaming-io-failover-slot-invariants?format=mdc","cursorrules":"/api/rules/postgres-17-streaming-io-failover-slot-invariants?format=cursor","windsurf":"/api/rules/postgres-17-streaming-io-failover-slot-invariants?format=windsurf","agents":"/api/rules/postgres-17-streaming-io-failover-slot-invariants?format=agents"}},{"id":"nextjs-15-ppr-shell-isolation-standard","title":"Next.js 15 Partial Prerendering (PPR) Shell Isolation & Boundary Decoupling","category":"frontend","severity":"critical","description":"Mandates strict boundary decoupling between static shell prerendering and dynamic streaming holes in Next.js 15 PPR routes. Dynamic APIs (cookies, headers, searchParams, and uncached data sources) must be strictly isolated inside dedicated Suspense boundaries to prevent prerender bailouts, shell invalidation, and dynamic context leakage.","antiPatternHeadline":"Accessing Dynamic Context in Route Shells or Suspense Fallbacks Causing Full-Tree Prerender Bailouts","stars_count":53,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs15","ppr","react","streaming","suspense"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-ppr-shell-isolation-standard?format=claude","cursorMdc":"/api/rules/nextjs-15-ppr-shell-isolation-standard?format=mdc","cursorrules":"/api/rules/nextjs-15-ppr-shell-isolation-standard?format=cursor","windsurf":"/api/rules/nextjs-15-ppr-shell-isolation-standard?format=windsurf","agents":"/api/rules/nextjs-15-ppr-shell-isolation-standard?format=agents"}},{"id":"tauri2-multiwindow-ipc-capability-sandboxing","title":"Tauri 2.0 Multi-Window Granular IPC Capability Sandboxing","category":"mobile","severity":"critical","description":"Enforces strict isolation of Tauri 2.0 IPC commands by mapping discrete capability files to specific window and webview labels. Prevents privilege escalation and cross-context permission inheritance by prohibiting wildcard window targeting and global permission assignments on auxiliary mobile webviews.","antiPatternHeadline":"Assigning global IPC permissions across all webviews or using wildcard window bindings in Tauri capabilities.","stars_count":68,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri","security","ipc","capabilities","sandboxing"],"exportEndpoints":{"claude":"/api/rules/tauri2-multiwindow-ipc-capability-sandboxing?format=claude","cursorMdc":"/api/rules/tauri2-multiwindow-ipc-capability-sandboxing?format=mdc","cursorrules":"/api/rules/tauri2-multiwindow-ipc-capability-sandboxing?format=cursor","windsurf":"/api/rules/tauri2-multiwindow-ipc-capability-sandboxing?format=windsurf","agents":"/api/rules/tauri2-multiwindow-ipc-capability-sandboxing?format=agents"}},{"id":"webauthn-prf-extension-binding-standard","title":"WebAuthn Level 3 PRF Extension & Passkey Session Binding Guardrail","category":"security","severity":"critical","description":"Enforces strict validation of WebAuthn Level 3 pseudo-random function (prf) extension outputs and exact SHA-256 clientDataJSON hash assertions during passkey authentication. Prevents session hijacking, credential substitution, and authenticator desynchronization by deterministically binding server-side session tokens to hardware-derived PRF symmetric keys.","antiPatternHeadline":"Trusting unverified authenticator extension outputs and skipping raw clientDataHash cryptographic verification","stars_count":41,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","fido2","passkeys","prf-extension","cryptography"],"exportEndpoints":{"claude":"/api/rules/webauthn-prf-extension-binding-standard?format=claude","cursorMdc":"/api/rules/webauthn-prf-extension-binding-standard?format=mdc","cursorrules":"/api/rules/webauthn-prf-extension-binding-standard?format=cursor","windsurf":"/api/rules/webauthn-prf-extension-binding-standard?format=windsurf","agents":"/api/rules/webauthn-prf-extension-binding-standard?format=agents"}},{"id":"opentelemetry-w3c-tracecontext-async-broker-fabric-standard","title":"OpenTelemetry W3C TraceContext Propagation for Asynchronous Message Fabrics","category":"devops","severity":"critical","description":"Eliminates distributed trace fragmentation across asynchronous message brokers such as Apache Kafka and NATS JetStream by mandating deterministic W3C TraceContext propagation. Enforces OpenTelemetry messaging semantic conventions, zero-allocation header manipulation, explicit carrier extraction/injection, and SpanKind boundary enforcement.","antiPatternHeadline":"Silent Distributed Trace Decoupling via Header Dropping and Context Disconnection","stars_count":83,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","tracing","kafka","nats-jetstream","w3c-tracecontext","observability"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-w3c-tracecontext-async-broker-fabric-standard?format=claude","cursorMdc":"/api/rules/opentelemetry-w3c-tracecontext-async-broker-fabric-standard?format=mdc","cursorrules":"/api/rules/opentelemetry-w3c-tracecontext-async-broker-fabric-standard?format=cursor","windsurf":"/api/rules/opentelemetry-w3c-tracecontext-async-broker-fabric-standard?format=windsurf","agents":"/api/rules/opentelemetry-w3c-tracecontext-async-broker-fabric-standard?format=agents"}},{"id":"kmp-swift-coroutines-interop-guardrail","title":"Kotlin Multiplatform to Swift Coroutines Bridge Concurrency Guardrail","category":"mobile","severity":"critical","description":"Enforces strict cancellation propagation and retain-cycle elimination across the Kotlin/Native Objective-C and Swift concurrency boundary. Prevents unhandled Kotlin CancellationException crashes in Swift async contexts and eliminates zombie coroutines holding strong references across the ARC and Kotlin GC boundary.","antiPatternHeadline":"Unbridged Swift Tasks Leaking Kotlin Coroutine Jobs and Crashing on CancellationException","stars_count":87,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","swift","coroutines","ios","memory-leak"],"exportEndpoints":{"claude":"/api/rules/kmp-swift-coroutines-interop-guardrail?format=claude","cursorMdc":"/api/rules/kmp-swift-coroutines-interop-guardrail?format=mdc","cursorrules":"/api/rules/kmp-swift-coroutines-interop-guardrail?format=cursor","windsurf":"/api/rules/kmp-swift-coroutines-interop-guardrail?format=windsurf","agents":"/api/rules/kmp-swift-coroutines-interop-guardrail?format=agents"}},{"id":"bun-native-socket-zero-copy-simd-deserialization","title":"Bun 1.2 Native Socket Zero-Copy SIMD Deserialization & Buffer Lifecycle Invariant","category":"backend","severity":"critical","description":"Enforces strict native ArrayBuffer lifecycle pooling and deterministic zero-copy subarray slicing within Bun.listen TCP sockets. Prohibits implicit TypedArray and Node.js Buffer allocations in high-throughput hot paths to eliminate JavaScriptCore heap fragmentation and optimize SIMD-accelerated deserialization.","antiPatternHeadline":"Transient Buffer Allocations, Escaping Chunk Slices, and Desynchronized Memory Lifecycles Under Native TCP Streaming","stars_count":77,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","networking","zero-copy","simd","performance","memory-management"],"exportEndpoints":{"claude":"/api/rules/bun-native-socket-zero-copy-simd-deserialization?format=claude","cursorMdc":"/api/rules/bun-native-socket-zero-copy-simd-deserialization?format=mdc","cursorrules":"/api/rules/bun-native-socket-zero-copy-simd-deserialization?format=cursor","windsurf":"/api/rules/bun-native-socket-zero-copy-simd-deserialization?format=windsurf","agents":"/api/rules/bun-native-socket-zero-copy-simd-deserialization?format=agents"}},{"id":"fastapi-pydanticv2-asyncio-offloading-standard","title":"FastAPI & Pydantic V2 Non-Blocking Rust Bridge & Event-Loop Thread-Pool Offloading","category":"backend","severity":"critical","description":"Enforces non-blocking asyncio thread-pool offloading during dense synchronous Pydantic V2 Rust-backed schema validation and serialization in high-throughput FastAPI endpoints. While Pydantic V2 core (`pydantic-core`) is compiled in Rust, its execution runs synchronously on Python's GIL-bound main OS thread, causing catastrophic event-loop starvation when processing multi-megabyte payloads or large collections. All CPU-bound validation and transformation pipelines must explicitly dispatch to worker thread pools via `asyncio.to_thread` or Starlette background worker primitives.","antiPatternHeadline":"Executing Synchronous Pydantic V2 Rust Deserialization In-Band Inside Async FastAPI Route Handlers","stars_count":116,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["fastapi","pydantic-v2","asyncio","python","performance","event-loop"],"exportEndpoints":{"claude":"/api/rules/fastapi-pydanticv2-asyncio-offloading-standard?format=claude","cursorMdc":"/api/rules/fastapi-pydanticv2-asyncio-offloading-standard?format=mdc","cursorrules":"/api/rules/fastapi-pydanticv2-asyncio-offloading-standard?format=cursor","windsurf":"/api/rules/fastapi-pydanticv2-asyncio-offloading-standard?format=windsurf","agents":"/api/rules/fastapi-pydanticv2-asyncio-offloading-standard?format=agents"}},{"id":"slsa-l3-ephemeral-oidc-sigstore-attestation","title":"SLSA Level 3 Ephemeral OIDC Provenance & Keyless Sigstore Attestation Standard","category":"devops","severity":"critical","description":"Enforces non-forgeable, cryptographically auditable CI/CD artifact provenance using keyless Sigstore attestation backed by ephemeral OpenID Connect (OIDC) tokens. Eliminates long-lived signing keys while guaranteeing tamper-proof in-toto SLSA Level 3 provenance recorded in the Rekor transparency log.","antiPatternHeadline":"Persisting Long-Lived Private Keys in CI Secrets with Self-Attested Unverified Build Provenance","stars_count":119,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","slsa","sigstore","cosign","oidc","supply-chain-security","in-toto"],"exportEndpoints":{"claude":"/api/rules/slsa-l3-ephemeral-oidc-sigstore-attestation?format=claude","cursorMdc":"/api/rules/slsa-l3-ephemeral-oidc-sigstore-attestation?format=mdc","cursorrules":"/api/rules/slsa-l3-ephemeral-oidc-sigstore-attestation?format=cursor","windsurf":"/api/rules/slsa-l3-ephemeral-oidc-sigstore-attestation?format=windsurf","agents":"/api/rules/slsa-l3-ephemeral-oidc-sigstore-attestation?format=agents"}},{"id":"vite-6-environment-api-runtime-boundary-standard","title":"Strict Multi-Runtime Module Resolution Boundary via Vite 6 Environment API","category":"frontend","severity":"critical","description":"Enforces complete structural isolation between Edge, Node.js (SSR), and Client (Browser) module graphs using Vite 6's Environment API. Eliminates silent runtime symbol leaks, unintended secret exposure, and browser bundling failures caused by sharing untyped runtime-agnostic module paths. Mandates explicit environment conditions, separated module instances, and zero cross-runtime direct imports.","antiPatternHeadline":"Cross-Runtime Symbol Contamination via Shared Module Graphs in Vite SSR Pipelines","stars_count":110,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","vite6","environment-api","ssr","module-resolution","edge-runtime"],"exportEndpoints":{"claude":"/api/rules/vite-6-environment-api-runtime-boundary-standard?format=claude","cursorMdc":"/api/rules/vite-6-environment-api-runtime-boundary-standard?format=mdc","cursorrules":"/api/rules/vite-6-environment-api-runtime-boundary-standard?format=cursor","windsurf":"/api/rules/vite-6-environment-api-runtime-boundary-standard?format=windsurf","agents":"/api/rules/vite-6-environment-api-runtime-boundary-standard?format=agents"}},{"id":"react-19-server-actions-optimistic-concurrency","title":"React 19 Server Actions & Optimistic Concurrency Invariants","category":"frontend","severity":"critical","description":"Mandates deterministic state reconciliation for React 19 mutations using useActionState and useOptimistic within strict transition boundaries. Prevents state divergence, lost updates, and orphaned optimistic UI under high network latency or out-of-order response arrival.","antiPatternHeadline":"Decoupled Client State Mirroring and Fire-and-Forget Server Actions Causing Torn State Under Network Jitter","stars_count":41,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","server-actions","use-action-state","use-optimistic","concurrency"],"exportEndpoints":{"claude":"/api/rules/react-19-server-actions-optimistic-concurrency?format=claude","cursorMdc":"/api/rules/react-19-server-actions-optimistic-concurrency?format=mdc","cursorrules":"/api/rules/react-19-server-actions-optimistic-concurrency?format=cursor","windsurf":"/api/rules/react-19-server-actions-optimistic-concurrency?format=windsurf","agents":"/api/rules/react-19-server-actions-optimistic-concurrency?format=agents"}},{"id":"vite6-environment-api-multi-runtime-isolation-vite-6-environme-532","title":"Vite 6 Environment API Multi-Runtime Isolation and Boundary Protocol","category":"frontend","severity":"critical","description":"Enforces strict isolation across client, Node.js (SSR), and Edge/workerd runtime module graphs using the Vite 6 Environment API. Prevents runtime cross-contamination, illegal module execution via deprecated APIs, and leakage of Node.js-specific built-ins into edge and browser compilation targets.","antiPatternHeadline":"Cross-Contaminating Multi-Target Module Graphs and Relying on Deprecated Single-SSR APIs","stars_count":101,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["vite6","environment-api","multi-runtime","ssr","edge","module-runner"],"exportEndpoints":{"claude":"/api/rules/vite6-environment-api-multi-runtime-isolation-vite-6-environme-532?format=claude","cursorMdc":"/api/rules/vite6-environment-api-multi-runtime-isolation-vite-6-environme-532?format=mdc","cursorrules":"/api/rules/vite6-environment-api-multi-runtime-isolation-vite-6-environme-532?format=cursor","windsurf":"/api/rules/vite6-environment-api-multi-runtime-isolation-vite-6-environme-532?format=windsurf","agents":"/api/rules/vite6-environment-api-multi-runtime-isolation-vite-6-environme-532?format=agents"}},{"id":"bun-multi-worker-zero-copy-http-invariants","title":"Bun 1.2 Multi-Worker Clustering and Zero-Copy HTTP Invariants","category":"backend","severity":"critical","description":"Enforces Linux SO_REUSEPORT kernel socket load balancing and strict zero-copy ArrayBuffer transfer semantics across Bun workers. Eliminates single-threaded event-loop starvation, V8/JSC structured-clone serialization overhead, and garbage collection pauses under multi-gigabit HTTP throughput.","antiPatternHeadline":"Monolithic Event-Loop Saturation via Single-Process Bun.serve and IPC JSON Serialization","stars_count":80,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","performance","clustering","zero-copy","concurrency","networking"],"exportEndpoints":{"claude":"/api/rules/bun-multi-worker-zero-copy-http-invariants?format=claude","cursorMdc":"/api/rules/bun-multi-worker-zero-copy-http-invariants?format=mdc","cursorrules":"/api/rules/bun-multi-worker-zero-copy-http-invariants?format=cursor","windsurf":"/api/rules/bun-multi-worker-zero-copy-http-invariants?format=windsurf","agents":"/api/rules/bun-multi-worker-zero-copy-http-invariants?format=agents"}},{"id":"tauri2-ipc-capability-manifest-scope-isolation","title":"Tauri 2.0 Mobile IPC Capability Matrix & Cryptographic Webview Scope Isolation","category":"mobile","severity":"critical","description":"Enforces strict principle of least privilege across Tauri 2.0 Android and iOS runtimes by requiring fine-grained capability manifests, explicit window-to-permission mappings, and strictly bounded plugin scopes. Prevents arbitrary code execution (RCE), arbitrary file access, and unauthorized native OS bridge privilege escalations resulting from XSS or unauthorized webview navigations.","antiPatternHeadline":"Wildcard IPC Permissions and Unbounded Webview Capabilities Exposing Native Mobile OS Bridges to RCE","stars_count":94,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri","ipc","security","capabilities","rust","webview"],"exportEndpoints":{"claude":"/api/rules/tauri2-ipc-capability-manifest-scope-isolation?format=claude","cursorMdc":"/api/rules/tauri2-ipc-capability-manifest-scope-isolation?format=mdc","cursorrules":"/api/rules/tauri2-ipc-capability-manifest-scope-isolation?format=cursor","windsurf":"/api/rules/tauri2-ipc-capability-manifest-scope-isolation?format=windsurf","agents":"/api/rules/tauri2-ipc-capability-manifest-scope-isolation?format=agents"}},{"id":"kmp-stateflow-swift-concurrency-bridge","title":"Kotlin Multiplatform StateFlow to Swift Concurrency Bridge Invariants","category":"mobile","severity":"critical","description":"Enforces non-blocking cooperative execution and bidirectional cancellation semantics when bridging Kotlin StateFlow/SharedFlow to Swift AsyncSequence. Prevents thread pool starvation in Darwin's cooperative thread pool and eliminates cyclic reference memory leaks across K/N Garbage Collector and Swift ARC boundaries.","antiPatternHeadline":"Synchronous Interop Blocking and Unbridled Flow Subscription Leaks","stars_count":111,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","swift-concurrency","ios","memory-management","coroutines"],"exportEndpoints":{"claude":"/api/rules/kmp-stateflow-swift-concurrency-bridge?format=claude","cursorMdc":"/api/rules/kmp-stateflow-swift-concurrency-bridge?format=mdc","cursorrules":"/api/rules/kmp-stateflow-swift-concurrency-bridge?format=cursor","windsurf":"/api/rules/kmp-stateflow-swift-concurrency-bridge?format=windsurf","agents":"/api/rules/kmp-stateflow-swift-concurrency-bridge?format=agents"}},{"id":"openfga-rebac-snapshot-token-guardrail","title":"OpenFGA Consistent Snapshot Token Enforcement for Zanzibar 'New Enemy' Mitigation","category":"security","severity":"critical","description":"Enforces cryptographically verifiable snapshot read tokens across distributed boundaries to mitigate the Zanzibar 'New Enemy' authorization race condition. Guarantees that ReBAC authorization evaluations against OpenFGA execute at a snapshot timestamp at least as fresh as the mutating transaction, preventing stale permission grants on newly modified or restricted resources.","antiPatternHeadline":"Executing authorization checks with default eventual consistency snapshots after state or relation mutations.","stars_count":78,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","rebac","openfga","zanzibar","authorization","distributed-systems"],"exportEndpoints":{"claude":"/api/rules/openfga-rebac-snapshot-token-guardrail?format=claude","cursorMdc":"/api/rules/openfga-rebac-snapshot-token-guardrail?format=mdc","cursorrules":"/api/rules/openfga-rebac-snapshot-token-guardrail?format=cursor","windsurf":"/api/rules/openfga-rebac-snapshot-token-guardrail?format=windsurf","agents":"/api/rules/openfga-rebac-snapshot-token-guardrail?format=agents"}},{"id":"cilium-ebpf-zero-trust-microsegmentation-standard","title":"Deterministic eBPF Cilium Kernel-Level Zero-Trust Microsegmentation","category":"security","severity":"critical","description":"Enforces deterministic, kernel-enforced Layer 3 to Layer 7 workload identity isolation and egress verification via Cilium eBPF without Envoy sidecar overhead. Mandates socket-level BPF program verification (sockops, tc) coupled with CiliumNetworkPolicy (CNP) and CiliumClusterwideNetworkPolicy (CCNP) to eliminate non-deterministic egress, DNS spoofing, and sidecar latency amplification.","antiPatternHeadline":"Over-Permissive CIDR Whitelisting and Unverified DNS Egress in Pod Network Namespaces","stars_count":102,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","ebpf","cilium","kubernetes","zero-trust","microsegmentation","networking"],"exportEndpoints":{"claude":"/api/rules/cilium-ebpf-zero-trust-microsegmentation-standard?format=claude","cursorMdc":"/api/rules/cilium-ebpf-zero-trust-microsegmentation-standard?format=mdc","cursorrules":"/api/rules/cilium-ebpf-zero-trust-microsegmentation-standard?format=cursor","windsurf":"/api/rules/cilium-ebpf-zero-trust-microsegmentation-standard?format=windsurf","agents":"/api/rules/cilium-ebpf-zero-trust-microsegmentation-standard?format=agents"}},{"id":"opentelemetry-baggage-exemplar-invariants","title":"OpenTelemetry W3C Baggage Propagation & High-Cardinality Exemplar Invariants","category":"devops","severity":"critical","description":"Enforces deterministic W3C tracecontext and baggage extraction/injection across asynchronous message queues, preventing context fragmentation in event-driven architectures. Mandates explicit high-cardinality metadata containment within baggage and exemplar attachments to prevent metric label explosions while preserving sub-millisecond trace-to-metric correlatability.","antiPatternHeadline":"Context Leakage Across Message Brokers and Unbounded High-Cardinality Dimensional Metric Poisoning","stars_count":107,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","tracing","metrics","kafka","observability","distributed-systems"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-baggage-exemplar-invariants?format=claude","cursorMdc":"/api/rules/opentelemetry-baggage-exemplar-invariants?format=mdc","cursorrules":"/api/rules/opentelemetry-baggage-exemplar-invariants?format=cursor","windsurf":"/api/rules/opentelemetry-baggage-exemplar-invariants?format=windsurf","agents":"/api/rules/opentelemetry-baggage-exemplar-invariants?format=agents"}},{"id":"svelte-5-runes-ssr-concurrency-isolation","title":"Svelte 5 Runes SSR State Isolation & Request Concurrency Guardrail","category":"frontend","severity":"critical","description":"Universal Svelte 5 runes ($state, $derived) declared at module scope create persistent singletons in Node.js/SSR runtimes that survive across individual HTTP transactions. Any mutable rune instantiated outside the component lifecycle or Svelte context leaks user sessions, permissions, and reactive proxies across concurrent requests. All dynamic or user-specific state must be instantiated per-request using context encapsulation or factory injection.","antiPatternHeadline":"Module-Scoped Runes Singletons Leaking State Across Concurrent SSR Requests","stars_count":114,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","ssr","concurrency","security","state-management"],"exportEndpoints":{"claude":"/api/rules/svelte-5-runes-ssr-concurrency-isolation?format=claude","cursorMdc":"/api/rules/svelte-5-runes-ssr-concurrency-isolation?format=mdc","cursorrules":"/api/rules/svelte-5-runes-ssr-concurrency-isolation?format=cursor","windsurf":"/api/rules/svelte-5-runes-ssr-concurrency-isolation?format=windsurf","agents":"/api/rules/svelte-5-runes-ssr-concurrency-isolation?format=agents"}},{"id":"postgres17-pgvector-direct-io-memory-guardrails","title":"PostgreSQL 17 Streaming Direct I/O and pgvector Buffer Memory Invariants","category":"backend","severity":"critical","description":"Enforces memory residency invariants, PostgreSQL 17 Direct I/O parameters, and pg_prewarm buffer management for pgvector workloads. Prevents HNSW vector index node eviction and kernel page cache double-buffering during high-throughput semantic searches.","antiPatternHeadline":"Unbounded HNSW Graph Traversal and Missing Buffer Pinning Causing Disk Thrashing and P99 Vector Latency Spikes","stars_count":96,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","pgvector","database-performance","memory-management","io-direct"],"exportEndpoints":{"claude":"/api/rules/postgres17-pgvector-direct-io-memory-guardrails?format=claude","cursorMdc":"/api/rules/postgres17-pgvector-direct-io-memory-guardrails?format=mdc","cursorrules":"/api/rules/postgres17-pgvector-direct-io-memory-guardrails?format=cursor","windsurf":"/api/rules/postgres17-pgvector-direct-io-memory-guardrails?format=windsurf","agents":"/api/rules/postgres17-pgvector-direct-io-memory-guardrails?format=agents"}},{"id":"openfga-rebac-latency-cache-invariants","title":"OpenFGA ReBAC Sub-5ms Evaluation and Distributed Cache Invariants","category":"security","severity":"critical","description":"Enforces deterministic sub-5ms tuple evaluation bounds and distributed cache coherence for OpenFGA Relationship-Based Access Control (ReBAC). Mandates in-memory single-flight deduplication, bounded contextual tuple payload sizing, and transactional write-token propagation to eliminate graph-traversal stampedes across distributed service boundaries.","antiPatternHeadline":"Unbounded Remote ReBAC Evaluation with Cache Stampedes and Missing Consistency Tokens","stars_count":68,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","rebac","authorization","distributed-systems","low-latency"],"exportEndpoints":{"claude":"/api/rules/openfga-rebac-latency-cache-invariants?format=claude","cursorMdc":"/api/rules/openfga-rebac-latency-cache-invariants?format=mdc","cursorrules":"/api/rules/openfga-rebac-latency-cache-invariants?format=cursor","windsurf":"/api/rules/openfga-rebac-latency-cache-invariants?format=windsurf","agents":"/api/rules/openfga-rebac-latency-cache-invariants?format=agents"}},{"id":"kmp-swift-coroutines-memory-boundary-safety","title":"KMP to Swift Coroutine Bridge Memory Leak and Cancellation Safety","category":"mobile","severity":"critical","description":"Prevents catastrophic memory leaks and zombie execution states across the Kotlin Native and Swift ARC memory boundaries. Calling suspend functions or collecting Kotlin StateFlows directly from Swift creates uncollected bridge references and unhandled Job lifecycles. All bridging must enforce structural cancellation bindings to Swift Task contexts or SwiftUI lifecycle owners via wrapped disposable adapters.","antiPatternHeadline":"Unbounded Swift Async/Await Bridging of Kotlin Coroutines Causing ARC Cyclic Retain Leaks and Dangling Native Jobs","stars_count":116,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","swift","coroutines","arc","memory-management"],"exportEndpoints":{"claude":"/api/rules/kmp-swift-coroutines-memory-boundary-safety?format=claude","cursorMdc":"/api/rules/kmp-swift-coroutines-memory-boundary-safety?format=mdc","cursorrules":"/api/rules/kmp-swift-coroutines-memory-boundary-safety?format=cursor","windsurf":"/api/rules/kmp-swift-coroutines-memory-boundary-safety?format=windsurf","agents":"/api/rules/kmp-swift-coroutines-memory-boundary-safety?format=agents"}},{"id":"cilium-tetragon-ebpf-zerotrust-socket-enforcement","title":"Kernel-Level Zero-Trust mTLS and Socket Enforcement with Cilium & Tetragon","category":"devops","severity":"critical","description":"Mandates kernel-space L7 zero-trust network policies and mutual authentication (mTLS) enforcement directly in BPF socket buffers (sockops/sock_msg), eliminating userspace sidecar proxy latencies. Requires deterministic SPIFFE/SPIRE cryptographic workload identity binding and Tetragon kernel tracing policies to terminate unverified raw socket egress/ingress attempts at the syscall boundary.","antiPatternHeadline":"Bypassing Kernel Socket Validation with Fragile L3/L4 CIDRs and High-Latency Userspace Sidecar Proxies","stars_count":52,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","cilium","tetragon","zero-trust","kubernetes","security"],"exportEndpoints":{"claude":"/api/rules/cilium-tetragon-ebpf-zerotrust-socket-enforcement?format=claude","cursorMdc":"/api/rules/cilium-tetragon-ebpf-zerotrust-socket-enforcement?format=mdc","cursorrules":"/api/rules/cilium-tetragon-ebpf-zerotrust-socket-enforcement?format=cursor","windsurf":"/api/rules/cilium-tetragon-ebpf-zerotrust-socket-enforcement?format=windsurf","agents":"/api/rules/cilium-tetragon-ebpf-zerotrust-socket-enforcement?format=agents"}},{"id":"fastapi-async-sqlalchemy-pool-lifecycle","title":"FastAPI Async SQLAlchemy 2.0 Connection Pool Lifecycle Invariants","category":"backend","severity":"critical","description":"Enforces strict scope boundaries and deterministic cleanup for SQLAlchemy 2.0 AsyncSession lifecycles within FastAPI applications. Prevents connection pool starvation, context variable bleeding, and orphaned connection checkouts across concurrent TaskGroups and streaming responses. Mandates explicit session scoping per concurrency unit and forbids leaking AsyncSession instances across async generator boundaries.","antiPatternHeadline":"Orphaned connection pool checkout and deadlock via unclosed async generators and shared AsyncSession instances across TaskGroups","stars_count":100,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["fastapi","sqlalchemy","asyncio","connection-pooling","python","backend"],"exportEndpoints":{"claude":"/api/rules/fastapi-async-sqlalchemy-pool-lifecycle?format=claude","cursorMdc":"/api/rules/fastapi-async-sqlalchemy-pool-lifecycle?format=mdc","cursorrules":"/api/rules/fastapi-async-sqlalchemy-pool-lifecycle?format=cursor","windsurf":"/api/rules/fastapi-async-sqlalchemy-pool-lifecycle?format=windsurf","agents":"/api/rules/fastapi-async-sqlalchemy-pool-lifecycle?format=agents"}},{"id":"webauthn-device-bound-assertion-replay-guardrail","title":"WebAuthn & Passkey Device-Bound Assertion & Replay Protection Invariants","category":"security","severity":"critical","description":"Enforces strict server-side validation of WebAuthn authenticator data, cryptographic challenge-response binding, client data origin validation, and signature counter monotonicity. Prevents cross-origin adversary-in-the-middle (AiTM) proxy attacks, credential replay, and challenge exhaustion across distributed authentication microservices.","antiPatternHeadline":"Accepting Untrusted Origin Hashes, Ephemeral Challenge Re-use, or Unchecked Signature Counters","stars_count":60,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","passkeys","fido2","cryptography","replay-protection","aitm"],"exportEndpoints":{"claude":"/api/rules/webauthn-device-bound-assertion-replay-guardrail?format=claude","cursorMdc":"/api/rules/webauthn-device-bound-assertion-replay-guardrail?format=mdc","cursorrules":"/api/rules/webauthn-device-bound-assertion-replay-guardrail?format=cursor","windsurf":"/api/rules/webauthn-device-bound-assertion-replay-guardrail?format=windsurf","agents":"/api/rules/webauthn-device-bound-assertion-replay-guardrail?format=agents"}},{"id":"capacitor7-secure-enclave-zero-exposure-memory-contract","title":"Capacitor 7 Secure Enclave Zero-Exposure Memory Contract & Bridge Transit","category":"mobile","severity":"critical","description":"Enforces strict memory zeroization and non-interned byte-buffer transit for hardware-backed decrypted secrets passing between native Swift/Kotlin Secure Enclave/KeyStore and the Capacitor 7 WebView runtime. Prohibits immutable string representations of sensitive cryptographic material across the bridge to prevent plaintexts from persisting in uncompacted native heaps and V8 garbage-collection pools.","antiPatternHeadline":"Leaking Hardware-Backed Secrets into Managed Heaps via Immutable String Bridge Serialization","stars_count":86,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","security","keychain","secure-enclave","memory-sanitization"],"exportEndpoints":{"claude":"/api/rules/capacitor7-secure-enclave-zero-exposure-memory-contract?format=claude","cursorMdc":"/api/rules/capacitor7-secure-enclave-zero-exposure-memory-contract?format=mdc","cursorrules":"/api/rules/capacitor7-secure-enclave-zero-exposure-memory-contract?format=cursor","windsurf":"/api/rules/capacitor7-secure-enclave-zero-exposure-memory-contract?format=windsurf","agents":"/api/rules/capacitor7-secure-enclave-zero-exposure-memory-contract?format=agents"}},{"id":"bun-isolated-worker-sandboxing-cgroups","title":"Bun 1.2 Isolated Worker Sandboxing & Cgroup Resource Boundaries","category":"backend","severity":"critical","description":"Mandates strict resource isolation, deterministic memory limits, and preemptive lifecycle recycling when executing untrusted multitenant workloads in Bun 1.2+. Requires pairing native Bun Workers or child processes with Linux cgroups v2 boundary constraints, strict RSS/heap inspection, and hard abort timeouts to prevent noisy-neighbor starvation and host process OOM panics.","antiPatternHeadline":"Unbounded Native Worker Spawning Without Cgroup Jails or Heap Watchdogs","stars_count":109,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","sandboxing","cgroups","security","workers"],"exportEndpoints":{"claude":"/api/rules/bun-isolated-worker-sandboxing-cgroups?format=claude","cursorMdc":"/api/rules/bun-isolated-worker-sandboxing-cgroups?format=mdc","cursorrules":"/api/rules/bun-isolated-worker-sandboxing-cgroups?format=cursor","windsurf":"/api/rules/bun-isolated-worker-sandboxing-cgroups?format=windsurf","agents":"/api/rules/bun-isolated-worker-sandboxing-cgroups?format=agents"}},{"id":"opentelemetry-w3c-batch-context-propagation-standard","title":"OpenTelemetry W3C Distributed Context Propagation Across Async Queue Batches","category":"devops","severity":"critical","description":"Enforces strict extraction and propagation of W3C TraceContext metadata across asynchronous batch messaging architectures (Kafka, SQS, RabbitMQ). Guarantees that batch-consuming workers link each individual processing span to its distinct remote traceparent via OpenTelemetry SpanLinks or isolated context executions, preventing context detachment and cross-tenant trace pollution.","antiPatternHeadline":"Executing Batch Item Processing Inside a Single Ambient Trace Context Inheriting Only One Traceparent or Rooting to Undefined","stars_count":84,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","distributed-tracing","kafka","sqs","w3c-trace-context"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-w3c-batch-context-propagation-standard?format=claude","cursorMdc":"/api/rules/opentelemetry-w3c-batch-context-propagation-standard?format=mdc","cursorrules":"/api/rules/opentelemetry-w3c-batch-context-propagation-standard?format=cursor","windsurf":"/api/rules/opentelemetry-w3c-batch-context-propagation-standard?format=windsurf","agents":"/api/rules/opentelemetry-w3c-batch-context-propagation-standard?format=agents"}},{"id":"nextjs-15-ppr-dynamic-shell-fallback-boundaries","title":"Next.js 15 PPR Dynamic Shell and Suspense Boundary Isolation","category":"frontend","severity":"critical","description":"Enforces strict static HTML skeleton delivery at the edge by isolating dynamic runtime operations within granular React Suspense boundaries. Any access to uncached dynamic I/O, headers, cookies, or searchParams outside a Suspense boundary triggers an uncaught route-level dynamic bailout, collapsing Partial Prerendering into full-page SSR and defeating edge TTFB optimization.","antiPatternHeadline":"Un-Suspended Dynamic Function Calls and Leaked Runtime State Forcing Full-Route SSR De-optimization","stars_count":116,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["nextjs","nextjs-15","react-19","ppr","partial-prerendering","suspense","streaming"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-ppr-dynamic-shell-fallback-boundaries?format=claude","cursorMdc":"/api/rules/nextjs-15-ppr-dynamic-shell-fallback-boundaries?format=mdc","cursorrules":"/api/rules/nextjs-15-ppr-dynamic-shell-fallback-boundaries?format=cursor","windsurf":"/api/rules/nextjs-15-ppr-dynamic-shell-fallback-boundaries?format=windsurf","agents":"/api/rules/nextjs-15-ppr-dynamic-shell-fallback-boundaries?format=agents"}},{"id":"svelte-5-runes-reactive-isolation-proxy-traps","title":"Svelte 5 Runes Reactive Isolation & Deep Proxy Trap Guardrails","category":"frontend","severity":"critical","description":"Enforces strict fine-grained reactivity boundaries in Svelte 5 by preventing deep proxy leaks into external systems and eliminating destructuring-induced reactive loss. Guarantees memory safety and deterministic rendering through explicit $state.raw usage for heavy/external references and $state.snapshot for boundary handoffs.","antiPatternHeadline":"Leaking Svelte 5 $state deep reactive proxies across package boundaries and destructuring reactive primitives","stars_count":78,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","reactivity","typescript","performance"],"exportEndpoints":{"claude":"/api/rules/svelte-5-runes-reactive-isolation-proxy-traps?format=claude","cursorMdc":"/api/rules/svelte-5-runes-reactive-isolation-proxy-traps?format=mdc","cursorrules":"/api/rules/svelte-5-runes-reactive-isolation-proxy-traps?format=cursor","windsurf":"/api/rules/svelte-5-runes-reactive-isolation-proxy-traps?format=windsurf","agents":"/api/rules/svelte-5-runes-reactive-isolation-proxy-traps?format=agents"}},{"id":"temporal-go-workflow-determinism-replay-guardrails","title":"Temporal Go SDK Workflow Determinism, Side-Effect Isolation, and Safe Replay Versioning","category":"backend","severity":"critical","description":"Enforces absolute determinism and side-effect isolation within Temporal Go workflow definitions to prevent NonDeterministicWorkflowError panics during event history replays. Mandates the use of Temporal-encapsulated primitives (workflow.Now, workflow.Sleep, workflow.Go, workflow.Channel) and strict change-management versioning via workflow.GetVersion across rolling cluster deployments.","antiPatternHeadline":"Invoking Non-Deterministic Native Primitives and Mutating Orchestration Graph Without workflow.GetVersion Migration Barriers","stars_count":75,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","temporal","golang","distributed-systems","determinism","event-sourcing"],"exportEndpoints":{"claude":"/api/rules/temporal-go-workflow-determinism-replay-guardrails?format=claude","cursorMdc":"/api/rules/temporal-go-workflow-determinism-replay-guardrails?format=mdc","cursorrules":"/api/rules/temporal-go-workflow-determinism-replay-guardrails?format=cursor","windsurf":"/api/rules/temporal-go-workflow-determinism-replay-guardrails?format=windsurf","agents":"/api/rules/temporal-go-workflow-determinism-replay-guardrails?format=agents"}},{"id":"openfga-rebac-tuple-standardization","title":"OpenFGA Zanzibar ReBAC Authorization and Atomic Tuple Management","category":"security","severity":"critical","description":"Standardizes centralized, zero-latency graph-based authorization checks across microservices via OpenFGA. Enforces atomic transactional consistency between local state persistence and OpenFGA tuple mutations using the Outbox pattern, while eliminating decentralized authorization bypasses caused by ad-hoc JWT claims parsing or disconnected database role tables.","antiPatternHeadline":"Bypassing Zanzibar ReBAC graphs via distributed role claims and desynchronized dual-write authorization tuples","stars_count":48,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","rebac","openfga","authorization","zanzibar","microservices"],"exportEndpoints":{"claude":"/api/rules/openfga-rebac-tuple-standardization?format=claude","cursorMdc":"/api/rules/openfga-rebac-tuple-standardization?format=mdc","cursorrules":"/api/rules/openfga-rebac-tuple-standardization?format=cursor","windsurf":"/api/rules/openfga-rebac-tuple-standardization?format=windsurf","agents":"/api/rules/openfga-rebac-tuple-standardization?format=agents"}},{"id":"webauthn-prf-client-key-derivation","title":"WebAuthn PRF Extension Client-Side Symmetric Key Derivation & Zero-Leakage Standard","category":"security","severity":"critical","description":"Mandates strict zero-knowledge client-side symmetric key derivation using the WebAuthn PRF (Pseudo-Random Function) extension. Requires intermediate PRF outputs to pass through HKDF domain separation and strictly prohibits leaking authenticator-derived secrets to servers or persistent storage.","antiPatternHeadline":"Leaking WebAuthn PRF outputs to backend APIs or using raw PRF material directly as symmetric cipher keys.","stars_count":59,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","prf-extension","cryptography","hkdf","e2ee","zero-knowledge"],"exportEndpoints":{"claude":"/api/rules/webauthn-prf-client-key-derivation?format=claude","cursorMdc":"/api/rules/webauthn-prf-client-key-derivation?format=mdc","cursorrules":"/api/rules/webauthn-prf-client-key-derivation?format=cursor","windsurf":"/api/rules/webauthn-prf-client-key-derivation?format=windsurf","agents":"/api/rules/webauthn-prf-client-key-derivation?format=agents"}},{"id":"opentelemetry-ebpf-ingress-pipeline-production-standard","title":"OpenTelemetry eBPF Zero-Overhead Ingress Pipeline and Context Propagation Standard","category":"devops","severity":"critical","description":"Mandates declarative security boundaries, BTF/CO-RE portability, and backpressure-resilient ring buffer configurations for OpenTelemetry eBPF auto-instrumentation ingress pipelines. Ensures deterministic W3C trace context propagation and golden signal extraction across polyglot workloads without invasive sidecars or privileged container escalation.","antiPatternHeadline":"Overprivileged DaemonSets with Unbounded Ring Buffers and Blind Kernel BTF Mounts","stars_count":98,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","opentelemetry","kubernetes","observability","distributed-tracing"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-ebpf-ingress-pipeline-production-standard?format=claude","cursorMdc":"/api/rules/opentelemetry-ebpf-ingress-pipeline-production-standard?format=mdc","cursorrules":"/api/rules/opentelemetry-ebpf-ingress-pipeline-production-standard?format=cursor","windsurf":"/api/rules/opentelemetry-ebpf-ingress-pipeline-production-standard?format=windsurf","agents":"/api/rules/opentelemetry-ebpf-ingress-pipeline-production-standard?format=agents"}},{"id":"cilium-ambient-kernel-mtls-l7-enforcement","title":"Cilium Ambient eBPF Kernel-Level mTLS and L7 Policy Enforcement Standard","category":"devops","severity":"critical","description":"Enforces sidecarless kernel-level mutual TLS (mTLS) with SPIFFE/SPIRE authentication and deterministic Layer 7 traffic routing via eBPF sockops. Prohibits redundant per-pod proxy sidecars and ensures zero-trust CiliumNetworkPolicy manifests strictly bind L7 visibility to node-level Envoy proxies.","antiPatternHeadline":"Permissive L7 Fallbacks and Redundant Application Sidecar Injections within eBPF Ambient Data Planes","stars_count":40,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","cilium","ebpf","ambient-mesh","mtls","kubernetes","zero-trust"],"exportEndpoints":{"claude":"/api/rules/cilium-ambient-kernel-mtls-l7-enforcement?format=claude","cursorMdc":"/api/rules/cilium-ambient-kernel-mtls-l7-enforcement?format=mdc","cursorrules":"/api/rules/cilium-ambient-kernel-mtls-l7-enforcement?format=cursor","windsurf":"/api/rules/cilium-ambient-kernel-mtls-l7-enforcement?format=windsurf","agents":"/api/rules/cilium-ambient-kernel-mtls-l7-enforcement?format=agents"}},{"id":"react-native-turbomodule-jsi-memory-safety","title":"React Native 0.76+ Bridgeless TurboModule JSI Memory Safety & HostObject Lifetime Guardrail","category":"mobile","severity":"critical","description":"In React Native 0.76+ bridgeless architecture, TurboModules bypass asynchronous serialization and interface directly with C++ JSI runtime heaps. Unmanaged native object references, dangling HostObject pointers, or cross-thread raw JSI access cause uncatchable SIGSEGV crashes, Hermes GC deadlocks, and silent memory leaks across JavaScript-native boundaries.","antiPatternHeadline":"Retaining Raw JSI HostObject Pointers and Capturing Non-Thread-Safe JSI Values Across Async Dispatch Boundaries","stars_count":75,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","react-native","turbomodules","jsi","memory-safety","bridgeless","hermes"],"exportEndpoints":{"claude":"/api/rules/react-native-turbomodule-jsi-memory-safety?format=claude","cursorMdc":"/api/rules/react-native-turbomodule-jsi-memory-safety?format=mdc","cursorrules":"/api/rules/react-native-turbomodule-jsi-memory-safety?format=cursor","windsurf":"/api/rules/react-native-turbomodule-jsi-memory-safety?format=windsurf","agents":"/api/rules/react-native-turbomodule-jsi-memory-safety?format=agents"}},{"id":"android-glance-workmanager-snapshot-invariants","title":"Jetpack Glance State Reconciliation & WorkManager Execution Guardrails","category":"mobile","severity":"critical","description":"Enforces non-blocking transactional widget state reconciliation across cold process terminations using GlanceStateDefinition backed by DataStore or Room. Mandates strict adherence to Android 15 background execution constraints and JobScheduler quotas by prohibiting direct I/O or unbounded coroutine dispatch within GlanceAppWidgetReceiver or GlanceAppWidget.provideGlance, offloading all state mutation and data fetching to transactional, unique WorkManager workers.","antiPatternHeadline":"Executing Direct Network/Database I/O or Unconstrained Coroutines Inside Glance Receivers and Composables","stars_count":87,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","android","jetpack-glance","workmanager","android-15","datastore","app-widgets"],"exportEndpoints":{"claude":"/api/rules/android-glance-workmanager-snapshot-invariants?format=claude","cursorMdc":"/api/rules/android-glance-workmanager-snapshot-invariants?format=mdc","cursorrules":"/api/rules/android-glance-workmanager-snapshot-invariants?format=cursor","windsurf":"/api/rules/android-glance-workmanager-snapshot-invariants?format=windsurf","agents":"/api/rules/android-glance-workmanager-snapshot-invariants?format=agents"}},{"id":"react-19-server-actions-idempotency-csrf-validation","title":"React 19 Server Actions Idempotency & CSRF Strict Origin Validation","category":"frontend","severity":"critical","description":"Enforces strict origin checking, host header verification, and cryptographic idempotency key caching for React 19 Server Actions. Guarantees cross-site POST replay resilience and prevents duplicate execution of mutating server functions in modern RSC architectures under network retry or concurrent submission conditions.","antiPatternHeadline":"Executing Non-Idempotent Server Actions Without Origin Validation or Replay Protection","stars_count":75,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","nextjs","server-actions","csrf","idempotency","security"],"exportEndpoints":{"claude":"/api/rules/react-19-server-actions-idempotency-csrf-validation?format=claude","cursorMdc":"/api/rules/react-19-server-actions-idempotency-csrf-validation?format=mdc","cursorrules":"/api/rules/react-19-server-actions-idempotency-csrf-validation?format=cursor","windsurf":"/api/rules/react-19-server-actions-idempotency-csrf-validation?format=windsurf","agents":"/api/rules/react-19-server-actions-idempotency-csrf-validation?format=agents"}},{"id":"vite-6-environment-api-ssr-context-isolation","title":"Vite 6 Environment API: Multi-Runtime SSR State and Module Context Isolation","category":"frontend","severity":"critical","description":"Enforces strict isolation boundaries across Client, Node.js, and Edge/Workerd environments within Vite 6 multi-runtime setups. Prevents cross-environment module graph pollution, ambient global mutations, and shared memory leakage across asynchronous request contexts during unified SSR compilation and execution.","antiPatternHeadline":"Global Module Singletons and Unisolated Cross-Runtime Module Graphs in Vite 6 SSR","stars_count":105,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["vite6","environment-api","ssr","multi-runtime","edge","workerd","node"],"exportEndpoints":{"claude":"/api/rules/vite-6-environment-api-ssr-context-isolation?format=claude","cursorMdc":"/api/rules/vite-6-environment-api-ssr-context-isolation?format=mdc","cursorrules":"/api/rules/vite-6-environment-api-ssr-context-isolation?format=cursor","windsurf":"/api/rules/vite-6-environment-api-ssr-context-isolation?format=windsurf","agents":"/api/rules/vite-6-environment-api-ssr-context-isolation?format=agents"}},{"id":"fastapi-anyio-taskgroup-structured-concurrency","title":"FastAPI & AnyIO TaskGroup Structured Concurrency Guardrail","category":"backend","severity":"critical","description":"Enforces strict structured concurrency in FastAPI request lifecycles using AnyIO TaskGroups to prevent orphaned child coroutines and leaked resources. Mandates that all concurrent fan-out operations remain bound to the request scope, ensuring immediate and clean cancellation cascading when a client disconnects or an upstream timeout occurs.","antiPatternHeadline":"Unbounded Fire-and-Forget asyncio.create_task Spawning Zombie Routines on Client Disconnect","stars_count":46,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","anyio","asyncio","structured-concurrency","python"],"exportEndpoints":{"claude":"/api/rules/fastapi-anyio-taskgroup-structured-concurrency?format=claude","cursorMdc":"/api/rules/fastapi-anyio-taskgroup-structured-concurrency?format=mdc","cursorrules":"/api/rules/fastapi-anyio-taskgroup-structured-concurrency?format=cursor","windsurf":"/api/rules/fastapi-anyio-taskgroup-structured-concurrency?format=windsurf","agents":"/api/rules/fastapi-anyio-taskgroup-structured-concurrency?format=agents"}},{"id":"openfga-contextual-tuples-cache-guardrail","title":"OpenFGA Contextual Tuple Authorization & Deterministic In-Memory Decision Caching","category":"security","severity":"critical","description":"Enforces deterministic cryptographic hashing of request-scoped contextual tuples, store IDs, and model versions within in-memory ReBAC evaluation caches. Prevents authorization bypasses, cache poisoning, and cross-tenant privilege escalation caused by naive cache keys that omit transient contextual claims.","antiPatternHeadline":"Omitting Contextual Tuples from In-Memory ReBAC Cache Keys Causing Permission Leaks","stars_count":108,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["openfga","rebac","authorization","caching","security","multi-tenant"],"exportEndpoints":{"claude":"/api/rules/openfga-contextual-tuples-cache-guardrail?format=claude","cursorMdc":"/api/rules/openfga-contextual-tuples-cache-guardrail?format=mdc","cursorrules":"/api/rules/openfga-contextual-tuples-cache-guardrail?format=cursor","windsurf":"/api/rules/openfga-contextual-tuples-cache-guardrail?format=windsurf","agents":"/api/rules/openfga-contextual-tuples-cache-guardrail?format=agents"}},{"id":"axum-tokio-sse-ws-graceful-draining-sigterm","title":"Axum Tokio In-Flight SSE & WebSocket Deterministic Channel Draining on SIGTERM","category":"backend","severity":"critical","description":"Long-lived HTTP streaming (SSE) and WebSocket connections in Axum must not rely solely on default hyper/axum graceful shutdown hooks, which stall indefinitely on open streams. Production services must coordinate Kubernetes SIGTERM teardown using CancellationToken hierarchies and TaskTracker primitives to stop ingress, flush buffered channel frames, dispatch WS 1001 (Going Away) close handshakes or SSE terminal events, and deterministically bound task draining before pod eviction.","antiPatternHeadline":"Leaking Open Streams Across Container Teardown Causing Hard SIGKILLs and Truncated In-Flight Payloads","stars_count":59,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","tokio","axum","kubernetes","websockets","sse"],"exportEndpoints":{"claude":"/api/rules/axum-tokio-sse-ws-graceful-draining-sigterm?format=claude","cursorMdc":"/api/rules/axum-tokio-sse-ws-graceful-draining-sigterm?format=mdc","cursorrules":"/api/rules/axum-tokio-sse-ws-graceful-draining-sigterm?format=cursor","windsurf":"/api/rules/axum-tokio-sse-ws-graceful-draining-sigterm?format=windsurf","agents":"/api/rules/axum-tokio-sse-ws-graceful-draining-sigterm?format=agents"}},{"id":"postgres-17-json-table-streaming-ingestion","title":"Postgres 17 JSON_TABLE Streaming Ingestion with Memory-Constrained Temp Buffers","category":"backend","severity":"critical","description":"Enforces SQL/JSON standard JSON_TABLE projections and strict transactional memory boundaries (work_mem and temp_buffers) for high-throughput JSON document ingestion in Postgres 17. Eliminates client-side V8 heap exhaustion and Postgres backend palloc OOM spikes while preventing intermediate staging tables from evicting hot pages in shared_buffers.","antiPatternHeadline":"Client-Side In-Memory Deserialization and jsonb_to_recordset Causing Postgres Backend OOM and Shared Buffer Churn","stars_count":41,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres-17","json-table","streaming-ingestion","buffer-pool","performance"],"exportEndpoints":{"claude":"/api/rules/postgres-17-json-table-streaming-ingestion?format=claude","cursorMdc":"/api/rules/postgres-17-json-table-streaming-ingestion?format=mdc","cursorrules":"/api/rules/postgres-17-json-table-streaming-ingestion?format=cursor","windsurf":"/api/rules/postgres-17-json-table-streaming-ingestion?format=windsurf","agents":"/api/rules/postgres-17-json-table-streaming-ingestion?format=agents"}},{"id":"ebpf-tracecontext-sockops-injection-standard","title":"Zero-Instrumentation Socket-Level W3C TraceContext eBPF Injection Standard","category":"devops","severity":"critical","description":"Enforces safe, deterministic W3C TraceContext injection at the kernel socket layer across heterogeneous polyglot services without application-level agent overhead. Mandates protocol-aware stream parsing, strict TLS boundary preservation via kTLS or uprobe co-processing, and non-destructive TCP byte-stream manipulation using sk_msg and sock_ops helpers.","antiPatternHeadline":"Corrupting In-Flight L7 Payloads or Breaking TCP Sequence Spaces via Blind eBPF Byte Injection","stars_count":63,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","distributed-tracing","observability","kernel","w3c-tracecontext"],"exportEndpoints":{"claude":"/api/rules/ebpf-tracecontext-sockops-injection-standard?format=claude","cursorMdc":"/api/rules/ebpf-tracecontext-sockops-injection-standard?format=mdc","cursorrules":"/api/rules/ebpf-tracecontext-sockops-injection-standard?format=cursor","windsurf":"/api/rules/ebpf-tracecontext-sockops-injection-standard?format=windsurf","agents":"/api/rules/ebpf-tracecontext-sockops-injection-standard?format=agents"}},{"id":"spiffe-spire-ephemeral-svid-attestation","title":"SPIFFE/SPIRE Ephemeral X.509 SVID Inter-Cluster Zero-Trust Attestation","category":"security","severity":"critical","description":"Mandates continuous ephemeral X.509 SVID issuance and verification via the SPIFFE Workload API, eliminating static long-lived credentials across multi-cloud meshes. Enforces non-blocking dynamic mTLS certificate reloads in memory and rejects permissive or wildcard SAN verification in favor of explicit federated SPIFFE ID validation.","antiPatternHeadline":"Bypassing SPIFFE Workload API with Long-Lived Static Certificates or Permissive TLS SAN Validation","stars_count":95,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","spiffe","spire","zero-trust","mtls","x509","mesh"],"exportEndpoints":{"claude":"/api/rules/spiffe-spire-ephemeral-svid-attestation?format=claude","cursorMdc":"/api/rules/spiffe-spire-ephemeral-svid-attestation?format=mdc","cursorrules":"/api/rules/spiffe-spire-ephemeral-svid-attestation?format=cursor","windsurf":"/api/rules/spiffe-spire-ephemeral-svid-attestation?format=windsurf","agents":"/api/rules/spiffe-spire-ephemeral-svid-attestation?format=agents"}},{"id":"react-native-jsi-direct-buffer-exchange","title":"Zero-Copy JSI ArrayBuffer Streaming for High-Frequency Native Buffers","category":"mobile","severity":"critical","description":"Mandates the usage of direct C++ JSI ArrayBuffer encapsulation and shared-memory HostObjects for streaming high-frequency biometric, audio, and visual data to the JavaScript engine. Prohibits Base64 conversion, JSON serialization, and per-frame heap allocations over the React Native bridge or TurboModule message queues.","antiPatternHeadline":"Serializing High-Frequency Binary Streams into Base64 or JSON Over Async TurboModule Promises","stars_count":85,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","react-native","jsi","cpp","turbomodules","zero-copy","performance"],"exportEndpoints":{"claude":"/api/rules/react-native-jsi-direct-buffer-exchange?format=claude","cursorMdc":"/api/rules/react-native-jsi-direct-buffer-exchange?format=mdc","cursorrules":"/api/rules/react-native-jsi-direct-buffer-exchange?format=cursor","windsurf":"/api/rules/react-native-jsi-direct-buffer-exchange?format=windsurf","agents":"/api/rules/react-native-jsi-direct-buffer-exchange?format=agents"}},{"id":"w3c-trusted-types-strict-csp-l3-enforcement","title":"W3C Trusted Types and Strict Nonce-Based CSP Level 3 Enforcement","category":"security","severity":"critical","description":"Enforces mathematically verifiable defenses against client-side DOM-based Cross-Site Scripting (XSS) by mandating W3C Trusted Types and CSP Level 3 strict nonces. Direct injection sink mutations (innerHTML, outerHTML, script.src) are prohibited unless routed through pre-compiled, audited TrustedType policies. All executable script tags must carry cryptographically secure per-request nonces, deprecating unsafe-inline and wildcard domain allowlists.","antiPatternHeadline":"Unsanitized DOM Sink Mutations and Permissive Host-Based CSP Policies Permitting Arbitrary Script Execution","stars_count":107,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","trusted-types","csp-level-3","xss-prevention","dompurify","defense-in-depth"],"exportEndpoints":{"claude":"/api/rules/w3c-trusted-types-strict-csp-l3-enforcement?format=claude","cursorMdc":"/api/rules/w3c-trusted-types-strict-csp-l3-enforcement?format=mdc","cursorrules":"/api/rules/w3c-trusted-types-strict-csp-l3-enforcement?format=cursor","windsurf":"/api/rules/w3c-trusted-types-strict-csp-l3-enforcement?format=windsurf","agents":"/api/rules/w3c-trusted-types-strict-csp-l3-enforcement?format=agents"}},{"id":"nextjs-15-ppr-streaming-boundaries-production-standard","title":"Next.js 15 PPR Boundary Isolation and Deterministic Shell Invariants","category":"frontend","severity":"critical","description":"Enforces strict structural segregation between prerendered static layout shells and dynamic streaming leaves under Next.js 15 Partial Prerendering (PPR). Mandates explicit React Suspense boundaries around all dynamic I/O operations (headers, cookies, searchParams promises, uncached queries) to guarantee zero prerender shell collapse and deterministic, layout-shift-free fallback streaming.","antiPatternHeadline":"Leaking Dynamic Request Context or Un-Suspended Async Components into Static Shells Causing Full Route Prerender De-optimization","stars_count":89,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs15","ppr","streaming","suspense","react-server-components"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-ppr-streaming-boundaries-production-standard?format=claude","cursorMdc":"/api/rules/nextjs-15-ppr-streaming-boundaries-production-standard?format=mdc","cursorrules":"/api/rules/nextjs-15-ppr-streaming-boundaries-production-standard?format=cursor","windsurf":"/api/rules/nextjs-15-ppr-streaming-boundaries-production-standard?format=windsurf","agents":"/api/rules/nextjs-15-ppr-streaming-boundaries-production-standard?format=agents"}},{"id":"svelte-5-runes-module-singleton-lifecycle-boundaries","title":"Svelte 5 Module-Level Reactive Singletons and Effect Lifecycle Boundaries","category":"frontend","severity":"critical","description":"Enforces strict encapsulation and lifecycle boundaries for module-level Svelte 5 runes ($state, $derived) shared across components. Prevents runaway reactive dependencies, dangling untracked effects, and memory leaks by forbidding naked effects in module scope and mandating explicit $effect.root cleanup contracts.","antiPatternHeadline":"Instantiating Naked $effect Calls in Module Scope and Leaking Cross-Component Signal Subscriptions","stars_count":49,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","state-management","memory-leaks"],"exportEndpoints":{"claude":"/api/rules/svelte-5-runes-module-singleton-lifecycle-boundaries?format=claude","cursorMdc":"/api/rules/svelte-5-runes-module-singleton-lifecycle-boundaries?format=mdc","cursorrules":"/api/rules/svelte-5-runes-module-singleton-lifecycle-boundaries?format=cursor","windsurf":"/api/rules/svelte-5-runes-module-singleton-lifecycle-boundaries?format=windsurf","agents":"/api/rules/svelte-5-runes-module-singleton-lifecycle-boundaries?format=agents"}},{"id":"openfga-zanzibar-depth-cyclic-guards","title":"OpenFGA Zanzibar Fine-Grained Authorization Depth & Cyclic Guards","category":"security","severity":"critical","description":"Enforces strict recursion depth constraints, cycle detection, and distributed context propagation during OpenFGA Zanzibar relation graph evaluations. Prevents catastrophic tail-latency amplification and distributed denial-of-service (DDoS) stemming from self-referential or deeply nested multi-tenant tuple hierarchies. Mandates schema-level cycle guards, bounded expansion timeouts, and client-side resolution throttles.","antiPatternHeadline":"Unbounded recursive tuple traversal inducing evaluation cycle storms and thread starvation","stars_count":61,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","zanzibar","authorization","dos-prevention","graph-algorithms"],"exportEndpoints":{"claude":"/api/rules/openfga-zanzibar-depth-cyclic-guards?format=claude","cursorMdc":"/api/rules/openfga-zanzibar-depth-cyclic-guards?format=mdc","cursorrules":"/api/rules/openfga-zanzibar-depth-cyclic-guards?format=cursor","windsurf":"/api/rules/openfga-zanzibar-depth-cyclic-guards?format=windsurf","agents":"/api/rules/openfga-zanzibar-depth-cyclic-guards?format=agents"}},{"id":"fido2-hardware-attestation-policy-guardrail","title":"FIDO2 Hardware Attestation and Device-Bound Credential Verification","category":"security","severity":"critical","description":"Enforces cryptographic verification of hardware-backed authenticator attachment and attestation statements during FIDO2/WebAuthn registration. Eliminates credential downgrade and unauthorized cross-platform synchronization by asserting FIDO MDS3 trust chains, validating AAGUID authentications, and auditing authenticator data backup flags.","antiPatternHeadline":"Permitting Unverified Passkey Registration via 'attestation: none' and Ignoring Authenticator Backup Flags","stars_count":77,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","fido2","passkeys","cryptography","attestation"],"exportEndpoints":{"claude":"/api/rules/fido2-hardware-attestation-policy-guardrail?format=claude","cursorMdc":"/api/rules/fido2-hardware-attestation-policy-guardrail?format=mdc","cursorrules":"/api/rules/fido2-hardware-attestation-policy-guardrail?format=cursor","windsurf":"/api/rules/fido2-hardware-attestation-policy-guardrail?format=windsurf","agents":"/api/rules/fido2-hardware-attestation-policy-guardrail?format=agents"}},{"id":"pgvector-hnsw-in-memory-partitioning-guardrail","title":"Postgres 17 pgvector HNSW Working-Set In-Memory Partitioning and Buffer Isolation","category":"backend","severity":"critical","description":"Enforces strict temporal or categorical range-partitioning on pgvector tables with separate HNSW index builds per partition. Prevents catastrophic Postgres shared buffer cache thrashing and kernel page I/O stalls by isolating vector similarity searches exclusively to memory-fit partitions, backed by pg_prewarm and partition pruning invariants.","antiPatternHeadline":"Monolithic pgvector Table HNSW Indexing Causing Shared Buffer Cache Thrashing and Global IO Stalls","stars_count":54,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres-17","pgvector","hnsw","rag","database-performance"],"exportEndpoints":{"claude":"/api/rules/pgvector-hnsw-in-memory-partitioning-guardrail?format=claude","cursorMdc":"/api/rules/pgvector-hnsw-in-memory-partitioning-guardrail?format=mdc","cursorrules":"/api/rules/pgvector-hnsw-in-memory-partitioning-guardrail?format=cursor","windsurf":"/api/rules/pgvector-hnsw-in-memory-partitioning-guardrail?format=windsurf","agents":"/api/rules/pgvector-hnsw-in-memory-partitioning-guardrail?format=agents"}},{"id":"go-slog-context-baggage-chi-goroutine-leak-prevention","title":"Go 1.24 slog Trace Baggage Propagation and Detached Goroutine Safety in Chi Handlers","category":"backend","severity":"critical","description":"Enforces immutable W3C trace and baggage propagation through Go 1.24 structured logging (log/slog) across multiplexed Chi router pipelines. Mandates the use of context.WithoutCancel with supervised asynchronous task handoffs to eliminate orphan goroutine memory leaks and broken distributed trace lineages caused by premature HTTP request context termination.","antiPatternHeadline":"Firing Naked Goroutines with r.Context() or context.Background() in HTTP Handlers Leading to Silent Context Canceled Aborts and Severed Distributed Traces","stars_count":84,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","golang","go-1-24","slog","opentelemetry","chi","concurrency"],"exportEndpoints":{"claude":"/api/rules/go-slog-context-baggage-chi-goroutine-leak-prevention?format=claude","cursorMdc":"/api/rules/go-slog-context-baggage-chi-goroutine-leak-prevention?format=mdc","cursorrules":"/api/rules/go-slog-context-baggage-chi-goroutine-leak-prevention?format=cursor","windsurf":"/api/rules/go-slog-context-baggage-chi-goroutine-leak-prevention?format=windsurf","agents":"/api/rules/go-slog-context-baggage-chi-goroutine-leak-prevention?format=agents"}},{"id":"fastapi-async-generator-stream-teardown-guardrail","title":"Deterministic Teardown for Dependency-Injected Async Generators in Streaming Endpoints","category":"backend","severity":"critical","description":"Enforces deterministic release of sockets, transactions, and telemetry spans yielded by FastAPI async generator dependencies during client disconnects or ASGI stream cancellations. Because Starlette StreamingResponse teardowns occur outside the immediate task context upon asyncio.CancelledError, generator dependencies must guarantee idempotency and shield finalization blocks from premature task death.","antiPatternHeadline":"Resource Leakage via Abrupt ASGI Cancellation in Dependency-Injected Streaming Generators","stars_count":68,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","asyncio","streaming","resource-management"],"exportEndpoints":{"claude":"/api/rules/fastapi-async-generator-stream-teardown-guardrail?format=claude","cursorMdc":"/api/rules/fastapi-async-generator-stream-teardown-guardrail?format=mdc","cursorrules":"/api/rules/fastapi-async-generator-stream-teardown-guardrail?format=cursor","windsurf":"/api/rules/fastapi-async-generator-stream-teardown-guardrail?format=windsurf","agents":"/api/rules/fastapi-async-generator-stream-teardown-guardrail?format=agents"}},{"id":"tauri2-scoped-ipc-capability-acl-origin-isolation","title":"Tauri 2.0 Scoped IPC Capability ACL and WebView Origin Isolation","category":"mobile","severity":"critical","description":"Enforces granular capability Access Control Lists (ACLs), path-scoped permissions, and strict WebView origin isolation in Tauri 2.0 mobile architectures. Eliminates arbitrary native binary execution, unauthorized file system access, and command injection arising from compromised frontend dependencies or untrusted WebViews.","antiPatternHeadline":"Permissive IPC Wildcarding, Default Global Capabilities, and Unscoped Native Invocation","stars_count":88,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri-2","ipc-security","capabilities-acl","rust-security"],"exportEndpoints":{"claude":"/api/rules/tauri2-scoped-ipc-capability-acl-origin-isolation?format=claude","cursorMdc":"/api/rules/tauri2-scoped-ipc-capability-acl-origin-isolation?format=mdc","cursorrules":"/api/rules/tauri2-scoped-ipc-capability-acl-origin-isolation?format=cursor","windsurf":"/api/rules/tauri2-scoped-ipc-capability-acl-origin-isolation?format=windsurf","agents":"/api/rules/tauri2-scoped-ipc-capability-acl-origin-isolation?format=agents"}},{"id":"cilium-ebpf-host-mtls-l7-policy-guardrail","title":"Cilium eBPF Host-Level Kernel mTLS & Ingress L7 Zero-Trust Policy Enforcement","category":"devops","severity":"critical","description":"Mandates kernel-level cryptographic identity verification and Layer 7 protocol parsing via Cilium eBPF socket programs and SPIRE identity attestation without injecting user-space sidecar proxies. Prevents cleartext socket bypasses, unauthenticated peer connections, and insecure egress/ingress policy fallbacks in zero-trust cluster datalayers.","antiPatternHeadline":"Defining sidecarless L7 CiliumNetworkPolicies lacking kernel-enforced mutual authentication or SPIRE identity attestation","stars_count":75,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["cilium","ebpf","mtls","zero-trust","kubernetes","spire","devops","network-security"],"exportEndpoints":{"claude":"/api/rules/cilium-ebpf-host-mtls-l7-policy-guardrail?format=claude","cursorMdc":"/api/rules/cilium-ebpf-host-mtls-l7-policy-guardrail?format=mdc","cursorrules":"/api/rules/cilium-ebpf-host-mtls-l7-policy-guardrail?format=cursor","windsurf":"/api/rules/cilium-ebpf-host-mtls-l7-policy-guardrail?format=windsurf","agents":"/api/rules/cilium-ebpf-host-mtls-l7-policy-guardrail?format=agents"}},{"id":"svelte-5-runes-async-effect-isolation","title":"Svelte 5 Runes Async Boundary & Effect Teardown Isolation","category":"frontend","severity":"critical","description":"Enforces synchronous dependency tracking and explicit cancellation isolation for asynchronous operations inside Svelte 5 $effect runes. In Svelte 5, reactive signal reads after an await boundary lose tracking, and async callbacks return Promises that drop cleanup teardowns. This standard guarantees lifecycle-safe asynchronous task execution and prevents orphaned listeners during client-side route transitions.","antiPatternHeadline":"Asynchronous Effect Cleanup Loss and Post-Await Reactivity Tracking Leaks","stars_count":41,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","async","lifecycle","state-management"],"exportEndpoints":{"claude":"/api/rules/svelte-5-runes-async-effect-isolation?format=claude","cursorMdc":"/api/rules/svelte-5-runes-async-effect-isolation?format=mdc","cursorrules":"/api/rules/svelte-5-runes-async-effect-isolation?format=cursor","windsurf":"/api/rules/svelte-5-runes-async-effect-isolation?format=windsurf","agents":"/api/rules/svelte-5-runes-async-effect-isolation?format=agents"}},{"id":"nextjs-15-ppr-dynamic-hole-streaming-invariants","title":"Next.js 15 PPR Dynamic Hole Streaming Invariants and Shell Isolation","category":"frontend","severity":"critical","description":"Enforces strict physical boundary isolation between static Server-Side Generation (SSG) shells and dynamic streaming edge chunks under Next.js 15 Partial Prerendering (PPR). Mandates the encapsulation of dynamic runtime data fetches inside isolated Suspense boundaries paired with dimensionally stable skeleton fallbacks to prevent cascading waterfall stalls, de-opt of static page shells into dynamic SSR, and Cumulative Layout Shift (CLS) thrashing.","antiPatternHeadline":"Dynamic Runtime Intrusion Poisoning Static PPR Shells into Blocking SSR Waterfalls","stars_count":95,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs15","ppr","react-suspense","performance","streaming"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-ppr-dynamic-hole-streaming-invariants?format=claude","cursorMdc":"/api/rules/nextjs-15-ppr-dynamic-hole-streaming-invariants?format=mdc","cursorrules":"/api/rules/nextjs-15-ppr-dynamic-hole-streaming-invariants?format=cursor","windsurf":"/api/rules/nextjs-15-ppr-dynamic-hole-streaming-invariants?format=windsurf","agents":"/api/rules/nextjs-15-ppr-dynamic-hole-streaming-invariants?format=agents"}},{"id":"fastapi-threadpool-starvation-contextvar-propagation","title":"FastAPI Blocking Worker Threadpool Isolation & ContextVar Telemetry Propagation","category":"backend","severity":"critical","description":"Enforces strict isolation of blocking synchronous dependencies onto dedicated, capacity-bounded worker pools to prevent event loop and default AnyIO threadpool starvation. Guarantees deterministic propagation of contextvars (e.g., OpenTelemetry spans, tenant IDs, correlation IDs) across asyncio-to-thread boundaries without state leaking or dropping.","antiPatternHeadline":"Executing blocking synchronous operations inside async def handlers or offloading to raw executors that drop ContextVar state and exhaust global worker threadpools.","stars_count":112,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["fastapi","asyncio","concurrency","contextvars","opentelemetry","python","performance"],"exportEndpoints":{"claude":"/api/rules/fastapi-threadpool-starvation-contextvar-propagation?format=claude","cursorMdc":"/api/rules/fastapi-threadpool-starvation-contextvar-propagation?format=mdc","cursorrules":"/api/rules/fastapi-threadpool-starvation-contextvar-propagation?format=cursor","windsurf":"/api/rules/fastapi-threadpool-starvation-contextvar-propagation?format=windsurf","agents":"/api/rules/fastapi-threadpool-starvation-contextvar-propagation?format=agents"}},{"id":"postgres17-logical-failover-slot-sync-invariants","title":"PostgreSQL 17 Failover Slot Synchronization & Logical Outbox Idempotency","category":"backend","severity":"critical","description":"Enforces strict failover synchronization invariants for PostgreSQL 17 logical replication slots across HA clusters. Mandates the use of 'failover = true' on primary publication slots, coordinated pg_sync_replication_slots() synchronization on standbys, and consumer-side deterministic LSN/transaction-ID deduplication to prevent message replay storms and outbox corruption following cluster promotion.","antiPatternHeadline":"Unsynchronized Logical Slots and Non-Idempotent Outbox Consumption Trigger Massive Data Duplication on Promotion","stars_count":68,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres","postgres17","replication","cdc","outbox","ha"],"exportEndpoints":{"claude":"/api/rules/postgres17-logical-failover-slot-sync-invariants?format=claude","cursorMdc":"/api/rules/postgres17-logical-failover-slot-sync-invariants?format=mdc","cursorrules":"/api/rules/postgres17-logical-failover-slot-sync-invariants?format=cursor","windsurf":"/api/rules/postgres17-logical-failover-slot-sync-invariants?format=windsurf","agents":"/api/rules/postgres17-logical-failover-slot-sync-invariants?format=agents"}},{"id":"hyper-v1-h3-zero-copy-dynamic-flow-control","title":"Hyper 1.0 Zero-Copy HTTP/3 Dynamic Flow Control Framing Architecture","category":"backend","severity":"critical","description":"Mandates zero-copy chunk framing and dynamic QUIC flow control orchestration across Hyper 1.0 and HTTP/3 streaming pipelines. Eliminates socket buffer amplification, stream starvation, and head-of-line blocking by propagating transport-level backpressure directly into frame encoders without intermediate vector allocations.","antiPatternHeadline":"Naive Vector Buffering and Unbounded Stream Spooling Leading to Bufferbloat and Out-of-Memory Cascade During QUIC Congestion","stars_count":58,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","hyper","http3","quic","zero-copy","flow-control"],"exportEndpoints":{"claude":"/api/rules/hyper-v1-h3-zero-copy-dynamic-flow-control?format=claude","cursorMdc":"/api/rules/hyper-v1-h3-zero-copy-dynamic-flow-control?format=mdc","cursorrules":"/api/rules/hyper-v1-h3-zero-copy-dynamic-flow-control?format=cursor","windsurf":"/api/rules/hyper-v1-h3-zero-copy-dynamic-flow-control?format=windsurf","agents":"/api/rules/hyper-v1-h3-zero-copy-dynamic-flow-control?format=agents"}},{"id":"cmp-skiko-render-target-sync-guardrail","title":"Compose Multiplatform Skiko Render Target Sync & GPU Context Invalidation","category":"mobile","severity":"critical","description":"Enforces strict synchronization between platform surface lifecycle events and Skiko GPU render loops across Desktop (JVM) and iOS (Metal) targets. Prevents native driver deadlocks, memory corruption, and EXC_BAD_ACCESS crashes caused by resizing or destroying backing surfaces while Skia DirectContext operations or CAMetalDrawables remain in flight.","antiPatternHeadline":"Unsynchronized Platform Surface Destruction and Asynchronous GPU Render Loop Dispatch","stars_count":77,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","compose-multiplatform","skiko","metal","gpu-concurrency","rendering-pipeline"],"exportEndpoints":{"claude":"/api/rules/cmp-skiko-render-target-sync-guardrail?format=claude","cursorMdc":"/api/rules/cmp-skiko-render-target-sync-guardrail?format=mdc","cursorrules":"/api/rules/cmp-skiko-render-target-sync-guardrail?format=cursor","windsurf":"/api/rules/cmp-skiko-render-target-sync-guardrail?format=windsurf","agents":"/api/rules/cmp-skiko-render-target-sync-guardrail?format=agents"}},{"id":"react-native-bridgeless-jsi-memory-pinning","title":"Bridgeless JSI TurboModule Memory Pinning & Hermes HostObject Lifecycle Invariant","category":"mobile","severity":"critical","description":"Enforces strict memory pinning and explicit lifecycle management when interfacing Hermes JavaScript runtime with C++ JSI TurboModules under React Native Bridgeless Architecture. Prevents use-after-free, dangling HostObject pointer access, and buffer reallocation crashes caused by asynchronous JS garbage collection during native zero-copy operations.","antiPatternHeadline":"Retaining Raw C++ Pointers to Hermes Managed Memory Across Asynchronous JSI Callbacks Without Explicit Pinning","stars_count":67,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","react-native","jsi","hermes","turbomodules","memory-management","bridgeless"],"exportEndpoints":{"claude":"/api/rules/react-native-bridgeless-jsi-memory-pinning?format=claude","cursorMdc":"/api/rules/react-native-bridgeless-jsi-memory-pinning?format=mdc","cursorrules":"/api/rules/react-native-bridgeless-jsi-memory-pinning?format=cursor","windsurf":"/api/rules/react-native-bridgeless-jsi-memory-pinning?format=windsurf","agents":"/api/rules/react-native-bridgeless-jsi-memory-pinning?format=agents"}},{"id":"spiffe-spire-ebpf-lsm-socket-attestation","title":"Kernel-Enforced SPIFFE Dynamic Attestation via Linux eBPF LSM Hooks","category":"security","severity":"critical","description":"Enforces non-bypassable workload identity verification at the Linux kernel boundary using eBPF LSM hooks prior to socket establishment. Prohibits static secret persistence, environmental tokens, and post-connect user-space authentication by cryptographically binding ephemeral SPIFFE IDs to task credentials and cgroups in kernel memory.","antiPatternHeadline":"Persisting Static Bootstrap Secrets or Deferring Workload Attestation to User-Space Application Handshakes","stars_count":110,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","spiffe","spire","ebpf","lsm","zero-trust","kernel-security"],"exportEndpoints":{"claude":"/api/rules/spiffe-spire-ebpf-lsm-socket-attestation?format=claude","cursorMdc":"/api/rules/spiffe-spire-ebpf-lsm-socket-attestation?format=mdc","cursorrules":"/api/rules/spiffe-spire-ebpf-lsm-socket-attestation?format=cursor","windsurf":"/api/rules/spiffe-spire-ebpf-lsm-socket-attestation?format=windsurf","agents":"/api/rules/spiffe-spire-ebpf-lsm-socket-attestation?format=agents"}},{"id":"webauthn-l3-dynamic-backup-state-verification","title":"WebAuthn Level 3 Dynamic Credential Backup State & Transport Flag Verification","category":"security","severity":"critical","description":"Enforces strict server-side cryptographic verification of authenticator data flags (BE/BS) and transport hints during registration and authentication ceremonies according to W3C WebAuthn Level 3. Prevents multi-device credential synchronization spoofing and ensures accurate auditing of multi-device (synced) versus single-device (hardware-bound) passkeys.","antiPatternHeadline":"Trusting client-reported credential properties or ignoring Backup Eligibility (BE) and Backup State (BS) flags during authenticatorData verification","stars_count":46,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","passkeys","cryptography","fido2","authentication"],"exportEndpoints":{"claude":"/api/rules/webauthn-l3-dynamic-backup-state-verification?format=claude","cursorMdc":"/api/rules/webauthn-l3-dynamic-backup-state-verification?format=mdc","cursorrules":"/api/rules/webauthn-l3-dynamic-backup-state-verification?format=cursor","windsurf":"/api/rules/webauthn-l3-dynamic-backup-state-verification?format=windsurf","agents":"/api/rules/webauthn-l3-dynamic-backup-state-verification?format=agents"}},{"id":"otel-in-process-exemplar-budgeting-guardrail","title":"OpenTelemetry In-Process Trace-to-Metric Exemplar Reservoir and Memory Budget Guardrail","category":"devops","severity":"critical","description":"Enforces strict memory budgeting and bucket-bound exemplar sampling for OpenTelemetry metric instruments to eliminate TSDB cardinality explosions and in-process heap exhaustion. Mandates deterministic ExemplarReservoir allocation, explicit bucket boundaries, and strict exemplar attribute pruning under high concurrency. Prevents unbounded retention of context references, high-cardinality span baggage, and runaway exemplar buffers in metric readers.","antiPatternHeadline":"Unbounded Exemplar Sampling with Full Attribute Propagation Causing TSDB Saturation and OOM","stars_count":84,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","metrics","tracing","exemplars","cardinality","sre"],"exportEndpoints":{"claude":"/api/rules/otel-in-process-exemplar-budgeting-guardrail?format=claude","cursorMdc":"/api/rules/otel-in-process-exemplar-budgeting-guardrail?format=mdc","cursorrules":"/api/rules/otel-in-process-exemplar-budgeting-guardrail?format=cursor","windsurf":"/api/rules/otel-in-process-exemplar-budgeting-guardrail?format=windsurf","agents":"/api/rules/otel-in-process-exemplar-budgeting-guardrail?format=agents"}},{"id":"react-19-metadata-asset-preloading-standard","title":"React 19 Native Metadata Hoisting and Asset Preloading Standard","category":"frontend","severity":"critical","description":"Mandates declarative document metadata (<title>, <meta>, <link>) with explicit precedence attributes and programmatic react-dom preloading APIs (preload, preinit). Eliminates client-side DOM head mutations, prevents asset waterfalls during React Server Component (RSC) streaming, and guarantees deduplicated, zero-FOUC resource loading.","antiPatternHeadline":"Mutating document.head in client effects, omitting precedence on stylesheets, or relying on legacy external head managers causing FOUC and network waterfalls.","stars_count":56,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["react-19","frontend","asset-preloading","metadata-hoisting","rsc","web-vitals"],"exportEndpoints":{"claude":"/api/rules/react-19-metadata-asset-preloading-standard?format=claude","cursorMdc":"/api/rules/react-19-metadata-asset-preloading-standard?format=mdc","cursorrules":"/api/rules/react-19-metadata-asset-preloading-standard?format=cursor","windsurf":"/api/rules/react-19-metadata-asset-preloading-standard?format=windsurf","agents":"/api/rules/react-19-metadata-asset-preloading-standard?format=agents"}},{"id":"pg17-logical-replication-failover-slot-sync-postgresql-17-lo-496","title":"PostgreSQL 17 Logical Replication Failover Slot Synchronization Standard","category":"backend","severity":"critical","description":"Enforces strict failover slot synchronization and standby confirmation protocol introduced in PostgreSQL 17 for zero-data-loss CDC architectures. Mandates synchronized slots on physical standbys and synchronized subscription failovers to prevent duplicate downstream ingestion and uncoordinated LSN rewind during primary node failover events.","antiPatternHeadline":"Unsynchronized Logical Slots and Uncoordinated Standby Promotion Causing CDC Replay and Downstream Poisoning","stars_count":115,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","postgres-17","cdc","logical-replication","wal","data-infrastructure"],"exportEndpoints":{"claude":"/api/rules/pg17-logical-replication-failover-slot-sync-postgresql-17-lo-496?format=claude","cursorMdc":"/api/rules/pg17-logical-replication-failover-slot-sync-postgresql-17-lo-496?format=mdc","cursorrules":"/api/rules/pg17-logical-replication-failover-slot-sync-postgresql-17-lo-496?format=cursor","windsurf":"/api/rules/pg17-logical-replication-failover-slot-sync-postgresql-17-lo-496?format=windsurf","agents":"/api/rules/pg17-logical-replication-failover-slot-sync-postgresql-17-lo-496?format=agents"}},{"id":"go-chi-context-cancellation-io-timeout-standard","title":"Go Chi Structured Context Cancellation and Downstream IO Deadline Standard","category":"backend","severity":"critical","description":"Enforces deterministic lifecycle binding between inbound HTTP requests in Go Chi routers and all downstream database, RPC, and goroutine operations. Prevents resource exhaustion, connection pool starvation, and runaway zombie computations by ensuring that client disconnections and middleware deadlines strictly propagate through request contexts.","antiPatternHeadline":"Orphaned Execution via context.Background() and Unchecked HTTP Disconnection","stars_count":46,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","chi","context","goroutines","io-timeout"],"exportEndpoints":{"claude":"/api/rules/go-chi-context-cancellation-io-timeout-standard?format=claude","cursorMdc":"/api/rules/go-chi-context-cancellation-io-timeout-standard?format=mdc","cursorrules":"/api/rules/go-chi-context-cancellation-io-timeout-standard?format=cursor","windsurf":"/api/rules/go-chi-context-cancellation-io-timeout-standard?format=windsurf","agents":"/api/rules/go-chi-context-cancellation-io-timeout-standard?format=agents"}},{"id":"tauri-v2-mobile-ipc-capability-sandboxing-standard","title":"Tauri 2.0 Mobile IPC Capability Sandboxing and Scoped Access Invariant","category":"mobile","severity":"critical","description":"Enforces compile-time granular permission capabilities and runtime parameter validation for Tauri 2.0 mobile webview-to-native IPC. Eliminates arbitrary command execution and privilege escalation on iOS and Android targets by prohibiting wildcard permissions, unconstrained shell execution, and global plugin access.","antiPatternHeadline":"Unsandboxed Tauri 2.0 IPC exposing unrestricted native plugins and shell execution across mobile webviews","stars_count":112,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri","rust","security","ipc","sandboxing"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-mobile-ipc-capability-sandboxing-standard?format=claude","cursorMdc":"/api/rules/tauri-v2-mobile-ipc-capability-sandboxing-standard?format=mdc","cursorrules":"/api/rules/tauri-v2-mobile-ipc-capability-sandboxing-standard?format=cursor","windsurf":"/api/rules/tauri-v2-mobile-ipc-capability-sandboxing-standard?format=windsurf","agents":"/api/rules/tauri-v2-mobile-ipc-capability-sandboxing-standard?format=agents"}},{"id":"webauthn-rp-origin-binding-attestation-standard","title":"WebAuthn Relying Party Origin Binding and Cryptographic Client Data Verification","category":"security","severity":"critical","description":"Enforces strict canonical origin binding, relying party identifier (rpId) validation, and clientDataJSON cryptographic integrity checks during WebAuthn registration and authentication ceremonies. Neutralizes cross-subdomain passkey relays, TLS terminating proxy injection, challenge replays, and man-in-the-middle phishing vectors.","antiPatternHeadline":"Permissive Subdomain Matching, Regex Origin Verification, or Unchecked clientDataJSON Hashes in WebAuthn Ceremonies","stars_count":88,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","fido2","passkeys","cryptography","authentication"],"exportEndpoints":{"claude":"/api/rules/webauthn-rp-origin-binding-attestation-standard?format=claude","cursorMdc":"/api/rules/webauthn-rp-origin-binding-attestation-standard?format=mdc","cursorrules":"/api/rules/webauthn-rp-origin-binding-attestation-standard?format=cursor","windsurf":"/api/rules/webauthn-rp-origin-binding-attestation-standard?format=windsurf","agents":"/api/rules/webauthn-rp-origin-binding-attestation-standard?format=agents"}},{"id":"openfga-distributed-consistency-guardrail","title":"OpenFGA Distributed Tuple Evaluation & Consistency Guardrail","category":"security","severity":"critical","description":"Enforces deterministic consistency levels and bounded staleness thresholds during OpenFGA relationship tuple evaluations across distributed microservices. Prevents authorization bypasses and New Enemy race conditions caused by replication lag between OpenFGA datastore replicas during privilege revocation and critical mutation flows.","antiPatternHeadline":"Defaulting to MINIMIZE_LATENCY for Authorization Checks Following Mutations or Revocations","stars_count":49,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","authorization","distributed-systems","consistency","rebac"],"exportEndpoints":{"claude":"/api/rules/openfga-distributed-consistency-guardrail?format=claude","cursorMdc":"/api/rules/openfga-distributed-consistency-guardrail?format=mdc","cursorrules":"/api/rules/openfga-distributed-consistency-guardrail?format=cursor","windsurf":"/api/rules/openfga-distributed-consistency-guardrail?format=windsurf","agents":"/api/rules/openfga-distributed-consistency-guardrail?format=agents"}},{"id":"cilium-ebpf-mutual-auth-l7-policy-standard","title":"Cilium eBPF Mutual Authentication & L7 Socket-Layer Policy Standard","category":"devops","severity":"critical","description":"Mandates sidecarless kernel-level L7 ingress/egress filtering and decoupled wire-speed mutual authentication using Cilium eBPF socket programs (sockops) and SPIFFE/SPIRE identities. Eliminates user-space sidecar serialization penalties while guaranteeing cryptographic identity attestation (authentication.mode: required) before data packets traverse node sockets. Prevents unauthenticated plaintext bypass, TCP stack overhead, and cross-tenant namespace spoofing.","antiPatternHeadline":"Deploying Legacy Per-Pod Proxy Sidecars or Applying L7 CiliumNetworkPolicies Without Cryptographic Mutual Auth Handshakes","stars_count":108,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","cilium","ebpf","mtls","kubernetes","spiffe","security"],"exportEndpoints":{"claude":"/api/rules/cilium-ebpf-mutual-auth-l7-policy-standard?format=claude","cursorMdc":"/api/rules/cilium-ebpf-mutual-auth-l7-policy-standard?format=mdc","cursorrules":"/api/rules/cilium-ebpf-mutual-auth-l7-policy-standard?format=cursor","windsurf":"/api/rules/cilium-ebpf-mutual-auth-l7-policy-standard?format=windsurf","agents":"/api/rules/cilium-ebpf-mutual-auth-l7-policy-standard?format=agents"}},{"id":"envoy-gateway-multicluster-routing-topology-guardrail","title":"Envoy Gateway 1.2 Multi-Cluster Traffic Routing and Canary Failover Invariant","category":"devops","severity":"critical","description":"Standardizes dynamic multi-cluster route tables, weighted canary deployments, and zero-downtime failover topologies across heterogeneous Kubernetes clusters using Envoy Gateway 1.2 and Kubernetes Gateway API (v1). Enforces strict separation between HTTPRoute backend references, EnvoyPatchPolicy extensions, and active health check thresholds to prevent cascading cross-cluster blackholes.","antiPatternHeadline":"Unvalidated BackendRef Cross-Cluster Direct Coupling and Missing Active Failover Healthchecks","stars_count":91,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","envoy-gateway","gateway-api","kubernetes","multi-cluster","traffic-management"],"exportEndpoints":{"claude":"/api/rules/envoy-gateway-multicluster-routing-topology-guardrail?format=claude","cursorMdc":"/api/rules/envoy-gateway-multicluster-routing-topology-guardrail?format=mdc","cursorrules":"/api/rules/envoy-gateway-multicluster-routing-topology-guardrail?format=cursor","windsurf":"/api/rules/envoy-gateway-multicluster-routing-topology-guardrail?format=windsurf","agents":"/api/rules/envoy-gateway-multicluster-routing-topology-guardrail?format=agents"}},{"id":"svelte-5-runes-module-state-ssr-isolation","title":"Svelte 5 Runes Module-State Boundary Isolation & Cross-Request SSR Leak Prevention","category":"frontend","severity":"critical","description":"Enforces strict lifecycle boundaries around Svelte 5 module-scoped runes ($state, $derived) in universal and SSR applications. Module-level reactive declarations persist across multiple server requests within shared Node/serverless runtimes, precipitating catastrophic cross-tenant data contamination and unbounded memory exhaustion. All mutable reactive state within SSR-traversed code paths must be strictly scoped to component trees via Context API, request locals, or lifecycle-bound factory instantiations.","antiPatternHeadline":"Shared Module-Scope $state() in Universal Modules Inducing Cross-User Session Leakage","stars_count":57,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","ssr","memory-leaks","security","state-management"],"exportEndpoints":{"claude":"/api/rules/svelte-5-runes-module-state-ssr-isolation?format=claude","cursorMdc":"/api/rules/svelte-5-runes-module-state-ssr-isolation?format=mdc","cursorrules":"/api/rules/svelte-5-runes-module-state-ssr-isolation?format=cursor","windsurf":"/api/rules/svelte-5-runes-module-state-ssr-isolation?format=windsurf","agents":"/api/rules/svelte-5-runes-module-state-ssr-isolation?format=agents"}},{"id":"react-19-server-actions-cryptographic-argument-verification","title":"React 19 Server Actions Cryptographic Argument Verification & Boundary Invariants","category":"frontend","severity":"critical","description":"Enforces strict cryptographic verification, authoritative session extraction, and schema parsing for all bound closure arguments and payload parameters across React 19 Server Action boundaries. Prevents Insecure Direct Object References (IDOR), boundary parameter tampering, and privileged action escalation in client-server RPC pipelines.","antiPatternHeadline":"Implicit Trust in Bound Server Action Arguments and Unsigned Client-Transited Closure State","stars_count":95,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","server-actions","cryptography","nextjs","authorization","security"],"exportEndpoints":{"claude":"/api/rules/react-19-server-actions-cryptographic-argument-verification?format=claude","cursorMdc":"/api/rules/react-19-server-actions-cryptographic-argument-verification?format=mdc","cursorrules":"/api/rules/react-19-server-actions-cryptographic-argument-verification?format=cursor","windsurf":"/api/rules/react-19-server-actions-cryptographic-argument-verification?format=windsurf","agents":"/api/rules/react-19-server-actions-cryptographic-argument-verification?format=agents"}},{"id":"fastapi-python313-free-threaded-concurrency","title":"FastAPI Python 3.13 Free-Threaded (PEP 703) Thread-Safe State Mutations","category":"backend","severity":"critical","description":"Enforces strict synchronization and memory safety when running FastAPI under Python 3.13t free-threaded mode (GIL disabled). Eliminates implicit reliance on the Global Interpreter Lock for atomic mutations across shared in-memory caches, singletons, app.state, and unverified C-extensions executing on multicore thread pools.","antiPatternHeadline":"Unsynchronized Global/Module State Mutations and Non-Thread-Safe C-Extension Execution Under Disabled GIL","stars_count":108,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","python313","free-threaded","concurrency","pep703","thread-safety"],"exportEndpoints":{"claude":"/api/rules/fastapi-python313-free-threaded-concurrency?format=claude","cursorMdc":"/api/rules/fastapi-python313-free-threaded-concurrency?format=mdc","cursorrules":"/api/rules/fastapi-python313-free-threaded-concurrency?format=cursor","windsurf":"/api/rules/fastapi-python313-free-threaded-concurrency?format=windsurf","agents":"/api/rules/fastapi-python313-free-threaded-concurrency?format=agents"}},{"id":"go-chi-otel-goroutine-context-propagation","title":"Deterministic OpenTelemetry Context Propagation Across Goroutines in Go Chi","category":"backend","severity":"critical","description":"Enforces strict context propagation across asynchronous goroutine boundaries within Go Chi HTTP services. Passing the raw request context directly to fire-and-forget goroutines causes context cancellation upon HTTP handler return, while spinning up goroutines with context.Background() severs trace lineages and drops baggage. Engineers must explicitly detach cancellation while propagating trace and baggage metadata, or derive child contexts from context.WithoutCancel.","antiPatternHeadline":"Spawning Asynchronous Goroutines with Direct HTTP Request Context or Blank context.Background()","stars_count":57,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","opentelemetry","chi","concurrency","tracing"],"exportEndpoints":{"claude":"/api/rules/go-chi-otel-goroutine-context-propagation?format=claude","cursorMdc":"/api/rules/go-chi-otel-goroutine-context-propagation?format=mdc","cursorrules":"/api/rules/go-chi-otel-goroutine-context-propagation?format=cursor","windsurf":"/api/rules/go-chi-otel-goroutine-context-propagation?format=windsurf","agents":"/api/rules/go-chi-otel-goroutine-context-propagation?format=agents"}},{"id":"pg17-cdc-failover-slot-sync-production-standard","title":"PostgreSQL 17 Logical Replication Failover Slot Synchronization for Zero-Data-Loss CDC","category":"backend","severity":"critical","description":"Enforces PostgreSQL 17 native failover-enabled logical replication slots (`failover = true`) and primary standby synchronization (`synchronized_standby_slots`). This guarantees logical replication slots persist across HA failovers, preventing CDC stream destruction, missing change events, and catastrophic rewind loops.","antiPatternHeadline":"Provisioning Unsynced Logical Replication Slots That Disappear or Desynchronize During HA Failover","stars_count":90,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql-17","cdc","logical-replication","high-availability","data-pipelines"],"exportEndpoints":{"claude":"/api/rules/pg17-cdc-failover-slot-sync-production-standard?format=claude","cursorMdc":"/api/rules/pg17-cdc-failover-slot-sync-production-standard?format=mdc","cursorrules":"/api/rules/pg17-cdc-failover-slot-sync-production-standard?format=cursor","windsurf":"/api/rules/pg17-cdc-failover-slot-sync-production-standard?format=windsurf","agents":"/api/rules/pg17-cdc-failover-slot-sync-production-standard?format=agents"}},{"id":"capacitor7-predictive-back-window-insets-sync","title":"Capacitor 7 Predictive Back & Android 15 Window Insets Synchronization","category":"mobile","severity":"critical","description":"Enforces edge-to-edge layout compliance and predictive back gesture synchronization under Capacitor 7 and Android 15 (API 35). Prevents viewport clipping behind system bars, touch event coordinate offsets, and abrupt app terminations by unifying native WindowInsetsCompat with CSS safe-area variables and client-side router navigation stacks.","antiPatternHeadline":"Hardcoded Viewport Offsets and Uncoordinated Native-to-Web Navigation Stacks Causing UI Clipping and Gesture Collisions","stars_count":70,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","android15","predictive-back","window-insets","safe-area","edge-to-edge"],"exportEndpoints":{"claude":"/api/rules/capacitor7-predictive-back-window-insets-sync?format=claude","cursorMdc":"/api/rules/capacitor7-predictive-back-window-insets-sync?format=mdc","cursorrules":"/api/rules/capacitor7-predictive-back-window-insets-sync?format=cursor","windsurf":"/api/rules/capacitor7-predictive-back-window-insets-sync?format=windsurf","agents":"/api/rules/capacitor7-predictive-back-window-insets-sync?format=agents"}},{"id":"passkey-conditional-mediation-step-up-invariants","title":"Passkey Conditional Mediation Step-Up Re-Authentication & Concurrency Invariants","category":"security","severity":"critical","description":"Standardizes step-up re-authentication flows alongside WebAuthn conditional mediation (autofill). Enforces deterministic AbortController orchestration, mutex-locking on navigator.credentials.get, and strict server-side userVerification: 'required' assertions to eliminate NotAllowedError UI deadlocks, concurrent credential collisions, and privilege escalation.","antiPatternHeadline":"Spawning modal WebAuthn step-up assertions without aborting background conditional mediation or failing to enforce server-side user verification flags.","stars_count":48,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","passkeys","authentication","concurrency","fido2"],"exportEndpoints":{"claude":"/api/rules/passkey-conditional-mediation-step-up-invariants?format=claude","cursorMdc":"/api/rules/passkey-conditional-mediation-step-up-invariants?format=mdc","cursorrules":"/api/rules/passkey-conditional-mediation-step-up-invariants?format=cursor","windsurf":"/api/rules/passkey-conditional-mediation-step-up-invariants?format=windsurf","agents":"/api/rules/passkey-conditional-mediation-step-up-invariants?format=agents"}},{"id":"rfc8693-cedar-token-exchange-delegation","title":"RFC 8693 OAuth 2.0 Token Exchange with Cedar Policy-Based Delegation Guardrail","category":"security","severity":"critical","description":"Enforces zero-trust cryptographic chain-of-custody and deterministic least-privilege scoping across multi-hop microservice delegation flows using RFC 8693 Token Exchange. Intermediary services must evaluate explicit Cedar policy delegation constraints before generating down-scoped downstream tokens, preventing token forwarding and privilege escalation attacks.","antiPatternHeadline":"Unvalidated Bearer Token Forwarding and Scope Creep Across Multi-Hop Service Calls","stars_count":106,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","oauth2","rfc8693","cedar-policy","zero-trust","token-exchange"],"exportEndpoints":{"claude":"/api/rules/rfc8693-cedar-token-exchange-delegation?format=claude","cursorMdc":"/api/rules/rfc8693-cedar-token-exchange-delegation?format=mdc","cursorrules":"/api/rules/rfc8693-cedar-token-exchange-delegation?format=cursor","windsurf":"/api/rules/rfc8693-cedar-token-exchange-delegation?format=windsurf","agents":"/api/rules/rfc8693-cedar-token-exchange-delegation?format=agents"}},{"id":"otel-ebpf-profiling-collector-invariants","title":"OTel eBPF Profiler Host-Protection and Resource Guardrails","category":"devops","severity":"critical","description":"Enforces deterministic host stability constraints for OpenTelemetry continuous profiling eBPF collectors deployed across high-density multi-tenant compute nodes. Guarantees CPU unwind sampling frequency ceilings (<=19Hz), off-host symbolization offloading, and kernel BPF ringbuffer drop policies to bound telemetry overhead below 1% CPU and 200MB memory. Prevents host kernel lockups, slab memory exhaustion, and CPU throttling under high container density.","antiPatternHeadline":"Unbounded Sampling Frequencies, On-Host DWARF Parsing, and Blocking BPF Ringbuffers Causing Host Memory Exhaustion","stars_count":115,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","opentelemetry","continuous-profiling","kubernetes","linux-kernel"],"exportEndpoints":{"claude":"/api/rules/otel-ebpf-profiling-collector-invariants?format=claude","cursorMdc":"/api/rules/otel-ebpf-profiling-collector-invariants?format=mdc","cursorrules":"/api/rules/otel-ebpf-profiling-collector-invariants?format=cursor","windsurf":"/api/rules/otel-ebpf-profiling-collector-invariants?format=windsurf","agents":"/api/rules/otel-ebpf-profiling-collector-invariants?format=agents"}},{"id":"bun-vfs-sandbox-host-filesystem-containment","title":"Bun 1.2 Standalone Executable VFS Sandbox & Path Containment Standard","category":"devops","severity":"critical","description":"Enforces strict virtual filesystem (VFS) boundary validation and path containment for Bun 1.2 standalone compiled binaries (`bun build --compile`). Prevents arbitrary host filesystem escalation and directory traversal when untrusted payloads access assets or scratch paths in compiled edge workers.","antiPatternHeadline":"Unconfined Path Traversal Escaping Bun Embedded VFS to Read or Write Host Files","stars_count":52,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["bun","devops","security","sandbox","vfs","edge-workers"],"exportEndpoints":{"claude":"/api/rules/bun-vfs-sandbox-host-filesystem-containment?format=claude","cursorMdc":"/api/rules/bun-vfs-sandbox-host-filesystem-containment?format=mdc","cursorrules":"/api/rules/bun-vfs-sandbox-host-filesystem-containment?format=cursor","windsurf":"/api/rules/bun-vfs-sandbox-host-filesystem-containment?format=windsurf","agents":"/api/rules/bun-vfs-sandbox-host-filesystem-containment?format=agents"}},{"id":"react-19-server-actions-idempotency-invariants","title":"React 19 Server Actions & useActionState Idempotency and State Reconciliation Guardrail","category":"frontend","severity":"critical","description":"Enforces strict mutation idempotency, cryptographically validated client transaction tokens, and deterministic state reconciliation across React 19 useActionState and useOptimistic boundaries. Prevents duplicate state mutations, replay attacks, and inconsistent optimistic rollbacks during transient network failures and rapid concurrent form dispatches in full-stack SSR environments.","antiPatternHeadline":"Non-Idempotent Server Action Invocations and Unbounded Optimistic UI Desynchronization","stars_count":60,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","server-actions","use-action-state","idempotency","optimistic-ui","nextjs"],"exportEndpoints":{"claude":"/api/rules/react-19-server-actions-idempotency-invariants?format=claude","cursorMdc":"/api/rules/react-19-server-actions-idempotency-invariants?format=mdc","cursorrules":"/api/rules/react-19-server-actions-idempotency-invariants?format=cursor","windsurf":"/api/rules/react-19-server-actions-idempotency-invariants?format=windsurf","agents":"/api/rules/react-19-server-actions-idempotency-invariants?format=agents"}},{"id":"svelte-5-runes-effect-lifecycle-isolation","title":"Svelte 5 Runes $effect Lifecycle and Memory Isolation Standards","category":"frontend","severity":"critical","description":"Enforces strict boundary constraints and deterministic microtask execution for Svelte 5 $effect, $effect.pre, and $effect.root runes. Eliminates cyclic signal cascading, unmanaged listener memory leaks, and improper synchronization across fine-grained universal reactivity trees. Mandates explicit untracking of non-dependent state reads and strict teardown semantics.","antiPatternHeadline":"Cyclic Signal Updates and Leaked Subscriptions via Implicitly Tracked Side-Effects in Svelte 5 Runes","stars_count":99,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","signals","reactivity","memory-management"],"exportEndpoints":{"claude":"/api/rules/svelte-5-runes-effect-lifecycle-isolation?format=claude","cursorMdc":"/api/rules/svelte-5-runes-effect-lifecycle-isolation?format=mdc","cursorrules":"/api/rules/svelte-5-runes-effect-lifecycle-isolation?format=cursor","windsurf":"/api/rules/svelte-5-runes-effect-lifecycle-isolation?format=windsurf","agents":"/api/rules/svelte-5-runes-effect-lifecycle-isolation?format=agents"}},{"id":"axum-0-8-tokio-cancellation-safe-handler-standard","title":"Axum 0.8 Tokio Cancellation-Safe Async Handler Standard","category":"backend","severity":"critical","description":"Enforces strict cancellation-safety invariants across Axum 0.8 HTTP handlers and Tokio async operations. Prevents orphan DB states, partial buffer flushes, and socket pool exhaustion when client connections terminate early or tokio::select! branches drop incomplete futures. Requires critical business mutations and database transactions to run within detached supervisor tasks or atomic linear sequences insulated from client transport lifecycle.","antiPatternHeadline":"Running Non-Cancellation-Safe Database and External Mutations Directly in Client-Bound Tokio Futures","stars_count":48,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tokio","async","concurrency"],"exportEndpoints":{"claude":"/api/rules/axum-0-8-tokio-cancellation-safe-handler-standard?format=claude","cursorMdc":"/api/rules/axum-0-8-tokio-cancellation-safe-handler-standard?format=mdc","cursorrules":"/api/rules/axum-0-8-tokio-cancellation-safe-handler-standard?format=cursor","windsurf":"/api/rules/axum-0-8-tokio-cancellation-safe-handler-standard?format=windsurf","agents":"/api/rules/axum-0-8-tokio-cancellation-safe-handler-standard?format=agents"}},{"id":"pg17-logical-replication-failover-slot-sync-postgresql-17-lo-730","title":"PostgreSQL 17 Logical Replication Failover Slot Synchronization Invariants","category":"backend","severity":"critical","description":"Enforces deterministic configuration and client-side failover guards for PostgreSQL 17 synchronized logical replication slots. Prevents silent data stream dropouts, unbounded WAL accumulation, and duplicate event ingestion during physical standby promotion across multi-region HA clusters. Mandates failover-enabled slot creation, primary synchronized_standby_slots gating, and strict post-promotion LSN boundary reconciliation.","antiPatternHeadline":"Unsynchronized Logical Slot Provisioning and Blind Consumer Reconnection During Physical Standby Promotion","stars_count":99,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql-17","logical-replication","high-availability","database","event-streaming"],"exportEndpoints":{"claude":"/api/rules/pg17-logical-replication-failover-slot-sync-postgresql-17-lo-730?format=claude","cursorMdc":"/api/rules/pg17-logical-replication-failover-slot-sync-postgresql-17-lo-730?format=mdc","cursorrules":"/api/rules/pg17-logical-replication-failover-slot-sync-postgresql-17-lo-730?format=cursor","windsurf":"/api/rules/pg17-logical-replication-failover-slot-sync-postgresql-17-lo-730?format=windsurf","agents":"/api/rules/pg17-logical-replication-failover-slot-sync-postgresql-17-lo-730?format=agents"}},{"id":"bun-websocket-hibernation-backpressure-drainage-policy","title":"Bun 1.2 Native WebSocket Hibernation & Backpressure Drainage Policy","category":"backend","severity":"critical","description":"Enforces Bun 1.2 native WebSocket server invariants by delegating idle connection state to the native C++ event loop via WebSocket Hibernation and strictly handling TCP backpressure during packet transmission. Prevents V8 heap exhaustion and silent message dropping under high-concurrency loads (100k+ concurrent connections) by forbidding JavaScript closure retention on socket instances and requiring drain-driven writes.","antiPatternHeadline":"Retaining JavaScript WebSocket References in Userland State and Ignoring ws.send() Backpressure Return Codes","stars_count":101,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","websockets","concurrency","performance","memory-management"],"exportEndpoints":{"claude":"/api/rules/bun-websocket-hibernation-backpressure-drainage-policy?format=claude","cursorMdc":"/api/rules/bun-websocket-hibernation-backpressure-drainage-policy?format=mdc","cursorrules":"/api/rules/bun-websocket-hibernation-backpressure-drainage-policy?format=cursor","windsurf":"/api/rules/bun-websocket-hibernation-backpressure-drainage-policy?format=windsurf","agents":"/api/rules/bun-websocket-hibernation-backpressure-drainage-policy?format=agents"}},{"id":"openfga-rebac-consistency-invalidation-invariants","title":"OpenFGA ReBAC Consistency, Contextual Tuples, and Invalidation Invariants","category":"security","severity":"critical","description":"Enforces strict read-after-write consistency, contextual tuple delegation, and change-driven invalidation across OpenFGA Relationship-Based Access Control (ReBAC) implementations. Prevents the Zanzibar 'New Enemy' vulnerability and eliminates cascading graph expansion latencies across multi-tenant microservices.","antiPatternHeadline":"Stale ReBAC Evaluation via Uncoordinated Eventual Consistency and Unbounded Graph Expansion","stars_count":57,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","rebac","authorization","distributed-systems","caching"],"exportEndpoints":{"claude":"/api/rules/openfga-rebac-consistency-invalidation-invariants?format=claude","cursorMdc":"/api/rules/openfga-rebac-consistency-invalidation-invariants?format=mdc","cursorrules":"/api/rules/openfga-rebac-consistency-invalidation-invariants?format=cursor","windsurf":"/api/rules/openfga-rebac-consistency-invalidation-invariants?format=windsurf","agents":"/api/rules/openfga-rebac-consistency-invalidation-invariants?format=agents"}},{"id":"webauthn-conditional-ui-step-up-guardrail","title":"Synchronized WebAuthn Conditional UI Mediation and Hardware Step-Up Enforcement","category":"security","severity":"critical","description":"Enforces deterministic lifecycle management between asynchronous WebAuthn Conditional UI autofill mediation and modal step-up re-authentication. Requires explicit AbortController teardown of active conditional mediation requests prior to initiating modal assertions, guarantees cryptographic origin and userVerification='required' validation, and neutralizes DOM race conditions during high-risk transactional workflows.","antiPatternHeadline":"Overlapping Unaborted Conditional Passkey Requests and Downgraded User Verification During High-Risk Step-Up","stars_count":53,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","passkeys","fido2","authentication","conditional-ui"],"exportEndpoints":{"claude":"/api/rules/webauthn-conditional-ui-step-up-guardrail?format=claude","cursorMdc":"/api/rules/webauthn-conditional-ui-step-up-guardrail?format=mdc","cursorrules":"/api/rules/webauthn-conditional-ui-step-up-guardrail?format=cursor","windsurf":"/api/rules/webauthn-conditional-ui-step-up-guardrail?format=windsurf","agents":"/api/rules/webauthn-conditional-ui-step-up-guardrail?format=agents"}},{"id":"opentelemetry-baggage-propagation-pii-redaction-pipeline","title":"OpenTelemetry W3C Baggage Propagation & Zero-Leak In-Flight PII Redaction Pipeline","category":"devops","severity":"critical","description":"Standardizes zero-overhead distributed trace correlation across heterogeneous runtimes while guaranteeing deterministic sanitization of high-cardinality telemetry data. Enforces strict boundary validation on W3C Baggage headers and mandates streaming span/log processor redaction to prevent accidental exfiltration of PII and credentials into downstream APM and observability backends.","antiPatternHeadline":"Blind W3C Baggage Injection and Unsanitized Span Attribute Ingestion Causing PII Leakage and Metric Cardinality Explosion","stars_count":84,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","tracing","w3c-baggage","pii-sanitization","observability","distributed-tracing"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-baggage-propagation-pii-redaction-pipeline?format=claude","cursorMdc":"/api/rules/opentelemetry-baggage-propagation-pii-redaction-pipeline?format=mdc","cursorrules":"/api/rules/opentelemetry-baggage-propagation-pii-redaction-pipeline?format=cursor","windsurf":"/api/rules/opentelemetry-baggage-propagation-pii-redaction-pipeline?format=windsurf","agents":"/api/rules/opentelemetry-baggage-propagation-pii-redaction-pipeline?format=agents"}},{"id":"ebpf-sockops-ktls-l7-policy-guardrail","title":"Deterministic eBPF Socket-Level kTLS Policy Enforcement and Sockmap Redirection","category":"devops","severity":"critical","description":"Enforces in-kernel L7 mutual TLS termination and zero-trust packet arbitration via Linux socket operations (BPF_PROG_TYPE_SOCK_OPS) and socket message programs (BPF_PROG_TYPE_SK_MSG). Bypasses userspace sidecar proxies by splicing peer sockets into BPF sockmaps and delegating cryptographic handoffs to Kernel TLS (kTLS) with atomic tail-call policy pipelines.","antiPatternHeadline":"Punting Encrypted Wire Traffic to Userspace Sidecars or Operating on Pre-Decrypted L7 Buffers Without Kernel TLS Offload","stars_count":48,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","cilium","ktls","zero-trust","linux-kernel","networking"],"exportEndpoints":{"claude":"/api/rules/ebpf-sockops-ktls-l7-policy-guardrail?format=claude","cursorMdc":"/api/rules/ebpf-sockops-ktls-l7-policy-guardrail?format=mdc","cursorrules":"/api/rules/ebpf-sockops-ktls-l7-policy-guardrail?format=cursor","windsurf":"/api/rules/ebpf-sockops-ktls-l7-policy-guardrail?format=windsurf","agents":"/api/rules/ebpf-sockops-ktls-l7-policy-guardrail?format=agents"}},{"id":"tauri-v2-ipc-capability-scoping-isolation","title":"Tauri 2.0 Multi-Process IPC Capability Scoping & Dynamic Permission Isolation","category":"mobile","severity":"critical","description":"Enforces strict principle-of-least-privilege capability manifests in Tauri 2.0, binding native plugins and custom commands exclusively to explicit window identifiers and cryptographically verified origins. Prevents remote code execution and local sandbox escapes across desktop and mobile (iOS/Android) targets by eliminating wildcard permissions and un-scoped filesystem or shell execution bridges.","antiPatternHeadline":"Wildcard Capability Mapping and Un-Scoped System Bridge Exposure in Tauri 2.0","stars_count":46,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri","security","ipc","rust","permissions"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-ipc-capability-scoping-isolation?format=claude","cursorMdc":"/api/rules/tauri-v2-ipc-capability-scoping-isolation?format=mdc","cursorrules":"/api/rules/tauri-v2-ipc-capability-scoping-isolation?format=cursor","windsurf":"/api/rules/tauri-v2-ipc-capability-scoping-isolation?format=windsurf","agents":"/api/rules/tauri-v2-ipc-capability-scoping-isolation?format=agents"}},{"id":"react-19-server-actions-optimistic-reconciliation","title":"React 19 Server Actions & useOptimistic Multi-Flight Reconciliation Guardrail","category":"frontend","severity":"critical","description":"Enforces deterministic rollback boundaries, monotonic sequence tracking, and transition containment for React 19 useOptimistic integrated with Server Actions. Eliminates ghost state clobbering, race-conditioned rollbacks, and out-of-order state reconciliation during concurrent multi-flight mutations and network partitions.","antiPatternHeadline":"Unsequenced Multi-Flight Server Actions with Naked useOptimistic State Clobbering","stars_count":60,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","server-actions","use-optimistic","concurrency","state-reconciliation"],"exportEndpoints":{"claude":"/api/rules/react-19-server-actions-optimistic-reconciliation?format=claude","cursorMdc":"/api/rules/react-19-server-actions-optimistic-reconciliation?format=mdc","cursorrules":"/api/rules/react-19-server-actions-optimistic-reconciliation?format=cursor","windsurf":"/api/rules/react-19-server-actions-optimistic-reconciliation?format=windsurf","agents":"/api/rules/react-19-server-actions-optimistic-reconciliation?format=agents"}},{"id":"vite-6-heterogeneous-environment-isolation-standard","title":"Vite 6 Environment API: Heterogeneous Multi-Runtime Isolation & Asset Sandbox Standard","category":"frontend","severity":"critical","description":"Enforces strict runtime module boundary isolation, deterministic environment-keyed resolution conditions, and sandboxed asset compilation across Edge, Web Worker, SSR, and Client targets using the Vite 6 Environment API. Eliminates shared module graph pollution, illegal native Node/DOM API cross-imports, and leaked execution contexts in federated micro-app architectures.","antiPatternHeadline":"Monolithic Module Resolution and Shared Memory Leaks Across Heterogeneous Runtimes in Vite Builds","stars_count":78,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["vite6","environment-api","micro-frontends","edge-runtime","web-workers","ssr","module-federation"],"exportEndpoints":{"claude":"/api/rules/vite-6-heterogeneous-environment-isolation-standard?format=claude","cursorMdc":"/api/rules/vite-6-heterogeneous-environment-isolation-standard?format=mdc","cursorrules":"/api/rules/vite-6-heterogeneous-environment-isolation-standard?format=cursor","windsurf":"/api/rules/vite-6-heterogeneous-environment-isolation-standard?format=windsurf","agents":"/api/rules/vite-6-heterogeneous-environment-isolation-standard?format=agents"}},{"id":"tauri2-mobile-zero-copy-ipc-streaming","title":"Tauri 2.0 Mobile Zero-Copy Binary IPC Streaming Standard","category":"mobile","severity":"critical","description":"Enforces zero-copy raw byte transfers and IPC Channel streaming for multi-megabyte payloads across the Tauri 2.0 Rust-WebView bridge. Eliminates base64 and JSON numeric array serialization that causes catastrophic WebKit heap inflation, frame drops, and mobile OS process termination.","antiPatternHeadline":"Serializing Raw Binary Chunks as Base64 or JSON Numeric Arrays Across Tauri Mobile IPC","stars_count":50,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri","ipc","performance","rust","memory-management"],"exportEndpoints":{"claude":"/api/rules/tauri2-mobile-zero-copy-ipc-streaming?format=claude","cursorMdc":"/api/rules/tauri2-mobile-zero-copy-ipc-streaming?format=mdc","cursorrules":"/api/rules/tauri2-mobile-zero-copy-ipc-streaming?format=cursor","windsurf":"/api/rules/tauri2-mobile-zero-copy-ipc-streaming?format=windsurf","agents":"/api/rules/tauri2-mobile-zero-copy-ipc-streaming?format=agents"}},{"id":"kmp-hierarchical-coroutine-native-bridge-standard","title":"KMP Coroutine Bridge: Deterministic Cancellation and Stack-Preserved Exception Architecture","category":"mobile","severity":"critical","description":"Enforces strict boundary contracts across Kotlin Multiplatform and Swift concurrency. Guarantees bi-directional cancellation propagation, prevents fatal unhandled Kotlin exceptions across the Objective-C/Swift bridge, and preserves multi-runtime stack traces.","antiPatternHeadline":"Unchecked Suspend Export Leaking Background Jobs and Triggering Bridge SIGABRTs","stars_count":52,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","coroutines","swift-concurrency","ios","native-bridge"],"exportEndpoints":{"claude":"/api/rules/kmp-hierarchical-coroutine-native-bridge-standard?format=claude","cursorMdc":"/api/rules/kmp-hierarchical-coroutine-native-bridge-standard?format=mdc","cursorrules":"/api/rules/kmp-hierarchical-coroutine-native-bridge-standard?format=cursor","windsurf":"/api/rules/kmp-hierarchical-coroutine-native-bridge-standard?format=windsurf","agents":"/api/rules/kmp-hierarchical-coroutine-native-bridge-standard?format=agents"}},{"id":"go-chi-context-afterfunc-resource-finalization","title":"Go Chi context.AfterFunc HTTP/2 Resource Finalization & Leak Prevention","category":"backend","severity":"critical","description":"Enforces deterministic resource finalization and external socket termination in Go Chi handlers using Go 1.21+ context.AfterFunc. Eliminates orphan watcher goroutines while ensuring immediate, non-blocking teardown of downstream TCP/gRPC connections upon HTTP/2 client disconnects (RST_STREAM).","antiPatternHeadline":"Spawning dedicated watchdog goroutines or failing to deregister context cancellation hooks for long-lived sockets","stars_count":106,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","chi","concurrency","http2","context","resource-management"],"exportEndpoints":{"claude":"/api/rules/go-chi-context-afterfunc-resource-finalization?format=claude","cursorMdc":"/api/rules/go-chi-context-afterfunc-resource-finalization?format=mdc","cursorrules":"/api/rules/go-chi-context-afterfunc-resource-finalization?format=cursor","windsurf":"/api/rules/go-chi-context-afterfunc-resource-finalization?format=windsurf","agents":"/api/rules/go-chi-context-afterfunc-resource-finalization?format=agents"}},{"id":"bun-atomics-sharedarraybuffer-concurrency-standard","title":"Bun 1.2 Atomics & SharedArrayBuffer Inter-Worker Concurrency Standard","category":"backend","severity":"critical","description":"Enforces deterministic, lock-free inter-worker synchronization using SharedArrayBuffer and the Atomics API within Bun 1.2 runtimes. Prevents main event-loop stalls, data races, and torn reads/writes across native Worker threads under heavy compute loads. Mandates explicit memory barriers, aligned typed views, and non-blocking wait/notify patterns on main threads.","antiPatternHeadline":"Unsynchronized SharedArrayBuffer mutations and blocking Atomics.wait on the main worker event loop","stars_count":41,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","atomics","multithreading","sharedarraybuffer","workers"],"exportEndpoints":{"claude":"/api/rules/bun-atomics-sharedarraybuffer-concurrency-standard?format=claude","cursorMdc":"/api/rules/bun-atomics-sharedarraybuffer-concurrency-standard?format=mdc","cursorrules":"/api/rules/bun-atomics-sharedarraybuffer-concurrency-standard?format=cursor","windsurf":"/api/rules/bun-atomics-sharedarraybuffer-concurrency-standard?format=windsurf","agents":"/api/rules/bun-atomics-sharedarraybuffer-concurrency-standard?format=agents"}},{"id":"openfga-consistency-tokens-monotonic-guardrail","title":"OpenFGA Monotonic Read-After-Write Consistency Token Invariant","category":"security","severity":"critical","description":"Enforces deterministic read-after-write monotonic invariants across distributed OpenFGA edge deployments using consistency tokens. Mitigates authorization race conditions, time-of-check to time-of-use (TOCTOU) exploits, and transient authorization bypasses caused by stale cache evaluation following permission mutations. Mandates explicit propagation, persistence, and evaluation of OpenFGA consistency tokens across client requests and internal service calls.","antiPatternHeadline":"Unsynchronized Read-After-Write Check Permitting Stale Authorization Bypasses","stars_count":63,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","authorization","distributed-systems","concurrency"],"exportEndpoints":{"claude":"/api/rules/openfga-consistency-tokens-monotonic-guardrail?format=claude","cursorMdc":"/api/rules/openfga-consistency-tokens-monotonic-guardrail?format=mdc","cursorrules":"/api/rules/openfga-consistency-tokens-monotonic-guardrail?format=cursor","windsurf":"/api/rules/openfga-consistency-tokens-monotonic-guardrail?format=windsurf","agents":"/api/rules/openfga-consistency-tokens-monotonic-guardrail?format=agents"}},{"id":"atls-hardware-enclave-dynamic-verification-standard","title":"Attested TLS (aTLS) Enclave Cryptographic Binding & Dynamic Verification Standard","category":"security","severity":"critical","description":"Enforces strict cryptographic binding between TLS ephemeral session keys and hardware enclave attestation reports (AMD SEV-SNP, Intel SGX/TDX, AWS Nitro) within the TLS handshake. Guarantees zero-trust sovereign compute integrity by verifying hardware roots of trust, platform measurements, and public key binding before application data transit.","antiPatternHeadline":"Decoupling Hardware Attestation from the TLS Handshake Allowing Man-in-the-Middle and Replay Attacks","stars_count":49,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","atls","confidential-computing","enclaves","zero-trust","cryptography"],"exportEndpoints":{"claude":"/api/rules/atls-hardware-enclave-dynamic-verification-standard?format=claude","cursorMdc":"/api/rules/atls-hardware-enclave-dynamic-verification-standard?format=mdc","cursorrules":"/api/rules/atls-hardware-enclave-dynamic-verification-standard?format=cursor","windsurf":"/api/rules/atls-hardware-enclave-dynamic-verification-standard?format=windsurf","agents":"/api/rules/atls-hardware-enclave-dynamic-verification-standard?format=agents"}},{"id":"postgres-17-block-incremental-pg-combinebackup","title":"Postgres 17 Block-Level Incremental Backup and pg_combinebackup Invariant","category":"devops","severity":"critical","description":"Enforces deterministic disaster recovery invariants for PostgreSQL 17+ by mandating native block-level incremental backups via WAL summarization and pg_combinebackup synthetic validation. Prohibits reliance on uncoordinated hypervisor snapshots and untested differential chains by guaranteeing WAL-free block-tracking and continuous manifest validation to safeguard strict RPO and RTO bounds.","antiPatternHeadline":"Unverified Hypervisor Snapshots or Fractured Incremental Backup Chains Lacking pg_combinebackup Manifest Validation","stars_count":110,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","postgres-17","pg-combinebackup","database-reliability","disaster-recovery","rpo-rto"],"exportEndpoints":{"claude":"/api/rules/postgres-17-block-incremental-pg-combinebackup?format=claude","cursorMdc":"/api/rules/postgres-17-block-incremental-pg-combinebackup?format=mdc","cursorrules":"/api/rules/postgres-17-block-incremental-pg-combinebackup?format=cursor","windsurf":"/api/rules/postgres-17-block-incremental-pg-combinebackup?format=windsurf","agents":"/api/rules/postgres-17-block-incremental-pg-combinebackup?format=agents"}},{"id":"opentelemetry-continuous-profiling-span-correlation-standard","title":"OpenTelemetry Continuous Profiling Span Correlation & Thread Registry Standard","category":"devops","severity":"critical","description":"Enforces zero-overhead binding between OpenTelemetry distributed trace spans and kernel-level continuous profiler samples (eBPF CPU and off-CPU/lock contention). Requires asynchronous OS thread/goroutine registration to expose active TraceID and SpanID via stable thread-local memory buffers readable by kernel probes without intercepting the fast-path execution. Eliminates runtime lock contention and synchronous user-space frame unwinding while preserving sub-millisecond trace-to-flamegraph lineage.","antiPatternHeadline":"Synchronous User-Space Profiler Interception or Disconnected High-Frequency Wall-Clock Sampling","stars_count":63,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","continuous-profiling","ebpf","distributed-tracing","performance"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-continuous-profiling-span-correlation-standard?format=claude","cursorMdc":"/api/rules/opentelemetry-continuous-profiling-span-correlation-standard?format=mdc","cursorrules":"/api/rules/opentelemetry-continuous-profiling-span-correlation-standard?format=cursor","windsurf":"/api/rules/opentelemetry-continuous-profiling-span-correlation-standard?format=windsurf","agents":"/api/rules/opentelemetry-continuous-profiling-span-correlation-standard?format=agents"}},{"id":"nextjs-15-distributed-cache-tag-tenant-isolation","title":"Next.js 15 Distributed Cache-Tag Partitioning & Multi-Tenant Cache Key Guardrail","category":"frontend","severity":"critical","description":"Enforces strict cryptographic tenant-prefixing and structural key partitioning on Next.js 15 'use cache' directives and fetch cache tags. Prevents cross-tenant data exfiltration and CDN cache poisoning under distributed stale-while-revalidate cycles by mandating validated tenant-scoped cache boundaries and immutable tag schemas.","antiPatternHeadline":"Global Unpartitioned Cache-Tag Collisions & Cross-Tenant Edge Leaks","stars_count":76,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs15","cache-tag","multi-tenancy","security","edge-cdn"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-distributed-cache-tag-tenant-isolation?format=claude","cursorMdc":"/api/rules/nextjs-15-distributed-cache-tag-tenant-isolation?format=mdc","cursorrules":"/api/rules/nextjs-15-distributed-cache-tag-tenant-isolation?format=cursor","windsurf":"/api/rules/nextjs-15-distributed-cache-tag-tenant-isolation?format=windsurf","agents":"/api/rules/nextjs-15-distributed-cache-tag-tenant-isolation?format=agents"}},{"id":"rust-axum-http2-goaway-graceful-draining-standard","title":"Rust Axum HTTP/2 GOAWAY Graceful Connection Draining Standard","category":"backend","severity":"critical","description":"Enforces RFC 9113 compliant HTTP/2 GOAWAY frame sequencing and deterministic stream draining in Rust Axum microservices. Guarantees zero dropped in-flight multiplexed requests and clean client reconnection signaling during rolling blue/green deployments and pod evictions.","antiPatternHeadline":"Naive Server Termination Dropping In-Flight HTTP/2 Streams via Premature TCP RST/FIN","stars_count":99,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["rust","axum","http2","hyper","zero-downtime","graceful-shutdown","kubernetes"],"exportEndpoints":{"claude":"/api/rules/rust-axum-http2-goaway-graceful-draining-standard?format=claude","cursorMdc":"/api/rules/rust-axum-http2-goaway-graceful-draining-standard?format=mdc","cursorrules":"/api/rules/rust-axum-http2-goaway-graceful-draining-standard?format=cursor","windsurf":"/api/rules/rust-axum-http2-goaway-graceful-draining-standard?format=windsurf","agents":"/api/rules/rust-axum-http2-goaway-graceful-draining-standard?format=agents"}},{"id":"fastapi-async-generator-backpressure-pydantic-v2-memory-invariant","title":"FastAPI Async Generator Backpressure & Pydantic V2 Memory Invariant","category":"backend","severity":"critical","description":"Enforces strict backpressure handling and zero-accumulation memory bounds for Server-Sent Events (SSE) and chunked binary streams in FastAPI. Prevents unbounded heap growth and event loop starvation caused by unconstrained buffer accumulation, eager Pydantic V2 collection materialization, and missed client disconnection signals.","antiPatternHeadline":"Eager model collection materialization and unbounded queueing during SSE/chunked response streaming.","stars_count":41,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","pydantic-v2","asyncio","streaming","memory-management"],"exportEndpoints":{"claude":"/api/rules/fastapi-async-generator-backpressure-pydantic-v2-memory-invariant?format=claude","cursorMdc":"/api/rules/fastapi-async-generator-backpressure-pydantic-v2-memory-invariant?format=mdc","cursorrules":"/api/rules/fastapi-async-generator-backpressure-pydantic-v2-memory-invariant?format=cursor","windsurf":"/api/rules/fastapi-async-generator-backpressure-pydantic-v2-memory-invariant?format=windsurf","agents":"/api/rules/fastapi-async-generator-backpressure-pydantic-v2-memory-invariant?format=agents"}},{"id":"postgres-17-async-streaming-io-buffer-boundary","title":"Postgres 17 Asynchronous Streaming I/O Buffer Allocation Boundary","category":"backend","severity":"critical","description":"Enforces strict session-level buffer allocation and asynchronous streaming I/O bounds for vector index operations in PostgreSQL 17. Eliminates shared buffer lock contention (LWLock:buffer_mapping/buffer_content) and OS page cache thrashing under concurrent high-throughput analytic scans by routing queries to dedicated read pools with isolated RingBuffer strategies and configured prefetch limits.","antiPatternHeadline":"Executing Concurrent Unbounded Vector Scans in Default OLTP Shared Buffers Causing Cache Eviction and LWLock Contention","stars_count":68,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres-17","async-io","pgvector","shared-buffers","concurrency"],"exportEndpoints":{"claude":"/api/rules/postgres-17-async-streaming-io-buffer-boundary?format=claude","cursorMdc":"/api/rules/postgres-17-async-streaming-io-buffer-boundary?format=mdc","cursorrules":"/api/rules/postgres-17-async-streaming-io-buffer-boundary?format=cursor","windsurf":"/api/rules/postgres-17-async-streaming-io-buffer-boundary?format=windsurf","agents":"/api/rules/postgres-17-async-streaming-io-buffer-boundary?format=agents"}},{"id":"kmp-swift-task-cancellation-bridge-standard","title":"KMP Bi-Directional Swift Task to Coroutine Cancellation Bridge","category":"mobile","severity":"critical","description":"Enforces deterministic, bi-directional cooperative cancellation bridging between Swift async/await Tasks and Kotlin Coroutine Jobs across the Kotlin/Native boundary. Eliminates orphaned background execution threads, UI memory retention cycles, and phantom network operations when Swift views discard active tasks.","antiPatternHeadline":"Orphaned Kotlin Coroutine Execution on Swift Task Cancellation","stars_count":99,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kmp","kotlin-native","swift-concurrency","coroutines","ios"],"exportEndpoints":{"claude":"/api/rules/kmp-swift-task-cancellation-bridge-standard?format=claude","cursorMdc":"/api/rules/kmp-swift-task-cancellation-bridge-standard?format=mdc","cursorrules":"/api/rules/kmp-swift-task-cancellation-bridge-standard?format=cursor","windsurf":"/api/rules/kmp-swift-task-cancellation-bridge-standard?format=windsurf","agents":"/api/rules/kmp-swift-task-cancellation-bridge-standard?format=agents"}},{"id":"react-native-bridgeless-jsi-direct-memory-invariants","title":"React Native Bridgeless TurboModule JSI Direct-Memory Thread-Affinity Guardrail","category":"mobile","severity":"critical","description":"Enforces strict C++ thread-affinity barriers and synchronous lifecycle guarantees for direct-memory JSI operations in React Native Bridgeless mode. Prohibits capturing raw jsi::ArrayBuffer pointers or unpinned heap references across worker threads without deterministic deep copying or runtime marshaling. Prevents fatal Hermes/V8 engine panics, heap corruption, and use-after-free vulnerabilities caused by asynchronous garbage collection during concurrent native access.","antiPatternHeadline":"Escaping raw jsi::ArrayBuffer memory pointers to asynchronous worker threads without JS thread pinning","stars_count":72,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","react-native","turbomodules","jsi","c++","memory-safety"],"exportEndpoints":{"claude":"/api/rules/react-native-bridgeless-jsi-direct-memory-invariants?format=claude","cursorMdc":"/api/rules/react-native-bridgeless-jsi-direct-memory-invariants?format=mdc","cursorrules":"/api/rules/react-native-bridgeless-jsi-direct-memory-invariants?format=cursor","windsurf":"/api/rules/react-native-bridgeless-jsi-direct-memory-invariants?format=windsurf","agents":"/api/rules/react-native-bridgeless-jsi-direct-memory-invariants?format=agents"}},{"id":"wasmtime-component-model-deterministic-sandboxing-standard","title":"Wasmtime Component Model Deterministic Memory Sandboxing and Fuel Limiting","category":"security","severity":"critical","description":"Enforces strict fuel-based CPU consumption metering and linear memory bounding for untrusted WebAssembly components executing within host backend services. Requires all Wasmtime Store instances hosting guest plugins to implement ResourceLimiter and configure deterministic epoch or fuel bounds to prevent CPU starvation and host Out-Of-Memory (OOM) exploits.","antiPatternHeadline":"Instantiating untrusted Wasm components with unbounded memory allocation and unmetered CPU execution cycles.","stars_count":101,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","wasm","wasmtime","component-model","sandboxing","rust"],"exportEndpoints":{"claude":"/api/rules/wasmtime-component-model-deterministic-sandboxing-standard?format=claude","cursorMdc":"/api/rules/wasmtime-component-model-deterministic-sandboxing-standard?format=mdc","cursorrules":"/api/rules/wasmtime-component-model-deterministic-sandboxing-standard?format=cursor","windsurf":"/api/rules/wasmtime-component-model-deterministic-sandboxing-standard?format=windsurf","agents":"/api/rules/wasmtime-component-model-deterministic-sandboxing-standard?format=agents"}},{"id":"cilium-ebpf-host-routing-wireguard-mesh-invariant","title":"Cilium eBPF Host-Routing WireGuard Mesh Invariant","category":"devops","severity":"critical","description":"Enforces transparent in-kernel packet encryption via Cilium eBPF host-routing and WireGuard mesh, bypassing the Linux network stack and user-space proxy overhead. Guarantees end-to-end cryptographic isolation and strict mutual authentication across tenant namespace boundaries without requiring Istio or Linkerd sidecars.","antiPatternHeadline":"Injecting user-space sidecar proxies for mTLS encryption and leaving eBPF host-routing disabled","stars_count":93,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["cilium","ebpf","wireguard","kubernetes","networking","zero-trust","infrastructure-as-code"],"exportEndpoints":{"claude":"/api/rules/cilium-ebpf-host-routing-wireguard-mesh-invariant?format=claude","cursorMdc":"/api/rules/cilium-ebpf-host-routing-wireguard-mesh-invariant?format=mdc","cursorrules":"/api/rules/cilium-ebpf-host-routing-wireguard-mesh-invariant?format=cursor","windsurf":"/api/rules/cilium-ebpf-host-routing-wireguard-mesh-invariant?format=windsurf","agents":"/api/rules/cilium-ebpf-host-routing-wireguard-mesh-invariant?format=agents"}},{"id":"otel-tracestate-hmac-provenance-invariant","title":"Cryptographic HMAC Provenance Verification for OTel TraceState and Baggage","category":"devops","severity":"critical","description":"Enforces cryptographic HMAC signing and strict provenance verification for W3C TraceState and Baggage headers at untrusted network perimeters. Prevents trace context spoofing, cross-tenant telemetry contamination, and privilege escalation via injected context baggage across service boundaries. Ensures distributed trace contexts are authenticated before downstream propagation or authorization decisions.","antiPatternHeadline":"Blind Propagation of Untrusted TraceState and Baggage Ingress Headers","stars_count":51,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","security","distributed-tracing","cryptography"],"exportEndpoints":{"claude":"/api/rules/otel-tracestate-hmac-provenance-invariant?format=claude","cursorMdc":"/api/rules/otel-tracestate-hmac-provenance-invariant?format=mdc","cursorrules":"/api/rules/otel-tracestate-hmac-provenance-invariant?format=cursor","windsurf":"/api/rules/otel-tracestate-hmac-provenance-invariant?format=windsurf","agents":"/api/rules/otel-tracestate-hmac-provenance-invariant?format=agents"}},{"id":"react-19-server-actions-cryptographic-idempotency","title":"React 19 Server Actions Cryptographic Idempotency and Replay Guardrail","category":"frontend","severity":"critical","description":"Enforces cryptographic replay protection and deterministic state reconciliation for React 19 Server Actions interacting with optimistic UI mutations. Prevents double-charge scenarios, orphaned side effects, and state desynchronization caused by automated browser retries, network blips, or concurrent optimistic dispatches. Mandates server-side idempotency keys backed by atomic reservation stores and signed action tokens.","antiPatternHeadline":"Blind Server Action Dispatches Subject to Network Retries and Concurrent Duplicate Executions","stars_count":86,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["react-19","server-actions","idempotency","optimistic-updates","concurrency"],"exportEndpoints":{"claude":"/api/rules/react-19-server-actions-cryptographic-idempotency?format=claude","cursorMdc":"/api/rules/react-19-server-actions-cryptographic-idempotency?format=mdc","cursorrules":"/api/rules/react-19-server-actions-cryptographic-idempotency?format=cursor","windsurf":"/api/rules/react-19-server-actions-cryptographic-idempotency?format=windsurf","agents":"/api/rules/react-19-server-actions-cryptographic-idempotency?format=agents"}},{"id":"fastapi-anyio-concurrency-limiter-thread-pool-standard","title":"FastAPI AnyIO Concurrency Limiter and Thread Pool Offload Standard","category":"backend","severity":"critical","description":"Enforces non-blocking execution boundaries for synchronous Python compute and legacy I/O routines within FastAPI applications. Mandates the explicit configuration of AnyIO thread pool capacity limiters and prevents event loop thread starvation by offloading blocking operations via isolated, token-bounded thread pools.","antiPatternHeadline":"Executing Blocking Sync Calls Inside Async Def or Using Unbounded Thread Pools That Exhaust System Resources","stars_count":117,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["fastapi","anyio","asyncio","concurrency","threadpool","python"],"exportEndpoints":{"claude":"/api/rules/fastapi-anyio-concurrency-limiter-thread-pool-standard?format=claude","cursorMdc":"/api/rules/fastapi-anyio-concurrency-limiter-thread-pool-standard?format=mdc","cursorrules":"/api/rules/fastapi-anyio-concurrency-limiter-thread-pool-standard?format=cursor","windsurf":"/api/rules/fastapi-anyio-concurrency-limiter-thread-pool-standard?format=windsurf","agents":"/api/rules/fastapi-anyio-concurrency-limiter-thread-pool-standard?format=agents"}},{"id":"postgres-17-logical-replication-failover-sync-guardrail","title":"PostgreSQL 17 Logical Replication Failover Slot Synchronization Guardrail","category":"backend","severity":"critical","description":"Enforces failover-safe logical replication and Change Data Capture (CDC) streaming pipelines on PostgreSQL 17+. Mandates failover-enabled logical slots, primary synchronized_standby_slots barrier coordination, and standby slot synchronization to prevent missing WAL segment errors, LSN drift, and CDC corruption during physical replica promotions.","antiPatternHeadline":"Unsynchronized Logical Slots on HA Clusters Triggering WAL Starvation and CDC Corruption on Standby Promotion","stars_count":96,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql-17","cdc","logical-replication","ha-failover","zero-data-loss","debezium"],"exportEndpoints":{"claude":"/api/rules/postgres-17-logical-replication-failover-sync-guardrail?format=claude","cursorMdc":"/api/rules/postgres-17-logical-replication-failover-sync-guardrail?format=mdc","cursorrules":"/api/rules/postgres-17-logical-replication-failover-sync-guardrail?format=cursor","windsurf":"/api/rules/postgres-17-logical-replication-failover-sync-guardrail?format=windsurf","agents":"/api/rules/postgres-17-logical-replication-failover-sync-guardrail?format=agents"}},{"id":"oauth2-dpop-sender-constrained-orchestration","title":"OAuth 2.1 Sender-Constrained DPoP Token Proof Orchestration Standard","category":"security","severity":"critical","description":"Mandates cryptographic binding of access tokens and HTTP requests via non-extractable client keypairs compliant with RFC 9449. Enforces ephemeral proof generation per outbound request, strict URI normalization ('htu'/'htm'), access token hash ('ath') computation, and automated server DPoP nonce challenge rotation.","antiPatternHeadline":"Transmitting bearer tokens without cryptographic sender-constraints, caching DPoP proof JWTs, or generating extractable keys in insecure storage.","stars_count":75,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","oauth2","dpop","rfc9449","cryptography","tokens"],"exportEndpoints":{"claude":"/api/rules/oauth2-dpop-sender-constrained-orchestration?format=claude","cursorMdc":"/api/rules/oauth2-dpop-sender-constrained-orchestration?format=mdc","cursorrules":"/api/rules/oauth2-dpop-sender-constrained-orchestration?format=cursor","windsurf":"/api/rules/oauth2-dpop-sender-constrained-orchestration?format=windsurf","agents":"/api/rules/oauth2-dpop-sender-constrained-orchestration?format=agents"}},{"id":"bun-websocket-streaming-backpressure-watermark","title":"Bun 1.2 Native WebSocket Streaming Backpressure and Buffer Watermark Guardrail","category":"backend","severity":"critical","description":"Mandates explicit backpressure management, low-level buffer watermark checks, and drain lifecycle coordination for native Bun 1.2 WebSocket streaming. Prevents unbounded heap growth and event-loop lag caused by slow consumers during high-throughput live broadcasts.","antiPatternHeadline":"Unchecked Fire-and-Forget ws.send() Loops Saturating Native Memory Without Drain Handling","stars_count":64,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","websockets","backpressure","memory-management","streaming"],"exportEndpoints":{"claude":"/api/rules/bun-websocket-streaming-backpressure-watermark?format=claude","cursorMdc":"/api/rules/bun-websocket-streaming-backpressure-watermark?format=mdc","cursorrules":"/api/rules/bun-websocket-streaming-backpressure-watermark?format=cursor","windsurf":"/api/rules/bun-websocket-streaming-backpressure-watermark?format=windsurf","agents":"/api/rules/bun-websocket-streaming-backpressure-watermark?format=agents"}},{"id":"react-native-bridgeless-concurrent-batching-standard","title":"React Native 0.76 Bridgeless Architecture Concurrent State Batching Standard","category":"mobile","severity":"critical","description":"Enforces synchronous C++ JSI direct-memory invocations and concurrent state batching invariants under React Native 0.76+ Bridgeless runtime. Eliminates frame-rate stutter, microtask starvation, and UI tearing caused by legacy asynchronous JSON bridge marshalling during continuous gesture and layout passes. Mandates typed TurboModules and React 18/19 concurrent transitions for cross-thread native-to-JS state reconciliation.","antiPatternHeadline":"Invoking Legacy Bridge Callbacks and Asynchronous NativeModules inside High-Frequency Gesture Loops Causing State Tearing","stars_count":118,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","react-native","react-native-0.76","bridgeless","jsi","turbomodules","concurrency"],"exportEndpoints":{"claude":"/api/rules/react-native-bridgeless-concurrent-batching-standard?format=claude","cursorMdc":"/api/rules/react-native-bridgeless-concurrent-batching-standard?format=mdc","cursorrules":"/api/rules/react-native-bridgeless-concurrent-batching-standard?format=cursor","windsurf":"/api/rules/react-native-bridgeless-concurrent-batching-standard?format=windsurf","agents":"/api/rules/react-native-bridgeless-concurrent-batching-standard?format=agents"}},{"id":"k8s-gateway-api-referencegrant-boundary-standard","title":"Kubernetes Gateway API Cross-Namespace ReferenceGrant Boundary Standard","category":"devops","severity":"critical","description":"Enforces strict zero-trust boundary governance across multi-tenant Kubernetes clusters utilizing Gateway API (gateway.networking.k8s.io). Mandates that every cross-namespace resource reference—including Gateway listener TLS secret references and HTTPRoute/GRPCRoute backend references—must be explicitly authorized by a co-located, least-privilege ReferenceGrant in the destination namespace. Prohibits implicit routing assumptions, broad namespace wildcards, and missing cross-namespace routing contracts.","antiPatternHeadline":"Unbounded Cross-Namespace Backend Routing and Omitted ReferenceGrants Triggering Silent Traffic Rejection or Tenant Boundary Exploitation","stars_count":65,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","kubernetes","gateway-api","zero-trust","multi-tenancy","reference-grant","security"],"exportEndpoints":{"claude":"/api/rules/k8s-gateway-api-referencegrant-boundary-standard?format=claude","cursorMdc":"/api/rules/k8s-gateway-api-referencegrant-boundary-standard?format=mdc","cursorrules":"/api/rules/k8s-gateway-api-referencegrant-boundary-standard?format=cursor","windsurf":"/api/rules/k8s-gateway-api-referencegrant-boundary-standard?format=windsurf","agents":"/api/rules/k8s-gateway-api-referencegrant-boundary-standard?format=agents"}},{"id":"swift-6-actor-isolation-data-race-safety-standard","title":"Swift 6 Actor Isolation and Compile-Time Data-Race Safety Standard","category":"mobile","severity":"critical","description":"Enforces complete compile-time concurrency checking and actor isolation guarantees under Swift 6 mode. Eliminates mutable reference escapes, unsafe global state, and non-sendable cross-isolation crossings to eradicate data races, deadlocks, and corrupted multithreaded application states.","antiPatternHeadline":"Bypassing Strict Concurrency via Unsafe Unchecked Conformance and Shared Mutable Reference Passing","stars_count":44,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","ios","swift","concurrency","actors","safety"],"exportEndpoints":{"claude":"/api/rules/swift-6-actor-isolation-data-race-safety-standard?format=claude","cursorMdc":"/api/rules/swift-6-actor-isolation-data-race-safety-standard?format=mdc","cursorrules":"/api/rules/swift-6-actor-isolation-data-race-safety-standard?format=cursor","windsurf":"/api/rules/swift-6-actor-isolation-data-race-safety-standard?format=windsurf","agents":"/api/rules/swift-6-actor-isolation-data-race-safety-standard?format=agents"}},{"id":"otel-collector-routing-connector-backpressure-invariant","title":"OpenTelemetry Collector Routing Connector Dynamic Backpressure and Load-Shedding Invariant","category":"devops","severity":"critical","description":"Enforces declarative routing connectors in OpenTelemetry Collector configurations to dynamically isolate and load-shed trace telemetry during downstream saturation or traffic bursts. Guarantees that pipeline congestion on heavy trace streams fails safely via probabilistic sampling and circuit breaking without destabilizing critical metric and log delivery. Mandates decoupled queue-bounded memory pipelines between receivers and high-cardinality exporters.","antiPatternHeadline":"Monolithic Shared-Pipeline Collector Configuration Lacking Dynamic Routing Connectors and Isolated Memory Queues","stars_count":94,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","observability","backpressure","traffic-shedding"],"exportEndpoints":{"claude":"/api/rules/otel-collector-routing-connector-backpressure-invariant?format=claude","cursorMdc":"/api/rules/otel-collector-routing-connector-backpressure-invariant?format=mdc","cursorrules":"/api/rules/otel-collector-routing-connector-backpressure-invariant?format=cursor","windsurf":"/api/rules/otel-collector-routing-connector-backpressure-invariant?format=windsurf","agents":"/api/rules/otel-collector-routing-connector-backpressure-invariant?format=agents"}},{"id":"wasm-component-model-microfrontend-isolation","title":"Wasm Component Model Isolation Standard for Untrusted Microfrontends","category":"frontend","severity":"critical","description":"Enforces strict capability-based isolation for federated third-party microfrontends using the WebAssembly Component Model and WASI interfaces. Prohibits direct host DOM references, credential access, and ambient network calls, mandating typed WIT contract boundaries, virtualized memory quotas, and declarative host-side canvas or vDOM marshaling.","antiPatternHeadline":"Executing Third-Party Microfrontends via Unsandboxed Eval or Unrestricted Iframe/DOM Injection","stars_count":49,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","webassembly","component-model","microfrontends","security","wasi"],"exportEndpoints":{"claude":"/api/rules/wasm-component-model-microfrontend-isolation?format=claude","cursorMdc":"/api/rules/wasm-component-model-microfrontend-isolation?format=mdc","cursorrules":"/api/rules/wasm-component-model-microfrontend-isolation?format=cursor","windsurf":"/api/rules/wasm-component-model-microfrontend-isolation?format=windsurf","agents":"/api/rules/wasm-component-model-microfrontend-isolation?format=agents"}},{"id":"react-19-server-actions-concurrent-mutation-fencing","title":"React 19 Server Actions Concurrent Mutation Fencing & Optimistic Reconciliation","category":"frontend","severity":"critical","description":"Enforces deterministic state reconciliation during concurrent React 19 Server Actions execution using transactional fencing tokens and monotonic epoch sequences. Prevents stale server responses and multi-tab race conditions from clobbering higher-version optimistic state or corrupting local caches. Mandates versioned payload validation within useActionState, useOptimistic, and Server Action transaction boundaries.","antiPatternHeadline":"Unfenced Server Actions with Naked useOptimistic Resulting in Stale Response Overwrite","stars_count":40,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react19","server-actions","optimistic-ui","concurrency","distributed-systems"],"exportEndpoints":{"claude":"/api/rules/react-19-server-actions-concurrent-mutation-fencing?format=claude","cursorMdc":"/api/rules/react-19-server-actions-concurrent-mutation-fencing?format=mdc","cursorrules":"/api/rules/react-19-server-actions-concurrent-mutation-fencing?format=cursor","windsurf":"/api/rules/react-19-server-actions-concurrent-mutation-fencing?format=windsurf","agents":"/api/rules/react-19-server-actions-concurrent-mutation-fencing?format=agents"}},{"id":"tauri-v2-ipc-zero-copy-buffer-protocol","title":"Tauri 2.0 Multi-Process IPC Zero-Copy Binary Buffer Architecture","category":"frontend","severity":"critical","description":"Enforces raw binary ArrayBuffer payload handling and Rust-backed Channel streaming for high-throughput AI inferencing in Tauri 2.0. Eliminates base64/JSON string serialization bottlenecks and prevents IPC heap exhaustion caused by unmanaged deserialization bursts between the webview renderer and native Rust engine.","antiPatternHeadline":"JSON and Base64-Encoded High-Frequency Tensor Serialization over Tauri IPC","stars_count":55,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","tauri","ipc","performance","rust","zero-copy","ai-inferencing"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-ipc-zero-copy-buffer-protocol?format=claude","cursorMdc":"/api/rules/tauri-v2-ipc-zero-copy-buffer-protocol?format=mdc","cursorrules":"/api/rules/tauri-v2-ipc-zero-copy-buffer-protocol?format=cursor","windsurf":"/api/rules/tauri-v2-ipc-zero-copy-buffer-protocol?format=windsurf","agents":"/api/rules/tauri-v2-ipc-zero-copy-buffer-protocol?format=agents"}},{"id":"axum-tower-cancellation-safety-drain","title":"Axum 0.8 Tower Async Cancellation Safety & Graceful Drain Standard","category":"backend","severity":"critical","description":"Enforces asynchronous cancellation safety and deterministic graceful drain semantics across Axum 0.8 and Tower service layers. Eliminates dropped in-flight HTTP/3 QUIC streams and dangling database transactions during Kubernetes rolling updates by decoupling transactional side effects from raw client drop lifecycles.","antiPatternHeadline":"Dangling Database Transactions and Abrupt QUIC Stream Termination via Unsafe tokio::select! in Axum Handlers","stars_count":81,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tokio","tower","quic","kubernetes"],"exportEndpoints":{"claude":"/api/rules/axum-tower-cancellation-safety-drain?format=claude","cursorMdc":"/api/rules/axum-tower-cancellation-safety-drain?format=mdc","cursorrules":"/api/rules/axum-tower-cancellation-safety-drain?format=cursor","windsurf":"/api/rules/axum-tower-cancellation-safety-drain?format=windsurf","agents":"/api/rules/axum-tower-cancellation-safety-drain?format=agents"}},{"id":"drizzle-pg-abortsignal-cancellation-standard","title":"Drizzle ORM Distributed AbortSignal & PostgreSQL Backend Cancellation Invariant","category":"backend","severity":"critical","description":"Terminates active PostgreSQL backend queries when incoming client HTTP requests or distributed trace deadlines abort. Merely rejecting TypeScript promises leaves database workers executing orphan queries (ghost queries), causing thread pool starvation and unreleased transactional table locks.","antiPatternHeadline":"Detached Client Aborts Spawning Ghost PostgreSQL Transactions via Unbound Drizzle Promises","stars_count":82,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","drizzle-orm","postgresql","abortsignal","performance","connection-pool"],"exportEndpoints":{"claude":"/api/rules/drizzle-pg-abortsignal-cancellation-standard?format=claude","cursorMdc":"/api/rules/drizzle-pg-abortsignal-cancellation-standard?format=mdc","cursorrules":"/api/rules/drizzle-pg-abortsignal-cancellation-standard?format=cursor","windsurf":"/api/rules/drizzle-pg-abortsignal-cancellation-standard?format=windsurf","agents":"/api/rules/drizzle-pg-abortsignal-cancellation-standard?format=agents"}},{"id":"rn-bridgeless-turbomodule-memory-safety","title":"React Native 0.78 Bridgeless TurboModule JSI Memory Safety & Thread Boundary Guardrail","category":"mobile","severity":"critical","description":"Enforces strict JSI thread-confinement invariants and CallInvoker dispatch protocols across native platform threads and the Hermes JavaScript runtime in React Native 0.78 Bridgeless Mode. Prevents fatal SIGSEGV memory corruption caused by concurrent Hermes garbage collection cycles sweeping non-thread-safe jsi::Value and jsi::Function handles accessed from background threads.","antiPatternHeadline":"Direct background-thread dereferencing and deallocation of raw jsi::Value and jsi::Function references across runtime boundaries","stars_count":52,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","react-native","turbomodules","bridgeless","hermes","jsi","thread-safety","cpp"],"exportEndpoints":{"claude":"/api/rules/rn-bridgeless-turbomodule-memory-safety?format=claude","cursorMdc":"/api/rules/rn-bridgeless-turbomodule-memory-safety?format=mdc","cursorrules":"/api/rules/rn-bridgeless-turbomodule-memory-safety?format=cursor","windsurf":"/api/rules/rn-bridgeless-turbomodule-memory-safety?format=windsurf","agents":"/api/rules/rn-bridgeless-turbomodule-memory-safety?format=agents"}},{"id":"kmp-ktor-connection-pooling-tls-resumption","title":"KMP Ktor Idle Connection Eviction & TLS 1.3 Session Resumption Guardrail","category":"mobile","severity":"critical","description":"Enforces deterministic idle socket pool eviction and platform-specific TLS 1.3 session ticket persistence across Android (OkHttp) and iOS (Darwin) Ktor engines. Prevents mobile baseband radio wakelocks (RRC state thrashing) and eliminates redundant cryptographic handshakes on mobile radio transitions.","antiPatternHeadline":"Ephemeral HttpClient instantiation with unbounded idle connection keep-alives and disabled TLS session caching","stars_count":85,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kmp","ktor","networking","battery-optimization","tls","android","ios"],"exportEndpoints":{"claude":"/api/rules/kmp-ktor-connection-pooling-tls-resumption?format=claude","cursorMdc":"/api/rules/kmp-ktor-connection-pooling-tls-resumption?format=mdc","cursorrules":"/api/rules/kmp-ktor-connection-pooling-tls-resumption?format=cursor","windsurf":"/api/rules/kmp-ktor-connection-pooling-tls-resumption?format=windsurf","agents":"/api/rules/kmp-ktor-connection-pooling-tls-resumption?format=agents"}},{"id":"spiffe-spire-x509-svid-federation-guardrail","title":"SPIFFE/SPIRE Ephemeral x509-SVID Workload Federation Standard","category":"security","severity":"critical","description":"Enforces short-lived, cryptographically verifiable x509-SVIDs acquired via local SPIRE Agent Workload API Unix Domain Sockets for all inter-workload and cross-cloud communication. Forbids baking static IAM credentials, long-lived API tokens, or pre-shared keys into deployments. Mandates automated mTLS handshake negotiation using dynamically rotated SPIFFE bundles across federated trust domains.","antiPatternHeadline":"Baking Static Cross-Cloud IAM Keys or Skipping SPIFFE Workload API Dynamic Rotation","stars_count":58,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","spiffe","spire","zero-trust","mtls","workload-identity","cryptography"],"exportEndpoints":{"claude":"/api/rules/spiffe-spire-x509-svid-federation-guardrail?format=claude","cursorMdc":"/api/rules/spiffe-spire-x509-svid-federation-guardrail?format=mdc","cursorrules":"/api/rules/spiffe-spire-x509-svid-federation-guardrail?format=cursor","windsurf":"/api/rules/spiffe-spire-x509-svid-federation-guardrail?format=windsurf","agents":"/api/rules/spiffe-spire-x509-svid-federation-guardrail?format=agents"}},{"id":"openid-caep-realtime-session-revocation-guardrail","title":"OpenID CAEP Real-Time Cross-Boundary Session Revocation Standard","category":"security","severity":"critical","description":"Enforces deterministic, sub-second propagation and enforcement of OpenID Continuous Access Evaluation Profile (CAEP) and Shared Signals and Events (SSE) revocation streams across edge runtimes. Mandates immediate cryptographically verified Security Event Token (SET) ingestion, distributed low-latency revocation tombstoning, and edge-evaluated session termination to eliminate replay vulnerabilities during credential compromise.","antiPatternHeadline":"Relying on Passive JWT Expiration or Asynchronous Polling During Verified Credential Compromise","stars_count":112,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openid","caep","sse","session-management","edge-computing","zero-trust"],"exportEndpoints":{"claude":"/api/rules/openid-caep-realtime-session-revocation-guardrail?format=claude","cursorMdc":"/api/rules/openid-caep-realtime-session-revocation-guardrail?format=mdc","cursorrules":"/api/rules/openid-caep-realtime-session-revocation-guardrail?format=cursor","windsurf":"/api/rules/openid-caep-realtime-session-revocation-guardrail?format=windsurf","agents":"/api/rules/openid-caep-realtime-session-revocation-guardrail?format=agents"}},{"id":"tetragon-ebpf-breakout-sigkill-enforcement","title":"Cilium Tetragon Synchronous In-Kernel Container Breakout SIGKILL Enforcement","category":"devops","severity":"critical","description":"Enforces synchronous in-kernel execution interception and immediate SIGKILL termination via Cilium Tetragon TracingPolicy CRDs at the ring-0 boundary. Prohibits asynchronous, userspace-only breakout detection patterns that introduce race windows permitting lateral movement across container namespaces before remediation.","antiPatternHeadline":"Permitting Asynchronous Alerting or Deferred Userspace Filtering for Kernel Breakout Primitives","stars_count":73,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","cilium","tetragon","ebpf","kubernetes","security-enforcement","zero-trust"],"exportEndpoints":{"claude":"/api/rules/tetragon-ebpf-breakout-sigkill-enforcement?format=claude","cursorMdc":"/api/rules/tetragon-ebpf-breakout-sigkill-enforcement?format=mdc","cursorrules":"/api/rules/tetragon-ebpf-breakout-sigkill-enforcement?format=cursor","windsurf":"/api/rules/tetragon-ebpf-breakout-sigkill-enforcement?format=windsurf","agents":"/api/rules/tetragon-ebpf-breakout-sigkill-enforcement?format=agents"}},{"id":"otel-collector-tail-sampling-memory-fencing","title":"OpenTelemetry Collector Tail-Based Sampling & Memory Limiter Fencing Standard","category":"devops","severity":"critical","description":"Enforces deterministic pipeline ordering and memory fencing within the OpenTelemetry Collector to prevent OOM panics during high-ingestion spikes while preserving trace completeness for anomalous transactions. Mandates the memory_limiter processor as the first processor in all trace pipelines and sizes buffer windows against container cgroup limits.","antiPatternHeadline":"Placing tail_sampling before memory_limiter or omitting spike boundaries, triggering kernel OOM kills under burst traffic.","stars_count":81,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","observability","kubernetes","resilience","sre"],"exportEndpoints":{"claude":"/api/rules/otel-collector-tail-sampling-memory-fencing?format=claude","cursorMdc":"/api/rules/otel-collector-tail-sampling-memory-fencing?format=mdc","cursorrules":"/api/rules/otel-collector-tail-sampling-memory-fencing?format=cursor","windsurf":"/api/rules/otel-collector-tail-sampling-memory-fencing?format=windsurf","agents":"/api/rules/otel-collector-tail-sampling-memory-fencing?format=agents"}},{"id":"svelte-5-runes-reactivity-boundary-ownership-invariant","title":"Svelte 5 Runes Reactivity Boundary & Ownership Invariant","category":"frontend","severity":"critical","description":"Enforces strict state ownership and unidirectional data flow within Svelte 5 Runes architectures. Prohibits state mutation inside $effect runes and forbids leaking mutable reactive proxies across decoupled micro-frontend boundaries to eliminate infinite update loops and non-deterministic state synchronization.","antiPatternHeadline":"Mutating $state inside $effect Runes and Leaking Mutable Reactive Proxies Across Micro-Frontend Boundaries","stars_count":119,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","micro-frontends","state-management","architecture"],"exportEndpoints":{"claude":"/api/rules/svelte-5-runes-reactivity-boundary-ownership-invariant?format=claude","cursorMdc":"/api/rules/svelte-5-runes-reactivity-boundary-ownership-invariant?format=mdc","cursorrules":"/api/rules/svelte-5-runes-reactivity-boundary-ownership-invariant?format=cursor","windsurf":"/api/rules/svelte-5-runes-reactivity-boundary-ownership-invariant?format=windsurf","agents":"/api/rules/svelte-5-runes-reactivity-boundary-ownership-invariant?format=agents"}},{"id":"vite-6-rolldown-mfe-chunk-invariant-guardrail","title":"Vite 6 / Rolldown Micro-Frontend Federation Chunk Invariant Guardrail","category":"frontend","severity":"critical","description":"Enforces strict sub-resource integrity (SRI), singleton-instance runtime locking, and resilient version skew mitigation across distributed Module Federation remotes powered by Vite 6 and Rolldown. Prevents catastrophic chunk drift, dual-react runtime crashes, and man-in-the-middle poisoning across dynamically fetched remote entry points.","antiPatternHeadline":"Dynamic Unpinned Federation Manifest Ingestion with Split Singletons and Missing SRI Hashes","stars_count":78,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","vite6","rolldown","micro-frontends","module-federation","sri","singletons"],"exportEndpoints":{"claude":"/api/rules/vite-6-rolldown-mfe-chunk-invariant-guardrail?format=claude","cursorMdc":"/api/rules/vite-6-rolldown-mfe-chunk-invariant-guardrail?format=mdc","cursorrules":"/api/rules/vite-6-rolldown-mfe-chunk-invariant-guardrail?format=cursor","windsurf":"/api/rules/vite-6-rolldown-mfe-chunk-invariant-guardrail?format=windsurf","agents":"/api/rules/vite-6-rolldown-mfe-chunk-invariant-guardrail?format=agents"}},{"id":"pg17-bounded-cdc-replication-slots-guardrail","title":"PostgreSQL 17 Streaming I/O and Bounded CDC Replication Slot Architecture","category":"backend","severity":"critical","description":"Enforces deterministic boundaries on logical decoding replication slots and leverages PostgreSQL 17 streaming I/O capabilities to eliminate unconstrained Write-Ahead Log (WAL) disk exhaustion. Prevents transaction catalog bloat and replica stalls by enforcing hard WAL retention ceilings, proactive slot invalidation handlers, and non-blocking asynchronous WAL consumption.","antiPatternHeadline":"Unbounded Logical Replication Slots Causing WAL Disk Saturation and Engine Deadlock","stars_count":79,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql-17","cdc","streaming-io","database-reliability","wal-retention"],"exportEndpoints":{"claude":"/api/rules/pg17-bounded-cdc-replication-slots-guardrail?format=claude","cursorMdc":"/api/rules/pg17-bounded-cdc-replication-slots-guardrail?format=mdc","cursorrules":"/api/rules/pg17-bounded-cdc-replication-slots-guardrail?format=cursor","windsurf":"/api/rules/pg17-bounded-cdc-replication-slots-guardrail?format=windsurf","agents":"/api/rules/pg17-bounded-cdc-replication-slots-guardrail?format=agents"}},{"id":"axum-08-tower-backpressure-adaptive-concurrency","title":"Axum 0.8 Deterministic Tower Backpressure and Adaptive Concurrency Limiting","category":"backend","severity":"critical","description":"Enforces deterministic tail latency and graceful connection shedding in Axum 0.8 workloads under saturated HTTP/3 and WebSocket conditions. Mandates the correct ordering of Tower middleware to isolate unbuffered TCP/QUIC streams and prevent unbounded task allocation during load spikes. Requires integration of adaptive concurrency limiting algorithms with fast-reject 503 responses before connection handshakes occur.","antiPatternHeadline":"Unbounded Task Spawning and Unordered Tower Layers Inducing Memory Blowup and Latency Cascades","stars_count":106,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tower","concurrency","http3","websockets"],"exportEndpoints":{"claude":"/api/rules/axum-08-tower-backpressure-adaptive-concurrency?format=claude","cursorMdc":"/api/rules/axum-08-tower-backpressure-adaptive-concurrency?format=mdc","cursorrules":"/api/rules/axum-08-tower-backpressure-adaptive-concurrency?format=cursor","windsurf":"/api/rules/axum-08-tower-backpressure-adaptive-concurrency?format=windsurf","agents":"/api/rules/axum-08-tower-backpressure-adaptive-concurrency?format=agents"}},{"id":"bun-worker-zero-copy-transfer-standard","title":"Bun 1.2 Multi-Threaded Worker Zero-Copy Buffer Ownership Standard","category":"backend","severity":"critical","description":"Enforces strict transfer list semantics and zero-copy ArrayBuffer ownership handoffs across Bun 1.2 multi-threaded Web Worker isolates. Eliminates multi-gigabyte memory fragmentation, heap cloning thrash, and garbage collection stop-the-world pauses in high-throughput data processing pipelines. Mandates explicit transfer list registration, post-transfer neutered checks, and typed buffer lifecycle management.","antiPatternHeadline":"Implicit Structured Cloning of Large TypedArrays and Shared Memory Leaks Across Worker Isolate Boundaries","stars_count":60,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","workers","concurrency","performance","memory-management"],"exportEndpoints":{"claude":"/api/rules/bun-worker-zero-copy-transfer-standard?format=claude","cursorMdc":"/api/rules/bun-worker-zero-copy-transfer-standard?format=mdc","cursorrules":"/api/rules/bun-worker-zero-copy-transfer-standard?format=cursor","windsurf":"/api/rules/bun-worker-zero-copy-transfer-standard?format=windsurf","agents":"/api/rules/bun-worker-zero-copy-transfer-standard?format=agents"}},{"id":"tauri-v2-ipc-capability-sandboxing-production-standard","title":"Tauri 2.0 Fine-Grained IPC Capabilities & Webview Sandboxing","category":"mobile","severity":"critical","description":"Enforces explicit compile-time capability scoping and origin isolation for Tauri 2.0 mobile architectures. Disallows wildcard native plugin permissions and unpartitioned webview access across Android and iOS execution contexts. Mandates deterministic per-window permission sets to eliminate native privilege escalation vulnerabilities from compromised web contexts.","antiPatternHeadline":"Permissive Wildcard Plugin Bindings and Global Webview Capabilities in Mobile Native IPC","stars_count":95,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri-2","security","ipc","sandboxing","ios","android"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-ipc-capability-sandboxing-production-standard?format=claude","cursorMdc":"/api/rules/tauri-v2-ipc-capability-sandboxing-production-standard?format=mdc","cursorrules":"/api/rules/tauri-v2-ipc-capability-sandboxing-production-standard?format=cursor","windsurf":"/api/rules/tauri-v2-ipc-capability-sandboxing-production-standard?format=windsurf","agents":"/api/rules/tauri-v2-ipc-capability-sandboxing-production-standard?format=agents"}},{"id":"kmp-skie-coroutines-swift-concurrency-standard","title":"Kotlin Multiplatform SKIE Coroutines & Swift Concurrency Invariant Standard","category":"mobile","severity":"critical","description":"Enforces strict cooperative cancellation, structured concurrency lifecycles, and bounded dispatcher execution across the Touchlab SKIE interop bridge. Prohibits orphaned Kotlin coroutines, thread pool exhaustion, and unmanaged background tasks caused by detached or non-cooperative Swift Task execution.","antiPatternHeadline":"Orphaned Kotlin Coroutines and Dispatcher Exhaustion via Unstructured Swift Concurrency","stars_count":70,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","skie","swift-concurrency","coroutines","ios"],"exportEndpoints":{"claude":"/api/rules/kmp-skie-coroutines-swift-concurrency-standard?format=claude","cursorMdc":"/api/rules/kmp-skie-coroutines-swift-concurrency-standard?format=mdc","cursorrules":"/api/rules/kmp-skie-coroutines-swift-concurrency-standard?format=cursor","windsurf":"/api/rules/kmp-skie-coroutines-swift-concurrency-standard?format=windsurf","agents":"/api/rules/kmp-skie-coroutines-swift-concurrency-standard?format=agents"}},{"id":"openfga-rebac-cyclic-graph-latency-quarantine","title":"OpenFGA 1.5 Cyclic Graph Traversal & Latency Quarantine Invariant","category":"security","severity":"critical","description":"Enforces bounded recursive traversal, strict evaluation deadlines, and circuit-breaking latency quarantines for OpenFGA 1.5 ReBAC authorization queries. Prevents unbounded graph walk memory exhaustion and cascading denial-of-service induced by cyclic tuple structures and deep transitive expansions.","antiPatternHeadline":"Unbounded ReBAC Graph Traversal Without Traversal Bounds, Deadlines, or Circuit-Breaker Latency Quarantines","stars_count":107,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","rebac","authorization","zero-trust","circuit-breaker","dos-mitigation"],"exportEndpoints":{"claude":"/api/rules/openfga-rebac-cyclic-graph-latency-quarantine?format=claude","cursorMdc":"/api/rules/openfga-rebac-cyclic-graph-latency-quarantine?format=mdc","cursorrules":"/api/rules/openfga-rebac-cyclic-graph-latency-quarantine?format=cursor","windsurf":"/api/rules/openfga-rebac-cyclic-graph-latency-quarantine?format=windsurf","agents":"/api/rules/openfga-rebac-cyclic-graph-latency-quarantine?format=agents"}},{"id":"webauthn-l3-passkey-attestation-step-up-binding","title":"WebAuthn Level 3 Synced Passkey Attestation & Step-Up Transaction Binding","category":"security","severity":"critical","description":"Enforces strict W3C WebAuthn Level 3 cryptographic verification, distinguishing hardware-bound FIDO2 devices from multi-device synced passkeys via credential backup state checks. Mandates short-lived, transaction-bound cryptographic challenges during step-up re-authentication to prevent session hijacking and adversary-in-the-middle (AiTM) proxy replay attacks.","antiPatternHeadline":"Trusting Bearer Session Tokens for High-Privilege Actions Without Cryptographic Challenge-Response Binding and Backup State Verification","stars_count":70,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","fido2","passkeys","aitm-mitigation","cryptography","session-security"],"exportEndpoints":{"claude":"/api/rules/webauthn-l3-passkey-attestation-step-up-binding?format=claude","cursorMdc":"/api/rules/webauthn-l3-passkey-attestation-step-up-binding?format=mdc","cursorrules":"/api/rules/webauthn-l3-passkey-attestation-step-up-binding?format=cursor","windsurf":"/api/rules/webauthn-l3-passkey-attestation-step-up-binding?format=windsurf","agents":"/api/rules/webauthn-l3-passkey-attestation-step-up-binding?format=agents"}},{"id":"ebpf-tetragon-realtime-syscall-containment-standard","title":"Tetragon In-Kernel Real-Time Syscall Anomaly Containment and Synchronous Sigkill Guardrails","category":"devops","severity":"critical","description":"Enforces synchronous in-kernel containment of unauthorized syscalls, binary executions, and namespace escapes using Cilium Tetragon TracingPolicies. Mandates the deployment of kernel-level Sigkill actions at probe entry to eliminate Time-of-Check to Time-of-Use (TOCTOU) race conditions and prevent user-space latency penalties during security incidents.","antiPatternHeadline":"Audit-Only Logging and Asynchronous User-Space Remediation for High-Risk Runtime Exploits","stars_count":57,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","tetragon","kubernetes-security","runtime-enforcement","zero-trust"],"exportEndpoints":{"claude":"/api/rules/ebpf-tetragon-realtime-syscall-containment-standard?format=claude","cursorMdc":"/api/rules/ebpf-tetragon-realtime-syscall-containment-standard?format=mdc","cursorrules":"/api/rules/ebpf-tetragon-realtime-syscall-containment-standard?format=cursor","windsurf":"/api/rules/ebpf-tetragon-realtime-syscall-containment-standard?format=windsurf","agents":"/api/rules/ebpf-tetragon-realtime-syscall-containment-standard?format=agents"}},{"id":"react-19-server-actions-optimistic-rollback-abort-signal","title":"Deterministic Optimistic Rollback and AbortSignal Lifecycle in React 19 Actions","category":"frontend","severity":"critical","description":"Enforces strict atomicity and deterministic rollback guarantees when orchestrating Server Actions using useOptimistic and useActionState in React 19. Mandates explicit AbortController lifecycle management across concurrent action dispatches to prevent out-of-order state reconciliation and orphaned network requests. Prohibits unbounded optimistic mutations that lack synchronization with native transition boundaries.","antiPatternHeadline":"Unbounded Optimistic UI State with Uncanceled Concurrent Action Mutations","stars_count":113,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","server-actions","useOptimistic","useActionState","concurrency"],"exportEndpoints":{"claude":"/api/rules/react-19-server-actions-optimistic-rollback-abort-signal?format=claude","cursorMdc":"/api/rules/react-19-server-actions-optimistic-rollback-abort-signal?format=mdc","cursorrules":"/api/rules/react-19-server-actions-optimistic-rollback-abort-signal?format=cursor","windsurf":"/api/rules/react-19-server-actions-optimistic-rollback-abort-signal?format=windsurf","agents":"/api/rules/react-19-server-actions-optimistic-rollback-abort-signal?format=agents"}},{"id":"nextjs-15-cache-life-quarantine-boundary","title":"Next.js 15 'use cache' Isolation & Dynamic Route Quarantine Boundary","category":"frontend","severity":"critical","description":"Enforces strict boundary isolation between Next.js 15 'use cache' directives and dynamic runtime inputs. Cached functions must receive primitive, deterministic arguments and quarantine dynamic context accessors like cookies(), headers(), and searchParams to outer consumer boundaries to prevent cross-tenant cache pollution and prerendering bailouts.","antiPatternHeadline":"Coupling Dynamic Runtime Accessors Directly Inside 'use cache' Scopes or Leaking Unsanitized Route Context into Shared Cache Keys","stars_count":51,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs15","use-cache","caching","react-server-components","data-fetching"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-cache-life-quarantine-boundary?format=claude","cursorMdc":"/api/rules/nextjs-15-cache-life-quarantine-boundary?format=mdc","cursorrules":"/api/rules/nextjs-15-cache-life-quarantine-boundary?format=cursor","windsurf":"/api/rules/nextjs-15-cache-life-quarantine-boundary?format=windsurf","agents":"/api/rules/nextjs-15-cache-life-quarantine-boundary?format=agents"}},{"id":"pg17-json-table-zero-copy-ingestion","title":"PostgreSQL 17 JSON_TABLE Zero-Copy Projection & Plan-Cache Safe Ingestion","category":"backend","severity":"critical","description":"Mandates native ANSI SQL/JSON JSON_TABLE projection for high-throughput batch ingestion pipelines on PostgreSQL 17+, completely bypassing Node.js heap allocations and plan-cache invalidation. Eliminates multi-pass jsonb_array_elements / jsonb_to_recordset table-scan overhead by binding payloads to single parameterized JSONB arguments evaluated strictly at the storage engine level.","antiPatternHeadline":"Heap-Bloating In-Memory Batch Transformations and Dynamic Multi-Row SQL Value Construction","stars_count":113,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql-17","json-table","database-performance","sql-json","zero-copy"],"exportEndpoints":{"claude":"/api/rules/pg17-json-table-zero-copy-ingestion?format=claude","cursorMdc":"/api/rules/pg17-json-table-zero-copy-ingestion?format=mdc","cursorrules":"/api/rules/pg17-json-table-zero-copy-ingestion?format=cursor","windsurf":"/api/rules/pg17-json-table-zero-copy-ingestion?format=windsurf","agents":"/api/rules/pg17-json-table-zero-copy-ingestion?format=agents"}},{"id":"axum-stream-decompression-bounded-buffer-limits","title":"Axum 0.8 Decompression Zip-Bomb & Bounded Buffer Guardrail","category":"backend","severity":"critical","description":"Enforces strict dual-stage bounded limits on wire transfers and decompressed streams in Axum 0.8 applications. Prevents catastrophic memory exhaustion and worker thread panics caused by decompression bombs (zip-bombs) and unmetered HTTP chunked transfer encodings.","antiPatternHeadline":"Unbounded Decompressed Body Collection and Misordered Tower Layers Permitting Zip-Bomb OOM","stars_count":113,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","security","dos-prevention","tower-http"],"exportEndpoints":{"claude":"/api/rules/axum-stream-decompression-bounded-buffer-limits?format=claude","cursorMdc":"/api/rules/axum-stream-decompression-bounded-buffer-limits?format=mdc","cursorrules":"/api/rules/axum-stream-decompression-bounded-buffer-limits?format=cursor","windsurf":"/api/rules/axum-stream-decompression-bounded-buffer-limits?format=windsurf","agents":"/api/rules/axum-stream-decompression-bounded-buffer-limits?format=agents"}},{"id":"kmp-swift6-concurrency-actor-bridge","title":"Kotlin Multiplatform to Swift 6 Complete Concurrency & Actor Isolation Bridge","category":"mobile","severity":"critical","description":"Enforces thread-safe bridging between Kotlin Multiplatform (KMP) coroutine primitives and Swift 6 complete concurrency. Swift 6 strict concurrency treats unannotated ObjC/KMP exported symbols as non-Sendable, leading to data races, thread pool exhaustion, or actor isolation compilation errors. This rule mandates explicit @preconcurrency imports, checked Sendable adapters, and thread-affinity hops using Swift Actors and Kotlin StateFlow wrappers.","antiPatternHeadline":"Passing unconstrained KMP mutable references directly into Swift 6 async tasks causing concurrency crashes","stars_count":112,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","swift-6","concurrency","actors","ios","kmp"],"exportEndpoints":{"claude":"/api/rules/kmp-swift6-concurrency-actor-bridge?format=claude","cursorMdc":"/api/rules/kmp-swift6-concurrency-actor-bridge?format=mdc","cursorrules":"/api/rules/kmp-swift6-concurrency-actor-bridge?format=cursor","windsurf":"/api/rules/kmp-swift6-concurrency-actor-bridge?format=windsurf","agents":"/api/rules/kmp-swift6-concurrency-actor-bridge?format=agents"}},{"id":"tauri2-mobile-lifecycle-atomic-state-rehydration","title":"Tauri 2.0 Mobile Lifecycle State Preservation & Cold-Start IPC Rehydration","category":"mobile","severity":"critical","description":"Enforces atomic state synchronization between the webview runtime and native Rust backend during aggressive Android and iOS mobile process reclamation. Prevents volatile UI state loss by utilizing native pause/resume hooks, write-ahead persistent state staging in Rust, and mandatory IPC rehydration gating before webview rendering.","antiPatternHeadline":"Relying on browser-level beforeunload or asynchronous local storage during native OS mobile memory reclamation","stars_count":90,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri-2","rust","ipc","state-management","android","ios"],"exportEndpoints":{"claude":"/api/rules/tauri2-mobile-lifecycle-atomic-state-rehydration?format=claude","cursorMdc":"/api/rules/tauri2-mobile-lifecycle-atomic-state-rehydration?format=mdc","cursorrules":"/api/rules/tauri2-mobile-lifecycle-atomic-state-rehydration?format=cursor","windsurf":"/api/rules/tauri2-mobile-lifecycle-atomic-state-rehydration?format=windsurf","agents":"/api/rules/tauri2-mobile-lifecycle-atomic-state-rehydration?format=agents"}},{"id":"fido-passkey-signal-api-realtime-revocation","title":"FIDO Passkey Signal API Real-Time Revocation & Multi-Device Sync Guardrail","category":"security","severity":"critical","description":"Eliminates phantom credential windows between Relying Parties (RP) and Passkey providers by synchronizing credential deletion, user updates, and device trust states in real time. Mandates atomic revocation lookups during assertion verification and outbound propagation via WebAuthn Signal API and Shared Signals and Events (CAEP/SSF).","antiPatternHeadline":"Asynchronous Unpropagated Passkey Revocation Permitting Phantom Authentication Windows","stars_count":102,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","fido2","passkeys","signal-api","zero-trust","caep"],"exportEndpoints":{"claude":"/api/rules/fido-passkey-signal-api-realtime-revocation?format=claude","cursorMdc":"/api/rules/fido-passkey-signal-api-realtime-revocation?format=mdc","cursorrules":"/api/rules/fido-passkey-signal-api-realtime-revocation?format=cursor","windsurf":"/api/rules/fido-passkey-signal-api-realtime-revocation?format=windsurf","agents":"/api/rules/fido-passkey-signal-api-realtime-revocation?format=agents"}},{"id":"mcp-capability-least-privilege-and-egress-control","title":"Model Context Protocol (MCP) Least-Privilege Capability & Egress Filtration","category":"security","severity":"critical","description":"Enforces strict input validation, capability confinement, and zero-trust outbound egress filtering for all Model Context Protocol (MCP) tool registrations. Mitigates indirect prompt injection, data exfiltration, and SSRF attacks by running tool execution routines in isolated sandboxes with domain-pinned network capabilities. Guarantees that untrusted context cannot dynamically influence destination endpoints, file system access boundaries, or credential dispatch.","antiPatternHeadline":"Unvalidated MCP tool invocation allowing dynamic URLs and unconstrained outbound network requests resulting in data exfiltration","stars_count":88,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","mcp","prompt-injection","ssrf","sandboxing","egress-filtering"],"exportEndpoints":{"claude":"/api/rules/mcp-capability-least-privilege-and-egress-control?format=claude","cursorMdc":"/api/rules/mcp-capability-least-privilege-and-egress-control?format=mdc","cursorrules":"/api/rules/mcp-capability-least-privilege-and-egress-control?format=cursor","windsurf":"/api/rules/mcp-capability-least-privilege-and-egress-control?format=windsurf","agents":"/api/rules/mcp-capability-least-privilege-and-egress-control?format=agents"}},{"id":"otel-ebpf-profiling-span-correlation-standard","title":"OpenTelemetry eBPF Continuous Profiling & Zero-Overhead W3C Span Correlation Standard","category":"devops","severity":"critical","description":"Mandates deterministic kernel-level CPU and memory allocation profiling via eBPF correlated directly to active W3C distributed trace contexts (trace_id, span_id). Enforces preservation of runtime frame pointers, external DWARF symbol retention, and precise Linux kernel capabilities (CAP_PERFMON, CAP_BPF, CAP_SYS_PTRACE) to eliminate blind spots without invasive bytecode runtime overhead.","antiPatternHeadline":"Span-Blind eBPF Profiling Caused by Stripped Frame Pointers and Missing Kernel Correlation Capabilities","stars_count":86,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","ebpf","continuous-profiling","distributed-tracing","performance","kubernetes"],"exportEndpoints":{"claude":"/api/rules/otel-ebpf-profiling-span-correlation-standard?format=claude","cursorMdc":"/api/rules/otel-ebpf-profiling-span-correlation-standard?format=mdc","cursorrules":"/api/rules/otel-ebpf-profiling-span-correlation-standard?format=cursor","windsurf":"/api/rules/otel-ebpf-profiling-span-correlation-standard?format=windsurf","agents":"/api/rules/otel-ebpf-profiling-span-correlation-standard?format=agents"}},{"id":"cilium-ebpf-sidecarless-mtls-spire-standard","title":"Cilium eBPF Sidecarless mTLS with SPIFFE/SPIRE Workload Attestation Guardrail","category":"devops","severity":"critical","description":"Enforces zero-trust cryptographic workload identity and kernel-level mutual TLS via Cilium eBPF and SPIFFE/SPIRE without user-space sidecar proxies. Mandates strict X509-SVID attestation at the host kernel layer to eliminate sidecar latency, memory amplification, and bypass vulnerabilities. Prohibits unauthenticated pod-to-pod network policies and unvalidated fallback transport paths.","antiPatternHeadline":"Injecting latency-heavy sidecars or omitting SPIRE authentication blocks in Cilium Network Policies","stars_count":43,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","cilium","ebpf","spiffe","spire","mtls","zero-trust","kubernetes"],"exportEndpoints":{"claude":"/api/rules/cilium-ebpf-sidecarless-mtls-spire-standard?format=claude","cursorMdc":"/api/rules/cilium-ebpf-sidecarless-mtls-spire-standard?format=mdc","cursorrules":"/api/rules/cilium-ebpf-sidecarless-mtls-spire-standard?format=cursor","windsurf":"/api/rules/cilium-ebpf-sidecarless-mtls-spire-standard?format=windsurf","agents":"/api/rules/cilium-ebpf-sidecarless-mtls-spire-standard?format=agents"}},{"id":"axum-adaptive-concurrency-gradient-load-shedding","title":"Axum 0.8 Adaptive Concurrency & Gradient-Based Dynamic Load Shedding","category":"backend","severity":"critical","description":"Enforces gradient-based dynamic concurrency limits and immediate load shedding in Axum 0.8 Tower service pipelines. Static concurrency caps fail catastrophically during un-batched agentic AI bursts due to extreme RTT variance, causing head-of-line queuing, memory bloat, and cascading timeouts across the service mesh.","antiPatternHeadline":"Hardcoded Static Concurrency Limits & Unbounded Buffering Inducing Latency Collapse","stars_count":57,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tower","load-shedding","backpressure","concurrency-limits"],"exportEndpoints":{"claude":"/api/rules/axum-adaptive-concurrency-gradient-load-shedding?format=claude","cursorMdc":"/api/rules/axum-adaptive-concurrency-gradient-load-shedding?format=mdc","cursorrules":"/api/rules/axum-adaptive-concurrency-gradient-load-shedding?format=cursor","windsurf":"/api/rules/axum-adaptive-concurrency-gradient-load-shedding?format=windsurf","agents":"/api/rules/axum-adaptive-concurrency-gradient-load-shedding?format=agents"}},{"id":"react19-action-optimistic-rollback-boundaries-production-standard","title":"React 19 Action Optimistic Rollback Boundaries and Transactional Revert Invariants","category":"frontend","severity":"critical","description":"Enforces strict transactional rollback boundaries between useActionState and useOptimistic across React 19 asynchronous transitions. Prevents UI-server state divergence, ghost states, and orphaned local mutations during network dropouts, server action rejections, or interrupted concurrent dispatches.","antiPatternHeadline":"Decoupled Local Mutation and Unbounded Optimistic Side-Effects During Failed Server Actions","stars_count":40,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react19","useActionState","useOptimistic","server-actions","state-synchronization"],"exportEndpoints":{"claude":"/api/rules/react19-action-optimistic-rollback-boundaries-production-standard?format=claude","cursorMdc":"/api/rules/react19-action-optimistic-rollback-boundaries-production-standard?format=mdc","cursorrules":"/api/rules/react19-action-optimistic-rollback-boundaries-production-standard?format=cursor","windsurf":"/api/rules/react19-action-optimistic-rollback-boundaries-production-standard?format=windsurf","agents":"/api/rules/react19-action-optimistic-rollback-boundaries-production-standard?format=agents"}},{"id":"kmp-swift-coroutine-lifecycle-scoping","title":"KMP-Swift Coroutine Scoping and ARC Lifecycle Invariant","category":"mobile","severity":"critical","description":"Enforces strict ARC-to-Garbage-Collector lifecycle ownership rules at the Kotlin Multiplatform and Swift boundary. Prevents native iOS retain cycles, zombie tasks, and memory leaks caused by strong references captured inside suspended coroutine continuations and unmanaged Flow collector closures.","antiPatternHeadline":"Bridging Unbounded Kotlin Coroutines Directly to Swift Native Closures Retaining Strong Self References","stars_count":92,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","swift","coroutines","arc","memory-management"],"exportEndpoints":{"claude":"/api/rules/kmp-swift-coroutine-lifecycle-scoping?format=claude","cursorMdc":"/api/rules/kmp-swift-coroutine-lifecycle-scoping?format=mdc","cursorrules":"/api/rules/kmp-swift-coroutine-lifecycle-scoping?format=cursor","windsurf":"/api/rules/kmp-swift-coroutine-lifecycle-scoping?format=windsurf","agents":"/api/rules/kmp-swift-coroutine-lifecycle-scoping?format=agents"}},{"id":"tauri-v2-capability-acl-scoping","title":"Tauri 2.0 Webview Capability ACL Scoping and Least-Privilege Origin Isolation","category":"security","severity":"critical","description":"Enforces strict origin-scoped Access Control List (ACL) manifests and fine-grained capability definitions across all Tauri 2.0 window contexts. Prohibits global wildcards or default-allow capability sets to prevent arbitrary native OS privilege escalation and remote code execution from compromised renderers.","antiPatternHeadline":"Global Capability Wildcarding and Unscoped Plugin Permissions Across Webview Windows","stars_count":93,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","tauri-v2","capabilities","acl","origin-isolation","sandboxing"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-capability-acl-scoping?format=claude","cursorMdc":"/api/rules/tauri-v2-capability-acl-scoping?format=mdc","cursorrules":"/api/rules/tauri-v2-capability-acl-scoping?format=cursor","windsurf":"/api/rules/tauri-v2-capability-acl-scoping?format=windsurf","agents":"/api/rules/tauri-v2-capability-acl-scoping?format=agents"}},{"id":"postgres-17-hnsw-wal-fencing-guardrail","title":"PostgreSQL 17 HNSW Vector Index WAL Fencing and Memory Guardrail","category":"backend","severity":"critical","description":"Enforces strict session-scoped maintenance_work_mem constraints and replication lag fencing during concurrent pgvector HNSW index builds. Mitigates massive write-ahead log (WAL) amplification and prevents logical/physical replica divergence in high-throughput multi-tenant RAG architectures.","antiPatternHeadline":"Unbounded concurrent HNSW index builds flooding WAL pipelines and desynchronizing database replicas","stars_count":48,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres","pgvector","hnsw","rag","database-migration"],"exportEndpoints":{"claude":"/api/rules/postgres-17-hnsw-wal-fencing-guardrail?format=claude","cursorMdc":"/api/rules/postgres-17-hnsw-wal-fencing-guardrail?format=mdc","cursorrules":"/api/rules/postgres-17-hnsw-wal-fencing-guardrail?format=cursor","windsurf":"/api/rules/postgres-17-hnsw-wal-fencing-guardrail?format=windsurf","agents":"/api/rules/postgres-17-hnsw-wal-fencing-guardrail?format=agents"}},{"id":"otel-w3c-baggage-pii-stripping-standard","title":"OpenTelemetry W3C Baggage Ingress Sanitization and PII Redaction","category":"devops","severity":"critical","description":"Enforces strict allowlist validation and deterministic redaction on OpenTelemetry W3C Baggage propagators at all microservice ingress points. Prevents covert data exfiltration and credential leaks by intercepting inbound headers before context propagation across distributed service mesh topologies.","antiPatternHeadline":"Default Pass-Through of Untrusted W3C Baggage Ingress Spilling PII Across Microservices","stars_count":40,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","w3c-baggage","pii-redaction","distributed-tracing","security"],"exportEndpoints":{"claude":"/api/rules/otel-w3c-baggage-pii-stripping-standard?format=claude","cursorMdc":"/api/rules/otel-w3c-baggage-pii-stripping-standard?format=mdc","cursorrules":"/api/rules/otel-w3c-baggage-pii-stripping-standard?format=cursor","windsurf":"/api/rules/otel-w3c-baggage-pii-stripping-standard?format=windsurf","agents":"/api/rules/otel-w3c-baggage-pii-stripping-standard?format=agents"}},{"id":"go-arena-allocation-streaming-invariants","title":"Go 1.24 Bounded Arena Allocation Invariants for Streaming Pipelines","category":"backend","severity":"critical","description":"Enforces strict bounded memory arena lifecycles across high-throughput streaming JSON and gRPC message ingest pipelines in Go 1.24. Eliminates GC pacing pressure and stop-the-world pauses by isolating deserialization graph allocations to disposable arena segments. Guarantees safety by preventing arena-allocated pointer leaks into long-lived state via explicit egress boundary cloning.","antiPatternHeadline":"Leaking Disposable Arena Pointers to Egress Heaps or Escaping Transient Allocations into Global GC Scope","stars_count":44,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","arenas","garbage-collection","grpc","performance","streaming"],"exportEndpoints":{"claude":"/api/rules/go-arena-allocation-streaming-invariants?format=claude","cursorMdc":"/api/rules/go-arena-allocation-streaming-invariants?format=mdc","cursorrules":"/api/rules/go-arena-allocation-streaming-invariants?format=cursor","windsurf":"/api/rules/go-arena-allocation-streaming-invariants?format=windsurf","agents":"/api/rules/go-arena-allocation-streaming-invariants?format=agents"}},{"id":"device-bound-session-credentials-dbsc-standard","title":"Hardware-Enforced Device-Bound Session Credentials (DBSC) Invariant","category":"security","severity":"critical","description":"Enforces strict implementation of Device-Bound Session Credentials (DBSC) by binding HTTP sessions to client-side hardware security modules (TPM or Secure Enclave). Eliminates infostealer malware attack vectors by mandating cryptographic proof-of-possession, ephemeral challenge verification, and short-lived cookie lifetimes on all session refresh operations.","antiPatternHeadline":"Exposing Unbound Long-Lived Bearer Sessions Susceptible to Token Exfiltration","stars_count":48,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","dbsc","cryptography","session-management","zero-trust","hardware-binding"],"exportEndpoints":{"claude":"/api/rules/device-bound-session-credentials-dbsc-standard?format=claude","cursorMdc":"/api/rules/device-bound-session-credentials-dbsc-standard?format=mdc","cursorrules":"/api/rules/device-bound-session-credentials-dbsc-standard?format=cursor","windsurf":"/api/rules/device-bound-session-credentials-dbsc-standard?format=windsurf","agents":"/api/rules/device-bound-session-credentials-dbsc-standard?format=agents"}},{"id":"vite-6-preload-dependency-manifest-pruning","title":"Vite 6 Transitive Modulepreload Pruning for Dynamic Route Manifests","category":"frontend","severity":"critical","description":"Mandates explicit pruning of transitive modulepreload dependencies using Vite 6's build.modulePreload.resolveDependencies API. Prevents browser network saturation and main-thread evaluation waterfalls caused by default unconstrained ESM preload graph generation in complex code-split architectures.","antiPatternHeadline":"Unconstrained Dynamic Route Preloading Causing Transitive Modulepreload Network Flooding","stars_count":46,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","vite","performance","esm","bundle-optimization","modulepreload"],"exportEndpoints":{"claude":"/api/rules/vite-6-preload-dependency-manifest-pruning?format=claude","cursorMdc":"/api/rules/vite-6-preload-dependency-manifest-pruning?format=mdc","cursorrules":"/api/rules/vite-6-preload-dependency-manifest-pruning?format=cursor","windsurf":"/api/rules/vite-6-preload-dependency-manifest-pruning?format=windsurf","agents":"/api/rules/vite-6-preload-dependency-manifest-pruning?format=agents"}},{"id":"cilium-ebpf-wireguard-mutual-auth-standard","title":"Cilium eBPF WireGuard Node-to-Node Mutual Authentication and Encryption Standard","category":"devops","severity":"critical","description":"Enforces strict kernel-level mutual authentication and transparent cryptographic encapsulation using Cilium eBPF and in-kernel WireGuard. Eliminates user-space proxy latency and ensures all inter-node pod and host traffic remains strictly zero-trust and tamper-proof.","antiPatternHeadline":"Unencrypted inter-node transit and fallback configurations exposing overlay traffic to unauthenticated snooping","stars_count":60,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","cilium","ebpf","wireguard","zero-trust","kubernetes","networking"],"exportEndpoints":{"claude":"/api/rules/cilium-ebpf-wireguard-mutual-auth-standard?format=claude","cursorMdc":"/api/rules/cilium-ebpf-wireguard-mutual-auth-standard?format=mdc","cursorrules":"/api/rules/cilium-ebpf-wireguard-mutual-auth-standard?format=cursor","windsurf":"/api/rules/cilium-ebpf-wireguard-mutual-auth-standard?format=windsurf","agents":"/api/rules/cilium-ebpf-wireguard-mutual-auth-standard?format=agents"}},{"id":"nextjs-15-dynamic-io-cache-life-guardrail","title":"Next.js 15 Dynamic I/O & `use cache` Compiler Boundary Invariant","category":"frontend","severity":"critical","description":"Enforces strict structural boundaries between prerendered static layouts and dynamic request-time I/O in Next.js 15 Canary/Dynamic I/O modes. Prohibits direct reads of uncached asynchronous APIs inside shared layout trees and mandates explicit caching scopes using `use cache` paired with `cacheLife` and `cacheTag`. Ensures that runtime fetches are isolated within dynamic Suspense boundaries to eliminate accidental dynamic opt-outs and cascading SSR waterfalls.","antiPatternHeadline":"Awaiting Uncached Request-Scoped Dynamic APIs inside Static Layout Components Triggering Full-Tree Dynamic Bailing and Cascading Waterfalls","stars_count":55,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs15","dynamic-io","react-server-components","caching","performance"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-dynamic-io-cache-life-guardrail?format=claude","cursorMdc":"/api/rules/nextjs-15-dynamic-io-cache-life-guardrail?format=mdc","cursorrules":"/api/rules/nextjs-15-dynamic-io-cache-life-guardrail?format=cursor","windsurf":"/api/rules/nextjs-15-dynamic-io-cache-life-guardrail?format=windsurf","agents":"/api/rules/nextjs-15-dynamic-io-cache-life-guardrail?format=agents"}},{"id":"svelte-5-state-raw-mutation-isolation-guardrail","title":"Svelte 5 Runes $state.raw Mutation Isolation Guardrail","category":"frontend","severity":"critical","description":"Mandates explicit shallow reactivity using `$state.raw` for high-frequency or large-scale streaming datasets to eliminate runaway deep-proxy memory overhead. Enforces complete reference re-assignment when emitting state changes and strictly forbids in-place deep mutations on raw runes. Isolates UI render cycles from high-throughput payload ingestion to guarantee sub-16ms frame budgets in real-time dashboards.","antiPatternHeadline":"Deep Reactive Proxy Poisoning via Deep $state Wrappers on High-Frequency Ingestion Streams","stars_count":53,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","memory-leaks","performance","websockets"],"exportEndpoints":{"claude":"/api/rules/svelte-5-state-raw-mutation-isolation-guardrail?format=claude","cursorMdc":"/api/rules/svelte-5-state-raw-mutation-isolation-guardrail?format=mdc","cursorrules":"/api/rules/svelte-5-state-raw-mutation-isolation-guardrail?format=cursor","windsurf":"/api/rules/svelte-5-state-raw-mutation-isolation-guardrail?format=windsurf","agents":"/api/rules/svelte-5-state-raw-mutation-isolation-guardrail?format=agents"}},{"id":"vite6-environment-api-multi-runtime-sandbox","title":"Vite 6 Multi-Runtime Environment Isolation & Global Sandbox Standard","category":"frontend","severity":"critical","description":"Mandates isolated environment execution contexts using the Vite 6 Environment API across Node.js, Cloudflare Workerd, and Edge runtimes during SSR bundling. Prevents cross-runtime globalThis pollution, leakage of Node.js globals (Buffer, process) into edge isolates, and shared module graph corruption.","antiPatternHeadline":"Monolithic SSR configuration leaking Node.js primitives into Edge/Workerd runtimes via unisolated shared module graphs.","stars_count":48,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","vite6","ssr","workerd","edge-runtime","environment-api"],"exportEndpoints":{"claude":"/api/rules/vite6-environment-api-multi-runtime-sandbox?format=claude","cursorMdc":"/api/rules/vite6-environment-api-multi-runtime-sandbox?format=mdc","cursorrules":"/api/rules/vite6-environment-api-multi-runtime-sandbox?format=cursor","windsurf":"/api/rules/vite6-environment-api-multi-runtime-sandbox?format=windsurf","agents":"/api/rules/vite6-environment-api-multi-runtime-sandbox?format=agents"}},{"id":"axum-hyper-v1-body-cancellation-invariants","title":"Axum/Hyper-v1 Zero-Copy Request Body Cancellation & Memory Invariants","category":"backend","severity":"critical","description":"Enforces deterministic socket teardown, zero-copy buffer disposal, and cancellation safety when consuming streaming request bodies in Axum 0.7+ and Hyper 1.x. Prevents worker thread pinning and dangling TCP connections during aborted multipart uploads by enforcing structured drop mechanics and asynchronous backpressure.","antiPatternHeadline":"Buffering multipart payloads or blocking worker threads during stream consumption, bypassing Hyper's cancellation-driven socket reclamation.","stars_count":63,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","hyper","tokio","zero-copy","async"],"exportEndpoints":{"claude":"/api/rules/axum-hyper-v1-body-cancellation-invariants?format=claude","cursorMdc":"/api/rules/axum-hyper-v1-body-cancellation-invariants?format=mdc","cursorrules":"/api/rules/axum-hyper-v1-body-cancellation-invariants?format=cursor","windsurf":"/api/rules/axum-hyper-v1-body-cancellation-invariants?format=windsurf","agents":"/api/rules/axum-hyper-v1-body-cancellation-invariants?format=agents"}},{"id":"bun-native-connection-pool-thread-safety-guardrail","title":"Bun 1.2 Native Database Driver & Thread-Local Connection Pool Isolation","category":"backend","severity":"critical","description":"Enforces thread-isolated connection pooling and prevents file descriptor corruption in Bun 1.2 runtimes. Native SQLite (bun:sqlite) and Postgres (bun:sql) instances allocate underlying C/Zig memory pointers and OS descriptors that are not safe for cross-worker sharing or concurrent cross-thread mutations. AI agents must enforce strict thread-local connection instantiation or serialize-by-value worker RPC architectures.","antiPatternHeadline":"Sharing Native Database Instances Across Bun Worker Threads Causing FD Corruption and Segfaults","stars_count":102,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","sqlite","postgres","multithreading","workers","database"],"exportEndpoints":{"claude":"/api/rules/bun-native-connection-pool-thread-safety-guardrail?format=claude","cursorMdc":"/api/rules/bun-native-connection-pool-thread-safety-guardrail?format=mdc","cursorrules":"/api/rules/bun-native-connection-pool-thread-safety-guardrail?format=cursor","windsurf":"/api/rules/bun-native-connection-pool-thread-safety-guardrail?format=windsurf","agents":"/api/rules/bun-native-connection-pool-thread-safety-guardrail?format=agents"}},{"id":"kmp-swift-export-native-gc-bridge-boundary","title":"KMP 2.1 Swift Export ARC-Native GC Retain Cycle Elimination Standard","category":"mobile","severity":"critical","description":"Enforces strict memory isolation and decoupled lifecycle boundaries between Swift ARC and Kotlin Native Concurrent GC across KMP 2.1 Swift Export interop. Prevents cross-runtime retain cycles caused by foreign references and unmanaged asynchronous callback capture.","antiPatternHeadline":"Bidirectional ARC-to-Native GC Strong Cycles Locking Interop Memory Graphs","stars_count":69,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kmp","kotlin-native","swift-export","arc","memory-management","concurrency"],"exportEndpoints":{"claude":"/api/rules/kmp-swift-export-native-gc-bridge-boundary?format=claude","cursorMdc":"/api/rules/kmp-swift-export-native-gc-bridge-boundary?format=mdc","cursorrules":"/api/rules/kmp-swift-export-native-gc-bridge-boundary?format=cursor","windsurf":"/api/rules/kmp-swift-export-native-gc-bridge-boundary?format=windsurf","agents":"/api/rules/kmp-swift-export-native-gc-bridge-boundary?format=agents"}},{"id":"tetragon-ebpf-namespace-syscall-enforcement","title":"Cilium Tetragon eBPF In-Kernel Syscall Enforcement and Breakout Prevention","category":"security","severity":"critical","description":"Mandates deterministic, synchronous eBPF kernel-level enforcement via Cilium Tetragon TracingPolicy CRDs to intercept and neutralize container breakout and namespace pivot syscalls (setns, unshare, pivot_root) before kernel state mutations occur. Prohibits relying on passive, asynchronous userspace audit monitoring that triggers after privilege escalation has already executed.","antiPatternHeadline":"Relying on Passive Userspace Audit Logs for Container Breakout Syscalls Instead of In-Kernel eBPF Sigkill Enforcement","stars_count":51,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","cilium","tetragon","ebpf","kubernetes","kernel-hardening","container-escape"],"exportEndpoints":{"claude":"/api/rules/tetragon-ebpf-namespace-syscall-enforcement?format=claude","cursorMdc":"/api/rules/tetragon-ebpf-namespace-syscall-enforcement?format=mdc","cursorrules":"/api/rules/tetragon-ebpf-namespace-syscall-enforcement?format=cursor","windsurf":"/api/rules/tetragon-ebpf-namespace-syscall-enforcement?format=windsurf","agents":"/api/rules/tetragon-ebpf-namespace-syscall-enforcement?format=agents"}},{"id":"opentelemetry-v130-outbox-correlation-standard","title":"OpenTelemetry v1.30 Structured Outbox Trace & Baggage Correlation Standard","category":"devops","severity":"critical","description":"Establishes mandatory OpenTelemetry Semantic Conventions v1.30 messaging standards for transactional outbox persistence and asynchronous message relay streams. Enforces explicit W3C TraceContext and Baggage serialization into outbox table schemas and ensures trace extraction with span links during relay publishing to eliminate telemetry dead zones.","antiPatternHeadline":"Discarded Trace Carriers and Telemetry Dead Zones in Transactional Outbox Workers","stars_count":118,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","semconv-v1.30","distributed-tracing","transactional-outbox","kafka","w3c-trace-context"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-v130-outbox-correlation-standard?format=claude","cursorMdc":"/api/rules/opentelemetry-v130-outbox-correlation-standard?format=mdc","cursorrules":"/api/rules/opentelemetry-v130-outbox-correlation-standard?format=cursor","windsurf":"/api/rules/opentelemetry-v130-outbox-correlation-standard?format=windsurf","agents":"/api/rules/opentelemetry-v130-outbox-correlation-standard?format=agents"}},{"id":"nextjs-15-async-context-boundary-pinning","title":"Next.js 15 Async Context Boundary Pinning and Request-Scope Isolation","category":"frontend","severity":"critical","description":"Enforces strict boundary pinning and lifecycle isolation for Next.js 15 asynchronous request-bound APIs (`cookies()`, `headers()`, `params`, and `searchParams`). Prevents un-memoized promise escapes, dynamic context tearing across concurrent SSR stream chunks, and illegal promise references inside static or memoized cache boundaries.","antiPatternHeadline":"Leaking Raw Request Promises or Module-Level Dynamic Context Across Suspense and Cache Boundaries","stars_count":94,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs-15","async-context","react-server-components","streaming-ssr","concurrency"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-async-context-boundary-pinning?format=claude","cursorMdc":"/api/rules/nextjs-15-async-context-boundary-pinning?format=mdc","cursorrules":"/api/rules/nextjs-15-async-context-boundary-pinning?format=cursor","windsurf":"/api/rules/nextjs-15-async-context-boundary-pinning?format=windsurf","agents":"/api/rules/nextjs-15-async-context-boundary-pinning?format=agents"}},{"id":"vite6-rolldown-module-graph-bailout-guardrail","title":"Vite 6 Rolldown Static ESM Tree-Shaking Bailout Guardrail","category":"frontend","severity":"critical","description":"Enforces strict static ESM purity and explicit side-effect boundary demarcation across hybrid micro-frontend dependencies. Prevents Rolldown from bailing out of module-graph tree-shaking, avoiding duplicate vendor singletons and monolithic runtime chunk generation.","antiPatternHeadline":"Dynamic Interop and Implicit Side Effects Triggering Rolldown Module Graph De-Optimization","stars_count":87,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["vite6","rolldown","tree-shaking","micro-frontends","esm","dead-code-elimination"],"exportEndpoints":{"claude":"/api/rules/vite6-rolldown-module-graph-bailout-guardrail?format=claude","cursorMdc":"/api/rules/vite6-rolldown-module-graph-bailout-guardrail?format=mdc","cursorrules":"/api/rules/vite6-rolldown-module-graph-bailout-guardrail?format=cursor","windsurf":"/api/rules/vite6-rolldown-module-graph-bailout-guardrail?format=windsurf","agents":"/api/rules/vite6-rolldown-module-graph-bailout-guardrail?format=agents"}},{"id":"axum-cancel-safe-body-extraction-drain-standard","title":"Axum 0.8 Cancel-Safe Body Extraction and Drain Standard","category":"backend","severity":"critical","description":"Enforces deterministic cancellation safety and complete HTTP body consumption when processing chunked or multipart streams in Axum 0.8 / Hyper 1.0. Prevents half-open TCP socket leaks, uncollected connection pools, and downstream backpressure deadlocks resulting from client aborts or unhandled error early-returns.","antiPatternHeadline":"Partial body reads and naked select! loops triggering Hyper 1.0 socket exhaustion on early client termination","stars_count":41,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","hyper","tokio","streaming","memory-safety"],"exportEndpoints":{"claude":"/api/rules/axum-cancel-safe-body-extraction-drain-standard?format=claude","cursorMdc":"/api/rules/axum-cancel-safe-body-extraction-drain-standard?format=mdc","cursorrules":"/api/rules/axum-cancel-safe-body-extraction-drain-standard?format=cursor","windsurf":"/api/rules/axum-cancel-safe-body-extraction-drain-standard?format=windsurf","agents":"/api/rules/axum-cancel-safe-body-extraction-drain-standard?format=agents"}},{"id":"postgres-17-direct-io-prefetch-isolation","title":"Postgres 17 Direct I/O and Asynchronous Streaming Read Ring Buffer Isolation","category":"backend","severity":"critical","description":"Enforces strict isolation of analytical sequential reads from the OLTP shared buffer pool using Postgres 17 streaming read APIs and Direct I/O configurations. Prevents kernel page-cache pollution, double-buffering overhead, and BufferMapping lock contention during bulk data access. Mandates dedicated connection routing and session-scoped streaming ring buffers for high-throughput scans.","antiPatternHeadline":"Executing Unconstrained Bulk Scans Over OLTP Pools Causing Buffer-Pool Lock Contention and Cache Thrashing","stars_count":40,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql-17","direct-io","buffer-pool","performance","database-architecture"],"exportEndpoints":{"claude":"/api/rules/postgres-17-direct-io-prefetch-isolation?format=claude","cursorMdc":"/api/rules/postgres-17-direct-io-prefetch-isolation?format=mdc","cursorrules":"/api/rules/postgres-17-direct-io-prefetch-isolation?format=cursor","windsurf":"/api/rules/postgres-17-direct-io-prefetch-isolation?format=windsurf","agents":"/api/rules/postgres-17-direct-io-prefetch-isolation?format=agents"}},{"id":"react-native-bridgeless-turbomodule-jsi-boundary","title":"React Native 0.76 Bridgeless TurboModule JSI Lifetime Boundary Invariant","category":"mobile","severity":"critical","description":"In React Native 0.76 Bridgeless Mode, Hermes GC cycles operate independently from native C++ execution threads. Direct caching or premature deallocation of C++ HostObjects via raw pointers across the JSI boundary leads to memory corruption, dangling pointer access violations (SIGSEGV), and silent data truncation during asynchronous dispatch.","antiPatternHeadline":"Retaining raw pointers to jsi::HostObject or invoking unmarshaled JSI HostFunctions directly across asynchronous native thread dispatch.","stars_count":43,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","react-native","hermes","turbomodules","jsi","c++","concurrency"],"exportEndpoints":{"claude":"/api/rules/react-native-bridgeless-turbomodule-jsi-boundary?format=claude","cursorMdc":"/api/rules/react-native-bridgeless-turbomodule-jsi-boundary?format=mdc","cursorrules":"/api/rules/react-native-bridgeless-turbomodule-jsi-boundary?format=cursor","windsurf":"/api/rules/react-native-bridgeless-turbomodule-jsi-boundary?format=windsurf","agents":"/api/rules/react-native-bridgeless-turbomodule-jsi-boundary?format=agents"}},{"id":"kmp-swift-asyncstream-cancellation-bridge","title":"Kotlin Multiplatform 2.1 Swift AsyncStream Cancellation Bridge Standard","category":"mobile","severity":"critical","description":"Enforces strict cooperative cancellation bridging between Kotlin Coroutines and Swift Concurrency via SKIE or explicit Job termination hooks in AsyncStream.onTermination handlers. Without this invariant, Swift Task aborts leave underlying Kotlin Job hierarchies running indefinitely, causing silent thread pool starvation and memory leaks across the Objective-C/Swift ABI bridge.","antiPatternHeadline":"Orphaned Kotlin Coroutine Jobs Surviving Cancelled Swift AsyncStream Tasks","stars_count":42,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","swift","coroutines","async-await","concurrency"],"exportEndpoints":{"claude":"/api/rules/kmp-swift-asyncstream-cancellation-bridge?format=claude","cursorMdc":"/api/rules/kmp-swift-asyncstream-cancellation-bridge?format=mdc","cursorrules":"/api/rules/kmp-swift-asyncstream-cancellation-bridge?format=cursor","windsurf":"/api/rules/kmp-swift-asyncstream-cancellation-bridge?format=windsurf","agents":"/api/rules/kmp-swift-asyncstream-cancellation-bridge?format=agents"}},{"id":"post-quantum-hybrid-mlkem-tls-ingress-standard","title":"Post-Quantum Hybrid ML-KEM TLS 1.3 Edge Termination Guardrail","category":"security","severity":"critical","description":"Enforces mandatory hybrid post-quantum key exchange (X25519MLKEM768 / X25519Kyber768) and strict TLS 1.3 termination at enterprise ingress boundaries. Preempts 'Harvest Now, Decrypt Later' (HNDL) adversarial decryption attacks while guaranteeing fallback resilience and zero-overhead handshake latency.","antiPatternHeadline":"Permitting Classical-Only TLS 1.2/1.3 Handshakes on Public Edge Ingress Exposing Inbound Payloads to Retroactive Cryptanalysis","stars_count":50,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","cryptography","post-quantum","ml-kem","tls-1-3","fips-203","edge-ingress"],"exportEndpoints":{"claude":"/api/rules/post-quantum-hybrid-mlkem-tls-ingress-standard?format=claude","cursorMdc":"/api/rules/post-quantum-hybrid-mlkem-tls-ingress-standard?format=mdc","cursorrules":"/api/rules/post-quantum-hybrid-mlkem-tls-ingress-standard?format=cursor","windsurf":"/api/rules/post-quantum-hybrid-mlkem-tls-ingress-standard?format=windsurf","agents":"/api/rules/post-quantum-hybrid-mlkem-tls-ingress-standard?format=agents"}},{"id":"ebpf-lsm-container-syscall-whitelist-standard","title":"In-Kernel eBPF LSM Container Syscall Whitelist & Namespace Containment","category":"security","severity":"critical","description":"Mandates deterministic, zero-trust container syscall whitelisting enforced strictly via eBPF Linux Security Module (LSM) hooks bound to cgroupv2 hierarchies. Eliminates Time-of-Check to Time-of-Use (TOCTOU) exploits and container namespace escapes by executing sub-millisecond, synchronous kernel-level authorization checks before execution traverses isolation boundaries. Replaces reactive, post-execution userspace auditing with pre-execution in-kernel denial via negative errno returns.","antiPatternHeadline":"Asynchronous Userspace Tracepoint Auditing or Fragile Blacklist-Based Syscall Filtering","stars_count":57,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","ebpf","lsm","containers","kernel","cgroupv2"],"exportEndpoints":{"claude":"/api/rules/ebpf-lsm-container-syscall-whitelist-standard?format=claude","cursorMdc":"/api/rules/ebpf-lsm-container-syscall-whitelist-standard?format=mdc","cursorrules":"/api/rules/ebpf-lsm-container-syscall-whitelist-standard?format=cursor","windsurf":"/api/rules/ebpf-lsm-container-syscall-whitelist-standard?format=windsurf","agents":"/api/rules/ebpf-lsm-container-syscall-whitelist-standard?format=agents"}},{"id":"otel-arrow-columnar-backpressure-standard","title":"OTel Arrow Columnar Pipeline Memory-Bounded Backpressure Standard","category":"devops","severity":"critical","description":"Enforces strict memory-bounded columnar batching, upstream gRPC backpressure, and deterministic memory limiter positioning in OpenTelemetry Collector topologies utilizing OTel-Arrow. Guarantees that high-throughput columnar transformations (row-to-record conversion) cannot breach container cgroup memory limits during multi-gigabit metric and trace bursts. Mandates early pipeline admission control, bounded stream allocations, and coordinated drain policies across downstream Arrow exporters.","antiPatternHeadline":"Unbounded Arrow In-Memory Record Accumulation with Missing or Misordered Memory Limiter Processors","stars_count":101,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","otel-arrow","backpressure","apache-arrow","observability","kubernetes"],"exportEndpoints":{"claude":"/api/rules/otel-arrow-columnar-backpressure-standard?format=claude","cursorMdc":"/api/rules/otel-arrow-columnar-backpressure-standard?format=mdc","cursorrules":"/api/rules/otel-arrow-columnar-backpressure-standard?format=cursor","windsurf":"/api/rules/otel-arrow-columnar-backpressure-standard?format=windsurf","agents":"/api/rules/otel-arrow-columnar-backpressure-standard?format=agents"}},{"id":"k8s-gateway-api-v1-2-referencegrant-boundary","title":"Enforce Gateway API v1.2 Explicit ReferenceGrant Isolation for Cross-Namespace Routing","category":"devops","severity":"critical","description":"Enforces strict tenant boundary isolation across Kubernetes namespaces by requiring explicit ReferenceGrant resources for all cross-namespace route-to-service and gateway-to-route attachments. Prevents unauthorized lateral traffic escalation and cross-tenant route hijacking by blocking wildcard selectors and unvalidated backend references in Gateway API v1.2 resources.","antiPatternHeadline":"Implicit or Wildcard Cross-Namespace Route Attachment Without Target ReferenceGrant","stars_count":49,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","kubernetes","gateway-api","security","referencegrant","zero-trust"],"exportEndpoints":{"claude":"/api/rules/k8s-gateway-api-v1-2-referencegrant-boundary?format=claude","cursorMdc":"/api/rules/k8s-gateway-api-v1-2-referencegrant-boundary?format=mdc","cursorrules":"/api/rules/k8s-gateway-api-v1-2-referencegrant-boundary?format=cursor","windsurf":"/api/rules/k8s-gateway-api-v1-2-referencegrant-boundary?format=windsurf","agents":"/api/rules/k8s-gateway-api-v1-2-referencegrant-boundary?format=agents"}},{"id":"react-19-server-actions-idempotent-mutation-boundary","title":"React 19 Server Actions Cryptographic Idempotency & State Reconciliation Boundary","category":"frontend","severity":"critical","description":"Enforces cryptographically signed idempotency keys and state reconciliation tokens across React 19 useActionState transitions and Server Actions. Prevents duplicate transactional side effects, phantom re-executions during packet loss, and stale DOM state reconciliation under network degradation or double submissions.","antiPatternHeadline":"Un-fenced Server Actions with Blind Form Submissions Allowing Duplicate Mutations and Desynchronized Action State","stars_count":68,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","server-actions","idempotency","state-reconciliation","distributed-systems"],"exportEndpoints":{"claude":"/api/rules/react-19-server-actions-idempotent-mutation-boundary?format=claude","cursorMdc":"/api/rules/react-19-server-actions-idempotent-mutation-boundary?format=mdc","cursorrules":"/api/rules/react-19-server-actions-idempotent-mutation-boundary?format=cursor","windsurf":"/api/rules/react-19-server-actions-idempotent-mutation-boundary?format=windsurf","agents":"/api/rules/react-19-server-actions-idempotent-mutation-boundary?format=agents"}},{"id":"svelte-5-runes-ssr-cross-request-isolation","title":"Svelte 5 Runes SSR Cross-Request State Leakage Prevention","category":"frontend","severity":"critical","description":"Enforces strict lexical encapsulation of Svelte 5 reactive runes ($state, $derived) within component lifecycles and context trees during Server-Side Rendering (SSR). Module-level mutable state in shared server processes leaks across concurrent multi-tenant requests, causing catastrophic data corruption and security breaches.","antiPatternHeadline":"Global Module-Level Runes Instantiation in Server-Rendered Contexts","stars_count":108,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","sveltekit","runes","ssr","security","multi-tenancy"],"exportEndpoints":{"claude":"/api/rules/svelte-5-runes-ssr-cross-request-isolation?format=claude","cursorMdc":"/api/rules/svelte-5-runes-ssr-cross-request-isolation?format=mdc","cursorrules":"/api/rules/svelte-5-runes-ssr-cross-request-isolation?format=cursor","windsurf":"/api/rules/svelte-5-runes-ssr-cross-request-isolation?format=windsurf","agents":"/api/rules/svelte-5-runes-ssr-cross-request-isolation?format=agents"}},{"id":"openfga-consistency-tokens-event-streams-production-standard","title":"OpenFGA Consistency Token Propagation in Distributed Event Streams","category":"security","severity":"critical","description":"Enforces deterministic read-after-write consistency for Relationship-Based Access Control (ReBAC) checks within distributed event-driven architectures. Mandates that OpenFGA write operations extract and propagate consistency tokens (Zanzibar zookies) through event metadata, requiring downstream asynchronous consumers to pass these tokens into subsequent authorization checks. This eradicates authorization race conditions and security bypasses caused by replication lag and out-of-order event consumption.","antiPatternHeadline":"Unbounded Event-Driven Read-After-Write Race Conditions Leading to Unauthorized Access or False Denials","stars_count":80,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","rebac","openfga","authorization","distributed-systems","kafka"],"exportEndpoints":{"claude":"/api/rules/openfga-consistency-tokens-event-streams-production-standard?format=claude","cursorMdc":"/api/rules/openfga-consistency-tokens-event-streams-production-standard?format=mdc","cursorrules":"/api/rules/openfga-consistency-tokens-event-streams-production-standard?format=cursor","windsurf":"/api/rules/openfga-consistency-tokens-event-streams-production-standard?format=windsurf","agents":"/api/rules/openfga-consistency-tokens-event-streams-production-standard?format=agents"}},{"id":"bun-native-cluster-zero-downtime-reloading","title":"Bun 1.2 Native Cluster Zero-Downtime Hot Reloading and FD Passing","category":"backend","severity":"critical","description":"Enforces strict master-worker IPC handshakes, listening socket migration, and atomic connection draining for Bun 1.2 runtimes. Prevents dropped TCP connections and port collisions during rolling zero-downtime deployments by decoupling process lifecycles via Unix domain socket file descriptor passing and graceful HTTP/WebSocket drain signals.","antiPatternHeadline":"Hard-killing Bun worker processes or binding shared SO_REUSEPORT sockets without an atomic IPC drain handshake","stars_count":44,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","cluster","zero-downtime","ipc","performance"],"exportEndpoints":{"claude":"/api/rules/bun-native-cluster-zero-downtime-reloading?format=claude","cursorMdc":"/api/rules/bun-native-cluster-zero-downtime-reloading?format=mdc","cursorrules":"/api/rules/bun-native-cluster-zero-downtime-reloading?format=cursor","windsurf":"/api/rules/bun-native-cluster-zero-downtime-reloading?format=windsurf","agents":"/api/rules/bun-native-cluster-zero-downtime-reloading?format=agents"}},{"id":"postgres-17-json-table-memory-guardrails","title":"Postgres 17 JSON_TABLE Memory Allocation and Streaming Guardrails","category":"backend","severity":"critical","description":"Enforces strict memory boundaries and deterministic path evaluations for Postgres 17 SQL/JSON JSON_TABLE projections. Unbounded wildcard path traversals and unconstrained joins against high-cardinality JSON collections can exhaust backend private work_mem and trigger OOM terminations. All queries utilizing JSON_TABLE must enforce strict path specifications, deterministic error-handling clauses, and localized work_mem ceilings.","antiPatternHeadline":"Unbounded JSON_TABLE Path Projections Inducing Backend OOM via Unconstrained Tuple Materialization","stars_count":119,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres","sql-json","database","memory-safety","performance"],"exportEndpoints":{"claude":"/api/rules/postgres-17-json-table-memory-guardrails?format=claude","cursorMdc":"/api/rules/postgres-17-json-table-memory-guardrails?format=mdc","cursorrules":"/api/rules/postgres-17-json-table-memory-guardrails?format=cursor","windsurf":"/api/rules/postgres-17-json-table-memory-guardrails?format=windsurf","agents":"/api/rules/postgres-17-json-table-memory-guardrails?format=agents"}},{"id":"fastapi-pydantic-v2-zerocopy-deserialization-guards","title":"FastAPI & Pydantic V2 Zero-Copy Deserialization & Strict Memory Guards","category":"backend","severity":"critical","description":"Enforces Rust-backed strict validation via Pydantic V2's TypeAdapter directly on raw byte buffers, bypassing intermediate Python dictionary allocations and preventing type coercion vulnerabilities. Mandates hard bounded streaming ingest controls to eliminate memory exhaustion and request tampering on multi-gigabit asynchronous endpoints.","antiPatternHeadline":"Unbounded Intermediate Dict Deserialization and Loose Type Coercion Vulnerability","stars_count":61,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["fastapi","pydantic-v2","pydantic-core","zero-copy","performance","memory-management","dos-prevention"],"exportEndpoints":{"claude":"/api/rules/fastapi-pydantic-v2-zerocopy-deserialization-guards?format=claude","cursorMdc":"/api/rules/fastapi-pydantic-v2-zerocopy-deserialization-guards?format=mdc","cursorrules":"/api/rules/fastapi-pydantic-v2-zerocopy-deserialization-guards?format=cursor","windsurf":"/api/rules/fastapi-pydantic-v2-zerocopy-deserialization-guards?format=windsurf","agents":"/api/rules/fastapi-pydantic-v2-zerocopy-deserialization-guards?format=agents"}},{"id":"tauri2-granular-multiwindow-ipc-capability-scoping","title":"Tauri 2.0 Granular Multi-Window IPC Capability Scoping & Privilege Isolation","category":"mobile","severity":"critical","description":"Enforces strict multi-window IPC boundary isolation in Tauri 2.0 by mandating window-specific capability schemas and denying wildcard permissions across webviews. Restricts OS-level plugin permissions through fine-grained capability definitions and runtime window label verification to prevent privilege escalation from untrusted child windows or webview surfaces.","antiPatternHeadline":"Global Window Wildcards and Ambient Plugin Permissions in Multi-Window Tauri Architectures","stars_count":70,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri","security","ipc","rust","capabilities"],"exportEndpoints":{"claude":"/api/rules/tauri2-granular-multiwindow-ipc-capability-scoping?format=claude","cursorMdc":"/api/rules/tauri2-granular-multiwindow-ipc-capability-scoping?format=mdc","cursorrules":"/api/rules/tauri2-granular-multiwindow-ipc-capability-scoping?format=cursor","windsurf":"/api/rules/tauri2-granular-multiwindow-ipc-capability-scoping?format=windsurf","agents":"/api/rules/tauri2-granular-multiwindow-ipc-capability-scoping?format=agents"}},{"id":"capacitor-7-hardware-attestation-sqlite-guardrail","title":"Hardware Enclave Attestation-Gated SQLite Store Initialization","category":"mobile","severity":"critical","description":"Enforces cryptographic hardware-backed attestation (Apple App Attest / Google Play Integrity) verified against an authoritative backend before releasing local SQLCipher decryption keys into memory. Prohibits local-only client trust decisions, hardcoded key derivation parameters, and unencrypted passphrase caching across Capacitor 7 bridge boundaries.","antiPatternHeadline":"Decrypting Local Embedded Databases Using Client-Decided Biometric Checks or Unattested Keystore Material","stars_count":92,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor-7","security","app-attest","play-integrity","sqlcipher","zero-trust"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-hardware-attestation-sqlite-guardrail?format=claude","cursorMdc":"/api/rules/capacitor-7-hardware-attestation-sqlite-guardrail?format=mdc","cursorrules":"/api/rules/capacitor-7-hardware-attestation-sqlite-guardrail?format=cursor","windsurf":"/api/rules/capacitor-7-hardware-attestation-sqlite-guardrail?format=windsurf","agents":"/api/rules/capacitor-7-hardware-attestation-sqlite-guardrail?format=agents"}},{"id":"otel-genai-streaming-spans-boundary-standard","title":"OpenTelemetry GenAI Semantic Streaming Span Boundaries and TTFT Instrumentation","category":"devops","severity":"critical","description":"Standardizes OpenTelemetry GenAI semantic conventions across asynchronous streaming LLM completions and multi-agent pipelines. Mandates strict lifecycle span encapsulation with deterministic TTFT (time-to-first-token) event attribution, token usage recording, and inline zero-allocation PII scrubbing prior to attribute export.","antiPatternHeadline":"Unbounded LLM Streaming Spans with Leaked Tokens, Missing TTFT Events, and Raw PII Export","stars_count":81,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","observability","genai","streaming","llm-agent","pii-sanitization"],"exportEndpoints":{"claude":"/api/rules/otel-genai-streaming-spans-boundary-standard?format=claude","cursorMdc":"/api/rules/otel-genai-streaming-spans-boundary-standard?format=mdc","cursorrules":"/api/rules/otel-genai-streaming-spans-boundary-standard?format=cursor","windsurf":"/api/rules/otel-genai-streaming-spans-boundary-standard?format=windsurf","agents":"/api/rules/otel-genai-streaming-spans-boundary-standard?format=agents"}},{"id":"ebpf-xdp-dsr-flow-invariant-standard","title":"eBPF XDP Direct Server Return (DSR) Flow Invariant & Conntrack Bypass","category":"devops","severity":"critical","description":"Enforces strict bounds verification, stateless encapsulation, and non-linear packet header adjustments within eBPF XDP programs executing Layer-4 Direct Server Return (DSR). Prevents Linux kernel networking stack traversal, sk_buff allocation, and nf_conntrack table exhaustion by guaranteeing hardware/driver-level redirection via XDP_TX or devmap lookups with strict MTU safety.","antiPatternHeadline":"Falling back to Linux netfilter conntrack or mutating L3/L4 payloads without incremental checksum recalculation and verifier-safe head-adjustment.","stars_count":100,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","xdp","dsr","networking","kernel","load-balancer"],"exportEndpoints":{"claude":"/api/rules/ebpf-xdp-dsr-flow-invariant-standard?format=claude","cursorMdc":"/api/rules/ebpf-xdp-dsr-flow-invariant-standard?format=mdc","cursorrules":"/api/rules/ebpf-xdp-dsr-flow-invariant-standard?format=cursor","windsurf":"/api/rules/ebpf-xdp-dsr-flow-invariant-standard?format=windsurf","agents":"/api/rules/ebpf-xdp-dsr-flow-invariant-standard?format=agents"}},{"id":"svelte-5-runes-async-reactivity-isolation-standard","title":"Svelte 5 Runes Universal Reactivity Isolation and Microtask Decoupling","category":"frontend","severity":"critical","description":"Enforces strict boundary isolation between fine-grained Svelte 5 runes ($state, $derived, $effect) and asynchronous microtask/streaming event sources. Prevents UI thread starvation and infinite microtask re-render cycles by decoupling high-frequency ingestion pipelines into staging buffers before synchronizing with reactive signal graphs.","antiPatternHeadline":"Direct asynchronous signal mutation inside high-frequency microtask loops and unthrottled WebSocket callbacks triggering reactive dependency thrashing","stars_count":86,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","reactivity","websockets","performance"],"exportEndpoints":{"claude":"/api/rules/svelte-5-runes-async-reactivity-isolation-standard?format=claude","cursorMdc":"/api/rules/svelte-5-runes-async-reactivity-isolation-standard?format=mdc","cursorrules":"/api/rules/svelte-5-runes-async-reactivity-isolation-standard?format=cursor","windsurf":"/api/rules/svelte-5-runes-async-reactivity-isolation-standard?format=windsurf","agents":"/api/rules/svelte-5-runes-async-reactivity-isolation-standard?format=agents"}},{"id":"vite-6-environment-api-multi-runtime-partitioning","title":"Deterministic Multi-Runtime Module Partitioning via Vite 6 Environment API","category":"frontend","severity":"critical","description":"Enforces strict compilation graph boundaries across client, Node.js SSR, and edge-worker environments using the Vite 6 Environment API. Eliminates cross-runtime pollution, prevents leaked server secrets, and guarantees deterministic module resolution across heterogeneous runtimes without relying on legacy dual-bundle hacks.","antiPatternHeadline":"Monolithic Isomorphic Bundling and Global Runtime Flag Pollution","stars_count":48,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","vite6","environment-api","ssr","bundler","architecture"],"exportEndpoints":{"claude":"/api/rules/vite-6-environment-api-multi-runtime-partitioning?format=claude","cursorMdc":"/api/rules/vite-6-environment-api-multi-runtime-partitioning?format=mdc","cursorrules":"/api/rules/vite-6-environment-api-multi-runtime-partitioning?format=cursor","windsurf":"/api/rules/vite-6-environment-api-multi-runtime-partitioning?format=windsurf","agents":"/api/rules/vite-6-environment-api-multi-runtime-partitioning?format=agents"}},{"id":"pg17-vectorized-io-workmem-partitioning","title":"Postgres 17 Vectorized Streaming I/O and Tenant WorkMem Quota Partitioning","category":"backend","severity":"critical","description":"Postgres 17 introduces vectorized streaming asynchronous sequential read-ahead (AIO) for bulk scans, joins, and aggregates. In multi-tenant environments, unbounded AIO combined with static work_mem permits aggressive analytical scans to monopolize OS page caches and backend execution buffers, resulting in noisy-neighbor starvation. Database client wrappers and transaction orchestrators must enforce dynamic transaction-scoped work_mem caps and bind asynchronous sequential read-ahead buffers strictly to tenant-tier resource profiles before executing analytical workloads.","antiPatternHeadline":"Global Unbounded AIO Read-Ahead with Static WorkMem Inducing Cache Eviction and Multi-Tenant Query Starvation","stars_count":87,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","postgres-17","multi-tenancy","work-mem","async-io","performance"],"exportEndpoints":{"claude":"/api/rules/pg17-vectorized-io-workmem-partitioning?format=claude","cursorMdc":"/api/rules/pg17-vectorized-io-workmem-partitioning?format=mdc","cursorrules":"/api/rules/pg17-vectorized-io-workmem-partitioning?format=cursor","windsurf":"/api/rules/pg17-vectorized-io-workmem-partitioning?format=windsurf","agents":"/api/rules/pg17-vectorized-io-workmem-partitioning?format=agents"}},{"id":"go-chi-context-memory-arena-request-lifetime-binding","title":"Go Chi Context Memory Arena Allocation & Request-Scoped Lifetime Binding","category":"backend","severity":"critical","description":"Enforces strict request-scoped memory arena allocation within Go Chi middleware to eliminate runtime garbage collection overhead during high-throughput microservice traffic spikes. Mandates contiguous arena allocation or reusable byte buffer pools for per-request metadata and strictly forbids persisting arena-allocated pointers beyond the HTTP handler lifetime. Violations result in use-after-free corruption, race conditions across pooled resources, or catastrophic GC pauses from heap escape.","antiPatternHeadline":"Escaping Heap Allocations via Chi Context Value Injection and Arena Pointer Retention Post-Request","stars_count":41,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","golang","chi","memory-arena","zero-allocation","performance"],"exportEndpoints":{"claude":"/api/rules/go-chi-context-memory-arena-request-lifetime-binding?format=claude","cursorMdc":"/api/rules/go-chi-context-memory-arena-request-lifetime-binding?format=mdc","cursorrules":"/api/rules/go-chi-context-memory-arena-request-lifetime-binding?format=cursor","windsurf":"/api/rules/go-chi-context-memory-arena-request-lifetime-binding?format=windsurf","agents":"/api/rules/go-chi-context-memory-arena-request-lifetime-binding?format=agents"}},{"id":"capacitor-7-jsi-thread-safety-zero-copy-guardrail","title":"Capacitor 7 JSI Synchronous Bridge Thread-Safety and Zero-Copy Buffer Isolation","category":"mobile","severity":"critical","description":"Enforces strict thread-affinity boundaries and zero-copy binary buffer swapping across JavaScript and native execution threads in Capacitor 7 JSI plugins. Prevents main-thread UI hitching, memory trashing, and concurrent execution crashes during high-frequency native telemetry streaming by forbidding JSON serialization over the bridge and isolating JSI host function execution to the dedicated JS runtime thread.","antiPatternHeadline":"Marshalling High-Frequency Hardware Telemetry via Serialized Bridge Objects on the Main Thread","stars_count":46,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor7","jsi","thread-safety","zero-copy","performance","telemetry"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-jsi-thread-safety-zero-copy-guardrail?format=claude","cursorMdc":"/api/rules/capacitor-7-jsi-thread-safety-zero-copy-guardrail?format=mdc","cursorrules":"/api/rules/capacitor-7-jsi-thread-safety-zero-copy-guardrail?format=cursor","windsurf":"/api/rules/capacitor-7-jsi-thread-safety-zero-copy-guardrail?format=windsurf","agents":"/api/rules/capacitor-7-jsi-thread-safety-zero-copy-guardrail?format=agents"}},{"id":"react-native-bridgeless-turbomodule-lazy-allocation","title":"React Native Bridgeless TurboModule Lazy Allocation Guardrail","category":"mobile","severity":"critical","description":"Enforces deferred, non-blocking JSI host object resolution and lazy native module allocation in React Native Bridgeless mode. Prohibits top-level synchronous module resolution during JS bundle evaluation to eliminate main-thread C++ runtime instantiation stalls and guarantee sub-second cold starts.","antiPatternHeadline":"Eager TurboModuleRegistry Top-Level Invocation During Bundle Parsing","stars_count":109,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","react-native","turbomodules","bridgeless","jsi","performance"],"exportEndpoints":{"claude":"/api/rules/react-native-bridgeless-turbomodule-lazy-allocation?format=claude","cursorMdc":"/api/rules/react-native-bridgeless-turbomodule-lazy-allocation?format=mdc","cursorrules":"/api/rules/react-native-bridgeless-turbomodule-lazy-allocation?format=cursor","windsurf":"/api/rules/react-native-bridgeless-turbomodule-lazy-allocation?format=windsurf","agents":"/api/rules/react-native-bridgeless-turbomodule-lazy-allocation?format=agents"}},{"id":"cilium-tetragon-namespace-exfiltration-guardrail","title":"Cilium Tetragon Kernel-Level Process Lineage and Namespace Containment Guardrail","category":"security","severity":"critical","description":"Enforces strict eBPF-driven runtime verification of process parentage and Linux namespace boundaries via Cilium Tetragon TracingPolicies. Immediately terminates zero-day breakout attempts—such as unauthorized sys_setns, sys_unshare, and mount namespace tampering—directly in kernel space via SIGKILL before transition execution. Guarantees that container boundary escapes cannot succeed even if container isolation primitives or local capabilities are compromised.","antiPatternHeadline":"Post-Facto Audit-Only Detection of Container Namespace Breakout Syscalls","stars_count":56,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","cilium","tetragon","ebpf","containers","kubernetes","zero-day"],"exportEndpoints":{"claude":"/api/rules/cilium-tetragon-namespace-exfiltration-guardrail?format=claude","cursorMdc":"/api/rules/cilium-tetragon-namespace-exfiltration-guardrail?format=mdc","cursorrules":"/api/rules/cilium-tetragon-namespace-exfiltration-guardrail?format=cursor","windsurf":"/api/rules/cilium-tetragon-namespace-exfiltration-guardrail?format=windsurf","agents":"/api/rules/cilium-tetragon-namespace-exfiltration-guardrail?format=agents"}},{"id":"webauthn-level3-prf-hardware-bound-key-derivation-standard","title":"WebAuthn Level 3 PRF Hardware-Bound Symmetric Key Derivation Standard","category":"security","severity":"critical","description":"Enforces strict implementation standards for WebAuthn Level 3 Pseudo-Random Function (PRF) extension to derive hardware-bound symmetric encryption keys directly from FIDO2/passkey authenticators. Guarantees that sensitive application data cannot be decrypted from exfiltrated memory or stolen browser tokens without active physical presence and explicit hardware token interaction. Mandates secondary key derivation via HKDF with strict domain separation before any derived secret touches application memory.","antiPatternHeadline":"Persisting Raw Symmetric Keys in Browser Storage or Exposing PRF Output Directly to Application State Without HKDF Domain Separation","stars_count":71,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","prf-extension","fido2","webcrypto","zero-trust","passkeys"],"exportEndpoints":{"claude":"/api/rules/webauthn-level3-prf-hardware-bound-key-derivation-standard?format=claude","cursorMdc":"/api/rules/webauthn-level3-prf-hardware-bound-key-derivation-standard?format=mdc","cursorrules":"/api/rules/webauthn-level3-prf-hardware-bound-key-derivation-standard?format=cursor","windsurf":"/api/rules/webauthn-level3-prf-hardware-bound-key-derivation-standard?format=windsurf","agents":"/api/rules/webauthn-level3-prf-hardware-bound-key-derivation-standard?format=agents"}},{"id":"otel-ebpf-profiling-span-exemplar-fusion-standard","title":"OpenTelemetry Continuous Profiling & Trace-Span Exemplar Fusion Standard","category":"devops","severity":"critical","description":"Enforces deterministic correlation between distributed W3C trace contexts and low-level kernel profiling signals (eBPF CPU cycles, off-CPU lock contention, L3 cache misses). Requires bidirectional linkage between continuous profiling frame-sets and OpenTelemetry span exemplars to eliminate latency tail diagnostic opacity.","antiPatternHeadline":"Uncorrelated Continuous Profiling and Siloed Distributed Tracing Without Kernel-Level Exemplar Fusion","stars_count":86,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","ebpf","profiling","distributed-tracing","observability","performance"],"exportEndpoints":{"claude":"/api/rules/otel-ebpf-profiling-span-exemplar-fusion-standard?format=claude","cursorMdc":"/api/rules/otel-ebpf-profiling-span-exemplar-fusion-standard?format=mdc","cursorrules":"/api/rules/otel-ebpf-profiling-span-exemplar-fusion-standard?format=cursor","windsurf":"/api/rules/otel-ebpf-profiling-span-exemplar-fusion-standard?format=windsurf","agents":"/api/rules/otel-ebpf-profiling-span-exemplar-fusion-standard?format=agents"}},{"id":"k8s-1-32-inplace-pod-resizing-boundary-standard","title":"Kubernetes 1.32 In-Place Dynamic Pod Resizing Resource Boundary Standard","category":"devops","severity":"critical","description":"Enforces strict resource boundary invariants and explicit resize policies under Kubernetes 1.32 InPlacePodVerticalScaling. Prevents silent container restarts, eviction cascades, and QoS degradation during automated CPU and memory scaling events.","antiPatternHeadline":"Patching Pod Container Resources Without Explicit Resize Policies or QoS Boundary Checks","stars_count":115,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["kubernetes","k8s-1-32","devops","autoscaling","finops","reliability"],"exportEndpoints":{"claude":"/api/rules/k8s-1-32-inplace-pod-resizing-boundary-standard?format=claude","cursorMdc":"/api/rules/k8s-1-32-inplace-pod-resizing-boundary-standard?format=mdc","cursorrules":"/api/rules/k8s-1-32-inplace-pod-resizing-boundary-standard?format=cursor","windsurf":"/api/rules/k8s-1-32-inplace-pod-resizing-boundary-standard?format=windsurf","agents":"/api/rules/k8s-1-32-inplace-pod-resizing-boundary-standard?format=agents"}},{"id":"svelte5-runes-effect-lifecycle-isolation","title":"Svelte 5 Runes Effect Lifecycle Isolation and Mutation Purity","category":"frontend","severity":"critical","description":"Enforces architectural boundaries for Svelte 5 runes ($effect, $effect.pre, $derived, $state) to eliminate infinite reactive invalidation loops, memory leaks, and race conditions. Mandates pure synchronous derivation via $derived, selective reactive dependency isolation with untrack(), and mandatory disposal teardown closures for all ambient allocations.","antiPatternHeadline":"Synchronous State Mutation and Untracked Side-Effects Inside $effect Causing Cascade Render Loops and Memory Leaks","stars_count":105,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","signals","reactivity","memory-leaks"],"exportEndpoints":{"claude":"/api/rules/svelte5-runes-effect-lifecycle-isolation?format=claude","cursorMdc":"/api/rules/svelte5-runes-effect-lifecycle-isolation?format=mdc","cursorrules":"/api/rules/svelte5-runes-effect-lifecycle-isolation?format=cursor","windsurf":"/api/rules/svelte5-runes-effect-lifecycle-isolation?format=windsurf","agents":"/api/rules/svelte5-runes-effect-lifecycle-isolation?format=agents"}},{"id":"nextjs-15-ppr-dynamic-hole-cache-tag-boundary","title":"Next.js 15 PPR Dynamic Hole and Multi-Tenant Cache-Tag Boundary Guardrail","category":"frontend","severity":"critical","description":"Enforces strict isolation between static edge prerendered shells and dynamic, cookie-dependent streaming subtrees under Next.js 15 Partial Prerendering (PPR). Prevents catastrophic cross-tenant cache contamination, dynamic bailout cascading, and layout tearing by mandating scoped Suspense boundaries and tenant-partitioned cache tags.","antiPatternHeadline":"Baking Dynamic Tenant Context into Static Shells or Sharing Unpartitioned Cache Tags Across PPR Dynamic Holes","stars_count":103,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs15","ppr","suspense","cache-tags","multi-tenant","react-server-components"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-ppr-dynamic-hole-cache-tag-boundary?format=claude","cursorMdc":"/api/rules/nextjs-15-ppr-dynamic-hole-cache-tag-boundary?format=mdc","cursorrules":"/api/rules/nextjs-15-ppr-dynamic-hole-cache-tag-boundary?format=cursor","windsurf":"/api/rules/nextjs-15-ppr-dynamic-hole-cache-tag-boundary?format=windsurf","agents":"/api/rules/nextjs-15-ppr-dynamic-hole-cache-tag-boundary?format=agents"}},{"id":"postgres-17-failover-slot-sync-ha-replication-guardrail","title":"PostgreSQL 17 Logical Replication Slot Failover Synchronization Guardrail","category":"backend","severity":"critical","description":"Enforces strict configuration and application-level handling of PostgreSQL 17 failover-enabled logical replication slots across high-availability physical standby promotions. Prevents change-data-capture message loss, silent stream truncation, and uncoordinated LSN regression during unexpected primary node failovers.","antiPatternHeadline":"Unsynchronized Logical Slots Dropping or Replaying Corrupted Data Streams Post-Failover","stars_count":57,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","postgres-17","replication","cdc","high-availability","kafka"],"exportEndpoints":{"claude":"/api/rules/postgres-17-failover-slot-sync-ha-replication-guardrail?format=claude","cursorMdc":"/api/rules/postgres-17-failover-slot-sync-ha-replication-guardrail?format=mdc","cursorrules":"/api/rules/postgres-17-failover-slot-sync-ha-replication-guardrail?format=cursor","windsurf":"/api/rules/postgres-17-failover-slot-sync-ha-replication-guardrail?format=windsurf","agents":"/api/rules/postgres-17-failover-slot-sync-ha-replication-guardrail?format=agents"}},{"id":"bun-multi-worker-zero-copy-transfer","title":"Bun 1.2 Structured Worker Concurrency and Zero-Copy Buffer Transfer","category":"backend","severity":"critical","description":"Enforces strict zero-copy ownership transfer of typed binary memory between Bun 1.2 workers and the main thread, eliminating IPC serialization latency and memory bloat. Mandates explicit transfer lists in postMessage calls and bounds worker lifecycle management to prevent event-loop stalls during CPU-heavy tasks.","antiPatternHeadline":"Structured Clone Heap Stalls and Detached Buffer Race Conditions","stars_count":95,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","workers","concurrency","performance","memory-management"],"exportEndpoints":{"claude":"/api/rules/bun-multi-worker-zero-copy-transfer?format=claude","cursorMdc":"/api/rules/bun-multi-worker-zero-copy-transfer?format=mdc","cursorrules":"/api/rules/bun-multi-worker-zero-copy-transfer?format=cursor","windsurf":"/api/rules/bun-multi-worker-zero-copy-transfer?format=windsurf","agents":"/api/rules/bun-multi-worker-zero-copy-transfer?format=agents"}},{"id":"go-chi-http3-quic-session-migration-invariants","title":"Go 1.24 Chi HTTP/3 QUIC Resilient Session Migration Architecture","category":"backend","severity":"critical","description":"Enforces transport-agnostic authenticated session lifecycles for Go 1.24 Chi HTTP/3 architectures across network transitions. Eliminates socket reset storms and unauthorized session invalidation during cellular and Wi-Fi handoffs through connection ID stability, stateless reset token configuration, and IP-independent RPC context binding.","antiPatternHeadline":"Pinning Session Authentication and RPC Contexts to Ephemeral Socket 4-Tuples Under HTTP/3 QUIC","stars_count":45,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","http3","quic","chi","session-migration","networking"],"exportEndpoints":{"claude":"/api/rules/go-chi-http3-quic-session-migration-invariants?format=claude","cursorMdc":"/api/rules/go-chi-http3-quic-session-migration-invariants?format=mdc","cursorrules":"/api/rules/go-chi-http3-quic-session-migration-invariants?format=cursor","windsurf":"/api/rules/go-chi-http3-quic-session-migration-invariants?format=windsurf","agents":"/api/rules/go-chi-http3-quic-session-migration-invariants?format=agents"}},{"id":"capacitor-7-secure-enclave-boundary","title":"Capacitor 7 Secure Enclave and Hardware KeyStore Boundary Isolation","category":"mobile","severity":"critical","description":"Enforces cryptographic isolation between untrusted WebView execution contexts and host platform hardware security modules (Apple Secure Enclave, Android StrongBox/TEE KeyStore). Mandates zero-knowledge token handling, platform-side cryptographic signature verification, and direct biometric gatekeeping within native plugins to prevent credential exfiltration from DOM XSS vectors.","antiPatternHeadline":"Exposing Raw Cryptographic Keys or Reusable Biometric Authorization Flags to the Hybrid WebView","stars_count":115,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","security","secure-enclave","keystore","biometrics","cryptography"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-secure-enclave-boundary?format=claude","cursorMdc":"/api/rules/capacitor-7-secure-enclave-boundary?format=mdc","cursorrules":"/api/rules/capacitor-7-secure-enclave-boundary?format=cursor","windsurf":"/api/rules/capacitor-7-secure-enclave-boundary?format=windsurf","agents":"/api/rules/capacitor-7-secure-enclave-boundary?format=agents"}},{"id":"oauth2-dpop-nonce-verification-standard","title":"OAuth 2.1 RFC 9449 DPoP Proof and Nonce Replay Verification Invariant","category":"security","severity":"critical","description":"Enforces RFC 9449 Demonstrating Proof-of-Possession (DPoP) at resource and authorization servers to prevent token theft and replay attacks. Mandates strict cryptographic verification of the ephemeral public key, HTTP method and URI bindings, access token hash (ath) validation, server-directed nonce rotation, and distributed jti replay prevention.","antiPatternHeadline":"Bypassing DPoP proof signature validation, neglecting HTTP method/URI binding, omitting access token hash verification, or allowing jti replay.","stars_count":102,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","oauth2","dpop","rfc9449","jwt","cryptography"],"exportEndpoints":{"claude":"/api/rules/oauth2-dpop-nonce-verification-standard?format=claude","cursorMdc":"/api/rules/oauth2-dpop-nonce-verification-standard?format=mdc","cursorrules":"/api/rules/oauth2-dpop-nonce-verification-standard?format=cursor","windsurf":"/api/rules/oauth2-dpop-nonce-verification-standard?format=windsurf","agents":"/api/rules/oauth2-dpop-nonce-verification-standard?format=agents"}},{"id":"envoy-gateway-wasm-oci-sandbox-verification-guardrail","title":"Envoy Gateway Wasm OCI Dynamic Module Sandbox & Cryptographic Verification","category":"security","severity":"critical","description":"Enforces strict memory isolation, resource ceilings, and cryptographic supply-chain verification for dynamic WebAssembly (Wasm) filters loaded from OCI registries into Envoy Gateway data planes. Prevents noisy-neighbor OOM host crashes and remote code execution by requiring Cosign/Notary v2 digest pinning and explicit V8/Wasmtime linear memory constraints before filter initialization.","antiPatternHeadline":"Loading Unsigned Wasm Modules with Uncapped Virtual Memory Across Envoy Filter Chains","stars_count":85,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","envoy-gateway","wasm","oci","sandboxing","supply-chain"],"exportEndpoints":{"claude":"/api/rules/envoy-gateway-wasm-oci-sandbox-verification-guardrail?format=claude","cursorMdc":"/api/rules/envoy-gateway-wasm-oci-sandbox-verification-guardrail?format=mdc","cursorrules":"/api/rules/envoy-gateway-wasm-oci-sandbox-verification-guardrail?format=cursor","windsurf":"/api/rules/envoy-gateway-wasm-oci-sandbox-verification-guardrail?format=windsurf","agents":"/api/rules/envoy-gateway-wasm-oci-sandbox-verification-guardrail?format=agents"}},{"id":"opentelemetry-arrow-columnar-ingestion-standard","title":"OpenTelemetry Arrow Columnar Ingestion and Streaming Protocol Standard","category":"devops","severity":"critical","description":"Mandates columnar Apache Arrow encoding (OTel-Arrow) for high-throughput, high-cardinality telemetry pipelines spanning network or availability-zone boundaries. Enforces dictionary encoding, bounded stream memory buffers, and graceful fallback to avoid crippling cross-AZ egress costs and collector heap exhaustion.","antiPatternHeadline":"Transporting High-Volume Telemetry via Standard Row-Oriented OTLP Protobuf Over Cost-Sensitive Egress Links","stars_count":57,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","apache-arrow","observability","finops","grpc","collector"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-arrow-columnar-ingestion-standard?format=claude","cursorMdc":"/api/rules/opentelemetry-arrow-columnar-ingestion-standard?format=mdc","cursorrules":"/api/rules/opentelemetry-arrow-columnar-ingestion-standard?format=cursor","windsurf":"/api/rules/opentelemetry-arrow-columnar-ingestion-standard?format=windsurf","agents":"/api/rules/opentelemetry-arrow-columnar-ingestion-standard?format=agents"}},{"id":"k8s-dra-gpu-partitioning-invariant","title":"Kubernetes Dynamic Resource Allocation (DRA) GPU Partitioning Invariant","category":"devops","severity":"critical","description":"Enforces deterministic, structured GPU hardware slicing via Kubernetes Dynamic Resource Allocation (DRA) ResourceSlices and structured parameters rather than uncoordinated device plugin sharing or unpartitioned nvidia.com/gpu limits. Eliminates noisy-neighbor compute and high-bandwidth memory (HBM) cache contention across collocated AI inference workloads by strictly bounding MIG or spatial GPU partitions at scheduling time.","antiPatternHeadline":"Uncoordinated Device Plugin GPU Over-subscription and Unpartitioned Integer Device Allocation","stars_count":118,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","kubernetes","dynamic-resource-allocation","gpu-partitioning","ai-inference","resource-management"],"exportEndpoints":{"claude":"/api/rules/k8s-dra-gpu-partitioning-invariant?format=claude","cursorMdc":"/api/rules/k8s-dra-gpu-partitioning-invariant?format=mdc","cursorrules":"/api/rules/k8s-dra-gpu-partitioning-invariant?format=cursor","windsurf":"/api/rules/k8s-dra-gpu-partitioning-invariant?format=windsurf","agents":"/api/rules/k8s-dra-gpu-partitioning-invariant?format=agents"}},{"id":"react-19-streaming-metadata-reconciliation-standard","title":"Deterministic React 19 Document Metadata Reconciliation in Distributed Streaming Runtimes","category":"frontend","severity":"critical","description":"Mandates the strict adoption of native React 19 metadata hoisting semantics across nested React Server Components (RSC) to guarantee zero layout shift (CLS) and deterministic deduplication. Prohibits legacy client-side mutation abstractions (e.g., react-helmet, next/head, direct DOM manipulation) that cause hydration mismatches and uncoordinated flushes during edge streaming. Enforces explicit precedence hierarchies on hoisted resource links to ensure atomic rendering and eliminate Flash of Unstyled Content (FOUC).","antiPatternHeadline":"Mutating document metadata via client-side effects or legacy wrappers during edge streaming","stars_count":77,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","rsc","metadata","streaming-ssr","edge-runtime","performance"],"exportEndpoints":{"claude":"/api/rules/react-19-streaming-metadata-reconciliation-standard?format=claude","cursorMdc":"/api/rules/react-19-streaming-metadata-reconciliation-standard?format=mdc","cursorrules":"/api/rules/react-19-streaming-metadata-reconciliation-standard?format=cursor","windsurf":"/api/rules/react-19-streaming-metadata-reconciliation-standard?format=windsurf","agents":"/api/rules/react-19-streaming-metadata-reconciliation-standard?format=agents"}},{"id":"openfga-zanzibar-distributed-cache-invalidation-standard","title":"OpenFGA Zanzibar Distributed Cache Invalidation & Consistency Guardrail","category":"security","severity":"critical","description":"Enforces strict causal consistency and atomic edge PDP cache invalidation during OpenFGA relationship tuple mutations. Prohibits heuristic TTL-based authorization caching for mutation-sensitive paths to eliminate stale read windows and privilege escalation vulnerabilities across distributed clusters.","antiPatternHeadline":"Heuristic TTL Authorization Caching and Unversioned Asynchronous Edge Reads Permitting Revoked Access Retention","stars_count":99,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","zanzibar","authorization","distributed-systems","cache-invalidation"],"exportEndpoints":{"claude":"/api/rules/openfga-zanzibar-distributed-cache-invalidation-standard?format=claude","cursorMdc":"/api/rules/openfga-zanzibar-distributed-cache-invalidation-standard?format=mdc","cursorrules":"/api/rules/openfga-zanzibar-distributed-cache-invalidation-standard?format=cursor","windsurf":"/api/rules/openfga-zanzibar-distributed-cache-invalidation-standard?format=windsurf","agents":"/api/rules/openfga-zanzibar-distributed-cache-invalidation-standard?format=agents"}},{"id":"pg17-incremental-backup-block-tracking-invariants","title":"PostgreSQL 17 Incremental Backup & WAL Summarization Invariants","category":"backend","severity":"critical","description":"Enforces continuous write-ahead log (WAL) summarization and deterministic block-level delta tracking in PostgreSQL 17 to prevent full-table relation scans during multi-terabyte backups. Eliminates I/O freeze windows and checkpoint spikes by asserting backup manifest chain continuity and validating WAL summary ranges prior to pg_combinebackup execution. Protects high-throughput transactional engines from catastrophic recovery latency and disk bandwidth saturation.","antiPatternHeadline":"Executing Unverified Basebackups or Severing WAL Summarization Chains Leading to Catastrophic Full I/O Re-Scans","stars_count":63,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","pg17","database-recovery","wal-summarization","disaster-recovery"],"exportEndpoints":{"claude":"/api/rules/pg17-incremental-backup-block-tracking-invariants?format=claude","cursorMdc":"/api/rules/pg17-incremental-backup-block-tracking-invariants?format=mdc","cursorrules":"/api/rules/pg17-incremental-backup-block-tracking-invariants?format=cursor","windsurf":"/api/rules/pg17-incremental-backup-block-tracking-invariants?format=windsurf","agents":"/api/rules/pg17-incremental-backup-block-tracking-invariants?format=agents"}},{"id":"capacitor-7-biometric-keystore-isolation-standard","title":"Capacitor 7 Biometric Hardware-Backed Keystore Isolation & Non-Exportability","category":"mobile","severity":"critical","description":"Enforces strict isolation between hardware security enclaves (iOS Secure Enclave, Android StrongBox/TEE) and Capacitor 7 WebView runtimes. Cryptographic private keys and raw biometric secrets must remain strictly non-exportable within the native hardware module, allowing only detached digital signatures or short-lived assertion tokens to traverse the bridge into the web execution context.","antiPatternHeadline":"Exporting raw cryptographic secrets, private keys, or long-lived authentication payloads into Capacitor WebView memory","stars_count":86,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor-7","biometrics","security","cryptography","keychain","android-keystore"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-biometric-keystore-isolation-standard?format=claude","cursorMdc":"/api/rules/capacitor-7-biometric-keystore-isolation-standard?format=mdc","cursorrules":"/api/rules/capacitor-7-biometric-keystore-isolation-standard?format=cursor","windsurf":"/api/rules/capacitor-7-biometric-keystore-isolation-standard?format=windsurf","agents":"/api/rules/capacitor-7-biometric-keystore-isolation-standard?format=agents"}},{"id":"fastapi-lifespan-state-graceful-draining-standard","title":"FastAPI Lifespan State Graceful Draining & Signal Invariance","category":"backend","severity":"critical","description":"Enforces deterministic teardown of connection pools and active asynchronous worker tasks within ASGI lifespan contexts during container SIGTERM signals. Prevents abrupt socket termination, unhandled CancelledError leaks, and state corruption across Kubernetes zero-downtime rolling deploys.","antiPatternHeadline":"Premature Resource Destruction and Fire-and-Forget Task Severance in Deprecated Event Handlers","stars_count":98,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","python","asyncio","kubernetes","resilience"],"exportEndpoints":{"claude":"/api/rules/fastapi-lifespan-state-graceful-draining-standard?format=claude","cursorMdc":"/api/rules/fastapi-lifespan-state-graceful-draining-standard?format=mdc","cursorrules":"/api/rules/fastapi-lifespan-state-graceful-draining-standard?format=cursor","windsurf":"/api/rules/fastapi-lifespan-state-graceful-draining-standard?format=windsurf","agents":"/api/rules/fastapi-lifespan-state-graceful-draining-standard?format=agents"}},{"id":"bun-ffi-pointer-ownership-guardrail","title":"Deterministic Bun 1.2 Native FFI Pointer Ownership and Memory Safety Guardrail","category":"backend","severity":"critical","description":"Enforces strict pointer lifetime management and explicit foreign heap deallocation semantics when interfacing with native dynamic libraries via Bun 1.2 `bun:ffi`. Prevents use-after-free, unmanaged memory leaks across event loop turns, and V8/JSC garbage collector desynchronization by strictly mandating explicit lifetime wrapping, finalization registration, and asynchronous boundary protection.","antiPatternHeadline":"Escaping Raw FFI Pointers Across Asynchronous Event Loop Ticks Without Explicit Heap Ownership or Finalization","stars_count":107,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","ffi","memory-safety","pointer-ownership","systems-programming"],"exportEndpoints":{"claude":"/api/rules/bun-ffi-pointer-ownership-guardrail?format=claude","cursorMdc":"/api/rules/bun-ffi-pointer-ownership-guardrail?format=mdc","cursorrules":"/api/rules/bun-ffi-pointer-ownership-guardrail?format=cursor","windsurf":"/api/rules/bun-ffi-pointer-ownership-guardrail?format=windsurf","agents":"/api/rules/bun-ffi-pointer-ownership-guardrail?format=agents"}},{"id":"ebpf-ring-buffer-backpressure-sampling-guardrails","title":"Deterministic Dynamic Drop-Sampling & Ring Buffer Backpressure Guardrails for eBPF Observability","category":"devops","severity":"critical","description":"Enforces adaptive drop-sampling and closed-loop backpressure regulation between user-space telemetry collectors and kernel eBPF ring buffers. Guarantees deterministic backpressure signaling during multi-gigabit partition storms to prevent unmonitored ring buffer exhaustion and kernel event loss.","antiPatternHeadline":"Unthrottled Static Ingestion Leading to Silent Kernel Ring Buffer Drops and Out-of-Memory Collector Cascades","stars_count":86,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","observability","networking","backpressure","telemetry","performance"],"exportEndpoints":{"claude":"/api/rules/ebpf-ring-buffer-backpressure-sampling-guardrails?format=claude","cursorMdc":"/api/rules/ebpf-ring-buffer-backpressure-sampling-guardrails?format=mdc","cursorrules":"/api/rules/ebpf-ring-buffer-backpressure-sampling-guardrails?format=cursor","windsurf":"/api/rules/ebpf-ring-buffer-backpressure-sampling-guardrails?format=windsurf","agents":"/api/rules/ebpf-ring-buffer-backpressure-sampling-guardrails?format=agents"}},{"id":"kmp-compose-metal-vulkan-zero-copy-bridge","title":"Zero-Copy Native Texture Ingestion for KMP Compose Multiplatform","category":"mobile","severity":"critical","description":"Enforces hardware-backed zero-copy texture sharing between platform-native rendering pipelines (AVFoundation/Metal on Apple, AHardwareBuffer/Vulkan on Android) and Compose Multiplatform's Skiko rasterization layer. Prohibits CPU heap allocation, readbacks, and synchronous GPU fence stalls to guarantee sustained 60/120 FPS performance.","antiPatternHeadline":"Intermediate CPU Heap Readback and Synchronous GPU Stalls in Texture Render Loops","stars_count":90,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kmp","compose-multiplatform","metal","vulkan","skiko","zero-copy"],"exportEndpoints":{"claude":"/api/rules/kmp-compose-metal-vulkan-zero-copy-bridge?format=claude","cursorMdc":"/api/rules/kmp-compose-metal-vulkan-zero-copy-bridge?format=mdc","cursorrules":"/api/rules/kmp-compose-metal-vulkan-zero-copy-bridge?format=cursor","windsurf":"/api/rules/kmp-compose-metal-vulkan-zero-copy-bridge?format=windsurf","agents":"/api/rules/kmp-compose-metal-vulkan-zero-copy-bridge?format=agents"}},{"id":"k8s-dra-gpu-partitioning-standard","title":"Deterministic Kubernetes Dynamic Resource Allocation (DRA) GPU Partitioning & Slicing","category":"devops","severity":"critical","description":"Mandates declarative ResourceClaimTemplates and structured DeviceClass primitives under Kubernetes Dynamic Resource Allocation (DRA) for multi-tenant GPU workloads. Prohibits legacy opaque resource counters (e.g., nvidia.com/gpu) and brittle environment injections that induce severe hardware fragmentation. Enforces zero-fragmentation bin-packing, exact compute/memory slicing, and NVLink topology preservation across heterogeneous AI/ML clusters.","antiPatternHeadline":"Monolithic Legacy GPU Requests with Ad-Hoc Runtime Environment Slicing","stars_count":45,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","kubernetes","gpu","dra","resource-claims","ai-infrastructure"],"exportEndpoints":{"claude":"/api/rules/k8s-dra-gpu-partitioning-standard?format=claude","cursorMdc":"/api/rules/k8s-dra-gpu-partitioning-standard?format=mdc","cursorrules":"/api/rules/k8s-dra-gpu-partitioning-standard?format=cursor","windsurf":"/api/rules/k8s-dra-gpu-partitioning-standard?format=windsurf","agents":"/api/rules/k8s-dra-gpu-partitioning-standard?format=agents"}},{"id":"nextjs-15-ppr-streaming-boundary-guardrail","title":"Next.js 15 Partial Prerendering (PPR) Streaming Boundary Guardrail","category":"frontend","severity":"critical","description":"Enforces strict isolation of dynamic runtime contexts from static prerender shells in Next.js 15 Partial Prerendering (PPR) architectures. Prevents dynamic request-time APIs (cookies, headers, searchParams, and uncached data fetches) from de-optimizing prerendered HTML shells into full dynamic request rendering or leaking request-bound state across concurrent streams.","antiPatternHeadline":"Dynamic Context Leakage into Static Shells via Unguarded Request APIs","stars_count":68,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs","ppr","react-server-components","streaming","suspense"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-ppr-streaming-boundary-guardrail?format=claude","cursorMdc":"/api/rules/nextjs-15-ppr-streaming-boundary-guardrail?format=mdc","cursorrules":"/api/rules/nextjs-15-ppr-streaming-boundary-guardrail?format=cursor","windsurf":"/api/rules/nextjs-15-ppr-streaming-boundary-guardrail?format=windsurf","agents":"/api/rules/nextjs-15-ppr-streaming-boundary-guardrail?format=agents"}},{"id":"bun-sqlite-wal-lease-concurrency","title":"Deterministic WAL Transaction Leasing for Bun 1.2 Native SQLite","category":"backend","severity":"critical","description":"Prevents transient write lock starvation (`SQLITE_BUSY`) and phantom dirty reads across multi-threaded worker pools in Bun 1.2. Mandates explicit busy-timeout configurations, synchronous transaction lease queues with deterministic rollback boundaries, and strict WAL write checkpoint isolation.","antiPatternHeadline":"Ad-Hoc Unsynchronized Write Transactions Causing SQLITE_BUSY Cascades and Unbounded Thread Pool Starvation","stars_count":91,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","sqlite","wal-mode","concurrency","transactions"],"exportEndpoints":{"claude":"/api/rules/bun-sqlite-wal-lease-concurrency?format=claude","cursorMdc":"/api/rules/bun-sqlite-wal-lease-concurrency?format=mdc","cursorrules":"/api/rules/bun-sqlite-wal-lease-concurrency?format=cursor","windsurf":"/api/rules/bun-sqlite-wal-lease-concurrency?format=windsurf","agents":"/api/rules/bun-sqlite-wal-lease-concurrency?format=agents"}},{"id":"capacitor-7-background-task-sqlite-reconciliation","title":"Capacitor 7 Background Task Execution State Reconciliation & SQLite Ledger Atomicity","category":"mobile","severity":"critical","description":"Enforces deterministic state reconciliation and atomic SQLite ledger transactions during Capacitor 7 background execution cycles. Mandates a defensive 25-second abort boundary to prevent OS-level SIGKILLs (enforcing iOS/Android 30-second execution caps) and guarantees zero-dangling write-ahead logs (WAL).","antiPatternHeadline":"Unbounded async reconciliation inside background workers leading to mid-transaction OS SIGKILL and SQLite WAL ledger corruption.","stars_count":72,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["capacitor-7","sqlite","background-task","mobile","ios","android","offline-first"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-background-task-sqlite-reconciliation?format=claude","cursorMdc":"/api/rules/capacitor-7-background-task-sqlite-reconciliation?format=mdc","cursorrules":"/api/rules/capacitor-7-background-task-sqlite-reconciliation?format=cursor","windsurf":"/api/rules/capacitor-7-background-task-sqlite-reconciliation?format=windsurf","agents":"/api/rules/capacitor-7-background-task-sqlite-reconciliation?format=agents"}},{"id":"kmp-2-1-native-stateflow-concurrency-barrier","title":"KMP 2.1 Native StateFlow & Swift Concurrency Memory Safety Barrier","category":"mobile","severity":"critical","description":"Enforces thread-confined mutation and deterministic cancellation barriers when exposing Kotlin StateFlow/SharedFlow to Apple platforms via Swift Concurrency (async/await and AsyncSequence). Prevents undefined native memory corruption, stale reference leaks, and actor re-entrancy races across the Kotlin Native GC and Swift Cooperative Thread Pool boundary in Kotlin 2.1.","antiPatternHeadline":"Direct Swift Observation of Mutable Kotlin StateFlow Across Actor Contexts Without Lifecycle Cancellation and MainActor Enforcement","stars_count":111,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","kmp","swift-concurrency","coroutines","ios","memory-safety"],"exportEndpoints":{"claude":"/api/rules/kmp-2-1-native-stateflow-concurrency-barrier?format=claude","cursorMdc":"/api/rules/kmp-2-1-native-stateflow-concurrency-barrier?format=mdc","cursorrules":"/api/rules/kmp-2-1-native-stateflow-concurrency-barrier?format=cursor","windsurf":"/api/rules/kmp-2-1-native-stateflow-concurrency-barrier?format=windsurf","agents":"/api/rules/kmp-2-1-native-stateflow-concurrency-barrier?format=agents"}},{"id":"ebpf-tc-spiffe-zero-trust-ingress-standard","title":"eBPF TC Ingress Zero-Trust SPIFFE Identity Verification & Session Offload","category":"security","severity":"critical","description":"Enforces pre-userspace kernel verification of mutual TLS (mTLS) session state and SPIFFE ID mapping directly at the Traffic Control (TC) ingress hook. Prevents unauthorized packets from traversing socket buffers into userspace sidecars (e.g., Envoy) by dropping unauthenticated traffic with BPF_DROP and caching validated SPIFFE Subject Alternative Names (SANs) in locked BPF map entries.","antiPatternHeadline":"Bypassing Kernel Ingress Validation by Relying Exclusively on Userspace Envoy Proxy Handshakes","stars_count":117,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","ebpf","tc-ingress","spiffe","zero-trust","kernel","linux"],"exportEndpoints":{"claude":"/api/rules/ebpf-tc-spiffe-zero-trust-ingress-standard?format=claude","cursorMdc":"/api/rules/ebpf-tc-spiffe-zero-trust-ingress-standard?format=mdc","cursorrules":"/api/rules/ebpf-tc-spiffe-zero-trust-ingress-standard?format=cursor","windsurf":"/api/rules/ebpf-tc-spiffe-zero-trust-ingress-standard?format=windsurf","agents":"/api/rules/ebpf-tc-spiffe-zero-trust-ingress-standard?format=agents"}},{"id":"oci-v1-1-referrers-intoto-attestation-invariant","title":"OCI v1.1 Referrers In-Toto Cryptographic Attestation Invariant","category":"devops","severity":"critical","description":"Enforces pre-execution verification of SLSA provenance and CycloneDX/SPDX SBOM chains via OCI v1.1 Referrers API trees directly against container registries. Prohibits container execution on orchestration nodes if cryptographic signatures, root-of-trust transparency log proofs, or in-toto predicate digests fail verification before runtime instantiation. Guarantees end-to-end supply chain integrity by decoupling verification logic from unverified ephemeral container host state.","antiPatternHeadline":"Mutating or instantiating images based on unverified digest assertions without traversing and verifying the OCI v1.1 subject referrer tree","stars_count":40,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","oci-v1-1","supply-chain","sigstore","in-toto","attestation","cosign","admission-control"],"exportEndpoints":{"claude":"/api/rules/oci-v1-1-referrers-intoto-attestation-invariant?format=claude","cursorMdc":"/api/rules/oci-v1-1-referrers-intoto-attestation-invariant?format=mdc","cursorrules":"/api/rules/oci-v1-1-referrers-intoto-attestation-invariant?format=cursor","windsurf":"/api/rules/oci-v1-1-referrers-intoto-attestation-invariant?format=windsurf","agents":"/api/rules/oci-v1-1-referrers-intoto-attestation-invariant?format=agents"}},{"id":"k8s-gateway-v1-2-cross-namespace-tls-referencegrant","title":"Mandatory ReferenceGrant Scoping for Gateway API Cross-Namespace TLS Delegation","category":"devops","severity":"critical","description":"Enforces strict, least-privilege ReferenceGrant policies for cross-namespace Secret and Gateway references under Kubernetes Gateway API v1.2. Prevents multi-tenant credential harvesting and Route hijacking by forbidding wildcard namespace matches and unbounded cross-namespace certificate bindings. Invariants require explicit namespace and resource-kind authorization pairings at all ingress trust boundaries.","antiPatternHeadline":"Unvalidated Cross-Namespace TLS Secret Reference Without Explicit Target-Namespace ReferenceGrant","stars_count":56,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","kubernetes","gateway-api","security","referencegrant","multi-tenancy"],"exportEndpoints":{"claude":"/api/rules/k8s-gateway-v1-2-cross-namespace-tls-referencegrant?format=claude","cursorMdc":"/api/rules/k8s-gateway-v1-2-cross-namespace-tls-referencegrant?format=mdc","cursorrules":"/api/rules/k8s-gateway-v1-2-cross-namespace-tls-referencegrant?format=cursor","windsurf":"/api/rules/k8s-gateway-v1-2-cross-namespace-tls-referencegrant?format=windsurf","agents":"/api/rules/k8s-gateway-v1-2-cross-namespace-tls-referencegrant?format=agents"}},{"id":"react-19-streaming-metadata-hoisting-hydration-guardrail","title":"Deterministic Metadata Hoisting and Rehydration Safety in React 19 Streaming SSR","category":"frontend","severity":"critical","description":"Enforces strict adherence to React 19 native document metadata hoisting semantics and asset prioritization during streaming SSR. Prevents client-server hydration mismatch errors, stylesheet cascade order corruption, and redundant script re-execution when asynchronous Suspense boundaries resolve out-of-order.","antiPatternHeadline":"Imperative Head Mutation and Missing Precedence in Streaming Suspense Boundaries","stars_count":109,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","ssr","streaming","hydration","metadata","concurrency"],"exportEndpoints":{"claude":"/api/rules/react-19-streaming-metadata-hoisting-hydration-guardrail?format=claude","cursorMdc":"/api/rules/react-19-streaming-metadata-hoisting-hydration-guardrail?format=mdc","cursorrules":"/api/rules/react-19-streaming-metadata-hoisting-hydration-guardrail?format=cursor","windsurf":"/api/rules/react-19-streaming-metadata-hoisting-hydration-guardrail?format=windsurf","agents":"/api/rules/react-19-streaming-metadata-hoisting-hydration-guardrail?format=agents"}},{"id":"axum-0-8-async-cancellation-stream-isolation","title":"Axum 0.8 Tower Service Async Cancellation Safety and Stream Isolation","category":"backend","severity":"critical","description":"Enforces strict cancellation safety and state isolation in Axum 0.8 and Tower services when handling streaming HTTP bodies and chunked client responses. Prevents state corruption, partial distributed commits, and resource leaks caused by Tokio futures being abruptly dropped upon downstream client disconnections.","antiPatternHeadline":"Executing non-atomic multi-step side effects across await points inside cancellable HTTP body streams","stars_count":73,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tower","tokio","async-safety","concurrency"],"exportEndpoints":{"claude":"/api/rules/axum-0-8-async-cancellation-stream-isolation?format=claude","cursorMdc":"/api/rules/axum-0-8-async-cancellation-stream-isolation?format=mdc","cursorrules":"/api/rules/axum-0-8-async-cancellation-stream-isolation?format=cursor","windsurf":"/api/rules/axum-0-8-async-cancellation-stream-isolation?format=windsurf","agents":"/api/rules/axum-0-8-async-cancellation-stream-isolation?format=agents"}},{"id":"bun-websocket-backpressure-highwatermark","title":"Bun 1.2 Native WebSocket Backpressure and High-Watermark Drain Management","category":"backend","severity":"critical","description":"Enforces strict per-socket buffered amount verification and cooperative backpressure in Bun 1.2 native WebSockets. Mandates drain lifecycle handler implementation and high-watermark boundaries to eliminate unbounded heap growth and process-level OOM crashes during high-throughput message fanouts.","antiPatternHeadline":"Unchecked ws.send() Loop Fanout Leading to Silent Buffer Bloat and Fatal OOM Disruption","stars_count":112,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","websockets","backpressure","memory-management","performance"],"exportEndpoints":{"claude":"/api/rules/bun-websocket-backpressure-highwatermark?format=claude","cursorMdc":"/api/rules/bun-websocket-backpressure-highwatermark?format=mdc","cursorrules":"/api/rules/bun-websocket-backpressure-highwatermark?format=cursor","windsurf":"/api/rules/bun-websocket-backpressure-highwatermark?format=windsurf","agents":"/api/rules/bun-websocket-backpressure-highwatermark?format=agents"}},{"id":"tauri-v2-mobile-ipc-capability-scoping","title":"Tauri 2.0 Mobile Webview IPC Capability Isolation & Permission Scoping","category":"mobile","severity":"critical","description":"Enforces granular, least-privilege capability manifests in Tauri 2.0 mobile architectures by strictly mapping native permissions to explicit webview identifiers. Prohibits global wildcards across multi-webview environments to eliminate privilege escalation vectors from unverified mobile webview contexts.","antiPatternHeadline":"Broadcasting Global Wildcard Permissions to All Webview Contexts via Permissive Capability Manifests","stars_count":111,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri-2","security","ipc","rust","capabilities"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-mobile-ipc-capability-scoping?format=claude","cursorMdc":"/api/rules/tauri-v2-mobile-ipc-capability-scoping?format=mdc","cursorrules":"/api/rules/tauri-v2-mobile-ipc-capability-scoping?format=cursor","windsurf":"/api/rules/tauri-v2-mobile-ipc-capability-scoping?format=windsurf","agents":"/api/rules/tauri-v2-mobile-ipc-capability-scoping?format=agents"}},{"id":"capacitor-7-background-task-watchdog-resiliency","title":"Capacitor 7 Background Task Suspension Boundaries and Watchdog Resiliency","category":"mobile","severity":"critical","description":"Mandates deterministic background execution lifecycles and atomic persistence boundaries during Capacitor 7 app suspension. Prevents OS watchdog terminations (e.g., iOS 0x8badf00d, Android ANR) and half-written state by bounding background operations within strict hardware timeouts and guaranteed task completion tokens.","antiPatternHeadline":"Unbounded Async Operations and Non-Atomic Persistence in App Suspension Callbacks","stars_count":110,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","capacitor-7","background-task","ios-watchdog","lifecycle","persistence"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-background-task-watchdog-resiliency?format=claude","cursorMdc":"/api/rules/capacitor-7-background-task-watchdog-resiliency?format=mdc","cursorrules":"/api/rules/capacitor-7-background-task-watchdog-resiliency?format=cursor","windsurf":"/api/rules/capacitor-7-background-task-watchdog-resiliency?format=windsurf","agents":"/api/rules/capacitor-7-background-task-watchdog-resiliency?format=agents"}},{"id":"openfga-cycle-safe-contextual-traversal-guardrail","title":"OpenFGA 1.6 Cycle-Safe Contextual Tuple Traversal and Depth Bounding","category":"security","severity":"critical","description":"Enforces strict bounded graph traversal and cycle prevention when evaluating OpenFGA 1.6 relationship checks with contextual tuples. Prevents recursive graph lookups, contextual tuple thrashing, and denial-of-service (DoS) latency spikes caused by circular graph hierarchies in high-concurrency ReBAC environments.","antiPatternHeadline":"Injecting Unbounded or Cyclic Contextual Tuples into OpenFGA Check API Inducing Graph Explosion","stars_count":110,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","rebac","authorization","zero-trust","graph-traversal"],"exportEndpoints":{"claude":"/api/rules/openfga-cycle-safe-contextual-traversal-guardrail?format=claude","cursorMdc":"/api/rules/openfga-cycle-safe-contextual-traversal-guardrail?format=mdc","cursorrules":"/api/rules/openfga-cycle-safe-contextual-traversal-guardrail?format=cursor","windsurf":"/api/rules/openfga-cycle-safe-contextual-traversal-guardrail?format=windsurf","agents":"/api/rules/openfga-cycle-safe-contextual-traversal-guardrail?format=agents"}},{"id":"fapi2-dpop-nonce-replay-token-binding","title":"FAPI 2.0 DPoP Nonce Replay Prevention and Asymmetric Token Binding","category":"security","severity":"critical","description":"Enforces RFC 9449 Demonstrating Proof-of-Possession (DPoP) and FAPI 2.0 security profile invariants across OAuth 2.0 token issuance and resource access. Prevents token replay, credential theft, and man-in-the-middle attacks by mandating cryptographic key-binding of access tokens via the 'cnf.jkt' thumbprint claim and strictly validating server-supplied single-use nonces with jitter-bounded clock drift.","antiPatternHeadline":"Accepting Unbound Bearer Tokens or Permitting Unvalidated, Cached, or Replayed DPoP Proofs","stars_count":102,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","fapi2","dpop","rfc9449","oauth2","jwt","cryptography","zero-trust"],"exportEndpoints":{"claude":"/api/rules/fapi2-dpop-nonce-replay-token-binding?format=claude","cursorMdc":"/api/rules/fapi2-dpop-nonce-replay-token-binding?format=mdc","cursorrules":"/api/rules/fapi2-dpop-nonce-replay-token-binding?format=cursor","windsurf":"/api/rules/fapi2-dpop-nonce-replay-token-binding?format=windsurf","agents":"/api/rules/fapi2-dpop-nonce-replay-token-binding?format=agents"}},{"id":"otel-tail-sampling-memory-buffer-guardrails","title":"OpenTelemetry Collector Tail-Based Sampling Memory Buffer Guardrails","category":"devops","severity":"critical","description":"Enforces strict memory bounds, ingestion load shedding, and decoupled pipeline queues for OpenTelemetry Collector tail-based sampling configurations. Prevents Out-Of-Memory (OOM) fatal crashes and head-of-line blocking during multi-second trace evaluation windows under high span cardinality. Guarantees predictable trace aggregation buffers by strictly harmonizing `memory_limiter`, `num_traces`, `expected_new_traces_per_sec`, and pipeline batch size constraints.","antiPatternHeadline":"Unbounded Trace Aggregation Buffering with Missing Memory Limiting and Downstream Pipeline Lockup","stars_count":48,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","observability","tail-sampling","kubernetes","resilience"],"exportEndpoints":{"claude":"/api/rules/otel-tail-sampling-memory-buffer-guardrails?format=claude","cursorMdc":"/api/rules/otel-tail-sampling-memory-buffer-guardrails?format=mdc","cursorrules":"/api/rules/otel-tail-sampling-memory-buffer-guardrails?format=cursor","windsurf":"/api/rules/otel-tail-sampling-memory-buffer-guardrails?format=windsurf","agents":"/api/rules/otel-tail-sampling-memory-buffer-guardrails?format=agents"}},{"id":"cilium-spiffe-spire-ebpf-mtls-attestation","title":"Cilium 1.16 SPIFFE/SPIRE eBPF-Accelerated Workload Identity Attestation","category":"devops","severity":"critical","description":"Mandates cryptographic zero-trust mutual authentication using Cilium 1.16 integrated with SPIRE/SPIFFE workload identity attestation. Enforces kernel-level eBPF connection orchestration with control-plane X.509 SVID validation without injecting resource-heavy sidecar proxies.","antiPatternHeadline":"Unattested L3/L4 Network Policies or Legacy Sidecar Proxy Injection for Inter-Pod mTLS","stars_count":57,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["cilium","spiffe","spire","ebpf","mtls","zero-trust","kubernetes","devops"],"exportEndpoints":{"claude":"/api/rules/cilium-spiffe-spire-ebpf-mtls-attestation?format=claude","cursorMdc":"/api/rules/cilium-spiffe-spire-ebpf-mtls-attestation?format=mdc","cursorrules":"/api/rules/cilium-spiffe-spire-ebpf-mtls-attestation?format=cursor","windsurf":"/api/rules/cilium-spiffe-spire-ebpf-mtls-attestation?format=windsurf","agents":"/api/rules/cilium-spiffe-spire-ebpf-mtls-attestation?format=agents"}},{"id":"react-19-rsc-taint-boundary-standard","title":"React 19 Server Component Taint Boundary & Secret Isolation Standard","category":"frontend","severity":"critical","description":"Enforces compiler-level isolation of sensitive credentials, tenant metadata, and database records across React Server Component (RSC) serialization boundaries. Mandates the registration of taint primitives to block inadvertent transmission of server-only secrets to client component trees or Flight payload serializations.","antiPatternHeadline":"Exposing Raw Server-Side Entities and Auth Tokens Directly to Client Components","stars_count":88,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","rsc","taint-api","security","nextjs","tenant-isolation"],"exportEndpoints":{"claude":"/api/rules/react-19-rsc-taint-boundary-standard?format=claude","cursorMdc":"/api/rules/react-19-rsc-taint-boundary-standard?format=mdc","cursorrules":"/api/rules/react-19-rsc-taint-boundary-standard?format=cursor","windsurf":"/api/rules/react-19-rsc-taint-boundary-standard?format=windsurf","agents":"/api/rules/react-19-rsc-taint-boundary-standard?format=agents"}},{"id":"tanstack-start-cryptographic-rpc-binding","title":"TanStack Start Cryptographic RPC Binding and Manifest Decoupling","category":"frontend","severity":"critical","description":"Guarantees tamper-proof remote procedure invocation in TanStack Start by cryptographically signing server function IDs and strictly decoupling client-side route hydration manifests. Prevents unauthorized endpoint enumeration, payload tampering, and arbitrary remote code execution via forged RPC call descriptors.","antiPatternHeadline":"Invoking Naked Server Functions Without Cryptographic Attestation and Schema Invariants","stars_count":100,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","tanstack-start","rpc-security","server-functions","cryptography","hydration-manifest"],"exportEndpoints":{"claude":"/api/rules/tanstack-start-cryptographic-rpc-binding?format=claude","cursorMdc":"/api/rules/tanstack-start-cryptographic-rpc-binding?format=mdc","cursorrules":"/api/rules/tanstack-start-cryptographic-rpc-binding?format=cursor","windsurf":"/api/rules/tanstack-start-cryptographic-rpc-binding?format=windsurf","agents":"/api/rules/tanstack-start-cryptographic-rpc-binding?format=agents"}},{"id":"axum-0-8-structured-async-stream-cancellation-guardrail","title":"Axum 0.8 Structured Async Stream Cancellation and Resource Leakage Guardrail","category":"backend","severity":"critical","description":"Mandates deterministic cancellation propagation from Axum 0.8 HTTP streaming responses down to database cursors, channel consumers, and Tokio tasks. Prevents orphan background tasks, pinned database connection pools, and memory leaks when clients prematurely disconnect or abort TCP connections.","antiPatternHeadline":"Detached Tokio Spawns and Unchecked Stream Consumers Causing Silent DB Connection Exhaustion on TCP Client Drop","stars_count":116,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tokio","async","sqlx","concurrency"],"exportEndpoints":{"claude":"/api/rules/axum-0-8-structured-async-stream-cancellation-guardrail?format=claude","cursorMdc":"/api/rules/axum-0-8-structured-async-stream-cancellation-guardrail?format=mdc","cursorrules":"/api/rules/axum-0-8-structured-async-stream-cancellation-guardrail?format=cursor","windsurf":"/api/rules/axum-0-8-structured-async-stream-cancellation-guardrail?format=windsurf","agents":"/api/rules/axum-0-8-structured-async-stream-cancellation-guardrail?format=agents"}},{"id":"nextjs-15-ppr-dynamic-boundary-standard","title":"Next.js 15 PPR Dynamic Boundary & Suspense Micro-Segmentation Standard","category":"frontend","severity":"critical","description":"Enforces strict structural boundaries between static pre-rendered shells and streaming dynamic micro-segments under Next.js 15 Partial Prerendering (PPR). Prevents dynamic runtime access (cookies, headers, searchParams, and uncached fetches) from leaking past React Suspense barriers, preserving instant edge delivery and preventing unhandled waterfall suspensions under high-concurrency loads.","antiPatternHeadline":"Dynamic Runtime Leakage De-optimizing Static PPR Edge Shells via Top-Level Async Execution","stars_count":41,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs","react","partial-prerendering","suspense","streaming","performance"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-ppr-dynamic-boundary-standard?format=claude","cursorMdc":"/api/rules/nextjs-15-ppr-dynamic-boundary-standard?format=mdc","cursorrules":"/api/rules/nextjs-15-ppr-dynamic-boundary-standard?format=cursor","windsurf":"/api/rules/nextjs-15-ppr-dynamic-boundary-standard?format=windsurf","agents":"/api/rules/nextjs-15-ppr-dynamic-boundary-standard?format=agents"}},{"id":"vite6-environment-api-ssr-sandboxing","title":"Vite 6 Environment API Multi-Runtime SSR Sandboxing Standard","category":"frontend","severity":"critical","description":"Mandates strict module graph isolation and runtime sandboxing across heterogeneous targets (Node.js, Bun, Edge/Workerd) using Vite 6's Environment API. Prohibits global pollution and legacy monolithic ssrLoadModule execution patterns that cause cross-runtime leakage during SSR compilation and evaluation.","antiPatternHeadline":"Leaking Host Node.js Globals and Sharing Monolithic Module Graphs Across Heterogeneous SSR Runtimes","stars_count":79,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","vite6","ssr","environment-api","sandboxing","edge-workers","multi-runtime"],"exportEndpoints":{"claude":"/api/rules/vite6-environment-api-ssr-sandboxing?format=claude","cursorMdc":"/api/rules/vite6-environment-api-ssr-sandboxing?format=mdc","cursorrules":"/api/rules/vite6-environment-api-ssr-sandboxing?format=cursor","windsurf":"/api/rules/vite6-environment-api-ssr-sandboxing?format=windsurf","agents":"/api/rules/vite6-environment-api-ssr-sandboxing?format=agents"}},{"id":"axum-0-8-http2-goaway-graceful-draining","title":"Axum 0.8 HTTP/2 GOAWAY Graceful Connection Draining Invariant","category":"backend","severity":"critical","description":"Guarantees zero-loss rolling updates under orchestrator lifecycle events by enforcing deterministic HTTP/2 GOAWAY frame sequencing and read-side socket draining before orchestrator SIGKILL deadlines. Prevents in-flight request termination, connection reset errors (RST_STREAM/ECONNRESET), and upstream 502 Bad Gateway responses during Kubernetes container retirement.","antiPatternHeadline":"Dropping the server future immediately upon SIGTERM or omitting bounded HTTP/2 connection drain timeouts","stars_count":101,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","hyper","http2","kubernetes","graceful-shutdown"],"exportEndpoints":{"claude":"/api/rules/axum-0-8-http2-goaway-graceful-draining?format=claude","cursorMdc":"/api/rules/axum-0-8-http2-goaway-graceful-draining?format=mdc","cursorrules":"/api/rules/axum-0-8-http2-goaway-graceful-draining?format=cursor","windsurf":"/api/rules/axum-0-8-http2-goaway-graceful-draining?format=windsurf","agents":"/api/rules/axum-0-8-http2-goaway-graceful-draining?format=agents"}},{"id":"pg17-parallel-apply-replication-invariant","title":"PostgreSQL 17 Parallel Apply Logical Replication and CDC Invariant Guardrail","category":"backend","severity":"critical","description":"Enforces strict configuration and migration invariants for PostgreSQL 17 parallel apply logical replication workers across cross-region subscriber topologies. Guarantees transaction-order serialization without cascading serialization-failure deadlocks or subscriber replication slot unbounded bloat during high-concurrency ingestion. Eliminates single-worker apply bottlenecks while preserving foreign key dependency graph order and cross-table consistency.","antiPatternHeadline":"Applying Unpartitioned Parallel Streaming Apply Without Serialization Order Guardrails or Worker Pool Bounds","stars_count":117,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","logical-replication","cdc","database-migrations","high-availability"],"exportEndpoints":{"claude":"/api/rules/pg17-parallel-apply-replication-invariant?format=claude","cursorMdc":"/api/rules/pg17-parallel-apply-replication-invariant?format=mdc","cursorrules":"/api/rules/pg17-parallel-apply-replication-invariant?format=cursor","windsurf":"/api/rules/pg17-parallel-apply-replication-invariant?format=windsurf","agents":"/api/rules/pg17-parallel-apply-replication-invariant?format=agents"}},{"id":"go-chi-zero-alloc-typed-context-propagation-guardrail","title":"Go Chi Zero-Allocation Typed Context Propagation Standard","category":"backend","severity":"critical","description":"Enforces zero-allocation typed context extraction and propagation within high-throughput Go Chi microservices. Prevents severe GC pause spikes and heap fragmentation caused by chaining context.WithValue with boxed primitive or struct values on the HTTP hot path by leveraging pooled pointers and single-key unified state propagation.","antiPatternHeadline":"Heap-Allocating Un-pooled Request State via Chained context.WithValue Invocations","stars_count":52,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","chi","performance","zero-allocation","memory-management","concurrency"],"exportEndpoints":{"claude":"/api/rules/go-chi-zero-alloc-typed-context-propagation-guardrail?format=claude","cursorMdc":"/api/rules/go-chi-zero-alloc-typed-context-propagation-guardrail?format=mdc","cursorrules":"/api/rules/go-chi-zero-alloc-typed-context-propagation-guardrail?format=cursor","windsurf":"/api/rules/go-chi-zero-alloc-typed-context-propagation-guardrail?format=windsurf","agents":"/api/rules/go-chi-zero-alloc-typed-context-propagation-guardrail?format=agents"}},{"id":"android-15-baseline-profiles-frame-pacing-standard","title":"Android 15 Baseline Profiles Ahead-Of-Time Frame Pacing Standard","category":"mobile","severity":"critical","description":"Mandates deterministic Ahead-Of-Time (AOT) profile compilation using Jetpack Macrobenchmark and Baseline Profile Gradle Plugin on Android 15. Eliminates runtime JIT de-optimizations and class verification micro-stutters to enforce strict 8.33ms UI thread frame pacing on 120Hz Jetpack Compose display surfaces. Guarantees automated profile generation and integration within release binaries to ensure zero initial-fling dropped frames.","antiPatternHeadline":"Shipping Unprofiled Jetpack Compose Release Binaries Relying on JIT Compilation for Critical Paths","stars_count":59,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","android","jetpack-compose","baseline-profiles","performance","aot","frame-pacing"],"exportEndpoints":{"claude":"/api/rules/android-15-baseline-profiles-frame-pacing-standard?format=claude","cursorMdc":"/api/rules/android-15-baseline-profiles-frame-pacing-standard?format=mdc","cursorrules":"/api/rules/android-15-baseline-profiles-frame-pacing-standard?format=cursor","windsurf":"/api/rules/android-15-baseline-profiles-frame-pacing-standard?format=windsurf","agents":"/api/rules/android-15-baseline-profiles-frame-pacing-standard?format=agents"}},{"id":"webauthn-prf-client-e2ee-standard","title":"Hardware Passkey PRF Extension Client-Side E2EE and Zero-Knowledge Key Derivation","category":"security","severity":"critical","description":"Enforces strict client-side cryptographic invariants when deriving zero-knowledge symmetric keys from WebAuthn Pseudorandom Function (PRF) authenticator extensions. Mandates secondary HKDF key expansion with domain-separated salts, prevents raw PRF output exposure, and forbids any network transmission or unencrypted persistence of derived keying material.","antiPatternHeadline":"Directly Utilizing Raw PRF Outputs as Symmetric Encryption Keys or Leaking Them to Remote Relying Parties","stars_count":100,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","prf-extension","zero-knowledge","cryptography","web-crypto-api","passkeys"],"exportEndpoints":{"claude":"/api/rules/webauthn-prf-client-e2ee-standard?format=claude","cursorMdc":"/api/rules/webauthn-prf-client-e2ee-standard?format=mdc","cursorrules":"/api/rules/webauthn-prf-client-e2ee-standard?format=cursor","windsurf":"/api/rules/webauthn-prf-client-e2ee-standard?format=windsurf","agents":"/api/rules/webauthn-prf-client-e2ee-standard?format=agents"}},{"id":"openfga-ephemeral-contextual-tuples-evaluation-guardrail","title":"OpenFGA Ephemeral Contextual Tuples Evaluation Guardrail","category":"security","severity":"critical","description":"Mandates that dynamic runtime attributes and transient environmental conditions are passed exclusively as evaluated contextual tuples or condition context during OpenFGA check evaluations. Strictly prohibits writing transient, request-bound authorization state to persistent tuple databases to eliminate privilege leaks, race conditions, and tuple store pollution.","antiPatternHeadline":"Persisting Transient Transaction State to OpenFGA Storage Instead of Passing In-Memory Contextual Tuples","stars_count":62,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","authorization","zanzibar","contextual-tuples","zero-trust"],"exportEndpoints":{"claude":"/api/rules/openfga-ephemeral-contextual-tuples-evaluation-guardrail?format=claude","cursorMdc":"/api/rules/openfga-ephemeral-contextual-tuples-evaluation-guardrail?format=mdc","cursorrules":"/api/rules/openfga-ephemeral-contextual-tuples-evaluation-guardrail?format=cursor","windsurf":"/api/rules/openfga-ephemeral-contextual-tuples-evaluation-guardrail?format=windsurf","agents":"/api/rules/openfga-ephemeral-contextual-tuples-evaluation-guardrail?format=agents"}},{"id":"otel-collector-adaptive-memory-limiter-flow-control","title":"OpenTelemetry Collector Dynamic Memory-Limiter and Upstream Backpressure Standard","category":"devops","severity":"critical","description":"Enforces strict ordering, dynamic cgroup-aware memory allocation, and upstream backpressure propagation across OpenTelemetry Collector pipelines. Prevents catastrophic OOMKills during telemetry micro-bursts by ensuring memory limiting executes before payload deserialization, buffering, and routing.","antiPatternHeadline":"Misordered Collector Pipelines and Static Thresholds Causing Kernel OOMKills and Telemetry Blackholes","stars_count":111,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","observability","kubernetes","flow-control","backpressure"],"exportEndpoints":{"claude":"/api/rules/otel-collector-adaptive-memory-limiter-flow-control?format=claude","cursorMdc":"/api/rules/otel-collector-adaptive-memory-limiter-flow-control?format=mdc","cursorrules":"/api/rules/otel-collector-adaptive-memory-limiter-flow-control?format=cursor","windsurf":"/api/rules/otel-collector-adaptive-memory-limiter-flow-control?format=windsurf","agents":"/api/rules/otel-collector-adaptive-memory-limiter-flow-control?format=agents"}},{"id":"ebpf-tc-dsr-conntrack-bypass","title":"eBPF TC Direct Server Return (DSR) Service Mesh Invariant","category":"devops","severity":"critical","description":"Enforces eBPF Traffic Control (TC) Direct Server Return (DSR) networking invariants across Kubernetes and edge service meshes. Bypasses intermediate node SNAT and kernel conntrack table saturation by dispatching ingress traffic via tunnel encapsulation and rewriting egress headers directly to client endpoints at the pod veth interface.","antiPatternHeadline":"SNAT/IPVS Double-Hop Routing Causing nf_conntrack Table Exhaustion and Asymmetric Packet Drops","stars_count":90,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","traffic-control","dsr","kubernetes","networking","conntrack"],"exportEndpoints":{"claude":"/api/rules/ebpf-tc-dsr-conntrack-bypass?format=claude","cursorMdc":"/api/rules/ebpf-tc-dsr-conntrack-bypass?format=mdc","cursorrules":"/api/rules/ebpf-tc-dsr-conntrack-bypass?format=cursor","windsurf":"/api/rules/ebpf-tc-dsr-conntrack-bypass?format=windsurf","agents":"/api/rules/ebpf-tc-dsr-conntrack-bypass?format=agents"}},{"id":"vite6-environment-api-runtime-isolation-vite-6-environme-640","title":"Vite 6 Environment API Multi-Runtime SSR Execution Isolation","category":"frontend","severity":"critical","description":"Enforces strict process, module graph, and memory isolation between distinct execution environments (Workerd/Cloudflare, Node.js, WebAssembly, and Client) when using Vite 6 Environment API. Prevents shared mutable state leakage, incorrect runtime primitive contamination, and invalid module runner resolution across heterogeneous dev and SSR graphs.","antiPatternHeadline":"Global Scope Pollution and Shared Module Graph Bleed Across Heterogeneous Vite 6 SSR Runtimes","stars_count":101,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","vite6","ssr","workerd","wasm","module-runner","environment-api"],"exportEndpoints":{"claude":"/api/rules/vite6-environment-api-runtime-isolation-vite-6-environme-640?format=claude","cursorMdc":"/api/rules/vite6-environment-api-runtime-isolation-vite-6-environme-640?format=mdc","cursorrules":"/api/rules/vite6-environment-api-runtime-isolation-vite-6-environme-640?format=cursor","windsurf":"/api/rules/vite6-environment-api-runtime-isolation-vite-6-environme-640?format=windsurf","agents":"/api/rules/vite6-environment-api-runtime-isolation-vite-6-environme-640?format=agents"}},{"id":"nextjs-15-ppr-dynamic-boundary-standard-next-js-15-parti-643","title":"Next.js 15 Partial Prerendering (PPR) Dynamic Context Boundary Standard","category":"frontend","severity":"critical","description":"Mandates strict isolation of dynamic request contexts (cookies, headers, searchParams, and uncached data fetches) within React Suspense boundaries to guarantee static shell delivery under Next.js 15 Partial Prerendering. Prevents route-level dynamic de-optimization and eliminates streaming waterfalls.","antiPatternHeadline":"Accessing Dynamic Context in Top-Level Layouts or Pages Collapsing PPR to Full Dynamic SSR","stars_count":46,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["nextjs-15","partial-prerendering","ppr","react-suspense","streaming","server-components","performance"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-ppr-dynamic-boundary-standard-next-js-15-parti-643?format=claude","cursorMdc":"/api/rules/nextjs-15-ppr-dynamic-boundary-standard-next-js-15-parti-643?format=mdc","cursorrules":"/api/rules/nextjs-15-ppr-dynamic-boundary-standard-next-js-15-parti-643?format=cursor","windsurf":"/api/rules/nextjs-15-ppr-dynamic-boundary-standard-next-js-15-parti-643?format=windsurf","agents":"/api/rules/nextjs-15-ppr-dynamic-boundary-standard-next-js-15-parti-643?format=agents"}},{"id":"fastapi-asgi-streaming-backpressure-cancellation-guardrail","title":"FastAPI ASGI Streaming Backpressure & Cooperative Task Cancellation Guardrail","category":"backend","severity":"critical","description":"Enforces strict cooperative cancellation and backpressure propagation between ASGI HTTP client disconnect events and underlying async generator pipelines. Prevents catastrophic worker thread starvation, uncollected generator frames, and phantom compute leaks by polling request disconnect status and handling asyncio.CancelledError during chunk yielding.","antiPatternHeadline":"Silent Async Generator Execution Post-Client Disconnect Leading to Worker Thread Pool Starvation","stars_count":58,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","asgi","streaming","asyncio","backpressure"],"exportEndpoints":{"claude":"/api/rules/fastapi-asgi-streaming-backpressure-cancellation-guardrail?format=claude","cursorMdc":"/api/rules/fastapi-asgi-streaming-backpressure-cancellation-guardrail?format=mdc","cursorrules":"/api/rules/fastapi-asgi-streaming-backpressure-cancellation-guardrail?format=cursor","windsurf":"/api/rules/fastapi-asgi-streaming-backpressure-cancellation-guardrail?format=windsurf","agents":"/api/rules/fastapi-asgi-streaming-backpressure-cancellation-guardrail?format=agents"}},{"id":"openfga-rebac-cache-consistency-batching","title":"OpenFGA ReBAC Contextual Tuple Caching and Deterministic Batching Invariant","category":"backend","severity":"critical","description":"Enforces deterministic batch evaluation and version-consistent contextual tuple caching for OpenFGA relationship-based access control (ReBAC). Eliminates N+1 authorization network hops and prevents authorization bypasses or stale permission grants caused by unversioned cache keys.","antiPatternHeadline":"Sequential Per-Resource OpenFGA Checks with Stale, Unversioned Contextual Tuple Caching","stars_count":98,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","openfga","rebac","authorization","caching","batching","performance"],"exportEndpoints":{"claude":"/api/rules/openfga-rebac-cache-consistency-batching?format=claude","cursorMdc":"/api/rules/openfga-rebac-cache-consistency-batching?format=mdc","cursorrules":"/api/rules/openfga-rebac-cache-consistency-batching?format=cursor","windsurf":"/api/rules/openfga-rebac-cache-consistency-batching?format=windsurf","agents":"/api/rules/openfga-rebac-cache-consistency-batching?format=agents"}},{"id":"postgres-17-hnsw-partition-memory-guardrail","title":"Postgres 17 Concurrent HNSW Partitioning and Vector Memory Ceiling Invariant","category":"backend","severity":"critical","description":"Prevents query worker and migration runner OOM-kills during high-dimensional vector search on Postgres 17. Guarantees that parallel HNSW index builds on partitioned tables enforce strict session-bounded maintenance memory ceilings and serialized leaf-partition builds, preventing cgroup memory quota exhaustion during concurrent hybrid search workloads.","antiPatternHeadline":"Unbounded parallel HNSW index construction on partitioned tables starving query workers and causing SIGKILL OOMs","stars_count":70,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres","pgvector","hnsw","database-reliability","memory-management"],"exportEndpoints":{"claude":"/api/rules/postgres-17-hnsw-partition-memory-guardrail?format=claude","cursorMdc":"/api/rules/postgres-17-hnsw-partition-memory-guardrail?format=mdc","cursorrules":"/api/rules/postgres-17-hnsw-partition-memory-guardrail?format=cursor","windsurf":"/api/rules/postgres-17-hnsw-partition-memory-guardrail?format=windsurf","agents":"/api/rules/postgres-17-hnsw-partition-memory-guardrail?format=agents"}},{"id":"kmp-swift-concurrency-lifespan-bridge-guardrail","title":"KMP-Swift Concurrency Lifespan & Cooperative Cancellation Guardrail","category":"mobile","severity":"critical","description":"Enforces deterministic lifecycle synchronization, thread-safe memory boundaries, and bidirectional cooperative cancellation between Kotlin Coroutines and Swift Structured Concurrency. Prevents orphaned background jobs, GC root retention leaks across the Objective-C export bridge, and cooperative thread pool starvation.","antiPatternHeadline":"Dangling Kotlin Coroutine Jobs and Leaked Native GC Roots via Unstructured Swift Task Wrappers","stars_count":79,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","swift-concurrency","coroutines","memory-management","arc"],"exportEndpoints":{"claude":"/api/rules/kmp-swift-concurrency-lifespan-bridge-guardrail?format=claude","cursorMdc":"/api/rules/kmp-swift-concurrency-lifespan-bridge-guardrail?format=mdc","cursorrules":"/api/rules/kmp-swift-concurrency-lifespan-bridge-guardrail?format=cursor","windsurf":"/api/rules/kmp-swift-concurrency-lifespan-bridge-guardrail?format=windsurf","agents":"/api/rules/kmp-swift-concurrency-lifespan-bridge-guardrail?format=agents"}},{"id":"react-native-bridgeless-concurrent-jsi-isolation-standard","title":"React Native Bridgeless Concurrent C++ JSI TurboModule Isolation Standard","category":"mobile","severity":"critical","description":"Enforces strict memory safety and thread isolation for concurrent C++ JSI TurboModules under React Native Bridgeless Mode. Prevents fatal runtime SIGSEGV crashes and UI thread hitching caused by accessing raw jsi::Value or jsi::Object instances across asynchronous threads without CallInvoker marshalling.","antiPatternHeadline":"Accessing Unpinned JSI Objects on Background C++ Worker Threads or Blocking Main CallInvoker with Heavy Native Computations","stars_count":118,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","react-native","bridgeless","jsi","turbomodules","cpp","concurrency"],"exportEndpoints":{"claude":"/api/rules/react-native-bridgeless-concurrent-jsi-isolation-standard?format=claude","cursorMdc":"/api/rules/react-native-bridgeless-concurrent-jsi-isolation-standard?format=mdc","cursorrules":"/api/rules/react-native-bridgeless-concurrent-jsi-isolation-standard?format=cursor","windsurf":"/api/rules/react-native-bridgeless-concurrent-jsi-isolation-standard?format=windsurf","agents":"/api/rules/react-native-bridgeless-concurrent-jsi-isolation-standard?format=agents"}},{"id":"webauthn-prf-vault-key-derivation-standard","title":"Hardware-Anchored Zero-Knowledge Vault Encryption via WebAuthn PRF Extension","category":"security","severity":"critical","description":"Enforces zero-knowledge client cryptographic vault encryption anchored directly to hardware-backed FIDO2 authenticators via the WebAuthn PRF (Pseudo-Random Function) extension. Requires non-extractable CryptoKey handles derived via HKDF domain separation and strictly prohibits transmitting PRF outputs, master derivation seeds, or plaintext vault encryption keys to any remote server.","antiPatternHeadline":"Exposing raw WebAuthn PRF outputs over network transport or deriving extractable vault keys without HKDF domain separation.","stars_count":74,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","prf-extension","cryptography","zero-knowledge","passkeys"],"exportEndpoints":{"claude":"/api/rules/webauthn-prf-vault-key-derivation-standard?format=claude","cursorMdc":"/api/rules/webauthn-prf-vault-key-derivation-standard?format=mdc","cursorrules":"/api/rules/webauthn-prf-vault-key-derivation-standard?format=cursor","windsurf":"/api/rules/webauthn-prf-vault-key-derivation-standard?format=windsurf","agents":"/api/rules/webauthn-prf-vault-key-derivation-standard?format=agents"}},{"id":"ebpf-socket-mtls-backpressure-telemetry-guardrail","title":"eBPF Socket-Layer kTLS & TCP Backpressure Telemetry Standard","category":"devops","severity":"critical","description":"Enforces zero-overhead L7 transport telemetry and backpressure detection directly at the Linux socket layer via eBPF (sockops, sk_msg) and kTLS, eliminating user-space sidecar proxy hops. Mandates lock-free ring-buffer kernel telemetry ingestion and prohibits iptables-based loopback hairpins that disguise TCP write-buffer saturation and inflate p99 tail latency.","antiPatternHeadline":"Routing microservice traffic through user-space sidecar proxies with iptables DNAT hairpins and polling-based socket metrics","stars_count":96,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","ktls","linux-kernel","networking","telemetry","backpressure"],"exportEndpoints":{"claude":"/api/rules/ebpf-socket-mtls-backpressure-telemetry-guardrail?format=claude","cursorMdc":"/api/rules/ebpf-socket-mtls-backpressure-telemetry-guardrail?format=mdc","cursorrules":"/api/rules/ebpf-socket-mtls-backpressure-telemetry-guardrail?format=cursor","windsurf":"/api/rules/ebpf-socket-mtls-backpressure-telemetry-guardrail?format=windsurf","agents":"/api/rules/ebpf-socket-mtls-backpressure-telemetry-guardrail?format=agents"}},{"id":"otel-collector-wasm-pii-tail-sampling-standard","title":"Deterministic Dynamic Wasm PII Masking and Tail-Based Sampling Pipeline Standard","category":"devops","severity":"critical","description":"Mandates inline WebAssembly (Wasm) bytecode execution for zero-allocation, linear-time PII tokenization and cryptographic pseudonymization at the OpenTelemetry Collector ingress edge before any trace egress. Enforces a multi-tiered collector architecture where stateless Wasm sanitation precedes trace-id consistent hash routing into isolated tail-based sampling clusters. Guarantees 100% capture of error/high-latency traces while neutralizing downstream compliance liabilities.","antiPatternHeadline":"Egressing Raw PII in Distributed Spans via Naive Head Sampling and Greedy Regex Processors","stars_count":43,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","wasm","tail-sampling","pii-masking","observability","data-governance"],"exportEndpoints":{"claude":"/api/rules/otel-collector-wasm-pii-tail-sampling-standard?format=claude","cursorMdc":"/api/rules/otel-collector-wasm-pii-tail-sampling-standard?format=mdc","cursorrules":"/api/rules/otel-collector-wasm-pii-tail-sampling-standard?format=cursor","windsurf":"/api/rules/otel-collector-wasm-pii-tail-sampling-standard?format=windsurf","agents":"/api/rules/otel-collector-wasm-pii-tail-sampling-standard?format=agents"}},{"id":"svelte-5-runes-ssr-lifecycle-isolation","title":"Svelte 5 Universal Runes SSR Isolation and Reactive Root Lifecycle Invariant","category":"frontend","severity":"critical","description":"Enforces strict isolation of Svelte 5 universal runes ($state, $derived) and explicit lifecycle disposal of $effect.root instances during SSR. Prohibits module-level reactive state singletons in server runtimes to prevent cross-request memory retention, data contamination across tenants, and unbounded heap exhaustion.","antiPatternHeadline":"Global Module-Scoped Runes and Orphaned Effect Roots Inducing Cross-Request SSR State Leakage","stars_count":42,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","ssr","sveltekit","memory-leak","reactive-root"],"exportEndpoints":{"claude":"/api/rules/svelte-5-runes-ssr-lifecycle-isolation?format=claude","cursorMdc":"/api/rules/svelte-5-runes-ssr-lifecycle-isolation?format=mdc","cursorrules":"/api/rules/svelte-5-runes-ssr-lifecycle-isolation?format=cursor","windsurf":"/api/rules/svelte-5-runes-ssr-lifecycle-isolation?format=windsurf","agents":"/api/rules/svelte-5-runes-ssr-lifecycle-isolation?format=agents"}},{"id":"react-19-server-component-taint-security-guardrail","title":"React 19 Server Component Cryptographic Taint & Secret Exfiltration Guardrail","category":"security","severity":"critical","description":"Enforces compiler-level taint checking using experimental_taintUniqueValue and taintObjectReference across all internal data-access boundaries. This prevents accidental serialization and exfiltration of sensitive backend credentials, cryptographic keys, and PII across React Server Component (RSC) serialization boundaries into Client Component bundles. Any data access layer entity containing sensitive identifiers or secrets must be explicitly marked as tainted before processing.","antiPatternHeadline":"Passing Raw Database Entities and Environment Secrets to Client Component Boundary Props Without Taint Invariants","stars_count":90,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","react-19","rsc","taint-analysis","nextjs","data-exfiltration","secret-management"],"exportEndpoints":{"claude":"/api/rules/react-19-server-component-taint-security-guardrail?format=claude","cursorMdc":"/api/rules/react-19-server-component-taint-security-guardrail?format=mdc","cursorrules":"/api/rules/react-19-server-component-taint-security-guardrail?format=cursor","windsurf":"/api/rules/react-19-server-component-taint-security-guardrail?format=windsurf","agents":"/api/rules/react-19-server-component-taint-security-guardrail?format=agents"}},{"id":"bun-socket-backpressure-zerocopy-invariant","title":"Bun 1.2 Kernel Socket Backpressure & Zero-Copy WebSocket Stream Standard","category":"backend","severity":"critical","description":"Enforces deterministic TCP buffer drainage thresholds and binary chunk recycling across high-throughput Bun WebSocket server connections. Mandates explicit inspection of ws.getBufferedAmount() combined with reactive drain callbacks to prevent native kernel-buffer saturation and process-level out-of-memory cascading faults.","antiPatternHeadline":"Unbounded WebSocket chunk streaming and ad-hoc Buffer allocations without socket drainage coordination causing native heap runaway.","stars_count":117,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","websockets","memory-management","backpressure","zero-copy"],"exportEndpoints":{"claude":"/api/rules/bun-socket-backpressure-zerocopy-invariant?format=claude","cursorMdc":"/api/rules/bun-socket-backpressure-zerocopy-invariant?format=mdc","cursorrules":"/api/rules/bun-socket-backpressure-zerocopy-invariant?format=cursor","windsurf":"/api/rules/bun-socket-backpressure-zerocopy-invariant?format=windsurf","agents":"/api/rules/bun-socket-backpressure-zerocopy-invariant?format=agents"}},{"id":"tauri-v2-ipc-binary-origin-guardrail","title":"Tauri 2.0 IPC Zero-Copy Binary Buffer & Origin Capability Guardrail","category":"mobile","severity":"critical","description":"Enforces strict origin-scoped capability boundaries and zero-copy binary IPC pipelines across the Rust-to-Webview bridge in Tauri 2.0 mobile architectures. Eliminates main-thread IPC serialization lockups by mandating raw byte streams over JSON-base64 representations and prevents privilege escalation by strictly binding IPC command execution to explicit window labels and vetted webview origins.","antiPatternHeadline":"Base64 JSON Serialization of Binary Buffers Combined with Wildcard IPC Origin Capabilities","stars_count":61,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri-2","rust","ipc","security","zero-copy","capabilities"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-ipc-binary-origin-guardrail?format=claude","cursorMdc":"/api/rules/tauri-v2-ipc-binary-origin-guardrail?format=mdc","cursorrules":"/api/rules/tauri-v2-ipc-binary-origin-guardrail?format=cursor","windsurf":"/api/rules/tauri-v2-ipc-binary-origin-guardrail?format=windsurf","agents":"/api/rules/tauri-v2-ipc-binary-origin-guardrail?format=agents"}},{"id":"kmp-swift-coroutine-cancellation-invariant","title":"KMP to Swift Interop Structured Concurrency and Coroutine Cancellation Invariant","category":"mobile","severity":"critical","description":"Enforces strict bidirectional structured concurrency across the Kotlin/Native Objective-C export bridge and Swift modern concurrency runtime. Without explicit cancellation bridging via KMP wrapper objects or SKIE-generated async hooks, Swift Task cancellations fail to propagate to active Kotlin CoroutineScopes, causing orphaned background work, memory leaks, and native iOS thread pool starvation.","antiPatternHeadline":"Directly Consuming Kotlin Suspend Functions in Swift Without SKIE or Explicit Job Cancellation Bridges","stars_count":112,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","swift","ios","coroutines","concurrency"],"exportEndpoints":{"claude":"/api/rules/kmp-swift-coroutine-cancellation-invariant?format=claude","cursorMdc":"/api/rules/kmp-swift-coroutine-cancellation-invariant?format=mdc","cursorrules":"/api/rules/kmp-swift-coroutine-cancellation-invariant?format=cursor","windsurf":"/api/rules/kmp-swift-coroutine-cancellation-invariant?format=windsurf","agents":"/api/rules/kmp-swift-coroutine-cancellation-invariant?format=agents"}},{"id":"fastapi-anyio-structured-concurrency-taskgroup-standard","title":"FastAPI AnyIO Structured Concurrency & TaskGroup Invariant Standard","category":"backend","severity":"critical","description":"Enforces strict structured concurrency in FastAPI route handlers and domain services via AnyIO TaskGroups and deterministic cancellation scopes. Prohibits fire-and-forget background asyncio tasks that cause silent task abandonment, orphan database sessions, and connection pool exhaustion.","antiPatternHeadline":"Orphan Asyncio Tasks Leaking Database Connection Pools and Silently Swallowing Failures","stars_count":91,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","anyio","asyncio","structured-concurrency","sqlalchemy","connection-pooling"],"exportEndpoints":{"claude":"/api/rules/fastapi-anyio-structured-concurrency-taskgroup-standard?format=claude","cursorMdc":"/api/rules/fastapi-anyio-structured-concurrency-taskgroup-standard?format=mdc","cursorrules":"/api/rules/fastapi-anyio-structured-concurrency-taskgroup-standard?format=cursor","windsurf":"/api/rules/fastapi-anyio-structured-concurrency-taskgroup-standard?format=windsurf","agents":"/api/rules/fastapi-anyio-structured-concurrency-taskgroup-standard?format=agents"}},{"id":"temporal-durable-execution-determinism-guardrail","title":"Temporal Durable Execution Determinism and Virtual Clock Invariant","category":"backend","severity":"critical","description":"Enforces strict execution determinism across Temporal workflow definitions to prevent replay mismatch panics during worker redeployments. Prohibits native wall-clock queries, unseeded random number generation, raw socket/HTTP I/O, native timers, and unversioned control flow modifications within workflow contexts.","antiPatternHeadline":"Leaking Native Wall Clocks, Unseeded Randomness, or Direct Network I/O Inside Temporal Workflows","stars_count":61,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","temporal","distributed-systems","event-sourcing","workflow-orchestration","determinism"],"exportEndpoints":{"claude":"/api/rules/temporal-durable-execution-determinism-guardrail?format=claude","cursorMdc":"/api/rules/temporal-durable-execution-determinism-guardrail?format=mdc","cursorrules":"/api/rules/temporal-durable-execution-determinism-guardrail?format=cursor","windsurf":"/api/rules/temporal-durable-execution-determinism-guardrail?format=windsurf","agents":"/api/rules/temporal-durable-execution-determinism-guardrail?format=agents"}},{"id":"ebpf-xdp-spiffe-mtls-validation-standard","title":"eBPF XDP Kernel-Level SPIFFE/mTLS Handshake Validation Standard","category":"security","severity":"critical","description":"Enforces strict bounds checking, bounded state machine parsing, and pinned kernel map lookups when offloading zero-trust SPIFFE/mTLS connection admission to eBPF XDP hooks. Precludes unbounded packet parsing, non-atomic map lookups, and unvalidated identity assertions that compromise the kernel network driver layer.","antiPatternHeadline":"Unbounded TLS Record Parsing and Unsynchronized Session Admittance in Kernel XDP Hooks","stars_count":59,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","ebpf","xdp","spiffe","mtls","kernel","zero-trust"],"exportEndpoints":{"claude":"/api/rules/ebpf-xdp-spiffe-mtls-validation-standard?format=claude","cursorMdc":"/api/rules/ebpf-xdp-spiffe-mtls-validation-standard?format=mdc","cursorrules":"/api/rules/ebpf-xdp-spiffe-mtls-validation-standard?format=cursor","windsurf":"/api/rules/ebpf-xdp-spiffe-mtls-validation-standard?format=windsurf","agents":"/api/rules/ebpf-xdp-spiffe-mtls-validation-standard?format=agents"}},{"id":"continuous-ebpf-profiling-otlp-convergence-standard","title":"Continuous eBPF Profiling & OTLP Trace Correlation Standard","category":"devops","severity":"critical","description":"Enforces sub-1% overhead fleet-wide continuous profiling utilizing non-invasive eBPF kernel probes mapped directly to OpenTelemetry span contexts. Mandates compiler frame-pointer preservation, non-lock sampling frequencies, and OTLP profiling signal schema convergence for deterministic code-level root cause analysis.","antiPatternHeadline":"Ad-Hoc In-Process Profiling Endpoints with Disconnected Trace Context and Omitted Frame Pointers","stars_count":48,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","opentelemetry","continuous-profiling","otlp","observability","performance"],"exportEndpoints":{"claude":"/api/rules/continuous-ebpf-profiling-otlp-convergence-standard?format=claude","cursorMdc":"/api/rules/continuous-ebpf-profiling-otlp-convergence-standard?format=mdc","cursorrules":"/api/rules/continuous-ebpf-profiling-otlp-convergence-standard?format=cursor","windsurf":"/api/rules/continuous-ebpf-profiling-otlp-convergence-standard?format=windsurf","agents":"/api/rules/continuous-ebpf-profiling-otlp-convergence-standard?format=agents"}},{"id":"wasi-02-capability-sandbox-standard","title":"WASI 0.2 Component Model Capability-Based Sandbox Boundary Standard","category":"devops","severity":"critical","description":"Enforces strict capability-based isolation for multi-tenant microservices compiled to WebAssembly (WASM) components under WASI 0.2. Mandates explicit WebAssembly Interface Type (WIT) capability imports, eliminating wild-card host virtualization, unconstrained ambient filesystem access, and unsanctioned socket operations to neutralize shared-kernel container breakout vulnerabilities.","antiPatternHeadline":"Ambient System Call Access and Unbounded Host Capability Inheritance in WASI Runtimes","stars_count":51,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","wasm","wasi-0.2","wit","security","sandboxing","zero-trust"],"exportEndpoints":{"claude":"/api/rules/wasi-02-capability-sandbox-standard?format=claude","cursorMdc":"/api/rules/wasi-02-capability-sandbox-standard?format=mdc","cursorrules":"/api/rules/wasi-02-capability-sandbox-standard?format=cursor","windsurf":"/api/rules/wasi-02-capability-sandbox-standard?format=windsurf","agents":"/api/rules/wasi-02-capability-sandbox-standard?format=agents"}},{"id":"react-19-server-actions-idempotency-key-guardrail","title":"Mandatory Idempotency Keys for Mutating React 19 Server Actions","category":"frontend","severity":"critical","description":"Enforces network-resilient mutations across React 19 Server Actions by requiring client-generated, cryptographically unique idempotency tokens bound to submission state. Under high-latency or unstable mobile network transitions, automatic or user-driven retries must guarantee strict exactly-once execution semantics at the persistence layer. Without this guardrail, duplicate executions corrupt state, duplicate financial transactions, and create unrecoverable orphaned records.","antiPatternHeadline":"Unbounded Server Action Invocations Allowing Duplicate Execution Under Mobile Network Retries","stars_count":71,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react19","server-actions","idempotency","resilience","distributed-systems"],"exportEndpoints":{"claude":"/api/rules/react-19-server-actions-idempotency-key-guardrail?format=claude","cursorMdc":"/api/rules/react-19-server-actions-idempotency-key-guardrail?format=mdc","cursorrules":"/api/rules/react-19-server-actions-idempotency-key-guardrail?format=cursor","windsurf":"/api/rules/react-19-server-actions-idempotency-key-guardrail?format=windsurf","agents":"/api/rules/react-19-server-actions-idempotency-key-guardrail?format=agents"}},{"id":"nextjs-15-dynamic-io-cache-invalidation-invariant","title":"Next.js 15 Dynamic I/O & Distributed Cache Invalidation Invariant","category":"frontend","severity":"critical","description":"Enforces strict boundaries between cached computation and dynamic runtime I/O in Next.js 15 with dynamicIO enabled. Mandates deterministic, hierarchical cache tags and isolates mutation-sensitive reads via explicit dynamic boundaries to prevent distributed stale read cascades and cache stampedes across edge regions.","antiPatternHeadline":"Global Unscoped Cache Tags and Leaking Dynamic Context into 'use cache' Scopes","stars_count":71,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs","react","cache-invalidation","dynamic-io","edge-computing"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-dynamic-io-cache-invalidation-invariant?format=claude","cursorMdc":"/api/rules/nextjs-15-dynamic-io-cache-invalidation-invariant?format=mdc","cursorrules":"/api/rules/nextjs-15-dynamic-io-cache-invalidation-invariant?format=cursor","windsurf":"/api/rules/nextjs-15-dynamic-io-cache-invalidation-invariant?format=windsurf","agents":"/api/rules/nextjs-15-dynamic-io-cache-invalidation-invariant?format=agents"}},{"id":"vite-6-environment-api-runtime-module-isolation-standard","title":"Vite 6 Environment API Runtime Module Isolation and Secret Boundary Standard","category":"frontend","severity":"critical","description":"Enforces strict runtime module graph boundaries across client, server, and edge environments using Vite 6's Environment API. Eliminates credential leakage by invalidating shared module caches and barring server-only dependencies from traversing into client compilation passes. Guarantees immutable separation between WebWorker, Node.js, and browser execution contexts during dev HMR and multi-environment builds.","antiPatternHeadline":"Implicit Cross-Environment Imports and Shared Module Cache Infiltration Leaking Server Secrets into Client Bundles","stars_count":108,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","vite6","environment-api","security","module-isolation","ssr"],"exportEndpoints":{"claude":"/api/rules/vite-6-environment-api-runtime-module-isolation-standard?format=claude","cursorMdc":"/api/rules/vite-6-environment-api-runtime-module-isolation-standard?format=mdc","cursorrules":"/api/rules/vite-6-environment-api-runtime-module-isolation-standard?format=cursor","windsurf":"/api/rules/vite-6-environment-api-runtime-module-isolation-standard?format=windsurf","agents":"/api/rules/vite-6-environment-api-runtime-module-isolation-standard?format=agents"}},{"id":"axum-tower-async-cancellation-safety-invariant","title":"Axum 0.8 & Tower Async Cancellation Safety Invariant","category":"backend","severity":"critical","description":"Enforces strict async cancellation safety across Axum 0.8 handlers and Tower middleware layers. In Tokio runtimes, premature client disconnects drop the request future synchronously at any `.await` boundary, leading to severed transactions, half-applied state transitions, and connection starvation unless atomic mutations are shielded or decoupled.","antiPatternHeadline":"Executing Non-Atomic Multi-Step Mutations Inside Ephemeral Request Futures Subject to Client Disconnect Drops","stars_count":104,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tokio","concurrency","database"],"exportEndpoints":{"claude":"/api/rules/axum-tower-async-cancellation-safety-invariant?format=claude","cursorMdc":"/api/rules/axum-tower-async-cancellation-safety-invariant?format=mdc","cursorrules":"/api/rules/axum-tower-async-cancellation-safety-invariant?format=cursor","windsurf":"/api/rules/axum-tower-async-cancellation-safety-invariant?format=windsurf","agents":"/api/rules/axum-tower-async-cancellation-safety-invariant?format=agents"}},{"id":"postgres-17-memory-adaptive-hash-join-governor","title":"Postgres 17 Memory-Adaptive Hash Join Concurrency Governor Guardrail","category":"backend","severity":"critical","description":"Enforces deterministic memory-bounded query execution for PostgreSQL 17 multi-node hash joins during analytical concurrency bursts. Prevents server-wide out-of-memory (OOM) events and cascade temp-file I/O thrashing by dynamically computing and setting transaction-local work_mem ceilings governed by active join concurrency tokens.","antiPatternHeadline":"Unbounded static work_mem allocation and uncoordinated parallel hash join execution under high analytical concurrency","stars_count":106,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","postgres-17","performance","query-governance","concurrency"],"exportEndpoints":{"claude":"/api/rules/postgres-17-memory-adaptive-hash-join-governor?format=claude","cursorMdc":"/api/rules/postgres-17-memory-adaptive-hash-join-governor?format=mdc","cursorrules":"/api/rules/postgres-17-memory-adaptive-hash-join-governor?format=cursor","windsurf":"/api/rules/postgres-17-memory-adaptive-hash-join-governor?format=windsurf","agents":"/api/rules/postgres-17-memory-adaptive-hash-join-governor?format=agents"}},{"id":"go-coroutine-range-over-func-leak-prevention","title":"Go 1.24 Coroutine Pull-Iterator Resource Leak and Panic Unwinding Standard","category":"backend","severity":"critical","description":"Enforces strict lifecycle management and deterministic cleanup for Go 1.24 range-over-func push-to-pull iterator conversions (`iter.Pull` and `iter.Pull2`). Guarantees that pull-iterator coroutines terminate predictably upon early consumer termination, panic propagation, or context cancellation without leaking coroutine goroutines or underlying OS/database resources.","antiPatternHeadline":"Orphaned Coroutine Goroutines and Leaked File/Connection Handles via Discarded iter.Pull Stop Functions","stars_count":68,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","concurrency","iterators","resource-cleanup","goroutine-leaks"],"exportEndpoints":{"claude":"/api/rules/go-coroutine-range-over-func-leak-prevention?format=claude","cursorMdc":"/api/rules/go-coroutine-range-over-func-leak-prevention?format=mdc","cursorrules":"/api/rules/go-coroutine-range-over-func-leak-prevention?format=cursor","windsurf":"/api/rules/go-coroutine-range-over-func-leak-prevention?format=windsurf","agents":"/api/rules/go-coroutine-range-over-func-leak-prevention?format=agents"}},{"id":"tauri-v2-mobile-ipc-zero-copy-binary-stream-standard","title":"Tauri 2.0 Mobile IPC Zero-Copy Binary & Telemetry Streaming Guardrail","category":"mobile","severity":"critical","description":"Enforces zero-copy raw binary transfer protocols and dedicated Web Worker offloading for high-frequency telemetry and sensor streams in Tauri 2.0 mobile applications. Eliminates JSON serialization, base64 encoding overhead, and main-thread event listener saturation that triggers Android/iOS WebView UI jank and severe frame drops.","antiPatternHeadline":"Serializing High-Frequency Binary Telemetry to JSON or Base64 over the Tauri Main Thread IPC Bridge","stars_count":93,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri-2","ipc","zero-copy","arraybuffer","performance","web-workers"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-mobile-ipc-zero-copy-binary-stream-standard?format=claude","cursorMdc":"/api/rules/tauri-v2-mobile-ipc-zero-copy-binary-stream-standard?format=mdc","cursorrules":"/api/rules/tauri-v2-mobile-ipc-zero-copy-binary-stream-standard?format=cursor","windsurf":"/api/rules/tauri-v2-mobile-ipc-zero-copy-binary-stream-standard?format=windsurf","agents":"/api/rules/tauri-v2-mobile-ipc-zero-copy-binary-stream-standard?format=agents"}},{"id":"webauthn-conditional-ui-rp-isolation","title":"WebAuthn Conditional UI RP Isolation & Tenant Boundary Invariant","category":"security","severity":"critical","description":"Mandates strict Relying Party ID (rpId) and clientDataJSON origin isolation for WebAuthn Conditional Mediation autofill across federated multi-tenant architectures. Prevents cross-subdomain passkey harvesting, ambient tenant credential leakage, and origin spoofing by cryptographically pinning tenant context to WebAuthn challenge generation and assertion verification.","antiPatternHeadline":"Permissive Root Domain RP ID Assignment and Unvalidated Dynamic Origin Trust in Passkey Autofill","stars_count":102,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","passkeys","conditional-ui","multi-tenant","fido2"],"exportEndpoints":{"claude":"/api/rules/webauthn-conditional-ui-rp-isolation?format=claude","cursorMdc":"/api/rules/webauthn-conditional-ui-rp-isolation?format=mdc","cursorrules":"/api/rules/webauthn-conditional-ui-rp-isolation?format=cursor","windsurf":"/api/rules/webauthn-conditional-ui-rp-isolation?format=windsurf","agents":"/api/rules/webauthn-conditional-ui-rp-isolation?format=agents"}},{"id":"ebpf-tetragon-realtime-kernel-syscall-enforcement-standard","title":"eBPF Tetragon Real-Time Kernel Syscall Enforcement Standard","category":"security","severity":"critical","description":"Enforces synchronous in-kernel interception and termination of anomalous container syscalls via eBPF Tetragon TracingPolicies before privilege escalation or container escape payloads execute. Prohibits asynchronous, out-of-band audit-only monitoring in perimeter-critical workloads by mandating Sigkill or Override action primitives tied directly to namespace and cgroup boundaries. Guarantees zero-overhead enforcement directly within the kprobe/tracepoint execution path without userspace round-trip delays.","antiPatternHeadline":"Post-Execution Asynchronous Audit Logging Instead of Synchronous In-Kernel Sigkill Termination","stars_count":92,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","ebpf","tetragon","kubernetes","runtime-security","cgroup-isolation"],"exportEndpoints":{"claude":"/api/rules/ebpf-tetragon-realtime-kernel-syscall-enforcement-standard?format=claude","cursorMdc":"/api/rules/ebpf-tetragon-realtime-kernel-syscall-enforcement-standard?format=mdc","cursorrules":"/api/rules/ebpf-tetragon-realtime-kernel-syscall-enforcement-standard?format=cursor","windsurf":"/api/rules/ebpf-tetragon-realtime-kernel-syscall-enforcement-standard?format=windsurf","agents":"/api/rules/ebpf-tetragon-realtime-kernel-syscall-enforcement-standard?format=agents"}},{"id":"opentelemetry-baggage-tail-sampling-guardrail","title":"OpenTelemetry Context Baggage & Collector Tail-Sampling Topology Guardrail","category":"devops","severity":"critical","description":"Enforces strict delineation between W3C Baggage and Span Attributes alongside two-tier OpenTelemetry Collector tail-based sampling. Baggage propagation must be minimal to avoid HTTP header bloat, while high-cardinality debugging metadata must be recorded as non-propagated span attributes evaluated for retention only when error or SLA thresholds are violated.","antiPatternHeadline":"Unbounded Baggage Injection and Head-Based Eager Sampling Leading to Network Header Bloat and Backend Ingestion Saturation","stars_count":61,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","distributed-tracing","tail-sampling","observability","otel-collector"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-baggage-tail-sampling-guardrail?format=claude","cursorMdc":"/api/rules/opentelemetry-baggage-tail-sampling-guardrail?format=mdc","cursorrules":"/api/rules/opentelemetry-baggage-tail-sampling-guardrail?format=cursor","windsurf":"/api/rules/opentelemetry-baggage-tail-sampling-guardrail?format=windsurf","agents":"/api/rules/opentelemetry-baggage-tail-sampling-guardrail?format=agents"}},{"id":"react-19-server-actions-cryptographic-nonce-replay-prevention","title":"React 19 Server Actions Cryptographic Nonce & Mutation Idempotency Boundary","category":"frontend","severity":"critical","description":"Mandates cryptographically verifiable, single-use idempotency nonces across all stateful React 19 Server Actions. Defeats replay attacks, eliminates duplicate mutations during optimistic streaming retries, and prevents cross-site state injection in multi-step transitions.","antiPatternHeadline":"Unbounded Server Action Invocations Permitting Replay Exploits and Concurrent Double-Mutation Execution","stars_count":43,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","server-actions","security","idempotency","use-optimistic"],"exportEndpoints":{"claude":"/api/rules/react-19-server-actions-cryptographic-nonce-replay-prevention?format=claude","cursorMdc":"/api/rules/react-19-server-actions-cryptographic-nonce-replay-prevention?format=mdc","cursorrules":"/api/rules/react-19-server-actions-cryptographic-nonce-replay-prevention?format=cursor","windsurf":"/api/rules/react-19-server-actions-cryptographic-nonce-replay-prevention?format=windsurf","agents":"/api/rules/react-19-server-actions-cryptographic-nonce-replay-prevention?format=agents"}},{"id":"declarative-shadow-dom-ssr-hydration-boundary-standard","title":"Declarative Shadow DOM SSR Hydration Boundary Isolation Standard","category":"frontend","severity":"critical","description":"Enforces strict Declarative Shadow DOM (DSD) boundaries for server-rendered web components and micro-frontends to eliminate Cumulative Layout Shift (CLS) and DOMException conflicts during client hydration. Mandates the use of standardized template attributes and non-destructive shadow root adoption before client scripts execute.","antiPatternHeadline":"Imperative attachShadow Overwrites and Missing shadowrootmode Fallbacks Causing FOUC and Hydration Crashes","stars_count":119,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","web-components","declarative-shadow-dom","ssr","micro-frontends","hydration"],"exportEndpoints":{"claude":"/api/rules/declarative-shadow-dom-ssr-hydration-boundary-standard?format=claude","cursorMdc":"/api/rules/declarative-shadow-dom-ssr-hydration-boundary-standard?format=mdc","cursorrules":"/api/rules/declarative-shadow-dom-ssr-hydration-boundary-standard?format=cursor","windsurf":"/api/rules/declarative-shadow-dom-ssr-hydration-boundary-standard?format=windsurf","agents":"/api/rules/declarative-shadow-dom-ssr-hydration-boundary-standard?format=agents"}},{"id":"temporal-workflow-determinism-replay-invariants","title":"Temporal.io Deterministic Workflow Execution & Replay Safety Guardrails","category":"backend","severity":"critical","description":"Enforces strict determinism constraints within Temporal workflow execution contexts to prevent non-deterministic history corruption during workflow replays. Mandates isolated side-effect delegation to Temporal Activities, deterministic runtime primitives, and versioned code-path branching via patching APIs for long-running orchestration sagas.","antiPatternHeadline":"Executing Non-Deterministic System Calls, Native Timers, or Unversioned Logic Mutations in Workflow Scopes","stars_count":88,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","temporal","orchestration","distributed-systems","determinism","saga-pattern"],"exportEndpoints":{"claude":"/api/rules/temporal-workflow-determinism-replay-invariants?format=claude","cursorMdc":"/api/rules/temporal-workflow-determinism-replay-invariants?format=mdc","cursorrules":"/api/rules/temporal-workflow-determinism-replay-invariants?format=cursor","windsurf":"/api/rules/temporal-workflow-determinism-replay-invariants?format=windsurf","agents":"/api/rules/temporal-workflow-determinism-replay-invariants?format=agents"}},{"id":"go-range-over-func-pull-iterator-cleanup-guardrail","title":"Go 1.24 Range-Over-Func Pull Iterator Defer Cleanup and Heap Leak Elimination","category":"backend","severity":"critical","description":"Mandates strict lifecycle management and explicit cleanup semantics for Go 1.24 range-over-func pull iterators created via iter.Pull and iter.Pull2. Eliminates coroutine runtime leaks, goroutine starvation, and high-frequency heap escapes during early breaks or consumer errors in streaming ingest engines.","antiPatternHeadline":"Discarding Pull Iterator Stop Closures Leading to Goroutine and Coroutine Resource Starvation","stars_count":75,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","iterators","concurrency","memory-leak","performance"],"exportEndpoints":{"claude":"/api/rules/go-range-over-func-pull-iterator-cleanup-guardrail?format=claude","cursorMdc":"/api/rules/go-range-over-func-pull-iterator-cleanup-guardrail?format=mdc","cursorrules":"/api/rules/go-range-over-func-pull-iterator-cleanup-guardrail?format=cursor","windsurf":"/api/rules/go-range-over-func-pull-iterator-cleanup-guardrail?format=windsurf","agents":"/api/rules/go-range-over-func-pull-iterator-cleanup-guardrail?format=agents"}},{"id":"pg17-logical-replication-failover-slot-sync-standard","title":"PostgreSQL 17 Failover-Safe Logical Replication Slot Synchronization","category":"backend","severity":"critical","description":"Enforces mandatory failover slot synchronization and physical standby synchronization boundaries for logical replication slots in PostgreSQL 17 topologies. Eliminates downstream CDC data loss, silent event skips, and replication lag panics during physical replica promotion by ensuring logical slots are synchronized to physical standbys with sync_replication_slots enabled. Prevents consumer consumption ahead of physical standby persistence.","antiPatternHeadline":"Creating unmanaged logical replication slots without failover sync or synchronized_standby_slots tracking","stars_count":79,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres","cdc","high-availability","database-reliability","distributed-systems"],"exportEndpoints":{"claude":"/api/rules/pg17-logical-replication-failover-slot-sync-standard?format=claude","cursorMdc":"/api/rules/pg17-logical-replication-failover-slot-sync-standard?format=mdc","cursorrules":"/api/rules/pg17-logical-replication-failover-slot-sync-standard?format=cursor","windsurf":"/api/rules/pg17-logical-replication-failover-slot-sync-standard?format=windsurf","agents":"/api/rules/pg17-logical-replication-failover-slot-sync-standard?format=agents"}},{"id":"tauri-v2-capability-scoped-ipc-permission-shield","title":"Tauri 2.0 Granular Capability-Scoped IPC Permission Shield and Origin Guardrail","category":"mobile","severity":"critical","description":"Enforces Tauri 2.0 compile-time JSON capability contracts and cryptographic IPC boundary isolation for hybrid mobile platforms. Eliminates wildcards in permission files, enforces window-level capability isolation, and mandates origin validation to prevent arbitrary native command execution from compromised webview contexts.","antiPatternHeadline":"Unrestricted IPC Access via Wildcard Permissions and Unscoped Window Capabilities","stars_count":99,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri-2","ipc-security","capabilities","rust"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-capability-scoped-ipc-permission-shield?format=claude","cursorMdc":"/api/rules/tauri-v2-capability-scoped-ipc-permission-shield?format=mdc","cursorrules":"/api/rules/tauri-v2-capability-scoped-ipc-permission-shield?format=cursor","windsurf":"/api/rules/tauri-v2-capability-scoped-ipc-permission-shield?format=windsurf","agents":"/api/rules/tauri-v2-capability-scoped-ipc-permission-shield?format=agents"}},{"id":"swift-6-strict-concurrency-actor-invariants","title":"Swift 6 Strict Concurrency Task-Isolated Actor Invariants","category":"mobile","severity":"critical","description":"Enforces Swift 6 complete concurrency safety across shared-memory multi-core mobile architectures by eliminating data races at compile time. Prohibits cross-actor mutable reference escapes, requires explicit isolation boundaries, and mandates value semantic Sendable types or compile-time region isolation transfers. Guarantees deterministic actor isolation and prevents actor reentrancy hazards.","antiPatternHeadline":"Escaping Non-Sendable Mutable References Across Actor Domains and Task Boundaries","stars_count":103,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","swift","concurrency","actors","ios","sendable"],"exportEndpoints":{"claude":"/api/rules/swift-6-strict-concurrency-actor-invariants?format=claude","cursorMdc":"/api/rules/swift-6-strict-concurrency-actor-invariants?format=mdc","cursorrules":"/api/rules/swift-6-strict-concurrency-actor-invariants?format=cursor","windsurf":"/api/rules/swift-6-strict-concurrency-actor-invariants?format=windsurf","agents":"/api/rules/swift-6-strict-concurrency-actor-invariants?format=agents"}},{"id":"spiffe-spire-x509-svid-rotation-standard","title":"SPIFFE/SPIRE Ephemeral X.509 SVID Dynamic In-Memory Auto-Rotation Standard","category":"security","severity":"critical","description":"Enforces dynamic consumption of SPIFFE X.509 SVIDs directly from SPIRE Workload API domain sockets without persisting secrets to disk or caching stale TLS contexts. Requires streaming Workload API listeners and dynamic TLS certificate reloading to guarantee uninterrupted mutual TLS during sub-hour identity rotation across heterogeneous multi-cloud topologies.","antiPatternHeadline":"Caching Static X.509 SVIDs or Persisting Ephemeral Keys to Filesystem Without Dynamic TLS Context Reloading","stars_count":59,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","spiffe","spire","zero-trust","mtls","x509-svid","cryptography"],"exportEndpoints":{"claude":"/api/rules/spiffe-spire-x509-svid-rotation-standard?format=claude","cursorMdc":"/api/rules/spiffe-spire-x509-svid-rotation-standard?format=mdc","cursorrules":"/api/rules/spiffe-spire-x509-svid-rotation-standard?format=cursor","windsurf":"/api/rules/spiffe-spire-x509-svid-rotation-standard?format=windsurf","agents":"/api/rules/spiffe-spire-x509-svid-rotation-standard?format=agents"}},{"id":"wasi-p2-capability-boundary-isolation-standard","title":"WASI 0.2 Component Model Least-Privilege Sandboxing & Capability Attenuation","category":"devops","severity":"critical","description":"Mandates mathematically sound capability attenuation for untrusted polyglot guest components executing within WASI 0.2 edge runtimes. Enforces strict zero-ambient-authority via discrete WASI context building, rejecting inherited host descriptors, wildcard socket allocations, and unfiltered outgoing HTTP handlers. Guarantees untrusted plugins cannot escape virtual preopened filesystems or breach runtime network perimeters.","antiPatternHeadline":"Ambient Descriptor Inheritance and Unconstrained Egress in WASI 0.2 Host Runtimes","stars_count":51,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","wasm","wasi-preview-2","sandboxing","edge-computing","security"],"exportEndpoints":{"claude":"/api/rules/wasi-p2-capability-boundary-isolation-standard?format=claude","cursorMdc":"/api/rules/wasi-p2-capability-boundary-isolation-standard?format=mdc","cursorrules":"/api/rules/wasi-p2-capability-boundary-isolation-standard?format=cursor","windsurf":"/api/rules/wasi-p2-capability-boundary-isolation-standard?format=windsurf","agents":"/api/rules/wasi-p2-capability-boundary-isolation-standard?format=agents"}},{"id":"nextjs-15-ppr-dynamic-hole-boundary-contract","title":"Next.js 15 PPR Shell Hydration & Dynamic Hole Boundary Contract","category":"frontend","severity":"critical","description":"Enforces strict isolation of dynamic runtime functions (cookies, headers, searchParams) inside granular React Suspense boundaries under Next.js 15 Partial Prerendering (PPR). Guarantees instantaneous edge delivery of the deterministic static shell while preventing route-wide de-optimization to runtime SSR and eliminating streaming hydration mismatches.","antiPatternHeadline":"Accessing dynamic runtime primitives at page or layout roots without Suspense encapsulation, collapsing the static shell into edge SSR.","stars_count":70,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs-15","partial-prerendering","suspense","react-server-components","hydration"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-ppr-dynamic-hole-boundary-contract?format=claude","cursorMdc":"/api/rules/nextjs-15-ppr-dynamic-hole-boundary-contract?format=mdc","cursorrules":"/api/rules/nextjs-15-ppr-dynamic-hole-boundary-contract?format=cursor","windsurf":"/api/rules/nextjs-15-ppr-dynamic-hole-boundary-contract?format=windsurf","agents":"/api/rules/nextjs-15-ppr-dynamic-hole-boundary-contract?format=agents"}},{"id":"axum-tokio-cancellation-token-cascading-abort-invariant","title":"Axum 0.8 Tokio CancellationToken Request Tree Cascading Abort Invariant","category":"backend","severity":"critical","description":"Enforces deterministic cancellation trees in Axum 0.8 applications by binding Tokio CancellationToken hierarchies to incoming HTTP request lifecycles. Prevents orphaned CPU-intensive operations, thread starvation, and dangling uncommitted database transactions when clients disconnect prematurely.","antiPatternHeadline":"Detached Workflows and Zombie Database Transactions on Client TCP Drop","stars_count":115,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tokio","concurrency","async","cancellation"],"exportEndpoints":{"claude":"/api/rules/axum-tokio-cancellation-token-cascading-abort-invariant?format=claude","cursorMdc":"/api/rules/axum-tokio-cancellation-token-cascading-abort-invariant?format=mdc","cursorrules":"/api/rules/axum-tokio-cancellation-token-cascading-abort-invariant?format=cursor","windsurf":"/api/rules/axum-tokio-cancellation-token-cascading-abort-invariant?format=windsurf","agents":"/api/rules/axum-tokio-cancellation-token-cascading-abort-invariant?format=agents"}},{"id":"openfga-contextual-tuple-mutation-boundary-standard","title":"OpenFGA Contextual Tuple Mutation Boundary & Read-After-Write Consistency Standard","category":"security","severity":"critical","description":"Enforces strict causal read-after-write consistency and transactional boundaries when mutating and evaluating OpenFGA relationship tuples. Mitigates authorization cache-drift, stale read replication lag, and window-of-exposure vulnerabilities in distributed zero-trust systems by requiring contextual tuple validation and client-side consistency token chaining during concurrent authorization checks.","antiPatternHeadline":"Asynchronous OpenFGA writes followed immediately by cached or un-tokenized check evaluations leading to unauthorized authorization state leakage","stars_count":61,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","authorization","rebac","consistency-token","distributed-systems"],"exportEndpoints":{"claude":"/api/rules/openfga-contextual-tuple-mutation-boundary-standard?format=claude","cursorMdc":"/api/rules/openfga-contextual-tuple-mutation-boundary-standard?format=mdc","cursorrules":"/api/rules/openfga-contextual-tuple-mutation-boundary-standard?format=cursor","windsurf":"/api/rules/openfga-contextual-tuple-mutation-boundary-standard?format=windsurf","agents":"/api/rules/openfga-contextual-tuple-mutation-boundary-standard?format=agents"}},{"id":"ebpf-tetragon-namespace-escape-prevention-standard","title":"eBPF Tetragon Kernel Sensor Enclave & Process Namespace Escape Prevention Standard","category":"devops","severity":"critical","description":"Enforces synchronous in-kernel enforcement of process and capability invariants using Tetragon TracingPolicies to terminate container escapes at the kprobe/fentry layer. Prevents post-execution race conditions by binding SIGKILL actions directly inside the kernel execution path before sensitive syscall commits complete. Guarantees that any namespace transition, unauthorized capability elevation, or host rootfs mount access results in immediate process group termination.","antiPatternHeadline":"Asynchronous User-Space Auditing and Permissive TracingPolicies Failing to Halt In-Flight Namespace Breakouts","stars_count":78,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","tetragon","kubernetes","security","runtime-enforcement"],"exportEndpoints":{"claude":"/api/rules/ebpf-tetragon-namespace-escape-prevention-standard?format=claude","cursorMdc":"/api/rules/ebpf-tetragon-namespace-escape-prevention-standard?format=mdc","cursorrules":"/api/rules/ebpf-tetragon-namespace-escape-prevention-standard?format=cursor","windsurf":"/api/rules/ebpf-tetragon-namespace-escape-prevention-standard?format=windsurf","agents":"/api/rules/ebpf-tetragon-namespace-escape-prevention-standard?format=agents"}},{"id":"pg17-failover-slot-sync-wal-retention-guardrail","title":"PostgreSQL 17 Failover Slot Synchronization & WAL Retention Guardrail","category":"backend","severity":"critical","description":"Enforces PostgreSQL 17 native logical replication slot synchronization on physical standbys alongside deterministic max_slot_wal_keep_size thresholds. Guarantees zero downstream logical subscriber rebuilds upon regional primary promotion while strictly preventing primary cluster storage exhaustion from disconnected slots.","antiPatternHeadline":"Unsynchronized Standby Slots with Unbounded WAL Retention Crashing Disks During Failovers","stars_count":111,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","replication","high-availability","database-reliability"],"exportEndpoints":{"claude":"/api/rules/pg17-failover-slot-sync-wal-retention-guardrail?format=claude","cursorMdc":"/api/rules/pg17-failover-slot-sync-wal-retention-guardrail?format=mdc","cursorrules":"/api/rules/pg17-failover-slot-sync-wal-retention-guardrail?format=cursor","windsurf":"/api/rules/pg17-failover-slot-sync-wal-retention-guardrail?format=windsurf","agents":"/api/rules/pg17-failover-slot-sync-wal-retention-guardrail?format=agents"}},{"id":"cmp-retained-state-cross-platform-lifecycle-contract","title":"Compose Multiplatform Retained State & Cross-Process Lifecycle Eviction Contract","category":"mobile","severity":"critical","description":"Enforces deterministic state restoration and native bridge lifecycle synchronization between Android ViewModel/SavedState semantics and iOS UIViewController/Jetsam lifecycles. Prevents silent state loss on Android OS process recreation and eliminates retain cycles between Kotlin/Native GC and Swift ARC under extreme memory pressure.","antiPatternHeadline":"Retaining In-Memory Compose State Without SavedState Serialization and Leaking Kotlin-Darwin Native Bridges Across View Controller Eviction","stars_count":49,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","compose-multiplatform","kotlin-multiplatform","lifecycle","saved-state","memory-management"],"exportEndpoints":{"claude":"/api/rules/cmp-retained-state-cross-platform-lifecycle-contract?format=claude","cursorMdc":"/api/rules/cmp-retained-state-cross-platform-lifecycle-contract?format=mdc","cursorrules":"/api/rules/cmp-retained-state-cross-platform-lifecycle-contract?format=cursor","windsurf":"/api/rules/cmp-retained-state-cross-platform-lifecycle-contract?format=windsurf","agents":"/api/rules/cmp-retained-state-cross-platform-lifecycle-contract?format=agents"}},{"id":"rfc-9420-mls-epoch-ratchet-commit-storage-guardrail","title":"RFC 9420 MLS Atomic Epoch Ratchet Commit & State Persistence Guardrail","category":"security","severity":"critical","description":"Enforces strict atomicity and monotonic ordering during RFC 9420 MLS Epoch Commit processing to prevent forward-secrecy loss and state desynchronization. Out-of-order concurrent commits must be serialized with optimistic concurrency checks, and epoch state transitions (ratchet tree, group context, and epoch secrets) must commit in an isolated transaction. Superseded ratchet secrets and ephemeral keys must be zeroized immediately upon commit confirmation.","antiPatternHeadline":"Non-Atomic Epoch Ratchet Mutations Allowing State Desynchronization and Stale Secret Retention","stars_count":42,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","cryptography","mls","rfc-9420","forward-secrecy","concurrency","storage"],"exportEndpoints":{"claude":"/api/rules/rfc-9420-mls-epoch-ratchet-commit-storage-guardrail?format=claude","cursorMdc":"/api/rules/rfc-9420-mls-epoch-ratchet-commit-storage-guardrail?format=mdc","cursorrules":"/api/rules/rfc-9420-mls-epoch-ratchet-commit-storage-guardrail?format=cursor","windsurf":"/api/rules/rfc-9420-mls-epoch-ratchet-commit-storage-guardrail?format=windsurf","agents":"/api/rules/rfc-9420-mls-epoch-ratchet-commit-storage-guardrail?format=agents"}},{"id":"vite6-mf-bidirectional-singleton-isolation-standard","title":"Vite 6 Bi-Directional Module Federation Shared Singleton & Edge Memory Isolation Standard","category":"frontend","severity":"critical","description":"Enforces deterministic shared dependency resolution, strict singleton scoping, and context lifecycle isolation for Vite 6 bi-directional Module Federation. Prevents split-brain context corruption (e.g., duplicated React/Zustand instances) and cross-request memory leaks during edge-node SSR hydration.","antiPatternHeadline":"Lax Shared Dependency Declarations and Global Symbol Leaks in Bi-Directional Edge Remotes","stars_count":114,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["vite6","module-federation","micro-frontends","singleton-isolation","react-context","edge-runtime"],"exportEndpoints":{"claude":"/api/rules/vite6-mf-bidirectional-singleton-isolation-standard?format=claude","cursorMdc":"/api/rules/vite6-mf-bidirectional-singleton-isolation-standard?format=mdc","cursorrules":"/api/rules/vite6-mf-bidirectional-singleton-isolation-standard?format=cursor","windsurf":"/api/rules/vite6-mf-bidirectional-singleton-isolation-standard?format=windsurf","agents":"/api/rules/vite6-mf-bidirectional-singleton-isolation-standard?format=agents"}},{"id":"otel-ebpf-profiler-overhead-circuit-breaker","title":"OTel eBPF Profiler Dynamic Overhead Circuit Breaker & Adaptive Rate Throttling","category":"devops","severity":"critical","description":"Mandates an automated runtime supervisor and eBPF sampling governor for OpenTelemetry continuous profiling agents in high-density Kubernetes environments. Enforces adaptive stack-unwinding frequency scaling and a failsafe circuit breaker to guarantee profiler CPU consumption stays strictly below 1% and RSS memory below 50MiB during severe thread contention and process-fork storms. Prevents kernel BPF ring-buffer lockups, cgroup throttling cascades, and noisy-neighbor node eviction.","antiPatternHeadline":"Unbounded eBPF Stack Walk Collection During Thread Contention Cascades","stars_count":117,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","ebpf","continuous-profiling","kubernetes","circuit-breaker","performance"],"exportEndpoints":{"claude":"/api/rules/otel-ebpf-profiler-overhead-circuit-breaker?format=claude","cursorMdc":"/api/rules/otel-ebpf-profiler-overhead-circuit-breaker?format=mdc","cursorrules":"/api/rules/otel-ebpf-profiler-overhead-circuit-breaker?format=cursor","windsurf":"/api/rules/otel-ebpf-profiler-overhead-circuit-breaker?format=windsurf","agents":"/api/rules/otel-ebpf-profiler-overhead-circuit-breaker?format=agents"}},{"id":"drizzle-orm-zero-allocation-batch-prepared-cache","title":"Drizzle ORM 0.38 Zero-Allocation Batch Prepared Statement Cache Invariant","category":"backend","severity":"critical","description":"Enforces static module-level prepared statement instantiation and deterministic placeholder binding in Drizzle ORM 0.38 on edge runtimes. Prevents dynamic query compilation, AST regeneration, and ephemeral statement allocations inside hot ingestion loops to eliminate V8 garbage collection pauses.","antiPatternHeadline":"Dynamic In-Loop Query Compilation and Ephemeral Prepared Statements Inducing Heap Fragmentation and Isolate GC Spikes","stars_count":113,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","drizzle-orm","edge-runtime","performance","memory-management","v8"],"exportEndpoints":{"claude":"/api/rules/drizzle-orm-zero-allocation-batch-prepared-cache?format=claude","cursorMdc":"/api/rules/drizzle-orm-zero-allocation-batch-prepared-cache?format=mdc","cursorrules":"/api/rules/drizzle-orm-zero-allocation-batch-prepared-cache?format=cursor","windsurf":"/api/rules/drizzle-orm-zero-allocation-batch-prepared-cache?format=windsurf","agents":"/api/rules/drizzle-orm-zero-allocation-batch-prepared-cache?format=agents"}},{"id":"nextjs-15-ppr-dynamic-boundary-standard-next-js-15-parti-940","title":"Next.js 15 Partial Prerendering (PPR) Dynamic Boundary Standard","category":"frontend","severity":"critical","description":"Enforces strict structural segregation between static edge cache shells and dynamic streaming Suspense boundaries under Next.js 15 Partial Prerendering (PPR). Prevents dynamic API leakage (such as async cookies, headers, and uncached data fetches) from poisoning static page shells and collapsing entire routes into dynamic runtime execution.","antiPatternHeadline":"Uncontained Dynamic API Access in Static Route Shells Causing Full PPR De-optimization","stars_count":92,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["nextjs15","ppr","react-suspense","performance","edge-cache","ttfb"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-ppr-dynamic-boundary-standard-next-js-15-parti-940?format=claude","cursorMdc":"/api/rules/nextjs-15-ppr-dynamic-boundary-standard-next-js-15-parti-940?format=mdc","cursorrules":"/api/rules/nextjs-15-ppr-dynamic-boundary-standard-next-js-15-parti-940?format=cursor","windsurf":"/api/rules/nextjs-15-ppr-dynamic-boundary-standard-next-js-15-parti-940?format=windsurf","agents":"/api/rules/nextjs-15-ppr-dynamic-boundary-standard-next-js-15-parti-940?format=agents"}},{"id":"fastapi-pydanticv2-strict-anyio-concurrency-budgets","title":"FastAPI Pydantic V2 Strict Mode & AnyIO Concurrency Budgets","category":"backend","severity":"critical","description":"Enforces Pydantic V2 strict validation across all request DTOs to eliminate silent type coercion vulnerabilities while mandating explicit AnyIO CapacityLimiter tokens for offloaded synchronous work to prevent threadpool saturation and event loop starvation under load.","antiPatternHeadline":"Silent Data Mutation via Lax Pydantic Coercion Combined with Unbounded AnyIO Threadpool Saturation","stars_count":98,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","pydantic-v2","anyio","asyncio","python","concurrency"],"exportEndpoints":{"claude":"/api/rules/fastapi-pydanticv2-strict-anyio-concurrency-budgets?format=claude","cursorMdc":"/api/rules/fastapi-pydanticv2-strict-anyio-concurrency-budgets?format=mdc","cursorrules":"/api/rules/fastapi-pydanticv2-strict-anyio-concurrency-budgets?format=cursor","windsurf":"/api/rules/fastapi-pydanticv2-strict-anyio-concurrency-budgets?format=windsurf","agents":"/api/rules/fastapi-pydanticv2-strict-anyio-concurrency-budgets?format=agents"}},{"id":"go-chi-context-propagation-streaming-guardrails","title":"Go Chi Context Propagation & Zero-Leak HTTP Streaming Guardrails","category":"backend","severity":"critical","description":"Enforces strict request context tree propagation and deterministic connection resource cleanup in Go Chi HTTP servers. Mandates explicit cancellation listener loops and connection-hijack buffer draining to eliminate goroutine leaks, socket exhaustion, and zombie background workers in high-throughput Server-Sent Events (SSE) and WebSocket endpoints.","antiPatternHeadline":"Orphaned Goroutines and Leaked File Descriptors via Detached Contexts and Unmonitored HTTP Streaming Loops","stars_count":81,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","golang","go-chi","concurrency","sse","websockets","leak-prevention"],"exportEndpoints":{"claude":"/api/rules/go-chi-context-propagation-streaming-guardrails?format=claude","cursorMdc":"/api/rules/go-chi-context-propagation-streaming-guardrails?format=mdc","cursorrules":"/api/rules/go-chi-context-propagation-streaming-guardrails?format=cursor","windsurf":"/api/rules/go-chi-context-propagation-streaming-guardrails?format=windsurf","agents":"/api/rules/go-chi-context-propagation-streaming-guardrails?format=agents"}},{"id":"capacitor-7-hardware-keystore-enclave-bridge","title":"Capacitor 7 Hardware-Backed StrongBox and Secure Enclave Bridge Protocol","category":"mobile","severity":"critical","description":"Enforces hardware-backed cryptographic key isolation using Android StrongBox/TEE Keystore and iOS Secure Enclave for Capacitor 7 hybrid mobile applications. Prevents plaintext key exposure across the JavaScript-to-native bridge and guarantees hardware-bound biometric authentication lifecycles with explicit enrollment invalidation.","antiPatternHeadline":"Software-Emulated Keystore Fallback and Plaintext Key Transit Over Web-Native Bridge","stars_count":68,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor-7","secure-enclave","strongbox","biometrics","keystore","cryptography"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-hardware-keystore-enclave-bridge?format=claude","cursorMdc":"/api/rules/capacitor-7-hardware-keystore-enclave-bridge?format=mdc","cursorrules":"/api/rules/capacitor-7-hardware-keystore-enclave-bridge?format=cursor","windsurf":"/api/rules/capacitor-7-hardware-keystore-enclave-bridge?format=windsurf","agents":"/api/rules/capacitor-7-hardware-keystore-enclave-bridge?format=agents"}},{"id":"openfga-rebac-contextual-cache-invalidation","title":"Deterministic OpenFGA Contextual Tuple Evaluation and Real-Time Invalidation","category":"security","severity":"critical","description":"Enforces deterministic cryptographic cache key hashing and real-time event-driven cache invalidation for OpenFGA ReBAC graph evaluations. Prevents stale authorization privilege retention and cache poisoning by strictly binding contextual tuple snapshots, quantized temporal attributes, and transactional write invalidations to graph check operations.","antiPatternHeadline":"Static TTL Caching of ReBAC Graph Checks with Non-Deterministic Contextual Tuples and Unsynchronized Tuple Mutation","stars_count":71,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","rebac","authorization","cache-invalidation","redis"],"exportEndpoints":{"claude":"/api/rules/openfga-rebac-contextual-cache-invalidation?format=claude","cursorMdc":"/api/rules/openfga-rebac-contextual-cache-invalidation?format=mdc","cursorrules":"/api/rules/openfga-rebac-contextual-cache-invalidation?format=cursor","windsurf":"/api/rules/openfga-rebac-contextual-cache-invalidation?format=windsurf","agents":"/api/rules/openfga-rebac-contextual-cache-invalidation?format=agents"}},{"id":"pq-hybrid-mlkem-x25519-tls13-standard","title":"Post-Quantum ML-KEM/X25519 Hybrid TLS 1.3 Key Exchange Enforcement","category":"security","severity":"critical","description":"Enforces mandatory hybrid post-quantum key exchange (FIPS 203 ML-KEM-768 combined with X25519) on all enterprise TLS 1.3 ingress terminations to defeat Harvest Now, Decrypt Later (HNDL) attacks. Disallows legacy TLS 1.2, prohibits classical-only key-exchange groups in secure profiles, and strictly mandates PQ-hybrid group preference ordering across API gateway listeners.","antiPatternHeadline":"Permitting Pure Classical ECDHE Key Agreement in Enterprise Ingress Terminations","stars_count":118,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","cryptography","tls13","post-quantum","ml-kem","hndl","ingress"],"exportEndpoints":{"claude":"/api/rules/pq-hybrid-mlkem-x25519-tls13-standard?format=claude","cursorMdc":"/api/rules/pq-hybrid-mlkem-x25519-tls13-standard?format=mdc","cursorrules":"/api/rules/pq-hybrid-mlkem-x25519-tls13-standard?format=cursor","windsurf":"/api/rules/pq-hybrid-mlkem-x25519-tls13-standard?format=windsurf","agents":"/api/rules/pq-hybrid-mlkem-x25519-tls13-standard?format=agents"}},{"id":"opentelemetry-w3c-queue-context-propagation","title":"Strict W3C Distributed Context & Baggage Propagation Across Async Queues","category":"devops","severity":"critical","description":"Enforces deterministic extraction and injection of OpenTelemetry W3C traceparent and baggage metadata across asynchronous queue boundaries (Kafka, SQS, RabbitMQ, BullMQ). Eliminates trace fragmentation and orphan spans by ensuring consumers restore caller context or establish explicit span links before executing worker logic.","antiPatternHeadline":"Silent Trace Fragmentation via In-Band Payload Dispatch without W3C Context Carrier Injection","stars_count":110,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","distributed-tracing","w3c-trace-context","async-queues","microservices"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-w3c-queue-context-propagation?format=claude","cursorMdc":"/api/rules/opentelemetry-w3c-queue-context-propagation?format=mdc","cursorrules":"/api/rules/opentelemetry-w3c-queue-context-propagation?format=cursor","windsurf":"/api/rules/opentelemetry-w3c-queue-context-propagation?format=windsurf","agents":"/api/rules/opentelemetry-w3c-queue-context-propagation?format=agents"}},{"id":"vite6-environment-api-multi-runtime-sandboxing","title":"Vite 6 Environment API Multi-Runtime Module Sandboxing and Isolation","category":"frontend","severity":"critical","description":"Enforces architectural isolation of distinct module graphs and execution contexts across Node.js, Edge (workerd), and browser targets using the Vite 6 Environment API. Prevents cross-runtime global state leakage, invalid Node.js built-in resolution in Edge/client bundles, and cross-polluted module caches in universal SSR pipelines.","antiPatternHeadline":"Cross-Runtime Module Graph Pollution and Shared Global State in Universal Vite 6 SSR","stars_count":118,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["vite","vite6","environment-api","ssr","edge-runtime","module-runner"],"exportEndpoints":{"claude":"/api/rules/vite6-environment-api-multi-runtime-sandboxing?format=claude","cursorMdc":"/api/rules/vite6-environment-api-multi-runtime-sandboxing?format=mdc","cursorrules":"/api/rules/vite6-environment-api-multi-runtime-sandboxing?format=cursor","windsurf":"/api/rules/vite6-environment-api-multi-runtime-sandboxing?format=windsurf","agents":"/api/rules/vite6-environment-api-multi-runtime-sandboxing?format=agents"}},{"id":"axum-tokio-graceful-connection-draining-barrier","title":"Axum 0.8 Deterministic HTTP/2 Graceful Draining Barrier","category":"backend","severity":"critical","description":"Enforces a two-phase connection draining barrier for Axum 0.8 and Tokio servers during orchestrated rolling deployments. Prevents client-side TCP resets and dropped HTTP/2 multiplexed streams by ensuring network mesh/ingress deregistration delays precede server shutdown, followed by deterministic HTTP/2 GOAWAY frame emission and in-flight request draining.","antiPatternHeadline":"Immediate Process Termination and Abrupt Socket Drops During Ingress Rollouts","stars_count":43,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tokio","hyper","kubernetes","networking"],"exportEndpoints":{"claude":"/api/rules/axum-tokio-graceful-connection-draining-barrier?format=claude","cursorMdc":"/api/rules/axum-tokio-graceful-connection-draining-barrier?format=mdc","cursorrules":"/api/rules/axum-tokio-graceful-connection-draining-barrier?format=cursor","windsurf":"/api/rules/axum-tokio-graceful-connection-draining-barrier?format=windsurf","agents":"/api/rules/axum-tokio-graceful-connection-draining-barrier?format=agents"}},{"id":"bun-websocket-dynamic-backpressure-autopacing","title":"Bun 1.2 WebSocket Dynamic Backpressure Auto-Pacing Standard","category":"backend","severity":"critical","description":"Enforces strict socket-level backpressure management during high-throughput WebSocket broadcast and fan-out operations in Bun 1.2+. Eliminates unconstrained heap memory growth and OOM crashes by monitoring `ws.getBufferedAmount()` and suspending publisher pipelines until the `drain` event clears the kernel network buffer.","antiPatternHeadline":"Unchecked Fire-and-Forget Broadcast Loops Causing Heap Exhaustion Under Slow Clients","stars_count":114,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","websockets","backpressure","networking","high-throughput"],"exportEndpoints":{"claude":"/api/rules/bun-websocket-dynamic-backpressure-autopacing?format=claude","cursorMdc":"/api/rules/bun-websocket-dynamic-backpressure-autopacing?format=mdc","cursorrules":"/api/rules/bun-websocket-dynamic-backpressure-autopacing?format=cursor","windsurf":"/api/rules/bun-websocket-dynamic-backpressure-autopacing?format=windsurf","agents":"/api/rules/bun-websocket-dynamic-backpressure-autopacing?format=agents"}},{"id":"postgres-17-json-table-vectorized-projection-guardrail","title":"Postgres 17 JSON_TABLE Projection & Nested Path Bounded Guardrail","category":"backend","severity":"critical","description":"Enforces strict structural constraints, index-backed predicate pushdowns, and nesting boundaries on PostgreSQL 17 JSON_TABLE queries. Unbounded JSON path traversals and unindexed JSON_TABLE expansions cause quadratic memory expansion in work_mem and disk spillages on multi-gigabyte JSONB datasets. All transformations must combine jsonb_path_ops index filtering with bounded path projections to preserve query engine throughput.","antiPatternHeadline":"Unbounded JSON_TABLE evaluation scanning raw JSONB without indexed pushdown and Cartesian sibling nesting","stars_count":115,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","postgres-17","json-table","jsonb","query-optimization","database-performance"],"exportEndpoints":{"claude":"/api/rules/postgres-17-json-table-vectorized-projection-guardrail?format=claude","cursorMdc":"/api/rules/postgres-17-json-table-vectorized-projection-guardrail?format=mdc","cursorrules":"/api/rules/postgres-17-json-table-vectorized-projection-guardrail?format=cursor","windsurf":"/api/rules/postgres-17-json-table-vectorized-projection-guardrail?format=windsurf","agents":"/api/rules/postgres-17-json-table-vectorized-projection-guardrail?format=agents"}},{"id":"kmp-2-1-swift-export-abi-layout-invariant","title":"Kotlin Multiplatform 2.1 Swift Export Direct ABI Value Layout","category":"mobile","severity":"critical","description":"Enforces direct Swift-Kotlin value-type memory alignment via Kotlin 2.1+ Swift Export, bypassing the legacy Objective-C runtime bridge. Eliminates heap allocations and boxing overhead (NSNumber/NSObject wrappers) on high-throughput native iOS execution paths. Guarantees predictable unboxed struct and scalar mappings across the native binary interface.","antiPatternHeadline":"Routing High-Frequency Data Across Legacy Obj-C XCFramework Bridges Inducing NSNumber Boxing and objc_msgSend Overhead","stars_count":99,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","swift-export","abi","ios-performance"],"exportEndpoints":{"claude":"/api/rules/kmp-2-1-swift-export-abi-layout-invariant?format=claude","cursorMdc":"/api/rules/kmp-2-1-swift-export-abi-layout-invariant?format=mdc","cursorrules":"/api/rules/kmp-2-1-swift-export-abi-layout-invariant?format=cursor","windsurf":"/api/rules/kmp-2-1-swift-export-abi-layout-invariant?format=windsurf","agents":"/api/rules/kmp-2-1-swift-export-abi-layout-invariant?format=agents"}},{"id":"android-15-private-space-decoupled-storage-isolation","title":"Android 15 Private Space Decoupled Storage & Cryptographic Isolation","category":"mobile","severity":"critical","description":"Enforces strict cryptographic hardware key isolation, profile-specific storage scoping, and decoupled cache lifecycles under Android 15 Private Space. Prohibits cross-profile keystore reuse, shared static singletons across profile boundaries, and uncleared memory-mapped storage when private profiles are locked or suspended.","antiPatternHeadline":"Cross-Profile Key Reuse and Static Cache Persistence Across Android 15 Private Space Boundaries","stars_count":67,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","android-15","private-space","keystore","storage-sandbox","security"],"exportEndpoints":{"claude":"/api/rules/android-15-private-space-decoupled-storage-isolation?format=claude","cursorMdc":"/api/rules/android-15-private-space-decoupled-storage-isolation?format=mdc","cursorrules":"/api/rules/android-15-private-space-decoupled-storage-isolation?format=cursor","windsurf":"/api/rules/android-15-private-space-decoupled-storage-isolation?format=windsurf","agents":"/api/rules/android-15-private-space-decoupled-storage-isolation?format=agents"}},{"id":"spiffe-spire-svid-rotation-standard","title":"Kernel-Attested Dynamic X.509 SVID Lifecycle and In-Memory Rotation Standard","category":"security","severity":"critical","description":"Enforces strict workload microsegmentation and cryptographic identity binding by streaming dynamic, short-lived X.509 SVIDs via local SPIFFE Workload API Unix Domain Sockets. Prohibits static long-lived credentials, disk caching of private keys, and manual TLS context restarts by requiring asynchronous in-memory keypair rotations upon Workload API updates.","antiPatternHeadline":"Mounting Static Certificates, Hardcoded API Secrets, or Persisting Workload Private Keys to Ephemeral Disk","stars_count":65,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","spiffe","spire","mTLS","zero-trust","cryptography","microsegmentation"],"exportEndpoints":{"claude":"/api/rules/spiffe-spire-svid-rotation-standard?format=claude","cursorMdc":"/api/rules/spiffe-spire-svid-rotation-standard?format=mdc","cursorrules":"/api/rules/spiffe-spire-svid-rotation-standard?format=cursor","windsurf":"/api/rules/spiffe-spire-svid-rotation-standard?format=windsurf","agents":"/api/rules/spiffe-spire-svid-rotation-standard?format=agents"}},{"id":"openfga-transitive-userset-graph-depth-guardrail","title":"OpenFGA Transitive Userset Graph Depth Traversal and Cycle Mitigation Standard","category":"security","severity":"critical","description":"Enforces bounded recursion depth limits and deterministic cycle detection across transitive relational usersets in OpenFGA authorization checks. Mitigates stack exhaustion, exponential state explosion, and denial-of-service vectors caused by self-referential or deeply nested tuple-to-userset relations.","antiPatternHeadline":"Unbounded Userset Traversal and Missing Graph Depth Guardrails","stars_count":97,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","rebac","authorization","dos-prevention","graph-traversal"],"exportEndpoints":{"claude":"/api/rules/openfga-transitive-userset-graph-depth-guardrail?format=claude","cursorMdc":"/api/rules/openfga-transitive-userset-graph-depth-guardrail?format=mdc","cursorrules":"/api/rules/openfga-transitive-userset-graph-depth-guardrail?format=cursor","windsurf":"/api/rules/openfga-transitive-userset-graph-depth-guardrail?format=windsurf","agents":"/api/rules/openfga-transitive-userset-graph-depth-guardrail?format=agents"}},{"id":"otel-exponential-histogram-bucketing-standard","title":"OpenTelemetry Exponential Histogram Bucketing & Cardinality Guardrail","category":"devops","severity":"critical","description":"Enforces Base-2 Exponential Bucket Histograms across OpenTelemetry MetricReaders to guarantee constant-relative-error latency tracking while capping memory consumption. Prohibits explicit boundary histograms on microsecond/millisecond latency metrics that cause unbounded memory overhead or inaccurate tail percentiles. Mandates strict cardinality bounding per instrument and view-level aggregation controls to defend against distributed denial-of-memory under high-throughput label variations.","antiPatternHeadline":"Unbounded Explicit Boundary Histograms and Unsanitized Attribute Cardinality Inducing Memory Leaks and Percentile Distortion","stars_count":51,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","metrics","observability","performance","histograms"],"exportEndpoints":{"claude":"/api/rules/otel-exponential-histogram-bucketing-standard?format=claude","cursorMdc":"/api/rules/otel-exponential-histogram-bucketing-standard?format=mdc","cursorrules":"/api/rules/otel-exponential-histogram-bucketing-standard?format=cursor","windsurf":"/api/rules/otel-exponential-histogram-bucketing-standard?format=windsurf","agents":"/api/rules/otel-exponential-histogram-bucketing-standard?format=agents"}},{"id":"ebpf-tc-egress-bandwidth-scheduling-standard","title":"eBPF TC Egress Packet Scheduling & Multi-Tenant Bandwidth Isolation","category":"devops","severity":"critical","description":"Enforces deterministic kernel-space egress traffic shaping and tenant rate limiting via eBPF Traffic Control (TC) BPF_PROG_TYPE_SCHED_ACT programs. Prevents noisy-neighbor egress bandwidth starvation on multi-tenant Kubernetes nodes by binding Token Bucket Filter (TBF) and Earliest Departure Time (EDT) scheduling algorithms directly to virtual ethernet and physical root interfaces.","antiPatternHeadline":"Relying on Userspace Rate Limiters or Best-Effort CNI QoS Without Kernel-Level TC Egress Queue Enforcement","stars_count":47,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","traffic-control","kubernetes","networking","cni","qos"],"exportEndpoints":{"claude":"/api/rules/ebpf-tc-egress-bandwidth-scheduling-standard?format=claude","cursorMdc":"/api/rules/ebpf-tc-egress-bandwidth-scheduling-standard?format=mdc","cursorrules":"/api/rules/ebpf-tc-egress-bandwidth-scheduling-standard?format=cursor","windsurf":"/api/rules/ebpf-tc-egress-bandwidth-scheduling-standard?format=windsurf","agents":"/api/rules/ebpf-tc-egress-bandwidth-scheduling-standard?format=agents"}},{"id":"ebpf-tetragon-kernel-syscall-quarantine-standard","title":"eBPF Tetragon In-Kernel Syscall Quarantine & Namespace Isolation Standard","category":"security","severity":"critical","description":"Mandates deterministic, in-kernel enforcement using Tetragon TracingPolicy resources with synchronous Sigkill actions rather than asynchronous userspace alert pipelines. Eliminates time-of-check to time-of-use (TOCTOU) race conditions during container escapes, privilege escalations, and unauthorized namespace traversals.","antiPatternHeadline":"Relying on Userspace Audit Collectors and Asynchronous Alerts for Container Escape Syscalls","stars_count":65,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","ebpf","tetragon","kubernetes","kernel","zero-trust"],"exportEndpoints":{"claude":"/api/rules/ebpf-tetragon-kernel-syscall-quarantine-standard?format=claude","cursorMdc":"/api/rules/ebpf-tetragon-kernel-syscall-quarantine-standard?format=mdc","cursorrules":"/api/rules/ebpf-tetragon-kernel-syscall-quarantine-standard?format=cursor","windsurf":"/api/rules/ebpf-tetragon-kernel-syscall-quarantine-standard?format=windsurf","agents":"/api/rules/ebpf-tetragon-kernel-syscall-quarantine-standard?format=agents"}},{"id":"react-19-rsc-taint-boundary-serialization","title":"React 19 RSC Taint Boundary Serialization Invariant","category":"frontend","severity":"critical","description":"Mandates strict object-level and cryptographic value taint tracking via React 19 Taint APIs to prevent sensitive server-only entities, database records, and secret tokens from crossing the React Server Component Flight serialization boundary. Enforces explicit DTO projection and immediate failure on inadvertent client exposure.","antiPatternHeadline":"Leaking Raw Database Models or Cryptographic Secrets to Client Components via RSC Flight Stream Serialization","stars_count":64,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","rsc","taint-api","security","flight-protocol"],"exportEndpoints":{"claude":"/api/rules/react-19-rsc-taint-boundary-serialization?format=claude","cursorMdc":"/api/rules/react-19-rsc-taint-boundary-serialization?format=mdc","cursorrules":"/api/rules/react-19-rsc-taint-boundary-serialization?format=cursor","windsurf":"/api/rules/react-19-rsc-taint-boundary-serialization?format=windsurf","agents":"/api/rules/react-19-rsc-taint-boundary-serialization?format=agents"}},{"id":"opentelemetry-genai-baggage-quarantine","title":"OpenTelemetry GenAI Semantic Conventions and PII Baggage Quarantine","category":"devops","severity":"critical","description":"Enforces strict compliance with OpenTelemetry GenAI Semantic Conventions while establishing an active quarantine perimeter around W3C baggage and span attributes. Guarantees that multi-agent contextual correlation tokens persist across distributed service hops without leaking raw prompts, model responses, or personally identifiable information (PII) into telemetry backends or egress headers.","antiPatternHeadline":"Indiscriminate Telemetry Baggage Injection and Raw Prompt Span Pollution Leaking Sensitive Data Across Service Hops","stars_count":74,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","genai","distributed-tracing","pii-sanitization","observability"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-genai-baggage-quarantine?format=claude","cursorMdc":"/api/rules/opentelemetry-genai-baggage-quarantine?format=mdc","cursorrules":"/api/rules/opentelemetry-genai-baggage-quarantine?format=cursor","windsurf":"/api/rules/opentelemetry-genai-baggage-quarantine?format=windsurf","agents":"/api/rules/opentelemetry-genai-baggage-quarantine?format=agents"}},{"id":"android-15-16kb-page-alignment-invariant","title":"Android 15 16KB ELF Alignment & Dynamic Page Size Invariant","category":"mobile","severity":"critical","description":"Mandates that all native shared libraries (.so) enforce 16KB ELF segment boundaries and that low-level memory operations dynamically query page dimensions. Prevents catastrophic dlopen SIGSEGV/SIGABRT crashes and invalid memory mappings on Android 15+ kernels configured with 16KB physical memory pages.","antiPatternHeadline":"Hardcoding 4KB Page Sizes and Shipping Unaligned ELF Shared Libraries","stars_count":79,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["android","ndk","16kb-pages","cmake","gradle","memory-management","elf-alignment"],"exportEndpoints":{"claude":"/api/rules/android-15-16kb-page-alignment-invariant?format=claude","cursorMdc":"/api/rules/android-15-16kb-page-alignment-invariant?format=mdc","cursorrules":"/api/rules/android-15-16kb-page-alignment-invariant?format=cursor","windsurf":"/api/rules/android-15-16kb-page-alignment-invariant?format=windsurf","agents":"/api/rules/android-15-16kb-page-alignment-invariant?format=agents"}},{"id":"tokio-cooperative-scheduling-task-budgeting","title":"Tokio 1.4x Cooperative Scheduling Task Budgeting & Worker Thread Isolation","category":"backend","severity":"critical","description":"Prevents async runtime worker pool starvation under high concurrency by enforcing cooperative yielding budgets in compute-heavy async loops and isolating synchronous, blocking, or CPU-intensive execution into dedicated blocking thread pools. Mandates explicit use of tokio::task::yield_now, spawn_blocking, or rayon offloading to uphold sub-millisecond tail latencies.","antiPatternHeadline":"Starving Tokio Worker Threads with Unbudgeted CPU Loops and Synchronous Blocking Calls","stars_count":49,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","tokio","async","concurrency","performance"],"exportEndpoints":{"claude":"/api/rules/tokio-cooperative-scheduling-task-budgeting?format=claude","cursorMdc":"/api/rules/tokio-cooperative-scheduling-task-budgeting?format=mdc","cursorrules":"/api/rules/tokio-cooperative-scheduling-task-budgeting?format=cursor","windsurf":"/api/rules/tokio-cooperative-scheduling-task-budgeting?format=windsurf","agents":"/api/rules/tokio-cooperative-scheduling-task-budgeting?format=agents"}},{"id":"vite6-subresource-integrity-dynamic-chunk-signing","title":"Cryptographic Integrity and Dynamic Chunk Signing for Module Federation","category":"frontend","severity":"critical","description":"Enforces strict SHA-384 Subresource Integrity (SRI) and signed hash manifests for all asynchronous dynamic imports and Module Federation remotes in Vite 6. Eliminates arbitrary remote code execution via CDN tampering or cache-poisoning at the edge by mandating cryptographic provenance verification before chunk evaluation.","antiPatternHeadline":"Unsigned Dynamic Chunk Fetching and Blind Execution via Unvalidated Module Federation Entrypoints","stars_count":63,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","vite6","subresource-integrity","module-federation","cryptography","security"],"exportEndpoints":{"claude":"/api/rules/vite6-subresource-integrity-dynamic-chunk-signing?format=claude","cursorMdc":"/api/rules/vite6-subresource-integrity-dynamic-chunk-signing?format=mdc","cursorrules":"/api/rules/vite6-subresource-integrity-dynamic-chunk-signing?format=cursor","windsurf":"/api/rules/vite6-subresource-integrity-dynamic-chunk-signing?format=windsurf","agents":"/api/rules/vite6-subresource-integrity-dynamic-chunk-signing?format=agents"}},{"id":"oauth2-rar-fine-grained-step-up-invariant","title":"OAuth 2.0 RFC 9396 Rich Authorization Requests (RAR) Step-Up Enforcement","category":"security","severity":"critical","description":"High-value and state-mutating API operations must reject coarse static OAuth 2.0 scopes and enforce RFC 9396 Rich Authorization Requests (RAR). The Resource Server must cryptographically validate authorization_details against the exact incoming transactional payload to prevent parameter tampering, authorization bypass, and cross-transaction token replay.","antiPatternHeadline":"Authorizing sensitive financial or mutating operations via coarse static scopes without payload-bound authorization_details validation","stars_count":48,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","oauth2","rfc9396","rar","step-up-auth","zero-trust"],"exportEndpoints":{"claude":"/api/rules/oauth2-rar-fine-grained-step-up-invariant?format=claude","cursorMdc":"/api/rules/oauth2-rar-fine-grained-step-up-invariant?format=mdc","cursorrules":"/api/rules/oauth2-rar-fine-grained-step-up-invariant?format=cursor","windsurf":"/api/rules/oauth2-rar-fine-grained-step-up-invariant?format=windsurf","agents":"/api/rules/oauth2-rar-fine-grained-step-up-invariant?format=agents"}},{"id":"go-chi-http3-quic-graceful-draining","title":"Go Chi v5 Deterministic HTTP/3 QUIC Dual-Stack Graceful Draining Standard","category":"backend","severity":"critical","description":"Enforces deterministic graceful shutdown orchestration for dual-stack HTTP/1.1+HTTP/2 (TCP) and HTTP/3 (QUIC/UDP) Chi v5 microservices. Mandates emission of QUIC GOAWAY frames and closure of early listeners while orchestrating bounded bidirectional stream completion to prevent dropped in-flight UDP RPCs during zero-downtime rolling deployments.","antiPatternHeadline":"Hard Socket Termination of UDP Listeners Dropping In-Flight QUIC Streams During Container SIGTERM","stars_count":106,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","golang","chi","http3","quic","zero-downtime","graceful-shutdown"],"exportEndpoints":{"claude":"/api/rules/go-chi-http3-quic-graceful-draining?format=claude","cursorMdc":"/api/rules/go-chi-http3-quic-graceful-draining?format=mdc","cursorrules":"/api/rules/go-chi-http3-quic-graceful-draining?format=cursor","windsurf":"/api/rules/go-chi-http3-quic-graceful-draining?format=windsurf","agents":"/api/rules/go-chi-http3-quic-graceful-draining?format=agents"}},{"id":"k8s-gateway-api-referencegrant-isolation-guardrail","title":"Kubernetes Gateway API v1.2 Cross-Namespace Isolation and ReferenceGrant Enforcement","category":"devops","severity":"critical","description":"Enforces deterministic, explicit ReferenceGrant handshakes for all cross-namespace references between Gateway API resources, HTTPRoutes, and backend Services. Eliminates cross-namespace route hijacking and unauthorized internal service exposure by restricting Gateway listener allowedRoutes scopes and strictly validating mutual boundary permissions in multi-tenant topologies.","antiPatternHeadline":"Permissive Wildcard Route Attachment and Missing ReferenceGrants Enabling Cross-Tenant Ingress Hijacking","stars_count":58,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","kubernetes","gateway-api","security","zero-trust","multi-tenancy"],"exportEndpoints":{"claude":"/api/rules/k8s-gateway-api-referencegrant-isolation-guardrail?format=claude","cursorMdc":"/api/rules/k8s-gateway-api-referencegrant-isolation-guardrail?format=mdc","cursorrules":"/api/rules/k8s-gateway-api-referencegrant-isolation-guardrail?format=cursor","windsurf":"/api/rules/k8s-gateway-api-referencegrant-isolation-guardrail?format=windsurf","agents":"/api/rules/k8s-gateway-api-referencegrant-isolation-guardrail?format=agents"}},{"id":"vite-6-environment-api-heterogeneous-ssr-isolation","title":"Vite 6 Heterogeneous SSR Runtime Isolation via Environment API","category":"frontend","severity":"critical","description":"Enforces strict runtime-agnostic module separation and module graph isolation across Node.js, WinterCG (Edge), and Browser environments utilizing Vite 6's Environment API. Prevents cross-environment global pollution, host-specific built-in leakage, and shared runtime singleton corruption during multi-target SSR compilation and hydration.","antiPatternHeadline":"Monolithic SSR Module Graph and Cross-Contaminating Host Primitives","stars_count":55,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["vite6","environment-api","ssr","runtime-isolation","wintercg","edge","node"],"exportEndpoints":{"claude":"/api/rules/vite-6-environment-api-heterogeneous-ssr-isolation?format=claude","cursorMdc":"/api/rules/vite-6-environment-api-heterogeneous-ssr-isolation?format=mdc","cursorrules":"/api/rules/vite-6-environment-api-heterogeneous-ssr-isolation?format=cursor","windsurf":"/api/rules/vite-6-environment-api-heterogeneous-ssr-isolation?format=windsurf","agents":"/api/rules/vite-6-environment-api-heterogeneous-ssr-isolation?format=agents"}},{"id":"nextjs-15-ppr-streaming-hole-isolation","title":"Next.js 15 PPR Dynamic Streaming Hole Boundary Isolation","category":"frontend","severity":"critical","description":"Enforces strict boundary isolation between static prerender shells and dynamic streaming holes under Next.js 15 Partial Prerendering (PPR). Mandates that dynamic data access (cookies, headers, searchParams, and uncached dynamic fetches) resides exclusively inside isolated React Suspense boundaries with deterministic, static-safe fallbacks to prevent edge-cache poisoning or de-opting the static layout shell.","antiPatternHeadline":"Dynamic Context Leakage into Static Shell De-opting Next.js 15 PPR to Dynamic SSR","stars_count":47,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs","partial-prerendering","react-server-components","streaming","performance"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-ppr-streaming-hole-isolation?format=claude","cursorMdc":"/api/rules/nextjs-15-ppr-streaming-hole-isolation?format=mdc","cursorrules":"/api/rules/nextjs-15-ppr-streaming-hole-isolation?format=cursor","windsurf":"/api/rules/nextjs-15-ppr-streaming-hole-isolation?format=windsurf","agents":"/api/rules/nextjs-15-ppr-streaming-hole-isolation?format=agents"}},{"id":"bun-cluster-websocket-backpressure-bounding","title":"Bun 1.2 Clustered WebSocket Native Backpressure & Memory Bounding Guardrail","category":"backend","severity":"critical","description":"Enforces strict native backpressure monitoring and memory bounding across multi-core Bun 1.2 WebSocket workers running with SO_REUSEPORT. Mandates active buffered-amount validation, drain hook orchestration, and explicit slow-consumer eviction to eliminate cascading Out-Of-Memory (OOM) worker panics during broadcast surges.","antiPatternHeadline":"Unbounded Direct Broadcast Loops Silently Buffering Payload Queues to Worker OOM Termination","stars_count":50,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","websockets","backpressure","performance","memory-management"],"exportEndpoints":{"claude":"/api/rules/bun-cluster-websocket-backpressure-bounding?format=claude","cursorMdc":"/api/rules/bun-cluster-websocket-backpressure-bounding?format=mdc","cursorrules":"/api/rules/bun-cluster-websocket-backpressure-bounding?format=cursor","windsurf":"/api/rules/bun-cluster-websocket-backpressure-bounding?format=windsurf","agents":"/api/rules/bun-cluster-websocket-backpressure-bounding?format=agents"}},{"id":"go-chi-http3-connection-migration-context-cancellation-invariants","title":"Go Chi HTTP/3 Connection Migration and Context Cancellation Propagation","category":"backend","severity":"critical","description":"Guarantees immediate propagation of cancellation signals and QUIC stream teardowns down to database transactions and worker routines during rapid mobile network migrations. Enforces strict binding to r.Context() and prevents detached context leakage when underlying HTTP/3 UDP 4-tuples shift or fail path validation.","antiPatternHeadline":"Decoupled Context Lifecycles and Goroutine Leaks During QUIC Stream Resets and Network Handoffs","stars_count":77,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","chi","http3","quic","concurrency","networking"],"exportEndpoints":{"claude":"/api/rules/go-chi-http3-connection-migration-context-cancellation-invariants?format=claude","cursorMdc":"/api/rules/go-chi-http3-connection-migration-context-cancellation-invariants?format=mdc","cursorrules":"/api/rules/go-chi-http3-connection-migration-context-cancellation-invariants?format=cursor","windsurf":"/api/rules/go-chi-http3-connection-migration-context-cancellation-invariants?format=windsurf","agents":"/api/rules/go-chi-http3-connection-migration-context-cancellation-invariants?format=agents"}},{"id":"kmp-swift6-strict-concurrency-bridge-guardrail","title":"KMP to Swift 6 Strict Concurrency & Sendable Memory Guardrail","category":"mobile","severity":"critical","description":"Enforces strict Sendable isolation and deterministic lifecycle cancellation when exposing Kotlin Coroutines and Flows to Swift 6 runtimes. Prevents data races, actor-reentrancy bugs, and retain cycles by mandating thread-safe SKIE/KMP-NativeCoroutines bridge contracts and explicit cancellation hooks across the dynamic Objective-C runtime boundary.","antiPatternHeadline":"Exposing Unchecked Kotlin Flow/Job Proxies Directly to Swift 6 Actors Without Sendable Boundary Adaptation","stars_count":68,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","swift-6","strict-concurrency","coroutines","actors","memory-management"],"exportEndpoints":{"claude":"/api/rules/kmp-swift6-strict-concurrency-bridge-guardrail?format=claude","cursorMdc":"/api/rules/kmp-swift6-strict-concurrency-bridge-guardrail?format=mdc","cursorrules":"/api/rules/kmp-swift6-strict-concurrency-bridge-guardrail?format=cursor","windsurf":"/api/rules/kmp-swift6-strict-concurrency-bridge-guardrail?format=windsurf","agents":"/api/rules/kmp-swift6-strict-concurrency-bridge-guardrail?format=agents"}},{"id":"tauri-v2-mobile-capability-sandboxing","title":"Tauri 2.0 Mobile Capability-Based IPC Sandboxing Invariant","category":"mobile","severity":"critical","description":"Enforces strict principle-of-least-privilege capability manifests between mobile WebView execution contexts and native Rust commands on iOS and Android. In Tauri 2.0, indiscriminate core permissions, default catch-all remote access, and unvalidated WebView origins allow untrusted or compromised UI scripts to execute privileged native device APIs. All commands and native plugins must be bounded by explicit target-scoped capability definitions and strict typed argument verification.","antiPatternHeadline":"Over-Privileged Mobile Capability Grants and Global Allow-All IPC Bindings","stars_count":47,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri-2","ipc-security","rust","ios","android","least-privilege"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-mobile-capability-sandboxing?format=claude","cursorMdc":"/api/rules/tauri-v2-mobile-capability-sandboxing?format=mdc","cursorrules":"/api/rules/tauri-v2-mobile-capability-sandboxing?format=cursor","windsurf":"/api/rules/tauri-v2-mobile-capability-sandboxing?format=windsurf","agents":"/api/rules/tauri-v2-mobile-capability-sandboxing?format=agents"}},{"id":"openfga-zanzibar-traversal-cache-guardrails","title":"Bounded Graph Traversal Depth and Contextual Cache Invalidation for OpenFGA Zanzibar","category":"security","severity":"critical","description":"Enforces strict limits on authorization graph traversal depth, mandatory context timeouts, and atomic contextual cache invalidation in OpenFGA Zanzibar implementations. Deeply nested group-of-groups hierarchies and transitive relationship queries can trigger catastrophic cascade latencies, resource exhaustion, and stale authorization decisions without bound resolution parameters. All check operations must configure explicit query depth limits, propagate distributed trace deadlines, and use deterministic tuple-versioned cache eviction keys.","antiPatternHeadline":"Unbounded Recursive Traversal and Uncoordinated In-Memory Caching in Authorization Checks","stars_count":43,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","zanzibar","authorization","rebac","performance"],"exportEndpoints":{"claude":"/api/rules/openfga-zanzibar-traversal-cache-guardrails?format=claude","cursorMdc":"/api/rules/openfga-zanzibar-traversal-cache-guardrails?format=mdc","cursorrules":"/api/rules/openfga-zanzibar-traversal-cache-guardrails?format=cursor","windsurf":"/api/rules/openfga-zanzibar-traversal-cache-guardrails?format=windsurf","agents":"/api/rules/openfga-zanzibar-traversal-cache-guardrails?format=agents"}},{"id":"sigstore-ephemeral-oidc-slsa-attestation","title":"Sigstore Ephemeral OIDC Keyless Attestation & SLSA v1.0 Invariant Verification","category":"security","severity":"critical","description":"Enforces zero-static-secret supply chain security by mandating ephemeral OpenID Connect (OIDC) identity tokens for artifact signing via Fulcio and Rekor transparency logging. Prohibits persistent cryptographic signing keys in CI/CD environments and enforces SLSA v1.0 in-toto provenance attestation verification before deployment.","antiPatternHeadline":"Signing artifacts with long-lived static private keys in CI/CD without Rekor transparency or SLSA provenance","stars_count":96,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","sigstore","slsa-v1.0","oidc","supply-chain-security","keyless-signing","rekor"],"exportEndpoints":{"claude":"/api/rules/sigstore-ephemeral-oidc-slsa-attestation?format=claude","cursorMdc":"/api/rules/sigstore-ephemeral-oidc-slsa-attestation?format=mdc","cursorrules":"/api/rules/sigstore-ephemeral-oidc-slsa-attestation?format=cursor","windsurf":"/api/rules/sigstore-ephemeral-oidc-slsa-attestation?format=windsurf","agents":"/api/rules/sigstore-ephemeral-oidc-slsa-attestation?format=agents"}},{"id":"k8s-gateway-api-spiffe-canary-mtls-invariants","title":"Kubernetes Gateway API Dynamic Canary Splitting & SPIFFE mTLS Invariants","category":"devops","severity":"critical","description":"Enforces strict Kubernetes Gateway API (v1) configuration invariants for progressive canary rollouts and zero-trust cryptographic service identity validation. Mandates deterministic traffic weight normalization, cross-namespace ReferenceGrant authorization, and strict SPIFFE x509 SVID validation via BackendTLSPolicy without relying on proprietary service mesh sidecars.","antiPatternHeadline":"Unvalidated Cross-Namespace Canary Routing with Insecure Cleartext Upstreams","stars_count":112,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","kubernetes","gateway-api","spiffe","spire","mtls","canary-deployment","zero-trust"],"exportEndpoints":{"claude":"/api/rules/k8s-gateway-api-spiffe-canary-mtls-invariants?format=claude","cursorMdc":"/api/rules/k8s-gateway-api-spiffe-canary-mtls-invariants?format=mdc","cursorrules":"/api/rules/k8s-gateway-api-spiffe-canary-mtls-invariants?format=cursor","windsurf":"/api/rules/k8s-gateway-api-spiffe-canary-mtls-invariants?format=windsurf","agents":"/api/rules/k8s-gateway-api-spiffe-canary-mtls-invariants?format=agents"}},{"id":"react-19-server-actions-optimistic-race-isolation","title":"React 19 Server Actions & Optimistic State Race Condition Isolation","category":"frontend","severity":"critical","description":"Enforces strict monotonic sequence tracking, AbortController propagation, and immutable transition isolation within React 19 useOptimistic and Server Action pipelines. Prevents out-of-order state reconciliation and stale server responses from clobbering concurrent user mutations without blocking the primary rendering thread. Guarantees linearizable client cache convergence through transaction epoch identifiers.","antiPatternHeadline":"Unordered concurrent server action dispatches overwriting recent optimistic state with stale payload responses","stars_count":44,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","server-actions","useOptimistic","concurrency","race-conditions"],"exportEndpoints":{"claude":"/api/rules/react-19-server-actions-optimistic-race-isolation?format=claude","cursorMdc":"/api/rules/react-19-server-actions-optimistic-race-isolation?format=mdc","cursorrules":"/api/rules/react-19-server-actions-optimistic-race-isolation?format=cursor","windsurf":"/api/rules/react-19-server-actions-optimistic-race-isolation?format=windsurf","agents":"/api/rules/react-19-server-actions-optimistic-race-isolation?format=agents"}},{"id":"go-chi-http3-early-data-replay-defense","title":"Go Chi HTTP/3 0-RTT Replay Defense & Idempotency Enforcement","category":"backend","severity":"critical","description":"HTTP/3 and TLS 1.3 0-RTT connection resumption permits early data transmission that is inherently vulnerable to network-level replay attacks. In Go Chi microservices executing financial transactions or state mutations, middleware must intercept non-safe requests containing the 'Early-Data: 1' header or QUIC early-data context and reject them with HTTP 425 (Too Early), forcing the client to retransmit after the full cryptographic handshake completes.","antiPatternHeadline":"Executing state-altering or financial handlers during HTTP/3 0-RTT early data without HTTP 425 rejection or distributed idempotency fencing.","stars_count":116,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","golang","http3","quic","chi","idempotency","security"],"exportEndpoints":{"claude":"/api/rules/go-chi-http3-early-data-replay-defense?format=claude","cursorMdc":"/api/rules/go-chi-http3-early-data-replay-defense?format=mdc","cursorrules":"/api/rules/go-chi-http3-early-data-replay-defense?format=cursor","windsurf":"/api/rules/go-chi-http3-early-data-replay-defense?format=windsurf","agents":"/api/rules/go-chi-http3-early-data-replay-defense?format=agents"}},{"id":"pg17-async-io-hnsw-streaming-guardrail","title":"PostgreSQL 17 Asynchronous Streaming I/O and pgvector HNSW Invariant Standard","category":"backend","severity":"critical","description":"Enforces session-level streaming asynchronous I/O and dedicated buffer management for high-concurrency HNSW vector similarity queries in PostgreSQL 17. Eliminates synchronous prefetch stalls and OS page-cache thrashing by coupling io_combine_limit and io_uring with pre-warmed, memory-bounded pgvector index scans. Prevents tail-latency degradation and keeps p99 vector retrieval sub-10ms across concurrent tenant workloads.","antiPatternHeadline":"Unbounded Synchronous Random-Read HNSW Traversal Inducing OS Page-Cache Thrashing and P99 Latency Spikes","stars_count":100,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql-17","pgvector","hnsw","async-io","performance","database"],"exportEndpoints":{"claude":"/api/rules/pg17-async-io-hnsw-streaming-guardrail?format=claude","cursorMdc":"/api/rules/pg17-async-io-hnsw-streaming-guardrail?format=mdc","cursorrules":"/api/rules/pg17-async-io-hnsw-streaming-guardrail?format=cursor","windsurf":"/api/rules/pg17-async-io-hnsw-streaming-guardrail?format=windsurf","agents":"/api/rules/pg17-async-io-hnsw-streaming-guardrail?format=agents"}},{"id":"bun-worker-sharedarraybuffer-atomics","title":"Data-Race-Free Worker Synchronization via SharedArrayBuffer and Atomics in Bun 1.2","category":"backend","severity":"critical","description":"Enforces deterministic, zero-copy inter-worker state synchronization in Bun 1.2 using SharedArrayBuffer and standard Atomics operations. Prevents silent data races, torn reads/writes, and IPC serialization throughput collapse by mandating atomic memory barriers and explicit ring-buffer queue synchronization patterns.","antiPatternHeadline":"Unsynchronized SharedArrayBuffer Mutations and Structured Cloning Serialization Bottlenecks","stars_count":88,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","multithreading","sharedarraybuffer","atomics","concurrency"],"exportEndpoints":{"claude":"/api/rules/bun-worker-sharedarraybuffer-atomics?format=claude","cursorMdc":"/api/rules/bun-worker-sharedarraybuffer-atomics?format=mdc","cursorrules":"/api/rules/bun-worker-sharedarraybuffer-atomics?format=cursor","windsurf":"/api/rules/bun-worker-sharedarraybuffer-atomics?format=windsurf","agents":"/api/rules/bun-worker-sharedarraybuffer-atomics?format=agents"}},{"id":"kmp-room-sqlcipher-hardware-key-derivation","title":"Hardware-Backed Key Derivation for KMP Room and SQLCipher","category":"mobile","severity":"critical","description":"Enforces cryptographic key derivation invariants for Kotlin Multiplatform Room databases using SQLCipher. Prevents static passphrase exposure by mandating direct binding to Android Keystore (StrongBox/TEE) and Apple Secure Enclave (Keychain with kSecAccessControlSecureEnclave), zeroizing key material immediately after database initialization.","antiPatternHeadline":"Hardcoded, SharedPrefs-Stored, or In-Memory Lingering Passphrases in Multiplatform Database Initialization","stars_count":52,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kmp","room","sqlcipher","security","android-keystore","secure-enclave"],"exportEndpoints":{"claude":"/api/rules/kmp-room-sqlcipher-hardware-key-derivation?format=claude","cursorMdc":"/api/rules/kmp-room-sqlcipher-hardware-key-derivation?format=mdc","cursorrules":"/api/rules/kmp-room-sqlcipher-hardware-key-derivation?format=cursor","windsurf":"/api/rules/kmp-room-sqlcipher-hardware-key-derivation?format=windsurf","agents":"/api/rules/kmp-room-sqlcipher-hardware-key-derivation?format=agents"}},{"id":"webauthn-prf-e2ee-key-derivation-standard","title":"WebAuthn PRF Extension Zero-Knowledge Key Derivation Standard","category":"security","severity":"critical","description":"Enforces strict cryptographic hygiene and zero-knowledge boundaries when deriving hardware-backed symmetric encryption keys using the WebAuthn PRF (Pseudo-Random Function) extension. Requires non-extractable CryptoKey derivation via HKDF domain separation, client-side isolation preventing PRF leak to relaying parties, and deterministic fallback validation.","antiPatternHeadline":"Directly Utilizing Raw PRF Output as AES Keys or Leaking PRF Extension Outputs to the Relaying Party Server","stars_count":98,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","prf","passkeys","e2ee","cryptography","webcrypto"],"exportEndpoints":{"claude":"/api/rules/webauthn-prf-e2ee-key-derivation-standard?format=claude","cursorMdc":"/api/rules/webauthn-prf-e2ee-key-derivation-standard?format=mdc","cursorrules":"/api/rules/webauthn-prf-e2ee-key-derivation-standard?format=cursor","windsurf":"/api/rules/webauthn-prf-e2ee-key-derivation-standard?format=windsurf","agents":"/api/rules/webauthn-prf-e2ee-key-derivation-standard?format=agents"}},{"id":"sigstore-ephemeral-oidc-keyless-provenance-standard","title":"Sigstore Ephemeral OIDC Keyless Signing and SLSA Level 3 Provenance Verification","category":"security","severity":"critical","description":"Mandates ambient OIDC federation with Sigstore Fulcio and Rekor transparency logging to eliminate long-lived cryptographic private keys across CI/CD build pipelines. Enforces automated generation and admission verification of SLSA Level 3 in-toto attestations tied to verifiable workload identities (issuer and subject) rather than static credentials.","antiPatternHeadline":"Persisting static private signing keys in pipeline secrets and signing mutable image tags without Rekor transparency or OIDC identity verification.","stars_count":99,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","sigstore","cosign","slsa","supply-chain","oidc","provenance"],"exportEndpoints":{"claude":"/api/rules/sigstore-ephemeral-oidc-keyless-provenance-standard?format=claude","cursorMdc":"/api/rules/sigstore-ephemeral-oidc-keyless-provenance-standard?format=mdc","cursorrules":"/api/rules/sigstore-ephemeral-oidc-keyless-provenance-standard?format=cursor","windsurf":"/api/rules/sigstore-ephemeral-oidc-keyless-provenance-standard?format=windsurf","agents":"/api/rules/sigstore-ephemeral-oidc-keyless-provenance-standard?format=agents"}},{"id":"otel-tail-sampling-continuous-profiling-guardrail","title":"Deterministic OTel Tail-Based Sampling & Profiling Retention","category":"devops","severity":"critical","description":"Enforces a two-tier OpenTelemetry Collector topology using consistent traceID hashing (loadbalancing exporter) and tail_sampling processor rules to guarantee 100% capture of error traces and p99.9 latency anomalies. Prevents runaway network egress costs and vendor bill shock while maintaining deterministic correlation between distributed traces and continuous CPU/memory profiles via trace-context baggage injection.","antiPatternHeadline":"Naive head-based sampling dropping fatal anomalies or unbuffered collector-egress exploding telemetry bills","stars_count":59,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","tail-sampling","continuous-profiling","observability","collector"],"exportEndpoints":{"claude":"/api/rules/otel-tail-sampling-continuous-profiling-guardrail?format=claude","cursorMdc":"/api/rules/otel-tail-sampling-continuous-profiling-guardrail?format=mdc","cursorrules":"/api/rules/otel-tail-sampling-continuous-profiling-guardrail?format=cursor","windsurf":"/api/rules/otel-tail-sampling-continuous-profiling-guardrail?format=windsurf","agents":"/api/rules/otel-tail-sampling-continuous-profiling-guardrail?format=agents"}},{"id":"cilium-ebpf-host-routing-wireguard-encryption","title":"Cilium eBPF Host-Routing & Sidecarless WireGuard Transparent Encryption Invariants","category":"devops","severity":"critical","description":"Enforces kernel-level eBPF host routing alongside transparent WireGuard pod-to-pod encryption while eliminating user-space sidecar proxies. Mandates strict MTU clamping, socket-layer enforcement, and native routing mode to prevent TCP segmentation packet drops, proxy memory bloat, and iptables traversal bottlenecks.","antiPatternHeadline":"Injecting user-space sidecars and defaulting to generic overlay iptables without MTU clamping and eBPF host routing","stars_count":115,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","cilium","ebpf","wireguard","kubernetes","networking","zero-trust"],"exportEndpoints":{"claude":"/api/rules/cilium-ebpf-host-routing-wireguard-encryption?format=claude","cursorMdc":"/api/rules/cilium-ebpf-host-routing-wireguard-encryption?format=mdc","cursorrules":"/api/rules/cilium-ebpf-host-routing-wireguard-encryption?format=cursor","windsurf":"/api/rules/cilium-ebpf-host-routing-wireguard-encryption?format=windsurf","agents":"/api/rules/cilium-ebpf-host-routing-wireguard-encryption?format=agents"}},{"id":"react-19-server-actions-idempotency-replay-shield-production-standard","title":"React 19 Server Actions Idempotency & Replay Shield Standard","category":"frontend","severity":"critical","description":"Enforces deterministic client-generated idempotency keys and atomic server-side deduplication for mutating React 19 Server Actions. Eliminates duplicate transactions and race conditions during network retries while preventing optimistic UI desynchronization.","antiPatternHeadline":"Blind Server Action Invocations and Transient Idempotency Generating Duplicate Side Effects on Network Retries","stars_count":45,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","server-actions","idempotency","optimistic-ui","distributed-systems"],"exportEndpoints":{"claude":"/api/rules/react-19-server-actions-idempotency-replay-shield-production-standard?format=claude","cursorMdc":"/api/rules/react-19-server-actions-idempotency-replay-shield-production-standard?format=mdc","cursorrules":"/api/rules/react-19-server-actions-idempotency-replay-shield-production-standard?format=cursor","windsurf":"/api/rules/react-19-server-actions-idempotency-replay-shield-production-standard?format=windsurf","agents":"/api/rules/react-19-server-actions-idempotency-replay-shield-production-standard?format=agents"}},{"id":"nextjs15-ppr-dynamic-scope-isolation","title":"Next.js 15 Partial Prerendering (PPR) Dynamic Scope De-escalation Boundary","category":"frontend","severity":"critical","description":"Enforces strict compile-time and runtime isolation between static prerendered HTML shells and dynamic streaming holes in Next.js 15. Prevents credential, session token, and tenant identity leakage into edge-cached static artifacts by guaranteeing that dynamic functions (cookies, headers, searchParams, and dynamic data access) execute exclusively within explicit Suspense boundaries.","antiPatternHeadline":"Dynamic Scope Creep Poisoning Static Prerender Shells","stars_count":98,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["nextjs","react-server-components","partial-prerendering","security","cache-poisoning"],"exportEndpoints":{"claude":"/api/rules/nextjs15-ppr-dynamic-scope-isolation?format=claude","cursorMdc":"/api/rules/nextjs15-ppr-dynamic-scope-isolation?format=mdc","cursorrules":"/api/rules/nextjs15-ppr-dynamic-scope-isolation?format=cursor","windsurf":"/api/rules/nextjs15-ppr-dynamic-scope-isolation?format=windsurf","agents":"/api/rules/nextjs15-ppr-dynamic-scope-isolation?format=agents"}},{"id":"sqlite-wasm-opfs-multitab-concurrency","title":"SQLite-Wasm OPFS Multi-Tab Concurrency & SyncAccessHandle Lease Protocol","category":"frontend","severity":"critical","description":"Enforces crash-safe multi-tab SQLite-Wasm persistence over the Origin Private File System (OPFS) without file handle collisions or silent database corruption. Mandates dedicated Web Worker isolation, the SAHPool VFS or Web Lock lease orchestration, and strict validation of cross-origin isolation headers for SharedArrayBuffer atomic primitives.","antiPatternHeadline":"Direct OPFS SyncAccessHandle Acquisition Across Multiple Tabs Causing NoModificationAllowedError and Database Corruption","stars_count":56,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","sqlite-wasm","opfs","web-workers","sharedarraybuffer","concurrency"],"exportEndpoints":{"claude":"/api/rules/sqlite-wasm-opfs-multitab-concurrency?format=claude","cursorMdc":"/api/rules/sqlite-wasm-opfs-multitab-concurrency?format=mdc","cursorrules":"/api/rules/sqlite-wasm-opfs-multitab-concurrency?format=cursor","windsurf":"/api/rules/sqlite-wasm-opfs-multitab-concurrency?format=windsurf","agents":"/api/rules/sqlite-wasm-opfs-multitab-concurrency?format=agents"}},{"id":"bun-1-2-websocket-kernel-backpressure-guardrail","title":"Bun 1.2 Native WebSocket Backpressure & Recycled Direct Memory Architecture","category":"backend","severity":"critical","description":"Under high-throughput outbound streaming, unbounded invocations of ws.send() trigger socket buffer bloat, unmanaged kernel queue expansion, and severe memory exhaustion. Bun services must govern stream velocity using ws.send() backpressure feedback, aggregate writes with ws.cork(), resume throttled producers exclusively via the native drain(ws) callback, and reuse pre-allocated slab buffers for outbound payloads.","antiPatternHeadline":"Unbounded Fire-and-Forget ws.send() Loops Inducing Kernel Buffer Bloat and Out-Of-Memory Crashes","stars_count":115,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","websockets","backpressure","memory-management","zero-copy"],"exportEndpoints":{"claude":"/api/rules/bun-1-2-websocket-kernel-backpressure-guardrail?format=claude","cursorMdc":"/api/rules/bun-1-2-websocket-kernel-backpressure-guardrail?format=mdc","cursorrules":"/api/rules/bun-1-2-websocket-kernel-backpressure-guardrail?format=cursor","windsurf":"/api/rules/bun-1-2-websocket-kernel-backpressure-guardrail?format=windsurf","agents":"/api/rules/bun-1-2-websocket-kernel-backpressure-guardrail?format=agents"}},{"id":"go-chi-quic-0rtt-anti-replay-standard","title":"Go Chi HTTP/3 QUIC 0-RTT Early-Data Anti-Replay Standard","category":"backend","severity":"critical","description":"Enforces cryptographic replay attack mitigation on QUIC 0-RTT early data within Go Chi HTTP/3 services. Mandates strict HTTP method safety invariants (RFC 8470) and route-level validation to reject early-data execution of state-mutating handlers via HTTP 425 Too Early. Guarantees downstream cache coherence via explicit Vary header injection.","antiPatternHeadline":"Permitting State Mutations or Unvalidated Endpoints Over QUIC 0-RTT Early Data","stars_count":40,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","chi","quic","http3","security","zero-rtt","cryptography"],"exportEndpoints":{"claude":"/api/rules/go-chi-quic-0rtt-anti-replay-standard?format=claude","cursorMdc":"/api/rules/go-chi-quic-0rtt-anti-replay-standard?format=mdc","cursorrules":"/api/rules/go-chi-quic-0rtt-anti-replay-standard?format=cursor","windsurf":"/api/rules/go-chi-quic-0rtt-anti-replay-standard?format=windsurf","agents":"/api/rules/go-chi-quic-0rtt-anti-replay-standard?format=agents"}},{"id":"react-native-bridgeless-jsi-hostobject-memory-pinning","title":"React Native 0.76 Bridgeless JSI HostObject Lifetime Pinning and Thread-Affinity Standard","category":"mobile","severity":"critical","description":"Enforces strict lifetime pinning and thread-affinity guarantees for C++ JSI HostObjects operating within React Native 0.76 Bridgeless mode. Eliminates native use-after-free (UAF) memory corruption and GC race conditions caused by cross-thread dereferencing of Hermes/JSI handles without CallInvoker synchronization.","antiPatternHeadline":"Dangling HostObject Pointer Access and Unsynchronized Thread Invocations During Bridgeless GC Sweeps","stars_count":101,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","react-native","jsi","bridgeless","memory-management","c++","hermes"],"exportEndpoints":{"claude":"/api/rules/react-native-bridgeless-jsi-hostobject-memory-pinning?format=claude","cursorMdc":"/api/rules/react-native-bridgeless-jsi-hostobject-memory-pinning?format=mdc","cursorrules":"/api/rules/react-native-bridgeless-jsi-hostobject-memory-pinning?format=cursor","windsurf":"/api/rules/react-native-bridgeless-jsi-hostobject-memory-pinning?format=windsurf","agents":"/api/rules/react-native-bridgeless-jsi-hostobject-memory-pinning?format=agents"}},{"id":"tauri-v2-ipc-origin-capability-sandboxing","title":"Tauri 2.0 Multi-Webview IPC Sandboxing and Origin-Bound Capability Isolation","category":"mobile","severity":"critical","description":"Enforces least-privilege IPC access control across Tauri 2.0 desktop and mobile architectures by isolating multi-webview windows with origin-bound capability sets. Disallows universal access wildcards and default platform permissions for auxiliary webviews, enforcing explicit permission manifests and IPC payload validation for both local and mobile-target webview contexts.","antiPatternHeadline":"Assigning global capability scopes or wildcard window bindings to untrusted or secondary webviews, permitting arbitrary native plugin execution.","stars_count":97,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri-2","security","ipc","sandboxing","rust"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-ipc-origin-capability-sandboxing?format=claude","cursorMdc":"/api/rules/tauri-v2-ipc-origin-capability-sandboxing?format=mdc","cursorrules":"/api/rules/tauri-v2-ipc-origin-capability-sandboxing?format=cursor","windsurf":"/api/rules/tauri-v2-ipc-origin-capability-sandboxing?format=windsurf","agents":"/api/rules/tauri-v2-ipc-origin-capability-sandboxing?format=agents"}},{"id":"spiffe-spire-workload-attestation-socket-lease-guardrail","title":"SPIFFE/SPIRE Ephemeral Workload Attestation & Socket Lease Standard","category":"security","severity":"critical","description":"Enforces kernel-level cryptographic zero-trust workload identities through the SPIFFE Workload API over Unix Domain Sockets. Mandates ephemeral sub-hour X.509 SVID dynamic in-memory rotation, peer credential validation, and strictly prohibits static disk-mounted long-lived credentials.","antiPatternHeadline":"Persisting static certificates or static tokens on disk instead of consuming dynamic SVID streams via the SPIFFE Workload API socket","stars_count":109,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","zero-trust","spiffe","spire","mtls","x509-svid"],"exportEndpoints":{"claude":"/api/rules/spiffe-spire-workload-attestation-socket-lease-guardrail?format=claude","cursorMdc":"/api/rules/spiffe-spire-workload-attestation-socket-lease-guardrail?format=mdc","cursorrules":"/api/rules/spiffe-spire-workload-attestation-socket-lease-guardrail?format=cursor","windsurf":"/api/rules/spiffe-spire-workload-attestation-socket-lease-guardrail?format=windsurf","agents":"/api/rules/spiffe-spire-workload-attestation-socket-lease-guardrail?format=agents"}},{"id":"cilium-ebpf-tail-call-context-preservation-standard","title":"Cilium eBPF Host-Routing Tail-Call sk_buff Context Preservation and Telemetry Invariant","category":"security","severity":"critical","description":"Enforces strict control buffer (cb[]) alignment and security identity preservation across eBPF BPF-to-BPF tail calls in Cilium host-routing and L7 proxy redirect paths. Eliminates policy bypass and silent packet drops caused by unanchored skb metadata shifts and unhandled tail-call dispatch exhaustion. Ensures full telemetry synchronization and verifier-compliant pointer re-validation across execution boundaries.","antiPatternHeadline":"Unchecked Control Buffer Mutation and Silent Fallthrough During Tail-Call Failure","stars_count":40,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","cilium","ebpf","networking","kernel","tail-calls"],"exportEndpoints":{"claude":"/api/rules/cilium-ebpf-tail-call-context-preservation-standard?format=claude","cursorMdc":"/api/rules/cilium-ebpf-tail-call-context-preservation-standard?format=mdc","cursorrules":"/api/rules/cilium-ebpf-tail-call-context-preservation-standard?format=cursor","windsurf":"/api/rules/cilium-ebpf-tail-call-context-preservation-standard?format=windsurf","agents":"/api/rules/cilium-ebpf-tail-call-context-preservation-standard?format=agents"}},{"id":"otel-genai-streaming-token-ledger-production-standard","title":"OpenTelemetry GenAI v1.28 Semantic Conventions Streaming Token Ledger","category":"devops","severity":"critical","description":"Enforces OpenTelemetry GenAI Semantic Conventions v1.28 for streaming LLM calls to guarantee exact-match token accounting, cross-service cost attribution, and prompt-injection security event telemetry. Mandates that spans remain open across the entire streaming lifecycle, accumulate token deltas, capture finish reasons, and populate standard 'gen_ai.usage.*' attributes on span completion.","antiPatternHeadline":"Premature Span Closure and Custom Ad-Hoc Attributes Discarding Streaming Token Metrics","stars_count":80,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","genai","observability","cost-attribution","finops"],"exportEndpoints":{"claude":"/api/rules/otel-genai-streaming-token-ledger-production-standard?format=claude","cursorMdc":"/api/rules/otel-genai-streaming-token-ledger-production-standard?format=mdc","cursorrules":"/api/rules/otel-genai-streaming-token-ledger-production-standard?format=cursor","windsurf":"/api/rules/otel-genai-streaming-token-ledger-production-standard?format=windsurf","agents":"/api/rules/otel-genai-streaming-token-ledger-production-standard?format=agents"}},{"id":"svelte-5-runes-reactive-isolation-standard","title":"Svelte 5 Runes Reactive Isolation & High-Frequency State Invariant","category":"frontend","severity":"critical","description":"Enforces deterministic boundaries between fine-grained reactive state ($state) and high-frequency or deeply nested external datasets ($state.raw). Prevents infinite cross-component render loops, memory exhaustion from recursive Proxy wrapping, and cascading downstream recalculations.","antiPatternHeadline":"Wrapping High-Frequency Telemetry in Deep $state Proxies with Bidirectional Effect Feedback","stars_count":73,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["svelte5","runes","state-raw","reactivity","performance","frontend"],"exportEndpoints":{"claude":"/api/rules/svelte-5-runes-reactive-isolation-standard?format=claude","cursorMdc":"/api/rules/svelte-5-runes-reactive-isolation-standard?format=mdc","cursorrules":"/api/rules/svelte-5-runes-reactive-isolation-standard?format=cursor","windsurf":"/api/rules/svelte-5-runes-reactive-isolation-standard?format=windsurf","agents":"/api/rules/svelte-5-runes-reactive-isolation-standard?format=agents"}},{"id":"nextjs-15-ppr-edge-cache-invariant","title":"Next.js 15 Partial Prerendering (PPR) Edge Cache Invariant Standard","category":"frontend","severity":"critical","description":"Enforces strict isolation between static prerendered HTML shells and dynamic stream chunks under Next.js 15 Partial Prerendering (PPR). Mandates explicit Suspense boundaries around all dynamic context (cookies, headers, searchParams, and uncached data fetches) to prevent edge cache poisoning and cross-session identity leakage.","antiPatternHeadline":"Dynamic session and auth context escaping Suspense boundaries into statically prerendered edge-cached shells.","stars_count":70,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs","ppr","edge-cache","security","suspense","react-server-components"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-ppr-edge-cache-invariant?format=claude","cursorMdc":"/api/rules/nextjs-15-ppr-edge-cache-invariant?format=mdc","cursorrules":"/api/rules/nextjs-15-ppr-edge-cache-invariant?format=cursor","windsurf":"/api/rules/nextjs-15-ppr-edge-cache-invariant?format=windsurf","agents":"/api/rules/nextjs-15-ppr-edge-cache-invariant?format=agents"}},{"id":"axum-0-8-tokio-cooperative-budgeting-standard","title":"Axum 0.8 Tokio Cooperative Task Budgeting & Cancellation Safety Standard","category":"backend","severity":"critical","description":"Mandates explicit cooperative task budgeting and cancellation-safe branching across Axum 0.8 middleware, extractors, and request streaming pipelines. Guarantees that compute-bound or tight I/O iterations yield control back to the Tokio runtime executor to prevent multi-threaded thread-pool starvation, latency tail spikes, and corrupt state on client disconnects.","antiPatternHeadline":"Unbounded iteration without cooperative budget checks and cancellation-unsafe futures in tokio::select! middleware branches","stars_count":94,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tokio","async","concurrency","performance"],"exportEndpoints":{"claude":"/api/rules/axum-0-8-tokio-cooperative-budgeting-standard?format=claude","cursorMdc":"/api/rules/axum-0-8-tokio-cooperative-budgeting-standard?format=mdc","cursorrules":"/api/rules/axum-0-8-tokio-cooperative-budgeting-standard?format=cursor","windsurf":"/api/rules/axum-0-8-tokio-cooperative-budgeting-standard?format=windsurf","agents":"/api/rules/axum-0-8-tokio-cooperative-budgeting-standard?format=agents"}},{"id":"postgres-17-failover-slot-cdc-invariant","title":"Postgres 17 Failover Slot Logical Replication Synchronization Standard","category":"backend","severity":"critical","description":"Enforces failover-enabled logical replication slots and synchronized standby progression introduced in Postgres 17 for mission-critical Change Data Capture (CDC) architectures. Ensures downstream streaming consumers can immediately reconnect to promoted physical standbys without replication slot invalidation, stream rewind failures, or duplicate message amplification. Mandates explicit failover slot creation, standby slot synchronization configuration, and LSN-safe consumer reconnection protocols.","antiPatternHeadline":"Creating unmanaged logical replication slots without failover sync, causing CDC consumer permanent failure or data loss upon standby promotion.","stars_count":117,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres-17","cdc","logical-replication","failover-slots","debezium","database-ha"],"exportEndpoints":{"claude":"/api/rules/postgres-17-failover-slot-cdc-invariant?format=claude","cursorMdc":"/api/rules/postgres-17-failover-slot-cdc-invariant?format=mdc","cursorrules":"/api/rules/postgres-17-failover-slot-cdc-invariant?format=cursor","windsurf":"/api/rules/postgres-17-failover-slot-cdc-invariant?format=windsurf","agents":"/api/rules/postgres-17-failover-slot-cdc-invariant?format=agents"}},{"id":"fastapi-pydantic-v2-async-generator-backpressure","title":"FastAPI Pydantic v2 Async Generator Backpressure Standard","category":"backend","severity":"critical","description":"Enforces strict TCP backpressure and bounded memory allocation for FastAPI StreamingResponse endpoints yielding Pydantic v2 serialized data. Eliminates fatal worker OOM events by coupling asynchronous database cursors and Pydantic serialization loops to ASGI send/drain cycles.","antiPatternHeadline":"Unbounded Async Generator Generation Leading to Worker Heap Exhaustion via Unthrottled ASGI Response Buffering","stars_count":53,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","pydantic-v2","asyncio","backpressure","memory-leak","streaming"],"exportEndpoints":{"claude":"/api/rules/fastapi-pydantic-v2-async-generator-backpressure?format=claude","cursorMdc":"/api/rules/fastapi-pydantic-v2-async-generator-backpressure?format=mdc","cursorrules":"/api/rules/fastapi-pydantic-v2-async-generator-backpressure?format=cursor","windsurf":"/api/rules/fastapi-pydantic-v2-async-generator-backpressure?format=windsurf","agents":"/api/rules/fastapi-pydantic-v2-async-generator-backpressure?format=agents"}},{"id":"cmp-skiko-gpu-surface-lifecycle-fencing","title":"Compose Multiplatform Skiko GPU Surface Lifecycle Fencing","category":"mobile","severity":"critical","description":"Enforces synchronous decoupling and fencing of Skiko hardware rendering surfaces prior to native platform surface destruction. Eliminates fatal Vulkan (VK_ERROR_SURFACE_LOST_KHR) and Metal context invalidation crashes triggered during Android 15 predictive back gesture transitions and iOS app-switcher backgrounding.","antiPatternHeadline":"Implicit Asynchronous Surface Tear-Down Without Deterministic Skiko GPU Render Fencing","stars_count":81,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","compose-multiplatform","skiko","metal","vulkan","android-15","ios-lifecycle"],"exportEndpoints":{"claude":"/api/rules/cmp-skiko-gpu-surface-lifecycle-fencing?format=claude","cursorMdc":"/api/rules/cmp-skiko-gpu-surface-lifecycle-fencing?format=mdc","cursorrules":"/api/rules/cmp-skiko-gpu-surface-lifecycle-fencing?format=cursor","windsurf":"/api/rules/cmp-skiko-gpu-surface-lifecycle-fencing?format=windsurf","agents":"/api/rules/cmp-skiko-gpu-surface-lifecycle-fencing?format=agents"}},{"id":"webauthn-prf-envelope-encryption-guardrail","title":"WebAuthn PRF Hardware-Bound Envelope Encryption Standard","category":"security","severity":"critical","description":"Mandates zero-trust client-side envelope encryption rooted in hardware authenticators using the WebAuthn PRF (Pseudo-Random Function) extension. Prohibits transmission or persistence of raw PRF bytes, unencrypted Data Encryption Keys (DEKs), or plaintext payloads to remote APIs. Requires strict HKDF derivation of Key Encryption Keys (KEKs) and cryptographically fresh per-record AES-256-GCM nonce and key generation.","antiPatternHeadline":"Leaking Raw Hardware PRF Outputs, Using PRF as Direct Symmetric Keys, or Transmitting Unwrapped DEKs","stars_count":80,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","prf-extension","envelope-encryption","zero-trust","webcrypto"],"exportEndpoints":{"claude":"/api/rules/webauthn-prf-envelope-encryption-guardrail?format=claude","cursorMdc":"/api/rules/webauthn-prf-envelope-encryption-guardrail?format=mdc","cursorrules":"/api/rules/webauthn-prf-envelope-encryption-guardrail?format=cursor","windsurf":"/api/rules/webauthn-prf-envelope-encryption-guardrail?format=windsurf","agents":"/api/rules/webauthn-prf-envelope-encryption-guardrail?format=agents"}},{"id":"spiffe-spire-x509-svid-attestation-guardrail","title":"SPIFFE/SPIRE Ephemeral SVID Attestation & Zero-Static-Secret Invariant","category":"security","severity":"critical","description":"Enforces short-lived mTLS X.509 SVID dynamic retrieval and in-memory rotation via the SPIFFE Workload API over Unix Domain Sockets. Prohibits static cloud credentials, persistent certificate disk writes, and manual TLS context instantiation that bypasses cryptographic platform attestation.","antiPatternHeadline":"Bypassing SPIFFE Workload API in Favor of Long-Lived Static Credentials or Statically Mounted Certificates","stars_count":89,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","spiffe","spire","zero-trust","mtls","x509-svid","attestation"],"exportEndpoints":{"claude":"/api/rules/spiffe-spire-x509-svid-attestation-guardrail?format=claude","cursorMdc":"/api/rules/spiffe-spire-x509-svid-attestation-guardrail?format=mdc","cursorrules":"/api/rules/spiffe-spire-x509-svid-attestation-guardrail?format=cursor","windsurf":"/api/rules/spiffe-spire-x509-svid-attestation-guardrail?format=windsurf","agents":"/api/rules/spiffe-spire-x509-svid-attestation-guardrail?format=agents"}},{"id":"otel-arrow-columnar-stream-backpressure-governor","title":"OpenTelemetry OTLP/Arrow Columnar Stream Backpressure Invariant","category":"devops","severity":"critical","description":"Prevents OpenTelemetry Collector OOM-kills during massive telemetry and high-cardinality metric spikes by enforcing Apache Arrow schema-batched columnar compression coupled with strict memory-limiter governors and bounded gRPC stream backpressure. Without hard admission bounds and columnar stream limits, standard Protobuf row-based deserialization exhausts node memory buffers before the collector can drop or flush payloads.","antiPatternHeadline":"Unbounded Protobuf OTLP Ingestion Without Arrow Columnar Batching or Upstream Flow Control","stars_count":112,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","apache-arrow","backpressure","collector","memory-management"],"exportEndpoints":{"claude":"/api/rules/otel-arrow-columnar-stream-backpressure-governor?format=claude","cursorMdc":"/api/rules/otel-arrow-columnar-stream-backpressure-governor?format=mdc","cursorrules":"/api/rules/otel-arrow-columnar-stream-backpressure-governor?format=cursor","windsurf":"/api/rules/otel-arrow-columnar-stream-backpressure-governor?format=windsurf","agents":"/api/rules/otel-arrow-columnar-stream-backpressure-governor?format=agents"}},{"id":"kubernetes-kms-v2-envelope-vault-sync-standard","title":"Kubernetes KMS v2 Envelope Vault Secret Synchronization Standard","category":"devops","severity":"critical","description":"Enforces hardware-backed envelope encryption using Kubernetes KMS v2 API and HashiCorp Vault Transit/HSM for all cluster secrets persisted to etcd. Mandates automated zero-downtime Key Encryption Key (KEK) rotation with deterministic storage migrations and continuous verification to prevent plaintext leaks.","antiPatternHeadline":"Persisting Plaintext Secrets to etcd or Relying on Deprecated KMS v1 Blocking IPC without Automated Storage Migration","stars_count":115,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","kubernetes","kms-v2","hashicorp-vault","hsm","envelope-encryption","etcd-security"],"exportEndpoints":{"claude":"/api/rules/kubernetes-kms-v2-envelope-vault-sync-standard?format=claude","cursorMdc":"/api/rules/kubernetes-kms-v2-envelope-vault-sync-standard?format=mdc","cursorrules":"/api/rules/kubernetes-kms-v2-envelope-vault-sync-standard?format=cursor","windsurf":"/api/rules/kubernetes-kms-v2-envelope-vault-sync-standard?format=windsurf","agents":"/api/rules/kubernetes-kms-v2-envelope-vault-sync-standard?format=agents"}},{"id":"nextjs-15-ppr-dynamic-stream-isolation-standard","title":"Next.js 15 PPR Dynamic Stream Isolation & Static Shell Preservation","category":"frontend","severity":"critical","description":"Enforces strict isolation of dynamic runtime operations (cookies, headers, searchParams, and uncached fetches) inside React Suspense boundaries for Next.js 15 Partial Prerendering (PPR). Prevents accidental de-optimization of static edge-prerendered shells into full server-rendered waterfall executions.","antiPatternHeadline":"Leaking Dynamic Contexts Outside Suspense Boundaries Causing Complete Route De-optimization","stars_count":79,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs15","ppr","react-server-components","streaming","suspense"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-ppr-dynamic-stream-isolation-standard?format=claude","cursorMdc":"/api/rules/nextjs-15-ppr-dynamic-stream-isolation-standard?format=mdc","cursorrules":"/api/rules/nextjs-15-ppr-dynamic-stream-isolation-standard?format=cursor","windsurf":"/api/rules/nextjs-15-ppr-dynamic-stream-isolation-standard?format=windsurf","agents":"/api/rules/nextjs-15-ppr-dynamic-stream-isolation-standard?format=agents"}},{"id":"react-19-server-actions-closure-parameter-tamper-proofing","title":"React 19 Server Functions Closure Parameter Tamper-Proofing & Integrity Guard","category":"frontend","severity":"critical","description":"Enforces cryptographic verification or server-session reconciliation on bound closure arguments in React 19 Server Functions. Bound arguments (via Function.prototype.bind or JSX outer scope capture) are serialized to the client and transmitted back across untrusted network boundaries, creating injection vectors if accepted without authorization validation.","antiPatternHeadline":"Implicit Trust of Serialized Closure State and Bound Arguments in Server Actions","stars_count":69,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","server-actions","application-security","cryptography","owasp"],"exportEndpoints":{"claude":"/api/rules/react-19-server-actions-closure-parameter-tamper-proofing?format=claude","cursorMdc":"/api/rules/react-19-server-actions-closure-parameter-tamper-proofing?format=mdc","cursorrules":"/api/rules/react-19-server-actions-closure-parameter-tamper-proofing?format=cursor","windsurf":"/api/rules/react-19-server-actions-closure-parameter-tamper-proofing?format=windsurf","agents":"/api/rules/react-19-server-actions-closure-parameter-tamper-proofing?format=agents"}},{"id":"temporal-deterministic-replay-sanitization","title":"Temporal Durable Workflow Deterministic State Replay Sanitization","category":"backend","severity":"critical","description":"Enforces strict determinism across Temporal durable workflow functions by eliminating native non-deterministic runtime calls. Workflows are event-sourced state machines that replay historical event logs; any divergence introduced by unseeded entropy, unmanaged system clocks, or direct I/O execution will trigger NonDeterministicWorkflowPolicy errors and break workflow execution invariants.","antiPatternHeadline":"Calling native random generators, standard date lookups, direct network I/O, or asynchronous race conditions within workflow orchestrators.","stars_count":59,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","temporal","distributed-systems","event-sourcing","orchestration","typescript"],"exportEndpoints":{"claude":"/api/rules/temporal-deterministic-replay-sanitization?format=claude","cursorMdc":"/api/rules/temporal-deterministic-replay-sanitization?format=mdc","cursorrules":"/api/rules/temporal-deterministic-replay-sanitization?format=cursor","windsurf":"/api/rules/temporal-deterministic-replay-sanitization?format=windsurf","agents":"/api/rules/temporal-deterministic-replay-sanitization?format=agents"}},{"id":"go-chi-zero-allocation-stream-ingestion","title":"Zero-Allocation Chunked Stream Ingestion & Backpressure Clamp for Go Chi","category":"backend","severity":"critical","description":"Enforces memory-bounded chunked stream consumption using sync.Pool byte slice recycling, http.MaxBytesReader payload caps, and buffered concurrency tokens on Go Chi routes. Eliminates heap allocations and GC thrashing during heavy webhook burst traffic by processing payloads in fixed-size reusable buffers while shedding load with HTTP 429/503 when worker capacity saturates.","antiPatternHeadline":"Unbounded io.ReadAll and Heap-Escaping Buffer Allocation Under Webhook Bursts","stars_count":48,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","chi","concurrency","performance","memory-management"],"exportEndpoints":{"claude":"/api/rules/go-chi-zero-allocation-stream-ingestion?format=claude","cursorMdc":"/api/rules/go-chi-zero-allocation-stream-ingestion?format=mdc","cursorrules":"/api/rules/go-chi-zero-allocation-stream-ingestion?format=cursor","windsurf":"/api/rules/go-chi-zero-allocation-stream-ingestion?format=windsurf","agents":"/api/rules/go-chi-zero-allocation-stream-ingestion?format=agents"}},{"id":"kmp-darwin-gcd-cancellation-bridge-guardrail","title":"KMP Darwin Coroutine & Swift Task Bidirectional Cancellation Invariant","category":"mobile","severity":"critical","description":"Mandates deterministic cancellation propagation and ARC-safe memory management between Kotlin Multiplatform Coroutine scopes and Darwin native Swift Concurrency/GCD tasks. Prevents orphaned Kotlin background jobs, uncancelled DispatchWorkItems, and cross-runtime retain cycles between the Kotlin/Native GC and Apple ARC runtime boundaries.","antiPatternHeadline":"Unbridged Darwin Swift Task Execution Leaking Orphaning Kotlin Coroutines and Retaining ARC Boundary Closures","stars_count":44,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","kmp","swift-concurrency","coroutines","darwin","memory-management"],"exportEndpoints":{"claude":"/api/rules/kmp-darwin-gcd-cancellation-bridge-guardrail?format=claude","cursorMdc":"/api/rules/kmp-darwin-gcd-cancellation-bridge-guardrail?format=mdc","cursorrules":"/api/rules/kmp-darwin-gcd-cancellation-bridge-guardrail?format=cursor","windsurf":"/api/rules/kmp-darwin-gcd-cancellation-bridge-guardrail?format=windsurf","agents":"/api/rules/kmp-darwin-gcd-cancellation-bridge-guardrail?format=agents"}},{"id":"webauthn-l3-origin-rpid-cross-verification","title":"WebAuthn Level 3 Cryptographic Origin, rpId, and Hash Cross-Checking Standard","category":"security","severity":"critical","description":"Enforces strict server-side cryptographic verification of WebAuthn Level 3 clientDataJSON and authenticatorData structures. Mandates canonical origin matching, rpIdHash validation over multi-tenant top-level domains, and exact clientDataHash integrity checks to eradicate adversary-in-the-middle (AiTM) proxy interception and replay phishing attacks.","antiPatternHeadline":"Trusting Client-Supplied Origins and Permissive rpId Wildcard Matching in WebAuthn Assertion Pipelines","stars_count":79,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","passkeys","fido2","cryptography","authentication","multi-tenant"],"exportEndpoints":{"claude":"/api/rules/webauthn-l3-origin-rpid-cross-verification?format=claude","cursorMdc":"/api/rules/webauthn-l3-origin-rpid-cross-verification?format=mdc","cursorrules":"/api/rules/webauthn-l3-origin-rpid-cross-verification?format=cursor","windsurf":"/api/rules/webauthn-l3-origin-rpid-cross-verification?format=windsurf","agents":"/api/rules/webauthn-l3-origin-rpid-cross-verification?format=agents"}},{"id":"sigstore-keyless-oidc-attestation-standard","title":"Sigstore Keyless Artifact Attestation and Rekor Transparency Verification Standard","category":"security","severity":"critical","description":"Enforces keyless artifact attestation by binding build container images and binary release assets directly to ephemeral OpenID Connect (OIDC) identities issued by Fulcio and recorded in Rekor public transparency logs. Eliminates high-risk long-lived signing keys and static credentials from CI/CD runners, requiring all admission gates and downstream orchestrators to verify cryptographic SAN provenance and inclusion proofs against root TUF metadata.","antiPatternHeadline":"Persisting Static Private Keys in CI Secrets and Bypassing Rekor Transparency Verification","stars_count":81,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","sigstore","cosign","oidc","slsa","supply-chain","containers"],"exportEndpoints":{"claude":"/api/rules/sigstore-keyless-oidc-attestation-standard?format=claude","cursorMdc":"/api/rules/sigstore-keyless-oidc-attestation-standard?format=mdc","cursorrules":"/api/rules/sigstore-keyless-oidc-attestation-standard?format=cursor","windsurf":"/api/rules/sigstore-keyless-oidc-attestation-standard?format=windsurf","agents":"/api/rules/sigstore-keyless-oidc-attestation-standard?format=agents"}},{"id":"k8s-gateway-api-backendtlspolicy-strict-mtls","title":"Strict BackendTLSPolicy Pod mTLS & SAN Verification Standard","category":"devops","severity":"critical","description":"Enforces zero-trust cryptographic pod-to-gateway mutual TLS and Subject Alternative Name (SAN) validation natively without sidecars via Kubernetes Gateway API v1.2 BackendTLSPolicy. Prohibits cleartext pod transit, unpinned wildcard certificates, and unanchored trust chains across heterogeneous service meshes.","antiPatternHeadline":"Cleartext Gateway-to-Pod Egress and Unvalidated Upstream Backend TLS Handshakes","stars_count":107,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","kubernetes","gateway-api","zero-trust","mtls","tls-verification","infosec"],"exportEndpoints":{"claude":"/api/rules/k8s-gateway-api-backendtlspolicy-strict-mtls?format=claude","cursorMdc":"/api/rules/k8s-gateway-api-backendtlspolicy-strict-mtls?format=mdc","cursorrules":"/api/rules/k8s-gateway-api-backendtlspolicy-strict-mtls?format=cursor","windsurf":"/api/rules/k8s-gateway-api-backendtlspolicy-strict-mtls?format=windsurf","agents":"/api/rules/k8s-gateway-api-backendtlspolicy-strict-mtls?format=agents"}},{"id":"opentelemetry-metric-exemplar-reservoir-sampling-standard","title":"OpenTelemetry Metric Exemplar High-Cardinality Reservoir Sampling Standard","category":"devops","severity":"critical","description":"Enforces strict memory-bounded reservoir sampling and trace-context filtering for OpenTelemetry metric exemplars. Prevents collector and agent heap exhaustion, stop-the-world garbage collection pauses, and telemetry pipeline OOM kills during high-throughput p99 anomaly bursts. Mandates deterministic reservoir sizing and strict exemplar attribute key filtering.","antiPatternHeadline":"Unbounded Exemplar Attachment and Naive Always-On Reservoir Retention Causing OOM Crashes","stars_count":114,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","observability","metrics","exemplars","sre","performance"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-metric-exemplar-reservoir-sampling-standard?format=claude","cursorMdc":"/api/rules/opentelemetry-metric-exemplar-reservoir-sampling-standard?format=mdc","cursorrules":"/api/rules/opentelemetry-metric-exemplar-reservoir-sampling-standard?format=cursor","windsurf":"/api/rules/opentelemetry-metric-exemplar-reservoir-sampling-standard?format=windsurf","agents":"/api/rules/opentelemetry-metric-exemplar-reservoir-sampling-standard?format=agents"}},{"id":"bun-cluster-socket-handoff-zero-downtime-draining-production-standard","title":"Atomic Socket Migration and Graceful In-Flight Draining in Bun Cluster Topologies","category":"backend","severity":"critical","description":"Enforces deterministic, zero-downtime rolling worker recycles in Bun 1.2+ server clusters by utilizing atomic socket handoff and non-destructive worker draining. Guarantees zero dropped TCP SYN packets or truncated in-flight TLS streams by decoupling the listening socket lifecycle from individual worker lifecycles.","antiPatternHeadline":"Abrupt Process Termination and Uncoordinated Socket Teardown Triggering TCP Reset (RST) and 502 Bad Gateway Cascades","stars_count":112,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","clustering","zero-downtime","networking","socket-handoff"],"exportEndpoints":{"claude":"/api/rules/bun-cluster-socket-handoff-zero-downtime-draining-production-standard?format=claude","cursorMdc":"/api/rules/bun-cluster-socket-handoff-zero-downtime-draining-production-standard?format=mdc","cursorrules":"/api/rules/bun-cluster-socket-handoff-zero-downtime-draining-production-standard?format=cursor","windsurf":"/api/rules/bun-cluster-socket-handoff-zero-downtime-draining-production-standard?format=windsurf","agents":"/api/rules/bun-cluster-socket-handoff-zero-downtime-draining-production-standard?format=agents"}},{"id":"fastapi-anyio-taskgroup-cancellation-propagation","title":"FastAPI AnyIO Structured Concurrency & Disconnect Cancellation Guardrail","category":"backend","severity":"critical","description":"Enforces strict structured concurrency using AnyIO TaskGroups bound to incoming FastAPI request lifecycles. Guarantees that client HTTP disconnections deterministically trigger cancellation scopes across all nested coroutines, immediately aborting active database transactions and returning pooled connections to prevent connection starvation.","antiPatternHeadline":"Unbounded Background Tasks and Ignored Client Disconnections Leading to DB Pool Exhaustion","stars_count":110,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","anyio","asyncio","structured-concurrency","sqlalchemy"],"exportEndpoints":{"claude":"/api/rules/fastapi-anyio-taskgroup-cancellation-propagation?format=claude","cursorMdc":"/api/rules/fastapi-anyio-taskgroup-cancellation-propagation?format=mdc","cursorrules":"/api/rules/fastapi-anyio-taskgroup-cancellation-propagation?format=cursor","windsurf":"/api/rules/fastapi-anyio-taskgroup-cancellation-propagation?format=windsurf","agents":"/api/rules/fastapi-anyio-taskgroup-cancellation-propagation?format=agents"}},{"id":"oauth2-dpop-ephemeral-key-nonce-sync","title":"OAuth 2.0 DPoP (RFC 9449) Ephemeral Key & Nonce Synchronization Boundary","category":"security","severity":"critical","description":"Enforces strict RFC 9449 Demonstrating Proof-of-Possession (DPoP) standards across client application layers to eliminate token-theft and replay vulnerabilities. Mandates non-extractable WebCrypto asymmetric keys, canonicalized proof claims, and atomic single-retry nonce synchronization boundaries.","antiPatternHeadline":"Persisting Extractable DPoP Private Keys to Web Storage with Unsynchronized Nonce Race Conditions","stars_count":55,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","oauth2","dpop","rfc9449","cryptography","webcrypto"],"exportEndpoints":{"claude":"/api/rules/oauth2-dpop-ephemeral-key-nonce-sync?format=claude","cursorMdc":"/api/rules/oauth2-dpop-ephemeral-key-nonce-sync?format=mdc","cursorrules":"/api/rules/oauth2-dpop-ephemeral-key-nonce-sync?format=cursor","windsurf":"/api/rules/oauth2-dpop-ephemeral-key-nonce-sync?format=windsurf","agents":"/api/rules/oauth2-dpop-ephemeral-key-nonce-sync?format=agents"}},{"id":"go-chi-http3-early-data-quarantine-middleware","title":"Go Chi HTTP/3 0-RTT Early-Data Quarantine and Replay Defense Standard","category":"backend","severity":"critical","description":"Enforces strict quarantine and validation of HTTP/3 QUIC 0-RTT early data across Go Chi routers. Prevents replay attack vulnerabilities by rejecting non-idempotent mutations executed under early data with HTTP 425 Too Early and mandating replay-safe context propagation.","antiPatternHeadline":"Permitting Unsafe State Mutations and Non-Idempotent Handlers Over QUIC 0-RTT Early Data","stars_count":97,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","chi","http3","quic","0-rtt","replay-attack","security"],"exportEndpoints":{"claude":"/api/rules/go-chi-http3-early-data-quarantine-middleware?format=claude","cursorMdc":"/api/rules/go-chi-http3-early-data-quarantine-middleware?format=mdc","cursorrules":"/api/rules/go-chi-http3-early-data-quarantine-middleware?format=cursor","windsurf":"/api/rules/go-chi-http3-early-data-quarantine-middleware?format=windsurf","agents":"/api/rules/go-chi-http3-early-data-quarantine-middleware?format=agents"}},{"id":"pg17-logical-replication-slot-synchronization-guardrail","title":"PostgreSQL 17 Logical Replication Slot Synchronization Guardrail","category":"backend","severity":"critical","description":"Enforces failover-ready logical replication slots on PostgreSQL 17 primary instances and validates slot synchronization across physical streaming standbys prior to promotion. Guarantees zero data loss and prevents subscriber divergence or invalidated slots during planned failovers or ungraceful primary promotions.","antiPatternHeadline":"Promoting Physical Standbys or Reconnecting CDC Subscribers Without Validating PG17 Failover Slot Synchronization State","stars_count":72,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","cdc","logical-replication","database-ha","zero-data-loss"],"exportEndpoints":{"claude":"/api/rules/pg17-logical-replication-slot-synchronization-guardrail?format=claude","cursorMdc":"/api/rules/pg17-logical-replication-slot-synchronization-guardrail?format=mdc","cursorrules":"/api/rules/pg17-logical-replication-slot-synchronization-guardrail?format=cursor","windsurf":"/api/rules/pg17-logical-replication-slot-synchronization-guardrail?format=windsurf","agents":"/api/rules/pg17-logical-replication-slot-synchronization-guardrail?format=agents"}},{"id":"kmp-swift-export-arc-retain-cycle-guardrail","title":"KMP 2.1 Swift Export Dynamic ARC Retain-Cycle Guardrail","category":"mobile","severity":"critical","description":"Enforces weak-reference proxy boundaries and explicit detachment lifecycle hooks on all bidirectional listeners exposed across Kotlin Multiplatform 2.1 Swift Export. Eliminates cross-runtime memory leaks caused by independent garbage collection mechanisms (Swift ARC and Kotlin/Native GC) forming uncollected cyclic references across the foreign function interface.","antiPatternHeadline":"Strong Bidirectional References Between Swift ARC Objects and Kotlin/Native Exported State Holders","stars_count":105,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kmp","kotlin-native","swift-export","arc","memory-leaks","memory-management"],"exportEndpoints":{"claude":"/api/rules/kmp-swift-export-arc-retain-cycle-guardrail?format=claude","cursorMdc":"/api/rules/kmp-swift-export-arc-retain-cycle-guardrail?format=mdc","cursorrules":"/api/rules/kmp-swift-export-arc-retain-cycle-guardrail?format=cursor","windsurf":"/api/rules/kmp-swift-export-arc-retain-cycle-guardrail?format=windsurf","agents":"/api/rules/kmp-swift-export-arc-retain-cycle-guardrail?format=agents"}},{"id":"capacitor-7-jsi-sharedbuffer-isolation-standard","title":"Capacitor 7 Native JSI Zero-Copy SharedBuffer Isolation Standard","category":"mobile","severity":"critical","description":"Enforces zero-copy binary buffer transmission and worker thread isolation between native mobile runtimes (iOS WKWebView/Android Chromium) and Capacitor 7 applications. Prohibits base64 serialization, standard JSON bridge payload encoding, and direct main-thread processing of high-frequency sensor and camera streams. Mandates transferable ArrayBuffers, SharedArrayBuffer with Atomics synchronization, or OffscreenCanvas delegation within Dedicated Web Workers.","antiPatternHeadline":"Marshalling high-frequency streaming frames via base64 JSON bridge payloads directly into the main UI thread.","stars_count":53,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","jsi","sharedarraybuffer","zero-copy","performance"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-jsi-sharedbuffer-isolation-standard?format=claude","cursorMdc":"/api/rules/capacitor-7-jsi-sharedbuffer-isolation-standard?format=mdc","cursorrules":"/api/rules/capacitor-7-jsi-sharedbuffer-isolation-standard?format=cursor","windsurf":"/api/rules/capacitor-7-jsi-sharedbuffer-isolation-standard?format=windsurf","agents":"/api/rules/capacitor-7-jsi-sharedbuffer-isolation-standard?format=agents"}},{"id":"otlp-arrow-buffer-backpressure-gate","title":"OTLP/Arrow In-Flight Chunk Quotas & Memory-Bound Backpressure Gate","category":"devops","severity":"critical","description":"Enforces strict byte-level memory accounting and adaptive backpressure on OpenTelemetry OTLP/Arrow columnar chunk streams prior to collector egress. Prevents telemetry agent and collector Out-Of-Memory (OOM) cascades by bounding in-flight Arrow RecordBatch allocations and shedding or throttling telemetry ingestion when memory saturation thresholds are reached.","antiPatternHeadline":"Unmetered Arrow RecordBatch Accumulation Leading to Collector Ingestion OOM Cascades","stars_count":80,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","arrow","backpressure","o11y","memory-safety"],"exportEndpoints":{"claude":"/api/rules/otlp-arrow-buffer-backpressure-gate?format=claude","cursorMdc":"/api/rules/otlp-arrow-buffer-backpressure-gate?format=mdc","cursorrules":"/api/rules/otlp-arrow-buffer-backpressure-gate?format=cursor","windsurf":"/api/rules/otlp-arrow-buffer-backpressure-gate?format=windsurf","agents":"/api/rules/otlp-arrow-buffer-backpressure-gate?format=agents"}},{"id":"cilium-wireguard-pmtu-mss-clamping-standard","title":"Cilium WireGuard Cross-Cluster PMTU and TCP MSS Clamping Invariant","category":"devops","severity":"critical","description":"Enforces deterministic Maximum Segment Size (MSS) clamping and dynamic Path MTU (PMTU) discovery configuration across multi-cluster Cilium mesh overlays utilizing WireGuard encryption. Prevents silent packet drops, intermittent TCP stalls, and TLS handshake truncation caused by unhandled encapsulation overhead in heterogeneous cross-cloud transit links.","antiPatternHeadline":"Unclamped TCP MSS Over Encrypted Overlays Causing Silent Blackhole Failures During TLS Exchanges","stars_count":68,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","cilium","wireguard","service-mesh","mtu-clamping","ebpf"],"exportEndpoints":{"claude":"/api/rules/cilium-wireguard-pmtu-mss-clamping-standard?format=claude","cursorMdc":"/api/rules/cilium-wireguard-pmtu-mss-clamping-standard?format=mdc","cursorrules":"/api/rules/cilium-wireguard-pmtu-mss-clamping-standard?format=cursor","windsurf":"/api/rules/cilium-wireguard-pmtu-mss-clamping-standard?format=windsurf","agents":"/api/rules/cilium-wireguard-pmtu-mss-clamping-standard?format=agents"}},{"id":"react-19-compiler-ref-mutation-invariants","title":"React 19 Compiler Reactivity & Ref Mutation Invariants","category":"frontend","severity":"critical","description":"Defines strict purity and ref lifecycle boundaries for React 19 compiler-optimized memoization blocks. Enforces that mutable ref reads and writes are restricted exclusively to effects and event handlers, preventing stale DOM references within memoized scopes and avoiding compiler de-optimizations. Guarantees that compiler-generated reactive blocks remain deterministic without triggering cascading re-renders across component boundaries.","antiPatternHeadline":"Reading or Mutating ref.current During Render Phase in Compiler-Optimized Scopes","stars_count":51,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react19","react-compiler","refs","reactivity","performance"],"exportEndpoints":{"claude":"/api/rules/react-19-compiler-ref-mutation-invariants?format=claude","cursorMdc":"/api/rules/react-19-compiler-ref-mutation-invariants?format=mdc","cursorrules":"/api/rules/react-19-compiler-ref-mutation-invariants?format=cursor","windsurf":"/api/rules/react-19-compiler-ref-mutation-invariants?format=windsurf","agents":"/api/rules/react-19-compiler-ref-mutation-invariants?format=agents"}},{"id":"nextjs-15-async-request-api-boundaries","title":"Next.js 15 Async Request API Resolution Boundaries and Streaming Invariants","category":"frontend","severity":"critical","description":"Next.js 15 transitions dynamic request contexts (cookies, headers, params, and searchParams) to asynchronous Promises to enable Dynamic I/O and Partial Prerendering (PPR). Eagerly awaiting these APIs at layout or page root scopes triggers premature dynamic bailouts and collapses downstream streaming boundaries into cascading server-side waterfalls.","antiPatternHeadline":"Top-level sequential awaiting of request context promises collapsing streaming trees into blocking micro-waterfalls.","stars_count":96,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["nextjs","next15","react19","dynamic-io","server-components","ppr","streaming"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-async-request-api-boundaries?format=claude","cursorMdc":"/api/rules/nextjs-15-async-request-api-boundaries?format=mdc","cursorrules":"/api/rules/nextjs-15-async-request-api-boundaries?format=cursor","windsurf":"/api/rules/nextjs-15-async-request-api-boundaries?format=windsurf","agents":"/api/rules/nextjs-15-async-request-api-boundaries?format=agents"}},{"id":"postgres-17-logical-failover-slot-sync","title":"Postgres 17 Logical Replication Failover Slot Synchronization Guardrail","category":"backend","severity":"critical","description":"Enforces Postgres 17 native logical replication failover slot synchronization across physical standbys. Prevents downstream CDC data duplication and message loss during standby promotion by requiring the FAILOVER clause and strict validation of synchronized_standby_slots alignment before WAL consumption.","antiPatternHeadline":"Unsynchronized Logical Slots Advancing Beyond Physical Standby Confirmed LSN","stars_count":49,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","postgres-17","logical-replication","cdc","high-availability"],"exportEndpoints":{"claude":"/api/rules/postgres-17-logical-failover-slot-sync?format=claude","cursorMdc":"/api/rules/postgres-17-logical-failover-slot-sync?format=mdc","cursorrules":"/api/rules/postgres-17-logical-failover-slot-sync?format=cursor","windsurf":"/api/rules/postgres-17-logical-failover-slot-sync?format=windsurf","agents":"/api/rules/postgres-17-logical-failover-slot-sync?format=agents"}},{"id":"axum-multipart-streaming-backpressure","title":"Axum 0.8 Streaming Multipart Byte-Budget Ceiling & Early-Abort Invariant","category":"backend","severity":"critical","description":"Enforces strict streaming chunk consumption with explicit byte-budget ceilings on Axum 0.8 multipart extractors to prevent unbounded memory allocation and heap exhaustion. Guarantees deterministic backpressure and explicit early-abort mechanics, eliminating socket buffer starvation and unconsumed TCP stream desynchronization during payload validation failures.","antiPatternHeadline":"Unbounded Field Buffering via field.bytes() and Dangling Socket Starvation on Early Error Abort","stars_count":63,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tokio","security","streaming"],"exportEndpoints":{"claude":"/api/rules/axum-multipart-streaming-backpressure?format=claude","cursorMdc":"/api/rules/axum-multipart-streaming-backpressure?format=mdc","cursorrules":"/api/rules/axum-multipart-streaming-backpressure?format=cursor","windsurf":"/api/rules/axum-multipart-streaming-backpressure?format=windsurf","agents":"/api/rules/axum-multipart-streaming-backpressure?format=agents"}},{"id":"go124-weak-pointer-cache-finalizer-deadlock-prevention","title":"Go 1.24 Weak Pointer Cache Eviction & Finalizer Deadlock Invariant","category":"backend","severity":"critical","description":"Enforces non-blocking weak reference tracking and decoupled cleanup semantics using Go 1.24 weak.Pointer and runtime.AddCleanup. Prohibits synchronous mutex acquisition in finalization routines and circular references that induce GC sweep latency spikes or permanent deadlock.","antiPatternHeadline":"Lock Inversion and Object Resurrection via Synchronous Mutex Acquisition in GC Finalizers","stars_count":113,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","golang","go124","concurrency","gc","memory-management","cache"],"exportEndpoints":{"claude":"/api/rules/go124-weak-pointer-cache-finalizer-deadlock-prevention?format=claude","cursorMdc":"/api/rules/go124-weak-pointer-cache-finalizer-deadlock-prevention?format=mdc","cursorrules":"/api/rules/go124-weak-pointer-cache-finalizer-deadlock-prevention?format=cursor","windsurf":"/api/rules/go124-weak-pointer-cache-finalizer-deadlock-prevention?format=windsurf","agents":"/api/rules/go124-weak-pointer-cache-finalizer-deadlock-prevention?format=agents"}},{"id":"kmp-darwin-stateflow-main-thread-affinity","title":"KMP Shared StateFlow Darwin Main-Thread Affinity Guardrail","category":"mobile","severity":"critical","description":"Enforces strict main-thread confinement for Kotlin Multiplatform StateFlow emissions bound for Darwin targets. Prevents off-main-thread UI state bridging, race conditions, and purple runtime warnings in SwiftUI and UIKit by requiring explicit dispatcher affinity at the KMP/Native boundary.","antiPatternHeadline":"Unconfined Coroutine StateFlow Bridging Directly to Darwin UI Surfaces","stars_count":89,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","kmp","swift","coroutines","stateflow","darwin","swiftui"],"exportEndpoints":{"claude":"/api/rules/kmp-darwin-stateflow-main-thread-affinity?format=claude","cursorMdc":"/api/rules/kmp-darwin-stateflow-main-thread-affinity?format=mdc","cursorrules":"/api/rules/kmp-darwin-stateflow-main-thread-affinity?format=cursor","windsurf":"/api/rules/kmp-darwin-stateflow-main-thread-affinity?format=windsurf","agents":"/api/rules/kmp-darwin-stateflow-main-thread-affinity?format=agents"}},{"id":"openfga-rebac-cyclic-evaluation-guardrails","title":"OpenFGA Zanzibar Hierarchical ReBAC Cyclic Evaluation & Recursion Guardrails","category":"security","severity":"critical","description":"Enforces strict recursion depth bounding, cyclic relation validation, and context-propagated cycle detection across OpenFGA/Zanzibar ReBAC authorization evaluations. Prevents unbounded graph traversals, distributed stack exhaustion, and Denial of Service (DoS) attacks caused by mutually nested relations or unconstrained transitive closure evaluations.","antiPatternHeadline":"Unbounded ReBAC graph expansion via cyclic or deeply nested relation-tuple evaluation without traversal bounds and cycle-breaking context","stars_count":85,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","zanzibar","rebac","authorization","cycle-detection","graph-traversal"],"exportEndpoints":{"claude":"/api/rules/openfga-rebac-cyclic-evaluation-guardrails?format=claude","cursorMdc":"/api/rules/openfga-rebac-cyclic-evaluation-guardrails?format=mdc","cursorrules":"/api/rules/openfga-rebac-cyclic-evaluation-guardrails?format=cursor","windsurf":"/api/rules/openfga-rebac-cyclic-evaluation-guardrails?format=windsurf","agents":"/api/rules/openfga-rebac-cyclic-evaluation-guardrails?format=agents"}},{"id":"webauthn-device-bound-step-up-invariant","title":"WebAuthn Device-Bound Step-Up Credential Invariant","category":"security","severity":"critical","description":"Enforces cryptographic and structural validation that rejects multi-device synced passkeys for high-risk transactions. Requires hardware-bound authenticators by strictly inspecting the Backup State (BS) and Backup Eligibility (BE) flags alongside explicit Authenticator Attachment requirements during WebAuthn assertion verification.","antiPatternHeadline":"Accepting Synced Passkeys for Critical Authorization and Omitting Authenticator Attachment Invariants","stars_count":42,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","fido2","passkeys","step-up-auth","cryptography"],"exportEndpoints":{"claude":"/api/rules/webauthn-device-bound-step-up-invariant?format=claude","cursorMdc":"/api/rules/webauthn-device-bound-step-up-invariant?format=mdc","cursorrules":"/api/rules/webauthn-device-bound-step-up-invariant?format=cursor","windsurf":"/api/rules/webauthn-device-bound-step-up-invariant?format=windsurf","agents":"/api/rules/webauthn-device-bound-step-up-invariant?format=agents"}},{"id":"otel-spanprocessor-nonblocking-ringbuffer-standard","title":"OpenTelemetry Non-Blocking Drop-Tail SpanProcessor Invariant","category":"devops","severity":"critical","description":"Enforces strict lock-free, drop-tail batch processing invariants across OpenTelemetry tracing pipelines. Ensures tracing overhead and collector backpressure can never cascade into critical execution paths, block worker event loops, or degrade primary request throughput.","antiPatternHeadline":"Synchronous Backpressure Propagation and Unbounded Buffering in Observability Exporters","stars_count":60,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","observability","distributed-tracing","concurrency","performance"],"exportEndpoints":{"claude":"/api/rules/otel-spanprocessor-nonblocking-ringbuffer-standard?format=claude","cursorMdc":"/api/rules/otel-spanprocessor-nonblocking-ringbuffer-standard?format=mdc","cursorrules":"/api/rules/otel-spanprocessor-nonblocking-ringbuffer-standard?format=cursor","windsurf":"/api/rules/otel-spanprocessor-nonblocking-ringbuffer-standard?format=windsurf","agents":"/api/rules/otel-spanprocessor-nonblocking-ringbuffer-standard?format=agents"}},{"id":"cilium-ebpf-pmtu-geneve-encapsulation-guardrail","title":"Cilium eBPF Host-Routing Path MTU Discovery and GENEVE Encapsulation Guardrails","category":"devops","severity":"critical","description":"Enforces deterministic Path MTU Discovery (PMTU) and explicit header overhead compensation when using Cilium eBPF host-routing over GENEVE tunnels in hybrid multi-cloud topologies. Prevents silent egress packet drops, TCP stall conditions, and kernel-level fragmentation bottlenecks caused by eBPF netkit/veth bypass of standard netfilter TCPMSS clamping.","antiPatternHeadline":"Bypassing Dynamic PMTU and MSS Clamping with Static MTUs in eBPF Host-Routed Multi-Cloud Overlay Networks","stars_count":90,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","cilium","ebpf","networking","kubernetes","geneve","mtu"],"exportEndpoints":{"claude":"/api/rules/cilium-ebpf-pmtu-geneve-encapsulation-guardrail?format=claude","cursorMdc":"/api/rules/cilium-ebpf-pmtu-geneve-encapsulation-guardrail?format=mdc","cursorrules":"/api/rules/cilium-ebpf-pmtu-geneve-encapsulation-guardrail?format=cursor","windsurf":"/api/rules/cilium-ebpf-pmtu-geneve-encapsulation-guardrail?format=windsurf","agents":"/api/rules/cilium-ebpf-pmtu-geneve-encapsulation-guardrail?format=agents"}},{"id":"svelte-5-async-effect-boundary-memory-leak-prevention","title":"Svelte 5 Runes Async Effect Boundary & Memory Leak Prevention","category":"frontend","severity":"critical","description":"Enforces strict lifecycle boundaries and deterministic cancellation for asynchronous operations initiated inside Svelte 5 `$effect` blocks. Prevents detached DOM nodes, stale closures, and listener accumulation in long-lived single-page applications by mandating AbortController propagation, synchronous teardown returns, and isolation of untracked async execution paths.","antiPatternHeadline":"Unbounded Async Operations in $effect Without AbortController Teardown Leading to Retained Scope References","stars_count":99,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","memory-leaks","async-lifecycle","reactivity"],"exportEndpoints":{"claude":"/api/rules/svelte-5-async-effect-boundary-memory-leak-prevention?format=claude","cursorMdc":"/api/rules/svelte-5-async-effect-boundary-memory-leak-prevention?format=mdc","cursorrules":"/api/rules/svelte-5-async-effect-boundary-memory-leak-prevention?format=cursor","windsurf":"/api/rules/svelte-5-async-effect-boundary-memory-leak-prevention?format=windsurf","agents":"/api/rules/svelte-5-async-effect-boundary-memory-leak-prevention?format=agents"}},{"id":"nextjs-15-ppr-static-dynamic-boundary-invariant","title":"Next.js 15 PPR Static-Dynamic Boundary and Suspense Isolation Invariant","category":"frontend","severity":"critical","description":"Enforces strict isolation between static prerendered shells and dynamic streaming subtrees under Next.js 15 Partial Prerendering (PPR). Guarantees dynamic data access (cookies, headers, searchParams, connection, uncached fetch) is quarantined behind React Suspense boundaries to prevent full-route de-optimization and cascading hydration bailouts.","antiPatternHeadline":"Top-Level Dynamic Access Poisoning Static Prerender Shells via Unwrapped Suspense Boundaries","stars_count":87,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs-15","ppr","react-suspense","streaming","hydration","server-components"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-ppr-static-dynamic-boundary-invariant?format=claude","cursorMdc":"/api/rules/nextjs-15-ppr-static-dynamic-boundary-invariant?format=mdc","cursorrules":"/api/rules/nextjs-15-ppr-static-dynamic-boundary-invariant?format=cursor","windsurf":"/api/rules/nextjs-15-ppr-static-dynamic-boundary-invariant?format=windsurf","agents":"/api/rules/nextjs-15-ppr-static-dynamic-boundary-invariant?format=agents"}},{"id":"fastapi-async-generator-streaming-session-cleanup","title":"FastAPI Async Generator Lifecycle & DB Session Cleanup in Streaming Responses","category":"backend","severity":"critical","description":"Enforces deterministic teardown of asynchronous database sessions and contextual resources during FastAPI StreamingResponse lifecycles. Guards against database connection pool starvation caused by unhandled asyncio.CancelledError and GeneratorExit exceptions when clients disconnect prematurely during chunk iteration.","antiPatternHeadline":"Leaking Active Database Connections via Unhandled Generator Cancellations in Streaming Responses","stars_count":45,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["fastapi","asyncio","sqlalchemy","pydantic-v2","connection-pool","streaming"],"exportEndpoints":{"claude":"/api/rules/fastapi-async-generator-streaming-session-cleanup?format=claude","cursorMdc":"/api/rules/fastapi-async-generator-streaming-session-cleanup?format=mdc","cursorrules":"/api/rules/fastapi-async-generator-streaming-session-cleanup?format=cursor","windsurf":"/api/rules/fastapi-async-generator-streaming-session-cleanup?format=windsurf","agents":"/api/rules/fastapi-async-generator-streaming-session-cleanup?format=agents"}},{"id":"bun-websocket-cluster-backpressure-protocol","title":"Bun 1.2 Native WebSocket Backpressure & Zero-Copy Buffer Recycling Protocol","category":"backend","severity":"critical","description":"Enforces strict TCP-level backpressure management and zero-copy binary buffer pooling for Bun 1.2 native WebSocket servers. Prohibits unchecked calls to `ws.send()` by evaluating `ws.getBufferedAmount()` against high-water marks and leveraging native `drain()` handlers with `ws.cork()` payload batching to eliminate kernel buffer bloat and Out-Of-Memory (OOM) crashes under high fan-out load.","antiPatternHeadline":"Unbounded `ws.send()` dispatching without `getBufferedAmount()` checks and missing native `drain()` lifecycle control.","stars_count":52,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","websockets","backpressure","memory-management","zero-copy"],"exportEndpoints":{"claude":"/api/rules/bun-websocket-cluster-backpressure-protocol?format=claude","cursorMdc":"/api/rules/bun-websocket-cluster-backpressure-protocol?format=mdc","cursorrules":"/api/rules/bun-websocket-cluster-backpressure-protocol?format=cursor","windsurf":"/api/rules/bun-websocket-cluster-backpressure-protocol?format=windsurf","agents":"/api/rules/bun-websocket-cluster-backpressure-protocol?format=agents"}},{"id":"kafka-kraft-quorum-reconfiguration-standard","title":"Apache Kafka 4.0 KRaft Dynamic Quorum Reconfiguration & Epoch Guard Standard","category":"backend","severity":"critical","description":"Mandates strict quorum epoch verification, single-voter transitions, and replica catch-up preconditions during KRaft dynamic quorum reconfiguration (KIP-853) in Kafka 4.0. Prevents split-brain divergence, quorum loss, and metadata log truncation during controller cluster topology changes.","antiPatternHeadline":"Unfenced Concurrent Controller Membership Mutations Without Epoch Fencing","stars_count":66,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","kafka","kraft","distributed-systems","consensus"],"exportEndpoints":{"claude":"/api/rules/kafka-kraft-quorum-reconfiguration-standard?format=claude","cursorMdc":"/api/rules/kafka-kraft-quorum-reconfiguration-standard?format=mdc","cursorrules":"/api/rules/kafka-kraft-quorum-reconfiguration-standard?format=cursor","windsurf":"/api/rules/kafka-kraft-quorum-reconfiguration-standard?format=windsurf","agents":"/api/rules/kafka-kraft-quorum-reconfiguration-standard?format=agents"}},{"id":"capacitor-7-biometric-keystore-lock-invalidation","title":"Capacitor 7 Biometric Cryptographic Keystore Invalidation on Device Lock State","category":"mobile","severity":"critical","description":"Mandates that volatile cryptographic keys, decrypted authorization tokens, and hardware-backed biometric cryptographic handles in Capacitor 7 applications are irrevocably zeroized from runtime memory whenever the application yields focus, transitions to the background, or the device enters a locked state. Prevents memory extraction, unauthorized forensic access, and stale biometric authentication states across app lifecycle boundaries.","antiPatternHeadline":"Retaining Plaintext Secrets and Unlocked Cryptographic Sessions in JavaScript Memory Across App Pause/Lock Lifecycle Events","stars_count":83,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor7","biometrics","keystore","keychain","cryptography","memory-hygiene","security"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-biometric-keystore-lock-invalidation?format=claude","cursorMdc":"/api/rules/capacitor-7-biometric-keystore-lock-invalidation?format=mdc","cursorrules":"/api/rules/capacitor-7-biometric-keystore-lock-invalidation?format=cursor","windsurf":"/api/rules/capacitor-7-biometric-keystore-lock-invalidation?format=windsurf","agents":"/api/rules/capacitor-7-biometric-keystore-lock-invalidation?format=agents"}},{"id":"react-native-bridgeless-jsi-zero-copy-buffer-standard","title":"React Native 0.78 Bridgeless JSI TurboModule Zero-Copy Binary Buffer Standard","category":"mobile","severity":"critical","description":"Enforces strict memory safety and zero-copy binary communication between native C++ runtimes and JavaScript/Hermes in React Native 0.78+ bridgeless architecture. Mandates the use of jsi::ArrayBuffer wrapping direct native allocations or shared memory pools, eliminating JSON/base64 serialization overhead and avoiding cross-runtime heap fragmentation during high-throughput sensor telemetry ingestion.","antiPatternHeadline":"Piping Sensor Telemetry Through Serialized Bridges or Managed JavaScript Heap Copies","stars_count":78,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["react-native","jsi","turbomodules","hermes","c++","zero-copy","performance"],"exportEndpoints":{"claude":"/api/rules/react-native-bridgeless-jsi-zero-copy-buffer-standard?format=claude","cursorMdc":"/api/rules/react-native-bridgeless-jsi-zero-copy-buffer-standard?format=mdc","cursorrules":"/api/rules/react-native-bridgeless-jsi-zero-copy-buffer-standard?format=cursor","windsurf":"/api/rules/react-native-bridgeless-jsi-zero-copy-buffer-standard?format=windsurf","agents":"/api/rules/react-native-bridgeless-jsi-zero-copy-buffer-standard?format=agents"}},{"id":"tetragon-process-lineage-binary-tamper-prevention","title":"eBPF Tetragon Process Lineage Invariants & Binary Tamper Prevention","category":"security","severity":"critical","description":"Enforces kernel-level execution namespace invariants via eBPF Tetragon TracingPolicies to prevent unauthorized runtime binary mutations and container escapes. Mandates synchronous in-kernel termination (Sigkill) on namespace traversal, fileless payload execution (memfd_create), and unexpected process lineage forks prior to userspace execution.","antiPatternHeadline":"Passive Audit-Only Logging for In-Flight Binary Tampering and Privilege Escalation","stars_count":61,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","ebpf","tetragon","runtime-security","kubernetes","zero-trust"],"exportEndpoints":{"claude":"/api/rules/tetragon-process-lineage-binary-tamper-prevention?format=claude","cursorMdc":"/api/rules/tetragon-process-lineage-binary-tamper-prevention?format=mdc","cursorrules":"/api/rules/tetragon-process-lineage-binary-tamper-prevention?format=cursor","windsurf":"/api/rules/tetragon-process-lineage-binary-tamper-prevention?format=windsurf","agents":"/api/rules/tetragon-process-lineage-binary-tamper-prevention?format=agents"}},{"id":"spiffe-spire-dynamic-workload-attestation-mesh-standard","title":"Enforce Dynamic SPIFFE/SPIRE x509-SVID Attestation & Ephemeral Rotation","category":"security","severity":"critical","description":"Enforces cryptographic workload identity in distributed multi-cloud service meshes using SPIFFE Workload API streams instead of static credentials. Demands zero filesystem-cached secret retention, sub-hour x509-SVID validity lifecycles, and in-memory non-disruptive TLS handshake context refreshment via dynamic watchers.","antiPatternHeadline":"Persisting static cloud API keys or caching static x509 certificates without dynamic Workload API watchers","stars_count":70,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","spiffe","spire","zero-trust","mtls","x509-svid","service-mesh"],"exportEndpoints":{"claude":"/api/rules/spiffe-spire-dynamic-workload-attestation-mesh-standard?format=claude","cursorMdc":"/api/rules/spiffe-spire-dynamic-workload-attestation-mesh-standard?format=mdc","cursorrules":"/api/rules/spiffe-spire-dynamic-workload-attestation-mesh-standard?format=cursor","windsurf":"/api/rules/spiffe-spire-dynamic-workload-attestation-mesh-standard?format=windsurf","agents":"/api/rules/spiffe-spire-dynamic-workload-attestation-mesh-standard?format=agents"}},{"id":"argocd-applicationset-progressive-rollout-ephemeral-cleanup","title":"ArgoCD ApplicationSet Progressive Rollouts and Dynamic Ephemeral Cluster Cleanup Invariant","category":"devops","severity":"critical","description":"Standardizes immutable GitOps convergence loops across dynamic and ephemeral target clusters using ArgoCD ApplicationSets. Enforces rolling update progressive sync gates, cascading resource finalizers, and automated garbage collection triggers to prevent resource orphaning, zombie application states, and simultaneous failure domain propagation during dynamic cluster lifecycle events.","antiPatternHeadline":"Unbounded concurrent cluster syncs without rolling update stages, missing cascade finalizers, and unpruned ephemeral cluster secrets leading to cluster resource orphaning and cascade blast radius.","stars_count":79,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","gitops","argocd","applicationset","kubernetes","ephemeral-environments"],"exportEndpoints":{"claude":"/api/rules/argocd-applicationset-progressive-rollout-ephemeral-cleanup?format=claude","cursorMdc":"/api/rules/argocd-applicationset-progressive-rollout-ephemeral-cleanup?format=mdc","cursorrules":"/api/rules/argocd-applicationset-progressive-rollout-ephemeral-cleanup?format=cursor","windsurf":"/api/rules/argocd-applicationset-progressive-rollout-ephemeral-cleanup?format=windsurf","agents":"/api/rules/argocd-applicationset-progressive-rollout-ephemeral-cleanup?format=agents"}},{"id":"fastapi-anyio-taskgroup-concurrency-guardrail","title":"FastAPI AnyIO Structured Concurrency TaskGroup Scoping Guardrail","category":"backend","severity":"critical","description":"Enforces strict structured concurrency in FastAPI services by requiring AnyIO TaskGroups for all concurrent execution paths instead of untracked asyncio.create_task calls. Prevents orphaned background coroutines, silent exception swallowing, and memory leaks by ensuring asynchronous child tasks are deterministically bound to the parent request context or explicit application lifecycle scopes.","antiPatternHeadline":"Spawning Unbound Coroutines via asyncio.create_task Causing Silent Task Death and Context Leaks","stars_count":103,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","anyio","asyncio","structured-concurrency","python"],"exportEndpoints":{"claude":"/api/rules/fastapi-anyio-taskgroup-concurrency-guardrail?format=claude","cursorMdc":"/api/rules/fastapi-anyio-taskgroup-concurrency-guardrail?format=mdc","cursorrules":"/api/rules/fastapi-anyio-taskgroup-concurrency-guardrail?format=cursor","windsurf":"/api/rules/fastapi-anyio-taskgroup-concurrency-guardrail?format=windsurf","agents":"/api/rules/fastapi-anyio-taskgroup-concurrency-guardrail?format=agents"}},{"id":"postgres-17-json-table-projection-invariant","title":"Postgres 17 JSON_TABLE SQL:2023 Projection Invariant","category":"backend","severity":"critical","description":"Enforces SQL:2023 JSON_TABLE projection over client-side parsing or legacy LATERAL jsonb_array_elements cross-joins for nested JSONB querying. Direct engine-level columnar transformation prevents memory bloat, avoids V8 heap spikes, and leverages native Postgres execution plan optimizations.","antiPatternHeadline":"Client-Side In-Memory JSON Parsing and Chained jsonb_array_elements Tuple Explosion","stars_count":104,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","postgres-17","sql-2023","json-table","jsonb","performance"],"exportEndpoints":{"claude":"/api/rules/postgres-17-json-table-projection-invariant?format=claude","cursorMdc":"/api/rules/postgres-17-json-table-projection-invariant?format=mdc","cursorrules":"/api/rules/postgres-17-json-table-projection-invariant?format=cursor","windsurf":"/api/rules/postgres-17-json-table-projection-invariant?format=windsurf","agents":"/api/rules/postgres-17-json-table-projection-invariant?format=agents"}},{"id":"kmp-skie-swift-concurrency-bridge-invariant","title":"Kotlin Multiplatform SKIE Swift Concurrency Bridge & Memory Invariant","category":"mobile","severity":"critical","description":"Enforces deterministic lifecycle management, cooperative cancellation, and leak-free memory semantics when bridging Kotlin Coroutines and Flows to Swift async/await and AsyncSequence via SKIE. Eliminates retain cycles caused by unmanaged Swift Task instances holding Kotlin Job references across the Native/Swift interop boundary.","antiPatternHeadline":"Unscoped Swift Task Bridging of Kotlin Flows and Suspending Functions Inducing Memory Leaks and Zombie Coroutines","stars_count":85,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kmp","skie","swift-concurrency","kotlin-native","coroutines","ios"],"exportEndpoints":{"claude":"/api/rules/kmp-skie-swift-concurrency-bridge-invariant?format=claude","cursorMdc":"/api/rules/kmp-skie-swift-concurrency-bridge-invariant?format=mdc","cursorrules":"/api/rules/kmp-skie-swift-concurrency-bridge-invariant?format=cursor","windsurf":"/api/rules/kmp-skie-swift-concurrency-bridge-invariant?format=windsurf","agents":"/api/rules/kmp-skie-swift-concurrency-bridge-invariant?format=agents"}},{"id":"react-native-bridgeless-jsi-zerocopy-memory-fence","title":"Hermes JSI Zero-Copy Memory Fence and Thread-Affinity Guardrails","category":"mobile","severity":"critical","description":"Enforces strict thread-affinity checks and atomic memory fences during zero-copy ArrayBuffer sharing between native C++ pipelines and the Hermes JS runtime. Bridgeless TurboModules must never mutate shared backing stores without explicit synchronization or invoke JSI APIs outside the designated Hermes thread. Violating these invariants triggers silent memory corruption, race conditions during GC sweep phases, or unrecoverable fatal SIGSEGV crashes.","antiPatternHeadline":"Unsynchronized Background Thread Mutation and Cross-Thread JSI Object Sharing","stars_count":95,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","react-native","bridgeless","jsi","hermes","memory-management","concurrency"],"exportEndpoints":{"claude":"/api/rules/react-native-bridgeless-jsi-zerocopy-memory-fence?format=claude","cursorMdc":"/api/rules/react-native-bridgeless-jsi-zerocopy-memory-fence?format=mdc","cursorrules":"/api/rules/react-native-bridgeless-jsi-zerocopy-memory-fence?format=cursor","windsurf":"/api/rules/react-native-bridgeless-jsi-zerocopy-memory-fence?format=windsurf","agents":"/api/rules/react-native-bridgeless-jsi-zerocopy-memory-fence?format=agents"}},{"id":"spiffe-spire-dynamic-workload-mtls-standard","title":"SPIFFE/SPIRE Dynamic mTLS Workload Attestation and Hot-Reload Invariant","category":"security","severity":"critical","description":"Enforces cryptographically verifiable, ephemeral microservice identity via the SPIRE Workload API Unix Domain Socket, eradicating all static API tokens and long-lived X.509 certificates. Mandates continuous streaming subscription to X.509 SVID rotations and in-memory dynamic TLS context reloading without process restarts or connection disruption.","antiPatternHeadline":"Baking static credentials or caching static X.509 SVID certificates indefinitely without dynamic SPIRE socket reload","stars_count":78,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","spiffe","spire","mtls","zero-trust","identity"],"exportEndpoints":{"claude":"/api/rules/spiffe-spire-dynamic-workload-mtls-standard?format=claude","cursorMdc":"/api/rules/spiffe-spire-dynamic-workload-mtls-standard?format=mdc","cursorrules":"/api/rules/spiffe-spire-dynamic-workload-mtls-standard?format=cursor","windsurf":"/api/rules/spiffe-spire-dynamic-workload-mtls-standard?format=windsurf","agents":"/api/rules/spiffe-spire-dynamic-workload-mtls-standard?format=agents"}},{"id":"ml-kem-fips203-hybrid-pq-ingress-standard","title":"Mandatory ML-KEM-768 Hybrid Key Exchange on Edge TLS 1.3 Ingress","category":"security","severity":"critical","description":"Enforces quantum-resistant hybrid X25519MLKEM768 (FIPS 203) key encapsulation on all external edge ingress and reverse proxy TLS 1.3 terminations. Prevents Harvest-Now-Decrypt-Later (HNDL) attacks by state adversaries seeking to record and retrospectively decipher encrypted enterprise communication using Cryptanalytically Relevant Quantum Computers (CRQCs).","antiPatternHeadline":"Terminating Edge TLS with Classical-Only Elliptic Curves (X25519/P-256) Without Quantum-Resistant ML-KEM KEM Hybrids","stars_count":43,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","post-quantum","fips-203","ml-kem","tls-1.3","cryptography","zero-trust"],"exportEndpoints":{"claude":"/api/rules/ml-kem-fips203-hybrid-pq-ingress-standard?format=claude","cursorMdc":"/api/rules/ml-kem-fips203-hybrid-pq-ingress-standard?format=mdc","cursorrules":"/api/rules/ml-kem-fips203-hybrid-pq-ingress-standard?format=cursor","windsurf":"/api/rules/ml-kem-fips203-hybrid-pq-ingress-standard?format=windsurf","agents":"/api/rules/ml-kem-fips203-hybrid-pq-ingress-standard?format=agents"}},{"id":"cilium-ebpf-host-routing-wireguard-standard","title":"Cilium eBPF Host-Routing Node-to-Node WireGuard Encryption Standard","category":"devops","severity":"critical","description":"Enforces transparent, kernel-level node-to-node WireGuard encryption paired with Cilium eBPF host-routing across Kubernetes clusters. Eliminates userspace context switching and MTU misconfiguration while maintaining full L7 visibility and zero-overhead packet encapsulation.","antiPatternHeadline":"Deploying unencrypted pod networking or userspace mTLS sidecars alongside conflicting MTU and IPsec/WireGuard overlay settings","stars_count":65,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","cilium","ebpf","wireguard","kubernetes","networking","security"],"exportEndpoints":{"claude":"/api/rules/cilium-ebpf-host-routing-wireguard-standard?format=claude","cursorMdc":"/api/rules/cilium-ebpf-host-routing-wireguard-standard?format=mdc","cursorrules":"/api/rules/cilium-ebpf-host-routing-wireguard-standard?format=cursor","windsurf":"/api/rules/cilium-ebpf-host-routing-wireguard-standard?format=windsurf","agents":"/api/rules/cilium-ebpf-host-routing-wireguard-standard?format=agents"}},{"id":"otel-ebpf-continuous-profiling-standard","title":"OpenTelemetry eBPF Continuous Profiling & Trace Context Correlation","category":"devops","severity":"critical","description":"Enforces deterministic linkage between OpenTelemetry distributed trace contexts and continuous eBPF CPU/memory profiling agents (such as OTel Profiling Agent / Beyla). Prevents blind spots in production microbenchmarks by ensuring compiled native runtimes preserve frame pointers, avoid stripped symbol tables, and inject W3C trace context into thread/task-local storage accessible by eBPF ring buffers without incurring sampling overhead.","antiPatternHeadline":"Uncorrelated Profiling Samples and Stripped Native Binaries Blocking eBPF Stack Unwinding","stars_count":65,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","ebpf","continuous-profiling","linux-kernel","observability"],"exportEndpoints":{"claude":"/api/rules/otel-ebpf-continuous-profiling-standard?format=claude","cursorMdc":"/api/rules/otel-ebpf-continuous-profiling-standard?format=mdc","cursorrules":"/api/rules/otel-ebpf-continuous-profiling-standard?format=cursor","windsurf":"/api/rules/otel-ebpf-continuous-profiling-standard?format=windsurf","agents":"/api/rules/otel-ebpf-continuous-profiling-standard?format=agents"}},{"id":"react-19-ppr-dynamic-hole-boundary-standard","title":"React 19 PPR Deterministic Dynamic Hole Boundary Standard","category":"frontend","severity":"critical","description":"Enforces strict physical boundaries between static build-time shells and deferred dynamic execution contexts under React 19 Partial Prerendering (PPR). Prevents dynamic I/O leakage into static prerender passes, eliminates client-side Cumulative Layout Shift (CLS) via mandatory skeleton geometry preservation, and prohibits nested streaming waterfalls.","antiPatternHeadline":"Dynamic I/O Pollution of Static Prerender Shells Causing Build De-optimization and Cascade Waterfalls","stars_count":86,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","nextjs","ppr","suspense","performance"],"exportEndpoints":{"claude":"/api/rules/react-19-ppr-dynamic-hole-boundary-standard?format=claude","cursorMdc":"/api/rules/react-19-ppr-dynamic-hole-boundary-standard?format=mdc","cursorrules":"/api/rules/react-19-ppr-dynamic-hole-boundary-standard?format=cursor","windsurf":"/api/rules/react-19-ppr-dynamic-hole-boundary-standard?format=windsurf","agents":"/api/rules/react-19-ppr-dynamic-hole-boundary-standard?format=agents"}},{"id":"postgres-17-failover-logical-slot-sync","title":"PostgreSQL 17 Failover-Safe Logical Replication Slot Synchronization","category":"backend","severity":"critical","description":"PostgreSQL 17 introduces synchronized logical replication slots across physical standby failovers. Infrastructure and migration automation must mandate failover-enabled logical slots, primary-side standby coordination, and multi-host client failover strings to prevent data duplication, missing WAL segments, and cluster desynchronization after primary failover.","antiPatternHeadline":"Creating Logical Slots Without Failover Support and Standby Slot Coordination","stars_count":69,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql-17","logical-replication","high-availability","infrastructure"],"exportEndpoints":{"claude":"/api/rules/postgres-17-failover-logical-slot-sync?format=claude","cursorMdc":"/api/rules/postgres-17-failover-logical-slot-sync?format=mdc","cursorrules":"/api/rules/postgres-17-failover-logical-slot-sync?format=cursor","windsurf":"/api/rules/postgres-17-failover-logical-slot-sync?format=windsurf","agents":"/api/rules/postgres-17-failover-logical-slot-sync?format=agents"}},{"id":"axum-0-8-backpressure-bounded-zero-copy-stream-pipeline","title":"Axum 0.8 Backpressure-Bounded Zero-Copy Stream Body Pipeline","category":"backend","severity":"critical","description":"Mandates that incoming and outgoing payloads in Axum 0.8 services are processed using bounded, zero-copy byte streams that propagate flow control end-to-end. Forbids in-memory aggregation via `to_bytes` and unbounded intermediate buffers to ensure strict O(1) heap residency during arbitrary payload transfers.","antiPatternHeadline":"Unbounded In-Memory Payload Buffering and Decoupled Channel Flooding in Stream Handlers","stars_count":41,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tokio","backpressure","zero-copy","streaming"],"exportEndpoints":{"claude":"/api/rules/axum-0-8-backpressure-bounded-zero-copy-stream-pipeline?format=claude","cursorMdc":"/api/rules/axum-0-8-backpressure-bounded-zero-copy-stream-pipeline?format=mdc","cursorrules":"/api/rules/axum-0-8-backpressure-bounded-zero-copy-stream-pipeline?format=cursor","windsurf":"/api/rules/axum-0-8-backpressure-bounded-zero-copy-stream-pipeline?format=windsurf","agents":"/api/rules/axum-0-8-backpressure-bounded-zero-copy-stream-pipeline?format=agents"}},{"id":"fastapi-anyio-structured-concurrency-taskgroup","title":"FastAPI AnyIO Structured Concurrency and TaskGroup Exception Aggregation Standard","category":"backend","severity":"critical","description":"Enforces deterministic structured concurrency in FastAPI request lifecycles using AnyIO TaskGroups instead of unbounded fire-and-forget tasks or loose coroutine aggregation. Guarantees clean cancellation propagation to all child tasks upon client disconnect or downstream failure, preventing orphan background execution and resource leaks through unified ExceptionGroup handling.","antiPatternHeadline":"Spawning Unbounded Fire-and-Forget Coroutines and Swallowing Child Exceptions in FastAPI Request Cycles","stars_count":86,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","anyio","asyncio","structured-concurrency","python"],"exportEndpoints":{"claude":"/api/rules/fastapi-anyio-structured-concurrency-taskgroup?format=claude","cursorMdc":"/api/rules/fastapi-anyio-structured-concurrency-taskgroup?format=mdc","cursorrules":"/api/rules/fastapi-anyio-structured-concurrency-taskgroup?format=cursor","windsurf":"/api/rules/fastapi-anyio-structured-concurrency-taskgroup?format=windsurf","agents":"/api/rules/fastapi-anyio-structured-concurrency-taskgroup?format=agents"}},{"id":"jetpack-compose-strong-skipping-stability-contract","title":"Jetpack Compose Strong Skipping Mode & Type Stability Contract","category":"mobile","severity":"critical","description":"Enforces strict Compose compiler stability contracts and immutable data structures under Strong Skipping Mode to prevent structural recomposition cascades in high-framerate screens. Mandates explicit stability annotations for cross-module domain objects, replaces non-guaranteed standard collection interfaces with kotlinx.collections.immutable types, and prevents unstable lambda capture scopes.","antiPatternHeadline":"Exposing Raw Collection Interfaces and Unannotated Cross-Module Domain Types to Lazy Item Composables","stars_count":44,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","android","jetpack-compose","kotlin","performance","strong-skipping"],"exportEndpoints":{"claude":"/api/rules/jetpack-compose-strong-skipping-stability-contract?format=claude","cursorMdc":"/api/rules/jetpack-compose-strong-skipping-stability-contract?format=mdc","cursorrules":"/api/rules/jetpack-compose-strong-skipping-stability-contract?format=cursor","windsurf":"/api/rules/jetpack-compose-strong-skipping-stability-contract?format=windsurf","agents":"/api/rules/jetpack-compose-strong-skipping-stability-contract?format=agents"}},{"id":"tauri-v2-mobile-ipc-granular-capability-scoping","title":"Tauri 2.0 Mobile IPC Granular Capability Scoping & Origin Enforcement","category":"mobile","severity":"critical","description":"Enforces strict principle-of-least-privilege capability manifests and cryptographically isolated IPC permissions for Tauri 2.0 on iOS and Android. Disallows default wildcard plugin bindings and unauthenticated webview context invocations to eliminate arbitrary native mobile bridge execution and privilege escalation vectors.","antiPatternHeadline":"Wildcard Plugin Capabilities and Unvalidated IPC Bridges in Embedded Web Contexts","stars_count":65,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri-v2","ipc-security","rust","android","ios","capabilities"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-mobile-ipc-granular-capability-scoping?format=claude","cursorMdc":"/api/rules/tauri-v2-mobile-ipc-granular-capability-scoping?format=mdc","cursorrules":"/api/rules/tauri-v2-mobile-ipc-granular-capability-scoping?format=cursor","windsurf":"/api/rules/tauri-v2-mobile-ipc-granular-capability-scoping?format=windsurf","agents":"/api/rules/tauri-v2-mobile-ipc-granular-capability-scoping?format=agents"}},{"id":"wasi-02-component-capability-sandboxing-standard","title":"WASI 0.2 Component Model Capability Sandboxing Standard","category":"security","severity":"critical","description":"Enforces strict capability-based security and zero ambient authority for third-party WebAssembly components executed under WASI 0.2 runtimes. Host linkers and WIT definitions must explicitly withhold POSIX primitives (filesystem, raw sockets, environment variables, clocks) by default, requiring fine-grained, tenant-isolated capabilities to be injected selectively.","antiPatternHeadline":"Ambient Authority Leakage via Unchecked Host WASI Inheritance and Permissive WIT Linker Bindings","stars_count":115,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","wasm","wasi-02","component-model","sandboxing","rust","wasmtime"],"exportEndpoints":{"claude":"/api/rules/wasi-02-component-capability-sandboxing-standard?format=claude","cursorMdc":"/api/rules/wasi-02-component-capability-sandboxing-standard?format=mdc","cursorrules":"/api/rules/wasi-02-component-capability-sandboxing-standard?format=cursor","windsurf":"/api/rules/wasi-02-component-capability-sandboxing-standard?format=windsurf","agents":"/api/rules/wasi-02-component-capability-sandboxing-standard?format=agents"}},{"id":"oidc-caep-real-time-revocation-standard","title":"Continuous Access Evaluation Profile (CAEP) Real-Time Revocation Invariant","category":"security","severity":"critical","description":"Enforces asynchronous Security Event Token (SET) processing (RFC 8935/8936) across distributed microservices to instantaneously invalidate sessions and security principals upon credential revocation or risk change. Eliminates window-of-vulnerability states caused by purely reliant, stateless JWT expiration timeouts. Guarantees idempotency, replay protection, and distributed revocation propagation across cache and active session tiers.","antiPatternHeadline":"Relying on Passive JWT Expiration and In-Memory Local Session Checks During Credential Compromise","stars_count":43,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","caep","sse","oidc","jwt","zero-trust","session-revocation"],"exportEndpoints":{"claude":"/api/rules/oidc-caep-real-time-revocation-standard?format=claude","cursorMdc":"/api/rules/oidc-caep-real-time-revocation-standard?format=mdc","cursorrules":"/api/rules/oidc-caep-real-time-revocation-standard?format=cursor","windsurf":"/api/rules/oidc-caep-real-time-revocation-standard?format=windsurf","agents":"/api/rules/oidc-caep-real-time-revocation-standard?format=agents"}},{"id":"opentelemetry-tail-sampling-adaptive-buffer-standard","title":"OpenTelemetry Two-Tier Tail-Based Sampling and Memory Limiter Guardrail","category":"devops","severity":"critical","description":"Enforces a two-tier OpenTelemetry Collector architecture utilizing trace-ID load balancing and tail-based sampling with memory limiter processors. Guarantees 100% capture of distributed traces exhibiting errors or latency anomalies while adaptively shedding nominal traffic and preventing out-of-memory crashes.","antiPatternHeadline":"Blind Head-Based Sampling and Unbounded Collector In-Memory Buffers","stars_count":115,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","tracing","tail-sampling","observability","performance"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-tail-sampling-adaptive-buffer-standard?format=claude","cursorMdc":"/api/rules/opentelemetry-tail-sampling-adaptive-buffer-standard?format=mdc","cursorrules":"/api/rules/opentelemetry-tail-sampling-adaptive-buffer-standard?format=cursor","windsurf":"/api/rules/opentelemetry-tail-sampling-adaptive-buffer-standard?format=windsurf","agents":"/api/rules/opentelemetry-tail-sampling-adaptive-buffer-standard?format=agents"}},{"id":"react-19-server-actions-idempotency-rollback","title":"React 19 Server Actions Idempotency and Optimistic Rollback Standard","category":"frontend","severity":"critical","description":"Requires all mutating React 19 Server Actions to bind a client-generated cryptographic idempotency key validated against an atomic distributed lock before executing side-effects. Mandates pairing useOptimistic with useActionState to guarantee deterministic UI rollback without phantom client persistence when network partitions or server exceptions occur.","antiPatternHeadline":"Unkeyed Server Actions with Naked useState Optimism Causing Double-Writes and Phantom UI States","stars_count":117,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","server-actions","use-optimistic","use-action-state","idempotency"],"exportEndpoints":{"claude":"/api/rules/react-19-server-actions-idempotency-rollback?format=claude","cursorMdc":"/api/rules/react-19-server-actions-idempotency-rollback?format=mdc","cursorrules":"/api/rules/react-19-server-actions-idempotency-rollback?format=cursor","windsurf":"/api/rules/react-19-server-actions-idempotency-rollback?format=windsurf","agents":"/api/rules/react-19-server-actions-idempotency-rollback?format=agents"}},{"id":"tanstack-router-ssr-streaming-boundary-isolation","title":"TanStack Router SSR Dehydration & Streaming Boundary Isolation","category":"frontend","severity":"critical","description":"Enforces strict decoupling of critical SSR route loaders from slow secondary microservices and third-party integrations using TanStack Router's deferred streaming boundaries. Prevents non-essential promises from stalling HTTP response headers and First Contentful Paint (FCP) by mandating explicit defer() wrapping paired with React Suspense and Await boundaries.","antiPatternHeadline":"Monolithic Loader Await Pattern Blocking SSR Shell and TTFB","stars_count":111,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","tanstack-router","ssr","streaming","react-suspense","performance"],"exportEndpoints":{"claude":"/api/rules/tanstack-router-ssr-streaming-boundary-isolation?format=claude","cursorMdc":"/api/rules/tanstack-router-ssr-streaming-boundary-isolation?format=mdc","cursorrules":"/api/rules/tanstack-router-ssr-streaming-boundary-isolation?format=cursor","windsurf":"/api/rules/tanstack-router-ssr-streaming-boundary-isolation?format=windsurf","agents":"/api/rules/tanstack-router-ssr-streaming-boundary-isolation?format=agents"}},{"id":"temporal-workflow-determinism-replay-invariants-temporal-sdk-det-180","title":"Temporal SDK Deterministic Workflow Sandboxing & State Replay Invariants","category":"backend","severity":"critical","description":"Temporal workflows compute state through deterministic event-sourcing replay; any deviation between execution passes results in a catastrophic NonDeterministicWorkflowError. This standard enforces strict isolation against ambient system clocks, unsandboxed asynchronous timers, random number generation, and external I/O operations inside workflow logic.","antiPatternHeadline":"Executing Ambient Node.js/V8 Non-Deterministic APIs and External Side Effects Inside Workflow Code","stars_count":41,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","temporal","event-sourcing","distributed-systems","determinism","typescript"],"exportEndpoints":{"claude":"/api/rules/temporal-workflow-determinism-replay-invariants-temporal-sdk-det-180?format=claude","cursorMdc":"/api/rules/temporal-workflow-determinism-replay-invariants-temporal-sdk-det-180?format=mdc","cursorrules":"/api/rules/temporal-workflow-determinism-replay-invariants-temporal-sdk-det-180?format=cursor","windsurf":"/api/rules/temporal-workflow-determinism-replay-invariants-temporal-sdk-det-180?format=windsurf","agents":"/api/rules/temporal-workflow-determinism-replay-invariants-temporal-sdk-det-180?format=agents"}},{"id":"go-weak-pointer-concurrent-cache-eviction","title":"Go 1.24 Weak Pointer Concurrent Cache Eviction and Memory Reclamation","category":"backend","severity":"critical","description":"Enforces Go 1.24 `weak.Pointer` semantics combined with `runtime.AddCleanup` for high-throughput in-memory routing tables, session registries, and object caches. Prevents unbounded heap growth and GC retention cycles by ensuring long-lived cache maps do not anchor active objects past their operational lifecycle.","antiPatternHeadline":"Anchoring Strong References in Concurrent Maps Causing Heap Retention Cycles and OOM","stars_count":56,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["go","golang-1.24","weak-pointers","concurrency","memory-management","gc-optimization","cache"],"exportEndpoints":{"claude":"/api/rules/go-weak-pointer-concurrent-cache-eviction?format=claude","cursorMdc":"/api/rules/go-weak-pointer-concurrent-cache-eviction?format=mdc","cursorrules":"/api/rules/go-weak-pointer-concurrent-cache-eviction?format=cursor","windsurf":"/api/rules/go-weak-pointer-concurrent-cache-eviction?format=windsurf","agents":"/api/rules/go-weak-pointer-concurrent-cache-eviction?format=agents"}},{"id":"tokio-cooperative-budget-yielding-axum","title":"Tokio 1.40 Cooperative Task Yielding & Budget Allocation in Axum","category":"backend","severity":"critical","description":"Enforces deterministic cooperative task yielding and CPU budget management within Axum request pipelines and Tokio async contexts. CPU-intensive operations such as large payload deserialization, cryptographic verification, or iteration over unbounded datasets must yield execution via `tokio::task::yield_now()` or be offloaded via `tokio::task::spawn_blocking` to prevent worker thread starvation and tail latency amplification.","antiPatternHeadline":"Running Unbudgeted Synchronous CPU Loops Inside Tokio Worker Threads Without Explicit Cooperative Yielding","stars_count":52,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","tokio","axum","concurrency","performance"],"exportEndpoints":{"claude":"/api/rules/tokio-cooperative-budget-yielding-axum?format=claude","cursorMdc":"/api/rules/tokio-cooperative-budget-yielding-axum?format=mdc","cursorrules":"/api/rules/tokio-cooperative-budget-yielding-axum?format=cursor","windsurf":"/api/rules/tokio-cooperative-budget-yielding-axum?format=windsurf","agents":"/api/rules/tokio-cooperative-budget-yielding-axum?format=agents"}},{"id":"capacitor-7-background-worker-sqlite-concurrency-invariant","title":"Capacitor 7 Background Worker SQLite Concurrency & WAL Isolation Invariant","category":"mobile","severity":"critical","description":"Enforces architectural separation of SQLite connections between Capacitor 7 UI WebViews and native background workers. Mandates Write-Ahead Logging (WAL) mode, calibrated busy timeouts, and serialized background write queues to eliminate SQLITE_BUSY deadlocks and UI thread starvation.","antiPatternHeadline":"Sharing Unbuffered Single-Connection SQLite Handles Across UI WebViews and Headless Background Workers in Default Rollback Journal Mode","stars_count":77,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","sqlite","concurrency","wal-mode","background-worker","ios","android"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-background-worker-sqlite-concurrency-invariant?format=claude","cursorMdc":"/api/rules/capacitor-7-background-worker-sqlite-concurrency-invariant?format=mdc","cursorrules":"/api/rules/capacitor-7-background-worker-sqlite-concurrency-invariant?format=cursor","windsurf":"/api/rules/capacitor-7-background-worker-sqlite-concurrency-invariant?format=windsurf","agents":"/api/rules/capacitor-7-background-worker-sqlite-concurrency-invariant?format=agents"}},{"id":"ml-kem-hybrid-pqc-tls-enforcement","title":"ML-KEM (FIPS 203) Hybrid Post-Quantum TLS 1.3 Key Exchange Enforcement","category":"security","severity":"critical","description":"Enforces post-quantum hybrid key encapsulation (ML-KEM-768 combined with classical X25519) on TLS 1.3 edge ingress endpoints to eliminate store-now-decrypt-later (SNDL) threats. Edge gateways must mandate TLS 1.3 minimums, prioritize X25519MLKEM768 groups, and prohibit classical-only handshakes for clients that advertise post-quantum capabilities.","antiPatternHeadline":"Permitting Classical-Only TLS Key Exchange on Sensitive Edge Ingress Gateways","stars_count":54,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","cryptography","pqc","fips-203","ml-kem","tls-1.3","ingress"],"exportEndpoints":{"claude":"/api/rules/ml-kem-hybrid-pqc-tls-enforcement?format=claude","cursorMdc":"/api/rules/ml-kem-hybrid-pqc-tls-enforcement?format=mdc","cursorrules":"/api/rules/ml-kem-hybrid-pqc-tls-enforcement?format=cursor","windsurf":"/api/rules/ml-kem-hybrid-pqc-tls-enforcement?format=windsurf","agents":"/api/rules/ml-kem-hybrid-pqc-tls-enforcement?format=agents"}},{"id":"spiffe-spire-ephemeral-x509-svid-attestation","title":"SPIFFE/SPIRE Ephemeral X.509 SVID Continuous Attestation and Rotation Standard","category":"security","severity":"critical","description":"Enforces zero-trust workload authentication using SPIFFE/SPIRE Unix Domain Socket (UDS) kernel attestation without static secrets. Mandates in-memory dynamic SVID rotation watchers and explicit peer SPIFFE ID validation, prohibiting disk persistence and static secret fallbacks.","antiPatternHeadline":"Static Secret Fallbacks and Disk-Persisted X.509 SVIDs Without Dynamic Rotation Watchers","stars_count":50,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","spiffe","spire","zero-trust","mtls","x509-svid","identity"],"exportEndpoints":{"claude":"/api/rules/spiffe-spire-ephemeral-x509-svid-attestation?format=claude","cursorMdc":"/api/rules/spiffe-spire-ephemeral-x509-svid-attestation?format=mdc","cursorrules":"/api/rules/spiffe-spire-ephemeral-x509-svid-attestation?format=cursor","windsurf":"/api/rules/spiffe-spire-ephemeral-x509-svid-attestation?format=windsurf","agents":"/api/rules/spiffe-spire-ephemeral-x509-svid-attestation?format=agents"}},{"id":"k8s-dra-cdi-gpu-slice-isolation-standard","title":"Kubernetes Dynamic Resource Allocation (DRA) CDI GPU Slice Isolation Standard","category":"devops","severity":"critical","description":"Enforces strict hardware-level noisy-neighbor isolation for multi-tenant inference workloads by migrating from legacy Kubernetes device plugins to Dynamic Resource Allocation (DRA) using Container Device Interface (CDI) resource claims. Mandates explicit slice partitioning (such as NVIDIA MIG profiles), device-level resource claim templates, and isolated CDI container specs to eliminate spatial and temporal contention across co-located tenants.","antiPatternHeadline":"Deploying Multi-Tenant GPU Workloads via Legacy Device Plugins and Host-Shared Device Nodes","stars_count":62,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["kubernetes","dra","cdi","gpu","nvidia-mig","multi-tenancy","inference"],"exportEndpoints":{"claude":"/api/rules/k8s-dra-cdi-gpu-slice-isolation-standard?format=claude","cursorMdc":"/api/rules/k8s-dra-cdi-gpu-slice-isolation-standard?format=mdc","cursorrules":"/api/rules/k8s-dra-cdi-gpu-slice-isolation-standard?format=cursor","windsurf":"/api/rules/k8s-dra-cdi-gpu-slice-isolation-standard?format=windsurf","agents":"/api/rules/k8s-dra-cdi-gpu-slice-isolation-standard?format=agents"}},{"id":"react-19-server-action-optimistic-idempotency-boundary","title":"React 19 Optimistic Transition Idempotency Boundary & Cryptographic Action Deduplication","category":"frontend","severity":"critical","description":"Mandates client-side generation and propagation of cryptographic idempotency tokens bound to React 19 useOptimistic and useActionState transitions. Prevents duplicate execution of non-idempotent Server Actions during network degradation, concurrent dispatches, and automatic transition revalidations while guaranteeing deterministic rollback safety.","antiPatternHeadline":"Unbounded Server Action Dispatch Within Optimistic Transitions Causing Duplicate Invocations and Ghost State Desynchronization","stars_count":94,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","server-actions","use-optimistic","use-action-state","idempotency","resilience"],"exportEndpoints":{"claude":"/api/rules/react-19-server-action-optimistic-idempotency-boundary?format=claude","cursorMdc":"/api/rules/react-19-server-action-optimistic-idempotency-boundary?format=mdc","cursorrules":"/api/rules/react-19-server-action-optimistic-idempotency-boundary?format=cursor","windsurf":"/api/rules/react-19-server-action-optimistic-idempotency-boundary?format=windsurf","agents":"/api/rules/react-19-server-action-optimistic-idempotency-boundary?format=agents"}},{"id":"svelte-5-runes-signal-graph-cycle-guardrail","title":"Svelte 5 Runes Fine-Grained Reactive Signal Graph Cycle Guardrail","category":"frontend","severity":"critical","description":"Enforces strict Directed Acyclic Graph (DAG) topology across Svelte 5 rune dependencies ($state, $derived, $effect) to prevent microtask thrashing and infinite update cascades. Mandates explicit dependency truncation via untrack() and prohibits cyclic feedback loops induced by mutating state within reactive tracking contexts.","antiPatternHeadline":"Cyclic Microtask Exhaustion via Unbounded $effect State Mutations and Bidirectional Prop Cascades","stars_count":57,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","reactivity","signals","performance"],"exportEndpoints":{"claude":"/api/rules/svelte-5-runes-signal-graph-cycle-guardrail?format=claude","cursorMdc":"/api/rules/svelte-5-runes-signal-graph-cycle-guardrail?format=mdc","cursorrules":"/api/rules/svelte-5-runes-signal-graph-cycle-guardrail?format=cursor","windsurf":"/api/rules/svelte-5-runes-signal-graph-cycle-guardrail?format=windsurf","agents":"/api/rules/svelte-5-runes-signal-graph-cycle-guardrail?format=agents"}},{"id":"axum-0-8-tokio-task-budgeting-cancellation-guardrail","title":"Axum 0.8 Tokio Cooperative Task Budgeting & Cancellation Guardrail","category":"backend","severity":"critical","description":"Prevents async runtime worker thread starvation and connection leakages under hyper-concurrent streaming workloads (including HTTP/3) in Axum 0.8 and Tokio. Mandates bounded cooperative yielding intervals in CPU-intensive or iterative async pipelines using tokio::task::consume_budget or tokio::task::yield_now. Enforces deterministic cancellation handling via tokio_util::sync::CancellationToken and Drop-safe async primitives across long-lived connection lifetimes.","antiPatternHeadline":"Unbounded Tight Loops in Async Handlers Causing Worker Thread Starvation and Abandoned Zombie Stream Processing on Client Disconnect","stars_count":116,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tokio","concurrency","cancellation","http3"],"exportEndpoints":{"claude":"/api/rules/axum-0-8-tokio-task-budgeting-cancellation-guardrail?format=claude","cursorMdc":"/api/rules/axum-0-8-tokio-task-budgeting-cancellation-guardrail?format=mdc","cursorrules":"/api/rules/axum-0-8-tokio-task-budgeting-cancellation-guardrail?format=cursor","windsurf":"/api/rules/axum-0-8-tokio-task-budgeting-cancellation-guardrail?format=windsurf","agents":"/api/rules/axum-0-8-tokio-task-budgeting-cancellation-guardrail?format=agents"}},{"id":"openfga-rebac-traversal-depth-cycle-guardrail","title":"OpenFGA ReBAC Sub-Graph Traversal Depth and Cycle Invariant Enforcement","category":"backend","severity":"critical","description":"Dynamic relationship-based access control (ReBAC) graphs risk recursive stack exhaustion and algorithmic denial-of-service (DoS) during resolution of cyclic or deeply nested transitive relations. This guardrail mandates bounded recursion depth thresholds, visited-node cycle detection via memoized resolution paths, and deterministic execution deadlines across all custom OpenFGA query orchestrators.","antiPatternHeadline":"Unbounded Recursive Sub-Graph Traversal and Missing Graph Cycle Detection in Custom ReBAC Clients","stars_count":50,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","openfga","rebac","authorization","security","graph-traversal","dos-mitigation"],"exportEndpoints":{"claude":"/api/rules/openfga-rebac-traversal-depth-cycle-guardrail?format=claude","cursorMdc":"/api/rules/openfga-rebac-traversal-depth-cycle-guardrail?format=mdc","cursorrules":"/api/rules/openfga-rebac-traversal-depth-cycle-guardrail?format=cursor","windsurf":"/api/rules/openfga-rebac-traversal-depth-cycle-guardrail?format=windsurf","agents":"/api/rules/openfga-rebac-traversal-depth-cycle-guardrail?format=agents"}},{"id":"bun-direct-fs-zero-copy-async-streaming","title":"Bun 1.2 Direct FileSystem Zero-Copy Async Streaming Guardrail","category":"backend","severity":"critical","description":"Enforces kernel-level zero-copy payload routing in Bun 1.2 runtime by passing native BunFile handles directly to HTTP responses. Bypasses intermediate JavaScriptCore (JSC) heap buffer allocations and leverages native sendfile/copy_file_range syscalls for ultra-high-throughput file serving. Prohibits reading binary files into user-space JavaScript memory buffers or manual stream chunk piping.","antiPatternHeadline":"Buffering Disk Files into JSC Memory Heap via ArrayBuffer, Buffer.from, or Manual Stream Loops","stars_count":62,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","zero-copy","streaming","performance","io"],"exportEndpoints":{"claude":"/api/rules/bun-direct-fs-zero-copy-async-streaming?format=claude","cursorMdc":"/api/rules/bun-direct-fs-zero-copy-async-streaming?format=mdc","cursorrules":"/api/rules/bun-direct-fs-zero-copy-async-streaming?format=cursor","windsurf":"/api/rules/bun-direct-fs-zero-copy-async-streaming?format=windsurf","agents":"/api/rules/bun-direct-fs-zero-copy-async-streaming?format=agents"}},{"id":"kmp-stateflow-swift-actor-bridge-guardrail","title":"KMP StateFlow to Swift 6 Actor Bridge Thread-Safety Invariant","category":"mobile","severity":"critical","description":"Enforces strict concurrency isolation and explicit cancellation semantics when consuming Kotlin Multiplatform (KMP) StateFlow streams within Swift 6 Actor environments. Prevents data-race thread hops, silent cancellation leakage, and Swift runtime assertion crashes caused by unshielded non-Sendable Kotlin coroutine job handles passing through isolated boundaries.","antiPatternHeadline":"Directly Collecting KMP StateFlow within Swift 6 Actors Without Sendable Wrappers or Explicit Task Lifecycle Binding","stars_count":74,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kmp","kotlin-multiplatform","swift6","concurrency","stateflow","actors"],"exportEndpoints":{"claude":"/api/rules/kmp-stateflow-swift-actor-bridge-guardrail?format=claude","cursorMdc":"/api/rules/kmp-stateflow-swift-actor-bridge-guardrail?format=mdc","cursorrules":"/api/rules/kmp-stateflow-swift-actor-bridge-guardrail?format=cursor","windsurf":"/api/rules/kmp-stateflow-swift-actor-bridge-guardrail?format=windsurf","agents":"/api/rules/kmp-stateflow-swift-actor-bridge-guardrail?format=agents"}},{"id":"wasi-02-capability-attenuated-sandbox-standard","title":"WASI 0.2 Capability Attenuation and Guest Memory Sandboxing Standard","category":"security","severity":"critical","description":"Enforces strict capability-based access control and memory isolation for multi-tenant dynamic guest plugins executed via WASI 0.2 and the WebAssembly Component Model. Mandates explicit attenuation of ambient system resources (filesystem, sockets, clocks, random, environment variables) through deterministic host contexts and denies direct pointer leaks across the canonical ABI boundary. Guarantees linear memory encapsulation, deterministic resource budgeting, and prevention of multi-tenant cross-contamination.","antiPatternHeadline":"Ambient Host Inheritance and Unbudgeted Resource Linking in Multi-Tenant Guest Runtimes","stars_count":93,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","wasm","wasi-0-2","component-model","wasmtime","sandboxing","multi-tenancy"],"exportEndpoints":{"claude":"/api/rules/wasi-02-capability-attenuated-sandbox-standard?format=claude","cursorMdc":"/api/rules/wasi-02-capability-attenuated-sandbox-standard?format=mdc","cursorrules":"/api/rules/wasi-02-capability-attenuated-sandbox-standard?format=cursor","windsurf":"/api/rules/wasi-02-capability-attenuated-sandbox-standard?format=windsurf","agents":"/api/rules/wasi-02-capability-attenuated-sandbox-standard?format=agents"}},{"id":"spire-dynamic-attestation-subhour-rotation-boundary","title":"SPIRE Dynamic Attestation Sub-Hour X.509 Ephemeral Rotation Boundary","category":"security","severity":"critical","description":"Enforces sub-hour lifetime boundaries for SPIRE/SPIFFE X.509-SVIDs through dynamic kernel-level workload attestation. Workloads must consume ephemeral certificates via active SPIFFE Workload API streams or dynamic memory reloaders, strictly prohibiting static disk credentials, long-lived cert caching, or process restarts during leaf rotation.","antiPatternHeadline":"Persisting Static Certificates or Caching X.509-SVIDs Beyond Rotation Thresholds Without Dynamic In-Memory Stream Listeners","stars_count":86,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","spiffe","spire","zero-trust","mtls","x509","cryptography"],"exportEndpoints":{"claude":"/api/rules/spire-dynamic-attestation-subhour-rotation-boundary?format=claude","cursorMdc":"/api/rules/spire-dynamic-attestation-subhour-rotation-boundary?format=mdc","cursorrules":"/api/rules/spire-dynamic-attestation-subhour-rotation-boundary?format=cursor","windsurf":"/api/rules/spire-dynamic-attestation-subhour-rotation-boundary?format=windsurf","agents":"/api/rules/spire-dynamic-attestation-subhour-rotation-boundary?format=agents"}},{"id":"envoy-gateway-dynamic-outlier-detection-circuit-breaking","title":"Envoy Gateway 1.2+ Dynamic Outlier Detection & Egress Circuit-Breaking Standard","category":"devops","severity":"critical","description":"Enforces deterministic outlier detection and egress circuit breaking via Envoy Gateway 1.2+ BackendTrafficPolicy CRDs across all canary and upstream service meshes. Proactively isolates failing pods and halts cascading failovers during statistical anomaly windows while preserving baseline traffic availability.","antiPatternHeadline":"Unbounded Egress Retries Without Outlier Detection Triggering Canary Collapse","stars_count":102,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","envoy-gateway","kubernetes","circuit-breaker","outlier-detection","canary","sre"],"exportEndpoints":{"claude":"/api/rules/envoy-gateway-dynamic-outlier-detection-circuit-breaking?format=claude","cursorMdc":"/api/rules/envoy-gateway-dynamic-outlier-detection-circuit-breaking?format=mdc","cursorrules":"/api/rules/envoy-gateway-dynamic-outlier-detection-circuit-breaking?format=cursor","windsurf":"/api/rules/envoy-gateway-dynamic-outlier-detection-circuit-breaking?format=windsurf","agents":"/api/rules/envoy-gateway-dynamic-outlier-detection-circuit-breaking?format=agents"}},{"id":"opentelemetry-baggage-cross-tenant-isolation-standard","title":"OpenTelemetry W3C Baggage Cross-Tenant Isolation & Ingress Sanitization Guardrail","category":"devops","severity":"critical","description":"Mandates strict allowlist filtering, cryptographic identity cross-verification, and untrusted header stripping for W3C Baggage (`baggage`) at service ingress boundaries. Prevents multi-tenant context confusion, privilege escalation, and exfiltration attacks caused by arbitrary baggage propagation across distributed trace contexts.","antiPatternHeadline":"Blind Ingress Propagation of Untrusted W3C Baggage Headers Across Multi-Tenant Boundaries","stars_count":117,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","security","multi-tenancy","tracing","distributed-systems"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-baggage-cross-tenant-isolation-standard?format=claude","cursorMdc":"/api/rules/opentelemetry-baggage-cross-tenant-isolation-standard?format=mdc","cursorrules":"/api/rules/opentelemetry-baggage-cross-tenant-isolation-standard?format=cursor","windsurf":"/api/rules/opentelemetry-baggage-cross-tenant-isolation-standard?format=windsurf","agents":"/api/rules/opentelemetry-baggage-cross-tenant-isolation-standard?format=agents"}},{"id":"react-19-server-actions-hmac-integrity-boundary","title":"React 19 Server Action Cryptographic HMAC Integrity and State Boundary Verification","category":"frontend","severity":"critical","description":"Enforces cryptographic HMAC integrity verification and replay-attack defenses for all serialized parameters and boundary state passed to React 19 Server Actions. Client-facing action endpoints generated by React Server Components (RSC) must reject any tampered payloads, stale timestamps, or forged closures across distributed server tiers.","antiPatternHeadline":"Implicit Trust in Client-Serialized Action Closures and Plaintext Hidden Form State","stars_count":90,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","server-actions","rsc","hmac","cryptography","security"],"exportEndpoints":{"claude":"/api/rules/react-19-server-actions-hmac-integrity-boundary?format=claude","cursorMdc":"/api/rules/react-19-server-actions-hmac-integrity-boundary?format=mdc","cursorrules":"/api/rules/react-19-server-actions-hmac-integrity-boundary?format=cursor","windsurf":"/api/rules/react-19-server-actions-hmac-integrity-boundary?format=windsurf","agents":"/api/rules/react-19-server-actions-hmac-integrity-boundary?format=agents"}},{"id":"cilium-ebpf-ambient-mtls-spiffe-production-standard","title":"Cilium eBPF Sidecarless Ambient mTLS with SPIFFE Identity Attestation Standard","category":"devops","severity":"critical","description":"Enforces sidecarless mutual TLS termination and continuous cryptographic identity validation directly within the Linux kernel via Cilium eBPF and SPIRE. Eliminates Envoy sidecar memory and CPU tax while preventing unauthenticated east-west workload impersonation. Mandates strict SPIFFE ID matching in CiliumNetworkPolicies to guarantee zero-trust kernel-level isolation.","antiPatternHeadline":"Injecting User-Space Envoy Sidecars and Relying on Perimeter or Pod IP-Based Authorization","stars_count":72,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","cilium","ebpf","spiffe","spire","mtls","kubernetes","zero-trust"],"exportEndpoints":{"claude":"/api/rules/cilium-ebpf-ambient-mtls-spiffe-production-standard?format=claude","cursorMdc":"/api/rules/cilium-ebpf-ambient-mtls-spiffe-production-standard?format=mdc","cursorrules":"/api/rules/cilium-ebpf-ambient-mtls-spiffe-production-standard?format=cursor","windsurf":"/api/rules/cilium-ebpf-ambient-mtls-spiffe-production-standard?format=windsurf","agents":"/api/rules/cilium-ebpf-ambient-mtls-spiffe-production-standard?format=agents"}},{"id":"capacitor-7-biometric-enclave-attestation-partitioning","title":"Capacitor 7 Hardware Enclave Attestation & Key Partitioning Invariant","category":"mobile","severity":"critical","description":"Mandates that hybrid mobile applications using Capacitor 7 isolate all biometric authorization proofs within hardware-backed security modules (Apple Secure Enclave and Android KeyStore StrongBox) via cryptographic challenge-response signing. Prohibits trusting client-side boolean biometric verification flags across the bridge, preventing OS-level runtime hook attacks (e.g., Frida, Objection).","antiPatternHeadline":"Boolean Biometric Evaluation and Unattested Software-Tier Credential Storage","stars_count":90,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","biometrics","secure-enclave","strongbox","cryptography","zero-trust"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-biometric-enclave-attestation-partitioning?format=claude","cursorMdc":"/api/rules/capacitor-7-biometric-enclave-attestation-partitioning?format=mdc","cursorrules":"/api/rules/capacitor-7-biometric-enclave-attestation-partitioning?format=cursor","windsurf":"/api/rules/capacitor-7-biometric-enclave-attestation-partitioning?format=windsurf","agents":"/api/rules/capacitor-7-biometric-enclave-attestation-partitioning?format=agents"}},{"id":"fastapi-anyio-structured-taskgroup-graceful-drain","title":"FastAPI AnyIO Structured TaskGroup Graceful Drain Invariant","category":"backend","severity":"critical","description":"Enforces strict nursery lifecycle boundaries using AnyIO TaskGroups anchored to the ASGI lifespan context to prevent asynchronous task leakage during rolling deployments. Prohibits fire-and-forget background tasks and unmanaged asyncio.create_task calls that lead to truncated database writes, broken socket states, and connection pool starvation upon SIGTERM.","antiPatternHeadline":"Spawning Unbound Fire-and-Forget Coroutines Outside ASGI Lifespan Nurseries","stars_count":95,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["fastapi","anyio","asyncio","structured-concurrency","lifespan","resilience"],"exportEndpoints":{"claude":"/api/rules/fastapi-anyio-structured-taskgroup-graceful-drain?format=claude","cursorMdc":"/api/rules/fastapi-anyio-structured-taskgroup-graceful-drain?format=mdc","cursorrules":"/api/rules/fastapi-anyio-structured-taskgroup-graceful-drain?format=cursor","windsurf":"/api/rules/fastapi-anyio-structured-taskgroup-graceful-drain?format=windsurf","agents":"/api/rules/fastapi-anyio-structured-taskgroup-graceful-drain?format=agents"}},{"id":"passkey-conditional-ui-dpop-sender-constrained-binding","title":"Mandatory DPoP Proof-Key Binding for Passkey Conditional UI Sessions","category":"security","severity":"critical","description":"Enforces strict cryptographic binding between WebAuthn Passkey Conditional UI assertions and ephemeral, non-extractable client-side DPoP (RFC 9449) key pairs. Eliminates enterprise token theft, session hijacking, and adversary-in-the-middle (AiTM) proxying by ensuring access tokens cannot be issued as bearer tokens or replayed outside the initiating browser context.","antiPatternHeadline":"Issuing Unconstrained Bearer Tokens from Unbound Passkey Conditional Autofill Assertions","stars_count":41,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","passkeys","webauthn","dpop","oauth2","zero-trust"],"exportEndpoints":{"claude":"/api/rules/passkey-conditional-ui-dpop-sender-constrained-binding?format=claude","cursorMdc":"/api/rules/passkey-conditional-ui-dpop-sender-constrained-binding?format=mdc","cursorrules":"/api/rules/passkey-conditional-ui-dpop-sender-constrained-binding?format=cursor","windsurf":"/api/rules/passkey-conditional-ui-dpop-sender-constrained-binding?format=windsurf","agents":"/api/rules/passkey-conditional-ui-dpop-sender-constrained-binding?format=agents"}},{"id":"svelte5-runes-shadow-dom-hydration-boundary-standard","title":"Svelte 5 Runes Shadow DOM Hydration and Micro-Frontend Memory Boundary","category":"frontend","severity":"critical","description":"Enforces strict lifecycle boundaries and reactive runtime isolation when mounting Svelte 5 Custom Elements within Shadow DOM boundaries. Prevents cross-micro-frontend reactive context leakage, orphaned Rune signal graph subscriptions, and dual-tree DOM reconciliation conflicts between host and guest runtimes.","antiPatternHeadline":"Leaking Svelte 5 Signal Graphs and Orphaned Effect Roots across Unmanaged Custom Element Shadow Roots","stars_count":105,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["svelte5","runes","shadow-dom","web-components","micro-frontends","memory-leaks"],"exportEndpoints":{"claude":"/api/rules/svelte5-runes-shadow-dom-hydration-boundary-standard?format=claude","cursorMdc":"/api/rules/svelte5-runes-shadow-dom-hydration-boundary-standard?format=mdc","cursorrules":"/api/rules/svelte5-runes-shadow-dom-hydration-boundary-standard?format=cursor","windsurf":"/api/rules/svelte5-runes-shadow-dom-hydration-boundary-standard?format=windsurf","agents":"/api/rules/svelte5-runes-shadow-dom-hydration-boundary-standard?format=agents"}},{"id":"go-chi-http3-early-data-anti-replay","title":"Go Chi HTTP/3 0-RTT Anti-Replay Idempotency Boundary Standard","category":"backend","severity":"critical","description":"Enforces strict RFC 8470 and RFC 9114 replay mitigation for HTTP/3 and QUIC 0-RTT early data connections in Go Chi services. Guarantees that mutating endpoints reject unsafe early data with HTTP 425 Too Early or require cryptographically signed, temporally bounded idempotency tokens validated atomically via distributed key stores.","antiPatternHeadline":"Mutating State from Unvalidated 0-RTT Early Data Allowing Replay-Driven Financial or State Duplication","stars_count":89,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","chi","http3","quic","tls13","idempotency","security"],"exportEndpoints":{"claude":"/api/rules/go-chi-http3-early-data-anti-replay?format=claude","cursorMdc":"/api/rules/go-chi-http3-early-data-anti-replay?format=mdc","cursorrules":"/api/rules/go-chi-http3-early-data-anti-replay?format=cursor","windsurf":"/api/rules/go-chi-http3-early-data-anti-replay?format=windsurf","agents":"/api/rules/go-chi-http3-early-data-anti-replay?format=agents"}},{"id":"otel-ebpf-profiling-exemplar-correlation-standard","title":"OpenTelemetry Continuous eBPF Profiling and OTLP Exemplar Correlation Standard","category":"devops","severity":"critical","description":"Enforces deterministic linkage between OpenTelemetry OTLP metric exemplars, distributed traces, and continuous eBPF kernel/user-space CPU and off-CPU profiling data. Eliminates unmapped latency anomalies by mandating consistent frame pointer preservation, context-bound baggage propagation, and exact 64-bit/128-bit trace ID linkage across Prometheus/OTel collector topologies.","antiPatternHeadline":"Decoupled P99 Latency Telemetry without Trace-to-Profile Exemplar Invariants","stars_count":73,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","ebpf","continuous-profiling","exemplars","observability","performance"],"exportEndpoints":{"claude":"/api/rules/otel-ebpf-profiling-exemplar-correlation-standard?format=claude","cursorMdc":"/api/rules/otel-ebpf-profiling-exemplar-correlation-standard?format=mdc","cursorrules":"/api/rules/otel-ebpf-profiling-exemplar-correlation-standard?format=cursor","windsurf":"/api/rules/otel-ebpf-profiling-exemplar-correlation-standard?format=windsurf","agents":"/api/rules/otel-ebpf-profiling-exemplar-correlation-standard?format=agents"}},{"id":"react-19-server-actions-optimistic-rollback-invariant","title":"React 19 Server Actions Optimistic State Rollback Invariant","category":"frontend","severity":"critical","description":"Enforces strict atomicity and deterministic rollback patterns when pairing React 19's `useOptimistic` with Server Actions across asynchronous transition boundaries. Guarantees that transient network partitions or server-side rejections cleanly restore the canonical snapshot without UI tearing or stale reference leaks. Mandates wrapping server mutations within `useActionState` or `startTransition` and prohibits manual synchronization via decoupled `useEffect` or external mutable state caches.","antiPatternHeadline":"Unbounded Optimistic UI Tearing and Desynchronization via Manual State Reassignment Across Async Actions","stars_count":51,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","server-actions","use-optimistic","concurrency","transitions"],"exportEndpoints":{"claude":"/api/rules/react-19-server-actions-optimistic-rollback-invariant?format=claude","cursorMdc":"/api/rules/react-19-server-actions-optimistic-rollback-invariant?format=mdc","cursorrules":"/api/rules/react-19-server-actions-optimistic-rollback-invariant?format=cursor","windsurf":"/api/rules/react-19-server-actions-optimistic-rollback-invariant?format=windsurf","agents":"/api/rules/react-19-server-actions-optimistic-rollback-invariant?format=agents"}},{"id":"vite-6-module-federation-isolation-dependency-negotiation-standard","title":"Vite 6 Module Federation Isolation & SemVer Dependency Negotiation Standard","category":"frontend","severity":"critical","description":"Enforces strict runtime sandbox boundaries, scoped shared dependency singletons, and deterministic SemVer negotiation across heterogeneous Vite 6 micro-frontend remotes. Prevents runtime state collisions, dual framework instantiation, and cascading boundary crashes via isolated share scopes and error-contained remote resolution.","antiPatternHeadline":"Unpinned Shared Dependencies and Direct Window Mutations Across Federated Boundaries","stars_count":43,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","vite6","module-federation","micro-frontends","esm","dependency-negotiation"],"exportEndpoints":{"claude":"/api/rules/vite-6-module-federation-isolation-dependency-negotiation-standard?format=claude","cursorMdc":"/api/rules/vite-6-module-federation-isolation-dependency-negotiation-standard?format=mdc","cursorrules":"/api/rules/vite-6-module-federation-isolation-dependency-negotiation-standard?format=cursor","windsurf":"/api/rules/vite-6-module-federation-isolation-dependency-negotiation-standard?format=windsurf","agents":"/api/rules/vite-6-module-federation-isolation-dependency-negotiation-standard?format=agents"}},{"id":"fastapi-taskgroup-structured-concurrency-isolation","title":"FastAPI & Pydantic v2 Structured Concurrency and TaskGroup Isolation","category":"backend","severity":"critical","description":"Enforces Python 3.12+ asyncio.TaskGroup boundaries and Pydantic v2 zero-copy Rust-backed validation for concurrent request workloads. Eliminates fire-and-forget coroutine leaks, uncaught background exceptions, and unhandled sub-task failures by mandating PEP 654 ExceptionGroup handling and strict lifecycle scoping.","antiPatternHeadline":"Unbounded asyncio.create_task Invocations and Leaked Coroutine Lifecycles Bypassing Exception Boundaries","stars_count":116,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","pydantic-v2","concurrency","asyncio","python-3-12","taskgroup"],"exportEndpoints":{"claude":"/api/rules/fastapi-taskgroup-structured-concurrency-isolation?format=claude","cursorMdc":"/api/rules/fastapi-taskgroup-structured-concurrency-isolation?format=mdc","cursorrules":"/api/rules/fastapi-taskgroup-structured-concurrency-isolation?format=cursor","windsurf":"/api/rules/fastapi-taskgroup-structured-concurrency-isolation?format=windsurf","agents":"/api/rules/fastapi-taskgroup-structured-concurrency-isolation?format=agents"}},{"id":"postgres-17-active-active-conflict-resolution-guardrail","title":"Postgres 17 Active-Active Logical Replication Conflict Resolution Guardrail","category":"backend","severity":"critical","description":"Enforces deterministic origin-filtering and automated timestamp-based last-write-wins (LWW) resolution across bi-directional Postgres 17 replication topologies. Prevents infinite update looping, replication worker stalls, and silent regional data divergence. Mandates origin tracking, immutable monotonically increasing clock vectors, and trigger-enforced row convergence.","antiPatternHeadline":"Naive Bi-Directional Subscriptions Lacking Origin Filtering and Deterministic LWW Conflict Handlers","stars_count":76,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","postgres-17","replication","distributed-systems","active-active"],"exportEndpoints":{"claude":"/api/rules/postgres-17-active-active-conflict-resolution-guardrail?format=claude","cursorMdc":"/api/rules/postgres-17-active-active-conflict-resolution-guardrail?format=mdc","cursorrules":"/api/rules/postgres-17-active-active-conflict-resolution-guardrail?format=cursor","windsurf":"/api/rules/postgres-17-active-active-conflict-resolution-guardrail?format=windsurf","agents":"/api/rules/postgres-17-active-active-conflict-resolution-guardrail?format=agents"}},{"id":"tauri-v2-capability-origin-isolation-standard","title":"Tauri 2.0 Capability-Based IPC Origin Isolation & Webview Defense-in-Depth","category":"mobile","severity":"critical","description":"Enforces strict window-scoped capability configurations and runtime caller verification in Tauri 2.0 to eliminate ambient IPC privilege leakage. Prevents untrusted mobile webviews and secondary authentication windows from executing high-privilege native system commands through fine-grained capability partitioning.","antiPatternHeadline":"Wildcard Capability Attachment & Unscoped Ambient Privileges Across Tauri Webview Instances","stars_count":63,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri","security","ipc","rust","capabilities"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-capability-origin-isolation-standard?format=claude","cursorMdc":"/api/rules/tauri-v2-capability-origin-isolation-standard?format=mdc","cursorrules":"/api/rules/tauri-v2-capability-origin-isolation-standard?format=cursor","windsurf":"/api/rules/tauri-v2-capability-origin-isolation-standard?format=windsurf","agents":"/api/rules/tauri-v2-capability-origin-isolation-standard?format=agents"}},{"id":"compose-multiplatform-skiko-vsync-render-loop-guardrail","title":"Compose Multiplatform Skiko Render Loop VSync & Swapchain Invariant","category":"mobile","severity":"critical","description":"Enforces strict synchronization between Compose Multiplatform's Skiko rendering engine and native presentation backends (Metal CADisplayLink on iOS, Vulkan Choreographer on Android/Desktop). Eliminates frame pacing stutter, unthrottled GPU command buffer allocation, and CAMetalLayer/VkSwapchainKHR surface exhaustion caused by detached recomposition clocks.","antiPatternHeadline":"Free-Running Redraw Loops and Unsynchronized Frame Clock Polling in Skiko Platform Layers","stars_count":93,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","compose-multiplatform","skiko","metal","vulkan","render-loop","gpu-memory"],"exportEndpoints":{"claude":"/api/rules/compose-multiplatform-skiko-vsync-render-loop-guardrail?format=claude","cursorMdc":"/api/rules/compose-multiplatform-skiko-vsync-render-loop-guardrail?format=mdc","cursorrules":"/api/rules/compose-multiplatform-skiko-vsync-render-loop-guardrail?format=cursor","windsurf":"/api/rules/compose-multiplatform-skiko-vsync-render-loop-guardrail?format=windsurf","agents":"/api/rules/compose-multiplatform-skiko-vsync-render-loop-guardrail?format=agents"}},{"id":"rfc-9449-dpop-asymmetric-token-binding","title":"RFC 9449 DPoP Asymmetric Token Binding & Anti-Replay Guardrail","category":"security","severity":"critical","description":"Enforces RFC 9449 Demonstrating Proof-of-Possession (DPoP) at application and microservice boundaries to cryptographically bind access tokens to client-held private keys. Prevents token replay, credential theft via log leakage, and unauthorized proxying by requiring strict verification of the dpop+jwt proof header, HTTP target binding (htm/htu), access token hash (ath), and nonces.","antiPatternHeadline":"Accepting Unbound Bearer Tokens or Incompletely Validated DPoP Proofs Lacking ATH and Replay Nonces","stars_count":115,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","rfc9449","dpop","oauth2","zero-trust","jwt","token-binding"],"exportEndpoints":{"claude":"/api/rules/rfc-9449-dpop-asymmetric-token-binding?format=claude","cursorMdc":"/api/rules/rfc-9449-dpop-asymmetric-token-binding?format=mdc","cursorrules":"/api/rules/rfc-9449-dpop-asymmetric-token-binding?format=cursor","windsurf":"/api/rules/rfc-9449-dpop-asymmetric-token-binding?format=windsurf","agents":"/api/rules/rfc-9449-dpop-asymmetric-token-binding?format=agents"}},{"id":"spiffe-spire-dynamic-mtls-workload-attestation","title":"SPIFFE/SPIRE Dynamic mTLS Workload Identity Attestation Guardrail","category":"security","severity":"critical","description":"Eliminates long-lived static credentials, baked-in certificates, and persistent tokens across hybrid cloud services by enforcing dynamic workload attestation via the local SPIRE Agent Workload API. Demands zero-trust mutual TLS (mTLS) with automated short-lived X.509 SVID rotation and deterministic SPIFFE ID authorization at kernel-attested process boundaries.","antiPatternHeadline":"Persisting Long-Lived Static Private Keys and Bypassing SPIRE Workload Attestation Sockets","stars_count":62,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","spiffe","spire","mtls","zero-trust","identity-attestation","pki"],"exportEndpoints":{"claude":"/api/rules/spiffe-spire-dynamic-mtls-workload-attestation?format=claude","cursorMdc":"/api/rules/spiffe-spire-dynamic-mtls-workload-attestation?format=mdc","cursorrules":"/api/rules/spiffe-spire-dynamic-mtls-workload-attestation?format=cursor","windsurf":"/api/rules/spiffe-spire-dynamic-mtls-workload-attestation?format=windsurf","agents":"/api/rules/spiffe-spire-dynamic-mtls-workload-attestation?format=agents"}},{"id":"cilium-tetragon-kernel-namespace-syscall-audit","title":"Cilium Tetragon Kernel-Level Namespace Escape and Raw Socket Invariant","category":"devops","severity":"critical","description":"Enforces synchronous kernel-level runtime protection invariants using Cilium Tetragon eBPF TracingPolicies against unauthorized container namespace traversal and anomalous raw socket bindings. Mandates immediate in-kernel SIGKILL termination on namespace boundary violations (sys_setns, sys_unshare) and raw packet manipulation (SOCK_RAW, AF_PACKET) to prevent container escape and network spoofing without incurring user-space context-switch overhead.","antiPatternHeadline":"Passive User-Space Audit Logging of Container Namespace Escapes and Raw Socket Creation Without In-Kernel Process Termination","stars_count":55,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","cilium","tetragon","kubernetes","runtime-security","zero-trust"],"exportEndpoints":{"claude":"/api/rules/cilium-tetragon-kernel-namespace-syscall-audit?format=claude","cursorMdc":"/api/rules/cilium-tetragon-kernel-namespace-syscall-audit?format=mdc","cursorrules":"/api/rules/cilium-tetragon-kernel-namespace-syscall-audit?format=cursor","windsurf":"/api/rules/cilium-tetragon-kernel-namespace-syscall-audit?format=windsurf","agents":"/api/rules/cilium-tetragon-kernel-namespace-syscall-audit?format=agents"}},{"id":"opentelemetry-native-exemplar-trace-correlation-standard","title":"OpenTelemetry 1.28 Native Exemplar-Metric Trace Correlation Standard","category":"devops","severity":"critical","description":"Mandates deterministic inline exemplar linkage between high-cardinality distributed traces and latency bucket histograms in OpenTelemetry SDK 1.28+. Ensures explicit ActiveContext propagation during histogram observations with custom ExemplarFilter/ExemplarReservoir configuration for sub-second root-cause isolation. Eliminates unlinked metrics, context-blind recording, and metric-label cardinality explosion.","antiPatternHeadline":"Recording Context-Free Metric Observations or Over-Indexing Span Context in Metric Attributes","stars_count":80,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","observability","metrics","tracing","exemplars"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-native-exemplar-trace-correlation-standard?format=claude","cursorMdc":"/api/rules/opentelemetry-native-exemplar-trace-correlation-standard?format=mdc","cursorrules":"/api/rules/opentelemetry-native-exemplar-trace-correlation-standard?format=cursor","windsurf":"/api/rules/opentelemetry-native-exemplar-trace-correlation-standard?format=windsurf","agents":"/api/rules/opentelemetry-native-exemplar-trace-correlation-standard?format=agents"}},{"id":"react-19-server-action-idempotency-optimistic-rollback","title":"React 19 Server Action Idempotency and Optimistic Rollback Invariant","category":"frontend","severity":"critical","description":"Enforces strict idempotency and deterministic rollback semantics across React 19 Server Actions and optimistic client states. Prevents phantom state drift, out-of-order resolution during network partitions, and concurrent mutation desynchronization by mandating useActionState, useOptimistic, and monotonic idempotency tokens.","antiPatternHeadline":"Ad-Hoc State Management with Unbounded Optimistic Drift and Non-Idempotent Server Mutations","stars_count":86,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","server-actions","optimistic-ui","idempotency","data-integrity"],"exportEndpoints":{"claude":"/api/rules/react-19-server-action-idempotency-optimistic-rollback?format=claude","cursorMdc":"/api/rules/react-19-server-action-idempotency-optimistic-rollback?format=mdc","cursorrules":"/api/rules/react-19-server-action-idempotency-optimistic-rollback?format=cursor","windsurf":"/api/rules/react-19-server-action-idempotency-optimistic-rollback?format=windsurf","agents":"/api/rules/react-19-server-action-idempotency-optimistic-rollback?format=agents"}},{"id":"svelte-5-runes-lifecycle-teardown-standard","title":"Svelte 5 Runes Dynamic Graph Teardown and Root Boundary Standard","category":"frontend","severity":"critical","description":"Mandates deterministic lifecycle boundary isolation and teardown functions for nested $effect, $derived, and dynamic signal graphs in long-lived single-page applications and microfrontends. Prevents subscriber retention leaks across microfrontend boundaries by enforcing $effect.root encapsulation, explicit signal detachment, and disciplined use of untrack().","antiPatternHeadline":"Leaking Svelte 5 Reactive Subscriptions Across Microfrontend Mounts via Orphaned $effect Graphs","stars_count":71,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","memory-leaks","microfrontends","reactivity"],"exportEndpoints":{"claude":"/api/rules/svelte-5-runes-lifecycle-teardown-standard?format=claude","cursorMdc":"/api/rules/svelte-5-runes-lifecycle-teardown-standard?format=mdc","cursorrules":"/api/rules/svelte-5-runes-lifecycle-teardown-standard?format=cursor","windsurf":"/api/rules/svelte-5-runes-lifecycle-teardown-standard?format=windsurf","agents":"/api/rules/svelte-5-runes-lifecycle-teardown-standard?format=agents"}},{"id":"axum-tokio-cancellation-token-graceful-drain","title":"Axum 0.8 Tokio CancellationToken Propagation and Graceful Drain Invariant","category":"backend","severity":"critical","description":"Enforces cooperative async task cancellation and deterministic connection draining across Axum 0.8 routes, Tower middleware layers, and spawned Tokio background workers. Guarantees zero dropped in-flight transactions or truncated TCP frames during Kubernetes SIGTERM rolling terminations.","antiPatternHeadline":"Detached Background Tasks and Naked Graceful Signals Causing In-Flight Transaction Truncation on SIGTERM","stars_count":96,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tokio","concurrency","kubernetes"],"exportEndpoints":{"claude":"/api/rules/axum-tokio-cancellation-token-graceful-drain?format=claude","cursorMdc":"/api/rules/axum-tokio-cancellation-token-graceful-drain?format=mdc","cursorrules":"/api/rules/axum-tokio-cancellation-token-graceful-drain?format=cursor","windsurf":"/api/rules/axum-tokio-cancellation-token-graceful-drain?format=windsurf","agents":"/api/rules/axum-tokio-cancellation-token-graceful-drain?format=agents"}},{"id":"openfga-rebac-subgraph-traversal-latency-budget-guardrail","title":"OpenFGA Distributed ReBAC Subgraph Traversal Latency Budget Guardrail","category":"backend","severity":"critical","description":"Enforces deterministic depth limits and strict sub-5ms p99 cache-aside memoization policies for recursive OpenFGA relationship-based access control (ReBAC) evaluations across microservices. Prevents unbounded graph traversals, circular reference latency spikes, and downstream connection pool exhaustion by requiring contextual multi-tier caching (in-memory L1 LRU + Redis L2) and strict per-request evaluation deadlines.","antiPatternHeadline":"Unbounded Recursive ReBAC Subgraph Traversal Without Memoization or Latency Budgets","stars_count":108,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","openfga","rebac","authorization","caching","performance"],"exportEndpoints":{"claude":"/api/rules/openfga-rebac-subgraph-traversal-latency-budget-guardrail?format=claude","cursorMdc":"/api/rules/openfga-rebac-subgraph-traversal-latency-budget-guardrail?format=mdc","cursorrules":"/api/rules/openfga-rebac-subgraph-traversal-latency-budget-guardrail?format=cursor","windsurf":"/api/rules/openfga-rebac-subgraph-traversal-latency-budget-guardrail?format=windsurf","agents":"/api/rules/openfga-rebac-subgraph-traversal-latency-budget-guardrail?format=agents"}},{"id":"bun-clustered-worker-websocket-hibernation-isolation-standard","title":"Bun 1.2 Clustered Worker WebSocket Hibernation Isolation Standard","category":"backend","severity":"critical","description":"Enforces zero-memory-leak WebSocket lifecycle management in Bun 1.2+ multi-worker cluster deployments by mandating the native C++ WebSocket hibernation API over in-memory socket retaining patterns. Ensures that worker threads do not retain JavaScript references to idle sockets, delegate cross-worker fanout to native Bun PubSub or an external broker rather than IPC socket transfer, and isolate worker memory footprints to achieve deterministic resource reclaiming.","antiPatternHeadline":"Retaining JavaScript WebSocket References in Worker Event Loops Breaking Bun Native Hibernation and PubSub Isolation","stars_count":67,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","websockets","hibernation","clustering","pubsub","concurrency"],"exportEndpoints":{"claude":"/api/rules/bun-clustered-worker-websocket-hibernation-isolation-standard?format=claude","cursorMdc":"/api/rules/bun-clustered-worker-websocket-hibernation-isolation-standard?format=mdc","cursorrules":"/api/rules/bun-clustered-worker-websocket-hibernation-isolation-standard?format=cursor","windsurf":"/api/rules/bun-clustered-worker-websocket-hibernation-isolation-standard?format=windsurf","agents":"/api/rules/bun-clustered-worker-websocket-hibernation-isolation-standard?format=agents"}},{"id":"tauri-v2-ipc-capability-scoping-standard","title":"Tauri 2.0 Rust-Host WebView IPC Capability Scoping Standard","category":"mobile","severity":"critical","description":"Enforces strict compile-time capability scoping and granular permission sets within Tauri 2.0 to eliminate WebView RCE attack surfaces. Mandates isolation of host OS primitives through cryptographic manifest validation, explicit path allowlisting, and zero-trust IPC command scoping across mobile and desktop targets. Prohibits global wildcards, unconstrained shell/fs access, and ambient host execution contexts.","antiPatternHeadline":"Ambient Wildcard IPC Permissions and Unscoped Host Command Execution","stars_count":91,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri","rust","security","ipc","webview"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-ipc-capability-scoping-standard?format=claude","cursorMdc":"/api/rules/tauri-v2-ipc-capability-scoping-standard?format=mdc","cursorrules":"/api/rules/tauri-v2-ipc-capability-scoping-standard?format=cursor","windsurf":"/api/rules/tauri-v2-ipc-capability-scoping-standard?format=windsurf","agents":"/api/rules/tauri-v2-ipc-capability-scoping-standard?format=agents"}},{"id":"capacitor-7-native-intent-link-verification-guardrail","title":"Capacitor 7 Cryptographic Intent & Universal Link Verification Guardrail","category":"mobile","severity":"critical","description":"Enforces deterministic origin verification and cryptographic domain association for all inbound deep links and intents in Capacitor 7 hybrid applications. Eliminates custom URL scheme hijacking and unauthorized native bridge invocation by restricting state mutation to cryptographically proven Universal Links (iOS) and Android App Links.","antiPatternHeadline":"Blind Trust in Insecure Custom Scheme Intents Driving Privileged Native Bridge Actions","stars_count":90,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["capacitor","mobile","security","universal-links","app-links","ios","android","bridge-security"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-native-intent-link-verification-guardrail?format=claude","cursorMdc":"/api/rules/capacitor-7-native-intent-link-verification-guardrail?format=mdc","cursorrules":"/api/rules/capacitor-7-native-intent-link-verification-guardrail?format=cursor","windsurf":"/api/rules/capacitor-7-native-intent-link-verification-guardrail?format=windsurf","agents":"/api/rules/capacitor-7-native-intent-link-verification-guardrail?format=agents"}},{"id":"webauthn-prf-zk-key-derivation-standard","title":"WebAuthn PRF Client-Side Zero-Knowledge Cryptographic Key Derivation Guardrail","category":"security","severity":"critical","description":"Enforces strict client-side zero-knowledge architectural standards for deriving symmetric cryptographic keys via the WebAuthn Pseudo-Random Function (PRF) extension (HMAC-secret). Prevents leakage of raw PRF outputs, mandates constant salt isolation, enforces subkey derivation using HKDF with quantum-resistant key lengths (AES-256-GCM / XChaCha20-Poly1305), and ensures hardware secrets never transit to relying party backend servers.","antiPatternHeadline":"Transmitting Raw PRF Outputs to Relying Parties or Directly Utilizing Unhashed Hardware Evaluation Results as Symmetric Vault Keys","stars_count":54,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","prf-extension","zero-knowledge","hkdf","cryptography"],"exportEndpoints":{"claude":"/api/rules/webauthn-prf-zk-key-derivation-standard?format=claude","cursorMdc":"/api/rules/webauthn-prf-zk-key-derivation-standard?format=mdc","cursorrules":"/api/rules/webauthn-prf-zk-key-derivation-standard?format=cursor","windsurf":"/api/rules/webauthn-prf-zk-key-derivation-standard?format=windsurf","agents":"/api/rules/webauthn-prf-zk-key-derivation-standard?format=agents"}},{"id":"cosign-keyless-slsa3-admission-invariant","title":"Sigstore Cosign Keyless Attestation and SLSA Level 3 Admission Invariant","category":"security","severity":"critical","description":"Enforces admission-time cryptographic verification of short-lived OIDC identities, Rekor transparency log entries, and SLSA Level 3 build provenance for all containerized workloads. Blocks execution of untrusted, unverified, or tampered artifacts by validating that image digests match immutable cryptographic signatures anchored in the Fulcio root of trust prior to Kubernetes workload scheduling.","antiPatternHeadline":"Admitting unverified container images, relying on static long-lived signing keys, or deploying without verifying SLSA Level 3 provenance predicates against Fulcio OIDC identities.","stars_count":80,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","sigstore","cosign","slsa-provenance","kubernetes","kyverno","supply-chain"],"exportEndpoints":{"claude":"/api/rules/cosign-keyless-slsa3-admission-invariant?format=claude","cursorMdc":"/api/rules/cosign-keyless-slsa3-admission-invariant?format=mdc","cursorrules":"/api/rules/cosign-keyless-slsa3-admission-invariant?format=cursor","windsurf":"/api/rules/cosign-keyless-slsa3-admission-invariant?format=windsurf","agents":"/api/rules/cosign-keyless-slsa3-admission-invariant?format=agents"}},{"id":"opentelemetry-w3c-baggage-multi-tenant-lineage-guardrail","title":"OpenTelemetry W3C Baggage Distributed Multi-Tenant Lineage Invariant","category":"devops","severity":"critical","description":"Enforces unbroken context propagation of multi-tenant boundaries and security clearance levels across asynchronous message brokers, background workers, and RPC boundaries via W3C Baggage. Mandates explicit allowlisting and sanitization of baggage entries to guarantee traceability while strictly preventing the ingestion of unbounded high-cardinality keys or PII into downstream telemetry systems.","antiPatternHeadline":"Baggage Over-Propagation, Tenant Leakage, and Broken Asynchronous Trace Lineage","stars_count":102,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","distributed-tracing","w3c-baggage","multi-tenancy","context-propagation"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-w3c-baggage-multi-tenant-lineage-guardrail?format=claude","cursorMdc":"/api/rules/opentelemetry-w3c-baggage-multi-tenant-lineage-guardrail?format=mdc","cursorrules":"/api/rules/opentelemetry-w3c-baggage-multi-tenant-lineage-guardrail?format=cursor","windsurf":"/api/rules/opentelemetry-w3c-baggage-multi-tenant-lineage-guardrail?format=windsurf","agents":"/api/rules/opentelemetry-w3c-baggage-multi-tenant-lineage-guardrail?format=agents"}},{"id":"pg17-failover-slot-sync-cdc-guardrail","title":"PostgreSQL 17 Failover Slot Synchronization for Zero-Data-Loss CDC","category":"backend","severity":"critical","description":"Enforces failover replication slot synchronization introduced in PostgreSQL 17 to prevent silent data loss and unbounded duplication during physical cluster failovers. Requires failover-enabled logical slots on the primary, synchronized standby worker coordination via synchronized_standby_slots, and consumer LSN confirmation validation across streaming worker boundaries.","antiPatternHeadline":"Creating unsynchronized logical replication slots on the primary without physical standby slot synchronization barriers","stars_count":86,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","cdc","debezium","replication","high-availability"],"exportEndpoints":{"claude":"/api/rules/pg17-failover-slot-sync-cdc-guardrail?format=claude","cursorMdc":"/api/rules/pg17-failover-slot-sync-cdc-guardrail?format=mdc","cursorrules":"/api/rules/pg17-failover-slot-sync-cdc-guardrail?format=cursor","windsurf":"/api/rules/pg17-failover-slot-sync-cdc-guardrail?format=windsurf","agents":"/api/rules/pg17-failover-slot-sync-cdc-guardrail?format=agents"}},{"id":"react19-flight-payload-pii-sanitization-guardrail","title":"React 19 Flight Payload PII & Secret Sanitization Guardrail","category":"frontend","severity":"critical","description":"Enforces strict boundary contracts between React 19 Server Components and Client Components to prevent secret and PII leakage over the wire. The React Flight serialization protocol sends raw prop values and bound Server Action closures directly to the browser DOM/network tab. This standard mandates explicit DTO projection, zero-spread object passing across client boundaries, and active use of React 19 taint APIs.","antiPatternHeadline":"Passing Unsanitized Server Entities, Direct ORM Models, or Closed-Over Secrets Across the RSC-to-Client Flight Serialization Boundary","stars_count":63,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react19","rsc","security","flight-protocol","pii-sanitization"],"exportEndpoints":{"claude":"/api/rules/react19-flight-payload-pii-sanitization-guardrail?format=claude","cursorMdc":"/api/rules/react19-flight-payload-pii-sanitization-guardrail?format=mdc","cursorrules":"/api/rules/react19-flight-payload-pii-sanitization-guardrail?format=cursor","windsurf":"/api/rules/react19-flight-payload-pii-sanitization-guardrail?format=windsurf","agents":"/api/rules/react19-flight-payload-pii-sanitization-guardrail?format=agents"}},{"id":"axum-hyper-cooperative-cancellation-propagation","title":"Axum 0.8 & Hyper 1.x Cooperative Request Cancellation Propagation","category":"backend","severity":"critical","description":"Enforces deterministic cancellation propagation across asynchronous boundaries in Axum 0.8 and Hyper 1.x services. Prevents orphaned compute and connection pool exhaustion by binding subtasks and database operations to client socket drop lifecycles using structured cancellation tokens and RAII drop guards.","antiPatternHeadline":"Detached background execution and unlinked Tokio spawns running after HTTP client disconnection","stars_count":56,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tokio","hyper","concurrency"],"exportEndpoints":{"claude":"/api/rules/axum-hyper-cooperative-cancellation-propagation?format=claude","cursorMdc":"/api/rules/axum-hyper-cooperative-cancellation-propagation?format=mdc","cursorrules":"/api/rules/axum-hyper-cooperative-cancellation-propagation?format=cursor","windsurf":"/api/rules/axum-hyper-cooperative-cancellation-propagation?format=windsurf","agents":"/api/rules/axum-hyper-cooperative-cancellation-propagation?format=agents"}},{"id":"capacitor-7-biometric-secure-enclave-key-invalidation-standard","title":"Capacitor 7 Biometric Hardware Key Invalidation on OS Enrollment Mutation","category":"mobile","severity":"critical","description":"Enforces automatic hardware-backed cryptographic key invalidation across iOS Secure Enclave and Android KeyStore when any OS biometric enrollment state changes. Prevents unauthorized credential replay and token reuse if an adversary or secondary user registers a new biometric identity on the host device. Mandates strict lifecycle handling of invalidated key errors with forced re-authentication and session revocation.","antiPatternHeadline":"Bypassing hardware-enforced biometric enrollment invalidation flags and persisting stale session tokens","stars_count":81,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","biometrics","security","secure-enclave","keystore"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-biometric-secure-enclave-key-invalidation-standard?format=claude","cursorMdc":"/api/rules/capacitor-7-biometric-secure-enclave-key-invalidation-standard?format=mdc","cursorrules":"/api/rules/capacitor-7-biometric-secure-enclave-key-invalidation-standard?format=cursor","windsurf":"/api/rules/capacitor-7-biometric-secure-enclave-key-invalidation-standard?format=windsurf","agents":"/api/rules/capacitor-7-biometric-secure-enclave-key-invalidation-standard?format=agents"}},{"id":"ebpf-tetragon-namespace-escape-guardrail","title":"eBPF Tetragon Real-Time In-Kernel Namespace Escape Interception and Kill Enforcement","category":"security","severity":"critical","description":"Defines and mandates zero-tolerance TracingPolicy CRDs within Tetragon to detect and synchronously terminate container escape attempts in kernel-space before privilege-escalated syscall execution completes. Ensures synchronous SIGKILL enforcement on unauthorized namespace manipulation (setns, unshare, pivot_root) and mount namespace breakouts across production Kubernetes worker nodes.","antiPatternHeadline":"Passive Asynchronous Audit Logging of Namespace Manipulation Syscalls Without In-Kernel SIGKILL Enforcement","stars_count":76,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","ebpf","tetragon","kubernetes","container-breakout","zero-trust"],"exportEndpoints":{"claude":"/api/rules/ebpf-tetragon-namespace-escape-guardrail?format=claude","cursorMdc":"/api/rules/ebpf-tetragon-namespace-escape-guardrail?format=mdc","cursorrules":"/api/rules/ebpf-tetragon-namespace-escape-guardrail?format=cursor","windsurf":"/api/rules/ebpf-tetragon-namespace-escape-guardrail?format=windsurf","agents":"/api/rules/ebpf-tetragon-namespace-escape-guardrail?format=agents"}},{"id":"opentelemetry-baggage-trace-context-redaction","title":"OpenTelemetry Baggage Context Boundary & In-Flight PII Redaction Policy","category":"devops","severity":"critical","description":"Enforces strict allowlists and automatic redaction boundaries on OpenTelemetry W3C Baggage propagation across distributed systems. Prohibits direct injection of raw Personally Identifiable Information (PII), unmasked account tokens, or internal multi-tenant credentials into cross-service headers. Requires cryptographic pseudonymization or gateway stripping before headers traverse trust boundaries.","antiPatternHeadline":"Propagating Raw PII and Multi-Tenant Isolation Secrets Across Services via Unrestricted W3C Baggage Headers","stars_count":116,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","distributed-tracing","pii-redaction","context-propagation","security-headers"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-baggage-trace-context-redaction?format=claude","cursorMdc":"/api/rules/opentelemetry-baggage-trace-context-redaction?format=mdc","cursorrules":"/api/rules/opentelemetry-baggage-trace-context-redaction?format=cursor","windsurf":"/api/rules/opentelemetry-baggage-trace-context-redaction?format=windsurf","agents":"/api/rules/opentelemetry-baggage-trace-context-redaction?format=agents"}},{"id":"openfga-contextual-tuple-memory-sandboxing","title":"OpenFGA Request-Scoped Contextual Tuple Memory and Cardinality Sandboxing","category":"security","severity":"critical","description":"Enforces strict cardinality bounding, payload memory budgets, and timeout sandboxing on request-scoped contextual tuples during OpenFGA check operations. Failure to sandbox ephemeral tuples exposes authorization nodes to heap exhaustion, algorithmic complexity attacks, and denial of service via recursive graph traversals.","antiPatternHeadline":"Unbounded Dynamic Contextual Tuple Ingestion Causing Authorization Cluster Exhaustion","stars_count":94,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","authorization","rebac","dos-prevention","sandboxing"],"exportEndpoints":{"claude":"/api/rules/openfga-contextual-tuple-memory-sandboxing?format=claude","cursorMdc":"/api/rules/openfga-contextual-tuple-memory-sandboxing?format=mdc","cursorrules":"/api/rules/openfga-contextual-tuple-memory-sandboxing?format=cursor","windsurf":"/api/rules/openfga-contextual-tuple-memory-sandboxing?format=windsurf","agents":"/api/rules/openfga-contextual-tuple-memory-sandboxing?format=agents"}},{"id":"fastapi-anyio-exceptiongroup-containment","title":"FastAPI AnyIO Structured Concurrency ExceptionGroup Containment","category":"backend","severity":"critical","description":"Enforces strict boundary containment and unwrapping of Python 3.11+ ExceptionGroup and anyio.ExceptionGroup instances inside FastAPI endpoints, background tasks, and ASGI worker loops. Failure to handle task group exceptions at the concurrency boundary causes them to bubble through Starlette middleware without invoking typed exception handlers, tearing down ASGI worker processes and dropping in-flight client connections.","antiPatternHeadline":"Leaking Unhandled ExceptionGroups Across ASGI Middleware Boundaries Crashing Worker Pools","stars_count":83,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","anyio","asyncio","structured-concurrency","python"],"exportEndpoints":{"claude":"/api/rules/fastapi-anyio-exceptiongroup-containment?format=claude","cursorMdc":"/api/rules/fastapi-anyio-exceptiongroup-containment?format=mdc","cursorrules":"/api/rules/fastapi-anyio-exceptiongroup-containment?format=cursor","windsurf":"/api/rules/fastapi-anyio-exceptiongroup-containment?format=windsurf","agents":"/api/rules/fastapi-anyio-exceptiongroup-containment?format=agents"}},{"id":"svelte-5-runes-derivation-loop-quarantine","title":"Svelte 5 Runes Reactive Derivation Microtask Loop Quarantine","category":"frontend","severity":"critical","description":"Enforces strict mathematical purity, acyclic dependency graph topology, and synchronous boundary quarantine for Svelte 5 $derived and $derived.by evaluation trees. Prohibits state mutation, hidden signal feedback cycles, and recursive dependency reads that trigger 'effect_update_depth_exceeded' runtime crashes or microtask starvation on the UI main thread.","antiPatternHeadline":"Mutating State or Introducing Circular Graph Reads Inside $derived and $derived.by Trees","stars_count":53,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","reactivity","performance","state-management"],"exportEndpoints":{"claude":"/api/rules/svelte-5-runes-derivation-loop-quarantine?format=claude","cursorMdc":"/api/rules/svelte-5-runes-derivation-loop-quarantine?format=mdc","cursorrules":"/api/rules/svelte-5-runes-derivation-loop-quarantine?format=cursor","windsurf":"/api/rules/svelte-5-runes-derivation-loop-quarantine?format=windsurf","agents":"/api/rules/svelte-5-runes-derivation-loop-quarantine?format=agents"}},{"id":"cilium-ebpf-inkernel-mtls-attestation-standard","title":"Cilium eBPF Node-to-Node In-Kernel mTLS Identity Attestation Standard","category":"devops","severity":"critical","description":"Mandates cryptographically enforced workload-to-workload mutual authentication via Cilium eBPF datapath attestation, eliminating user-space sidecar proxy overhead. Enforces SPIFFE-based identity validation directly integrated into the kernel socket layer alongside IPsec or WireGuard transparent node encryption.","antiPatternHeadline":"Deploying User-Space Envoy Sidecars for L3/L4 mTLS or Permitting Unauthenticated IP-Based NetworkPolicies","stars_count":93,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","cilium","ebpf","mtls","zero-trust","spiffe","kubernetes"],"exportEndpoints":{"claude":"/api/rules/cilium-ebpf-inkernel-mtls-attestation-standard?format=claude","cursorMdc":"/api/rules/cilium-ebpf-inkernel-mtls-attestation-standard?format=mdc","cursorrules":"/api/rules/cilium-ebpf-inkernel-mtls-attestation-standard?format=cursor","windsurf":"/api/rules/cilium-ebpf-inkernel-mtls-attestation-standard?format=windsurf","agents":"/api/rules/cilium-ebpf-inkernel-mtls-attestation-standard?format=agents"}},{"id":"react-19-action-state-abort-signal-propagation","title":"React 19 Concurrent Action State AbortSignal Propagation","category":"frontend","severity":"critical","description":"Mandates strict AbortSignal binding and lifecycle cancellation across concurrent React 19 useActionState dispatches. Guarantees that superseded asynchronous mutations are immediately aborted at the transport layer, preventing out-of-order state settlement and orphaned server operations.","antiPatternHeadline":"Uncancelled Concurrent Action Invocations Causing Race Condition State Overrides","stars_count":65,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["react-19","useActionState","concurrency","abort-controller","race-conditions"],"exportEndpoints":{"claude":"/api/rules/react-19-action-state-abort-signal-propagation?format=claude","cursorMdc":"/api/rules/react-19-action-state-abort-signal-propagation?format=mdc","cursorrules":"/api/rules/react-19-action-state-abort-signal-propagation?format=cursor","windsurf":"/api/rules/react-19-action-state-abort-signal-propagation?format=windsurf","agents":"/api/rules/react-19-action-state-abort-signal-propagation?format=agents"}},{"id":"nextjs-15-server-action-context-isolation","title":"Next.js 15 Server Action Ephemeral Request Context Boundary & Origin Verification","category":"frontend","severity":"critical","description":"Enforces strict runtime cryptographic origin verification and isolated AsyncLocalStorage boundaries across Next.js 15 Server Actions. Prevents cross-request context bleeding, state contamination, and unauthorized action invocation across concurrent serverless execution environments.","antiPatternHeadline":"Global Mutable State Leaks & Unverified Cross-Site Server Action Executions","stars_count":55,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs-15","server-actions","security","async-local-storage","csrf"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-server-action-context-isolation?format=claude","cursorMdc":"/api/rules/nextjs-15-server-action-context-isolation?format=mdc","cursorrules":"/api/rules/nextjs-15-server-action-context-isolation?format=cursor","windsurf":"/api/rules/nextjs-15-server-action-context-isolation?format=windsurf","agents":"/api/rules/nextjs-15-server-action-context-isolation?format=agents"}},{"id":"axum-08-tower-backpressure-stream-throttling","title":"Axum 0.8 Layered Tower Backpressure Stream Throttling","category":"backend","severity":"critical","description":"Enforces deterministic backpressure propagation across Axum 0.8 routing pipelines and Tower middleware layers down to underlying network sockets. Mandates strictly bounded channel buffering and frame consumption via http-body 1.0 to eliminate unbounded heap growth during slow-consumer and slow-read attacks.","antiPatternHeadline":"Eager Buffering and Unbounded Asynchronous Queues in Streaming Tower Layers","stars_count":65,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tower","backpressure","streams","tokio"],"exportEndpoints":{"claude":"/api/rules/axum-08-tower-backpressure-stream-throttling?format=claude","cursorMdc":"/api/rules/axum-08-tower-backpressure-stream-throttling?format=mdc","cursorrules":"/api/rules/axum-08-tower-backpressure-stream-throttling?format=cursor","windsurf":"/api/rules/axum-08-tower-backpressure-stream-throttling?format=windsurf","agents":"/api/rules/axum-08-tower-backpressure-stream-throttling?format=agents"}},{"id":"postgres-17-logical-replication-parallel-apply-buffer-bound","title":"PostgreSQL 17 Logical Replication Parallel Apply Buffer Bound Invariant","category":"backend","severity":"critical","description":"Enforces strict memory buffering constraints and worker limits on PostgreSQL 17 parallel apply logical replication subscribers. Unbounded worker memory allocation during high-volume multi-partition streaming transactions depletes host memory and triggers subscriber postmaster SIGKILL terminations via the OS OOM killer.","antiPatternHeadline":"Unbounded Parallel Apply Workers and Unconstrained Buffer Memory in Logical Replication","stars_count":49,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","postgres-17","logical-replication","database-reliability","memory-safety"],"exportEndpoints":{"claude":"/api/rules/postgres-17-logical-replication-parallel-apply-buffer-bound?format=claude","cursorMdc":"/api/rules/postgres-17-logical-replication-parallel-apply-buffer-bound?format=mdc","cursorrules":"/api/rules/postgres-17-logical-replication-parallel-apply-buffer-bound?format=cursor","windsurf":"/api/rules/postgres-17-logical-replication-parallel-apply-buffer-bound?format=windsurf","agents":"/api/rules/postgres-17-logical-replication-parallel-apply-buffer-bound?format=agents"}},{"id":"kmp-ktor-ssl-pinning-certificate-transparency","title":"KMP Ktor Multiplatform Engine SSL Pinning and Certificate Transparency Guardrail","category":"mobile","severity":"critical","description":"Enforces hardware-backed Subject Public Key Info (SPKI) SHA-256 certificate pinning with disaster-recovery backup keys and Certificate Transparency (CT) log verification across native Ktor networking engines (OkHttp on Android and Darwin on iOS). Eliminates insecure platform-agnostic trust bypasses and brittle leaf certificate pinning that cause catastrophic service outages during rotation.","antiPatternHeadline":"Leaf Certificate Hardcoding or Unpinned Ktor Multiplatform Networking Without Platform CT Audits","stars_count":90,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kmp","ktor","security","ssl-pinning","certificate-transparency","android","ios"],"exportEndpoints":{"claude":"/api/rules/kmp-ktor-ssl-pinning-certificate-transparency?format=claude","cursorMdc":"/api/rules/kmp-ktor-ssl-pinning-certificate-transparency?format=mdc","cursorrules":"/api/rules/kmp-ktor-ssl-pinning-certificate-transparency?format=cursor","windsurf":"/api/rules/kmp-ktor-ssl-pinning-certificate-transparency?format=windsurf","agents":"/api/rules/kmp-ktor-ssl-pinning-certificate-transparency?format=agents"}},{"id":"capacitor-7-secure-keystore-biometric-crypto-policy","title":"Hardware-Backed KeyStore & Biometric Cryptographic Isolation Standard","category":"mobile","severity":"critical","description":"Mandates that all asymmetric private cryptographic keys reside exclusively within hardware-backed secure elements (iOS Secure Enclave, Android StrongBox/TEE Keystore) guarded by user biometric authentication. Strictly prohibits exposing, passing, or handling raw private keys or seeds within the Capacitor 7 JavaScript/WebView execution context.","antiPatternHeadline":"Extracting Raw Private Keys into WebView Memory or Performing In-Browser Software Signing","stars_count":92,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","security","cryptography","biometrics","keystore","secure-enclave"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-secure-keystore-biometric-crypto-policy?format=claude","cursorMdc":"/api/rules/capacitor-7-secure-keystore-biometric-crypto-policy?format=mdc","cursorrules":"/api/rules/capacitor-7-secure-keystore-biometric-crypto-policy?format=cursor","windsurf":"/api/rules/capacitor-7-secure-keystore-biometric-crypto-policy?format=windsurf","agents":"/api/rules/capacitor-7-secure-keystore-biometric-crypto-policy?format=agents"}},{"id":"webauthn-device-bound-attestation-enforcement","title":"Hardware Device-Bound FIDO2 Attestation & Synced Passkey Rejection Guardrail","category":"security","severity":"critical","description":"Enforces hardware-backed, device-bound WebAuthn credentials for zero-trust administrative control planes by cryptographically validating attestation statement certificates and AAGUIDs against the FIDO Alliance Metadata Service. Rejects multi-device synced passkeys by validating authenticator data flags (backup eligibility and backup state) and mandating direct attestation during credential registration.","antiPatternHeadline":"Permitting Synced Multi-Device Passkeys and Attestation-Free Registration on Privileged Administrative Surfaces","stars_count":99,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","fido2","zero-trust","attestation","cryptography","passkeys"],"exportEndpoints":{"claude":"/api/rules/webauthn-device-bound-attestation-enforcement?format=claude","cursorMdc":"/api/rules/webauthn-device-bound-attestation-enforcement?format=mdc","cursorrules":"/api/rules/webauthn-device-bound-attestation-enforcement?format=cursor","windsurf":"/api/rules/webauthn-device-bound-attestation-enforcement?format=windsurf","agents":"/api/rules/webauthn-device-bound-attestation-enforcement?format=agents"}},{"id":"openfga-cycle-termination-guardrail","title":"OpenFGA Modular Schema Cycle-Termination and Recursion-Budget Guardrail","category":"security","severity":"critical","description":"Enforces strict recursion-depth budgets, memoized graph evaluation checks, and acyclic invariant compilation on modular OpenFGA schemas and client-side graph traversals. Protects authorization engines against ReDoS-style denial-of-service vulnerabilities caused by self-referential relations, mutual group nestings, or trans-module tuple cycles. Guarantees deterministic evaluation bounds across distributed Zanzibar-like authorization deployments.","antiPatternHeadline":"Unbounded Recursive Tuple Evaluation Inducing ReDoS and Resource Exhaustion in Modular OpenFGA Stores","stars_count":98,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","authorization","rebac","graph-algorithms","dos-prevention"],"exportEndpoints":{"claude":"/api/rules/openfga-cycle-termination-guardrail?format=claude","cursorMdc":"/api/rules/openfga-cycle-termination-guardrail?format=mdc","cursorrules":"/api/rules/openfga-cycle-termination-guardrail?format=cursor","windsurf":"/api/rules/openfga-cycle-termination-guardrail?format=windsurf","agents":"/api/rules/openfga-cycle-termination-guardrail?format=agents"}},{"id":"ebpf-sockops-service-mesh-mtls-standard","title":"Kernel Socket-Layer BPF Acceleration with Cryptographic Handshake and L7 Telemetry Retention","category":"devops","severity":"critical","description":"Enforces deterministic eBPF socket-layer redirection (sockops/sockmap) invariants across service mesh proxies. Kernel-level TCP stream short-circuiting must never bypass mutual TLS authentication, cgroup identity attribution, or L7 telemetry ring-buffer dispatch.","antiPatternHeadline":"Blind Kernel Socket Splicing That Bypasses Userspace Proxy Authentication and Evades L7 Telemetry","stars_count":106,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","service-mesh","mtls","sockops","cilium","linux-kernel"],"exportEndpoints":{"claude":"/api/rules/ebpf-sockops-service-mesh-mtls-standard?format=claude","cursorMdc":"/api/rules/ebpf-sockops-service-mesh-mtls-standard?format=mdc","cursorrules":"/api/rules/ebpf-sockops-service-mesh-mtls-standard?format=cursor","windsurf":"/api/rules/ebpf-sockops-service-mesh-mtls-standard?format=windsurf","agents":"/api/rules/ebpf-sockops-service-mesh-mtls-standard?format=agents"}},{"id":"otel-tail-sampling-dynamic-memory-shedding","title":"OpenTelemetry Collector Dynamic Memory Shedding & Adaptive Tail Sampling Invariant","category":"devops","severity":"critical","description":"Enforces survival invariants on OpenTelemetry Collector pipelines by prioritizing critical error traces and shedding non-erroneous telemetry under downstream backpressure. Prevents OOM kills through strict processor ordering, memory_limiter thresholds, and composite tail-sampling policies with prioritized fallback tiers.","antiPatternHeadline":"Unbounded Trace Buffering and Indiscriminate In-Memory Tail Sampling Inducing Outage Cascades and OOM Kills","stars_count":56,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","observability","tail-sampling","memory-management","resilience"],"exportEndpoints":{"claude":"/api/rules/otel-tail-sampling-dynamic-memory-shedding?format=claude","cursorMdc":"/api/rules/otel-tail-sampling-dynamic-memory-shedding?format=mdc","cursorrules":"/api/rules/otel-tail-sampling-dynamic-memory-shedding?format=cursor","windsurf":"/api/rules/otel-tail-sampling-dynamic-memory-shedding?format=windsurf","agents":"/api/rules/otel-tail-sampling-dynamic-memory-shedding?format=agents"}},{"id":"react-19-action-state-optimistic-ui-idempotency","title":"React 19 Action State & Optimistic UI Idempotency Boundary","category":"frontend","severity":"critical","description":"Guarantees deterministic rollback behavior and prevents dangling mutation states during concurrent optimistic updates across distributed network partitions. Mandates strict transaction-scoped idempotency keys, non-mutating update reducers, and explicit abort-signal binding in React 19 useActionState and useOptimistic transitions. Ensures UI state remains strictly reconcilable when async Server Actions fail, timeout, or arrive out of sequence.","antiPatternHeadline":"Non-Idempotent Concurrent Mutations with Dangling Optimistic Reducer States","stars_count":107,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","useActionState","useOptimistic","idempotency","concurrent-mode"],"exportEndpoints":{"claude":"/api/rules/react-19-action-state-optimistic-ui-idempotency?format=claude","cursorMdc":"/api/rules/react-19-action-state-optimistic-ui-idempotency?format=mdc","cursorrules":"/api/rules/react-19-action-state-optimistic-ui-idempotency?format=cursor","windsurf":"/api/rules/react-19-action-state-optimistic-ui-idempotency?format=windsurf","agents":"/api/rules/react-19-action-state-optimistic-ui-idempotency?format=agents"}},{"id":"drizzle-orm-connection-scoped-rls-session-invariant","title":"Drizzle ORM Connection-Scoped RLS Session Context Invariant","category":"backend","severity":"critical","description":"Enforces mandatory transactional session-context injection (e.g., SET LOCAL app.current_tenant_id) within Drizzle ORM transactions prior to executing queries under PostgreSQL Row Level Security (RLS). Prevents cross-tenant data leakage caused by asynchronous connection pool reuse when ambient session parameters persist or default to empty scopes.","antiPatternHeadline":"Global Pool Querying Without Local Transactional Tenant Context Injection","stars_count":109,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","drizzle-orm","postgresql","row-level-security","multi-tenancy","connection-pooling"],"exportEndpoints":{"claude":"/api/rules/drizzle-orm-connection-scoped-rls-session-invariant?format=claude","cursorMdc":"/api/rules/drizzle-orm-connection-scoped-rls-session-invariant?format=mdc","cursorrules":"/api/rules/drizzle-orm-connection-scoped-rls-session-invariant?format=cursor","windsurf":"/api/rules/drizzle-orm-connection-scoped-rls-session-invariant?format=windsurf","agents":"/api/rules/drizzle-orm-connection-scoped-rls-session-invariant?format=agents"}},{"id":"go-chi-context-propagation-goroutine-teardown-guardrail","title":"Go Chi Structured Context Propagation and Goroutine Teardown Guardrail","category":"backend","severity":"critical","description":"Enforces strict context deadline inheritance, cooperative goroutine cancellation, and bounded lifecycle synchronization in Go Chi HTTP services. Prevents silent memory bloat, resource exhaustion, and zombie goroutines caused by detaching contexts or spawning unmonitored background routines from active HTTP handlers under sustained load.","antiPatternHeadline":"Spawning fire-and-forget goroutines or stripping request context deadlines in Chi handlers","stars_count":92,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","chi","concurrency","context","goroutines","memory-leak"],"exportEndpoints":{"claude":"/api/rules/go-chi-context-propagation-goroutine-teardown-guardrail?format=claude","cursorMdc":"/api/rules/go-chi-context-propagation-goroutine-teardown-guardrail?format=mdc","cursorrules":"/api/rules/go-chi-context-propagation-goroutine-teardown-guardrail?format=cursor","windsurf":"/api/rules/go-chi-context-propagation-goroutine-teardown-guardrail?format=windsurf","agents":"/api/rules/go-chi-context-propagation-goroutine-teardown-guardrail?format=agents"}},{"id":"tauri2-scope-bound-ipc-capability-sandboxing","title":"Tauri 2.0 Scope-Bound IPC Capability Sandboxing for Multi-Webview Surfaces","category":"mobile","severity":"critical","description":"Enforces declarative, compile-time capability sandboxing across multi-webview surfaces in Tauri 2.0 mobile and desktop targets. Restricts low-level OS IPC bindings by guaranteeing non-primary webviews operate under least-privilege capability files without ambient system access.","antiPatternHeadline":"Ambient Wildcard Capabilities and Shared IPC Contexts on Secondary Webview Surfaces","stars_count":87,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri","ipc","security","capabilities","sandboxing"],"exportEndpoints":{"claude":"/api/rules/tauri2-scope-bound-ipc-capability-sandboxing?format=claude","cursorMdc":"/api/rules/tauri2-scope-bound-ipc-capability-sandboxing?format=mdc","cursorrules":"/api/rules/tauri2-scope-bound-ipc-capability-sandboxing?format=cursor","windsurf":"/api/rules/tauri2-scope-bound-ipc-capability-sandboxing?format=windsurf","agents":"/api/rules/tauri2-scope-bound-ipc-capability-sandboxing?format=agents"}},{"id":"kmp-concurrent-stateflow-swift-isolation","title":"Kotlin Multiplatform Concurrent StateFlow and Swift Concurrency Memory Invariant","category":"mobile","severity":"critical","description":"Enforces strict memory isolation and non-blocking emission boundaries when exposing Kotlin Coroutines StateFlow or SharedFlow instances across the Objective-C/Swift interoperability bridge. Prevents silent thread starvation, deadlocks, and legacy runtime freezing on Darwin platforms by mandating buffered dispatching and MainActor-isolated adapter contracts.","antiPatternHeadline":"Direct Consumption of Unbuffered Cold/Hot Flows in Swift Tasks Leading to Main-Thread Deadlocks","stars_count":75,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","swift","concurrency","stateflow","coroutines"],"exportEndpoints":{"claude":"/api/rules/kmp-concurrent-stateflow-swift-isolation?format=claude","cursorMdc":"/api/rules/kmp-concurrent-stateflow-swift-isolation?format=mdc","cursorrules":"/api/rules/kmp-concurrent-stateflow-swift-isolation?format=cursor","windsurf":"/api/rules/kmp-concurrent-stateflow-swift-isolation?format=windsurf","agents":"/api/rules/kmp-concurrent-stateflow-swift-isolation?format=agents"}},{"id":"capacitor-7-hardware-attestation-session-invariant","title":"Capacitor 7 Hardware-Backed Key Attestation and Session Binding Standard","category":"security","severity":"critical","description":"Binds mobile JWT refresh sessions to hardware-backed cryptographic keys generated inside the Apple Secure Enclave or Android StrongBox/TEE Keystore. Mandates client-side Demonstrating Proof of Possession (DPoP) or challenge-response assertion signing inside isolated hardware, rendering exfiltrated refresh tokens mathematically unusable by adversaries.","antiPatternHeadline":"Persisting Raw Bearer Refresh Tokens in WebView Storage or Software-Only Keychains Without Enclave Proof-of-Possession","stars_count":114,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","capacitor-7","secure-enclave","dpop","jwt","key-attestation","ios","android"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-hardware-attestation-session-invariant?format=claude","cursorMdc":"/api/rules/capacitor-7-hardware-attestation-session-invariant?format=mdc","cursorrules":"/api/rules/capacitor-7-hardware-attestation-session-invariant?format=cursor","windsurf":"/api/rules/capacitor-7-hardware-attestation-session-invariant?format=windsurf","agents":"/api/rules/capacitor-7-hardware-attestation-session-invariant?format=agents"}},{"id":"wasm-component-wasi-p2-sandbox-guardrail","title":"WASI 0.2 Component Model Zero-Trust Linear Memory Sandbox Isolation","category":"security","severity":"critical","description":"Enforces strict zero-trust compute isolation for third-party pluggable extensions running inside the host runtime via the WebAssembly Component Model and WASI 0.2 (Preview 2). Mandates explicit capability-oriented interface imports, strict fuel metering, epoch-based execution interruption, and disallows raw linear memory sharing or unmediated host syscall leaks across the canonical ABI boundary.","antiPatternHeadline":"Ambient Authority Leakage and Unmetered Linear Memory Access in In-Process Third-Party Wasm Plugins","stars_count":47,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webassembly","wasm-component-model","wasi-0.2","sandboxing","zero-trust"],"exportEndpoints":{"claude":"/api/rules/wasm-component-wasi-p2-sandbox-guardrail?format=claude","cursorMdc":"/api/rules/wasm-component-wasi-p2-sandbox-guardrail?format=mdc","cursorrules":"/api/rules/wasm-component-wasi-p2-sandbox-guardrail?format=cursor","windsurf":"/api/rules/wasm-component-wasi-p2-sandbox-guardrail?format=windsurf","agents":"/api/rules/wasm-component-wasi-p2-sandbox-guardrail?format=agents"}},{"id":"cilium-ebpf-socket-mtls-enforcement","title":"Cilium eBPF Socket-Level Mutual TLS and Kernel Data-Path Enforcement","category":"devops","severity":"critical","description":"Enforces Cilium native eBPF socket-level mutual authentication and kernel-level wire encryption, eliminating the performance penalties of userspace Envoy sidecars. Guarantees cryptographic identity verification at the Linux kernel sockops layer while bypassing userspace context switches for ultra-low latency service mesh networking.","antiPatternHeadline":"Injecting Heavy Userspace Envoy Sidecars for Pod-to-Pod mTLS Instead of Kernel-Level eBPF Socket Redirection","stars_count":46,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","cilium","ebpf","mtls","kubernetes","networking","spire"],"exportEndpoints":{"claude":"/api/rules/cilium-ebpf-socket-mtls-enforcement?format=claude","cursorMdc":"/api/rules/cilium-ebpf-socket-mtls-enforcement?format=mdc","cursorrules":"/api/rules/cilium-ebpf-socket-mtls-enforcement?format=cursor","windsurf":"/api/rules/cilium-ebpf-socket-mtls-enforcement?format=windsurf","agents":"/api/rules/cilium-ebpf-socket-mtls-enforcement?format=agents"}},{"id":"otel-baggage-sanitization-propagation-boundary","title":"OpenTelemetry W3C Baggage Header Sanitization and Trust-Boundary Propagation","category":"devops","severity":"critical","description":"Enforces strict trust boundaries, size budgets, and schema validation on W3C Baggage headers entering or exiting asynchronous message brokers (e.g., Kafka, RabbitMQ, SQS). Eliminates multitenant cross-contamination, PII leakage, and unbounded HTTP/broker header inflation vulnerabilities (HTTP 431 / broker message size rejection).","antiPatternHeadline":"Blind Passthrough of Unvalidated, Unbounded W3C Baggage Across Heterogeneous Message Brokers","stars_count":53,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","baggage","kafka","distributed-tracing","security"],"exportEndpoints":{"claude":"/api/rules/otel-baggage-sanitization-propagation-boundary?format=claude","cursorMdc":"/api/rules/otel-baggage-sanitization-propagation-boundary?format=mdc","cursorrules":"/api/rules/otel-baggage-sanitization-propagation-boundary?format=cursor","windsurf":"/api/rules/otel-baggage-sanitization-propagation-boundary?format=windsurf","agents":"/api/rules/otel-baggage-sanitization-propagation-boundary?format=agents"}},{"id":"react-19-server-actions-concurrent-optimistic-rollback-standard","title":"React 19 Server Actions Concurrent Optimistic Rollback Standard","category":"frontend","severity":"critical","description":"Enforces deterministic state reconciliation and eliminates race-condition tearing across multiplexed React 19 Server Actions. Guarantees that concurrent out-of-order server responses discard stale acknowledgments and preserve in-flight optimistic projections using monotonic sequence tags. Prevents cascading rollback anomalies when rapid sequential mutations resolve non-deterministically.","antiPatternHeadline":"Out-of-Order Optimistic State Tearing via Unsequenced Server Action Mutations","stars_count":85,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","server-actions","useOptimistic","concurrency","state-reconciliation"],"exportEndpoints":{"claude":"/api/rules/react-19-server-actions-concurrent-optimistic-rollback-standard?format=claude","cursorMdc":"/api/rules/react-19-server-actions-concurrent-optimistic-rollback-standard?format=mdc","cursorrules":"/api/rules/react-19-server-actions-concurrent-optimistic-rollback-standard?format=cursor","windsurf":"/api/rules/react-19-server-actions-concurrent-optimistic-rollback-standard?format=windsurf","agents":"/api/rules/react-19-server-actions-concurrent-optimistic-rollback-standard?format=agents"}},{"id":"nextjs-ppr-edge-hole-cache-stampede-guardrail","title":"Next.js 15 PPR Dynamic Streaming Hole Cache-Stampede Guardrail","category":"frontend","severity":"critical","description":"Enforces deterministic request coalescing, multi-tiered cache invalidation, and circuit-breaker fallbacks on dynamic streaming holes in Next.js 15 Partial Prerendering (PPR). Prevents downstream microservice saturation caused by dog-piling / cache stampedes during high-concurrency cold-starts and edge CDN cache misses.","antiPatternHeadline":"Unmemoized Direct Upstream Service Invocations Inside Uncached PPR Dynamic Holes","stars_count":59,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs15","ppr","cache-stampede","streaming","edge-computing","concurrency"],"exportEndpoints":{"claude":"/api/rules/nextjs-ppr-edge-hole-cache-stampede-guardrail?format=claude","cursorMdc":"/api/rules/nextjs-ppr-edge-hole-cache-stampede-guardrail?format=mdc","cursorrules":"/api/rules/nextjs-ppr-edge-hole-cache-stampede-guardrail?format=cursor","windsurf":"/api/rules/nextjs-ppr-edge-hole-cache-stampede-guardrail?format=windsurf","agents":"/api/rules/nextjs-ppr-edge-hole-cache-stampede-guardrail?format=agents"}},{"id":"postgres-17-failover-slot-sync-cdc-invariant","title":"Postgres 17 Failover Slot Sync Invariant for Resilient Logical CDC","category":"backend","severity":"critical","description":"Enforces PostgreSQL 17 failover-enabled logical replication slots and synchronized standby slot topologies across active change-data-capture (CDC) pipelines. Eliminates data loss, stream dropouts, and unbounded duplicate replays during automated physical replica promotions.","antiPatternHeadline":"Creating Unsynchronized Logical Replication Slots Without Standby WAL Anchors and Failover Flags","stars_count":64,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres-17","cdc","logical-replication","failover","infrastructure-as-code"],"exportEndpoints":{"claude":"/api/rules/postgres-17-failover-slot-sync-cdc-invariant?format=claude","cursorMdc":"/api/rules/postgres-17-failover-slot-sync-cdc-invariant?format=mdc","cursorrules":"/api/rules/postgres-17-failover-slot-sync-cdc-invariant?format=cursor","windsurf":"/api/rules/postgres-17-failover-slot-sync-cdc-invariant?format=windsurf","agents":"/api/rules/postgres-17-failover-slot-sync-cdc-invariant?format=agents"}},{"id":"pgvector-hnsw-iterative-scan-rls-guardrail","title":"pgvector 0.8 HNSW Iterative Scan Bounded Multi-Tenant RLS Isolation","category":"backend","severity":"critical","description":"Mandates explicit iterative scan configuration (hnsw.iterative_scan and hnsw.max_scan_tuples) and tenant partitioning bounds when performing approximate nearest-neighbor searches under Row-Level Security (RLS). Prevents post-filtering graph starvation, unbounded index traversal latency spikes, and silent query truncation in multi-tenant vector workloads.","antiPatternHeadline":"Executing unconstrained HNSW vector queries against RLS-protected tables without iterative scan tuning and tuple traversal budgets","stars_count":75,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","pgvector","hnsw","rls","multi-tenant","vector-search"],"exportEndpoints":{"claude":"/api/rules/pgvector-hnsw-iterative-scan-rls-guardrail?format=claude","cursorMdc":"/api/rules/pgvector-hnsw-iterative-scan-rls-guardrail?format=mdc","cursorrules":"/api/rules/pgvector-hnsw-iterative-scan-rls-guardrail?format=cursor","windsurf":"/api/rules/pgvector-hnsw-iterative-scan-rls-guardrail?format=windsurf","agents":"/api/rules/pgvector-hnsw-iterative-scan-rls-guardrail?format=agents"}},{"id":"go-chi-http3-early-data-anti-replay-go-chi-http-3-0--597","title":"Go Chi HTTP/3 0-RTT Early-Data Anti-Replay Idempotency Standard","category":"backend","severity":"critical","description":"Enforces strict rejection of non-idempotent HTTP methods in QUIC/HTTP/3 0-RTT early data and mandates distributed replay cache verification for permissible early requests. Protects state-mutating handlers from double-execution vulnerabilities caused by network-level packet replication or passive eavesdropper replays during TLS 1.3/QUIC connection resumption.","antiPatternHeadline":"Executing state-mutating operations or unverified idempotent calls over HTTP/3 0-RTT early data","stars_count":43,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","chi","quic","http3","zero-rtt","security","idempotency"],"exportEndpoints":{"claude":"/api/rules/go-chi-http3-early-data-anti-replay-go-chi-http-3-0--597?format=claude","cursorMdc":"/api/rules/go-chi-http3-early-data-anti-replay-go-chi-http-3-0--597?format=mdc","cursorrules":"/api/rules/go-chi-http3-early-data-anti-replay-go-chi-http-3-0--597?format=cursor","windsurf":"/api/rules/go-chi-http3-early-data-anti-replay-go-chi-http-3-0--597?format=windsurf","agents":"/api/rules/go-chi-http3-early-data-anti-replay-go-chi-http-3-0--597?format=agents"}},{"id":"tauri-v2-mobile-multi-webview-memory-eviction","title":"Tauri 2.0 Mobile Multi-WebView Memory Pressure Dynamic Eviction Guardrail","category":"mobile","severity":"critical","description":"Enforces deterministic lifecycle-aware state hydration and background WKWebView/Android WebView eviction in Tauri 2.0 multi-webview mobile architectures. Prevents aggressive OS watchdog termination (iOS Jetsam/EXC_RESOURCE and Android LMK kill) by intercepting native memory pressure notifications, persisting ephemeral DOM state to IndexedDB/Rust disk stores, and tearing down detached WebViews prior to background suspension.","antiPatternHeadline":"Retaining Multiple Active WebViews in Background Triggers Immediate OS Watchdog Termination","stars_count":91,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri-2.0","memory-management","wkwebview","android-webview","lifecycle"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-mobile-multi-webview-memory-eviction?format=claude","cursorMdc":"/api/rules/tauri-v2-mobile-multi-webview-memory-eviction?format=mdc","cursorrules":"/api/rules/tauri-v2-mobile-multi-webview-memory-eviction?format=cursor","windsurf":"/api/rules/tauri-v2-mobile-multi-webview-memory-eviction?format=windsurf","agents":"/api/rules/tauri-v2-mobile-multi-webview-memory-eviction?format=agents"}},{"id":"oauth21-sender-constrained-dpop-key-rotation","title":"OAuth 2.1 Sender-Constrained DPoP Proof & Key-Rotation Enforcement","category":"security","severity":"critical","description":"Enforces RFC 9449 Demonstrating Proof-of-Possession (DPoP) at the HTTP client and resource server boundary to prevent token theft and replay attacks. Requires ephemeral, asymmetric hardware-backed or WebCrypto key pairs rotated per session or risk threshold, binding every access and refresh token to a cryptographic key thumbprint (jkt).","antiPatternHeadline":"Falling back to bearer tokens or reusing static, non-rotated private keys without jti replay verification and URI/method binding.","stars_count":59,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","oauth2.1","dpop","cryptography","rfc9449","jwt"],"exportEndpoints":{"claude":"/api/rules/oauth21-sender-constrained-dpop-key-rotation?format=claude","cursorMdc":"/api/rules/oauth21-sender-constrained-dpop-key-rotation?format=mdc","cursorrules":"/api/rules/oauth21-sender-constrained-dpop-key-rotation?format=cursor","windsurf":"/api/rules/oauth21-sender-constrained-dpop-key-rotation?format=windsurf","agents":"/api/rules/oauth21-sender-constrained-dpop-key-rotation?format=agents"}},{"id":"envoy-wasm-openfga-batch-pipeline","title":"Non-Blocking WASM OpenFGA Batch Evaluation Pipeline Standard","category":"security","severity":"critical","description":"Enforces non-blocking, batched fine-grained authorization lookups within Envoy Proxy WASM filters interfacing with OpenFGA. Eliminates L7 worker event loop stalling and ephemeral socket depletion by channeling concurrent check tuples through unified gRPC/HTTP/2 multiplexed streams over local Envoy cluster sockets using asynchronous dispatch hooks rather than inline synchronous or unbounded discrete subrequests.","antiPatternHeadline":"Synchronous discrete HTTP dispatch per authorization tuple on Envoy worker threads causing thread lock and socket exhaustion","stars_count":114,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","envoy","wasm","openfga","authorization","performance"],"exportEndpoints":{"claude":"/api/rules/envoy-wasm-openfga-batch-pipeline?format=claude","cursorMdc":"/api/rules/envoy-wasm-openfga-batch-pipeline?format=mdc","cursorrules":"/api/rules/envoy-wasm-openfga-batch-pipeline?format=cursor","windsurf":"/api/rules/envoy-wasm-openfga-batch-pipeline?format=windsurf","agents":"/api/rules/envoy-wasm-openfga-batch-pipeline?format=agents"}},{"id":"cilium-ebpf-pmtu-mss-clamping-standard","title":"Cilium eBPF Dynamic PMTU Discovery and MSS Clamping Standard","category":"devops","severity":"critical","description":"Enforces deterministic Maximum Transmission Unit (MTU) calculations and TCP Maximum Segment Size (MSS) clamping inside Cilium eBPF datapath configurations. Prevents silent ICMP 'Packet Too Big' black-holing across heterogeneous multi-cloud transit networks with nested Geneve encapsulation and WireGuard node-to-node encryption overlays.","antiPatternHeadline":"Hardcoding default 1500 or 9000 byte MTU across nested WireGuard/Geneve overlays without dynamic MSS clamping and PMTU ICMP reflection.","stars_count":79,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","cilium","ebpf","networking","kubernetes","wireguard","geneve"],"exportEndpoints":{"claude":"/api/rules/cilium-ebpf-pmtu-mss-clamping-standard?format=claude","cursorMdc":"/api/rules/cilium-ebpf-pmtu-mss-clamping-standard?format=mdc","cursorrules":"/api/rules/cilium-ebpf-pmtu-mss-clamping-standard?format=cursor","windsurf":"/api/rules/cilium-ebpf-pmtu-mss-clamping-standard?format=windsurf","agents":"/api/rules/cilium-ebpf-pmtu-mss-clamping-standard?format=agents"}},{"id":"otel-dynamic-head-sampling-p99-escalation-production-standard","title":"OTel Collector Dynamic Head Sampling with P99 Latency Escalation Architecture","category":"devops","severity":"critical","description":"Enforces a two-tier OpenTelemetry Collector architecture combining dynamic head-based probabilistic sampling at the edge with deterministic P99 tail latency escalation. Guarantees 100% capture of distributed trace anomalies without risking edge agent memory exhaustion or buffer drops during traffic bursts.","antiPatternHeadline":"Unbounded Edge Buffering and Static Head Sampling Dropping P99 Tail Latency Traces","stars_count":58,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","tail-sampling","observability","distributed-tracing","resilience"],"exportEndpoints":{"claude":"/api/rules/otel-dynamic-head-sampling-p99-escalation-production-standard?format=claude","cursorMdc":"/api/rules/otel-dynamic-head-sampling-p99-escalation-production-standard?format=mdc","cursorrules":"/api/rules/otel-dynamic-head-sampling-p99-escalation-production-standard?format=cursor","windsurf":"/api/rules/otel-dynamic-head-sampling-p99-escalation-production-standard?format=windsurf","agents":"/api/rules/otel-dynamic-head-sampling-p99-escalation-production-standard?format=agents"}},{"id":"nextjs-15-ppr-dynamic-streaming-invariant","title":"Next.js 15 Partial Prerendering (PPR) Shell & Suspense Hole Isolation Invariant","category":"frontend","severity":"critical","description":"Enforces strict architectural separation between the static prerendered HTML shell and dynamic runtime streaming holes in Next.js 15 PPR. Mandates that all dynamic data access—including cookies, headers, uncached database queries, and searchParams—is encapsulated inside dedicated React Suspense boundaries to preserve edge static generation and guarantee sub-50ms TTFB at enterprise scale.","antiPatternHeadline":"Dynamic Contamination of Static Shell Collapsing Route to Full SSR","stars_count":80,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs15","ppr","react19","performance","streaming","suspense"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-ppr-dynamic-streaming-invariant?format=claude","cursorMdc":"/api/rules/nextjs-15-ppr-dynamic-streaming-invariant?format=mdc","cursorrules":"/api/rules/nextjs-15-ppr-dynamic-streaming-invariant?format=cursor","windsurf":"/api/rules/nextjs-15-ppr-dynamic-streaming-invariant?format=windsurf","agents":"/api/rules/nextjs-15-ppr-dynamic-streaming-invariant?format=agents"}},{"id":"svelte-5-runes-mutation-effect-boundary","title":"Svelte 5 Runes Signal Mutation & Effect Isolation Boundary","category":"frontend","severity":"critical","description":"Enforces unidirectional reactive state transitions in Svelte 5 by strictly prohibiting synchronous state mutations inside $derived runes, $effect primitives, and render paths. Guarantees deterministic fine-grained reactive state propagation while strictly preventing circular dependency cascades across enterprise component libraries.","antiPatternHeadline":"Reactive Loop Cascade via Cyclical Signal Mutation inside Svelte 5 Effects and Computed Proxies","stars_count":78,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","reactivity","signals","state-management"],"exportEndpoints":{"claude":"/api/rules/svelte-5-runes-mutation-effect-boundary?format=claude","cursorMdc":"/api/rules/svelte-5-runes-mutation-effect-boundary?format=mdc","cursorrules":"/api/rules/svelte-5-runes-mutation-effect-boundary?format=cursor","windsurf":"/api/rules/svelte-5-runes-mutation-effect-boundary?format=windsurf","agents":"/api/rules/svelte-5-runes-mutation-effect-boundary?format=agents"}},{"id":"axum-0-8-zero-copy-streaming-tower-pipeline","title":"Axum 0.8 Zero-Copy Streaming and Backpressured Tower Service Invariants","category":"backend","severity":"critical","description":"Enforces zero-allocation and bounded-memory streaming pipelines in Axum 0.8 microservices handling multi-gigabit workloads. Mandates explicit frame-based backpressure across Tower layers and strictly forbids buffering unbounded bodies into contiguous memory allocations. Guarantees constant memory consumption regardless of payload size under heavy concurrent ingress.","antiPatternHeadline":"Buffering Unbounded Request Payloads into Contiguous Buffers Without Flow Control","stars_count":64,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tower","tokio","zero-copy","streaming"],"exportEndpoints":{"claude":"/api/rules/axum-0-8-zero-copy-streaming-tower-pipeline?format=claude","cursorMdc":"/api/rules/axum-0-8-zero-copy-streaming-tower-pipeline?format=mdc","cursorrules":"/api/rules/axum-0-8-zero-copy-streaming-tower-pipeline?format=cursor","windsurf":"/api/rules/axum-0-8-zero-copy-streaming-tower-pipeline?format=windsurf","agents":"/api/rules/axum-0-8-zero-copy-streaming-tower-pipeline?format=agents"}},{"id":"fastapi-python-313-nogil-concurrency-engine","title":"FastAPI Python 3.13 Free-Threaded Concurrency and Memory Model Standards","category":"backend","severity":"critical","description":"Enforces strict thread-safety, zero-copy memory patterns, and non-blocking scheduling for FastAPI services deployed on Python 3.13 free-threaded (python3.13t, No-GIL) builds. Prevents race conditions on shared mutable structures and thread starvation caused by blocking the ASGI event loop with CPU-bound vector computations.","antiPatternHeadline":"Mutating shared Python collections across concurrent threads and running CPU-bound workloads directly on the uvloop event loop","stars_count":69,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","python-3-13","no-gil","multithreading","concurrency","performance"],"exportEndpoints":{"claude":"/api/rules/fastapi-python-313-nogil-concurrency-engine?format=claude","cursorMdc":"/api/rules/fastapi-python-313-nogil-concurrency-engine?format=mdc","cursorrules":"/api/rules/fastapi-python-313-nogil-concurrency-engine?format=cursor","windsurf":"/api/rules/fastapi-python-313-nogil-concurrency-engine?format=windsurf","agents":"/api/rules/fastapi-python-313-nogil-concurrency-engine?format=agents"}},{"id":"kmp-swift-coroutines-memory-isolation-guardrail","title":"KMP to Swift Memory Isolation and Coroutine Dispatch Bridge Invariants","category":"mobile","severity":"critical","description":"Prevents memory corruption, thread confinement violations, and runtime crashes when bridging Kotlin Coroutines/Flows with Swift async/await and GCD across Darwin runtimes. Enforces strict boundary dispatching via KMP-native wrappers, eliminating raw Objective-C interop pointer leaks and concurrent unconfined mutation of shared state.","antiPatternHeadline":"Unconfined Kotlin Flow Collection Across Swift Dispatch Queues Causing Native Heap Corruption","stars_count":41,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kmp","kotlin-multiplatform","swift","coroutines","concurrency","ios"],"exportEndpoints":{"claude":"/api/rules/kmp-swift-coroutines-memory-isolation-guardrail?format=claude","cursorMdc":"/api/rules/kmp-swift-coroutines-memory-isolation-guardrail?format=mdc","cursorrules":"/api/rules/kmp-swift-coroutines-memory-isolation-guardrail?format=cursor","windsurf":"/api/rules/kmp-swift-coroutines-memory-isolation-guardrail?format=windsurf","agents":"/api/rules/kmp-swift-coroutines-memory-isolation-guardrail?format=agents"}},{"id":"tauri2-scoped-ipc-capability-sandboxing-boundary","title":"Tauri 2.0 Scoped IPC Capability & Subprocess Sandboxing Boundary","category":"mobile","severity":"critical","description":"Enforces strict runtime capability contracts between WebView rendering contexts and native OS/subprocess APIs in Tauri 2.0 mobile architectures. Eliminates cross-origin execution risks, arbitrary shell access, and broad filesystem escape by mandating fine-grained capability sets, explicit remote URL origin access control, and validated command argument boundaries.","antiPatternHeadline":"Wildcard Capability Grants and Unsanitized Plugin Command Forwarding to Native Shells","stars_count":87,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri2","ipc-security","sandboxing","rust","capabilities"],"exportEndpoints":{"claude":"/api/rules/tauri2-scoped-ipc-capability-sandboxing-boundary?format=claude","cursorMdc":"/api/rules/tauri2-scoped-ipc-capability-sandboxing-boundary?format=mdc","cursorrules":"/api/rules/tauri2-scoped-ipc-capability-sandboxing-boundary?format=cursor","windsurf":"/api/rules/tauri2-scoped-ipc-capability-sandboxing-boundary?format=windsurf","agents":"/api/rules/tauri2-scoped-ipc-capability-sandboxing-boundary?format=agents"}},{"id":"openfga-rebac-batch-evaluation-pattern","title":"OpenFGA Sub-10ms Batch Authorization and Ephemeral Context Pattern","category":"security","severity":"critical","description":"Enforces high-throughput ReBAC evaluation patterns using OpenFGA by prohibiting iterative sequential checks and ephemeral write operations. Mandates client-side batching (`batchCheck`), contextual tuple injection, and strict fail-closed fallbacks to resolve complex relationship graph traversals within a sub-10ms latency budget.","antiPatternHeadline":"Sequential N+1 `client.check()` loops and transactional tuple writes for transient authorization state","stars_count":82,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","rebac","authorization","performance"],"exportEndpoints":{"claude":"/api/rules/openfga-rebac-batch-evaluation-pattern?format=claude","cursorMdc":"/api/rules/openfga-rebac-batch-evaluation-pattern?format=mdc","cursorrules":"/api/rules/openfga-rebac-batch-evaluation-pattern?format=cursor","windsurf":"/api/rules/openfga-rebac-batch-evaluation-pattern?format=windsurf","agents":"/api/rules/openfga-rebac-batch-evaluation-pattern?format=agents"}},{"id":"sigstore-keyless-slsa-provenance-production-standard","title":"Sigstore Keyless OIDC Attestation & SLSA v1.0 Provenance Verification","category":"security","severity":"critical","description":"Enforces cryptographically verifiable, keyless container signing and SLSA v1.0 provenance attestation across CI/CD and deployment admission gates. Prevents software supply-chain poisoning by requiring ephemeral Fulcio certificates bound to OIDC workload identities, Rekor transparency log inclusion proofs, and immutable image digest pinning.","antiPatternHeadline":"Signing artifacts with long-lived static private keys or deploying images without cryptographic SLSA v1.0 provenance and Rekor verification","stars_count":105,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","sigstore","cosign","slsa-provenance","supply-chain","oidc","containers"],"exportEndpoints":{"claude":"/api/rules/sigstore-keyless-slsa-provenance-production-standard?format=claude","cursorMdc":"/api/rules/sigstore-keyless-slsa-provenance-production-standard?format=mdc","cursorrules":"/api/rules/sigstore-keyless-slsa-provenance-production-standard?format=cursor","windsurf":"/api/rules/sigstore-keyless-slsa-provenance-production-standard?format=windsurf","agents":"/api/rules/sigstore-keyless-slsa-provenance-production-standard?format=agents"}},{"id":"opentelemetry-w3c-tracecontext-exemplar-correlation-invariant","title":"OpenTelemetry W3C TraceContext Ingestion & Exemplar Correlation Invariant","category":"devops","severity":"critical","description":"Enforces strict extraction and propagation of W3C TraceContext headers ('traceparent' and 'tracestate') across polyglot boundaries while guaranteeing active spans attach TraceID and SpanID as exemplars to Prometheus/OpenMetrics histograms. Eliminates distributed diagnostic blindspots by ensuring 100% correlation between tail-latency metric excursions and corresponding distributed trace spans.","antiPatternHeadline":"Unlinked Metric Anomalies from Stripped Trace Headers and Missing Exemplar Context","stars_count":89,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","distributed-tracing","w3c-tracecontext","metrics","exemplars","observability"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-w3c-tracecontext-exemplar-correlation-invariant?format=claude","cursorMdc":"/api/rules/opentelemetry-w3c-tracecontext-exemplar-correlation-invariant?format=mdc","cursorrules":"/api/rules/opentelemetry-w3c-tracecontext-exemplar-correlation-invariant?format=cursor","windsurf":"/api/rules/opentelemetry-w3c-tracecontext-exemplar-correlation-invariant?format=windsurf","agents":"/api/rules/opentelemetry-w3c-tracecontext-exemplar-correlation-invariant?format=agents"}},{"id":"svelte-5-effect-disposer-bounds","title":"Svelte 5 Runes Fine-Grained Effect Disposer Bounds & Teardown Lifecycle","category":"frontend","severity":"critical","description":"Enforces strict cleanup contracts and scope boundaries for Svelte 5 $effect and $effect.pre runes within high-frequency streaming dashboards. Guarantees that dynamically mounted DOM branch transitions and reactive subscription switches explicitly return teardown disposers to prevent catastrophic detached DOM and WebSocket listener leaks.","antiPatternHeadline":"Unbounded Async Side-Effects and Missing Teardown Disposers in Svelte 5 $effect Runes","stars_count":58,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","reactivity","memory-leaks","performance"],"exportEndpoints":{"claude":"/api/rules/svelte-5-effect-disposer-bounds?format=claude","cursorMdc":"/api/rules/svelte-5-effect-disposer-bounds?format=mdc","cursorrules":"/api/rules/svelte-5-effect-disposer-bounds?format=cursor","windsurf":"/api/rules/svelte-5-effect-disposer-bounds?format=windsurf","agents":"/api/rules/svelte-5-effect-disposer-bounds?format=agents"}},{"id":"bun-multi-worker-sqlite-wal-concurrency","title":"Bun 1.2 Multi-Worker SQLite WAL Concurrency Isolation & Busy Timeout Guardrail","category":"backend","severity":"critical","description":"Ensures transaction serializability and prevents thread-locking stalls across clustered Bun workers executing concurrent read-write transactions on embedded SQLite. Mandates Write-Ahead Logging (WAL) configuration, explicit busy timeouts, immediate transactions for mutations, and proper resource disposal to avoid database lock contention (SQLITE_BUSY). Prevents event-loop thread blocking and process deadlocks across separate OS processes or web workers accessing shared SQLite database files.","antiPatternHeadline":"Unbounded Event-Loop Starvation via Default Deferred Transactions and Missing WAL Busy Handlers in Multi-Worker Bun","stars_count":97,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","sqlite","concurrency","wal","transactions","event-loop"],"exportEndpoints":{"claude":"/api/rules/bun-multi-worker-sqlite-wal-concurrency?format=claude","cursorMdc":"/api/rules/bun-multi-worker-sqlite-wal-concurrency?format=mdc","cursorrules":"/api/rules/bun-multi-worker-sqlite-wal-concurrency?format=cursor","windsurf":"/api/rules/bun-multi-worker-sqlite-wal-concurrency?format=windsurf","agents":"/api/rules/bun-multi-worker-sqlite-wal-concurrency?format=agents"}},{"id":"go-chi-context-aware-inflight-request-draining","title":"Deterministic Request Draining and Bounded Context Propagation in Go Chi","category":"backend","severity":"critical","description":"Enforces bounded lifecycle fencing and strict context propagation across Go Chi middleware pipelines during rolling pod terminations. Guarantees in-flight HTTP requests complete within a bounded grace period while rejecting ingress traffic and preventing uncoordinated goroutine abandonment during SIGTERM events.","antiPatternHeadline":"Hard Server Teardown and Unbounded Detached Goroutines Causing Dropped Edge Connections During Rolling Updates","stars_count":112,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","chi","graceful-shutdown","context-propagation","zero-downtime"],"exportEndpoints":{"claude":"/api/rules/go-chi-context-aware-inflight-request-draining?format=claude","cursorMdc":"/api/rules/go-chi-context-aware-inflight-request-draining?format=mdc","cursorrules":"/api/rules/go-chi-context-aware-inflight-request-draining?format=cursor","windsurf":"/api/rules/go-chi-context-aware-inflight-request-draining?format=windsurf","agents":"/api/rules/go-chi-context-aware-inflight-request-draining?format=agents"}},{"id":"fastapi-pydantic-v2-zerocopy-streaming","title":"FastAPI with Pydantic v2 Zero-Copy Serialization Streaming Standard","category":"backend","severity":"critical","description":"Enforces direct streaming serialization using Pydantic v2's Rust-backed engine (pydantic-core) and chunked byte generators for large JSON payloads. Eliminates multi-gigabyte heap allocations and Python GIL stalls by bypassing Starlette's default intermediate dict materialization.","antiPatternHeadline":"In-Memory Materialization of Bulk Model Collections via Default FastAPI response_model","stars_count":59,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","pydantic-v2","memory-management","streaming","performance"],"exportEndpoints":{"claude":"/api/rules/fastapi-pydantic-v2-zerocopy-streaming?format=claude","cursorMdc":"/api/rules/fastapi-pydantic-v2-zerocopy-streaming?format=mdc","cursorrules":"/api/rules/fastapi-pydantic-v2-zerocopy-streaming?format=cursor","windsurf":"/api/rules/fastapi-pydantic-v2-zerocopy-streaming?format=windsurf","agents":"/api/rules/fastapi-pydantic-v2-zerocopy-streaming?format=agents"}},{"id":"capacitor-7-biometric-enclave-attestation-standard","title":"Capacitor 7 Secure Enclave Hardware-Attested Token Binding Guardrail","category":"mobile","severity":"critical","description":"Enforces hardware-backed cryptographic token binding across the Capacitor 7 JavaScript-to-Native bridge. Mandates that authentication sessions derive from non-extractable Secure Enclave/Android Keystore asymmetric keys gated by biometric prompts, preventing session hijacking via malicious WebView inspection, cross-site scripting (XSS), or compromised local storage.","antiPatternHeadline":"Persisting Raw Bearer Tokens in WebView Storage Without Hardware-Backed Cryptographic Attestation","stars_count":87,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","ios-secure-enclave","android-keystore","cryptography","dpop","biometrics"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-biometric-enclave-attestation-standard?format=claude","cursorMdc":"/api/rules/capacitor-7-biometric-enclave-attestation-standard?format=mdc","cursorrules":"/api/rules/capacitor-7-biometric-enclave-attestation-standard?format=cursor","windsurf":"/api/rules/capacitor-7-biometric-enclave-attestation-standard?format=windsurf","agents":"/api/rules/capacitor-7-biometric-enclave-attestation-standard?format=agents"}},{"id":"opentelemetry-baggage-boundary-sanitization-production-standard","title":"OpenTelemetry W3C Baggage Ingress Boundary Sanitization & Schema Filtering","category":"devops","severity":"critical","description":"Enforces strict allowlist validation, key-name regex filtering, and byte-length caps on incoming W3C Baggage headers at API gateways and service ingress boundaries. Prevents cross-tenant context injection, downstream PII/credential leaks into telemetry sinks, and HTTP 431 header bloat attacks.","antiPatternHeadline":"Unvalidated W3C Baggage Ingestion Permitting PII Propagation and Header Bloat","stars_count":48,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","distributed-tracing","security","data-protection","pii"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-baggage-boundary-sanitization-production-standard?format=claude","cursorMdc":"/api/rules/opentelemetry-baggage-boundary-sanitization-production-standard?format=mdc","cursorrules":"/api/rules/opentelemetry-baggage-boundary-sanitization-production-standard?format=cursor","windsurf":"/api/rules/opentelemetry-baggage-boundary-sanitization-production-standard?format=windsurf","agents":"/api/rules/opentelemetry-baggage-boundary-sanitization-production-standard?format=agents"}},{"id":"nextjs-15-taint-boundaries-and-sensitive-closure-isolation","title":"Next.js 15 Server Action Taint Boundaries & Sensitive Closure Isolation","category":"frontend","severity":"critical","description":"Enforces strict runtime assertions using React's experimental_taintObjectReference and experimental_taintUniqueValue to prevent cryptographic credentials, secret tokens, and sensitive tenant metadata from crossing the server-to-client serialization boundary. Prevents accidental closure captures in Next.js 15 Server Actions and Server Components by enforcing explicit data transfer objects (DTOs) and taint registry invocations on hydrated entities.","antiPatternHeadline":"Leaking Ambient Secrets, Database Records, or Auth Tokens Across Server-to-Client Serialization Boundaries via Closure Capture","stars_count":47,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["nextjs-15","react-server-components","server-actions","security","taint-api","zero-trust"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-taint-boundaries-and-sensitive-closure-isolation?format=claude","cursorMdc":"/api/rules/nextjs-15-taint-boundaries-and-sensitive-closure-isolation?format=mdc","cursorrules":"/api/rules/nextjs-15-taint-boundaries-and-sensitive-closure-isolation?format=cursor","windsurf":"/api/rules/nextjs-15-taint-boundaries-and-sensitive-closure-isolation?format=windsurf","agents":"/api/rules/nextjs-15-taint-boundaries-and-sensitive-closure-isolation?format=agents"}},{"id":"axum-tower-cancellation-connection-draining-protocol","title":"Axum 0.8 Tower Cancellation Propagation and Connection Draining Protocol","category":"backend","severity":"critical","description":"Enforces cooperative cancellation propagation, TaskTracker-bound asynchronous lifecycles, and deterministic connection draining in Axum 0.8 applications. Prevents dropped multiplexed HTTP/3 and HTTP/2 streams and incomplete database mutations during rolling updates.","antiPatternHeadline":"Detaching unmonitored Tokio tasks and terminating runtimes abruptly without signaling GOAWAY frames or awaiting TaskTracker completion.","stars_count":81,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tokio","tower","http3","graceful-shutdown"],"exportEndpoints":{"claude":"/api/rules/axum-tower-cancellation-connection-draining-protocol?format=claude","cursorMdc":"/api/rules/axum-tower-cancellation-connection-draining-protocol?format=mdc","cursorrules":"/api/rules/axum-tower-cancellation-connection-draining-protocol?format=cursor","windsurf":"/api/rules/axum-tower-cancellation-connection-draining-protocol?format=windsurf","agents":"/api/rules/axum-tower-cancellation-connection-draining-protocol?format=agents"}},{"id":"postgres-17-pgvector-halfvec-bounded-indexing","title":"Postgres 17 pgvector Halfvec Quantization & Worker-Bounded Indexing Standard","category":"backend","severity":"critical","description":"Mandates 16-bit halfvec quantization over standard 32-bit vectors and establishes strictly bounded maintenance_work_mem alongside capped parallel maintenance workers. This prevents shared-buffer eviction cascades, memory exhaustion, and query pipeline stalls during continuous high-velocity LLM embedding upserts.","antiPatternHeadline":"Unquantized 32-bit Vector Storage with Unconstrained Parallel Maintenance Workers Inducing Buffer Cache Thrashing","stars_count":79,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres","pgvector","halfvec","indexing","performance"],"exportEndpoints":{"claude":"/api/rules/postgres-17-pgvector-halfvec-bounded-indexing?format=claude","cursorMdc":"/api/rules/postgres-17-pgvector-halfvec-bounded-indexing?format=mdc","cursorrules":"/api/rules/postgres-17-pgvector-halfvec-bounded-indexing?format=cursor","windsurf":"/api/rules/postgres-17-pgvector-halfvec-bounded-indexing?format=windsurf","agents":"/api/rules/postgres-17-pgvector-halfvec-bounded-indexing?format=agents"}},{"id":"go-1-24-weak-pointer-deterministic-cache-eviction","title":"Go 1.24 Weak Pointers and Cleanup-Driven Deterministic In-Memory Cache Eviction","category":"backend","severity":"critical","description":"Governs the use of Go 1.24 weak pointers (weak.Pointer) and runtime.AddCleanup within high-throughput Go Chi in-memory cache topologies. Replaces legacy runtime.SetFinalizer patterns and explicit stop-the-world eviction sweeps to eliminate GC pacing spikes, finalizer thread starvation, and cyclic reference memory leaks under extreme HTTP request concurrency.","antiPatternHeadline":"Legacy runtime.SetFinalizer and Strong Reference Maps Inducing GC Latency Spikes and Memory Leaks","stars_count":86,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","cache","concurrency","performance","go-1.24"],"exportEndpoints":{"claude":"/api/rules/go-1-24-weak-pointer-deterministic-cache-eviction?format=claude","cursorMdc":"/api/rules/go-1-24-weak-pointer-deterministic-cache-eviction?format=mdc","cursorrules":"/api/rules/go-1-24-weak-pointer-deterministic-cache-eviction?format=cursor","windsurf":"/api/rules/go-1-24-weak-pointer-deterministic-cache-eviction?format=windsurf","agents":"/api/rules/go-1-24-weak-pointer-deterministic-cache-eviction?format=agents"}},{"id":"svelte-5-async-effect-teardown-invariants","title":"Svelte 5 Runes Async Effect Teardown & Untracked Invariants","category":"frontend","severity":"critical","description":"Enforces synchronous cleanup registration in Svelte 5 $effect runes and explicit lifecycle cancellation boundaries. Prevents orphaned reactive subscriptions, uncollected event listeners, and post-unmount microtask race conditions caused by asynchronous effect callbacks.","antiPatternHeadline":"Passing Async Callbacks to $effect Runes and Omitting Synchronous Teardown Handlers","stars_count":40,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","reactivity","lifecycle","memory-leaks"],"exportEndpoints":{"claude":"/api/rules/svelte-5-async-effect-teardown-invariants?format=claude","cursorMdc":"/api/rules/svelte-5-async-effect-teardown-invariants?format=mdc","cursorrules":"/api/rules/svelte-5-async-effect-teardown-invariants?format=cursor","windsurf":"/api/rules/svelte-5-async-effect-teardown-invariants?format=windsurf","agents":"/api/rules/svelte-5-async-effect-teardown-invariants?format=agents"}},{"id":"webauthn-prf-deterministic-key-derivation","title":"Deterministic Client-Side Key Derivation via WebAuthn PRF Extension","category":"security","severity":"critical","description":"Standardizes client-side symmetric key derivation using the WebAuthn Pseudo-Random Function (PRF) extension (`eval` / `evalByCredential`). Mandates strict tenant-isolated HKDF chaining, in-memory isolation of derived root secrets, and zero transmission of derived keys or raw PRF outputs across transport layers.","antiPatternHeadline":"Leaking Raw PRF Outputs to Backend APIs or Directly Using PRF Output as Symmetric Cipher Keys Without Tenant-Scoped HKDF Expansion","stars_count":102,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","prf-extension","cryptography","hkdf","zero-knowledge"],"exportEndpoints":{"claude":"/api/rules/webauthn-prf-deterministic-key-derivation?format=claude","cursorMdc":"/api/rules/webauthn-prf-deterministic-key-derivation?format=mdc","cursorrules":"/api/rules/webauthn-prf-deterministic-key-derivation?format=cursor","windsurf":"/api/rules/webauthn-prf-deterministic-key-derivation?format=windsurf","agents":"/api/rules/webauthn-prf-deterministic-key-derivation?format=agents"}},{"id":"android-15-predictive-back-lifecycle-invariance","title":"Android 15 Predictive Back Navigation Lifecycle Invariance in Cross-Platform Shells","category":"mobile","severity":"critical","description":"Enforces strict two-phase commit protocols for Android 15 predictive back navigation across hybrid webviews, React Native, and Kotlin Multiplatform (KMP) navigation controllers. Mandates an isolated transaction snapshot and explicit rollback/commit lifecycle hooks before visual transition interpolations to prevent phantom state mutability and detached multi-stack drift.","antiPatternHeadline":"Optimistically Popping Internal Navigation Stacks During OnBackProgressed Animations","stars_count":112,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","android-15","predictive-back","kmp","react-native","navigation-lifecycle"],"exportEndpoints":{"claude":"/api/rules/android-15-predictive-back-lifecycle-invariance?format=claude","cursorMdc":"/api/rules/android-15-predictive-back-lifecycle-invariance?format=mdc","cursorrules":"/api/rules/android-15-predictive-back-lifecycle-invariance?format=cursor","windsurf":"/api/rules/android-15-predictive-back-lifecycle-invariance?format=windsurf","agents":"/api/rules/android-15-predictive-back-lifecycle-invariance?format=agents"}},{"id":"otel-w3c-baggage-tenant-boundary-sanitization","title":"OpenTelemetry W3C Baggage Multi-Tenant Boundary Sanitization and Cryptographic Verification","category":"devops","severity":"critical","description":"Enforces boundary-level sanitization and HMAC signing of W3C baggage headers at ingress gateways to prevent cross-tenant trace spoofing and telemetry privilege escalation. Downstream services must discard unverified contextual baggage and strictly accept tenant-scoped attributes extracted from authenticated identity claims. Prevents unauthorized tenant isolation bypasses occurring through distributed context propagation mechanisms.","antiPatternHeadline":"Blind Ingress Propagation of Untrusted W3C Baggage Headers Without Cryptographic Authentication","stars_count":109,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","w3c-baggage","multi-tenancy","api-gateway","security"],"exportEndpoints":{"claude":"/api/rules/otel-w3c-baggage-tenant-boundary-sanitization?format=claude","cursorMdc":"/api/rules/otel-w3c-baggage-tenant-boundary-sanitization?format=mdc","cursorrules":"/api/rules/otel-w3c-baggage-tenant-boundary-sanitization?format=cursor","windsurf":"/api/rules/otel-w3c-baggage-tenant-boundary-sanitization?format=windsurf","agents":"/api/rules/otel-w3c-baggage-tenant-boundary-sanitization?format=agents"}},{"id":"k8s-gateway-api-reference-grant-cross-namespace-invariants","title":"Enforce ReferenceGrant Invariants for Cross-Namespace Routing in Kubernetes Gateway API v1.2","category":"devops","severity":"critical","description":"Enforces strict validation of explicit ReferenceGrant resources when Gateway API routes (HTTPRoute, GRPCRoute, TLSRoute, TCPRoute, UDPRoute) traverse namespace boundaries to attach to Gateways or forward traffic to backend Services. Without explicit bidirectional trust established by a ReferenceGrant in the target namespace, controllers and reconcilers must immediately fail validation, drop unauthorized backend refs, and emit ResolvedRefs: False status conditions to eliminate cross-namespace route hijacking vulnerabilities in multi-tenant environments.","antiPatternHeadline":"Implicit Cross-Namespace Route Forwarding Without Explicit ReferenceGrant Mutual Authorization","stars_count":117,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","kubernetes","gateway-api","reference-grant","multi-tenancy","security-invariants"],"exportEndpoints":{"claude":"/api/rules/k8s-gateway-api-reference-grant-cross-namespace-invariants?format=claude","cursorMdc":"/api/rules/k8s-gateway-api-reference-grant-cross-namespace-invariants?format=mdc","cursorrules":"/api/rules/k8s-gateway-api-reference-grant-cross-namespace-invariants?format=cursor","windsurf":"/api/rules/k8s-gateway-api-reference-grant-cross-namespace-invariants?format=windsurf","agents":"/api/rules/k8s-gateway-api-reference-grant-cross-namespace-invariants?format=agents"}},{"id":"in-toto-cyclonedx-reproducible-build-attestation","title":"In-Toto v1.0 & CycloneDX 1.6 Cryptographic Build Reproducibility Verification","category":"security","severity":"critical","description":"Enforces strict bit-for-bit determinism validation across independent isolated build workers before publishing compiled artifacts to registries. Requires mutual cross-verification of CycloneDX 1.6 Cryptographic Bill of Materials (CBOM/SBOM) digests against signed in-toto v1.0 attestation envelopes containing hardware-rooted enclave measurements.","antiPatternHeadline":"Publishing Binaries Lacking Multi-Worker Determinism Consensus or Signed Hardware Attestation Envelopes","stars_count":54,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","supply-chain","in-toto","cyclonedx","reproducible-builds","attestation","dsse"],"exportEndpoints":{"claude":"/api/rules/in-toto-cyclonedx-reproducible-build-attestation?format=claude","cursorMdc":"/api/rules/in-toto-cyclonedx-reproducible-build-attestation?format=mdc","cursorrules":"/api/rules/in-toto-cyclonedx-reproducible-build-attestation?format=cursor","windsurf":"/api/rules/in-toto-cyclonedx-reproducible-build-attestation?format=windsurf","agents":"/api/rules/in-toto-cyclonedx-reproducible-build-attestation?format=agents"}},{"id":"nextjs-15-ppr-static-shell-isolation","title":"Next.js 15 PPR Boundary Static Shell Isolation and Layout Shift Prevention","category":"frontend","severity":"critical","description":"Enforces deterministic boundaries between edge-cacheable static shells and streamed dynamic subtrees in Next.js 15 Partial Prerendering (PPR). Guarantees sub-50ms TTFB by strictly isolating runtime dynamic operations (cookies, headers, searchParams, and uncached data) inside Suspense boundaries. Mandates dimensionally stable skeleton fallbacks to prevent Cumulative Layout Shift (CLS) during client-side hydration stalls.","antiPatternHeadline":"Uncontained Dynamic Entry Points Demoting Edge Static Shells to Server-Side Bottlenecks with Hydration Layout Shift","stars_count":70,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs","nextjs-15","ppr","react-suspense","performance","web-vitals"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-ppr-static-shell-isolation?format=claude","cursorMdc":"/api/rules/nextjs-15-ppr-static-shell-isolation?format=mdc","cursorrules":"/api/rules/nextjs-15-ppr-static-shell-isolation?format=cursor","windsurf":"/api/rules/nextjs-15-ppr-static-shell-isolation?format=windsurf","agents":"/api/rules/nextjs-15-ppr-static-shell-isolation?format=agents"}},{"id":"react-19-server-action-optimistic-rollback-idempotency-standard","title":"React 19 Server Action Optimistic State Rollback & Cryptographic Idempotency Standard","category":"frontend","severity":"critical","description":"Enforces cryptographically random client-generated idempotency tokens and transactional state reconciliation across all React 19 Server Actions paired with useOptimistic. Prevents duplicate backend mutations, ghost entities, and desynchronized local states during intermittent mobile network dropouts or retry storms.","antiPatternHeadline":"Un-reverted useOptimistic updates and bare Server Actions vulnerable to retry replay bugs and ghost state","stars_count":105,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","server-actions","useOptimistic","idempotency","distributed-state"],"exportEndpoints":{"claude":"/api/rules/react-19-server-action-optimistic-rollback-idempotency-standard?format=claude","cursorMdc":"/api/rules/react-19-server-action-optimistic-rollback-idempotency-standard?format=mdc","cursorrules":"/api/rules/react-19-server-action-optimistic-rollback-idempotency-standard?format=cursor","windsurf":"/api/rules/react-19-server-action-optimistic-rollback-idempotency-standard?format=windsurf","agents":"/api/rules/react-19-server-action-optimistic-rollback-idempotency-standard?format=agents"}},{"id":"postgres-17-logical-replication-slot-failover-lag-fencing","title":"Postgres 17 Logical Replication Failover Slot Synchronization & Lag Fencing Invariants","category":"backend","severity":"critical","description":"Enforces explicit failover-enabled logical replication slots (failover = true) and strict lag-fencing orchestration during automated physical standby promotions in PostgreSQL 17. Guarantees that CDC consumers and downstream event streams never suffer unrecoverable LSN divergence or silent message loss across multi-region failovers.","antiPatternHeadline":"Unfenced Standby Promotion with Desynchronized Logical Slots Leading to CDC Consumer Invalidation and Silent Data Divergence","stars_count":49,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql-17","logical-replication","cdc","high-availability","distributed-systems","failover"],"exportEndpoints":{"claude":"/api/rules/postgres-17-logical-replication-slot-failover-lag-fencing?format=claude","cursorMdc":"/api/rules/postgres-17-logical-replication-slot-failover-lag-fencing?format=mdc","cursorrules":"/api/rules/postgres-17-logical-replication-slot-failover-lag-fencing?format=cursor","windsurf":"/api/rules/postgres-17-logical-replication-slot-failover-lag-fencing?format=windsurf","agents":"/api/rules/postgres-17-logical-replication-slot-failover-lag-fencing?format=agents"}},{"id":"go-1-24-weak-pointer-swiss-table-cache-isolation","title":"Go 1.24 Weak Pointer & Swiss Table Cache Isolation Standard","category":"backend","severity":"critical","description":"Enforces memory isolation and zero-retention ephemeral caching using Go 1.24's native weak.Pointer and Swiss Table runtime map architecture. Prevents high-throughput multi-gigabit ingress buffers from escaping into tenured heap generations and triggering catastrophic Garbage Collection (GC) Mark-Sweep latency spikes.","antiPatternHeadline":"Pinning Ephemeral Payloads via Strong-Pointer Caches Triggering Millisecond GC Pause Degradation","stars_count":44,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","golang","go1.24","weak-pointers","swiss-tables","gc-optimization","high-throughput"],"exportEndpoints":{"claude":"/api/rules/go-1-24-weak-pointer-swiss-table-cache-isolation?format=claude","cursorMdc":"/api/rules/go-1-24-weak-pointer-swiss-table-cache-isolation?format=mdc","cursorrules":"/api/rules/go-1-24-weak-pointer-swiss-table-cache-isolation?format=cursor","windsurf":"/api/rules/go-1-24-weak-pointer-swiss-table-cache-isolation?format=windsurf","agents":"/api/rules/go-1-24-weak-pointer-swiss-table-cache-isolation?format=agents"}},{"id":"kmp-swift-export-arc-boundary-pinning","title":"Kotlin Multiplatform 2.1 Swift-Export ARC Boundary Pinning","category":"mobile","severity":"critical","description":"Enforces strict lifecycle management, explicit object pinning, and cycle decoupling across the Kotlin/Native and Apple Swift-Export ARC boundary in KMP 2.1+. Prevents catastrophic native heap corruption and undetectable retain cycles caused by bridge-crossing closures, strong delegate references, and implicit Kotlin StableRef handling under Swift Automatic Reference Counting.","antiPatternHeadline":"Implicit Bidirectional Retain Cycles and Premature Object Deallocation across Swift-Export Boundaries","stars_count":42,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","swift-export","arc","kotlin-native","memory-management"],"exportEndpoints":{"claude":"/api/rules/kmp-swift-export-arc-boundary-pinning?format=claude","cursorMdc":"/api/rules/kmp-swift-export-arc-boundary-pinning?format=mdc","cursorrules":"/api/rules/kmp-swift-export-arc-boundary-pinning?format=cursor","windsurf":"/api/rules/kmp-swift-export-arc-boundary-pinning?format=windsurf","agents":"/api/rules/kmp-swift-export-arc-boundary-pinning?format=agents"}},{"id":"capacitor-7-secure-enclave-crypto-isolation","title":"Capacitor 7 Secure Enclave Direct-Memory Cryptographic Isolation","category":"mobile","severity":"critical","description":"Enforces strict native memory isolation for hardware-backed cryptographic operations across the Capacitor 7 bridge. High-entropy key material and biometric credentials must remain locked within iOS Secure Enclave (kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly) or Android StrongBox KeyStore, prohibiting serialization or leakage of private keys into the V8 or JavaScriptCore webview heap.","antiPatternHeadline":"Exposing Raw Private Keys or Biometric Secrets to the Capacitor JavaScript Webview Heap","stars_count":86,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor-7","secure-enclave","cryptography","keychain","strongbox"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-secure-enclave-crypto-isolation?format=claude","cursorMdc":"/api/rules/capacitor-7-secure-enclave-crypto-isolation?format=mdc","cursorrules":"/api/rules/capacitor-7-secure-enclave-crypto-isolation?format=cursor","windsurf":"/api/rules/capacitor-7-secure-enclave-crypto-isolation?format=windsurf","agents":"/api/rules/capacitor-7-secure-enclave-crypto-isolation?format=agents"}},{"id":"openfga-rebac-causal-consistency-standard","title":"OpenFGA ReBAC Causal Consistency & Tuple Transactional Invalidation Standard","category":"security","severity":"critical","description":"Enforces strict causal ordering and read-after-write consistency between relational database transactions and OpenFGA relationship tuple mutations. Eliminates privilege-escalation and authorization bypass race conditions by prohibiting fire-and-forget tuple updates, stale authorization cache reads, and unsequenced check operations. Mandates the transactional outbox pattern or dual-phase commit coordination with consistent token propagation across all ReBAC evaluations.","antiPatternHeadline":"Dual-Write Race Conditions and Eventual Inconsistency Permitting Privilege Escalation During Tuple Invalidation","stars_count":41,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","rebac","authorization","concurrency","distributed-systems","outbox-pattern"],"exportEndpoints":{"claude":"/api/rules/openfga-rebac-causal-consistency-standard?format=claude","cursorMdc":"/api/rules/openfga-rebac-causal-consistency-standard?format=mdc","cursorrules":"/api/rules/openfga-rebac-causal-consistency-standard?format=cursor","windsurf":"/api/rules/openfga-rebac-causal-consistency-standard?format=windsurf","agents":"/api/rules/openfga-rebac-causal-consistency-standard?format=agents"}},{"id":"rfc-9449-dpop-ephemeral-attestation-standard","title":"RFC 9449 DPoP Sender-Constrained Token Attestation & Ephemeral Proof Validation","category":"security","severity":"critical","description":"Mandates end-to-end cryptographic binding of OAuth 2.0 access and refresh tokens to client-held private keys via RFC 9449 DPoP proofs. Eliminates bearer token theft, exfiltration, and replay attacks by enforcing asymmetric key attestation, access token hash (ath) binding, HTTP method/URI parity, and strict single-use jti validation. Prohibits fallback to unconstrained bearer tokens and prevents DPoP proof caching across distinct HTTP requests.","antiPatternHeadline":"Accepting Unbound Bearer Tokens or Reusing Static DPoP Proofs Without ath, htm/htu, and jti Verification","stars_count":55,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","oauth2","dpop","rfc9449","sender-constrained","cryptography","zero-trust"],"exportEndpoints":{"claude":"/api/rules/rfc-9449-dpop-ephemeral-attestation-standard?format=claude","cursorMdc":"/api/rules/rfc-9449-dpop-ephemeral-attestation-standard?format=mdc","cursorrules":"/api/rules/rfc-9449-dpop-ephemeral-attestation-standard?format=cursor","windsurf":"/api/rules/rfc-9449-dpop-ephemeral-attestation-standard?format=windsurf","agents":"/api/rules/rfc-9449-dpop-ephemeral-attestation-standard?format=agents"}},{"id":"cilium-ebpf-ambient-mesh-socket-mtls-standard","title":"Cilium eBPF Ambient Mesh Socket-Level L4/L7 Mutual TLS Interception Standard","category":"devops","severity":"critical","description":"Enforces sidecar-free ambient service mesh architecture utilizing Cilium eBPF socket-layer redirection (sockops/sk_msg) and transparent kernel encryption. Eliminates sidecar memory footprint and latency penalties while guaranteeing continuous cryptographic workload attestation via SPIRE/SPIFFE and automated L4/L7 mutual TLS interception.","antiPatternHeadline":"Injecting User-Space Proxy Sidecars and Bypassing Socket-Level eBPF Acceleration","stars_count":104,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","cilium","ebpf","service-mesh","mtls","spiffe","kubernetes","zero-trust"],"exportEndpoints":{"claude":"/api/rules/cilium-ebpf-ambient-mesh-socket-mtls-standard?format=claude","cursorMdc":"/api/rules/cilium-ebpf-ambient-mesh-socket-mtls-standard?format=mdc","cursorrules":"/api/rules/cilium-ebpf-ambient-mesh-socket-mtls-standard?format=cursor","windsurf":"/api/rules/cilium-ebpf-ambient-mesh-socket-mtls-standard?format=windsurf","agents":"/api/rules/cilium-ebpf-ambient-mesh-socket-mtls-standard?format=agents"}},{"id":"argocd-oci-digest-ephemeral-sync-fence","title":"ArgoCD Immutable OCI Artifact Digest Drift-Detection & Ephemeral Sync Fence","category":"devops","severity":"critical","description":"Enforces immutable OCI-packaged Helm chart deployments strictly pinned to cryptographic sha256 digests in ArgoCD Application CRDs. Prevents supply chain tampering, non-deterministic drift, and unverified mutation by establishing pre-sync ephemeral admission fences and blocking mutable semantic version tags in reconciliation loops.","antiPatternHeadline":"Tracking Mutable OCI Helm Semantic Tags Without Cryptographic Digest Pinning or Ephemeral Pre-Sync Verification","stars_count":101,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","argocd","gitops","helm","oci","supply-chain-security","kubernetes"],"exportEndpoints":{"claude":"/api/rules/argocd-oci-digest-ephemeral-sync-fence?format=claude","cursorMdc":"/api/rules/argocd-oci-digest-ephemeral-sync-fence?format=mdc","cursorrules":"/api/rules/argocd-oci-digest-ephemeral-sync-fence?format=cursor","windsurf":"/api/rules/argocd-oci-digest-ephemeral-sync-fence?format=windsurf","agents":"/api/rules/argocd-oci-digest-ephemeral-sync-fence?format=agents"}},{"id":"vite-6-environment-api-multi-runtime-isolation-standard","title":"Vite 6 Environment API Deterministic Multi-Runtime Isolation Standard","category":"frontend","severity":"critical","description":"Enforces deterministic module graph segregation and runtime boundaries across heterogeneous environments (Workerd, Node, Browser) using Vite 6 Environment APIs. Prevents dual-package hazards, runtime context leaks, and accidental bundle pollution caused by legacy SSR flags or unified module resolution paths.","antiPatternHeadline":"Unified Module Resolution Bleeding Server Secrets or Dual-Package Singletons across Heterogeneous Runtimes","stars_count":91,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","vite6","environment-api","ssr","workerd","module-isolation"],"exportEndpoints":{"claude":"/api/rules/vite-6-environment-api-multi-runtime-isolation-standard?format=claude","cursorMdc":"/api/rules/vite-6-environment-api-multi-runtime-isolation-standard?format=mdc","cursorrules":"/api/rules/vite-6-environment-api-multi-runtime-isolation-standard?format=cursor","windsurf":"/api/rules/vite-6-environment-api-multi-runtime-isolation-standard?format=windsurf","agents":"/api/rules/vite-6-environment-api-multi-runtime-isolation-standard?format=agents"}},{"id":"nextjs-15-ppr-cache-life-boundary-standard","title":"Next.js 15 Partial Prerendering (PPR) Cache-Life Boundary Standard","category":"frontend","severity":"critical","description":"Enforces strict isolation between prerendered static layout shells and dynamic request-time streaming slots in Next.js 15. Requires explicit `use cache` scoping and explicit `cacheLife` profiles to prevent dynamic request headers (e.g., cookies, session tokens) from contaminating shared edge cache layers. Eliminates cross-tenant cache poisoning and de-opt cascading across React Suspense boundaries.","antiPatternHeadline":"Dynamic Request Leaks Inside Prerendered Shells and Untyped Unscoped Edge Cache Bleed","stars_count":84,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["nextjs-15","ppr","react-suspense","edge-cache","cache-life"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-ppr-cache-life-boundary-standard?format=claude","cursorMdc":"/api/rules/nextjs-15-ppr-cache-life-boundary-standard?format=mdc","cursorrules":"/api/rules/nextjs-15-ppr-cache-life-boundary-standard?format=cursor","windsurf":"/api/rules/nextjs-15-ppr-cache-life-boundary-standard?format=windsurf","agents":"/api/rules/nextjs-15-ppr-cache-life-boundary-standard?format=agents"}},{"id":"go-chi-http3-zero-rtt-anti-replay-barrier","title":"Go Chi HTTP/3 0-RTT Anti-Replay Mutation Barrier","category":"backend","severity":"critical","description":"Enforces an application-layer barrier against TLS 1.3 and QUIC 0-RTT early-data replay amplification attacks within Go Chi routers. State-mutating requests (POST, PUT, PATCH, DELETE) received as early data must be rejected immediately with HTTP 425 (Too Early) before hitting business logic or database layers.","antiPatternHeadline":"Executing state-mutating operations on unvalidated 0-RTT early data requests","stars_count":53,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","chi","http3","quic","tls13","security","zero-rtt"],"exportEndpoints":{"claude":"/api/rules/go-chi-http3-zero-rtt-anti-replay-barrier?format=claude","cursorMdc":"/api/rules/go-chi-http3-zero-rtt-anti-replay-barrier?format=mdc","cursorrules":"/api/rules/go-chi-http3-zero-rtt-anti-replay-barrier?format=cursor","windsurf":"/api/rules/go-chi-http3-zero-rtt-anti-replay-barrier?format=windsurf","agents":"/api/rules/go-chi-http3-zero-rtt-anti-replay-barrier?format=agents"}},{"id":"pgvector-08-hnsw-resident-set-partition-pruning","title":"Deterministic HNSW Index Memory-Locking & Partition Pruning Standard","category":"backend","severity":"critical","description":"Enforces strict partition key propagation and pre-warmed HNSW index residency in PostgreSQL 17 with pgvector 0.8+. Prevents unpruned multi-partition graph traversals and memory cache thrashing during high-concurrency approximate nearest neighbor (ANN) vector queries.","antiPatternHeadline":"Global Unpartitioned HNSW Traversal with Cache Eviction Cascades","stars_count":118,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","pgvector","postgresql-17","hnsw","database-performance"],"exportEndpoints":{"claude":"/api/rules/pgvector-08-hnsw-resident-set-partition-pruning?format=claude","cursorMdc":"/api/rules/pgvector-08-hnsw-resident-set-partition-pruning?format=mdc","cursorrules":"/api/rules/pgvector-08-hnsw-resident-set-partition-pruning?format=cursor","windsurf":"/api/rules/pgvector-08-hnsw-resident-set-partition-pruning?format=windsurf","agents":"/api/rules/pgvector-08-hnsw-resident-set-partition-pruning?format=agents"}},{"id":"otel-genai-streaming-backpressure-standard","title":"OpenTelemetry GenAI Semantic Conventions and Streaming Backpressure Telemetry","category":"backend","severity":"critical","description":"Standardizes OpenTelemetry GenAI semantic conventions across asynchronous LLM streaming pipelines to prevent distributed trace fragmentation and metrics drift. Enforces strict parent-child span linkage, time-to-first-token (TTFT) duration recording, prompt-injection guardrail span containment, and backpressure queue latency telemetry across reactive streams.","antiPatternHeadline":"Detached LLM Stream Tracing with Opaque Latency and Uninstrumented Backpressure","stars_count":93,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","opentelemetry","genai","streaming","backpressure","distributed-tracing","observability"],"exportEndpoints":{"claude":"/api/rules/otel-genai-streaming-backpressure-standard?format=claude","cursorMdc":"/api/rules/otel-genai-streaming-backpressure-standard?format=mdc","cursorrules":"/api/rules/otel-genai-streaming-backpressure-standard?format=cursor","windsurf":"/api/rules/otel-genai-streaming-backpressure-standard?format=windsurf","agents":"/api/rules/otel-genai-streaming-backpressure-standard?format=agents"}},{"id":"kmp-compose-skiko-ios-render-thread-synchronization","title":"Compose Multiplatform Skiko Metal Render Thread Synchronization Guardrail","category":"mobile","severity":"critical","description":"Enforces strict non-blocking mutual exclusion and asynchronous dispatch between native iOS UIKit run loops and the Skiko Metal rendering pipeline in Compose Multiplatform. Eliminates catastrophic CADisplayLink deadlocks, CAMetalLayer drawable timeouts, and frame-pacing degradation caused by synchronous main-thread reentrancy.","antiPatternHeadline":"Synchronous Main-Thread Blocking and Reentrant Layout Within Skiko CADisplayLink Render Cycles","stars_count":111,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kmp","compose-multiplatform","skiko","ios","metal","concurrency"],"exportEndpoints":{"claude":"/api/rules/kmp-compose-skiko-ios-render-thread-synchronization?format=claude","cursorMdc":"/api/rules/kmp-compose-skiko-ios-render-thread-synchronization?format=mdc","cursorrules":"/api/rules/kmp-compose-skiko-ios-render-thread-synchronization?format=cursor","windsurf":"/api/rules/kmp-compose-skiko-ios-render-thread-synchronization?format=windsurf","agents":"/api/rules/kmp-compose-skiko-ios-render-thread-synchronization?format=agents"}},{"id":"hybrid-post-quantum-tls-mlkem-invariant","title":"Mandatory Hybrid Post-Quantum TLS (ML-KEM / X25519MLKEM768) Zero-Trust Invariant","category":"security","severity":"critical","description":"Enforces mandatory hybrid post-quantum key encapsulation mechanisms (ML-KEM / X25519MLKEM768) across all internal ingress, east-west microservices, and mTLS connections. Mitigates 'Harvest Now, Decrypt Later' (HNDL) adversarial captures by banning legacy classical-only key exchange groups (such as standalone P-256 or non-hybrid X25519) and requiring TLS 1.3 with strict hybrid post-quantum cryptographic suites.","antiPatternHeadline":"Configuring classical-only TLS key exchange or permitting TLS 1.2 downgrades vulnerable to quantum interception","stars_count":42,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","cryptography","post-quantum","ml-kem","tls-1-3","zero-trust"],"exportEndpoints":{"claude":"/api/rules/hybrid-post-quantum-tls-mlkem-invariant?format=claude","cursorMdc":"/api/rules/hybrid-post-quantum-tls-mlkem-invariant?format=mdc","cursorrules":"/api/rules/hybrid-post-quantum-tls-mlkem-invariant?format=cursor","windsurf":"/api/rules/hybrid-post-quantum-tls-mlkem-invariant?format=windsurf","agents":"/api/rules/hybrid-post-quantum-tls-mlkem-invariant?format=agents"}},{"id":"oauth21-rfc9449-dpop-sender-constrained-tokens","title":"Enforce OAuth 2.1 RFC 9449 Demonstrating Proof-of-Possession (DPoP) Token Binding","category":"security","severity":"critical","description":"Mandates asymmetric cryptographic proof-of-possession (DPoP) verification on all incoming OAuth 2.1 access and refresh token flows. Prevents token replay and exfiltration attacks by strictly enforcing JWK thumbprint binding (cnf.jkt), access token hashing (ath), HTTP method/URI binding (htm/htu), and server-provided nonce validation.","antiPatternHeadline":"Accepting Unconstrained Bearer Tokens Without Asymmetric Proof-of-Possession and Thumbprint Binding","stars_count":117,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","oauth2","dpop","rfc9449","sender-constrained-tokens","jwt","zero-trust"],"exportEndpoints":{"claude":"/api/rules/oauth21-rfc9449-dpop-sender-constrained-tokens?format=claude","cursorMdc":"/api/rules/oauth21-rfc9449-dpop-sender-constrained-tokens?format=mdc","cursorrules":"/api/rules/oauth21-rfc9449-dpop-sender-constrained-tokens?format=cursor","windsurf":"/api/rules/oauth21-rfc9449-dpop-sender-constrained-tokens?format=windsurf","agents":"/api/rules/oauth21-rfc9449-dpop-sender-constrained-tokens?format=agents"}},{"id":"k8s-dra-structured-parameter-standard","title":"Kubernetes Dynamic Resource Allocation (DRA) Structured Parameter Invariant","category":"devops","severity":"critical","description":"Enforces deterministic accelerator provisioning using Kubernetes Dynamic Resource Allocation (DRA) structured parameters and Common Device Interface (CDI) descriptors instead of legacy opaque integer limits. Prevents cross-workload PCIe/NVLink contention, memory fragmentation, and noisy-neighbor stalls in heterogeneous AI/ML clusters by mandating CEL-based hardware constraint validation at scheduling time.","antiPatternHeadline":"Over-subscribing heterogeneous GPUs via legacy opaque extended resources (e.g., nvidia.com/gpu) without topology or capability filtering","stars_count":64,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","kubernetes","dra","scheduling","gpu","cdi","mlops"],"exportEndpoints":{"claude":"/api/rules/k8s-dra-structured-parameter-standard?format=claude","cursorMdc":"/api/rules/k8s-dra-structured-parameter-standard?format=mdc","cursorrules":"/api/rules/k8s-dra-structured-parameter-standard?format=cursor","windsurf":"/api/rules/k8s-dra-structured-parameter-standard?format=windsurf","agents":"/api/rules/k8s-dra-structured-parameter-standard?format=agents"}},{"id":"opentofu-state-layer-zk-envelope-encryption-standard","title":"OpenTofu State-Layer Zero-Knowledge Envelope Encryption Standard","category":"devops","severity":"critical","description":"Mandates client-side zero-knowledge envelope encryption for all OpenTofu remote state backends using hardware-backed KMS customer managed keys with automated rotation. Guarantees that state payloads containing sensitive resource outputs and cryptographic secrets remain strictly ciphertext prior to leaving CI/CD runner memory and residing in backend storage buckets. Prevents plaintext credential leakage across storage providers, logging collectors, and intermediary transport layers.","antiPatternHeadline":"Unencrypted or Provider-Managed Server-Side Encryption (SSE) of OpenTofu State Payloads","stars_count":41,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentofu","state-encryption","kms","envelope-encryption","zero-knowledge","security"],"exportEndpoints":{"claude":"/api/rules/opentofu-state-layer-zk-envelope-encryption-standard?format=claude","cursorMdc":"/api/rules/opentofu-state-layer-zk-envelope-encryption-standard?format=mdc","cursorrules":"/api/rules/opentofu-state-layer-zk-envelope-encryption-standard?format=cursor","windsurf":"/api/rules/opentofu-state-layer-zk-envelope-encryption-standard?format=windsurf","agents":"/api/rules/opentofu-state-layer-zk-envelope-encryption-standard?format=agents"}},{"id":"react-19-rsc-taint-boundary-protection","title":"React 19 Taint Object API Boundary Enforcement for RSC Serialization","category":"frontend","severity":"critical","description":"Enforces mandatory registration of cryptographic keys, raw database records, and PII using React 19's experimental_taintObjectReference and experimental_taintUniqueValue APIs. Prevents unintentional serialization of server-side secrets across the Server-to-Client Component boundary within React Server Component (RSC) Flight streams.","antiPatternHeadline":"Passing Untainted Raw Records or Secrets Directly to Client Component Props Across RSC Flight Boundaries","stars_count":41,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","rsc","taint-api","security","nextjs"],"exportEndpoints":{"claude":"/api/rules/react-19-rsc-taint-boundary-protection?format=claude","cursorMdc":"/api/rules/react-19-rsc-taint-boundary-protection?format=mdc","cursorrules":"/api/rules/react-19-rsc-taint-boundary-protection?format=cursor","windsurf":"/api/rules/react-19-rsc-taint-boundary-protection?format=windsurf","agents":"/api/rules/react-19-rsc-taint-boundary-protection?format=agents"}},{"id":"fastapi-pydantic-v2-streaming-memory-bounds","title":"FastAPI 0.115+ & Pydantic V2 Bounded Streaming Deserialization Memory Ceiling","category":"backend","severity":"critical","description":"Enforces strict byte-budget memory ceilings and bounded chunk ingestion for high-throughput streaming and multipart endpoints in FastAPI 0.115+ and Pydantic V2. Prevents worker process Out-Of-Memory (OOM) panics caused by unbounded request buffering and unconstrained native Rust deserialization during high-concurrency payload injection.","antiPatternHeadline":"Unbounded Request Body Buffering and Monolithic Rust Deserialization Triggering Worker OOM","stars_count":103,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["fastapi","pydantic-v2","memory-management","streaming","asgi","dos-prevention","performance"],"exportEndpoints":{"claude":"/api/rules/fastapi-pydantic-v2-streaming-memory-bounds?format=claude","cursorMdc":"/api/rules/fastapi-pydantic-v2-streaming-memory-bounds?format=mdc","cursorrules":"/api/rules/fastapi-pydantic-v2-streaming-memory-bounds?format=cursor","windsurf":"/api/rules/fastapi-pydantic-v2-streaming-memory-bounds?format=windsurf","agents":"/api/rules/fastapi-pydantic-v2-streaming-memory-bounds?format=agents"}},{"id":"go-chi-v5-context-afterfunc-cleanup-orchestration","title":"Deterministic Resource Cleanup and Rollbacks with Chi v5 and context.AfterFunc","category":"backend","severity":"critical","description":"Enforces asynchronous, non-blocking distributed resource cancellation and database transaction rollbacks upon client connection termination (such as HTTP/3 QUIC stream resets) using Go 1.21+ `context.AfterFunc`. Prevents orphan lock retention, dangling distributed leases, and zombie worker routines when a client disconnects prior to HTTP handler completion in Chi v5 routers.","antiPatternHeadline":"Relying Exclusively on Synchronous Defer Blocks and Epoll Context Checks in Handlers","stars_count":58,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","chi","context","http3","concurrency"],"exportEndpoints":{"claude":"/api/rules/go-chi-v5-context-afterfunc-cleanup-orchestration?format=claude","cursorMdc":"/api/rules/go-chi-v5-context-afterfunc-cleanup-orchestration?format=mdc","cursorrules":"/api/rules/go-chi-v5-context-afterfunc-cleanup-orchestration?format=cursor","windsurf":"/api/rules/go-chi-v5-context-afterfunc-cleanup-orchestration?format=windsurf","agents":"/api/rules/go-chi-v5-context-afterfunc-cleanup-orchestration?format=agents"}},{"id":"postgres-17-pgvector-hnsw-iterative-pruning","title":"PostgreSQL 17 Memory-Optimized pgvector HNSW Iterative Search and Buffer Protection","category":"backend","severity":"critical","description":"Enforces strict transaction-scoped tuning for pgvector HNSW iterative index scans in PostgreSQL 17 to eliminate shared_buffers thrashing during concurrent high-throughput ingestion. Prevents unconstrained vector graph traversals from causing buffer cache eviction storms and starvation by mandating relaxed iterative scan ordering and deterministic scan tuple ceilings.","antiPatternHeadline":"Unbounded HNSW Graph Traversal and Post-Filtering Thrashing Shared Buffer Pools","stars_count":90,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","pgvector","hnsw","performance","memory-management"],"exportEndpoints":{"claude":"/api/rules/postgres-17-pgvector-hnsw-iterative-pruning?format=claude","cursorMdc":"/api/rules/postgres-17-pgvector-hnsw-iterative-pruning?format=mdc","cursorrules":"/api/rules/postgres-17-pgvector-hnsw-iterative-pruning?format=cursor","windsurf":"/api/rules/postgres-17-pgvector-hnsw-iterative-pruning?format=windsurf","agents":"/api/rules/postgres-17-pgvector-hnsw-iterative-pruning?format=agents"}},{"id":"capacitor-7-hardware-key-attestation-enclave","title":"Capacitor 7 Hardware-Backed Secure Enclave & StrongBox Session Binding","category":"mobile","severity":"critical","description":"Enforces strict cryptographic binding of hybrid web view session lifecycles to non-exportable, hardware-isolated asymmetric keypairs generated inside Apple's Secure Enclave or Android's StrongBox KeyStore. Eradicates web-layer session hijacking and token exfiltration vulnerabilities by restricting the web view context to ephemeral transaction payloads signed across the Capacitor 7 bridge via native biometric proof-of-possession.","antiPatternHeadline":"Persisting Bearer Tokens in Hybrid Web Storage or Software-Emulated Keychains","stars_count":60,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","secure-enclave","strongbox","biometrics","dpop","cryptography"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-hardware-key-attestation-enclave?format=claude","cursorMdc":"/api/rules/capacitor-7-hardware-key-attestation-enclave?format=mdc","cursorrules":"/api/rules/capacitor-7-hardware-key-attestation-enclave?format=cursor","windsurf":"/api/rules/capacitor-7-hardware-key-attestation-enclave?format=windsurf","agents":"/api/rules/capacitor-7-hardware-key-attestation-enclave?format=agents"}},{"id":"compose-multiplatform-skiko-thread-affinity-guardrail","title":"Compose Multiplatform Skiko Render Pipeline Thread-Affinity Guardrail","category":"mobile","severity":"critical","description":"Enforces strict mutation isolation between Kotlin coroutine dispatchers and native Skiko render loops across Compose Multiplatform targets. Prevents fatal native SIGSEGV and EGL/Metal surface crashes during multi-window transitions and configuration changes by restricting surface mutation, context lifecycle, and Skia Canvas operations exclusively to the designated render thread dispatchers.","antiPatternHeadline":"Dispatching Canvas and Skia Surface Mutations from Asynchronous Default or IO Coroutine Contexts","stars_count":112,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","compose-multiplatform","skiko","coroutine-dispatchers","native-rendering","thread-affinity","metal","opengl"],"exportEndpoints":{"claude":"/api/rules/compose-multiplatform-skiko-thread-affinity-guardrail?format=claude","cursorMdc":"/api/rules/compose-multiplatform-skiko-thread-affinity-guardrail?format=mdc","cursorrules":"/api/rules/compose-multiplatform-skiko-thread-affinity-guardrail?format=cursor","windsurf":"/api/rules/compose-multiplatform-skiko-thread-affinity-guardrail?format=windsurf","agents":"/api/rules/compose-multiplatform-skiko-thread-affinity-guardrail?format=agents"}},{"id":"rfc-9449-dpop-spa-invariant","title":"RFC 9449 OAuth 2.0 DPoP Token Binding for Single Page Applications and BFFs","category":"security","severity":"critical","description":"Enforces sender-constraining of OAuth 2.0 tokens via RFC 9449 Demonstrating Proof-of-Possession (DPoP) across client runtimes and Backend-For-Frontend (BFF) proxies. Every outbound API call and token exchange must cryptographically bind access and refresh tokens to an ephemeral, non-extractable client key pair using Web Crypto API. Exfiltrated tokens become completely inert against replay attacks on third-party origins.","antiPatternHeadline":"Unbound Bearer Tokens in Browser Storage Vulnerable to XSS Token Replay and Exfiltration","stars_count":115,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","oauth2","dpop","rfc9449","cryptography","zero-trust","spa"],"exportEndpoints":{"claude":"/api/rules/rfc-9449-dpop-spa-invariant?format=claude","cursorMdc":"/api/rules/rfc-9449-dpop-spa-invariant?format=mdc","cursorrules":"/api/rules/rfc-9449-dpop-spa-invariant?format=cursor","windsurf":"/api/rules/rfc-9449-dpop-spa-invariant?format=windsurf","agents":"/api/rules/rfc-9449-dpop-spa-invariant?format=agents"}},{"id":"k8s-gateway-api-backend-tls-policy-standard","title":"Gateway API v1.2 Declarative BackendTLSPolicy Upstream mTLS and SAN Validation Standard","category":"devops","severity":"critical","description":"Enforces declarative, statically validated cluster-wide cryptographic routing configurations from the Gateway data plane directly to upstream backend workloads using Kubernetes Gateway API v1.2 BackendTLSPolicy. Replaces brittle, unvalidated ingress annotations with explicit CA certificate trust anchors and strict Subject Alternative Name (SAN) verification to guarantee zero-trust in-transit security.","antiPatternHeadline":"Bypassing Upstream TLS Validation or Relying on Vendor-Specific Ingress Annotations for Backend Encryption","stars_count":80,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","kubernetes","gateway-api","tls","security","zero-trust","mtls"],"exportEndpoints":{"claude":"/api/rules/k8s-gateway-api-backend-tls-policy-standard?format=claude","cursorMdc":"/api/rules/k8s-gateway-api-backend-tls-policy-standard?format=mdc","cursorrules":"/api/rules/k8s-gateway-api-backend-tls-policy-standard?format=cursor","windsurf":"/api/rules/k8s-gateway-api-backend-tls-policy-standard?format=windsurf","agents":"/api/rules/k8s-gateway-api-backend-tls-policy-standard?format=agents"}},{"id":"otel-ebpf-profiling-budget-quotas","title":"OpenTelemetry Continuous eBPF Profiling Overhead Budgeting and Quota Enforcement","category":"devops","severity":"critical","description":"Enforces strict CPU, memory, and telemetry ring-buffer quotas on OpenTelemetry eBPF continuous profiling agents deployed across high-density containerized nodes. Unrestricted sampling rates and unbounded userspace aggregation cause ring buffer drops, kernel scheduling latency, and CPU thrashing during traffic spikes. Telemetry infrastructure must implement hard sampling rate ceilings, memory limits, and automated backoff mechanisms to prevent kernel-level resource starvation.","antiPatternHeadline":"Uncapped continuous eBPF stack collection triggering kernel ring buffer contention and CPU starvation","stars_count":52,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","ebpf","continuous-profiling","observability","kubernetes","performance"],"exportEndpoints":{"claude":"/api/rules/otel-ebpf-profiling-budget-quotas?format=claude","cursorMdc":"/api/rules/otel-ebpf-profiling-budget-quotas?format=mdc","cursorrules":"/api/rules/otel-ebpf-profiling-budget-quotas?format=cursor","windsurf":"/api/rules/otel-ebpf-profiling-budget-quotas?format=windsurf","agents":"/api/rules/otel-ebpf-profiling-budget-quotas?format=agents"}},{"id":"openfga-contextual-tuple-bounded-resolution-guardrail","title":"OpenFGA 1.6 Contextual Tuple Bounded Resolution & Graph Invariant Guardrail","category":"security","severity":"critical","description":"Enforces strict bounds, relation whitelisting, and cycle-safe ingestion on dynamic OpenFGA contextual tuples during authorization checks. Prevents unbounded graph traversals, traversal-induced denial of service (DoS), and latency degradation to guarantee deterministic sub-10ms p99 ReBAC resolutions.","antiPatternHeadline":"Injecting Unsanitized, Unbounded Dynamic Contextual Tuples into OpenFGA Check Calls","stars_count":67,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","rebac","authorization","performance","dos-prevention"],"exportEndpoints":{"claude":"/api/rules/openfga-contextual-tuple-bounded-resolution-guardrail?format=claude","cursorMdc":"/api/rules/openfga-contextual-tuple-bounded-resolution-guardrail?format=mdc","cursorrules":"/api/rules/openfga-contextual-tuple-bounded-resolution-guardrail?format=cursor","windsurf":"/api/rules/openfga-contextual-tuple-bounded-resolution-guardrail?format=windsurf","agents":"/api/rules/openfga-contextual-tuple-bounded-resolution-guardrail?format=agents"}},{"id":"bun-worker-heap-fence-production-standard","title":"Bun 1.2 Multi-Tenant Isolated Worker Heap Fence & Zero-Copy Memory Standard","category":"backend","severity":"critical","description":"Enforces strict isolated execution boundaries and memory fencing across multi-tenant Bun worker threads. Mandates bounded worker pooling, explicit heap telemetry watchdogs with rapid process termination, and zero-copy transferable ArrayBuffer or SharedArrayBuffer pooling to eliminate noisy-neighbor heap exhaustion in edge micro-runtimes.","antiPatternHeadline":"Unbounded Worker Spawning with Structured Cloning Allocations Inducing Host OOM","stars_count":97,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","web-workers","concurrency","memory-management","zero-copy"],"exportEndpoints":{"claude":"/api/rules/bun-worker-heap-fence-production-standard?format=claude","cursorMdc":"/api/rules/bun-worker-heap-fence-production-standard?format=mdc","cursorrules":"/api/rules/bun-worker-heap-fence-production-standard?format=cursor","windsurf":"/api/rules/bun-worker-heap-fence-production-standard?format=windsurf","agents":"/api/rules/bun-worker-heap-fence-production-standard?format=agents"}},{"id":"react-19-async-transition-microtask-fence","title":"React 19 Async Transition Microtask Priority Inversion Fence","category":"frontend","severity":"critical","description":"Prevents UI thread starvation and discrete event input latency by enforcing explicit macrotask-yielding fences within React 19 asynchronous transitions. Prevents microtask queue saturation from inverting transition priorities and blocking React's internal fiber scheduler and user-driven discrete interactions.","antiPatternHeadline":"Starving Main Thread via Unbounded Microtask Cascades Inside React 19 Async Transitions","stars_count":98,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","useTransition","concurrency","event-loop","scheduler"],"exportEndpoints":{"claude":"/api/rules/react-19-async-transition-microtask-fence?format=claude","cursorMdc":"/api/rules/react-19-async-transition-microtask-fence?format=mdc","cursorrules":"/api/rules/react-19-async-transition-microtask-fence?format=cursor","windsurf":"/api/rules/react-19-async-transition-microtask-fence?format=windsurf","agents":"/api/rules/react-19-async-transition-microtask-fence?format=agents"}},{"id":"fastapi-anyio-structured-concurrency-lifecycle","title":"FastAPI AnyIO Structured Concurrency TaskGroup Lifecycle Guardrail","category":"backend","severity":"critical","description":"Eliminates orphaned async background tasks, thread pool starvation, and leaked socket descriptors triggered by premature client disconnections. Mandates the use of AnyIO TaskGroup cancellation scopes bound directly to the FastAPI request lifecycle instead of unmonitored asyncio fire-and-forget tasks or unbounded BackgroundTasks. Guarantees deterministic cooperative cancellation cascades, resource deallocation, and shielded critical sections during connection drops.","antiPatternHeadline":"Spawning detached coroutines via asyncio.create_task or unbounded background tasks that outlive client disconnection and leak resources.","stars_count":116,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["fastapi","anyio","structured-concurrency","asyncio","python","backend"],"exportEndpoints":{"claude":"/api/rules/fastapi-anyio-structured-concurrency-lifecycle?format=claude","cursorMdc":"/api/rules/fastapi-anyio-structured-concurrency-lifecycle?format=mdc","cursorrules":"/api/rules/fastapi-anyio-structured-concurrency-lifecycle?format=cursor","windsurf":"/api/rules/fastapi-anyio-structured-concurrency-lifecycle?format=windsurf","agents":"/api/rules/fastapi-anyio-structured-concurrency-lifecycle?format=agents"}},{"id":"react-native-76-jsi-zerocopy-hostobject-lifecycle-guardrail","title":"React Native 0.76 JSI Zero-Copy HostObject Lifecycle Guardrail","category":"mobile","severity":"critical","description":"Eliminates native-to-JS bridge serialization overhead by enforcing safe zero-copy JSI HostObjects in React Native 0.76+. Guarantees deterministic C++ resource destruction across Fabric concurrent renders and Hermes garbage collection cycles, preventing native SIGSEGV and use-after-free panics during UI thread preemption.","antiPatternHeadline":"Dangling C++ Pointer Dereferencing and Use-After-Free in Concurrent Fabric HostObject Lifecycles","stars_count":89,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["react-native","jsi","c++","fabric","zero-copy","memory-safety"],"exportEndpoints":{"claude":"/api/rules/react-native-76-jsi-zerocopy-hostobject-lifecycle-guardrail?format=claude","cursorMdc":"/api/rules/react-native-76-jsi-zerocopy-hostobject-lifecycle-guardrail?format=mdc","cursorrules":"/api/rules/react-native-76-jsi-zerocopy-hostobject-lifecycle-guardrail?format=cursor","windsurf":"/api/rules/react-native-76-jsi-zerocopy-hostobject-lifecycle-guardrail?format=windsurf","agents":"/api/rules/react-native-76-jsi-zerocopy-hostobject-lifecycle-guardrail?format=agents"}},{"id":"postgres-17-radix-vacuum-memory-accounting","title":"PostgreSQL 17 Radix Tree Memory Accounting Invariant for Adaptive Vacuuming","category":"backend","severity":"critical","description":"PostgreSQL 17 replaces flat dead-tuple arrays with an adaptive radix tree (TidStore), lifting the legacy 1GB dead-tuple indexing limitation. Infrastructure orchestration and database access layers must dynamically account for concurrent autovacuum worker memory and radix-tree overhead, enforcing per-table scale factors and bounded maintenance budgets to prevent container OOMs and transaction ID wraparound under heavy ingest.","antiPatternHeadline":"Unbounded Radix Allocation and Static Maintenance Memory Leading to OOM or Wraparound Halts","stars_count":50,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql-17","database-reliability","autovacuum","memory-accounting","radix-tree"],"exportEndpoints":{"claude":"/api/rules/postgres-17-radix-vacuum-memory-accounting?format=claude","cursorMdc":"/api/rules/postgres-17-radix-vacuum-memory-accounting?format=mdc","cursorrules":"/api/rules/postgres-17-radix-vacuum-memory-accounting?format=cursor","windsurf":"/api/rules/postgres-17-radix-vacuum-memory-accounting?format=windsurf","agents":"/api/rules/postgres-17-radix-vacuum-memory-accounting?format=agents"}},{"id":"webauthn-l3-backup-state-device-bound-enforcement","title":"WebAuthn L3 Backup State Assertion & Device-Bound Token Enforcement","category":"security","severity":"critical","description":"Enforces strict discrimination between multi-device synced passkeys and hardware-bound passkeys using WebAuthn Level 3 AuthenticatorData Backup Eligibility (BE) and Backup State (BS) flags. Prevents privilege escalation and session exportability on high-assurance operations (e.g., step-up authentication, cryptographic key authorization, admin actions) by cryptographically guaranteeing credentials cannot leave their initial physical Secure Element or FIPS-validated enclave.","antiPatternHeadline":"Accepting generic WebAuthn credentials for high-assurance actions without validating BE/BS flags, allowing synced passkeys to bypass physical hardware requirements.","stars_count":107,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","fido2","passkeys","authentication","cryptography"],"exportEndpoints":{"claude":"/api/rules/webauthn-l3-backup-state-device-bound-enforcement?format=claude","cursorMdc":"/api/rules/webauthn-l3-backup-state-device-bound-enforcement?format=mdc","cursorrules":"/api/rules/webauthn-l3-backup-state-device-bound-enforcement?format=cursor","windsurf":"/api/rules/webauthn-l3-backup-state-device-bound-enforcement?format=windsurf","agents":"/api/rules/webauthn-l3-backup-state-device-bound-enforcement?format=agents"}},{"id":"envoy-gateway-spiffe-waypoint-l7-authz-standard","title":"Envoy Gateway 1.2 SPIFFE Waypoint Dynamic L7 Authorization Standard","category":"devops","severity":"critical","description":"Enforces cryptographically verifiable SPIFFE workload identities at intermediate Envoy Gateway 1.2 waypoint proxies before backend egress in sidecarless ambient mesh architectures. Mandates explicit URI SAN matching against authorized trust domains within SecurityPolicy configurations and prohibits unverified client identity header propagation.","antiPatternHeadline":"Ambient Waypoint Bypass via Unverified Forwarded Headers or Permissive SPIFFE Trust Domain Matching","stars_count":83,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","envoy-gateway","spiffe","zero-trust","ambient-mesh","kubernetes"],"exportEndpoints":{"claude":"/api/rules/envoy-gateway-spiffe-waypoint-l7-authz-standard?format=claude","cursorMdc":"/api/rules/envoy-gateway-spiffe-waypoint-l7-authz-standard?format=mdc","cursorrules":"/api/rules/envoy-gateway-spiffe-waypoint-l7-authz-standard?format=cursor","windsurf":"/api/rules/envoy-gateway-spiffe-waypoint-l7-authz-standard?format=windsurf","agents":"/api/rules/envoy-gateway-spiffe-waypoint-l7-authz-standard?format=agents"}},{"id":"opentelemetry-otlp-arrow-stream-invariant","title":"OpenTelemetry OTLP/Arrow High-Throughput Columnar Streaming Guardrail","category":"devops","severity":"critical","description":"Mandates columnar Apache Arrow batch encoding and persistent bidirectional gRPC streaming on high-volume OpenTelemetry Collector pipelines. Standard row-oriented Protobuf serialization incurs catastrophic memory allocation overhead, collector garbage collection thrashing, and excessive network egress under sustained workloads. Adopting OTLP/Arrow record-batch encoding slashes telemetry bandwidth and collector GC overhead by up to 70% via zero-copy columnar data structures.","antiPatternHeadline":"Deploying Standard Row-Based OTLP Exporters in High-Throughput Pipelines Causing GC Freezes and Bandwidth Bottlenecks","stars_count":72,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","apache-arrow","grpc","observability","performance"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-otlp-arrow-stream-invariant?format=claude","cursorMdc":"/api/rules/opentelemetry-otlp-arrow-stream-invariant?format=mdc","cursorrules":"/api/rules/opentelemetry-otlp-arrow-stream-invariant?format=cursor","windsurf":"/api/rules/opentelemetry-otlp-arrow-stream-invariant?format=windsurf","agents":"/api/rules/opentelemetry-otlp-arrow-stream-invariant?format=agents"}},{"id":"tls-1-3-hybrid-post-quantum-rollout-standard","title":"Mandatory TLS 1.3 Hybrid Post-Quantum Key Exchange (X25519MLKEM768)","category":"security","severity":"critical","description":"Enforces TLS 1.3 hybrid post-quantum key exchange using X25519 combined with FIPS 203 ML-KEM-768 (X25519MLKEM768 / codepoint 0x11ec) across all enterprise ingress and inter-service mesh gateways. Eliminates vulnerability to 'Harvest Now, Decrypt Later' (HNDL) adversary campaigns while retaining classical Elliptic Curve Diffie-Hellman guarantees and graceful fallback to pure X25519/SecP256r1 for non-PQC clients.","antiPatternHeadline":"Configuring Classical-Only Elliptic Curves or Hardcoding Deprecated Non-Standard Kyber Draft Identifiers","stars_count":117,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","tls-1-3","post-quantum-cryptography","fips-203","ml-kem","ingress"],"exportEndpoints":{"claude":"/api/rules/tls-1-3-hybrid-post-quantum-rollout-standard?format=claude","cursorMdc":"/api/rules/tls-1-3-hybrid-post-quantum-rollout-standard?format=mdc","cursorrules":"/api/rules/tls-1-3-hybrid-post-quantum-rollout-standard?format=cursor","windsurf":"/api/rules/tls-1-3-hybrid-post-quantum-rollout-standard?format=windsurf","agents":"/api/rules/tls-1-3-hybrid-post-quantum-rollout-standard?format=agents"}},{"id":"nextjs-15-ppr-dynamic-hydration-boundary-standard","title":"Next.js 15 Partial Prerendering Dynamic Micro-Suspense and Fallback Isolation Standard","category":"frontend","severity":"critical","description":"Enforces strict structural boundaries between the static prerender shell and runtime dynamic streams under Next.js 15 Partial Prerendering (PPR). Guarantees that dynamic request contexts, asynchronous headers, and unstable data reads are sealed inside isolated React Suspense boundaries with zero-dependency static fallbacks, preventing static shell deopt and server-side request starvation under high concurrent traffic.","antiPatternHeadline":"Leaking Dynamic Accessors Across the Static Shell Boundary or Rendering Dynamic Fallbacks","stars_count":104,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["nextjs","nextjs-15","react-19","ppr","suspense","streaming","performance"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-ppr-dynamic-hydration-boundary-standard?format=claude","cursorMdc":"/api/rules/nextjs-15-ppr-dynamic-hydration-boundary-standard?format=mdc","cursorrules":"/api/rules/nextjs-15-ppr-dynamic-hydration-boundary-standard?format=cursor","windsurf":"/api/rules/nextjs-15-ppr-dynamic-hydration-boundary-standard?format=windsurf","agents":"/api/rules/nextjs-15-ppr-dynamic-hydration-boundary-standard?format=agents"}},{"id":"react19-compiler-deterministic-mutation-escape-guardrails","title":"React 19 Compiler Interior Reference Mutation and Memoization Graph Integrity Guardrail","category":"frontend","severity":"critical","description":"Enforces strict interior reference immutability and deterministic pure functional transformations across complex client-side state trees. Eliminates post-render interior mutations and leaking aliases that shatter React 19's automatically synthesized memoization blocks ($_memoize) and trigger catastrophic de-optimizations or cascading re-renders.","antiPatternHeadline":"Mutating Nested Heap References Post-Derivation Breaking Compiler Dependency Graphs","stars_count":63,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","react-compiler","immutability","typescript","memoization"],"exportEndpoints":{"claude":"/api/rules/react19-compiler-deterministic-mutation-escape-guardrails?format=claude","cursorMdc":"/api/rules/react19-compiler-deterministic-mutation-escape-guardrails?format=mdc","cursorrules":"/api/rules/react19-compiler-deterministic-mutation-escape-guardrails?format=cursor","windsurf":"/api/rules/react19-compiler-deterministic-mutation-escape-guardrails?format=windsurf","agents":"/api/rules/react19-compiler-deterministic-mutation-escape-guardrails?format=agents"}},{"id":"pg17-aio-direct-io-memory-invariants-standard","title":"PostgreSQL 17 AIO and Direct-IO Subsystem Memory Invariants","category":"backend","severity":"critical","description":"Governs the allocation and execution limits for PostgreSQL 17 asynchronous I/O worker pools, direct-IO buffers, and parallel streaming query patterns. Enforces deterministic session-level resource boundaries and streaming backpressure during high-throughput vector index scans and parallel sequential scans to prevent kernel buffer bloat and system-terminating Out-Of-Memory (OOM) panics.","antiPatternHeadline":"Unbounded concurrent parallel vector or sequential scans overwhelming io_uring queues and direct-IO ring buffers, triggering kernel OOM panics.","stars_count":47,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","pg17","aio","io-uring","pgvector","direct-io","memory-management"],"exportEndpoints":{"claude":"/api/rules/pg17-aio-direct-io-memory-invariants-standard?format=claude","cursorMdc":"/api/rules/pg17-aio-direct-io-memory-invariants-standard?format=mdc","cursorrules":"/api/rules/pg17-aio-direct-io-memory-invariants-standard?format=cursor","windsurf":"/api/rules/pg17-aio-direct-io-memory-invariants-standard?format=windsurf","agents":"/api/rules/pg17-aio-direct-io-memory-invariants-standard?format=agents"}},{"id":"axum-sse-backpressure-disconnect-cleanup","title":"Axum 0.8 SSE Stream Disconnect Lifecycle and Broadcast Backpressure Invariant","category":"backend","severity":"critical","description":"Mandates deterministic client disconnect propagation and Tokio broadcast subscriber teardown for Server-Sent Events (SSE) endpoints in Axum 0.8. Eliminates zombie worker tasks and ghost compute leaks by binding stream drop semantics directly to Tokio cancellation tokens and handling broadcast lag errors defensively.","antiPatternHeadline":"Spawning Unlinked Long-Polling Background Tasks and Leaking Tokio Broadcast Receivers on Client Abort","stars_count":99,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tokio","sse","concurrency"],"exportEndpoints":{"claude":"/api/rules/axum-sse-backpressure-disconnect-cleanup?format=claude","cursorMdc":"/api/rules/axum-sse-backpressure-disconnect-cleanup?format=mdc","cursorrules":"/api/rules/axum-sse-backpressure-disconnect-cleanup?format=cursor","windsurf":"/api/rules/axum-sse-backpressure-disconnect-cleanup?format=windsurf","agents":"/api/rules/axum-sse-backpressure-disconnect-cleanup?format=agents"}},{"id":"go124-chi-http3-quic-graceful-draining-guardrails","title":"Go 1.24 Chi HTTP/3 QUIC Graceful Connection Draining and Migration Invariants","category":"backend","severity":"critical","description":"Mandates strict decoupling of UDP packet listener shutdown from active QUIC connection context lifecycles when serving HTTP/3 over Chi in Go 1.24. Precludes sudden socket termination by enforcing coordinated GOAWAY frame dissemination, bidirectional stream draining timeouts, and atomic connection closure without severing live client address migrations during rolling container deployments.","antiPatternHeadline":"Premature UDP Packet Socket Closure and Abrupt QUIC Engine Termination Dropping In-Flight Multiplexed Streams","stars_count":100,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","http3","quic","chi","networking","k8s"],"exportEndpoints":{"claude":"/api/rules/go124-chi-http3-quic-graceful-draining-guardrails?format=claude","cursorMdc":"/api/rules/go124-chi-http3-quic-graceful-draining-guardrails?format=mdc","cursorrules":"/api/rules/go124-chi-http3-quic-graceful-draining-guardrails?format=cursor","windsurf":"/api/rules/go124-chi-http3-quic-graceful-draining-guardrails?format=windsurf","agents":"/api/rules/go124-chi-http3-quic-graceful-draining-guardrails?format=agents"}},{"id":"kmp-workmanager-bgtask-reentrancy-barrier","title":"KMP WorkManager and BGTaskScheduler Idempotent Re-entrancy Barrier","category":"mobile","severity":"critical","description":"Enforces an atomic, distributed transaction barrier across shared Kotlin Multiplatform codebases to eliminate race conditions between Android WorkManager retries and iOS BGTaskScheduler invocations. Guarantees mutually exclusive background job execution, deterministic state fencing, and monotonic lease fencing against stale task instances.","antiPatternHeadline":"Unsynchronized cross-platform background dispatch permitting overlapping worker execution and non-idempotent payload corruption","stars_count":110,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kmp","kotlin-multiplatform","workmanager","bgtaskscheduler","concurrency","idempotency"],"exportEndpoints":{"claude":"/api/rules/kmp-workmanager-bgtask-reentrancy-barrier?format=claude","cursorMdc":"/api/rules/kmp-workmanager-bgtask-reentrancy-barrier?format=mdc","cursorrules":"/api/rules/kmp-workmanager-bgtask-reentrancy-barrier?format=cursor","windsurf":"/api/rules/kmp-workmanager-bgtask-reentrancy-barrier?format=windsurf","agents":"/api/rules/kmp-workmanager-bgtask-reentrancy-barrier?format=agents"}},{"id":"tauri-2-multi-webview-ipc-isolation-guardrail","title":"Tauri 2.0 Multi-WebView IPC Isolation & Dynamic Context Inheritance Guardrail","category":"mobile","severity":"critical","description":"Enforces strict process sandboxing, capability scoping, and deterministic origin-scoped message port validation when spawning decoupled native child windows and embedded webviews in Tauri 2.0. Prevents untrusted frame elevation, privilege leaks across secondary webview contexts, and arbitrary IPC execution on mobile viewports. Guarantees that dynamically initialized contexts inherit exclusively minimized, cryptographically verifiable access boundaries.","antiPatternHeadline":"Spawning Decoupled Secondary WebViews with Implicit Root IPC Capability Inheritance and Unfiltered PostMessage Handshakes","stars_count":60,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri","security","ipc-isolation","sandboxing","webview"],"exportEndpoints":{"claude":"/api/rules/tauri-2-multi-webview-ipc-isolation-guardrail?format=claude","cursorMdc":"/api/rules/tauri-2-multi-webview-ipc-isolation-guardrail?format=mdc","cursorrules":"/api/rules/tauri-2-multi-webview-ipc-isolation-guardrail?format=cursor","windsurf":"/api/rules/tauri-2-multi-webview-ipc-isolation-guardrail?format=windsurf","agents":"/api/rules/tauri-2-multi-webview-ipc-isolation-guardrail?format=agents"}},{"id":"rfc-9449-dpop-hardware-enclave-key-rotation-standard","title":"RFC 9449 DPoP Hardware-Bound Ephemeral Key Rotation Standard","category":"security","severity":"critical","description":"Enforces cryptographic binding of OAuth 2.1 access and refresh tokens to non-exportable, hardware-enclave-backed asymmetric keys per RFC 9449. Mandates strict verification of DPoP proof claims (htm, htu, jti, iat, ath, nonce) and zero-trust key rotation intervals to neutralize token exfiltration and replay attacks.","antiPatternHeadline":"Exportable Software-Managed Private Keys and Static DPoP Proof Reuse Across HTTP Requests","stars_count":57,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","oauth2","rfc9449","dpop","cryptography","hardware-security-module","enclave"],"exportEndpoints":{"claude":"/api/rules/rfc-9449-dpop-hardware-enclave-key-rotation-standard?format=claude","cursorMdc":"/api/rules/rfc-9449-dpop-hardware-enclave-key-rotation-standard?format=mdc","cursorrules":"/api/rules/rfc-9449-dpop-hardware-enclave-key-rotation-standard?format=cursor","windsurf":"/api/rules/rfc-9449-dpop-hardware-enclave-key-rotation-standard?format=windsurf","agents":"/api/rules/rfc-9449-dpop-hardware-enclave-key-rotation-standard?format=agents"}},{"id":"pqc-mlkem768-x25519-hybrid-tls-enforcement","title":"Post-Quantum ML-KEM-768 & X25519 Hybrid Key Exchange Invariant for TLS 1.3","category":"security","severity":"critical","description":"Enforces ML-KEM-768 combined with X25519 hybrid key encapsulation (X25519MLKEM768) across all ingress controllers, internal service-to-service communication, and egress clients. Restricts protocols strictly to TLS 1.3 to guarantee forward secrecy against 'Harvest Now, Decrypt Later' (HNDL) adversaries, mitigating quantum-enabled retrospective cryptanalysis without compromising latency.","antiPatternHeadline":"Negotiating Classical-Only TLS Key Exchanges Vulnerable to Retrospective Quantum Decryption","stars_count":95,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","cryptography","tls","post-quantum","ml-kem","zero-trust"],"exportEndpoints":{"claude":"/api/rules/pqc-mlkem768-x25519-hybrid-tls-enforcement?format=claude","cursorMdc":"/api/rules/pqc-mlkem768-x25519-hybrid-tls-enforcement?format=mdc","cursorrules":"/api/rules/pqc-mlkem768-x25519-hybrid-tls-enforcement?format=cursor","windsurf":"/api/rules/pqc-mlkem768-x25519-hybrid-tls-enforcement?format=windsurf","agents":"/api/rules/pqc-mlkem768-x25519-hybrid-tls-enforcement?format=agents"}},{"id":"k8s-gateway-v1-2-cross-namespace-reference-grant-standard","title":"Kubernetes Gateway API v1.2 Bidirectional Cross-Namespace ReferenceGrant Enforcement","category":"devops","severity":"critical","description":"Mandates strict bidirectional authorization boundaries for cross-namespace Gateway API v1.2 topologies using explicit ReferenceGrant resources and scoped Gateway listener allowedRoutes. Prevents cross-tenant traffic hijacking, unverified backend routing, and route collision across isolated microservice namespaces.","antiPatternHeadline":"Permissive Wildcard Cross-Namespace Route Attachment Without Explicit ReferenceGrant Scoping","stars_count":62,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","kubernetes","gateway-api","security","multi-tenancy","referencegrant","networking"],"exportEndpoints":{"claude":"/api/rules/k8s-gateway-v1-2-cross-namespace-reference-grant-standard?format=claude","cursorMdc":"/api/rules/k8s-gateway-v1-2-cross-namespace-reference-grant-standard?format=mdc","cursorrules":"/api/rules/k8s-gateway-v1-2-cross-namespace-reference-grant-standard?format=cursor","windsurf":"/api/rules/k8s-gateway-v1-2-cross-namespace-reference-grant-standard?format=windsurf","agents":"/api/rules/k8s-gateway-v1-2-cross-namespace-reference-grant-standard?format=agents"}},{"id":"nextjs15-ppr-dynamic-boundary-guardrail","title":"Next.js 15 PPR Static Shell Preservation & Suspense Dynamic Boundary Guardrail","category":"frontend","severity":"critical","description":"Next.js 15 Partial Prerendering (PPR) mandates that the root shell of pages and layouts remain strictly static to allow immediate edge HTML streaming. Unwrapping dynamic async functions (e.g., cookies(), headers(), searchParams) outside of explicit Suspense boundaries de-optimizes the entire route tree into full dynamic server rendering. All dynamic context, uncached data fetches, and runtime request reads must be encapsulated within isolated child components wrapped in Suspense.","antiPatternHeadline":"Top-Level Dynamic Request Invocations Bypassing Suspense and Collapsing Edge Prerendered Shells","stars_count":52,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs15","ppr","react-suspense","edge-rendering","performance"],"exportEndpoints":{"claude":"/api/rules/nextjs15-ppr-dynamic-boundary-guardrail?format=claude","cursorMdc":"/api/rules/nextjs15-ppr-dynamic-boundary-guardrail?format=mdc","cursorrules":"/api/rules/nextjs15-ppr-dynamic-boundary-guardrail?format=cursor","windsurf":"/api/rules/nextjs15-ppr-dynamic-boundary-guardrail?format=windsurf","agents":"/api/rules/nextjs15-ppr-dynamic-boundary-guardrail?format=agents"}},{"id":"openfga-contextual-tuple-bound-latency-guardrail","title":"OpenFGA 1.6 Contextual Tuple Bounding & Recursion Depth Guardrail","category":"backend","severity":"critical","description":"Enforces strict cardinality constraints on dynamic contextual tuples and sets explicit evaluation depth limits during OpenFGA authorization checks. Prevents combinatorial graph expansion and tail-latency degradation across high-cardinality Zanzibar relationship graphs by mandating fail-fast validation, chunked batch evaluation, and client-side deadline propagation.","antiPatternHeadline":"Unbounded Contextual Tuple Injection Causing High-Cardinality Zanzibar Traversal Storms","stars_count":111,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","openfga","rebac","zanzibar","authorization","performance"],"exportEndpoints":{"claude":"/api/rules/openfga-contextual-tuple-bound-latency-guardrail?format=claude","cursorMdc":"/api/rules/openfga-contextual-tuple-bound-latency-guardrail?format=mdc","cursorrules":"/api/rules/openfga-contextual-tuple-bound-latency-guardrail?format=cursor","windsurf":"/api/rules/openfga-contextual-tuple-bound-latency-guardrail?format=windsurf","agents":"/api/rules/openfga-contextual-tuple-bound-latency-guardrail?format=agents"}},{"id":"fastapi-lifespan-task-supervisor-invariant","title":"FastAPI Lifespan-Managed Async Task Pipeline and Drain Invariant","category":"backend","severity":"critical","description":"Enforces deterministic, structured async worker lifecycles managed strictly through FastAPI lifespan context managers. Prevents orphaned background tasks, silent unhandled task exceptions, and thread/database pool exhaustion during client disconnection cascades by prohibiting ad-hoc asyncio.create_task and legacy Starlette BackgroundTasks for unbounded processing.","antiPatternHeadline":"Ad-hoc asyncio.create_task spawning and unmonitored BackgroundTasks leaking resources on client disconnect","stars_count":41,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","asyncio","lifespan","concurrency","connection-pools"],"exportEndpoints":{"claude":"/api/rules/fastapi-lifespan-task-supervisor-invariant?format=claude","cursorMdc":"/api/rules/fastapi-lifespan-task-supervisor-invariant?format=mdc","cursorrules":"/api/rules/fastapi-lifespan-task-supervisor-invariant?format=cursor","windsurf":"/api/rules/fastapi-lifespan-task-supervisor-invariant?format=windsurf","agents":"/api/rules/fastapi-lifespan-task-supervisor-invariant?format=agents"}},{"id":"postgres-17-streaming-io-parallel-budgeting","title":"Postgres 17 Streaming I/O and Parallel Hash Execution Budgeting","category":"backend","severity":"critical","description":"Enforces strict session-level resource admission controls and deterministic parameter scaling for PostgreSQL 17 streaming read operations and parallel hash join execution. Prevents kernel page cache eviction spirals, NVMe queue saturation, and Out-Of-Memory (OOM) terminations caused by unconstrained concurrent analytical OLAP queries.","antiPatternHeadline":"Global Memory Oversubscription and Unbounded Parallel Streaming I/O Prefetching","stars_count":94,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","postgres-17","streaming-io","olap","concurrency","performance"],"exportEndpoints":{"claude":"/api/rules/postgres-17-streaming-io-parallel-budgeting?format=claude","cursorMdc":"/api/rules/postgres-17-streaming-io-parallel-budgeting?format=mdc","cursorrules":"/api/rules/postgres-17-streaming-io-parallel-budgeting?format=cursor","windsurf":"/api/rules/postgres-17-streaming-io-parallel-budgeting?format=windsurf","agents":"/api/rules/postgres-17-streaming-io-parallel-budgeting?format=agents"}},{"id":"react-native-bridgeless-turbomodule-memory-safety-standard","title":"React Native 0.76+ Bridgeless TurboModule Memory Safety and Thread-Affinity Guardrail","category":"mobile","severity":"critical","description":"Enforces strict thread-affinity checks, JSI host object lifetime boundaries, and RAII wrappers across C++ TurboModules in the React Native 0.76+ Bridgeless Fabric runtime. Prevents use-after-free corruption from raw jsi::Value captures across asynchronous executor dispatch boundaries and eliminates UI/JS thread priority inversion deadlocks.","antiPatternHeadline":"Capturing raw jsi::Pointer references across asynchronous dispatch queues in Bridgeless TurboModules causing SIGSEGV and UI thread lockups","stars_count":62,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","react-native","bridgeless","turbomodules","jsi","c++","memory-safety"],"exportEndpoints":{"claude":"/api/rules/react-native-bridgeless-turbomodule-memory-safety-standard?format=claude","cursorMdc":"/api/rules/react-native-bridgeless-turbomodule-memory-safety-standard?format=mdc","cursorrules":"/api/rules/react-native-bridgeless-turbomodule-memory-safety-standard?format=cursor","windsurf":"/api/rules/react-native-bridgeless-turbomodule-memory-safety-standard?format=windsurf","agents":"/api/rules/react-native-bridgeless-turbomodule-memory-safety-standard?format=agents"}},{"id":"spiffe-spire-ephemeral-workload-attestation-standard","title":"SPIFFE/SPIRE Ephemeral Workload Attestation and Dynamic SVID Standard","category":"security","severity":"critical","description":"Enforces zero-trust multi-cloud identity verification by requiring workloads to obtain ephemeral X.509 and JWT SVIDs dynamically via the local SPIFFE Workload API Unix Domain Socket. Forbids the storage, mounting, or passing of long-lived cloud credentials, static API tokens, or hardcoded private keys. Mandates automated cert rotation and SPIFFE ID SAN validation for all cross-cluster and cross-cloud transport channels.","antiPatternHeadline":"Persisting static cloud provider credentials or long-lived static certificates instead of dynamic SPIFFE Workload API attestation","stars_count":104,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","spiffe","spire","zero-trust","mtls","cloud-security","attestation"],"exportEndpoints":{"claude":"/api/rules/spiffe-spire-ephemeral-workload-attestation-standard?format=claude","cursorMdc":"/api/rules/spiffe-spire-ephemeral-workload-attestation-standard?format=mdc","cursorrules":"/api/rules/spiffe-spire-ephemeral-workload-attestation-standard?format=cursor","windsurf":"/api/rules/spiffe-spire-ephemeral-workload-attestation-standard?format=windsurf","agents":"/api/rules/spiffe-spire-ephemeral-workload-attestation-standard?format=agents"}},{"id":"k8s-gateway-api-referencegrant-delegation","title":"Mandatory ReferenceGrant Handshake for Cross-Namespace Gateway API Route Delegation","category":"devops","severity":"critical","description":"Enforces explicit two-way cryptographic and administrative trust boundaries when delegating Gateway API routes or referencing cross-namespace backend services and secrets. In Kubernetes Gateway API v1.2+, any cross-namespace reference between Gateways, HTTPRoutes, and Services must have a co-located ReferenceGrant in the target namespace to prevent route hijacking and unauthorized traffic ingress.","antiPatternHeadline":"Unvalidated Cross-Namespace Route Attachment or Backend Forwarding Without Explicit Target-Namespace ReferenceGrant","stars_count":40,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","kubernetes","gateway-api","zero-trust","security","networking"],"exportEndpoints":{"claude":"/api/rules/k8s-gateway-api-referencegrant-delegation?format=claude","cursorMdc":"/api/rules/k8s-gateway-api-referencegrant-delegation?format=mdc","cursorrules":"/api/rules/k8s-gateway-api-referencegrant-delegation?format=cursor","windsurf":"/api/rules/k8s-gateway-api-referencegrant-delegation?format=windsurf","agents":"/api/rules/k8s-gateway-api-referencegrant-delegation?format=agents"}},{"id":"clickhouse-sharedmergetree-s3-tiering-guardrail","title":"ClickHouse SharedMergeTree S3 Tiering and Zero-Copy Mutation Guardrail","category":"devops","severity":"critical","description":"Enforces strict deterministic mutation ordering, zero-copy clone invariants, and isolated storage tiering policies across ClickHouse SharedMergeTree topologies backed by AWS S3/GCS. Prevents split-brain metadata divergence, object lifecycle thrashing, and uncoordinated partition rewriting during ingestion spikes.","antiPatternHeadline":"Executing Uncoordinated Mutations and Non-Idempotent Storage Policies on Shared S3 Volumes Without Centralized Coordination","stars_count":92,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","clickhouse","s3","sharedmergetree","distributed-systems","database-reliability"],"exportEndpoints":{"claude":"/api/rules/clickhouse-sharedmergetree-s3-tiering-guardrail?format=claude","cursorMdc":"/api/rules/clickhouse-sharedmergetree-s3-tiering-guardrail?format=mdc","cursorrules":"/api/rules/clickhouse-sharedmergetree-s3-tiering-guardrail?format=cursor","windsurf":"/api/rules/clickhouse-sharedmergetree-s3-tiering-guardrail?format=windsurf","agents":"/api/rules/clickhouse-sharedmergetree-s3-tiering-guardrail?format=agents"}},{"id":"svelte5-runes-lifecycle-teardown-guardrail","title":"Svelte 5 Runes Universal Reactivity & Lifecycle Boundary Isolation","category":"frontend","severity":"critical","description":"Enforces strict lifecycle boundaries and explicit effect disposal when crossing component contexts with universal runes (.svelte.ts). Prevents memory leaks caused by unbounded $effect.root scopes, detached signal listeners, and stale closure traps when reactive state instances escape Svelte component lifecycle trees into global or shared singletons.","antiPatternHeadline":"Leaking Unbounded Universal Runes and Stale Closures Across Component Mount Boundaries","stars_count":107,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","reactivity","memory-leaks"],"exportEndpoints":{"claude":"/api/rules/svelte5-runes-lifecycle-teardown-guardrail?format=claude","cursorMdc":"/api/rules/svelte5-runes-lifecycle-teardown-guardrail?format=mdc","cursorrules":"/api/rules/svelte5-runes-lifecycle-teardown-guardrail?format=cursor","windsurf":"/api/rules/svelte5-runes-lifecycle-teardown-guardrail?format=windsurf","agents":"/api/rules/svelte5-runes-lifecycle-teardown-guardrail?format=agents"}},{"id":"react-19-rsc-streaming-hydration-watermark-standard","title":"React 19 RSC Selective Hydration and Streaming Watermark Standard","category":"frontend","severity":"critical","description":"Enforces deterministic out-of-order partial hydration boundaries across deeply nested React 19 Server Components and Suspense boundaries. Prevents layout thrashing, cascading hydration waterfalls, and client-side mismatch bailouts by establishing rigid layout watermarks with strict CSS containment and non-cascading fallback constraints.","antiPatternHeadline":"Uncontained Deep Suspense Fallbacks Inducing Cumulative Layout Shift (CLS) and Cascade Hydration Deadlocks","stars_count":103,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","rsc","hydration","suspense","performance"],"exportEndpoints":{"claude":"/api/rules/react-19-rsc-streaming-hydration-watermark-standard?format=claude","cursorMdc":"/api/rules/react-19-rsc-streaming-hydration-watermark-standard?format=mdc","cursorrules":"/api/rules/react-19-rsc-streaming-hydration-watermark-standard?format=cursor","windsurf":"/api/rules/react-19-rsc-streaming-hydration-watermark-standard?format=windsurf","agents":"/api/rules/react-19-rsc-streaming-hydration-watermark-standard?format=agents"}},{"id":"axum-08-tokio-streaming-backpressure-sse-draining","title":"Axum 0.8 Tokio Streaming Backpressure & SSE Connection Draining Standard","category":"backend","severity":"critical","description":"Enforces bounded channels, consumer-driven stream backpressure, and coordinated connection draining for Server-Sent Events (SSE) and WebSockets during zero-downtime rolling deploys in Axum 0.8. Prevents memory leaks caused by unbounded queueing and abrupt client socket terminations using CancellationToken and graceful shutdown barriers.","antiPatternHeadline":"Unbounded mpsc Channel Buffering and Abrupt Connection Severing on SIGTERM","stars_count":103,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tokio","sse","websockets","graceful-shutdown"],"exportEndpoints":{"claude":"/api/rules/axum-08-tokio-streaming-backpressure-sse-draining?format=claude","cursorMdc":"/api/rules/axum-08-tokio-streaming-backpressure-sse-draining?format=mdc","cursorrules":"/api/rules/axum-08-tokio-streaming-backpressure-sse-draining?format=cursor","windsurf":"/api/rules/axum-08-tokio-streaming-backpressure-sse-draining?format=windsurf","agents":"/api/rules/axum-08-tokio-streaming-backpressure-sse-draining?format=agents"}},{"id":"postgres-17-logical-replication-failover-slot-sync-postgres-17-logi-632","title":"Postgres 17 Failover Slot Synchronization & Lag Invariant","category":"backend","severity":"critical","description":"Enforces strict failover slot synchronization (`failover = true` and `pg_sync_replication_slots()`) between primary and physical standby instances in Postgres 17. Guarantees zero message loss for active change data capture (CDC) consumers during unplanned primary failovers while actively gating primary transaction commit horizons via `synchronized_standby_slots` to avert catastrophic slot lag and disk-exhausting WAL bloat.","antiPatternHeadline":"Creating Logical Replication Slots Without Failover Flags or Synchronized Standby Slot Gating","stars_count":62,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres-17","logical-replication","cdc","high-availability","database-reliability"],"exportEndpoints":{"claude":"/api/rules/postgres-17-logical-replication-failover-slot-sync-postgres-17-logi-632?format=claude","cursorMdc":"/api/rules/postgres-17-logical-replication-failover-slot-sync-postgres-17-logi-632?format=mdc","cursorrules":"/api/rules/postgres-17-logical-replication-failover-slot-sync-postgres-17-logi-632?format=cursor","windsurf":"/api/rules/postgres-17-logical-replication-failover-slot-sync-postgres-17-logi-632?format=windsurf","agents":"/api/rules/postgres-17-logical-replication-failover-slot-sync-postgres-17-logi-632?format=agents"}},{"id":"bun-websocket-hibernation-zero-copy-tls-standard","title":"Bun 1.2 WebSocket Hibernation and Native Zero-Copy TLS Standard","category":"backend","severity":"critical","description":"Enforces Bun 1.2+ native WebSocket hibernation semantics and kernel-offloaded zero-copy TLS to maximize connection density across hundreds of thousands of concurrent sockets. Prohibits retaining JavaScript-side references to active sockets and mandates native topic subscriptions and epoll-backed idle suspension.","antiPatternHeadline":"Retaining Long-Lived WebSocket References in JavaScript Memory and Manual Socket Iteration","stars_count":115,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","websockets","tls","performance","concurrency"],"exportEndpoints":{"claude":"/api/rules/bun-websocket-hibernation-zero-copy-tls-standard?format=claude","cursorMdc":"/api/rules/bun-websocket-hibernation-zero-copy-tls-standard?format=mdc","cursorrules":"/api/rules/bun-websocket-hibernation-zero-copy-tls-standard?format=cursor","windsurf":"/api/rules/bun-websocket-hibernation-zero-copy-tls-standard?format=windsurf","agents":"/api/rules/bun-websocket-hibernation-zero-copy-tls-standard?format=agents"}},{"id":"kmp-swift-concurrency-stateflow-boundary","title":"KMP StateFlow to Swift AsyncStream Memory Safety and Lifecycle Protocol","category":"mobile","severity":"critical","description":"Enforces strict cancellation hooks and memory decoupling when bridging Kotlin Multiplatform StateFlow instances into Swift TaskGroup-managed AsyncStreams. Prevents silent ARC/Kotlin GC retain cycles and thread-confinement panics caused by indefinite Native Job references surviving Swift Task cancellations.","antiPatternHeadline":"Unregistered Kotlin Job Cancellations in Swift TaskGroup Producing ARC Zombie Leaks","stars_count":73,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","swift-concurrency","stateflow","memory-management"],"exportEndpoints":{"claude":"/api/rules/kmp-swift-concurrency-stateflow-boundary?format=claude","cursorMdc":"/api/rules/kmp-swift-concurrency-stateflow-boundary?format=mdc","cursorrules":"/api/rules/kmp-swift-concurrency-stateflow-boundary?format=cursor","windsurf":"/api/rules/kmp-swift-concurrency-stateflow-boundary?format=windsurf","agents":"/api/rules/kmp-swift-concurrency-stateflow-boundary?format=agents"}},{"id":"capacitor-7-native-bridge-thread-sandbox-standard","title":"Capacitor 7 Native Bridge Background Thread & WebView Sandbox Standard","category":"mobile","severity":"critical","description":"Enforces asynchronous background thread execution for native bridge invocations and implements strict WebView origin sandboxing in Capacitor 7. Eliminates main UI thread starvation during bridge roundtrips and prevents arbitrary JavaScript execution from unauthorized origins.","antiPatternHeadline":"Executing Synchronous Native Bridge Calls on the Main UI Queue with Permissive WebView Navigation","stars_count":46,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","capacitor-7","ios","android","webview","performance","security"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-native-bridge-thread-sandbox-standard?format=claude","cursorMdc":"/api/rules/capacitor-7-native-bridge-thread-sandbox-standard?format=mdc","cursorrules":"/api/rules/capacitor-7-native-bridge-thread-sandbox-standard?format=cursor","windsurf":"/api/rules/capacitor-7-native-bridge-thread-sandbox-standard?format=windsurf","agents":"/api/rules/capacitor-7-native-bridge-thread-sandbox-standard?format=agents"}},{"id":"webauthn-passkey-prf-cryptographic-seed-invariants","title":"WebAuthn Passkey PRF Cryptographic Seed Invariants for Zero-Knowledge Vaults","category":"security","severity":"critical","description":"Enforces strict cryptographic handling and memory safety invariants when deriving client-side Zero-Knowledge encryption keys via WebAuthn Pseudo-Random Function (PRF) extensions. Mandates domain-separated key derivation (HKDF), strict buffer zeroization of raw PRF outputs, and explicit assertions against authenticator extension omission.","antiPatternHeadline":"Directly consuming raw WebAuthn PRF output as symmetric cipher keys and leaking un-zeroized raw seeds across client state or network boundaries.","stars_count":74,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","passkeys","prf-extension","zero-knowledge","cryptography","hkdf"],"exportEndpoints":{"claude":"/api/rules/webauthn-passkey-prf-cryptographic-seed-invariants?format=claude","cursorMdc":"/api/rules/webauthn-passkey-prf-cryptographic-seed-invariants?format=mdc","cursorrules":"/api/rules/webauthn-passkey-prf-cryptographic-seed-invariants?format=cursor","windsurf":"/api/rules/webauthn-passkey-prf-cryptographic-seed-invariants?format=windsurf","agents":"/api/rules/webauthn-passkey-prf-cryptographic-seed-invariants?format=agents"}},{"id":"sigstore-cosign-slsa3-attestation-invariants","title":"Sigstore Cosign Keyless Artifact Attestation and SLSA Level 3 Invariants","category":"security","severity":"critical","description":"Enforces immutable cryptographic provenance and SLSA Level 3 build attestation verification for all OCI container images prior to deployment. Prohibits deployment via mutable image tags and mandates verification of keyless Fulcio certificates and Rekor transparency log entries against trusted OIDC identity bounds.","antiPatternHeadline":"Deploying Unverified OCI Images or Trusting Mutable Tags Without Rekor and Fulcio Attestation","stars_count":69,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","sigstore","cosign","slsa-level-3","supply-chain","container-security","provenance"],"exportEndpoints":{"claude":"/api/rules/sigstore-cosign-slsa3-attestation-invariants?format=claude","cursorMdc":"/api/rules/sigstore-cosign-slsa3-attestation-invariants?format=mdc","cursorrules":"/api/rules/sigstore-cosign-slsa3-attestation-invariants?format=cursor","windsurf":"/api/rules/sigstore-cosign-slsa3-attestation-invariants?format=windsurf","agents":"/api/rules/sigstore-cosign-slsa3-attestation-invariants?format=agents"}},{"id":"tetragon-kernel-exec-ancestry-enforcement","title":"Synchronous eBPF Tetragon Kernel-Level Process Ancestry and Namespace Escape Guardrails","category":"devops","severity":"critical","description":"Enforces synchronous in-kernel enforcement using Cilium Tetragon TracingPolicies to terminate unauthorized process execution, namespace transitions, and capability escalation before system calls return to user space. Prevents asynchronous post-exploitation telemetry delays by utilizing eBPF kprobe/tracepoint overrides and SIGKILL actions on ancestry policy violations. Mandates strict container namespace immutability and parent-child execution path constraints across containerized deployments.","antiPatternHeadline":"Relying on asynchronous user-space audit daemons or passive eBPF event streams that detect privilege escalation and container escapes only after syscall completion.","stars_count":105,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","tetragon","kubernetes","runtime-security","linux-kernel"],"exportEndpoints":{"claude":"/api/rules/tetragon-kernel-exec-ancestry-enforcement?format=claude","cursorMdc":"/api/rules/tetragon-kernel-exec-ancestry-enforcement?format=mdc","cursorrules":"/api/rules/tetragon-kernel-exec-ancestry-enforcement?format=cursor","windsurf":"/api/rules/tetragon-kernel-exec-ancestry-enforcement?format=windsurf","agents":"/api/rules/tetragon-kernel-exec-ancestry-enforcement?format=agents"}},{"id":"vite-6-environment-api-cross-runtime-isolation-invariant","title":"Vite 6 Environment API Strict Cross-Runtime Module Isolation Guardrail","category":"frontend","severity":"critical","description":"Enforces architectural boundary isolation across heterogeneous runtime environments (browser, node, workerd, edge) using the Vite 6 Environment API. Prevents cross-contamination of runtime-specific module graphs, accidental leaking of Node/Edge primitives into browser bundles, and leaky module resolution during unified multi-target SSR builds.","antiPatternHeadline":"Cross-Runtime Graph Contamination and Deprecated Monolithic SSR Configuration in Vite 6","stars_count":89,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["vite6","environment-api","module-isolation","ssr","edge-runtime","typescript"],"exportEndpoints":{"claude":"/api/rules/vite-6-environment-api-cross-runtime-isolation-invariant?format=claude","cursorMdc":"/api/rules/vite-6-environment-api-cross-runtime-isolation-invariant?format=mdc","cursorrules":"/api/rules/vite-6-environment-api-cross-runtime-isolation-invariant?format=cursor","windsurf":"/api/rules/vite-6-environment-api-cross-runtime-isolation-invariant?format=windsurf","agents":"/api/rules/vite-6-environment-api-cross-runtime-isolation-invariant?format=agents"}},{"id":"next15-ppr-shell-stream-hydration-invariant","title":"Next.js 15 Partial Prerendering (PPR) Shell-Stream Hydration Invariant","category":"frontend","severity":"critical","description":"Enforces strict isolation of dynamic runtime access (cookies, headers, uncached data) behind explicit Suspense boundaries in Next.js 15 Partial Prerendering (PPR). Prevents static shell de-optimization, delayed Time-to-First-Byte (TTFB), and client-side hydration thrashing caused by mismatched skeleton geometries under network jitter.","antiPatternHeadline":"Leaking Dynamic Request Data into Route Shells and Unbounded Fallback Skeletons","stars_count":82,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs15","react19","ppr","partial-prerendering","hydration","suspense"],"exportEndpoints":{"claude":"/api/rules/next15-ppr-shell-stream-hydration-invariant?format=claude","cursorMdc":"/api/rules/next15-ppr-shell-stream-hydration-invariant?format=mdc","cursorrules":"/api/rules/next15-ppr-shell-stream-hydration-invariant?format=cursor","windsurf":"/api/rules/next15-ppr-shell-stream-hydration-invariant?format=windsurf","agents":"/api/rules/next15-ppr-shell-stream-hydration-invariant?format=agents"}},{"id":"axum-0-8-transaction-cancellation-safety","title":"Axum 0.8 Cancellation Safety and RAII Rollback in Async Database Transactions","category":"backend","severity":"critical","description":"Enforces strict cancellation safety invariants across Axum 0.8 handlers holding database connections and transactions. Guarantees that premature HTTP client disconnections during async stream evaluation or unbounded yield points immediately trigger deterministic RAII rollbacks rather than starving connection pools, abandoning uncommitted transactions, or executing partial transactional side-effects.","antiPatternHeadline":"Holding Open Database Transactions Across Unbounded Client Streaming Yields Causing Pool Exhaustion on Cancellation","stars_count":99,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","sqlx","async","cancellation-safety","tokio"],"exportEndpoints":{"claude":"/api/rules/axum-0-8-transaction-cancellation-safety?format=claude","cursorMdc":"/api/rules/axum-0-8-transaction-cancellation-safety?format=mdc","cursorrules":"/api/rules/axum-0-8-transaction-cancellation-safety?format=cursor","windsurf":"/api/rules/axum-0-8-transaction-cancellation-safety?format=windsurf","agents":"/api/rules/axum-0-8-transaction-cancellation-safety?format=agents"}},{"id":"postgres-17-transaction-local-rls-guardrail","title":"Postgres 17 Multi-Tenant Transaction-Local RLS Variable Enforcement","category":"backend","severity":"critical","description":"Enforces transaction-scoped session variable injection ('SET LOCAL app.current_tenant_id') for multi-tenant Row-Level Security (RLS) policies within pooled database connections. Prohibits session-level parameter leakage ('SET app.current_tenant_id') across pooled clients that triggers catastrophic cross-tenant data exposure. Mandates explicit parameter validation, deterministic cast safety, and fail-closed RLS policies relying on nullif() and current_setting().","antiPatternHeadline":"Session-Scoped SET in Connection Pools Causing Cross-Tenant RLS Leaks","stars_count":110,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","rls","multi-tenancy","connection-pooling","pgbouncer"],"exportEndpoints":{"claude":"/api/rules/postgres-17-transaction-local-rls-guardrail?format=claude","cursorMdc":"/api/rules/postgres-17-transaction-local-rls-guardrail?format=mdc","cursorrules":"/api/rules/postgres-17-transaction-local-rls-guardrail?format=cursor","windsurf":"/api/rules/postgres-17-transaction-local-rls-guardrail?format=windsurf","agents":"/api/rules/postgres-17-transaction-local-rls-guardrail?format=agents"}},{"id":"nats-jetstream-deduplication-ack-window-alignment","title":"NATS JetStream 2.10 Clustered Deduplication Window and Ack Wait Alignment Invariant","category":"backend","severity":"critical","description":"Enforces deterministic at-most-once and exactly-once processing semantics across NATS JetStream 2.10 distributed clusters. Guarantees that stream-level duplicate tracking windows (`duplicate_window`) strictly exceed consumer acknowledgement wait periods (`ack_wait`) by at least a safety propagation buffer, while requiring deterministic, high-entropy `Nats-Msg-Id` headers on all publisher operations. Prevents phantom message duplication cascades during network partitions, consumer retry cycles, and Raft leader re-elections.","antiPatternHeadline":"Mismatched Duplicate Window and Consumer Ack Wait Resulting in Silent Double-Processing Cascades","stars_count":118,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","nats","jetstream","distributed-systems","idempotency","microservices"],"exportEndpoints":{"claude":"/api/rules/nats-jetstream-deduplication-ack-window-alignment?format=claude","cursorMdc":"/api/rules/nats-jetstream-deduplication-ack-window-alignment?format=mdc","cursorrules":"/api/rules/nats-jetstream-deduplication-ack-window-alignment?format=cursor","windsurf":"/api/rules/nats-jetstream-deduplication-ack-window-alignment?format=windsurf","agents":"/api/rules/nats-jetstream-deduplication-ack-window-alignment?format=agents"}},{"id":"oauth-2-1-dpop-token-binding-guardrail","title":"OAuth 2.1 RFC 9449 DPoP Cryptographic Token Binding & Nonce Enforcement","category":"security","severity":"critical","description":"Enforces RFC 9449 Demonstrating Proof-of-Possession (DPoP) at the API gateway layer to prevent credential theft and replay attacks. Access tokens must be cryptographically bound via thumbprint (jkt) to ephemeral asymmetric key pairs, validated against incoming DPoP proof JWTs, and subject to strict single-use server nonce cycling.","antiPatternHeadline":"Accepting Bearer tokens on sensitive APIs or validating DPoP proofs without thumbprint confirmation and nonce verification","stars_count":108,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","oauth2","dpop","rfc9449","api-gateway","zero-trust"],"exportEndpoints":{"claude":"/api/rules/oauth-2-1-dpop-token-binding-guardrail?format=claude","cursorMdc":"/api/rules/oauth-2-1-dpop-token-binding-guardrail?format=mdc","cursorrules":"/api/rules/oauth-2-1-dpop-token-binding-guardrail?format=cursor","windsurf":"/api/rules/oauth-2-1-dpop-token-binding-guardrail?format=windsurf","agents":"/api/rules/oauth-2-1-dpop-token-binding-guardrail?format=agents"}},{"id":"spiffe-spire-hardware-attested-envoy-identity-invariant","title":"Hardware-Attested SPIFFE/SPIRE SDS Invariant for Envoy Workload Identity","category":"security","severity":"critical","description":"Mandates that Envoy proxies dynamically consume cryptographic identities exclusively via the Secret Discovery Service (SDS) backed by a local TPM/vTPM-attested SPIRE Agent Unix Domain Socket. Prohibits static TLS mounts, long-lived secrets, and non-hardware node attestations across multi-cluster service meshes. Enforces continuous wire-speed X.509 SVID rotation and exact SPIFFE ID Trust Domain SAN validation.","antiPatternHeadline":"Static File-Mounted Certificates and Token-Attested Envoy Transport Sockets","stars_count":51,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","spiffe","spire","envoy","tpm","sds","zero-trust"],"exportEndpoints":{"claude":"/api/rules/spiffe-spire-hardware-attested-envoy-identity-invariant?format=claude","cursorMdc":"/api/rules/spiffe-spire-hardware-attested-envoy-identity-invariant?format=mdc","cursorrules":"/api/rules/spiffe-spire-hardware-attested-envoy-identity-invariant?format=cursor","windsurf":"/api/rules/spiffe-spire-hardware-attested-envoy-identity-invariant?format=windsurf","agents":"/api/rules/spiffe-spire-hardware-attested-envoy-identity-invariant?format=agents"}},{"id":"android-16kb-page-size-alignment-invariant","title":"Android 15 16KB Page Size Alignment and Native Memory Mapping Invariant","category":"mobile","severity":"critical","description":"Enforces strict 16KB (0x4000) page boundary alignment for all compiled ELF shared libraries (.so), dynamic memory mappings (mmap/mprotect), and native custom allocators. Android 15 devices running 16KB page kernels abort execution via dynamic linker failures or kernel panics if ELF segments or memory descriptors rely on legacy 4KB compile-time assumptions.","antiPatternHeadline":"Hardcoded 4KB Page Sizes and Unaligned ELF Segment Linking in Android NDK Binaries","stars_count":65,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","android","ndk","android-15","c-cpp","memory-management","elf-alignment"],"exportEndpoints":{"claude":"/api/rules/android-16kb-page-size-alignment-invariant?format=claude","cursorMdc":"/api/rules/android-16kb-page-size-alignment-invariant?format=mdc","cursorrules":"/api/rules/android-16kb-page-size-alignment-invariant?format=cursor","windsurf":"/api/rules/android-16kb-page-size-alignment-invariant?format=windsurf","agents":"/api/rules/android-16kb-page-size-alignment-invariant?format=agents"}},{"id":"swift-6-complete-concurrency-actor-bridge","title":"Swift 6 Complete Concurrency Actor-Isolated Bridge Guardrail","category":"mobile","severity":"critical","description":"Enforces compiler-level Sendable validation and strict actor isolation across native bridge boundaries (React Native TurboModules, Flutter Platform Channels, and WebKit script handlers) in Swift 6. Eliminates multithreaded data races by forbidding @unchecked Sendable escapes, unisolated mutable bridge state, and non-isolated async callbacks. Guarantees that all payloads crossing the boundary are strictly Sendable value types and mutation occurs exclusively within designated actors.","antiPatternHeadline":"Escaping Mutable Platform Channel or TurboModule State Across Unisolated Concurrent Contexts","stars_count":90,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","swift6","concurrency","actors","sendable","turbo-modules","platform-channels","ios"],"exportEndpoints":{"claude":"/api/rules/swift-6-complete-concurrency-actor-bridge?format=claude","cursorMdc":"/api/rules/swift-6-complete-concurrency-actor-bridge?format=mdc","cursorrules":"/api/rules/swift-6-complete-concurrency-actor-bridge?format=cursor","windsurf":"/api/rules/swift-6-complete-concurrency-actor-bridge?format=windsurf","agents":"/api/rules/swift-6-complete-concurrency-actor-bridge?format=agents"}},{"id":"opentelemetry-high-cardinality-dynamic-attribute-guardrail","title":"OpenTelemetry v1.28 Dynamic Attribute Cardinality Guardrail & Schema Validation","category":"devops","severity":"critical","description":"Enforces compile-time metric attribute typing and runtime cardinality shedding on OpenTelemetry metric streams. Prevents downstream TSDB (Prometheus, M3DB, Cortex, VictoriaMetrics) memory exhaustion and OOM cascades caused by unbounded dynamic dimensions such as UUIDs, email addresses, or unparameterized URLs.","antiPatternHeadline":"Injecting Dynamic High-Cardinality Identifiers Directly into OpenTelemetry Metric Dimensions","stars_count":57,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","metrics","cardinality","observability","tsdb","telemetry-pipeline"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-high-cardinality-dynamic-attribute-guardrail?format=claude","cursorMdc":"/api/rules/opentelemetry-high-cardinality-dynamic-attribute-guardrail?format=mdc","cursorrules":"/api/rules/opentelemetry-high-cardinality-dynamic-attribute-guardrail?format=cursor","windsurf":"/api/rules/opentelemetry-high-cardinality-dynamic-attribute-guardrail?format=windsurf","agents":"/api/rules/opentelemetry-high-cardinality-dynamic-attribute-guardrail?format=agents"}},{"id":"react-19-taint-api-serialization-guardrails","title":"React 19 Taint API & RSC Boundary Data Leakage Prevention","category":"frontend","severity":"critical","description":"Enforces deterministic data masking and memory-level boundary protection using React 19's experimental Taint APIs (experimental_taintObjectReference and experimental_taintUniqueValue). Prevents cryptographic secrets, authentication tokens, internal tenant identifiers, and unmasked PII from leaking across the React Server Component (RSC) serialization boundary into client bundles.","antiPatternHeadline":"Passing Raw Database Records or Unsanitized Context Containing Secrets Directly Across the RSC Flight Boundary","stars_count":113,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","rsc","nextjs","security","taint-api","data-leakage"],"exportEndpoints":{"claude":"/api/rules/react-19-taint-api-serialization-guardrails?format=claude","cursorMdc":"/api/rules/react-19-taint-api-serialization-guardrails?format=mdc","cursorrules":"/api/rules/react-19-taint-api-serialization-guardrails?format=cursor","windsurf":"/api/rules/react-19-taint-api-serialization-guardrails?format=windsurf","agents":"/api/rules/react-19-taint-api-serialization-guardrails?format=agents"}},{"id":"astro-5-content-layer-cache-invalidation-guardrail","title":"Astro 5 Content Layer Reactive Cache Invalidation & Static Pre-rendering Boundaries","category":"frontend","severity":"critical","description":"Enforces strict memory-bounded ingestion and deterministic cache invalidation within Astro 5 Content Layer custom loaders and hybrid pre-rendering routes. Guarantees deterministic static site generation (SSG) artifact stability and eliminates heap exhaustion during high-volume multi-tenant asset ingestion by forbidding in-memory entry buffering and un-hashed reactive cache bypasses.","antiPatternHeadline":"Unbounded In-Memory Accumulation and Volatile Cache Eviction in Astro 5 Custom Content Loaders","stars_count":63,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","astro","content-layer","cache-invalidation","ssg","performance"],"exportEndpoints":{"claude":"/api/rules/astro-5-content-layer-cache-invalidation-guardrail?format=claude","cursorMdc":"/api/rules/astro-5-content-layer-cache-invalidation-guardrail?format=mdc","cursorrules":"/api/rules/astro-5-content-layer-cache-invalidation-guardrail?format=cursor","windsurf":"/api/rules/astro-5-content-layer-cache-invalidation-guardrail?format=windsurf","agents":"/api/rules/astro-5-content-layer-cache-invalidation-guardrail?format=agents"}},{"id":"bun-worker-native-memory-fence-finalization-isolation","title":"Bun 1.2 Worker Memory Fence & FinalizationRegistry Isolation Guardrail","category":"backend","severity":"critical","description":"Enforces strict isolate boundaries and thread-safe lifecycle management for native C-bindings and Node-API handles across Bun 1.2 multi-threaded Workers. Prevents premature resource collection, cross-worker heap pollution, and use-after-free segfaults caused by uncoordinated FinalizationRegistry callbacks on transferred raw pointers.","antiPatternHeadline":"Cross-Worker Raw Pointer Leakage Subject to Asynchronous Foreign-Isolate Finalization","stars_count":110,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","workers","ffi","memory-fence","finalizationregistry","concurrency"],"exportEndpoints":{"claude":"/api/rules/bun-worker-native-memory-fence-finalization-isolation?format=claude","cursorMdc":"/api/rules/bun-worker-native-memory-fence-finalization-isolation?format=mdc","cursorrules":"/api/rules/bun-worker-native-memory-fence-finalization-isolation?format=cursor","windsurf":"/api/rules/bun-worker-native-memory-fence-finalization-isolation?format=windsurf","agents":"/api/rules/bun-worker-native-memory-fence-finalization-isolation?format=agents"}},{"id":"go-chi-distributed-context-cancellation-leak-quarantine","title":"Go Chi v5 Distributed Context Cancellation & Goroutine Leak Quarantine","category":"backend","severity":"critical","description":"Enforces strict propagation of HTTP request contexts across Chi v5 routers, downstream gRPC calls, and asynchronous worker goroutines. Eliminates goroutine leaks and cascading connection starvation by mandating context-derived channels, timeout inheritance, and structured concurrency patterns like errgroup.Group with derived context boundaries.","antiPatternHeadline":"Orphaned background goroutines and decoupled contexts causing silent resource exhaustion and zombie microservice queries.","stars_count":69,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","chi-v5","concurrency","goroutine-leaks","context-propagation","grpc"],"exportEndpoints":{"claude":"/api/rules/go-chi-distributed-context-cancellation-leak-quarantine?format=claude","cursorMdc":"/api/rules/go-chi-distributed-context-cancellation-leak-quarantine?format=mdc","cursorrules":"/api/rules/go-chi-distributed-context-cancellation-leak-quarantine?format=cursor","windsurf":"/api/rules/go-chi-distributed-context-cancellation-leak-quarantine?format=windsurf","agents":"/api/rules/go-chi-distributed-context-cancellation-leak-quarantine?format=agents"}},{"id":"pg17-adaptive-workmem-hashjoin-spill-control","title":"PostgreSQL 17 Adaptive WorkMem Hash-Join Memory Spilling Guardrail","category":"backend","severity":"critical","description":"Enforces deterministic bounded memory limits for PostgreSQL 17 multi-batch hash joins across concurrent analytical workloads. Mandates session-level dynamic work_mem scaling, hash-spill plan verification, and resource group isolation to completely prevent OS OOM-killer invocations during concurrent batch join spikes.","antiPatternHeadline":"Global Unbounded work_mem Sizing Combined with Uncalibrated Hash-Join Memory Accounting Causing OOM Crashes","stars_count":82,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql-17","database-performance","memory-management","query-optimization"],"exportEndpoints":{"claude":"/api/rules/pg17-adaptive-workmem-hashjoin-spill-control?format=claude","cursorMdc":"/api/rules/pg17-adaptive-workmem-hashjoin-spill-control?format=mdc","cursorrules":"/api/rules/pg17-adaptive-workmem-hashjoin-spill-control?format=cursor","windsurf":"/api/rules/pg17-adaptive-workmem-hashjoin-spill-control?format=windsurf","agents":"/api/rules/pg17-adaptive-workmem-hashjoin-spill-control?format=agents"}},{"id":"kmp-swift-concurrency-cancellation-bridge-guardrail","title":"Kotlin Multiplatform 2.1 Swift Concurrency Task Cancellation Bridge","category":"mobile","severity":"critical","description":"Mandates strict bidirectional cancellation propagation and explicit memory lifecycle boundaries across the Kotlin Multiplatform 2.1 Kotlin/Native and Swift async/await ABI. Prevents memory retention cycles and orphaned Kotlin coroutines running indefinitely in background dispatchers after parent Swift Tasks are cancelled.","antiPatternHeadline":"Orphaned Background Coroutines and ARC Retention Cycles Across Swift Task ABI","stars_count":63,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","swift-concurrency","kmp","ios","coroutines"],"exportEndpoints":{"claude":"/api/rules/kmp-swift-concurrency-cancellation-bridge-guardrail?format=claude","cursorMdc":"/api/rules/kmp-swift-concurrency-cancellation-bridge-guardrail?format=mdc","cursorrules":"/api/rules/kmp-swift-concurrency-cancellation-bridge-guardrail?format=cursor","windsurf":"/api/rules/kmp-swift-concurrency-cancellation-bridge-guardrail?format=windsurf","agents":"/api/rules/kmp-swift-concurrency-cancellation-bridge-guardrail?format=agents"}},{"id":"compose-strong-skipping-stability-guardrails","title":"Jetpack Compose 1.8 Strong Skipping Mode Stability Guardrails","category":"mobile","severity":"critical","description":"Enforces strict parameter immutability, immutable collection boundaries, and deterministic lambda memoization under Jetpack Compose 1.8 Strong Skipping Mode. While Strong Skipping enables skipping composables with unstable parameters via structural equality (equals), unoptimized collections, lack of custom equals, or in-place mutations trigger severe UI thread micro-stutters and dropped frames on low-tier Android devices.","antiPatternHeadline":"Relying on standard Kotlin collections or default instance equality under Strong Skipping, resulting in expensive deep equality checks and dropped frames during recomposition.","stars_count":67,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","android","jetpack-compose","performance","strong-skipping","kotlin"],"exportEndpoints":{"claude":"/api/rules/compose-strong-skipping-stability-guardrails?format=claude","cursorMdc":"/api/rules/compose-strong-skipping-stability-guardrails?format=mdc","cursorrules":"/api/rules/compose-strong-skipping-stability-guardrails?format=cursor","windsurf":"/api/rules/compose-strong-skipping-stability-guardrails?format=windsurf","agents":"/api/rules/compose-strong-skipping-stability-guardrails?format=agents"}},{"id":"wasi-0-2-component-model-capability-sandbox-isolation","title":"WASI 0.2 Capability-Based Sandbox Isolation and Resource Attenuation","category":"security","severity":"critical","description":"Enforces strict zero-ambient-authority capability derivation and deterministic resource attenuation for untrusted tenant guest components in WASI 0.2 edge runtimes. Mandates explicit capability binding, virtualized network/filesystem handles, strict epoch-based interruption, and dedicated per-tenant resource tables to mathematically prevent cross-tenant escape and resource exhaustion.","antiPatternHeadline":"Ambient Host Resource Inheritance and Unmetered Dynamic Linking in WASI 0.2 Guest Runtimes","stars_count":100,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["wasi","webassembly","component-model","security","zero-trust","edge-runtime","wasmtime"],"exportEndpoints":{"claude":"/api/rules/wasi-0-2-component-model-capability-sandbox-isolation?format=claude","cursorMdc":"/api/rules/wasi-0-2-component-model-capability-sandbox-isolation?format=mdc","cursorrules":"/api/rules/wasi-0-2-component-model-capability-sandbox-isolation?format=cursor","windsurf":"/api/rules/wasi-0-2-component-model-capability-sandbox-isolation?format=windsurf","agents":"/api/rules/wasi-0-2-component-model-capability-sandbox-isolation?format=agents"}},{"id":"sigstore-keyless-ephemeral-workload-attestation-production-standard","title":"Sigstore Keyless Ephemeral Workload Identity Attestation and Verification Standard","category":"security","severity":"critical","description":"Enforces zero-trust supply chain validation by mandating keyless, short-lived OIDC workload identity attestation via Sigstore (Fulcio and Rekor) instead of static long-lived private keys. Requires strict verification of cryptographic transparency log inclusion proofs (SETs) and cryptographic binding of ephemeral X.509 certificates to immutable CI/CD workload identity claims.","antiPatternHeadline":"Persisting static cryptographic signing keys in CI/CD secrets or skipping Rekor log and Fulcio SAN identity validation during artifact verification","stars_count":57,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","sigstore","software-supply-chain","attestation","oidc","zero-trust"],"exportEndpoints":{"claude":"/api/rules/sigstore-keyless-ephemeral-workload-attestation-production-standard?format=claude","cursorMdc":"/api/rules/sigstore-keyless-ephemeral-workload-attestation-production-standard?format=mdc","cursorrules":"/api/rules/sigstore-keyless-ephemeral-workload-attestation-production-standard?format=cursor","windsurf":"/api/rules/sigstore-keyless-ephemeral-workload-attestation-production-standard?format=windsurf","agents":"/api/rules/sigstore-keyless-ephemeral-workload-attestation-production-standard?format=agents"}},{"id":"otel-exponential-histogram-exemplar-alignment","title":"OpenTelemetry Exponential Histogram Aggregation and Exemplar Alignment Standard","category":"devops","severity":"critical","description":"Enforces OpenTelemetry native exponential bucket histograms with dynamic scaling over static explicit boundaries to bound timeseries cardinality while preserving relative error guarantees across latency dynamic ranges. Mandates deterministic attachment of distributed trace contexts via OpenTelemetry exemplars instead of injecting high-cardinality identifiers into metric dimensions.","antiPatternHeadline":"Static Bucket Histogram Cardinality Explosion and Metric Dimension Contamination","stars_count":66,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","metrics","observability","distributed-tracing","cardinality-control"],"exportEndpoints":{"claude":"/api/rules/otel-exponential-histogram-exemplar-alignment?format=claude","cursorMdc":"/api/rules/otel-exponential-histogram-exemplar-alignment?format=mdc","cursorrules":"/api/rules/otel-exponential-histogram-exemplar-alignment?format=cursor","windsurf":"/api/rules/otel-exponential-histogram-exemplar-alignment?format=windsurf","agents":"/api/rules/otel-exponential-histogram-exemplar-alignment?format=agents"}},{"id":"nextjs-ppr-dynamic-streaming-abort-boundary-invariant","title":"Next.js 15 PPR Dynamic Streaming Abort Boundary and Circuit-Breaker Invariant","category":"frontend","severity":"critical","description":"Enforces deterministic client-side fallback rendering and downstream microservice circuit-breaking when Partial Prerendering (PPR) dynamic stream holes exceed strict time-to-first-byte (TTFB) or streaming budget deadlines. Guarantees that suspended dynamic server components abort stalled upstream network requests using cooperative AbortController signals, preventing resource starvation and edge worker execution lockups.","antiPatternHeadline":"Unbounded React Suspense holes in PPR that block streaming indefinitely and cascade microservice latency into edge worker timeouts.","stars_count":55,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["nextjs","nextjs-15","ppr","react-server-components","streaming","circuit-breaker","resilience"],"exportEndpoints":{"claude":"/api/rules/nextjs-ppr-dynamic-streaming-abort-boundary-invariant?format=claude","cursorMdc":"/api/rules/nextjs-ppr-dynamic-streaming-abort-boundary-invariant?format=mdc","cursorrules":"/api/rules/nextjs-ppr-dynamic-streaming-abort-boundary-invariant?format=cursor","windsurf":"/api/rules/nextjs-ppr-dynamic-streaming-abort-boundary-invariant?format=windsurf","agents":"/api/rules/nextjs-ppr-dynamic-streaming-abort-boundary-invariant?format=agents"}},{"id":"svelte-5-reactive-cycle-containment-standard","title":"Svelte 5 Runes Reactive Cycle Containment & Microtask Starvation Prevention","category":"frontend","severity":"critical","description":"Enforces strict mathematical purity in $derived and $derived.by execution graphs to prevent microtask-loop starvation in high-frequency trading and monitoring dashboards. Prohibits reading transitively mutated state inside reactive derivations and enforces decoupled asynchronous state propagation via discrete effect handlers and event queues.","antiPatternHeadline":"Asynchronous Mutation Cascade Triggered Inside or Synchronously Downstream of $derived.by Computation Graphs","stars_count":116,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","reactivity","performance"],"exportEndpoints":{"claude":"/api/rules/svelte-5-reactive-cycle-containment-standard?format=claude","cursorMdc":"/api/rules/svelte-5-reactive-cycle-containment-standard?format=mdc","cursorrules":"/api/rules/svelte-5-reactive-cycle-containment-standard?format=cursor","windsurf":"/api/rules/svelte-5-reactive-cycle-containment-standard?format=windsurf","agents":"/api/rules/svelte-5-reactive-cycle-containment-standard?format=agents"}},{"id":"fastapi-async-multipart-streaming-buffer-fencing","title":"FastAPI Async Multipart Chunked Streaming & Bounded Buffer Fencing","category":"backend","severity":"critical","description":"Enforces strict chunked async streaming protocols for multi-gigabyte multipart file uploads and payload ingestion in FastAPI. Mandates backpressured async generators with bounded rolling byte buffers and incremental Pydantic v2 parsing to prevent unmanaged heap inflation and event-loop starvation. Eliminates standard UploadFile in-memory spooling and unconstrained eagerly parsed JSON payloads on large data vectors.","antiPatternHeadline":"Eager In-Memory Multipart Buffering and Blocking File Reads Leading to OOM Panics and Event-Loop Starvation","stars_count":77,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","python","streaming","backpressure","pydantic-v2","memory-safety"],"exportEndpoints":{"claude":"/api/rules/fastapi-async-multipart-streaming-buffer-fencing?format=claude","cursorMdc":"/api/rules/fastapi-async-multipart-streaming-buffer-fencing?format=mdc","cursorrules":"/api/rules/fastapi-async-multipart-streaming-buffer-fencing?format=cursor","windsurf":"/api/rules/fastapi-async-multipart-streaming-buffer-fencing?format=windsurf","agents":"/api/rules/fastapi-async-multipart-streaming-buffer-fencing?format=agents"}},{"id":"postgres17-streaming-io-readahead-concurrency-boundary","title":"Postgres 17 Streaming I/O Engine Read-Ahead Concurrency Boundary","category":"backend","severity":"critical","description":"Configures strict per-connection block prefetch ceilings against POSIX Direct I/O subsystem saturation to eliminate buffer cache lock contention during concurrent sequential analytics scans. In Postgres 17, unconstrained streaming read-ahead across parallel worker processes overwhelms OS queue depths and evicts hot OLTP pages through buffer pool thrashing. Enforcing calibrated io_combine_limit, maintenance_io_concurrency, and query-scoped prefetch boundaries prevents kernel I/O starvation and maintains deterministic p99 latencies.","antiPatternHeadline":"Unbounded Parallel Read-Ahead Starving Buffer Mapping Locks and Kernel I/O Ring Buffers","stars_count":86,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres17","streaming-io","direct-io","concurrency","performance","database"],"exportEndpoints":{"claude":"/api/rules/postgres17-streaming-io-readahead-concurrency-boundary?format=claude","cursorMdc":"/api/rules/postgres17-streaming-io-readahead-concurrency-boundary?format=mdc","cursorrules":"/api/rules/postgres17-streaming-io-readahead-concurrency-boundary?format=cursor","windsurf":"/api/rules/postgres17-streaming-io-readahead-concurrency-boundary?format=windsurf","agents":"/api/rules/postgres17-streaming-io-readahead-concurrency-boundary?format=agents"}},{"id":"kmp-native-concurrent-stateflow-atomic-barrier","title":"KMP Native Concurrent StateFlow Atomic Mutation Barrier Standard","category":"mobile","severity":"critical","description":"Enforces thread-safe, atomic mutations and cross-runtime boundary encapsulation for Kotlin Multiplatform StateFlow pipelines consumed by Swift. Precludes memory tearing, race-conditioned telemetry drops, and legacy thread-state freezing crashes during high-throughput concurrent ingress across Darwin GCD queues and Kotlin Native worker dispatchers.","antiPatternHeadline":"Unprotected mutable StateFlow reference exposure and non-atomic field assignments across Darwin-K/N thread boundaries","stars_count":82,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","swift","coroutines","stateflow","concurrency","darwin"],"exportEndpoints":{"claude":"/api/rules/kmp-native-concurrent-stateflow-atomic-barrier?format=claude","cursorMdc":"/api/rules/kmp-native-concurrent-stateflow-atomic-barrier?format=mdc","cursorrules":"/api/rules/kmp-native-concurrent-stateflow-atomic-barrier?format=cursor","windsurf":"/api/rules/kmp-native-concurrent-stateflow-atomic-barrier?format=windsurf","agents":"/api/rules/kmp-native-concurrent-stateflow-atomic-barrier?format=agents"}},{"id":"capacitor-7-enclave-biometric-attestation","title":"Hardware-Backed Enclave Biometric Attestation Invariant for Capacitor 7","category":"mobile","severity":"critical","description":"Enforces cryptographic payload signing inside Apple Secure Enclave or Android StrongBox Keymaster during biometric authentication in Capacitor 7 applications. Mitigates rogue WebView bridge interception, memory hooking (Frida/Xposed), and MITM exploits by prohibiting naive boolean biometric resolutions. All biometric authorizations must return an asymmetric cryptographic signature generated natively across a hardware-bound key paired with a server-issued challenge.","antiPatternHeadline":"Trusting Insecure Boolean Bridge Responses for Biometric Verification Without Hardware Attestation","stars_count":87,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor7","security","biometrics","secure-enclave","strongbox","attestation"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-enclave-biometric-attestation?format=claude","cursorMdc":"/api/rules/capacitor-7-enclave-biometric-attestation?format=mdc","cursorrules":"/api/rules/capacitor-7-enclave-biometric-attestation?format=cursor","windsurf":"/api/rules/capacitor-7-enclave-biometric-attestation?format=windsurf","agents":"/api/rules/capacitor-7-enclave-biometric-attestation?format=agents"}},{"id":"tauri-v2-multi-webview-ipc-capability-scoping-standard","title":"Tauri 2.0 Multi-WebView IPC Capability Scoping & Manifest Isolation Standard","category":"security","severity":"critical","description":"Enforces strict window-level and webview-level IPC permission scoping within Tauri 2.0 capability manifests to eliminate privilege escalation vectors across multi-window architectures. Restricts IPC commands, plugins, and remote URL access to explicit window identifiers and cryptographically verified contexts rather than shared or wildcard execution envelopes.","antiPatternHeadline":"Global Window Wildcards and Unscoped IPC Permissions Across Multi-WebView Desktop Contexts","stars_count":72,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","tauri-2.0","ipc","rust","capabilities","multi-window","sandboxing"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-multi-webview-ipc-capability-scoping-standard?format=claude","cursorMdc":"/api/rules/tauri-v2-multi-webview-ipc-capability-scoping-standard?format=mdc","cursorrules":"/api/rules/tauri-v2-multi-webview-ipc-capability-scoping-standard?format=cursor","windsurf":"/api/rules/tauri-v2-multi-webview-ipc-capability-scoping-standard?format=windsurf","agents":"/api/rules/tauri-v2-multi-webview-ipc-capability-scoping-standard?format=agents"}},{"id":"webauthn-prf-wasm-isolation-sandbox-standard","title":"WebAuthn PRF Ephemeral Wasm Sandboxing & Memory Zeroization Standard","category":"security","severity":"critical","description":"Mandates that raw cryptographic material derived via the WebAuthn PRF (Pseudo-Random Function) extension must immediately be ingested into an isolated, linear WebAssembly memory sandbox for key derivation and symmetric operations. Prohibits retaining raw PRF outputs or derived key material within the garbage-collected JavaScript heap, global state, or browser storage engines. Requires deterministic zeroization of linear Wasm memory immediately upon completion of cryptographic cycles to neutralize DOM-based memory scraping and XSS exfiltration.","antiPatternHeadline":"Persisting Raw WebAuthn PRF Secrets in Garbage-Collected JavaScript Heap or Web Storage","stars_count":92,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","prf-extension","wasm","cryptography","memory-isolation","zeroization"],"exportEndpoints":{"claude":"/api/rules/webauthn-prf-wasm-isolation-sandbox-standard?format=claude","cursorMdc":"/api/rules/webauthn-prf-wasm-isolation-sandbox-standard?format=mdc","cursorrules":"/api/rules/webauthn-prf-wasm-isolation-sandbox-standard?format=cursor","windsurf":"/api/rules/webauthn-prf-wasm-isolation-sandbox-standard?format=windsurf","agents":"/api/rules/webauthn-prf-wasm-isolation-sandbox-standard?format=agents"}},{"id":"ebpf-af-xdp-umem-watermark-guardrail","title":"AF_XDP UMEM Fill Ring Watermark & Kernel Drop Invariant","category":"devops","severity":"critical","description":"Enforces strict kernel-level drop policies and user-space fill-ring capacity watermarks before zero-copy UMEM buffer exhaustion degrades ingress packet processing. Mandates lock-free ring balance monitoring and active BPF map backpressure signaling to guarantee deterministic zero-copy networking under ingress microbursts.","antiPatternHeadline":"Unbounded AF_XDP Ingress Without Ring Watermark Enforcement Causing Silent UMEM Exhaustion","stars_count":95,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","af-xdp","networking","kernel","zero-copy"],"exportEndpoints":{"claude":"/api/rules/ebpf-af-xdp-umem-watermark-guardrail?format=claude","cursorMdc":"/api/rules/ebpf-af-xdp-umem-watermark-guardrail?format=mdc","cursorrules":"/api/rules/ebpf-af-xdp-umem-watermark-guardrail?format=cursor","windsurf":"/api/rules/ebpf-af-xdp-umem-watermark-guardrail?format=windsurf","agents":"/api/rules/ebpf-af-xdp-umem-watermark-guardrail?format=agents"}},{"id":"otel-metric-exemplar-fixed-reservoir-bounding-standard","title":"OpenTelemetry Metric Exemplar Fixed-Reservoir Cardinality Bounding Standard","category":"devops","severity":"critical","description":"Enforces strict memory-safe boundaries on OpenTelemetry exemplar retention across high-throughput metrics pipelines. Mandates lock-free fixed-size circular reservoirs and trace-based exemplar filters to eliminate heap exhaustion caused by unbounded trace-metric exemplar linkage under high transaction volumes.","antiPatternHeadline":"Unbounded or Default Exemplar Allocation Under High Throughput Causing Heap Bloat and GC Pauses","stars_count":106,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","metrics","exemplars","performance","memory-leak"],"exportEndpoints":{"claude":"/api/rules/otel-metric-exemplar-fixed-reservoir-bounding-standard?format=claude","cursorMdc":"/api/rules/otel-metric-exemplar-fixed-reservoir-bounding-standard?format=mdc","cursorrules":"/api/rules/otel-metric-exemplar-fixed-reservoir-bounding-standard?format=cursor","windsurf":"/api/rules/otel-metric-exemplar-fixed-reservoir-bounding-standard?format=windsurf","agents":"/api/rules/otel-metric-exemplar-fixed-reservoir-bounding-standard?format=agents"}},{"id":"react-19-tainted-reference-serialization-guardrail","title":"React 19 Server-to-Client Tainted Reference Serialization Boundary","category":"frontend","severity":"critical","description":"Enforces strict cryptographic and object-level poisoning using React 19's taintObjectReference and taintUniqueValue APIs across all Server Component data fetchers. Prevents catastrophic security leakage of API secrets, database credentials, and raw cryptographic keys through the React Server Component (RSC) Flight serialization protocol to client bundles.","antiPatternHeadline":"Exposing Raw Server Credentials and Sensitive Objects to RSC Flight Serialization Graphs","stars_count":72,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["react-19","rsc","nextjs","security","serialization","taint-api"],"exportEndpoints":{"claude":"/api/rules/react-19-tainted-reference-serialization-guardrail?format=claude","cursorMdc":"/api/rules/react-19-tainted-reference-serialization-guardrail?format=mdc","cursorrules":"/api/rules/react-19-tainted-reference-serialization-guardrail?format=cursor","windsurf":"/api/rules/react-19-tainted-reference-serialization-guardrail?format=windsurf","agents":"/api/rules/react-19-tainted-reference-serialization-guardrail?format=agents"}},{"id":"vite-6-environment-api-runtime-isolation-guardrail","title":"Vite 6 Environment API Cross-Runtime State Isolation & HMR Invariant","category":"frontend","severity":"critical","description":"Enforces strict process, context, and module graph isolation across heterogeneous SSR runtimes (Workerd, Bun, Node) within the Vite 6 Environment API. Prevents shared memory corruption, cross-runtime prototype pollution, and out-of-order state leakage during Hot Module Replacement (HMR).","antiPatternHeadline":"Cross-Pollinating Global State and Unified Module Graphs Across Heterogeneous Vite 6 DevEnvironments","stars_count":109,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","vite","vite-6","ssr","workerd","hmr","environment-api"],"exportEndpoints":{"claude":"/api/rules/vite-6-environment-api-runtime-isolation-guardrail?format=claude","cursorMdc":"/api/rules/vite-6-environment-api-runtime-isolation-guardrail?format=mdc","cursorrules":"/api/rules/vite-6-environment-api-runtime-isolation-guardrail?format=cursor","windsurf":"/api/rules/vite-6-environment-api-runtime-isolation-guardrail?format=windsurf","agents":"/api/rules/vite-6-environment-api-runtime-isolation-guardrail?format=agents"}},{"id":"bun-ffi-buffer-pinning-reclamation","title":"Bun 1.2 Native FFI Buffer Pinning and Explicit Memory Reclamation Standard","category":"backend","severity":"critical","description":"Establishes deterministic lifecycle boundaries and pin-tracking for Uint8Array memory buffers crossed between Bun 1.2 runtime and foreign native dynamic libraries (C/Rust). Prevents premature JavaScript garbage collection, use-after-free (UAF), and native memory leaks during asynchronous FFI invocations and worker-thread dispatch under high-throughput I/O.","antiPatternHeadline":"Ephemeral FFI pointer conversions causing catastrophic use-after-free or unbounded unmanaged heap leaks","stars_count":93,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","ffi","memory-management","native","rust","c"],"exportEndpoints":{"claude":"/api/rules/bun-ffi-buffer-pinning-reclamation?format=claude","cursorMdc":"/api/rules/bun-ffi-buffer-pinning-reclamation?format=mdc","cursorrules":"/api/rules/bun-ffi-buffer-pinning-reclamation?format=cursor","windsurf":"/api/rules/bun-ffi-buffer-pinning-reclamation?format=windsurf","agents":"/api/rules/bun-ffi-buffer-pinning-reclamation?format=agents"}},{"id":"pg17-streaming-io-vector-scan-buffer-guardrail","title":"Postgres 17 Streaming I/O Vector Scan Buffer Pool Guardrail","category":"backend","severity":"critical","description":"Enforces deterministic configuration and session-level constraints for PostgreSQL 17 asynchronous streaming I/O and vectorized scans. Saturates high-bandwidth NVMe storage during bulk analytical queries while isolating ring buffer access strategies (BAS_BULKREAD) to prevent eviction of hot OLTP cache blocks from shared buffers.","antiPatternHeadline":"Global Unconstrained Table Scans Evicting Low-Latency OLTP Buffer Pools via Unbounded Streaming I/O","stars_count":87,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql-17","streaming-io","performance","buffer-pool","nvme-saturation"],"exportEndpoints":{"claude":"/api/rules/pg17-streaming-io-vector-scan-buffer-guardrail?format=claude","cursorMdc":"/api/rules/pg17-streaming-io-vector-scan-buffer-guardrail?format=mdc","cursorrules":"/api/rules/pg17-streaming-io-vector-scan-buffer-guardrail?format=cursor","windsurf":"/api/rules/pg17-streaming-io-vector-scan-buffer-guardrail?format=windsurf","agents":"/api/rules/pg17-streaming-io-vector-scan-buffer-guardrail?format=agents"}},{"id":"fastapi-lifespan-pydantic-v2-core-schema-cache","title":"FastAPI Lifespan-Scoped Pydantic V2 Core Schema Cache Invariant","category":"backend","severity":"critical","description":"Enforces pre-compilation and immutable caching of Pydantic V2 TypeAdapters and complex CoreSchemas during the FastAPI application lifespan initialization phase. Prevents runtime thread-safety overhead, JIT schema validator recompilation, and tail-latency degradation under high-concurrency request execution paths.","antiPatternHeadline":"Dynamic Runtime Instantiation of Pydantic TypeAdapter or SchemaValidator Within Request Handlers","stars_count":50,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","pydantic-v2","pydantic-core","concurrency","performance"],"exportEndpoints":{"claude":"/api/rules/fastapi-lifespan-pydantic-v2-core-schema-cache?format=claude","cursorMdc":"/api/rules/fastapi-lifespan-pydantic-v2-core-schema-cache?format=mdc","cursorrules":"/api/rules/fastapi-lifespan-pydantic-v2-core-schema-cache?format=cursor","windsurf":"/api/rules/fastapi-lifespan-pydantic-v2-core-schema-cache?format=windsurf","agents":"/api/rules/fastapi-lifespan-pydantic-v2-core-schema-cache?format=agents"}},{"id":"kmp-skiko-metal-vulkan-frame-pacing-mutex-standard","title":"KMP Skiko Metal/Vulkan Frame Pacing and Mutex Synchronization Standard","category":"mobile","severity":"critical","description":"Enforces strict isolation between native frame-pacing mechanisms (CADisplayLink/Choreographer) and Skiko rendering mutexes in Compose Multiplatform. Prevents main-thread priority inversion and deadlocks by prohibiting synchronous waits on GPU drawables or command buffer completion inside lock-holding native vsync callbacks.","antiPatternHeadline":"Synchronously blocking CADisplayLink or Main RunLoop on Skiko Render Mutexes and GPU Surface Acquisition","stars_count":66,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kmp","compose-multiplatform","skiko","metal","vulkan","threading","graphics"],"exportEndpoints":{"claude":"/api/rules/kmp-skiko-metal-vulkan-frame-pacing-mutex-standard?format=claude","cursorMdc":"/api/rules/kmp-skiko-metal-vulkan-frame-pacing-mutex-standard?format=mdc","cursorrules":"/api/rules/kmp-skiko-metal-vulkan-frame-pacing-mutex-standard?format=cursor","windsurf":"/api/rules/kmp-skiko-metal-vulkan-frame-pacing-mutex-standard?format=windsurf","agents":"/api/rules/kmp-skiko-metal-vulkan-frame-pacing-mutex-standard?format=agents"}},{"id":"webauthn-device-bound-attestation-enforcement-webauthn-device--616","title":"WebAuthn Device-Bound Attestation vs Synced-Passkey Enforcement Invariant","category":"security","severity":"critical","description":"Enforces strict validation of authenticator attachment, AAGUID metadata, and authenticator data flags at the Relying Party (RP) layer during credential registration and step-up authentication. Prevents multi-device synced credentials (such as iCloud Keychain or Google Password Manager passkeys) from satisfying high-assurance authorization gates requiring hardware-bound FIDO2 security keys (YubiKey, Titan).","antiPatternHeadline":"Accepting Synced Passkeys for Step-Up Authentication Due to Missing AAGUID and BE/BS Flag Checks","stars_count":44,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","fido2","passkeys","authentication","cryptography"],"exportEndpoints":{"claude":"/api/rules/webauthn-device-bound-attestation-enforcement-webauthn-device--616?format=claude","cursorMdc":"/api/rules/webauthn-device-bound-attestation-enforcement-webauthn-device--616?format=mdc","cursorrules":"/api/rules/webauthn-device-bound-attestation-enforcement-webauthn-device--616?format=cursor","windsurf":"/api/rules/webauthn-device-bound-attestation-enforcement-webauthn-device--616?format=windsurf","agents":"/api/rules/webauthn-device-bound-attestation-enforcement-webauthn-device--616?format=agents"}},{"id":"ebpf-xdp-hardware-syn-flood-mitigation-standard","title":"eBPF XDP Hardware-Offloaded SYN Flood Mitigation Standard","category":"security","severity":"critical","description":"Enforces deterministic drop and SYN-cookie generation directly at the NIC driver/offload XDP layer to eliminate kernel sk_buff allocation overhead under volumetric SYN floods. Prevents control-plane saturation and memory starvation by executing strict pointer-bounds validation, incremental L3/L4 checksum recalculation, and line-rate packet drops before traffic ascends into the Linux network subsystem.","antiPatternHeadline":"Leaking Volumetric SYN Packets to Generic Stack via Incomplete Bounds Checks or SKB Allocation Fallbacks","stars_count":97,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","ebpf","xdp","ddos-mitigation","kernel","networking","c"],"exportEndpoints":{"claude":"/api/rules/ebpf-xdp-hardware-syn-flood-mitigation-standard?format=claude","cursorMdc":"/api/rules/ebpf-xdp-hardware-syn-flood-mitigation-standard?format=mdc","cursorrules":"/api/rules/ebpf-xdp-hardware-syn-flood-mitigation-standard?format=cursor","windsurf":"/api/rules/ebpf-xdp-hardware-syn-flood-mitigation-standard?format=windsurf","agents":"/api/rules/ebpf-xdp-hardware-syn-flood-mitigation-standard?format=agents"}},{"id":"opentelemetry-baggage-hmac-integrity-envelope","title":"OpenTelemetry W3C Baggage Cryptographic Integrity Envelope Standard","category":"devops","severity":"critical","description":"Enforces strict HMAC-SHA256 signature verification and deterministic schema whitelisting on outbound and inbound W3C Baggage context propagation. Prevents tenant impersonation, privilege escalation, and log injection attacks across untrusted multi-cloud service mesh boundaries by rejecting forged or unverified contextual key-value pairs.","antiPatternHeadline":"Propagating Unauthenticated W3C Baggage Headers Blindly Across Distributed Service Boundaries","stars_count":61,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","security","zero-trust","distributed-tracing","w3c-baggage"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-baggage-hmac-integrity-envelope?format=claude","cursorMdc":"/api/rules/opentelemetry-baggage-hmac-integrity-envelope?format=mdc","cursorrules":"/api/rules/opentelemetry-baggage-hmac-integrity-envelope?format=cursor","windsurf":"/api/rules/opentelemetry-baggage-hmac-integrity-envelope?format=windsurf","agents":"/api/rules/opentelemetry-baggage-hmac-integrity-envelope?format=agents"}},{"id":"spiffe-spire-dynamic-svid-rotation-guardrail","title":"SPIFFE/SPIRE Dynamic SVID Zero-Downtime TLS Handshake Guardrail","category":"devops","severity":"critical","description":"Enforces atomic in-memory dynamic SVID X.509 rotation using thread-safe pointers and dynamic TLS SNI/Handshake callbacks (e.g., GetCertificate/sni_callback). Prevents process restarts, connection draining drops, and destructive TLS renegotiation loops across high-throughput edge proxies.","antiPatternHeadline":"Hard Restarting Services or Rebinding Listeners on SPIFFE SVID Expiration","stars_count":75,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","spiffe","spire","mtls","zero-downtime","tls-rotation","security"],"exportEndpoints":{"claude":"/api/rules/spiffe-spire-dynamic-svid-rotation-guardrail?format=claude","cursorMdc":"/api/rules/spiffe-spire-dynamic-svid-rotation-guardrail?format=mdc","cursorrules":"/api/rules/spiffe-spire-dynamic-svid-rotation-guardrail?format=cursor","windsurf":"/api/rules/spiffe-spire-dynamic-svid-rotation-guardrail?format=windsurf","agents":"/api/rules/spiffe-spire-dynamic-svid-rotation-guardrail?format=agents"}},{"id":"svelte-5-runes-memory-boundary-invariant","title":"Svelte 5 Runes Memory Boundary & Proxy Graph Isolation Invariant","category":"frontend","severity":"critical","description":"Enforces strict memory boundary hygiene between Svelte 5 fine-grained reactive proxy graphs ($state) and long-lived outer micro-frontend (MFE) contexts. Unsanitized sharing of deep reactive state creates implicit signal dependency retain-cycles that prevent garbage collection of detached MFE DOM nodes, component trees, and reactive effects.","antiPatternHeadline":"Exposing Raw Svelte 5 Reactive Proxies Across Long-Lived Micro-Frontend Shells and Event Buses","stars_count":63,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","memory-leaks","micro-frontends","reactivity"],"exportEndpoints":{"claude":"/api/rules/svelte-5-runes-memory-boundary-invariant?format=claude","cursorMdc":"/api/rules/svelte-5-runes-memory-boundary-invariant?format=mdc","cursorrules":"/api/rules/svelte-5-runes-memory-boundary-invariant?format=cursor","windsurf":"/api/rules/svelte-5-runes-memory-boundary-invariant?format=windsurf","agents":"/api/rules/svelte-5-runes-memory-boundary-invariant?format=agents"}},{"id":"axum-08-tokio-task-cancellation-backpressure-standard","title":"Axum 0.8 Tokio Task Cancellation & Hyper Socket Disconnect Guardrail","category":"backend","severity":"critical","description":"Enforces strict cancellation safety, RAII-driven cleanup, and child task termination for Axum 0.8 handlers backed by Tokio and Hyper. Mandates explicit cancellation token trees and abort-on-drop semantics to eliminate orphaned background workers, zombie streaming connections, and database connection pool starvation when clients abruptly disconnect.","antiPatternHeadline":"Spawning detached tokio::spawn workloads inside Axum handlers without CancellationToken or RAII abort guards","stars_count":67,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tokio","hyper","concurrency","cancellation-safety"],"exportEndpoints":{"claude":"/api/rules/axum-08-tokio-task-cancellation-backpressure-standard?format=claude","cursorMdc":"/api/rules/axum-08-tokio-task-cancellation-backpressure-standard?format=mdc","cursorrules":"/api/rules/axum-08-tokio-task-cancellation-backpressure-standard?format=cursor","windsurf":"/api/rules/axum-08-tokio-task-cancellation-backpressure-standard?format=windsurf","agents":"/api/rules/axum-08-tokio-task-cancellation-backpressure-standard?format=agents"}},{"id":"go-coroutine-iterator-arena-allocation-invariant","title":"Go 1.24 Range-over-Func Iterator and Arena Memory Lifetime Invariants","category":"backend","severity":"critical","description":"Mandates strict lifetime boundaries and zero-escape semantics when combining Go 1.24 iterators (iter.Seq, iter.Seq2, iter.Pull) with memory arenas or reusable scratch allocations. Eliminates GC pause overhead in high-throughput streaming pipelines while mathematically preventing use-after-free corruption caused by retaining ephemeral pointers across iteration reset phases.","antiPatternHeadline":"Retaining or Escaping Ephemeral Arena-Allocated Pointers Across Range-over-Func Yield Boundaries","stars_count":87,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","iterators","memory-arenas","coroutines","zero-allocation"],"exportEndpoints":{"claude":"/api/rules/go-coroutine-iterator-arena-allocation-invariant?format=claude","cursorMdc":"/api/rules/go-coroutine-iterator-arena-allocation-invariant?format=mdc","cursorrules":"/api/rules/go-coroutine-iterator-arena-allocation-invariant?format=cursor","windsurf":"/api/rules/go-coroutine-iterator-arena-allocation-invariant?format=windsurf","agents":"/api/rules/go-coroutine-iterator-arena-allocation-invariant?format=agents"}},{"id":"postgres-17-failover-slot-sync-invariant","title":"Postgres 17 Failover Slot Sync Replication Invariant for Transactional Outbox","category":"backend","severity":"critical","description":"Enforces failover logical replication slot synchronization natively introduced in Postgres 17 across streaming physical standby instances. Guarantees zero message loss and prevents silent outbox replication stream drops or catastrophic offset regression during planned or unplanned failovers.","antiPatternHeadline":"Creating unsynced physical/logical replication slots causing silent event drops or duplicate re-emission upon standby promotion.","stars_count":42,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","replication","transactional-outbox","high-availability","distributed-systems"],"exportEndpoints":{"claude":"/api/rules/postgres-17-failover-slot-sync-invariant?format=claude","cursorMdc":"/api/rules/postgres-17-failover-slot-sync-invariant?format=mdc","cursorrules":"/api/rules/postgres-17-failover-slot-sync-invariant?format=cursor","windsurf":"/api/rules/postgres-17-failover-slot-sync-invariant?format=windsurf","agents":"/api/rules/postgres-17-failover-slot-sync-invariant?format=agents"}},{"id":"kmp-swift-arc-deterministic-interop-standard","title":"Deterministic Swift-ARC and Kotlin/Native Boundary Lifecycle Management","category":"mobile","severity":"critical","description":"Prevents cross-runtime cyclic memory deadlocks and untracked retain leaks across Kotlin/Native tracing GC and Swift Automatic Reference Counting (ARC). Mandates zero strong bidirectional references across the Objective-C/Swift bridge, deterministic delegate detachment, and explicit teardown protocols for offline-first enterprise synchronizers.","antiPatternHeadline":"Unmanaged Strong Bidirectional Cross-Runtime Delegates Causing Permanent Retention and ARC Deadlocks","stars_count":42,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kmp","kotlin-native","swift","arc","memory-management","offline-first"],"exportEndpoints":{"claude":"/api/rules/kmp-swift-arc-deterministic-interop-standard?format=claude","cursorMdc":"/api/rules/kmp-swift-arc-deterministic-interop-standard?format=mdc","cursorrules":"/api/rules/kmp-swift-arc-deterministic-interop-standard?format=cursor","windsurf":"/api/rules/kmp-swift-arc-deterministic-interop-standard?format=windsurf","agents":"/api/rules/kmp-swift-arc-deterministic-interop-standard?format=agents"}},{"id":"capacitor-7-webauthn-prf-hardware-derivation","title":"Capacitor 7 WebAuthn PRF Hardware Key Derivation Invariant","category":"mobile","severity":"critical","description":"Enforces hardware-backed zero-knowledge key derivation using the WebAuthn Pseudo-Random Function (PRF) extension within Capacitor 7 native bridges. Ensures derived symmetric encryption keys are computed in native secure enclaves/Keystore without exposing long-lived master secrets, credential IDs, or raw entropy directly to the untrusted WebView JavaScript context.","antiPatternHeadline":"Deriving master encryption keys in WebView JavaScript or caching PRF raw outputs in unencrypted storage","stars_count":42,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","webauthn","prf","cryptography","security","biometrics"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-webauthn-prf-hardware-derivation?format=claude","cursorMdc":"/api/rules/capacitor-7-webauthn-prf-hardware-derivation?format=mdc","cursorrules":"/api/rules/capacitor-7-webauthn-prf-hardware-derivation?format=cursor","windsurf":"/api/rules/capacitor-7-webauthn-prf-hardware-derivation?format=windsurf","agents":"/api/rules/capacitor-7-webauthn-prf-hardware-derivation?format=agents"}},{"id":"oauth21-rfc8705-mtls-sender-constrained-tokens","title":"OAuth 2.1 RFC 8705 Mutual-TLS Sender-Constrained Token Verification","category":"security","severity":"critical","description":"Mandates strict verification of sender-constrained access tokens bound to client X.509 certificates as specified in RFC 8705. Resource servers must extract the active mutual TLS client certificate, compute its SHA-256 DER digest (x5t#S256), and perform a constant-time comparison against the token confirmation claim (cnf). Replay attacks and exfiltrated tokens must be rejected unconditionally if the certificate thumbprint does not match the active TLS session.","antiPatternHeadline":"Accepting Bearer Tokens Without Validating Certificate Confirmation (cnf.x5t#S256) Against Active mTLS Session","stars_count":61,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","oauth2","rfc8705","mtls","jwt","zero-trust"],"exportEndpoints":{"claude":"/api/rules/oauth21-rfc8705-mtls-sender-constrained-tokens?format=claude","cursorMdc":"/api/rules/oauth21-rfc8705-mtls-sender-constrained-tokens?format=mdc","cursorrules":"/api/rules/oauth21-rfc8705-mtls-sender-constrained-tokens?format=cursor","windsurf":"/api/rules/oauth21-rfc8705-mtls-sender-constrained-tokens?format=windsurf","agents":"/api/rules/oauth21-rfc8705-mtls-sender-constrained-tokens?format=agents"}},{"id":"k8s-gateway-api-gamma-mesh-guardrail","title":"Kubernetes Gateway API v1.2 GAMMA Mesh Routing and Zero-Trust Guardrail","category":"devops","severity":"critical","description":"Enforces Gateway API v1.2 GAMMA (Gateway API for Mesh Management and Administration) specifications for zero-trust east-west service routing. Mandates using Service parentRefs for service-to-service routing without sidecars, preventing ingress gateway looping and unauthorized cross-namespace route bindings. Ensures mutual TLS verification via BackendTLSPolicy and ReferenceGrant compliance across infrastructure fabrics.","antiPatternHeadline":"Hairpinning East-West Mesh Traffic Through North-South Ingress Gateways or Binding Cross-Namespace Services Without ReferenceGrant","stars_count":70,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["kubernetes","gateway-api","gamma","service-mesh","zero-trust","devops","cilium","istio-ambient"],"exportEndpoints":{"claude":"/api/rules/k8s-gateway-api-gamma-mesh-guardrail?format=claude","cursorMdc":"/api/rules/k8s-gateway-api-gamma-mesh-guardrail?format=mdc","cursorrules":"/api/rules/k8s-gateway-api-gamma-mesh-guardrail?format=cursor","windsurf":"/api/rules/k8s-gateway-api-gamma-mesh-guardrail?format=windsurf","agents":"/api/rules/k8s-gateway-api-gamma-mesh-guardrail?format=agents"}},{"id":"otel-w3c-trace-context-dlq-preservation","title":"OpenTelemetry W3C Trace Context and Baggage Preservation in Event-Driven DLQ Pipelines","category":"devops","severity":"critical","description":"Enforces strict extraction, preservation, and propagation of W3C traceparent, tracestate, and OpenTelemetry baggage across asynchronous message retries and Dead Letter Queue (DLQ) routing. Prevents distributed trace truncation and observability blind spots by mandating explicit Span Links and deterministic header propagation when redirecting poisoned payloads to dead-letter brokers.","antiPatternHeadline":"Telemetry orphan routing where consumer failures publish to DLQs with blank headers or disconnected root spans.","stars_count":61,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","w3c-tracecontext","distributed-tracing","dlq","kafka","event-driven"],"exportEndpoints":{"claude":"/api/rules/otel-w3c-trace-context-dlq-preservation?format=claude","cursorMdc":"/api/rules/otel-w3c-trace-context-dlq-preservation?format=mdc","cursorrules":"/api/rules/otel-w3c-trace-context-dlq-preservation?format=cursor","windsurf":"/api/rules/otel-w3c-trace-context-dlq-preservation?format=windsurf","agents":"/api/rules/otel-w3c-trace-context-dlq-preservation?format=agents"}},{"id":"openfga-rebac-consistency-latency-guardrail","title":"OpenFGA 1.6+ Distributed ReBAC Read-After-Write Consistency & Sub-Millisecond Latency Guardrail","category":"security","severity":"critical","description":"Enforces strict read-after-write authorization invariants across distributed cell architectures using OpenFGA 1.6+. Prevents the Zanzibar 'New Enemy Problem' by guaranteeing monotonic consistency during permission mutations while preserving sub-millisecond edge check latencies via selective consistency levels and contextual tuples.","antiPatternHeadline":"Blind Eventually-Consistent Read-After-Write Evaluation Causing Authorization Bypass (New Enemy Problem)","stars_count":41,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","rebac","zanzibar","distributed-systems","authorization"],"exportEndpoints":{"claude":"/api/rules/openfga-rebac-consistency-latency-guardrail?format=claude","cursorMdc":"/api/rules/openfga-rebac-consistency-latency-guardrail?format=mdc","cursorrules":"/api/rules/openfga-rebac-consistency-latency-guardrail?format=cursor","windsurf":"/api/rules/openfga-rebac-consistency-latency-guardrail?format=windsurf","agents":"/api/rules/openfga-rebac-consistency-latency-guardrail?format=agents"}},{"id":"nextjs-react19-taint-api-data-leakage-guardrail","title":"Next.js 15 & React 19 Taint Object API Serialization Boundary Guardrail","category":"frontend","severity":"critical","description":"Enforces strict boundary isolation of sensitive server-side secrets, raw database models, and PII from React Server Component (RSC) serialization boundaries using React 19's experimental_taintObjectReference and experimental_taintUniqueValue APIs. Prevents accidental transmission of credentials, authentication tokens, and sensitive record fields to client bundles.","antiPatternHeadline":"Passing Unprojected Server Entities or Credentials Directly to Client Component Props Across RSC Boundaries","stars_count":100,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["nextjs","react-19","rsc","taint-api","security","pii","data-protection"],"exportEndpoints":{"claude":"/api/rules/nextjs-react19-taint-api-data-leakage-guardrail?format=claude","cursorMdc":"/api/rules/nextjs-react19-taint-api-data-leakage-guardrail?format=mdc","cursorrules":"/api/rules/nextjs-react19-taint-api-data-leakage-guardrail?format=cursor","windsurf":"/api/rules/nextjs-react19-taint-api-data-leakage-guardrail?format=windsurf","agents":"/api/rules/nextjs-react19-taint-api-data-leakage-guardrail?format=agents"}},{"id":"axum-hyper-graceful-connection-drain","title":"Axum 0.8 Hyper v1 Graceful Connection Drain and Lease Standard","category":"backend","severity":"critical","description":"Guarantees deterministic zero-downtime rolling deployments by decoupling socket listener termination from in-flight request cancellation. Enforces explicit connection drain timeouts, correct HTTP/2 GOAWAY emission, and bounded keep-alive leases before SIGKILL triggers.","antiPatternHeadline":"Immediate Runtime Future Dropping and Unbounded HTTP/2 Keep-Alive Lease Starvation During SIGTERM","stars_count":45,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","hyper","kubernetes","tokio","zero-downtime"],"exportEndpoints":{"claude":"/api/rules/axum-hyper-graceful-connection-drain?format=claude","cursorMdc":"/api/rules/axum-hyper-graceful-connection-drain?format=mdc","cursorrules":"/api/rules/axum-hyper-graceful-connection-drain?format=cursor","windsurf":"/api/rules/axum-hyper-graceful-connection-drain?format=windsurf","agents":"/api/rules/axum-hyper-graceful-connection-drain?format=agents"}},{"id":"bun-worker-memory-caging-zero-copy-production-standard","title":"Bun 1.2 Worker Isolation: Zero-Copy Transfer and Memory Caging Standard","category":"backend","severity":"critical","description":"Enforces deterministic heap boundaries and zero-copy transferable memory mechanics for native Workers in Bun 1.2. Eliminates process-wide Out-Of-Memory (OOM) cascades in high-throughput edge nodes by caging worker allocation limits and preventing structured clone serialization overhead. Guarantees detached buffer transfers and active thread resource caging under sustained concurrency.","antiPatternHeadline":"Spawning uncaged Bun workers with structured clone serialization of binary payloads, causing GC amplification and parent process SIGKILLs.","stars_count":80,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","workers","concurrency","memory-management","zero-copy"],"exportEndpoints":{"claude":"/api/rules/bun-worker-memory-caging-zero-copy-production-standard?format=claude","cursorMdc":"/api/rules/bun-worker-memory-caging-zero-copy-production-standard?format=mdc","cursorrules":"/api/rules/bun-worker-memory-caging-zero-copy-production-standard?format=cursor","windsurf":"/api/rules/bun-worker-memory-caging-zero-copy-production-standard?format=windsurf","agents":"/api/rules/bun-worker-memory-caging-zero-copy-production-standard?format=agents"}},{"id":"go-1-24-weak-pointer-cache-lifetime-invariants","title":"Go 1.24 Weak Pointer & Finalizer-Free Cache Lifetime Invariants","category":"backend","severity":"critical","description":"Enforces modern Go 1.24+ memory reclamation standards using weak.Pointer and runtime.AddCleanup for high-concurrency caches. Prevents garbage collector multi-phase sweep delays and Stop-The-World (STW) latency spikes caused by legacy runtime.SetFinalizer object resurrection and leaking strong cache references.","antiPatternHeadline":"Retaining strong references in cache indices or using runtime.SetFinalizer causing GC resurrection loops and tail-latency spikes","stars_count":114,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","golang","memory-management","garbage-collection","caching","concurrency"],"exportEndpoints":{"claude":"/api/rules/go-1-24-weak-pointer-cache-lifetime-invariants?format=claude","cursorMdc":"/api/rules/go-1-24-weak-pointer-cache-lifetime-invariants?format=mdc","cursorrules":"/api/rules/go-1-24-weak-pointer-cache-lifetime-invariants?format=cursor","windsurf":"/api/rules/go-1-24-weak-pointer-cache-lifetime-invariants?format=windsurf","agents":"/api/rules/go-1-24-weak-pointer-cache-lifetime-invariants?format=agents"}},{"id":"temporal-workflow-determinism-replay-migration-standard","title":"Temporal Durable Execution Determinism & Replay Verification Standard","category":"backend","severity":"critical","description":"Enforces strict workflow determinism invariants, backward-compatible migration patterns using workflow.patched(), and automated history replay verification in CI/CD. Eliminates NonDeterministicWorkflowPolicy errors, replay divergence, and state corruption across distributed asynchronous workers undergoing rolling deployments.","antiPatternHeadline":"Unversioned Workflow Topology Mutations and Non-Deterministic Runtime Operations Causing Production Replay Panics","stars_count":109,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","temporal","distributed-systems","state-machines","event-sourcing","determinism","typescript"],"exportEndpoints":{"claude":"/api/rules/temporal-workflow-determinism-replay-migration-standard?format=claude","cursorMdc":"/api/rules/temporal-workflow-determinism-replay-migration-standard?format=mdc","cursorrules":"/api/rules/temporal-workflow-determinism-replay-migration-standard?format=cursor","windsurf":"/api/rules/temporal-workflow-determinism-replay-migration-standard?format=windsurf","agents":"/api/rules/temporal-workflow-determinism-replay-migration-standard?format=agents"}},{"id":"react-native-bridgeless-jsi-lifecycle-guardrail","title":"React Native 0.77+ Bridgeless C++ JSI Memory Lifecycle Guardrail","category":"mobile","severity":"critical","description":"Enforces strict memory ownership boundaries between C++ HostObjects and the Hermes JavaScript Garbage Collector under React Native 0.77+ Bridgeless Architecture. Prevents SIGSEGV crashes, use-after-free conditions, and uncollectable GC roots during asynchronous native callbacks across rapid unmount/mount component lifecycles.","antiPatternHeadline":"Dangling C++ JSI References and Stale Callbacks Outliving Unmounted React Fiber Nodes","stars_count":94,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","react-native","hermes","jsi","bridgeless","memory-management","c++"],"exportEndpoints":{"claude":"/api/rules/react-native-bridgeless-jsi-lifecycle-guardrail?format=claude","cursorMdc":"/api/rules/react-native-bridgeless-jsi-lifecycle-guardrail?format=mdc","cursorrules":"/api/rules/react-native-bridgeless-jsi-lifecycle-guardrail?format=cursor","windsurf":"/api/rules/react-native-bridgeless-jsi-lifecycle-guardrail?format=windsurf","agents":"/api/rules/react-native-bridgeless-jsi-lifecycle-guardrail?format=agents"}},{"id":"capacitor-secure-enclave-keychain-persistence","title":"Hardware-Backed Secure Enclave & Keystore Invariants for Capacitor 7","category":"mobile","severity":"critical","description":"Establishes non-exportable hardware-backed cryptographic key isolation across Capacitor 7 hybrid mobile applications, binding long-lived authentication and session tokens to Apple Secure Enclave or Android StrongBox KeyMint via biometrics. Precludes token exfiltration vulnerabilities by ensuring private keys never traverse the WebKit/Chromium JavaScript bridge or sit unencrypted in WebStorage, IndexedDB, or standard SharedPreferences.","antiPatternHeadline":"Persisting Raw Bearer Tokens in WebView Storage Accessible to Cross-Site Scripting (XSS)","stars_count":96,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","security","biometrics","ios-keychain","android-keystore"],"exportEndpoints":{"claude":"/api/rules/capacitor-secure-enclave-keychain-persistence?format=claude","cursorMdc":"/api/rules/capacitor-secure-enclave-keychain-persistence?format=mdc","cursorrules":"/api/rules/capacitor-secure-enclave-keychain-persistence?format=cursor","windsurf":"/api/rules/capacitor-secure-enclave-keychain-persistence?format=windsurf","agents":"/api/rules/capacitor-secure-enclave-keychain-persistence?format=agents"}},{"id":"ebpf-tetragon-kernel-memory-syscall-invariants","title":"eBPF Tetragon Kernel-Level Memory & Syscall Enforcement Guardrail","category":"devops","severity":"critical","description":"Enforces synchronous, kernel-level behavioral policies via Cilium Tetragon TracingPolicies to detect and immediately SIGKILL container namespace escapes, process credential tampering, and unauthorized memory modifications. Prohibits relying on post-facto userspace audit logs by verifying in-kernel bpf_send_signal enforcement for high-risk syscalls (e.g., setns, unshare, ptrace, and unauthorized execve). Ensures cluster-wide deployments integrate immutable BPF maps and strict probe selectors with zero kernel runtime bypasses.","antiPatternHeadline":"Post-Facto Asynchronous Userspace Log Auditing for Critical Kernel Syscall Exploits and Escapes","stars_count":108,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","tetragon","kubernetes-security","runtime-enforcement","zero-trust"],"exportEndpoints":{"claude":"/api/rules/ebpf-tetragon-kernel-memory-syscall-invariants?format=claude","cursorMdc":"/api/rules/ebpf-tetragon-kernel-memory-syscall-invariants?format=mdc","cursorrules":"/api/rules/ebpf-tetragon-kernel-memory-syscall-invariants?format=cursor","windsurf":"/api/rules/ebpf-tetragon-kernel-memory-syscall-invariants?format=windsurf","agents":"/api/rules/ebpf-tetragon-kernel-memory-syscall-invariants?format=agents"}},{"id":"react-19-server-components-taint-api-standard","title":"Enforce React 19 Experimental Taint API for Boundary Serialization Safety","category":"frontend","severity":"critical","description":"Enforces deterministic data boundary protection in React 19 Server Components using experimental_taintObjectReference and experimental_taintUniqueValue. Guarantees that raw cryptographic secrets, database tokens, and sensitive PII records cannot be serialized across the Server-to-Client Component boundary by throwing runtime errors during the React Flight serialization pass.","antiPatternHeadline":"Leaking Raw Sensitive Records or Operational Credentials across the Server-Client Boundary via Flight Serialization","stars_count":69,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","nextjs","server-components","rsc","security","taint-api"],"exportEndpoints":{"claude":"/api/rules/react-19-server-components-taint-api-standard?format=claude","cursorMdc":"/api/rules/react-19-server-components-taint-api-standard?format=mdc","cursorrules":"/api/rules/react-19-server-components-taint-api-standard?format=cursor","windsurf":"/api/rules/react-19-server-components-taint-api-standard?format=windsurf","agents":"/api/rules/react-19-server-components-taint-api-standard?format=agents"}},{"id":"webauthn-l3-prf-hardware-key-derivation","title":"WebAuthn Level 3 PRF Hardware Key Derivation & Zero-Exposure Cryptographic Isolation","category":"security","severity":"critical","description":"Enforces hardware-bound client-side key derivation via the WebAuthn Level 3 PRF (Pseudo-Random Function) extension. Requires immediate zeroization of intermediate derivation buffers, non-extractable CryptoKey constraints in SubtleCrypto, and strict isolation preventing raw symmetric secrets from leaking to auth servers or browser memory heaps.","antiPatternHeadline":"Exposing Raw PRF Output to Authentication Transport or Retaining Extractable Keys in Web Application State","stars_count":116,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","prf-extension","cryptography","webcrypto","zero-trust"],"exportEndpoints":{"claude":"/api/rules/webauthn-l3-prf-hardware-key-derivation?format=claude","cursorMdc":"/api/rules/webauthn-l3-prf-hardware-key-derivation?format=mdc","cursorrules":"/api/rules/webauthn-l3-prf-hardware-key-derivation?format=cursor","windsurf":"/api/rules/webauthn-l3-prf-hardware-key-derivation?format=windsurf","agents":"/api/rules/webauthn-l3-prf-hardware-key-derivation?format=agents"}},{"id":"openfga-contextual-tuples-concurrent-evaluation-standard","title":"OpenFGA 1.8 Contextual Tuples and Concurrent Evaluation Standard","category":"security","severity":"critical","description":"Enforces strict atomicity and freshness in OpenFGA 1.8 authorization checks by mandating ephemeral contextual tuples over long-lived transactional storage. Eliminates distributed cache stampedes and authorization races during high-velocity evaluations through deterministic request-scoped deduplication and bounded concurrency pools.","antiPatternHeadline":"Persisting Ephemeral Claims to Relational Stores and Unbounded Sequential Check Loops Causing Cache Stampedes","stars_count":110,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","authorization","fine-grained-auth","concurrency"],"exportEndpoints":{"claude":"/api/rules/openfga-contextual-tuples-concurrent-evaluation-standard?format=claude","cursorMdc":"/api/rules/openfga-contextual-tuples-concurrent-evaluation-standard?format=mdc","cursorrules":"/api/rules/openfga-contextual-tuples-concurrent-evaluation-standard?format=cursor","windsurf":"/api/rules/openfga-contextual-tuples-concurrent-evaluation-standard?format=windsurf","agents":"/api/rules/openfga-contextual-tuples-concurrent-evaluation-standard?format=agents"}},{"id":"pg17-streaming-direct-io-buffer-guardrail","title":"PostgreSQL 17 Streaming Direct I/O Buffer Pool Invariant","category":"backend","severity":"critical","description":"Enforces PostgreSQL 17 streaming I/O configurations and ring-buffer allocation invariants across high-throughput backend services. Prevents kernel page-cache duplication, dirty write stalls, and NVMe bus contention during concurrent high-volume sequential scans and OLTP transactions.","antiPatternHeadline":"Unbounded Sequential Scans and Default Direct I/O Mismatches Inducing OS Cache Double-Buffering","stars_count":104,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql-17","database-performance","direct-io","buffer-pool","nvme-tuning"],"exportEndpoints":{"claude":"/api/rules/pg17-streaming-direct-io-buffer-guardrail?format=claude","cursorMdc":"/api/rules/pg17-streaming-direct-io-buffer-guardrail?format=mdc","cursorrules":"/api/rules/pg17-streaming-direct-io-buffer-guardrail?format=cursor","windsurf":"/api/rules/pg17-streaming-direct-io-buffer-guardrail?format=windsurf","agents":"/api/rules/pg17-streaming-direct-io-buffer-guardrail?format=agents"}},{"id":"bun-native-socket-pool-lifecycle-invariant","title":"Bun 1.2 Native TCP & UDS Socket Connection Pool and Zero-Copy Lifecycle","category":"backend","severity":"critical","description":"Enforces deterministic connection reuse, fixed-size ring buffer pooling, and zero-copy byte transport across Bun 1.2 native TCP (`Bun.connect`) and Unix Domain Socket (UDS) IPC boundaries. Prevents cross-boundary V8/JSC GC thrashing, socket handle exhaustion, and heap fragmentation under multi-gigabit throughput workloads.","antiPatternHeadline":"Ephemerally allocating `Bun.connect` handlers and cloning dynamic ArrayBuffers per-transaction without backpressure pooling","stars_count":106,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","networking","ipc","memory-management","zero-copy","performance"],"exportEndpoints":{"claude":"/api/rules/bun-native-socket-pool-lifecycle-invariant?format=claude","cursorMdc":"/api/rules/bun-native-socket-pool-lifecycle-invariant?format=mdc","cursorrules":"/api/rules/bun-native-socket-pool-lifecycle-invariant?format=cursor","windsurf":"/api/rules/bun-native-socket-pool-lifecycle-invariant?format=windsurf","agents":"/api/rules/bun-native-socket-pool-lifecycle-invariant?format=agents"}},{"id":"fastapi-anyio-worker-thread-boundary-loop-starvation-guardrail","title":"FastAPI AnyIO Worker Thread Boundary and Event Loop Starvation Guardrail","category":"backend","severity":"critical","description":"Enforces strict physical boundaries between the asyncio event loop, AnyIO worker thread pools, and process pools in FastAPI applications. Prevents synchronous legacy I/O drivers, unbuffered disk operations, and heavy CPU-bound serialization from monopolizing the event loop tick and inducing severe cascading tail-latency under burst concurrency.","antiPatternHeadline":"Executing blocking synchronous I/O or heavy CPU-bound parsing directly within `async def` endpoints, starving the single-threaded asyncio event loop.","stars_count":59,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","anyio","asyncio","concurrency","threadpool","starvation"],"exportEndpoints":{"claude":"/api/rules/fastapi-anyio-worker-thread-boundary-loop-starvation-guardrail?format=claude","cursorMdc":"/api/rules/fastapi-anyio-worker-thread-boundary-loop-starvation-guardrail?format=mdc","cursorrules":"/api/rules/fastapi-anyio-worker-thread-boundary-loop-starvation-guardrail?format=cursor","windsurf":"/api/rules/fastapi-anyio-worker-thread-boundary-loop-starvation-guardrail?format=windsurf","agents":"/api/rules/fastapi-anyio-worker-thread-boundary-loop-starvation-guardrail?format=agents"}},{"id":"capacitor7-biometric-keystore-isolation-guardrail","title":"Capacitor 7 Biometric Auth and Hardware Keystore Bridge Isolation","category":"mobile","severity":"critical","description":"Enforces strict isolation between Capacitor 7 WebViews and native hardware keystores (iOS Secure Enclave and Android Hardware-backed Keystore). Prevents cross-site scripting (XSS) and malicious WebView script injections from exfiltrating raw private keys or persistent credentials by delegating all cryptographic signing, asymmetric key generation, and token unwrapping exclusively to native-isolated bridge operations.","antiPatternHeadline":"Exposing Raw Cryptographic Secrets or Symmetric Session Keys Directly Across the Capacitor Bridge into the WebView Memory Space","stars_count":96,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["capacitor","biometrics","security","secure-enclave","android-keystore","crypto"],"exportEndpoints":{"claude":"/api/rules/capacitor7-biometric-keystore-isolation-guardrail?format=claude","cursorMdc":"/api/rules/capacitor7-biometric-keystore-isolation-guardrail?format=mdc","cursorrules":"/api/rules/capacitor7-biometric-keystore-isolation-guardrail?format=cursor","windsurf":"/api/rules/capacitor7-biometric-keystore-isolation-guardrail?format=windsurf","agents":"/api/rules/capacitor7-biometric-keystore-isolation-guardrail?format=agents"}},{"id":"envoy-gateway-wasmplugin-sandboxed-invariant","title":"Envoy Gateway 1.2 WasmPlugin Isolation and Thread-Safety Invariant","category":"devops","severity":"critical","description":"Enforces strict runtime isolation, resource limits, and failure domain boundaries for WebAssembly plugins executed within Envoy Gateway 1.2. Preempts control plane crashes, main proxy event-loop blocking, and data plane thread starvation by mandating fail-open fallbacks, strict memory limits, and isolated runtime configurations.","antiPatternHeadline":"Attaching unconstrained WasmPlugins without fail-open policies, dedicated VM runtimes, or strict resource boundaries","stars_count":76,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","envoy-gateway","wasm","kubernetes","networking","service-mesh"],"exportEndpoints":{"claude":"/api/rules/envoy-gateway-wasmplugin-sandboxed-invariant?format=claude","cursorMdc":"/api/rules/envoy-gateway-wasmplugin-sandboxed-invariant?format=mdc","cursorrules":"/api/rules/envoy-gateway-wasmplugin-sandboxed-invariant?format=cursor","windsurf":"/api/rules/envoy-gateway-wasmplugin-sandboxed-invariant?format=windsurf","agents":"/api/rules/envoy-gateway-wasmplugin-sandboxed-invariant?format=agents"}},{"id":"opentelemetry-collector-tail-sampling-exemplar-standard","title":"OpenTelemetry Collector Tail-Based Sampling and Exemplar Retention Standard","category":"devops","severity":"critical","description":"Architects a two-tier OpenTelemetry Collector topology utilizing trace-ID routing via loadbalancingexporter and tail_sampling processors to deterministically retain 100% of traces with errors, P99 latency spikes, and explicit business anomalies while reducing healthy trace volume by over 80%. Guarantees continuous Prometheus and OpenTelemetry metric correlation by enforcing Span-to-Metric Exemplar propagation across service boundaries.","antiPatternHeadline":"Head-based probabilistic SDK sampling and stateless uncoordinated Collector load balancing that fragment traces and discard root-cause error diagnostics.","stars_count":55,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","observability","tail-sampling","exemplars","prometheus","distributed-tracing"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-collector-tail-sampling-exemplar-standard?format=claude","cursorMdc":"/api/rules/opentelemetry-collector-tail-sampling-exemplar-standard?format=mdc","cursorrules":"/api/rules/opentelemetry-collector-tail-sampling-exemplar-standard?format=cursor","windsurf":"/api/rules/opentelemetry-collector-tail-sampling-exemplar-standard?format=windsurf","agents":"/api/rules/opentelemetry-collector-tail-sampling-exemplar-standard?format=agents"}},{"id":"react19-activity-webgl-context-preservation-boundary","title":"React 19 Activity WebGL Context Lifecycle and Resource Preservation Guardrail","category":"frontend","severity":"critical","description":"Mandates explicit WebGL context preservation, tick loop suspension, and resource lifecycle management when wrapping Three.js, Babylon.js, or raw WebGL renderers inside React 19 `<Activity>` boundaries. Components hidden via the Activity API remain mounted in memory with DOM attachment preserved or detached into an offscreen state, necessitating immediate RAF cancellation, buffer preservation, and idempotent context restoration upon visibility reactivation.","antiPatternHeadline":"Unbounded RAF loops and naive canvas unmount cleansers during React 19 Activity state transitions","stars_count":47,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","webgl","activity-api","offscreen","performance"],"exportEndpoints":{"claude":"/api/rules/react19-activity-webgl-context-preservation-boundary?format=claude","cursorMdc":"/api/rules/react19-activity-webgl-context-preservation-boundary?format=mdc","cursorrules":"/api/rules/react19-activity-webgl-context-preservation-boundary?format=cursor","windsurf":"/api/rules/react19-activity-webgl-context-preservation-boundary?format=windsurf","agents":"/api/rules/react19-activity-webgl-context-preservation-boundary?format=agents"}},{"id":"openfga-zanzibar-consistency-token-evaluation","title":"OpenFGA Zanzibar Consistency Token (zed_token) Evaluation Invariant","category":"security","severity":"critical","description":"Enforces snapshot consistency token propagation or HIGHER_CONSISTENCY evaluation on all OpenFGA checks following state mutations. Eliminates read-after-write replication lag vulnerabilities such as stale authorization evaluations and the Zanzibar 'New Enemy' security flaw.","antiPatternHeadline":"Executing authorization checks with default minimize-latency consistency immediately after tuple writes","stars_count":64,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","zanzibar","authorization","distributed-consistency","access-control"],"exportEndpoints":{"claude":"/api/rules/openfga-zanzibar-consistency-token-evaluation?format=claude","cursorMdc":"/api/rules/openfga-zanzibar-consistency-token-evaluation?format=mdc","cursorrules":"/api/rules/openfga-zanzibar-consistency-token-evaluation?format=cursor","windsurf":"/api/rules/openfga-zanzibar-consistency-token-evaluation?format=windsurf","agents":"/api/rules/openfga-zanzibar-consistency-token-evaluation?format=agents"}},{"id":"kmp-swift-arc-reference-cycle-guardrail","title":"Kotlin Multiplatform Swift Interop ARC Strong Reference Cycle Guardrail","category":"mobile","severity":"critical","description":"Enforces strict weak-reference and explicit lifecycle decoupling across the Kotlin/Native ARC boundary. Prevents cross-runtime heap retention cycles where Kotlin Native garbage collection and Apple Swift ARC fail to traverse foreign object graphs during bidirectional event delegation.","antiPatternHeadline":"Cross-Runtime Zombie Heap Retention via Bidirectional Kotlin/Swift Strong Delegation","stars_count":80,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kmp","kotlin-native","swift","arc","memory-management"],"exportEndpoints":{"claude":"/api/rules/kmp-swift-arc-reference-cycle-guardrail?format=claude","cursorMdc":"/api/rules/kmp-swift-arc-reference-cycle-guardrail?format=mdc","cursorrules":"/api/rules/kmp-swift-arc-reference-cycle-guardrail?format=cursor","windsurf":"/api/rules/kmp-swift-arc-reference-cycle-guardrail?format=windsurf","agents":"/api/rules/kmp-swift-arc-reference-cycle-guardrail?format=agents"}},{"id":"pg17-json-table-workmem-ceiling","title":"PostgreSQL 17 JSON_TABLE Execution Memory Bounds & WorkMem Invariants","category":"backend","severity":"critical","description":"Enforces transaction-scoped work_mem ceilings and chunked ingestion during PostgreSQL 17 JSON_TABLE columnar parsing. Prevents catastrophic backend OOM kills under concurrent high-throughput SQL/JSON unpack operations by bounding plan-node allocation buffers and eliminating unbounded NESTED PATH projections.","antiPatternHeadline":"Global Unbounded Ingestion and Unconstrained NESTED PATH Projections in JSON_TABLE","stars_count":40,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","json-table","memory-management","sql","performance"],"exportEndpoints":{"claude":"/api/rules/pg17-json-table-workmem-ceiling?format=claude","cursorMdc":"/api/rules/pg17-json-table-workmem-ceiling?format=mdc","cursorrules":"/api/rules/pg17-json-table-workmem-ceiling?format=cursor","windsurf":"/api/rules/pg17-json-table-workmem-ceiling?format=windsurf","agents":"/api/rules/pg17-json-table-workmem-ceiling?format=agents"}},{"id":"opentelemetry-ebpf-profiling-cpu-ceiling-standard","title":"OpenTelemetry eBPF Profiler Kernel CPU Ceiling and Ring-Buffer Integrity Standard","category":"devops","severity":"critical","description":"Establishes a mandatory 1.5% single-core CPU utilization limit and zero-loss ring-buffer threshold for OpenTelemetry eBPF continuous profiling agents deployed on high-density Kubernetes nodes. Enforces automated sample rate throttling, dynamic frame-pointer unwinding bailouts, and Prometheus alerting on perf event buffer drop deltas to prevent node degradation.","antiPatternHeadline":"Unbounded eBPF Stack Unwinding Frequency and Unmonitored BPF Ring Buffer Overflows","stars_count":81,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","opentelemetry","continuous-profiling","kubernetes"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-ebpf-profiling-cpu-ceiling-standard?format=claude","cursorMdc":"/api/rules/opentelemetry-ebpf-profiling-cpu-ceiling-standard?format=mdc","cursorrules":"/api/rules/opentelemetry-ebpf-profiling-cpu-ceiling-standard?format=cursor","windsurf":"/api/rules/opentelemetry-ebpf-profiling-cpu-ceiling-standard?format=windsurf","agents":"/api/rules/opentelemetry-ebpf-profiling-cpu-ceiling-standard?format=agents"}},{"id":"temporal-workflow-determinism-and-patch-versioning","title":"Temporal Durable Execution Determinism and Replay Versioning Invariants","category":"backend","severity":"critical","description":"Enforces strict static determinism barriers prohibiting non-deterministic system clocks, random generators, native timers, and direct I/O inside Temporal workflow scopes. Mandates deterministic Temporal SDK primitives and structural versioning via workflow.patched() to guarantee identical event history replays across multi-year long-running workflows.","antiPatternHeadline":"Executing Non-Deterministic Host Runtime Calls and Unversioned Workflow DAG Mutations","stars_count":108,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","temporal","event-sourcing","distributed-systems","durable-execution"],"exportEndpoints":{"claude":"/api/rules/temporal-workflow-determinism-and-patch-versioning?format=claude","cursorMdc":"/api/rules/temporal-workflow-determinism-and-patch-versioning?format=mdc","cursorrules":"/api/rules/temporal-workflow-determinism-and-patch-versioning?format=cursor","windsurf":"/api/rules/temporal-workflow-determinism-and-patch-versioning?format=windsurf","agents":"/api/rules/temporal-workflow-determinism-and-patch-versioning?format=agents"}},{"id":"rn-fabric-shadow-tree-mutex-boundary","title":"React Native 0.78 Fabric Shadow Tree Synchronous Mutex Boundary Isolation","category":"mobile","severity":"critical","description":"Enforces strict isolation between Fabric C++ Shadow Tree synchronous layout measurements and JSI native module invocations. Prevents lock contention and dropped frames on 120Hz ProMotion displays (8.33ms frame deadline) caused by thread priority inversions between the React Native UI thread, JS thread, and Shadow Tree mutation mutex.","antiPatternHeadline":"Contending Fabric Shadow Tree Mutexes via Interleaved Synchronous Measurements and JSI Invocations in 120Hz Animation Loops","stars_count":69,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","react-native","fabric","reanimated","performance","120hz"],"exportEndpoints":{"claude":"/api/rules/rn-fabric-shadow-tree-mutex-boundary?format=claude","cursorMdc":"/api/rules/rn-fabric-shadow-tree-mutex-boundary?format=mdc","cursorrules":"/api/rules/rn-fabric-shadow-tree-mutex-boundary?format=cursor","windsurf":"/api/rules/rn-fabric-shadow-tree-mutex-boundary?format=windsurf","agents":"/api/rules/rn-fabric-shadow-tree-mutex-boundary?format=agents"}},{"id":"slsa-level-3-cosign-oidc-provenance-guardrail","title":"SLSA Level 3 Keyless Ephemeral OIDC Provenance Verification Guardrail","category":"devops","severity":"critical","description":"Enforces cryptographic verification of SLSA Level 3 provenance for all container images using ephemeral OIDC identities backed by Sigstore Fulcio and Rekor. Prohibits deployment of images referenced by mutable tags or signed with long-lived private keys, ensuring unforgeable build traceability and supply chain integrity.","antiPatternHeadline":"Deploying container images via mutable tags or trusting self-signed, unverified supply chain artifacts lacking OIDC Rekor transparency logging.","stars_count":89,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","slsa3","sigstore","cosign","oidc","supply-chain-security","provenance"],"exportEndpoints":{"claude":"/api/rules/slsa-level-3-cosign-oidc-provenance-guardrail?format=claude","cursorMdc":"/api/rules/slsa-level-3-cosign-oidc-provenance-guardrail?format=mdc","cursorrules":"/api/rules/slsa-level-3-cosign-oidc-provenance-guardrail?format=cursor","windsurf":"/api/rules/slsa-level-3-cosign-oidc-provenance-guardrail?format=windsurf","agents":"/api/rules/slsa-level-3-cosign-oidc-provenance-guardrail?format=agents"}},{"id":"go-124-swiss-map-cacheline-alignment","title":"Go 1.24 Swiss Table Map Allocation and Cache-Line Invariant","category":"backend","severity":"critical","description":"Enforces strict cache-line alignment and false-sharing isolation when utilizing Go 1.24's Swiss Table-backed runtime maps in concurrent workloads. Mandates explicit memory padding, per-core sharding, and allocation pre-sizing to maximize SIMD control-byte probing throughput without triggering CPU L1/L2 cache-line bouncing.","antiPatternHeadline":"Global Mutex Contention and Unaligned Struct Packaging over Shared Swiss Map Partitions","stars_count":95,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","golang","go-124","swiss-tables","cache-line","concurrency","simd","low-latency"],"exportEndpoints":{"claude":"/api/rules/go-124-swiss-map-cacheline-alignment?format=claude","cursorMdc":"/api/rules/go-124-swiss-map-cacheline-alignment?format=mdc","cursorrules":"/api/rules/go-124-swiss-map-cacheline-alignment?format=cursor","windsurf":"/api/rules/go-124-swiss-map-cacheline-alignment?format=windsurf","agents":"/api/rules/go-124-swiss-map-cacheline-alignment?format=agents"}},{"id":"nextjs15-ppr-dynamic-hole-boundary-standard","title":"Next.js 15 PPR Dynamic Hole Isolation and Suspense Boundary Standard","category":"frontend","severity":"critical","description":"Enforces strict component-level dynamic hole boundaries in Next.js 15 Partial Prerendering (PPR) architectures. Dynamic execution contexts (cookies, headers, searchParams, and uncached data fetches) must be strictly isolated inside dedicated async leaf components wrapped by explicit React Suspense boundaries with layout-stable fallbacks. Prevents static shell de-opt, cascading waterfalls, and TTFB degradation in enterprise storefronts.","antiPatternHeadline":"Dynamic Context Leakage into Static Shells Causing Full-Page PPR De-Optimization","stars_count":49,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs","nextjs-15","react-server-components","ppr","performance","suspense"],"exportEndpoints":{"claude":"/api/rules/nextjs15-ppr-dynamic-hole-boundary-standard?format=claude","cursorMdc":"/api/rules/nextjs15-ppr-dynamic-hole-boundary-standard?format=mdc","cursorrules":"/api/rules/nextjs15-ppr-dynamic-hole-boundary-standard?format=cursor","windsurf":"/api/rules/nextjs15-ppr-dynamic-hole-boundary-standard?format=windsurf","agents":"/api/rules/nextjs15-ppr-dynamic-hole-boundary-standard?format=agents"}},{"id":"react-19-resource-preloading-dedup-standard","title":"React 19 Native Resource Preloading & Document Head Deduplication Standard","category":"frontend","severity":"critical","description":"Enforces React 19 native document metadata hoisting and react-dom resource preloading APIs across micro-frontend boundaries. Eliminates manual DOM script/link injections that cause style flickering (FOUC), duplicate tag mounting, and broken concurrency during asynchronous module transitions. Guarantees deterministic asset deduplication by leveraging React's built-in href and precedence matching engine.","antiPatternHeadline":"Manual DOM Link/Script Append Injections and Imperative Document Head Mutation","stars_count":116,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","micro-frontends","resource-preloading","asset-deduplication","suspense"],"exportEndpoints":{"claude":"/api/rules/react-19-resource-preloading-dedup-standard?format=claude","cursorMdc":"/api/rules/react-19-resource-preloading-dedup-standard?format=mdc","cursorrules":"/api/rules/react-19-resource-preloading-dedup-standard?format=cursor","windsurf":"/api/rules/react-19-resource-preloading-dedup-standard?format=windsurf","agents":"/api/rules/react-19-resource-preloading-dedup-standard?format=agents"}},{"id":"postgres-17-json-table-memory-guardrail","title":"Postgres 17 JSON_TABLE Memory Projection & Bounded Expansion Standard","category":"backend","severity":"critical","description":"Mandates strict memory guardrails, column dimension bounds, and traversal depth limits when using Postgres 17 JSON_TABLE row projection functions. Prohibits unbounded NESTED PATH expansions over high-volume hierarchical JSON payloads that cause catastrophic backend work_mem exhaustion and OOM kills.","antiPatternHeadline":"Unbounded Hierarchical JSON_TABLE Expansion Inducing Postgres Backend Out-Of-Memory Crashes","stars_count":86,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres-17","json-table","sql-json","performance","memory-management"],"exportEndpoints":{"claude":"/api/rules/postgres-17-json-table-memory-guardrail?format=claude","cursorMdc":"/api/rules/postgres-17-json-table-memory-guardrail?format=mdc","cursorrules":"/api/rules/postgres-17-json-table-memory-guardrail?format=cursor","windsurf":"/api/rules/postgres-17-json-table-memory-guardrail?format=windsurf","agents":"/api/rules/postgres-17-json-table-memory-guardrail?format=agents"}},{"id":"axum-hyper-v1-rapid-reset-mitigation-standard","title":"Axum & Hyper v1 Deterministic HTTP/2 Rapid Reset Invariant","category":"backend","severity":"critical","description":"Enforces strict HTTP/2 and HTTP/3 stream lifecycle budgets on Axum and Hyper v1 services to eliminate CVE-2023-44487 Rapid Reset attacks. Requires deterministic per-connection reset quotas, bounded stream concurrency, and explicit connection shutdown when reset frequency thresholds are breached.","antiPatternHeadline":"Default Axum/Hyper Server Configuration Permitting Unbounded RST_STREAM Cancellation Floods","stars_count":50,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","hyper","http2","security","ddos-mitigation"],"exportEndpoints":{"claude":"/api/rules/axum-hyper-v1-rapid-reset-mitigation-standard?format=claude","cursorMdc":"/api/rules/axum-hyper-v1-rapid-reset-mitigation-standard?format=mdc","cursorrules":"/api/rules/axum-hyper-v1-rapid-reset-mitigation-standard?format=cursor","windsurf":"/api/rules/axum-hyper-v1-rapid-reset-mitigation-standard?format=windsurf","agents":"/api/rules/axum-hyper-v1-rapid-reset-mitigation-standard?format=agents"}},{"id":"kmp-coroutine-to-swift-concurrency-bridge-standard","title":"Strict KMP Coroutine Job to Swift Task Lifecycle Binding","category":"mobile","severity":"critical","description":"Enforces deterministic cancellation propagation and memory safety between Kotlin Multiplatform Coroutine Jobs and Swift Structured Concurrency. Prevents orphaned background threads, runaway network executions, and retain cycles by mandating bi-directional cancellation wiring via withTaskCancellationHandler or SKIE wrapper abstractions.","antiPatternHeadline":"Unbound Kotlin Coroutine execution from detached Swift Tasks causing orphaned native jobs and memory leaks.","stars_count":95,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kmp","kotlin-multiplatform","swift","coroutines","structured-concurrency","ios"],"exportEndpoints":{"claude":"/api/rules/kmp-coroutine-to-swift-concurrency-bridge-standard?format=claude","cursorMdc":"/api/rules/kmp-coroutine-to-swift-concurrency-bridge-standard?format=mdc","cursorrules":"/api/rules/kmp-coroutine-to-swift-concurrency-bridge-standard?format=cursor","windsurf":"/api/rules/kmp-coroutine-to-swift-concurrency-bridge-standard?format=windsurf","agents":"/api/rules/kmp-coroutine-to-swift-concurrency-bridge-standard?format=agents"}},{"id":"tauri-2-scoped-capability-webview-sandboxing","title":"Tauri 2.0 Scoped Capability Multi-Webview IPC Sandboxing Standard","category":"mobile","severity":"critical","description":"Enforces deterministic, window-specific capability isolation across Tauri 2.0 multi-webview architectures to eliminate cross-webview privilege escalation and unauthorized native plugin execution. Prevents shared IPC bridge exposure by requiring fine-grained capability definitions scoped strictly to verified webview and window labels. Guarantees that untrusted or secondary webviews cannot invoke privileged core APIs or native mobile plugins.","antiPatternHeadline":"Wildcard Window Scoping and Monolithic Capability Binding Across Heterogeneous Webviews","stars_count":100,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri","security","ipc","sandboxing","rust"],"exportEndpoints":{"claude":"/api/rules/tauri-2-scoped-capability-webview-sandboxing?format=claude","cursorMdc":"/api/rules/tauri-2-scoped-capability-webview-sandboxing?format=mdc","cursorrules":"/api/rules/tauri-2-scoped-capability-webview-sandboxing?format=cursor","windsurf":"/api/rules/tauri-2-scoped-capability-webview-sandboxing?format=windsurf","agents":"/api/rules/tauri-2-scoped-capability-webview-sandboxing?format=agents"}},{"id":"openfga-temporal-grant-rebac-eviction-standard","title":"OpenFGA Temporal Grant Lifecycle and Distributed ReBAC Eviction Guardrail","category":"security","severity":"critical","description":"Guarantees deterministic authorization state synchronization across distributed OpenFGA check nodes during short-lived and temporal relationship evaluations. Mandates the use of CEL-based conditional tuples with server-enforced monotonic timestamps, dynamic contextual tuple evaluation, and Zanzibar consistency tokens to eliminate stale authorization hits post-expiration.","antiPatternHeadline":"Relying on asynchronous database writes/deletions and default eventual consistency for short-lived access grants, causing distributed cache poisoning and authorization bypass.","stars_count":59,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","rebac","authorization","temporal-grants","cache-invalidation"],"exportEndpoints":{"claude":"/api/rules/openfga-temporal-grant-rebac-eviction-standard?format=claude","cursorMdc":"/api/rules/openfga-temporal-grant-rebac-eviction-standard?format=mdc","cursorrules":"/api/rules/openfga-temporal-grant-rebac-eviction-standard?format=cursor","windsurf":"/api/rules/openfga-temporal-grant-rebac-eviction-standard?format=windsurf","agents":"/api/rules/openfga-temporal-grant-rebac-eviction-standard?format=agents"}},{"id":"pqc-mlkem-tls-handshake-boundary-guardrail","title":"PQC ML-KEM TLS 1.3 Hybrid Key Exchange Handshake Fragmentation and Buffer Protection","category":"security","severity":"critical","description":"Enforces strict TCP socket buffer sizing, MSS-aligned fragmentation handling, and bounded reassembly memory limits during TLS 1.3 hybrid post-quantum key exchanges (e.g., X25519MLKEM768). Mitigates packet dropouts and Slowloris-style denial-of-service vectors caused by enlarged post-quantum KeyShare extension payloads crossing MTU thresholds.","antiPatternHeadline":"Unbounded TCP socket allocation and default buffer assumptions during multi-packet post-quantum KeyShare payload ingestion","stars_count":102,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","pqc","ml-kem","tls1.3","crypto","networking"],"exportEndpoints":{"claude":"/api/rules/pqc-mlkem-tls-handshake-boundary-guardrail?format=claude","cursorMdc":"/api/rules/pqc-mlkem-tls-handshake-boundary-guardrail?format=mdc","cursorrules":"/api/rules/pqc-mlkem-tls-handshake-boundary-guardrail?format=cursor","windsurf":"/api/rules/pqc-mlkem-tls-handshake-boundary-guardrail?format=windsurf","agents":"/api/rules/pqc-mlkem-tls-handshake-boundary-guardrail?format=agents"}},{"id":"ebpf-xdp-conntrack-exhaustion-mitigation-standard","title":"eBPF XDP Line-Rate SYN Flood Filtering & Conntrack Protection Standard","category":"devops","severity":"critical","description":"Mandates early packet filtering at the NIC driver layer via eBPF XDP before Linux kernel network subsystem ingress. Prevents slab memory depletion and netfilter connection tracking table exhaustion (nf_conntrack_max) during asymmetric volumetric SYN floods by enforcing driver-level drops and stateless SYN cookie verification prior to sk_buff allocation.","antiPatternHeadline":"Relying on Kernel-Space Iptables/Nftables or Allocating Maps for SYN Flood Mitigation","stars_count":87,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","xdp","linux-kernel","networking","ddos-mitigation","conntrack"],"exportEndpoints":{"claude":"/api/rules/ebpf-xdp-conntrack-exhaustion-mitigation-standard?format=claude","cursorMdc":"/api/rules/ebpf-xdp-conntrack-exhaustion-mitigation-standard?format=mdc","cursorrules":"/api/rules/ebpf-xdp-conntrack-exhaustion-mitigation-standard?format=cursor","windsurf":"/api/rules/ebpf-xdp-conntrack-exhaustion-mitigation-standard?format=windsurf","agents":"/api/rules/ebpf-xdp-conntrack-exhaustion-mitigation-standard?format=agents"}},{"id":"envoy-http3-happy-eyeballs-v2-pool-boundary","title":"Envoy HTTP/3 Happy Eyeballs v2 Dual-Stack Upstream Pool Guardrail","category":"devops","severity":"critical","description":"Enforces strict connection pool boundaries, bounded Happy Eyeballs v2 (RFC 8305) fallback timers, and isolated circuit breakers for Envoy upstream HTTP/3 (QUIC) and TCP/TLS dual-stack clusters. Eliminates tail latency spikes and worker thread starvation caused by silent UDP blackholing and unconstrained concurrent fallback racing.","antiPatternHeadline":"Unbounded Dual-Stack Concurrent QUIC/TCP Upstream Probing Inducing Worker Thread Exhaustion","stars_count":52,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","envoy","http3","quic","happy-eyeballs","networking","service-mesh"],"exportEndpoints":{"claude":"/api/rules/envoy-http3-happy-eyeballs-v2-pool-boundary?format=claude","cursorMdc":"/api/rules/envoy-http3-happy-eyeballs-v2-pool-boundary?format=mdc","cursorrules":"/api/rules/envoy-http3-happy-eyeballs-v2-pool-boundary?format=cursor","windsurf":"/api/rules/envoy-http3-happy-eyeballs-v2-pool-boundary?format=windsurf","agents":"/api/rules/envoy-http3-happy-eyeballs-v2-pool-boundary?format=agents"}},{"id":"vite6-environment-api-runtime-isolation-vite-6-environme-725","title":"Vite 6 Environment API Multi-Runtime Compilation Boundary Isolation","category":"frontend","severity":"critical","description":"Enforces strict runtime module boundary isolation across client, SSR Node.js, and edge worker execution contexts using the Vite 6 Environment API. Prevents toxic module leakage such as Node.js built-ins or server secrets bundling into client chunks by mandating explicit per-environment export conditions, isolated Rollup configurations, and environment-aware plugin hooks.","antiPatternHeadline":"Monolithic Multi-Target Compilation and Cross-Environment Module Bleed","stars_count":48,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","vite6","environment-api","ssr","bundling","isolation"],"exportEndpoints":{"claude":"/api/rules/vite6-environment-api-runtime-isolation-vite-6-environme-725?format=claude","cursorMdc":"/api/rules/vite6-environment-api-runtime-isolation-vite-6-environme-725?format=mdc","cursorrules":"/api/rules/vite6-environment-api-runtime-isolation-vite-6-environme-725?format=cursor","windsurf":"/api/rules/vite6-environment-api-runtime-isolation-vite-6-environme-725?format=windsurf","agents":"/api/rules/vite6-environment-api-runtime-isolation-vite-6-environme-725?format=agents"}},{"id":"react-19-compiler-closure-idempotence","title":"React 19 Compiler Idempotence & Closure Immutability Invariant","category":"frontend","severity":"critical","description":"Enforces strict mathematical purity, render-phase side-effect freedom, and closure immutability across React 19 functional components and custom hooks. Prevents React Compiler memoization bailouts, dirty-read stale state hazards, and catastrophic auto-memoization cache invalidation loops caused by mutating inputs, lexical escapes, or unstable reference creation during render.","antiPatternHeadline":"Mutating Render-Path References and In-Flight Closure Leaks Causing Compiler Bailouts and Infinite Invalidation Spirals","stars_count":58,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","react-compiler","forget","immutability","ast-analysis","idempotence"],"exportEndpoints":{"claude":"/api/rules/react-19-compiler-closure-idempotence?format=claude","cursorMdc":"/api/rules/react-19-compiler-closure-idempotence?format=mdc","cursorrules":"/api/rules/react-19-compiler-closure-idempotence?format=cursor","windsurf":"/api/rules/react-19-compiler-closure-idempotence?format=windsurf","agents":"/api/rules/react-19-compiler-closure-idempotence?format=agents"}},{"id":"bun-websocket-kernel-backpressure-standard","title":"Bun 1.2 Native WebSocket Kernel Backpressure and Buffer Draining Standard","category":"backend","severity":"critical","description":"Mandates explicit C-level memory buffer monitoring and drain-event orchestration for Bun native WebSockets. In high-throughput streaming pipelines, blind calls to ws.send() accumulate un-drained packets inside native uWebSockets C++ ring buffers outside the JavaScript runtime heap, evading V8/JSC GC thresholds and triggering silent OS OOM termination. This standard enforces watermarked backpressure control, producer pause/resume states, and bounded client disconnect thresholds.","antiPatternHeadline":"Blind ws.send() invocation during high-throughput streaming without bufferedAmount tracking and drain lifecycle handling.","stars_count":45,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","websockets","backpressure","memory-leaks","systems-programming"],"exportEndpoints":{"claude":"/api/rules/bun-websocket-kernel-backpressure-standard?format=claude","cursorMdc":"/api/rules/bun-websocket-kernel-backpressure-standard?format=mdc","cursorrules":"/api/rules/bun-websocket-kernel-backpressure-standard?format=cursor","windsurf":"/api/rules/bun-websocket-kernel-backpressure-standard?format=windsurf","agents":"/api/rules/bun-websocket-kernel-backpressure-standard?format=agents"}},{"id":"openfga-contextual-tuples-transaction-isolation-standard","title":"OpenFGA Contextual Tuples Transaction Isolation & TOCTOU Eradication Standard","category":"backend","severity":"critical","description":"Mandates that ephemeral contextual tuples provided to OpenFGA authorization checks are strictly derived from and bound to transactional database snapshots (or locked rows). This eradicates Time-of-Check to Time-of-Use (TOCTOU) authorization vulnerabilities where parent reassignment, tenancy migration, or ownership transfer occurs concurrently between check evaluation and database mutation.","antiPatternHeadline":"Evaluating Ephemeral Contextual Tuples from Unlocked or Pre-Transaction Cache Prior to Mutation","stars_count":115,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","openfga","authorization","rebac","concurrency","toctou","security"],"exportEndpoints":{"claude":"/api/rules/openfga-contextual-tuples-transaction-isolation-standard?format=claude","cursorMdc":"/api/rules/openfga-contextual-tuples-transaction-isolation-standard?format=mdc","cursorrules":"/api/rules/openfga-contextual-tuples-transaction-isolation-standard?format=cursor","windsurf":"/api/rules/openfga-contextual-tuples-transaction-isolation-standard?format=windsurf","agents":"/api/rules/openfga-contextual-tuples-transaction-isolation-standard?format=agents"}},{"id":"postgres-17-streaming-io-memory-budgeting-standard","title":"Postgres 17 Streaming Read-Ahead & Shared I/O Memory Isolation Standard","category":"backend","severity":"critical","description":"Enforces strict session-level memory limits, worker pool segregation, and controlled asynchronous read-ahead buffer sizing for PostgreSQL 17 streaming I/O. Prevents vectorized parallel sequential scans and aggressive prefetching buffers from saturating shared disk rings and evicting concurrent transactional OLTP working sets.","antiPatternHeadline":"Unbounded Parallel Scans and Global Streaming Read-Ahead Saturating Shared Buffer Pools for Concurrent OLTP","stars_count":116,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres","postgres-17","database","connection-pooling","performance"],"exportEndpoints":{"claude":"/api/rules/postgres-17-streaming-io-memory-budgeting-standard?format=claude","cursorMdc":"/api/rules/postgres-17-streaming-io-memory-budgeting-standard?format=mdc","cursorrules":"/api/rules/postgres-17-streaming-io-memory-budgeting-standard?format=cursor","windsurf":"/api/rules/postgres-17-streaming-io-memory-budgeting-standard?format=windsurf","agents":"/api/rules/postgres-17-streaming-io-memory-budgeting-standard?format=agents"}},{"id":"cmp-skia-metal-lifecycle-sync-guardrail","title":"Compose Multiplatform Skia-Metal Hardware Layer Lifecycle Synchronization","category":"mobile","severity":"critical","description":"Enforces deterministic coordination between Skia GPU rendering surfaces and iOS UIKit lifecycle events across CAMetalLayer hierarchies. Prevents fatal Metal assertion crashes, frame tearing, and background GPU memory leaks by synchronizing GrDirectContext flushes with CADisplayLink and UIApplication states.","antiPatternHeadline":"Asynchronous Metal Surface Destruction and Unflushed Command Buffers During UIKit Background Transitions","stars_count":60,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","compose-multiplatform","skia","metal","ios","uikit","lifecycle"],"exportEndpoints":{"claude":"/api/rules/cmp-skia-metal-lifecycle-sync-guardrail?format=claude","cursorMdc":"/api/rules/cmp-skia-metal-lifecycle-sync-guardrail?format=mdc","cursorrules":"/api/rules/cmp-skia-metal-lifecycle-sync-guardrail?format=cursor","windsurf":"/api/rules/cmp-skia-metal-lifecycle-sync-guardrail?format=windsurf","agents":"/api/rules/cmp-skia-metal-lifecycle-sync-guardrail?format=agents"}},{"id":"android-15-predictive-back-gesture-state-transition-guardrail","title":"Android 15 Predictive Back Deterministic Dual-State Rollback Guardrail","category":"mobile","severity":"critical","description":"Enforces strict dual-state rollback synchronization and lifecycle-bounded callback isolation across Android 15 Predictive Back transitions in hybrid Jetpack Compose and Fragment architectures. Prevents premature state commitment, orphaned transient animations, and UI desynchronization when gesture invocations are canceled mid-swipe by the user. Mandates isolated preview state channels that commit to the canonical navigation stack only upon confirmed gesture completion.","antiPatternHeadline":"Eager State Mutation in OnBackInvokedCallback / PredictiveBackHandler Corrupting Navigation Stacks on Gesture Cancellation","stars_count":74,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","android","android-15","jetpack-compose","fragments","predictive-back","navigation"],"exportEndpoints":{"claude":"/api/rules/android-15-predictive-back-gesture-state-transition-guardrail?format=claude","cursorMdc":"/api/rules/android-15-predictive-back-gesture-state-transition-guardrail?format=mdc","cursorrules":"/api/rules/android-15-predictive-back-gesture-state-transition-guardrail?format=cursor","windsurf":"/api/rules/android-15-predictive-back-gesture-state-transition-guardrail?format=windsurf","agents":"/api/rules/android-15-predictive-back-gesture-state-transition-guardrail?format=agents"}},{"id":"webauthn-largeblob-envelope-encryption-standard","title":"Mandatory Zero-Knowledge Client-Side AEAD Envelope Encryption for WebAuthn LargeBlob Storage","category":"security","severity":"critical","description":"Passkey LargeBlob storage synchronizes opaque binary payloads across multi-device credential ecosystems (e.g., Apple iCloud Keychain, Google Password Manager), inherently exposing unencrypted data to synchronization providers. All data committed to WebAuthn LargeBlob must undergo client-side zero-knowledge envelope encryption using authenticated symmetric ciphers (AES-256-GCM) with distinct ephemeral Data Encryption Keys (DEK) wrapped by a hardened Key Encryption Key (KEK) derived independently of the passkey provider.","antiPatternHeadline":"Persisting Raw Plaintext or Unauthenticated Payloads Directly into WebAuthn LargeBlob Storage","stars_count":79,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["webauthn","passkeys","largeblob","cryptography","envelope-encryption","aead","zero-knowledge"],"exportEndpoints":{"claude":"/api/rules/webauthn-largeblob-envelope-encryption-standard?format=claude","cursorMdc":"/api/rules/webauthn-largeblob-envelope-encryption-standard?format=mdc","cursorrules":"/api/rules/webauthn-largeblob-envelope-encryption-standard?format=cursor","windsurf":"/api/rules/webauthn-largeblob-envelope-encryption-standard?format=windsurf","agents":"/api/rules/webauthn-largeblob-envelope-encryption-standard?format=agents"}},{"id":"bpf-lsm-runtime-container-capability-enforcement","title":"BPF-LSM In-Kernel Capability Guardrails and Synchronous Mediation Invariant","category":"security","severity":"critical","description":"Enforces synchronous, in-kernel security mediation at Linux Security Module (LSM) hooks to block container privilege escalation and capability abuses before syscall completion. Eliminates Time-of-Check to Time-of-Use (TOCTOU) race conditions and user-space context-switching penalties by asserting immediate -EPERM enforcement in kernel space.","antiPatternHeadline":"Deferred or Tracepoint-Based Capability Auditing Prone to TOCTOU and Unbounded Privilege Escalation","stars_count":80,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","ebpf","bpf-lsm","linux-security-module","containers","privilege-escalation"],"exportEndpoints":{"claude":"/api/rules/bpf-lsm-runtime-container-capability-enforcement?format=claude","cursorMdc":"/api/rules/bpf-lsm-runtime-container-capability-enforcement?format=mdc","cursorrules":"/api/rules/bpf-lsm-runtime-container-capability-enforcement?format=cursor","windsurf":"/api/rules/bpf-lsm-runtime-container-capability-enforcement?format=windsurf","agents":"/api/rules/bpf-lsm-runtime-container-capability-enforcement?format=agents"}},{"id":"opentelemetry-otlp-arrow-compression-memory-thresholds","title":"Deterministic Chunk-Size Limits and Backpressure Invariants for OTLP Arrow Telemetry","category":"devops","severity":"critical","description":"Enforces mandatory memory limits, dynamic payload compression thresholds, and strict stream backpressure configurations for OpenTelemetry OTLP Arrow pipelines. High-cardinality telemetry combined with columnar batching can lead to rapid unbounded heap allocation if record batch size limits and upstream backpressure triggers are omitted.","antiPatternHeadline":"Unbounded Columnar Record Batching Without Memory-Limiter Interceptors and Static Flush Ceilings","stars_count":50,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","apache-arrow","otlp","memory-management","backpressure","collector"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-otlp-arrow-compression-memory-thresholds?format=claude","cursorMdc":"/api/rules/opentelemetry-otlp-arrow-compression-memory-thresholds?format=mdc","cursorrules":"/api/rules/opentelemetry-otlp-arrow-compression-memory-thresholds?format=cursor","windsurf":"/api/rules/opentelemetry-otlp-arrow-compression-memory-thresholds?format=windsurf","agents":"/api/rules/opentelemetry-otlp-arrow-compression-memory-thresholds?format=agents"}},{"id":"vite6-environment-api-secret-fence","title":"Vite 6 Multi-Runtime Environment API Secret Fence Standard","category":"frontend","severity":"critical","description":"Enforces strict compile-time boundary isolation across Vite 6 Environment API runtimes (Client, Node SSR, Edge). Prevents server-only credentials, platform bindings, and non-distributable server module graphs from leaking into client-targeted compilation units.","antiPatternHeadline":"Cross-Runtime Module Graph Contamination Leaking Server Secrets into Client Artifacts","stars_count":78,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","vite","vite-6","environment-api","ssr","security"],"exportEndpoints":{"claude":"/api/rules/vite6-environment-api-secret-fence?format=claude","cursorMdc":"/api/rules/vite6-environment-api-secret-fence?format=mdc","cursorrules":"/api/rules/vite6-environment-api-secret-fence?format=cursor","windsurf":"/api/rules/vite6-environment-api-secret-fence?format=windsurf","agents":"/api/rules/vite6-environment-api-secret-fence?format=agents"}},{"id":"postgres-17-memory-context-clamping-guardrail","title":"Postgres 17 Backend Memory-Context Clamping & Preemptive Resource Guardrails","category":"backend","severity":"critical","description":"Enforces strict query-level memory quotas and leverages PostgreSQL 17 enhanced memory context introspection (pg_backend_memory_contexts) to prevent Linux OOM-killer invocations. Requires programmatic session-level clamping of work_mem and statement_timeout alongside proactive termination of runaway memory-consuming analytical queries. Prevents uncontrolled backend memory growth across complex hash joins, materializations, and sort operations.","antiPatternHeadline":"Global Unclamped work_mem Allocation Leading to Backend Process Linux OOM Evictions","stars_count":111,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres-17","database","memory-management","high-availability"],"exportEndpoints":{"claude":"/api/rules/postgres-17-memory-context-clamping-guardrail?format=claude","cursorMdc":"/api/rules/postgres-17-memory-context-clamping-guardrail?format=mdc","cursorrules":"/api/rules/postgres-17-memory-context-clamping-guardrail?format=cursor","windsurf":"/api/rules/postgres-17-memory-context-clamping-guardrail?format=windsurf","agents":"/api/rules/postgres-17-memory-context-clamping-guardrail?format=agents"}},{"id":"fastapi-anyio-structured-concurrency-guardrail","title":"FastAPI 0.115+ AnyIO Structured Concurrency and TaskGroup Isolation","category":"backend","severity":"critical","description":"Enforces strict structured concurrency in FastAPI 0.115+ via AnyIO TaskGroups to ensure deterministic cancellation trees and bounded resource lifecycles. Forbids unmanaged asyncio.create_task and legacy BackgroundTasks for core business operations, completely eliminating dangling child coroutines, silent task drop, and unhandled nursery exceptions.","antiPatternHeadline":"Fire-and-Forget Coroutine Spawning via asyncio.create_task and Unbound BackgroundTasks","stars_count":64,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","anyio","asyncio","concurrency","python"],"exportEndpoints":{"claude":"/api/rules/fastapi-anyio-structured-concurrency-guardrail?format=claude","cursorMdc":"/api/rules/fastapi-anyio-structured-concurrency-guardrail?format=mdc","cursorrules":"/api/rules/fastapi-anyio-structured-concurrency-guardrail?format=cursor","windsurf":"/api/rules/fastapi-anyio-structured-concurrency-guardrail?format=windsurf","agents":"/api/rules/fastapi-anyio-structured-concurrency-guardrail?format=agents"}},{"id":"tauri2-zero-copy-shared-memory-ipc-protocol","title":"Tauri 2.0 Binary IPC Protocol & Zero-Copy Memory Slice Enforcement","category":"mobile","severity":"critical","description":"Enforces raw binary ArrayBuffer transfers and memory-mapped byte slices over the Tauri 2.0 IPC bridge for high-frequency telemetry and binary streams. Eliminates serde_json serialization overhead and GC thrashing across the Rust core and mobile WebKit/Chromium WebView boundary.","antiPatternHeadline":"JSON-Serialized Telemetry and High-Frequency Bridge Flooding","stars_count":67,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri","ipc","performance","rust","zero-copy"],"exportEndpoints":{"claude":"/api/rules/tauri2-zero-copy-shared-memory-ipc-protocol?format=claude","cursorMdc":"/api/rules/tauri2-zero-copy-shared-memory-ipc-protocol?format=mdc","cursorrules":"/api/rules/tauri2-zero-copy-shared-memory-ipc-protocol?format=cursor","windsurf":"/api/rules/tauri2-zero-copy-shared-memory-ipc-protocol?format=windsurf","agents":"/api/rules/tauri2-zero-copy-shared-memory-ipc-protocol?format=agents"}},{"id":"capacitor-7-opfs-worker-sync-standard","title":"Capacitor 7 OPFS Worker Direct-to-Disk Sync Standard","category":"mobile","severity":"critical","description":"Enforces that all Origin Private File System (OPFS) direct-to-disk synchronous access handle operations and embedded SQLite/database I/O are strictly isolated to dedicated Web Workers. Prohibits executing FileSystemSyncAccessHandle operations, IndexedDB synchronous fallbacks, or high-frequency writes on the primary WebView thread to prevent UI micro-stutters and main-thread ANR crashes in Capacitor 7 hybrid applications.","antiPatternHeadline":"Executing Synchronous OPFS Access Handles or Intensive SQLite Disk I/O on the Main WebView Thread","stars_count":84,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","opfs","web-workers","sqlite","local-first","storage"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-opfs-worker-sync-standard?format=claude","cursorMdc":"/api/rules/capacitor-7-opfs-worker-sync-standard?format=mdc","cursorrules":"/api/rules/capacitor-7-opfs-worker-sync-standard?format=cursor","windsurf":"/api/rules/capacitor-7-opfs-worker-sync-standard?format=windsurf","agents":"/api/rules/capacitor-7-opfs-worker-sync-standard?format=agents"}},{"id":"webauthn-conditional-mediation-rate-fencing-standard","title":"WebAuthn Passkey Conditional Mediation Rate-Fencing & Assertion Isolation","category":"security","severity":"critical","description":"Enforces strict server-side rate-fencing, atomic challenge invalidation, and origin-bound assertion validation for WebAuthn autofill/conditional UI requests. Mitigates automated cross-device credential enumeration, passkey credential stuffing, and replay attacks on ambient authentication flows. Guarantees that ephemeral conditional challenges cannot be recycled across sessions or elevated into modal authentication contexts.","antiPatternHeadline":"Unmetered Conditional WebAuthn Verification with Reusable or Shared Challenges","stars_count":80,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","passkeys","fido2","rate-limiting","conditional-mediation"],"exportEndpoints":{"claude":"/api/rules/webauthn-conditional-mediation-rate-fencing-standard?format=claude","cursorMdc":"/api/rules/webauthn-conditional-mediation-rate-fencing-standard?format=mdc","cursorrules":"/api/rules/webauthn-conditional-mediation-rate-fencing-standard?format=cursor","windsurf":"/api/rules/webauthn-conditional-mediation-rate-fencing-standard?format=windsurf","agents":"/api/rules/webauthn-conditional-mediation-rate-fencing-standard?format=agents"}},{"id":"ebpf-service-mesh-bypass-prevention-production-standard","title":"eBPF Socket-Level Service Mesh Proxy Bypass Guardrail","category":"security","severity":"critical","description":"Enforces unconditional kernel-level socket mediation using eBPF cgroup hooks (sock_addr and sock_ops) across container network namespaces. Guarantees that all ingress and egress TCP traffic strictly traverses the local Envoy/ambient zero-trust proxy, neutralizing lateral bypass attacks via raw sockets, modified iptables rules, or netns manipulation.","antiPatternHeadline":"Relying exclusively on user-space iptables redirects susceptible to CAP_NET_ADMIN tampering and raw socket bypass","stars_count":101,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","ebpf","service-mesh","envoy","zero-trust","kernel","cgroup"],"exportEndpoints":{"claude":"/api/rules/ebpf-service-mesh-bypass-prevention-production-standard?format=claude","cursorMdc":"/api/rules/ebpf-service-mesh-bypass-prevention-production-standard?format=mdc","cursorrules":"/api/rules/ebpf-service-mesh-bypass-prevention-production-standard?format=cursor","windsurf":"/api/rules/ebpf-service-mesh-bypass-prevention-production-standard?format=windsurf","agents":"/api/rules/ebpf-service-mesh-bypass-prevention-production-standard?format=agents"}},{"id":"opentelemetry-w3c-span-link-async-choreography-standard","title":"OpenTelemetry W3C Span Link Asynchronous Choreography Standard","category":"devops","severity":"critical","description":"Enforces non-causal OpenTelemetry Span Links instead of parent-child trace contexts across message-driven broker boundaries such as Kafka and AWS SQS. Using direct parent-child contexts across asynchronous broker queues artificially inflates producer latency metrics, creates unbounded distributed trace graphs, and misrepresents independent consumer execution as downstream blocking calls. Consumers must initiate a detached root trace and record the extracted producer context via links with explicit link attributes.","antiPatternHeadline":"Direct Parent Context Propagation in Asynchronous Queue Consumers Corrupting Trace Durations","stars_count":79,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["opentelemetry","distributed-tracing","kafka","sqs","observability","span-links"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-w3c-span-link-async-choreography-standard?format=claude","cursorMdc":"/api/rules/opentelemetry-w3c-span-link-async-choreography-standard?format=mdc","cursorrules":"/api/rules/opentelemetry-w3c-span-link-async-choreography-standard?format=cursor","windsurf":"/api/rules/opentelemetry-w3c-span-link-async-choreography-standard?format=windsurf","agents":"/api/rules/opentelemetry-w3c-span-link-async-choreography-standard?format=agents"}},{"id":"vite-6-environment-api-runtime-sandboxing","title":"Vite 6 Environment API Multi-Runtime Module Sandboxing Standard","category":"frontend","severity":"critical","description":"Enforces strict runtime boundary isolation when cross-compiling shared libraries across browser, edge, Node.js, and workerd targets within a single Vite 6 dev server instance. Guarantees that module graphs, resolve conditions, and transform pipelines remain sandboxed to prevent runtime global contamination and invalid target execution.","antiPatternHeadline":"Cross-contaminating module graphs and resolve conditions across browser, workerd, and Node.js runtimes using legacy single-target Vite paradigms.","stars_count":54,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["vite","vite-6","environment-api","multi-runtime","workerd","edge","sandboxing"],"exportEndpoints":{"claude":"/api/rules/vite-6-environment-api-runtime-sandboxing?format=claude","cursorMdc":"/api/rules/vite-6-environment-api-runtime-sandboxing?format=mdc","cursorrules":"/api/rules/vite-6-environment-api-runtime-sandboxing?format=cursor","windsurf":"/api/rules/vite-6-environment-api-runtime-sandboxing?format=windsurf","agents":"/api/rules/vite-6-environment-api-runtime-sandboxing?format=agents"}},{"id":"react-19-concurrent-optimistic-rollback-invariant","title":"React 19 Concurrent Action Optimistic Rollback State Invariant","category":"frontend","severity":"critical","description":"Enforces deterministic state reconciliation during concurrent React 19 micro-frontend mutations using useActionState and useOptimistic. Prevents state tear, race-condition flashes, and corrupted rollbacks when multiple disjoint transactional mutations resolve out-of-order across micro-frontend boundaries. Mandates monotonic transaction sequence numbering and idempotent reduction contracts for all optimistic buffers.","antiPatternHeadline":"Unsequenced Optimistic Overwrites and Non-Atomic Rollbacks in Concurrent Action Boundaries","stars_count":87,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","useOptimistic","useActionState","concurrency","state-machines","micro-frontends"],"exportEndpoints":{"claude":"/api/rules/react-19-concurrent-optimistic-rollback-invariant?format=claude","cursorMdc":"/api/rules/react-19-concurrent-optimistic-rollback-invariant?format=mdc","cursorrules":"/api/rules/react-19-concurrent-optimistic-rollback-invariant?format=cursor","windsurf":"/api/rules/react-19-concurrent-optimistic-rollback-invariant?format=windsurf","agents":"/api/rules/react-19-concurrent-optimistic-rollback-invariant?format=agents"}},{"id":"axum-tokio-cooperative-cancellation-barrier","title":"Axum 0.8 State Extractors & Tokio Task Cooperative Cancellation Barrier","category":"backend","severity":"critical","description":"Enforces deterministic cancellation boundaries across Axum 0.8 request pipelines and background Tokio worker tasks. Prevents orphaned database transactions, unbounded I/O streams, and thread starvation when HTTP/3 clients abruptly drop connections or trigger stream resets (RST_STREAM). Mandates RAII rollback guards and explicit tokio_util::sync::CancellationToken propagation across async boundaries.","antiPatternHeadline":"Orphaned Tokio Tasks and Leaked Connection Handles on Abrupt HTTP/3 Client Resets","stars_count":76,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tokio","async-cancellation","concurrency"],"exportEndpoints":{"claude":"/api/rules/axum-tokio-cooperative-cancellation-barrier?format=claude","cursorMdc":"/api/rules/axum-tokio-cooperative-cancellation-barrier?format=mdc","cursorrules":"/api/rules/axum-tokio-cooperative-cancellation-barrier?format=cursor","windsurf":"/api/rules/axum-tokio-cooperative-cancellation-barrier?format=windsurf","agents":"/api/rules/axum-tokio-cooperative-cancellation-barrier?format=agents"}},{"id":"postgres-17-json-table-work-mem-spill-prevention","title":"Postgres 17 SQL/JSON JSON_TABLE Memory Boundary and Work-Mem Spill Prevention Guardrail","category":"backend","severity":"critical","description":"Enforces deterministic batch chunking, explicit projection boundaries, and work_mem allocation guards for Postgres 17 JSON_TABLE transformations in CDC ingest paths. Eliminates silent temp-file disk thrashing by preventing cardinality misestimates and unbounded hash joins from exceeding memory limits.","antiPatternHeadline":"Unbounded Dynamic JSON_TABLE Projection Spilling to Temp Disk Files During CDC Ingestion","stars_count":112,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","postgres-17","json-table","cdc","memory-management","performance"],"exportEndpoints":{"claude":"/api/rules/postgres-17-json-table-work-mem-spill-prevention?format=claude","cursorMdc":"/api/rules/postgres-17-json-table-work-mem-spill-prevention?format=mdc","cursorrules":"/api/rules/postgres-17-json-table-work-mem-spill-prevention?format=cursor","windsurf":"/api/rules/postgres-17-json-table-work-mem-spill-prevention?format=windsurf","agents":"/api/rules/postgres-17-json-table-work-mem-spill-prevention?format=agents"}},{"id":"go-chi-wazero-wasm-isolation-boundary","title":"Strict In-Process Wazero WASM Isolation for Multi-Tenant Chi Middleware","category":"backend","severity":"critical","description":"Enforces strict memory page ceilings, lifecycle sandboxing, and secure host function boundaries for dynamic request enrichment plugins executed via Wazero in Go 1.24 Chi HTTP pipelines. Prohibits global mutable runtime modules and unbound host function exports to eliminate cross-tenant data bleed and noisy-neighbor OOM panics while preserving zero-IPC performance.","antiPatternHeadline":"Executing Multi-Tenant Plugins on Shared Wazero Module Instances with Unbounded Memory and Raw Pointer Host Exports","stars_count":107,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["go","chi","wazero","wasm","multi-tenant","isolation","sandboxing"],"exportEndpoints":{"claude":"/api/rules/go-chi-wazero-wasm-isolation-boundary?format=claude","cursorMdc":"/api/rules/go-chi-wazero-wasm-isolation-boundary?format=mdc","cursorrules":"/api/rules/go-chi-wazero-wasm-isolation-boundary?format=cursor","windsurf":"/api/rules/go-chi-wazero-wasm-isolation-boundary?format=windsurf","agents":"/api/rules/go-chi-wazero-wasm-isolation-boundary?format=agents"}},{"id":"webauthn-prf-client-key-derivation-guardrail","title":"WebAuthn PRF Hardware-Backed Deterministic Client Key Derivation Invariant","category":"security","severity":"critical","description":"Enforces strict zero-knowledge end-to-end data encryption at rest in client-side persistence layers by anchoring root key derivation to hardware-backed FIDO2/WebAuthn PRF (Pseudo-Random Function) authenticator extensions. Mandates fail-closed semantics, HKDF-SHA-256 context separation, in-memory ephemeral key handling, and zero network transmission of derived secret material.","antiPatternHeadline":"Persisting raw PRF outputs, bypassing HKDF domain separation, or transmitting hardware-derived secrets across network boundaries","stars_count":73,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","prf-extension","cryptography","zero-knowledge","hkdf","indexeddb"],"exportEndpoints":{"claude":"/api/rules/webauthn-prf-client-key-derivation-guardrail?format=claude","cursorMdc":"/api/rules/webauthn-prf-client-key-derivation-guardrail?format=mdc","cursorrules":"/api/rules/webauthn-prf-client-key-derivation-guardrail?format=cursor","windsurf":"/api/rules/webauthn-prf-client-key-derivation-guardrail?format=windsurf","agents":"/api/rules/webauthn-prf-client-key-derivation-guardrail?format=agents"}},{"id":"kmp-skie-swift-actor-isolation-barrier","title":"KMP 2.1 SKIE Swift Concurrency Actor Isolation and Executor Barrier Standard","category":"mobile","severity":"critical","description":"Enforces rigid boundary protocols when bridging Kotlin Coroutines and Swift 6 actors via SKIE on iOS 18. Eliminates cooperative thread pool starvation, priority inversions, and executor deadlocks caused by unmanaged cross-runtime reentrancy and shared mutable state across Swift and Kotlin Native dispatchers.","antiPatternHeadline":"Directly Consuming Kotlin Suspend Functions and Flows Inside Swift Actor Execution Contexts Without Isolation Decoupling","stars_count":93,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kmp","swift-concurrency","skie","kotlin-native","ios18"],"exportEndpoints":{"claude":"/api/rules/kmp-skie-swift-actor-isolation-barrier?format=claude","cursorMdc":"/api/rules/kmp-skie-swift-actor-isolation-barrier?format=mdc","cursorrules":"/api/rules/kmp-skie-swift-actor-isolation-barrier?format=cursor","windsurf":"/api/rules/kmp-skie-swift-actor-isolation-barrier?format=windsurf","agents":"/api/rules/kmp-skie-swift-actor-isolation-barrier?format=agents"}},{"id":"tauri-v2-mobile-zero-copy-ipc-protocol","title":"Tauri 2.0 Zero-Copy Binary Stream Buffer Protocol for Mobile WebViews","category":"mobile","severity":"critical","description":"Prohibits base64 stringification and standard JSON serialization across the Tauri 2.0 IPC boundary for media payloads, model weights, and embeddings exceeding 64KB. Mandates direct binary buffer transfers via Tauri 2.0 raw byte streaming channels or custom protocol schemes to eliminate V8/JavaScriptCore heap pressure and prevent immediate mobile OS low-memory termination (OOM).","antiPatternHeadline":"Base64-Encoding Multi-Megabyte Buffers Over JSON IPC Causing Mobile WebView OOM Terminations","stars_count":88,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri-v2","ipc","zero-copy","memory-management","rust"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-mobile-zero-copy-ipc-protocol?format=claude","cursorMdc":"/api/rules/tauri-v2-mobile-zero-copy-ipc-protocol?format=mdc","cursorrules":"/api/rules/tauri-v2-mobile-zero-copy-ipc-protocol?format=cursor","windsurf":"/api/rules/tauri-v2-mobile-zero-copy-ipc-protocol?format=windsurf","agents":"/api/rules/tauri-v2-mobile-zero-copy-ipc-protocol?format=agents"}},{"id":"opentelemetry-ebpf-profiling-pii-scrubbing-standard","title":"OpenTelemetry eBPF Continuous Profiling In-Kernel PII and Pointer Scrubbing Standard","category":"devops","severity":"critical","description":"Enforces strict in-kernel sanitization and pointer normalization inside eBPF continuous profiling probes prior to user-space ring buffer submission. Prevents inadvertent leakage of Personally Identifiable Information (PII), application secrets, and kernel/user ASLR address layouts to OpenTelemetry collectors.","antiPatternHeadline":"Exporting Raw Pointer Layouts and Stack String Arguments via Unscrubbed eBPF Profiling Buffers","stars_count":92,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","opentelemetry","continuous-profiling","pii-protection","linux-kernel","aslr"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-ebpf-profiling-pii-scrubbing-standard?format=claude","cursorMdc":"/api/rules/opentelemetry-ebpf-profiling-pii-scrubbing-standard?format=mdc","cursorrules":"/api/rules/opentelemetry-ebpf-profiling-pii-scrubbing-standard?format=cursor","windsurf":"/api/rules/opentelemetry-ebpf-profiling-pii-scrubbing-standard?format=windsurf","agents":"/api/rules/opentelemetry-ebpf-profiling-pii-scrubbing-standard?format=agents"}},{"id":"cosign-keyless-slsa-attestation-boundary","title":"Sigstore Ephemeral Keyless Attestation & SLSA v1.0 Verification Boundary","category":"devops","severity":"critical","description":"Enforces cryptographic supply-chain integrity by mandating Cosign keyless image verification and SLSA v1.0 provenance validation before container deployment. Blocks unverified mutable image tags, long-lived asymmetric keys, and missing Rekor transparency log inclusion proofs within zero-trust cluster admission controllers. Ensures every artifact is cryptographically bound to an immutable OIDC builder identity and an authenticated source repository.","antiPatternHeadline":"Admitting unverified container tags, relying on static signing keys, or omitting SLSA v1.0 provenance verification","stars_count":56,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","sigstore","cosign","slsa-v1","supply-chain-security","zero-trust"],"exportEndpoints":{"claude":"/api/rules/cosign-keyless-slsa-attestation-boundary?format=claude","cursorMdc":"/api/rules/cosign-keyless-slsa-attestation-boundary?format=mdc","cursorrules":"/api/rules/cosign-keyless-slsa-attestation-boundary?format=cursor","windsurf":"/api/rules/cosign-keyless-slsa-attestation-boundary?format=windsurf","agents":"/api/rules/cosign-keyless-slsa-attestation-boundary?format=agents"}},{"id":"nextjs-15-ppr-cache-isolation-boundary","title":"Next.js 15 PPR Cache Isolation and Dynamic Slot Boundary Enforcement","category":"frontend","severity":"critical","description":"Enforces strict physical boundaries between static prerendered layout shells and dynamic streaming holes in Next.js 15 Partial Prerendering (PPR). Mandates the encapsulation of dynamic runtime data access (headers, cookies, searchParams, and un-cached I/O) within dedicated React Suspense boundaries to prevent layout cache de-opt, CDN edge cache thrashing, and critical PII leakage via static shell baking.","antiPatternHeadline":"Dynamic Hook Invocation and Header Leaks Inside Static Layout Shells","stars_count":109,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs","react","partial-prerendering","edge-cache","security"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-ppr-cache-isolation-boundary?format=claude","cursorMdc":"/api/rules/nextjs-15-ppr-cache-isolation-boundary?format=mdc","cursorrules":"/api/rules/nextjs-15-ppr-cache-isolation-boundary?format=cursor","windsurf":"/api/rules/nextjs-15-ppr-cache-isolation-boundary?format=windsurf","agents":"/api/rules/nextjs-15-ppr-cache-isolation-boundary?format=agents"}},{"id":"angular-19-zoneless-signals-guardrail","title":"Angular 19 Zoneless Signals & Deterministic Change Detection Guardrail","category":"frontend","severity":"critical","description":"Enforces strict zoneless architecture in Angular 19 by removing Zone.js runtime monkey-patching in favor of explicit reactive signals and microtask scheduling. Prevents silent UI update failures caused by untracked mutable class properties modified during asynchronous events. Mandates the use of Signal primitives, resource APIs, and RxJS-to-Signal bridges across all presentation and state layers.","antiPatternHeadline":"Mutating Un-signaled Class Properties in Async Handlers Under Zoneless Execution","stars_count":91,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","angular","angular-19","zoneless","signals","change-detection","typescript"],"exportEndpoints":{"claude":"/api/rules/angular-19-zoneless-signals-guardrail?format=claude","cursorMdc":"/api/rules/angular-19-zoneless-signals-guardrail?format=mdc","cursorrules":"/api/rules/angular-19-zoneless-signals-guardrail?format=cursor","windsurf":"/api/rules/angular-19-zoneless-signals-guardrail?format=windsurf","agents":"/api/rules/angular-19-zoneless-signals-guardrail?format=agents"}},{"id":"postgres-17-failover-replication-slot-sync-standard","title":"PostgreSQL 17 Failover Logical Replication Slot Synchronization Invariant","category":"backend","severity":"critical","description":"Enforces PostgreSQL 17 native logical replication slot synchronization across physical High Availability (HA) replicas. Prevents event loss, catastrophic replay storms, and corrupted downstream stream offsets during replica promotion by requiring failover-enabled slots and synchronized standby barriers.","antiPatternHeadline":"Unflagged Logical Slot Creation and Missing Standby Synchronization Barriers","stars_count":63,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql-17","cdc","logical-replication","high-availability","event-driven"],"exportEndpoints":{"claude":"/api/rules/postgres-17-failover-replication-slot-sync-standard?format=claude","cursorMdc":"/api/rules/postgres-17-failover-replication-slot-sync-standard?format=mdc","cursorrules":"/api/rules/postgres-17-failover-replication-slot-sync-standard?format=cursor","windsurf":"/api/rules/postgres-17-failover-replication-slot-sync-standard?format=windsurf","agents":"/api/rules/postgres-17-failover-replication-slot-sync-standard?format=agents"}},{"id":"pydantic-v2-rust-core-strict-validation","title":"Pydantic V2 Rust-Core Strict Ingestion Boundary Standard","category":"backend","severity":"critical","description":"Mandates compile-level strict validation mode and direct binary deserialization via pydantic-core at all external network boundaries. Eliminates silent implicit type coercion vulnerabilities and bypasses Python GIL runtime serialization bottlenecks by delegating parsing directly to the Rust core.","antiPatternHeadline":"Lax Type Coercion and Intermediate Dict Allocation at Network Boundaries","stars_count":46,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","python","pydantic","pydantic-core","fastapi","security"],"exportEndpoints":{"claude":"/api/rules/pydantic-v2-rust-core-strict-validation?format=claude","cursorMdc":"/api/rules/pydantic-v2-rust-core-strict-validation?format=mdc","cursorrules":"/api/rules/pydantic-v2-rust-core-strict-validation?format=cursor","windsurf":"/api/rules/pydantic-v2-rust-core-strict-validation?format=windsurf","agents":"/api/rules/pydantic-v2-rust-core-strict-validation?format=agents"}},{"id":"nats-jetstream-deterministic-deduplication-guardrail","title":"Deterministic Deduplication and Optimistic Concurrency Invariants in NATS JetStream 2.11","category":"backend","severity":"critical","description":"Mandates deterministic Nats-Msg-Id generation and optimistic concurrency headers across all publisher operations in NATS JetStream 2.11. Eliminates phantom state drifts and dual-write anomalies across geo-distributed clusters by enforcing stream-level deduplication windows and aggregate sequence invariants instead of relying on distributed two-phase locking.","antiPatternHeadline":"Publishing State-Altering Events with Ephemeral UUIDs and Missing Concurrency Control Headers","stars_count":51,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","nats","jetstream","event-sourcing","idempotency","distributed-systems"],"exportEndpoints":{"claude":"/api/rules/nats-jetstream-deterministic-deduplication-guardrail?format=claude","cursorMdc":"/api/rules/nats-jetstream-deterministic-deduplication-guardrail?format=mdc","cursorrules":"/api/rules/nats-jetstream-deterministic-deduplication-guardrail?format=cursor","windsurf":"/api/rules/nats-jetstream-deterministic-deduplication-guardrail?format=windsurf","agents":"/api/rules/nats-jetstream-deterministic-deduplication-guardrail?format=agents"}},{"id":"capacitor-7-bridgeless-plugin-security-sandboxing","title":"Capacitor 7 Bridgeless Plugin Origin-Scoped Capability Sandboxing","category":"mobile","severity":"critical","description":"Enforces strict origin-scoped capability manifests and sandbox barriers for Capacitor 7 web-to-native execution channels. Prevents cross-webview script injection, arbitrary native bridge calls from untrusted subframes or injected XSS payloads, and privilege escalation by binding plugin dispatch to cryptographically verified or origin-whitelisted execution contexts.","antiPatternHeadline":"Unrestricted Global Native Bridge Exposure and Unvalidated Cross-Origin Plugin Invocation","stars_count":102,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["capacitor","capacitor-7","mobile-security","sandbox","webview","bridgeless"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-bridgeless-plugin-security-sandboxing?format=claude","cursorMdc":"/api/rules/capacitor-7-bridgeless-plugin-security-sandboxing?format=mdc","cursorrules":"/api/rules/capacitor-7-bridgeless-plugin-security-sandboxing?format=cursor","windsurf":"/api/rules/capacitor-7-bridgeless-plugin-security-sandboxing?format=windsurf","agents":"/api/rules/capacitor-7-bridgeless-plugin-security-sandboxing?format=agents"}},{"id":"jetpack-compose-strong-skipping-layout-stabilization-standard","title":"Jetpack Compose Strong Skipping Mode Layout Stabilization Standard","category":"mobile","severity":"critical","description":"Enforces compiler-grade stability contracts, structural equality invariants, and capture hygiene under Compose Strong Skipping Mode. Eradicates recomposition cascades in high-frequency rendering trees by eliminating unstable parameter passing, non-memoized lambda capture leaks, and broken equals/hashCode contracts.","antiPatternHeadline":"Instantiating Unstable Models and Breaking Value Equality Across Strong-Skipping Composable Boundaries","stars_count":43,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","android","jetpack-compose","performance","compiler-plugin","recomposition"],"exportEndpoints":{"claude":"/api/rules/jetpack-compose-strong-skipping-layout-stabilization-standard?format=claude","cursorMdc":"/api/rules/jetpack-compose-strong-skipping-layout-stabilization-standard?format=mdc","cursorrules":"/api/rules/jetpack-compose-strong-skipping-layout-stabilization-standard?format=cursor","windsurf":"/api/rules/jetpack-compose-strong-skipping-layout-stabilization-standard?format=windsurf","agents":"/api/rules/jetpack-compose-strong-skipping-layout-stabilization-standard?format=agents"}},{"id":"webauthn-prf-client-key-derivation-guardrail-webauthn-prf-ext-783","title":"WebAuthn PRF Zero-Knowledge Client-Side Key Derivation Standard","category":"security","severity":"critical","description":"Enforces strict client-side evaluation of WebAuthn Pseudo-Random Function (PRF) extension outputs and secure derivation of non-extractable symmetric encryption keys via Web Crypto HKDF. Guarantees that raw PRF outputs, intermediate salts, and derived plaintext keys never egress beyond ephemeral browser memory or traverse server boundaries, preserving end-to-end zero-knowledge confidentiality.","antiPatternHeadline":"Transmitting Raw WebAuthn PRF Outputs to Backends or Storing Derived Keys in Persistent Client Storage","stars_count":81,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","prf-extension","zero-knowledge","webcrypto","hkdf"],"exportEndpoints":{"claude":"/api/rules/webauthn-prf-client-key-derivation-guardrail-webauthn-prf-ext-783?format=claude","cursorMdc":"/api/rules/webauthn-prf-client-key-derivation-guardrail-webauthn-prf-ext-783?format=mdc","cursorrules":"/api/rules/webauthn-prf-client-key-derivation-guardrail-webauthn-prf-ext-783?format=cursor","windsurf":"/api/rules/webauthn-prf-client-key-derivation-guardrail-webauthn-prf-ext-783?format=windsurf","agents":"/api/rules/webauthn-prf-client-key-derivation-guardrail-webauthn-prf-ext-783?format=agents"}},{"id":"sigstore-cosign-slsa3-ephemeral-keyless-guardrail","title":"Sigstore Cosign SLSA Level 3 Ephemeral Keyless Attestation & Admission Guardrail","category":"security","severity":"critical","description":"Enforces cryptographically verifiable provenance and container integrity via Sigstore Cosign utilizing ephemeral OIDC workload identities (Fulcio, Rekor). Mandates cluster-wide Kubernetes admission control (Kyverno/Policy Controller) to reject any container image lacking verifiable SLSA Level 3 provenance attestations and signed SBOMs prior to pod execution.","antiPatternHeadline":"Deploying unsigned container images or relying on static long-lived signing keys without admission verification","stars_count":94,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","sigstore","cosign","slsa-level-3","kubernetes","supply-chain","kyverno"],"exportEndpoints":{"claude":"/api/rules/sigstore-cosign-slsa3-ephemeral-keyless-guardrail?format=claude","cursorMdc":"/api/rules/sigstore-cosign-slsa3-ephemeral-keyless-guardrail?format=mdc","cursorrules":"/api/rules/sigstore-cosign-slsa3-ephemeral-keyless-guardrail?format=cursor","windsurf":"/api/rules/sigstore-cosign-slsa3-ephemeral-keyless-guardrail?format=windsurf","agents":"/api/rules/sigstore-cosign-slsa3-ephemeral-keyless-guardrail?format=agents"}},{"id":"opentelemetry-ebpf-zero-overhead-context-injection","title":"OpenTelemetry eBPF Kernel-Level W3C Trace Context Injection Guardrails","category":"devops","severity":"critical","description":"Enforces zero-overhead W3C distributed trace context injection directly within Linux socket buffers via eBPF kprobes and TC egress filters. Prevents TCP stream desynchronization, kernel memory corruption, and TLS frame mangling when instrumenting legacy workloads without sidecars. Guarantees fail-open semantics and strict kernel verifier safety without injecting latency into the critical network path.","antiPatternHeadline":"Corrupting In-Flight TCP Streams and Triggering Kernel Panics via Unchecked Socket Buffer Rewrite","stars_count":48,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","opentelemetry","tracing","kprobes","kernel","observability"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-ebpf-zero-overhead-context-injection?format=claude","cursorMdc":"/api/rules/opentelemetry-ebpf-zero-overhead-context-injection?format=mdc","cursorrules":"/api/rules/opentelemetry-ebpf-zero-overhead-context-injection?format=cursor","windsurf":"/api/rules/opentelemetry-ebpf-zero-overhead-context-injection?format=windsurf","agents":"/api/rules/opentelemetry-ebpf-zero-overhead-context-injection?format=agents"}},{"id":"openfga-rebac-graph-expansion-depth-quotas","title":"Deterministic Traversal Depth and Cycle Quotas for OpenFGA 1.8 ReBAC","category":"security","severity":"critical","description":"Enforces deterministic graph traversal ceilings, strict contextual tuple limits, and cycle-breaking invariants across OpenFGA 1.8 relationship-based access control (ReBAC) implementations. Prevents unbounded graph expansion attacks, recursive amplification denial-of-service, and resource exhaustion during Check, ListObjects, and Expand evaluation pipelines.","antiPatternHeadline":"Unbounded Graph Traversal and Unvalidated Contextual Tuple Injection in ReBAC Evaluation","stars_count":53,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","rebac","authorization","dos-prevention","graph-depth"],"exportEndpoints":{"claude":"/api/rules/openfga-rebac-graph-expansion-depth-quotas?format=claude","cursorMdc":"/api/rules/openfga-rebac-graph-expansion-depth-quotas?format=mdc","cursorrules":"/api/rules/openfga-rebac-graph-expansion-depth-quotas?format=cursor","windsurf":"/api/rules/openfga-rebac-graph-expansion-depth-quotas?format=windsurf","agents":"/api/rules/openfga-rebac-graph-expansion-depth-quotas?format=agents"}},{"id":"bun-ffi-buffer-pinning-alignment-guardrail","title":"Bun 1.2 Native FFI Concurrent Buffer Pinning & Memory Alignment Guardrail","category":"backend","severity":"critical","description":"Prevents garbage collector memory-compaction race conditions, invalid pointer invalidations, and unaligned memory traps when zero-copy passing typed array buffers between Bun's JavaScriptCore runtime and native C/Rust shared libraries. Enforces explicit pointer lifetime pinning, explicit memory boundary alignment verification, and lifecycle-bounded execution across asynchronous FFI task boundaries.","antiPatternHeadline":"Zero-Copy Transient TypedArray Passing Without Explicit Memory Alignment and Reference Pinning Across Async Native Boundaries","stars_count":87,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["bun","ffi","memory-safety","javascriptcore","concurrency","alignment"],"exportEndpoints":{"claude":"/api/rules/bun-ffi-buffer-pinning-alignment-guardrail?format=claude","cursorMdc":"/api/rules/bun-ffi-buffer-pinning-alignment-guardrail?format=mdc","cursorrules":"/api/rules/bun-ffi-buffer-pinning-alignment-guardrail?format=cursor","windsurf":"/api/rules/bun-ffi-buffer-pinning-alignment-guardrail?format=windsurf","agents":"/api/rules/bun-ffi-buffer-pinning-alignment-guardrail?format=agents"}},{"id":"tauri2-capability-matrix-ipc-filter-standard","title":"Tauri 2.0 Granular Capability Matrix Scoping and IPC Filter Standard","category":"mobile","severity":"critical","description":"Enforces strict principle-of-least-privilege by cryptographically binding platform-native API access exclusively to explicit runtime window labels and URL origin contexts. Prevents cross-context privilege escalation on mobile runtimes by mandating granular capability JSON manifests with fine-grained permission arrays, explicit remote/local origin boundaries, and runtime IPC call filtering. Eliminates ambient authority by rejecting wildcard permissions, unconstrained core plugin exports, and unvalidated frontend invoke dispatches.","antiPatternHeadline":"Ambient IPC Authority and Wildcard Permission Scoping in Tauri 2.0 Mobile Capabilities","stars_count":104,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri-2","security","ipc","rust","capabilities"],"exportEndpoints":{"claude":"/api/rules/tauri2-capability-matrix-ipc-filter-standard?format=claude","cursorMdc":"/api/rules/tauri2-capability-matrix-ipc-filter-standard?format=mdc","cursorrules":"/api/rules/tauri2-capability-matrix-ipc-filter-standard?format=cursor","windsurf":"/api/rules/tauri2-capability-matrix-ipc-filter-standard?format=windsurf","agents":"/api/rules/tauri2-capability-matrix-ipc-filter-standard?format=agents"}},{"id":"compose-multiplatform-vulkan-metal-surface-synchronization","title":"Deterministic Vulkan/Metal Swapchain and Surface Invalidation Guardrail","category":"mobile","severity":"critical","description":"Enforces synchronous GPU pipeline fencing and swapchain invalidation during asynchronous native lifecycle suspension in Compose Multiplatform 1.8. Prevents fatal GPU hardware driver hangs (VK_ERROR_SURFACE_LOST_KHR) and CAMetalLayer memory faults by blocking surface destruction until in-flight command buffers retire and the swap barrier is safely quarantined.","antiPatternHeadline":"Asynchronous Surface Teardown Triggering Orphaned GPU Submissions and Swapchain Deadlocks","stars_count":117,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","compose-multiplatform","vulkan","metal","graphics","concurrency","android","ios"],"exportEndpoints":{"claude":"/api/rules/compose-multiplatform-vulkan-metal-surface-synchronization?format=claude","cursorMdc":"/api/rules/compose-multiplatform-vulkan-metal-surface-synchronization?format=mdc","cursorrules":"/api/rules/compose-multiplatform-vulkan-metal-surface-synchronization?format=cursor","windsurf":"/api/rules/compose-multiplatform-vulkan-metal-surface-synchronization?format=windsurf","agents":"/api/rules/compose-multiplatform-vulkan-metal-surface-synchronization?format=agents"}},{"id":"nats-jetstream-deduplication-window-invariant","title":"NATS JetStream 2.11 Clustered Message Deduplication Window Invariant","category":"backend","severity":"critical","description":"Enforces deterministic, non-zero deduplication windows and client-side monotonic Nats-Msg-Id generation across Raft-replicated JetStream streams. Prevents at-least-once message explosion and silent double-execution during network partitions, cluster failovers, and slow consumer re-transmissions. Mandates aligned StreamConfig duplicate_window durations that match or exceed max consumer ack wait and producer retry horizons.","antiPatternHeadline":"Publishing to JetStream without Nats-Msg-Id headers or using duplicate_window shorter than producer retry timeouts","stars_count":108,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","nats","jetstream","distributed-systems","raft","idempotency"],"exportEndpoints":{"claude":"/api/rules/nats-jetstream-deduplication-window-invariant?format=claude","cursorMdc":"/api/rules/nats-jetstream-deduplication-window-invariant?format=mdc","cursorrules":"/api/rules/nats-jetstream-deduplication-window-invariant?format=cursor","windsurf":"/api/rules/nats-jetstream-deduplication-window-invariant?format=windsurf","agents":"/api/rules/nats-jetstream-deduplication-window-invariant?format=agents"}},{"id":"react-19-resource-preload-dedup-invariant","title":"React 19 Document Resource Preload Priority & Deduplication Invariant","category":"frontend","severity":"critical","description":"Enforces deterministic asset preloading and deduplication via React 19's native resource dispatchers and hoisted metadata elements. Eliminates client-side waterfalls, DOM mutation side-effects, and duplicate script execution by integrating directly with React's streaming resource discovery engine.","antiPatternHeadline":"Imperative Head Injections and Client-Side useEffect Preloading Waterfall","stars_count":79,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react19","performance","ssr","streaming","preloading","web-vitals"],"exportEndpoints":{"claude":"/api/rules/react-19-resource-preload-dedup-invariant?format=claude","cursorMdc":"/api/rules/react-19-resource-preload-dedup-invariant?format=mdc","cursorrules":"/api/rules/react-19-resource-preload-dedup-invariant?format=cursor","windsurf":"/api/rules/react-19-resource-preload-dedup-invariant?format=windsurf","agents":"/api/rules/react-19-resource-preload-dedup-invariant?format=agents"}},{"id":"cilium-ebpf-host-routing-ephemeral-port-standard","title":"Cilium eBPF Host-Routing NodePort Ephemeral Port Allocation Standard","category":"devops","severity":"critical","description":"Enforces strict coordination between Linux kernel ephemeral port ranges (ip_local_port_range) and Cilium eBPF host-routing NodePort configurations. Under ultra-high-throughput microservice topologies, port collision or conntrack table saturation triggers silent packet drops unless Cilium bypasses the legacy netfilter/conntrack subsystem via eBPF host routing (bpf.masquerade=true, bpf.hostRouting=true) and non-overlapping NodePort allocation.","antiPatternHeadline":"Overlapping Linux Ephemeral Port Range with Kubernetes NodePort Port Range while Legacy Conntrack Remains Unbypassed","stars_count":55,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","cilium","ebpf","networking","kubernetes","conntrack","helm"],"exportEndpoints":{"claude":"/api/rules/cilium-ebpf-host-routing-ephemeral-port-standard?format=claude","cursorMdc":"/api/rules/cilium-ebpf-host-routing-ephemeral-port-standard?format=mdc","cursorrules":"/api/rules/cilium-ebpf-host-routing-ephemeral-port-standard?format=cursor","windsurf":"/api/rules/cilium-ebpf-host-routing-ephemeral-port-standard?format=windsurf","agents":"/api/rules/cilium-ebpf-host-routing-ephemeral-port-standard?format=agents"}},{"id":"oidc-dpop-token-binding-guardrail","title":"RFC 9449 Demonstrating Proof-of-Possession (DPoP) & Server-Nonce Invariants","category":"security","severity":"critical","description":"Enforces RFC 9449 Demonstrating Proof-of-Possession (DPoP) token binding across all client and resource server interactions. Ensures access and refresh tokens are cryptographically sender-constrained using non-exportable asymmetric keypairs and mandates automated retry semantics with strict server-nonce verification to mitigate replay and exfiltration vectors.","antiPatternHeadline":"Transmitting bearer tokens without cryptographic key binding or ignoring DPoP-Nonce rotation protocols","stars_count":50,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","oauth2","oidc","dpop","cryptography","jwt","rfc9449"],"exportEndpoints":{"claude":"/api/rules/oidc-dpop-token-binding-guardrail?format=claude","cursorMdc":"/api/rules/oidc-dpop-token-binding-guardrail?format=mdc","cursorrules":"/api/rules/oidc-dpop-token-binding-guardrail?format=cursor","windsurf":"/api/rules/oidc-dpop-token-binding-guardrail?format=windsurf","agents":"/api/rules/oidc-dpop-token-binding-guardrail?format=agents"}},{"id":"svelte-5-runes-effect-root-lifecycle-isolation","title":"Svelte 5 Runes Memory Lifecycle Isolation & $effect.root Teardown Guardrail","category":"frontend","severity":"critical","description":"Strictly governs the instantiation, scoping, and teardown of non-component reactive graphs using Svelte 5 runes. Enforces explicit disposal of $effect.root scopes to eliminate Node.js/Bun heap leaks during streaming SSR and prevent runaway reactive dependency cycles across client-side page transitions.","antiPatternHeadline":"Leaking Detached Reactive Roots and Request-Polluting Singletons in Streaming SSR","stars_count":47,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["svelte","svelte-5","runes","memory-management","ssr","reactivity"],"exportEndpoints":{"claude":"/api/rules/svelte-5-runes-effect-root-lifecycle-isolation?format=claude","cursorMdc":"/api/rules/svelte-5-runes-effect-root-lifecycle-isolation?format=mdc","cursorrules":"/api/rules/svelte-5-runes-effect-root-lifecycle-isolation?format=cursor","windsurf":"/api/rules/svelte-5-runes-effect-root-lifecycle-isolation?format=windsurf","agents":"/api/rules/svelte-5-runes-effect-root-lifecycle-isolation?format=agents"}},{"id":"vite6-environment-boundary-segmentation-standard","title":"Vite 6 Environment API Segmentation and Zero-Leak Module Isolation","category":"frontend","severity":"critical","description":"Enforces strict boundary segmentation across browser, Node.js, and edge runtimes using the Vite 6 Environment API. Guarantees zero module leak, deterministic polyfill elimination, and isolated module graphs during unified client, SSR, and edge builds.","antiPatternHeadline":"Monolithic Multi-Target Configs Causing Node Polyfill Leakage and Runtime Boundary Cross-Contamination","stars_count":111,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","vite6","environment-api","module-isolation","edge","ssr","bundling"],"exportEndpoints":{"claude":"/api/rules/vite6-environment-boundary-segmentation-standard?format=claude","cursorMdc":"/api/rules/vite6-environment-boundary-segmentation-standard?format=mdc","cursorrules":"/api/rules/vite6-environment-boundary-segmentation-standard?format=cursor","windsurf":"/api/rules/vite6-environment-boundary-segmentation-standard?format=windsurf","agents":"/api/rules/vite6-environment-boundary-segmentation-standard?format=agents"}},{"id":"go-124-swissmap-cache-reclamation-invariant","title":"Go 1.24 SwissMap Cache Memory Reclamation and Bucket Retention Invariant","category":"backend","severity":"critical","description":"Go 1.24 replaces internal map internals with a high-performance Swiss Table implementation that reduces group overhead but retains allocated group control words and table capacity across high-churn clear/delete operations. High-throughput concurrent caches must mandate epoch-based generation rotation or explicit map reconstruction rather than unbounded clear/delete iterations, avoiding permanent heap inflation and GC scan tail-latency. Strict non-blocking read paths and atomic pointer rotations are enforced to guarantee deterministic runtime GC sweeps.","antiPatternHeadline":"Unbounded map clearance and key deletion in high-churn Go 1.24 caches causing zombie group table retention and GC scan overhead.","stars_count":66,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","concurrency","garbage-collection","memory-management","swiss-table"],"exportEndpoints":{"claude":"/api/rules/go-124-swissmap-cache-reclamation-invariant?format=claude","cursorMdc":"/api/rules/go-124-swissmap-cache-reclamation-invariant?format=mdc","cursorrules":"/api/rules/go-124-swissmap-cache-reclamation-invariant?format=cursor","windsurf":"/api/rules/go-124-swissmap-cache-reclamation-invariant?format=windsurf","agents":"/api/rules/go-124-swissmap-cache-reclamation-invariant?format=agents"}},{"id":"iceberg-v3-rest-catalog-occ-fencing","title":"Apache Iceberg v3 REST Catalog OCC Commit Fencing & Monotonic State Validation","category":"backend","severity":"critical","description":"Enforces strict Optimistic Concurrency Control (OCC) fencing and monotonic sequence assertion on Apache Iceberg v3 REST catalog commit operations. Prevents silent data corruption, phantom table updates, and lost commits caused by concurrent writes across heterogeneous compute engines (e.g., Spark, Trino, Flink). Catalogs and clients must validate metadata-log lineage, sequence numbers, and assert-table-uuid checks atomically before committing table updates.","antiPatternHeadline":"Blind Catalog Pointer Overwrites and Missing Sequence Number Fencing in REST Catalog Commit Handlers","stars_count":76,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","iceberg","data-lakehouse","concurrency","distributed-systems","rest-catalog"],"exportEndpoints":{"claude":"/api/rules/iceberg-v3-rest-catalog-occ-fencing?format=claude","cursorMdc":"/api/rules/iceberg-v3-rest-catalog-occ-fencing?format=mdc","cursorrules":"/api/rules/iceberg-v3-rest-catalog-occ-fencing?format=cursor","windsurf":"/api/rules/iceberg-v3-rest-catalog-occ-fencing?format=windsurf","agents":"/api/rules/iceberg-v3-rest-catalog-occ-fencing?format=agents"}},{"id":"tauri-v2-capability-ipc-sandbox","title":"Tauri 2.0 Mobile Capability Sandboxing & Origin-Bound IPC Guardrails","category":"mobile","severity":"critical","description":"Enforces strict capability-based Access Control Lists (ACLs) and origin-bound IPC permission sandboxing in Tauri 2.0 mobile architectures. Mandates granular command scoping, file-system path sandboxing, and webview origin isolation to prevent remote code execution (RCE) and unauthorized native privilege escalation from compromised renderer contexts.","antiPatternHeadline":"Permissive Wildcard IPC Capabilities and Unscoped Command Invocation in Tauri Mobile Webviews","stars_count":84,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri-2","ipc-security","rust","sandbox","capabilities"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-capability-ipc-sandbox?format=claude","cursorMdc":"/api/rules/tauri-v2-capability-ipc-sandbox?format=mdc","cursorrules":"/api/rules/tauri-v2-capability-ipc-sandbox?format=cursor","windsurf":"/api/rules/tauri-v2-capability-ipc-sandbox?format=windsurf","agents":"/api/rules/tauri-v2-capability-ipc-sandbox?format=agents"}},{"id":"passkey-conditional-mediation-origin-downgrade-fencing","title":"Passkey Conditional Mediation Cross-Origin Downgrade Fencing & RP Binding Invariant","category":"security","severity":"critical","description":"Enforces cryptographic and architectural fencing for WebAuthn autofill (conditional mediation) flows to prevent relying-party origin reflection vulnerabilities. Verifies that the clientDataJSON origin and authenticatorData rpIdHash match immutable, cryptographically sealed whitelists rather than trusting incoming HTTP headers or permissive cross-origin delegations.","antiPatternHeadline":"Reflecting Dynamic HTTP Origin/Host Headers into WebAuthn Assertion RP Verification","stars_count":89,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","fido2","passkeys","conditional-mediation","origin-fencing"],"exportEndpoints":{"claude":"/api/rules/passkey-conditional-mediation-origin-downgrade-fencing?format=claude","cursorMdc":"/api/rules/passkey-conditional-mediation-origin-downgrade-fencing?format=mdc","cursorrules":"/api/rules/passkey-conditional-mediation-origin-downgrade-fencing?format=cursor","windsurf":"/api/rules/passkey-conditional-mediation-origin-downgrade-fencing?format=windsurf","agents":"/api/rules/passkey-conditional-mediation-origin-downgrade-fencing?format=agents"}},{"id":"openfga-recursive-contextual-tuple-bound","title":"OpenFGA Recursive Contextual Tuple Evaluation Bound and Cycle Guard","category":"security","severity":"critical","description":"Enforces strict validation, cycle detection, and traversal depth limits on contextual tuples passed during runtime OpenFGA Check and ListObjects operations. Unbounded or cyclic relationship-based access control (ReBAC) evaluations through dynamic contextual tuples induce catastrophic resource exhaustion and denial-of-service across the authorization pipeline.","antiPatternHeadline":"Injecting unconstrained or cyclic contextual tuples into OpenFGA Check requests without depth bounding or cycle screening","stars_count":119,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","rebac","dos-prevention","graph-traversal"],"exportEndpoints":{"claude":"/api/rules/openfga-recursive-contextual-tuple-bound?format=claude","cursorMdc":"/api/rules/openfga-recursive-contextual-tuple-bound?format=mdc","cursorrules":"/api/rules/openfga-recursive-contextual-tuple-bound?format=cursor","windsurf":"/api/rules/openfga-recursive-contextual-tuple-bound?format=windsurf","agents":"/api/rules/openfga-recursive-contextual-tuple-bound?format=agents"}},{"id":"otel-baggage-high-cardinality-sanitization-invariant","title":"OpenTelemetry Baggage Cardinality and Cryptographic Bounding Invariant","category":"devops","severity":"critical","description":"Enforces deterministic byte-length caps, strict key allowlists, and HMAC signature verification on OpenTelemetry baggage propagators. Unbounded or untrusted baggage injected into W3C headers causes cascaded memory exhaustion in distributed trace contexts and forces premature downstream span-store index eviction.","antiPatternHeadline":"Blind Injection of Unbounded Dynamic Context and Unsigned Payload into Distributed Baggage Headers","stars_count":75,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","tracing","distributed-systems","security"],"exportEndpoints":{"claude":"/api/rules/otel-baggage-high-cardinality-sanitization-invariant?format=claude","cursorMdc":"/api/rules/otel-baggage-high-cardinality-sanitization-invariant?format=mdc","cursorrules":"/api/rules/otel-baggage-high-cardinality-sanitization-invariant?format=cursor","windsurf":"/api/rules/otel-baggage-high-cardinality-sanitization-invariant?format=windsurf","agents":"/api/rules/otel-baggage-high-cardinality-sanitization-invariant?format=agents"}},{"id":"postgres-17-pg-stat-io-budget-throttling-standard","title":"Postgres 17 pg_stat_io Real-Time Backend I/O Budget Throttling","category":"devops","severity":"critical","description":"Enforces real-time per-backend I/O budget monitoring and Linux cgroup v2 block I/O throttling derived from Postgres 17 pg_stat_io metrics. Prevents NVMe/EBS disk controller saturation and backend starvation by programmatically calculating differential read, write, and extend operations and applying kernel-level IOPS caps to runaway backend worker PIDs.","antiPatternHeadline":"Unregulated Storage Controller Saturation via Unthrottled Backend I/O Spikes","stars_count":116,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","postgres","postgres-17","pg_stat_io","cgroups-v2","io-throttling","storage"],"exportEndpoints":{"claude":"/api/rules/postgres-17-pg-stat-io-budget-throttling-standard?format=claude","cursorMdc":"/api/rules/postgres-17-pg-stat-io-budget-throttling-standard?format=mdc","cursorrules":"/api/rules/postgres-17-pg-stat-io-budget-throttling-standard?format=cursor","windsurf":"/api/rules/postgres-17-pg-stat-io-budget-throttling-standard?format=windsurf","agents":"/api/rules/postgres-17-pg-stat-io-budget-throttling-standard?format=agents"}},{"id":"vite-6-rolldown-dynamic-chunk-graph-fencing","title":"Vite 6 Rolldown Dynamic Import Chunk Graph Fencing and Waterfall Containment","category":"frontend","severity":"critical","description":"Enforces deterministic module chunk boundaries and compile-time cycle elimination in Vite 6 and Rolldown architectures. Prevents transitive chunk bleed and deep HTTP cascade preloading waterfalls across distributed enterprise micro-frontends by fencing dynamic imports behind strict architectural barriers and explicit chunk grouping strategies.","antiPatternHeadline":"Unconstrained Dynamic Imports Causing Synthetic Common Chunk Splitting and Cascading Waterfall Fetches","stars_count":89,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","vite-6","rolldown","code-splitting","micro-frontends","performance","chunk-graph"],"exportEndpoints":{"claude":"/api/rules/vite-6-rolldown-dynamic-chunk-graph-fencing?format=claude","cursorMdc":"/api/rules/vite-6-rolldown-dynamic-chunk-graph-fencing?format=mdc","cursorrules":"/api/rules/vite-6-rolldown-dynamic-chunk-graph-fencing?format=cursor","windsurf":"/api/rules/vite-6-rolldown-dynamic-chunk-graph-fencing?format=windsurf","agents":"/api/rules/vite-6-rolldown-dynamic-chunk-graph-fencing?format=agents"}},{"id":"svelte-5-rune-streaming-hydration-boundary-standard","title":"Svelte 5 Rune-Derived Streaming Hydration Boundary Standard","category":"frontend","severity":"critical","description":"Enforces deterministic client reconciliation boundaries for asynchronous and derived rune primitives during progressive HTML streaming. Prevents client-side hydration mismatches, DOM tearing, and microtask race conditions caused by evaluating unstable $derived expressions against streamed promise payloads.","antiPatternHeadline":"Directly evaluating raw streamed promises inside synchronous $derived runes without hydration boundary guards","stars_count":64,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","hydration","streaming","sveltekit"],"exportEndpoints":{"claude":"/api/rules/svelte-5-rune-streaming-hydration-boundary-standard?format=claude","cursorMdc":"/api/rules/svelte-5-rune-streaming-hydration-boundary-standard?format=mdc","cursorrules":"/api/rules/svelte-5-rune-streaming-hydration-boundary-standard?format=cursor","windsurf":"/api/rules/svelte-5-rune-streaming-hydration-boundary-standard?format=windsurf","agents":"/api/rules/svelte-5-rune-streaming-hydration-boundary-standard?format=agents"}},{"id":"postgres-17-json-table-parallel-memory-guardrail","title":"PostgreSQL 17 JSON_TABLE Parallel Worker Memory & Projection Guardrail","category":"backend","severity":"critical","description":"Enforces strict memory governance and cursor streaming on PostgreSQL 17 JSON_TABLE evaluations during parallel query execution. Prevents runaway per-worker work_mem consumption and Out-Of-Memory (OOM) backend crashes caused by unindexed lateral unwrapping of deeply nested JSONB payloads across parallel gather nodes.","antiPatternHeadline":"Unbounded Parallel JSON_TABLE Projections on Unindexed JSONB Payloads Exhausting Per-Worker work_mem","stars_count":114,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql-17","json-table","parallel-query","work-mem","jsonb"],"exportEndpoints":{"claude":"/api/rules/postgres-17-json-table-parallel-memory-guardrail?format=claude","cursorMdc":"/api/rules/postgres-17-json-table-parallel-memory-guardrail?format=mdc","cursorrules":"/api/rules/postgres-17-json-table-parallel-memory-guardrail?format=cursor","windsurf":"/api/rules/postgres-17-json-table-parallel-memory-guardrail?format=windsurf","agents":"/api/rules/postgres-17-json-table-parallel-memory-guardrail?format=agents"}},{"id":"go-chi-http3-early-data-anti-replay-ring-buffer","title":"Go Chi HTTP/3 0-RTT Anti-Replay Ring Buffer Invariant","category":"backend","severity":"critical","description":"Enforces deterministic prevention of QUIC/HTTP/3 0-RTT early-data replay amplification attacks across stateless Go Chi services. Guarantees that mutating HTTP verbs reject early data with HTTP 425 Too Early and safe early-data requests are validated via an in-memory lock-free partitioned sliding ring buffer strike register without introducing cross-node round-trip latencies.","antiPatternHeadline":"Executing State-Mutating or Unfiltered 0-RTT Early Data Without Monotonic Strike-Register Replay Validation","stars_count":88,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["go","chi","http3","quic","zero-rtt","security","anti-replay"],"exportEndpoints":{"claude":"/api/rules/go-chi-http3-early-data-anti-replay-ring-buffer?format=claude","cursorMdc":"/api/rules/go-chi-http3-early-data-anti-replay-ring-buffer?format=mdc","cursorrules":"/api/rules/go-chi-http3-early-data-anti-replay-ring-buffer?format=cursor","windsurf":"/api/rules/go-chi-http3-early-data-anti-replay-ring-buffer?format=windsurf","agents":"/api/rules/go-chi-http3-early-data-anti-replay-ring-buffer?format=agents"}},{"id":"wasi-0-2-capability-sandbox-isolation","title":"Deterministic Capability-Based Sandbox Isolation for WASI 0.2 Plugins","category":"backend","severity":"critical","description":"Third-party guest WebAssembly components executing under WASI 0.2 must strictly adhere to capability-based security invariants by eliminating ambient host authority. Host runtimes must construct explicit, bounded WASI contexts with pre-opened virtual directories, restricted socket interfaces, and deterministic resource limiters to prevent host breakout and resource exhaustion.","antiPatternHeadline":"Ambient Host Privilege Leakage via Unconstrained WASI Context Inheritance","stars_count":41,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","wasm","wasi-0-2","component-model","sandboxing","security"],"exportEndpoints":{"claude":"/api/rules/wasi-0-2-capability-sandbox-isolation?format=claude","cursorMdc":"/api/rules/wasi-0-2-capability-sandbox-isolation?format=mdc","cursorrules":"/api/rules/wasi-0-2-capability-sandbox-isolation?format=cursor","windsurf":"/api/rules/wasi-0-2-capability-sandbox-isolation?format=windsurf","agents":"/api/rules/wasi-0-2-capability-sandbox-isolation?format=agents"}},{"id":"capacitor7-passkey-native-delegation-bridge","title":"Hardware-Isolated WebAuthn Credential Delegation Bridge for Capacitor 7","category":"mobile","severity":"critical","description":"Enforces strict native OS credential orchestration (Credential Manager API on Android and ASAuthorizationController on iOS) for WebAuthn passkey lifecycles in Capacitor 7 hybrid applications. Forbids in-WebView JavaScript polyfilling, custom cryptographic implementations, and direct DOM access to sensitive credential parameters. Guarantees hardware-backed Secure Enclave and StrongBox key custody with out-of-process biometric prompts across WebView boundaries.","antiPatternHeadline":"Polyfilling WebAuthn in WebView DOM or Exposing Raw Cryptographic Primitives Across the Hybrid Bridge","stars_count":41,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","webauthn","passkeys","biometrics","ios","android","security"],"exportEndpoints":{"claude":"/api/rules/capacitor7-passkey-native-delegation-bridge?format=claude","cursorMdc":"/api/rules/capacitor7-passkey-native-delegation-bridge?format=mdc","cursorrules":"/api/rules/capacitor7-passkey-native-delegation-bridge?format=cursor","windsurf":"/api/rules/capacitor7-passkey-native-delegation-bridge?format=windsurf","agents":"/api/rules/capacitor7-passkey-native-delegation-bridge?format=agents"}},{"id":"webauthn-l3-conditional-mediation-attestation-verifier","title":"WebAuthn L3 Conditional Mediation Fallback and Cryptographic Attestation Verification","category":"security","severity":"critical","description":"Enforces strict zero-trust validation of WebAuthn clientDataJSON, authenticatorData flags (UP/UV), and cryptographic attestation statements during registration and assertion. Mandates clean AbortController orchestration for conditional mediation (passkey autofill) to prevent UI lockouts and race conditions during modal fallbacks.","antiPatternHeadline":"Silent degradation to unauthenticated fallback and lax clientDataJSON or attestation verification","stars_count":86,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","passkeys","cryptography","fido2","authentication"],"exportEndpoints":{"claude":"/api/rules/webauthn-l3-conditional-mediation-attestation-verifier?format=claude","cursorMdc":"/api/rules/webauthn-l3-conditional-mediation-attestation-verifier?format=mdc","cursorrules":"/api/rules/webauthn-l3-conditional-mediation-attestation-verifier?format=cursor","windsurf":"/api/rules/webauthn-l3-conditional-mediation-attestation-verifier?format=windsurf","agents":"/api/rules/webauthn-l3-conditional-mediation-attestation-verifier?format=agents"}},{"id":"openid-caep-ssf-realtime-session-revocation-mesh","title":"OpenID CAEP/SSF Real-Time Session Revocation Mesh Standard","category":"security","severity":"critical","description":"Enforces push-based OpenID Shared Signals and Events (SSF) and Continuous Access Evaluation Profile (CAEP) real-time session invalidation across multi-tenant distributed services. Prevents relying on vulnerable unrevokable stateless JWTs or latency-prohibitive synchronous introspection polling by mandating cryptographically verified Security Event Token (SET) ingestion into local sub-millisecond revocation stores.","antiPatternHeadline":"Blind Stateless JWT Trust and Latency-Inducing Synchronous Token Polling Anti-Pattern","stars_count":118,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","caep","ssf","openid","jwt","session-revocation","zero-trust"],"exportEndpoints":{"claude":"/api/rules/openid-caep-ssf-realtime-session-revocation-mesh?format=claude","cursorMdc":"/api/rules/openid-caep-ssf-realtime-session-revocation-mesh?format=mdc","cursorrules":"/api/rules/openid-caep-ssf-realtime-session-revocation-mesh?format=cursor","windsurf":"/api/rules/openid-caep-ssf-realtime-session-revocation-mesh?format=windsurf","agents":"/api/rules/openid-caep-ssf-realtime-session-revocation-mesh?format=agents"}},{"id":"ebpf-tc-direct-sockhash-ingress-standard","title":"eBPF TC Direct Socket Ingress Acceleration and CFS Quota Decoupling Standard","category":"devops","severity":"critical","description":"Enforces deterministic eBPF TC (Traffic Control) direct socket assignment and sockhash redirection to bypass host TCP stack ingress traversal overhead. Eliminates CFS bandwidth quota throttling artifacts induced by softirq processing (ksoftirqd) and mitigates socket lock contention under high-PPS workloads by guaranteeing explicit socket state validation, reference count release, and non-blocking fallback handling.","antiPatternHeadline":"Unchecked Host Stack Ingress Traversal and Unsafe Socket Redirection Without State Validation or Refcount Balancing","stars_count":96,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","tc","sockhash","networking","kernel","performance"],"exportEndpoints":{"claude":"/api/rules/ebpf-tc-direct-sockhash-ingress-standard?format=claude","cursorMdc":"/api/rules/ebpf-tc-direct-sockhash-ingress-standard?format=mdc","cursorrules":"/api/rules/ebpf-tc-direct-sockhash-ingress-standard?format=cursor","windsurf":"/api/rules/ebpf-tc-direct-sockhash-ingress-standard?format=windsurf","agents":"/api/rules/ebpf-tc-direct-sockhash-ingress-standard?format=agents"}},{"id":"otel-exponential-histogram-memory-limiter-production-standard","title":"OpenTelemetry Exponential Histogram Dynamic Downsampling & Memory Limiter Guardrail","category":"devops","severity":"critical","description":"Enforces strict upper bounds on exponential histogram scale and bucket capacities across OpenTelemetry metric readers and collectors. During high-cardinality metric spikes or wide dynamic ranges, unbounded bucket growth exhausts heap allocations, causing agent and gateway Out-Of-Memory (OOM) crashes. Systems must implement dynamic scale downsampling, deterministic bucket limits, and proactive memory-aware backpressure.","antiPatternHeadline":"Unconstrained Exponential Histogram Max Buckets and Fixed High-Scale Allocations Causing Process Out-Of-Memory (OOM) Termination","stars_count":114,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","metrics","memory-management","observability","histograms"],"exportEndpoints":{"claude":"/api/rules/otel-exponential-histogram-memory-limiter-production-standard?format=claude","cursorMdc":"/api/rules/otel-exponential-histogram-memory-limiter-production-standard?format=mdc","cursorrules":"/api/rules/otel-exponential-histogram-memory-limiter-production-standard?format=cursor","windsurf":"/api/rules/otel-exponential-histogram-memory-limiter-production-standard?format=windsurf","agents":"/api/rules/otel-exponential-histogram-memory-limiter-production-standard?format=agents"}},{"id":"svelte-5-runes-reactive-scope-isolation-standard","title":"Svelte 5 Runes Reactive Scope Isolation Standard","category":"frontend","severity":"critical","description":"Enforces strict lifecycle boundaries and reactive scope containment for Svelte 5 runes ($state, $derived, $effect) instantiated in long-lived non-component contexts and external stores. Prevents memory leaks and untracked microtask state desynchronization caused by uncontained $effect.root scopes and asynchronous state mutations across route transitions.","antiPatternHeadline":"Dangling Root Runes and Orphaned $effect Subscriptions Leaking Memory Across Route Navigation","stars_count":119,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte-5","runes","memory-management","reactivity","performance"],"exportEndpoints":{"claude":"/api/rules/svelte-5-runes-reactive-scope-isolation-standard?format=claude","cursorMdc":"/api/rules/svelte-5-runes-reactive-scope-isolation-standard?format=mdc","cursorrules":"/api/rules/svelte-5-runes-reactive-scope-isolation-standard?format=cursor","windsurf":"/api/rules/svelte-5-runes-reactive-scope-isolation-standard?format=windsurf","agents":"/api/rules/svelte-5-runes-reactive-scope-isolation-standard?format=agents"}},{"id":"vite6-environment-api-runtime-isolation-vite-6-environme-419","title":"Vite 6 Environment API Cross-Runtime Hydration Isolation Standard","category":"frontend","severity":"critical","description":"Enforces strict execution-boundary isolation between client, Node.js, workerd, and Bun environments using the Vite 6 Environment API. Prevents runtime-specific global pollution, invalid isomorphic imports, and unvalidated environment state serialization during isomorphic hydration.","antiPatternHeadline":"Leaking Runtime-Specific Globals and Bindings Across Vite 6 Multi-Environment Module Graphs","stars_count":73,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","vite6","environment-api","ssr","hydration","workerd","nodejs","bun"],"exportEndpoints":{"claude":"/api/rules/vite6-environment-api-runtime-isolation-vite-6-environme-419?format=claude","cursorMdc":"/api/rules/vite6-environment-api-runtime-isolation-vite-6-environme-419?format=mdc","cursorrules":"/api/rules/vite6-environment-api-runtime-isolation-vite-6-environme-419?format=cursor","windsurf":"/api/rules/vite6-environment-api-runtime-isolation-vite-6-environme-419?format=windsurf","agents":"/api/rules/vite6-environment-api-runtime-isolation-vite-6-environme-419?format=agents"}},{"id":"pg17-logical-replication-failover-slot-sync-postgresql-17-lo-801","title":"PostgreSQL 17 Logical Replication Failover Slot Synchronization Invariant","category":"backend","severity":"critical","description":"PostgreSQL 17 introduces native logical replication slot failover support via the failover parameter and pg_sync_replication_slots(). Backend orchestration and database clients must ensure logical slots are explicitly flagged with failover = true and synchronized across physical standbys before acknowledging primary promotion, preventing silent data duplication or permanent WAL subscriber stalls.","antiPatternHeadline":"Creating Logical Slots Without Failover Capabilities or Promoting Physical Standbys Without Verifying Slot Synchronization","stars_count":59,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","logical-replication","failover","ha","wal","database-migration"],"exportEndpoints":{"claude":"/api/rules/pg17-logical-replication-failover-slot-sync-postgresql-17-lo-801?format=claude","cursorMdc":"/api/rules/pg17-logical-replication-failover-slot-sync-postgresql-17-lo-801?format=mdc","cursorrules":"/api/rules/pg17-logical-replication-failover-slot-sync-postgresql-17-lo-801?format=cursor","windsurf":"/api/rules/pg17-logical-replication-failover-slot-sync-postgresql-17-lo-801?format=windsurf","agents":"/api/rules/pg17-logical-replication-failover-slot-sync-postgresql-17-lo-801?format=agents"}},{"id":"bun-v12-clustered-websocket-backpressure-drain-guardrail","title":"Bun 1.2 Native Clustered WebSocket Memory-Drain Backpressure Invariant","category":"backend","severity":"critical","description":"Enforces deterministic high-watermark socket buffering and non-blocking backpressure drain policies for Bun 1.2 clustered native WebSockets. Eliminates silent OOM crashes, buffer starvation, and runaway worker heap allocation under slow-consumer scenarios by requiring explicit return code evaluation from `ws.send()` and coordinated `drain` lifecycle handler implementation.","antiPatternHeadline":"Unchecked Fire-and-Forget `ws.send()` Leading to Silent Out-Of-Memory Panics in Bun Worker Clusters","stars_count":78,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","websockets","backpressure","memory-management","clustering","performance"],"exportEndpoints":{"claude":"/api/rules/bun-v12-clustered-websocket-backpressure-drain-guardrail?format=claude","cursorMdc":"/api/rules/bun-v12-clustered-websocket-backpressure-drain-guardrail?format=mdc","cursorrules":"/api/rules/bun-v12-clustered-websocket-backpressure-drain-guardrail?format=cursor","windsurf":"/api/rules/bun-v12-clustered-websocket-backpressure-drain-guardrail?format=windsurf","agents":"/api/rules/bun-v12-clustered-websocket-backpressure-drain-guardrail?format=agents"}},{"id":"fastapi-stream-backpressure-cancellation-contract","title":"FastAPI Streaming Response Disconnect Handling and Resource Cancellation Contract","category":"backend","severity":"critical","description":"Enforces deterministic cancellation of upstream compute, external LLM streams, and database server-side cursors upon downstream HTTP/TCP client disconnection in FastAPI. Prevents catastrophic resource exhaustion and dangling background tasks by mandating periodic ASGI disconnect polling or structured async generator cleanup semantics.","antiPatternHeadline":"Unchecked Async Streaming Yields Leading to Dangling LLM Inferences and Database Cursor Leaks","stars_count":79,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","python","asyncio","streaming","sse","resource-cleanup"],"exportEndpoints":{"claude":"/api/rules/fastapi-stream-backpressure-cancellation-contract?format=claude","cursorMdc":"/api/rules/fastapi-stream-backpressure-cancellation-contract?format=mdc","cursorrules":"/api/rules/fastapi-stream-backpressure-cancellation-contract?format=cursor","windsurf":"/api/rules/fastapi-stream-backpressure-cancellation-contract?format=windsurf","agents":"/api/rules/fastapi-stream-backpressure-cancellation-contract?format=agents"}},{"id":"openfga-cache-invalidation-cycle-boundary-standard","title":"OpenFGA Consistency Boundary: Generation-Aware Invalidation and Bounded Graph Traversal","category":"security","severity":"critical","description":"Enforces strict snapshot consistency tokens (Zookies/LST), atomic cache invalidation boundaries, and bounded cycle-pruning traversals during OpenFGA relationship-based access evaluations. Eliminates security windows where stale access grants persist post-revocation and prevents authorization engine denial-of-service from cyclic group-nesting graphs under concurrent mutations.","antiPatternHeadline":"Unversioned In-Memory Tuple Caching with Unbounded Recursive Graph Traversal","stars_count":75,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","rebac","authorization","cache-invalidation","graph-algorithms"],"exportEndpoints":{"claude":"/api/rules/openfga-cache-invalidation-cycle-boundary-standard?format=claude","cursorMdc":"/api/rules/openfga-cache-invalidation-cycle-boundary-standard?format=mdc","cursorrules":"/api/rules/openfga-cache-invalidation-cycle-boundary-standard?format=cursor","windsurf":"/api/rules/openfga-cache-invalidation-cycle-boundary-standard?format=windsurf","agents":"/api/rules/openfga-cache-invalidation-cycle-boundary-standard?format=agents"}},{"id":"webauthn-prf-zero-knowledge-vault-standard","title":"WebAuthn PRF Hardware-Bound Zero-Knowledge Vault Decryption Guardrail","category":"security","severity":"critical","description":"Enforces deterministic derivation of symmetric vault encryption keys via the WebAuthn PRF (Pseudo-Random Function) extension while maintaining strict zero-knowledge architecture. Mandates that raw PRF outputs are immediately imported into non-extractable WebCrypto keys via HKDF and never serialized, persisted, or transmitted to any server.","antiPatternHeadline":"Directly using raw PRF output as a cipher key, persisting derived seeds, or leaking PRF buffers over network boundaries","stars_count":95,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","prf-extension","zero-knowledge","cryptography","webcrypto"],"exportEndpoints":{"claude":"/api/rules/webauthn-prf-zero-knowledge-vault-standard?format=claude","cursorMdc":"/api/rules/webauthn-prf-zero-knowledge-vault-standard?format=mdc","cursorrules":"/api/rules/webauthn-prf-zero-knowledge-vault-standard?format=cursor","windsurf":"/api/rules/webauthn-prf-zero-knowledge-vault-standard?format=windsurf","agents":"/api/rules/webauthn-prf-zero-knowledge-vault-standard?format=agents"}},{"id":"capacitor-7-background-runner-worker-fence","title":"Capacitor 7 Background Runner Execution Fence and Budget Enforcement","category":"mobile","severity":"critical","description":"Enforces isolated headless Web Worker execution boundaries and cooperative deadline budgets for Capacitor 7 Background Runner tasks. Prevents native watchdog terminations (SIGKILL/0x8badf00d on iOS, Foreground Service/WorkManager ANRs on Android) by isolating state, capping in-memory buffer allocations, and binding operations to non-negotiable runtime fences.","antiPatternHeadline":"Unbounded Async Execution and State Leakage in Headless Background Runner Tasks","stars_count":96,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","background-runner","ios","android","web-worker","performance"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-background-runner-worker-fence?format=claude","cursorMdc":"/api/rules/capacitor-7-background-runner-worker-fence?format=mdc","cursorrules":"/api/rules/capacitor-7-background-runner-worker-fence?format=cursor","windsurf":"/api/rules/capacitor-7-background-runner-worker-fence?format=windsurf","agents":"/api/rules/capacitor-7-background-runner-worker-fence?format=agents"}},{"id":"k8s-gateway-cross-namespace-referencegrant-invariant","title":"Kubernetes Gateway API Cross-Namespace ReferenceGrant Security Invariant","category":"devops","severity":"critical","description":"Enforces strict multi-tenant boundary isolation across Kubernetes Gateway API resources by requiring explicit, minimal ReferenceGrant declarations for any cross-namespace route-to-service attachments. Prevents unauthorized tenant route hijacking, cross-namespace backend binding leaks, and service mesh boundary bypasses in multi-tenant clusters. Ensures declarative infrastructure pipelines automatically validate bidirectional trust contracts prior to deployment.","antiPatternHeadline":"Implicit Cross-Namespace Route Attachment Lacking Target-Namespace ReferenceGrant Validation","stars_count":41,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","kubernetes","gateway-api","security","multi-tenancy","referencegrant"],"exportEndpoints":{"claude":"/api/rules/k8s-gateway-cross-namespace-referencegrant-invariant?format=claude","cursorMdc":"/api/rules/k8s-gateway-cross-namespace-referencegrant-invariant?format=mdc","cursorrules":"/api/rules/k8s-gateway-cross-namespace-referencegrant-invariant?format=cursor","windsurf":"/api/rules/k8s-gateway-cross-namespace-referencegrant-invariant?format=windsurf","agents":"/api/rules/k8s-gateway-cross-namespace-referencegrant-invariant?format=agents"}},{"id":"ebpf-lsm-container-privilege-escalation-guardrail","title":"Kernel-Level Non-Bypassable eBPF-LSM Container Privilege and Namespace Guardrail","category":"devops","severity":"critical","description":"Enforces synchronous in-kernel access control at the Linux Security Module (LSM) layer to block container escapes, privilege escalation, and unauthorized socket/filesystem operations. Bypasses the latency, race conditions (TOCTOU), and tamper vulnerabilities inherent in userspace security agents by evaluating immutable policies directly within kernel context via pinned BPF maps and BPF ring buffers.","antiPatternHeadline":"Relying on Userspace Audit daemons, Asynchronous Tracepoints, or Seccomp TOCTOU Filters for Container Boundary Enforcement","stars_count":112,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","lsm","container-security","zero-trust","linux-kernel","kubernetes"],"exportEndpoints":{"claude":"/api/rules/ebpf-lsm-container-privilege-escalation-guardrail?format=claude","cursorMdc":"/api/rules/ebpf-lsm-container-privilege-escalation-guardrail?format=mdc","cursorrules":"/api/rules/ebpf-lsm-container-privilege-escalation-guardrail?format=cursor","windsurf":"/api/rules/ebpf-lsm-container-privilege-escalation-guardrail?format=windsurf","agents":"/api/rules/ebpf-lsm-container-privilege-escalation-guardrail?format=agents"}},{"id":"nextjs-15-ppr-dynamic-hole-cache-guardrail","title":"Next.js 15 PPR Dynamic Hole Isolation and Static Shell Guardrail","category":"frontend","severity":"critical","description":"Next.js 15 Partial Prerendering (PPR) combines static shell prerendering with streamed dynamic holes. Un-cached dynamic APIs (e.g., cookies(), headers(), searchParams, or uncached fetches) invoked outside of explicit React Suspense boundaries poison the prerender phase and de-opt the entire route into full dynamic SSR, triggering cascading edge stalls and invalidating CDN cache strategies.","antiPatternHeadline":"Unbounded Dynamic APIs Poisoning Next.js 15 Prerender Shells and Forcing Route-Wide Dynamic De-opt","stars_count":73,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs","react","ppr","performance","edge","caching"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-ppr-dynamic-hole-cache-guardrail?format=claude","cursorMdc":"/api/rules/nextjs-15-ppr-dynamic-hole-cache-guardrail?format=mdc","cursorrules":"/api/rules/nextjs-15-ppr-dynamic-hole-cache-guardrail?format=cursor","windsurf":"/api/rules/nextjs-15-ppr-dynamic-hole-cache-guardrail?format=windsurf","agents":"/api/rules/nextjs-15-ppr-dynamic-hole-cache-guardrail?format=agents"}},{"id":"vite-6-environment-api-module-graph-boundary","title":"Vite 6 Environment API Server-Client Module Graph Boundary Invariant","category":"frontend","severity":"critical","description":"Vite 6 introduces the Environment API to provide isolated module graphs for discrete runtimes (e.g., client, ssr, edge workers). Sharing mutable plugin caches, referencing legacy root server.moduleGraph, or failing to isolate module graph traversal across environments causes catastrophic server secret leaks, Node.js runtime leakage into client bundles, and untracked cross-environment memory leaks.","antiPatternHeadline":"Global Plugin Caching and Root ModuleGraph Cross-Contamination Across Vite 6 Environments","stars_count":91,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","vite-6","environment-api","module-graph","ssr","runtime-isolation"],"exportEndpoints":{"claude":"/api/rules/vite-6-environment-api-module-graph-boundary?format=claude","cursorMdc":"/api/rules/vite-6-environment-api-module-graph-boundary?format=mdc","cursorrules":"/api/rules/vite-6-environment-api-module-graph-boundary?format=cursor","windsurf":"/api/rules/vite-6-environment-api-module-graph-boundary?format=windsurf","agents":"/api/rules/vite-6-environment-api-module-graph-boundary?format=agents"}},{"id":"drizzle-read-your-writes-lsn-consistency","title":"Drizzle ORM Read-Your-Writes Causal Consistency via LSN Tracking","category":"backend","severity":"critical","description":"Enforces causal consistency across distributed primary-replica database topologies when using Drizzle ORM. Guarantees that client sessions read their own writes by capturing commit WAL LSN tokens on mutations and routing read queries to the primary if replicas have not caught up to the required LSN state.","antiPatternHeadline":"Unsynchronized Replica Reads Leading to Stale Data Reads Immediately After Writes","stars_count":118,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","drizzle-orm","postgresql","replication-lag","distributed-systems","causal-consistency"],"exportEndpoints":{"claude":"/api/rules/drizzle-read-your-writes-lsn-consistency?format=claude","cursorMdc":"/api/rules/drizzle-read-your-writes-lsn-consistency?format=mdc","cursorrules":"/api/rules/drizzle-read-your-writes-lsn-consistency?format=cursor","windsurf":"/api/rules/drizzle-read-your-writes-lsn-consistency?format=windsurf","agents":"/api/rules/drizzle-read-your-writes-lsn-consistency?format=agents"}},{"id":"go-chi-graceful-shutdown-stream-drain","title":"Go Chi Deterministic Graceful Shutdown & In-Flight Stream Drain Invariant","category":"backend","severity":"critical","description":"Enforces deterministic graceful shutdown semantics for Go Chi services handling HTTP/1.1 and HTTP/2 multiplexed streams. Prevents dropped client streams, unbuffered transport frame truncations, and orphan goroutines by unifying BaseContext cascading, explicit stream cancellation listeners, and synchronized drain timeouts.","antiPatternHeadline":"Uncoordinated http.Server.Shutdown with Orphan Streaming Goroutines and Unbound HTTP/2 Truncation","stars_count":97,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","chi","concurrency","http2","graceful-shutdown","goroutine-leaks"],"exportEndpoints":{"claude":"/api/rules/go-chi-graceful-shutdown-stream-drain?format=claude","cursorMdc":"/api/rules/go-chi-graceful-shutdown-stream-drain?format=mdc","cursorrules":"/api/rules/go-chi-graceful-shutdown-stream-drain?format=cursor","windsurf":"/api/rules/go-chi-graceful-shutdown-stream-drain?format=windsurf","agents":"/api/rules/go-chi-graceful-shutdown-stream-drain?format=agents"}},{"id":"kmp-compose-skiko-render-thread-isolation-standard","title":"Compose Multiplatform Skiko Render Thread Isolation and ARC-GC Barrier Standard","category":"mobile","severity":"critical","description":"Enforces strict boundary separation between Skiko graphics rendering pipelines and native host UI event loops across Kotlin Multiplatform targets. Eliminates main-thread rendering hitching and prevents cross-runtime memory leaks caused by bidirectional reference pinning between Apple Automated Reference Counting (ARC) and Kotlin Native Garbage Collector (GC).","antiPatternHeadline":"Executing heavy composition or state evaluation directly inside the Skiko CADisplayLink frame callback while holding strong native UIKit references across coroutine boundaries","stars_count":67,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","compose-multiplatform","skiko","ios-performance","memory-management"],"exportEndpoints":{"claude":"/api/rules/kmp-compose-skiko-render-thread-isolation-standard?format=claude","cursorMdc":"/api/rules/kmp-compose-skiko-render-thread-isolation-standard?format=mdc","cursorrules":"/api/rules/kmp-compose-skiko-render-thread-isolation-standard?format=cursor","windsurf":"/api/rules/kmp-compose-skiko-render-thread-isolation-standard?format=windsurf","agents":"/api/rules/kmp-compose-skiko-render-thread-isolation-standard?format=agents"}},{"id":"capacitor-7-deep-link-verification-sanitization","title":"Capacitor 7 Deep-Link Intent Cryptographic Verification and Payload Sanitization","category":"mobile","severity":"critical","description":"Enforces strict origin validation, HMAC/Ed25519 signature verification, and schema sanitization on all incoming Capacitor 7 deep links, universal links, and app intent payloads before bridge dispatch. Prevents open intent redirection, parameter injection, and cross-site scripting (XSS) attacks across the native-to-web dynamic bridge boundary.","antiPatternHeadline":"Unvalidated Ingress Routing & Dynamic Bridge Execution from Untrusted Native Intents","stars_count":54,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","deep-links","security","intent-verification","cryptography","input-sanitization"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-deep-link-verification-sanitization?format=claude","cursorMdc":"/api/rules/capacitor-7-deep-link-verification-sanitization?format=mdc","cursorrules":"/api/rules/capacitor-7-deep-link-verification-sanitization?format=cursor","windsurf":"/api/rules/capacitor-7-deep-link-verification-sanitization?format=windsurf","agents":"/api/rules/capacitor-7-deep-link-verification-sanitization?format=agents"}},{"id":"webauthn-level3-hardware-bound-attestation-standard","title":"Enforce WebAuthn Level 3 Hardware-Bound Attestation and Replay Prevention","category":"security","severity":"critical","description":"Enforces strict W3C WebAuthn Level 3 server-side validation invariants, mandating hardware-bound device attestation (FIDO2/WebAuthn), non-exportable authenticator attachment, and cryptographic replay defense. Guarantees immutable validation of clientDataJSON origin, single-use atomic challenges, strictly monotonic sign counters, and user-verification (UV) flags to completely neutralize session hijacking and credential stuffing vectors.","antiPatternHeadline":"Trusting unverified WebAuthn assertions, ignoring sign-counter rollbacks, accepting attestation 'none' for high-assurance flows, or validating origins with loose substring checks.","stars_count":103,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","fido2","passkeys","authentication","cryptography"],"exportEndpoints":{"claude":"/api/rules/webauthn-level3-hardware-bound-attestation-standard?format=claude","cursorMdc":"/api/rules/webauthn-level3-hardware-bound-attestation-standard?format=mdc","cursorrules":"/api/rules/webauthn-level3-hardware-bound-attestation-standard?format=cursor","windsurf":"/api/rules/webauthn-level3-hardware-bound-attestation-standard?format=windsurf","agents":"/api/rules/webauthn-level3-hardware-bound-attestation-standard?format=agents"}},{"id":"spiffe-spire-workload-mtls-attestation-invariant","title":"Kernel-Attested SPIFFE/SPIRE Workload Identity and Dynamic mTLS Invariant","category":"security","severity":"critical","description":"Mandates the complete elimination of static infrastructure secrets and disk-mounted private keys in favor of short-lived, ephemeral X.509 SVIDs sourced via the SPIFFE Workload API. SPIRE agents bind identities directly to kernel-attested process primitives (UID, GID, cgroups, container IDs), requiring dynamic in-memory credential rotation and explicit SPIFFE ID SAN validation for all zero-trust service communication.","antiPatternHeadline":"Bypassing Kernel Attestation Using Static Long-Lived TLS Certificates or File-Mounted Secrets","stars_count":118,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","spiffe","spire","zero-trust","mtls","workload-identity","cryptography"],"exportEndpoints":{"claude":"/api/rules/spiffe-spire-workload-mtls-attestation-invariant?format=claude","cursorMdc":"/api/rules/spiffe-spire-workload-mtls-attestation-invariant?format=mdc","cursorrules":"/api/rules/spiffe-spire-workload-mtls-attestation-invariant?format=cursor","windsurf":"/api/rules/spiffe-spire-workload-mtls-attestation-invariant?format=windsurf","agents":"/api/rules/spiffe-spire-workload-mtls-attestation-invariant?format=agents"}},{"id":"otel-semantic-pii-redaction-exemplar-standard","title":"OpenTelemetry Semantic Conventions Dynamic PII Redaction & Deterministic Exemplar Standard","category":"devops","severity":"critical","description":"Enforces synchronous edge-level PII token masking and deterministic log-trace exemplar correlation across the telemetry pipeline before long-term persistent storage. Mandates that all OpenTelemetry SpanProcessors and LogRecordProcessors sanitize high-cardinality and sensitive identifiers into pseudonymous HMAC hashes or redacted tokens while deterministically attaching active TraceId/SpanId exemplars to metric histograms.","antiPatternHeadline":"Leaking Plaintext PII in Telemetry Attributes and Emitting Metrics Without Correlated Trace Exemplars","stars_count":64,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","observability","pii-redaction","exemplars","distributed-tracing"],"exportEndpoints":{"claude":"/api/rules/otel-semantic-pii-redaction-exemplar-standard?format=claude","cursorMdc":"/api/rules/otel-semantic-pii-redaction-exemplar-standard?format=mdc","cursorrules":"/api/rules/otel-semantic-pii-redaction-exemplar-standard?format=cursor","windsurf":"/api/rules/otel-semantic-pii-redaction-exemplar-standard?format=windsurf","agents":"/api/rules/otel-semantic-pii-redaction-exemplar-standard?format=agents"}},{"id":"opentofu-state-lock-ephemeral-quarantine-guardrail","title":"OpenTofu Cryptographic State Locking & Ephemeral Workspace Drift Quarantine","category":"devops","severity":"critical","description":"Guarantees deterministic declarative infrastructure provisioning by enforcing cryptographically validated state locks and continuous reconciliation isolation across parallel CI/CD lanes. Restricts write operations to ephemeral run-scoped workspaces governed by deterministic lock lease timeouts, and immediately quarantines any execution lane detecting unmanaged out-of-band state mutation.","antiPatternHeadline":"Parallel Unlocked Execution and Unquarantined In-Place Apply on Drifted Shared State","stars_count":92,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentofu","iac","state-locking","drift-detection","security"],"exportEndpoints":{"claude":"/api/rules/opentofu-state-lock-ephemeral-quarantine-guardrail?format=claude","cursorMdc":"/api/rules/opentofu-state-lock-ephemeral-quarantine-guardrail?format=mdc","cursorrules":"/api/rules/opentofu-state-lock-ephemeral-quarantine-guardrail?format=cursor","windsurf":"/api/rules/opentofu-state-lock-ephemeral-quarantine-guardrail?format=windsurf","agents":"/api/rules/opentofu-state-lock-ephemeral-quarantine-guardrail?format=agents"}},{"id":"react-19-taint-boundary-protection","title":"React 19 Server Data Tainting & Serialization Boundary Isolation","category":"frontend","severity":"critical","description":"Enforces strict isolation of sensitive server-side state, user PII, and credentials using React 19 taint APIs (experimental_taintUniqueValue and experimental_taintObjectReference). Prevents accidental exposure of raw database models, cryptographic keys, and private tokens through Server-to-Client Component serialization boundaries.","antiPatternHeadline":"Leaking Raw Database Records and Environment Secrets to Client Component Props via RSC Serialization","stars_count":110,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","rsc","security","taint-api","nextjs"],"exportEndpoints":{"claude":"/api/rules/react-19-taint-boundary-protection?format=claude","cursorMdc":"/api/rules/react-19-taint-boundary-protection?format=mdc","cursorrules":"/api/rules/react-19-taint-boundary-protection?format=cursor","windsurf":"/api/rules/react-19-taint-boundary-protection?format=windsurf","agents":"/api/rules/react-19-taint-boundary-protection?format=agents"}},{"id":"vite6-environment-api-runtime-isolation-standard","title":"Vite 6 Environment API Cross-Runtime Module Graph & Memory Isolation","category":"frontend","severity":"critical","description":"Mandates strict separation of module evaluation graphs, runtime instances, and HMR boundaries across Client, SSR (Node.js), and Edge environments utilizing Vite 6's Environment API. Prevents cross-runtime state pollution, module graph contamination, and invalid module executions across heterogeneous target runtimes.","antiPatternHeadline":"Cross-Runtime Memory Leakage and Module Graph Contamination via Legacy Unified Server APIs","stars_count":88,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["vite6","environment-api","ssr","edge-runtime","hmr","runtime-isolation"],"exportEndpoints":{"claude":"/api/rules/vite6-environment-api-runtime-isolation-standard?format=claude","cursorMdc":"/api/rules/vite6-environment-api-runtime-isolation-standard?format=mdc","cursorrules":"/api/rules/vite6-environment-api-runtime-isolation-standard?format=cursor","windsurf":"/api/rules/vite6-environment-api-runtime-isolation-standard?format=windsurf","agents":"/api/rules/vite6-environment-api-runtime-isolation-standard?format=agents"}},{"id":"axum-tokio-task-tracker-graceful-draining","title":"Axum 0.8 Tokio Task-Tracker and Graceful Draining Standard","category":"backend","severity":"critical","description":"Enforces deterministic two-phase graceful shutdown in Axum 0.8 services using tokio-util TaskTracker and CancellationToken. Prevents HTTP/2 stream truncation, uncommitted database transaction abandonment, and abrupt socket terminations during rapid Kubernetes SIGTERM scale-down events.","antiPatternHeadline":"Untracked Background Spawns and Instant Process Exit on SIGTERM","stars_count":65,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tokio","kubernetes","concurrency"],"exportEndpoints":{"claude":"/api/rules/axum-tokio-task-tracker-graceful-draining?format=claude","cursorMdc":"/api/rules/axum-tokio-task-tracker-graceful-draining?format=mdc","cursorrules":"/api/rules/axum-tokio-task-tracker-graceful-draining?format=cursor","windsurf":"/api/rules/axum-tokio-task-tracker-graceful-draining?format=windsurf","agents":"/api/rules/axum-tokio-task-tracker-graceful-draining?format=agents"}},{"id":"postgres-17-pgvector-hnsw-quantization-invariants","title":"Postgres 17 pgvector Scaled HNSW Halfvec Quantization Standards","category":"backend","severity":"critical","description":"Mandates half-precision scalar quantization (halfvec) and strict hyperparameter boundaries for HNSW indexes on high-dimensional vector embeddings in Postgres 17. Eliminates unconstrained shared buffer consumption, maintenance memory exhaustion, and connection starvation during concurrent write-heavy vector ingestion pipelines.","antiPatternHeadline":"Unquantized Float32 HNSW Indexing Under High-Concurrency Vector Ingestion","stars_count":109,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres","pgvector","hnsw","vector-database","performance","memory-management"],"exportEndpoints":{"claude":"/api/rules/postgres-17-pgvector-hnsw-quantization-invariants?format=claude","cursorMdc":"/api/rules/postgres-17-pgvector-hnsw-quantization-invariants?format=mdc","cursorrules":"/api/rules/postgres-17-pgvector-hnsw-quantization-invariants?format=cursor","windsurf":"/api/rules/postgres-17-pgvector-hnsw-quantization-invariants?format=windsurf","agents":"/api/rules/postgres-17-pgvector-hnsw-quantization-invariants?format=agents"}},{"id":"fastapi-pydantic-v2-serialization-boundary-invariant","title":"FastAPI Pydantic v2 Compiled Boundary Serialization and ORM Leak Prevention","category":"backend","severity":"critical","description":"Enforces compiled C/Rust-level serialization boundaries via Pydantic v2's pydantic-core rather than raw Python dictionary hydration or unvalidated ORM pass-through. Mandates explicit `response_model` definitions with `from_attributes=True` and strict field exclusion to eliminate arbitrary internal ORM attribute leaks (e.g., hashed passwords, internal foreign keys) while reducing CPU overhead and latency. Prohibits manual `.dict()` or unvalidated `dict(orm_instance)` dumps across public HTTP egress boundaries.","antiPatternHeadline":"Leaking sensitive ORM attributes and degrading serialization throughput via ad-hoc dictionary conversions or unconstrained model returns","stars_count":82,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","pydantic-v2","orm-leak","serialization","security"],"exportEndpoints":{"claude":"/api/rules/fastapi-pydantic-v2-serialization-boundary-invariant?format=claude","cursorMdc":"/api/rules/fastapi-pydantic-v2-serialization-boundary-invariant?format=mdc","cursorrules":"/api/rules/fastapi-pydantic-v2-serialization-boundary-invariant?format=cursor","windsurf":"/api/rules/fastapi-pydantic-v2-serialization-boundary-invariant?format=windsurf","agents":"/api/rules/fastapi-pydantic-v2-serialization-boundary-invariant?format=agents"}},{"id":"capacitor-7-native-bridge-buffer-isolation","title":"Capacitor 7 Native Bridge Buffer Isolation & High-Frequency Streaming Guardrail","category":"mobile","severity":"critical","description":"Enforces strict buffer isolation, off-thread queuing, and Web Worker routing for high-throughput peripheral and sensor streams over the Capacitor 7 native-web bridge. Eliminates V8 heap exhaustion and main-thread UI frame dropping caused by unthrottled serialization across WKWebView and Android WebView bridge boundaries.","antiPatternHeadline":"Unthrottled Bridge Event Dispatching Directly into Main-Thread React/Vue State","stars_count":70,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","native-bridge","performance","memory-management","web-workers"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-native-bridge-buffer-isolation?format=claude","cursorMdc":"/api/rules/capacitor-7-native-bridge-buffer-isolation?format=mdc","cursorrules":"/api/rules/capacitor-7-native-bridge-buffer-isolation?format=cursor","windsurf":"/api/rules/capacitor-7-native-bridge-buffer-isolation?format=windsurf","agents":"/api/rules/capacitor-7-native-bridge-buffer-isolation?format=agents"}},{"id":"openfga-zanzibar-consistency-token-propagation","title":"OpenFGA Zanzibar Consistency Token Propagation Standard","category":"security","severity":"critical","description":"Enforces deterministic read-after-write consistency in distributed OpenFGA zero-trust authorization checks. Prevents authorization bypass and stale denial anomalies by capturing write continuation/checkpoint tokens and propagating them across distributed microservice RPC boundaries to guarantee evaluation against post-mutation authorization snapshots.","antiPatternHeadline":"Stale Snapshot Authorization via Unpropagated Zanzibar Write Checkpoint Tokens","stars_count":99,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","zanzibar","authorization","distributed-systems","concurrency"],"exportEndpoints":{"claude":"/api/rules/openfga-zanzibar-consistency-token-propagation?format=claude","cursorMdc":"/api/rules/openfga-zanzibar-consistency-token-propagation?format=mdc","cursorrules":"/api/rules/openfga-zanzibar-consistency-token-propagation?format=cursor","windsurf":"/api/rules/openfga-zanzibar-consistency-token-propagation?format=windsurf","agents":"/api/rules/openfga-zanzibar-consistency-token-propagation?format=agents"}},{"id":"webauthn-l3-conditional-mediation-auto-upgrade-standard","title":"WebAuthn Level 3 Conditional Mediation Auto-Upgrade & Transactional Challenge Binding","category":"security","severity":"critical","description":"Enforces strict WebAuthn Level 3 specifications for conditional UI auto-upgrade and cryptographically binds passkey assertion challenges to high-risk transactional session state. Mitigates AitM (Adversary-in-the-Middle) relay attacks during step-up re-authentication by disallowing cached server challenges, mandating clientDataJSON hash verification against atomic transaction contexts, and enforcing userVerification: 'required'.","antiPatternHeadline":"Unbound Re-authentication Challenges and Missing Conditional UI Fallback Invariants","stars_count":92,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn-l3","passkeys","fido2","session-step-up","cryptography"],"exportEndpoints":{"claude":"/api/rules/webauthn-l3-conditional-mediation-auto-upgrade-standard?format=claude","cursorMdc":"/api/rules/webauthn-l3-conditional-mediation-auto-upgrade-standard?format=mdc","cursorrules":"/api/rules/webauthn-l3-conditional-mediation-auto-upgrade-standard?format=cursor","windsurf":"/api/rules/webauthn-l3-conditional-mediation-auto-upgrade-standard?format=windsurf","agents":"/api/rules/webauthn-l3-conditional-mediation-auto-upgrade-standard?format=agents"}},{"id":"opentelemetry-baggage-quotas-pii-redaction","title":"OpenTelemetry Baggage Context Quotas and PII Redaction Pipeline","category":"devops","severity":"critical","description":"Enforces strict payload size budgets and deterministic PII masking on distributed OpenTelemetry baggage contexts before carrier propagation. Prevents HTTP 431 Request Header Fields Too Large outages at edge gateways and eliminates downstream context leakage of credentials and customer data across microservice boundaries.","antiPatternHeadline":"Unbounded baggage accumulation and raw token forwarding triggering gateway HTTP 431 dropouts and PII leakage","stars_count":40,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","observability","distributed-tracing","security","http431"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-baggage-quotas-pii-redaction?format=claude","cursorMdc":"/api/rules/opentelemetry-baggage-quotas-pii-redaction?format=mdc","cursorrules":"/api/rules/opentelemetry-baggage-quotas-pii-redaction?format=cursor","windsurf":"/api/rules/opentelemetry-baggage-quotas-pii-redaction?format=windsurf","agents":"/api/rules/opentelemetry-baggage-quotas-pii-redaction?format=agents"}},{"id":"otel-ebpf-profiler-overhead-guardrail","title":"OpenTelemetry eBPF Continuous Profiler Overhead Guardrail","category":"devops","severity":"critical","description":"Enforces strict kernel-level sampling ceilings, frame unwinding bounds, and ring-buffer allocation limits for OpenTelemetry eBPF continuous profiling daemonsets. Guarantees that continuous stack tracing does not induce kernel lock contention or exceed a 1% CPU overhead budget on latency-critical workloads.","antiPatternHeadline":"Unbounded high-frequency eBPF sampling rates with infinite frame unwinding and unconstrained map buffers","stars_count":113,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","opentelemetry","continuous-profiling","performance"],"exportEndpoints":{"claude":"/api/rules/otel-ebpf-profiler-overhead-guardrail?format=claude","cursorMdc":"/api/rules/otel-ebpf-profiler-overhead-guardrail?format=mdc","cursorrules":"/api/rules/otel-ebpf-profiler-overhead-guardrail?format=cursor","windsurf":"/api/rules/otel-ebpf-profiler-overhead-guardrail?format=windsurf","agents":"/api/rules/otel-ebpf-profiler-overhead-guardrail?format=agents"}},{"id":"vite-6-environment-api-runtime-boundary-guardrail","title":"Vite 6 Environment API Custom Runtime Boundary Guardrail","category":"frontend","severity":"critical","description":"Enforces strict isolation of client, server, and edge module graphs using the Vite 6 Environment API. Prevents cross-target compilation leakage, runtime polyfill bleeding, and secret exposure by scoping transforms, module resolutions, and runtime instances strictly to designated environment runtimes.","antiPatternHeadline":"Cross-Target Module Graph Pollution via Shared Legacy Vite Plugin Contexts","stars_count":83,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["vite","vite-6","environment-api","ssr","edge-runtime","module-graph-isolation"],"exportEndpoints":{"claude":"/api/rules/vite-6-environment-api-runtime-boundary-guardrail?format=claude","cursorMdc":"/api/rules/vite-6-environment-api-runtime-boundary-guardrail?format=mdc","cursorrules":"/api/rules/vite-6-environment-api-runtime-boundary-guardrail?format=cursor","windsurf":"/api/rules/vite-6-environment-api-runtime-boundary-guardrail?format=windsurf","agents":"/api/rules/vite-6-environment-api-runtime-boundary-guardrail?format=agents"}},{"id":"react19-useoptimistic-rollback-reconciliation","title":"React 19 useOptimistic Rollback and Concurrency Reconciliation Contract","category":"frontend","severity":"critical","description":"Enforces deterministic state reconciliation and error boundary isolation for React 19 useOptimistic during high-frequency concurrent server actions and transient network drops. Mandates that all optimistic transitions maintain monotonic versioning, execute strictly within Action or transition scopes, and preserve source-of-truth immutability upon rejection.","antiPatternHeadline":"Unbounded Server Action Calls with Out-of-Order State Tearing and Manual Rollback Flags","stars_count":68,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","useOptimistic","server-actions","transitions","concurrency"],"exportEndpoints":{"claude":"/api/rules/react19-useoptimistic-rollback-reconciliation?format=claude","cursorMdc":"/api/rules/react19-useoptimistic-rollback-reconciliation?format=mdc","cursorrules":"/api/rules/react19-useoptimistic-rollback-reconciliation?format=cursor","windsurf":"/api/rules/react19-useoptimistic-rollback-reconciliation?format=windsurf","agents":"/api/rules/react19-useoptimistic-rollback-reconciliation?format=agents"}},{"id":"postgres-17-aio-hnsw-vector-guardrail","title":"PostgreSQL 17 Direct AIO HNSW Vector Pipeline Guardrail","category":"backend","severity":"critical","description":"Enforces direct asynchronous I/O (AIO) utilization for high-dimensional vector search on PostgreSQL 17 using pgvector. Eliminates backend thread blocking and kernel context-switch stalls during massive HNSW graph traversals by guaranteeing proper connection pool settings, vectorized batching, and kernel-level io_uring/posix AIO prefetch alignment.","antiPatternHeadline":"Unbuffered Synchronous Sequential Scans and Thread Starvation on HNSW Vector Traversals","stars_count":88,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres-17","pgvector","hnsw","async-io","io-uring","database-performance"],"exportEndpoints":{"claude":"/api/rules/postgres-17-aio-hnsw-vector-guardrail?format=claude","cursorMdc":"/api/rules/postgres-17-aio-hnsw-vector-guardrail?format=mdc","cursorrules":"/api/rules/postgres-17-aio-hnsw-vector-guardrail?format=cursor","windsurf":"/api/rules/postgres-17-aio-hnsw-vector-guardrail?format=windsurf","agents":"/api/rules/postgres-17-aio-hnsw-vector-guardrail?format=agents"}},{"id":"bun-worker-messageport-transfer-invariant","title":"Bun 1.2 Worker MessagePort Zero-Copy Structured-Cloning Transfer Invariant","category":"backend","severity":"critical","description":"Enforces strict zero-copy memory transfers across Bun 1.2 multi-threaded Worker contexts via MessagePort and Web Worker APIs. Guarantees linear memory ownership transfer using Transferable ArrayBuffer instances, preventing severe serialization latency, GC pressure, and race conditions on detached memory buffers.","antiPatternHeadline":"Implicit Structured-Clone Payload Duplication and Post-Transfer Mutation of Detached Buffers","stars_count":70,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","web-workers","messageport","multithreading","concurrency","zero-copy"],"exportEndpoints":{"claude":"/api/rules/bun-worker-messageport-transfer-invariant?format=claude","cursorMdc":"/api/rules/bun-worker-messageport-transfer-invariant?format=mdc","cursorrules":"/api/rules/bun-worker-messageport-transfer-invariant?format=cursor","windsurf":"/api/rules/bun-worker-messageport-transfer-invariant?format=windsurf","agents":"/api/rules/bun-worker-messageport-transfer-invariant?format=agents"}},{"id":"kmp-concurrent-gc-mutator-thread-isolation","title":"Kotlin Multiplatform 2.1 Concurrent GC Mutator Thread Isolation","category":"mobile","severity":"critical","description":"Enforces strict isolation of high-throughput background persistence mutations from main UI mutator threads under Kotlin Native 2.1 Concurrent Mark and Sweep (CMS) GC. Prevents iOS/Android UI hitching caused by thread-to-thread safepoint synchronization and mutator suspension during large object graph allocations.","antiPatternHeadline":"Leaking Heavy Serialization Graphs into UI Mutator Safepoints Triggering GC Pauses","stars_count":118,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kmp","kotlin-native","memory-management","concurrency"],"exportEndpoints":{"claude":"/api/rules/kmp-concurrent-gc-mutator-thread-isolation?format=claude","cursorMdc":"/api/rules/kmp-concurrent-gc-mutator-thread-isolation?format=mdc","cursorrules":"/api/rules/kmp-concurrent-gc-mutator-thread-isolation?format=cursor","windsurf":"/api/rules/kmp-concurrent-gc-mutator-thread-isolation?format=windsurf","agents":"/api/rules/kmp-concurrent-gc-mutator-thread-isolation?format=agents"}},{"id":"tauri-mobile-scoped-ipc-capability-boundary","title":"Tauri 2.0 Mobile Scoped IPC Capability Schema Boundary","category":"mobile","severity":"critical","description":"Enforces strict compile-time capabilities and granular permission scoping on all Tauri 2.0 mobile IPC bridges. Mitigates native privilege escalation via compromised webviews by isolating mobile window contexts, enforcing explicit command whitelists, and rejecting wildcard filesystem or shell permissions.","antiPatternHeadline":"Wildcard Permissions and Unscoped Native Invocation in Mobile Webview Bridges","stars_count":57,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri","ipc-security","rust","capabilities","android","ios"],"exportEndpoints":{"claude":"/api/rules/tauri-mobile-scoped-ipc-capability-boundary?format=claude","cursorMdc":"/api/rules/tauri-mobile-scoped-ipc-capability-boundary?format=mdc","cursorrules":"/api/rules/tauri-mobile-scoped-ipc-capability-boundary?format=cursor","windsurf":"/api/rules/tauri-mobile-scoped-ipc-capability-boundary?format=windsurf","agents":"/api/rules/tauri-mobile-scoped-ipc-capability-boundary?format=agents"}},{"id":"oauth2-dpop-nonce-binding-guardrail","title":"OAuth 2.0 DPoP Proof-of-Possession and Ephemeral Nonce-Binding Standard","category":"security","severity":"critical","description":"Enforces strict RFC 9449 compliance for Demonstrating Proof-of-Possession (DPoP) across all single-page applications and API consumers. Mandates that non-extractable CryptoKey pairs bound to Web Crypto IndexedDB generate single-use signed DPoP proofs for every mutating and token-exchange request, strictly managing server-supplied DPoP nonces with automatic replay-retry loops. Eliminates bearer token exfiltration risks by cryptographically coupling the access token and request context to asymmetric hardware/browser-isolated keys.","antiPatternHeadline":"Bearer-Token Fallback, Reused DPoP Proofs, and Non-Extractable Key Leakage in SPA HTTP Clients","stars_count":88,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","oauth2","dpop","rfc9449","webcrypto","tokens"],"exportEndpoints":{"claude":"/api/rules/oauth2-dpop-nonce-binding-guardrail?format=claude","cursorMdc":"/api/rules/oauth2-dpop-nonce-binding-guardrail?format=mdc","cursorrules":"/api/rules/oauth2-dpop-nonce-binding-guardrail?format=cursor","windsurf":"/api/rules/oauth2-dpop-nonce-binding-guardrail?format=windsurf","agents":"/api/rules/oauth2-dpop-nonce-binding-guardrail?format=agents"}},{"id":"k8s-132-dra-gpu-device-fencing-standard","title":"Deterministic GPU Isolation via Kubernetes 1.32 Dynamic Resource Allocation (DRA)","category":"devops","severity":"critical","description":"Enforces strict device fencing for multi-tenant GPU workloads using Kubernetes 1.32 Dynamic Resource Allocation (DRA) structured parameters (resource.k8s.io/v1beta1). Replaces legacy opaque integer extended resources (nvidia.com/gpu) with deterministic ResourceClaims, ensuring PCIe topology alignment, explicit hardware boundary isolation, and zero cross-tenant noisy-neighbor starvation.","antiPatternHeadline":"Legacy Opaque GPU Counting and Unfenced Container Device Mounts","stars_count":60,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","kubernetes","dra","gpu","multi-tenancy","device-fencing","infrastructure-as-code"],"exportEndpoints":{"claude":"/api/rules/k8s-132-dra-gpu-device-fencing-standard?format=claude","cursorMdc":"/api/rules/k8s-132-dra-gpu-device-fencing-standard?format=mdc","cursorrules":"/api/rules/k8s-132-dra-gpu-device-fencing-standard?format=cursor","windsurf":"/api/rules/k8s-132-dra-gpu-device-fencing-standard?format=windsurf","agents":"/api/rules/k8s-132-dra-gpu-device-fencing-standard?format=agents"}},{"id":"otel-baggage-ingress-sanitization-standard","title":"OpenTelemetry Baggage Ingress Sanitization and Boundary Defense","category":"devops","severity":"critical","description":"Enforces strict boundary validation and stripping of untrusted W3C Baggage HTTP headers at API gateways and perimeter ingress proxies. Prevents trace context poisoning, privilege escalation via contextual spoofing, and memory exhaustion caused by unbounded baggage propagation across downstream distributed microservices.","antiPatternHeadline":"Blind Context Propagation of Untrusted Ingress Baggage Headers into Internal Tracing Spans","stars_count":50,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","observability","security","api-gateway","distributed-tracing"],"exportEndpoints":{"claude":"/api/rules/otel-baggage-ingress-sanitization-standard?format=claude","cursorMdc":"/api/rules/otel-baggage-ingress-sanitization-standard?format=mdc","cursorrules":"/api/rules/otel-baggage-ingress-sanitization-standard?format=cursor","windsurf":"/api/rules/otel-baggage-ingress-sanitization-standard?format=windsurf","agents":"/api/rules/otel-baggage-ingress-sanitization-standard?format=agents"}},{"id":"svelte-5-runes-effect-cleanup-isolation","title":"Svelte 5 Runes Fine-Grained Reactive Effect Cleanup Isolation","category":"frontend","severity":"critical","description":"Mandates strict synchronous teardown returns inside Svelte 5 `$effect` and `$effect.pre` blocks to prevent detached DOM and listener memory leaks in dynamic micro-frontend lifecycles. Forbids passing async executors directly to `$effect`, requiring inner asynchronous tasks to track and cancel in-flight work via explicit AbortController references. Enforces clean disposal of third-party observer and subscription instances before subsequent reactive triggers or component unmounting.","antiPatternHeadline":"Dangling Subscriptions and Leaked Async Tasks via Async $effect Callback Signatures","stars_count":100,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","memory-leaks","micro-frontends","lifecycle"],"exportEndpoints":{"claude":"/api/rules/svelte-5-runes-effect-cleanup-isolation?format=claude","cursorMdc":"/api/rules/svelte-5-runes-effect-cleanup-isolation?format=mdc","cursorrules":"/api/rules/svelte-5-runes-effect-cleanup-isolation?format=cursor","windsurf":"/api/rules/svelte-5-runes-effect-cleanup-isolation?format=windsurf","agents":"/api/rules/svelte-5-runes-effect-cleanup-isolation?format=agents"}},{"id":"react-19-hoisted-asset-preloading-watermark","title":"React 19 Deterministic Hoisted Resource Preloading and Waterfall Prevention","category":"frontend","severity":"critical","description":"Enforces deterministic layout-level resource preloading using React 19 react-dom hoisting APIs (preload, preinit, preinitModule) to eradicate sub-tree request waterfall cascades during concurrent client-side transitions. Guarantees that critical fonts, stylesheets, and module chunks are pre-warmed during the initial render phase rather than discovered post-mount inside leaf nodes.","antiPatternHeadline":"Imperative useEffect Asset Injections and Deep Sub-Tree Discovery Waterfalls","stars_count":72,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react19","react-dom","performance","resource-hints","transitions"],"exportEndpoints":{"claude":"/api/rules/react-19-hoisted-asset-preloading-watermark?format=claude","cursorMdc":"/api/rules/react-19-hoisted-asset-preloading-watermark?format=mdc","cursorrules":"/api/rules/react-19-hoisted-asset-preloading-watermark?format=cursor","windsurf":"/api/rules/react-19-hoisted-asset-preloading-watermark?format=windsurf","agents":"/api/rules/react-19-hoisted-asset-preloading-watermark?format=agents"}},{"id":"fastapi-pydantic-v2-zero-copy-ingestion","title":"FastAPI Pydantic V2 Zero-Copy Buffer Ingestion Invariants","category":"backend","severity":"critical","description":"Enforces direct memory buffer ingestion in high-throughput FastAPI endpoints handling multi-megabyte payloads. Circumvents default starlette/pydantic byte-string reallocations by streaming raw bytes into Pydantic v2's Rust-backed deserializer (`pydantic-core`) or memory-mapped buffers. Prevents fatal Out-Of-Memory (OOM) amplification and high Garbage Collection pause spikes under sustained ingestion loads.","antiPatternHeadline":"Implicit string/bytes payload buffering triggering 4x memory amplification during Pydantic schema parsing","stars_count":65,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","pydantic-v2","memory-optimization","zero-copy","performance"],"exportEndpoints":{"claude":"/api/rules/fastapi-pydantic-v2-zero-copy-ingestion?format=claude","cursorMdc":"/api/rules/fastapi-pydantic-v2-zero-copy-ingestion?format=mdc","cursorrules":"/api/rules/fastapi-pydantic-v2-zero-copy-ingestion?format=cursor","windsurf":"/api/rules/fastapi-pydantic-v2-zero-copy-ingestion?format=windsurf","agents":"/api/rules/fastapi-pydantic-v2-zero-copy-ingestion?format=agents"}},{"id":"apache-iceberg-partition-evolution-compatibility-guardrail","title":"Apache Iceberg Partition Evolution and Schema Invariant Guardrail","category":"backend","severity":"critical","description":"Enforces non-breaking schema and hidden partition evolution invariants on Apache Iceberg lakehouse tables to guarantee deterministic query engine scan planning. Mandates void transforms for retired partition fields, preserves source column field IDs, and strictly prevents physical partition rewrites or field ID reassignments that cause query pruning degradation across distributed engines (Trino, Spark, DuckDB).","antiPatternHeadline":"Mutating existing partition field specs in-place or re-ordering schema field IDs during Iceberg partition updates","stars_count":58,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","apache-iceberg","data-lakehouse","partition-evolution","distributed-systems","schema-evolution"],"exportEndpoints":{"claude":"/api/rules/apache-iceberg-partition-evolution-compatibility-guardrail?format=claude","cursorMdc":"/api/rules/apache-iceberg-partition-evolution-compatibility-guardrail?format=mdc","cursorrules":"/api/rules/apache-iceberg-partition-evolution-compatibility-guardrail?format=cursor","windsurf":"/api/rules/apache-iceberg-partition-evolution-compatibility-guardrail?format=windsurf","agents":"/api/rules/apache-iceberg-partition-evolution-compatibility-guardrail?format=agents"}},{"id":"kmp-swift-export-arc-threading-guardrail","title":"Deterministic KMP Swift-Export ARC Pinning and Cross-Runtime Lifecycle Guardrail","category":"mobile","severity":"critical","description":"Enforces strict memory boundary invariants between Kotlin/Native GC and Swift ARC during cross-runtime invocations and Swift-Export bindings. Prevents uncollected cross-runtime retain cycles, unsafe cross-thread ARC object releases, and native thread deadlocks when bridging Kotlin Coroutines with Swift Concurrency.","antiPatternHeadline":"Cross-Runtime Retain Cycles and Unpinned Foreign Pointer Deallocation Across Asynchronous Boundaries","stars_count":72,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","swift-export","cinterop","arc-pinning","memory-management","concurrency"],"exportEndpoints":{"claude":"/api/rules/kmp-swift-export-arc-threading-guardrail?format=claude","cursorMdc":"/api/rules/kmp-swift-export-arc-threading-guardrail?format=mdc","cursorrules":"/api/rules/kmp-swift-export-arc-threading-guardrail?format=cursor","windsurf":"/api/rules/kmp-swift-export-arc-threading-guardrail?format=windsurf","agents":"/api/rules/kmp-swift-export-arc-threading-guardrail?format=agents"}},{"id":"capacitor7-universal-link-route-intent-attestation","title":"Capacitor 7 Universal Link Cryptographic Route Intent Attestation","category":"mobile","severity":"critical","description":"Mandates strict origin-bound verification, hostname enforcement, and cryptographic intent attestation for incoming Universal Links and App Links in Capacitor 7 applications. Precludes authorization code hijacking, parameter injection, and malicious intra-app payload routing caused by trusting unauthenticated custom URI schemes and deep link events.","antiPatternHeadline":"Directly Dispatching Navigation or Mutating State from Unverified Deep Link Payloads","stars_count":57,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","security","universal-links","app-links","deep-linking","cryptography"],"exportEndpoints":{"claude":"/api/rules/capacitor7-universal-link-route-intent-attestation?format=claude","cursorMdc":"/api/rules/capacitor7-universal-link-route-intent-attestation?format=mdc","cursorrules":"/api/rules/capacitor7-universal-link-route-intent-attestation?format=cursor","windsurf":"/api/rules/capacitor7-universal-link-route-intent-attestation?format=windsurf","agents":"/api/rules/capacitor7-universal-link-route-intent-attestation?format=agents"}},{"id":"spiffe-spire-x509-svid-automated-rotation-invariant","title":"Automated Sub-Hour SPIFFE/SPIRE X.509 SVID Dynamic Workload Identity Rotation","category":"security","severity":"critical","description":"Workloads across heterogeneous cloud meshes must eliminate all static long-lived credentials by continuously leasing short-lived X.509 SVIDs from the SPIFFE Workload API over a secure UNIX domain socket. Applications and mTLS transport layers must implement in-memory dynamic keypair hot-reloading via persistent streaming watchers, strictly binding maximum SVID lifetime to under 60 minutes. Storing SVID private keys on persistent non-volatile disks, bypassing the SPIFFE Workload API, or caching TLS contexts without automated rotation violates zero-trust isolation invariants.","antiPatternHeadline":"Static Cloud Credentials and Unwatched, Stale X.509 Certificate Loading","stars_count":65,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","spiffe","spire","zero-trust","mtls","workload-identity","cryptography"],"exportEndpoints":{"claude":"/api/rules/spiffe-spire-x509-svid-automated-rotation-invariant?format=claude","cursorMdc":"/api/rules/spiffe-spire-x509-svid-automated-rotation-invariant?format=mdc","cursorrules":"/api/rules/spiffe-spire-x509-svid-automated-rotation-invariant?format=cursor","windsurf":"/api/rules/spiffe-spire-x509-svid-automated-rotation-invariant?format=windsurf","agents":"/api/rules/spiffe-spire-x509-svid-automated-rotation-invariant?format=agents"}},{"id":"amd-sev-snp-attestation-gatekeeper-mandate","title":"AMD SEV-SNP Cryptographic Attestation and Key Release Gatekeeper","category":"security","severity":"critical","description":"Mandates strict cryptographic verification of AMD SEV-SNP attestation reports prior to releasing tenant master encryption keys to ephemeral enclaves. Requires end-to-end validation of the AMD VCEK certificate chain back to the AMD Root Key (ARK), strict verification of launch measurements against signed golden baselines, and cryptographic binding of an ephemeral session key to REPORT_DATA to prevent relay attacks.","antiPatternHeadline":"Injecting Master Keys via Unauthenticated Ephemeral Sessions or Incomplete VCEK Chain and Measurement Validation","stars_count":57,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","confidential-computing","sev-snp","attestation","cryptography","zero-trust"],"exportEndpoints":{"claude":"/api/rules/amd-sev-snp-attestation-gatekeeper-mandate?format=claude","cursorMdc":"/api/rules/amd-sev-snp-attestation-gatekeeper-mandate?format=mdc","cursorrules":"/api/rules/amd-sev-snp-attestation-gatekeeper-mandate?format=cursor","windsurf":"/api/rules/amd-sev-snp-attestation-gatekeeper-mandate?format=windsurf","agents":"/api/rules/amd-sev-snp-attestation-gatekeeper-mandate?format=agents"}},{"id":"k8s-gateway-api-cross-namespace-referencegrant-enforcement","title":"Mandatory ReferenceGrant Authorization for Cross-Namespace Kubernetes Gateway API Bindings","category":"devops","severity":"critical","description":"Enforces explicit, least-privilege ReferenceGrant declarations in target namespaces whenever Kubernetes Gateway API routes or listeners bind cross-namespace services or secrets. Disallows unrestricted cross-tenant backendRefs and wildcard listener selectors to eliminate traffic interception, secret exfiltration, and route hijacking across cluster boundaries.","antiPatternHeadline":"Cross-Namespace Route Attachment and Backend Forwarding Without Explicit Administrative ReferenceGrant Bindings","stars_count":103,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","kubernetes","gateway-api","security","multi-tenancy","rbac"],"exportEndpoints":{"claude":"/api/rules/k8s-gateway-api-cross-namespace-referencegrant-enforcement?format=claude","cursorMdc":"/api/rules/k8s-gateway-api-cross-namespace-referencegrant-enforcement?format=mdc","cursorrules":"/api/rules/k8s-gateway-api-cross-namespace-referencegrant-enforcement?format=cursor","windsurf":"/api/rules/k8s-gateway-api-cross-namespace-referencegrant-enforcement?format=windsurf","agents":"/api/rules/k8s-gateway-api-cross-namespace-referencegrant-enforcement?format=agents"}},{"id":"ebpf-so-reuseport-connection-draining-standard","title":"eBPF SO_REUSEPORT Socket Map Connection Draining and Zero-Loss Handoff Standard","category":"devops","severity":"critical","description":"Enforces deterministic, zero-packet-loss rolling process deployments by orchestrating eBPF BPF_PROG_TYPE_SK_REUSEPORT programs and BPF_MAP_TYPE_REUSEPORT_SOCKARRAY maps. Mandates atomic ingress TCP socket redirection to new generation worker groups while draining established connections on legacy workers before SIGKILL/close. Eliminates kernel-level SYN backlog resets and RST injection caused by naive process termination or standard SO_REUSEPORT round-robin distribution during shutdown.","antiPatternHeadline":"Terminating SO_REUSEPORT Listeners Without eBPF Socket Map Steering and Synchronized Backlog Evacuation","stars_count":117,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","linux-kernel","networking","zero-downtime","so-reuseport"],"exportEndpoints":{"claude":"/api/rules/ebpf-so-reuseport-connection-draining-standard?format=claude","cursorMdc":"/api/rules/ebpf-so-reuseport-connection-draining-standard?format=mdc","cursorrules":"/api/rules/ebpf-so-reuseport-connection-draining-standard?format=cursor","windsurf":"/api/rules/ebpf-so-reuseport-connection-draining-standard?format=windsurf","agents":"/api/rules/ebpf-so-reuseport-connection-draining-standard?format=agents"}},{"id":"nextjs-15-ppr-suspense-streaming-invariant","title":"Next.js 15 Partial Prerendering (PPR) Boundary Isolation Invariant","category":"frontend","severity":"critical","description":"Enforces strict boundary encapsulation between static CDN pre-rendered shells and dynamic React Server Components (RSC) micro-streams. Prevents dynamic request accessors (headers, cookies, searchParams, uncached fetch calls) from leaking into root execution contexts, which collapses the static prerender shell into full dynamic SSR and introduces cascading client-side waterfalls.","antiPatternHeadline":"Dynamic Accessor Leakage in Outer Layouts and Top-Level Shells Collapsing PPR","stars_count":52,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs","react-server-components","partial-prerendering","performance"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-ppr-suspense-streaming-invariant?format=claude","cursorMdc":"/api/rules/nextjs-15-ppr-suspense-streaming-invariant?format=mdc","cursorrules":"/api/rules/nextjs-15-ppr-suspense-streaming-invariant?format=cursor","windsurf":"/api/rules/nextjs-15-ppr-suspense-streaming-invariant?format=windsurf","agents":"/api/rules/nextjs-15-ppr-suspense-streaming-invariant?format=agents"}},{"id":"react-19-resource-precedence-guardrail","title":"React 19 Asset Preloading and Resource Hint Precedence Guardrail","category":"frontend","severity":"critical","description":"Enforces deterministic resource loading using React 19 native DOM APIs (preload, preinit, prefetchDNS, connect) and explicit style precedence descriptors over imperative link tags and CSS-in-JS runtime injections. Prevents Flash of Unstyled Content (FOUC), layout shifts, and cascading render-blocking in concurrent transitions by ensuring asset discovery happens during render preparation rather than layout effects.","antiPatternHeadline":"Imperative Link Tag Injection and Unordered Stylesheet Ingestion Triggering Layout Shifts in Concurrent Mode","stars_count":56,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","resource-hints","asset-preloading","concurrent-react","performance"],"exportEndpoints":{"claude":"/api/rules/react-19-resource-precedence-guardrail?format=claude","cursorMdc":"/api/rules/react-19-resource-precedence-guardrail?format=mdc","cursorrules":"/api/rules/react-19-resource-precedence-guardrail?format=cursor","windsurf":"/api/rules/react-19-resource-precedence-guardrail?format=windsurf","agents":"/api/rules/react-19-resource-precedence-guardrail?format=agents"}},{"id":"fastapi-python313-free-threaded-state-isolation","title":"FastAPI 0.115+ Free-Threaded (Python 3.13t) State Isolation & Thread-Safety Standard","category":"backend","severity":"critical","description":"Guarantees strict request context encapsulation, thread isolation, and memory-safe shared state under Python 3.13 free-threaded (GIL-disabled, PEP 703) runtimes. Prevents severe race conditions, cross-request state leakage, and memory corruption caused by legacy assumptions of GIL-backed atomicity.","antiPatternHeadline":"Relying on Implicit GIL Atomicity and Mutable Global Singletons in Free-Threaded Async Execution","stars_count":97,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","python313","free-threaded","concurrency","thread-safety","asyncio"],"exportEndpoints":{"claude":"/api/rules/fastapi-python313-free-threaded-state-isolation?format=claude","cursorMdc":"/api/rules/fastapi-python313-free-threaded-state-isolation?format=mdc","cursorrules":"/api/rules/fastapi-python313-free-threaded-state-isolation?format=cursor","windsurf":"/api/rules/fastapi-python313-free-threaded-state-isolation?format=windsurf","agents":"/api/rules/fastapi-python313-free-threaded-state-isolation?format=agents"}},{"id":"go-chi-http3-zero-rtt-replay-guardrail","title":"Go 1.24+ Chi HTTP/3 0-RTT Early-Data Anti-Replay Guardrail","category":"backend","severity":"critical","description":"Enforces RFC 8470 early-data verification and rejection on state-mutating HTTP methods over QUIC/HTTP/3 in Go Chi routers to prevent 0-RTT replay vulnerabilities. Rejects unsafe requests arriving in 0-RTT early data with HTTP 425 Too Early before executing any business logic. Ensures non-idempotent operations cannot be replayed across networks by eavesdroppers capturing initial QUIC flights.","antiPatternHeadline":"Allowing State-Mutating Handlers to Process QUIC 0-RTT Early Data Without HTTP 425 Rejection","stars_count":74,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","chi","http3","quic","security","zero-rtt","replay-attack"],"exportEndpoints":{"claude":"/api/rules/go-chi-http3-zero-rtt-replay-guardrail?format=claude","cursorMdc":"/api/rules/go-chi-http3-zero-rtt-replay-guardrail?format=mdc","cursorrules":"/api/rules/go-chi-http3-zero-rtt-replay-guardrail?format=cursor","windsurf":"/api/rules/go-chi-http3-zero-rtt-replay-guardrail?format=windsurf","agents":"/api/rules/go-chi-http3-zero-rtt-replay-guardrail?format=agents"}},{"id":"pgvector-hnsw-partition-iterative-filter-pushdown","title":"pgvector 0.8+ / Postgres 17 Partition-Pruned Iterative HNSW Scan Invariant","category":"backend","severity":"critical","description":"Requires strict partition boundary pushdown and explicit iterative HNSW scan configuration in pgvector 0.8+ and Postgres 17. Omitting partition keys or relying on unindexed metadata predicates forces HNSW iterative traversal to exhaust candidate queues and fall back to multi-second unindexed sequential scans.","antiPatternHeadline":"Global Unpartitioned Vector Search with Unindexed Post-Filters Triggering Sequential Scans","stars_count":87,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","pgvector","hnsw","database-performance"],"exportEndpoints":{"claude":"/api/rules/pgvector-hnsw-partition-iterative-filter-pushdown?format=claude","cursorMdc":"/api/rules/pgvector-hnsw-partition-iterative-filter-pushdown?format=mdc","cursorrules":"/api/rules/pgvector-hnsw-partition-iterative-filter-pushdown?format=cursor","windsurf":"/api/rules/pgvector-hnsw-partition-iterative-filter-pushdown?format=windsurf","agents":"/api/rules/pgvector-hnsw-partition-iterative-filter-pushdown?format=agents"}},{"id":"capacitor7-biometric-secure-enclave-interop","title":"Capacitor 7 Hardware-Backed Keystore Cryptographic Interop Contract","category":"mobile","severity":"critical","description":"Enforces asymmetric payload signing exclusively within the native hardware Secure Enclave or Android Keystore via Capacitor 7 native bridges. Eliminates the persistence or exposure of raw cryptographic private keys, refresh tokens, and master credentials within the hybrid WebView JavaScript context. Mandates proof-of-possession signing using ephemeral challenge-response mechanics.","antiPatternHeadline":"Exposing Raw Private Keys or Storing Static Bearer Tokens in WebView Storage","stars_count":76,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","security","biometrics","keystore","secure-enclave"],"exportEndpoints":{"claude":"/api/rules/capacitor7-biometric-secure-enclave-interop?format=claude","cursorMdc":"/api/rules/capacitor7-biometric-secure-enclave-interop?format=mdc","cursorrules":"/api/rules/capacitor7-biometric-secure-enclave-interop?format=cursor","windsurf":"/api/rules/capacitor7-biometric-secure-enclave-interop?format=windsurf","agents":"/api/rules/capacitor7-biometric-secure-enclave-interop?format=agents"}},{"id":"tauri-v2-granular-ipc-capabilities-invariant","title":"Enforce Granular Capability-Based IPC Permissions in Tauri 2.0","category":"security","severity":"critical","description":"Tauri 2.0 replaces the legacy monolithic allowlist with a capability-driven access control model for IPC commands. Every frontend-to-Rust command, plugin capability, and filesystem/network scope must be explicitly mapped to designated windows and domains through scoped capability files, eliminating the risk of arbitrary command injection and remote code execution.","antiPatternHeadline":"Over-privileged Default Capabilities and Wildcard IPC Command Execution","stars_count":62,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","tauri","ipc","rust","capabilities","authorization"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-granular-ipc-capabilities-invariant?format=claude","cursorMdc":"/api/rules/tauri-v2-granular-ipc-capabilities-invariant?format=mdc","cursorrules":"/api/rules/tauri-v2-granular-ipc-capabilities-invariant?format=cursor","windsurf":"/api/rules/tauri-v2-granular-ipc-capabilities-invariant?format=windsurf","agents":"/api/rules/tauri-v2-granular-ipc-capabilities-invariant?format=agents"}},{"id":"webauthn-prf-zero-knowledge-derivation-webauthn-level-3-933","title":"WebAuthn Level 3 PRF Extension Zero-Knowledge Client-Side Key Derivation","category":"security","severity":"critical","description":"Enforces strict zero-knowledge client-side field-level encryption using WebAuthn Level 3 PRF (Pseudo-Random Function) extensions. Raw PRF outputs and derived symmetric encryption keys must remain strictly within volatile client memory and never be transmitted to, cached on, or regenerated by backend services. Cryptographic operations must consume Web Crypto HKDF and AES-GCM primitives with distinct salt-keyed credential lookups.","antiPatternHeadline":"Transmitting PRF Outputs or Derived Decryption Keys to Backend Services","stars_count":107,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","cryptography","prf-extension","zero-knowledge","aes-gcm"],"exportEndpoints":{"claude":"/api/rules/webauthn-prf-zero-knowledge-derivation-webauthn-level-3-933?format=claude","cursorMdc":"/api/rules/webauthn-prf-zero-knowledge-derivation-webauthn-level-3-933?format=mdc","cursorrules":"/api/rules/webauthn-prf-zero-knowledge-derivation-webauthn-level-3-933?format=cursor","windsurf":"/api/rules/webauthn-prf-zero-knowledge-derivation-webauthn-level-3-933?format=windsurf","agents":"/api/rules/webauthn-prf-zero-knowledge-derivation-webauthn-level-3-933?format=agents"}},{"id":"openfga-ephemeral-contextual-tuples-zero-retention","title":"OpenFGA Ephemeral Contextual Tuples Zero-Retention Boundary Standard","category":"security","severity":"critical","description":"Enforces strict isolation between persistent relation tuples and dynamic runtime authorization claims. Engineers must supply temporal, environmental, or session-scoped attributes exclusively via OpenFGA in-memory contextual tuples during graph traversal rather than writing ephemeral state to the persistent tuple store.","antiPatternHeadline":"Persisting Ephemeral or Session Claims to OpenFGA Store Resulting in State Drift and Privilege Leaks","stars_count":67,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","authorization","rebac","zero-trust","contextual-tuples"],"exportEndpoints":{"claude":"/api/rules/openfga-ephemeral-contextual-tuples-zero-retention?format=claude","cursorMdc":"/api/rules/openfga-ephemeral-contextual-tuples-zero-retention?format=mdc","cursorrules":"/api/rules/openfga-ephemeral-contextual-tuples-zero-retention?format=cursor","windsurf":"/api/rules/openfga-ephemeral-contextual-tuples-zero-retention?format=windsurf","agents":"/api/rules/openfga-ephemeral-contextual-tuples-zero-retention?format=agents"}},{"id":"cilium-ebpf-zero-trust-socketops-production-standard","title":"Cilium eBPF Socket-Level Mutual Authentication and WireGuard Invariant","category":"devops","severity":"critical","description":"Mandates in-kernel socket-level zero-trust mutual authentication and WireGuard encapsulation using Cilium eBPF, replacing legacy user-space sidecar proxies. Guarantees cryptographically attested pod identities and line-rate L3/L4/L7 policy enforcement without sidecar memory footprint, connection latency penalties, or bypass vulnerabilities.","antiPatternHeadline":"Injecting memory-intensive user-space sidecars or relying on unencrypted, unauthenticated plain-text pod transit.","stars_count":85,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","cilium","ebpf","wireguard","zero-trust","kubernetes","security"],"exportEndpoints":{"claude":"/api/rules/cilium-ebpf-zero-trust-socketops-production-standard?format=claude","cursorMdc":"/api/rules/cilium-ebpf-zero-trust-socketops-production-standard?format=mdc","cursorrules":"/api/rules/cilium-ebpf-zero-trust-socketops-production-standard?format=cursor","windsurf":"/api/rules/cilium-ebpf-zero-trust-socketops-production-standard?format=windsurf","agents":"/api/rules/cilium-ebpf-zero-trust-socketops-production-standard?format=agents"}},{"id":"react-19-rsc-flight-protocol-serialization-barrier","title":"React 19 RSC Flight Protocol Serialization Barrier and Boundary Tainting","category":"frontend","severity":"critical","description":"Enforces a strict serialization and sanitization boundary when crossing from React Server Components (RSC) to Client Components via the Flight protocol. Eliminates prototype poisoning, accidental server-state leakage, and non-POJO hydration bugs by mandating explicit Data Transfer Object (DTO) projection and React taint protection APIs.","antiPatternHeadline":"Passing Raw Database Entities, Prototype-Bearing Instances, or Server Context directly to Client Components","stars_count":65,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","rsc","flight-protocol","security","taint-api","dto"],"exportEndpoints":{"claude":"/api/rules/react-19-rsc-flight-protocol-serialization-barrier?format=claude","cursorMdc":"/api/rules/react-19-rsc-flight-protocol-serialization-barrier?format=mdc","cursorrules":"/api/rules/react-19-rsc-flight-protocol-serialization-barrier?format=cursor","windsurf":"/api/rules/react-19-rsc-flight-protocol-serialization-barrier?format=windsurf","agents":"/api/rules/react-19-rsc-flight-protocol-serialization-barrier?format=agents"}},{"id":"tanstack-start-cryptographic-rpc-envelope-guardrail","title":"TanStack Start Cryptographic RPC Envelope & Schema Coercion Guardrail","category":"frontend","severity":"critical","description":"Enforces runtime schema coercion and cryptographic replay validation on all TanStack Start server functions (`createServerFn`). Prevents unvalidated payload execution, state manipulation via raw JSON injection, and duplicate execution of stateful mutations.","antiPatternHeadline":"Unvalidated and Replayable TanStack Start Server Function Mutations","stars_count":50,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","tanstack-start","rpc-security","zod","replay-prevention","data-integrity"],"exportEndpoints":{"claude":"/api/rules/tanstack-start-cryptographic-rpc-envelope-guardrail?format=claude","cursorMdc":"/api/rules/tanstack-start-cryptographic-rpc-envelope-guardrail?format=mdc","cursorrules":"/api/rules/tanstack-start-cryptographic-rpc-envelope-guardrail?format=cursor","windsurf":"/api/rules/tanstack-start-cryptographic-rpc-envelope-guardrail?format=windsurf","agents":"/api/rules/tanstack-start-cryptographic-rpc-envelope-guardrail?format=agents"}},{"id":"axum-tokio-streaming-backpressure-standard","title":"Axum 0.8 Tokio Cooperative Task Budgeting and Streaming Backpressure Guardrail","category":"backend","severity":"critical","description":"Enforces strict bounded channels, explicit Tokio cooperative task budget yielding, and client-driven backpressure on all streaming HTTP response pipelines in Axum 0.8. Eliminates Tokio thread starvation, unbounded heap growth, and runaway producer tasks when downstream clients read slowly or disconnect prematurely.","antiPatternHeadline":"Unbounded Channel Buffering and Tight Serialization Loops in Axum Streaming Endpoints","stars_count":55,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tokio","backpressure","async","streaming"],"exportEndpoints":{"claude":"/api/rules/axum-tokio-streaming-backpressure-standard?format=claude","cursorMdc":"/api/rules/axum-tokio-streaming-backpressure-standard?format=mdc","cursorrules":"/api/rules/axum-tokio-streaming-backpressure-standard?format=cursor","windsurf":"/api/rules/axum-tokio-streaming-backpressure-standard?format=windsurf","agents":"/api/rules/axum-tokio-streaming-backpressure-standard?format=agents"}},{"id":"bun-zero-copy-socket-splice-invariant","title":"Bun 1.2 Zero-Copy TCP Socket Splice Pipeline Invariant","category":"backend","severity":"critical","description":"Mandates kernel-level zero-copy TCP socket piping in Bun edge proxy gateways to prevent userspace buffer allocations and JavaScript heap thrashing. Enforces direct socket pipe chaining over manual chunk aggregation in event listeners to maintain high-throughput kernel splicing.","antiPatternHeadline":"Userspace Buffer Intermediation in Proxy Sockets Inducing High GC Pressure and Kernel Transition Overhead","stars_count":83,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","networking","zero-copy","tcp-proxy","kernel-splice"],"exportEndpoints":{"claude":"/api/rules/bun-zero-copy-socket-splice-invariant?format=claude","cursorMdc":"/api/rules/bun-zero-copy-socket-splice-invariant?format=mdc","cursorrules":"/api/rules/bun-zero-copy-socket-splice-invariant?format=cursor","windsurf":"/api/rules/bun-zero-copy-socket-splice-invariant?format=windsurf","agents":"/api/rules/bun-zero-copy-socket-splice-invariant?format=agents"}},{"id":"openfga-contextual-tuple-temporal-partitioning","title":"OpenFGA 1.6 Contextual Tuple Temporal Invariant and Evaluation Partitioning","category":"security","severity":"critical","description":"Mandates absolute segregation between persistent graph authorization tuples and ephemeral, request-scoped contextual tuples within OpenFGA 1.6+ evaluation paths. Enforces strictly bounded contextual tuple payloads and temporal condition partitioning to guarantee sub-millisecond evaluation without store cache degradation or unbounded cycle traversal.","antiPatternHeadline":"Persisting ephemeral session states to the authorization datastore or passing unbounded contextual tuples across transitive traversal boundaries.","stars_count":49,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","rebac","authorization","zero-trust"],"exportEndpoints":{"claude":"/api/rules/openfga-contextual-tuple-temporal-partitioning?format=claude","cursorMdc":"/api/rules/openfga-contextual-tuple-temporal-partitioning?format=mdc","cursorrules":"/api/rules/openfga-contextual-tuple-temporal-partitioning?format=cursor","windsurf":"/api/rules/openfga-contextual-tuple-temporal-partitioning?format=windsurf","agents":"/api/rules/openfga-contextual-tuple-temporal-partitioning?format=agents"}},{"id":"ebpf-lsm-binary-digest-enforcement","title":"BPF-LSM Kernel-Level Cryptographic Binary Hash Enforcement Standard","category":"security","severity":"critical","description":"Enforces immutable container security by intercepting binary execution at the kernel LSM layer (bprm_check_security). Guarantees synchronous integrity validation via cryptographic digests before process execution, strictly preventing TOCTOU races, unapproved binaries, and container drift.","antiPatternHeadline":"Relying on Userland Path Checking or Asynchronous Syscall Tracing for Binary Authorization","stars_count":56,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["ebpf","bpf-lsm","kernel-security","zero-trust","containers","integrity"],"exportEndpoints":{"claude":"/api/rules/ebpf-lsm-binary-digest-enforcement?format=claude","cursorMdc":"/api/rules/ebpf-lsm-binary-digest-enforcement?format=mdc","cursorrules":"/api/rules/ebpf-lsm-binary-digest-enforcement?format=cursor","windsurf":"/api/rules/ebpf-lsm-binary-digest-enforcement?format=windsurf","agents":"/api/rules/ebpf-lsm-binary-digest-enforcement?format=agents"}},{"id":"sigstore-intoto-slsa-provenance-admission-verification","title":"Sigstore In-Toto SLSA Level 3 Attestation Verification at Kubernetes Admission Boundary","category":"security","severity":"critical","description":"Enforces strict zero-trust deployment gates at the Kubernetes admission boundary by verifying Sigstore In-Toto SLSA Level 3 provenance attestations. Images must resolve to immutable digests with validated Fulcio keyless OIDC identity claims, Rekor transparency log proofs, and builder workflow predicates before workloads are scheduled.","antiPatternHeadline":"Admitting Images via Mutable Tags or Signature-Only Validation Without Cryptographic In-Toto Build Predicate Verification","stars_count":84,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","sigstore","in-toto","slsa-level-3","kubernetes-admission","zero-trust","supply-chain"],"exportEndpoints":{"claude":"/api/rules/sigstore-intoto-slsa-provenance-admission-verification?format=claude","cursorMdc":"/api/rules/sigstore-intoto-slsa-provenance-admission-verification?format=mdc","cursorrules":"/api/rules/sigstore-intoto-slsa-provenance-admission-verification?format=cursor","windsurf":"/api/rules/sigstore-intoto-slsa-provenance-admission-verification?format=windsurf","agents":"/api/rules/sigstore-intoto-slsa-provenance-admission-verification?format=agents"}},{"id":"cmp-gpu-swapchain-sync-fence-standard","title":"Compose Multiplatform 1.7 GPU Swapchain Synchronization & Fence Lifecycle Guardrail","category":"mobile","severity":"critical","description":"Enforces deterministic GPU swapchain synchronization fences across Metal (iOS) and Vulkan (Android) backends in Compose Multiplatform 1.7. Prevents render thread deadlocks, CAMetalDrawable exhaustion, and VK_ERROR_DEVICE_LOST during rapid view hierarchy churn, navigation transitions, and application lifecycle changes.","antiPatternHeadline":"Asynchronous surface detachment without GPU fence draining or Skia context flushing during lifecycle transitions","stars_count":51,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","compose-multiplatform","metal","vulkan","skia","graphics-pipeline","concurrency"],"exportEndpoints":{"claude":"/api/rules/cmp-gpu-swapchain-sync-fence-standard?format=claude","cursorMdc":"/api/rules/cmp-gpu-swapchain-sync-fence-standard?format=mdc","cursorrules":"/api/rules/cmp-gpu-swapchain-sync-fence-standard?format=cursor","windsurf":"/api/rules/cmp-gpu-swapchain-sync-fence-standard?format=windsurf","agents":"/api/rules/cmp-gpu-swapchain-sync-fence-standard?format=agents"}},{"id":"opentelemetry-baggage-boundary-pii-redaction","title":"OpenTelemetry W3C Baggage Header Boundary and PII Redaction Invariant","category":"devops","severity":"critical","description":"Enforces strict byte-quota limits and automated regex-driven PII redaction on OpenTelemetry W3C Baggage propagation. Prevents HTTP 431 header amplification denial-of-service vectors and downstream compliance violations caused by in-band context leakage.","antiPatternHeadline":"Unbounded and Unsanitized Baggage Propagation Causing Header Flooding and PII Leakage","stars_count":46,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","observability","security","w3c-baggage","distributed-tracing"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-baggage-boundary-pii-redaction?format=claude","cursorMdc":"/api/rules/opentelemetry-baggage-boundary-pii-redaction?format=mdc","cursorrules":"/api/rules/opentelemetry-baggage-boundary-pii-redaction?format=cursor","windsurf":"/api/rules/opentelemetry-baggage-boundary-pii-redaction?format=windsurf","agents":"/api/rules/opentelemetry-baggage-boundary-pii-redaction?format=agents"}},{"id":"openfga-rebac-contextual-tuple-authorization-standard","title":"OpenFGA 1.8 ReBAC Ephemeral Contextual Tuple Guardrail","category":"security","severity":"critical","description":"Enforces deterministic, zero-leakage relationship-based access control (ReBAC) across distributed microservice meshes using OpenFGA 1.8. Mandates that dynamic request attributes and transient authorization relations are supplied strictly via contextual tuples and CEL condition contexts rather than persistent database writes. Guarantees sub-millisecond check latency while preventing stale privilege escalation across service boundaries.","antiPatternHeadline":"Persisting Ephemeral Request State as Storage Tuples Causing Permission Bleed and Latency Spikes","stars_count":50,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","rebac","authorization","contextual-tuples","zero-trust"],"exportEndpoints":{"claude":"/api/rules/openfga-rebac-contextual-tuple-authorization-standard?format=claude","cursorMdc":"/api/rules/openfga-rebac-contextual-tuple-authorization-standard?format=mdc","cursorrules":"/api/rules/openfga-rebac-contextual-tuple-authorization-standard?format=cursor","windsurf":"/api/rules/openfga-rebac-contextual-tuple-authorization-standard?format=windsurf","agents":"/api/rules/openfga-rebac-contextual-tuple-authorization-standard?format=agents"}},{"id":"svelte-5-runes-reactive-isolation-boundary-production-standard","title":"Svelte 5 Runes Reactive Isolation Boundary & Cascading Cycle Protection","category":"frontend","severity":"critical","description":"Enforces deterministic state synchronization and strict reactive boundaries within Svelte 5 application trees. Prevents runaway fine-grained signal loops, microtask queue starvation, and silent subscription leakage caused by un-isolated mutations inside $derived runes, ambient $effect tracking, and cross-boundary mutable state sharing.","antiPatternHeadline":"Unbounded Signal Feedback Loops and Ambient Reactive Entanglement Across Rune Boundaries","stars_count":85,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","state-management","reactivity","signals"],"exportEndpoints":{"claude":"/api/rules/svelte-5-runes-reactive-isolation-boundary-production-standard?format=claude","cursorMdc":"/api/rules/svelte-5-runes-reactive-isolation-boundary-production-standard?format=mdc","cursorrules":"/api/rules/svelte-5-runes-reactive-isolation-boundary-production-standard?format=cursor","windsurf":"/api/rules/svelte-5-runes-reactive-isolation-boundary-production-standard?format=windsurf","agents":"/api/rules/svelte-5-runes-reactive-isolation-boundary-production-standard?format=agents"}},{"id":"nextjs-15-server-actions-origin-attestation","title":"Next.js 15 Server Action Distributed Edge Origin Attestation Invariant","category":"frontend","severity":"critical","description":"Next.js 15 Server Actions mandate strict runtime Host, X-Forwarded-Host, and Origin header attestation to eliminate state-mutating request injection behind distributed CDNs and multi-tenant edge proxies. Relying on default host validation without explicit origin allowlisting permits cross-origin invocations and host-poisoning attacks across split-edge architectures.","antiPatternHeadline":"Implicit Trust of Origin and Host Headers in Edge-Terminated Server Actions","stars_count":72,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs","security","server-actions","edge-computing","csrf"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-server-actions-origin-attestation?format=claude","cursorMdc":"/api/rules/nextjs-15-server-actions-origin-attestation?format=mdc","cursorrules":"/api/rules/nextjs-15-server-actions-origin-attestation?format=cursor","windsurf":"/api/rules/nextjs-15-server-actions-origin-attestation?format=windsurf","agents":"/api/rules/nextjs-15-server-actions-origin-attestation?format=agents"}},{"id":"postgres-17-standby-failover-slot-sync-standard","title":"PostgreSQL 17 Failover Slot Sync & CDC Continuity Guardrail","category":"backend","severity":"critical","description":"Enforces PostgreSQL 17 native logical replication failover slot synchronization and LSN progression controls across high-availability clusters. Guarantees logical replication slots survive automated primary failovers without CDC event stream duplication, un-replicated transaction loss, or pipeline restart panics.","antiPatternHeadline":"Creating un-synchronized logical slots without failover flags and standby_slot_names coordination","stars_count":61,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","cdc","high-availability","database-reliability","replication"],"exportEndpoints":{"claude":"/api/rules/postgres-17-standby-failover-slot-sync-standard?format=claude","cursorMdc":"/api/rules/postgres-17-standby-failover-slot-sync-standard?format=mdc","cursorrules":"/api/rules/postgres-17-standby-failover-slot-sync-standard?format=cursor","windsurf":"/api/rules/postgres-17-standby-failover-slot-sync-standard?format=windsurf","agents":"/api/rules/postgres-17-standby-failover-slot-sync-standard?format=agents"}},{"id":"webauthn-prf-zk-key-wrapping-standard","title":"Zero-Knowledge Envelope Key Derivation & Wrapping via WebAuthn PRF Extension","category":"security","severity":"critical","description":"Enforces cryptographically isolated client-side envelope decryption derived directly from hardware passkey authenticators via the WebAuthn PRF (Pseudo-Random Function) extension. Prohibits server-side master key escrow, prevents raw PRF output usage, and mandates HKDF-SHA256 domain-separated key stretching with authenticated DEK wrapping and immediate memory zeroing.","antiPatternHeadline":"Directly Utilizing Raw WebAuthn PRF Output as Encryption Keys or Leaking Derived Key Material to RP Servers","stars_count":67,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","prf-extension","zero-knowledge","cryptography","envelope-encryption"],"exportEndpoints":{"claude":"/api/rules/webauthn-prf-zk-key-wrapping-standard?format=claude","cursorMdc":"/api/rules/webauthn-prf-zk-key-wrapping-standard?format=mdc","cursorrules":"/api/rules/webauthn-prf-zk-key-wrapping-standard?format=cursor","windsurf":"/api/rules/webauthn-prf-zk-key-wrapping-standard?format=windsurf","agents":"/api/rules/webauthn-prf-zk-key-wrapping-standard?format=agents"}},{"id":"kmp-darwin-gcd-concurrency-invariant","title":"Kotlin Multiplatform Darwin GCD & ARC Concurrency Invariant","category":"mobile","severity":"critical","description":"Enforces strict synchronization boundaries, autoreleasepool enclosures, and non-blocking dispatcher handoffs between Kotlin Coroutines and Apple Grand Central Dispatch (GCD). Eliminates thread starvation under Darwin GCD worker pool limits and prevents ARC memory leaks or use-after-free races across the Kotlin/Native and Darwin runtime boundaries.","antiPatternHeadline":"Unconfined Coroutine Dispatching and Blocking Across Darwin GCD Worker Thread Pools","stars_count":97,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","darwin","gcd","coroutines","arc","ios"],"exportEndpoints":{"claude":"/api/rules/kmp-darwin-gcd-concurrency-invariant?format=claude","cursorMdc":"/api/rules/kmp-darwin-gcd-concurrency-invariant?format=mdc","cursorrules":"/api/rules/kmp-darwin-gcd-concurrency-invariant?format=cursor","windsurf":"/api/rules/kmp-darwin-gcd-concurrency-invariant?format=windsurf","agents":"/api/rules/kmp-darwin-gcd-concurrency-invariant?format=agents"}},{"id":"tauri-v2-granular-ipc-capability-acl-hardening","title":"Tauri 2.0 Granular IPC Capability ACL Hardening & Bridge Isolation","category":"mobile","severity":"critical","description":"Enforces zero-trust native bridge isolation in Tauri 2.0 mobile runtimes by prohibiting wildcard permissions and unconstrained command execution. Requires explicit capability manifests mapping isolated WebView contexts to strictly scoped native commands to eliminate privilege escalation vectors into core mobile OS subsystems.","antiPatternHeadline":"Unscoped Wildcard Capabilities Exposing Native Mobile OS Subsystems via Permissive IPC Bridges","stars_count":66,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri-2","security","ipc","capability-acl","rust"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-granular-ipc-capability-acl-hardening?format=claude","cursorMdc":"/api/rules/tauri-v2-granular-ipc-capability-acl-hardening?format=mdc","cursorrules":"/api/rules/tauri-v2-granular-ipc-capability-acl-hardening?format=cursor","windsurf":"/api/rules/tauri-v2-granular-ipc-capability-acl-hardening?format=windsurf","agents":"/api/rules/tauri-v2-granular-ipc-capability-acl-hardening?format=agents"}},{"id":"go-chi-context-deadline-goroutine-lifecycle","title":"Go Chi Structured Context Deadline & Goroutine Tree Lifecycle Propagation","category":"backend","severity":"critical","description":"Mandates strict structured concurrency and cancellation propagation from Chi HTTP request contexts to all downstream goroutines and I/O clients. Prevents orphaned background operations, memory leaks, and database connection pool exhaustion when clients disconnect or streaming requests terminate prematurely.","antiPatternHeadline":"Detached Background Context Spawning and Goroutine Leaks in Chi HTTP Handlers","stars_count":91,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","golang","chi","concurrency","context","goroutines"],"exportEndpoints":{"claude":"/api/rules/go-chi-context-deadline-goroutine-lifecycle?format=claude","cursorMdc":"/api/rules/go-chi-context-deadline-goroutine-lifecycle?format=mdc","cursorrules":"/api/rules/go-chi-context-deadline-goroutine-lifecycle?format=cursor","windsurf":"/api/rules/go-chi-context-deadline-goroutine-lifecycle?format=windsurf","agents":"/api/rules/go-chi-context-deadline-goroutine-lifecycle?format=agents"}},{"id":"vite-6-environment-api-module-graph-isolation","title":"Vite 6 Environment API Module Graph and Runtime Isolation Standard","category":"frontend","severity":"critical","description":"Enforces strict isolation across Vite 6 environments (client, ssr, edge, and worker) via discrete module graphs, distinct resolution conditions, and environment-scoped plugin hooks. Eliminates cross-runtime contamination, Node polyfill leakage into browser bundles, and module cache poisoning in isomorphic enterprise applications.","antiPatternHeadline":"Monolithic Module Graph Resolution and Ambient Node Polyfill Leakage Across Isomorphic Boundaries","stars_count":98,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["vite","vite-6","environment-api","module-graph","bundler","ssr","typescript"],"exportEndpoints":{"claude":"/api/rules/vite-6-environment-api-module-graph-isolation?format=claude","cursorMdc":"/api/rules/vite-6-environment-api-module-graph-isolation?format=mdc","cursorrules":"/api/rules/vite-6-environment-api-module-graph-isolation?format=cursor","windsurf":"/api/rules/vite-6-environment-api-module-graph-isolation?format=windsurf","agents":"/api/rules/vite-6-environment-api-module-graph-isolation?format=agents"}},{"id":"sigstore-cosign-slsa-level-3-provenance-guardrail","title":"Sigstore Cosign & In-Toto SLSA Level 3 Cryptographic Provenance Invariant","category":"devops","severity":"critical","description":"Enforces strict keyless cryptographic signature verification and in-toto SLSA Level 3 provenance validation inside admission controllers (such as Kyverno or Sigstore Policy Controller) before any pod is scheduled in production. Workloads must resolve to immutable sha256 digests bound to ephemeral OIDC identity certificates rooted in Fulcio and recorded in the Rekor transparency log. Rejects mutable tags, unsigned blobs, and non-hardened builder environments lacking verifiable source-to-binary attestation.","antiPatternHeadline":"Admitting Unsigned Containers or Unverified Build Provenance into Production Clusters","stars_count":44,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","kubernetes","sigstore","cosign","slsa-l3","in-toto","security","supply-chain"],"exportEndpoints":{"claude":"/api/rules/sigstore-cosign-slsa-level-3-provenance-guardrail?format=claude","cursorMdc":"/api/rules/sigstore-cosign-slsa-level-3-provenance-guardrail?format=mdc","cursorrules":"/api/rules/sigstore-cosign-slsa-level-3-provenance-guardrail?format=cursor","windsurf":"/api/rules/sigstore-cosign-slsa-level-3-provenance-guardrail?format=windsurf","agents":"/api/rules/sigstore-cosign-slsa-level-3-provenance-guardrail?format=agents"}},{"id":"vite6-environment-api-runtime-sandboxing","title":"Vite 6 Environment API Hybrid Runtime Sandboxing","category":"frontend","severity":"critical","description":"Enforces strict module resolution, execution isolation, and runner virtualization across heterogeneous server runtimes (Workflows, Edge/workerd, Node.js) using the Vite 6 Environment API. Prevents runtime cross-contamination, global state bleed, and illegal platform-specific primitive leakage across concurrent SSR compilation targets.","antiPatternHeadline":"Monolithic SSR resolution leaking Node-specific primitives into Edge/Workflow environments via legacy server.ssrLoadModule APIs","stars_count":90,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["vite6","environment-api","ssr","runtime-isolation","edge-computing","workerd"],"exportEndpoints":{"claude":"/api/rules/vite6-environment-api-runtime-sandboxing?format=claude","cursorMdc":"/api/rules/vite6-environment-api-runtime-sandboxing?format=mdc","cursorrules":"/api/rules/vite6-environment-api-runtime-sandboxing?format=cursor","windsurf":"/api/rules/vite6-environment-api-runtime-sandboxing?format=windsurf","agents":"/api/rules/vite6-environment-api-runtime-sandboxing?format=agents"}},{"id":"tanstack-query-v5-stream-cancellation-gc-eviction","title":"TanStack Query v5 Stream Cancellation and Bounded Memory Eviction","category":"frontend","severity":"critical","description":"High-frequency streaming interfaces (SSE, WebSockets, or chunked transfer feeds) managed by TanStack Query v5 must explicitly link query cancellation tokens to the underlying transport abort protocol. Infinite streaming queries must configure strict sliding memory bounds using maxPages and deterministic garbage collection eviction timeouts (gcTime) to prevent runaway heap expansion and catastrophic browser tab crashes on unmount.","antiPatternHeadline":"Ignoring QueryFunctionContext.signal in streaming queries while accumulating unbounded infinite pages with unevicted cache lifetimes.","stars_count":78,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","tanstack-query","react-query","streaming","memory-management","sse","performance"],"exportEndpoints":{"claude":"/api/rules/tanstack-query-v5-stream-cancellation-gc-eviction?format=claude","cursorMdc":"/api/rules/tanstack-query-v5-stream-cancellation-gc-eviction?format=mdc","cursorrules":"/api/rules/tanstack-query-v5-stream-cancellation-gc-eviction?format=cursor","windsurf":"/api/rules/tanstack-query-v5-stream-cancellation-gc-eviction?format=windsurf","agents":"/api/rules/tanstack-query-v5-stream-cancellation-gc-eviction?format=agents"}},{"id":"axum-08-typed-state-graceful-draining-production-standard","title":"Axum 0.8 Typed State Extraction & Graceful Connection Draining Invariant","category":"backend","severity":"critical","description":"Enforces compile-time type-safe sub-state extraction via FromRef and deterministic connection draining bounded by hard termination deadlines in Axum 0.8. Guarantees leak-free thread handoffs and prevents orchestrator SIGKILL aborts during zero-downtime rolling deployments.","antiPatternHeadline":"Runtime Extension Extraction Failures and Unbounded Rolling Deploy Connection Freezes","stars_count":93,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tokio","zero-downtime","concurrency"],"exportEndpoints":{"claude":"/api/rules/axum-08-typed-state-graceful-draining-production-standard?format=claude","cursorMdc":"/api/rules/axum-08-typed-state-graceful-draining-production-standard?format=mdc","cursorrules":"/api/rules/axum-08-typed-state-graceful-draining-production-standard?format=cursor","windsurf":"/api/rules/axum-08-typed-state-graceful-draining-production-standard?format=windsurf","agents":"/api/rules/axum-08-typed-state-graceful-draining-production-standard?format=agents"}},{"id":"pg17-streaming-vacuum-freeze-horizon-management","title":"Postgres 17 Streaming Vacuum & Proactive XID Horizon Management","category":"backend","severity":"critical","description":"Enforces strict Transaction ID (XID) horizon tracking, adaptive per-table freeze limits, and Postgres 17 radix-tree vacuum buffer controls for high-throughput append-only workloads. Eliminates catastrophic stop-the-world anti-wraparound vacuum spikes by decoupling freeze cycles from generic autovacuum defaults and utilizing streaming memory management.","antiPatternHeadline":"Default Autovacuum Configuration on Multi-Terabyte Append Tables Causing Emergency Anti-Wraparound I/O Saturation","stars_count":62,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","postgres-17","database-performance","vacuum","xid-wraparound","typescript"],"exportEndpoints":{"claude":"/api/rules/pg17-streaming-vacuum-freeze-horizon-management?format=claude","cursorMdc":"/api/rules/pg17-streaming-vacuum-freeze-horizon-management?format=mdc","cursorrules":"/api/rules/pg17-streaming-vacuum-freeze-horizon-management?format=cursor","windsurf":"/api/rules/pg17-streaming-vacuum-freeze-horizon-management?format=windsurf","agents":"/api/rules/pg17-streaming-vacuum-freeze-horizon-management?format=agents"}},{"id":"clickhouse-arrow-flight-sql-zero-copy-ingestion-standard","title":"ClickHouse Arrow Flight SQL Zero-Copy Stream Ingestion Standard","category":"backend","severity":"critical","description":"Enforces direct columnar memory transfer from microservice partitions to ClickHouse analytics engines via Apache Arrow Flight SQL. Eliminates CPU serialization bottlenecks, heap memory amplification, and GC pressure by prohibiting row-by-row transformation and JSON string serialization during ingestion pipelines.","antiPatternHeadline":"Hydrating columnar memory buffers into row objects or JSON payloads prior to ingestion","stars_count":86,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","clickhouse","arrow-flight-sql","zero-copy","columnar-streaming","performance"],"exportEndpoints":{"claude":"/api/rules/clickhouse-arrow-flight-sql-zero-copy-ingestion-standard?format=claude","cursorMdc":"/api/rules/clickhouse-arrow-flight-sql-zero-copy-ingestion-standard?format=mdc","cursorrules":"/api/rules/clickhouse-arrow-flight-sql-zero-copy-ingestion-standard?format=cursor","windsurf":"/api/rules/clickhouse-arrow-flight-sql-zero-copy-ingestion-standard?format=windsurf","agents":"/api/rules/clickhouse-arrow-flight-sql-zero-copy-ingestion-standard?format=agents"}},{"id":"kmp-swift-export-arc-lifetime-synchronization","title":"KMP 2.1 Swift Export Cross-Runtime ARC/GC Lifetime Synchronization","category":"mobile","severity":"critical","description":"Enforces strict memory boundary management between Kotlin/Native's modern concurrent GC and Swift ARC when using KMP 2.1 Swift Export. Prohibits cross-runtime strong reference cycles caused by bidirectional delegation, long-lived observer callbacks, and unbounded native view bindings. Mandates explicit teardown protocols, unowned/weak Swift proxies, and CoroutineScope lifecycle anchoring to prevent cross-language heap leaks.","antiPatternHeadline":"Cross-Language Retain Cycles via Strong Delegation and Unbounded Coroutine Bridge Observers","stars_count":63,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","swift-export","arc","memory-management","concurrency"],"exportEndpoints":{"claude":"/api/rules/kmp-swift-export-arc-lifetime-synchronization?format=claude","cursorMdc":"/api/rules/kmp-swift-export-arc-lifetime-synchronization?format=mdc","cursorrules":"/api/rules/kmp-swift-export-arc-lifetime-synchronization?format=cursor","windsurf":"/api/rules/kmp-swift-export-arc-lifetime-synchronization?format=windsurf","agents":"/api/rules/kmp-swift-export-arc-lifetime-synchronization?format=agents"}},{"id":"react-native-nitro-zero-copy-memory-bridge","title":"React Native 0.76 Nitro Modules Zero-Copy Direct Memory Bridge Standard","category":"mobile","severity":"critical","description":"Enforces zero-copy byte-level buffer sharing between native graphics/audio threads and Hermes JavaScript via Nitro Modules C++ ArrayBuffers. Prohibits base64 stringification, JSON serialization, and unmanaged raw pointer lifetime hazards that induce SIGSEGV or bridge stalls.","antiPatternHeadline":"Serializing High-Frequency Binary Streams via Base64/JSON Strings and Dangling Raw Pointers Across Native-Hermes Boundaries","stars_count":96,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","react-native","nitro-modules","jsi","c++","hermes","zero-copy","sharedarraybuffer"],"exportEndpoints":{"claude":"/api/rules/react-native-nitro-zero-copy-memory-bridge?format=claude","cursorMdc":"/api/rules/react-native-nitro-zero-copy-memory-bridge?format=mdc","cursorrules":"/api/rules/react-native-nitro-zero-copy-memory-bridge?format=cursor","windsurf":"/api/rules/react-native-nitro-zero-copy-memory-bridge?format=windsurf","agents":"/api/rules/react-native-nitro-zero-copy-memory-bridge?format=agents"}},{"id":"cosign-oidc-slsa-verification-gate","title":"Cosign Keyless OIDC Identity Verification and SLSA Provenance Gate","category":"security","severity":"critical","description":"Enforces non-repudiable container build provenance verification at the admission controller stage without managing long-lived signing keys. Validates short-lived Fulcio certificates issued via OIDC Workload Identity against immutable Rekor transparency log entries and evaluates cryptographic SLSA Level 3 attestations before permitting deployment execution.","antiPatternHeadline":"Bypassing Keyless Verification by Trusting Static Long-Lived Asymmetric Keys or Mutable Image Tags Without Transparency Log Enforcement","stars_count":113,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","sigstore","cosign","slsa","kubernetes","admission-control","supply-chain"],"exportEndpoints":{"claude":"/api/rules/cosign-oidc-slsa-verification-gate?format=claude","cursorMdc":"/api/rules/cosign-oidc-slsa-verification-gate?format=mdc","cursorrules":"/api/rules/cosign-oidc-slsa-verification-gate?format=cursor","windsurf":"/api/rules/cosign-oidc-slsa-verification-gate?format=windsurf","agents":"/api/rules/cosign-oidc-slsa-verification-gate?format=agents"}},{"id":"k8s-gateway-api-v1-2-cross-namespace-delegation","title":"Kubernetes Gateway API v1.2 Cross-Namespace L7 Route Delegation & Canary Invariants","category":"devops","severity":"critical","description":"Enforces strict RBAC boundary separation between platform teams and multi-tenant application developers using Gateway API v1.2 route delegation. Mandates that root Gateway listeners delegate path-prefixes via explicit ReferenceGrants, prohibiting application teams from binding directly to root gateways while preserving zero-trust canary weights and fallback routing.","antiPatternHeadline":"Direct Gateway-to-Service Binding and Unscoped Cross-Namespace Route Hijacking","stars_count":52,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["kubernetes","gateway-api","zero-trust","canary","referencegrant","rbac"],"exportEndpoints":{"claude":"/api/rules/k8s-gateway-api-v1-2-cross-namespace-delegation?format=claude","cursorMdc":"/api/rules/k8s-gateway-api-v1-2-cross-namespace-delegation?format=mdc","cursorrules":"/api/rules/k8s-gateway-api-v1-2-cross-namespace-delegation?format=cursor","windsurf":"/api/rules/k8s-gateway-api-v1-2-cross-namespace-delegation?format=windsurf","agents":"/api/rules/k8s-gateway-api-v1-2-cross-namespace-delegation?format=agents"}},{"id":"react-19-use-action-state-concurrent-rollback-guardrails","title":"React 19 useActionState Concurrent Optimistic Mutation & Deterministic Rollback Guardrails","category":"frontend","severity":"critical","description":"Enforces strict monotonic sequencing and transactional reconciliation when combining React 19 useActionState and useOptimistic across concurrent Server Action invocations. Prevents race conditions, out-of-order resolution overwrites, and unhandled state wedging during network failures or rollback sequences.","antiPatternHeadline":"Out-of-Order Flight Overwrites and Wedged Optimistic UI States in Concurrent Server Action Pipelines","stars_count":73,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","use-action-state","use-optimistic","server-actions","concurrency","state-reconciliation"],"exportEndpoints":{"claude":"/api/rules/react-19-use-action-state-concurrent-rollback-guardrails?format=claude","cursorMdc":"/api/rules/react-19-use-action-state-concurrent-rollback-guardrails?format=mdc","cursorrules":"/api/rules/react-19-use-action-state-concurrent-rollback-guardrails?format=cursor","windsurf":"/api/rules/react-19-use-action-state-concurrent-rollback-guardrails?format=windsurf","agents":"/api/rules/react-19-use-action-state-concurrent-rollback-guardrails?format=agents"}},{"id":"svelte-5-runes-microtask-cycle-detection","title":"Svelte 5 Runes Reactive Graph Microtask Flush Cycle Prevention","category":"frontend","severity":"critical","description":"Enforces strict acyclic dependency topology in Svelte 5 reactive graphs to eliminate microtask flush loops (ERR_SVELTE_TOO_MANY_UPDATES) and runtime re-entrancy bugs. Prohibits state synchronization through side-effect loops, mandating pure derived computations ($derived / $derived.by) and explicit untracked boundary guards.","antiPatternHeadline":"Mutating Reactive Runes Inside Unbounded $effect Chains Causing Infinite Microtask Batches","stars_count":80,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","reactivity","signals","performance"],"exportEndpoints":{"claude":"/api/rules/svelte-5-runes-microtask-cycle-detection?format=claude","cursorMdc":"/api/rules/svelte-5-runes-microtask-cycle-detection?format=mdc","cursorrules":"/api/rules/svelte-5-runes-microtask-cycle-detection?format=cursor","windsurf":"/api/rules/svelte-5-runes-microtask-cycle-detection?format=windsurf","agents":"/api/rules/svelte-5-runes-microtask-cycle-detection?format=agents"}},{"id":"nextjs-15-dynamic-io-cache-determinism","title":"Next.js 15 Dynamic I/O Cache Determinism & Uncached IO Quarantine","category":"backend","severity":"critical","description":"Enforces strict isolation between static prerenders and dynamic runtime operations under Next.js 15 Dynamic I/O (experimental.dynamicIO). Guarantees that uncached operations like raw database queries, cookies, and headers are quarantined behind explicit connection boundaries and Suspense fallbacks, while deterministic data paths leverage explicit 'use cache' directives with deterministic cacheLife and cacheTag declarations.","antiPatternHeadline":"Leaking Dynamic Primitives or Uncached Async I/O into Prerenderable Component Subtrees","stars_count":114,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","nextjs-15","dynamic-io","cache-determinism","server-components","performance"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-dynamic-io-cache-determinism?format=claude","cursorMdc":"/api/rules/nextjs-15-dynamic-io-cache-determinism?format=mdc","cursorrules":"/api/rules/nextjs-15-dynamic-io-cache-determinism?format=cursor","windsurf":"/api/rules/nextjs-15-dynamic-io-cache-determinism?format=windsurf","agents":"/api/rules/nextjs-15-dynamic-io-cache-determinism?format=agents"}},{"id":"postgres-17-json-table-memory-bounds","title":"Deterministic Memory Quotas and Disk-Spill Prevention for Postgres 17 JSON_TABLE","category":"backend","severity":"critical","description":"Enforces deterministic work_mem allocation and chunked streaming execution for Postgres 17 JSON_TABLE projections. Prevents uncontrolled temp file disk spilling and worker process OOM terminations when transforming high-throughput semi-structured JSON payloads into relational tuples.","antiPatternHeadline":"Monolithic In-Memory JSON Deserialization and Unbounded Projections Inducing Temp Disk Spilling","stars_count":92,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres","postgres-17","json-table","memory-management","high-throughput"],"exportEndpoints":{"claude":"/api/rules/postgres-17-json-table-memory-bounds?format=claude","cursorMdc":"/api/rules/postgres-17-json-table-memory-bounds?format=mdc","cursorrules":"/api/rules/postgres-17-json-table-memory-bounds?format=cursor","windsurf":"/api/rules/postgres-17-json-table-memory-bounds?format=windsurf","agents":"/api/rules/postgres-17-json-table-memory-bounds?format=agents"}},{"id":"fastapi-taskgroup-structural-isolation-standard","title":"FastAPI Async Native TaskGroup Concurrency Structural Isolation","category":"backend","severity":"critical","description":"Enforces structured concurrency invariants across FastAPI asynchronous request handlers using Python 3.12+ asyncio.TaskGroup. Mandates fail-fast cooperative cancellation, strict ExceptionGroup unwrapping, and deterministic cleanup to eliminate orphaned background coroutines and unbounded connection leaks during fan-out execution.","antiPatternHeadline":"Orphaned coroutine leakage and silent background execution via asyncio.gather with return_exceptions or unmanaged create_task fan-out","stars_count":70,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","python","asyncio","taskgroup","structured-concurrency","resilience"],"exportEndpoints":{"claude":"/api/rules/fastapi-taskgroup-structural-isolation-standard?format=claude","cursorMdc":"/api/rules/fastapi-taskgroup-structural-isolation-standard?format=mdc","cursorrules":"/api/rules/fastapi-taskgroup-structural-isolation-standard?format=cursor","windsurf":"/api/rules/fastapi-taskgroup-structural-isolation-standard?format=windsurf","agents":"/api/rules/fastapi-taskgroup-structural-isolation-standard?format=agents"}},{"id":"tauri-mobile-ipc-capability-acl-sandboxing","title":"Tauri 2.0 Mobile IPC Capability ACL Sandboxing","category":"mobile","severity":"critical","description":"Enforces principle-of-least-privilege Access Control Lists (ACL) and compile-time capability sandboxing for Tauri 2.0 mobile bridges. Restricts hybrid WebView IPC access to prevent cross-context script injection and unauthorized native capability invocation on iOS and Android targets.","antiPatternHeadline":"Exposing Wildcard IPC Capabilities or Global Plugin Grants to Mobile WebViews","stars_count":101,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri","security","ipc","acl","sandboxing"],"exportEndpoints":{"claude":"/api/rules/tauri-mobile-ipc-capability-acl-sandboxing?format=claude","cursorMdc":"/api/rules/tauri-mobile-ipc-capability-acl-sandboxing?format=mdc","cursorrules":"/api/rules/tauri-mobile-ipc-capability-acl-sandboxing?format=cursor","windsurf":"/api/rules/tauri-mobile-ipc-capability-acl-sandboxing?format=windsurf","agents":"/api/rules/tauri-mobile-ipc-capability-acl-sandboxing?format=agents"}},{"id":"capacitor-7-background-runner-memory-safety-contract","title":"Capacitor 7 Background Runner Web Worker Memory-Safety Contract","category":"mobile","severity":"critical","description":"Enforces isolated, memory-bounded headless execution contexts within Capacitor 7 Background Runner tasks. Prohibits state retention across thread dispatches, unbounded buffer serialization, and persistent global references that trigger iOS Jetsam or Android Low Memory Killer (LMK) process terminations.","antiPatternHeadline":"Retaining Stateful Closures and Unbounded Payloads in Headless Background Contexts Leading to OS OOM Kills","stars_count":54,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","background-runner","memory-safety","android-lmk","jetsam","web-worker"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-background-runner-memory-safety-contract?format=claude","cursorMdc":"/api/rules/capacitor-7-background-runner-memory-safety-contract?format=mdc","cursorrules":"/api/rules/capacitor-7-background-runner-memory-safety-contract?format=cursor","windsurf":"/api/rules/capacitor-7-background-runner-memory-safety-contract?format=windsurf","agents":"/api/rules/capacitor-7-background-runner-memory-safety-contract?format=agents"}},{"id":"webauthn-prf-zk-e2ee-key-derivation-standard","title":"Zero-Knowledge Hardware-Bound Key Derivation via WebAuthn PRF Extension","category":"security","severity":"critical","description":"Enforces cryptographic invariants when deriving client-side End-to-End Encryption (E2EE) root keys from WebAuthn Pseudo-Random Function (PRF) extension outputs (HMAC-secret). Mandates zero-knowledge isolation ensuring neither PRF salt inputs, intermediate PRF outputs, nor derived key encryption keys (KEKs) leak across network boundaries or unmanaged volatile memory buffers.","antiPatternHeadline":"Leaking PRF outputs to authentication servers or directly using raw PRF symmetric outputs as symmetric data encryption keys (DEKs)","stars_count":115,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","prf-extension","e2ee","cryptography","zero-knowledge"],"exportEndpoints":{"claude":"/api/rules/webauthn-prf-zk-e2ee-key-derivation-standard?format=claude","cursorMdc":"/api/rules/webauthn-prf-zk-e2ee-key-derivation-standard?format=mdc","cursorrules":"/api/rules/webauthn-prf-zk-e2ee-key-derivation-standard?format=cursor","windsurf":"/api/rules/webauthn-prf-zk-e2ee-key-derivation-standard?format=windsurf","agents":"/api/rules/webauthn-prf-zk-e2ee-key-derivation-standard?format=agents"}},{"id":"cosign-ephemeral-oidc-keyless-attestation","title":"Sigstore Cosign Ephemeral OIDC Keyless Attestation in Hermetic CI","category":"security","severity":"critical","description":"Mandates the use of Sigstore Cosign keyless signing via ambient OIDC identity providers and ephemeral X.509 Fulcio certificates for all containerized build artifacts. Prohibits static long-lived signing keys in CI runner secrets, enforcing cryptographic provenance verification against Rekor transparency logs using immutable SHA256 image digests.","antiPatternHeadline":"Using Long-Lived Static Private Keys and Mutable Image Tags for Artifact Signing","stars_count":52,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","sigstore","cosign","supply-chain","oidc","containers","ci-cd"],"exportEndpoints":{"claude":"/api/rules/cosign-ephemeral-oidc-keyless-attestation?format=claude","cursorMdc":"/api/rules/cosign-ephemeral-oidc-keyless-attestation?format=mdc","cursorrules":"/api/rules/cosign-ephemeral-oidc-keyless-attestation?format=cursor","windsurf":"/api/rules/cosign-ephemeral-oidc-keyless-attestation?format=windsurf","agents":"/api/rules/cosign-ephemeral-oidc-keyless-attestation?format=agents"}},{"id":"ebpf-opentelemetry-w3c-trace-propagation","title":"Kernel-Level eBPF W3C Trace Context Auto-Propagation & Socket Injection","category":"devops","severity":"critical","description":"Enforces strict protocol invariants and memory boundaries for transparent W3C trace context (traceparent/tracestate) injection at the Linux kernel socket layer via eBPF sockops and TC/sk_msg filters. Prevents payload corruption, protocol desynchronization, and broken distributed trace lineages across sidecarless microservices without introducing application runtime overhead.","antiPatternHeadline":"Blind socket payload prepending and unvalidated TCP window shifts in eBPF sock_ops trace injectors","stars_count":76,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","opentelemetry","w3c-trace-context","observability","linux-kernel"],"exportEndpoints":{"claude":"/api/rules/ebpf-opentelemetry-w3c-trace-propagation?format=claude","cursorMdc":"/api/rules/ebpf-opentelemetry-w3c-trace-propagation?format=mdc","cursorrules":"/api/rules/ebpf-opentelemetry-w3c-trace-propagation?format=cursor","windsurf":"/api/rules/ebpf-opentelemetry-w3c-trace-propagation?format=windsurf","agents":"/api/rules/ebpf-opentelemetry-w3c-trace-propagation?format=agents"}},{"id":"nextjs-15-ppr-shell-hydration-boundary-invariant","title":"Next.js 15 PPR Static Shell & Dynamic Hole Hydration Invariant","category":"frontend","severity":"critical","description":"Next.js 15 Partial Prerendering (PPR) combines a deterministic static HTML shell generated at build time with edge-streamed dynamic holes. Invoking dynamic APIs (cookies(), headers(), connection(), or uncached async queries) outside an explicit React Suspense boundary collapses the static shell, causing edge CDN cache poisoning or total de-optimization to dynamic rendering.","antiPatternHeadline":"Leaking Dynamic Request Primitives into Root Shell Trees Outside Suspense Boundaries","stars_count":71,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs-15","partial-prerendering","suspense","cdn-caching","edge-streaming"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-ppr-shell-hydration-boundary-invariant?format=claude","cursorMdc":"/api/rules/nextjs-15-ppr-shell-hydration-boundary-invariant?format=mdc","cursorrules":"/api/rules/nextjs-15-ppr-shell-hydration-boundary-invariant?format=cursor","windsurf":"/api/rules/nextjs-15-ppr-shell-hydration-boundary-invariant?format=windsurf","agents":"/api/rules/nextjs-15-ppr-shell-hydration-boundary-invariant?format=agents"}},{"id":"fastapi-lifespan-async-resource-drain-standard","title":"FastAPI Lifespan Async Resource Cleanup & Signal Drain Standard","category":"backend","severity":"critical","description":"Mandates strict async resource lifecycle management via FastAPI lifespan context managers to prevent socket leaks, aborted transactions, and dropped traces during Kubernetes SIGTERM rolling deployments. Guarantees that in-flight requests, connection pools, streaming tasks, and telemetry exporters safely drain and shut down within bounded timeouts.","antiPatternHeadline":"Unmanaged background tasks and deprecated on_event hooks abruptly severed by SIGTERM causing orphaned connections and corrupted state","stars_count":66,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["fastapi","asyncio","python","kubernetes","lifespan","graceful-shutdown","database-pools"],"exportEndpoints":{"claude":"/api/rules/fastapi-lifespan-async-resource-drain-standard?format=claude","cursorMdc":"/api/rules/fastapi-lifespan-async-resource-drain-standard?format=mdc","cursorrules":"/api/rules/fastapi-lifespan-async-resource-drain-standard?format=cursor","windsurf":"/api/rules/fastapi-lifespan-async-resource-drain-standard?format=windsurf","agents":"/api/rules/fastapi-lifespan-async-resource-drain-standard?format=agents"}},{"id":"android-16kb-page-size-alignment-standard","title":"Android 15 16KB Page Size ELF Native Library Memory Alignment Standard","category":"mobile","severity":"critical","description":"Enforces strict 16KB (16384-byte) ELF segment memory boundary alignment across all compiled C/C++ native dependencies (.so) and packaging configurations. Prevents immediate runtime SIGSEGV aborts and dynamic linker rejection on Android 15 devices running 16KB page size kernels. Mandates modern NDK toolchains, explicit linker max-page-size flags, and 16KB-compatible zip alignment.","antiPatternHeadline":"Shipping 4KB-aligned native libraries or legacy APK packaging causing linker crashes on 16KB Android 15 kernels","stars_count":58,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","android","ndk","android-15","16kb-pages","cmake","c-cpp","elf-alignment"],"exportEndpoints":{"claude":"/api/rules/android-16kb-page-size-alignment-standard?format=claude","cursorMdc":"/api/rules/android-16kb-page-size-alignment-standard?format=mdc","cursorrules":"/api/rules/android-16kb-page-size-alignment-standard?format=cursor","windsurf":"/api/rules/android-16kb-page-size-alignment-standard?format=windsurf","agents":"/api/rules/android-16kb-page-size-alignment-standard?format=agents"}},{"id":"webauthn-prf-zk-key-derivation-standard-webauthn-prf-ext-194","title":"WebAuthn PRF Extension Zero-Knowledge Master Key Derivation Standard","category":"security","severity":"critical","description":"Enforces strict client-side derivation of zero-knowledge symmetric master keys using the WebAuthn Pseudo-Random Function (PRF) extension. Mandates that PRF output bytes never cross the network boundary to Relying Party (RP) servers, requires HKDF domain separation for secondary key expansion, and enforces non-extractable WebCrypto key representations.","antiPatternHeadline":"Exposing Raw Authenticator PRF Outputs to Backend Servers or Reusing PRF Entropy Directly as Symmetric Cipher Keys","stars_count":45,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","prf-extension","zero-knowledge","cryptography","webcrypto"],"exportEndpoints":{"claude":"/api/rules/webauthn-prf-zk-key-derivation-standard-webauthn-prf-ext-194?format=claude","cursorMdc":"/api/rules/webauthn-prf-zk-key-derivation-standard-webauthn-prf-ext-194?format=mdc","cursorrules":"/api/rules/webauthn-prf-zk-key-derivation-standard-webauthn-prf-ext-194?format=cursor","windsurf":"/api/rules/webauthn-prf-zk-key-derivation-standard-webauthn-prf-ext-194?format=windsurf","agents":"/api/rules/webauthn-prf-zk-key-derivation-standard-webauthn-prf-ext-194?format=agents"}},{"id":"otel-w3c-tracecontext-partitioned-mesh-invariant","title":"OTel W3C TraceContext Ingestion and Propagation Invariant for Partitioned Event Meshes","category":"devops","severity":"critical","description":"Enforces strict extraction and propagation of W3C TraceContext (traceparent, tracestate) across high-throughput Kafka topic partition rebalances and asynchronous Dead-Letter Queue (DLQ) routing. Prevents distributed trace fragmentation, disconnected parent spans, and orphaned transactional traces across asynchronous boundary handoffs.","antiPatternHeadline":"Implicit ambient context inheritance and unlinked DLQ message routing during Kafka partition consumption","stars_count":62,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","kafka","distributed-tracing","w3c-tracecontext","observability"],"exportEndpoints":{"claude":"/api/rules/otel-w3c-tracecontext-partitioned-mesh-invariant?format=claude","cursorMdc":"/api/rules/otel-w3c-tracecontext-partitioned-mesh-invariant?format=mdc","cursorrules":"/api/rules/otel-w3c-tracecontext-partitioned-mesh-invariant?format=cursor","windsurf":"/api/rules/otel-w3c-tracecontext-partitioned-mesh-invariant?format=windsurf","agents":"/api/rules/otel-w3c-tracecontext-partitioned-mesh-invariant?format=agents"}},{"id":"postgres-17-concurrent-merge-deterministic-row-locking-standard","title":"Postgres 17 Concurrent MERGE Deterministic Row-Locking Standard","category":"backend","severity":"critical","description":"Enforces strict deterministic ordering on surrogate keys for all batch MERGE statements and their supporting Common Table Expressions (CTEs) in PostgreSQL 17. Unordered set processing across concurrent microservices causes interleaved tuple evaluation, triggering cyclic lock dependencies and fatal deadlocks (SQLSTATE 40P01). All batch inputs MUST be sorted by primary key prior to evaluation and locked in an ascending or uniform direction.","antiPatternHeadline":"Unordered Batch MERGE Ingestion Inducing Circular Lock Dependencies (Deadlock 40P01)","stars_count":40,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","postgres-17","concurrency","locking","deadlock-prevention","database-architecture"],"exportEndpoints":{"claude":"/api/rules/postgres-17-concurrent-merge-deterministic-row-locking-standard?format=claude","cursorMdc":"/api/rules/postgres-17-concurrent-merge-deterministic-row-locking-standard?format=mdc","cursorrules":"/api/rules/postgres-17-concurrent-merge-deterministic-row-locking-standard?format=cursor","windsurf":"/api/rules/postgres-17-concurrent-merge-deterministic-row-locking-standard?format=windsurf","agents":"/api/rules/postgres-17-concurrent-merge-deterministic-row-locking-standard?format=agents"}},{"id":"tauri-v2-scoped-ipc-capability-allowlist","title":"Tauri 2.0 Webview Scoped IPC Capability & Origin Isolation Standard","category":"security","severity":"critical","description":"Enforces strict capability-based access control and origin isolation for Tauri 2.0 IPC bridges. Host-level Rust commands and native plugin APIs must be locked down to verified local origins with zero-trust capability files, preventing Remote Code Execution (RCE) via untrusted web assets or compromised remote origins.","antiPatternHeadline":"Unscoped IPC capabilities granting native Rust execution to wildcard windows or remote origins.","stars_count":87,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","tauri-2","ipc","capabilities","remote-code-execution"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-scoped-ipc-capability-allowlist?format=claude","cursorMdc":"/api/rules/tauri-v2-scoped-ipc-capability-allowlist?format=mdc","cursorrules":"/api/rules/tauri-v2-scoped-ipc-capability-allowlist?format=cursor","windsurf":"/api/rules/tauri-v2-scoped-ipc-capability-allowlist?format=windsurf","agents":"/api/rules/tauri-v2-scoped-ipc-capability-allowlist?format=agents"}},{"id":"drizzle-serverless-pgbouncer-prepared-statement-invariant","title":"Drizzle ORM Serverless Transaction-Pool Prepared Statement Invariant","category":"backend","severity":"critical","description":"Enforces explicit disabling of named prepared statements and caps connection allocations when connecting Drizzle ORM to transaction-mode connection poolers such as PgBouncer, Supabase Pooler, or AWS RDS Proxy. Prevents SQLSTATE 42P05 collisions, cross-client state contamination, and ephemeral serverless socket exhaustion. Mandates strict client configuration for postgres.js, node-postgres, and serverless edge adapters.","antiPatternHeadline":"Instantiating Drizzle ORM in serverless runtimes using default driver options, triggering duplicate prepared statement exceptions (42P05) and pooler socket exhaustion.","stars_count":113,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","drizzle-orm","pgbouncer","serverless","postgresql","connection-pooling"],"exportEndpoints":{"claude":"/api/rules/drizzle-serverless-pgbouncer-prepared-statement-invariant?format=claude","cursorMdc":"/api/rules/drizzle-serverless-pgbouncer-prepared-statement-invariant?format=mdc","cursorrules":"/api/rules/drizzle-serverless-pgbouncer-prepared-statement-invariant?format=cursor","windsurf":"/api/rules/drizzle-serverless-pgbouncer-prepared-statement-invariant?format=windsurf","agents":"/api/rules/drizzle-serverless-pgbouncer-prepared-statement-invariant?format=agents"}},{"id":"rn-bridgeless-jsi-state-sync-standard","title":"React Native Bridgeless JSI Thread-Safe State Synchronization & Lifecycle Guardrail","category":"mobile","severity":"critical","description":"Enforces deterministic, thread-safe memory management and lifecycle unbinding between the Hermes JS runtime and native C++ TurboModules in Bridgeless mode. Guarantees atomic teardown of JSI HostObjects and HostFunctions to eliminate dangling raw pointers (use-after-free) and race conditions during rapid component unmount cycles across concurrent execution threads.","antiPatternHeadline":"Asynchronous or Unprotected Teardown of Native C++ JSI References in Bridgeless Runtimes","stars_count":63,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","react-native","turbomodules","jsi","c++","memory-safety","bridgeless"],"exportEndpoints":{"claude":"/api/rules/rn-bridgeless-jsi-state-sync-standard?format=claude","cursorMdc":"/api/rules/rn-bridgeless-jsi-state-sync-standard?format=mdc","cursorrules":"/api/rules/rn-bridgeless-jsi-state-sync-standard?format=cursor","windsurf":"/api/rules/rn-bridgeless-jsi-state-sync-standard?format=windsurf","agents":"/api/rules/rn-bridgeless-jsi-state-sync-standard?format=agents"}},{"id":"react-19-server-actions-concurrent-optimistic-reconciliation","title":"Deterministic Action Queuing & Rollback Idempotency in React 19 Optimistic Mutations","category":"frontend","severity":"critical","description":"Enforces deterministic action sequencing, monotonic state reconciliation, and transactional rollback semantics during concurrent React 19 Server Action execution. Prevents UI tearing, state drift, and race-conditioned stale overwrites during rapid asynchronous user interactions by mandating native useOptimistic and useActionState primitives wrapped inside concurrent transitions.","antiPatternHeadline":"Unsequenced Fire-and-Forget Server Actions with Manual Desynchronized Optimistic State","stars_count":90,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","server-actions","optimistic-ui","concurrency","typescript"],"exportEndpoints":{"claude":"/api/rules/react-19-server-actions-concurrent-optimistic-reconciliation?format=claude","cursorMdc":"/api/rules/react-19-server-actions-concurrent-optimistic-reconciliation?format=mdc","cursorrules":"/api/rules/react-19-server-actions-concurrent-optimistic-reconciliation?format=cursor","windsurf":"/api/rules/react-19-server-actions-concurrent-optimistic-reconciliation?format=windsurf","agents":"/api/rules/react-19-server-actions-concurrent-optimistic-reconciliation?format=agents"}},{"id":"fastapi-anyio-structured-concurrency-lifespan-standard","title":"FastAPI AnyIO Structured Concurrency and Deterministic Lifespan Standard","category":"backend","severity":"critical","description":"Enforces structured concurrency across FastAPI application lifespans and asynchronous request boundaries via AnyIO TaskGroups. Eliminates orphan background task leaks, guarantees deterministic cancellation propagation, and prevents connection pool exhaustion or use-after-free conditions during process termination.","antiPatternHeadline":"Spawning detached asyncio.create_task coroutines and closing shared database or network pools prior to background task termination","stars_count":106,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["fastapi","anyio","structured-concurrency","lifespan","asyncio","connection-pools"],"exportEndpoints":{"claude":"/api/rules/fastapi-anyio-structured-concurrency-lifespan-standard?format=claude","cursorMdc":"/api/rules/fastapi-anyio-structured-concurrency-lifespan-standard?format=mdc","cursorrules":"/api/rules/fastapi-anyio-structured-concurrency-lifespan-standard?format=cursor","windsurf":"/api/rules/fastapi-anyio-structured-concurrency-lifespan-standard?format=windsurf","agents":"/api/rules/fastapi-anyio-structured-concurrency-lifespan-standard?format=agents"}},{"id":"postgres-17-synchronized-failover-slots-guardrail","title":"Postgres 17 Synchronized Logical Replication Failover Slots Guardrail","category":"backend","severity":"critical","description":"Enforces Postgres 17 failover-ready logical replication slots by mandating the failover flag on physical primaries, configuring standby sync slots, and binding logical slots to physical replication standby slots via synchronized slot machinery. Guarantees zero change-data-capture message loss, prevents WAL bloat, and avoids downstream subscriber divergence during HA promotion.","antiPatternHeadline":"Creating unsynchronized logical slots without failover-enablement or standby synchronization in Postgres 17 topologies","stars_count":41,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres-17","cdc","logical-replication","failover-slots","high-availability"],"exportEndpoints":{"claude":"/api/rules/postgres-17-synchronized-failover-slots-guardrail?format=claude","cursorMdc":"/api/rules/postgres-17-synchronized-failover-slots-guardrail?format=mdc","cursorrules":"/api/rules/postgres-17-synchronized-failover-slots-guardrail?format=cursor","windsurf":"/api/rules/postgres-17-synchronized-failover-slots-guardrail?format=windsurf","agents":"/api/rules/postgres-17-synchronized-failover-slots-guardrail?format=agents"}},{"id":"drizzle-zero-downtime-dual-write-schema-evolution","title":"Drizzle ORM Zero-Downtime Dual-Write Schema Evolution Guardrail","category":"backend","severity":"critical","description":"Enforces the expand-and-contract pattern for Drizzle ORM schema modifications in high-concurrency 24/7 OLTP environments. Strictly prevents atomic in-place column renames, type mutations, and immediate column drops that cause downtime across phased application fleet rollouts. Mandates explicit multi-phase dual-writing, non-destructive migration sequences, and type-safe schema fallback readers.","antiPatternHeadline":"Executing in-place schema column renames or destructive drops directly in Drizzle ORM definitions during rolling deployments.","stars_count":58,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","drizzle-orm","zero-downtime","database-migrations","typescript","postgresql","oltp"],"exportEndpoints":{"claude":"/api/rules/drizzle-zero-downtime-dual-write-schema-evolution?format=claude","cursorMdc":"/api/rules/drizzle-zero-downtime-dual-write-schema-evolution?format=mdc","cursorrules":"/api/rules/drizzle-zero-downtime-dual-write-schema-evolution?format=cursor","windsurf":"/api/rules/drizzle-zero-downtime-dual-write-schema-evolution?format=windsurf","agents":"/api/rules/drizzle-zero-downtime-dual-write-schema-evolution?format=agents"}},{"id":"kmp-swift6-actor-bridge-isolation-standard","title":"Kotlin Multiplatform Swift 6 Actor Bridge Isolation Standard","category":"mobile","severity":"critical","description":"Enforces strict Swift 6 actor isolation boundaries over Kotlin Multiplatform (KMP) coroutine dispatchers and shared native references. Eliminates memory corruption, thread deadlocks, and data races caused by escaping non-Sendable Objective-C bridged pointers into Swift concurrency domains.","antiPatternHeadline":"Escaping Non-Sendable Kotlin Native References Across Swift 6 Structured Concurrency Domains","stars_count":108,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kmp","swift6","kotlin-native","actors","concurrency"],"exportEndpoints":{"claude":"/api/rules/kmp-swift6-actor-bridge-isolation-standard?format=claude","cursorMdc":"/api/rules/kmp-swift6-actor-bridge-isolation-standard?format=mdc","cursorrules":"/api/rules/kmp-swift6-actor-bridge-isolation-standard?format=cursor","windsurf":"/api/rules/kmp-swift6-actor-bridge-isolation-standard?format=windsurf","agents":"/api/rules/kmp-swift6-actor-bridge-isolation-standard?format=agents"}},{"id":"react-native-078-jsi-memory-pinning-guardrail","title":"React Native 0.78 JSI HostObject Memory Pinning and Thread Safety Guardrail","category":"mobile","severity":"critical","description":"Enforces strict memory pinning invariants and thread-affinity separation between Hermes JavaScript runtime execution, Fabric UI shadow tree state mutators, and asynchronous TurboModule C++ workers. Eliminates double-free crashes (SIGSEGV/SIGABRT) caused by raw jsi::Value captures and unpinned jsi::HostObject lifecycle cross-talk in React Native 0.78 New Architecture codebases.","antiPatternHeadline":"Dangling JSI Pointer Dereference & Double-Free via Unpinned HostObject Capture Across Threads","stars_count":116,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","react-native","new-architecture","turbo-modules","fabric","c++","jsi","memory-management"],"exportEndpoints":{"claude":"/api/rules/react-native-078-jsi-memory-pinning-guardrail?format=claude","cursorMdc":"/api/rules/react-native-078-jsi-memory-pinning-guardrail?format=mdc","cursorrules":"/api/rules/react-native-078-jsi-memory-pinning-guardrail?format=cursor","windsurf":"/api/rules/react-native-078-jsi-memory-pinning-guardrail?format=windsurf","agents":"/api/rules/react-native-078-jsi-memory-pinning-guardrail?format=agents"}},{"id":"webauthn-device-bound-passkey-downgrade-prevention-standard","title":"WebAuthn Device-Bound Attestation and Step-Up Downgrade Prevention Standard","category":"security","severity":"critical","description":"Enforces strict validation of authenticator attestation flags, authenticator data bitmasks (UV, UP, BE, BS), and cryptographic step-up challenges during WebAuthn ceremonies. Neutralizes passkey downgrade attacks, cross-device sync relays, and unauthorized silent authentication by cryptographically binding sessions exclusively to hardware-backed authenticators when high-assurance operations are requested.","antiPatternHeadline":"Blind Registration of Multi-Device Synced Passkeys Without Attestation and Flag Verification for High-Assurance Endpoints","stars_count":54,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","fido2","passkeys","cryptography","zero-trust"],"exportEndpoints":{"claude":"/api/rules/webauthn-device-bound-passkey-downgrade-prevention-standard?format=claude","cursorMdc":"/api/rules/webauthn-device-bound-passkey-downgrade-prevention-standard?format=mdc","cursorrules":"/api/rules/webauthn-device-bound-passkey-downgrade-prevention-standard?format=cursor","windsurf":"/api/rules/webauthn-device-bound-passkey-downgrade-prevention-standard?format=windsurf","agents":"/api/rules/webauthn-device-bound-passkey-downgrade-prevention-standard?format=agents"}},{"id":"ebpf-lsm-container-privilege-escalation-guardrail-ebpf-lsm-sandbox-621","title":"eBPF LSM Sandboxed Container Privilege Escalation Invariant","category":"security","severity":"critical","description":"Enforces mandatory kernel-level verification via eBPF LSM hooks to intercept and block unauthorized container privilege escalation, namespace breakouts, and capability elevations before syscall dispatch. Prevents Time-of-Check to Time-of-Use (TOCTOU) race conditions by validating caller cgroup credentials directly inside kernel memory structures rather than relying on reactive userspace tracepoint audits. Guarantees that unprivileged container tasks cannot invoke setuid transitions or acquire ambient capabilities regardless of runtime configuration misconfigurations.","antiPatternHeadline":"Relying on Userspace Audit Daemon Tracepoints or Async Seccomp Filters Allowing Kernel TOCTOU Container Escapes","stars_count":99,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","ebpf","lsm","containers","kernel","privilege-escalation","sandbox"],"exportEndpoints":{"claude":"/api/rules/ebpf-lsm-container-privilege-escalation-guardrail-ebpf-lsm-sandbox-621?format=claude","cursorMdc":"/api/rules/ebpf-lsm-container-privilege-escalation-guardrail-ebpf-lsm-sandbox-621?format=mdc","cursorrules":"/api/rules/ebpf-lsm-container-privilege-escalation-guardrail-ebpf-lsm-sandbox-621?format=cursor","windsurf":"/api/rules/ebpf-lsm-container-privilege-escalation-guardrail-ebpf-lsm-sandbox-621?format=windsurf","agents":"/api/rules/ebpf-lsm-container-privilege-escalation-guardrail-ebpf-lsm-sandbox-621?format=agents"}},{"id":"otel-w3c-baggage-multitenant-boundary-propagation","title":"Immutable W3C Baggage Tenant Context Propagation Across Microservices and Message Queues","category":"devops","severity":"critical","description":"Enforces strict extraction, validation, and propagation of tenant boundaries via W3C Baggage across synchronous RPC and asynchronous message brokers. Prohibits direct mutation of the active OpenTelemetry context and prevents downstream tenant pollution or cross-tenant log and trace leakage. Guarantees that tenant baggage entries are cryptographically validated or strictly verified at the network perimeter before crossing distributed trace contexts.","antiPatternHeadline":"Ad-Hoc Span Attribute Mutation and Unvalidated Asynchronous Trace Context Bleed Across Tenant Boundaries","stars_count":100,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","w3c-baggage","multi-tenancy","context-propagation","kafka","distributed-tracing"],"exportEndpoints":{"claude":"/api/rules/otel-w3c-baggage-multitenant-boundary-propagation?format=claude","cursorMdc":"/api/rules/otel-w3c-baggage-multitenant-boundary-propagation?format=mdc","cursorrules":"/api/rules/otel-w3c-baggage-multitenant-boundary-propagation?format=cursor","windsurf":"/api/rules/otel-w3c-baggage-multitenant-boundary-propagation?format=windsurf","agents":"/api/rules/otel-w3c-baggage-multitenant-boundary-propagation?format=agents"}},{"id":"svelte-5-runes-reactive-isolation-standard-svelte-5-runes-f-955","title":"Svelte 5 Runes Fine-Grained Reactive Isolation and Asynchronous Boundary Standard","category":"frontend","severity":"critical","description":"Enforces strict isolation and boundary guarantees when sharing signal-driven state across asynchronous pipelines and federated micro-frontends in Svelte 5. Prevents broken dependency tracking caused by async context degradation and eliminates memory leaks or state desynchronization from leaking reactive proxy objects across foreign domains.","antiPatternHeadline":"Leaking Mutable Reactive Proxies Across Micro-Frontend Boundaries and Tracking Across Async Await Yields","stars_count":78,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","micro-frontends","signals","reactivity"],"exportEndpoints":{"claude":"/api/rules/svelte-5-runes-reactive-isolation-standard-svelte-5-runes-f-955?format=claude","cursorMdc":"/api/rules/svelte-5-runes-reactive-isolation-standard-svelte-5-runes-f-955?format=mdc","cursorrules":"/api/rules/svelte-5-runes-reactive-isolation-standard-svelte-5-runes-f-955?format=cursor","windsurf":"/api/rules/svelte-5-runes-reactive-isolation-standard-svelte-5-runes-f-955?format=windsurf","agents":"/api/rules/svelte-5-runes-reactive-isolation-standard-svelte-5-runes-f-955?format=agents"}},{"id":"axum-08-tokio-select-cancellation-safe-state-standard","title":"Axum 0.8 Tokio Select Cancellation-Safe State Standard","category":"backend","severity":"critical","description":"Enforces strict cancellation safety in Axum 0.8 asynchronous handlers using tokio::select! or timeout wrappers. Prevents dangling database transactions, orphaned resource handles, and half-consumed stream states caused by unpinned or non-cancellation-safe futures being dropped upon abrupt HTTP/3 client disconnection or socket termination.","antiPatternHeadline":"Dropping Non-Cancellation-Safe Futures in tokio::select! Branches During Client Disconnects","stars_count":103,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tokio","async","cancellation-safety"],"exportEndpoints":{"claude":"/api/rules/axum-08-tokio-select-cancellation-safe-state-standard?format=claude","cursorMdc":"/api/rules/axum-08-tokio-select-cancellation-safe-state-standard?format=mdc","cursorrules":"/api/rules/axum-08-tokio-select-cancellation-safe-state-standard?format=cursor","windsurf":"/api/rules/axum-08-tokio-select-cancellation-safe-state-standard?format=windsurf","agents":"/api/rules/axum-08-tokio-select-cancellation-safe-state-standard?format=agents"}},{"id":"pg17-json-table-memory-bounded-streaming-projection","title":"PostgreSQL 17 SQL/JSON JSON_TABLE Memory-Bounded Streaming Projection","category":"backend","severity":"critical","description":"Enforces deterministic memory bounds and prevents query engine OOMs when projecting relational rows from massive semi-structured payloads using PostgreSQL 17 SQL/JSON JSON_TABLE. Mandates strict path projection, explicit column typing with fail-safe error handling, and transaction-local work_mem caps to guarantee streaming execution without intermediate AST materialization.","antiPatternHeadline":"Unbounded JSON Parsing via Full-Document LATERAL recordset Deserialization","stars_count":108,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","sql-json","json-table","performance","memory-safety"],"exportEndpoints":{"claude":"/api/rules/pg17-json-table-memory-bounded-streaming-projection?format=claude","cursorMdc":"/api/rules/pg17-json-table-memory-bounded-streaming-projection?format=mdc","cursorrules":"/api/rules/pg17-json-table-memory-bounded-streaming-projection?format=cursor","windsurf":"/api/rules/pg17-json-table-memory-bounded-streaming-projection?format=windsurf","agents":"/api/rules/pg17-json-table-memory-bounded-streaming-projection?format=agents"}},{"id":"kmp-swift-export-c-interop-memory-ownership-standard","title":"KMP Swift-Export Direct C-Interoperability Memory Ownership Standard","category":"mobile","severity":"critical","description":"Enforces strict memory ownership boundaries, reference lifecycle discipline, and non-blocking thread transitions for Kotlin Multiplatform Swift-Export using direct C-interop primitives. Prevents ARC-to-Kotlin GC retain cycles, native memory leaks from dangling StableRefs, and undefined behavior during cross-thread reference passing. Eliminates Objective-C dynamic dispatch serialization overhead while ensuring thread-safe object disposal.","antiPatternHeadline":"Unbounded StableRef Retention and Cross-Thread ARC-to-Kotlin GC Circular Leaks","stars_count":85,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","swift-export","c-interop","arc","memory-management","concurrency"],"exportEndpoints":{"claude":"/api/rules/kmp-swift-export-c-interop-memory-ownership-standard?format=claude","cursorMdc":"/api/rules/kmp-swift-export-c-interop-memory-ownership-standard?format=mdc","cursorrules":"/api/rules/kmp-swift-export-c-interop-memory-ownership-standard?format=cursor","windsurf":"/api/rules/kmp-swift-export-c-interop-memory-ownership-standard?format=windsurf","agents":"/api/rules/kmp-swift-export-c-interop-memory-ownership-standard?format=agents"}},{"id":"tauri2-ipc-capability-sandboxing-standard","title":"Tauri 2.0 Fine-Grained IPC Capability Sandboxing Standard","category":"mobile","severity":"critical","description":"Enforces fine-grained capability sets, window-level access control, and strictly typed command boundaries across mobile and desktop webviews in Tauri 2.0. Prohibits global wildcard permissions, unconstrained filesystem scopes, and raw untyped IPC invocations that expose host system APIs to remote code execution or privilege escalation.","antiPatternHeadline":"Assigning global default permissions and wildcards across mobile/desktop webviews without discrete scoped capability manifests","stars_count":54,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri","ipc","security","rust","sandboxing"],"exportEndpoints":{"claude":"/api/rules/tauri2-ipc-capability-sandboxing-standard?format=claude","cursorMdc":"/api/rules/tauri2-ipc-capability-sandboxing-standard?format=mdc","cursorrules":"/api/rules/tauri2-ipc-capability-sandboxing-standard?format=cursor","windsurf":"/api/rules/tauri2-ipc-capability-sandboxing-standard?format=windsurf","agents":"/api/rules/tauri2-ipc-capability-sandboxing-standard?format=agents"}},{"id":"spiffe-spire-tpm2-hardware-workload-attestation-standard","title":"SPIFFE/SPIRE TPM 2.0 Hardware-Rooted Workload Attestation Standard","category":"security","severity":"critical","description":"Enforces cryptographic workload identity issuance bound to bare-metal TPM 2.0 secure enclaves via SPIFFE/SPIRE node and workload attestation. Eliminates static long-lived IAM tokens, secrets files, and ambient cloud credentials by requiring short-lived X.509 SVIDs rooted in measured boot Platform Configuration Registers (PCRs).","antiPatternHeadline":"Bypassing Hardware Attestation with Static IAM Secret Keys or Unvalidated Local Workload Sockets","stars_count":90,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","spiffe","spire","tpm2","zero-trust","attestation","hardware-security"],"exportEndpoints":{"claude":"/api/rules/spiffe-spire-tpm2-hardware-workload-attestation-standard?format=claude","cursorMdc":"/api/rules/spiffe-spire-tpm2-hardware-workload-attestation-standard?format=mdc","cursorrules":"/api/rules/spiffe-spire-tpm2-hardware-workload-attestation-standard?format=cursor","windsurf":"/api/rules/spiffe-spire-tpm2-hardware-workload-attestation-standard?format=windsurf","agents":"/api/rules/spiffe-spire-tpm2-hardware-workload-attestation-standard?format=agents"}},{"id":"amd-sev-snp-attestation-invariant","title":"AMD SEV-SNP Confidential Containers In-Enclave Attestation Invariant","category":"security","severity":"critical","description":"Guarantees tenant isolation and zero-trust memory encryption for sensitive AI inference microservices running in untrusted multi-tenant clouds. Enforces in-enclave hardware attestation report acquisition directly via /dev/sev-guest, cryptographic binding of ephemeral public keys within REPORT_DATA, and strict verification of the AMD Key Distribution Service (KDS) VCEK certificate chain before unsealing model weights or processing customer payloads.","antiPatternHeadline":"Trusting Host-Forwarded Attestation Tokens or Decrypting Model Weights Prior to Cryptographic SEV-SNP Hardware Report Verification","stars_count":48,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","confidential-computing","amd-sev-snp","attestation","zero-trust","ai-inference"],"exportEndpoints":{"claude":"/api/rules/amd-sev-snp-attestation-invariant?format=claude","cursorMdc":"/api/rules/amd-sev-snp-attestation-invariant?format=mdc","cursorrules":"/api/rules/amd-sev-snp-attestation-invariant?format=cursor","windsurf":"/api/rules/amd-sev-snp-attestation-invariant?format=windsurf","agents":"/api/rules/amd-sev-snp-attestation-invariant?format=agents"}},{"id":"otlp-arrow-streaming-compression-standard","title":"OTLP Arrow Protocol Streaming Columnar Compression Enforcement","category":"devops","severity":"critical","description":"Enforces Apache Arrow columnar batch streaming on OpenTelemetry Collector pipelines to eliminate network egress saturation caused by high-cardinality telemetry. Standardizes collector receivers, exporters, and client transport configurations to preserve memory budgets while achieving 5x-10x compression gains over standard OTLP Protobuf. Prevents head-of-line blocking and buffer starvation through deterministic streaming chunk size limits and backpressure controls.","antiPatternHeadline":"Uncompressed row-oriented OTLP Protobuf transmission causing telemetry egress saturation and OOM cascades","stars_count":116,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","arrow","compression","streaming","observability","grpc"],"exportEndpoints":{"claude":"/api/rules/otlp-arrow-streaming-compression-standard?format=claude","cursorMdc":"/api/rules/otlp-arrow-streaming-compression-standard?format=mdc","cursorrules":"/api/rules/otlp-arrow-streaming-compression-standard?format=cursor","windsurf":"/api/rules/otlp-arrow-streaming-compression-standard?format=windsurf","agents":"/api/rules/otlp-arrow-streaming-compression-standard?format=agents"}},{"id":"k8s-gateway-api-reference-grant-cross-namespace-invariant","title":"Gateway API v1.2 ReferenceGrant Bidirectional Cross-Namespace Invariant","category":"devops","severity":"critical","description":"Enforces strict bidirectional trust handshakes across Kubernetes namespaces in Gateway API v1.2 deployments using scoped ReferenceGrant resources. Prevents cross-tenant traffic hijacking and unauthorized service attachment by ensuring every cross-namespace HTTPRoute-to-Service and Gateway-to-Secret binding contains a corresponding, non-wildcarded ReferenceGrant in the target namespace.","antiPatternHeadline":"Unauthenticated Cross-Namespace Backend Routing Without Target-Side ReferenceGrant Handshakes","stars_count":65,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","kubernetes","gateway-api","referencegrant","multi-tenancy","zero-trust"],"exportEndpoints":{"claude":"/api/rules/k8s-gateway-api-reference-grant-cross-namespace-invariant?format=claude","cursorMdc":"/api/rules/k8s-gateway-api-reference-grant-cross-namespace-invariant?format=mdc","cursorrules":"/api/rules/k8s-gateway-api-reference-grant-cross-namespace-invariant?format=cursor","windsurf":"/api/rules/k8s-gateway-api-reference-grant-cross-namespace-invariant?format=windsurf","agents":"/api/rules/k8s-gateway-api-reference-grant-cross-namespace-invariant?format=agents"}},{"id":"vite-6-environment-api-graph-isolation","title":"Vite 6 Environment API Multi-Runtime Module Graph & Context Isolation","category":"frontend","severity":"critical","description":"Enforces strict isolation across Vite 6 execution environments (browser, Node.js SSR, and Edge runtimes) using the Environment API. Guarantees zero cross-contamination of module instances, transform caches, and environment variables across heterogeneous execution targets during universal development and bundling.","antiPatternHeadline":"Monolithic Module Graph Querying and Cross-Environment Plugin Cache Leakage","stars_count":63,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["vite","vite-6","environment-api","ssr","edge","module-graph","bundler","typescript"],"exportEndpoints":{"claude":"/api/rules/vite-6-environment-api-graph-isolation?format=claude","cursorMdc":"/api/rules/vite-6-environment-api-graph-isolation?format=mdc","cursorrules":"/api/rules/vite-6-environment-api-graph-isolation?format=cursor","windsurf":"/api/rules/vite-6-environment-api-graph-isolation?format=windsurf","agents":"/api/rules/vite-6-environment-api-graph-isolation?format=agents"}},{"id":"bun-clustered-worker-native-sql-isolation-standard","title":"Bun 1.2 Clustered Worker Native SQL Connection Pool Isolation Standard","category":"backend","severity":"critical","description":"Enforces strict per-worker thread-pinned lifecycle management for native SQL clients (`bun:sqlite`, native Postgres/MySQL clients) when operating under Bun clustered worker topologies. Prevents cross-worker socket desynchronization, file descriptor leaks, and IPC contention by prohibiting shared connection handles across process or thread boundaries.","antiPatternHeadline":"Sharing or Hoisting Native Database Clients Across Bun Worker Thread Boundaries","stars_count":62,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","postgresql","concurrency","connection-pooling","workers"],"exportEndpoints":{"claude":"/api/rules/bun-clustered-worker-native-sql-isolation-standard?format=claude","cursorMdc":"/api/rules/bun-clustered-worker-native-sql-isolation-standard?format=mdc","cursorrules":"/api/rules/bun-clustered-worker-native-sql-isolation-standard?format=cursor","windsurf":"/api/rules/bun-clustered-worker-native-sql-isolation-standard?format=windsurf","agents":"/api/rules/bun-clustered-worker-native-sql-isolation-standard?format=agents"}},{"id":"postgres-17-pgvector-parallel-hnsw-memory-pinning","title":"Postgres 17 pgvector Parallel HNSW Index Build Memory Pinning Standard","category":"backend","severity":"critical","description":"Governs session-scoped maintenance_work_mem sizing and max_parallel_maintenance_workers allocation during parallel HNSW vector index builds in Postgres 17. Enforces strict aggregate memory safety invariants to prevent Out-Of-Memory (OOM) Linux kernel cgroup terminations on active transactional primaries. Mandates CONCURRENTLY index construction alongside ephemeral per-session GUC resets and query cancellation timeouts.","antiPatternHeadline":"Global maintenance_work_mem Oversubscription Spawning Unconstrained Parallel HNSW Worker OOM Evictions","stars_count":49,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","pgvector","hnsw","database-performance","high-availability"],"exportEndpoints":{"claude":"/api/rules/postgres-17-pgvector-parallel-hnsw-memory-pinning?format=claude","cursorMdc":"/api/rules/postgres-17-pgvector-parallel-hnsw-memory-pinning?format=mdc","cursorrules":"/api/rules/postgres-17-pgvector-parallel-hnsw-memory-pinning?format=cursor","windsurf":"/api/rules/postgres-17-pgvector-parallel-hnsw-memory-pinning?format=windsurf","agents":"/api/rules/postgres-17-pgvector-parallel-hnsw-memory-pinning?format=agents"}},{"id":"kmp-skie-swift-concurrency-coroutine-bridge-invariant","title":"KMP SKIE Swift Concurrency and Coroutine Memory-Safe Cancellation Invariant","category":"mobile","severity":"critical","description":"Enforces strict bidirectional cancellation propagation and deterministic lifecycle deallocation between Kotlin/Native Coroutines and Swift async/await via Touchlab SKIE. Prevents silent coroutine thread leaks and retain cycles caused by detached Swift Tasks holding strong Kotlin Job references across the foreign runtime boundary.","antiPatternHeadline":"Detached Swift Task Leaks Kotlin Coroutine Scope and Traps Native ARC Retain Cycles","stars_count":99,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","kmp","skie","swift-concurrency","coroutines","memory-management"],"exportEndpoints":{"claude":"/api/rules/kmp-skie-swift-concurrency-coroutine-bridge-invariant?format=claude","cursorMdc":"/api/rules/kmp-skie-swift-concurrency-coroutine-bridge-invariant?format=mdc","cursorrules":"/api/rules/kmp-skie-swift-concurrency-coroutine-bridge-invariant?format=cursor","windsurf":"/api/rules/kmp-skie-swift-concurrency-coroutine-bridge-invariant?format=windsurf","agents":"/api/rules/kmp-skie-swift-concurrency-coroutine-bridge-invariant?format=agents"}},{"id":"powersync-ios-wal-checkpoint-background-invariants","title":"PowerSync SQLite WAL Invariant & Background Task Suspension Protocol","category":"mobile","severity":"critical","description":"Mandates deterministic sync stream detachment and atomic SQLite WAL truncation checkpointing prior to iOS background task expiration. Prevents persistent -shm and -wal lockfile corruption caused by abrupt OS SIGKILL or suspension during in-flight CRDT mutations. Enforces atomic POSIX advisory lock cleanup across iOS application lifecycle transitions.","antiPatternHeadline":"Unbounded CRDT Streaming and Missing WAL Checkpoint During iOS Background Suspension","stars_count":82,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","powersync","sqlite","ios","crdt","wal","concurrency"],"exportEndpoints":{"claude":"/api/rules/powersync-ios-wal-checkpoint-background-invariants?format=claude","cursorMdc":"/api/rules/powersync-ios-wal-checkpoint-background-invariants?format=mdc","cursorrules":"/api/rules/powersync-ios-wal-checkpoint-background-invariants?format=cursor","windsurf":"/api/rules/powersync-ios-wal-checkpoint-background-invariants?format=windsurf","agents":"/api/rules/powersync-ios-wal-checkpoint-background-invariants?format=agents"}},{"id":"openfga-zanzibar-deterministic-traversal-guardrail","title":"Deterministic Traversal Depth Bounding and Cycle Rejection for OpenFGA Zanzibar Engines","category":"security","severity":"critical","description":"Enforces strict limits on graph traversal depth, contextual tuple cardinality, and cycle detection during distributed Zanzibar relationship evaluations. Eliminates exponential expansion and goroutine/thread starvation to guarantee sub-5ms P99 authorization latencies.","antiPatternHeadline":"Unbounded Contextual Graph Traversal and Missing Cycle Guardrails Causing Evaluation Hangs and ReBAC DoS","stars_count":57,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","zanzibar","rebac","authorization","performance"],"exportEndpoints":{"claude":"/api/rules/openfga-zanzibar-deterministic-traversal-guardrail?format=claude","cursorMdc":"/api/rules/openfga-zanzibar-deterministic-traversal-guardrail?format=mdc","cursorrules":"/api/rules/openfga-zanzibar-deterministic-traversal-guardrail?format=cursor","windsurf":"/api/rules/openfga-zanzibar-deterministic-traversal-guardrail?format=windsurf","agents":"/api/rules/openfga-zanzibar-deterministic-traversal-guardrail?format=agents"}},{"id":"webauthn-prf-deterministic-key-derivation-webauthn-prf-ext-140","title":"Hardware-Backed WebAuthn PRF Deterministic Key Derivation & Zero-Knowledge Enclaves","category":"security","severity":"critical","description":"Enforces strict cryptographic patterns for WebAuthn Pseudo-Random Function (PRF) extension key derivation in client-side zero-knowledge enclaves. Mandates ephemeral HKDF expansion from authenticator outputs, strict separation of credential IDs, and prohibits storing, transmitting, or caching unmasked derived symmetric master keys.","antiPatternHeadline":"Deriving Symmetric Keys from Raw Passkey Assertion Signatures or Storing PRF Secrets Unencrypted in State","stars_count":112,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","prf-extension","cryptography","zero-knowledge","hkdf"],"exportEndpoints":{"claude":"/api/rules/webauthn-prf-deterministic-key-derivation-webauthn-prf-ext-140?format=claude","cursorMdc":"/api/rules/webauthn-prf-deterministic-key-derivation-webauthn-prf-ext-140?format=mdc","cursorrules":"/api/rules/webauthn-prf-deterministic-key-derivation-webauthn-prf-ext-140?format=cursor","windsurf":"/api/rules/webauthn-prf-deterministic-key-derivation-webauthn-prf-ext-140?format=windsurf","agents":"/api/rules/webauthn-prf-deterministic-key-derivation-webauthn-prf-ext-140?format=agents"}},{"id":"k8s-gateway-api-referencegrant-boundary-standard-kubernetes-gatew-959","title":"Kubernetes Gateway API v1.2 Cross-Namespace ReferenceGrant Boundary Standard","category":"devops","severity":"critical","description":"Enforces strict authorization boundaries for cross-namespace routing within Kubernetes Gateway API v1.2 environments. Requires explicit ReferenceGrant resources in target service namespaces before HTTPRoute or GRPCRoute objects can reference backend services across namespace boundaries. Prevents multi-tenant traffic hijacking and unintended blast-radius expansion across shared ingress gateways and service meshes.","antiPatternHeadline":"Cross-Namespace Backend Hijacking Without Explicit ReferenceGrant Consent","stars_count":50,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","kubernetes","gateway-api","security","multi-tenancy","service-mesh"],"exportEndpoints":{"claude":"/api/rules/k8s-gateway-api-referencegrant-boundary-standard-kubernetes-gatew-959?format=claude","cursorMdc":"/api/rules/k8s-gateway-api-referencegrant-boundary-standard-kubernetes-gatew-959?format=mdc","cursorrules":"/api/rules/k8s-gateway-api-referencegrant-boundary-standard-kubernetes-gatew-959?format=cursor","windsurf":"/api/rules/k8s-gateway-api-referencegrant-boundary-standard-kubernetes-gatew-959?format=windsurf","agents":"/api/rules/k8s-gateway-api-referencegrant-boundary-standard-kubernetes-gatew-959?format=agents"}},{"id":"ebpf-profiler-dwarf-buffer-throttling-invariant","title":"eBPF Continuous Profiling DWARF Unwinding Buffer-Pressure Throttling Invariant","category":"devops","severity":"critical","description":"Enforces adaptive ring-buffer backpressure and sampling frequency throttling during DWARF unwinding in production continuous profilers. Uncontrolled symbolization and kernel-to-userspace stack trace streaming under high container density will cause kernel ring-buffer overflows, silent telemetry frame drops, and severe soft-lockup/CPU exhaustion. The architecture mandates feedback loops between userspace ring-buffer consumer watermark metrics and kernel BPF sampling interval maps.","antiPatternHeadline":"Static-Rate Unwinding Without Adaptive Watermark Backpressure and Dynamic Subsampling","stars_count":116,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","profiling","dwarf","linux-kernel","observability","performance"],"exportEndpoints":{"claude":"/api/rules/ebpf-profiler-dwarf-buffer-throttling-invariant?format=claude","cursorMdc":"/api/rules/ebpf-profiler-dwarf-buffer-throttling-invariant?format=mdc","cursorrules":"/api/rules/ebpf-profiler-dwarf-buffer-throttling-invariant?format=cursor","windsurf":"/api/rules/ebpf-profiler-dwarf-buffer-throttling-invariant?format=windsurf","agents":"/api/rules/ebpf-profiler-dwarf-buffer-throttling-invariant?format=agents"}},{"id":"axum-tower-adaptive-concurrency-shedding-standard","title":"Axum 0.8 Adaptive Concurrency Limiting & Latency-Based Load Shedding","category":"backend","severity":"critical","description":"Production Axum 0.8 services must reject traffic dynamically via moving latency percentiles (such as Vegas or Gradient estimators) instead of static semaphore bounds. Static concurrency thresholds fail under tail-latency degradations, causing unbounded thread/task queuing, socket exhaustion, and cascading microservice collapse across distributed topologies.","antiPatternHeadline":"Static Semaphore Concurrency Limiting Causing Queue Saturation and Cascade Failures","stars_count":72,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tower","concurrency","load-shedding","resilience"],"exportEndpoints":{"claude":"/api/rules/axum-tower-adaptive-concurrency-shedding-standard?format=claude","cursorMdc":"/api/rules/axum-tower-adaptive-concurrency-shedding-standard?format=mdc","cursorrules":"/api/rules/axum-tower-adaptive-concurrency-shedding-standard?format=cursor","windsurf":"/api/rules/axum-tower-adaptive-concurrency-shedding-standard?format=windsurf","agents":"/api/rules/axum-tower-adaptive-concurrency-shedding-standard?format=agents"}},{"id":"vite-6-environment-runtime-isolation","title":"Vite 6 Environment API Cross-Runtime Module Isolation Standard","category":"frontend","severity":"critical","description":"Enforces strict module execution boundaries across heterogeneous execution targets (Client, Node SSR, and Edge Workers) using Vite 6's Environment API. Prevents cross-environment memory leaks, shared runtime state bleed, and unsafe module graph contamination in unified multi-target builds.","antiPatternHeadline":"Shared Ambient Singletons and Unscoped Plugins Leaking Across DevEnvironment Boundaries","stars_count":113,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["vite","vite-6","environment-api","ssr","edge-worker","module-isolation","memory-leaks"],"exportEndpoints":{"claude":"/api/rules/vite-6-environment-runtime-isolation?format=claude","cursorMdc":"/api/rules/vite-6-environment-runtime-isolation?format=mdc","cursorrules":"/api/rules/vite-6-environment-runtime-isolation?format=cursor","windsurf":"/api/rules/vite-6-environment-runtime-isolation?format=windsurf","agents":"/api/rules/vite-6-environment-runtime-isolation?format=agents"}},{"id":"postgres-17-json-table-memory-allocation-bound","title":"Postgres 17 JSON_TABLE Memory Allocation Bound & Execution Ceiling","category":"backend","severity":"critical","description":"Enforces strict transaction-scoped memory allocation limits and row-projection caps on PostgreSQL 17 SQL/JSON JSON_TABLE queries. Deeply nested JSON path evaluations and unbounded NESTED PATH clauses expand combinatorially in backend process memory, requiring explicit SET LOCAL work_mem boundaries and deterministic pagination to prevent backend Out-Of-Memory (OOM) process termination and connection drops.","antiPatternHeadline":"Unbounded JSON_TABLE Queries with Deeply Nested Paths Over Exhaustible Connection Pools","stars_count":76,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","sql-json","json-table","memory-management","performance"],"exportEndpoints":{"claude":"/api/rules/postgres-17-json-table-memory-allocation-bound?format=claude","cursorMdc":"/api/rules/postgres-17-json-table-memory-allocation-bound?format=mdc","cursorrules":"/api/rules/postgres-17-json-table-memory-allocation-bound?format=cursor","windsurf":"/api/rules/postgres-17-json-table-memory-allocation-bound?format=windsurf","agents":"/api/rules/postgres-17-json-table-memory-allocation-bound?format=agents"}},{"id":"tauri-v2-granular-ipc-scope-capability-standard","title":"Tauri 2.0 Granular Mobile IPC Scope Capability Standard","category":"mobile","severity":"critical","description":"Mandates cryptographically enforced capability schemas and granular command permissions across Tauri 2.0 IPC boundaries on iOS and Android. Prohibits global command enablement, wildcard file/network access scopes, and unvalidated WebView invocations across mobile target platforms. Invariant enforcement guarantees zero-trust boundaries between client-side JavaScript execution and the native Rust backend.","antiPatternHeadline":"Overprivileged Mobile Capabilities and Unscoped IPC Invocations Across Native Boundaries","stars_count":103,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri-v2","rust","ipc-security","ios","android","capabilities"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-granular-ipc-scope-capability-standard?format=claude","cursorMdc":"/api/rules/tauri-v2-granular-ipc-scope-capability-standard?format=mdc","cursorrules":"/api/rules/tauri-v2-granular-ipc-scope-capability-standard?format=cursor","windsurf":"/api/rules/tauri-v2-granular-ipc-scope-capability-standard?format=windsurf","agents":"/api/rules/tauri-v2-granular-ipc-scope-capability-standard?format=agents"}},{"id":"pqc-ml-kem-hybrid-tls-ingress-standard","title":"Mandatory ML-KEM-768 Hybrid TLS 1.3 Ingress Key Exchange","category":"security","severity":"critical","description":"Enforces post-quantum hybrid key encapsulation (X25519MLKEM768) on all perimeter ingress points and external API terminations. Neutralizes Harvest-Now-Decrypt-Later (HNDL) threats by guaranteeing TLS 1.3 key exchanges combine classical ECDH security with lattice-based ML-KEM-768 (FIPS 203) resistance.","antiPatternHeadline":"Terminating public TLS with classical-only curves (X25519 or secp256r1) vulnerable to retrospective quantum decryption.","stars_count":99,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","pqc","tls13","ml-kem","cryptography","ingress"],"exportEndpoints":{"claude":"/api/rules/pqc-ml-kem-hybrid-tls-ingress-standard?format=claude","cursorMdc":"/api/rules/pqc-ml-kem-hybrid-tls-ingress-standard?format=mdc","cursorrules":"/api/rules/pqc-ml-kem-hybrid-tls-ingress-standard?format=cursor","windsurf":"/api/rules/pqc-ml-kem-hybrid-tls-ingress-standard?format=windsurf","agents":"/api/rules/pqc-ml-kem-hybrid-tls-ingress-standard?format=agents"}},{"id":"nextjs-15-cache-life-tag-invalidation-consistency","title":"Next.js 15 Monotonic Cache Life & Tag Invalidation Guardrail","category":"frontend","severity":"critical","description":"Enforces strict monotonic read-after-write consistency across Next.js 15 edge nodes and the Data Cache layer during distributed database mutations. Prevents stale-while-revalidate race conditions and cross-region cache drift by mandating deterministic cacheLife profiles, entity-scoped cacheTag strategies, and post-commit tag revalidation barriers.","antiPatternHeadline":"Executing un-scoped revalidateTag calls before write durability or using ambient cacheLife settings that serve stale edge state post-mutation.","stars_count":99,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs15","cache-life","revalidate-tag","edge-cdn","distributed-systems","swr"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-cache-life-tag-invalidation-consistency?format=claude","cursorMdc":"/api/rules/nextjs-15-cache-life-tag-invalidation-consistency?format=mdc","cursorrules":"/api/rules/nextjs-15-cache-life-tag-invalidation-consistency?format=cursor","windsurf":"/api/rules/nextjs-15-cache-life-tag-invalidation-consistency?format=windsurf","agents":"/api/rules/nextjs-15-cache-life-tag-invalidation-consistency?format=agents"}},{"id":"cilium-bpf-host-routing-pmtu-guardrail","title":"Cilium BPF Host-Routing & Path MTU Discovery Invariant Enforcement","category":"devops","severity":"critical","description":"Eliminates silent IP packet blackholing, frame truncation, and sporadic TCP reset (RST) storms caused by eBPF FIB host routing bypassing standard kernel IP stack PMTUD handling. Dynamically synchronizes overlay encapsulation overheads, host network device MTUs, and TCP MSS clamping across Kubernetes cloud provider envelopes.","antiPatternHeadline":"Unclamped eBPF Host Routing Over Overlays Causing Silent MTU Blackholing and TCP Resets","stars_count":115,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["cilium","ebpf","networking","kubernetes","devops","mtu","pmtud"],"exportEndpoints":{"claude":"/api/rules/cilium-bpf-host-routing-pmtu-guardrail?format=claude","cursorMdc":"/api/rules/cilium-bpf-host-routing-pmtu-guardrail?format=mdc","cursorrules":"/api/rules/cilium-bpf-host-routing-pmtu-guardrail?format=cursor","windsurf":"/api/rules/cilium-bpf-host-routing-pmtu-guardrail?format=windsurf","agents":"/api/rules/cilium-bpf-host-routing-pmtu-guardrail?format=agents"}},{"id":"capacitor-7-biometric-secure-storage-lifecycle-interlock","title":"Capacitor 7 Biometric Secure Storage Lifecycle Interlock Standard","category":"mobile","severity":"critical","description":"Enforces deterministic in-memory zeroization of decrypted authentication tokens and sensitive credentials upon mobile OS background suspension. Mandates that resume cycles gate all WebView credential access behind biometric re-authentication backed by hardware Secure Enclave or Android KeyStore Keyset handles.","antiPatternHeadline":"Persisting Raw Tokens in Memory Across Lifecycle Suspensions Bypassing Hardware Biometric Invalidation","stars_count":47,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor-7","biometrics","secure-enclave","keystore","cryptography","memory-zeroization"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-biometric-secure-storage-lifecycle-interlock?format=claude","cursorMdc":"/api/rules/capacitor-7-biometric-secure-storage-lifecycle-interlock?format=mdc","cursorrules":"/api/rules/capacitor-7-biometric-secure-storage-lifecycle-interlock?format=cursor","windsurf":"/api/rules/capacitor-7-biometric-secure-storage-lifecycle-interlock?format=windsurf","agents":"/api/rules/capacitor-7-biometric-secure-storage-lifecycle-interlock?format=agents"}},{"id":"otel-w3c-baggage-tenant-isolation-filter","title":"OpenTelemetry W3C Baggage Cross-Tenant Isolation and Propagation Sanitizer","category":"devops","severity":"critical","description":"Enforces strict boundary sanitization on W3C Baggage headers across microservice ingress and egress filters to prevent tenant spoofing, authorization bypass, and metadata leakage. Untrusted incoming baggage keys representing tenant identity, customer scope, or authorization claims must be dropped or re-validated against cryptographically signed session tokens before propagation. Downstream egress proxies must strictly whitelist contextual metadata keys to avoid exfiltrating internal partition topologies.","antiPatternHeadline":"Blind Ingress/Egress Propagation of W3C Baggage Containing Unsanitized Tenant Identifiers","stars_count":68,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","security","multi-tenancy","observability","distributed-tracing"],"exportEndpoints":{"claude":"/api/rules/otel-w3c-baggage-tenant-isolation-filter?format=claude","cursorMdc":"/api/rules/otel-w3c-baggage-tenant-isolation-filter?format=mdc","cursorrules":"/api/rules/otel-w3c-baggage-tenant-isolation-filter?format=cursor","windsurf":"/api/rules/otel-w3c-baggage-tenant-isolation-filter?format=windsurf","agents":"/api/rules/otel-w3c-baggage-tenant-isolation-filter?format=agents"}},{"id":"fastapi-anyio-cancellation-shielding-standard","title":"FastAPI AnyIO Client Disconnect Shielding & Atomic Pipeline Guardrail","category":"backend","severity":"critical","description":"Enforces non-cancellable shielded scopes and deterministic cleanups in multi-step asynchronous database transactions under FastAPI. Prevents orphaned mutations, unreleased connection pool slots, and transaction leaks when upstream HTTP clients disconnect mid-pipeline.","antiPatternHeadline":"Unshielded async transaction pipelines interrupted by client disconnects, causing orphaned mutations and DB pool starvation","stars_count":46,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","anyio","asyncio","sqlalchemy","transactions","concurrency"],"exportEndpoints":{"claude":"/api/rules/fastapi-anyio-cancellation-shielding-standard?format=claude","cursorMdc":"/api/rules/fastapi-anyio-cancellation-shielding-standard?format=mdc","cursorrules":"/api/rules/fastapi-anyio-cancellation-shielding-standard?format=cursor","windsurf":"/api/rules/fastapi-anyio-cancellation-shielding-standard?format=windsurf","agents":"/api/rules/fastapi-anyio-cancellation-shielding-standard?format=agents"}},{"id":"react-19-rsc-data-taint-boundary","title":"React 19 RSC Taint Boundary & Cryptographic Secret Protection","category":"frontend","severity":"critical","description":"Enforces compiler- and runtime-level data tainting via React 19 experimental_taintUniqueValue and experimental_taintObjectReference across the Data Access Layer (DAL). Guarantees that cryptographic keys, authentication tokens, and raw entity models containing sensitive fields cannot be serialized into React Server Component (RSC) flight payloads or leaked to client bundles.","antiPatternHeadline":"Passing Untainted Raw Database Entities or Cryptographic Secrets Through RSC Boundaries to Client Components","stars_count":53,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","nextjs","rsc","security","data-tainting","server-components"],"exportEndpoints":{"claude":"/api/rules/react-19-rsc-data-taint-boundary?format=claude","cursorMdc":"/api/rules/react-19-rsc-data-taint-boundary?format=mdc","cursorrules":"/api/rules/react-19-rsc-data-taint-boundary?format=cursor","windsurf":"/api/rules/react-19-rsc-data-taint-boundary?format=windsurf","agents":"/api/rules/react-19-rsc-data-taint-boundary?format=agents"}},{"id":"svelte-5-runes-ssr-scope-isolation","title":"Svelte 5 Runes SSR Cross-Request Scope Isolation & Leak Prevention","category":"frontend","severity":"critical","description":"Enforces strict request-boundary isolation for Svelte 5 reactive runes ($state, $derived) in server-side rendering (SSR) runtimes. Module-scoped reactive runes in persistent server runtimes like Node.js and Bun persist across concurrent requests, resulting in cross-user data leakage and critical security vulnerabilities. All mutable user, tenant, or request-specific reactive states must be encapsulated within Svelte Context or instantiated per-request lifecycle.","antiPatternHeadline":"Module-Level $state Singletons Leaking Concurrent Request Data in SSR Runtimes","stars_count":75,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","ssr","sveltekit","security","node"],"exportEndpoints":{"claude":"/api/rules/svelte-5-runes-ssr-scope-isolation?format=claude","cursorMdc":"/api/rules/svelte-5-runes-ssr-scope-isolation?format=mdc","cursorrules":"/api/rules/svelte-5-runes-ssr-scope-isolation?format=cursor","windsurf":"/api/rules/svelte-5-runes-ssr-scope-isolation?format=windsurf","agents":"/api/rules/svelte-5-runes-ssr-scope-isolation?format=agents"}},{"id":"vite6-environment-api-runtime-decoupling-vite-6-environme-769","title":"Strict Module & Environment Isolation via Vite 6 Environment API","category":"frontend","severity":"critical","description":"Enforces complete module graph and execution environment segregation across client, edge (workerd), and Node.js runtimes using the Vite 6 Environment API. Prevents cross-runtime module leakage, unconditioned Node.js built-ins in edge/client bundles, and monolithic plugin side-effects across heterogeneous runtime boundaries.","antiPatternHeadline":"Cross-Pollinating Module Graphs and Leaking Server Runables into Heterogeneous Vite Environments","stars_count":76,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["vite","vite-6","environment-api","module-graph","edge-runtime","ssr","full-stack"],"exportEndpoints":{"claude":"/api/rules/vite6-environment-api-runtime-decoupling-vite-6-environme-769?format=claude","cursorMdc":"/api/rules/vite6-environment-api-runtime-decoupling-vite-6-environme-769?format=mdc","cursorrules":"/api/rules/vite6-environment-api-runtime-decoupling-vite-6-environme-769?format=cursor","windsurf":"/api/rules/vite6-environment-api-runtime-decoupling-vite-6-environme-769?format=windsurf","agents":"/api/rules/vite6-environment-api-runtime-decoupling-vite-6-environme-769?format=agents"}},{"id":"postgres-17-cdc-failover-slot-sync","title":"Postgres 17 Failover Slot Synchronization Guardrail for CDC Pipelines","category":"backend","severity":"critical","description":"Mandates the use of Postgres 17 logical failover replication slots and synchronized standby slot topologies for all streaming Change Data Capture (CDC) architectures. Eliminates WAL retention truncation, stream corruption, and duplicate event storms across Kafka Connect and Debezium during primary-replica failovers.","antiPatternHeadline":"Creating Unsynchronized Logical Replication Slots Vulnerable to WAL Truncation During Failover","stars_count":60,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","cdc","debezium","kafka","high-availability"],"exportEndpoints":{"claude":"/api/rules/postgres-17-cdc-failover-slot-sync?format=claude","cursorMdc":"/api/rules/postgres-17-cdc-failover-slot-sync?format=mdc","cursorrules":"/api/rules/postgres-17-cdc-failover-slot-sync?format=cursor","windsurf":"/api/rules/postgres-17-cdc-failover-slot-sync?format=windsurf","agents":"/api/rules/postgres-17-cdc-failover-slot-sync?format=agents"}},{"id":"temporal-workflow-determinism-patching-invariant","title":"Temporal Workflow Determinism & Dynamic Patch Invariant Guardrail","category":"backend","severity":"critical","description":"Temporal workflows must maintain absolute event-history replay determinism across deployments. Any modification to existing workflow definitions—including reordering activities, mutating control-flow branches, or removing timers—must use deterministic versioning primitives (patched/deprecatePatch) to prevent non-deterministic execution exceptions and workflow corruption during rolling deployments.","antiPatternHeadline":"Mutating Workflow Control Flow or Schedule Commands Without Version Patching","stars_count":97,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","temporal","event-sourcing","distributed-systems","determinism","workflow-orchestration"],"exportEndpoints":{"claude":"/api/rules/temporal-workflow-determinism-patching-invariant?format=claude","cursorMdc":"/api/rules/temporal-workflow-determinism-patching-invariant?format=mdc","cursorrules":"/api/rules/temporal-workflow-determinism-patching-invariant?format=cursor","windsurf":"/api/rules/temporal-workflow-determinism-patching-invariant?format=windsurf","agents":"/api/rules/temporal-workflow-determinism-patching-invariant?format=agents"}},{"id":"go-chi-http2-sse-stream-lifecycle-guardrail","title":"Go Chi HTTP/2 SSE Stream Lifecycle and Context Cancellation Standard","category":"backend","severity":"critical","description":"Enforces deterministic context cancellation propagation, unbuffered channel drain safeguards, and explicit client termination handling for HTTP/2 and Server-Sent Events (SSE) handlers in Go Chi. Eliminates silent goroutine leaks, orphan producers, and socket descriptor exhaustion triggered by premature client TCP/TLS RST or HTTP/2 stream cancellations.","antiPatternHeadline":"Unbounded Goroutine Spawning and Channel Deadlocks on Abrupt HTTP/2 Stream Cancellation","stars_count":77,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","chi","http2","sse","goroutines","concurrency"],"exportEndpoints":{"claude":"/api/rules/go-chi-http2-sse-stream-lifecycle-guardrail?format=claude","cursorMdc":"/api/rules/go-chi-http2-sse-stream-lifecycle-guardrail?format=mdc","cursorrules":"/api/rules/go-chi-http2-sse-stream-lifecycle-guardrail?format=cursor","windsurf":"/api/rules/go-chi-http2-sse-stream-lifecycle-guardrail?format=windsurf","agents":"/api/rules/go-chi-http2-sse-stream-lifecycle-guardrail?format=agents"}},{"id":"openfga-cache-coherence-boundary-guardrail","title":"OpenFGA Relationship Tuple Cache Coherence and TOCTOU Mitigation Standard","category":"security","severity":"critical","description":"Enforces strict cache coherence and consistency token invariants across OpenFGA/Zanzibar relationship graph evaluations. Prevents time-of-check to time-of-use (TOCTOU) authorization bypass vulnerabilities by eliminating naive client-side TTL caching and mandating write-through invalidation or read-at-least-as-fresh-as snapshot tokens.","antiPatternHeadline":"Decoupled Check Caching and Unversioned Tuple Mutation Leading to Stale Authorization Bypasses","stars_count":61,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","authorization","zanzibar","caching","toctou","access-control"],"exportEndpoints":{"claude":"/api/rules/openfga-cache-coherence-boundary-guardrail?format=claude","cursorMdc":"/api/rules/openfga-cache-coherence-boundary-guardrail?format=mdc","cursorrules":"/api/rules/openfga-cache-coherence-boundary-guardrail?format=cursor","windsurf":"/api/rules/openfga-cache-coherence-boundary-guardrail?format=windsurf","agents":"/api/rules/openfga-cache-coherence-boundary-guardrail?format=agents"}},{"id":"webauthn-synced-passkey-stepup-attestation-standard","title":"Mandatory Hardware-Bound User Verification and Cryptographic Challenge Step-Up Guardrail","category":"security","severity":"critical","description":"Enforces cryptographic re-attestation and explicit user verification (UV) before high-privilege mutations to mitigate unauthorized actions from cloud-synced or cloned multi-device credentials. High-risk operations must mandate fresh server-side ephemeral challenges and reject any assertion lacking strict hardware-level user verification and action payload binding.","antiPatternHeadline":"Trusting Ambient Sessions or Permissive WebAuthn Assertions for Privileged Operations","stars_count":75,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","passkeys","step-up-authentication","cryptography","zero-trust"],"exportEndpoints":{"claude":"/api/rules/webauthn-synced-passkey-stepup-attestation-standard?format=claude","cursorMdc":"/api/rules/webauthn-synced-passkey-stepup-attestation-standard?format=mdc","cursorrules":"/api/rules/webauthn-synced-passkey-stepup-attestation-standard?format=cursor","windsurf":"/api/rules/webauthn-synced-passkey-stepup-attestation-standard?format=windsurf","agents":"/api/rules/webauthn-synced-passkey-stepup-attestation-standard?format=agents"}},{"id":"swift-6-complete-concurrency-bridge-isolation","title":"Swift 6 Complete Concurrency & Region-Based Isolation Across Native Bridges","category":"mobile","severity":"critical","description":"Enforces compiler-verified thread safety and region-based memory isolation across native platform bridging boundaries (e.g., React Native TurboModules, Flutter Platform Channels, JNI, UniFFI). Mandates strict compliance with Swift 6 Complete Concurrency, prohibiting unsafe concurrency escapes like unvetted '@unchecked Sendable' and unisolated mutable bridge state. Leverages SE-0414 region-based isolation to transfer disconnected mutable state safely across actor and thread domains without heap copying.","antiPatternHeadline":"Bypassing Swift 6 Concurrency via @unchecked Sendable and Raw Pointer Sharing Across Native Bridge Boundaries","stars_count":96,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","swift6","concurrency","sendable","region-isolation","native-bridge"],"exportEndpoints":{"claude":"/api/rules/swift-6-complete-concurrency-bridge-isolation?format=claude","cursorMdc":"/api/rules/swift-6-complete-concurrency-bridge-isolation?format=mdc","cursorrules":"/api/rules/swift-6-complete-concurrency-bridge-isolation?format=cursor","windsurf":"/api/rules/swift-6-complete-concurrency-bridge-isolation?format=windsurf","agents":"/api/rules/swift-6-complete-concurrency-bridge-isolation?format=agents"}},{"id":"cilium-ebpf-dynamic-l7-zerotrust-policy","title":"Cilium eBPF Dynamic L7 Zero-Trust Microsegmentation Standard","category":"devops","severity":"critical","description":"Enforces cryptographically attested, microsecond-latency L7 microsegmentation via Cilium eBPF socket redirection and in-kernel Envoy proxy injection, eliminating fragile sidecar proxies. Prohibits implicit inter-workload L3/L4 bypasses, unauthenticated egress, and wildcards in application-layer filtering rules.","antiPatternHeadline":"Deploying Permissive CIDR-Based Policies or Sidecar Meshes Lacking eBPF L7 Protocol Validation and SPIFFE Mutual Identity Attestation","stars_count":98,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","cilium","ebpf","zero-trust","kubernetes","security","network-policy"],"exportEndpoints":{"claude":"/api/rules/cilium-ebpf-dynamic-l7-zerotrust-policy?format=claude","cursorMdc":"/api/rules/cilium-ebpf-dynamic-l7-zerotrust-policy?format=mdc","cursorrules":"/api/rules/cilium-ebpf-dynamic-l7-zerotrust-policy?format=cursor","windsurf":"/api/rules/cilium-ebpf-dynamic-l7-zerotrust-policy?format=windsurf","agents":"/api/rules/cilium-ebpf-dynamic-l7-zerotrust-policy?format=agents"}},{"id":"kmp-swift6-strict-concurrency-actor-bridge","title":"KMP to Swift 6 Strict Concurrency Boundary & Actor Isolation Standard","category":"mobile","severity":"critical","description":"Enforces thread-safe, `@Sendable`-compliant boundary transitions between Kotlin/Native Coroutines and Swift 6 Actor-isolated execution contexts. Eliminates unsafe pointer passing, silent cross-thread data races, and SIGSEGV memory faults originating from bridging Objective-C runtime references across Swift concurrency domains.","antiPatternHeadline":"Exposing Raw KMP References to Swift Actors via Non-Sendable Bridges and Unbounded Callbacks","stars_count":99,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kmp","kotlin-multiplatform","swift6","concurrency","actors","coroutines"],"exportEndpoints":{"claude":"/api/rules/kmp-swift6-strict-concurrency-actor-bridge?format=claude","cursorMdc":"/api/rules/kmp-swift6-strict-concurrency-actor-bridge?format=mdc","cursorrules":"/api/rules/kmp-swift6-strict-concurrency-actor-bridge?format=cursor","windsurf":"/api/rules/kmp-swift6-strict-concurrency-actor-bridge?format=windsurf","agents":"/api/rules/kmp-swift6-strict-concurrency-actor-bridge?format=agents"}},{"id":"k8s-gateway-envoy-ebpf-socket-acceleration-guardrail","title":"Kubernetes Gateway API Envoy eBPF Socket Redirection Invariants","category":"devops","severity":"critical","description":"Enforces strict architectural and resource invariants when pairing Kubernetes Gateway API implementations (such as Cilium or Envoy Gateway) with eBPF sockops and sockmap socket acceleration. Bypasses the standard host TCP/IP stack safely for node-local L7 proxying while guaranteeing socket lookup continuity, mTLS SPIFFE validation, and cgroup namespace compatibility.","antiPatternHeadline":"Bypassing Host TCP/IP Without Node-Local Topology Constraints and Sockmap Socket Preservation","stars_count":47,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","kubernetes","gateway-api","envoy","ebpf","sockmap","mtls"],"exportEndpoints":{"claude":"/api/rules/k8s-gateway-envoy-ebpf-socket-acceleration-guardrail?format=claude","cursorMdc":"/api/rules/k8s-gateway-envoy-ebpf-socket-acceleration-guardrail?format=mdc","cursorrules":"/api/rules/k8s-gateway-envoy-ebpf-socket-acceleration-guardrail?format=cursor","windsurf":"/api/rules/k8s-gateway-envoy-ebpf-socket-acceleration-guardrail?format=windsurf","agents":"/api/rules/k8s-gateway-envoy-ebpf-socket-acceleration-guardrail?format=agents"}},{"id":"opentelemetry-genai-llm-semantic-conventions","title":"OpenTelemetry GenAI Semantic Convention Standard for Multi-Agent Pipelines","category":"devops","severity":"critical","description":"Standardizes OpenTelemetry GenAI semantic conventions across autonomous multi-agent pipelines to ensure deterministic context propagation, token quota observability, and vector retrieval traceability. Prohibits custom ad-hoc telemetry attributes, missing parent trace contexts in asynchronous agent handoffs, and untracked embeddings or model tool calls. Enforces compliance with standard `gen_ai.*` namespace attributes across all LLM inference and vector operations.","antiPatternHeadline":"Uncorrelated Agent Handoffs with Ad-Hoc LLM Metadata and Missing Token Accounting Spans","stars_count":90,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","genai","llm","distributed-tracing","observability","agents"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-genai-llm-semantic-conventions?format=claude","cursorMdc":"/api/rules/opentelemetry-genai-llm-semantic-conventions?format=mdc","cursorrules":"/api/rules/opentelemetry-genai-llm-semantic-conventions?format=cursor","windsurf":"/api/rules/opentelemetry-genai-llm-semantic-conventions?format=windsurf","agents":"/api/rules/opentelemetry-genai-llm-semantic-conventions?format=agents"}},{"id":"go-chi-context-deadline-propagation","title":"Go Chi Upstream Context Deadline & Cascading RPC Cancellation Guardrail","category":"backend","severity":"critical","description":"Enforces strict derivation and propagation of HTTP request contexts across Chi middleware, database transactions, and outbound RPC trees. Guarantees deterministic cascading cancellation upon client disconnection or middleware timeout expiration, eliminating orphan goroutines and socket exhaustion under heavy degradation.","antiPatternHeadline":"Severing context trees with context.Background() and unmonitored goroutines during outbound RPC fan-out","stars_count":88,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","chi","concurrency","context-propagation","goroutine-leaks","resilience"],"exportEndpoints":{"claude":"/api/rules/go-chi-context-deadline-propagation?format=claude","cursorMdc":"/api/rules/go-chi-context-deadline-propagation?format=mdc","cursorrules":"/api/rules/go-chi-context-deadline-propagation?format=cursor","windsurf":"/api/rules/go-chi-context-deadline-propagation?format=windsurf","agents":"/api/rules/go-chi-context-deadline-propagation?format=agents"}},{"id":"android-15-16kb-page-alignment-invariant-android-15-16kb--368","title":"Android 15 16KB Page Size ELF Alignment and Native Memory Invariant","category":"mobile","severity":"critical","description":"Enforces strict 16KB (0x4000) ELF segment alignment and page boundary compatibility across all C/C++ native NDK binaries, third-party shared libraries (.so), CMake/ndk-build toolchains, and custom memory allocators. Android 15 introduces support for 16KB physical memory page sizes on modern ARM64 hardware; loading unaligned 4KB ELF binaries causes immediate `dlopen()` failures and SIGSEGV process termination at startup.","antiPatternHeadline":"Compiling NDK binaries or bundling third-party native libraries with 4KB page alignment assumptions causing fatal SIGSEGV crashes on Android 15 ARM64 devices.","stars_count":65,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","android","ndk","android-15","memory-alignment","cpp","cmake","gradle"],"exportEndpoints":{"claude":"/api/rules/android-15-16kb-page-alignment-invariant-android-15-16kb--368?format=claude","cursorMdc":"/api/rules/android-15-16kb-page-alignment-invariant-android-15-16kb--368?format=mdc","cursorrules":"/api/rules/android-15-16kb-page-alignment-invariant-android-15-16kb--368?format=cursor","windsurf":"/api/rules/android-15-16kb-page-alignment-invariant-android-15-16kb--368?format=windsurf","agents":"/api/rules/android-15-16kb-page-alignment-invariant-android-15-16kb--368?format=agents"}},{"id":"drizzle-multitenant-prepared-statement-cache-partitioning","title":"Drizzle ORM Multi-Tenant Prepared Statement Isolation & Cache Partitioning","category":"backend","severity":"critical","description":"Mandates strict tenant-partitioned prepared statement caching and pool-aware execution strategies in multi-tenant Drizzle ORM architectures. Eliminates cross-tenant query plan pollution, statement name collisions under transaction pooling (PgBouncer), and process memory leaks in dynamic schema environments.","antiPatternHeadline":"Global Unpartitioned Prepared Statement Caching Across Dynamic Multi-Tenant Schemas","stars_count":111,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","drizzle-orm","multi-tenancy","pgbouncer","postgresql","serverless"],"exportEndpoints":{"claude":"/api/rules/drizzle-multitenant-prepared-statement-cache-partitioning?format=claude","cursorMdc":"/api/rules/drizzle-multitenant-prepared-statement-cache-partitioning?format=mdc","cursorrules":"/api/rules/drizzle-multitenant-prepared-statement-cache-partitioning?format=cursor","windsurf":"/api/rules/drizzle-multitenant-prepared-statement-cache-partitioning?format=windsurf","agents":"/api/rules/drizzle-multitenant-prepared-statement-cache-partitioning?format=agents"}},{"id":"slsa-v1-sigstore-keyless-provenance-attestation","title":"SLSA v1.0 Provenance Attestation with Sigstore Keyless Ephemeral Signing","category":"security","severity":"critical","description":"Enforces non-forgeable SLSA v1.0 Level 3 build provenance for container artifacts using Sigstore keyless ephemeral signing via Fulcio OIDC federation and Rekor transparency logs. Prevents compromised CI/CD runners, unauthorized build modifications, and unverifiable binary delivery by guaranteeing cryptographic non-repudiation and immutable digest pinning. Mandates that verification occurs before ingestion and runtime admission via cryptographically enforced identity claims rather than ambient trust.","antiPatternHeadline":"Long-lived static signing keys, unpinned artifact digests, and self-generated unverified provenance statements.","stars_count":95,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","slsa-v1","sigstore","cosign","supply-chain","provenance"],"exportEndpoints":{"claude":"/api/rules/slsa-v1-sigstore-keyless-provenance-attestation?format=claude","cursorMdc":"/api/rules/slsa-v1-sigstore-keyless-provenance-attestation?format=mdc","cursorrules":"/api/rules/slsa-v1-sigstore-keyless-provenance-attestation?format=cursor","windsurf":"/api/rules/slsa-v1-sigstore-keyless-provenance-attestation?format=windsurf","agents":"/api/rules/slsa-v1-sigstore-keyless-provenance-attestation?format=agents"}},{"id":"react-19-use-action-state-optimistic-replay-invariants","title":"React 19 useActionState & Optimistic Update Idempotent Replay Standard","category":"frontend","severity":"critical","description":"Enforces strict synchronization between React 19 useActionState, useOptimistic, and server actions. Prevents orphaned client-side UI drift and state inconsistency during transient network partitions, server rejections, and retry storms by binding client-generated idempotency keys with deterministic rollback boundaries.","antiPatternHeadline":"Unreconciled Optimistic State with Non-Idempotent Server Actions Causing Ghost UI Drift","stars_count":40,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["react19","useActionState","useOptimistic","idempotency","frontend","server-actions"],"exportEndpoints":{"claude":"/api/rules/react-19-use-action-state-optimistic-replay-invariants?format=claude","cursorMdc":"/api/rules/react-19-use-action-state-optimistic-replay-invariants?format=mdc","cursorrules":"/api/rules/react-19-use-action-state-optimistic-replay-invariants?format=cursor","windsurf":"/api/rules/react-19-use-action-state-optimistic-replay-invariants?format=windsurf","agents":"/api/rules/react-19-use-action-state-optimistic-replay-invariants?format=agents"}},{"id":"svelte5-ssr-runes-context-leakage-isolation","title":"Svelte 5 Rune-Driven SSR Context Leakage & Module Isolation Standard","category":"frontend","severity":"critical","description":"Enforces strict lifecycle encapsulation of Svelte 5 universal reactive primitives ($state, $derived) within server-side rendering contexts. Prevents cross-request multi-tenant state corruption and session hijacking caused by module-scoped reactive singletons in shared server runtime processes.","antiPatternHeadline":"Module-Scope Mutable Runes Leaking Tenant State Across Concurrent SSR Lifecycles","stars_count":67,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","ssr","security","multi-tenancy"],"exportEndpoints":{"claude":"/api/rules/svelte5-ssr-runes-context-leakage-isolation?format=claude","cursorMdc":"/api/rules/svelte5-ssr-runes-context-leakage-isolation?format=mdc","cursorrules":"/api/rules/svelte5-ssr-runes-context-leakage-isolation?format=cursor","windsurf":"/api/rules/svelte5-ssr-runes-context-leakage-isolation?format=windsurf","agents":"/api/rules/svelte5-ssr-runes-context-leakage-isolation?format=agents"}},{"id":"go-chi-graceful-draining-goroutine-leak-prevention","title":"Go 1.24 Chi Context-Driven Graceful Pipeline Draining & Goroutine Leak Invariants","category":"backend","severity":"critical","description":"Enforces strict context propagation, deterministic goroutine lifecycle bounding, and orderly HTTP server draining for Go 1.24 applications using the Chi router during Kubernetes SIGTERM rolling updates. Prevents dropped in-flight requests and lingering background workers by synchronizing OS signal captures, net/http server shutdowns, and context-chained channel pipelines with sync.WaitGroup barriers.","antiPatternHeadline":"Unbounded Background Goroutines, Detached Contexts, and Abrupt Process Termination Dropping In-Flight Workloads","stars_count":52,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","golang","chi","concurrency","kubernetes","graceful-shutdown","goroutines"],"exportEndpoints":{"claude":"/api/rules/go-chi-graceful-draining-goroutine-leak-prevention?format=claude","cursorMdc":"/api/rules/go-chi-graceful-draining-goroutine-leak-prevention?format=mdc","cursorrules":"/api/rules/go-chi-graceful-draining-goroutine-leak-prevention?format=cursor","windsurf":"/api/rules/go-chi-graceful-draining-goroutine-leak-prevention?format=windsurf","agents":"/api/rules/go-chi-graceful-draining-goroutine-leak-prevention?format=agents"}},{"id":"postgres-17-hnsw-concurrency-autovacuum-guardrails","title":"Postgres 17 pgvector HNSW Concurrency & Autovacuum Budgeting Guardrails","category":"backend","severity":"critical","description":"Enforces deterministic table-level autovacuum budgeting, transaction batching, and resource isolation for pgvector HNSW indexes in PostgreSQL 17. Prevents OOM kills, index bloat, and catastrophic p99 vector search latency degradation caused by unthrottled concurrent inserts and autovacuum worker resource starvation.","antiPatternHeadline":"Default Autovacuum Settings with Unbounded Concurrent Inserts on HNSW Vector Tables","stars_count":57,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres-17","pgvector","hnsw","database-reliability","performance"],"exportEndpoints":{"claude":"/api/rules/postgres-17-hnsw-concurrency-autovacuum-guardrails?format=claude","cursorMdc":"/api/rules/postgres-17-hnsw-concurrency-autovacuum-guardrails?format=mdc","cursorrules":"/api/rules/postgres-17-hnsw-concurrency-autovacuum-guardrails?format=cursor","windsurf":"/api/rules/postgres-17-hnsw-concurrency-autovacuum-guardrails?format=windsurf","agents":"/api/rules/postgres-17-hnsw-concurrency-autovacuum-guardrails?format=agents"}},{"id":"kmp-swift-export-concurrency-actor-invariants","title":"KMP Swift-Export Concurrency & Thread-Boundary Invariants","category":"mobile","severity":"critical","description":"Enforces strict actor isolation, Sendable boundary enforcement, and cooperative cancellation propagation when bridging Kotlin Native Coroutines into Swift 6 Concurrency. Prevents cooperative thread pool starvation, ARC-to-Kotlin GC cross-runtime reference retention cycles, and actor reentrancy data corruption.","antiPatternHeadline":"Leaking Mutable Kotlin References Across Swift 6 Actor Boundaries Without Cancellation Synchronization","stars_count":78,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kmp","kotlin-native","swift6","concurrency","actors","coroutines"],"exportEndpoints":{"claude":"/api/rules/kmp-swift-export-concurrency-actor-invariants?format=claude","cursorMdc":"/api/rules/kmp-swift-export-concurrency-actor-invariants?format=mdc","cursorrules":"/api/rules/kmp-swift-export-concurrency-actor-invariants?format=cursor","windsurf":"/api/rules/kmp-swift-export-concurrency-actor-invariants?format=windsurf","agents":"/api/rules/kmp-swift-export-concurrency-actor-invariants?format=agents"}},{"id":"capacitor-7-zero-copy-arraybuffer-bridge-standard","title":"Capacitor 7 Zero-Copy ArrayBuffer Bridge Serialization Standard","category":"mobile","severity":"critical","description":"Enforces direct native memory and WebView transfer using Capacitor 7 native binary bridges for high-frequency sensor readings, audio buffers, and camera frames. Eliminates main-thread JavaScript UI freezes and native GC pressure caused by base64 encoding or JSON stringification of contiguous byte payloads.","antiPatternHeadline":"Encoding High-Throughput Binary Streams as Base64 or Serialized Number Arrays Across the Native Bridge","stars_count":85,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["capacitor","ios","android","arraybuffer","performance","memory-management"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-zero-copy-arraybuffer-bridge-standard?format=claude","cursorMdc":"/api/rules/capacitor-7-zero-copy-arraybuffer-bridge-standard?format=mdc","cursorrules":"/api/rules/capacitor-7-zero-copy-arraybuffer-bridge-standard?format=cursor","windsurf":"/api/rules/capacitor-7-zero-copy-arraybuffer-bridge-standard?format=windsurf","agents":"/api/rules/capacitor-7-zero-copy-arraybuffer-bridge-standard?format=agents"}},{"id":"webauthn-l3-device-bound-attestation-conditional-mediation","title":"WebAuthn L3 Passkey Device-Bound Attestation and Conditional Mediation Verification","category":"security","severity":"critical","description":"Enforces strict validation of WebAuthn Level 3 device-bound passkeys to mitigate unauthorized sync and credential-phishing attacks. Mandates server-side cryptographic verification of authenticator data flags (User Presence, User Verification, Backup State, Backup Eligibility) and requires client-side conditional UI mediation checks backed by AbortSignal lifecycle management.","antiPatternHeadline":"Accepting Synced Multi-Device Passkeys for High-Assurance Workflows and Unmediated Autofill Requests","stars_count":48,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","passkeys","fido2","cryptography","authentication"],"exportEndpoints":{"claude":"/api/rules/webauthn-l3-device-bound-attestation-conditional-mediation?format=claude","cursorMdc":"/api/rules/webauthn-l3-device-bound-attestation-conditional-mediation?format=mdc","cursorrules":"/api/rules/webauthn-l3-device-bound-attestation-conditional-mediation?format=cursor","windsurf":"/api/rules/webauthn-l3-device-bound-attestation-conditional-mediation?format=windsurf","agents":"/api/rules/webauthn-l3-device-bound-attestation-conditional-mediation?format=agents"}},{"id":"spiffe-spire-svid-rotation-guardrail","title":"Mandatory SPIFFE/SPIRE Ephemeral SVID Streaming and Zero-Static-Secret Federation","category":"security","severity":"critical","description":"Enforces dynamic Workload Identity consumption exclusively through the SPIFFE/SPIRE Workload API UNIX domain socket, requiring active rotation stream listeners for ephemeral X.509 and JWT SVIDs. Forbids static long-lived credentials, persisting ephemeral private keys to disk, and bypasses of trust-domain federation boundaries. Mandates exact SPIFFE ID validation on all authenticated peer connections.","antiPatternHeadline":"Persisting SVID Keys to Disk or Bypassing Workload API In-Memory Rotation Streams","stars_count":94,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","spiffe","spire","zero-trust","mtls","iam-federation"],"exportEndpoints":{"claude":"/api/rules/spiffe-spire-svid-rotation-guardrail?format=claude","cursorMdc":"/api/rules/spiffe-spire-svid-rotation-guardrail?format=mdc","cursorrules":"/api/rules/spiffe-spire-svid-rotation-guardrail?format=cursor","windsurf":"/api/rules/spiffe-spire-svid-rotation-guardrail?format=windsurf","agents":"/api/rules/spiffe-spire-svid-rotation-guardrail?format=agents"}},{"id":"otel-collector-arrow-buffer-governance","title":"OpenTelemetry Collector OTLP/Arrow Columnar Ingestion and Buffer Budget Governance","category":"devops","severity":"critical","description":"Enforces strict memory governance, hard queue sizing, and Apache Arrow columnar compression on OpenTelemetry Collector pipelines. Prevents catastrophic OOM collector crashes during high-cardinality traffic surges through zero-copy batch streaming and calibrated memory limiter thresholds.","antiPatternHeadline":"Unbounded In-Memory Batching and Row-Oriented Serialization Inducing Out-of-Memory Collector Cascades","stars_count":115,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","apache-arrow","memory-management","observability","resilience"],"exportEndpoints":{"claude":"/api/rules/otel-collector-arrow-buffer-governance?format=claude","cursorMdc":"/api/rules/otel-collector-arrow-buffer-governance?format=mdc","cursorrules":"/api/rules/otel-collector-arrow-buffer-governance?format=cursor","windsurf":"/api/rules/otel-collector-arrow-buffer-governance?format=windsurf","agents":"/api/rules/otel-collector-arrow-buffer-governance?format=agents"}},{"id":"cilium-ebpf-wireguard-zero-trust-guardrail","title":"Cilium eBPF L7 WireGuard In-Kernel Zero-Trust Network Policy Guardrail","category":"devops","severity":"critical","description":"Enforces strict in-kernel zero-trust microsegmentation using CiliumNetworkPolicies and node-to-node WireGuard encryption, bypassing userspace sidecar proxies. Eliminates insecure CIDR-based rules and plaintext pod-to-pod transit by mandating cryptographic identity-aware L3/L4/L7 rules executed directly within Linux eBPF hooks. Guarantees default-deny egress/ingress postures while restricting application traffic strictly to explicit HTTP/gRPC methods and paths.","antiPatternHeadline":"Deploying permissive CIDR-based K8s NetworkPolicies with unencrypted node-to-node transit and userspace sidecar proxy bypass vulnerabilities","stars_count":41,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","cilium","ebpf","wireguard","kubernetes","zero-trust","security"],"exportEndpoints":{"claude":"/api/rules/cilium-ebpf-wireguard-zero-trust-guardrail?format=claude","cursorMdc":"/api/rules/cilium-ebpf-wireguard-zero-trust-guardrail?format=mdc","cursorrules":"/api/rules/cilium-ebpf-wireguard-zero-trust-guardrail?format=cursor","windsurf":"/api/rules/cilium-ebpf-wireguard-zero-trust-guardrail?format=windsurf","agents":"/api/rules/cilium-ebpf-wireguard-zero-trust-guardrail?format=agents"}},{"id":"nextjs-15-router-cache-stale-time-governance","title":"Next.js 15 Client-Side Router Cache Stale-Time Governance","category":"frontend","severity":"critical","description":"Next.js 15 changes the default Router Cache staleTimes to 0 seconds for dynamic renders, yet misconfigurations in Link prefetching, unstable cache revalidation, and route-segment configs can re-introduce silent cache persistence or trigger severe server thrashing. This standard strictly governs client-side router cache invalidation, fetch revalidation flags, and explicit staleTimes in next.config.js to eliminate mutated state desynchronization across client navigations.","antiPatternHeadline":"Uncontrolled Client Navigation Cache Retaining Mutated State or Triggering Unchecked Dynamic Request Thrashing","stars_count":80,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs","router-cache","caching","react-server-components"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-router-cache-stale-time-governance?format=claude","cursorMdc":"/api/rules/nextjs-15-router-cache-stale-time-governance?format=mdc","cursorrules":"/api/rules/nextjs-15-router-cache-stale-time-governance?format=cursor","windsurf":"/api/rules/nextjs-15-router-cache-stale-time-governance?format=windsurf","agents":"/api/rules/nextjs-15-router-cache-stale-time-governance?format=agents"}},{"id":"openfga-rebac-traversal-latency-guardrail","title":"OpenFGA ReBAC Graph Traversal & Sub-10ms Latency Bound Guardrail","category":"security","severity":"critical","description":"Enforces deterministic sub-10ms relation tuple resolution and cycle-detection limits to eliminate authorization latency spikes across deeply nested multi-tenant graphs. Prevents unbounded recursive schema evaluation, guarantees client-side timeouts with fail-closed semantics, and mandates contextual tuple hydration over arbitrary runtime graph hops.","antiPatternHeadline":"Unbounded Recursive Model Traversal and Un-budgeted Graph Checks in the Critical Request Path","stars_count":89,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","rebac","openfga","authorization","graph-traversal","performance"],"exportEndpoints":{"claude":"/api/rules/openfga-rebac-traversal-latency-guardrail?format=claude","cursorMdc":"/api/rules/openfga-rebac-traversal-latency-guardrail?format=mdc","cursorrules":"/api/rules/openfga-rebac-traversal-latency-guardrail?format=cursor","windsurf":"/api/rules/openfga-rebac-traversal-latency-guardrail?format=windsurf","agents":"/api/rules/openfga-rebac-traversal-latency-guardrail?format=agents"}},{"id":"capacitor-7-hardware-keystore-cryptographic-boundary","title":"Capacitor 7 Hardware-Backed KeyStore & Biometric Zero-Plaintext Boundary","category":"mobile","severity":"critical","description":"Enforces hardware-isolated asymmetric key generation within Android StrongBox Keymaster and iOS Secure Enclave, strictly prohibiting plaintext session tokens and symmetric secrets from residing in the hybrid WebView JavaScript memory, LocalStorage, or standard Capacitor Preferences. All session verifications must execute via hardware-attested cryptographic challenge signing with biometric gatekeeping at the native boundary.","antiPatternHeadline":"Persisting Plaintext Bearer Tokens in Hybrid Storage or Leaking Symmetric Keys to JS Heap","stars_count":118,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","cryptography","secure-enclave","android-keystore","biometrics","zero-trust"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-hardware-keystore-cryptographic-boundary?format=claude","cursorMdc":"/api/rules/capacitor-7-hardware-keystore-cryptographic-boundary?format=mdc","cursorrules":"/api/rules/capacitor-7-hardware-keystore-cryptographic-boundary?format=cursor","windsurf":"/api/rules/capacitor-7-hardware-keystore-cryptographic-boundary?format=windsurf","agents":"/api/rules/capacitor-7-hardware-keystore-cryptographic-boundary?format=agents"}},{"id":"pg17-subxact-overflow-logical-decoding-guardrail","title":"PostgreSQL 17 Subtransaction Snapshot Overflow & Logical Decoding Protection","category":"backend","severity":"critical","description":"Enforces strict limits on nested subtransactions and savepoints to prevent PGPROC cache overflow (>64 subxacts) and SubtransSLRU lock contention. Eliminates catastrophic replication worker stalling, ReorderBuffer disk spillages, and replication lag during high-throughput Change Data Capture (CDC).","antiPatternHeadline":"Unbounded Iterative Savepoints Inside Long-Lived Transactions Triggering SLRU Thrashing","stars_count":111,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","logical-replication","cdc","database-performance","concurrency"],"exportEndpoints":{"claude":"/api/rules/pg17-subxact-overflow-logical-decoding-guardrail?format=claude","cursorMdc":"/api/rules/pg17-subxact-overflow-logical-decoding-guardrail?format=mdc","cursorrules":"/api/rules/pg17-subxact-overflow-logical-decoding-guardrail?format=cursor","windsurf":"/api/rules/pg17-subxact-overflow-logical-decoding-guardrail?format=windsurf","agents":"/api/rules/pg17-subxact-overflow-logical-decoding-guardrail?format=agents"}},{"id":"bun-websocket-backpressure-high-watermark-standard","title":"Bun 1.2 Native WebSocket Backpressure High-Watermark Standard","category":"backend","severity":"critical","description":"Enforces strict backpressure monitoring on Bun native WebSockets using `ws.getBufferedAmount()` and the return value of `ws.send()`. Failure to handle backpressure allows slow or malicious consumers to force unbounded C++ heap buffer allocations in uWebSockets, causing process-level Out-Of-Memory (OOM) crashes under sustained broadcast loads.","antiPatternHeadline":"Unchecked Fire-and-Forget Streaming Over Saturated Bun WebSockets Inducing Native Heap Exhaustion","stars_count":71,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","websockets","backpressure","memory-leak","real-time"],"exportEndpoints":{"claude":"/api/rules/bun-websocket-backpressure-high-watermark-standard?format=claude","cursorMdc":"/api/rules/bun-websocket-backpressure-high-watermark-standard?format=mdc","cursorrules":"/api/rules/bun-websocket-backpressure-high-watermark-standard?format=cursor","windsurf":"/api/rules/bun-websocket-backpressure-high-watermark-standard?format=windsurf","agents":"/api/rules/bun-websocket-backpressure-high-watermark-standard?format=agents"}},{"id":"go-chi-context-cancellation-cascade","title":"Go Chi Context-Aware Deadline and Upstream Cancellation Cascade","category":"backend","severity":"critical","description":"Enforces strict propagation of Chi HTTP request contexts (`r.Context()`) down to all database drivers, external RPC calls, and derived child goroutines. Prevents orphaned goroutines, zombie connection leaks, and wasted compute across downstream dependencies when clients abort or disconnect prematurely.","antiPatternHeadline":"Ignoring r.Context() or Decoupling Background Goroutines with context.Background()","stars_count":90,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","chi","context","sql","concurrency"],"exportEndpoints":{"claude":"/api/rules/go-chi-context-cancellation-cascade?format=claude","cursorMdc":"/api/rules/go-chi-context-cancellation-cascade?format=mdc","cursorrules":"/api/rules/go-chi-context-cancellation-cascade?format=cursor","windsurf":"/api/rules/go-chi-context-cancellation-cascade?format=windsurf","agents":"/api/rules/go-chi-context-cancellation-cascade?format=agents"}},{"id":"tetragon-lsm-provenance-enforcement","title":"Kernel-Level Syscall Provenance and Namespace Escape Enforcement via Tetragon","category":"security","severity":"critical","description":"Enforces deterministic, in-kernel syscall authorization using Tetragon TracingPolicies backed by BPF LSM hooks rather than userspace audit loops or post-execution telemetry. Prevents binary execution hijacking, unauthorized binary execs, and mount namespace breakout attacks synchronously before userspace processes can pivot within Kubernetes nodes.","antiPatternHeadline":"Post-execution asynchronous audit logging and non-blocking eBPF kprobes allowing lateral movement before remediation","stars_count":104,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","ebpf","tetragon","lsm","kubernetes","linux-kernel","runtime-security"],"exportEndpoints":{"claude":"/api/rules/tetragon-lsm-provenance-enforcement?format=claude","cursorMdc":"/api/rules/tetragon-lsm-provenance-enforcement?format=mdc","cursorrules":"/api/rules/tetragon-lsm-provenance-enforcement?format=cursor","windsurf":"/api/rules/tetragon-lsm-provenance-enforcement?format=windsurf","agents":"/api/rules/tetragon-lsm-provenance-enforcement?format=agents"}},{"id":"opentelemetry-baggage-isolation-cardinality-guardrail","title":"OpenTelemetry W3C Baggage Isolation and Metric Cardinality Guardrail","category":"devops","severity":"critical","description":"Distributed tracing setups that blindly forward W3C Baggage across perimeter boundaries leak sensitive PII downstream and trigger metric cardinality denial-of-service. This guardrail mandates strict allowlisting for baggage propagation across services, completely decouples baggage from metric dimensions, and enforces bounded cardinality controls at span and metric boundaries.","antiPatternHeadline":"Blind W3C Baggage Propagation and High-Cardinality Dimension Injection into Metrics","stars_count":57,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","observability","distributed-tracing","metrics","cardinality","security"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-baggage-isolation-cardinality-guardrail?format=claude","cursorMdc":"/api/rules/opentelemetry-baggage-isolation-cardinality-guardrail?format=mdc","cursorrules":"/api/rules/opentelemetry-baggage-isolation-cardinality-guardrail?format=cursor","windsurf":"/api/rules/opentelemetry-baggage-isolation-cardinality-guardrail?format=windsurf","agents":"/api/rules/opentelemetry-baggage-isolation-cardinality-guardrail?format=agents"}},{"id":"k8s-gateway-v1-2-cross-mesh-failover-invariant","title":"Kubernetes Gateway API v1.2 Multi-Cluster Cross-Mesh Failover and Resilience Invariant","category":"devops","severity":"critical","description":"Enforces vendor-neutral multi-cluster routing, cross-cloud failover, and active resiliency contracts exclusively using Kubernetes Gateway API v1.2 specification primitives. Prohibits reliance on proprietary service mesh CRDs (such as Istio VirtualService/DestinationRule or Linkerd TrafficSplit), mandating HTTPRoute backendRefs, ServiceImport targeting, explicit ReferenceGrants, and standard request timeouts.","antiPatternHeadline":"Proprietary Mesh Lock-in via Vendor CRDs for Ingress Failover and Cross-Cluster Routing","stars_count":118,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","kubernetes","gateway-api","service-mesh","multi-cluster","high-availability","cloud-native"],"exportEndpoints":{"claude":"/api/rules/k8s-gateway-v1-2-cross-mesh-failover-invariant?format=claude","cursorMdc":"/api/rules/k8s-gateway-v1-2-cross-mesh-failover-invariant?format=mdc","cursorrules":"/api/rules/k8s-gateway-v1-2-cross-mesh-failover-invariant?format=cursor","windsurf":"/api/rules/k8s-gateway-v1-2-cross-mesh-failover-invariant?format=windsurf","agents":"/api/rules/k8s-gateway-v1-2-cross-mesh-failover-invariant?format=agents"}},{"id":"react-19-rsc-taint-object-guardrails","title":"React 19 Server Components Experimental Taint Object and Value Guardrails","category":"frontend","severity":"critical","description":"Enforces compiler-level and runtime tainted token boundaries using React 19 experimental taint APIs (taintObjectReference and taintUniqueValue) across all Server-to-Client component serialization boundaries. Prevents multi-tenant credentials, cryptographic secrets, database instances, and raw internal entities from leaking into client-side flight payloads.","antiPatternHeadline":"Passing un-tainted raw entity models and cryptographic tokens directly across Server/Client component props","stars_count":66,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","rsc","security","taint-api","data-leakage"],"exportEndpoints":{"claude":"/api/rules/react-19-rsc-taint-object-guardrails?format=claude","cursorMdc":"/api/rules/react-19-rsc-taint-object-guardrails?format=mdc","cursorrules":"/api/rules/react-19-rsc-taint-object-guardrails?format=cursor","windsurf":"/api/rules/react-19-rsc-taint-object-guardrails?format=windsurf","agents":"/api/rules/react-19-rsc-taint-object-guardrails?format=agents"}},{"id":"svelte-5-worker-proxy-transfer-barrier","title":"Svelte 5 Deep-Proxy Signal Barrier for Web Worker Structured Clones","category":"frontend","severity":"critical","description":"Svelte 5 wraps reactive objects created via `$state` in deep reactivity proxies tightly coupled to the Universal Signal runtime graph. Passing or serializing these proxies directly across Web Worker boundaries triggers DataCloneError exceptions or corrupts reactivity tracking, causing permanent state desynchronization. All state exiting or entering thread contexts must traverse an explicit barrier via `$state.snapshot()`.","antiPatternHeadline":"Direct Inter-Thread Serialization of Svelte 5 Live Signal Proxies via postMessage or structuredClone","stars_count":109,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte","svelte-5","runes","web-workers","signals","concurrency"],"exportEndpoints":{"claude":"/api/rules/svelte-5-worker-proxy-transfer-barrier?format=claude","cursorMdc":"/api/rules/svelte-5-worker-proxy-transfer-barrier?format=mdc","cursorrules":"/api/rules/svelte-5-worker-proxy-transfer-barrier?format=cursor","windsurf":"/api/rules/svelte-5-worker-proxy-transfer-barrier?format=windsurf","agents":"/api/rules/svelte-5-worker-proxy-transfer-barrier?format=agents"}},{"id":"axum-tokio-cancellation-safe-mutex-invariants","title":"Axum 0.8 Tokio Cancellation-Safe State Invariants & Mutex Hygiene","category":"backend","severity":"critical","description":"Enforces strict cancellation safety in Axum 0.8 handlers backed by Tokio runtimes. Prevents partial state mutation, deadlocks, and invariant corruption when HTTP/2 RST_STREAM or client TCP drops abort handlers mid-execution across .await points.","antiPatternHeadline":"Mutating shared zero-copy state across async yield points without cancellation-safe transactional rollback.","stars_count":81,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tokio","concurrency","cancellation-safety"],"exportEndpoints":{"claude":"/api/rules/axum-tokio-cancellation-safe-mutex-invariants?format=claude","cursorMdc":"/api/rules/axum-tokio-cancellation-safe-mutex-invariants?format=mdc","cursorrules":"/api/rules/axum-tokio-cancellation-safe-mutex-invariants?format=cursor","windsurf":"/api/rules/axum-tokio-cancellation-safe-mutex-invariants?format=windsurf","agents":"/api/rules/axum-tokio-cancellation-safe-mutex-invariants?format=agents"}},{"id":"fastapi-asyncpg-lifespan-drain-protocol","title":"FastAPI Lifespan Asyncpg Connection Pool Drain Protocol","category":"backend","severity":"critical","description":"Enforces graceful connection draining for asyncpg connection pools during FastAPI lifespan context teardown. Mandates bounded timeouts using asyncio.wait_for with explicit fallback to pool termination, preventing container shutdown hangs and orphaned in-flight database transactions during rolling orchestrator deployments.","antiPatternHeadline":"Unbounded Asyncpg Pool Closure or Missing Fallback Causing Hanging Lifespans and SIGKILL Socket Drops","stars_count":107,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["fastapi","asyncpg","postgresql","lifespan","kubernetes","graceful-shutdown","backend"],"exportEndpoints":{"claude":"/api/rules/fastapi-asyncpg-lifespan-drain-protocol?format=claude","cursorMdc":"/api/rules/fastapi-asyncpg-lifespan-drain-protocol?format=mdc","cursorrules":"/api/rules/fastapi-asyncpg-lifespan-drain-protocol?format=cursor","windsurf":"/api/rules/fastapi-asyncpg-lifespan-drain-protocol?format=windsurf","agents":"/api/rules/fastapi-asyncpg-lifespan-drain-protocol?format=agents"}},{"id":"bun-sqlite-wal-serial-write-barrier","title":"Bun 1.2 Native SQLite Multi-Threaded WAL Flush Synchronization Standard","category":"backend","severity":"critical","description":"Enforces a strict serial write barrier architecture with isolated read replicas when using Bun 1.2 native bun:sqlite across multi-threaded workers. Prohibits multi-isolate concurrent write transactions and uncoordinated WAL checkpoints that trigger SQLITE_BUSY locks, deadlocks, and WAL file bloat.","antiPatternHeadline":"Uncoordinated Multi-Isolate Write Connections and Arbitrary WAL Checkpoints Causing SQLITE_BUSY Lock Contention","stars_count":51,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","sqlite","wal-mode","concurrency","multi-threading"],"exportEndpoints":{"claude":"/api/rules/bun-sqlite-wal-serial-write-barrier?format=claude","cursorMdc":"/api/rules/bun-sqlite-wal-serial-write-barrier?format=mdc","cursorrules":"/api/rules/bun-sqlite-wal-serial-write-barrier?format=cursor","windsurf":"/api/rules/bun-sqlite-wal-serial-write-barrier?format=windsurf","agents":"/api/rules/bun-sqlite-wal-serial-write-barrier?format=agents"}},{"id":"postgres17-json-table-nested-projection-memory-bounds","title":"Postgres 17 JSON_TABLE Nested Projection Memory Bounds Guardrail","category":"backend","severity":"critical","description":"Enforces strict batching, Cartesian isolation, and memory bounding on Postgres 17 JSON_TABLE queries during high-throughput nested JSON ingestion. Uncoordinated multi-level NESTED PATH clauses expand intermediate tuple slots inside executor memory contexts, causing backend memory exhaustion and worker process termination. Application code must enforce ingestion chunk sizes, bounded path projections, and transactional work_mem thresholds.","antiPatternHeadline":"Unbounded Multi-Level NESTED PATH Projections Triggering Backend Worker OOM Crashes","stars_count":75,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres","postgres17","json-table","sql","performance","memory-safety"],"exportEndpoints":{"claude":"/api/rules/postgres17-json-table-nested-projection-memory-bounds?format=claude","cursorMdc":"/api/rules/postgres17-json-table-nested-projection-memory-bounds?format=mdc","cursorrules":"/api/rules/postgres17-json-table-nested-projection-memory-bounds?format=cursor","windsurf":"/api/rules/postgres17-json-table-nested-projection-memory-bounds?format=windsurf","agents":"/api/rules/postgres17-json-table-nested-projection-memory-bounds?format=agents"}},{"id":"kmp-stateflow-swift-bridge-memory-barrier","title":"KMP StateFlow Swift-Bridge Memory Barrier and Concurrency Protocol","category":"mobile","severity":"critical","description":"Enforces strict memory barrier synchronization and dispatch-thread alignment when bridging Kotlin Coroutine StateFlow instances to Swift async runtimes. Eliminates silent data races, thread-crossing memory leaks, and dropped frame updates caused by non-atomic runtime transitions between Kotlin/Native memory models and Swift Structured Concurrency.","antiPatternHeadline":"Directly Consuming Raw KMP StateFlow in Swift Contexts Without Actor Boundary Isolation and Cooperative Job Cancellation","stars_count":77,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kmp","kotlin-native","swift","concurrency","stateflow","memory-barrier"],"exportEndpoints":{"claude":"/api/rules/kmp-stateflow-swift-bridge-memory-barrier?format=claude","cursorMdc":"/api/rules/kmp-stateflow-swift-bridge-memory-barrier?format=mdc","cursorrules":"/api/rules/kmp-stateflow-swift-bridge-memory-barrier?format=cursor","windsurf":"/api/rules/kmp-stateflow-swift-bridge-memory-barrier?format=windsurf","agents":"/api/rules/kmp-stateflow-swift-bridge-memory-barrier?format=agents"}},{"id":"capacitor-7-biometric-enclave-token-binding","title":"Hardware-Enclave Biometric Token Binding Invariant for Capacitor 7","category":"mobile","severity":"critical","description":"Cryptographically tethers local authentication and refresh tokens to hardware-backed Secure Enclave or Android StrongBox key pairs requiring biometric verification. Prevents session hijacking and token exfiltration across hybrid WebViews, rooted environments, or device backup compromises.","antiPatternHeadline":"Storing Bare Bearer Tokens in Hybrid Storage Without Biometric Proof-of-Possession","stars_count":107,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","security","biometrics","secure-enclave","cryptography"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-biometric-enclave-token-binding?format=claude","cursorMdc":"/api/rules/capacitor-7-biometric-enclave-token-binding?format=mdc","cursorrules":"/api/rules/capacitor-7-biometric-enclave-token-binding?format=cursor","windsurf":"/api/rules/capacitor-7-biometric-enclave-token-binding?format=windsurf","agents":"/api/rules/capacitor-7-biometric-enclave-token-binding?format=agents"}},{"id":"openfga-bounded-contextual-tuple-fanout-guard","title":"Bounded Contextual Tuple Evaluation and Graph Fan-Out Guardrail for OpenFGA","category":"security","severity":"critical","description":"Enforces strict bounds, validation, and recursion limits on dynamic contextual tuples passed to OpenFGA Check requests. Unbounded contextual tuple injection exposes fine-grained authorization graphs to algorithmic complexity exhaustion, cyclic traversals, and tail-latency degradation. This rule mandates explicit cardinality caps, relation whitelisting, and evaluation timeouts on all dynamic authorization paths.","antiPatternHeadline":"Injecting Unbounded or Arbitrary Client-Controlled Contextual Tuples into OpenFGA Check Evaluations","stars_count":55,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","authorization","rebac","dos-prevention","rate-limiting"],"exportEndpoints":{"claude":"/api/rules/openfga-bounded-contextual-tuple-fanout-guard?format=claude","cursorMdc":"/api/rules/openfga-bounded-contextual-tuple-fanout-guard?format=mdc","cursorrules":"/api/rules/openfga-bounded-contextual-tuple-fanout-guard?format=cursor","windsurf":"/api/rules/openfga-bounded-contextual-tuple-fanout-guard?format=windsurf","agents":"/api/rules/openfga-bounded-contextual-tuple-fanout-guard?format=agents"}},{"id":"cilium-bpf-host-routing-socket-invariants","title":"Cilium eBPF Host Routing and Socket-Level Zero-Trust Policy Enforcement","category":"devops","severity":"critical","description":"Enforces strict configuration invariants for Cilium eBPF host routing and socket-layer load balancing (sockops/sock_msg). Prevents catastrophic silent policy bypasses, routing deadlocks, and kernel-space connection drops when bypassing the host TCP/IP stack.","antiPatternHeadline":"Partial eBPF Socket-LB Adoption with Incomplete Host-Routing and Conflicting Node iptables Rules","stars_count":80,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","cilium","kubernetes","networking","zero-trust","linux-kernel"],"exportEndpoints":{"claude":"/api/rules/cilium-bpf-host-routing-socket-invariants?format=claude","cursorMdc":"/api/rules/cilium-bpf-host-routing-socket-invariants?format=mdc","cursorrules":"/api/rules/cilium-bpf-host-routing-socket-invariants?format=cursor","windsurf":"/api/rules/cilium-bpf-host-routing-socket-invariants?format=windsurf","agents":"/api/rules/cilium-bpf-host-routing-socket-invariants?format=agents"}},{"id":"react-19-rsc-server-taint-boundary","title":"Mandatory React 19 RSC Server Taint Boundary and Secret Isolation","category":"frontend","severity":"critical","description":"Enforces strict isolation of server-only secrets, cryptographic material, and raw database models using React 19's Server Taint APIs (taintObjectReference, taintUniqueValue) alongside explicit Data Transfer Object (DTO) projection. Prevents accidental serialization of sensitive backend credentials and internal domain models into React Server Component (RSC) streaming Flight protocol payloads sent to the client browser.","antiPatternHeadline":"Leaking Raw Database Entities and Environment Secrets Through RSC Flight Wire Payloads","stars_count":119,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","rsc","security","server-taint","nextjs","flight-protocol"],"exportEndpoints":{"claude":"/api/rules/react-19-rsc-server-taint-boundary?format=claude","cursorMdc":"/api/rules/react-19-rsc-server-taint-boundary?format=mdc","cursorrules":"/api/rules/react-19-rsc-server-taint-boundary?format=cursor","windsurf":"/api/rules/react-19-rsc-server-taint-boundary?format=windsurf","agents":"/api/rules/react-19-rsc-server-taint-boundary?format=agents"}},{"id":"swift6-strict-concurrency-mainactor-boundary-guardrail","title":"Swift 6 Strict Concurrency and MainActor Boundary Enforcement","category":"mobile","severity":"critical","description":"Enforces complete compile-time data race safety under Swift 6 strict concurrency across UI-bound MainActor states and background telemetry tasks. Mandates strict Sendable adherence, explicit actor domain boundaries, and prohibits capturing mutable reference state within detached Tasks or unisolated async contexts.","antiPatternHeadline":"Escaping Non-Sendable Mutable State and Premature MainActor De-Isolation in Background Telemetry","stars_count":112,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","ios","swift6","concurrency","actors","mainactor","sendable"],"exportEndpoints":{"claude":"/api/rules/swift6-strict-concurrency-mainactor-boundary-guardrail?format=claude","cursorMdc":"/api/rules/swift6-strict-concurrency-mainactor-boundary-guardrail?format=mdc","cursorrules":"/api/rules/swift6-strict-concurrency-mainactor-boundary-guardrail?format=cursor","windsurf":"/api/rules/swift6-strict-concurrency-mainactor-boundary-guardrail?format=windsurf","agents":"/api/rules/swift6-strict-concurrency-mainactor-boundary-guardrail?format=agents"}},{"id":"kmp-swift-interop-memory-isolation-guardrail","title":"Kotlin Multiplatform Swift-Interop Memory Isolation and Deterministic Ownership Fences","category":"mobile","severity":"critical","description":"Governs boundary crossings between Kotlin/Native GC and Apple Swift ARC runtimes. Mandates explicit ownership transfer fences, deterministic unpinning of bridged references via paired disposable tokens, and weak capture semantics across runtime boundaries to eliminate native heap leaks.","antiPatternHeadline":"Leaking Kotlin Native Objects Across Swift Interop via Unfenced Bridging and Orphaned Retain Cycles","stars_count":56,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kmp","swift","kotlin-native","arc","memory-leaks"],"exportEndpoints":{"claude":"/api/rules/kmp-swift-interop-memory-isolation-guardrail?format=claude","cursorMdc":"/api/rules/kmp-swift-interop-memory-isolation-guardrail?format=mdc","cursorrules":"/api/rules/kmp-swift-interop-memory-isolation-guardrail?format=cursor","windsurf":"/api/rules/kmp-swift-interop-memory-isolation-guardrail?format=windsurf","agents":"/api/rules/kmp-swift-interop-memory-isolation-guardrail?format=agents"}},{"id":"fastapi-async-lifespan-graceful-draining-invariant","title":"FastAPI Async Lifespan Graceful Draining & Deterministic Cancellation Trees","category":"backend","severity":"critical","description":"Enforces deterministic cancellation trees, task registry draining, and socket flushing during container SIGTERM teardown within FastAPI async lifespans. Prohibits fire-and-forget unmanaged background tasks and out-of-order resource teardown to eliminate transaction corruption and dropped in-flight requests.","antiPatternHeadline":"Unmanaged Fire-and-Forget Coroutines Severed Mid-Flight During SIGTERM Container Eviction","stars_count":103,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","asyncio","lifespan","concurrency","kubernetes"],"exportEndpoints":{"claude":"/api/rules/fastapi-async-lifespan-graceful-draining-invariant?format=claude","cursorMdc":"/api/rules/fastapi-async-lifespan-graceful-draining-invariant?format=mdc","cursorrules":"/api/rules/fastapi-async-lifespan-graceful-draining-invariant?format=cursor","windsurf":"/api/rules/fastapi-async-lifespan-graceful-draining-invariant?format=windsurf","agents":"/api/rules/fastapi-async-lifespan-graceful-draining-invariant?format=agents"}},{"id":"go-chi-context-deadline-propagation-standard","title":"Go Chi Context Deadline Propagation and Client Abort Sentinel Guardrail","category":"backend","severity":"critical","description":"Mandates the strict propagation of Chi HTTP request contexts (`r.Context()`) across database drivers, cache layers, and fan-out worker goroutines. Prevents thread pool exhaustion, unmonitored orphan executions, and phantom database transactions caused by client dropouts.","antiPatternHeadline":"Discarding request contexts in handlers or detaching goroutines, leading to orphaned database workloads and connection pool starvation.","stars_count":105,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","chi","concurrency","sql","performance"],"exportEndpoints":{"claude":"/api/rules/go-chi-context-deadline-propagation-standard?format=claude","cursorMdc":"/api/rules/go-chi-context-deadline-propagation-standard?format=mdc","cursorrules":"/api/rules/go-chi-context-deadline-propagation-standard?format=cursor","windsurf":"/api/rules/go-chi-context-deadline-propagation-standard?format=windsurf","agents":"/api/rules/go-chi-context-deadline-propagation-standard?format=agents"}},{"id":"temporal-deterministic-replay-patch-fencing","title":"Temporal Workflow Deterministic Replay & Patch-Fencing Standard","category":"backend","severity":"critical","description":"Enforces strict determinism constraints and explicit event-history patch fencing for distributed state workflows. Prevents non-deterministic workflow execution corruption, deadlocks, and worker crashes caused by modifying active replay execution graphs without proper Temporal SDK patch primitives.","antiPatternHeadline":"Unfenced Workflow Mutation Inducing NonDeterministicWorkflowError During History Replay","stars_count":69,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","temporal","event-sourcing","distributed-systems","orchestration","typescript"],"exportEndpoints":{"claude":"/api/rules/temporal-deterministic-replay-patch-fencing?format=claude","cursorMdc":"/api/rules/temporal-deterministic-replay-patch-fencing?format=mdc","cursorrules":"/api/rules/temporal-deterministic-replay-patch-fencing?format=cursor","windsurf":"/api/rules/temporal-deterministic-replay-patch-fencing?format=windsurf","agents":"/api/rules/temporal-deterministic-replay-patch-fencing?format=agents"}},{"id":"bun-worker-sharedarraybuffer-zero-copy-standard","title":"Bun 1.2 Multi-Worker SharedArrayBuffer Zero-Copy and Atomic Memory Fences","category":"backend","severity":"critical","description":"Mandates zero-copy memory boundaries across Bun 1.2 Worker instances using SharedArrayBuffer and explicit Transferable objects to eliminate structured clone serialization latencies. Enforces strict synchronization invariants using the Atomics API to prevent data races and memory corruption in shared typed arrays.","antiPatternHeadline":"Implicit Structured Cloning and Unsynchronized Shared Memory Access in Multi-Threaded Workers","stars_count":66,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","sharedarraybuffer","atomics","zero-copy","concurrency","workers"],"exportEndpoints":{"claude":"/api/rules/bun-worker-sharedarraybuffer-zero-copy-standard?format=claude","cursorMdc":"/api/rules/bun-worker-sharedarraybuffer-zero-copy-standard?format=mdc","cursorrules":"/api/rules/bun-worker-sharedarraybuffer-zero-copy-standard?format=cursor","windsurf":"/api/rules/bun-worker-sharedarraybuffer-zero-copy-standard?format=windsurf","agents":"/api/rules/bun-worker-sharedarraybuffer-zero-copy-standard?format=agents"}},{"id":"oauth-2-1-dpop-rfc-9449-token-binding-guardrail","title":"OAuth 2.1 RFC 9449 DPoP Token-Binding and Replay-Fencing Guardrail","category":"security","severity":"critical","description":"Enforces asymmetric sender-constrained token binding and non-replayable proof validation per RFC 9449 (Demonstrating Proof-of-Possession). Mandates cryptographic validation of client ephemeral public keys, HTTP method/URI containment, access token hash (ath) binding, and distributed nonce/jti replay caching to eliminate bearer token exfiltration risks.","antiPatternHeadline":"Accepting Unbound Bearer Tokens or Failing to Cryptographically Validate DPoP Proof Claims and Nonces","stars_count":102,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","oauth2","dpop","rfc-9449","jwt","zero-trust","api-security"],"exportEndpoints":{"claude":"/api/rules/oauth-2-1-dpop-rfc-9449-token-binding-guardrail?format=claude","cursorMdc":"/api/rules/oauth-2-1-dpop-rfc-9449-token-binding-guardrail?format=mdc","cursorrules":"/api/rules/oauth-2-1-dpop-rfc-9449-token-binding-guardrail?format=cursor","windsurf":"/api/rules/oauth-2-1-dpop-rfc-9449-token-binding-guardrail?format=windsurf","agents":"/api/rules/oauth-2-1-dpop-rfc-9449-token-binding-guardrail?format=agents"}},{"id":"sigstore-keyless-slsa-attestation-admission-guardrail","title":"Mandatory Sigstore Keyless OIDC Attestation & SLSA v1.0 Provenance Verification","category":"security","severity":"critical","description":"Enforces strict admission-time cryptographic verification of container images using Sigstore keyless signatures and SLSA provenance attestations. Rejects long-lived static keys in favor of ephemeral Fulcio X.509 certificates verified against Rekor transparency logs with pinned OIDC issuer and subject SANs.","antiPatternHeadline":"Admitting Images via Unscoped Static Keys or Bypassing Rekor Inclusion Proofs and Predicate Validation","stars_count":68,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","supply-chain","sigstore","slsa","admission-controller","cosign","rekor"],"exportEndpoints":{"claude":"/api/rules/sigstore-keyless-slsa-attestation-admission-guardrail?format=claude","cursorMdc":"/api/rules/sigstore-keyless-slsa-attestation-admission-guardrail?format=mdc","cursorrules":"/api/rules/sigstore-keyless-slsa-attestation-admission-guardrail?format=cursor","windsurf":"/api/rules/sigstore-keyless-slsa-attestation-admission-guardrail?format=windsurf","agents":"/api/rules/sigstore-keyless-slsa-attestation-admission-guardrail?format=agents"}},{"id":"otel-dynamic-pii-scrubbing-baggage-fencing","title":"OpenTelemetry Gateway Schema-Aware Dynamic PII Scrubbing and Baggage Fencing","category":"devops","severity":"critical","description":"Telemetry ingestion gateways MUST enforce schema-aware PII masking and W3C Baggage boundary fencing via OTTL (OpenTelemetry Transformation Language) transform processors before routing to cold storage sinks. Unfenced baggage propagation and unscrubbed span/log attributes violate PCI-DSS, HIPAA, and GDPR by persisting plaintext credentials, auth tokens, and identity markers across audit boundaries.","antiPatternHeadline":"Unfenced Ingestion Gateway Persisting Plaintext PII and Poisoned Baggage Context to Cold Storage","stars_count":78,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","security","pii-scrubbing","baggage-fencing","ottl"],"exportEndpoints":{"claude":"/api/rules/otel-dynamic-pii-scrubbing-baggage-fencing?format=claude","cursorMdc":"/api/rules/otel-dynamic-pii-scrubbing-baggage-fencing?format=mdc","cursorrules":"/api/rules/otel-dynamic-pii-scrubbing-baggage-fencing?format=cursor","windsurf":"/api/rules/otel-dynamic-pii-scrubbing-baggage-fencing?format=windsurf","agents":"/api/rules/otel-dynamic-pii-scrubbing-baggage-fencing?format=agents"}},{"id":"axum-tower-request-cancellation-drain","title":"Axum 0.8 Tower Leaf-Node Request Cancellation and Socket Drain Invariant","category":"backend","severity":"critical","description":"Enforces deterministic downstream socket cleanup and prevents orphaned Tokio task leaks when HTTP/3 client streams abort mid-flight during backpressured operations. Mandates explicit cancellation propagation via tokens and guards across Tower leaf services and decoupled background tasks.","antiPatternHeadline":"Spawning Unmonitored Tokio Tasks and Ignoring Stream Abort Drops in Axum Request Pipelines","stars_count":95,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tower","tokio","http3","concurrency"],"exportEndpoints":{"claude":"/api/rules/axum-tower-request-cancellation-drain?format=claude","cursorMdc":"/api/rules/axum-tower-request-cancellation-drain?format=mdc","cursorrules":"/api/rules/axum-tower-request-cancellation-drain?format=cursor","windsurf":"/api/rules/axum-tower-request-cancellation-drain?format=windsurf","agents":"/api/rules/axum-tower-request-cancellation-drain?format=agents"}},{"id":"ebpf-bpf-lsm-binary-provenance-guard","title":"eBPF BPF-LSM Inode Digest Provenance Enforcement for Container Executables","category":"security","severity":"critical","description":"Enforces kernel-level execution authorization via the BPF-LSM bprm_check_security hook by verifying immutable cryptographic inode digests against container cgroup manifests. Blocks unauthenticated binary execution, runtime drift, and fileless memory injection before process address spaces are allocated, eliminating the race conditions and user-space overhead of ptrace or auditd.","antiPatternHeadline":"Path-Based String Filtering and Asynchronous Audit Tracepoints for Container Execution Auditing","stars_count":70,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","ebpf","bpf-lsm","containers","zero-trust","kernel"],"exportEndpoints":{"claude":"/api/rules/ebpf-bpf-lsm-binary-provenance-guard?format=claude","cursorMdc":"/api/rules/ebpf-bpf-lsm-binary-provenance-guard?format=mdc","cursorrules":"/api/rules/ebpf-bpf-lsm-binary-provenance-guard?format=cursor","windsurf":"/api/rules/ebpf-bpf-lsm-binary-provenance-guard?format=windsurf","agents":"/api/rules/ebpf-bpf-lsm-binary-provenance-guard?format=agents"}},{"id":"svelte-5-snippet-immutability-dom-detach-barrier","title":"Svelte 5 Snippet Parameter Immutability and DOM Detach Barrier","category":"frontend","severity":"critical","description":"Enforces strict immutability of parameters passed into Svelte 5 snippets and establishes clean teardown barriers for dynamic snippet renders. Mutating snippet arguments or closing over mutating outer rune state within dynamic SSR snippets causes reactive signal desynchronization, hydration mismatches, and memory leaks from orphaned DOM references.","antiPatternHeadline":"Mutating Snippet Closure Arguments or Leaking Outer Reactive Runes into Snippet Dynamic Blocks","stars_count":51,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","snippets","ssr","hydration","memory-management"],"exportEndpoints":{"claude":"/api/rules/svelte-5-snippet-immutability-dom-detach-barrier?format=claude","cursorMdc":"/api/rules/svelte-5-snippet-immutability-dom-detach-barrier?format=mdc","cursorrules":"/api/rules/svelte-5-snippet-immutability-dom-detach-barrier?format=cursor","windsurf":"/api/rules/svelte-5-snippet-immutability-dom-detach-barrier?format=windsurf","agents":"/api/rules/svelte-5-snippet-immutability-dom-detach-barrier?format=agents"}},{"id":"pg17-combinebackup-manifest-sequencing-guardrail","title":"PostgreSQL 17 pg_combinebackup Block Invariant and Manifest LSN Sequencing","category":"backend","severity":"critical","description":"Enforces strict monotonic LSN and manifest checksum validation across distributed storage tiers when constructing backup chains for PostgreSQL 17 native incremental backups. Prevents block-level corruption and divergence during synthetic full reconstruction via pg_combinebackup under concurrent WAL archiving and tier migration.","antiPatternHeadline":"Unordered Manifest Ingestion and LSN Window Gaps in Synthetic Full Backup Assembly","stars_count":105,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","pg-combinebackup","disaster-recovery","storage-orchestration"],"exportEndpoints":{"claude":"/api/rules/pg17-combinebackup-manifest-sequencing-guardrail?format=claude","cursorMdc":"/api/rules/pg17-combinebackup-manifest-sequencing-guardrail?format=mdc","cursorrules":"/api/rules/pg17-combinebackup-manifest-sequencing-guardrail?format=cursor","windsurf":"/api/rules/pg17-combinebackup-manifest-sequencing-guardrail?format=windsurf","agents":"/api/rules/pg17-combinebackup-manifest-sequencing-guardrail?format=agents"}},{"id":"cmp-ios-metal-cadisplaylink-vsync-lock","title":"Compose Multiplatform iOS CAMetalLayer CADisplayLink V-Sync Cadence Lock","category":"mobile","severity":"critical","description":"Aligns Kotlin Multiplatform / Compose Multiplatform iOS rendering loop passes strictly with CoreAnimation CADisplayLink ticks on ProMotion (120Hz) and variable refresh rate displays. Prevents thread contention, main thread stalls, and dropped frame pacing by synchronizing CAMetalLayer drawable presentation calls with NSRunLoopCommonModes ticks rather than unbounded Kotlin coroutine dispatchers.","antiPatternHeadline":"Free-Running Coroutine Render Dispatches and Unsynchronized CAMetalLayer NextDrawable Calls Leading to ProMotion Jitter","stars_count":70,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","ios","compose-multiplatform","metal","cadisplaylink","promotion","kotlin-native"],"exportEndpoints":{"claude":"/api/rules/cmp-ios-metal-cadisplaylink-vsync-lock?format=claude","cursorMdc":"/api/rules/cmp-ios-metal-cadisplaylink-vsync-lock?format=mdc","cursorrules":"/api/rules/cmp-ios-metal-cadisplaylink-vsync-lock?format=cursor","windsurf":"/api/rules/cmp-ios-metal-cadisplaylink-vsync-lock?format=windsurf","agents":"/api/rules/cmp-ios-metal-cadisplaylink-vsync-lock?format=agents"}},{"id":"openfga-tuple-cycle-breaker","title":"OpenFGA Graph Traversal Cycle Detection and Depth Ceilings","category":"security","severity":"critical","description":"Enforces strict recursion depth ceilings and memoized visited-path sets during OpenFGA relational tuple expansion and check operations. Prevents Denial of Service (DoS), catastrophic algorithmic complexity (O(N^k)), and recursive stack overflow vulnerabilities caused by self-referential or cyclic relational hierarchies (e.g., recursive team-in-team or nested group-membership graphs).","antiPatternHeadline":"Unbounded Recursive Resolution of Nested Relational Tuples Without Path Memoization or Depth Limits","stars_count":110,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","authorization","cycle-detection","graph-traversal","dos-prevention"],"exportEndpoints":{"claude":"/api/rules/openfga-tuple-cycle-breaker?format=claude","cursorMdc":"/api/rules/openfga-tuple-cycle-breaker?format=mdc","cursorrules":"/api/rules/openfga-tuple-cycle-breaker?format=cursor","windsurf":"/api/rules/openfga-tuple-cycle-breaker?format=windsurf","agents":"/api/rules/openfga-tuple-cycle-breaker?format=agents"}},{"id":"otel-prometheus-exemplar-dynamic-reservoir-cap","title":"OpenTelemetry Prometheus Exemplar Dynamic Reservoir Sampling Cap","category":"devops","severity":"critical","description":"Enforces deterministic memory bounds and ingestion rate throttling on OpenTelemetry Prometheus exemplars via dynamic reservoir sampling. Prevents TSDB cardinality explosions, GC pressure, and Prometheus scrape timeouts during high-concurrency traffic spikes by capping in-memory exemplar allocation per metric family and scrape cycle.","antiPatternHeadline":"Unbounded Exemplar Collection and Static Trace-Binding Under Traffic Surges","stars_count":107,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","prometheus","exemplars","observability","cardinality-control","memory-safety"],"exportEndpoints":{"claude":"/api/rules/otel-prometheus-exemplar-dynamic-reservoir-cap?format=claude","cursorMdc":"/api/rules/otel-prometheus-exemplar-dynamic-reservoir-cap?format=mdc","cursorrules":"/api/rules/otel-prometheus-exemplar-dynamic-reservoir-cap?format=cursor","windsurf":"/api/rules/otel-prometheus-exemplar-dynamic-reservoir-cap?format=windsurf","agents":"/api/rules/otel-prometheus-exemplar-dynamic-reservoir-cap?format=agents"}},{"id":"vite6-rolldown-chunk-splitting-singleton-guardrail","title":"Vite 6 Rolldown Deterministic Chunk Splitting & Singleton Module De-duplication","category":"frontend","severity":"critical","description":"Enforces deterministic chunk boundary isolation and strict singleton module de-duplication in Vite 6 when targeting the Rolldown Rust-native bundling engine. Guarantees that runtime-critical singletons (e.g., React context, TanStack Query clients, Zustand stores) resolve to identical canonical modules across independently hydrated micro-frontends.","antiPatternHeadline":"Implicit Dynamic Splitting Permitting Duplicate Singleton Instances Across Hydrated Micro-Frontends","stars_count":44,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","vite6","rolldown","micro-frontends","module-deduplication","singleton-pattern","bundling"],"exportEndpoints":{"claude":"/api/rules/vite6-rolldown-chunk-splitting-singleton-guardrail?format=claude","cursorMdc":"/api/rules/vite6-rolldown-chunk-splitting-singleton-guardrail?format=mdc","cursorrules":"/api/rules/vite6-rolldown-chunk-splitting-singleton-guardrail?format=cursor","windsurf":"/api/rules/vite6-rolldown-chunk-splitting-singleton-guardrail?format=windsurf","agents":"/api/rules/vite6-rolldown-chunk-splitting-singleton-guardrail?format=agents"}},{"id":"capacitor-coreml-wasm-offload-pipeline-guardrail","title":"Capacitor 7 Core ML WebAssembly Zero-Copy Offload Pipeline Guardrail","category":"mobile","severity":"critical","description":"Enforces zero-copy buffer transfers between WebAssembly workers and native iOS Core ML inference threads in Capacitor 7 hybrid applications. Eliminates WebView main thread frame-drops (UI thread starvation) by strictly prohibiting base64/JSON IPC serialization and mandating SharedArrayBuffer backing with dedicated native dispatch queues targeting Apple Neural Engine (ANE).","antiPatternHeadline":"Serializing Raw Tensor Buffers Over Capacitor Plugin IPC onto WebView UI Thread","stars_count":108,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor-7","coreml","webassembly","ios","shared-array-buffer","performance"],"exportEndpoints":{"claude":"/api/rules/capacitor-coreml-wasm-offload-pipeline-guardrail?format=claude","cursorMdc":"/api/rules/capacitor-coreml-wasm-offload-pipeline-guardrail?format=mdc","cursorrules":"/api/rules/capacitor-coreml-wasm-offload-pipeline-guardrail?format=cursor","windsurf":"/api/rules/capacitor-coreml-wasm-offload-pipeline-guardrail?format=windsurf","agents":"/api/rules/capacitor-coreml-wasm-offload-pipeline-guardrail?format=agents"}},{"id":"spiffe-spire-ebpf-cgroupv2-attestation-standard","title":"SPIFFE/SPIRE eBPF-Based Cgroupv2 Workload Identity Attestation Standard","category":"devops","severity":"critical","description":"Enforces cryptographically unfakeable pod mTLS identity minting at the kernel socket layer via SPIRE Agent eBPF tracing and cgroupv2 hierarchy verification. Eliminates vulnerable mounted Kubernetes Projected ServiceAccountTokens and mitigates SO_PEERCRED PID-recycling TOCTOU race conditions.","antiPatternHeadline":"Relying on Mounted ServiceAccount Tokens or PID-Based Socket Attestation Prone to TOCTOU Spoofing","stars_count":99,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","spiffe","spire","ebpf","cgroupv2","zero-trust","mtls","kubernetes"],"exportEndpoints":{"claude":"/api/rules/spiffe-spire-ebpf-cgroupv2-attestation-standard?format=claude","cursorMdc":"/api/rules/spiffe-spire-ebpf-cgroupv2-attestation-standard?format=mdc","cursorrules":"/api/rules/spiffe-spire-ebpf-cgroupv2-attestation-standard?format=cursor","windsurf":"/api/rules/spiffe-spire-ebpf-cgroupv2-attestation-standard?format=windsurf","agents":"/api/rules/spiffe-spire-ebpf-cgroupv2-attestation-standard?format=agents"}},{"id":"react-19-use-optimistic-rollback-invariant","title":"React 19 useOptimistic Atomic Transition and Canonical Rollback Invariant","category":"frontend","severity":"critical","description":"Enforces strict isolation between canonical store state and React 19 useOptimistic projection pipelines within asynchronous Action transitions. Guarantees that network aborts, server action rejections, or concurrent interruptions deterministically revert the active UI tree without leaving uncommitted state in external or parent stores.","antiPatternHeadline":"Preemptive Canonical Store Sync and Unbounded Optimistic Mutation Dispatches","stars_count":57,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react19","useOptimistic","state-management","concurrency"],"exportEndpoints":{"claude":"/api/rules/react-19-use-optimistic-rollback-invariant?format=claude","cursorMdc":"/api/rules/react-19-use-optimistic-rollback-invariant?format=mdc","cursorrules":"/api/rules/react-19-use-optimistic-rollback-invariant?format=cursor","windsurf":"/api/rules/react-19-use-optimistic-rollback-invariant?format=windsurf","agents":"/api/rules/react-19-use-optimistic-rollback-invariant?format=agents"}},{"id":"react-router-v7-single-fetch-streaming-fence","title":"React Router v7 Single Fetch Streaming Hydration Fence & Microtask Isolation","category":"frontend","severity":"critical","description":"Enforces bounded microtask execution and AbortSignal propagation in React Router v7 Single Fetch loaders serializing via turbo-stream. Prevents partial hydration deadlocks and dangling fiber states across rapid client navigations by establishing deterministic streaming hydration fences.","antiPatternHeadline":"Unbounded turbo-stream Promises Starving Microtask Queues and Deadlocking Component Hydration on Interrupted Navigations","stars_count":50,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-router-v7","single-fetch","turbo-stream","streaming-hydration","concurrency"],"exportEndpoints":{"claude":"/api/rules/react-router-v7-single-fetch-streaming-fence?format=claude","cursorMdc":"/api/rules/react-router-v7-single-fetch-streaming-fence?format=mdc","cursorrules":"/api/rules/react-router-v7-single-fetch-streaming-fence?format=cursor","windsurf":"/api/rules/react-router-v7-single-fetch-streaming-fence?format=windsurf","agents":"/api/rules/react-router-v7-single-fetch-streaming-fence?format=agents"}},{"id":"bun-native-worker-arraybuffer-transfer-guardrail","title":"Bun 1.2 Native Worker ArrayBuffer Zero-Copy Transfer Guardrail","category":"backend","severity":"critical","description":"Enforces deterministic ownership transfer of TypedArray underlying ArrayBuffers across Bun 1.2 native workers using explicit transfer lists. Disallows structured-cloning of binary payloads across thread boundaries, which triggers silent native heap re-allocation, uncoordinated dual-ownership, and severe native memory fragmentation under high I/O throughput. Mandates explicit detaching and zero-copy semantics via postMessage transfer lists.","antiPatternHeadline":"Implicit Structured Cloning of Large Binary Buffers Across Worker Boundaries Leading to Native Heap Bloat and Memory Fragmentation","stars_count":103,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","web-workers","concurrency","memory-management","performance"],"exportEndpoints":{"claude":"/api/rules/bun-native-worker-arraybuffer-transfer-guardrail?format=claude","cursorMdc":"/api/rules/bun-native-worker-arraybuffer-transfer-guardrail?format=mdc","cursorrules":"/api/rules/bun-native-worker-arraybuffer-transfer-guardrail?format=cursor","windsurf":"/api/rules/bun-native-worker-arraybuffer-transfer-guardrail?format=windsurf","agents":"/api/rules/bun-native-worker-arraybuffer-transfer-guardrail?format=agents"}},{"id":"kmp-concurrent-stateflow-memory-fence-guardrail","title":"KMP StateFlow Sequential Consistency Across Kotlin/Native and Swift ARC Boundary","category":"mobile","severity":"critical","description":"Enforces sequentially consistent cross-thread state propagation across the Kotlin/Native and Swift ARC interop boundary. Prevents data races, torn reads, and stale cache lines when mutating StateFlow instances observed concurrently across distinct runtime runloops by mandating strict memory fence barriers and thread confinement.","antiPatternHeadline":"Unconfined Cross-Thread StateFlow Mutation Causing Out-of-Order Memory Visibility Across Swift Interop","stars_count":105,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","swift","concurrency","stateflow","memory-ordering"],"exportEndpoints":{"claude":"/api/rules/kmp-concurrent-stateflow-memory-fence-guardrail?format=claude","cursorMdc":"/api/rules/kmp-concurrent-stateflow-memory-fence-guardrail?format=mdc","cursorrules":"/api/rules/kmp-concurrent-stateflow-memory-fence-guardrail?format=cursor","windsurf":"/api/rules/kmp-concurrent-stateflow-memory-fence-guardrail?format=windsurf","agents":"/api/rules/kmp-concurrent-stateflow-memory-fence-guardrail?format=agents"}},{"id":"tauri-v2-capability-ipc-isolation-guardrail","title":"Tauri 2.0 Granular Capability-Scoped IPC Channel Isolation","category":"mobile","severity":"critical","description":"Enforces Tauri 2.0 compile-time capability isolation to strictly restrict mobile OS-level API bridge commands. Guarantees that untrusted webview contexts and cross-origin mobile scripts cannot invoke unauthorized host OS interfaces or execute arbitrary native procedures. Eliminates privilege escalation vectors caused by wildcard permissions and unsegmented window capabilities.","antiPatternHeadline":"Over-privileged IPC bridges exposing OS-level shell, filesystem, and native APIs via unsegmented wildcard capabilities.","stars_count":106,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri-2","ipc-security","capabilities","rust"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-capability-ipc-isolation-guardrail?format=claude","cursorMdc":"/api/rules/tauri-v2-capability-ipc-isolation-guardrail?format=mdc","cursorrules":"/api/rules/tauri-v2-capability-ipc-isolation-guardrail?format=cursor","windsurf":"/api/rules/tauri-v2-capability-ipc-isolation-guardrail?format=windsurf","agents":"/api/rules/tauri-v2-capability-ipc-isolation-guardrail?format=agents"}},{"id":"oauth-rar-rfc9396-enforcement-standard","title":"RFC 9396 OAuth Rich Authorization Requests (RAR) Cryptographic & Schema Verification Guardrail","category":"security","severity":"critical","description":"Enforces strict schema validation, deterministic transaction matching, and cryptographic sender-constraint binding on RFC 9396 'authorization_details' vectors. Prevents privilege-widening attacks in complex API handshakes where coarse scopes bypass fine-grained authorization constraints.","antiPatternHeadline":"Coarse-Scope Fallback and Unvalidated authorization_details Processing","stars_count":82,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","oauth2","rfc9396","rich-authorization-requests","zero-trust","jwt"],"exportEndpoints":{"claude":"/api/rules/oauth-rar-rfc9396-enforcement-standard?format=claude","cursorMdc":"/api/rules/oauth-rar-rfc9396-enforcement-standard?format=mdc","cursorrules":"/api/rules/oauth-rar-rfc9396-enforcement-standard?format=cursor","windsurf":"/api/rules/oauth-rar-rfc9396-enforcement-standard?format=windsurf","agents":"/api/rules/oauth-rar-rfc9396-enforcement-standard?format=agents"}},{"id":"passkey-conditional-ui-stepup-boundary","title":"Passkey Conditional UI Step-Up Authentication Boundary Enforcement","category":"security","severity":"critical","description":"Enforces a strict cryptographic and architectural boundary between WebAuthn Conditional UI (autofill mediation) used for ambient session establishment and active, user-verified re-authentication for sensitive actions. Passive autofill ceremonies must never satisfy elevated administrative authorization states; step-up flows must mandate explicit hardware-attested user verification (UV) with fresh cryptographic challenges and short-lived, transaction-bound tokens.","antiPatternHeadline":"Conflating Passive Passkey Autofill Assertions with Explicit Step-Up User Verification","stars_count":43,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","passkeys","authentication","fido2"],"exportEndpoints":{"claude":"/api/rules/passkey-conditional-ui-stepup-boundary?format=claude","cursorMdc":"/api/rules/passkey-conditional-ui-stepup-boundary?format=mdc","cursorrules":"/api/rules/passkey-conditional-ui-stepup-boundary?format=cursor","windsurf":"/api/rules/passkey-conditional-ui-stepup-boundary?format=windsurf","agents":"/api/rules/passkey-conditional-ui-stepup-boundary?format=agents"}},{"id":"k8s-dra-cdi-lifecycle-guardrail","title":"Kubernetes Dynamic Resource Allocation (DRA) CDI Deterministic Lifecycle and Cgroup Isolation Standard","category":"devops","severity":"critical","description":"Enforces vendor-agnostic Container Device Interface (CDI) spec generation and Dynamic Resource Allocation (DRA) driver lifecycles. Prevents orphaned host device nodes, non-deterministic cgroup device access leaks, and node-level GPU/NPU state corruption by mandating atomic CDI file emission, strict semantic naming, and idempotent NodeUnprepareResource cleanup.","antiPatternHeadline":"Direct Host Device Injection and Ephemeral CDI Specs without Atomic NodeUnprepareResource Finalization","stars_count":89,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["kubernetes","dra","cdi","ai-infrastructure","cgroups","hardware-isolation"],"exportEndpoints":{"claude":"/api/rules/k8s-dra-cdi-lifecycle-guardrail?format=claude","cursorMdc":"/api/rules/k8s-dra-cdi-lifecycle-guardrail?format=mdc","cursorrules":"/api/rules/k8s-dra-cdi-lifecycle-guardrail?format=cursor","windsurf":"/api/rules/k8s-dra-cdi-lifecycle-guardrail?format=windsurf","agents":"/api/rules/k8s-dra-cdi-lifecycle-guardrail?format=agents"}},{"id":"opentelemetry-w3c-baggage-sanitization-guardrail","title":"OpenTelemetry W3C Baggage Context Sanitization and Boundary Filtering","category":"devops","severity":"critical","description":"Enforces strict gateway-level validation, allowlisting, and sanitization on incoming and outgoing W3C Baggage HTTP headers to prevent distributed context contamination. Blindly propagating baggage across untrusted trust boundaries causes severe PII leakage, credential exfiltration, and tenant impersonation vulnerabilities. Distributed context propagation must strictly parse, validate against an immutable allowlist, and re-sign or isolate operational metadata at system perimeters.","antiPatternHeadline":"Blind Ingress Extraction and Downstream Forwarding of Untrusted W3C Baggage Headers","stars_count":114,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","distributed-tracing","security","api-gateway"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-w3c-baggage-sanitization-guardrail?format=claude","cursorMdc":"/api/rules/opentelemetry-w3c-baggage-sanitization-guardrail?format=mdc","cursorrules":"/api/rules/opentelemetry-w3c-baggage-sanitization-guardrail?format=cursor","windsurf":"/api/rules/opentelemetry-w3c-baggage-sanitization-guardrail?format=windsurf","agents":"/api/rules/opentelemetry-w3c-baggage-sanitization-guardrail?format=agents"}},{"id":"vite-6-environment-api-multi-runtime-isolation-vite-6-environme-583","title":"Vite 6 Environment API: Multi-Runtime Context & Memory Isolation Invariants","category":"frontend","severity":"critical","description":"Enforces strict runtime boundary separation and deterministic module evaluation across divergent execution targets (Browser DOM, Node.js SSR, Edge/workerd) using the Vite 6 Environment API. Prevents cross-environment state pollution, invalidated cross-runtime module graph caching, and catastrophic CJS/ESM interop leaks in hybrid compilation topologies.","antiPatternHeadline":"Global Plugin State Sharing and Legacy SSR Pipeline Coupling Across Heterogeneous Runtimes","stars_count":79,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["vite6","environment-api","ssr","edge-runtime","context-isolation","frontend-architecture"],"exportEndpoints":{"claude":"/api/rules/vite-6-environment-api-multi-runtime-isolation-vite-6-environme-583?format=claude","cursorMdc":"/api/rules/vite-6-environment-api-multi-runtime-isolation-vite-6-environme-583?format=mdc","cursorrules":"/api/rules/vite-6-environment-api-multi-runtime-isolation-vite-6-environme-583?format=cursor","windsurf":"/api/rules/vite-6-environment-api-multi-runtime-isolation-vite-6-environme-583?format=windsurf","agents":"/api/rules/vite-6-environment-api-multi-runtime-isolation-vite-6-environme-583?format=agents"}},{"id":"fastapi-anyio-structured-concurrency-taskgroup-bounds","title":"FastAPI AnyIO Structured Concurrency & TaskGroup Cancellation Boundaries","category":"backend","severity":"critical","description":"Enforces strict structured concurrency boundaries using AnyIO task groups and cancellation scopes in FastAPI endpoints. Prevents zombie background tasks, orphaned fan-out coroutines, and connection leaks when clients abruptly terminate HTTP or Server-Sent Events (SSE) connections.","antiPatternHeadline":"Spawning unparented asyncio tasks or using asyncio.gather without structured cancel scopes during HTTP client disconnects.","stars_count":109,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","anyio","asyncio","structured-concurrency","python"],"exportEndpoints":{"claude":"/api/rules/fastapi-anyio-structured-concurrency-taskgroup-bounds?format=claude","cursorMdc":"/api/rules/fastapi-anyio-structured-concurrency-taskgroup-bounds?format=mdc","cursorrules":"/api/rules/fastapi-anyio-structured-concurrency-taskgroup-bounds?format=cursor","windsurf":"/api/rules/fastapi-anyio-structured-concurrency-taskgroup-bounds?format=windsurf","agents":"/api/rules/fastapi-anyio-structured-concurrency-taskgroup-bounds?format=agents"}},{"id":"bun-s3-streaming-zero-copy-backpressure-guardrail","title":"Bun 1.2 Native S3 Streaming Zero-Copy Backpressure Standard","category":"backend","severity":"critical","description":"Enforces zero-copy stream piping for Bun 1.2 native S3 client uploads to prevent unconstrained V8/JSC heap allocation. Mandates direct linkage between incoming consumer HTTP request bodies or native file streams and native S3 target writers without intermediate JavaScript buffer allocation.","antiPatternHeadline":"Buffering HTTP Request Payloads into Memory Before Forwarding to S3 Multipart Uploads","stars_count":90,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","s3","streaming","backpressure","memory-leak-prevention"],"exportEndpoints":{"claude":"/api/rules/bun-s3-streaming-zero-copy-backpressure-guardrail?format=claude","cursorMdc":"/api/rules/bun-s3-streaming-zero-copy-backpressure-guardrail?format=mdc","cursorrules":"/api/rules/bun-s3-streaming-zero-copy-backpressure-guardrail?format=cursor","windsurf":"/api/rules/bun-s3-streaming-zero-copy-backpressure-guardrail?format=windsurf","agents":"/api/rules/bun-s3-streaming-zero-copy-backpressure-guardrail?format=agents"}},{"id":"postgres-17-logical-replication-memory-spooling-invariant","title":"Postgres 17 CDC Logical Decoding Memory Quotas and Worker Parallelism Guardrail","category":"backend","severity":"critical","description":"Enforces strict memory allocation limits and streaming worker parallelism for PostgreSQL 17 logical replication and CDC pipelines. Prevents replication lag spikes, temporary disk spooling thrashing, and apply-worker head-of-line blocking during multi-gigabyte schema migrations and bulk writes.","antiPatternHeadline":"Unbounded Memory Spooling and Monolithic Apply Workers During Large-Scale Data Migrations","stars_count":113,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","cdc","logical-replication","database-migrations","postgres-17"],"exportEndpoints":{"claude":"/api/rules/postgres-17-logical-replication-memory-spooling-invariant?format=claude","cursorMdc":"/api/rules/postgres-17-logical-replication-memory-spooling-invariant?format=mdc","cursorrules":"/api/rules/postgres-17-logical-replication-memory-spooling-invariant?format=cursor","windsurf":"/api/rules/postgres-17-logical-replication-memory-spooling-invariant?format=windsurf","agents":"/api/rules/postgres-17-logical-replication-memory-spooling-invariant?format=agents"}},{"id":"kmp-skiko-metal-surface-lifecycle-synchronization","title":"KMP Skiko Metal Surface Lifecycle Synchronization Invariant","category":"mobile","severity":"critical","description":"Enforces strict synchronization between iOS UIViewController lifecycle transitions, CADisplayLink rendering loops, and Compose Multiplatform Skiko Metal layers. Eliminates command buffer acquisition race conditions, dropped drawables, and GPU execution panics during interactive modal dismissals and navigation transitions.","antiPatternHeadline":"Unsynchronized Metal Command Buffer Scheduling During iOS Lifecycle and View Hierarchy Transitions","stars_count":107,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kmp","compose-multiplatform","skiko","metal","ios","gpu"],"exportEndpoints":{"claude":"/api/rules/kmp-skiko-metal-surface-lifecycle-synchronization?format=claude","cursorMdc":"/api/rules/kmp-skiko-metal-surface-lifecycle-synchronization?format=mdc","cursorrules":"/api/rules/kmp-skiko-metal-surface-lifecycle-synchronization?format=cursor","windsurf":"/api/rules/kmp-skiko-metal-surface-lifecycle-synchronization?format=windsurf","agents":"/api/rules/kmp-skiko-metal-surface-lifecycle-synchronization?format=agents"}},{"id":"tauri-v2-mobile-custom-scheme-intent-sanitization-guardrail","title":"Tauri 2.0 Mobile Deep Link Scheme Sanitization and Origin Validation","category":"mobile","severity":"critical","description":"Enforces strict origin, host, and path validation for custom URL schemes and deep-link intents across Tauri 2.0 Android and iOS targets. Prevents intent hijacking, arbitrary state manipulation, and cross-origin WebView contamination by mandating centralized URL parsing and strict route allowlisting before dispatching events to the frontend.","antiPatternHeadline":"Blind Routing of Unsanitized Custom URI Schemes and Deep-Link Intents into Tauri WebViews","stars_count":117,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri","rust","android","ios","deep-links","appsec"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-mobile-custom-scheme-intent-sanitization-guardrail?format=claude","cursorMdc":"/api/rules/tauri-v2-mobile-custom-scheme-intent-sanitization-guardrail?format=mdc","cursorrules":"/api/rules/tauri-v2-mobile-custom-scheme-intent-sanitization-guardrail?format=cursor","windsurf":"/api/rules/tauri-v2-mobile-custom-scheme-intent-sanitization-guardrail?format=windsurf","agents":"/api/rules/tauri-v2-mobile-custom-scheme-intent-sanitization-guardrail?format=agents"}},{"id":"webauthn-backup-eligibility-boundary-production-standard","title":"Strict WebAuthn Backup Eligibility and Attestation Boundary Enforcement","category":"security","severity":"critical","description":"Enforces cryptographic and authenticator data verification bounds to block synchronized (multi-device) credentials on privileged administration pathways. Mandates parsing and validating the raw authenticator data byte flags, specifically asserting that Backup Eligibility (BE) and Backup State (BS) are disabled, paired with direct attestation validation. Prevents unauthorized cloud key-sync exfiltration across consumer ecosystem boundaries in zero-trust administrative planes.","antiPatternHeadline":"Permitting Multi-Device Synced Passkeys on High-Privilege Zero-Trust Portals Without Backup-Eligibility Assertion","stars_count":45,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","fido2","passkeys","zero-trust","authentication","cryptography"],"exportEndpoints":{"claude":"/api/rules/webauthn-backup-eligibility-boundary-production-standard?format=claude","cursorMdc":"/api/rules/webauthn-backup-eligibility-boundary-production-standard?format=mdc","cursorrules":"/api/rules/webauthn-backup-eligibility-boundary-production-standard?format=cursor","windsurf":"/api/rules/webauthn-backup-eligibility-boundary-production-standard?format=windsurf","agents":"/api/rules/webauthn-backup-eligibility-boundary-production-standard?format=agents"}},{"id":"oci-cosign-intoto-attestation-admission-standard","title":"OCI 1.1 In-Toto Cosign Attestation Inline Admission Standard","category":"security","severity":"critical","description":"Enforces inline cryptographic validation of In-Toto Software Bill of Materials (SBOM) and SLSA provenance attestations via OCI 1.1 Referrers prior to container execution. Rejects any workload referencing mutable tags, unverified cryptographic signatures, missing transparency log inclusions, or non-compliant predicate schemas.","antiPatternHeadline":"Trusting unpinned container tags or unverified client annotations instead of cryptographically signed OCI 1.1 In-Toto attestation trees","stars_count":75,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","oci","cosign","in-toto","admission-controller","sbom","slsa"],"exportEndpoints":{"claude":"/api/rules/oci-cosign-intoto-attestation-admission-standard?format=claude","cursorMdc":"/api/rules/oci-cosign-intoto-attestation-admission-standard?format=mdc","cursorrules":"/api/rules/oci-cosign-intoto-attestation-admission-standard?format=cursor","windsurf":"/api/rules/oci-cosign-intoto-attestation-admission-standard?format=windsurf","agents":"/api/rules/oci-cosign-intoto-attestation-admission-standard?format=agents"}},{"id":"ebpf-xdp-tcp-mss-clamping-production-standard","title":"eBPF XDP Dynamic TCP-MSS Clamping Invariant","category":"devops","severity":"critical","description":"Enforces deterministic, in-kernel TCP Maximum Segment Size (MSS) clamping at the eBPF XDP layer across overlay and WireGuard network interfaces. Guarantees zero PMTU discovery black-holing and eliminates tunnel-induced packet fragmentation by rewriting SYN/SYN-ACK packet options and incrementally updating the TCP checksum before socket allocation.","antiPatternHeadline":"Relying on ICMP Type 3 Code 4 PMTUD or iptables TCPMSS target across high-throughput overlay topologies","stars_count":60,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","xdp","networking","wireguard","kernel"],"exportEndpoints":{"claude":"/api/rules/ebpf-xdp-tcp-mss-clamping-production-standard?format=claude","cursorMdc":"/api/rules/ebpf-xdp-tcp-mss-clamping-production-standard?format=mdc","cursorrules":"/api/rules/ebpf-xdp-tcp-mss-clamping-production-standard?format=cursor","windsurf":"/api/rules/ebpf-xdp-tcp-mss-clamping-production-standard?format=windsurf","agents":"/api/rules/ebpf-xdp-tcp-mss-clamping-production-standard?format=agents"}},{"id":"nextjs-15-after-background-execution-standard","title":"Next.js 15 after() Post-Response Execution and Serverless Task Drain Standard","category":"frontend","severity":"critical","description":"Next.js 15 introduces 'after()' to schedule asynchronous microtasks that execute reliably after a streaming or buffered response completes. Failing to use 'after()' in serverless runtimes results in either dropped background execution due to container freezing or artificial response latency from blocking unneeded awaits in the critical response path.","antiPatternHeadline":"Detached Floating Promises and Blocking Side-Effects in Serverless Response Handlers","stars_count":111,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs","nextjs-15","after","serverless","async-microtasks","server-actions","route-handlers"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-after-background-execution-standard?format=claude","cursorMdc":"/api/rules/nextjs-15-after-background-execution-standard?format=mdc","cursorrules":"/api/rules/nextjs-15-after-background-execution-standard?format=cursor","windsurf":"/api/rules/nextjs-15-after-background-execution-standard?format=windsurf","agents":"/api/rules/nextjs-15-after-background-execution-standard?format=agents"}},{"id":"axum-tower-async-cancellation-drop-cleanup-invariant","title":"Axum 0.8 & Tower Async Cancellation & Drop Cleanup Invariant","category":"backend","severity":"critical","description":"Enforces cancellation-safe handlers and deterministic drop mechanics across Axum 0.8 and Tower service pipelines. Ensures aborted client TCP connections and early drops immediately propagate down the future tree to abort downstream SQL/database operations, preventing connection pool exhaustion and phantom writes.","antiPatternHeadline":"Detaching or shielding uncancelable database futures from client drop notifications, causing ghost queries and connection pool starvation.","stars_count":41,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tower","tokio","concurrency","sqlx"],"exportEndpoints":{"claude":"/api/rules/axum-tower-async-cancellation-drop-cleanup-invariant?format=claude","cursorMdc":"/api/rules/axum-tower-async-cancellation-drop-cleanup-invariant?format=mdc","cursorrules":"/api/rules/axum-tower-async-cancellation-drop-cleanup-invariant?format=cursor","windsurf":"/api/rules/axum-tower-async-cancellation-drop-cleanup-invariant?format=windsurf","agents":"/api/rules/axum-tower-async-cancellation-drop-cleanup-invariant?format=agents"}},{"id":"postgres-17-failover-replication-slot-synchronization-standard","title":"PostgreSQL 17 Native Logical Replication Slot Failover Synchronization Standard","category":"backend","severity":"critical","description":"Enforces strict configuration and runtime verification of PostgreSQL 17 native failover-enabled logical replication slots. Prevents data loss, message duplication storms, and unrecoverable consumer drift in high-availability CDC pipelines by mandating 'failover = true' on slots and synchronizing physical standby slots before promoting secondary nodes.","antiPatternHeadline":"Unsynchronized Logical Slots Causing CDC Pipeline Invalidation and Lost Changes Post-Failover","stars_count":74,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql-17","cdc","replication-slots","high-availability"],"exportEndpoints":{"claude":"/api/rules/postgres-17-failover-replication-slot-synchronization-standard?format=claude","cursorMdc":"/api/rules/postgres-17-failover-replication-slot-synchronization-standard?format=mdc","cursorrules":"/api/rules/postgres-17-failover-replication-slot-synchronization-standard?format=cursor","windsurf":"/api/rules/postgres-17-failover-replication-slot-synchronization-standard?format=windsurf","agents":"/api/rules/postgres-17-failover-replication-slot-synchronization-standard?format=agents"}},{"id":"go-1-24-runtime-addcleanup-finalizer-replacement","title":"Go 1.24 runtime.AddCleanup Finalizer Replacement Standard","category":"backend","severity":"critical","description":"Mandates replacing legacy runtime.SetFinalizer with Go 1.24's runtime.AddCleanup across unmanaged OS descriptors and Cgo lifecycles. Eliminates multi-cycle GC retention, resurrection vulnerabilities, and serialized finalizer goroutine deadlocks by decoupling deallocation state from parent object references.","antiPatternHeadline":"Using runtime.SetFinalizer Induces Object Resurrection, Multi-Cycle GC Leaks, and Serialized Goroutine Head-of-Line Blocking","stars_count":62,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","golang","gc","cgo","memory-management","concurrency"],"exportEndpoints":{"claude":"/api/rules/go-1-24-runtime-addcleanup-finalizer-replacement?format=claude","cursorMdc":"/api/rules/go-1-24-runtime-addcleanup-finalizer-replacement?format=mdc","cursorrules":"/api/rules/go-1-24-runtime-addcleanup-finalizer-replacement?format=cursor","windsurf":"/api/rules/go-1-24-runtime-addcleanup-finalizer-replacement?format=windsurf","agents":"/api/rules/go-1-24-runtime-addcleanup-finalizer-replacement?format=agents"}},{"id":"react-native-bridgeless-turbomodule-jsi-memory-boundary","title":"React Native 0.76 Bridgeless TurboModule JSI Memory Boundary & Thread Affinity Standard","category":"mobile","severity":"critical","description":"Enforces strict JSI thread-affinity constraints and deterministic heap memory boundaries in React Native 0.76+ Bridgeless TurboModules. Prevents fatal Hermes GC heap corruption, cross-thread jsi::Value dereferencing, and dangling pointer segmentation faults across native C++ and JS runtime contexts.","antiPatternHeadline":"Retaining bare jsi::Value references across threads without CallInvoker synchronization or thread-safe heap handles","stars_count":65,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","react-native","turbomodules","jsi","hermes","bridgeless","cpp"],"exportEndpoints":{"claude":"/api/rules/react-native-bridgeless-turbomodule-jsi-memory-boundary?format=claude","cursorMdc":"/api/rules/react-native-bridgeless-turbomodule-jsi-memory-boundary?format=mdc","cursorrules":"/api/rules/react-native-bridgeless-turbomodule-jsi-memory-boundary?format=cursor","windsurf":"/api/rules/react-native-bridgeless-turbomodule-jsi-memory-boundary?format=windsurf","agents":"/api/rules/react-native-bridgeless-turbomodule-jsi-memory-boundary?format=agents"}},{"id":"kmp-room-wal-concurrency-invariant","title":"KMP Room 2.7 Multiplatform SQLite WAL Concurrency & Isolation Invariant","category":"mobile","severity":"critical","description":"Enforces strict Write-Ahead Logging (WAL) mode, connection pooling bounds, and coroutine-isolated transactional execution across Kotlin Multiplatform (Room 2.7+). Prevents cross-platform SQLite lock contention (SQLITE_BUSY/SQLITE_LOCKED) between iOS background Darwin threads and Android concurrent background services.","antiPatternHeadline":"Unmanaged Multi-Threaded Dispatching Without Explicit WAL Initialization and Busy Timeouts in KMP Room","stars_count":80,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kmp","room","sqlite","concurrency","wal","kotlin-multiplatform","ios","android"],"exportEndpoints":{"claude":"/api/rules/kmp-room-wal-concurrency-invariant?format=claude","cursorMdc":"/api/rules/kmp-room-wal-concurrency-invariant?format=mdc","cursorrules":"/api/rules/kmp-room-wal-concurrency-invariant?format=cursor","windsurf":"/api/rules/kmp-room-wal-concurrency-invariant?format=windsurf","agents":"/api/rules/kmp-room-wal-concurrency-invariant?format=agents"}},{"id":"webauthn-l3-cross-origin-binding-guardrail","title":"WebAuthn Level 3 Passkey Origin & Relying Party Cryptographic Binding Standard","category":"security","severity":"critical","description":"Enforces strict, cryptographically verified origin and Relying Party (RP) ID validation on WebAuthn Level 3 authentication assertions to defeat Adversary-in-the-Middle (AitM) reverse-proxy session hijacking. Mandates canonical origin whitelisting over dynamic header reflection, explicit verification of the clientDataJSON crossOrigin member, and strict validation of authenticatorData rpIdHash and flags.","antiPatternHeadline":"Dynamic RP Origin Reflection and Missing crossOrigin Checks Permitting Reverse-Proxy Phishing Hijacks","stars_count":92,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","passkeys","fido2","authentication","aitm-defense","cryptography"],"exportEndpoints":{"claude":"/api/rules/webauthn-l3-cross-origin-binding-guardrail?format=claude","cursorMdc":"/api/rules/webauthn-l3-cross-origin-binding-guardrail?format=mdc","cursorrules":"/api/rules/webauthn-l3-cross-origin-binding-guardrail?format=cursor","windsurf":"/api/rules/webauthn-l3-cross-origin-binding-guardrail?format=windsurf","agents":"/api/rules/webauthn-l3-cross-origin-binding-guardrail?format=agents"}},{"id":"envoy-gateway-extauthz-fail-closed-circuit-breaking","title":"Envoy Gateway 1.2 ExtAuthz Fail-Closed Ingress Isolation Standard","category":"security","severity":"critical","description":"Mandates fail-closed semantics coupled with strict circuit breaking, sub-second timeouts, and outlier detection on external authorization (ExtAuthz) backends in Envoy Gateway 1.2. Prevents unauthorized request bypass and ingress latency cascades that exhaust worker thread pools during centralized IdP brownouts.","antiPatternHeadline":"Configuring fail-open authorization or unconstrained ExtAuthz connection queues during centralized IdP degradation","stars_count":43,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","envoy-gateway","ext-authz","circuit-breaking","zero-trust","kubernetes"],"exportEndpoints":{"claude":"/api/rules/envoy-gateway-extauthz-fail-closed-circuit-breaking?format=claude","cursorMdc":"/api/rules/envoy-gateway-extauthz-fail-closed-circuit-breaking?format=mdc","cursorrules":"/api/rules/envoy-gateway-extauthz-fail-closed-circuit-breaking?format=cursor","windsurf":"/api/rules/envoy-gateway-extauthz-fail-closed-circuit-breaking?format=windsurf","agents":"/api/rules/envoy-gateway-extauthz-fail-closed-circuit-breaking?format=agents"}},{"id":"k8s-132-inplace-pod-vertical-scaling-cgroupv2-guardrail","title":"Kubernetes 1.32 In-Place Pod Vertical Scaling Cgroup-v2 Dynamic Memory Runtime Sync","category":"devops","severity":"critical","description":"Enforces deterministic synchronization between Kubernetes 1.32 In-Place Pod Vertical Scaling (InPlacePodVerticalScaling feature gate) and runtime-level memory/heap governors using Cgroup v2 events. Prevents silent kernel OOM invocations (SIGKILL 137) during live downward memory adjustments by coordinating inotify watches on cgroup.memory.high/max with runtime GC triggering and heap bounds re-tuning prior to kernel threshold clamp-downs.","antiPatternHeadline":"Unsynchronized In-Place Downward Resize Inducing Immediate Cgroup v2 Kernel OOM Kill","stars_count":66,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","kubernetes","cgroups-v2","resource-management","nodejs","v8"],"exportEndpoints":{"claude":"/api/rules/k8s-132-inplace-pod-vertical-scaling-cgroupv2-guardrail?format=claude","cursorMdc":"/api/rules/k8s-132-inplace-pod-vertical-scaling-cgroupv2-guardrail?format=mdc","cursorrules":"/api/rules/k8s-132-inplace-pod-vertical-scaling-cgroupv2-guardrail?format=cursor","windsurf":"/api/rules/k8s-132-inplace-pod-vertical-scaling-cgroupv2-guardrail?format=windsurf","agents":"/api/rules/k8s-132-inplace-pod-vertical-scaling-cgroupv2-guardrail?format=agents"}},{"id":"openfga-contextual-tuple-transaction-boundary","title":"Atomic Evaluation of Contextual Tuples in OpenFGA Boundaries","category":"security","severity":"critical","description":"Enforces strict isolation and atomicity for ephemeral authorization states by mandating that request-scoped context attributes are passed solely via contextual tuples within a single Check or ListObjects evaluation cycle. Prevents split-brain authorization anomalies, race conditions, and persistent relationship contamination caused by writing temporary tuples to the OpenFGA datastore.","antiPatternHeadline":"Persisting Ephemeral Tuples or Splitting Contextual Checks Across Multiple Roundtrips","stars_count":82,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","authorization","rebac","zero-trust"],"exportEndpoints":{"claude":"/api/rules/openfga-contextual-tuple-transaction-boundary?format=claude","cursorMdc":"/api/rules/openfga-contextual-tuple-transaction-boundary?format=mdc","cursorrules":"/api/rules/openfga-contextual-tuple-transaction-boundary?format=cursor","windsurf":"/api/rules/openfga-contextual-tuple-transaction-boundary?format=windsurf","agents":"/api/rules/openfga-contextual-tuple-transaction-boundary?format=agents"}},{"id":"nextjs15-react-taint-boundary-protection","title":"Next.js 15 Experimental React Taint Object Boundary Enforcement","category":"frontend","severity":"critical","description":"Enforces strict boundary isolation using React's experimental taint APIs in Next.js 15 to prevent raw database records, ORM entities, and cryptographic keys from serializing into React Server Component (RSC) flight payloads. Guarantees that any server-only object or sensitive token inadvertently passed to a Client Component triggers an immediate execution halt.","antiPatternHeadline":"Implicit Flight Payload Leaks of Database Entities and Cryptographic Tokens Across RSC Boundaries","stars_count":63,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs","react19","security","rsc","server-components"],"exportEndpoints":{"claude":"/api/rules/nextjs15-react-taint-boundary-protection?format=claude","cursorMdc":"/api/rules/nextjs15-react-taint-boundary-protection?format=mdc","cursorrules":"/api/rules/nextjs15-react-taint-boundary-protection?format=cursor","windsurf":"/api/rules/nextjs15-react-taint-boundary-protection?format=windsurf","agents":"/api/rules/nextjs15-react-taint-boundary-protection?format=agents"}},{"id":"axum-tokio-task-cancellation-shielding","title":"Axum 0.8 Tokio Task Cancellation Shielding Standard","category":"backend","severity":"critical","description":"Enforces architectural shielding for in-flight side-effecting operations in Axum 0.8 against client TCP disconnects. In Hyper and Axum, dropping an HTTP connection immediately drops the handler future at its current yield point, risking partial distributed state mutations, dangling external API calls, and incomplete transactional boundaries.","antiPatternHeadline":"Awaiting multi-step transactional side-effects directly within unshielded Axum HTTP handler futures","stars_count":47,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tokio","concurrency","distributed-systems"],"exportEndpoints":{"claude":"/api/rules/axum-tokio-task-cancellation-shielding?format=claude","cursorMdc":"/api/rules/axum-tokio-task-cancellation-shielding?format=mdc","cursorrules":"/api/rules/axum-tokio-task-cancellation-shielding?format=cursor","windsurf":"/api/rules/axum-tokio-task-cancellation-shielding?format=windsurf","agents":"/api/rules/axum-tokio-task-cancellation-shielding?format=agents"}},{"id":"vite-6-rolldown-module-federation-chunk-isolation","title":"Vite 6 Rolldown Module Federation Chunk Isolation & Singleton Integrity","category":"frontend","severity":"critical","description":"Enforces deterministic shared runtime singletons and strict CSS/DOM chunk scoping boundaries across decoupled microfrontends compiled via Vite 6 with Rolldown. Prevents catastrophic duplicate runtime instantiation (such as dual React contexts and broken hooks) and uncontained CSS cascading collisions between host containers and dynamically loaded remotes.","antiPatternHeadline":"Dual Runtime Singleton Splitting and Global Style Collision via Unbounded Rolldown Federation Bundling","stars_count":77,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["vite6","rolldown","module-federation","microfrontends","css-scoping","runtime-singleton"],"exportEndpoints":{"claude":"/api/rules/vite-6-rolldown-module-federation-chunk-isolation?format=claude","cursorMdc":"/api/rules/vite-6-rolldown-module-federation-chunk-isolation?format=mdc","cursorrules":"/api/rules/vite-6-rolldown-module-federation-chunk-isolation?format=cursor","windsurf":"/api/rules/vite-6-rolldown-module-federation-chunk-isolation?format=windsurf","agents":"/api/rules/vite-6-rolldown-module-federation-chunk-isolation?format=agents"}},{"id":"postgres-17-pgvector-hnsw-memory-budgeting","title":"Postgres 17 pgvector HNSW Dynamic Memory and Maintenance Budget Guardrail","category":"backend","severity":"critical","description":"Enforces strict session-scoped memory budgeting and connection concurrency controls when building and streaming into pgvector HNSW indexes in Postgres 17. Prevents host kernel OOM kills by systematically bounding maintenance_work_mem, constraining max_parallel_maintenance_workers, and governing working memory during high-throughput vector ingestion.","antiPatternHeadline":"Global Unbounded maintenance_work_mem and Unthrottled Streaming Vector Ingestion Inducing Process-Wide OOM","stars_count":62,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres","pgvector","hnsw","database-performance","vector-search"],"exportEndpoints":{"claude":"/api/rules/postgres-17-pgvector-hnsw-memory-budgeting?format=claude","cursorMdc":"/api/rules/postgres-17-pgvector-hnsw-memory-budgeting?format=mdc","cursorrules":"/api/rules/postgres-17-pgvector-hnsw-memory-budgeting?format=cursor","windsurf":"/api/rules/postgres-17-pgvector-hnsw-memory-budgeting?format=windsurf","agents":"/api/rules/postgres-17-pgvector-hnsw-memory-budgeting?format=agents"}},{"id":"capacitor-7-secure-enclave-hardware-attestation","title":"Capacitor 7 Secure Enclave and StrongBox Hardware Key Attestation Invariant","category":"mobile","severity":"critical","description":"Mandates that cryptographic authentication keys generated within Capacitor 7 hybrid runtimes are physically bound to hardware-isolated crypto co-processors (Apple Secure Enclave or Android StrongBox Keymaster/KeyMint). Enforces server-side hardware attestation verification and strict per-operation or tightly bounded biometric authentication timeouts.","antiPatternHeadline":"Ephemeral WebCrypto key generation or software-backed keystore fallbacks lacking biometric access controls and hardware attestation","stars_count":67,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["capacitor","mobile","security","secure-enclave","strongbox","webauthn","cryptography"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-secure-enclave-hardware-attestation?format=claude","cursorMdc":"/api/rules/capacitor-7-secure-enclave-hardware-attestation?format=mdc","cursorrules":"/api/rules/capacitor-7-secure-enclave-hardware-attestation?format=cursor","windsurf":"/api/rules/capacitor-7-secure-enclave-hardware-attestation?format=windsurf","agents":"/api/rules/capacitor-7-secure-enclave-hardware-attestation?format=agents"}},{"id":"k8s-gateway-api-referencegrant-isolation-standard","title":"Kubernetes Gateway API v1.2 Cross-Namespace ReferenceGrant Isolation","category":"devops","severity":"critical","description":"Enforces strict bidirectional explicit authorization across namespace boundaries within Kubernetes Gateway API v1.2 implementations. Prevents unauthorized multi-tenant route hijacking by ensuring that any cross-namespace reference from an HTTPRoute to a Service or from a Gateway to an HTTPRoute is guarded by a corresponding ReferenceGrant in the target namespace. Guarantees that reconciliation controllers drop unpermitted cross-namespace references with a ReferenceGrantStatus condition of ResolvedRefs=False.","antiPatternHeadline":"Unvalidated Cross-Namespace Backend and Gateway Attachment Permitting Route Hijacking","stars_count":45,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","kubernetes","gateway-api","security","multi-tenancy","network-policy"],"exportEndpoints":{"claude":"/api/rules/k8s-gateway-api-referencegrant-isolation-standard?format=claude","cursorMdc":"/api/rules/k8s-gateway-api-referencegrant-isolation-standard?format=mdc","cursorrules":"/api/rules/k8s-gateway-api-referencegrant-isolation-standard?format=cursor","windsurf":"/api/rules/k8s-gateway-api-referencegrant-isolation-standard?format=windsurf","agents":"/api/rules/k8s-gateway-api-referencegrant-isolation-standard?format=agents"}},{"id":"fastapi-pydantic-v2-async-streaming-serialization","title":"FastAPI & Pydantic v2 Async Chunked Stream Rust-Level Serialization Guardrail","category":"backend","severity":"critical","description":"Mandates direct, unbuffered serialization via Pydantic v2's Rust-backed model_dump_json() within asynchronous generators feeding StreamingResponse or Server-Sent Events (SSE). Prohibits intermediate Python dictionary materialization and synchronous standard library json.dumps calls to eliminate Global Interpreter Lock (GIL) contention, event-loop starvation, and heap bloat on infinite or large-scale data streams.","antiPatternHeadline":"Intermediate Dict Materialization and Synchronous JSON Serialization in Async Stream Generators","stars_count":61,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","pydantic-v2","asyncio","streaming","memory-optimization"],"exportEndpoints":{"claude":"/api/rules/fastapi-pydantic-v2-async-streaming-serialization?format=claude","cursorMdc":"/api/rules/fastapi-pydantic-v2-async-streaming-serialization?format=mdc","cursorrules":"/api/rules/fastapi-pydantic-v2-async-streaming-serialization?format=cursor","windsurf":"/api/rules/fastapi-pydantic-v2-async-streaming-serialization?format=windsurf","agents":"/api/rules/fastapi-pydantic-v2-async-streaming-serialization?format=agents"}},{"id":"tetragon-ebpf-namespace-transition-quarantine","title":"Zero-Latency eBPF Namespace Transition Quarantine via Tetragon TracingPolicy","category":"security","severity":"critical","description":"Mandates in-kernel synchronous SIGKILL enforcement via Cilium Tetragon TracingPolicies on unauthorized setns and unshare syscall transitions. Eliminates user-space detection latency by terminating unauthorized PID and mount namespace boundary escapes directly within the eBPF probe context before syscall completion.","antiPatternHeadline":"Asynchronous User-Space Auditing or Non-Blocking Telemetry for Container Namespace Escapes","stars_count":106,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","tetragon","ebpf","kubernetes","runtime-security","container-escape","zero-trust"],"exportEndpoints":{"claude":"/api/rules/tetragon-ebpf-namespace-transition-quarantine?format=claude","cursorMdc":"/api/rules/tetragon-ebpf-namespace-transition-quarantine?format=mdc","cursorrules":"/api/rules/tetragon-ebpf-namespace-transition-quarantine?format=cursor","windsurf":"/api/rules/tetragon-ebpf-namespace-transition-quarantine?format=windsurf","agents":"/api/rules/tetragon-ebpf-namespace-transition-quarantine?format=agents"}},{"id":"cmp-skiko-vsync-render-pipeline-standard","title":"Compose Multiplatform SKIKO VSync Pipeline Synchronization Standard","category":"mobile","severity":"critical","description":"Mandates deterministic thread dispatch and VSync lock synchronization between platform display clocks (iOS CADisplayLink and Android Choreographer) and the SKIKO rendering engine in Compose Multiplatform. Prevents main-thread priority inversion, rendering deadlocks, and dropped frame deadlines across variable refresh rate displays.","antiPatternHeadline":"Uncoordinated VSync dispatch, blocking calls in display callbacks, and unsynchronized SKIKO render requests across native runtimes","stars_count":115,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","compose-multiplatform","skiko","kotlin-native","ios","android","vsync","metal"],"exportEndpoints":{"claude":"/api/rules/cmp-skiko-vsync-render-pipeline-standard?format=claude","cursorMdc":"/api/rules/cmp-skiko-vsync-render-pipeline-standard?format=mdc","cursorrules":"/api/rules/cmp-skiko-vsync-render-pipeline-standard?format=cursor","windsurf":"/api/rules/cmp-skiko-vsync-render-pipeline-standard?format=windsurf","agents":"/api/rules/cmp-skiko-vsync-render-pipeline-standard?format=agents"}},{"id":"svelte5-runes-ssr-scope-isolation-standard","title":"Svelte 5 Runes SSR Reactive Scope Isolation & Context Encapsulation","category":"frontend","severity":"critical","description":"Enforces strict lexical and contextual isolation for Svelte 5 reactive runes in SSR environments. Module-level $state declarations share memory across concurrent requests in persistent Node.js/edge worker runtimes, causing critical cross-tenant data contamination and memory leaks. Mutable reactive proxies must strictly be encapsulated within request-scoped contexts, factory functions, or component instances.","antiPatternHeadline":"Module-Level $state Declarations Causing Cross-Request State Pollution in SvelteKit SSR","stars_count":87,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["svelte","svelte5","sveltekit","ssr","runes","state-management","security"],"exportEndpoints":{"claude":"/api/rules/svelte5-runes-ssr-scope-isolation-standard?format=claude","cursorMdc":"/api/rules/svelte5-runes-ssr-scope-isolation-standard?format=mdc","cursorrules":"/api/rules/svelte5-runes-ssr-scope-isolation-standard?format=cursor","windsurf":"/api/rules/svelte5-runes-ssr-scope-isolation-standard?format=windsurf","agents":"/api/rules/svelte5-runes-ssr-scope-isolation-standard?format=agents"}},{"id":"react19-server-action-idempotency-replay-boundary","title":"Cryptographically Enforced Idempotency & Replay Boundaries in React 19 Server Actions","category":"frontend","severity":"critical","description":"Enforces client-generated cryptographically unique idempotency tokens across React 19 mutating Server Actions combined with atomic server-side deduplication. Guarantees that transient network drops, browser auto-replays, and concurrent optimistic UI updates cannot produce duplicate database mutations or financial double-charges.","antiPatternHeadline":"Non-Idempotent Server Actions Prone to Silent Duplicate Execution and Phantom State Mutations","stars_count":58,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react19","server-actions","idempotency","optimistic-ui","security"],"exportEndpoints":{"claude":"/api/rules/react19-server-action-idempotency-replay-boundary?format=claude","cursorMdc":"/api/rules/react19-server-action-idempotency-replay-boundary?format=mdc","cursorrules":"/api/rules/react19-server-action-idempotency-replay-boundary?format=cursor","windsurf":"/api/rules/react19-server-action-idempotency-replay-boundary?format=windsurf","agents":"/api/rules/react19-server-action-idempotency-replay-boundary?format=agents"}},{"id":"fastify-v5-asynclocalstorage-context-isolation-standard","title":"Fastify v5 AsyncLocalStorage Request Context Isolation & Anti-Bleed Standard","category":"backend","severity":"critical","description":"Enforces strict AsyncLocalStorage boundary encapsulation across Fastify v5 request lifecycles to prevent cross-tenant telemetry, logging, and security context leakage. Mandates execution within async hook boundaries (onRequest/preHandler) using explicit `als.run()` scopes instead of naive `als.enterWith()`, ensuring determinism across asynchronous continuations, connection pool handoffs, and microtask queues.","antiPatternHeadline":"Ambient ALS Mutability via enterWith() and Hook De-synchronization Leading to Cross-Tenant Context Pollution","stars_count":80,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastify","asynclocalstorage","multitenancy","nodejs","security"],"exportEndpoints":{"claude":"/api/rules/fastify-v5-asynclocalstorage-context-isolation-standard?format=claude","cursorMdc":"/api/rules/fastify-v5-asynclocalstorage-context-isolation-standard?format=mdc","cursorrules":"/api/rules/fastify-v5-asynclocalstorage-context-isolation-standard?format=cursor","windsurf":"/api/rules/fastify-v5-asynclocalstorage-context-isolation-standard?format=windsurf","agents":"/api/rules/fastify-v5-asynclocalstorage-context-isolation-standard?format=agents"}},{"id":"go-synctest-concurrency-bubble-invariants","title":"Go 1.24 synctest Concurrency Bubble Isolation and Deterministic Time Invariants","category":"backend","severity":"critical","description":"Mandates strict isolation of synthetic time bubbles when using Go 1.24 testing/synctest for concurrent and distributed systems testing. Prevents deadlocks and runtime panics caused by cross-bubble synchronization leakage, unconfined background goroutines, and unmocked real-world operating system I/O.","antiPatternHeadline":"Escaping synctest Bubbles via External Channels or Unmocked Real-Time System I/O","stars_count":57,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","golang","concurrency","synctest","testing","distributed-systems"],"exportEndpoints":{"claude":"/api/rules/go-synctest-concurrency-bubble-invariants?format=claude","cursorMdc":"/api/rules/go-synctest-concurrency-bubble-invariants?format=mdc","cursorrules":"/api/rules/go-synctest-concurrency-bubble-invariants?format=cursor","windsurf":"/api/rules/go-synctest-concurrency-bubble-invariants?format=windsurf","agents":"/api/rules/go-synctest-concurrency-bubble-invariants?format=agents"}},{"id":"pgvector-halfvec-hnsw-memory-guardrail-pgvector-0-8-hal-939","title":"pgvector 0.8 Half-Vector HNSW Index Build Memory Guardrail","category":"backend","severity":"critical","description":"Enforces deterministic maintenance_work_mem boundaries and max_parallel_maintenance_workers constraints during pgvector 0.8 halfvec (fp16) HNSW index builds. Prevents Linux Out-Of-Memory (OOM) killer panics caused by unconstrained per-worker memory allocation multiplying across concurrent vector indexing pipelines.","antiPatternHeadline":"Global Unchecked maintenance_work_mem and Vector Casting During Parallel HNSW Indexing","stars_count":97,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres","pgvector","database-migration","hnsw","memory-management"],"exportEndpoints":{"claude":"/api/rules/pgvector-halfvec-hnsw-memory-guardrail-pgvector-0-8-hal-939?format=claude","cursorMdc":"/api/rules/pgvector-halfvec-hnsw-memory-guardrail-pgvector-0-8-hal-939?format=mdc","cursorrules":"/api/rules/pgvector-halfvec-hnsw-memory-guardrail-pgvector-0-8-hal-939?format=cursor","windsurf":"/api/rules/pgvector-halfvec-hnsw-memory-guardrail-pgvector-0-8-hal-939?format=windsurf","agents":"/api/rules/pgvector-halfvec-hnsw-memory-guardrail-pgvector-0-8-hal-939?format=agents"}},{"id":"react-native-bridgeless-fabric-jsi-concurrency-guardrail","title":"React Native 0.76+ Bridgeless Fabric JSI Concurrency Invariant","category":"mobile","severity":"critical","description":"In React Native 0.76+ Bridgeless Mode with Fabric and the New Architecture, synchronous C++ JSI host object methods and TurboModule invocations bound to the JS Runtime must never be executed on background worker threads without runtime isolation. Violating this invariant causes fatal UI thread deadlocks, SIGSEGV crashes from non-thread-safe JSI pointer dereferencing, and engine heap corruption.","antiPatternHeadline":"Calling synchronous JSI Host Objects or TurboModules directly from background web workers or secondary thread runtimes","stars_count":65,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","react-native","new-architecture","bridgeless","fabric","jsi","concurrency","turbomodules"],"exportEndpoints":{"claude":"/api/rules/react-native-bridgeless-fabric-jsi-concurrency-guardrail?format=claude","cursorMdc":"/api/rules/react-native-bridgeless-fabric-jsi-concurrency-guardrail?format=mdc","cursorrules":"/api/rules/react-native-bridgeless-fabric-jsi-concurrency-guardrail?format=cursor","windsurf":"/api/rules/react-native-bridgeless-fabric-jsi-concurrency-guardrail?format=windsurf","agents":"/api/rules/react-native-bridgeless-fabric-jsi-concurrency-guardrail?format=agents"}},{"id":"capacitor-7-background-runner-execution-quota-guardrail","title":"Capacitor 7 Headless Background Runner Memory and Watchdog Execution Quotas","category":"mobile","severity":"critical","description":"Enforces deterministic watchdog timeout budgets and strict heap allocation boundaries for @capacitor/background-runner headless workers. Preempts silent OS termination (iOS Jetsam/0x8badf00d and Android WorkManager 10-minute/OOM kills) by mandating cooperative AbortController timeouts, state checkpointing, and zero-allocation payload streaming.","antiPatternHeadline":"Unbounded Headless Background Execution Without Cooperative Watchdog Abort or Memory Constraints","stars_count":58,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","background-runner","ios","android","resilience"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-background-runner-execution-quota-guardrail?format=claude","cursorMdc":"/api/rules/capacitor-7-background-runner-execution-quota-guardrail?format=mdc","cursorrules":"/api/rules/capacitor-7-background-runner-execution-quota-guardrail?format=cursor","windsurf":"/api/rules/capacitor-7-background-runner-execution-quota-guardrail?format=windsurf","agents":"/api/rules/capacitor-7-background-runner-execution-quota-guardrail?format=agents"}},{"id":"spiffe-spire-ephemeral-x509-svid-lifecycle-standard","title":"SPIFFE/SPIRE Ephemeral X.509 SVID Attestation Lifecycle Standard","category":"security","severity":"critical","description":"Enforces sub-one-hour ephemeral X.509 SVID lifecycles and continuous kernel-level attestation via the local SPIRE Workload API over UNIX domain sockets. Guarantees that cryptographic private keys remain in-memory only and that dynamic TLS configurations automatically rotate identities prior to expiry to eliminate exfiltration windows and lateral movement.","antiPatternHeadline":"Persisting Workload Credentials to Disk or Using Long-Lived Static TLS Pairs Instead of In-Memory Dynamic SVID Streams","stars_count":53,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","spiffe","spire","zero-trust","mtls","x509","cryptography"],"exportEndpoints":{"claude":"/api/rules/spiffe-spire-ephemeral-x509-svid-lifecycle-standard?format=claude","cursorMdc":"/api/rules/spiffe-spire-ephemeral-x509-svid-lifecycle-standard?format=mdc","cursorrules":"/api/rules/spiffe-spire-ephemeral-x509-svid-lifecycle-standard?format=cursor","windsurf":"/api/rules/spiffe-spire-ephemeral-x509-svid-lifecycle-standard?format=windsurf","agents":"/api/rules/spiffe-spire-ephemeral-x509-svid-lifecycle-standard?format=agents"}},{"id":"cilium-ebpf-socket-dns-egress-guardrail","title":"Cilium eBPF Socket-Level FQDN Egress Filtering and DNS Handshake Invariant","category":"security","severity":"critical","description":"Enforces strict FQDN-based egress access policies at the Linux kernel socket layer using Cilium eBPF before any TCP SYN packets or UDP frames egress the host. Mandates that all application network requests transit a kernel-intercepted DNS proxy cache with strict TTL tracking, completely mitigating blind IP-based egress bypasses and out-of-band data exfiltration.","antiPatternHeadline":"Bypassing Kernel DNS Proxies via Direct IP Egress or Unvalidated FQDN Wildcards","stars_count":68,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","cilium","ebpf","kubernetes","network-policy","egress-filtering"],"exportEndpoints":{"claude":"/api/rules/cilium-ebpf-socket-dns-egress-guardrail?format=claude","cursorMdc":"/api/rules/cilium-ebpf-socket-dns-egress-guardrail?format=mdc","cursorrules":"/api/rules/cilium-ebpf-socket-dns-egress-guardrail?format=cursor","windsurf":"/api/rules/cilium-ebpf-socket-dns-egress-guardrail?format=windsurf","agents":"/api/rules/cilium-ebpf-socket-dns-egress-guardrail?format=agents"}},{"id":"otel-collector-tail-sampling-backpressure-standard","title":"OpenTelemetry Collector Tail-Based Sampling Memory Backpressure Standard","category":"devops","severity":"critical","description":"Enforces deterministic memory safety boundaries and backpressure mechanics within OpenTelemetry Collector deployments running tail-based sampling. Mandates the placement of the memory_limiter processor strictly before stateful sampling processors and requires explicit calibration of trace buffer limits against container cgroup allocations to prevent OOMKilled events during high-concurrency traffic bursts.","antiPatternHeadline":"Buffering unbounded in-flight traces in tail samplers without upstream memory gating, triggering catastrophic OOM crashes during sudden microservice traffic spikes.","stars_count":74,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","observability","kubernetes","infrastructure","reliability"],"exportEndpoints":{"claude":"/api/rules/otel-collector-tail-sampling-backpressure-standard?format=claude","cursorMdc":"/api/rules/otel-collector-tail-sampling-backpressure-standard?format=mdc","cursorrules":"/api/rules/otel-collector-tail-sampling-backpressure-standard?format=cursor","windsurf":"/api/rules/otel-collector-tail-sampling-backpressure-standard?format=windsurf","agents":"/api/rules/otel-collector-tail-sampling-backpressure-standard?format=agents"}},{"id":"tauri-v2-ipc-capability-scoping-isolation-boundary","title":"Tauri 2.0 Granular Capability Manifests and IPC Boundary Isolation","category":"mobile","severity":"critical","description":"Tauri 2.0 enforces a multi-layered security architecture where native plugins and IPC commands require explicit, fine-grained capability definitions scoped to specific webview windows and mobile platforms. Unrestricted wildcards or global plugin permissions expose desktop and mobile webviews to arbitrary native bridge escalation if XSS or malicious deep links compromise the frontend context. All native bridge invocations must be bound to minimal capability permission sets, cryptographically validated payloads, and isolated execution windows.","antiPatternHeadline":"Global Plugin Enablement and Wildcard Capability Mapping Allowing Arbitrary Native Bridge Escalation","stars_count":109,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri-2","security","ipc","rust","capabilities"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-ipc-capability-scoping-isolation-boundary?format=claude","cursorMdc":"/api/rules/tauri-v2-ipc-capability-scoping-isolation-boundary?format=mdc","cursorrules":"/api/rules/tauri-v2-ipc-capability-scoping-isolation-boundary?format=cursor","windsurf":"/api/rules/tauri-v2-ipc-capability-scoping-isolation-boundary?format=windsurf","agents":"/api/rules/tauri-v2-ipc-capability-scoping-isolation-boundary?format=agents"}},{"id":"webauthn-conditional-mediation-synced-passkey-invariants","title":"WebAuthn Conditional Mediation & Synced Passkey Assertion Invariants","category":"security","severity":"critical","description":"Enforces strict cryptographic verification for WebAuthn conditional mediation (autofill) and multi-device synced passkeys. Mandates server-side cryptographic challenge generation, single-use binding to secure HTTP-only sessions, multi-device backup state evaluation, and absolute prohibition of zero-trust signature counter checks for synced credentials.","antiPatternHeadline":"Blind Counter Verification and Unbound Challenge Consumption in Conditional Autofill Flows","stars_count":64,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","passkeys","cryptography","conditional-mediation","fido2"],"exportEndpoints":{"claude":"/api/rules/webauthn-conditional-mediation-synced-passkey-invariants?format=claude","cursorMdc":"/api/rules/webauthn-conditional-mediation-synced-passkey-invariants?format=mdc","cursorrules":"/api/rules/webauthn-conditional-mediation-synced-passkey-invariants?format=cursor","windsurf":"/api/rules/webauthn-conditional-mediation-synced-passkey-invariants?format=windsurf","agents":"/api/rules/webauthn-conditional-mediation-synced-passkey-invariants?format=agents"}},{"id":"capacitor-7-android-15-lifecycle-back-navigation-guardrail","title":"Deterministic Lifecycle State Restoration and Predictive Back Handling in Capacitor 7","category":"mobile","severity":"critical","description":"Enforces robust process eviction survival and zero-lag Android 15 Predictive Back gesture integration in Capacitor 7 hybrid web runtimes. Mandates asynchronous state preservation during native lifecycle transitions and non-blocking back-action routing to eliminate WebView crashes, unhandled synthetic navigation events, and white-screen regressions on low-memory eviction.","antiPatternHeadline":"Unregistered Predictive Back Handlers with Memory-Synchronous State Eviction","stars_count":91,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor7","android15","predictive-back","lifecycle","webview"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-android-15-lifecycle-back-navigation-guardrail?format=claude","cursorMdc":"/api/rules/capacitor-7-android-15-lifecycle-back-navigation-guardrail?format=mdc","cursorrules":"/api/rules/capacitor-7-android-15-lifecycle-back-navigation-guardrail?format=cursor","windsurf":"/api/rules/capacitor-7-android-15-lifecycle-back-navigation-guardrail?format=windsurf","agents":"/api/rules/capacitor-7-android-15-lifecycle-back-navigation-guardrail?format=agents"}},{"id":"ebpf-tetragon-namespace-execution-guardrail","title":"Deterministic Kernel-Level Tetragon Process & Namespace Socket Boundary Enforcement","category":"security","severity":"critical","description":"Enforces synchronous kernel-level process and namespace boundary invariants using Cilium Tetragon TracingPolicies inside hardened distroless container environments. Mandates in-kernel sigkill termination on unlisted binary execve invocations and restricts AF_INET/AF_PACKET socket creation within targeted container namespaces to eliminate zero-day escapes and lateral movement.","antiPatternHeadline":"Relying on Asynchronous User-Space Audit Logs Instead of In-Kernel Synchronous Sigkill Policy Enforcement","stars_count":65,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","ebpf","tetragon","kubernetes","distroless","runtime-security"],"exportEndpoints":{"claude":"/api/rules/ebpf-tetragon-namespace-execution-guardrail?format=claude","cursorMdc":"/api/rules/ebpf-tetragon-namespace-execution-guardrail?format=mdc","cursorrules":"/api/rules/ebpf-tetragon-namespace-execution-guardrail?format=cursor","windsurf":"/api/rules/ebpf-tetragon-namespace-execution-guardrail?format=windsurf","agents":"/api/rules/ebpf-tetragon-namespace-execution-guardrail?format=agents"}},{"id":"drizzle-edge-connection-pooling-prepared-statements","title":"Drizzle ORM Edge Runtime Pooling and Prepared Statement Invariants","category":"backend","severity":"critical","description":"Mandates explicit connection pool sizing and prepared statement disabling when configuring Drizzle ORM across ephemeral edge runtimes and transaction poolers (PgBouncer/Supabase/Neon). Prevents connection starvation, 42P05 prepared statement collisions, and micro-VM memory exhaustion under high concurrency.","antiPatternHeadline":"Instantiating Per-Request Database Clients and Enabling Prepared Statements Through Transaction-Mode Connection Poolers","stars_count":52,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","drizzle-orm","postgresql","serverless","edge-runtime","connection-pooling"],"exportEndpoints":{"claude":"/api/rules/drizzle-edge-connection-pooling-prepared-statements?format=claude","cursorMdc":"/api/rules/drizzle-edge-connection-pooling-prepared-statements?format=mdc","cursorrules":"/api/rules/drizzle-edge-connection-pooling-prepared-statements?format=cursor","windsurf":"/api/rules/drizzle-edge-connection-pooling-prepared-statements?format=windsurf","agents":"/api/rules/drizzle-edge-connection-pooling-prepared-statements?format=agents"}},{"id":"otel-w3c-tracecontext-baggage-pii-sanitization-standard","title":"OpenTelemetry W3C TraceContext and Baggage PII Sanitization Guardrail","category":"devops","severity":"critical","description":"Enforces strict allowlisting, redaction, and size boundaries on OpenTelemetry W3C Baggage propagation across service boundaries. Prevents severe regulatory compliance exposure (GDPR, HIPAA, CCPA) and downstream HTTP 431 header overflow cascades caused by unconstrained propagation of sensitive contextual data.","antiPatternHeadline":"Blind Downstream Propagation of Unsanitized Baggage Headers Leaking PII and Inducing Header Bloat","stars_count":52,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","observability","w3c-tracecontext","pii-redaction","distributed-tracing","compliance"],"exportEndpoints":{"claude":"/api/rules/otel-w3c-tracecontext-baggage-pii-sanitization-standard?format=claude","cursorMdc":"/api/rules/otel-w3c-tracecontext-baggage-pii-sanitization-standard?format=mdc","cursorrules":"/api/rules/otel-w3c-tracecontext-baggage-pii-sanitization-standard?format=cursor","windsurf":"/api/rules/otel-w3c-tracecontext-baggage-pii-sanitization-standard?format=windsurf","agents":"/api/rules/otel-w3c-tracecontext-baggage-pii-sanitization-standard?format=agents"}},{"id":"iceberg-rest-catalog-clickhouse-zero-copy-invariants","title":"Apache Iceberg REST Catalog and ClickHouse Zero-Copy Ingestion Invariants","category":"backend","severity":"critical","description":"Enforces strict optimistic concurrency control (OCC) commit protocols on Iceberg REST Catalog endpoints while managing ClickHouse zero-copy table attachments. Guarantees linearizable ACID metadata transitions, eliminates catalog split-brain states, and prevents orphaned object storage data files during concurrent sub-second analytical streaming writes.","antiPatternHeadline":"Unfenced Metadata Appends and Direct Object Storage Writes Bypassing REST Catalog CAS Contracts","stars_count":76,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","apache-iceberg","clickhouse","rest-catalog","zero-copy","acid-transactions","concurrency"],"exportEndpoints":{"claude":"/api/rules/iceberg-rest-catalog-clickhouse-zero-copy-invariants?format=claude","cursorMdc":"/api/rules/iceberg-rest-catalog-clickhouse-zero-copy-invariants?format=mdc","cursorrules":"/api/rules/iceberg-rest-catalog-clickhouse-zero-copy-invariants?format=cursor","windsurf":"/api/rules/iceberg-rest-catalog-clickhouse-zero-copy-invariants?format=windsurf","agents":"/api/rules/iceberg-rest-catalog-clickhouse-zero-copy-invariants?format=agents"}},{"id":"k8s-gateway-api-cross-cluster-canary-invariants","title":"Kubernetes Gateway API Cross-Cluster Route Migration and Canary Invariants","category":"devops","severity":"critical","description":"Mandates declarative atomic traffic splitting, synchronized multi-cluster ServiceImport references, and explicit ReferenceGrant validation during Layer-7 route migrations. Eliminates dropped requests, orphaned upstream backends, and non-convergent canary states across federated clusters.","antiPatternHeadline":"Unvalidated Cross-Cluster Canary Transitions with Missing ReferenceGrants and Unsynchronized ServiceImports","stars_count":82,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","kubernetes","gateway-api","multi-cluster","canary","traffic-management"],"exportEndpoints":{"claude":"/api/rules/k8s-gateway-api-cross-cluster-canary-invariants?format=claude","cursorMdc":"/api/rules/k8s-gateway-api-cross-cluster-canary-invariants?format=mdc","cursorrules":"/api/rules/k8s-gateway-api-cross-cluster-canary-invariants?format=cursor","windsurf":"/api/rules/k8s-gateway-api-cross-cluster-canary-invariants?format=windsurf","agents":"/api/rules/k8s-gateway-api-cross-cluster-canary-invariants?format=agents"}},{"id":"react19-server-action-idempotency-protocol","title":"React 19 Server Action Idempotency-Key Protocol & Optimistic Mutation Deduplication","category":"frontend","severity":"critical","description":"Enforces strictly deduplicated, at-most-once mutation guarantees across transient client network retries during React 19 optimistic UI transitions. Requires client-side generation of cryptographically secure idempotency keys bounded to user action lifecycles and server-side atomic reservation before state execution.","antiPatternHeadline":"Blind Server Action Invocations and Regenerated Request Keys Causing Duplicate Ledger Mutations on Transient Retries","stars_count":115,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","server-actions","idempotency","optimistic-ui","transactions"],"exportEndpoints":{"claude":"/api/rules/react19-server-action-idempotency-protocol?format=claude","cursorMdc":"/api/rules/react19-server-action-idempotency-protocol?format=mdc","cursorrules":"/api/rules/react19-server-action-idempotency-protocol?format=cursor","windsurf":"/api/rules/react19-server-action-idempotency-protocol?format=windsurf","agents":"/api/rules/react19-server-action-idempotency-protocol?format=agents"}},{"id":"vite6-dynamic-esm-microfrontend-sri-standard","title":"Vite 6 Dynamic ESM Micro-Frontend Subresource Integrity (SRI) Standard","category":"frontend","severity":"critical","description":"Mandates cryptographic origin verification and tamper-proofing for federated chunks resolved at runtime across decoupled CDN deployments. Enforces deterministic manifest-driven SRI verification via link-modulepreload pre-injection or cryptographically validated dynamic import wrappers in Vite 6 host applications.","antiPatternHeadline":"Blind Dynamic ESM Remote Execution Without Cryptographic Subresource Integrity Validation","stars_count":72,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","vite6","esm","micro-frontends","subresource-integrity","supply-chain-security"],"exportEndpoints":{"claude":"/api/rules/vite6-dynamic-esm-microfrontend-sri-standard?format=claude","cursorMdc":"/api/rules/vite6-dynamic-esm-microfrontend-sri-standard?format=mdc","cursorrules":"/api/rules/vite6-dynamic-esm-microfrontend-sri-standard?format=cursor","windsurf":"/api/rules/vite6-dynamic-esm-microfrontend-sri-standard?format=windsurf","agents":"/api/rules/vite6-dynamic-esm-microfrontend-sri-standard?format=agents"}},{"id":"bun-websocket-backpressure-drain-invariant","title":"Bun 1.2 Native WebSocket Backpressure & Auto-Paced Drain Invariant","category":"backend","severity":"critical","description":"Enforces strict backpressure handling and drain threshold auto-pacing on native Bun 1.2 WebSocket connections. Prevents silent C++ uSockets buffer accumulation, event-loop starvation, and native heap exhaustion under high-throughput concurrent loads by mandating backpressure state inspection and asynchronous stream suspension until native drain hooks fire.","antiPatternHeadline":"Unchecked Native ws.send() Broadcasting Without Drain Listeners or High-Water Mark Throttling","stars_count":58,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","websockets","backpressure","memory-management","concurrency"],"exportEndpoints":{"claude":"/api/rules/bun-websocket-backpressure-drain-invariant?format=claude","cursorMdc":"/api/rules/bun-websocket-backpressure-drain-invariant?format=mdc","cursorrules":"/api/rules/bun-websocket-backpressure-drain-invariant?format=cursor","windsurf":"/api/rules/bun-websocket-backpressure-drain-invariant?format=windsurf","agents":"/api/rules/bun-websocket-backpressure-drain-invariant?format=agents"}},{"id":"postgres-17-hashjoin-adaptive-spill-memory-cap-standard","title":"Postgres 17 Hash Join Adaptive Spill Memory-Cap Standard","category":"backend","severity":"critical","description":"Enforces deterministic per-query memory limits and spill-to-disk safeguards for multi-tenant analytical workloads in PostgreSQL 17. Guarantees that hash join allocations adaptively respect transaction-scoped work_mem and hash_mem_multiplier boundaries, preventing concurrent multi-tenant aggregations from triggering Linux kernel OOM (Out-Of-Memory) killer termination.","antiPatternHeadline":"Unbounded Hash Table Expansion Triggering Host-Level OOM Killer During Multi-Tenant Analytical Aggregations","stars_count":94,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres","performance","database","memory-management","multi-tenant"],"exportEndpoints":{"claude":"/api/rules/postgres-17-hashjoin-adaptive-spill-memory-cap-standard?format=claude","cursorMdc":"/api/rules/postgres-17-hashjoin-adaptive-spill-memory-cap-standard?format=mdc","cursorrules":"/api/rules/postgres-17-hashjoin-adaptive-spill-memory-cap-standard?format=cursor","windsurf":"/api/rules/postgres-17-hashjoin-adaptive-spill-memory-cap-standard?format=windsurf","agents":"/api/rules/postgres-17-hashjoin-adaptive-spill-memory-cap-standard?format=agents"}},{"id":"openfga-contextual-tuple-depth-bounded-resolution","title":"Depth-Bounded Cycle-Safe ReBAC Contextual Tuple Graph Resolution","category":"security","severity":"critical","description":"Enforces bounded graph evaluation and input sanitization for Zanzibar-style ReBAC systems when resolving contextual authorization tuples. Prevents algorithmic complexity denial-of-service (ReDoS/Graph DoS) and evaluation deadlocks caused by unbounded recursion, user-injected cyclic dependencies, and missing traversal deadlines.","antiPatternHeadline":"Injecting Unsanitized Contextual Tuples Permitting Circular Traversal and Algorithmic DoS","stars_count":107,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","rebac","zanzibar","authorization","dos-prevention"],"exportEndpoints":{"claude":"/api/rules/openfga-contextual-tuple-depth-bounded-resolution?format=claude","cursorMdc":"/api/rules/openfga-contextual-tuple-depth-bounded-resolution?format=mdc","cursorrules":"/api/rules/openfga-contextual-tuple-depth-bounded-resolution?format=cursor","windsurf":"/api/rules/openfga-contextual-tuple-depth-bounded-resolution?format=windsurf","agents":"/api/rules/openfga-contextual-tuple-depth-bounded-resolution?format=agents"}},{"id":"spiffe-spire-x509-svid-rotation-standard-spiffe-spire-sho-204","title":"SPIFFE/SPIRE Short-Lived X.509 SVID Sub-Hour Rotation Standard","category":"security","severity":"critical","description":"Eliminates static ambient credentials by mandating dynamic, sub-15-minute X.509 SVID lifecycles driven by SPIRE Workload API streams. Enforces non-disruptive, in-memory TLS certificate updates using dynamic SNI/cert callbacks without process restarts, static filesystem writes, or cached TLS contexts.","antiPatternHeadline":"Persisting X.509 SVIDs to Disk or Baking Certificates into Immutable Static TLS Contexts","stars_count":43,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","spiffe","spire","mtls","zero-trust","pki"],"exportEndpoints":{"claude":"/api/rules/spiffe-spire-x509-svid-rotation-standard-spiffe-spire-sho-204?format=claude","cursorMdc":"/api/rules/spiffe-spire-x509-svid-rotation-standard-spiffe-spire-sho-204?format=mdc","cursorrules":"/api/rules/spiffe-spire-x509-svid-rotation-standard-spiffe-spire-sho-204?format=cursor","windsurf":"/api/rules/spiffe-spire-x509-svid-rotation-standard-spiffe-spire-sho-204?format=windsurf","agents":"/api/rules/spiffe-spire-x509-svid-rotation-standard-spiffe-spire-sho-204?format=agents"}},{"id":"capacitor-7-android-15-edge-to-edge-inset-sync","title":"Capacitor 7 Android 15 Edge-to-Edge System Inset Synchronization","category":"mobile","severity":"critical","description":"Android 15 (API level 35) enforces edge-to-edge window layout by default, extending hybrid WebViews underneath system status bars and gesture navigation bars. Without deterministic viewport configuration and safe-area inset synchronization, primary interactive elements such as bottom navigation bars and floating buttons become occluded and unclickable. This guardrail mandates viewport-fit declarations, CSS environment variable injection, and automated safe-area fallback token management across Capacitor 7 hybrid web applications.","antiPatternHeadline":"Unpadded Viewport Submersion and Gesture Inset Occlusion Under Android 15 System Bars","stars_count":62,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","android-15","edge-to-edge","insets","css-safe-area","webview"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-android-15-edge-to-edge-inset-sync?format=claude","cursorMdc":"/api/rules/capacitor-7-android-15-edge-to-edge-inset-sync?format=mdc","cursorrules":"/api/rules/capacitor-7-android-15-edge-to-edge-inset-sync?format=cursor","windsurf":"/api/rules/capacitor-7-android-15-edge-to-edge-inset-sync?format=windsurf","agents":"/api/rules/capacitor-7-android-15-edge-to-edge-inset-sync?format=agents"}},{"id":"tauri-v2-deep-link-origin-attestation","title":"Tauri 2.0 Deep-Link Cryptographic Origin Attestation & IPC Boundary Standard","category":"mobile","severity":"critical","description":"Enforces cryptographic attestation, ephemeral state verification, and strict origin validation on all deep-link scheme payloads at the Tauri 2.0 native Rust boundary before dispatching events across the inner IPC bus. Defends against custom URI scheme hijacking and intent interception on mobile operating systems where malicious applications register identical schemes.","antiPatternHeadline":"Direct Forwarding of Unverified Custom Scheme Payloads to Tauri IPC Bus","stars_count":96,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri-v2","security","deep-linking","cryptography","ipc"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-deep-link-origin-attestation?format=claude","cursorMdc":"/api/rules/tauri-v2-deep-link-origin-attestation?format=mdc","cursorrules":"/api/rules/tauri-v2-deep-link-origin-attestation?format=cursor","windsurf":"/api/rules/tauri-v2-deep-link-origin-attestation?format=windsurf","agents":"/api/rules/tauri-v2-deep-link-origin-attestation?format=agents"}},{"id":"opentelemetry-1-28-baggage-tamper-proof-guardrail","title":"OpenTelemetry 1.28 Baggage Tamper-Proof & Telemetry Boundary Enforcement","category":"devops","severity":"critical","description":"Enforces strict cryptographic integrity, schema validation, and trust-boundary sanitization on W3C Baggage propagation conforming to OpenTelemetry Semantic Conventions 1.28. Precludes telemetry spoofing, routing injection, and cross-service privilege escalation by ensuring distributed context cannot be mutated or consumed across untrusted network edges without HMAC-SHA256 verification.","antiPatternHeadline":"Unvalidated Ingestion and Downstream Propagation of Raw W3C Baggage Headers across Security Boundaries","stars_count":84,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","security","distributed-tracing","w3c-baggage"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-1-28-baggage-tamper-proof-guardrail?format=claude","cursorMdc":"/api/rules/opentelemetry-1-28-baggage-tamper-proof-guardrail?format=mdc","cursorrules":"/api/rules/opentelemetry-1-28-baggage-tamper-proof-guardrail?format=cursor","windsurf":"/api/rules/opentelemetry-1-28-baggage-tamper-proof-guardrail?format=windsurf","agents":"/api/rules/opentelemetry-1-28-baggage-tamper-proof-guardrail?format=agents"}},{"id":"nextjs-15-ppr-async-boundary-enforcement","title":"Next.js 15 Partial Prerendering (PPR) Async Request API Boundary Enforcement","category":"frontend","severity":"critical","description":"Next.js 15 Partial Prerendering couples static shell delivery with dynamic streaming. Awaiting dynamic request APIs (cookies, headers, connection, or unresolved searchParams) in root page components or layouts destroys the static pre-rendered shell and collapses the route into full dynamic SSR. Dynamic accessor invocation must be strictly isolated to leaf Server Components wrapped in explicit Suspense boundaries.","antiPatternHeadline":"Awaiting Dynamic APIs at Route Root Causing Full-Route Dynamic Bailout and Static Shell Collapse","stars_count":62,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs","react19","partial-prerendering","server-components","performance"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-ppr-async-boundary-enforcement?format=claude","cursorMdc":"/api/rules/nextjs-15-ppr-async-boundary-enforcement?format=mdc","cursorrules":"/api/rules/nextjs-15-ppr-async-boundary-enforcement?format=cursor","windsurf":"/api/rules/nextjs-15-ppr-async-boundary-enforcement?format=windsurf","agents":"/api/rules/nextjs-15-ppr-async-boundary-enforcement?format=agents"}},{"id":"fastapi-sse-client-disconnect-backpressure-pipeline","title":"FastAPI Async SSE Client Disconnect & Backpressure Propagation Standard","category":"backend","severity":"critical","description":"Mandates explicit client disconnect detection and active task cancellation within FastAPI Server-Sent Events (SSE) and StreamingResponse pipelines. Eliminates orphan upstream LLM generation loops, unmetered token depletion, and dangling TCP/HTTP/2 kernel buffer handles when downstream clients drop connections.","antiPatternHeadline":"Zombie Token Generation and Socket Buffer Leakage via Unmonitored Async Generators","stars_count":52,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","asyncio","server-sent-events","streaming","http2","resource-management"],"exportEndpoints":{"claude":"/api/rules/fastapi-sse-client-disconnect-backpressure-pipeline?format=claude","cursorMdc":"/api/rules/fastapi-sse-client-disconnect-backpressure-pipeline?format=mdc","cursorrules":"/api/rules/fastapi-sse-client-disconnect-backpressure-pipeline?format=cursor","windsurf":"/api/rules/fastapi-sse-client-disconnect-backpressure-pipeline?format=windsurf","agents":"/api/rules/fastapi-sse-client-disconnect-backpressure-pipeline?format=agents"}},{"id":"react-native-bridgeless-turbomodule-swift6-concurrency","title":"React Native Bridgeless TurboModule Swift 6 Strict Concurrency & Sendable Invariant","category":"mobile","severity":"critical","description":"Enforces complete Swift 6 strict concurrency checks, explicit Sendable isolation, and actor-bound state synchronization across React Native Bridgeless TurboModules. Prevents undefined execution order, thread hopping crashes, and low-level data races caused by unmarshaled C++ Nitro/JSI dispatch queues interacting with mutable Swift runtime instances.","antiPatternHeadline":"Unsynchronized Mutable State and Non-Sendable Escaping Closures in Bridgeless TurboModules","stars_count":87,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","react-native","turbomodules","swift6","concurrency","bridgeless","nitro-modules"],"exportEndpoints":{"claude":"/api/rules/react-native-bridgeless-turbomodule-swift6-concurrency?format=claude","cursorMdc":"/api/rules/react-native-bridgeless-turbomodule-swift6-concurrency?format=mdc","cursorrules":"/api/rules/react-native-bridgeless-turbomodule-swift6-concurrency?format=cursor","windsurf":"/api/rules/react-native-bridgeless-turbomodule-swift6-concurrency?format=windsurf","agents":"/api/rules/react-native-bridgeless-turbomodule-swift6-concurrency?format=agents"}},{"id":"flutter-impeller-vulkan-pipeline-cache-prewarming-guardrail","title":"Flutter Impeller Vulkan Pipeline Cache Pre-Warming & Persistence Invariant","category":"mobile","severity":"critical","description":"Enforces proactive compilation and disk-backed persistence of Impeller Vulkan Pipeline State Objects (PSOs) before initiating navigation transitions or rendering dynamic GPU effects. Prevents JIT pipeline compilation stalls on the raster thread, eliminating sub-8.33ms frame-drop anomalies on 120Hz display refresh targets.","antiPatternHeadline":"Executing Dynamic Pipeline Compilation and Uncached Shaders During Route Transitions on Impeller Vulkan","stars_count":42,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["flutter","impeller","vulkan","performance","shaders","mobile"],"exportEndpoints":{"claude":"/api/rules/flutter-impeller-vulkan-pipeline-cache-prewarming-guardrail?format=claude","cursorMdc":"/api/rules/flutter-impeller-vulkan-pipeline-cache-prewarming-guardrail?format=mdc","cursorrules":"/api/rules/flutter-impeller-vulkan-pipeline-cache-prewarming-guardrail?format=cursor","windsurf":"/api/rules/flutter-impeller-vulkan-pipeline-cache-prewarming-guardrail?format=windsurf","agents":"/api/rules/flutter-impeller-vulkan-pipeline-cache-prewarming-guardrail?format=agents"}},{"id":"fapi-20-dpop-key-bound-tokens","title":"FAPI 2.0 Security Profile with DPoP Key-Bound Token Enforcement","category":"security","severity":"critical","description":"Enforces FAPI 2.0 Security Profile compliance by mandating Demonstrating Proof-of-Possession (DPoP) key-binding (RFC 9449) on all outbound client credentials and inbound resource server validations. Disallows raw Bearer token schemes across microservice perimeters to neutralize token exfiltration and replay attacks at Layer 7.","antiPatternHeadline":"Accepting or Transmitting Unbound Bearer Tokens in FAPI 2.0 Perimeters","stars_count":110,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","fapi-2","dpop","oauth2","oidc","cryptography"],"exportEndpoints":{"claude":"/api/rules/fapi-20-dpop-key-bound-tokens?format=claude","cursorMdc":"/api/rules/fapi-20-dpop-key-bound-tokens?format=mdc","cursorrules":"/api/rules/fapi-20-dpop-key-bound-tokens?format=cursor","windsurf":"/api/rules/fapi-20-dpop-key-bound-tokens?format=windsurf","agents":"/api/rules/fapi-20-dpop-key-bound-tokens?format=agents"}},{"id":"webauthn-passkey-tenant-rpid-sandboxing","title":"Passkey WebAuthn RP ID Sandboxing and Tenant-Scoped Conditional Mediation","category":"security","severity":"critical","description":"Enforces strict dynamic Relying Party ID (RP ID) scoping and origin isolation in multi-tenant WebAuthn deployments. Prevents cross-tenant credential autocomplete pollution and account collisions during conditional mediation passkey ceremonies by prohibiting broad apex-domain relaxation.","antiPatternHeadline":"Apex-Domain RP ID Relaxation in Multi-Tenant Passkey Conditional Mediation Allowing Cross-Tenant Credential Leakage","stars_count":65,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","passkeys","multi-tenant","conditional-mediation","fido2"],"exportEndpoints":{"claude":"/api/rules/webauthn-passkey-tenant-rpid-sandboxing?format=claude","cursorMdc":"/api/rules/webauthn-passkey-tenant-rpid-sandboxing?format=mdc","cursorrules":"/api/rules/webauthn-passkey-tenant-rpid-sandboxing?format=cursor","windsurf":"/api/rules/webauthn-passkey-tenant-rpid-sandboxing?format=windsurf","agents":"/api/rules/webauthn-passkey-tenant-rpid-sandboxing?format=agents"}},{"id":"sigstore-cosign-argocd-keyless-attestation-guardrail","title":"Sigstore Cosign Keyless OCI Attestation and SLSA Provenance Verification in ArgoCD","category":"devops","severity":"critical","description":"Enforces mandatory pre-sync cryptographic verification of OCI container image signatures, SLSA Level 3 provenance, and CycloneDX/SPDX SBOM attestations using Sigstore Cosign keyless OpenID Connect (OIDC) identities within ArgoCD reconciliation cycles. Prevents untrusted or tampered artifacts from being materialized into Kubernetes clusters by blocking reconciliation at the ArgoCD PreSync hook and admission controller layers.","antiPatternHeadline":"Deploying Unverified Container Images via GitOps Without Cryptographic Identity and SLSA Attestation Verification","stars_count":68,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","gitops","argocd","sigstore","cosign","slsa","supply-chain-security","kubernetes"],"exportEndpoints":{"claude":"/api/rules/sigstore-cosign-argocd-keyless-attestation-guardrail?format=claude","cursorMdc":"/api/rules/sigstore-cosign-argocd-keyless-attestation-guardrail?format=mdc","cursorrules":"/api/rules/sigstore-cosign-argocd-keyless-attestation-guardrail?format=cursor","windsurf":"/api/rules/sigstore-cosign-argocd-keyless-attestation-guardrail?format=windsurf","agents":"/api/rules/sigstore-cosign-argocd-keyless-attestation-guardrail?format=agents"}},{"id":"opentelemetry-ebpf-profiling-overhead-guardrail","title":"OpenTelemetry eBPF Continuous Profiling Bounded Overhead Sampling Invariant","category":"devops","severity":"critical","description":"Enforces strict limits on kernel ring-buffer allocation sizes, sampling frequency, and stack-walking unwind depths for OpenTelemetry eBPF profiling agents. Guarantees that continuous production kernel and userspace profiling strictly consumes under 1% total CPU and prevents unpinned kernel memory exhaustion. Prevents resonance lockups, cache thrashing, and soft lockup CPU stalls on dense multi-tenant Kubernetes nodes.","antiPatternHeadline":"Unconstrained eBPF Perf Buffers and High-Frequency Stack Unwinding Inducing Kernel Lock Contention and Production CPU Starvation","stars_count":81,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","opentelemetry","continuous-profiling","kubernetes","performance-budget"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-ebpf-profiling-overhead-guardrail?format=claude","cursorMdc":"/api/rules/opentelemetry-ebpf-profiling-overhead-guardrail?format=mdc","cursorrules":"/api/rules/opentelemetry-ebpf-profiling-overhead-guardrail?format=cursor","windsurf":"/api/rules/opentelemetry-ebpf-profiling-overhead-guardrail?format=windsurf","agents":"/api/rules/opentelemetry-ebpf-profiling-overhead-guardrail?format=agents"}},{"id":"nextjs-15-after-task-execution-standard","title":"Next.js 15 after() Lifecycle Standard for Non-Blocking Post-Response Tasks","category":"frontend","severity":"critical","description":"Next.js 15 introduces after() to coordinate secondary tasks that must execute only after the response stream is finalized without inflating TTFB. Un-awaited floating promises in serverless runtimes lead to frozen lambdas and dropped tasks, while awaiting background tasks directly degrades response latency.","antiPatternHeadline":"Dangling Floating Promises or Awaited Background Telemetry in Route Handlers and Server Actions","stars_count":44,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs","nextjs-15","after","server-actions","performance","serverless"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-after-task-execution-standard?format=claude","cursorMdc":"/api/rules/nextjs-15-after-task-execution-standard?format=mdc","cursorrules":"/api/rules/nextjs-15-after-task-execution-standard?format=cursor","windsurf":"/api/rules/nextjs-15-after-task-execution-standard?format=windsurf","agents":"/api/rules/nextjs-15-after-task-execution-standard?format=agents"}},{"id":"svelte5-runes-proxy-boundary-isolation","title":"Svelte 5 Runes Proxy Boundary Isolation across Workers and Micro-Frontends","category":"frontend","severity":"critical","description":"Svelte 5 wraps deeply reactive state in internal reactive proxies via `$state()` runes. Passing these proxies across thread boundaries (Web Workers) triggers structured clone algorithm failures (DataCloneError), while passing them across micro-frontend boundaries causes cross-runtime signal leaks, retain cycles, and untracked cascade reactivity. Engineers must enforce explicit boundary snapshotting and immutability fences using `$state.snapshot()` before data exits the Svelte reactive context.","antiPatternHeadline":"Leaking Svelte 5 Reactive Proxy References Across Boundary Fences (Web Workers & Micro-Frontends)","stars_count":45,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["svelte5","runes","state-snapshot","web-workers","micro-frontends","memory-leaks"],"exportEndpoints":{"claude":"/api/rules/svelte5-runes-proxy-boundary-isolation?format=claude","cursorMdc":"/api/rules/svelte5-runes-proxy-boundary-isolation?format=mdc","cursorrules":"/api/rules/svelte5-runes-proxy-boundary-isolation?format=cursor","windsurf":"/api/rules/svelte5-runes-proxy-boundary-isolation?format=windsurf","agents":"/api/rules/svelte5-runes-proxy-boundary-isolation?format=agents"}},{"id":"axum-adaptive-load-shedding-guardrail","title":"Axum 0.8 Adaptive Load-Shedding & Dynamic Concurrency Guardrail","category":"backend","severity":"critical","description":"Protects Tokio asynchronous runtime worker threads from catastrophic queue saturation and metastable latency collapse by enforcing dynamic Little's Law concurrency thresholds per route. Replaces static, unbounded channel buffers with adaptive latency-gradient load shedders that immediately reject excess traffic with HTTP 503 and accurate Retry-After directives. Guarantees that internal runtime task scheduling queues remain bounded under heavy p99 tail-latency degradation.","antiPatternHeadline":"Unbounded Task Queuing and Static Concurrency Limits Leading to Tokio Worker Starvation","stars_count":98,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tokio","concurrency","load-shedding","systems-architecture"],"exportEndpoints":{"claude":"/api/rules/axum-adaptive-load-shedding-guardrail?format=claude","cursorMdc":"/api/rules/axum-adaptive-load-shedding-guardrail?format=mdc","cursorrules":"/api/rules/axum-adaptive-load-shedding-guardrail?format=cursor","windsurf":"/api/rules/axum-adaptive-load-shedding-guardrail?format=windsurf","agents":"/api/rules/axum-adaptive-load-shedding-guardrail?format=agents"}},{"id":"bun-sqlite-dual-wal-orchestration-standard","title":"Bun 1.2 SQLite WAL Checkpoint and Multi-Process Lock Orchestration Guardrail","category":"backend","severity":"critical","description":"Enforces deterministic write-ahead log (WAL) pragmas, synchronous checkpoint boundaries, and cross-process lock orchestration for native bun:sqlite in Bun 1.2. Eliminates SQLITE_BUSY lock starvation, unbounded WAL file growth, and transactional corruption under high-throughput edge concurrency.","antiPatternHeadline":"Ad-Hoc Inline Checkpointing and Unsynchronized Multi-Worker Writes in Native bun:sqlite","stars_count":107,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","sqlite","wal","concurrency","edge-runtime","database-integrity"],"exportEndpoints":{"claude":"/api/rules/bun-sqlite-dual-wal-orchestration-standard?format=claude","cursorMdc":"/api/rules/bun-sqlite-dual-wal-orchestration-standard?format=mdc","cursorrules":"/api/rules/bun-sqlite-dual-wal-orchestration-standard?format=cursor","windsurf":"/api/rules/bun-sqlite-dual-wal-orchestration-standard?format=windsurf","agents":"/api/rules/bun-sqlite-dual-wal-orchestration-standard?format=agents"}},{"id":"postgres-17-async-streaming-io-nvme-alignment","title":"PostgreSQL 17 Asynchronous Streaming I/O & NVMe Block Strata Alignment","category":"backend","severity":"critical","description":"Mandates explicit mathematical alignment between PostgreSQL 17 io_combine_limit and the underlying NVMe storage block strata across database provisioning scripts, configuration management, and analytical query sessions. Prevents NVMe queue serialization, split-page I/O churn, and CPU context switching during asynchronous vectorized table and bitmap heap scans.","antiPatternHeadline":"Running PostgreSQL 17 on High-Throughput NVMe with Default or Misaligned io_combine_limit and Asynchronous I/O Settings","stars_count":97,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres","postgresql-17","storage-tuning","nvme","performance"],"exportEndpoints":{"claude":"/api/rules/postgres-17-async-streaming-io-nvme-alignment?format=claude","cursorMdc":"/api/rules/postgres-17-async-streaming-io-nvme-alignment?format=mdc","cursorrules":"/api/rules/postgres-17-async-streaming-io-nvme-alignment?format=cursor","windsurf":"/api/rules/postgres-17-async-streaming-io-nvme-alignment?format=windsurf","agents":"/api/rules/postgres-17-async-streaming-io-nvme-alignment?format=agents"}},{"id":"tauri-v2-mobile-granular-ipc-capability-scoping","title":"Tauri 2.0 Mobile Granular IPC Capability Scoping & ACL Hardening","category":"mobile","severity":"critical","description":"Enforces least-privilege capability manifests and strict Access Control List (ACL) scoping over native core APIs in Tauri 2.0 mobile targets. Neutralizes cross-plugin command injection and untrusted WebView elevation by binding granular permission scopes exclusively to designated windows and webview targets.","antiPatternHeadline":"Permissive Core Capability Wildcarding and Dynamic IPC Command Dispatch in Tauri Mobile","stars_count":74,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri-2","security","ipc","rust","acl","capabilities"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-mobile-granular-ipc-capability-scoping?format=claude","cursorMdc":"/api/rules/tauri-v2-mobile-granular-ipc-capability-scoping?format=mdc","cursorrules":"/api/rules/tauri-v2-mobile-granular-ipc-capability-scoping?format=cursor","windsurf":"/api/rules/tauri-v2-mobile-granular-ipc-capability-scoping?format=windsurf","agents":"/api/rules/tauri-v2-mobile-granular-ipc-capability-scoping?format=agents"}},{"id":"capacitor-biometric-hardware-attestation-standard","title":"Hardware-Backed Biometric Secure Storage and Enrollment Invalidation Guardrail","category":"mobile","severity":"critical","description":"Enforces cryptographic binding of client credentials to hardware Secure Enclave and Android Keystore with strict biometric enrollment invalidation. Prevents unauthorized credential reuse when new biometric templates are enrolled and forbids software fallbacks.","antiPatternHeadline":"Boolean Biometric Gating with Software Storage Fallback and Silent Template Invalidation Bypass","stars_count":119,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor7","security","biometrics","secure-enclave","keystore","cryptography"],"exportEndpoints":{"claude":"/api/rules/capacitor-biometric-hardware-attestation-standard?format=claude","cursorMdc":"/api/rules/capacitor-biometric-hardware-attestation-standard?format=mdc","cursorrules":"/api/rules/capacitor-biometric-hardware-attestation-standard?format=cursor","windsurf":"/api/rules/capacitor-biometric-hardware-attestation-standard?format=windsurf","agents":"/api/rules/capacitor-biometric-hardware-attestation-standard?format=agents"}},{"id":"passkey-sync-provider-downgrade-invariant","title":"Passkey Sync-Provider Downgrade & Cryptographic Recovery Invariant","category":"security","severity":"critical","description":"Enforces strict cryptographic step-up verification when WebAuthn credentials transition between multi-device synchronized states and unmanaged single-device states. Prevents account takeovers caused by credential cloning, sync-provider desynchronization, and unauthorized recovery downgrades by validating authenticator backup flags and requiring dual-rooted verification before binding changes.","antiPatternHeadline":"Silently accepting passkey assertion state drift or falling back to weak recovery channels when sync flags mutate","stars_count":78,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","fido2","passkeys","authentication","zero-trust"],"exportEndpoints":{"claude":"/api/rules/passkey-sync-provider-downgrade-invariant?format=claude","cursorMdc":"/api/rules/passkey-sync-provider-downgrade-invariant?format=mdc","cursorrules":"/api/rules/passkey-sync-provider-downgrade-invariant?format=cursor","windsurf":"/api/rules/passkey-sync-provider-downgrade-invariant?format=windsurf","agents":"/api/rules/passkey-sync-provider-downgrade-invariant?format=agents"}},{"id":"spiffe-spire-in-kernel-workload-identity-projection","title":"Enforce Zero-Static-Secret In-Kernel SPIFFE/SPIRE Workload Identity Projection","category":"security","severity":"critical","description":"Workloads must eliminate all static API tokens and long-lived cloud credentials by deriving cryptographically verifiable identities directly from ephemeral X.509 SVIDs projected into the runtime via kernel-managed CSI volume mounts or Unix domain sockets. Client architectures must continuously hot-reload projected credentials without pod restarts and strictly validate peer SPIFFE IDs against expected trust domains. Any fallback to static environment secrets, Kubernetes Secrets for auth tokens, or unrotated mTLS certificates breaks zero-trust non-repudiation invariants.","antiPatternHeadline":"Persisting Static Service Credentials or Bypassing Projected Ephemeral SPIRE Workload Sockets","stars_count":46,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","spiffe","spire","zero-trust","mtls","csi-driver","identity"],"exportEndpoints":{"claude":"/api/rules/spiffe-spire-in-kernel-workload-identity-projection?format=claude","cursorMdc":"/api/rules/spiffe-spire-in-kernel-workload-identity-projection?format=mdc","cursorrules":"/api/rules/spiffe-spire-in-kernel-workload-identity-projection?format=cursor","windsurf":"/api/rules/spiffe-spire-in-kernel-workload-identity-projection?format=windsurf","agents":"/api/rules/spiffe-spire-in-kernel-workload-identity-projection?format=agents"}},{"id":"otel-collector-weaver-schema-validation-check","title":"OTel Collector Weaver Semantic Convention Schema Check","category":"devops","severity":"critical","description":"Enforces pre-deployment schema validation using OpenTelemetry Weaver across CI/CD pipelines to guarantee all telemetry payloads conform to enterprise semantic convention registries. Prevents breaking downstream telemetry contracts, unvetted custom attribute injection, and catalog fragmentation across collectors and services.","antiPatternHeadline":"Deploying Telemetry Pipelines Without Automated Weaver Semantic Convention Validation","stars_count":42,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","weaver","semconv","otel-collector","schema-validation","ci-cd"],"exportEndpoints":{"claude":"/api/rules/otel-collector-weaver-schema-validation-check?format=claude","cursorMdc":"/api/rules/otel-collector-weaver-schema-validation-check?format=mdc","cursorrules":"/api/rules/otel-collector-weaver-schema-validation-check?format=cursor","windsurf":"/api/rules/otel-collector-weaver-schema-validation-check?format=windsurf","agents":"/api/rules/otel-collector-weaver-schema-validation-check?format=agents"}},{"id":"vite-6-environment-api-runtime-isolation-vite-6-environme-508","title":"Vite 6 Environment API Cross-Runtime State Isolation & Module Graph Guardrail","category":"frontend","severity":"critical","description":"Enforces strict module graph separation across client, SSR, and Edge runtimes leveraging the Vite 6 Environment API. Prevents runtime state pollution, server-side secret leaks via client module graph inclusion, and invalid node built-in resolution in edge and browser environments.","antiPatternHeadline":"Cross-Boundary Module Graph Leakage & Runtime Contamination via Shared Bundler Contexts","stars_count":59,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","vite6","environment-api","runtime-isolation","ssr","security"],"exportEndpoints":{"claude":"/api/rules/vite-6-environment-api-runtime-isolation-vite-6-environme-508?format=claude","cursorMdc":"/api/rules/vite-6-environment-api-runtime-isolation-vite-6-environme-508?format=mdc","cursorrules":"/api/rules/vite-6-environment-api-runtime-isolation-vite-6-environme-508?format=cursor","windsurf":"/api/rules/vite-6-environment-api-runtime-isolation-vite-6-environme-508?format=windsurf","agents":"/api/rules/vite-6-environment-api-runtime-isolation-vite-6-environme-508?format=agents"}},{"id":"nextjs-15-requeststore-context-isolation","title":"Next.js 15 Async Request Context and RequestStore Lifespan Isolation","category":"frontend","severity":"critical","description":"Enforces immutable asynchronous resolution of dynamic APIs (`headers()`, `cookies()`, `params`, `searchParams`) strictly within bounded RequestStore lifespans in Next.js 15. Prohibits escaping `AsyncLocalStorage` boundaries through module-level caching, detached microtasks, or singleton smuggling to eliminate cross-request context bleeding during concurrent streaming SSR.","antiPatternHeadline":"Escaping RequestStore Scopes via Module Singletons or Detached Promises from headers() and cookies()","stars_count":67,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs-15","async-local-storage","streaming-ssr","security","rsc"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-requeststore-context-isolation?format=claude","cursorMdc":"/api/rules/nextjs-15-requeststore-context-isolation?format=mdc","cursorrules":"/api/rules/nextjs-15-requeststore-context-isolation?format=cursor","windsurf":"/api/rules/nextjs-15-requeststore-context-isolation?format=windsurf","agents":"/api/rules/nextjs-15-requeststore-context-isolation?format=agents"}},{"id":"axum-tower-cancellation-propagation-backpressure","title":"Axum 0.8 Tower Client Cancellation Propagation and Database Backpressure","category":"backend","severity":"critical","description":"Couples HTTP/2 RST_STREAM and HTTP/3 client socket disconnections directly to Tokio task abort handles and database transactions within Tower services. Prevents orphaned upstream database queries and connection pool exhaustion when clients abort in-flight requests under load.","antiPatternHeadline":"Spawning Detached Tokio Tasks in Handlers Causing Database Pool Starvation on Client Socket Drops","stars_count":86,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["rust","axum","tower","tokio","backpressure","sqlx","http2"],"exportEndpoints":{"claude":"/api/rules/axum-tower-cancellation-propagation-backpressure?format=claude","cursorMdc":"/api/rules/axum-tower-cancellation-propagation-backpressure?format=mdc","cursorrules":"/api/rules/axum-tower-cancellation-propagation-backpressure?format=cursor","windsurf":"/api/rules/axum-tower-cancellation-propagation-backpressure?format=windsurf","agents":"/api/rules/axum-tower-cancellation-propagation-backpressure?format=agents"}},{"id":"pgvector-08-hnsw-mmap-resident-ceiling","title":"pgvector 0.8 HNSW Memory-Mapped Vector Resident Ceiling and Quantization Invariant","category":"backend","severity":"critical","description":"Enforces strict scalar quantization thresholds (SQ8/halfvec) and kernel-level resident set size ceilings for pgvector 0.8 HNSW indexes running on PostgreSQL 17. Prevents unconstrained virtual memory page faulting and Linux kernel OOM panics caused by concurrent high-dimensional approximate nearest neighbor (ANN) searches exhausting cgroup memory allocations.","antiPatternHeadline":"Unquantized 1536+ dimension HNSW index instantiation without explicit work_mem ceilings and mmap page budgeting.","stars_count":111,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","pgvector","hnsw","memory-management","database-optimization"],"exportEndpoints":{"claude":"/api/rules/pgvector-08-hnsw-mmap-resident-ceiling?format=claude","cursorMdc":"/api/rules/pgvector-08-hnsw-mmap-resident-ceiling?format=mdc","cursorrules":"/api/rules/pgvector-08-hnsw-mmap-resident-ceiling?format=cursor","windsurf":"/api/rules/pgvector-08-hnsw-mmap-resident-ceiling?format=windsurf","agents":"/api/rules/pgvector-08-hnsw-mmap-resident-ceiling?format=agents"}},{"id":"kmp-skie-swift-task-cancellation-bridge","title":"Kotlin Multiplatform 2.1 SKIE Swift Task Cancellation Bridge","category":"mobile","severity":"critical","description":"Enforces strict propagation of Swift Structured Concurrency Task cancellation into Kotlin Coroutine Job hierarchies across the Kotlin/Native Objective-C interop boundary. Prevents zombie background coroutines, memory leaks, and CPU thrashing on iOS when SwiftUI views or Task trees are cancelled. Mandates the use of Touchlab SKIE's bidirectional cancellation bridges or structured withTaskCancellationHandler wrappers over unmanaged completion-handler calls.","antiPatternHeadline":"Unbridged Objective-C Completion Handlers Disconnecting Swift Task Cancellation from Kotlin Coroutine Jobs","stars_count":62,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kmp","kotlin-multiplatform","skie","swift-concurrency","coroutines","ios"],"exportEndpoints":{"claude":"/api/rules/kmp-skie-swift-task-cancellation-bridge?format=claude","cursorMdc":"/api/rules/kmp-skie-swift-task-cancellation-bridge?format=mdc","cursorrules":"/api/rules/kmp-skie-swift-task-cancellation-bridge?format=cursor","windsurf":"/api/rules/kmp-skie-swift-task-cancellation-bridge?format=windsurf","agents":"/api/rules/kmp-skie-swift-task-cancellation-bridge?format=agents"}},{"id":"android-15-16kb-page-alignment-boundary","title":"Android 15 16KB Page-Size Boundary and Dynamic Linker Alignment Standard","category":"mobile","severity":"critical","description":"Enforces strict 16KB ELF segment boundaries and runtime page-size agnostic memory operations across native C/C++ libraries. Prevents fatal dynamic linker loader aborts and SIGSEGV memory faults on Android 15 kernels configured with 16KB page sizes. Mandates max-page-size linker configurations and dynamic page-size resolution via sysconf instead of compile-time constants.","antiPatternHeadline":"Hardcoded 4KB Page Assumptions and Unaligned ELF PT_LOAD Segments Triggering Native SIGSEGV","stars_count":83,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","android","ndk","16kb-pages","dynamic-linker","c++","memory-management"],"exportEndpoints":{"claude":"/api/rules/android-15-16kb-page-alignment-boundary?format=claude","cursorMdc":"/api/rules/android-15-16kb-page-alignment-boundary?format=mdc","cursorrules":"/api/rules/android-15-16kb-page-alignment-boundary?format=cursor","windsurf":"/api/rules/android-15-16kb-page-alignment-boundary?format=windsurf","agents":"/api/rules/android-15-16kb-page-alignment-boundary?format=agents"}},{"id":"webauthn-l3-prf-zero-knowledge-key-derivation-standard","title":"WebAuthn Level 3 PRF Zero-Knowledge Key Derivation and Lifecycle Invariant","category":"security","severity":"critical","description":"Enforces deterministic, zero-knowledge symmetric key derivation using the WebAuthn Level 3 PRF (Pseudo-Random Function) extension. Derived raw secret material MUST be processed via HKDF with domain-separated contexts, marked non-extractable, zeroized in volatile memory, and NEVER transmitted across network boundaries or stored in persistent client-side storage.","antiPatternHeadline":"Persisting raw PRF outputs or treating PRF output as directly usable symmetric keys without HKDF expansion and extractability guards","stars_count":114,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","cryptography","prf-extension","zero-knowledge","webcrypto"],"exportEndpoints":{"claude":"/api/rules/webauthn-l3-prf-zero-knowledge-key-derivation-standard?format=claude","cursorMdc":"/api/rules/webauthn-l3-prf-zero-knowledge-key-derivation-standard?format=mdc","cursorrules":"/api/rules/webauthn-l3-prf-zero-knowledge-key-derivation-standard?format=cursor","windsurf":"/api/rules/webauthn-l3-prf-zero-knowledge-key-derivation-standard?format=windsurf","agents":"/api/rules/webauthn-l3-prf-zero-knowledge-key-derivation-standard?format=agents"}},{"id":"oauth21-dpop-ephemeral-key-guardrail","title":"OAuth 2.1 Demonstrating Proof-of-Possession (DPoP) Invariant Enforcement","category":"security","severity":"critical","description":"Enforces RFC 9449 Demonstrating Proof-of-Possession (DPoP) standards across public edge API gateways and client SDKs. Mandates cryptographic thumbprint binding of access and refresh tokens to client-generated ephemeral asymmetric keypairs (ES256/Ed25519) to eliminate token interception, exfiltration, and cross-origin replay attacks.","antiPatternHeadline":"Bearer Token Pass-Through and Static Private Key Reuse Without Cryptographic Request Binding","stars_count":119,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","oauth21","dpop","rfc9449","cryptography","zero-trust","edge-gateway"],"exportEndpoints":{"claude":"/api/rules/oauth21-dpop-ephemeral-key-guardrail?format=claude","cursorMdc":"/api/rules/oauth21-dpop-ephemeral-key-guardrail?format=mdc","cursorrules":"/api/rules/oauth21-dpop-ephemeral-key-guardrail?format=cursor","windsurf":"/api/rules/oauth21-dpop-ephemeral-key-guardrail?format=windsurf","agents":"/api/rules/oauth21-dpop-ephemeral-key-guardrail?format=agents"}},{"id":"otel-collector-0115-memory-limiter-tenant-isolation","title":"OpenTelemetry Collector 0.115 Memory-Limiter Tenant Isolation Guardrail","category":"devops","severity":"critical","description":"Enforces strict tenant pipeline isolation and preemptive backpressure using scoped memory-limiter processors in OpenTelemetry Collector 0.115+. Prevents noisy-neighbor memory exhaustion and Out-Of-Memory (OOM) cluster crashes by ensuring memory-limiter processors precede queuing and batching within tenant-isolated routing pipelines.","antiPatternHeadline":"Global Unpartitioned Memory Limiter or Downstream Limiter Placement Causing OOM Cascade","stars_count":72,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","otel-collector","kubernetes","observability","reliability"],"exportEndpoints":{"claude":"/api/rules/otel-collector-0115-memory-limiter-tenant-isolation?format=claude","cursorMdc":"/api/rules/otel-collector-0115-memory-limiter-tenant-isolation?format=mdc","cursorrules":"/api/rules/otel-collector-0115-memory-limiter-tenant-isolation?format=cursor","windsurf":"/api/rules/otel-collector-0115-memory-limiter-tenant-isolation?format=windsurf","agents":"/api/rules/otel-collector-0115-memory-limiter-tenant-isolation?format=agents"}},{"id":"opentofu-ephemeral-resource-zero-retention-state-invariant","title":"OpenTofu 1.9 Ephemeral Resource Zero-Retention State Invariant","category":"devops","severity":"critical","description":"Mandates the strict utilization of OpenTofu 1.9+ `ephemeral` resources and values for dynamic authentication credentials, HashiCorp Vault tokens, and runtime KMS envelope encryption keys. Guarantees that sensitive short-lived pipeline artifacts are scrubbed post-apply and never serialized into persistent backend state files.","antiPatternHeadline":"Persisting dynamic credentials and cryptographic keys into remote state storage via standard data blocks or managed resources.","stars_count":100,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentofu","ephemeral-resources","state-security","secrets-management","iac"],"exportEndpoints":{"claude":"/api/rules/opentofu-ephemeral-resource-zero-retention-state-invariant?format=claude","cursorMdc":"/api/rules/opentofu-ephemeral-resource-zero-retention-state-invariant?format=mdc","cursorrules":"/api/rules/opentofu-ephemeral-resource-zero-retention-state-invariant?format=cursor","windsurf":"/api/rules/opentofu-ephemeral-resource-zero-retention-state-invariant?format=windsurf","agents":"/api/rules/opentofu-ephemeral-resource-zero-retention-state-invariant?format=agents"}},{"id":"vite-6-environment-api-runtime-segregation","title":"Vite 6 Environment API Runtime Segregation and Boundary Isolation","category":"frontend","severity":"critical","description":"Enforces strict runtime segregation across client, SSR, and edge environments using Vite 6's Environment API. Prevents cross-runtime contamination, inadvertent leakage of private server-side secrets or Node built-in APIs into browser bundles, and ensures isolated module graphs with distinct resolve conditions.","antiPatternHeadline":"Leaking Server Modules or Secrets to Client Builds via Unified Vite 5-style Configuration","stars_count":91,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","vite6","environment-api","runtime-isolation","ssr","edge"],"exportEndpoints":{"claude":"/api/rules/vite-6-environment-api-runtime-segregation?format=claude","cursorMdc":"/api/rules/vite-6-environment-api-runtime-segregation?format=mdc","cursorrules":"/api/rules/vite-6-environment-api-runtime-segregation?format=cursor","windsurf":"/api/rules/vite-6-environment-api-runtime-segregation?format=windsurf","agents":"/api/rules/vite-6-environment-api-runtime-segregation?format=agents"}},{"id":"svelte-5-runes-reactive-cycle-guardrail","title":"Svelte 5 Runes Reactive Graph Cycle and Evaluation Depth Guardrail","category":"frontend","severity":"critical","description":"Enforces topological acyclicity and bounded evaluation depth across Svelte 5 rune-based signal graphs. Prevents runtime ERR_SVELTE_TOO_MANY_UPDATES microtask panics by prohibiting cyclic feedback between $effect mutations and $derived signal graphs, mandating explicit cycle-break boundaries via untrack() and single-source-of-truth architectures.","antiPatternHeadline":"Cascading Microtask Loops via Reciprocal $effect State Feedback and Impure $derived Graphs","stars_count":47,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["svelte5","runes","reactivity","signals","graph-cycles","frontend","state-management"],"exportEndpoints":{"claude":"/api/rules/svelte-5-runes-reactive-cycle-guardrail?format=claude","cursorMdc":"/api/rules/svelte-5-runes-reactive-cycle-guardrail?format=mdc","cursorrules":"/api/rules/svelte-5-runes-reactive-cycle-guardrail?format=cursor","windsurf":"/api/rules/svelte-5-runes-reactive-cycle-guardrail?format=windsurf","agents":"/api/rules/svelte-5-runes-reactive-cycle-guardrail?format=agents"}},{"id":"bun-websocket-backpressure-ceiling","title":"Bun 1.2 Native WebSocket Backpressure Memory Ceiling and Drain Governor","category":"backend","severity":"critical","description":"Enforces strict socket backpressure management using Bun's native WebSocket return values and drain lifecycle hook. Prevents unbounded native C++ heap accumulation and catastrophic OOM crashes during asymmetric client slow-drain conditions.","antiPatternHeadline":"Unchecked ws.send() flooding in async loops without evaluating socket bufferedAmount or implementing the drain lifecycle hook.","stars_count":114,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","websockets","backpressure","memory-safety","zero-copy"],"exportEndpoints":{"claude":"/api/rules/bun-websocket-backpressure-ceiling?format=claude","cursorMdc":"/api/rules/bun-websocket-backpressure-ceiling?format=mdc","cursorrules":"/api/rules/bun-websocket-backpressure-ceiling?format=cursor","windsurf":"/api/rules/bun-websocket-backpressure-ceiling?format=windsurf","agents":"/api/rules/bun-websocket-backpressure-ceiling?format=agents"}},{"id":"fastapi-python313-nogil-subinterpreter-isolation-boundary","title":"FastAPI Python 3.13 Free-Threaded (No-GIL) Subinterpreter Isolation Boundary","category":"backend","severity":"critical","description":"Enforces strict thread-safe memory isolation and concurrency boundaries across Python 3.13 free-threaded subinterpreters and worker threads within FastAPI services. Mandates zero implicit shared mutable state, synchronized memory buffers, and lock-free thread-safe queues when processing CPU-bound asynchronous tasks without GIL safety nets.","antiPatternHeadline":"Unsynchronized Mutable Global State and GIL-Dependent Race Conditions in Free-Threaded Python 3.13 Async Routes","stars_count":91,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","python-3.13","free-threaded","no-gil","concurrency"],"exportEndpoints":{"claude":"/api/rules/fastapi-python313-nogil-subinterpreter-isolation-boundary?format=claude","cursorMdc":"/api/rules/fastapi-python313-nogil-subinterpreter-isolation-boundary?format=mdc","cursorrules":"/api/rules/fastapi-python313-nogil-subinterpreter-isolation-boundary?format=cursor","windsurf":"/api/rules/fastapi-python313-nogil-subinterpreter-isolation-boundary?format=windsurf","agents":"/api/rules/fastapi-python313-nogil-subinterpreter-isolation-boundary?format=agents"}},{"id":"axum-sse-task-cancellation-standard","title":"Axum SSE Channel Disconnection & Task Cancellation Standard","category":"backend","severity":"critical","description":"Enforces proactive cancellation propagation via Tokio AbortHandles or CancellationToken during Axum Server-Sent Events (SSE) stream termination. Prevents orphaned background worker tasks, zombie database connections, and unbounded memory leaks caused by decoupled mpsc channels when HTTP clients abruptly disconnect.","antiPatternHeadline":"Spawning detached Tokio tasks feeding unmonitored SSE channels without drop-detection or cancellation tokens","stars_count":75,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["rust","axum","tokio","sse","concurrency","backend"],"exportEndpoints":{"claude":"/api/rules/axum-sse-task-cancellation-standard?format=claude","cursorMdc":"/api/rules/axum-sse-task-cancellation-standard?format=mdc","cursorrules":"/api/rules/axum-sse-task-cancellation-standard?format=cursor","windsurf":"/api/rules/axum-sse-task-cancellation-standard?format=windsurf","agents":"/api/rules/axum-sse-task-cancellation-standard?format=agents"}},{"id":"postgres-17-parallel-apply-deadlock-governor","title":"PostgreSQL 17 Parallel Apply Worker Conflict and Deadlock Governor","category":"backend","severity":"critical","description":"Standardizes PostgreSQL 17 logical replication parallel worker provisioning, conflict detection, and transactional dependency tracking. Enforces deterministic apply concurrency limits, explicit replica identities, and lock ordering to prevent cross-worker deadlocks and out-of-order commit hazards in multi-subscriber clusters.","antiPatternHeadline":"Unconstrained Parallel Apply Allocation and Ambiguous Replica Identities Causing Worker Deadlocks and Data Divergence","stars_count":117,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql-17","logical-replication","concurrency","distributed-systems","database-migration"],"exportEndpoints":{"claude":"/api/rules/postgres-17-parallel-apply-deadlock-governor?format=claude","cursorMdc":"/api/rules/postgres-17-parallel-apply-deadlock-governor?format=mdc","cursorrules":"/api/rules/postgres-17-parallel-apply-deadlock-governor?format=cursor","windsurf":"/api/rules/postgres-17-parallel-apply-deadlock-governor?format=windsurf","agents":"/api/rules/postgres-17-parallel-apply-deadlock-governor?format=agents"}},{"id":"cmp-ios-cadisplaylink-metal-vsync-production-standard","title":"Compose Multiplatform iOS CADisplayLink Metal VSync Synchronization","category":"mobile","severity":"critical","description":"Enforces strict synchronization between Skiko Metal render passes and Apple CADisplayLink hardware refresh boundaries on iOS. Prevents main-thread hitching, micro-stutter, and frame drops across variable refresh rate (VRR) ProMotion displays by aligning frame generation with target display presentation timestamps.","antiPatternHeadline":"Unsynchronized Coroutine Loop or Unbounded Main Dispatcher CADisplayLink Triggering Skiko Redraws","stars_count":81,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","compose-multiplatform","ios","metal","cadisplaylink","skiko","promotion"],"exportEndpoints":{"claude":"/api/rules/cmp-ios-cadisplaylink-metal-vsync-production-standard?format=claude","cursorMdc":"/api/rules/cmp-ios-cadisplaylink-metal-vsync-production-standard?format=mdc","cursorrules":"/api/rules/cmp-ios-cadisplaylink-metal-vsync-production-standard?format=cursor","windsurf":"/api/rules/cmp-ios-cadisplaylink-metal-vsync-production-standard?format=windsurf","agents":"/api/rules/cmp-ios-cadisplaylink-metal-vsync-production-standard?format=agents"}},{"id":"openfga-recursive-traversal-depth-boundary","title":"Deterministic Depth Limits and Cycle Hardening for OpenFGA Authorization Graphs","category":"security","severity":"critical","description":"Enforces strict recursion depth boundaries, contextual cycle dampening, and deterministic query timeouts for OpenFGA graph authorization calls. Prevents algorithmic complexity Denial-of-Service (ReDoS/Graph-DoS) caused by circular relations, deeply nested groups, or unconstrained userset traversals during Check, Expand, and ListObjects evaluations.","antiPatternHeadline":"Unbounded recursive tuple resolution and unconstrained Check evaluations vulnerable to cyclical graph exhaustion","stars_count":53,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","authorization","fine-grained-auth","dos-prevention","rebac"],"exportEndpoints":{"claude":"/api/rules/openfga-recursive-traversal-depth-boundary?format=claude","cursorMdc":"/api/rules/openfga-recursive-traversal-depth-boundary?format=mdc","cursorrules":"/api/rules/openfga-recursive-traversal-depth-boundary?format=cursor","windsurf":"/api/rules/openfga-recursive-traversal-depth-boundary?format=windsurf","agents":"/api/rules/openfga-recursive-traversal-depth-boundary?format=agents"}},{"id":"ebpf-xdp-ringbuf-backpressure-invariant","title":"eBPF XDP In-Kernel Ring Buffer Backpressure and Adaptive Drop Standard","category":"devops","severity":"critical","description":"Maintains bounded user-space memory and CPU usage by enforcing early in-kernel XDP packet dropping invariants before ring buffers overload during L4 volumetric DDoS events. Systems must check ring-buffer queue availability and watermarks in XDP context, executing an immediate XDP_DROP when backpressure thresholds are breached instead of attempting unmonitored BPF_MAP_TYPE_RINGBUF emissions.","antiPatternHeadline":"Unchecked Ring-Buffer Submissions and Unbounded User-Space Channel Ingestion Under Volumetric Floods","stars_count":85,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","xdp","ddos-mitigation","ring-buffer","kernel-bypass","networking"],"exportEndpoints":{"claude":"/api/rules/ebpf-xdp-ringbuf-backpressure-invariant?format=claude","cursorMdc":"/api/rules/ebpf-xdp-ringbuf-backpressure-invariant?format=mdc","cursorrules":"/api/rules/ebpf-xdp-ringbuf-backpressure-invariant?format=cursor","windsurf":"/api/rules/ebpf-xdp-ringbuf-backpressure-invariant?format=windsurf","agents":"/api/rules/ebpf-xdp-ringbuf-backpressure-invariant?format=agents"}},{"id":"opentelemetry-genai-streaming-redaction-standard","title":"OpenTelemetry GenAI In-Flight PII Redaction and TTFT Telemetry Standard","category":"devops","severity":"critical","description":"Mandates that streaming GenAI telemetry pipelines perform synchronous, token-by-token PII masking and exact Time-To-First-Token (TTFT) attribute enrichment before span events or payloads are exported. Unredacted prompt/completion text and delayed metric instrumentation violate data compliance boundaries and degrade latency profiling.","antiPatternHeadline":"Exporting raw unredacted streaming token events or deferring TTFT calculation to stream completion","stars_count":47,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","genai","streaming","pii-redaction","observability","llm"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-genai-streaming-redaction-standard?format=claude","cursorMdc":"/api/rules/opentelemetry-genai-streaming-redaction-standard?format=mdc","cursorrules":"/api/rules/opentelemetry-genai-streaming-redaction-standard?format=cursor","windsurf":"/api/rules/opentelemetry-genai-streaming-redaction-standard?format=windsurf","agents":"/api/rules/opentelemetry-genai-streaming-redaction-standard?format=agents"}},{"id":"react-19-server-action-optimistic-reversion-standard","title":"React 19 Server Action Optimistic State Reversion and Concurrent Queue Rollback Standard","category":"frontend","severity":"critical","description":"Mandates atomic optimistic state management using React 19's native useOptimistic paired with useActionState across asynchronous Server Actions. Prohibits manual imperative useState rollbacks inside async try-catch blocks that induce state tearing during concurrent action execution.","antiPatternHeadline":"Manual Imperative State Rollback via Async Try-Catch Blocks in Concurrent Action Handlers","stars_count":49,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","server-actions","use-optimistic","concurrency","state-reversion"],"exportEndpoints":{"claude":"/api/rules/react-19-server-action-optimistic-reversion-standard?format=claude","cursorMdc":"/api/rules/react-19-server-action-optimistic-reversion-standard?format=mdc","cursorrules":"/api/rules/react-19-server-action-optimistic-reversion-standard?format=cursor","windsurf":"/api/rules/react-19-server-action-optimistic-reversion-standard?format=windsurf","agents":"/api/rules/react-19-server-action-optimistic-reversion-standard?format=agents"}},{"id":"vite6-environment-api-cross-runtime-isolation","title":"Vite 6 Environment API Cross-Runtime Boundary and Global Isolation","category":"frontend","severity":"critical","description":"Enforces strict boundary isolation and distinct module execution pipelines across heterogeneous runtimes (client, Node.js, workerd, Edge) using the Vite 6 Environment API. Prevents shared in-memory state, global namespace contamination (e.g., leaking Node.js process or Buffer into Edge/workerd), and cross-environment module graph leakage during multi-target development and SSR evaluation.","antiPatternHeadline":"Cross-Runtime Scope Pollution and Shared In-Memory Module Graphs in Multi-Target Vite SSR","stars_count":105,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","vite6","environment-api","ssr","workerd","edge-runtime"],"exportEndpoints":{"claude":"/api/rules/vite6-environment-api-cross-runtime-isolation?format=claude","cursorMdc":"/api/rules/vite6-environment-api-cross-runtime-isolation?format=mdc","cursorrules":"/api/rules/vite6-environment-api-cross-runtime-isolation?format=cursor","windsurf":"/api/rules/vite6-environment-api-cross-runtime-isolation?format=windsurf","agents":"/api/rules/vite6-environment-api-cross-runtime-isolation?format=agents"}},{"id":"axum-tower-cancellation-token-propagation","title":"Axum 0.8 Tower Cancellation Token Propagation & Zombie Transaction Guardrail","category":"backend","severity":"critical","description":"Enforces strict cooperative cancellation token propagation across Axum 0.8 Tower middleware, route handlers, and database adapters. Eliminates orphan compute, task leakage, and lingering zombie database transactions caused by abrupt client disconnections (HTTP/2 RST_STREAM, HTTP/1.1 socket drop).","antiPatternHeadline":"Detached Background Spawning and Silent Drop Failures Causing Zombie Transactions and Connection Pool Starvation","stars_count":84,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tower","tokio","sqlx","concurrency"],"exportEndpoints":{"claude":"/api/rules/axum-tower-cancellation-token-propagation?format=claude","cursorMdc":"/api/rules/axum-tower-cancellation-token-propagation?format=mdc","cursorrules":"/api/rules/axum-tower-cancellation-token-propagation?format=cursor","windsurf":"/api/rules/axum-tower-cancellation-token-propagation?format=windsurf","agents":"/api/rules/axum-tower-cancellation-token-propagation?format=agents"}},{"id":"postgres-17-block-level-incremental-backup-lsn-sync","title":"PostgreSQL 17 Incremental Backup LSN Synchronization and WAL Summary Guardrail","category":"backend","severity":"critical","description":"PostgreSQL 17 introduces native block-level incremental backups driven by WAL summarization (pg_walsummarizer). Orchestration engines must enforce strict write-ahead log summary continuity, LSN boundary monotonicity, and manifest chain validation across distributed standbys to prevent silent data corruption during pg_combinebackup restoration.","antiPatternHeadline":"Executing Incremental Backups Without WAL Summary Continuity and Standby LSN Alignment Validation","stars_count":77,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql-17","disaster-recovery","pitr","wal-summarization","pg-combinebackup"],"exportEndpoints":{"claude":"/api/rules/postgres-17-block-level-incremental-backup-lsn-sync?format=claude","cursorMdc":"/api/rules/postgres-17-block-level-incremental-backup-lsn-sync?format=mdc","cursorrules":"/api/rules/postgres-17-block-level-incremental-backup-lsn-sync?format=cursor","windsurf":"/api/rules/postgres-17-block-level-incremental-backup-lsn-sync?format=windsurf","agents":"/api/rules/postgres-17-block-level-incremental-backup-lsn-sync?format=agents"}},{"id":"go124-iter-pull-resource-disposal","title":"Go 1.24 iter.Pull Explicit Defer-Stop Coroutine Lifecycle Guardrail","category":"backend","severity":"critical","description":"Go 1.24 pull iterators (iter.Pull and iter.Pull2) allocate underlying coroutine runtime machinery to transform push iterators into stateful pull closures. Failure to invoke the returned stop function when execution terminates before sequence exhaustion permanently leaks the runtime goroutine and pinned stack allocations. All pull iterators must enforce an immediate defer-stop contract across all error, early exit, and panic paths.","antiPatternHeadline":"Dangling iter.Pull Coroutines Leaking Background Goroutines on Early Exit","stars_count":55,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","golang","go124","concurrency","iterators","memory-leak"],"exportEndpoints":{"claude":"/api/rules/go124-iter-pull-resource-disposal?format=claude","cursorMdc":"/api/rules/go124-iter-pull-resource-disposal?format=mdc","cursorrules":"/api/rules/go124-iter-pull-resource-disposal?format=cursor","windsurf":"/api/rules/go124-iter-pull-resource-disposal?format=windsurf","agents":"/api/rules/go124-iter-pull-resource-disposal?format=agents"}},{"id":"openfga-dynamic-contextual-tuple-cache-invalidation","title":"OpenFGA Dynamic Contextual Tuple Evaluation & Cache Invalidation Invariant","category":"security","severity":"critical","description":"Enforces strict consistency and isolation between durable authorization tuples and transient request attributes in OpenFGA/Zanzibar architectures. Guarantees sub-millisecond evaluation latency without stale-permission vulnerabilities under high-throughput writes by binding cached access decisions to deterministic cryptographic context digests and change-data-capture (CDC) invalidation watermarks.","antiPatternHeadline":"Blind TTL-caching of OpenFGA evaluations and persisting transient request context as durable tuples","stars_count":59,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","zanzibar","authorization","cache-invalidation","zero-trust"],"exportEndpoints":{"claude":"/api/rules/openfga-dynamic-contextual-tuple-cache-invalidation?format=claude","cursorMdc":"/api/rules/openfga-dynamic-contextual-tuple-cache-invalidation?format=mdc","cursorrules":"/api/rules/openfga-dynamic-contextual-tuple-cache-invalidation?format=cursor","windsurf":"/api/rules/openfga-dynamic-contextual-tuple-cache-invalidation?format=windsurf","agents":"/api/rules/openfga-dynamic-contextual-tuple-cache-invalidation?format=agents"}},{"id":"webauthn-synced-passkey-stepup-attestation-guardrail","title":"WebAuthn Synced Passkey Step-Up Verification and Hardware Attestation Guardrail","category":"security","severity":"critical","description":"Enforces cryptographic step-up verification and high-assurance hardware attestation for privileged tenant operations when passkeys are synchronized across consumer clouds. Distinguishes multi-device credentials (synced passkeys with BE=1, BS=1) from device-bound security keys (single-device credentials) by inspecting authenticator data flags and attestation roots.","antiPatternHeadline":"Accepting Multi-Device Synced Consumer Passkeys for Tier-0 Privileged Tenant Operations Without Hardware Attestation","stars_count":107,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","fido2","passkeys","attestation","zero-trust","multi-tenancy"],"exportEndpoints":{"claude":"/api/rules/webauthn-synced-passkey-stepup-attestation-guardrail?format=claude","cursorMdc":"/api/rules/webauthn-synced-passkey-stepup-attestation-guardrail?format=mdc","cursorrules":"/api/rules/webauthn-synced-passkey-stepup-attestation-guardrail?format=cursor","windsurf":"/api/rules/webauthn-synced-passkey-stepup-attestation-guardrail?format=windsurf","agents":"/api/rules/webauthn-synced-passkey-stepup-attestation-guardrail?format=agents"}},{"id":"kmp-skiko-surface-lifecycle-guardrail","title":"KMP Compose Skiko Render Surface Lifecycle and Swapchain Invariant","category":"mobile","severity":"critical","description":"Enforces synchronous swapchain invalidation and strict render target lifecycle synchronization across Kotlin Multiplatform Compose targets (iOS Metal, Android SurfaceView, Desktop AWT). Prevents SIGSEGV crashes, Metal validation layer panics, and native GPU context leaks caused by asynchronous render dispatches to destroyed surface handles.","antiPatternHeadline":"Dispatching draw passes to unlinked native GPU surfaces or delaying SkiaLayer disposal after view hierarchy detachment","stars_count":82,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kmp","compose-multiplatform","skiko","metal","vulkan","lifecycle"],"exportEndpoints":{"claude":"/api/rules/kmp-skiko-surface-lifecycle-guardrail?format=claude","cursorMdc":"/api/rules/kmp-skiko-surface-lifecycle-guardrail?format=mdc","cursorrules":"/api/rules/kmp-skiko-surface-lifecycle-guardrail?format=cursor","windsurf":"/api/rules/kmp-skiko-surface-lifecycle-guardrail?format=windsurf","agents":"/api/rules/kmp-skiko-surface-lifecycle-guardrail?format=agents"}},{"id":"otel-genai-semantic-conventions-distributed-tracing","title":"OpenTelemetry GenAI Semantic Conventions for Asynchronous Agentic Workflows","category":"devops","severity":"critical","description":"Standardizes token accounting, guardrail evaluation latency, and distributed trace context propagation across asynchronous, multi-agent LLM inference topologies. Enforces strict compliance with OpenTelemetry GenAI Semantic Conventions and W3C Trace Context propagation across message brokers and task queues.","antiPatternHeadline":"Ad-Hoc Unstandardized GenAI Telemetry with Broken Distributed Context and Unmeasured Guardrail Overhead","stars_count":118,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","observability","genai","distributed-tracing","multi-agent"],"exportEndpoints":{"claude":"/api/rules/otel-genai-semantic-conventions-distributed-tracing?format=claude","cursorMdc":"/api/rules/otel-genai-semantic-conventions-distributed-tracing?format=mdc","cursorrules":"/api/rules/otel-genai-semantic-conventions-distributed-tracing?format=cursor","windsurf":"/api/rules/otel-genai-semantic-conventions-distributed-tracing?format=windsurf","agents":"/api/rules/otel-genai-semantic-conventions-distributed-tracing?format=agents"}},{"id":"nextjs-15-async-request-context-resolution-guardrail","title":"Next.js 15 Async Dynamic Request Context Resolution and Streaming Isolation Guardrail","category":"frontend","severity":"critical","description":"Next.js 15 transforms all dynamic request APIs (`cookies()`, `headers()`, `params`, `searchParams`) into asynchronous operations to enforce strict isolation during concurrent React Server Component (RSC) streaming. Synchronous access or unawaited deferred context extraction causes request-scope contamination, hydration mismatches, and severe security vulnerabilities where concurrent streaming requests bleed tenant or authentication state.","antiPatternHeadline":"Synchronous Access of Dynamic Request Contexts and Cross-Request Scope Pollution in RSC Streaming Trees","stars_count":40,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs","react-server-components","rsc","concurrency","security"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-async-request-context-resolution-guardrail?format=claude","cursorMdc":"/api/rules/nextjs-15-async-request-context-resolution-guardrail?format=mdc","cursorrules":"/api/rules/nextjs-15-async-request-context-resolution-guardrail?format=cursor","windsurf":"/api/rules/nextjs-15-async-request-context-resolution-guardrail?format=windsurf","agents":"/api/rules/nextjs-15-async-request-context-resolution-guardrail?format=agents"}},{"id":"svelte-5-runes-microtask-scheduler-loop-guardrail","title":"Svelte 5 Runes Microtask Scheduler Loop & State Tearing Guardrail","category":"frontend","severity":"critical","description":"Enforces strict boundaries around asynchronous operations inside Svelte 5 runes ($effect, $derived) to prevent microtask scheduler loops and state tearing. Svelte 5's fine-grained push-pull signals batch synchronous reads and writes; interleaving async awaits directly within reactive contexts without untrack() or local transaction state causes circular reactivity queues and stale signal closures across tick boundaries.","antiPatternHeadline":"Mutating reactive state across un-isolated async ticks in $effect triggering infinite scheduler cascades","stars_count":72,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["svelte","svelte-5","runes","signals","microtasks","async-state"],"exportEndpoints":{"claude":"/api/rules/svelte-5-runes-microtask-scheduler-loop-guardrail?format=claude","cursorMdc":"/api/rules/svelte-5-runes-microtask-scheduler-loop-guardrail?format=mdc","cursorrules":"/api/rules/svelte-5-runes-microtask-scheduler-loop-guardrail?format=cursor","windsurf":"/api/rules/svelte-5-runes-microtask-scheduler-loop-guardrail?format=windsurf","agents":"/api/rules/svelte-5-runes-microtask-scheduler-loop-guardrail?format=agents"}},{"id":"pg17-vectorized-streaming-io-buffer-invariant","title":"PostgreSQL 17 Streaming I/O Buffer Bound & Zero-Checkpoint Bulk Upsert Standard","category":"backend","severity":"critical","description":"Enforces strict session-level memory bounds via temp_buffers and work_mem to prevent disk spills during vectorized staging table operations. Guarantees zero write-ahead log (WAL) overhead and eliminates checkpoint stalls during high-throughput bulk upserts by leveraging unlogged temporary tables and aligned batch sizes that exploit PostgreSQL 17 streaming read/write infrastructure.","antiPatternHeadline":"Unbounded Direct-to-Target Bulk Upserts Triggering Checkpoint Spikes and Excessive Shared Buffer Eviction","stars_count":114,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","streaming-io","performance","database"],"exportEndpoints":{"claude":"/api/rules/pg17-vectorized-streaming-io-buffer-invariant?format=claude","cursorMdc":"/api/rules/pg17-vectorized-streaming-io-buffer-invariant?format=mdc","cursorrules":"/api/rules/pg17-vectorized-streaming-io-buffer-invariant?format=cursor","windsurf":"/api/rules/pg17-vectorized-streaming-io-buffer-invariant?format=windsurf","agents":"/api/rules/pg17-vectorized-streaming-io-buffer-invariant?format=agents"}},{"id":"bun-ffi-pointer-lifecycle-and-ownership-standard","title":"Bun 1.2 FFI Deterministic Pointer Lifecycle & Native Memory Ownership Guardrail","category":"backend","severity":"critical","description":"Enforces deterministic pointer ownership, zero-copy memory safety, and leak/double-free prevention across the Bun 1.2 C-ABI FFI boundary. Mandates explicit Disposable lifecycle protocols, nullification guards on deallocated pointers, and strict isolation between JavaScript V8/JSC GC-managed typed arrays and foreign heap allocations.","antiPatternHeadline":"Dangling Pointer Deallocation, Double-Free, and V8/JSC Buffer Corruption in Bun FFI Lifecycles","stars_count":51,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","ffi","c-abi","memory-safety","zero-copy","pointers"],"exportEndpoints":{"claude":"/api/rules/bun-ffi-pointer-lifecycle-and-ownership-standard?format=claude","cursorMdc":"/api/rules/bun-ffi-pointer-lifecycle-and-ownership-standard?format=mdc","cursorrules":"/api/rules/bun-ffi-pointer-lifecycle-and-ownership-standard?format=cursor","windsurf":"/api/rules/bun-ffi-pointer-lifecycle-and-ownership-standard?format=windsurf","agents":"/api/rules/bun-ffi-pointer-lifecycle-and-ownership-standard?format=agents"}},{"id":"tauri-v2-mobile-ipc-scoped-isolation-standard","title":"Tauri 2.0 Mobile IPC Scoped Isolation & Capability Key Validation","category":"mobile","severity":"critical","description":"Enforces strict isolation pattern hooks and cryptographic capability validation for IPC calls between native Rust hosts and multi-webview mobile sandboxes in Tauri 2.0. Guarantees that untrusted or secondary webviews cannot execute privileged native system commands without passing an ephemeral, host-attested capability token through the isolation runtime.","antiPatternHeadline":"Bypassing Isolation Hooks via Direct Unscoped Native Invocations in Multi-Webview Mobile Sandboxes","stars_count":63,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri-2","ipc-security","rust","isolation-pattern"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-mobile-ipc-scoped-isolation-standard?format=claude","cursorMdc":"/api/rules/tauri-v2-mobile-ipc-scoped-isolation-standard?format=mdc","cursorrules":"/api/rules/tauri-v2-mobile-ipc-scoped-isolation-standard?format=cursor","windsurf":"/api/rules/tauri-v2-mobile-ipc-scoped-isolation-standard?format=windsurf","agents":"/api/rules/tauri-v2-mobile-ipc-scoped-isolation-standard?format=agents"}},{"id":"cmp-strong-skipping-stability-invariant","title":"Compose Multiplatform 1.8 Strong Skipping & Parameter Stability Invariant","category":"mobile","severity":"critical","description":"Enforces strict parameter stability contracts and deterministic memoization boundaries across Compose Multiplatform (JVM & Kotlin/Native iOS) compilation targets under Strong Skipping Mode. Prevents cascading phantom recompositions and memory retention issues caused by relying on implicit reference equality (===) checks on unstable types and standard collection interfaces.","antiPatternHeadline":"Passing Unstable Standard Collections and Unannotated Multiplatform Entities into Skippable Composable Boundaries","stars_count":62,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","compose-multiplatform","kotlin-multiplatform","jetpack-compose","ios","android","performance"],"exportEndpoints":{"claude":"/api/rules/cmp-strong-skipping-stability-invariant?format=claude","cursorMdc":"/api/rules/cmp-strong-skipping-stability-invariant?format=mdc","cursorrules":"/api/rules/cmp-strong-skipping-stability-invariant?format=cursor","windsurf":"/api/rules/cmp-strong-skipping-stability-invariant?format=windsurf","agents":"/api/rules/cmp-strong-skipping-stability-invariant?format=agents"}},{"id":"webauthn-prf-symmetric-key-derivation-guardrail","title":"WebAuthn Level 3 PRF Hardware-Backed Symmetric Key Derivation Guardrail","category":"security","severity":"critical","description":"Enforces hardware-backed zero-knowledge credential derivation using WebAuthn Level 3 PRF (Pseudo-Random Function) extension for client-side encrypted database synchronization. Mandates using constant-time cryptographic operations, HKDF key stretching with ephemeral salts, zero-allocation memory zeroing, and strict validation of authenticator PRF outputs prior to master key reconstruction.","antiPatternHeadline":"Persisting Unsalted PRF Outputs or Deriving Database Encryption Keys in Extractable Non-Wiped Client Memory","stars_count":87,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","prf-extension","zero-knowledge","cryptography","e2ee"],"exportEndpoints":{"claude":"/api/rules/webauthn-prf-symmetric-key-derivation-guardrail?format=claude","cursorMdc":"/api/rules/webauthn-prf-symmetric-key-derivation-guardrail?format=mdc","cursorrules":"/api/rules/webauthn-prf-symmetric-key-derivation-guardrail?format=cursor","windsurf":"/api/rules/webauthn-prf-symmetric-key-derivation-guardrail?format=windsurf","agents":"/api/rules/webauthn-prf-symmetric-key-derivation-guardrail?format=agents"}},{"id":"spiffe-spire-workload-attestation-lifecycle","title":"SPIFFE/SPIRE In-Memory X.509-SVID Non-Disruptive Rotation Guardrail","category":"security","severity":"critical","description":"Enforces non-disruptive, zero-trust mTLS credential rotation driven directly by the SPIFFE Workload API over UNIX Domain Sockets. Prohibits process restarts, socket re-binding, and disk-bound certificate reads, requiring atomic in-memory TLS context swaps to eliminate race conditions and dropped active connections during aggressive ephemeral SVID rotations.","antiPatternHeadline":"Static Disk-Based Certificate Bootstrapping and Process Recycling on SVID Expiration","stars_count":117,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","spiffe","spire","mtls","zero-trust","tls-rotation"],"exportEndpoints":{"claude":"/api/rules/spiffe-spire-workload-attestation-lifecycle?format=claude","cursorMdc":"/api/rules/spiffe-spire-workload-attestation-lifecycle?format=mdc","cursorrules":"/api/rules/spiffe-spire-workload-attestation-lifecycle?format=cursor","windsurf":"/api/rules/spiffe-spire-workload-attestation-lifecycle?format=windsurf","agents":"/api/rules/spiffe-spire-workload-attestation-lifecycle?format=agents"}},{"id":"ebpf-xdp-quic-anti-amplification-guardrail","title":"XDP Stateless Token Verification for QUIC Connection Migration Anti-Amplification","category":"devops","severity":"critical","description":"Enforces stateless cryptographic token verification and strict RFC 9000 3x anti-amplification accounting directly in the eBPF/XDP driver layer prior to socket buffer allocation. Prevents asymmetric UDP reflection and amplification attacks during QUIC connection migration by dropping unauthenticated path probe floods before kernel networking stack ingress.","antiPatternHeadline":"Bypassing Kernel Bypass Filters to Validate QUIC Migration Handshakes in User-Space","stars_count":40,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","xdp","quic","anti-amplification","rfc9000","ddos-mitigation","kernel"],"exportEndpoints":{"claude":"/api/rules/ebpf-xdp-quic-anti-amplification-guardrail?format=claude","cursorMdc":"/api/rules/ebpf-xdp-quic-anti-amplification-guardrail?format=mdc","cursorrules":"/api/rules/ebpf-xdp-quic-anti-amplification-guardrail?format=cursor","windsurf":"/api/rules/ebpf-xdp-quic-anti-amplification-guardrail?format=windsurf","agents":"/api/rules/ebpf-xdp-quic-anti-amplification-guardrail?format=agents"}},{"id":"otel-continuous-profiling-symbol-scrubbing-standard","title":"OTel Continuous Profiling In-Memory Symbol & Stack Frame Scrubbing Guardrail","category":"devops","severity":"critical","description":"Enforces pre-ingest, in-memory sanitization of continuous profiling stack traces, frame addresses, and dynamic symbol names across userland and kernel boundaries. Prevents the accidental exfiltration of PII, credential-bearing closure names, dynamic query string symbols, and sensitive kernel pointer offsets to remote OpenTelemetry Protocol (OTLP) collectors.","antiPatternHeadline":"Exporting unredacted dynamic runtime frames, closure-embedded credentials, and raw kernel pointers directly to OTLP profiling sinks.","stars_count":49,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","continuous-profiling","ebpf","data-privacy","zero-trust"],"exportEndpoints":{"claude":"/api/rules/otel-continuous-profiling-symbol-scrubbing-standard?format=claude","cursorMdc":"/api/rules/otel-continuous-profiling-symbol-scrubbing-standard?format=mdc","cursorrules":"/api/rules/otel-continuous-profiling-symbol-scrubbing-standard?format=cursor","windsurf":"/api/rules/otel-continuous-profiling-symbol-scrubbing-standard?format=windsurf","agents":"/api/rules/otel-continuous-profiling-symbol-scrubbing-standard?format=agents"}},{"id":"react19-server-actions-idempotency-replay-defense","title":"React 19 Server Actions Idempotency & Cryptographic Replay Defense Standard","category":"frontend","severity":"critical","description":"Enforces strict mutation idempotency and cryptographic token binding for React 19 Server Actions paired with speculative optimistic UI transitions. Prevents duplicate state mutations, double-spends, and replayed Flight RPC payloads across concurrent network retries and optimistic rollbacks.","antiPatternHeadline":"Unprotected Server Action Mutation Invoked Across Speculative Transitions Without Idempotency Locks","stars_count":84,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react19","server-actions","security","idempotency","optimistic-ui"],"exportEndpoints":{"claude":"/api/rules/react19-server-actions-idempotency-replay-defense?format=claude","cursorMdc":"/api/rules/react19-server-actions-idempotency-replay-defense?format=mdc","cursorrules":"/api/rules/react19-server-actions-idempotency-replay-defense?format=cursor","windsurf":"/api/rules/react19-server-actions-idempotency-replay-defense?format=windsurf","agents":"/api/rules/react19-server-actions-idempotency-replay-defense?format=agents"}},{"id":"svelte-5-snippet-cross-root-context-boundary","title":"Svelte 5 Polymorphic Snippet Isolation and Cross-Root Context Bridging","category":"frontend","severity":"critical","description":"Mandates explicit context isolation, type-safe contract bridging, and deterministic lifecycle teardown when passing Svelte 5 polymorphic snippets across independent root mounts or micro-frontend boundaries. Prevents detached reactive tree memory leaks and ambient context lookup failures across disparate application runtimes.","antiPatternHeadline":"Direct Cross-Root Snippet Execution Without Context Bridging and Lifecycle Teardown","stars_count":67,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","snippets","micro-frontends","memory-management","context-api"],"exportEndpoints":{"claude":"/api/rules/svelte-5-snippet-cross-root-context-boundary?format=claude","cursorMdc":"/api/rules/svelte-5-snippet-cross-root-context-boundary?format=mdc","cursorrules":"/api/rules/svelte-5-snippet-cross-root-context-boundary?format=cursor","windsurf":"/api/rules/svelte-5-snippet-cross-root-context-boundary?format=windsurf","agents":"/api/rules/svelte-5-snippet-cross-root-context-boundary?format=agents"}},{"id":"fastapi-freethreaded-subinterpreter-state-quarantine","title":"FastAPI Free-Threaded Worker Sub-Interpreter State Quarantine","category":"backend","severity":"critical","description":"Enforces strict isolation of request-scoped C-extension state and non-thread-safe resources within Python 3.13+ free-threaded (PEP 703) runtimes. Prevents silent heap corruption, re-entrancy crashes, and thread race conditions across GIL-free worker threads through PEP 554/684 sub-interpreter channel topologies and thread-local state bounds. Mandates immutability boundaries across worker channels when interfacing with legacy C-extensions or thread-unsafe global state.","antiPatternHeadline":"Global C-Extension Singleton Access in GIL-Free Python 3.13+ Async Workers","stars_count":118,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","python3.13","pep703","nogil","subinterpreters","concurrency"],"exportEndpoints":{"claude":"/api/rules/fastapi-freethreaded-subinterpreter-state-quarantine?format=claude","cursorMdc":"/api/rules/fastapi-freethreaded-subinterpreter-state-quarantine?format=mdc","cursorrules":"/api/rules/fastapi-freethreaded-subinterpreter-state-quarantine?format=cursor","windsurf":"/api/rules/fastapi-freethreaded-subinterpreter-state-quarantine?format=windsurf","agents":"/api/rules/fastapi-freethreaded-subinterpreter-state-quarantine?format=agents"}},{"id":"axum-08-tower-per-tenant-lease-shedding","title":"Axum 0.8 Per-Tenant Semaphore Lease & Deterministic Backpressure Load Shedding","category":"backend","severity":"critical","description":"Enforces deterministic bounded concurrency per tenant via Tower middleware lease acquisition prior to async handler buffer allocation. Prevents noisy-neighbor memory exhaustion and thread starvation by shedding excess requests with HTTP 429 before streaming request bodies into memory.","antiPatternHeadline":"Buffering Request Payloads in Handlers Before Acquiring Tenant Concurrency Leases","stars_count":97,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tower","concurrency","load-shedding"],"exportEndpoints":{"claude":"/api/rules/axum-08-tower-per-tenant-lease-shedding?format=claude","cursorMdc":"/api/rules/axum-08-tower-per-tenant-lease-shedding?format=mdc","cursorrules":"/api/rules/axum-08-tower-per-tenant-lease-shedding?format=cursor","windsurf":"/api/rules/axum-08-tower-per-tenant-lease-shedding?format=windsurf","agents":"/api/rules/axum-08-tower-per-tenant-lease-shedding?format=agents"}},{"id":"postgres-17-subtransaction-cache-overflow-defense-standard","title":"PostgreSQL 17 Subtransaction Cache Overflow Defense Standard","category":"backend","severity":"critical","description":"Prevents catastrophic ProcArrayLock and SubtransSLRU latch contention across all concurrent connections caused by exceeding PGPROC_MAX_CACHED_SUBXIDS (64). Mandates strict avoidance of iterative savepoints, nested ORM rollback scopes in loops, and requires atomic batching or partitioned transactional boundaries.","antiPatternHeadline":"Loop-Scoped Savepoints and Deeply Nested ORM Subtransactions Inducing Subtrans SLRU Lock Saturation","stars_count":118,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","subtransactions","savepoints","slru","concurrency","prisma","performance"],"exportEndpoints":{"claude":"/api/rules/postgres-17-subtransaction-cache-overflow-defense-standard?format=claude","cursorMdc":"/api/rules/postgres-17-subtransaction-cache-overflow-defense-standard?format=mdc","cursorrules":"/api/rules/postgres-17-subtransaction-cache-overflow-defense-standard?format=cursor","windsurf":"/api/rules/postgres-17-subtransaction-cache-overflow-defense-standard?format=windsurf","agents":"/api/rules/postgres-17-subtransaction-cache-overflow-defense-standard?format=agents"}},{"id":"kmp-swift-concurrency-actor-thread-confinement","title":"KMP 2.1 Swift Concurrency Direct Interop Actor Thread Confinement","category":"mobile","severity":"critical","description":"Enforces strict thread-confinement boundaries and explicit cooperative dispatch when bridging Kotlin Multiplatform (KMP 2.1+) suspend functions into Swift structured actors. Prevents cooperative thread-pool exhaustion, unmanaged continuation context switching, and cross-runtime reentrancy deadlocks between Swift's actor executors and Kotlin's Dispatchers.Default/Main thread pools.","antiPatternHeadline":"Unchecked Suspension Bridging Across Isolated Swift Actors and Kotlin Coroutine Dispatchers Causing Thread-Pool Starvation and Reentrancy Deadlocks","stars_count":95,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kmp","swift-concurrency","kotlin-native","coroutines","actors"],"exportEndpoints":{"claude":"/api/rules/kmp-swift-concurrency-actor-thread-confinement?format=claude","cursorMdc":"/api/rules/kmp-swift-concurrency-actor-thread-confinement?format=mdc","cursorrules":"/api/rules/kmp-swift-concurrency-actor-thread-confinement?format=cursor","windsurf":"/api/rules/kmp-swift-concurrency-actor-thread-confinement?format=windsurf","agents":"/api/rules/kmp-swift-concurrency-actor-thread-confinement?format=agents"}},{"id":"tauri2-scoped-protocol-origin-poisoning-barrier","title":"Tauri 2.0 Origin-Bound Custom Protocol Capability & Asset Isolation Guardrail","category":"mobile","severity":"critical","description":"Enforces strict origin-bound verification, canonical path isolation, and capability verification on custom asset protocol handlers in Tauri 2.0 mobile webviews. Prevents cross-origin privilege escalation, directory traversal, and unauthorized capability execution across Android and iOS webview runtime contexts.","antiPatternHeadline":"Unrestricted Custom Protocol Asset Fetching Permitting Webview Origin Spoofing and Arbitrary Sandbox Traversal","stars_count":114,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri","security","ipc","webview"],"exportEndpoints":{"claude":"/api/rules/tauri2-scoped-protocol-origin-poisoning-barrier?format=claude","cursorMdc":"/api/rules/tauri2-scoped-protocol-origin-poisoning-barrier?format=mdc","cursorrules":"/api/rules/tauri2-scoped-protocol-origin-poisoning-barrier?format=cursor","windsurf":"/api/rules/tauri2-scoped-protocol-origin-poisoning-barrier?format=windsurf","agents":"/api/rules/tauri2-scoped-protocol-origin-poisoning-barrier?format=agents"}},{"id":"openfga-transitive-cycle-detection-circuit-breaker","title":"OpenFGA Transitive Relation Cycle-Detection and Traversal Circuit-Breaker Standard","category":"security","severity":"critical","description":"Enforces deterministic recursion termination, hop-budget bounding, and cycle-detection circuit breakers across OpenFGA authorization checks and client-side graph traversals. Protects authorization engines and distributed query layers from algorithmic complexity denial-of-service (ReDoS/Graph DoS) caused by circular group memberships or unbounded transitive relationship expansion.","antiPatternHeadline":"Unbounded Recursive Traversal and Silent Circular Relationship Expansion in Authorization Graphs","stars_count":63,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","authorization","circuit-breaker","cycle-detection","graph-dos"],"exportEndpoints":{"claude":"/api/rules/openfga-transitive-cycle-detection-circuit-breaker?format=claude","cursorMdc":"/api/rules/openfga-transitive-cycle-detection-circuit-breaker?format=mdc","cursorrules":"/api/rules/openfga-transitive-cycle-detection-circuit-breaker?format=cursor","windsurf":"/api/rules/openfga-transitive-cycle-detection-circuit-breaker?format=windsurf","agents":"/api/rules/openfga-transitive-cycle-detection-circuit-breaker?format=agents"}},{"id":"cilium-ebpf-xdp-ingress-cryptographic-attestation-guardrail","title":"Cilium eBPF XDP Ingress Cryptographic Attestation Validation Standard","category":"devops","severity":"critical","description":"Enforces strict cryptographic attestation (IPsec, WireGuard, or SPIFFE/mTLS token verification) during Cilium eBPF XDP ingress acceleration. Prevents kernel-bypass line-rate packet processing from short-circuiting zero-trust authentication boundaries prior to cluster workload dispatch.","antiPatternHeadline":"Short-Circuiting Cryptographic Verification via Unchecked XDP_REDIRECT Ingress Rules","stars_count":114,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","cilium","ebpf","xdp","zero-trust","mtls","kubernetes","network-security"],"exportEndpoints":{"claude":"/api/rules/cilium-ebpf-xdp-ingress-cryptographic-attestation-guardrail?format=claude","cursorMdc":"/api/rules/cilium-ebpf-xdp-ingress-cryptographic-attestation-guardrail?format=mdc","cursorrules":"/api/rules/cilium-ebpf-xdp-ingress-cryptographic-attestation-guardrail?format=cursor","windsurf":"/api/rules/cilium-ebpf-xdp-ingress-cryptographic-attestation-guardrail?format=windsurf","agents":"/api/rules/cilium-ebpf-xdp-ingress-cryptographic-attestation-guardrail?format=agents"}},{"id":"opentelemetry-non-parented-span-link-propagation-standard","title":"OpenTelemetry Span Link Propagation for Detached Asynchronous Queue Consumers","category":"devops","severity":"critical","description":"Enforces asynchronous batch and queue consumers to initialize decoupled trace contexts linked causally via Span Links instead of inheriting parent context directly. Prevents broken distributed traces, skewed latency metrics, and incomplete error telemetry when consumer execution outlives publisher scope or processes multi-origin batches under cascading failures.","antiPatternHeadline":"Direct Parent-Child Context Inheritance in Batch Queue Consumers Causing Context Leaks and Distorted Latencies","stars_count":63,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","distributed-tracing","event-driven-architecture","observability","reliability"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-non-parented-span-link-propagation-standard?format=claude","cursorMdc":"/api/rules/opentelemetry-non-parented-span-link-propagation-standard?format=mdc","cursorrules":"/api/rules/opentelemetry-non-parented-span-link-propagation-standard?format=cursor","windsurf":"/api/rules/opentelemetry-non-parented-span-link-propagation-standard?format=windsurf","agents":"/api/rules/opentelemetry-non-parented-span-link-propagation-standard?format=agents"}},{"id":"nextjs-15-taint-and-action-signature-verification","title":"Next.js 15 Server Actions Cryptographic Taint & Action Signature Verification","category":"frontend","severity":"critical","description":"Enforces strict runtime cryptographic taint tracking via experimental_taintObjectReference and experimental_taintUniqueValue to prevent ambient server secrets and raw domain entities from leaking across the React Server Component (RSC) serialization boundary. Mandates cryptographic signature verification, explicit Data Transfer Object (DTO) projection, and Zod input validation on all Next.js 15 Server Action invocation entry points.","antiPatternHeadline":"Leaking Raw Domain Objects or Ambient Secrets across RSC Serialization Boundaries Without Taint Traps or Signature Verification","stars_count":47,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs15","server-actions","rsc","security","taint-analysis"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-taint-and-action-signature-verification?format=claude","cursorMdc":"/api/rules/nextjs-15-taint-and-action-signature-verification?format=mdc","cursorrules":"/api/rules/nextjs-15-taint-and-action-signature-verification?format=cursor","windsurf":"/api/rules/nextjs-15-taint-and-action-signature-verification?format=windsurf","agents":"/api/rules/nextjs-15-taint-and-action-signature-verification?format=agents"}},{"id":"react19-server-transition-cancellation-boundary","title":"Deterministic Server Component Transition Cancellation & Interruption Boundaries","category":"frontend","severity":"critical","description":"Enforces deterministic AbortController integration and epoch sequence synchronization across concurrent React 19 Server Actions and Transitions. Prevents stale flight streams and out-of-order asynchronous server responses from overwriting active client-side optimistic mutations during rapid user interactions.","antiPatternHeadline":"Unbounded Concurrent Server Transitions Overwriting Optimistic UI with Stale RSC Payloads","stars_count":94,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","server-actions","concurrency","rsc","abort-controller","optimistic-ui"],"exportEndpoints":{"claude":"/api/rules/react19-server-transition-cancellation-boundary?format=claude","cursorMdc":"/api/rules/react19-server-transition-cancellation-boundary?format=mdc","cursorrules":"/api/rules/react19-server-transition-cancellation-boundary?format=cursor","windsurf":"/api/rules/react19-server-transition-cancellation-boundary?format=windsurf","agents":"/api/rules/react19-server-transition-cancellation-boundary?format=agents"}},{"id":"tauri2-ipc-granular-capability-scope-acl","title":"Tauri 2.0 Granular IPC Command Capability & Scope ACL Invariant","category":"security","severity":"critical","description":"Enforces strict least-privilege capability manifests and explicit argument-scoping ACLs for all Tauri 2.0 webview-to-Rust IPC boundaries. Prohibits global wildcards, un-scoped filesystem paths, and unrestricted shell execution permissions across all capability definition files.","antiPatternHeadline":"Assigning wildcard permissions or un-scoped filesystem/shell capabilities to webview windows","stars_count":77,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","tauri-v2","rust","ipc","acl","capabilities"],"exportEndpoints":{"claude":"/api/rules/tauri2-ipc-granular-capability-scope-acl?format=claude","cursorMdc":"/api/rules/tauri2-ipc-granular-capability-scope-acl?format=mdc","cursorrules":"/api/rules/tauri2-ipc-granular-capability-scope-acl?format=cursor","windsurf":"/api/rules/tauri2-ipc-granular-capability-scope-acl?format=windsurf","agents":"/api/rules/tauri2-ipc-granular-capability-scope-acl?format=agents"}},{"id":"webauthn-prf-zk-client-encryption-standard","title":"Zero-Knowledge Hardware-Bound Key Derivation via WebAuthn PRF Extension","category":"security","severity":"critical","description":"Enforces cryptographic invariants when deriving deterministic symmetric encryption keys via the WebAuthn Pseudo-Random Function (PRF) extension (HMAC-secret). The host application must maintain absolute zero-knowledge guarantees: raw PRF outputs and derived symmetric keys must never be exposed to server-side telemetry or transmission, and must pass through HKDF with cryptographically distinct salts and info parameters before AES-GCM envelope encryption.","antiPatternHeadline":"Leaking Raw Authenticator PRF Outputs or Using Unsalted PRF Secrets Directly as Encryption Keys","stars_count":87,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","prf-extension","zero-knowledge","hkdf","aes-gcm","cryptography"],"exportEndpoints":{"claude":"/api/rules/webauthn-prf-zk-client-encryption-standard?format=claude","cursorMdc":"/api/rules/webauthn-prf-zk-client-encryption-standard?format=mdc","cursorrules":"/api/rules/webauthn-prf-zk-client-encryption-standard?format=cursor","windsurf":"/api/rules/webauthn-prf-zk-client-encryption-standard?format=windsurf","agents":"/api/rules/webauthn-prf-zk-client-encryption-standard?format=agents"}},{"id":"axum-08-tokio-tower-graceful-drain-websocket-cancellation","title":"Axum 0.8 Tokio Tower Bounded Graceful Drain & WebSocket Cancellation Protocol","category":"backend","severity":"critical","description":"Enforces deterministic, bounded connection draining during SIGTERM/SIGINT teardown in Axum 0.8 and Tokio runtimes. Requires tokio_util CancellationToken propagation across nested Tower service layers and coordinated Close frame broadcasts to stateful WebSockets before runtime drop to prevent dropped in-flight requests and orphaned socket descriptors.","antiPatternHeadline":"Unbounded Axum serve_with_graceful_shutdown causing abruptly aborted TCP sockets and unnotified WebSocket client disconnections","stars_count":87,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tokio","tower","websockets","graceful-shutdown"],"exportEndpoints":{"claude":"/api/rules/axum-08-tokio-tower-graceful-drain-websocket-cancellation?format=claude","cursorMdc":"/api/rules/axum-08-tokio-tower-graceful-drain-websocket-cancellation?format=mdc","cursorrules":"/api/rules/axum-08-tokio-tower-graceful-drain-websocket-cancellation?format=cursor","windsurf":"/api/rules/axum-08-tokio-tower-graceful-drain-websocket-cancellation?format=windsurf","agents":"/api/rules/axum-08-tokio-tower-graceful-drain-websocket-cancellation?format=agents"}},{"id":"postgres-17-direct-io-vectorized-streaming-standard","title":"Postgres 17 Direct I/O and Vectorized Streaming Buffer Standard","category":"backend","severity":"critical","description":"Postgres 17 introduces native direct I/O (io_direct) and vectorized streaming read interfaces that bypass OS page cache double-buffering. Enforcing direct block alignment, asynchronous I/O prefetch rings, and memory-safe streaming cursor sessions prevents filesystem cache thrashing and collapses p99 tail latencies under concurrent analytics workloads.","antiPatternHeadline":"Unbounded OS Page Cache Double-Buffering with Synchronous Non-Vectorized Row Scans","stars_count":109,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres-17","direct-io","performance","database","storage-engine"],"exportEndpoints":{"claude":"/api/rules/postgres-17-direct-io-vectorized-streaming-standard?format=claude","cursorMdc":"/api/rules/postgres-17-direct-io-vectorized-streaming-standard?format=mdc","cursorrules":"/api/rules/postgres-17-direct-io-vectorized-streaming-standard?format=cursor","windsurf":"/api/rules/postgres-17-direct-io-vectorized-streaming-standard?format=windsurf","agents":"/api/rules/postgres-17-direct-io-vectorized-streaming-standard?format=agents"}},{"id":"go-weak-pointer-finalizer-free-cache-standard","title":"Go 1.24 Weak Pointer Finalizer-Free In-Memory Cache Invariant","category":"backend","severity":"critical","description":"Mandates the use of Go 1.24 standard library weak.Pointer for L1 runtime caches in latency-sensitive RPC services. Prohibits runtime.SetFinalizer and strong-pointer storage in eviction tables to prevent multi-generation GC promotion, stop-the-world finalizer queues, and heap fragmentation.","antiPatternHeadline":"Retaining Strong References or Attaching runtime.SetFinalizer in In-Memory Caches Induces Head-of-Line GC Blocking","stars_count":96,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","concurrency","performance","garbage-collection","memory-management"],"exportEndpoints":{"claude":"/api/rules/go-weak-pointer-finalizer-free-cache-standard?format=claude","cursorMdc":"/api/rules/go-weak-pointer-finalizer-free-cache-standard?format=mdc","cursorrules":"/api/rules/go-weak-pointer-finalizer-free-cache-standard?format=cursor","windsurf":"/api/rules/go-weak-pointer-finalizer-free-cache-standard?format=windsurf","agents":"/api/rules/go-weak-pointer-finalizer-free-cache-standard?format=agents"}},{"id":"react-native-nitro-hybridobject-lifetime-isolation","title":"React Native Nitro Modules C++ HybridObject Lifetime & RAII Isolation","category":"mobile","severity":"critical","description":"Mandates deterministic C++ smart pointer ownership boundaries and RAII encapsulation for Nitro Modules HybridObjects bridging Hermes and platform native runtimes. Prevents phantom off-heap leaks and cyclic strong references between JSI garbage-collected wrappers and native asynchronous dispatch queues.","antiPatternHeadline":"Retaining Strong Shared Pointers or Unwrapped Native Resources Across the Nitro JSI Boundary Causing GC-Invisible Memory Leaks","stars_count":51,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","react-native","nitro-modules","cpp","hermes","raii","memory-management"],"exportEndpoints":{"claude":"/api/rules/react-native-nitro-hybridobject-lifetime-isolation?format=claude","cursorMdc":"/api/rules/react-native-nitro-hybridobject-lifetime-isolation?format=mdc","cursorrules":"/api/rules/react-native-nitro-hybridobject-lifetime-isolation?format=cursor","windsurf":"/api/rules/react-native-nitro-hybridobject-lifetime-isolation?format=windsurf","agents":"/api/rules/react-native-nitro-hybridobject-lifetime-isolation?format=agents"}},{"id":"opentelemetry-w3c-baggage-redaction-pii-erasure-gatekeeper","title":"OpenTelemetry W3C Baggage Redaction and PII Erasure Gatekeeper","category":"devops","severity":"critical","description":"Enforces strict zero-trust schema validation, allowlist enforcement, and cryptographic masking on distributed W3C Baggage and TraceState headers at edge perimeters. Prevents propagation of sensitive identity tokens, credentials, and regulatory PII (GDPR/HIPAA/CCPA) into downstream distributed contexts and telemetry observability backends.","antiPatternHeadline":"Unconstrained Ingress Propagation and Span Injection of Raw W3C Baggage","stars_count":43,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","security","pii-redaction","w3c-trace-context","distributed-tracing","zero-trust"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-w3c-baggage-redaction-pii-erasure-gatekeeper?format=claude","cursorMdc":"/api/rules/opentelemetry-w3c-baggage-redaction-pii-erasure-gatekeeper?format=mdc","cursorrules":"/api/rules/opentelemetry-w3c-baggage-redaction-pii-erasure-gatekeeper?format=cursor","windsurf":"/api/rules/opentelemetry-w3c-baggage-redaction-pii-erasure-gatekeeper?format=windsurf","agents":"/api/rules/opentelemetry-w3c-baggage-redaction-pii-erasure-gatekeeper?format=agents"}},{"id":"cilium-ebpf-sockops-tcp-quarantine","title":"Cilium eBPF Sockops Kernel-Level TCP Half-Open Connection Quarantine","category":"devops","severity":"critical","description":"Mandates kernel-level interception of TCP socket state transitions via Cilium eBPF sockops programs to detect and terminate orphaned SYN-ACK handshakes in the kernel. This prevents upstream Envoy and ingress proxies from exhausting epoll file descriptors and listen backlogs under connection churn and SYN-flood anomalies.","antiPatternHeadline":"Passive Userspace Handshake Timeout Reliance Leading to Ingress Epoll Starvation","stars_count":48,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","cilium","ebpf","networking","tcp","linux-kernel"],"exportEndpoints":{"claude":"/api/rules/cilium-ebpf-sockops-tcp-quarantine?format=claude","cursorMdc":"/api/rules/cilium-ebpf-sockops-tcp-quarantine?format=mdc","cursorrules":"/api/rules/cilium-ebpf-sockops-tcp-quarantine?format=cursor","windsurf":"/api/rules/cilium-ebpf-sockops-tcp-quarantine?format=windsurf","agents":"/api/rules/cilium-ebpf-sockops-tcp-quarantine?format=agents"}},{"id":"vite6-environment-api-multi-runtime-ssr-guardrail","title":"Vite 6 Environment API Multi-Runtime SSR Boundary Standard","category":"frontend","severity":"critical","description":"Enforces strict module execution isolation, decoupled module graphs, and runtime-targeted resolve conditions across heterogeneous SSR environments (Node.js, Bun, Workerd) using Vite 6 Environment API. Prevents cross-runtime symbol contamination, node global leakage into edge runtimes, and obsolete legacy ssrLoadModule invocation patterns.","antiPatternHeadline":"Monolithic SSR Module Graphs and Legacy ssrLoadModule Bleeding Cross-Runtime Dependencies","stars_count":102,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","vite-6","ssr","workerd","environment-api","runtime-isolation"],"exportEndpoints":{"claude":"/api/rules/vite6-environment-api-multi-runtime-ssr-guardrail?format=claude","cursorMdc":"/api/rules/vite6-environment-api-multi-runtime-ssr-guardrail?format=mdc","cursorrules":"/api/rules/vite6-environment-api-multi-runtime-ssr-guardrail?format=cursor","windsurf":"/api/rules/vite6-environment-api-multi-runtime-ssr-guardrail?format=windsurf","agents":"/api/rules/vite6-environment-api-multi-runtime-ssr-guardrail?format=agents"}},{"id":"react19-cache-request-boundary-invariant","title":"React 19 Server cache() Request Lifespan & State Leakage Guardrail","category":"frontend","severity":"critical","description":"Enforces deterministic, request-scoped memoization boundaries for React 19's server-side cache() utility across React Server Component (RSC) execution graphs. Prevents cross-request state leakage, memory bloat, and stale data propagation caused by persistent module-level closures or unmemoized asynchronous dispatch. Mandates referential equality discipline and pure functional boundaries when deriving data within server environments.","antiPatternHeadline":"Global Module-Level Memoization or Unbound Closures Leaking Cross-Request Server State","stars_count":87,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["react19","rsc","cache","server-components","nextjs","concurrency"],"exportEndpoints":{"claude":"/api/rules/react19-cache-request-boundary-invariant?format=claude","cursorMdc":"/api/rules/react19-cache-request-boundary-invariant?format=mdc","cursorrules":"/api/rules/react19-cache-request-boundary-invariant?format=cursor","windsurf":"/api/rules/react19-cache-request-boundary-invariant?format=windsurf","agents":"/api/rules/react19-cache-request-boundary-invariant?format=agents"}},{"id":"axum-tokio-structured-drain-sse-lifeline-standard","title":"Axum 0.8 Tokio Structured Drain & In-Flight SSE Lifeline Standard","category":"backend","severity":"critical","description":"Enforces deterministic, zero-loss socket termination and bounded backpressure drain for active Server-Sent Events (SSE) and WebSocket connections during rolling deployments in Axum 0.8. Eliminates zombie socket hangs and abrupt TCP RST terminations by wiring coordinated tokio_util cancellation tokens and explicit protocol termination frames into the server shutdown lifecycle.","antiPatternHeadline":"Unbounded Long-Lived Streams Causing Deployment Deadlocks or Abrupt Client Drops via SIGKILL","stars_count":63,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["axum","tokio","rust","sse","websockets","graceful-shutdown","kubernetes"],"exportEndpoints":{"claude":"/api/rules/axum-tokio-structured-drain-sse-lifeline-standard?format=claude","cursorMdc":"/api/rules/axum-tokio-structured-drain-sse-lifeline-standard?format=mdc","cursorrules":"/api/rules/axum-tokio-structured-drain-sse-lifeline-standard?format=cursor","windsurf":"/api/rules/axum-tokio-structured-drain-sse-lifeline-standard?format=windsurf","agents":"/api/rules/axum-tokio-structured-drain-sse-lifeline-standard?format=agents"}},{"id":"postgres-17-failover-slot-sync-cdc-invariant-postgres-17-fail-186","title":"PostgreSQL 17 Failover Slot Sync & Logical Replication Invariants","category":"backend","severity":"critical","description":"Enforces failover-safe logical replication slots introduced in PostgreSQL 17 to prevent message loss or unbounded re-streaming during high-availability switchovers. Mandates `failover = true` on logical slots, strict synchronization across physical standbys via `synchronized_standby_slots`, and downstream LSN tracking to uphold exactly-once or at-least-once CDC processing invariants.","antiPatternHeadline":"Creating unmanaged logical replication slots that are dropped or rewound upon physical standby failover","stars_count":52,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","cdc","high-availability","debezium","database"],"exportEndpoints":{"claude":"/api/rules/postgres-17-failover-slot-sync-cdc-invariant-postgres-17-fail-186?format=claude","cursorMdc":"/api/rules/postgres-17-failover-slot-sync-cdc-invariant-postgres-17-fail-186?format=mdc","cursorrules":"/api/rules/postgres-17-failover-slot-sync-cdc-invariant-postgres-17-fail-186?format=cursor","windsurf":"/api/rules/postgres-17-failover-slot-sync-cdc-invariant-postgres-17-fail-186?format=windsurf","agents":"/api/rules/postgres-17-failover-slot-sync-cdc-invariant-postgres-17-fail-186?format=agents"}},{"id":"capacitor-7-jni-decoupling-background-task-standard","title":"Capacitor 7 Main-Thread JNI Decoupling & Background Task Standard","category":"mobile","severity":"critical","description":"Enforces non-blocking native bridge execution boundaries and managed OS background task lifecycles in Capacitor 7. Eliminates UI thread deadlocks, Android Application Not Responding (ANR) violations, and iOS Watchdog (0x8badf00d) terminations caused by synchronous JNI/bridge executions during heavy workloads and background transitions.","antiPatternHeadline":"Executing heavy bridge operations synchronously on native UI threads without background task assertions","stars_count":44,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","capacitor-7","jni","android-anr","ios-watchdog","background-tasks"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-jni-decoupling-background-task-standard?format=claude","cursorMdc":"/api/rules/capacitor-7-jni-decoupling-background-task-standard?format=mdc","cursorrules":"/api/rules/capacitor-7-jni-decoupling-background-task-standard?format=cursor","windsurf":"/api/rules/capacitor-7-jni-decoupling-background-task-standard?format=windsurf","agents":"/api/rules/capacitor-7-jni-decoupling-background-task-standard?format=agents"}},{"id":"compose-skiko-vsync-frame-pacing-invariant","title":"Compose Multiplatform Skiko Frame-Pacing & VSync Invariant","category":"mobile","severity":"critical","description":"Enforces hardware VSync synchronization across Compose Multiplatform targets using Skiko (iOS CADisplayLink, Android Choreographer, desktop refresh hooks). Prevents GPU buffer queue exhaustion and frame dropping by disallowing unmetered manual redraw dispatch and decoupled coroutine render loops.","antiPatternHeadline":"Decoupled Timed Coroutine Polling and Unthrottled needRedraw() Invocation in Skiko Render Loop","stars_count":99,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","compose-multiplatform","skiko","vsync","frame-pacing","kotlin","graphics"],"exportEndpoints":{"claude":"/api/rules/compose-skiko-vsync-frame-pacing-invariant?format=claude","cursorMdc":"/api/rules/compose-skiko-vsync-frame-pacing-invariant?format=mdc","cursorrules":"/api/rules/compose-skiko-vsync-frame-pacing-invariant?format=cursor","windsurf":"/api/rules/compose-skiko-vsync-frame-pacing-invariant?format=windsurf","agents":"/api/rules/compose-skiko-vsync-frame-pacing-invariant?format=agents"}},{"id":"openfga-contextual-tuple-temporal-invariant","title":"OpenFGA 1.6 Contextual Tuple Temporal Invariant and Ephemeral Attribute Enforcement","category":"security","severity":"critical","description":"Enforces that short-lived permissions, time-bound delegations, and dynamic environment context are evaluated ephemerally via OpenFGA 1.6 contextual tuples and CEL-conditioned context objects. Eliminates authorization staleness, race conditions, and tuple pollution caused by persisting ephemeral state directly into durable ReBAC storage.","antiPatternHeadline":"Persisting Ephemeral Temporal State to Durable Tuple Storage or Omitting Temporal Context During Authorization Checks","stars_count":113,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","rebac","authorization","temporal-access","contextual-tuples"],"exportEndpoints":{"claude":"/api/rules/openfga-contextual-tuple-temporal-invariant?format=claude","cursorMdc":"/api/rules/openfga-contextual-tuple-temporal-invariant?format=mdc","cursorrules":"/api/rules/openfga-contextual-tuple-temporal-invariant?format=cursor","windsurf":"/api/rules/openfga-contextual-tuple-temporal-invariant?format=windsurf","agents":"/api/rules/openfga-contextual-tuple-temporal-invariant?format=agents"}},{"id":"spiffe-spire-svid-attestation-standard","title":"SPIFFE/SPIRE Dynamic SVID Attestation & Ephemeral mTLS Enforcement","category":"security","severity":"critical","description":"Mandates non-blocking runtime integration with the SPIFFE Workload API via local Unix Domain Socket (UDS) to dynamically stream short-lived X.509 SVIDs and SPIFFE trust bundles. Prohibits mounting static certificates, private keys, or long-lived credentials into workload filesystems. Enforces automated, in-memory rotation of mTLS contexts and strict SPIFFE ID SAN validation on all inter-service communications.","antiPatternHeadline":"Baking Static X.509 PEM Files and Long-Lived Credentials into Container Filesystems","stars_count":65,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","spiffe","spire","zero-trust","mtls","cryptography"],"exportEndpoints":{"claude":"/api/rules/spiffe-spire-svid-attestation-standard?format=claude","cursorMdc":"/api/rules/spiffe-spire-svid-attestation-standard?format=mdc","cursorrules":"/api/rules/spiffe-spire-svid-attestation-standard?format=cursor","windsurf":"/api/rules/spiffe-spire-svid-attestation-standard?format=windsurf","agents":"/api/rules/spiffe-spire-svid-attestation-standard?format=agents"}},{"id":"opentofu-kms-envelope-encryption-ephemeral-lease-standard","title":"OpenTofu State KMS Envelope Encryption & Ephemeral Lease Standard","category":"devops","severity":"critical","description":"Enforces client-side envelope encryption for OpenTofu state files and execution plans using hardware-backed KMS customer-managed keys (CMK) alongside short-lived, workload-identity-federated runner leases. This eliminates plaintext state exposure in backend object storage and mitigates persistent credential theft risks across CI/CD execution pipelines.","antiPatternHeadline":"Unencrypted State Backends Using Server-Side Fallbacks and Static IAM Pipeline Credentials","stars_count":58,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["opentofu","devops","kms","envelope-encryption","state-security","oidc","ephemeral-credentials"],"exportEndpoints":{"claude":"/api/rules/opentofu-kms-envelope-encryption-ephemeral-lease-standard?format=claude","cursorMdc":"/api/rules/opentofu-kms-envelope-encryption-ephemeral-lease-standard?format=mdc","cursorrules":"/api/rules/opentofu-kms-envelope-encryption-ephemeral-lease-standard?format=cursor","windsurf":"/api/rules/opentofu-kms-envelope-encryption-ephemeral-lease-standard?format=windsurf","agents":"/api/rules/opentofu-kms-envelope-encryption-ephemeral-lease-standard?format=agents"}},{"id":"otel-collector-persistent-queue-disk-buffer-invariant","title":"OpenTelemetry Collector Persistent Queue Disk-Buffer Invariant","category":"devops","severity":"critical","description":"Enforces file-storage-backed persistent queueing within OpenTelemetry Collector exporters alongside upstream memory_limiter guards. Guarantees zero telemetry loss and prevents out-of-memory (OOM) fatal crashes during extended downstream network partitions by spilling bounded batches to persistent volumes.","antiPatternHeadline":"Volatile In-Memory Exporter Queuing Without Disk Spooling or Memory Throttling","stars_count":76,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","observability","kubernetes","resilience"],"exportEndpoints":{"claude":"/api/rules/otel-collector-persistent-queue-disk-buffer-invariant?format=claude","cursorMdc":"/api/rules/otel-collector-persistent-queue-disk-buffer-invariant?format=mdc","cursorrules":"/api/rules/otel-collector-persistent-queue-disk-buffer-invariant?format=cursor","windsurf":"/api/rules/otel-collector-persistent-queue-disk-buffer-invariant?format=windsurf","agents":"/api/rules/otel-collector-persistent-queue-disk-buffer-invariant?format=agents"}},{"id":"react19-server-actions-idempotency-optimistic-mutation","title":"React 19 Server Actions Idempotency & Deterministic Optimistic Invariant","category":"frontend","severity":"critical","description":"Enforces cryptographic idempotency tokens and transactional sequence identity across React 19 Server Action dispatches and optimistic mutations. Guarantees deterministic state rollback and prevents double-execution artifacts or stale-response clobbering during degraded network transitions and concurrent dispatches.","antiPatternHeadline":"Non-Idempotent Concurrent Action Dispatching with Uncorrelated Optimistic State Mutation","stars_count":81,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","server-actions","optimistic-ui","concurrency","idempotency"],"exportEndpoints":{"claude":"/api/rules/react19-server-actions-idempotency-optimistic-mutation?format=claude","cursorMdc":"/api/rules/react19-server-actions-idempotency-optimistic-mutation?format=mdc","cursorrules":"/api/rules/react19-server-actions-idempotency-optimistic-mutation?format=cursor","windsurf":"/api/rules/react19-server-actions-idempotency-optimistic-mutation?format=windsurf","agents":"/api/rules/react19-server-actions-idempotency-optimistic-mutation?format=agents"}},{"id":"vite6-environment-api-runtime-isolation-boundary","title":"Vite 6 Environment API Multi-Runtime Module Isolation Boundary","category":"frontend","severity":"critical","description":"Vite 6 replaces legacy monolithic SSR handling with the Environment API, enabling independent module graphs, runner pipelines, and transform contexts across heterogeneous runtimes (Node.js, workerd, Edge, browser). This guardrail strictly enforces execution context isolation, per-environment resolution conditions, and scoped plugin lifecycle hooks to prevent catastrophic module leakage, invalid native bindings, and cross-runtime graph contamination.","antiPatternHeadline":"Leaking Node Built-ins and Cross-Polluting Module Graphs Across Vite 6 Environments","stars_count":45,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","vite6","environment-api","ssr","workerd","cloudflare-workers","module-isolation"],"exportEndpoints":{"claude":"/api/rules/vite6-environment-api-runtime-isolation-boundary?format=claude","cursorMdc":"/api/rules/vite6-environment-api-runtime-isolation-boundary?format=mdc","cursorrules":"/api/rules/vite6-environment-api-runtime-isolation-boundary?format=cursor","windsurf":"/api/rules/vite6-environment-api-runtime-isolation-boundary?format=windsurf","agents":"/api/rules/vite6-environment-api-runtime-isolation-boundary?format=agents"}},{"id":"openfga-contextual-tuple-traversal-cycle-guardrail","title":"OpenFGA Contextual Tuple Graph Traversal & Cycle Guardrail","category":"security","severity":"critical","description":"Enforces pre-flight Directed Acyclic Graph (DAG) cycle detection, strict contextual tuple cardinality limits, and deterministic traversal timeouts for OpenFGA ReBAC evaluation. Prevents catastrophic recursive graph explosion, CPU exhaustion, and multi-tenant denial of service during dynamic contextual permission checks.","antiPatternHeadline":"Unbounded or Cyclical Contextual Tuples Injected Directly into OpenFGA Check API","stars_count":103,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","rebac","authorization","graph-traversal","dos-prevention"],"exportEndpoints":{"claude":"/api/rules/openfga-contextual-tuple-traversal-cycle-guardrail?format=claude","cursorMdc":"/api/rules/openfga-contextual-tuple-traversal-cycle-guardrail?format=mdc","cursorrules":"/api/rules/openfga-contextual-tuple-traversal-cycle-guardrail?format=cursor","windsurf":"/api/rules/openfga-contextual-tuple-traversal-cycle-guardrail?format=windsurf","agents":"/api/rules/openfga-contextual-tuple-traversal-cycle-guardrail?format=agents"}},{"id":"tauri2-capability-ipc-sandboxing-origin-isolation-standard","title":"Tauri 2.0 Capability-Based IPC Sandboxing and Origin Isolation Standard","category":"mobile","severity":"critical","description":"Enforces Tauri 2.0 capability-driven permission manifests, explicit webview origin boundaries, and least-privilege IPC command access across mobile and desktop runtimes. Eliminates arbitrary native code execution and lateral privilege escalation by isolating webview contexts and strictly forbidding wildcard plugin permissions. Mandates cryptographic origin validation, granular capability scoping, and deterministic payload schema validation between the frontend and native Rust handlers.","antiPatternHeadline":"Exposing Wildcard Plugin Capabilities and Permitting Remote or Untrusted Webviews to Invoke Native System APIs","stars_count":110,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri-2","security","ipc-sandboxing","capabilities","origin-isolation","rust"],"exportEndpoints":{"claude":"/api/rules/tauri2-capability-ipc-sandboxing-origin-isolation-standard?format=claude","cursorMdc":"/api/rules/tauri2-capability-ipc-sandboxing-origin-isolation-standard?format=mdc","cursorrules":"/api/rules/tauri2-capability-ipc-sandboxing-origin-isolation-standard?format=cursor","windsurf":"/api/rules/tauri2-capability-ipc-sandboxing-origin-isolation-standard?format=windsurf","agents":"/api/rules/tauri2-capability-ipc-sandboxing-origin-isolation-standard?format=agents"}},{"id":"kmp-swift-concurrency-actor-boundary-standard","title":"Kotlin Multiplatform & Swift 6 Actor Boundary Memory and Deadlock Guardrail","category":"mobile","severity":"critical","description":"Enforces strict isolation boundaries when bridging Kotlin Native coroutines and Swift 6 actors across the Objective-C/C export interface. Prevents ARC race conditions, double frees, and cooperative thread-pool starvation caused by passing mutable reference graphs across the interop boundary without explicit value semantics or unconfined thread dispatching.","antiPatternHeadline":"Passing Mutable Kotlin Objects to Swift Actors or Bridging Suspend Calls on Main Dispatchers","stars_count":61,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","swift-concurrency","native-interop","memory-safety"],"exportEndpoints":{"claude":"/api/rules/kmp-swift-concurrency-actor-boundary-standard?format=claude","cursorMdc":"/api/rules/kmp-swift-concurrency-actor-boundary-standard?format=mdc","cursorrules":"/api/rules/kmp-swift-concurrency-actor-boundary-standard?format=cursor","windsurf":"/api/rules/kmp-swift-concurrency-actor-boundary-standard?format=windsurf","agents":"/api/rules/kmp-swift-concurrency-actor-boundary-standard?format=agents"}},{"id":"webauthn-origin-nonce-assertion-invariant","title":"WebAuthn Passkey Cryptographic Origin & Nonce Assertion Invariant","category":"security","severity":"critical","description":"Defends against real-time adversary-in-the-middle (AiTM) reverse proxy phishing and replay attacks by enforcing cryptographic clientDataJSON origin validation and atomic single-use nonce consumption. WebAuthn assertions must strictly validate the fully-qualified canonical origin, rely on atomic get-and-delete challenge storage, and enforce user verification invariants.","antiPatternHeadline":"Permissive Origin Matching and Non-Atomic Challenge Consumption in WebAuthn Verification","stars_count":111,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","fido2","passkeys","cryptography","phishing-defense","session-security"],"exportEndpoints":{"claude":"/api/rules/webauthn-origin-nonce-assertion-invariant?format=claude","cursorMdc":"/api/rules/webauthn-origin-nonce-assertion-invariant?format=mdc","cursorrules":"/api/rules/webauthn-origin-nonce-assertion-invariant?format=cursor","windsurf":"/api/rules/webauthn-origin-nonce-assertion-invariant?format=windsurf","agents":"/api/rules/webauthn-origin-nonce-assertion-invariant?format=agents"}},{"id":"ebpf-sidecarless-mesh-mtls-kernel-flow","title":"eBPF Sidecarless Service Mesh L7 mTLS & Kernel Flow Standard","category":"devops","severity":"critical","description":"Enforces cryptographic zero-trust verification and deterministic L7 proxy steering within sidecarless eBPF mesh datapaths. Guarantees that kernel-level socket short-circuits (sockmap/sockops) do not bypass mutual TLS authentication, SPIFFE identity attestation, or Layer 7 inspection filters.","antiPatternHeadline":"Bypassing mTLS handshakes and L7 policy enforcement via unauthenticated eBPF socket-to-socket short-circuiting","stars_count":48,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","service-mesh","cilium","istio-ambient","mtls","kubernetes"],"exportEndpoints":{"claude":"/api/rules/ebpf-sidecarless-mesh-mtls-kernel-flow?format=claude","cursorMdc":"/api/rules/ebpf-sidecarless-mesh-mtls-kernel-flow?format=mdc","cursorrules":"/api/rules/ebpf-sidecarless-mesh-mtls-kernel-flow?format=cursor","windsurf":"/api/rules/ebpf-sidecarless-mesh-mtls-kernel-flow?format=windsurf","agents":"/api/rules/ebpf-sidecarless-mesh-mtls-kernel-flow?format=agents"}},{"id":"slsa-l3-ephemeral-oidc-attestation-fence","title":"SLSA Level 3 Ephemeral OIDC Provenance & Cryptographic Attestation Fence","category":"devops","severity":"critical","description":"Enforces non-forgeable SLSA Level 3 build provenance by binding artifact signatures to short-lived OIDC/SPIFFE identity tokens generated in isolated runners. Precludes static deployment credentials and requires admission controllers to reject container images lacking verifiable transparency log entries and cryptographic attestations.","antiPatternHeadline":"Ambient Static Credentials and Tag-Based Admission Without Rekor-Logged Cryptographic Provenance","stars_count":75,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","slsa-l3","oidc","sigstore","cosign","supply-chain-security","admission-control"],"exportEndpoints":{"claude":"/api/rules/slsa-l3-ephemeral-oidc-attestation-fence?format=claude","cursorMdc":"/api/rules/slsa-l3-ephemeral-oidc-attestation-fence?format=mdc","cursorrules":"/api/rules/slsa-l3-ephemeral-oidc-attestation-fence?format=cursor","windsurf":"/api/rules/slsa-l3-ephemeral-oidc-attestation-fence?format=windsurf","agents":"/api/rules/slsa-l3-ephemeral-oidc-attestation-fence?format=agents"}},{"id":"bun-socket-kernel-backpressure-drain-standard","title":"Bun 1.2 Kernel Socket Zero-Copy Backpressure Drainage Standard","category":"backend","severity":"critical","description":"Enforces strict TCP backpressure drainage and zero-copy memory preservation when dispatching high-throughput data via Bun 1.2 native socket primitives. Prevents unbounded internal C++/JSC write-queue allocation and kernel socket buffer saturation that leads to catastrophic process out-of-memory (OOM) termination under multi-gigabit workloads.","antiPatternHeadline":"Fire-and-forget socket.write() calls ignoring partial writes and missing drain event synchronization","stars_count":64,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","networking","tcp","backpressure","zero-copy","sockets"],"exportEndpoints":{"claude":"/api/rules/bun-socket-kernel-backpressure-drain-standard?format=claude","cursorMdc":"/api/rules/bun-socket-kernel-backpressure-drain-standard?format=mdc","cursorrules":"/api/rules/bun-socket-kernel-backpressure-drain-standard?format=cursor","windsurf":"/api/rules/bun-socket-kernel-backpressure-drain-standard?format=windsurf","agents":"/api/rules/bun-socket-kernel-backpressure-drain-standard?format=agents"}},{"id":"svelte5-runes-reactive-proxy-serialization-guardrail","title":"Svelte 5 Runes Reactive Proxy Serialization Guardrail","category":"frontend","severity":"critical","description":"Enforces explicit dereferencing and snapshotting of Svelte 5 rune reactive proxies before passing data across Web Worker message ports, BroadcastChannels, or SSR-to-client hydration state boundaries. Deeply reactive state generated via $state() wraps structures in JavaScript Proxies that fail structured clone algorithms or retain hidden component lifecycle bindings, causing cross-boundary memory leaks and silent mutation tracking failures. Production systems must mandate explicit $state.snapshot() extraction and structured schema-validated transfer.","antiPatternHeadline":"Passing $state Reactive Proxies Across Structured Clone Boundaries Causing Clone Failures and State Retainment","stars_count":54,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","web-workers","serialization","hydration","performance"],"exportEndpoints":{"claude":"/api/rules/svelte5-runes-reactive-proxy-serialization-guardrail?format=claude","cursorMdc":"/api/rules/svelte5-runes-reactive-proxy-serialization-guardrail?format=mdc","cursorrules":"/api/rules/svelte5-runes-reactive-proxy-serialization-guardrail?format=cursor","windsurf":"/api/rules/svelte5-runes-reactive-proxy-serialization-guardrail?format=windsurf","agents":"/api/rules/svelte5-runes-reactive-proxy-serialization-guardrail?format=agents"}},{"id":"wasm-component-sharedarraybuffer-zero-leak-standard","title":"Deterministic Teardown and Memory Isolation for SharedArrayBuffer WebAssembly Components","category":"frontend","severity":"critical","description":"Enforces deterministic lifecycle teardown contracts (AsyncDisposable) for WebAssembly Component Model instances backed by SharedArrayBuffer and multi-threaded linear memory. In long-lived single-page applications, uncoordinated garbage collection fails to reclaim SharedArrayBuffer linear allocations and pooled worker memory, leading to browser tab exhaustion and memory leaks.","antiPatternHeadline":"Leaking SharedArrayBuffer allocations and dangling Worker references via non-deterministic GC reliance on Wasm unmount","stars_count":91,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","webassembly","sharedarraybuffer","memory-management","component-model","lifecycle"],"exportEndpoints":{"claude":"/api/rules/wasm-component-sharedarraybuffer-zero-leak-standard?format=claude","cursorMdc":"/api/rules/wasm-component-sharedarraybuffer-zero-leak-standard?format=mdc","cursorrules":"/api/rules/wasm-component-sharedarraybuffer-zero-leak-standard?format=cursor","windsurf":"/api/rules/wasm-component-sharedarraybuffer-zero-leak-standard?format=windsurf","agents":"/api/rules/wasm-component-sharedarraybuffer-zero-leak-standard?format=agents"}},{"id":"pg17-logical-replication-failover-slot-wal-quota","title":"Postgres 17 Logical Failover Slots with Mandatory WAL Quota Boundaries","category":"backend","severity":"critical","description":"Postgres 17 introduces native failover-capable logical replication slots (FAILOVER = true) that synchronize across physical streaming standbys. To prevent catastrophic primary disk exhaustion when subscribers fail or network partitions occur, every logical failover slot provisioning and health-check routine must enforce a non-negotiable max_slot_wal_keep_size boundary paired with reactive invalidation monitoring.","antiPatternHeadline":"Unbounded Logical Failover Slots Retaining Indefinite WAL Logs Causing Primary Node Outages","stars_count":43,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres","replication","high-availability","database-reliability"],"exportEndpoints":{"claude":"/api/rules/pg17-logical-replication-failover-slot-wal-quota?format=claude","cursorMdc":"/api/rules/pg17-logical-replication-failover-slot-wal-quota?format=mdc","cursorrules":"/api/rules/pg17-logical-replication-failover-slot-wal-quota?format=cursor","windsurf":"/api/rules/pg17-logical-replication-failover-slot-wal-quota?format=windsurf","agents":"/api/rules/pg17-logical-replication-failover-slot-wal-quota?format=agents"}},{"id":"axum-0-8-backpressure-streaming-guardrail","title":"Axum 0.8 Backpressure-Bounded Zero-Allocation Streaming Standard","category":"backend","severity":"critical","description":"Mandates strict byte-limit boundaries and end-to-end backpressure propagation across all Axum 0.8 streaming extractors and response pipelines. Prevents catastrophic heap exhaustion, buffer bloat, and slowloris memory DoS vulnerabilities by eliminating unbounded chunk aggregation in Tokio runtimes.","antiPatternHeadline":"Unbounded Request Ingestion and Decoupled Async Stream Buffering","stars_count":84,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tokio","security","dos-prevention","streaming"],"exportEndpoints":{"claude":"/api/rules/axum-0-8-backpressure-streaming-guardrail?format=claude","cursorMdc":"/api/rules/axum-0-8-backpressure-streaming-guardrail?format=mdc","cursorrules":"/api/rules/axum-0-8-backpressure-streaming-guardrail?format=cursor","windsurf":"/api/rules/axum-0-8-backpressure-streaming-guardrail?format=windsurf","agents":"/api/rules/axum-0-8-backpressure-streaming-guardrail?format=agents"}},{"id":"go-124-weak-pointer-cache-reclamation-invariant","title":"Go 1.24 Weak Pointer In-Memory Cache Reclamation and Finalizer Safety","category":"backend","severity":"critical","description":"Go 1.24 introduced native weak pointers via the 'weak' package, enabling GC-cooperative in-memory caches that safely release heap allocations without periodic TTL sweeper overhead. Implementing this pattern requires strict enforcement of dereference validation invariants, avoiding intermediate pointer pinning during cache reads, and preventing phantom memory leaks across concurrent map reads.","antiPatternHeadline":"Unchecked Weak Pointer Dereference and Strong Reference Pinning Inside In-Memory Caches","stars_count":63,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","weak-pointers","garbage-collection","concurrency","performance"],"exportEndpoints":{"claude":"/api/rules/go-124-weak-pointer-cache-reclamation-invariant?format=claude","cursorMdc":"/api/rules/go-124-weak-pointer-cache-reclamation-invariant?format=mdc","cursorrules":"/api/rules/go-124-weak-pointer-cache-reclamation-invariant?format=cursor","windsurf":"/api/rules/go-124-weak-pointer-cache-reclamation-invariant?format=windsurf","agents":"/api/rules/go-124-weak-pointer-cache-reclamation-invariant?format=agents"}},{"id":"kmp-skie-flow-cancellation-swiftui-binding","title":"KMP SKIE Flow-Cancellation-to-SwiftUI-Task Lifecycle Binding","category":"mobile","severity":"critical","description":"Enforces deterministic coroutine cancellation bridging between Touchlab SKIE-generated Swift AsyncSequences and SwiftUI lifecycle tasks. Prevents unmanaged Kotlin coroutine leaks, orphaned background processing, and iOS Darwin dispatcher thread starvation caused by escaping structured concurrency boundaries.","antiPatternHeadline":"Unstructured Flow Collection via Escaped Tasks or onAppear Lifecycle Callbacks","stars_count":65,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kmp","skie","swiftui","kotlin-multiplatform","concurrency","ios"],"exportEndpoints":{"claude":"/api/rules/kmp-skie-flow-cancellation-swiftui-binding?format=claude","cursorMdc":"/api/rules/kmp-skie-flow-cancellation-swiftui-binding?format=mdc","cursorrules":"/api/rules/kmp-skie-flow-cancellation-swiftui-binding?format=cursor","windsurf":"/api/rules/kmp-skie-flow-cancellation-swiftui-binding?format=windsurf","agents":"/api/rules/kmp-skie-flow-cancellation-swiftui-binding?format=agents"}},{"id":"rfc-9449-dpop-ephemeral-nonce-guardrail","title":"RFC 9449 DPoP Ephemeral Proof Nonce-Clamping and Replay Prevention Guardrail","category":"security","severity":"critical","description":"Enforces strict RFC 9449 Demonstrating Proof-of-Possession (DPoP) verification at the API gateway layer. Eliminates distributed token replay attacks by mandating cryptographic thumbprint binding, single-use proof-token jti deduplication via distributed cache, tight clock-skew clamping (max ±5 seconds), and strict ath/htm/htu claims validation.","antiPatternHeadline":"Accepting Unbound Bearer Tokens or Uncached DPoP Proofs with Lenient Clock Skew","stars_count":60,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","dpop","rfc9449","oauth2","jwt","zero-trust","replay-attack"],"exportEndpoints":{"claude":"/api/rules/rfc-9449-dpop-ephemeral-nonce-guardrail?format=claude","cursorMdc":"/api/rules/rfc-9449-dpop-ephemeral-nonce-guardrail?format=mdc","cursorrules":"/api/rules/rfc-9449-dpop-ephemeral-nonce-guardrail?format=cursor","windsurf":"/api/rules/rfc-9449-dpop-ephemeral-nonce-guardrail?format=windsurf","agents":"/api/rules/rfc-9449-dpop-ephemeral-nonce-guardrail?format=agents"}},{"id":"rfc-8693-token-exchange-audience-downscoping","title":"RFC 8693 Token Exchange: Mandatory Audience Downscoping & Actor Verification","category":"security","severity":"critical","description":"Enforces deterministic token downscoping and explicit actor verification via RFC 8693 OAuth 2.0 Token Exchange during east-west service calls. Prevents cross-service privilege escalation, delegation pivot vulnerabilities, and ambient credential pass-through by restricting audience scope and anchoring delegation chains.","antiPatternHeadline":"Raw Token Pass-Through and Broad Audience Propagation in East-West Service Delegation","stars_count":76,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","oauth2","rfc8693","token-exchange","zero-trust","jwt"],"exportEndpoints":{"claude":"/api/rules/rfc-8693-token-exchange-audience-downscoping?format=claude","cursorMdc":"/api/rules/rfc-8693-token-exchange-audience-downscoping?format=mdc","cursorrules":"/api/rules/rfc-8693-token-exchange-audience-downscoping?format=cursor","windsurf":"/api/rules/rfc-8693-token-exchange-audience-downscoping?format=windsurf","agents":"/api/rules/rfc-8693-token-exchange-audience-downscoping?format=agents"}},{"id":"opentelemetry-arrow-columnar-ingestion-standard-opentelemetry-ar-590","title":"OpenTelemetry Arrow Columnar Ingestion Throughput and Zero-Copy Pipeline Standard","category":"devops","severity":"critical","description":"Mandates the deployment of Apache Arrow columnar telemetry encoding across all high-throughput OpenTelemetry collector tiers and edge daemons. Eliminates row-oriented protobuf object allocations to eradicate stop-the-world garbage collection pauses and reduce CPU utilization under high-cardinality telemetry loads.","antiPatternHeadline":"Row-Oriented Protobuf Serialization Flooding Collector Heap and Triggering Fatal GC Stalls","stars_count":73,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","apache-arrow","observability","performance"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-arrow-columnar-ingestion-standard-opentelemetry-ar-590?format=claude","cursorMdc":"/api/rules/opentelemetry-arrow-columnar-ingestion-standard-opentelemetry-ar-590?format=mdc","cursorrules":"/api/rules/opentelemetry-arrow-columnar-ingestion-standard-opentelemetry-ar-590?format=cursor","windsurf":"/api/rules/opentelemetry-arrow-columnar-ingestion-standard-opentelemetry-ar-590?format=windsurf","agents":"/api/rules/opentelemetry-arrow-columnar-ingestion-standard-opentelemetry-ar-590?format=agents"}},{"id":"cilium-ebpf-wireguard-pmtu-clamping-standard","title":"Cilium eBPF Dynamic WireGuard Path-MTU Clamping Invariant","category":"devops","severity":"critical","description":"Enforces deterministic MTU sizing and dynamic TCP MSS clamping at the eBPF layer for WireGuard encrypted multi-cloud meshes. Prevents silent packet drops, ICMP 'Fragmentation Needed' blackholes, and throughput degradation caused by uncalculated encapsulation overhead across cloud VPC fabrics.","antiPatternHeadline":"Blind 1500 MTU Overlay Defaults and Static MSS Configurations Causing Encrypted Packet Drops","stars_count":43,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","cilium","ebpf","wireguard","kubernetes","networking","mtu"],"exportEndpoints":{"claude":"/api/rules/cilium-ebpf-wireguard-pmtu-clamping-standard?format=claude","cursorMdc":"/api/rules/cilium-ebpf-wireguard-pmtu-clamping-standard?format=mdc","cursorrules":"/api/rules/cilium-ebpf-wireguard-pmtu-clamping-standard?format=cursor","windsurf":"/api/rules/cilium-ebpf-wireguard-pmtu-clamping-standard?format=windsurf","agents":"/api/rules/cilium-ebpf-wireguard-pmtu-clamping-standard?format=agents"}},{"id":"react-19-action-optimistic-rollback-standard","title":"React 19 Action Optimistic Rollback and State Synchronization Invariant","category":"frontend","severity":"critical","description":"Enforces deterministic optimistic mutation contracts using React 19 useOptimistic and useActionState primitives. Prevents phantom state desynchronization, stale UI anomalies, and unhandled transition rejections when asynchronous Server Actions fail.","antiPatternHeadline":"Unsynchronized Manual Local State Mutation with Unhandled Server Action Rejections","stars_count":83,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","server-actions","useOptimistic","useActionState","state-management"],"exportEndpoints":{"claude":"/api/rules/react-19-action-optimistic-rollback-standard?format=claude","cursorMdc":"/api/rules/react-19-action-optimistic-rollback-standard?format=mdc","cursorrules":"/api/rules/react-19-action-optimistic-rollback-standard?format=cursor","windsurf":"/api/rules/react-19-action-optimistic-rollback-standard?format=windsurf","agents":"/api/rules/react-19-action-optimistic-rollback-standard?format=agents"}},{"id":"webgpu-compute-worker-memory-barrier-sync","title":"WebGPU Compute Pipeline Memory Barrier & Worker Synchronization Standard","category":"frontend","severity":"critical","description":"Mandates deterministic execution ordering and explicit memory barrier synchronization for multi-stage compute passes and OffscreenCanvas frame transfers across Web Worker threads. Prevents Read-After-Write (RAW) tensor buffer hazards and cross-thread race conditions during client-side local LLM inference by enforcing explicit queue submission fencing, staging buffer lifecycle management, and synchronized buffer mapping.","antiPatternHeadline":"Unfenced Cross-Worker Buffer Re-use and Asynchronous Compute Race Hazards","stars_count":68,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","webgpu","compute-shader","web-workers","concurrency","llm-inference"],"exportEndpoints":{"claude":"/api/rules/webgpu-compute-worker-memory-barrier-sync?format=claude","cursorMdc":"/api/rules/webgpu-compute-worker-memory-barrier-sync?format=mdc","cursorrules":"/api/rules/webgpu-compute-worker-memory-barrier-sync?format=cursor","windsurf":"/api/rules/webgpu-compute-worker-memory-barrier-sync?format=windsurf","agents":"/api/rules/webgpu-compute-worker-memory-barrier-sync?format=agents"}},{"id":"bun-websocket-kernel-backpressure-guardrail","title":"Bun 1.2 Native WebSocket Kernel TCP Backpressure & Drain Invariants","category":"backend","severity":"critical","description":"Enforces mandatory TCP backpressure handling and kernel socket drainage monitoring for Bun 1.2+ native WebSockets. Prevents catastrophic heap exhaustion and silent message dropping under bursty bidirectional workloads by integrating the native drain lifecycle hook and bounded per-socket write queues.","antiPatternHeadline":"Unbounded Fire-and-Forget ws.send() Broadcasting Leading to Kernel Buffer Exhaustion and Heap OOM","stars_count":108,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","websockets","backpressure","concurrency","performance"],"exportEndpoints":{"claude":"/api/rules/bun-websocket-kernel-backpressure-guardrail?format=claude","cursorMdc":"/api/rules/bun-websocket-kernel-backpressure-guardrail?format=mdc","cursorrules":"/api/rules/bun-websocket-kernel-backpressure-guardrail?format=cursor","windsurf":"/api/rules/bun-websocket-kernel-backpressure-guardrail?format=windsurf","agents":"/api/rules/bun-websocket-kernel-backpressure-guardrail?format=agents"}},{"id":"go-chi-http3-zero-rtt-anti-replay-gate","title":"Go Chi HTTP/3 0-RTT Anti-Replay Verification Gate for Mutating Requests","category":"backend","severity":"critical","description":"Enforces strict HTTP/3 QUIC 0-RTT (Early Data) validation invariants within Go Chi routing pipelines to prevent replay attacks on state-mutating operations. Mutating HTTP verbs (POST, PUT, PATCH, DELETE) and unsafe GET endpoints must reject Early Data with HTTP 425 Too Early or require single-use cryptographic token validation before execution. Safe read paths utilizing 0-RTT must be verified strictly idempotent and protected against side-effect leakages.","antiPatternHeadline":"Executing Unvalidated State-Mutating Operations Inside Replayable QUIC 0-RTT Early Data Payloads","stars_count":44,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","chi","http3","quic","zero-rtt","security","anti-replay"],"exportEndpoints":{"claude":"/api/rules/go-chi-http3-zero-rtt-anti-replay-gate?format=claude","cursorMdc":"/api/rules/go-chi-http3-zero-rtt-anti-replay-gate?format=mdc","cursorrules":"/api/rules/go-chi-http3-zero-rtt-anti-replay-gate?format=cursor","windsurf":"/api/rules/go-chi-http3-zero-rtt-anti-replay-gate?format=windsurf","agents":"/api/rules/go-chi-http3-zero-rtt-anti-replay-gate?format=agents"}},{"id":"kmp-room-sqlite-connection-pool-dispatcher-isolation","title":"KMP Room Multiplatform SQLite Connection Pool and Dispatcher Boundary Guardrail","category":"mobile","severity":"critical","description":"Enforces strict asynchronous dispatcher isolation and connection pool boundary configuration across Android and iOS/Darwin runtimes in Room Multiplatform. Prevents catastrophic SQLite lock contention and deadlocks caused by thread-hopping continuation re-entries across Android coroutine thread pools and Darwin Grand Central Dispatch queues during nested transactions.","antiPatternHeadline":"Unconfined Room Query Contexts and Cross-Platform Dispatcher Re-entry in Native SQLite Engines","stars_count":92,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kmp","room","sqlite","coroutines","kotlin-native","darwin"],"exportEndpoints":{"claude":"/api/rules/kmp-room-sqlite-connection-pool-dispatcher-isolation?format=claude","cursorMdc":"/api/rules/kmp-room-sqlite-connection-pool-dispatcher-isolation?format=mdc","cursorrules":"/api/rules/kmp-room-sqlite-connection-pool-dispatcher-isolation?format=cursor","windsurf":"/api/rules/kmp-room-sqlite-connection-pool-dispatcher-isolation?format=windsurf","agents":"/api/rules/kmp-room-sqlite-connection-pool-dispatcher-isolation?format=agents"}},{"id":"webauthn-prf-e2e-key-derivation-standard","title":"Hardware-Anchored PRF Extension Zero-Knowledge Key Derivation Guardrail","category":"security","severity":"critical","description":"Enforces strict cryptographic guarantees when evaluating WebAuthn Pseudo-Random Function (PRF) extensions for client-side zero-knowledge encryption. Guarantees that raw PRF outputs undergo non-extractable HKDF-SHA256 stretching, input salts remain cryptographically isolated and static per-domain, and raw symmetric key material never leaks through network payloads or persistent browser storage.","antiPatternHeadline":"Exposing Unhashed PRF Output or Transmitting Derived Keys to Relying Party Servers","stars_count":73,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","prf-extension","zero-knowledge","cryptography","hkdf","webcrypto"],"exportEndpoints":{"claude":"/api/rules/webauthn-prf-e2e-key-derivation-standard?format=claude","cursorMdc":"/api/rules/webauthn-prf-e2e-key-derivation-standard?format=mdc","cursorrules":"/api/rules/webauthn-prf-e2e-key-derivation-standard?format=cursor","windsurf":"/api/rules/webauthn-prf-e2e-key-derivation-standard?format=windsurf","agents":"/api/rules/webauthn-prf-e2e-key-derivation-standard?format=agents"}},{"id":"wasi-02-capability-grant-isolation-standard","title":"WASI 0.2 Component Model Link-Time Capability Isolation and Sandboxing","category":"security","severity":"critical","description":"WASI 0.2 mandates strict capability-based security where guest WebAssembly components have zero ambient access to host resources by default. Host runtimes executing untrusted multi-tenant plugins must explicitly instantiate isolated capability contexts (WasiCtx), denying ambient host network, filesystem, and environment inheritance at link time. Sandboxes must only bind least-privilege virtualized capabilities or stubbed interfaces through explicit Linker contracts.","antiPatternHeadline":"Ambient Capability Inheritance Exposing Host Filesystem and Sockets to Untrusted Components","stars_count":113,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","wasi","webassembly","component-model","sandboxing","rust"],"exportEndpoints":{"claude":"/api/rules/wasi-02-capability-grant-isolation-standard?format=claude","cursorMdc":"/api/rules/wasi-02-capability-grant-isolation-standard?format=mdc","cursorrules":"/api/rules/wasi-02-capability-grant-isolation-standard?format=cursor","windsurf":"/api/rules/wasi-02-capability-grant-isolation-standard?format=windsurf","agents":"/api/rules/wasi-02-capability-grant-isolation-standard?format=agents"}},{"id":"k8s-in-place-pod-resize-cgroupv2-memory-headroom-invariant","title":"Kubernetes In-Place Pod Resize cgroup-v2 Memory Buffer Headroom Invariant","category":"devops","severity":"critical","description":"When leveraging Kubernetes In-Place Pod Vertical Scaling (KEP-1287), dynamic adjustments to pod resource limits directly mutate cgroup-v2 memory controllers (memory.max, memory.high) without container restarts. Engineers must enforce a calculated memory buffer headroom and sequencing invariant during downscaling and upscaling to prevent kernel OOM-killer invocations caused by dirty page reclaim latency, page cache pressure, and memory allocation races under high load.","antiPatternHeadline":"Immediate memory downscaling or tight-bound resizing that collapses cgroup-v2 memory.max below working set plus dirty page buffers, triggering instantaneous kernel OOM kills.","stars_count":55,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","kubernetes","cgroups-v2","resource-management","in-place-resize","memory-headroom"],"exportEndpoints":{"claude":"/api/rules/k8s-in-place-pod-resize-cgroupv2-memory-headroom-invariant?format=claude","cursorMdc":"/api/rules/k8s-in-place-pod-resize-cgroupv2-memory-headroom-invariant?format=mdc","cursorrules":"/api/rules/k8s-in-place-pod-resize-cgroupv2-memory-headroom-invariant?format=cursor","windsurf":"/api/rules/k8s-in-place-pod-resize-cgroupv2-memory-headroom-invariant?format=windsurf","agents":"/api/rules/k8s-in-place-pod-resize-cgroupv2-memory-headroom-invariant?format=agents"}},{"id":"fastapi-anyio-lifespan-cancellation-boundary","title":"FastAPI AnyIO Lifespan Cancellation and Pool Teardown Boundary","category":"backend","severity":"critical","description":"FastAPI background workers and database pool acquisitions must be strictly anchored to an explicit AnyIO task group within the application lifespan boundary. Unsupervised coroutines and unshielded pool disposal cause worker deadlocks and connection leaks during pod SIGTERM teardown, resulting in hard kills by the container runtime.","antiPatternHeadline":"Spawning Unmanaged Background Coroutines and Executing Unshielded Pool Teardown in Lifespan Contexts","stars_count":64,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["fastapi","anyio","asyncio","sqlalchemy","asyncpg","lifespan","pod-lifecycle"],"exportEndpoints":{"claude":"/api/rules/fastapi-anyio-lifespan-cancellation-boundary?format=claude","cursorMdc":"/api/rules/fastapi-anyio-lifespan-cancellation-boundary?format=mdc","cursorrules":"/api/rules/fastapi-anyio-lifespan-cancellation-boundary?format=cursor","windsurf":"/api/rules/fastapi-anyio-lifespan-cancellation-boundary?format=windsurf","agents":"/api/rules/fastapi-anyio-lifespan-cancellation-boundary?format=agents"}},{"id":"openfga-rebac-zero-check-cache-invalidation-barrier","title":"OpenFGA ReBAC Transactional Outbox & Invalidation Barrier","category":"security","severity":"critical","description":"Enforces dual-write prevention and cache-invalidation barriers when mutating domain entities alongside OpenFGA relationship tuples. Mandates that OpenFGA tuple updates and local read-cache evictions execute strictly via transactional outbox or Change Data Capture (CDC) pipelines to prevent stale authorization decisions and 'new enemy' security vulnerabilities.","antiPatternHeadline":"Dual-Writing to Domain DB and OpenFGA API with Asynchronous Uncoordinated Cache Invalidation","stars_count":62,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","rebac","authorization","zanzibar","cache-invalidation","transactional-outbox"],"exportEndpoints":{"claude":"/api/rules/openfga-rebac-zero-check-cache-invalidation-barrier?format=claude","cursorMdc":"/api/rules/openfga-rebac-zero-check-cache-invalidation-barrier?format=mdc","cursorrules":"/api/rules/openfga-rebac-zero-check-cache-invalidation-barrier?format=cursor","windsurf":"/api/rules/openfga-rebac-zero-check-cache-invalidation-barrier?format=windsurf","agents":"/api/rules/openfga-rebac-zero-check-cache-invalidation-barrier?format=agents"}},{"id":"pg17-json-table-workmem-ceiling-invariant","title":"PostgreSQL 17 SQL/JSON JSON_TABLE WorkMem Ceiling Invariant","category":"backend","severity":"critical","description":"Enforces deterministic memory bounds and streaming execution semantics when evaluating PostgreSQL 17 native SQL/JSON operators (JSON_TABLE, JSON_QUERY, JSON_VALUE) over high-cardinality nested structures. Prevents backend worker Out-Of-Memory (OOM) panics by mandating transaction-local work_mem ceilings, explicit data type projections with byte-bounded VARCHAR limits, and streaming chunk-based batching.","antiPatternHeadline":"Unbounded JSON_TABLE materialization inside default sessions triggering backend worker OOM kills","stars_count":91,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","sql-json","json-table","performance","database","memory-management"],"exportEndpoints":{"claude":"/api/rules/pg17-json-table-workmem-ceiling-invariant?format=claude","cursorMdc":"/api/rules/pg17-json-table-workmem-ceiling-invariant?format=mdc","cursorrules":"/api/rules/pg17-json-table-workmem-ceiling-invariant?format=cursor","windsurf":"/api/rules/pg17-json-table-workmem-ceiling-invariant?format=windsurf","agents":"/api/rules/pg17-json-table-workmem-ceiling-invariant?format=agents"}},{"id":"nextjs-15-client-segment-cache-crypto-tag-pinning","title":"Next.js 15 Client Router Segment Cache Cryptographic Tag Pinning Standard","category":"frontend","severity":"critical","description":"Enforces cryptographic deployment revision tag pinning for Next.js 15 App Router client-side segment cache payloads during zero-downtime rolling deployments. Prevents hydration skew, chunk execution crashes, and stale React Server Component (RSC) tree stitching by deterministically invalidating client router memory upon server release divergence.","antiPatternHeadline":"Unpinned Client Segment Prefetching Causing Hydration Skew and Action Desync During Rolling Deploys","stars_count":106,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs15","rsc","router-cache","zero-downtime","deployment-pinning"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-client-segment-cache-crypto-tag-pinning?format=claude","cursorMdc":"/api/rules/nextjs-15-client-segment-cache-crypto-tag-pinning?format=mdc","cursorrules":"/api/rules/nextjs-15-client-segment-cache-crypto-tag-pinning?format=cursor","windsurf":"/api/rules/nextjs-15-client-segment-cache-crypto-tag-pinning?format=windsurf","agents":"/api/rules/nextjs-15-client-segment-cache-crypto-tag-pinning?format=agents"}},{"id":"tauri-2-mobile-core-thread-affinity-guardrail","title":"Tauri 2.0 Mobile Cross-Runtime Thread Affinity & UI Loop Isolation","category":"mobile","severity":"critical","description":"Enforces strict thread-affinity boundaries between native mobile UI threads (Android Main Looper / iOS Main RunLoop) and Tauri 2.0's Rust Tokio runtime. Prevents catastrophic frame hitches, Choreographer dropped frame warnings, and CADisplayLink pipeline stalls by mandating asynchronous bridge execution, non-blocking IPC batching, and off-main-thread FFI marshaling.","antiPatternHeadline":"Executing synchronous Rust FFI operations or unbounded Tauri IPC calls directly within native UI gesture and render lifecycles.","stars_count":100,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri-2","rust","android","ios","performance","choreographer","cadisplaylink"],"exportEndpoints":{"claude":"/api/rules/tauri-2-mobile-core-thread-affinity-guardrail?format=claude","cursorMdc":"/api/rules/tauri-2-mobile-core-thread-affinity-guardrail?format=mdc","cursorrules":"/api/rules/tauri-2-mobile-core-thread-affinity-guardrail?format=cursor","windsurf":"/api/rules/tauri-2-mobile-core-thread-affinity-guardrail?format=windsurf","agents":"/api/rules/tauri-2-mobile-core-thread-affinity-guardrail?format=agents"}},{"id":"tetragon-ebpf-cpu-governor-guardrail","title":"Cilium Tetragon eBPF Host-Level Kernel CPU and Cache Budget Governor","category":"devops","severity":"critical","description":"Enforces strict host-level CPU and L3 cache overhead governance for Cilium Tetragon eBPF tracing programs. Prevents kernel-space telemetry runaway and soft lockups by dynamically throttling, degrading tracing resolution, or detaching non-essential kprobes/tracepoints when host resource budgets breach safety thresholds.","antiPatternHeadline":"Unbounded kernel tracing triggers CPU starvation, ring buffer drops, and node instability under heavy syscall workloads.","stars_count":59,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","cilium","tetragon","observability","kernel-security","performance"],"exportEndpoints":{"claude":"/api/rules/tetragon-ebpf-cpu-governor-guardrail?format=claude","cursorMdc":"/api/rules/tetragon-ebpf-cpu-governor-guardrail?format=mdc","cursorrules":"/api/rules/tetragon-ebpf-cpu-governor-guardrail?format=cursor","windsurf":"/api/rules/tetragon-ebpf-cpu-governor-guardrail?format=windsurf","agents":"/api/rules/tetragon-ebpf-cpu-governor-guardrail?format=agents"}},{"id":"kmp-atomicfu-memory-ordering-guardrail","title":"Kotlin Multiplatform 2.1 AtomicFU Lock-Free Memory Ordering Invariant","category":"mobile","severity":"critical","description":"Enforces strict memory ordering and publication safety invariants in Kotlin Multiplatform 2.1 lock-free data structures using AtomicFU. Prevents silent ARM64 weak memory model instruction reordering and stale cache line visibility issues across iOS Native and Android runtimes.","antiPatternHeadline":"Non-Atomic Shared Mutable State and Plain Reads Bypassing AtomicFU Memory Fences on Weakly-Ordered ARM64 Architectures","stars_count":102,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","atomicfu","concurrency","lock-free","memory-model"],"exportEndpoints":{"claude":"/api/rules/kmp-atomicfu-memory-ordering-guardrail?format=claude","cursorMdc":"/api/rules/kmp-atomicfu-memory-ordering-guardrail?format=mdc","cursorrules":"/api/rules/kmp-atomicfu-memory-ordering-guardrail?format=cursor","windsurf":"/api/rules/kmp-atomicfu-memory-ordering-guardrail?format=windsurf","agents":"/api/rules/kmp-atomicfu-memory-ordering-guardrail?format=agents"}},{"id":"bun-native-ffi-cabi-memory-ownership","title":"Bun 1.2 Native FFI C-ABI Off-Heap Memory Ownership Protocol","category":"backend","severity":"critical","description":"Enforces deterministic lifecycle management and strict single-owner semantics for off-heap native memory allocated via Bun 1.2 FFI. Eliminates silent use-after-free segmentation faults and off-heap RSS memory exhaustion when high-throughput event loops interface with native C/Rust shared libraries. Mandates TC39 Explicit Resource Management alongside FinalizationRegistry fail-safes for non-trivial native allocations.","antiPatternHeadline":"Unmanaged C-Allocated Pointers Exposed Directly to JavaScript Event Loop Contexts Without Deterministic Deallocation Lifecycles","stars_count":73,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","ffi","memory-management","c-abi","systems-programming"],"exportEndpoints":{"claude":"/api/rules/bun-native-ffi-cabi-memory-ownership?format=claude","cursorMdc":"/api/rules/bun-native-ffi-cabi-memory-ownership?format=mdc","cursorrules":"/api/rules/bun-native-ffi-cabi-memory-ownership?format=cursor","windsurf":"/api/rules/bun-native-ffi-cabi-memory-ownership?format=windsurf","agents":"/api/rules/bun-native-ffi-cabi-memory-ownership?format=agents"}},{"id":"webauthn-prf-hardware-key-derivation-security","title":"FIDO2 WebAuthn PRF Hardware-Bound Key Derivation Standard","category":"security","severity":"critical","description":"Mandates cryptographically sound implementation of WebAuthn Pseudo-Random Function (PRF) extension for client-side zero-knowledge encryption key derivation. Prohibits direct usage of raw PRF outputs as symmetric keys, enforces mandatory biometric/PIN user verification ('required'), and guarantees domain-separated HKDF expansion with ephemeral memory zeroization.","antiPatternHeadline":"Direct use of raw PRF outputs as AES keys without HKDF expansion, lax user verification, or unverified extension support.","stars_count":110,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","fido2","prf-extension","zero-knowledge","hkdf","cryptography"],"exportEndpoints":{"claude":"/api/rules/webauthn-prf-hardware-key-derivation-security?format=claude","cursorMdc":"/api/rules/webauthn-prf-hardware-key-derivation-security?format=mdc","cursorrules":"/api/rules/webauthn-prf-hardware-key-derivation-security?format=cursor","windsurf":"/api/rules/webauthn-prf-hardware-key-derivation-security?format=windsurf","agents":"/api/rules/webauthn-prf-hardware-key-derivation-security?format=agents"}},{"id":"otel-span-attribute-cardinality-governor","title":"OpenTelemetry In-Process Span Attribute Cardinality Governor","category":"devops","severity":"critical","description":"Enforces pre-export filtering and sanitization of dynamic OpenTelemetry span attributes directly within the in-process SDK boundary. Prevents downstream TSDB (e.g., Prometheus, Cortex, ClickHouse, Mimir) index exhaustion caused by unbounded dynamic values like raw UUIDs, timestamps, and unrestricted user input injected as metric labels or indexed span attributes.","antiPatternHeadline":"Unchecked dynamic values injected as high-cardinality span attributes causing downstream TSDB/APM ingest OOM and indexing death","stars_count":107,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","observability","cardinality","tracing","performance"],"exportEndpoints":{"claude":"/api/rules/otel-span-attribute-cardinality-governor?format=claude","cursorMdc":"/api/rules/otel-span-attribute-cardinality-governor?format=mdc","cursorrules":"/api/rules/otel-span-attribute-cardinality-governor?format=cursor","windsurf":"/api/rules/otel-span-attribute-cardinality-governor?format=windsurf","agents":"/api/rules/otel-span-attribute-cardinality-governor?format=agents"}},{"id":"react-19-activity-hydration-deferral-guardrail","title":"React 19 Activity Hydration Deferral and Layout Budget Guardrail","category":"frontend","severity":"critical","description":"Enforces deferred hydration and execution suppression for inactive view trees and off-screen panels using React 19 Activity boundaries. Prevents synchronous layout effect cascades, DOM measurement thrashing, and main-thread budget depletion during concurrent server transitions.","antiPatternHeadline":"Eager Mounting and Synchronous Layout Thrashing in Hidden View Panes During Concurrent Transitions","stars_count":100,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","activity","hydration","suspense","performance","web-vitals"],"exportEndpoints":{"claude":"/api/rules/react-19-activity-hydration-deferral-guardrail?format=claude","cursorMdc":"/api/rules/react-19-activity-hydration-deferral-guardrail?format=mdc","cursorrules":"/api/rules/react-19-activity-hydration-deferral-guardrail?format=cursor","windsurf":"/api/rules/react-19-activity-hydration-deferral-guardrail?format=windsurf","agents":"/api/rules/react-19-activity-hydration-deferral-guardrail?format=agents"}},{"id":"vite-6-rolldown-chunk-tree-shaking-isolation-standard","title":"Vite 6 & Rolldown Module Tree-Shaking and Edge SSR Side-Effect Isolation Standard","category":"frontend","severity":"critical","description":"Mandates absolute module-level side-effect isolation for Vite 6 Rolldown-native edge SSR compilation to guarantee deterministic sub-50ms cold-start execution. Eliminates module-scope object allocations, un-annotated global initializations, and barrel-file side-effect leaks that destabilize tree-shaking boundaries in isolated V8 edge runtimes.","antiPatternHeadline":"Eager Module-Scope Instantiation and Leaky Dynamic Imports in Edge SSR Runtimes","stars_count":86,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","vite6","rolldown","ssr","tree-shaking","performance"],"exportEndpoints":{"claude":"/api/rules/vite-6-rolldown-chunk-tree-shaking-isolation-standard?format=claude","cursorMdc":"/api/rules/vite-6-rolldown-chunk-tree-shaking-isolation-standard?format=mdc","cursorrules":"/api/rules/vite-6-rolldown-chunk-tree-shaking-isolation-standard?format=cursor","windsurf":"/api/rules/vite-6-rolldown-chunk-tree-shaking-isolation-standard?format=windsurf","agents":"/api/rules/vite-6-rolldown-chunk-tree-shaking-isolation-standard?format=agents"}},{"id":"pg17-logical-replication-failover-slot-sync-postgres-17-logi-490","title":"Postgres 17 Logical Replication Failover Slot Synchronization Guardrail","category":"backend","severity":"critical","description":"Enforces strict failover safety for Change Data Capture (CDC) pipelines leveraging PostgreSQL 17 logical replication. Mandates the configuration of failover-enabled logical slots on the primary, synchronized slots on physical standbys via synchronized_standby_slots, and validation of confirmed_flush_lsn boundaries prior to promoting standbys, preventing silent data duplication or permanent data loss during HA cutovers.","antiPatternHeadline":"Unsynchronized Logical Replication Slots During Physical Standby Failover Causing CDC Stream Invalidation or Data Loss","stars_count":101,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["postgresql-17","logical-replication","cdc","high-availability","data-engineering","database-reliability"],"exportEndpoints":{"claude":"/api/rules/pg17-logical-replication-failover-slot-sync-postgres-17-logi-490?format=claude","cursorMdc":"/api/rules/pg17-logical-replication-failover-slot-sync-postgres-17-logi-490?format=mdc","cursorrules":"/api/rules/pg17-logical-replication-failover-slot-sync-postgres-17-logi-490?format=cursor","windsurf":"/api/rules/pg17-logical-replication-failover-slot-sync-postgres-17-logi-490?format=windsurf","agents":"/api/rules/pg17-logical-replication-failover-slot-sync-postgres-17-logi-490?format=agents"}},{"id":"fastapi-async-lifespan-deterministic-drain-standard","title":"FastAPI Async Lifespan Deterministic Connection Pool Drain Standard","category":"backend","severity":"critical","description":"Enforces deterministic cancellation tokens and socket draining across async HTTP and database client pools during FastAPI ASGI lifespan shutdown. Guarantees in-flight transactions finish within bounded grace periods and prevents socket leakage and RST dropouts during rolling Kubernetes pod evictions.","antiPatternHeadline":"Leaking sockets and severing active transactions via uncoordinated async pool teardown on SIGTERM","stars_count":66,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","asyncio","uvicorn","connection-pooling","kubernetes"],"exportEndpoints":{"claude":"/api/rules/fastapi-async-lifespan-deterministic-drain-standard?format=claude","cursorMdc":"/api/rules/fastapi-async-lifespan-deterministic-drain-standard?format=mdc","cursorrules":"/api/rules/fastapi-async-lifespan-deterministic-drain-standard?format=cursor","windsurf":"/api/rules/fastapi-async-lifespan-deterministic-drain-standard?format=windsurf","agents":"/api/rules/fastapi-async-lifespan-deterministic-drain-standard?format=agents"}},{"id":"bun-websocket-native-backpressure-invariant","title":"Bun 1.2 Native WebSocket Backpressure & High-Watermark Guardrail","category":"backend","severity":"critical","description":"Enforces strict handling of native backpressure in Bun WebSocket servers during high-concurrency fan-out operations. Failing to check the return byte count of `ws.send()` causes unconstrained native buffer allocations in the underlying uSockets/JSC runtime, leading to silent memory leaks and process termination under load.","antiPatternHeadline":"Unchecked `ws.send()` or `ws.publish()` fan-out causing native uSockets buffer inflation and unmitigated OOM kills","stars_count":42,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","websockets","backpressure","memory-management","concurrency"],"exportEndpoints":{"claude":"/api/rules/bun-websocket-native-backpressure-invariant?format=claude","cursorMdc":"/api/rules/bun-websocket-native-backpressure-invariant?format=mdc","cursorrules":"/api/rules/bun-websocket-native-backpressure-invariant?format=cursor","windsurf":"/api/rules/bun-websocket-native-backpressure-invariant?format=windsurf","agents":"/api/rules/bun-websocket-native-backpressure-invariant?format=agents"}},{"id":"kmp-darwin-arc-gc-boundary-leak-guardrail","title":"Kotlin Native Darwin GC and Apple ARC Interop Boundary Leak & Deadlock Guardrail","category":"mobile","severity":"critical","description":"Prevents catastrophic cross-runtime retain cycles and interop deadlocks across Kotlin/Native Garbage Collector and Apple Automatic Reference Counting (ARC). Mandates explicit cancellation of cross-boundary state observers, safe disposal of StableRef wrappers, and non-blocking asynchronous cleanup during Darwin object deallocation.","antiPatternHeadline":"Cross-Runtime Retain Cycles and Synchronous Interop Deallocation Deadlocks","stars_count":114,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","swift","darwin","arc","memory-management","concurrency"],"exportEndpoints":{"claude":"/api/rules/kmp-darwin-arc-gc-boundary-leak-guardrail?format=claude","cursorMdc":"/api/rules/kmp-darwin-arc-gc-boundary-leak-guardrail?format=mdc","cursorrules":"/api/rules/kmp-darwin-arc-gc-boundary-leak-guardrail?format=cursor","windsurf":"/api/rules/kmp-darwin-arc-gc-boundary-leak-guardrail?format=windsurf","agents":"/api/rules/kmp-darwin-arc-gc-boundary-leak-guardrail?format=agents"}},{"id":"tauri2-granular-capability-acl-ipc-guardrail","title":"Tauri 2.0 Least-Privilege Capability ACL & IPC Boundary Enforcement","category":"mobile","severity":"critical","description":"Enforces granular, least-privilege capability manifests and strict IPC boundary isolation for Tauri 2.0 mobile and desktop targets. Prohibits global command wildcards, unconstrained shell execution, and ambient native API access from untrusted or dynamically loaded webview contexts.","antiPatternHeadline":"Exposing Wildcard Shell and Native OS Primitives to Client Webviews via Permissive Tauri 2.0 Capability Manifests","stars_count":119,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri-2","security","ipc","acl","capabilities"],"exportEndpoints":{"claude":"/api/rules/tauri2-granular-capability-acl-ipc-guardrail?format=claude","cursorMdc":"/api/rules/tauri2-granular-capability-acl-ipc-guardrail?format=mdc","cursorrules":"/api/rules/tauri2-granular-capability-acl-ipc-guardrail?format=cursor","windsurf":"/api/rules/tauri2-granular-capability-acl-ipc-guardrail?format=windsurf","agents":"/api/rules/tauri2-granular-capability-acl-ipc-guardrail?format=agents"}},{"id":"spiffe-spire-cgroupv2-attestation-production-standard","title":"SPIFFE/SPIRE Linux Cgroup v2 Kernel Workload Attestation Guardrail","category":"security","severity":"critical","description":"Enforces kernel-level Cgroup v2 workload attestation across SPIRE agents and SPIFFE workload API endpoints, eliminating time-of-check to time-of-use (TOCTOU) and PID recycling race conditions inherent in naive Unix domain socket SO_PEERCRED lookups. Mandates the use of the unified cgroup v2 hierarchy, 64-bit cgroup ID verification via kernel file handles, and process start-time validation to prevent container workload impersonation.","antiPatternHeadline":"Relying on Unverified SO_PEERCRED PID Lookups and Ephemeral /proc Tree Traversal Subject to PID Recycling Attacks","stars_count":110,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","spiffe","spire","cgroups-v2","workload-identity","zero-trust","linux-kernel"],"exportEndpoints":{"claude":"/api/rules/spiffe-spire-cgroupv2-attestation-production-standard?format=claude","cursorMdc":"/api/rules/spiffe-spire-cgroupv2-attestation-production-standard?format=mdc","cursorrules":"/api/rules/spiffe-spire-cgroupv2-attestation-production-standard?format=cursor","windsurf":"/api/rules/spiffe-spire-cgroupv2-attestation-production-standard?format=windsurf","agents":"/api/rules/spiffe-spire-cgroupv2-attestation-production-standard?format=agents"}},{"id":"cilium-ebpf-sockops-zero-trust-identity-standard","title":"Cilium eBPF Socket-Layer Acceleration & Cryptographic Mutual Identity Guardrail","category":"security","severity":"critical","description":"Enforces strict cryptographic pod-to-pod identity authentication via Cilium Network Policies decoupled from data-path forwarding, utilizing Linux eBPF sockops programs for socket-level short-circuiting. Eliminates unauthenticated label-only trust models and sidecar proxy CPU/latency overhead by mandating control-plane mutual handshake validation with socket-layer kernel redirection.","antiPatternHeadline":"Relying on Unauthenticated IP/Label Whitelisting and User-Space Sidecar Proxies Instead of In-Kernel Socket Acceleration and Mutual Identity Verification","stars_count":46,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","cilium","ebpf","zero-trust","kubernetes","spire","networking"],"exportEndpoints":{"claude":"/api/rules/cilium-ebpf-sockops-zero-trust-identity-standard?format=claude","cursorMdc":"/api/rules/cilium-ebpf-sockops-zero-trust-identity-standard?format=mdc","cursorrules":"/api/rules/cilium-ebpf-sockops-zero-trust-identity-standard?format=cursor","windsurf":"/api/rules/cilium-ebpf-sockops-zero-trust-identity-standard?format=windsurf","agents":"/api/rules/cilium-ebpf-sockops-zero-trust-identity-standard?format=agents"}},{"id":"otel-baggage-cardinality-tail-sampling-guardrail","title":"OpenTelemetry W3C Baggage Cardinality Throttling & Tail Sampling Invariants","category":"devops","severity":"critical","description":"Enforces strict byte budgets and high-entropy key filtering for W3C Baggage propagation at API gateways and service boundaries. Prevents metric cardinality explosions and downstream telemetry storage exhaustion by mandating allowlist validation and tail-sampling retention policies before traces enter collector pipelines.","antiPatternHeadline":"Unbounded W3C Baggage Propagation Causing TSDB Cardinality Explosion and Tail-Sampling Eviction","stars_count":82,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","observability","distributed-tracing","cardinality","tail-sampling"],"exportEndpoints":{"claude":"/api/rules/otel-baggage-cardinality-tail-sampling-guardrail?format=claude","cursorMdc":"/api/rules/otel-baggage-cardinality-tail-sampling-guardrail?format=mdc","cursorrules":"/api/rules/otel-baggage-cardinality-tail-sampling-guardrail?format=cursor","windsurf":"/api/rules/otel-baggage-cardinality-tail-sampling-guardrail?format=windsurf","agents":"/api/rules/otel-baggage-cardinality-tail-sampling-guardrail?format=agents"}},{"id":"react-19-async-hydration-promise-dedupe","title":"React 19 Async Resource Hydration & Promise De-duplication Standard","category":"frontend","severity":"critical","description":"Mandates deterministic microtask de-duplication and memory eviction for async resources unwrapped via React 19's `use()` API. Enforces request-scoped cache boundaries and WeakMap-backed promise registries to prevent infinite suspension loops and server memory leaks during concurrent streaming hydration.","antiPatternHeadline":"Instantiating Uncached Promises in Render or Using Unbounded Global Caches with use()","stars_count":109,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","use-api","streaming-hydration","memory-leaks","promise-deduplication"],"exportEndpoints":{"claude":"/api/rules/react-19-async-hydration-promise-dedupe?format=claude","cursorMdc":"/api/rules/react-19-async-hydration-promise-dedupe?format=mdc","cursorrules":"/api/rules/react-19-async-hydration-promise-dedupe?format=cursor","windsurf":"/api/rules/react-19-async-hydration-promise-dedupe?format=windsurf","agents":"/api/rules/react-19-async-hydration-promise-dedupe?format=agents"}},{"id":"nextjs-15-multitenant-cache-fencing","title":"Next.js 15 Multi-Tenant Cache Key Fencing & Stale Lifecycle Invariants","category":"frontend","severity":"critical","description":"Enforces cryptographically isolated cache namespaces and deterministic cacheLife profiles when utilizing Next.js 15's 'use cache' directive in multi-tenant environments. Prevents cross-tenant data exfiltration and stale cache bleeding across Edge and CDN runtimes by requiring tenant-isolated cacheTag prefixes and bounded invalidation lifecycles.","antiPatternHeadline":"Global Unpartitioned 'use cache' Directives Causing Multi-Tenant Cache Bleeding and Unbounded Staleness","stars_count":46,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs15","use-cache","cache-life","multi-tenancy","cache-poisoning","edge-computing"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-multitenant-cache-fencing?format=claude","cursorMdc":"/api/rules/nextjs-15-multitenant-cache-fencing?format=mdc","cursorrules":"/api/rules/nextjs-15-multitenant-cache-fencing?format=cursor","windsurf":"/api/rules/nextjs-15-multitenant-cache-fencing?format=windsurf","agents":"/api/rules/nextjs-15-multitenant-cache-fencing?format=agents"}},{"id":"axum-graceful-drain-websocket-fencing","title":"Axum 0.8 Tower Graceful Connection Drain & WebSocket Handshake Fencing","category":"backend","severity":"critical","description":"Enforces deterministic zero-downtime rolling deploys in Axum 0.8 by decoupling TCP connection draining from stateful HTTP upgrade handshakes. Mandates an atomic handshake fence to reject new WebSocket upgrades with 503 during shutdown, alongside bounded dual-phase horizons that dispatch RFC 6455 1001 Close frames to active sessions before hyper socket termination.","antiPatternHeadline":"Unbounded WebSocket Upgrades Stalling Axum Graceful Drains and Causing SIGKILL Dropped Frames","stars_count":87,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tower","websockets","graceful-shutdown","zero-downtime"],"exportEndpoints":{"claude":"/api/rules/axum-graceful-drain-websocket-fencing?format=claude","cursorMdc":"/api/rules/axum-graceful-drain-websocket-fencing?format=mdc","cursorrules":"/api/rules/axum-graceful-drain-websocket-fencing?format=cursor","windsurf":"/api/rules/axum-graceful-drain-websocket-fencing?format=windsurf","agents":"/api/rules/axum-graceful-drain-websocket-fencing?format=agents"}},{"id":"go-chi-http3-zero-rtt-anti-replay-fencing","title":"Go Chi HTTP/3 0-RTT Anti-Replay Session Ticket Fencing","category":"backend","severity":"critical","description":"Enforces distributed anti-replay validation for HTTP/3 0-RTT (Early Data) across multi-node Go Chi edge deployments. Protects against TLS 1.3 replay attacks by gating early data behind synchronized monotonic timestamp windows, strict HTTP method idempotency enforcement, and atomic single-use ticket reservation backed by a distributed key-value store.","antiPatternHeadline":"Unvalidated 0-RTT Early Data Processing on Non-Idempotent Endpoints Enabling Multi-Node Replay Attacks","stars_count":51,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","chi","http3","quic","anti-replay","zero-rtt","tls13"],"exportEndpoints":{"claude":"/api/rules/go-chi-http3-zero-rtt-anti-replay-fencing?format=claude","cursorMdc":"/api/rules/go-chi-http3-zero-rtt-anti-replay-fencing?format=mdc","cursorrules":"/api/rules/go-chi-http3-zero-rtt-anti-replay-fencing?format=cursor","windsurf":"/api/rules/go-chi-http3-zero-rtt-anti-replay-fencing?format=windsurf","agents":"/api/rules/go-chi-http3-zero-rtt-anti-replay-fencing?format=agents"}},{"id":"bun-sqlite-wal2-checkpoint-starvation-backpressure","title":"Bun 1.2 SQLite WAL2 Auto-Checkpoint Starvation Mitigation","category":"backend","severity":"critical","description":"Enforces cooperative backpressure and explicit frame threshold throttling on embedded SQLite (WAL/WAL2 mode) under Bun 1.2. Prevents unbounded disk bloat and severe read latency degradation caused by high-concurrency write loops starving background checkpoint threads.","antiPatternHeadline":"Unbounded Concurrent Write Loops Starving WAL Checkpoints and Causing Frame Bloat","stars_count":92,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","sqlite","wal2","concurrency","performance","storage"],"exportEndpoints":{"claude":"/api/rules/bun-sqlite-wal2-checkpoint-starvation-backpressure?format=claude","cursorMdc":"/api/rules/bun-sqlite-wal2-checkpoint-starvation-backpressure?format=mdc","cursorrules":"/api/rules/bun-sqlite-wal2-checkpoint-starvation-backpressure?format=cursor","windsurf":"/api/rules/bun-sqlite-wal2-checkpoint-starvation-backpressure?format=windsurf","agents":"/api/rules/bun-sqlite-wal2-checkpoint-starvation-backpressure?format=agents"}},{"id":"compose-skiko-metal-render-synchronization-standard","title":"Compose Multiplatform SKIKO Metal Render-Thread CADisplayLink Synchronization Standard","category":"mobile","severity":"critical","description":"Mandates deterministic vsync synchronization between Apple Metal command buffers in SKIKO and UIKit run loops using CADisplayLink. Enforces strict frame-pacing and buffer locks to eliminate visual tearing and render-thread contention across native interoperability boundaries.","antiPatternHeadline":"Unsynchronized Main-Thread Render Loops and Ad-Hoc Timers Leading to Metal Buffer Contention and Frame Tearing","stars_count":45,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","compose-multiplatform","skiko","metal","ios","rendering","cadisplaylink"],"exportEndpoints":{"claude":"/api/rules/compose-skiko-metal-render-synchronization-standard?format=claude","cursorMdc":"/api/rules/compose-skiko-metal-render-synchronization-standard?format=mdc","cursorrules":"/api/rules/compose-skiko-metal-render-synchronization-standard?format=cursor","windsurf":"/api/rules/compose-skiko-metal-render-synchronization-standard?format=windsurf","agents":"/api/rules/compose-skiko-metal-render-synchronization-standard?format=agents"}},{"id":"webauthn-prf-zk-key-derivation-enclave-standard","title":"WebAuthn PRF Zero-Knowledge Key Derivation & Enclave Isolation Standard","category":"security","severity":"critical","description":"Enforces hardware-bound client-side symmetric key derivation via the WebAuthn Pseudo-Random Function (PRF) extension for end-to-end encrypted vaults. Guarantees that derived cryptographic secrets and PRF outputs never leave the client enclave, remain non-extractable within the Web Cryptography API, and are never transmitted to application servers or persisted to unencrypted client storage.","antiPatternHeadline":"Leaking PRF outputs to application backends or persisting derived master keys in extractable client storage","stars_count":43,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","prf-extension","zero-knowledge","webcrypto","e2ee"],"exportEndpoints":{"claude":"/api/rules/webauthn-prf-zk-key-derivation-enclave-standard?format=claude","cursorMdc":"/api/rules/webauthn-prf-zk-key-derivation-enclave-standard?format=mdc","cursorrules":"/api/rules/webauthn-prf-zk-key-derivation-enclave-standard?format=cursor","windsurf":"/api/rules/webauthn-prf-zk-key-derivation-enclave-standard?format=windsurf","agents":"/api/rules/webauthn-prf-zk-key-derivation-enclave-standard?format=agents"}},{"id":"openfga-contextual-tuple-boundary-validation","title":"OpenFGA Dynamic Contextual Tuple Ingestion Boundary Validation & Anti-Escalation Guardrail","category":"security","severity":"critical","description":"Restricts ephemeral, request-time contextual authorization tuples to strictly typed, allowlisted, non-escalatable claim schemas. Ingesting untrusted or weakly validated client claims directly into OpenFGA contextual tuples allows adversaries to inject arbitrary relation edges (such as owner or admin) and bypass zero-trust access boundaries.","antiPatternHeadline":"Unvalidated Contextual Tuple Injection Permitting Dynamic Privilege Escalation in OpenFGA Check Calls","stars_count":92,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","authorization","rebac","zero-trust","privilege-escalation","zod"],"exportEndpoints":{"claude":"/api/rules/openfga-contextual-tuple-boundary-validation?format=claude","cursorMdc":"/api/rules/openfga-contextual-tuple-boundary-validation?format=mdc","cursorrules":"/api/rules/openfga-contextual-tuple-boundary-validation?format=cursor","windsurf":"/api/rules/openfga-contextual-tuple-boundary-validation?format=windsurf","agents":"/api/rules/openfga-contextual-tuple-boundary-validation?format=agents"}},{"id":"ebpf-xdp-tc-syn-flood-flow-pacing-guardrail","title":"eBPF TC/XDP Ingress Flow-Pacing & Early SYN Flood Mitigation Standard","category":"devops","severity":"critical","description":"Enforces deterministic packet-shedding at the eBPF XDP and TC ingress layers before kernel socket buffer (sk_buff) allocation. Eliminates conntrack table exhaustion, ksoftirqd CPU starvation, and container network interface bottlenecks during high-PPS volumetric transport layer attacks.","antiPatternHeadline":"Delegating Ingress SYN Flood Mitigation to User-Space or Host Iptables Conntrack","stars_count":47,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","xdp","networking","ddos-mitigation","linux-kernel"],"exportEndpoints":{"claude":"/api/rules/ebpf-xdp-tc-syn-flood-flow-pacing-guardrail?format=claude","cursorMdc":"/api/rules/ebpf-xdp-tc-syn-flood-flow-pacing-guardrail?format=mdc","cursorrules":"/api/rules/ebpf-xdp-tc-syn-flood-flow-pacing-guardrail?format=cursor","windsurf":"/api/rules/ebpf-xdp-tc-syn-flood-flow-pacing-guardrail?format=windsurf","agents":"/api/rules/ebpf-xdp-tc-syn-flood-flow-pacing-guardrail?format=agents"}},{"id":"react-19-optimistic-action-rollback-isolation","title":"React 19 Optimistic Action Rollback Isolation & State Monotonicity","category":"frontend","severity":"critical","description":"Enforces strict optimistic state monotonicity and deterministic error rollback across asynchronous React 19 concurrent transitions. Prohibits manual side-effect rollbacks in detached closures, uncoordinated useOptimistic mutations, and out-of-order resolution leaks during concurrent action dispatches. Ensures UI state transitions strictly derive from canonical server state while preserving deterministic branch isolation on network failures.","antiPatternHeadline":"Uncoordinated React 19 useOptimistic mutation dispatching with manual closure-based rollbacks causing race condition state corruption","stars_count":76,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","useOptimistic","transitions","state-monotonicity","concurrency"],"exportEndpoints":{"claude":"/api/rules/react-19-optimistic-action-rollback-isolation?format=claude","cursorMdc":"/api/rules/react-19-optimistic-action-rollback-isolation?format=mdc","cursorrules":"/api/rules/react-19-optimistic-action-rollback-isolation?format=cursor","windsurf":"/api/rules/react-19-optimistic-action-rollback-isolation?format=windsurf","agents":"/api/rules/react-19-optimistic-action-rollback-isolation?format=agents"}},{"id":"speculation-rules-cross-origin-partitioning-standard","title":"Mandatory Partitioning and Credential Isolation for W3C Speculation Rules API","category":"frontend","severity":"critical","description":"Enforces strict isolation, anonymous credential modes, and Sec-Purpose headers validation when using the W3C Speculation Rules API for prefetching and prerendering. Prevents cross-site information leaks (XS-Leaks), speculative timing attacks, and CSRF/state mutation via unpartitioned cross-origin speculative fetching.","antiPatternHeadline":"Unrestricted Credentialed Speculative Execution Across Origins Without Partitioning Guards","stars_count":95,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","security","speculation-rules","xs-leaks","performance","cors"],"exportEndpoints":{"claude":"/api/rules/speculation-rules-cross-origin-partitioning-standard?format=claude","cursorMdc":"/api/rules/speculation-rules-cross-origin-partitioning-standard?format=mdc","cursorrules":"/api/rules/speculation-rules-cross-origin-partitioning-standard?format=cursor","windsurf":"/api/rules/speculation-rules-cross-origin-partitioning-standard?format=windsurf","agents":"/api/rules/speculation-rules-cross-origin-partitioning-standard?format=agents"}},{"id":"axum-08-task-scoped-cancellation-token-propagation","title":"Axum 0.8 Task-Scoped Cancellation Token Propagation & Connection Leak Prevention","category":"backend","severity":"critical","description":"Enforces deterministic cancellation hierarchies across Axum 0.8 request pipelines to prevent orphan async compute and database pool starvation upon client disconnect. Mandates wrapping spawned asynchronous child routines and heavy IO in scoped cancellation tokens tied to the request lifetime. Guarantees that dropping the top-level HTTP handler future cleanly aborts all downstream work and immediately returns pooled resources.","antiPatternHeadline":"Spawning Detached Async Tasks and Unguarded Pool Checkouts Without Client Disconnect Propagation","stars_count":67,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tokio","cancellation-token","concurrency"],"exportEndpoints":{"claude":"/api/rules/axum-08-task-scoped-cancellation-token-propagation?format=claude","cursorMdc":"/api/rules/axum-08-task-scoped-cancellation-token-propagation?format=mdc","cursorrules":"/api/rules/axum-08-task-scoped-cancellation-token-propagation?format=cursor","windsurf":"/api/rules/axum-08-task-scoped-cancellation-token-propagation?format=windsurf","agents":"/api/rules/axum-08-task-scoped-cancellation-token-propagation?format=agents"}},{"id":"postgres-17-streaming-json-table-memory-allocator","title":"Postgres 17 Streaming JSON_TABLE Zero-Materialization Allocator Standard","category":"backend","severity":"critical","description":"Enforces non-materializing, stream-based evaluation for Postgres 17 SQL/JSON JSON_TABLE queries during high-volume document ingestion. Prevents catastrophic backend OOM conditions caused by eager JSONB AST deserialization and unbounded memory context retention by streaming raw text buffers directly into relational columns without intermediate DOM allocation.","antiPatternHeadline":"Eager JSONB Parsing and Deep AST Materialization in JSON_TABLE Query Execution","stars_count":71,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","postgres-17","json-table","sql-json","memory-management","database-performance"],"exportEndpoints":{"claude":"/api/rules/postgres-17-streaming-json-table-memory-allocator?format=claude","cursorMdc":"/api/rules/postgres-17-streaming-json-table-memory-allocator?format=mdc","cursorrules":"/api/rules/postgres-17-streaming-json-table-memory-allocator?format=cursor","windsurf":"/api/rules/postgres-17-streaming-json-table-memory-allocator?format=windsurf","agents":"/api/rules/postgres-17-streaming-json-table-memory-allocator?format=agents"}},{"id":"temporal-workflow-determinism-drift-invariant","title":"Temporal Durable Workflow Determinism and History Drift Invariant","category":"backend","severity":"critical","description":"Enforces strict static execution-path determinism and version-gated branching within Temporal workflows. Prevents fatal NonDeterministicWorkflowError panics and corrupted event-history replay states during hot deployments of long-running executions.","antiPatternHeadline":"Unversioned Execution Graph Mutation and Non-Deterministic Primitives in Flight Paths","stars_count":57,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","temporal","event-sourcing","durable-execution","deterministic-replay","typescript"],"exportEndpoints":{"claude":"/api/rules/temporal-workflow-determinism-drift-invariant?format=claude","cursorMdc":"/api/rules/temporal-workflow-determinism-drift-invariant?format=mdc","cursorrules":"/api/rules/temporal-workflow-determinism-drift-invariant?format=cursor","windsurf":"/api/rules/temporal-workflow-determinism-drift-invariant?format=windsurf","agents":"/api/rules/temporal-workflow-determinism-drift-invariant?format=agents"}},{"id":"capacitor-7-custom-scheme-bridge-isolation-standard","title":"Capacitor 7 Custom Scheme and Native Bridge Origin Pinning Isolation","category":"mobile","severity":"critical","description":"Mandates deterministic origin validation and custom scheme isolation within Capacitor 7 architectures. Restricts WebView-to-native IPC bridge invocations strictly to internally pinned origin namespaces, neutralizing cross-context script execution, bridge hijacking, and untrusted iframe privilege escalation.","antiPatternHeadline":"Permissive WebView Navigation and Unpinned Origin Bridge Exposure","stars_count":89,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","security","ipc-bridge","webview-isolation","origin-pinning"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-custom-scheme-bridge-isolation-standard?format=claude","cursorMdc":"/api/rules/capacitor-7-custom-scheme-bridge-isolation-standard?format=mdc","cursorrules":"/api/rules/capacitor-7-custom-scheme-bridge-isolation-standard?format=cursor","windsurf":"/api/rules/capacitor-7-custom-scheme-bridge-isolation-standard?format=windsurf","agents":"/api/rules/capacitor-7-custom-scheme-bridge-isolation-standard?format=agents"}},{"id":"mlkem768-hybrid-tls-downgrade-protection","title":"ML-KEM-768 Hybrid TLS 1.3 Downgrade Protection Invariant","category":"security","severity":"critical","description":"Enforces post-quantum hybrid key exchange (X25519MLKEM768 / SecP256r1MLKEM768) over TLS 1.3 to permanently neutralize Harvest-Now-Decrypt-Later (HNDL) threats. Strictly proscribes unauthenticated fallback mechanisms, legacy TLS protocols (<1.3), and classical-only ECDHE groups in cryptographic configurations.","antiPatternHeadline":"Permitting Classical-Only TLS Fallback or Omission of ML-KEM-768 Hybrid Key Encapsulation","stars_count":47,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","cryptography","tls","post-quantum","ml-kem","zero-trust"],"exportEndpoints":{"claude":"/api/rules/mlkem768-hybrid-tls-downgrade-protection?format=claude","cursorMdc":"/api/rules/mlkem768-hybrid-tls-downgrade-protection?format=mdc","cursorrules":"/api/rules/mlkem768-hybrid-tls-downgrade-protection?format=cursor","windsurf":"/api/rules/mlkem768-hybrid-tls-downgrade-protection?format=windsurf","agents":"/api/rules/mlkem768-hybrid-tls-downgrade-protection?format=agents"}},{"id":"nodejs-22-permission-model-io-boundary","title":"Node.js 22 Native Capability Permission Model and I/O Boundary Guardrail","category":"security","severity":"critical","description":"Enforces Node.js 22 native runtime permission flags and programmatic capability checks to restrict filesystem I/O, child process spawning, worker creation, and native addon execution. This invariant prevents compromised third-party dependencies from accessing sensitive credentials, spawning rogue binaries, or exfiltrating data without requiring container or OS-level virtualization. All I/O interfaces must implement explicit capability pre-flight checks and operate under the least-privilege permission model.","antiPatternHeadline":"Unconstrained Ambient Runtime Authority Allowing Third-Party Supply-Chain Remote Code Execution and Data Exfiltration","stars_count":51,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","nodejs","permission-model","supply-chain","least-privilege","zero-trust"],"exportEndpoints":{"claude":"/api/rules/nodejs-22-permission-model-io-boundary?format=claude","cursorMdc":"/api/rules/nodejs-22-permission-model-io-boundary?format=mdc","cursorrules":"/api/rules/nodejs-22-permission-model-io-boundary?format=cursor","windsurf":"/api/rules/nodejs-22-permission-model-io-boundary?format=windsurf","agents":"/api/rules/nodejs-22-permission-model-io-boundary?format=agents"}},{"id":"vite6-environment-api-multi-runtime-sandboxing-vite-6-environme-851","title":"Vite 6 Environment API Multi-Runtime Target Sandboxing & Isolation","category":"devops","severity":"critical","description":"Enforces strict runtime boundary isolation using the Vite 6 Environment API across heterogeneous deployment targets (Node.js, Bun, workerd). Eliminates cross-runtime polyfill pollution, prevents global scope contamination, and ensures deterministic per-environment module resolution and execution pipelines.","antiPatternHeadline":"Monolithic SSR Configuration and Global Runtime Polyfill Leakage Across Node, Bun, and Edge Targets","stars_count":49,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["vite6","environment-api","ssr","workerd","bun","multi-runtime","devops"],"exportEndpoints":{"claude":"/api/rules/vite6-environment-api-multi-runtime-sandboxing-vite-6-environme-851?format=claude","cursorMdc":"/api/rules/vite6-environment-api-multi-runtime-sandboxing-vite-6-environme-851?format=mdc","cursorrules":"/api/rules/vite6-environment-api-multi-runtime-sandboxing-vite-6-environme-851?format=cursor","windsurf":"/api/rules/vite6-environment-api-multi-runtime-sandboxing-vite-6-environme-851?format=windsurf","agents":"/api/rules/vite6-environment-api-multi-runtime-sandboxing-vite-6-environme-851?format=agents"}},{"id":"otel-collector-adaptive-backpressure-standard","title":"OpenTelemetry Collector Adaptive Backpressure and Memory Limiter Guardrail","category":"devops","severity":"critical","description":"Enforces strict memory limits, queue boundaries, and tail-sampling circuit breakers across OpenTelemetry Collector deployments. Prevents out-of-memory (OOMKilled) crashes and silent data drops during downstream degradation by coupling cgroup-aware memory limiters with bounded persistent or memory sending queues.","antiPatternHeadline":"Unbounded Exporter Queues and Missing Memory Limiter Leading to Fatal OOM Cascades","stars_count":72,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","observability","kubernetes","resilience"],"exportEndpoints":{"claude":"/api/rules/otel-collector-adaptive-backpressure-standard?format=claude","cursorMdc":"/api/rules/otel-collector-adaptive-backpressure-standard?format=mdc","cursorrules":"/api/rules/otel-collector-adaptive-backpressure-standard?format=cursor","windsurf":"/api/rules/otel-collector-adaptive-backpressure-standard?format=windsurf","agents":"/api/rules/otel-collector-adaptive-backpressure-standard?format=agents"}},{"id":"react-19-rsc-cache-signal-invalidation-standard","title":"React 19 Server Components Cache Signal Invalidation Standard","category":"frontend","severity":"critical","description":"Enforces strict AbortSignal wiring, cryptographic cache tagging, and deterministic revalidation semantics across async data boundaries in React 19 Server Component hierarchies. Prevents orphaned server-side rendering promises and stale hydration mismatches by coupling cache lifetime directly to request lifecycle signals and cryptographically signed tags.","antiPatternHeadline":"Dangling fetch requests without AbortSignal propagation and unstructured string tags causing hydration desyncs","stars_count":90,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","rsc","nextjs","cache-invalidation","abort-signal"],"exportEndpoints":{"claude":"/api/rules/react-19-rsc-cache-signal-invalidation-standard?format=claude","cursorMdc":"/api/rules/react-19-rsc-cache-signal-invalidation-standard?format=mdc","cursorrules":"/api/rules/react-19-rsc-cache-signal-invalidation-standard?format=cursor","windsurf":"/api/rules/react-19-rsc-cache-signal-invalidation-standard?format=windsurf","agents":"/api/rules/react-19-rsc-cache-signal-invalidation-standard?format=agents"}},{"id":"webauthn-l3-passkey-device-binding-attestation-standard","title":"WebAuthn Level 3 Synced Passkey Device-Binding and Attestation Guardrail","category":"security","severity":"critical","description":"Enforces strict WebAuthn Level 3 cryptographic validation for passkey registration and authentication. Mandates explicit inspection of AuthenticatorData flags (Backup Eligibility, Backup State, User Verification), Device Public Key (DPK) extensions, and exact origin binding to neutralize credential-sync hijacking and multi-device replay attacks.","antiPatternHeadline":"Accepting unverified authenticator flags, missing DPK attestation, and applying rigid signature counters to multi-device synced passkeys.","stars_count":87,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","passkeys","fido2","attestation","device-binding"],"exportEndpoints":{"claude":"/api/rules/webauthn-l3-passkey-device-binding-attestation-standard?format=claude","cursorMdc":"/api/rules/webauthn-l3-passkey-device-binding-attestation-standard?format=mdc","cursorrules":"/api/rules/webauthn-l3-passkey-device-binding-attestation-standard?format=cursor","windsurf":"/api/rules/webauthn-l3-passkey-device-binding-attestation-standard?format=windsurf","agents":"/api/rules/webauthn-l3-passkey-device-binding-attestation-standard?format=agents"}},{"id":"bun-sqlite-wal2-concurrent-replica-guardrail","title":"Bun 1.2 Native SQLite WAL2 Concurrency and Read-Replica Connection Guardrail","category":"backend","severity":"critical","description":"Enforces strict isolation between a singleton writer connection and dedicated read-only replica handles using Bun 1.2 native bun:sqlite. Prevents thread-pool deadlocks, SQLITE_BUSY lock escalation anomalies, and writer starvation during high-throughput multi-threaded worker offloading.","antiPatternHeadline":"Sharing Mutable SQLite Handles Across Multi-Threaded Workers Without WAL Tuning or Read-Only Segregation","stars_count":58,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","sqlite","wal2","concurrency","workers","edge"],"exportEndpoints":{"claude":"/api/rules/bun-sqlite-wal2-concurrent-replica-guardrail?format=claude","cursorMdc":"/api/rules/bun-sqlite-wal2-concurrent-replica-guardrail?format=mdc","cursorrules":"/api/rules/bun-sqlite-wal2-concurrent-replica-guardrail?format=cursor","windsurf":"/api/rules/bun-sqlite-wal2-concurrent-replica-guardrail?format=windsurf","agents":"/api/rules/bun-sqlite-wal2-concurrent-replica-guardrail?format=agents"}},{"id":"ebpf-xdp-l4-syncookie-offload-standard","title":"eBPF XDP Driver-Level TCP SYN-Cookie Verification & Offload Standard","category":"devops","severity":"critical","description":"Mandates that edge gateways and edge proxy infrastructure validate and generate cryptographically signed TCP SYN cookies directly at the NIC ingress driver level via eBPF XDP hooks. Prevents kernel socket queue exhaustion, conntrack table saturation, and sk_buff allocation overhead during volumetric TCP SYN flood attacks. Guarantees zero TCP state allocation until the full three-way handshake is verified.","antiPatternHeadline":"SKB Allocation Pass-Through and In-Kernel Connection Backlog Saturation Under L4 SYN Floods","stars_count":99,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["ebpf","xdp","ddos-mitigation","syn-cookies","linux-kernel","tcp-ip","devops"],"exportEndpoints":{"claude":"/api/rules/ebpf-xdp-l4-syncookie-offload-standard?format=claude","cursorMdc":"/api/rules/ebpf-xdp-l4-syncookie-offload-standard?format=mdc","cursorrules":"/api/rules/ebpf-xdp-l4-syncookie-offload-standard?format=cursor","windsurf":"/api/rules/ebpf-xdp-l4-syncookie-offload-standard?format=windsurf","agents":"/api/rules/ebpf-xdp-l4-syncookie-offload-standard?format=agents"}},{"id":"kmp-swift-concurrency-actor-isolation-boundary-kotlin-multiplat-883","title":"KMP and Swift Concurrency Actor Isolation Boundary","category":"mobile","severity":"critical","description":"Strictly enforces isolation between Kotlin Multiplatform (KMP) Coroutine runtimes and native Swift actors under modern Swift 6 strict concurrency. Forbids passing unconstrained reference types across the FFI boundary, mandating defensive transformations into immutable Swift Sendable value types and explicit actor isolation.","antiPatternHeadline":"Leaking Non-Sendable Kotlin Reference Types Directly Across Swift Async/Await Actor Boundaries","stars_count":60,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","swift-concurrency","actors","memory-safety","ios"],"exportEndpoints":{"claude":"/api/rules/kmp-swift-concurrency-actor-isolation-boundary-kotlin-multiplat-883?format=claude","cursorMdc":"/api/rules/kmp-swift-concurrency-actor-isolation-boundary-kotlin-multiplat-883?format=mdc","cursorrules":"/api/rules/kmp-swift-concurrency-actor-isolation-boundary-kotlin-multiplat-883?format=cursor","windsurf":"/api/rules/kmp-swift-concurrency-actor-isolation-boundary-kotlin-multiplat-883?format=windsurf","agents":"/api/rules/kmp-swift-concurrency-actor-isolation-boundary-kotlin-multiplat-883?format=agents"}},{"id":"go-chi-w3c-otel-context-propagation-guardrail","title":"Go Chi v5 Panic-Safe W3C Trace & Baggage Propagation Standard","category":"backend","severity":"critical","description":"Enforces deterministic extraction and injection of W3C Trace Context (traceparent, tracestate) and distributed Baggage across Go Chi v5 middleware chains. Guarantees panic-safe span lifecycle management, semantic error recording, and context preservation to eliminate orphan traces and broken distributed causality.","antiPatternHeadline":"Broken Context Inheritance and Leaked Spans via Manual Header Handling or Naive Middleware Chaining","stars_count":116,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","chi","opentelemetry","w3c-tracing","observability","distributed-tracing"],"exportEndpoints":{"claude":"/api/rules/go-chi-w3c-otel-context-propagation-guardrail?format=claude","cursorMdc":"/api/rules/go-chi-w3c-otel-context-propagation-guardrail?format=mdc","cursorrules":"/api/rules/go-chi-w3c-otel-context-propagation-guardrail?format=cursor","windsurf":"/api/rules/go-chi-w3c-otel-context-propagation-guardrail?format=windsurf","agents":"/api/rules/go-chi-w3c-otel-context-propagation-guardrail?format=agents"}},{"id":"vite6-runtime-css-inversion-guardrail","title":"Vite 6 Runtime CSS Chunk Inversion Ordering & Cascade Guardrail","category":"frontend","severity":"critical","description":"Enforces deterministic runtime CSS chunk injection and cascade boundary isolation across Vite 6 micro-frontend host and remote topologies. Prevents catastrophic stylesheet specificity leakage, non-deterministic cascade overrides, and Flash of Unstyled Content (FOUC) triggered by race conditions during asynchronous, heterogeneous module preloading.","antiPatternHeadline":"Unordered Document Head Injection Causing Runtime CSS Specificity Inversion","stars_count":78,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","vite6","micro-frontends","css-cascade","module-federation","fouc-prevention"],"exportEndpoints":{"claude":"/api/rules/vite6-runtime-css-inversion-guardrail?format=claude","cursorMdc":"/api/rules/vite6-runtime-css-inversion-guardrail?format=mdc","cursorrules":"/api/rules/vite6-runtime-css-inversion-guardrail?format=cursor","windsurf":"/api/rules/vite6-runtime-css-inversion-guardrail?format=windsurf","agents":"/api/rules/vite6-runtime-css-inversion-guardrail?format=agents"}},{"id":"tauri-android-intent-sandboxed-ipc-origin-standard","title":"Tauri 2.0 Android Intent Sandboxed IPC Origin & URI Permission Standard","category":"mobile","severity":"critical","description":"Enforces cryptographic payload signing, origin validation, and strict Content URI permission filtering across the Tauri 2.0 WebView-to-Rust-to-Android IPC boundary. Prevents arbitrary intent redirection, unauthorized file system access, and untrusted component resolution via explicit origin sandboxing and transient URI permission grants.","antiPatternHeadline":"Unvalidated IPC Dispatch of Raw Android Intents with File Scheme URIs and Missing Origin Attestation","stars_count":78,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri","android","ipc-security","intent-sandboxing","uri-permissions"],"exportEndpoints":{"claude":"/api/rules/tauri-android-intent-sandboxed-ipc-origin-standard?format=claude","cursorMdc":"/api/rules/tauri-android-intent-sandboxed-ipc-origin-standard?format=mdc","cursorrules":"/api/rules/tauri-android-intent-sandboxed-ipc-origin-standard?format=cursor","windsurf":"/api/rules/tauri-android-intent-sandboxed-ipc-origin-standard?format=windsurf","agents":"/api/rules/tauri-android-intent-sandboxed-ipc-origin-standard?format=agents"}},{"id":"postgres-17-rls-cryptographic-session-claims-standard","title":"Postgres 17 RLS Cryptographic Session Claims Injection Standard","category":"security","severity":"critical","description":"Enforces cryptographically verified JWT session claims injected directly into transaction-scoped PostgreSQL session variables using SET LOCAL. Mandates strict isolation within explicit transaction blocks to eliminate cross-request tenant leakage and prevent tenant privilege escalation in Row-Level Security (RLS) policies.","antiPatternHeadline":"Persisting Session-Scoped Settings or Bypassing Transaction-Scoped SET LOCAL for RLS Claims","stars_count":88,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","postgresql","rls","jwt","multi-tenancy","transactions"],"exportEndpoints":{"claude":"/api/rules/postgres-17-rls-cryptographic-session-claims-standard?format=claude","cursorMdc":"/api/rules/postgres-17-rls-cryptographic-session-claims-standard?format=mdc","cursorrules":"/api/rules/postgres-17-rls-cryptographic-session-claims-standard?format=cursor","windsurf":"/api/rules/postgres-17-rls-cryptographic-session-claims-standard?format=windsurf","agents":"/api/rules/postgres-17-rls-cryptographic-session-claims-standard?format=agents"}},{"id":"otel-collector-continuous-profiling-sampling-standard","title":"OTel Collector Continuous Profiling Flame Graph Sampling and Memory Limiter Guardrail","category":"devops","severity":"critical","description":"Enforces strict memory limiter pre-filtering, backpressure buffers, and adaptive sample-rate governors for OpenTelemetry continuous profiling data streams. Prevents heap allocation telemetry bursts from exhausting Collector cgroup limits and causing catastrophic container runtime OOMKills during service memory spikes.","antiPatternHeadline":"Unbounded Continuous Profiling Ingestion Without Upstream Limiting Induces Collector OOMKills","stars_count":51,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","continuous-profiling","observability","memory-limiter","kubernetes"],"exportEndpoints":{"claude":"/api/rules/otel-collector-continuous-profiling-sampling-standard?format=claude","cursorMdc":"/api/rules/otel-collector-continuous-profiling-sampling-standard?format=mdc","cursorrules":"/api/rules/otel-collector-continuous-profiling-sampling-standard?format=cursor","windsurf":"/api/rules/otel-collector-continuous-profiling-sampling-standard?format=windsurf","agents":"/api/rules/otel-collector-continuous-profiling-sampling-standard?format=agents"}},{"id":"react-19-useactionstate-optimistic-reentrancy-guardrail","title":"Deterministic Re-entrancy and Rollback Invariants for React 19 useActionState and useOptimistic","category":"frontend","severity":"critical","description":"Enforces deterministic snapshot isolation, monotonic sequencing, and tear-free rollbacks across concurrent React 19 useActionState invocations coupled with useOptimistic. Prevents state corruption, out-of-order resolution tearing, and destructive rollbacks when interleaved asynchronous server actions fail or resolve non-deterministically.","antiPatternHeadline":"Non-Deterministic Optimistic Overwrites and Destructive Rollbacks in Interleaved Server Actions","stars_count":109,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react19","useActionState","useOptimistic","server-actions","concurrency","state-integrity"],"exportEndpoints":{"claude":"/api/rules/react-19-useactionstate-optimistic-reentrancy-guardrail?format=claude","cursorMdc":"/api/rules/react-19-useactionstate-optimistic-reentrancy-guardrail?format=mdc","cursorrules":"/api/rules/react-19-useactionstate-optimistic-reentrancy-guardrail?format=cursor","windsurf":"/api/rules/react-19-useactionstate-optimistic-reentrancy-guardrail?format=windsurf","agents":"/api/rules/react-19-useactionstate-optimistic-reentrancy-guardrail?format=agents"}},{"id":"postgres-17-failover-slot-synchronization-invariant","title":"Postgres 17 Logical Replication Slot Failover Synchronization Invariant","category":"backend","severity":"critical","description":"Enforces failover-enabled logical replication slots and standby slot synchronization introduced in PostgreSQL 17. Eliminates CDC event loss and duplicate replay during primary-to-standby switchover by ensuring physical standbys continuously synchronize logical replication slots before promotion.","antiPatternHeadline":"Creating Logical Slots Without Failover Invariants and Blindly Switching Consumers to Out-of-Sync Standbys","stars_count":84,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","postgres-17","cdc","logical-replication","high-availability"],"exportEndpoints":{"claude":"/api/rules/postgres-17-failover-slot-synchronization-invariant?format=claude","cursorMdc":"/api/rules/postgres-17-failover-slot-synchronization-invariant?format=mdc","cursorrules":"/api/rules/postgres-17-failover-slot-synchronization-invariant?format=cursor","windsurf":"/api/rules/postgres-17-failover-slot-synchronization-invariant?format=windsurf","agents":"/api/rules/postgres-17-failover-slot-synchronization-invariant?format=agents"}},{"id":"kmp-native-coroutines-leak-immunity-standard","title":"KMP Native Coroutines Memory-Leak Immunity Standard","category":"mobile","severity":"critical","description":"Enforces strict lifecycle boundaries and deterministic cancellation contracts between Kotlin Multiplatform Coroutines and Swift/Objective-C runtime memory management. Eliminates uncollected ARC reference cycles and detached Job retention across Apple native foreign-function interfaces by mandating explicit disposable tokens and scope deallocation hooks.","antiPatternHeadline":"Retaining Long-Lived Kotlin Job Continuations via Escaping Swift Closures and Strong Scope Capture","stars_count":100,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","swift","coroutines","memory-management","arc","native"],"exportEndpoints":{"claude":"/api/rules/kmp-native-coroutines-leak-immunity-standard?format=claude","cursorMdc":"/api/rules/kmp-native-coroutines-leak-immunity-standard?format=mdc","cursorrules":"/api/rules/kmp-native-coroutines-leak-immunity-standard?format=cursor","windsurf":"/api/rules/kmp-native-coroutines-leak-immunity-standard?format=windsurf","agents":"/api/rules/kmp-native-coroutines-leak-immunity-standard?format=agents"}},{"id":"tauri-2-mobile-granular-ipc-capability-scoping-standard","title":"Tauri 2.0 Mobile Granular IPC Capability Scoping & Zero-Trust Command Standard","category":"mobile","severity":"critical","description":"Enforces strict capability-driven security architecture for Tauri 2.0 mobile targets across Android and iOS runtimes. Mandates explicit window/webview label isolation, cryptographically validated command payloads, and fine-grained runtime permission sets to prevent arbitrary native subsystem invocation from untrusted web contexts.","antiPatternHeadline":"Wildcard IPC Allowlisting and Global Plugin Permissions in Mobile WebViews","stars_count":48,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri","rust","ipc-security","zero-trust","capabilities"],"exportEndpoints":{"claude":"/api/rules/tauri-2-mobile-granular-ipc-capability-scoping-standard?format=claude","cursorMdc":"/api/rules/tauri-2-mobile-granular-ipc-capability-scoping-standard?format=mdc","cursorrules":"/api/rules/tauri-2-mobile-granular-ipc-capability-scoping-standard?format=cursor","windsurf":"/api/rules/tauri-2-mobile-granular-ipc-capability-scoping-standard?format=windsurf","agents":"/api/rules/tauri-2-mobile-granular-ipc-capability-scoping-standard?format=agents"}},{"id":"nextjs-15-server-action-origin-shielding","title":"Next.js 15 Server Action Dynamic Host & Cryptographic Origin Attestation Invariant","category":"security","severity":"critical","description":"Next.js 15 Server Actions accept POST dispatches that can become vulnerable to host header poisoning and cross-origin attacks in multi-domain or reverse-proxy topologies if origin validation is unshielded. This rule mandates strict origin verification, forward-header attestation against canonical domain registries, and defense-in-depth runtime assertions using timing-safe comparisons.","antiPatternHeadline":"Executing naked Server Actions without canonical dynamic host validation or relying entirely on unverified proxy-forwarded headers.","stars_count":92,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["nextjs15","server-actions","csrf","origin-shielding","security","cryptography"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-server-action-origin-shielding?format=claude","cursorMdc":"/api/rules/nextjs-15-server-action-origin-shielding?format=mdc","cursorrules":"/api/rules/nextjs-15-server-action-origin-shielding?format=cursor","windsurf":"/api/rules/nextjs-15-server-action-origin-shielding?format=windsurf","agents":"/api/rules/nextjs-15-server-action-origin-shielding?format=agents"}},{"id":"istio-ambient-ztunnel-ebpf-mtls-identity-transition-invariant","title":"Istio Ambient ztunnel eBPF L4-to-L7 Waypoint Cryptographic Identity Transition Standard","category":"security","severity":"critical","description":"Enforces strict peer identity preservation and cryptographic attestation during transparent Layer-4 ztunnel eBPF redirections to Layer-7 Envoy Waypoint proxies. Prevents identity spoofing, dropped HBONE context, and TCP RST connection resets during cross-node mTLS renegotiation. Ensures authorization policies evaluate downstream SPIFFE SAN identities rather than intermediate node-level ztunnel proxy credentials.","antiPatternHeadline":"Unvalidated Waypoint Forwarding and Intermediate Identity Stripping via Plaintext HBONE Unpacking","stars_count":119,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","istio","ambient-mesh","ztunnel","ebpf","spiffe","mtls","zero-trust"],"exportEndpoints":{"claude":"/api/rules/istio-ambient-ztunnel-ebpf-mtls-identity-transition-invariant?format=claude","cursorMdc":"/api/rules/istio-ambient-ztunnel-ebpf-mtls-identity-transition-invariant?format=mdc","cursorrules":"/api/rules/istio-ambient-ztunnel-ebpf-mtls-identity-transition-invariant?format=cursor","windsurf":"/api/rules/istio-ambient-ztunnel-ebpf-mtls-identity-transition-invariant?format=windsurf","agents":"/api/rules/istio-ambient-ztunnel-ebpf-mtls-identity-transition-invariant?format=agents"}},{"id":"otel-semantic-tail-sampling-ring-guardrail","title":"OpenTelemetry Adaptive In-Memory Ring Buffer Tail-Sampling and High-Cardinality Sanitization","category":"devops","severity":"critical","description":"Enforces strict local memory-ring buffering and cardinality pruning for OpenTelemetry traces prior to network export. Restricts unbounded attribute explosion by enforcing OTel semantic convention compliance and selectively dropping non-error trace spans when heap utilization surpasses critical thresholds.","antiPatternHeadline":"Unbounded Head-Sampling with Raw Ephemeral Attribute Insertion Leading to OOM and Exporter Congestion","stars_count":75,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","observability","tail-sampling","memory-management","cardinality"],"exportEndpoints":{"claude":"/api/rules/otel-semantic-tail-sampling-ring-guardrail?format=claude","cursorMdc":"/api/rules/otel-semantic-tail-sampling-ring-guardrail?format=mdc","cursorrules":"/api/rules/otel-semantic-tail-sampling-ring-guardrail?format=cursor","windsurf":"/api/rules/otel-semantic-tail-sampling-ring-guardrail?format=windsurf","agents":"/api/rules/otel-semantic-tail-sampling-ring-guardrail?format=agents"}},{"id":"k8s-dra-cdi-claim-lifecycle-standard","title":"Kubernetes 1.32 DRA Structured CDI Claim Lifecycle & Deterministic Unprepare Guardrail","category":"devops","severity":"critical","description":"Enforces strict conformance to Kubernetes 1.32 Dynamic Resource Allocation (DRA) structured parameters and Container Device Interface (CDI) device claim lifecycles. Mandates idempotent NodeUnprepareResource execution, transactional finalizer synchronization, and atomic cleanup of dynamic /var/run/cdi specifications. Prevents device leakage and node-level orphaned hardware allocations during Pod eviction, ungraceful termination, or kubelet restarts.","antiPatternHeadline":"Leaking physical GPU/accelerator allocations via non-idempotent DRA NodeUnprepare execution and static CDI spec abandonment","stars_count":48,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","kubernetes","dra","cdi","gpu-orchestration","golang"],"exportEndpoints":{"claude":"/api/rules/k8s-dra-cdi-claim-lifecycle-standard?format=claude","cursorMdc":"/api/rules/k8s-dra-cdi-claim-lifecycle-standard?format=mdc","cursorrules":"/api/rules/k8s-dra-cdi-claim-lifecycle-standard?format=cursor","windsurf":"/api/rules/k8s-dra-cdi-claim-lifecycle-standard?format=windsurf","agents":"/api/rules/k8s-dra-cdi-claim-lifecycle-standard?format=agents"}},{"id":"svelte-5-effect-root-disposal-invariant","title":"Svelte 5 $effect.root Disposal and Microtask Boundary Invariant","category":"frontend","severity":"critical","description":"Enforces deterministic teardown of unparented fine-grained reactive roots instantiated via $effect.root outside of standard Svelte component lifecycles. Prevents cross-request memory retention during SSR, node heap exhaustion, and zombie listener execution across asynchronous microtask boundaries in dynamic client-server execution paths.","antiPatternHeadline":"Orphaned $effect.root Instantiations and Unbounded Asynchronous Reactive Registrations","stars_count":103,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","memory-leaks","ssr","reactive-graphs"],"exportEndpoints":{"claude":"/api/rules/svelte-5-effect-root-disposal-invariant?format=claude","cursorMdc":"/api/rules/svelte-5-effect-root-disposal-invariant?format=mdc","cursorrules":"/api/rules/svelte-5-effect-root-disposal-invariant?format=cursor","windsurf":"/api/rules/svelte-5-effect-root-disposal-invariant?format=windsurf","agents":"/api/rules/svelte-5-effect-root-disposal-invariant?format=agents"}},{"id":"vite-6-environment-api-runtime-isolation-standard","title":"Vite 6 Environment API Multi-Runtime Sandbox Isolation Standard","category":"frontend","severity":"critical","description":"Enforces strict boundary separation across Vite 6 environments (client, ssr, edge, workerd) to prevent cross-runtime module graph pollution, unauthorized Node.js built-in leakage, and environment-mismatched bundle poisoning. Mandates programmatic isolation via Vite 6 Environment API configurations, environment-scoped plugin hooks, and explicit package export condition targeting.","antiPatternHeadline":"Cross-Runtime Module Graph Leaks and Monolithic Plugin State Poisoning","stars_count":76,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["vite-6","environment-api","multi-runtime","ssr","sandbox-isolation","edge-worker"],"exportEndpoints":{"claude":"/api/rules/vite-6-environment-api-runtime-isolation-standard?format=claude","cursorMdc":"/api/rules/vite-6-environment-api-runtime-isolation-standard?format=mdc","cursorrules":"/api/rules/vite-6-environment-api-runtime-isolation-standard?format=cursor","windsurf":"/api/rules/vite-6-environment-api-runtime-isolation-standard?format=windsurf","agents":"/api/rules/vite-6-environment-api-runtime-isolation-standard?format=agents"}},{"id":"drizzle-zero-downtime-concurrent-migration-invariant","title":"Drizzle ORM Zero-Downtime Concurrent Migration & Shadow View Swap Invariant","category":"backend","severity":"critical","description":"Enforces an expand-and-contract dual-column shadowing protocol for all schema evolutions and type conversions executed with Drizzle ORM. Eliminates ACCESS EXCLUSIVE write-lock contention under heavy concurrent workloads by forbidding monolithic in-place column alterations and blocking DDLs. Mandates phased backward-compatible migrations guarded by strict lock timeouts, asynchronous backfills, and atomic view/column aliasing swaps.","antiPatternHeadline":"In-Place Synchronous Column Alteration with Blocking Table Locks","stars_count":73,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","drizzle-orm","postgresql","migrations","zero-downtime","concurrency"],"exportEndpoints":{"claude":"/api/rules/drizzle-zero-downtime-concurrent-migration-invariant?format=claude","cursorMdc":"/api/rules/drizzle-zero-downtime-concurrent-migration-invariant?format=mdc","cursorrules":"/api/rules/drizzle-zero-downtime-concurrent-migration-invariant?format=cursor","windsurf":"/api/rules/drizzle-zero-downtime-concurrent-migration-invariant?format=windsurf","agents":"/api/rules/drizzle-zero-downtime-concurrent-migration-invariant?format=agents"}},{"id":"kmp-swift-export-atomic-reference-cycle-guardrail","title":"Kotlin Multiplatform (KMP) Swift-Export Cross-Bridge Memory Decoupling Guardrail","category":"mobile","severity":"critical","description":"Prevents catastrophic cross-runtime memory leaks and zombie objects caused by circular strong references bridging Kotlin/Native garbage collection and Apple Automatic Reference Counting (ARC). Mandates explicit decoupled subscription tokens, weak delegator proxies, and deterministic lifecycle disposal across the Swift-Export boundary.","antiPatternHeadline":"Bidirectional Strong Bridging Creating Indestructible ARC-to-Kotlin GC Retain Cycles","stars_count":64,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","swift-export","arc","kotlin-native","memory-leak"],"exportEndpoints":{"claude":"/api/rules/kmp-swift-export-atomic-reference-cycle-guardrail?format=claude","cursorMdc":"/api/rules/kmp-swift-export-atomic-reference-cycle-guardrail?format=mdc","cursorrules":"/api/rules/kmp-swift-export-atomic-reference-cycle-guardrail?format=cursor","windsurf":"/api/rules/kmp-swift-export-atomic-reference-cycle-guardrail?format=windsurf","agents":"/api/rules/kmp-swift-export-atomic-reference-cycle-guardrail?format=agents"}},{"id":"tauri2-custom-protocol-stream-backpressure","title":"Tauri 2.0 Mobile Custom Protocol Asset Streaming & Backpressure Standard","category":"mobile","severity":"critical","description":"Restricts Rust-to-WebView binary asset pipelines to bounded, chunked streams over Tauri 2.0 custom URI protocols to prevent IPC buffer exhaustion on mobile runtimes. Monolithic IPC buffer allocations across iOS WKWebView and Android WebView bridges trigger Out-Of-Memory (OOM) process termination and main-thread render stalls. Mandates HTTP range-compliant chunked responses with consumer-driven backpressure via ReadableStream pipelines.","antiPatternHeadline":"Monolithic IPC buffer transfers and unbounded ArrayBuffer loading across the mobile WebView boundary","stars_count":79,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri-2","rust","ipc-backpressure","memory-management","streaming"],"exportEndpoints":{"claude":"/api/rules/tauri2-custom-protocol-stream-backpressure?format=claude","cursorMdc":"/api/rules/tauri2-custom-protocol-stream-backpressure?format=mdc","cursorrules":"/api/rules/tauri2-custom-protocol-stream-backpressure?format=cursor","windsurf":"/api/rules/tauri2-custom-protocol-stream-backpressure?format=windsurf","agents":"/api/rules/tauri2-custom-protocol-stream-backpressure?format=agents"}},{"id":"oauth21-dpop-nonce-rotation-replay-guardrail","title":"OAuth 2.1 RFC 9449 DPoP Sender-Constrained Nonce Rotation and Replay Prevention","category":"security","severity":"critical","description":"Enforces RFC 9449 Demonstrating Proof-of-Possession (DPoP) bindings with dynamic server-issued nonce rotation and atomic jti replay caching across all mutating endpoints. Prevents bearer token exfiltration and distributed replay attacks by sender-constraining access tokens to client ephemeral asymmetric key pairs.","antiPatternHeadline":"Accepting Unbound Bearer Tokens or DPoP Proofs Lacking Nonce Verification and Replay Validation","stars_count":84,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","oauth2","dpop","rfc9449","cryptography","zero-trust","jwt"],"exportEndpoints":{"claude":"/api/rules/oauth21-dpop-nonce-rotation-replay-guardrail?format=claude","cursorMdc":"/api/rules/oauth21-dpop-nonce-rotation-replay-guardrail?format=mdc","cursorrules":"/api/rules/oauth21-dpop-nonce-rotation-replay-guardrail?format=cursor","windsurf":"/api/rules/oauth21-dpop-nonce-rotation-replay-guardrail?format=windsurf","agents":"/api/rules/oauth21-dpop-nonce-rotation-replay-guardrail?format=agents"}},{"id":"otel-ottl-pii-masking-cardinality-guardrail","title":"OpenTelemetry OTTL In-Flight PII Masking & Stream Cardinality Guardrail","category":"devops","severity":"critical","description":"Enforces edge-layer telemetry sanitization and cardinality boundaries via OpenTelemetry Transformation Language (OTTL) within the collector pipeline. Guarantees that sensitive PII (emails, tokens, SSNs) is masked in-memory and unbounded metric/span dimensions are hashed, bucketed, or dropped prior to network egress or backend ingestion.","antiPatternHeadline":"Egressing Unmasked PII and High-Cardinality Dimensions to Downstream Telemetry Backends","stars_count":40,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","ottl","observability","security","pii","cardinality"],"exportEndpoints":{"claude":"/api/rules/otel-ottl-pii-masking-cardinality-guardrail?format=claude","cursorMdc":"/api/rules/otel-ottl-pii-masking-cardinality-guardrail?format=mdc","cursorrules":"/api/rules/otel-ottl-pii-masking-cardinality-guardrail?format=cursor","windsurf":"/api/rules/otel-ottl-pii-masking-cardinality-guardrail?format=windsurf","agents":"/api/rules/otel-ottl-pii-masking-cardinality-guardrail?format=agents"}},{"id":"k8s-gamma-ambient-cross-cluster-failover-standard","title":"GAMMA Ambient Multi-Cluster Failover & L7 Outlier Circuit Breaking Standard","category":"devops","severity":"critical","description":"Enforces strict declarative L7 east-west traffic failover and real-time outlier detection across multi-cluster service meshes using Kubernetes Gateway API GAMMA specifications and sidecarless ambient waypoints. Eliminates split-brain outages and client DNS caching bottlenecks by replacing DNS TTL-based shifting with kernel/waypoint-level active-passive circuit breaking.","antiPatternHeadline":"Relying on Client-Side DNS Resolution and Legacy Sidecars for Regional East-West Failover","stars_count":86,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","kubernetes","gateway-api","gamma","ambient-mesh","istio","resilience","circuit-breaking"],"exportEndpoints":{"claude":"/api/rules/k8s-gamma-ambient-cross-cluster-failover-standard?format=claude","cursorMdc":"/api/rules/k8s-gamma-ambient-cross-cluster-failover-standard?format=mdc","cursorrules":"/api/rules/k8s-gamma-ambient-cross-cluster-failover-standard?format=cursor","windsurf":"/api/rules/k8s-gamma-ambient-cross-cluster-failover-standard?format=windsurf","agents":"/api/rules/k8s-gamma-ambient-cross-cluster-failover-standard?format=agents"}},{"id":"nextjs-15-dynamic-io-use-cache-tag-invalidation","title":"Next.js 15 Dynamic I/O & 'use cache' Cryptographic Boundary Standard","category":"frontend","severity":"critical","description":"Enforces strict tenant isolation and deterministic cache tagging under Next.js 15 Dynamic I/O architecture. Mandates that all cached execution scopes using the 'use cache' directive bind cryptographic, tenant-scoped cache tags and cacheLife profiles, eliminating multi-tenant data bleed across prerendered edge runtimes and persistent cache stores.","antiPatternHeadline":"Global Unscoped 'use cache' Directives Causing Multi-Tenant Cache Pollution and Cross-Tenant Data Leaks","stars_count":51,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs-15","dynamic-io","use-cache","caching","multi-tenancy","react-server-components"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-dynamic-io-use-cache-tag-invalidation?format=claude","cursorMdc":"/api/rules/nextjs-15-dynamic-io-use-cache-tag-invalidation?format=mdc","cursorrules":"/api/rules/nextjs-15-dynamic-io-use-cache-tag-invalidation?format=cursor","windsurf":"/api/rules/nextjs-15-dynamic-io-use-cache-tag-invalidation?format=windsurf","agents":"/api/rules/nextjs-15-dynamic-io-use-cache-tag-invalidation?format=agents"}},{"id":"webauthn-conditional-ui-passkey-origin-binding-invariant","title":"WebAuthn Conditional UI & Cryptographic Origin-Binding Invariant","category":"security","severity":"critical","description":"Enforces strict WebAuthn Conditional Mediation (passkey autofill) on client interfaces alongside deterministic, immutable origin and Relying Party (RP) ID validation on the server. Guarantees that passkey assertions are cryptographically bound to the canonical, server-configured origin, neutralizing real-time reverse-proxy phishing (AitM) and spoofed domain vectors.","antiPatternHeadline":"Dynamic Origin Validation, Missing Conditional UI Fallbacks, or Trusting Client-Reported Hostnames","stars_count":46,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","passkeys","fido2","phishing-resistance","origin-binding","aitm"],"exportEndpoints":{"claude":"/api/rules/webauthn-conditional-ui-passkey-origin-binding-invariant?format=claude","cursorMdc":"/api/rules/webauthn-conditional-ui-passkey-origin-binding-invariant?format=mdc","cursorrules":"/api/rules/webauthn-conditional-ui-passkey-origin-binding-invariant?format=cursor","windsurf":"/api/rules/webauthn-conditional-ui-passkey-origin-binding-invariant?format=windsurf","agents":"/api/rules/webauthn-conditional-ui-passkey-origin-binding-invariant?format=agents"}},{"id":"go-1-24-weak-pointer-cache-canonicalization-standard","title":"Go 1.24 weak.Pointer Memory Interning and Non-Retaining Cache Standard","category":"backend","severity":"critical","description":"Enforces strict canonicalization and deduplication invariants using Go 1.24's standard library `weak.Pointer` for in-memory object interning. Eliminates GC retention cycles, unbounded heap growth, and synchronization deadlocks during high-throughput cross-request deduplication without keeping unreachable heap objects alive artificially.","antiPatternHeadline":"Strong-Reference Map Leak and Stale Dereference Race in Memory Interning Pools","stars_count":78,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","golang","go1.24","memory-management","weak-pointer","gc-optimization","concurrency"],"exportEndpoints":{"claude":"/api/rules/go-1-24-weak-pointer-cache-canonicalization-standard?format=claude","cursorMdc":"/api/rules/go-1-24-weak-pointer-cache-canonicalization-standard?format=mdc","cursorrules":"/api/rules/go-1-24-weak-pointer-cache-canonicalization-standard?format=cursor","windsurf":"/api/rules/go-1-24-weak-pointer-cache-canonicalization-standard?format=windsurf","agents":"/api/rules/go-1-24-weak-pointer-cache-canonicalization-standard?format=agents"}},{"id":"kmp-skia-metal-render-sync-standard","title":"KMP Compose Multiplatform Skia/Metal Surface Render Sync & Disposal Barrier Standard","category":"mobile","severity":"critical","description":"Enforces deterministic synchronization barriers between Skia render loops and native graphics surfaces (Metal CAMetalLayer / Android SurfaceView) across Kotlin Multiplatform viewports. Guarantees that native surface teardown waits on in-flight GPU command buffers and disposes GrDirectContext/Skia resources cleanly, preventing GPU memory leaks, command buffer race panics, and dangling drawable crashes during rapid view recycling.","antiPatternHeadline":"Asynchronous Surface Teardown and Dangling GPU Command Buffer Execution During Lifecycle Disposal","stars_count":40,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","compose-multiplatform","skia","metal","gpu-memory"],"exportEndpoints":{"claude":"/api/rules/kmp-skia-metal-render-sync-standard?format=claude","cursorMdc":"/api/rules/kmp-skia-metal-render-sync-standard?format=mdc","cursorrules":"/api/rules/kmp-skia-metal-render-sync-standard?format=cursor","windsurf":"/api/rules/kmp-skia-metal-render-sync-standard?format=windsurf","agents":"/api/rules/kmp-skia-metal-render-sync-standard?format=agents"}},{"id":"postgres-17-json-table-simd-streaming-guardrail","title":"Postgres 17 JSON_TABLE & SIMD Ingestion Memory Bounds","category":"backend","severity":"critical","description":"Enforces bounded chunking, explicit work_mem isolation, and memory-safe projection limits when utilizing Postgres 17's SQL/JSON JSON_TABLE feature and SIMD-accelerated JSON parsers. Prevents backend worker out-of-memory (OOM) crashes and CPU starvation during high-throughput JSON batch ingestion by requiring micro-batched payloads and strict path projection constraints.","antiPatternHeadline":"Ingesting Unbounded JSON Payloads into Unmetered JSON_TABLE Queries Causing PG Worker OOM","stars_count":46,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres","postgres-17","json-table","simd","memory-management","database-performance"],"exportEndpoints":{"claude":"/api/rules/postgres-17-json-table-simd-streaming-guardrail?format=claude","cursorMdc":"/api/rules/postgres-17-json-table-simd-streaming-guardrail?format=mdc","cursorrules":"/api/rules/postgres-17-json-table-simd-streaming-guardrail?format=cursor","windsurf":"/api/rules/postgres-17-json-table-simd-streaming-guardrail?format=windsurf","agents":"/api/rules/postgres-17-json-table-simd-streaming-guardrail?format=agents"}},{"id":"ebpf-ringbuf-backpressure-loss-detection-standard","title":"eBPF TCX/XDP Ring-Buffer Backpressure & Loss-Detection Standard","category":"devops","severity":"critical","description":"Regulates kernel-to-userspace event submission through adaptive pacing, reserve-commit paradigms, and sequence tracking to guarantee zero unmonitored network security drops during high-packet-rate bursts. Mandates monotonic loss counters and fallback dynamic sampling before buffer saturation compromises observability.","antiPatternHeadline":"Blind bpf_ringbuf_output drops with missing per-CPU monotonic drop-counter accounting","stars_count":47,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","linux-kernel","xdp","tcx","observability","performance"],"exportEndpoints":{"claude":"/api/rules/ebpf-ringbuf-backpressure-loss-detection-standard?format=claude","cursorMdc":"/api/rules/ebpf-ringbuf-backpressure-loss-detection-standard?format=mdc","cursorrules":"/api/rules/ebpf-ringbuf-backpressure-loss-detection-standard?format=cursor","windsurf":"/api/rules/ebpf-ringbuf-backpressure-loss-detection-standard?format=windsurf","agents":"/api/rules/ebpf-ringbuf-backpressure-loss-detection-standard?format=agents"}},{"id":"pqc-hybrid-mlkem-x25519-edge-tls-standard","title":"Mandatory Hybrid ML-KEM/X25519 Key Encapsulation for Edge TLS Ingress","category":"security","severity":"critical","description":"Mandates dual-mode hybrid post-quantum key encapsulation (X25519MLKEM768 / X25519Kyber768Draft00) across all ingress edge load balancers, TLS termination proxies, and internal microservice mesh boundaries. This neutralizes 'harvest-now, decrypt-later' (HNDL) adversarial vectors while preserving classical FIPS/RFC-compliant cryptographic fallback security. Any TLS listener configured solely with classical elliptic curves or RSA key transport violates edge transport policy.","antiPatternHeadline":"Classical-Only ECDHE Key Exchange Permitted on Ingress Edge Terminations","stars_count":107,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","cryptography","tls13","post-quantum","ml-kem","x25519","infrastructure"],"exportEndpoints":{"claude":"/api/rules/pqc-hybrid-mlkem-x25519-edge-tls-standard?format=claude","cursorMdc":"/api/rules/pqc-hybrid-mlkem-x25519-edge-tls-standard?format=mdc","cursorrules":"/api/rules/pqc-hybrid-mlkem-x25519-edge-tls-standard?format=cursor","windsurf":"/api/rules/pqc-hybrid-mlkem-x25519-edge-tls-standard?format=windsurf","agents":"/api/rules/pqc-hybrid-mlkem-x25519-edge-tls-standard?format=agents"}},{"id":"otel-ebpf-profiler-cfs-adaptive-throttling","title":"OpenTelemetry eBPF Continuous Profiler Adaptive CFS Quota Throttling Guardrail","category":"devops","severity":"critical","description":"Continuous eBPF stack-unwinding profiles introduce measurable kernel CPU overhead under high context-switch frequencies. Profiling agents must actively monitor target cgroup cpu.stat metrics and dynamically back off sampling frequency or pause unwind iterations when target cgroups exceed configurable CFS throttling thresholds, preventing profiling-induced cascade latency.","antiPatternHeadline":"Static high-frequency eBPF sampling causing kernel-level CFS starvation and cascade pod throttling","stars_count":55,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","opentelemetry","cgroups","observability","performance"],"exportEndpoints":{"claude":"/api/rules/otel-ebpf-profiler-cfs-adaptive-throttling?format=claude","cursorMdc":"/api/rules/otel-ebpf-profiler-cfs-adaptive-throttling?format=mdc","cursorrules":"/api/rules/otel-ebpf-profiler-cfs-adaptive-throttling?format=cursor","windsurf":"/api/rules/otel-ebpf-profiler-cfs-adaptive-throttling?format=windsurf","agents":"/api/rules/otel-ebpf-profiler-cfs-adaptive-throttling?format=agents"}},{"id":"sqlx-tokio-dead-socket-eviction-guardrail","title":"SQLx/Tokio Active Heartbeat and TCP Half-Close Eviction Invariant","category":"backend","severity":"critical","description":"Enforces strict pre-acquisition health validation, aggressive idle eviction, and kernel-level TCP keepalive probes within SQLx pools managed by Tokio runtimes. This eliminates transaction lockups and zero-window worker stalls caused by silent connection state drops across cloud NAT gateways, proxies, and service mesh boundaries.","antiPatternHeadline":"Trusting stale pool connections across cloud NAT boundaries without test-on-acquire or kernel keepalives","stars_count":45,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","sqlx","tokio","connection-pooling","tcp","resilience"],"exportEndpoints":{"claude":"/api/rules/sqlx-tokio-dead-socket-eviction-guardrail?format=claude","cursorMdc":"/api/rules/sqlx-tokio-dead-socket-eviction-guardrail?format=mdc","cursorrules":"/api/rules/sqlx-tokio-dead-socket-eviction-guardrail?format=cursor","windsurf":"/api/rules/sqlx-tokio-dead-socket-eviction-guardrail?format=windsurf","agents":"/api/rules/sqlx-tokio-dead-socket-eviction-guardrail?format=agents"}},{"id":"react19-compiler-memo-invalidation-boundary","title":"React 19 Compiler Closure Purity and Dynamic Memoization Invalidation Boundaries","category":"frontend","severity":"critical","description":"Enforces strict immutability, closure purity, and input dependency stability to maintain React 19 Compiler memoization block validity. Prevents cascading subtree re-renders caused by in-place object mutations, unstable closure capture, and leaky reactive scopes that force the compiler to de-optimize or continuously bust auto-generated cache slots.","antiPatternHeadline":"In-Place Mutation and Non-Idempotent Render Closures Triggering Full Memoization Slot De-Optimization","stars_count":42,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","react-compiler","memoization","immutability","closure-purity"],"exportEndpoints":{"claude":"/api/rules/react19-compiler-memo-invalidation-boundary?format=claude","cursorMdc":"/api/rules/react19-compiler-memo-invalidation-boundary?format=mdc","cursorrules":"/api/rules/react19-compiler-memo-invalidation-boundary?format=cursor","windsurf":"/api/rules/react19-compiler-memo-invalidation-boundary?format=windsurf","agents":"/api/rules/react19-compiler-memo-invalidation-boundary?format=agents"}},{"id":"tauri-v2-ipc-zero-copy-binary-boundary","title":"Tauri 2.0 IPC Zero-Copy ArrayBuffer & Channel Binary Transfer Boundary","category":"frontend","severity":"critical","description":"Enforces zero-serialization binary streaming between the Tauri Core Rust runtime and web client WebViews using Tauri 2.0 Channels or raw binary Response types. Prohibits base64 strings or JSON integer array representations of byte arrays (`Vec<u8>`) across the IPC boundary to eliminate memory thrashing, main thread serialization locks, and quadratic GC allocation churn.","antiPatternHeadline":"Serializing Raw Byte Buffers into Base64 Strings or JSON Number Arrays across Tauri IPC","stars_count":85,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","tauri","ipc","performance","binary","web-workers"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-ipc-zero-copy-binary-boundary?format=claude","cursorMdc":"/api/rules/tauri-v2-ipc-zero-copy-binary-boundary?format=mdc","cursorrules":"/api/rules/tauri-v2-ipc-zero-copy-binary-boundary?format=cursor","windsurf":"/api/rules/tauri-v2-ipc-zero-copy-binary-boundary?format=windsurf","agents":"/api/rules/tauri-v2-ipc-zero-copy-binary-boundary?format=agents"}},{"id":"go-chi-quic-http3-0rtt-anti-replay-guardrail","title":"Strict Chi HTTP/3 0-RTT Early Data Anti-Replay Guardrail","category":"backend","severity":"critical","description":"Enforces deterministic rejection of non-idempotent HTTP methods transmitted within TLS 1.3/QUIC 0-RTT early data frames across Go Chi microservices. Prevents replay attacks against stateful mutations by returning HTTP 425 Too Early, restricting 0-RTT processing strictly to safe, idempotent operations in compliance with RFC 8470 and RFC 9114.","antiPatternHeadline":"Executing stateful mutations (POST/PUT/PATCH/DELETE) on unvalidated QUIC 0-RTT early data","stars_count":118,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","chi","quic","http3","security","tls13","replay-attack"],"exportEndpoints":{"claude":"/api/rules/go-chi-quic-http3-0rtt-anti-replay-guardrail?format=claude","cursorMdc":"/api/rules/go-chi-quic-http3-0rtt-anti-replay-guardrail?format=mdc","cursorrules":"/api/rules/go-chi-quic-http3-0rtt-anti-replay-guardrail?format=cursor","windsurf":"/api/rules/go-chi-quic-http3-0rtt-anti-replay-guardrail?format=windsurf","agents":"/api/rules/go-chi-quic-http3-0rtt-anti-replay-guardrail?format=agents"}},{"id":"postgres-17-hnsw-vector-partition-pruning-guardrail","title":"Postgres 17 HNSW Vector Index Partition-Pruning Alignment","category":"backend","severity":"critical","description":"Guarantees billion-scale vector similarity lookups avoid catastrophic unindexed table scans by enforcing composite scalar-vector partition pruning at the query planner level. In Postgres 17 and pgvector 0.7+, declarative partitioning combined with localized HNSW indexing requires exact scalar predicate alignment to prevent the query planner from fanning out unpruned sub-plan index scans or falling back to sequential scans across partitioned tables.","antiPatternHeadline":"Global Vector Probing Without Deterministic Partition Pruning Predicates","stars_count":90,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres-17","pgvector","hnsw","database","sql"],"exportEndpoints":{"claude":"/api/rules/postgres-17-hnsw-vector-partition-pruning-guardrail?format=claude","cursorMdc":"/api/rules/postgres-17-hnsw-vector-partition-pruning-guardrail?format=mdc","cursorrules":"/api/rules/postgres-17-hnsw-vector-partition-pruning-guardrail?format=cursor","windsurf":"/api/rules/postgres-17-hnsw-vector-partition-pruning-guardrail?format=windsurf","agents":"/api/rules/postgres-17-hnsw-vector-partition-pruning-guardrail?format=agents"}},{"id":"bun-worker-postmessage-backpressure-guardrail","title":"Bun 1.2 Native Worker PostMessage Queue Backpressure & Memory Bounds","category":"backend","severity":"critical","description":"Enforces bounded queue depths and explicit bidirectional backpressure on Bun 1.2 Worker thread message dispatching. Prevents silent native heap and RSS ballooning caused by unacknowledged postMessage queues during high-throughput CPU-bound processing bursts.","antiPatternHeadline":"Unbounded postMessage Fire-and-Forget Dispatch Leading to Silent Native Heap Exhaustion and OOM Crashes","stars_count":49,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","worker-threads","concurrency","backpressure","memory-management"],"exportEndpoints":{"claude":"/api/rules/bun-worker-postmessage-backpressure-guardrail?format=claude","cursorMdc":"/api/rules/bun-worker-postmessage-backpressure-guardrail?format=mdc","cursorrules":"/api/rules/bun-worker-postmessage-backpressure-guardrail?format=cursor","windsurf":"/api/rules/bun-worker-postmessage-backpressure-guardrail?format=windsurf","agents":"/api/rules/bun-worker-postmessage-backpressure-guardrail?format=agents"}},{"id":"kmp-stateflow-swift-interop-lifetime-anchor-standard","title":"Deterministic Lifetime Anchoring for KMP Coroutine StateFlow Swift Interop","category":"mobile","severity":"critical","description":"Enforces deterministic cancellation and deallocation bridging between Kotlin Coroutine Scopes and Swift Automatic Reference Counting (ARC) across the Objective-C/Swift interop barrier. Unanchored Kotlin StateFlow collectors bridge as unmanaged or global callbacks that keep underlying coroutine jobs alive indefinitely in native heaps, leaking memory, CPU cycles, and battery. Native Swift wrappers must own an explicit disposable lifetime anchor tied to deinit and native SwiftUI/UIKit view lifecycle lifespans.","antiPatternHeadline":"Exposing Unmanaged Kotlin Coroutine Job Callbacks to Swift Retain Cycles Causing Zombie Background Execution","stars_count":98,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","swift","coroutines","stateflow","memory-leak","arc"],"exportEndpoints":{"claude":"/api/rules/kmp-stateflow-swift-interop-lifetime-anchor-standard?format=claude","cursorMdc":"/api/rules/kmp-stateflow-swift-interop-lifetime-anchor-standard?format=mdc","cursorrules":"/api/rules/kmp-stateflow-swift-interop-lifetime-anchor-standard?format=cursor","windsurf":"/api/rules/kmp-stateflow-swift-interop-lifetime-anchor-standard?format=windsurf","agents":"/api/rules/kmp-stateflow-swift-interop-lifetime-anchor-standard?format=agents"}},{"id":"capacitor-7-native-bridge-thread-pool-quarantine","title":"Capacitor 7 Native Bridge Thread-Pool Concurrency Quarantine","category":"mobile","severity":"critical","description":"Heavy filesystem I/O, cryptographic computations, and biometric authorizations executed across the Capacitor 7 bridge must be explicitly quarantined from the native UI dispatch queue and throttled against the WebView event loop. Failure to segregate asynchronous native thread pools from main-thread bridge callbacks introduces severe UI micro-stutters, IPC message queue starvation, and dropped 60/120Hz display frames.","antiPatternHeadline":"Executing heavy native file I/O or cryptographic routines on the main UI dispatch queue via unthrottled bridge calls.","stars_count":53,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","concurrency","ios","android","webview","performance"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-native-bridge-thread-pool-quarantine?format=claude","cursorMdc":"/api/rules/capacitor-7-native-bridge-thread-pool-quarantine?format=mdc","cursorrules":"/api/rules/capacitor-7-native-bridge-thread-pool-quarantine?format=cursor","windsurf":"/api/rules/capacitor-7-native-bridge-thread-pool-quarantine?format=windsurf","agents":"/api/rules/capacitor-7-native-bridge-thread-pool-quarantine?format=agents"}},{"id":"openid-caep-realtime-token-revocation-guardrail","title":"OpenID CAEP Real-Time Token Revocation and SET Invalidation Standard","category":"security","severity":"critical","description":"Enforces strict cryptographic verification, tenant-isolated routing, and deterministic replay mitigation for OpenID Continuous Access Evaluation Profile (CAEP) Security Event Tokens (SETs). Guarantees that token revocations and device posture updates are validated against verified issuer JWKS and propagated to distributed token caches within sub-second latencies.","antiPatternHeadline":"Unvalidated SET Payloads, In-Memory Non-Distributed Revocations, and Missing JTI Replay Defense","stars_count":85,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openid-connect","caep","sse","zero-trust","token-revocation","distributed-systems"],"exportEndpoints":{"claude":"/api/rules/openid-caep-realtime-token-revocation-guardrail?format=claude","cursorMdc":"/api/rules/openid-caep-realtime-token-revocation-guardrail?format=mdc","cursorrules":"/api/rules/openid-caep-realtime-token-revocation-guardrail?format=cursor","windsurf":"/api/rules/openid-caep-realtime-token-revocation-guardrail?format=windsurf","agents":"/api/rules/openid-caep-realtime-token-revocation-guardrail?format=agents"}},{"id":"k8s-gateway-api-referencegrant-cross-namespace-enforcement","title":"Mandatory ReferenceGrant Handshakes for Cross-Namespace Gateway API Routing","category":"devops","severity":"critical","description":"Enforces strict bidirectional handshake governance under Kubernetes Gateway API v1.2 specifications by mandating explicit ReferenceGrant resources in target namespaces for all cross-namespace parentRefs, backendRefs, and Secret certificate references. Prevents catastrophic cross-tenant route hijacking, unauthorized ingress exposure, and silent route dropping due to missing ResolvedRefs status conditions in multi-tenant clusters.","antiPatternHeadline":"Cross-Namespace Parent/Backend Binding Without Explicit Target-Namespace ReferenceGrant Authorization","stars_count":82,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","kubernetes","gateway-api","zero-trust","multi-tenancy","infrastructure-as-code"],"exportEndpoints":{"claude":"/api/rules/k8s-gateway-api-referencegrant-cross-namespace-enforcement?format=claude","cursorMdc":"/api/rules/k8s-gateway-api-referencegrant-cross-namespace-enforcement?format=mdc","cursorrules":"/api/rules/k8s-gateway-api-referencegrant-cross-namespace-enforcement?format=cursor","windsurf":"/api/rules/k8s-gateway-api-referencegrant-cross-namespace-enforcement?format=windsurf","agents":"/api/rules/k8s-gateway-api-referencegrant-cross-namespace-enforcement?format=agents"}},{"id":"otel-ebpf-profiler-kernel-overhead-throttling","title":"OTel Continuous Profiling eBPF Stack-Unwinding Kernel Overhead Throttling","category":"devops","severity":"critical","description":"Enforces dynamic throttling on eBPF continuous profiling agents to limit ring-buffer saturation and kernel stack-unwinding CPU overhead. Under sustained host compute spikes, agents must autonomously reduce unwinding frequency, fall back to frame-pointer walking, or drop samples to preserve host node stability.","antiPatternHeadline":"Unbounded eBPF Stack Walking and Ring-Buffer Allocations Saturating Production Kernel Cores","stars_count":79,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","opentelemetry","continuous-profiling","observability","linux-kernel"],"exportEndpoints":{"claude":"/api/rules/otel-ebpf-profiler-kernel-overhead-throttling?format=claude","cursorMdc":"/api/rules/otel-ebpf-profiler-kernel-overhead-throttling?format=mdc","cursorrules":"/api/rules/otel-ebpf-profiler-kernel-overhead-throttling?format=cursor","windsurf":"/api/rules/otel-ebpf-profiler-kernel-overhead-throttling?format=windsurf","agents":"/api/rules/otel-ebpf-profiler-kernel-overhead-throttling?format=agents"}},{"id":"vite6-environment-api-multi-runtime-isolation-vite-6-environme-503","title":"Vite 6 Multi-Environment Isolation and Cross-Runtime Boundary Enforcement","category":"frontend","severity":"critical","description":"Vite 6 Environment API allows distinct execution contexts (Node SSR, Workerd edge, React Server Components, and client bundles) to run in unified dev and build pipelines. In multi-runtime setups, you must enforce strict module boundary isolation, dedicated DevEnvironment configs, and explicit runtime export conditions to prevent host Node.js globals and stateful module graphs from cross-pollinating isolated runtimes.","antiPatternHeadline":"Cross-Pollinating Node.js Globals and Sharing Module Execution Caches Across Isolated Vite 6 Environments","stars_count":101,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["vite","vite6","environment-api","ssr","workerd","multi-runtime","cloudflare-workers"],"exportEndpoints":{"claude":"/api/rules/vite6-environment-api-multi-runtime-isolation-vite-6-environme-503?format=claude","cursorMdc":"/api/rules/vite6-environment-api-multi-runtime-isolation-vite-6-environme-503?format=mdc","cursorrules":"/api/rules/vite6-environment-api-multi-runtime-isolation-vite-6-environme-503?format=cursor","windsurf":"/api/rules/vite6-environment-api-multi-runtime-isolation-vite-6-environme-503?format=windsurf","agents":"/api/rules/vite6-environment-api-multi-runtime-isolation-vite-6-environme-503?format=agents"}},{"id":"bun-websocket-backpressure-drain-invariant-bun-1-2-native-w-975","title":"Bun Native WebSocket Backpressure Drain & High-Watermark Guardrail","category":"backend","severity":"critical","description":"Enforces strict high-watermark backpressure checks and drain-driven event dispatching on Bun native WebSockets (`Bun.serve`). Unchecked streaming without inspecting `ws.send()` byte returns or awaiting the `drain(ws)` lifecycle hook creates unmonitored native uWebSockets heap allocations that lead to silent process termination via OOM.","antiPatternHeadline":"Fire-and-forget WebSocket streaming without checking send return values or handling native drain lifecycle events.","stars_count":64,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","websockets","backpressure","memory-management","streaming"],"exportEndpoints":{"claude":"/api/rules/bun-websocket-backpressure-drain-invariant-bun-1-2-native-w-975?format=claude","cursorMdc":"/api/rules/bun-websocket-backpressure-drain-invariant-bun-1-2-native-w-975?format=mdc","cursorrules":"/api/rules/bun-websocket-backpressure-drain-invariant-bun-1-2-native-w-975?format=cursor","windsurf":"/api/rules/bun-websocket-backpressure-drain-invariant-bun-1-2-native-w-975?format=windsurf","agents":"/api/rules/bun-websocket-backpressure-drain-invariant-bun-1-2-native-w-975?format=agents"}},{"id":"axum-0-8-tower-frame-budgeted-streaming-invariant","title":"Axum 0.8 / Tower Deterministic Frame-Budgeted Multipart Streaming Invariant","category":"backend","severity":"critical","description":"Enforces strict frame and memory budgeting on incoming multipart request streams within Axum 0.8 and Tower services. Prevents heap exhaustion and uncontrolled resource consumption triggered by unbuffered or malicious HTTP/3 DATA frame bursts by decoupling zero-copy network frames from unbounded heap allocators and asserting deterministic backpressure-aware quotas.","antiPatternHeadline":"Unbounded Stream Ingestion and Naive Multipart Unwrapping Permitting HTTP/3 Frame Amplification OOM","stars_count":114,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tower","http3","zero-copy","security"],"exportEndpoints":{"claude":"/api/rules/axum-0-8-tower-frame-budgeted-streaming-invariant?format=claude","cursorMdc":"/api/rules/axum-0-8-tower-frame-budgeted-streaming-invariant?format=mdc","cursorrules":"/api/rules/axum-0-8-tower-frame-budgeted-streaming-invariant?format=cursor","windsurf":"/api/rules/axum-0-8-tower-frame-budgeted-streaming-invariant?format=windsurf","agents":"/api/rules/axum-0-8-tower-frame-budgeted-streaming-invariant?format=agents"}},{"id":"go-124-weak-pointer-route-cache-contract","title":"Go 1.24 Weak-Pointer Dynamic Route Cache & Canonicalization Contract","category":"backend","severity":"critical","description":"Enforces Go 1.24 weak pointer semantics (`weak.Pointer`) for dynamic HTTP path-trie canonicalization caches to eliminate cache-induced memory leaks without generational sweep overhead. Mandates non-escaped value validation, atomic nil-checks on dereferencing, and bounded key retention to prevent cardinality-induced heap exhaustion.","antiPatternHeadline":"Retaining Strong References in Path Canonicalization Caches Causing Unbounded Trie Heap Growth","stars_count":69,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","memory-management","http-router","weak-pointers","go124"],"exportEndpoints":{"claude":"/api/rules/go-124-weak-pointer-route-cache-contract?format=claude","cursorMdc":"/api/rules/go-124-weak-pointer-route-cache-contract?format=mdc","cursorrules":"/api/rules/go-124-weak-pointer-route-cache-contract?format=cursor","windsurf":"/api/rules/go-124-weak-pointer-route-cache-contract?format=windsurf","agents":"/api/rules/go-124-weak-pointer-route-cache-contract?format=agents"}},{"id":"drizzle-prepared-statement-pool-eviction-standard","title":"Drizzle ORM Prepared Statement Connection-Pool Eviction & Multiplexer Protection","category":"backend","severity":"critical","description":"Enforces strict bounds on dynamic prepared statement generation and mandates explicit statement lifecycle controls across multi-tenant PostgreSQL pools. Dynamic interpolation and unconstrained statement names exhaust backend connection memory and trigger prepared statement collision errors behind transaction poolers like PgBouncer and Supabase Supavisor. All dynamic queries must execute in direct un-cached modes or maintain deterministic, tenant-isolated parameterized identities.","antiPatternHeadline":"Unbounded Dynamic Prepared Statement Proliferation Causing Session-Pooler Exhaustion and Tenant Cross-Contamination","stars_count":47,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","drizzle-orm","postgresql","pgbouncer","multi-tenancy","connection-pooling"],"exportEndpoints":{"claude":"/api/rules/drizzle-prepared-statement-pool-eviction-standard?format=claude","cursorMdc":"/api/rules/drizzle-prepared-statement-pool-eviction-standard?format=mdc","cursorrules":"/api/rules/drizzle-prepared-statement-pool-eviction-standard?format=cursor","windsurf":"/api/rules/drizzle-prepared-statement-pool-eviction-standard?format=windsurf","agents":"/api/rules/drizzle-prepared-statement-pool-eviction-standard?format=agents"}},{"id":"cmp21-swapchain-metal-surfaceview-sync-guardrail","title":"Compose Multiplatform 2.1 Metal-SurfaceView Swapchain Synchronization","category":"mobile","severity":"critical","description":"Enforces non-blocking graphics buffer destruction and synchronized vsync pacing across Skiko rendering pipelines on iOS CAMetalLayer and Android SurfaceView. Prevents GPU driver starvation, triple-buffering exhaustion, and UI-thread deadlocks during cross-platform navigation transitions.","antiPatternHeadline":"Synchronous swapchain teardown on UI dispatcher causing GPU presentation deadlocks and buffer starvation during navigation","stars_count":112,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","compose-multiplatform","metal","surfaceview","skiko","vsync","swapchain"],"exportEndpoints":{"claude":"/api/rules/cmp21-swapchain-metal-surfaceview-sync-guardrail?format=claude","cursorMdc":"/api/rules/cmp21-swapchain-metal-surfaceview-sync-guardrail?format=mdc","cursorrules":"/api/rules/cmp21-swapchain-metal-surfaceview-sync-guardrail?format=cursor","windsurf":"/api/rules/cmp21-swapchain-metal-surfaceview-sync-guardrail?format=windsurf","agents":"/api/rules/cmp21-swapchain-metal-surfaceview-sync-guardrail?format=agents"}},{"id":"webauthn-conditional-mediation-abortsignal-chaining-standard","title":"WebAuthn Conditional Mediation AbortSignal Chaining & Atomic Cancellation Standard","category":"security","severity":"critical","description":"Enforces atomic cancellation cascades and dedicated AbortController state machines for WebAuthn conditional mediation (passkey autofill) requests. Prevents InvalidStateError browser locks, credential prompt hijacking, and token desynchronization during active UI re-renders or transitions to modal authentication ceremonies.","antiPatternHeadline":"Unmanaged Conditional WebAuthn Ceremonies Causing Credential Manager Deadlocks and Prompt Hijacking","stars_count":48,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","passkeys","abort-controller","concurrency","browser-apis"],"exportEndpoints":{"claude":"/api/rules/webauthn-conditional-mediation-abortsignal-chaining-standard?format=claude","cursorMdc":"/api/rules/webauthn-conditional-mediation-abortsignal-chaining-standard?format=mdc","cursorrules":"/api/rules/webauthn-conditional-mediation-abortsignal-chaining-standard?format=cursor","windsurf":"/api/rules/webauthn-conditional-mediation-abortsignal-chaining-standard?format=windsurf","agents":"/api/rules/webauthn-conditional-mediation-abortsignal-chaining-standard?format=agents"}},{"id":"envoy-gateway-extauthz-monotonic-budgeting-fail-closed","title":"Envoy Gateway 1.2 ExtAuthz Monotonic Budgeting and Fail-Closed Boundary","category":"security","severity":"critical","description":"Mandates strict fail-closed authorization posture and monotonic deadline budgeting for External Authorization (ExtAuthz) filters in Envoy Gateway 1.2. Prevents worker thread saturation, denial-of-service, and unauthorized bypass by enforcing explicit request timeouts, connection pool circuit breaking, and failOpen=false invariants.","antiPatternHeadline":"Unbounded ExtAuthz Timeouts and Permissive Fail-Open Fallbacks Leading to Proxy Thread Starvation and Auth Bypass","stars_count":95,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","envoy-gateway","ext-authz","zero-trust","circuit-breaking","dos-prevention"],"exportEndpoints":{"claude":"/api/rules/envoy-gateway-extauthz-monotonic-budgeting-fail-closed?format=claude","cursorMdc":"/api/rules/envoy-gateway-extauthz-monotonic-budgeting-fail-closed?format=mdc","cursorrules":"/api/rules/envoy-gateway-extauthz-monotonic-budgeting-fail-closed?format=cursor","windsurf":"/api/rules/envoy-gateway-extauthz-monotonic-budgeting-fail-closed?format=windsurf","agents":"/api/rules/envoy-gateway-extauthz-monotonic-budgeting-fail-closed?format=agents"}},{"id":"opentelemetry-carrier-immutability-enforcement","title":"OpenTelemetry Trace Context Carrier Immutability and Copy-on-Write Baggage","category":"devops","severity":"critical","description":"Enforces strict immutability across OpenTelemetry propagation carriers and baggage dictionaries over asynchronous task boundaries. Prevents shared mutable state from corrupting distributed trace parentage, span link integrity, and downstream context values during concurrent outbound dispatch. Guarantees that injected carrier payloads and baggage entries use copy-on-write isolation across async event loops and promise continuations.","antiPatternHeadline":"In-Place Mutation of Shared Trace Propagation Carriers and Baggage Across Concurrent Task Boundaries","stars_count":117,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","distributed-tracing","observability","context-propagation","async-safety"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-carrier-immutability-enforcement?format=claude","cursorMdc":"/api/rules/opentelemetry-carrier-immutability-enforcement?format=mdc","cursorrules":"/api/rules/opentelemetry-carrier-immutability-enforcement?format=cursor","windsurf":"/api/rules/opentelemetry-carrier-immutability-enforcement?format=windsurf","agents":"/api/rules/opentelemetry-carrier-immutability-enforcement?format=agents"}},{"id":"ebpf-tcx-deterministic-priority-attachment","title":"Linux eBPF TCX Multi-Program Attachment Priority Determinism","category":"devops","severity":"critical","description":"Requires explicit relative program anchoring and atomic link flags when dynamically attaching multiple eBPF TCX programs to network interfaces. Prevents non-deterministic filter execution order, pipeline drops, and security policy bypasses caused by default head/tail attachment races.","antiPatternHeadline":"Attaching TCX ingress programs with default attachment flags, causing filter execution reordering and security bypasses.","stars_count":49,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","tcx","linux-kernel","networking","security"],"exportEndpoints":{"claude":"/api/rules/ebpf-tcx-deterministic-priority-attachment?format=claude","cursorMdc":"/api/rules/ebpf-tcx-deterministic-priority-attachment?format=mdc","cursorrules":"/api/rules/ebpf-tcx-deterministic-priority-attachment?format=cursor","windsurf":"/api/rules/ebpf-tcx-deterministic-priority-attachment?format=windsurf","agents":"/api/rules/ebpf-tcx-deterministic-priority-attachment?format=agents"}},{"id":"vite6-cross-runtime-environment-isolation-standard","title":"Vite 6 Environment API Cross-Runtime Module Isolation Standard","category":"frontend","severity":"critical","description":"Enforces strict memory, global scope, and module graph isolation when simultaneously executing client, edge-worker (WinterCG), and Node.js runtimes in Vite 6 pipelines. Prevents cross-runtime state leakage, unisolated global mutations, and corrupted Hot Module Replacement (HMR) broadcasts across environment boundaries.","antiPatternHeadline":"Shared Module Graph Contamination and Global Scope Bleed Across Vite 6 Multi-Runtime Environments","stars_count":114,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","vite6","environment-api","ssr","wintercg","module-isolation"],"exportEndpoints":{"claude":"/api/rules/vite6-cross-runtime-environment-isolation-standard?format=claude","cursorMdc":"/api/rules/vite6-cross-runtime-environment-isolation-standard?format=mdc","cursorrules":"/api/rules/vite6-cross-runtime-environment-isolation-standard?format=cursor","windsurf":"/api/rules/vite6-cross-runtime-environment-isolation-standard?format=windsurf","agents":"/api/rules/vite6-cross-runtime-environment-isolation-standard?format=agents"}},{"id":"nextjs-15-ppr-shell-hole-concurrency-barrier","title":"Next.js 15 PPR Dynamic Hole Isolation and Edge Stampede Barrier","category":"frontend","severity":"critical","description":"Enforces strict isolation between static pre-rendered shells and dynamic asynchronous streaming holes under Next.js 15 Partial Prerendering (PPR). Mandates boundary encapsulation using React Suspense with deduped, cached dynamic loaders to prevent blocking Time to First Byte (TTFB) at distributed edge points of presence (POPs). Eliminates thundering-herd cache stampedes across edge workers during traffic spikes by coupling React cache() with stale-while-revalidate data primitives.","antiPatternHeadline":"Leaking Dynamic Accessors to Component Shells and Uncached Multi-Hole Suspense Stampedes","stars_count":116,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["nextjs","react-19","partial-prerendering","edge-computing","concurrency","caching"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-ppr-shell-hole-concurrency-barrier?format=claude","cursorMdc":"/api/rules/nextjs-15-ppr-shell-hole-concurrency-barrier?format=mdc","cursorrules":"/api/rules/nextjs-15-ppr-shell-hole-concurrency-barrier?format=cursor","windsurf":"/api/rules/nextjs-15-ppr-shell-hole-concurrency-barrier?format=windsurf","agents":"/api/rules/nextjs-15-ppr-shell-hole-concurrency-barrier?format=agents"}},{"id":"fastapi-anyio4-structured-concurrency-invariant","title":"FastAPI with AnyIO 4 Structured Concurrency TaskGroup Invariant","category":"backend","severity":"critical","description":"Enforces strict structured concurrency invariants using AnyIO 4 TaskGroups across FastAPI ASGI endpoints and service boundaries. Prevents orphaned background tasks, broken cancellation cascades, and uncontrolled exception fan-out across concurrent external I/O operations by mandating deterministic cancellation scopes and PEP 654 ExceptionGroup handling.","antiPatternHeadline":"Unbounded asyncio.create_task and asyncio.gather Fan-Out Leaking Coroutines Across ASGI Worker Lifecycles","stars_count":61,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","anyio","structured-concurrency","python","asyncio"],"exportEndpoints":{"claude":"/api/rules/fastapi-anyio4-structured-concurrency-invariant?format=claude","cursorMdc":"/api/rules/fastapi-anyio4-structured-concurrency-invariant?format=mdc","cursorrules":"/api/rules/fastapi-anyio4-structured-concurrency-invariant?format=cursor","windsurf":"/api/rules/fastapi-anyio4-structured-concurrency-invariant?format=windsurf","agents":"/api/rules/fastapi-anyio4-structured-concurrency-invariant?format=agents"}},{"id":"postgres-17-logical-replication-failover-slot-sync-postgresql-17-lo-524","title":"PostgreSQL 17 Logical Replication Slot Failover Synchronization Invariant","category":"backend","severity":"critical","description":"Enforces failover-enabled logical replication slots and physical standby synchronization invariants introduced in PostgreSQL 17. Guarantees that logical replication slots are synchronized to hot standbys before WAL retirement, preventing downstream CDC stream corruption, message drops, or mass duplication during automated cluster failovers.","antiPatternHeadline":"Creating unmanaged logical replication slots without failover capability or synchronized standby coordination, causing stream loss or massive duplicates on failover.","stars_count":94,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","logical-replication","high-availability","failover","cdc"],"exportEndpoints":{"claude":"/api/rules/postgres-17-logical-replication-failover-slot-sync-postgresql-17-lo-524?format=claude","cursorMdc":"/api/rules/postgres-17-logical-replication-failover-slot-sync-postgresql-17-lo-524?format=mdc","cursorrules":"/api/rules/postgres-17-logical-replication-failover-slot-sync-postgresql-17-lo-524?format=cursor","windsurf":"/api/rules/postgres-17-logical-replication-failover-slot-sync-postgresql-17-lo-524?format=windsurf","agents":"/api/rules/postgres-17-logical-replication-failover-slot-sync-postgresql-17-lo-524?format=agents"}},{"id":"bun-native-websocket-kernel-backpressure-standard","title":"Bun 1.2 Clustered WebSocket Kernel Backpressure & Buffer Guardrail","category":"backend","severity":"critical","description":"Enforces strict socket-level backpressure management and native drain lifecycle handling in Bun 1.2 clustered WebSocket runtimes. Prevents catastrophic OOM container restarts caused by unbounded kernel/C++ buffer accumulation when streaming high-frequency LLM tokens to slow TCP clients.","antiPatternHeadline":"Unbounded WebSocket Token Streaming without Native Buffer Probing or Drain Suspension","stars_count":78,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","websockets","backpressure","llm-streaming","memory-management"],"exportEndpoints":{"claude":"/api/rules/bun-native-websocket-kernel-backpressure-standard?format=claude","cursorMdc":"/api/rules/bun-native-websocket-kernel-backpressure-standard?format=mdc","cursorrules":"/api/rules/bun-native-websocket-kernel-backpressure-standard?format=cursor","windsurf":"/api/rules/bun-native-websocket-kernel-backpressure-standard?format=windsurf","agents":"/api/rules/bun-native-websocket-kernel-backpressure-standard?format=agents"}},{"id":"tauri2-ipc-capability-origin-isolation","title":"Tauri 2.0 IPC Capability Granular Scoping and Origin Isolation","category":"mobile","severity":"critical","description":"Enforces strict principle-of-least-privilege IPC capabilities and remote-origin isolation across mobile WebViews under Tauri 2.0. Eliminates wildcard IPC plugin bindings, prevents unvalidated origin access to native platform bridges, and guarantees that frontend commands adhere to cryptographically and syntactically scoped JSON capabilities on both Android and iOS runtimes.","antiPatternHeadline":"Wildcard Capability Bindings and Unscoped IPC Invocations Across Webview Origins","stars_count":114,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri2","ipc-security","capabilities","origin-isolation"],"exportEndpoints":{"claude":"/api/rules/tauri2-ipc-capability-origin-isolation?format=claude","cursorMdc":"/api/rules/tauri2-ipc-capability-origin-isolation?format=mdc","cursorrules":"/api/rules/tauri2-ipc-capability-origin-isolation?format=cursor","windsurf":"/api/rules/tauri2-ipc-capability-origin-isolation?format=windsurf","agents":"/api/rules/tauri2-ipc-capability-origin-isolation?format=agents"}},{"id":"kmp-compose-state-mutation-boundary","title":"Enforce Target-Native Main Dispatcher Boundaries for Compose Multiplatform State Mutations","category":"mobile","severity":"critical","description":"Ensures all shared Kotlin Multiplatform (KMP) StateFlow, SharedFlow, and Compose runtime state mutations execute strictly on Dispatchers.Main.immediate. Cross-thread state updates originating from background dispatchers bypass UIKit and Android Choreographer synchronizations, inducing UI race conditions, deadlocks, and missed recomposition frames.","antiPatternHeadline":"Mutating Shared ViewState on Unconfined or Worker Dispatchers Triggering Multiplatform UI Desynchronization","stars_count":44,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kmp","compose-multiplatform","coroutines","stateflow","concurrency"],"exportEndpoints":{"claude":"/api/rules/kmp-compose-state-mutation-boundary?format=claude","cursorMdc":"/api/rules/kmp-compose-state-mutation-boundary?format=mdc","cursorrules":"/api/rules/kmp-compose-state-mutation-boundary?format=cursor","windsurf":"/api/rules/kmp-compose-state-mutation-boundary?format=windsurf","agents":"/api/rules/kmp-compose-state-mutation-boundary?format=agents"}},{"id":"webauthn-prf-zk-key-derivation-standard-webauthn-prf-ext-701","title":"Zero-Knowledge Hardware-Derived Cryptographic Keys via WebAuthn PRF Extension","category":"security","severity":"critical","description":"Enforces strict client-side symmetric key derivation from hardware authenticators using the WebAuthn Pseudo-Random Function (PRF) extension (HMAC-secret). Raw derived keys, PRF evaluation outputs, and unencrypted key materials must never be transmitted to the application server or persisted in non-ephemeral storage, maintaining absolute zero-knowledge privacy.","antiPatternHeadline":"Transmitting Raw PRF Outputs or Derived Master Keys to Servers and Persisting Unencrypted Key Material","stars_count":46,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","prf-extension","cryptography","zero-knowledge","webcrypto"],"exportEndpoints":{"claude":"/api/rules/webauthn-prf-zk-key-derivation-standard-webauthn-prf-ext-701?format=claude","cursorMdc":"/api/rules/webauthn-prf-zk-key-derivation-standard-webauthn-prf-ext-701?format=mdc","cursorrules":"/api/rules/webauthn-prf-zk-key-derivation-standard-webauthn-prf-ext-701?format=cursor","windsurf":"/api/rules/webauthn-prf-zk-key-derivation-standard-webauthn-prf-ext-701?format=windsurf","agents":"/api/rules/webauthn-prf-zk-key-derivation-standard-webauthn-prf-ext-701?format=agents"}},{"id":"cedar-policy-slicing-evaluation-fence","title":"Cedar Engine Compile-Time Policy Slicing and In-Memory Evaluation Fence","category":"security","severity":"critical","description":"Enforces deterministic, sub-millisecond Cedar authorization decisions by mandating static compile-time policy slicing and a strict zero-network evaluation fence. Prohibits in-band network fetches, uncompiled schema validations, and dynamic policy discovery within the critical evaluation loop.","antiPatternHeadline":"In-Band Remote Policy Retrieval and Dynamic Attribute Hydration During Authorization Evaluation","stars_count":48,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","cedar","authorization","zero-trust","performance","abac"],"exportEndpoints":{"claude":"/api/rules/cedar-policy-slicing-evaluation-fence?format=claude","cursorMdc":"/api/rules/cedar-policy-slicing-evaluation-fence?format=mdc","cursorrules":"/api/rules/cedar-policy-slicing-evaluation-fence?format=cursor","windsurf":"/api/rules/cedar-policy-slicing-evaluation-fence?format=windsurf","agents":"/api/rules/cedar-policy-slicing-evaluation-fence?format=agents"}},{"id":"ebpf-tetragon-namespace-execution-lineage-gate","title":"eBPF Cilium Tetragon Runtime Namespace Execution Lineage Gate","category":"devops","severity":"critical","description":"Enforces synchronous in-kernel blocking via Cilium Tetragon TracingPolicies on sys_execve/sys_execveat to prevent container breakouts and unauthorized shell spawns. Requires strict process lineage validation and deterministic SIGKILL enforcement before syscall return, rejecting asynchronous user-space post-facto audit logging.","antiPatternHeadline":"Relying on Asynchronous User-Space Auditing or Permissive Non-Enforcing TracingPolicies for Container Executions","stars_count":117,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","cilium","tetragon","kubernetes","runtime-security","security"],"exportEndpoints":{"claude":"/api/rules/ebpf-tetragon-namespace-execution-lineage-gate?format=claude","cursorMdc":"/api/rules/ebpf-tetragon-namespace-execution-lineage-gate?format=mdc","cursorrules":"/api/rules/ebpf-tetragon-namespace-execution-lineage-gate?format=cursor","windsurf":"/api/rules/ebpf-tetragon-namespace-execution-lineage-gate?format=windsurf","agents":"/api/rules/ebpf-tetragon-namespace-execution-lineage-gate?format=agents"}},{"id":"nextjs15-ppr-streaming-hole-hydration-fence","title":"Next.js 15 Partial Prerendering (PPR) Streaming Hole Hydration Fence Standard","category":"frontend","severity":"critical","description":"Enforces strict structural boundaries and layout-stable hydration fences around dynamic streaming holes in Next.js 15 Partial Prerendering (PPR). Prevents dynamic data bailout of static prerender shells, uncoordinated cumulative layout shifts (CLS), and client-side hydration race conditions across progressive streaming boundaries.","antiPatternHeadline":"Unbounded Dynamic Hole Streaming Causing PPR De-optimization and Hydration Layout Collapse","stars_count":49,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs15","ppr","react19","hydration","streaming","performance"],"exportEndpoints":{"claude":"/api/rules/nextjs15-ppr-streaming-hole-hydration-fence?format=claude","cursorMdc":"/api/rules/nextjs15-ppr-streaming-hole-hydration-fence?format=mdc","cursorrules":"/api/rules/nextjs15-ppr-streaming-hole-hydration-fence?format=cursor","windsurf":"/api/rules/nextjs15-ppr-streaming-hole-hydration-fence?format=windsurf","agents":"/api/rules/nextjs15-ppr-streaming-hole-hydration-fence?format=agents"}},{"id":"openfga-rebac-depth-clamping-cycle-guardrail","title":"OpenFGA ReBAC Recursive Cycle Clamping and Transitive Graph Depth Standard","category":"backend","severity":"critical","description":"Prevents catastrophic denial-of-service vulnerabilities caused by unbounded transitive graph traversals, circular group nestings, and unchecked contextual tuple expansions in OpenFGA Relationship-Based Access Control (ReBAC). Mandates cycle-detection pre-validation on tuple writes, strict execution budgets with deadline clamping on authorization checks, and fail-closed traversal boundary policies.","antiPatternHeadline":"Unbounded ReBAC Graph Traversal and Cyclic Relation Expansion Causing Service Starvation","stars_count":83,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","openfga","authorization","rebac","security","dos-prevention","distributed-systems"],"exportEndpoints":{"claude":"/api/rules/openfga-rebac-depth-clamping-cycle-guardrail?format=claude","cursorMdc":"/api/rules/openfga-rebac-depth-clamping-cycle-guardrail?format=mdc","cursorrules":"/api/rules/openfga-rebac-depth-clamping-cycle-guardrail?format=cursor","windsurf":"/api/rules/openfga-rebac-depth-clamping-cycle-guardrail?format=windsurf","agents":"/api/rules/openfga-rebac-depth-clamping-cycle-guardrail?format=agents"}},{"id":"bun-websocket-hibernation-eviction-boundary","title":"Bun 1.2 WebSocket Engine Server-Side Hibernation & Memory Eviction Guardrail","category":"backend","severity":"critical","description":"Enforces Bun 1.2 native uWebSockets-backed server-side hibernation semantics for ultra-dense real-time connection pooling. Prevents JavaScript V8/JSC heap exhaustion by eliminating long-lived JavaScript closure references, external maps, and non-pruned buffers, allowing idle sockets to drop their JS wrappers and sleep in kernel memory without V8 heap allocation.","antiPatternHeadline":"Retaining JavaScript Object References and External Map Registries for Dormant WebSockets","stars_count":104,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","websockets","memory-management","concurrency","performance"],"exportEndpoints":{"claude":"/api/rules/bun-websocket-hibernation-eviction-boundary?format=claude","cursorMdc":"/api/rules/bun-websocket-hibernation-eviction-boundary?format=mdc","cursorrules":"/api/rules/bun-websocket-hibernation-eviction-boundary?format=cursor","windsurf":"/api/rules/bun-websocket-hibernation-eviction-boundary?format=windsurf","agents":"/api/rules/bun-websocket-hibernation-eviction-boundary?format=agents"}},{"id":"fastapi-anyio-taskgroup-shielding-invariant","title":"FastAPI AnyIO Structured TaskGroup Exception Shielding Invariant","category":"backend","severity":"critical","description":"Enforces strict structured concurrency via AnyIO TaskGroups within FastAPI asynchronous execution contexts to guarantee deterministic cancellation propagation. Prevents orphaned background tasks and resource leaks by mandating explicit cancellation scopes and shielding critical cleanup blocks during task group failure.","antiPatternHeadline":"Unstructured coroutine spawning via asyncio.create_task or unshielded cancellation blocks leaking zombie background workers.","stars_count":99,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["fastapi","anyio","asyncio","structured-concurrency","cancellation","backend"],"exportEndpoints":{"claude":"/api/rules/fastapi-anyio-taskgroup-shielding-invariant?format=claude","cursorMdc":"/api/rules/fastapi-anyio-taskgroup-shielding-invariant?format=mdc","cursorrules":"/api/rules/fastapi-anyio-taskgroup-shielding-invariant?format=cursor","windsurf":"/api/rules/fastapi-anyio-taskgroup-shielding-invariant?format=windsurf","agents":"/api/rules/fastapi-anyio-taskgroup-shielding-invariant?format=agents"}},{"id":"capacitor-7-webview-bridge-origin-isolation-guardrail","title":"Capacitor 7 Native Bridge Origin Isolation and IPC Cryptographic Token Binding","category":"mobile","severity":"critical","description":"Enforces cryptographic origin binding and strict webview context isolation on the Capacitor 7 JavaScript-to-Native bridge. Prevents unauthorized native plugin invocation by rogue cross-origin iframes, malicious redirect targets, and injected third-party scripts through mutual token verification and strict origin assertion during bridge bootstrap.","antiPatternHeadline":"Unvalidated Capacitor Bridge Exposure Allowing Arbitrary Cross-Origin Native Plugin Execution","stars_count":40,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","security","ipc","webview","origin-isolation"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-webview-bridge-origin-isolation-guardrail?format=claude","cursorMdc":"/api/rules/capacitor-7-webview-bridge-origin-isolation-guardrail?format=mdc","cursorrules":"/api/rules/capacitor-7-webview-bridge-origin-isolation-guardrail?format=cursor","windsurf":"/api/rules/capacitor-7-webview-bridge-origin-isolation-guardrail?format=windsurf","agents":"/api/rules/capacitor-7-webview-bridge-origin-isolation-guardrail?format=agents"}},{"id":"kmp-wasm-cooperative-gc-memory-pressure-standard","title":"KMP Kotlin/Wasm Cooperative GC Browser Memory Pressure Yield Standard","category":"mobile","severity":"critical","description":"Regulates cross-platform shared Kotlin/Wasm runtime heap allocations against host browser memory-pressure events to avert silent tab terminations. Mandates cooperative coroutine yielding to browser event loop cycles and proactive cache eviction under host memory constraints.","antiPatternHeadline":"Unyielding synchronous allocation loops in Kotlin/Wasm starving host browser GC and triggering mobile browser tab terminations","stars_count":88,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kmp","wasm","wasm-gc","memory-management","browser-performance"],"exportEndpoints":{"claude":"/api/rules/kmp-wasm-cooperative-gc-memory-pressure-standard?format=claude","cursorMdc":"/api/rules/kmp-wasm-cooperative-gc-memory-pressure-standard?format=mdc","cursorrules":"/api/rules/kmp-wasm-cooperative-gc-memory-pressure-standard?format=cursor","windsurf":"/api/rules/kmp-wasm-cooperative-gc-memory-pressure-standard?format=windsurf","agents":"/api/rules/kmp-wasm-cooperative-gc-memory-pressure-standard?format=agents"}},{"id":"webauthn-l3-prf-symmetric-key-derivation-guardrail","title":"WebAuthn Level 3 PRF Hardware-Anchored Symmetric Key Derivation Protocol","category":"security","severity":"critical","description":"Enforces strict cryptographic hygiene when using the WebAuthn Level 3 PRF (Pseudo-Random Function) extension for zero-knowledge client-side encryption. Requires non-extractable Web Crypto API key handles, domain-separated HKDF salt inputs, resilient extension capability checks, and explicit volatile memory zeroization to prevent key exfiltration via DOM XSS.","antiPatternHeadline":"Deriving client encryption keys from authenticator signatures or retaining extractable raw PRF outputs in browser heap","stars_count":76,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","prf-extension","passkeys","web-crypto","zero-knowledge"],"exportEndpoints":{"claude":"/api/rules/webauthn-l3-prf-symmetric-key-derivation-guardrail?format=claude","cursorMdc":"/api/rules/webauthn-l3-prf-symmetric-key-derivation-guardrail?format=mdc","cursorrules":"/api/rules/webauthn-l3-prf-symmetric-key-derivation-guardrail?format=cursor","windsurf":"/api/rules/webauthn-l3-prf-symmetric-key-derivation-guardrail?format=windsurf","agents":"/api/rules/webauthn-l3-prf-symmetric-key-derivation-guardrail?format=agents"}},{"id":"spiffe-spire-svid-renewal-grace-period-invariant","title":"SPIFFE/SPIRE X.509-SVID Proactive Two-Thirds Lifetime Renewal Invariant","category":"security","severity":"critical","description":"Enforces deterministic certificate rotation scheduling before the two-thirds (2/3) validity boundary of short-lived X.509 SVIDs expires. Prohibits lazy or reactive attestation lookups to prevent synchronous TLS handshake failures and connection severance across high-throughput service meshes. Guarantees non-blocking in-memory TLS context hot-reloading backed by jittered background attestation routines.","antiPatternHeadline":"Lazy or Half-Life SVID Renewal Causing Mesh Handshake Failures","stars_count":113,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","spiffe","spire","mtls","zero-trust","certificate-lifecycle"],"exportEndpoints":{"claude":"/api/rules/spiffe-spire-svid-renewal-grace-period-invariant?format=claude","cursorMdc":"/api/rules/spiffe-spire-svid-renewal-grace-period-invariant?format=mdc","cursorrules":"/api/rules/spiffe-spire-svid-renewal-grace-period-invariant?format=cursor","windsurf":"/api/rules/spiffe-spire-svid-renewal-grace-period-invariant?format=windsurf","agents":"/api/rules/spiffe-spire-svid-renewal-grace-period-invariant?format=agents"}},{"id":"opentelemetry-otlp-exporter-nonblocking-ring-buffer-backpressure-dropping-standard","title":"OpenTelemetry OTLP Exporter Non-Blocking Ring Buffer and Backpressure Dropping Standard","category":"devops","severity":"critical","description":"Enforces strict bounding on OpenTelemetry BatchSpanProcessor and BatchLogRecordProcessor queues to eliminate memory leaks and event loop starvation during upstream collector latency or outages. Invariants require explicit bounded queue size ceilings, strict export timeouts, non-blocking telemetry generation, and observable drop counters. Telemetry generation must never degrade primary business logic availability or latency.","antiPatternHeadline":"Unbounded or Blocking Telemetry Export Causing Host Out-Of-Memory Crashes and Event Loop Starvation","stars_count":81,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","backpressure","observability","reliability","node"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-otlp-exporter-nonblocking-ring-buffer-backpressure-dropping-standard?format=claude","cursorMdc":"/api/rules/opentelemetry-otlp-exporter-nonblocking-ring-buffer-backpressure-dropping-standard?format=mdc","cursorrules":"/api/rules/opentelemetry-otlp-exporter-nonblocking-ring-buffer-backpressure-dropping-standard?format=cursor","windsurf":"/api/rules/opentelemetry-otlp-exporter-nonblocking-ring-buffer-backpressure-dropping-standard?format=windsurf","agents":"/api/rules/opentelemetry-otlp-exporter-nonblocking-ring-buffer-backpressure-dropping-standard?format=agents"}},{"id":"k8s-inplace-vertical-scaling-cgroupv2-guardrail","title":"Kubernetes In-Place Pod Vertical Scaling Cgroupv2 Dynamic Throttling Guardrail","category":"devops","severity":"critical","description":"Enforces strict resource adjustment sequences and kernel-level Pressure Stall Information (PSI) synchronization during Kubernetes In-Place Pod Vertical Scaling (KEP-1287). Prevents fatal kernel Out-Of-Memory (OOM) invocations and multi-second CFS CPU throttling collapses when shifting cgroupv2 memory.max, memory.high, and cpu.max controllers without restarting containers.","antiPatternHeadline":"Directly Patching Pod Spec Limits Below Active Cgroupv2 Working Sets Inducing Kernel OOM Kills","stars_count":89,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","kubernetes","cgroupv2","in-place-scaling","linux-kernel","resource-management"],"exportEndpoints":{"claude":"/api/rules/k8s-inplace-vertical-scaling-cgroupv2-guardrail?format=claude","cursorMdc":"/api/rules/k8s-inplace-vertical-scaling-cgroupv2-guardrail?format=mdc","cursorrules":"/api/rules/k8s-inplace-vertical-scaling-cgroupv2-guardrail?format=cursor","windsurf":"/api/rules/k8s-inplace-vertical-scaling-cgroupv2-guardrail?format=windsurf","agents":"/api/rules/k8s-inplace-vertical-scaling-cgroupv2-guardrail?format=agents"}},{"id":"nextjs-15-async-request-context-boundary","title":"Next.js 15 Async Request Context & Dynamic Data Boundary Guardrail","category":"frontend","severity":"critical","description":"Enforces strict asynchronous resolution of Next.js 15 dynamic request APIs (cookies, headers, params, searchParams) and prevents cross-request context leakage in React 19 concurrent server rendering environments. Prohibits global or module-scoped mutable request caches that risk multi-tenant contamination during concurrent microtask execution.","antiPatternHeadline":"Synchronous consumption or module-scoped caching of request primitives leaking tenant data across concurrent server renders","stars_count":49,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs-15","react-19","server-components","async-context","data-isolation"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-async-request-context-boundary?format=claude","cursorMdc":"/api/rules/nextjs-15-async-request-context-boundary?format=mdc","cursorrules":"/api/rules/nextjs-15-async-request-context-boundary?format=cursor","windsurf":"/api/rules/nextjs-15-async-request-context-boundary?format=windsurf","agents":"/api/rules/nextjs-15-async-request-context-boundary?format=agents"}},{"id":"pg17-logical-replication-slot-sync-failover-invariant","title":"Postgres 17 Logical Replication Slot Failover Synchronization Invariant","category":"backend","severity":"critical","description":"Postgres 17 introduces native logical replication slot synchronization from primary to physical standbys via failover-enabled logical slots and the standby sync_replication_slots worker. Without configuring failover = true on the slot, ensuring the physical standby is listed in synchronized_standby_slots on the primary, and enabling sync_replication_slots on the standby, HA failovers cause downstream CDC pipelines to re-read from stale restart_lsn or crash due to missing slots, producing massive event duplication or data divergence.","antiPatternHeadline":"Creating Logical Replication Slots Without Failover Support Leading to Stale LSNs or Total Slot Loss Post-Failover","stars_count":89,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","postgres-17","cdc","debezium","replication","high-availability"],"exportEndpoints":{"claude":"/api/rules/pg17-logical-replication-slot-sync-failover-invariant?format=claude","cursorMdc":"/api/rules/pg17-logical-replication-slot-sync-failover-invariant?format=mdc","cursorrules":"/api/rules/pg17-logical-replication-slot-sync-failover-invariant?format=cursor","windsurf":"/api/rules/pg17-logical-replication-slot-sync-failover-invariant?format=windsurf","agents":"/api/rules/pg17-logical-replication-slot-sync-failover-invariant?format=agents"}},{"id":"axum-hyper-v1-http2-stream-drain-governor","title":"Axum Hyper-v1 Multiplexed HTTP/2 Stream Drain Governor","category":"backend","severity":"critical","description":"Enforces a deterministic two-phase HTTP/2 connection drain protocol with bounded eviction deadlines on Axum Hyper-v1 servers during SIGTERM signals. Prevents persistent multiplexed keep-alive streams from stalling rolling blue/green deployments and inducing abrupt SIGKILL dropped connections.","antiPatternHeadline":"Unbounded HTTP/2 Keep-Alive Connection Deadlock During Container Termination","stars_count":104,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","hyper","http2","kubernetes","graceful-shutdown"],"exportEndpoints":{"claude":"/api/rules/axum-hyper-v1-http2-stream-drain-governor?format=claude","cursorMdc":"/api/rules/axum-hyper-v1-http2-stream-drain-governor?format=mdc","cursorrules":"/api/rules/axum-hyper-v1-http2-stream-drain-governor?format=cursor","windsurf":"/api/rules/axum-hyper-v1-http2-stream-drain-governor?format=windsurf","agents":"/api/rules/axum-hyper-v1-http2-stream-drain-governor?format=agents"}},{"id":"webauthn-conditional-ui-signal-revocation-sync","title":"Mandatory WebAuthn Signal API Synchronization for Revoked Passkey Lifecycle State","category":"security","severity":"critical","description":"Enforces synchronous and distributed broadcast of passkey revocation events via the WebAuthn Signal API (PublicKeyCredential.signalUnknownCredential and signalAllAcceptedCredentials). When a credential is deleted or revoked at an identity provider or relying party, client-side autofill caches and peer relying parties must update their credential stores immediately to eliminate autofill presentation and replay of invalid credentials during Conditional UI flows.","antiPatternHeadline":"Silent Server-Side Deletion Without Signal API Notification Causing Conditional UI Ghost Passkey Loops","stars_count":115,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","passkeys","conditional-ui","signal-api","fido2"],"exportEndpoints":{"claude":"/api/rules/webauthn-conditional-ui-signal-revocation-sync?format=claude","cursorMdc":"/api/rules/webauthn-conditional-ui-signal-revocation-sync?format=mdc","cursorrules":"/api/rules/webauthn-conditional-ui-signal-revocation-sync?format=cursor","windsurf":"/api/rules/webauthn-conditional-ui-signal-revocation-sync?format=windsurf","agents":"/api/rules/webauthn-conditional-ui-signal-revocation-sync?format=agents"}},{"id":"kmp-swift-task-cancellation-bridge-standard-kmp-structured-c-258","title":"KMP Structured Concurrency Bidirectional Swift Task Cancellation Bridge","category":"mobile","severity":"critical","description":"Enforces strict cooperative cancellation semantics across the Kotlin Native/Objective-C/Swift interop boundary. Requires binding Kotlin Job completion handles and Swift withTaskCancellationHandler hooks to eliminate orphaned background threads, resource leaks, and uncoordinated task execution.","antiPatternHeadline":"Fire-and-Forget Kotlin Coroutines Inside Unbound Swift Async Contexts Causing Zombie Executions","stars_count":102,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kmp","kotlin-multiplatform","swift-concurrency","structured-concurrency","ios"],"exportEndpoints":{"claude":"/api/rules/kmp-swift-task-cancellation-bridge-standard-kmp-structured-c-258?format=claude","cursorMdc":"/api/rules/kmp-swift-task-cancellation-bridge-standard-kmp-structured-c-258?format=mdc","cursorrules":"/api/rules/kmp-swift-task-cancellation-bridge-standard-kmp-structured-c-258?format=cursor","windsurf":"/api/rules/kmp-swift-task-cancellation-bridge-standard-kmp-structured-c-258?format=windsurf","agents":"/api/rules/kmp-swift-task-cancellation-bridge-standard-kmp-structured-c-258?format=agents"}},{"id":"fastapi-0-115-async-lifespan-subapp-isolation","title":"FastAPI 0.115+ Async Lifespan Sub-Application Scope Isolation Standard","category":"backend","severity":"critical","description":"Enforces strict ASGI lifespan context isolation between root FastAPI orchestrators and mounted sub-applications in FastAPI 0.115+. Prevents shared mutable state, connection handle leakage, and skipped sub-application lifespan teardown phases when mounting isolated services or multi-tenant sub-apps under a shared server process.","antiPatternHeadline":"Mounting Sub-Applications with Root-Inherited State or Uninvoked Isolated Lifespans","stars_count":47,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","asgi","lifespan","concurrency","tenancy","python"],"exportEndpoints":{"claude":"/api/rules/fastapi-0-115-async-lifespan-subapp-isolation?format=claude","cursorMdc":"/api/rules/fastapi-0-115-async-lifespan-subapp-isolation?format=mdc","cursorrules":"/api/rules/fastapi-0-115-async-lifespan-subapp-isolation?format=cursor","windsurf":"/api/rules/fastapi-0-115-async-lifespan-subapp-isolation?format=windsurf","agents":"/api/rules/fastapi-0-115-async-lifespan-subapp-isolation?format=agents"}},{"id":"opentelemetry-span-cardinality-governor","title":"OpenTelemetry High-Throughput Span Attribute Cardinality Throttling Governor","category":"devops","severity":"critical","description":"Enforces strict bounds and dynamic bucketing on span attribute key-value pairs across high-throughput microsecond RPC paths. Unchecked high-cardinality metadata (e.g., raw UUIDs, unbounded customer inputs, arbitrary query params) causes exponential memory growth and downstream time-series backend crashes. Implements pre-allocated attribute filtering, LRU-bounded dimension clamping, and fallback rollups directly within the OpenTelemetry SpanProcessor lifecycle.","antiPatternHeadline":"Injecting Dynamic Unbounded Identifiers Directly into OpenTelemetry Span Attributes","stars_count":79,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","observability","tracing","cardinality-explosion","performance"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-span-cardinality-governor?format=claude","cursorMdc":"/api/rules/opentelemetry-span-cardinality-governor?format=mdc","cursorrules":"/api/rules/opentelemetry-span-cardinality-governor?format=cursor","windsurf":"/api/rules/opentelemetry-span-cardinality-governor?format=windsurf","agents":"/api/rules/opentelemetry-span-cardinality-governor?format=agents"}},{"id":"k8s-gateway-api-backend-tls-policy-zero-trust","title":"Kubernetes Gateway API BackendTLSPolicy Zero-Trust Pod Termination Invariant","category":"devops","severity":"critical","description":"Enforces cryptographic end-to-end encryption from Kubernetes Gateway controllers directly to pod workload endpoints using Gateway API BackendTLSPolicy. Mandates explicit CA trust anchor configuration and Subject Alternative Name (SAN) validation to eliminate plaintext intra-cluster egress without the compute, memory, and latency overhead of service mesh sidecars.","antiPatternHeadline":"Terminating TLS at Gateway and Forwarding Plaintext HTTP to Backend Pods Across Cluster Network Fabric","stars_count":51,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","kubernetes","gateway-api","zero-trust","backend-tls-policy","tls-verification","security"],"exportEndpoints":{"claude":"/api/rules/k8s-gateway-api-backend-tls-policy-zero-trust?format=claude","cursorMdc":"/api/rules/k8s-gateway-api-backend-tls-policy-zero-trust?format=mdc","cursorrules":"/api/rules/k8s-gateway-api-backend-tls-policy-zero-trust?format=cursor","windsurf":"/api/rules/k8s-gateway-api-backend-tls-policy-zero-trust?format=windsurf","agents":"/api/rules/k8s-gateway-api-backend-tls-policy-zero-trust?format=agents"}},{"id":"openfga-modular-compilation-cycle-detection-standard","title":"OpenFGA Modular Authorization Model Compilation and Cycle Detection Standard","category":"security","severity":"critical","description":"Enforces strict static graph cycle detection and validation during the compilation phase of OpenFGA modular authorization models. Prevents unconstrained recursive relation expansion (such as nested group hierarchies or cross-module tuple-to-userset cycles) that trigger evaluation engine timeouts, Denial of Service (DoS), or runaway latency in production Check calls.","antiPatternHeadline":"Unvalidated Cross-Module Tupleset Recursion Causing Infinite Check Evaluation and Engine Starvation","stars_count":63,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","authorization","rebac","graph-algorithms","cycle-detection","modular-schemas"],"exportEndpoints":{"claude":"/api/rules/openfga-modular-compilation-cycle-detection-standard?format=claude","cursorMdc":"/api/rules/openfga-modular-compilation-cycle-detection-standard?format=mdc","cursorrules":"/api/rules/openfga-modular-compilation-cycle-detection-standard?format=cursor","windsurf":"/api/rules/openfga-modular-compilation-cycle-detection-standard?format=windsurf","agents":"/api/rules/openfga-modular-compilation-cycle-detection-standard?format=agents"}},{"id":"react-19-metadata-hoisting-style-precedence","title":"React 19 Document Metadata Hoisting and Deterministic Style Precedence Guardrail","category":"frontend","severity":"critical","description":"Enforces native React 19 document metadata hoisting and deterministic stylesheet cascade precedence across concurrent server-client streaming transitions. Eliminates Flash of Unstyled Content (FOUC) and Cumulative Layout Shift (CLS) by mandating explicit precedence attributes on stylesheets and utilizing react-dom resource discovery APIs over legacy imperative link injection.","antiPatternHeadline":"Imperative Client-Side DOM Injection or Missing Precedence on Streaming Stylesheets Inducing Cascade Inversion","stars_count":49,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","ssr-streaming","metadata-hoisting","css-cascade","layout-shift"],"exportEndpoints":{"claude":"/api/rules/react-19-metadata-hoisting-style-precedence?format=claude","cursorMdc":"/api/rules/react-19-metadata-hoisting-style-precedence?format=mdc","cursorrules":"/api/rules/react-19-metadata-hoisting-style-precedence?format=cursor","windsurf":"/api/rules/react-19-metadata-hoisting-style-precedence?format=windsurf","agents":"/api/rules/react-19-metadata-hoisting-style-precedence?format=agents"}},{"id":"axum-webtransport-quic-stream-flow-control","title":"Axum 0.8 WebTransport Stream Multiplexing & Flow-Control Guardrails","category":"backend","severity":"critical","description":"Enforces bounded per-stream memory allocations and strict backpressure propagation across multiplexed WebTransport streams in Axum 0.8 HTTP/3 architectures. Eliminates head-of-line blocking, unbounded heap bloat, and connection starvation during asynchronous QUIC connection migration events.","antiPatternHeadline":"Unbounded Stream Buffering and Unguarded Task Spawning During QUIC Connection Migration","stars_count":47,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","webtransport","quic","flow-control","http3"],"exportEndpoints":{"claude":"/api/rules/axum-webtransport-quic-stream-flow-control?format=claude","cursorMdc":"/api/rules/axum-webtransport-quic-stream-flow-control?format=mdc","cursorrules":"/api/rules/axum-webtransport-quic-stream-flow-control?format=cursor","windsurf":"/api/rules/axum-webtransport-quic-stream-flow-control?format=windsurf","agents":"/api/rules/axum-webtransport-quic-stream-flow-control?format=agents"}},{"id":"vite6-environment-weakref-context-gc-guardrail","title":"Vite 6 Environment API WeakRef & FinalizationRegistry Context Reclamation","category":"frontend","severity":"critical","description":"Enforces strict memory reclamation for multi-runtime SSR module evaluations using Vite 6's Environment API. Strong references to transient DevEnvironment runner scopes, execution contexts, and evaluated module graphs MUST be replaced with WeakRef and tracked via FinalizationRegistry to prevent fatal heap exhaustion during Hot Module Replacement (HMR).","antiPatternHeadline":"Retaining Strong References to Multi-Runtime SSR ModuleRunner Contexts Across HMR Cycles","stars_count":111,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","vite6","ssr","memory-leaks","weakref","hmr"],"exportEndpoints":{"claude":"/api/rules/vite6-environment-weakref-context-gc-guardrail?format=claude","cursorMdc":"/api/rules/vite6-environment-weakref-context-gc-guardrail?format=mdc","cursorrules":"/api/rules/vite6-environment-weakref-context-gc-guardrail?format=cursor","windsurf":"/api/rules/vite6-environment-weakref-context-gc-guardrail?format=windsurf","agents":"/api/rules/vite6-environment-weakref-context-gc-guardrail?format=agents"}},{"id":"kmp-wasm-gc-native-interop-lifetime-boundary","title":"KMP Wasm-GC Cross-Runtime Reference Lifetime Synchronization","category":"mobile","severity":"critical","description":"Eliminates cross-runtime frame drops and native bridge leaks by deterministically synchronizing Kotlin Multiplatform Wasm-GC allocations with host UI event cycles. Replaces non-deterministic finalizers with strict disposable handles and scoped host reference registries across the execution boundary.","antiPatternHeadline":"Implicit Cross-Runtime Retain Cycles Relying on Host GC Finalizers Leading to Dual-Heap Fragmentation and Frame Drops","stars_count":54,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","wasm-gc","interop","memory-management","performance"],"exportEndpoints":{"claude":"/api/rules/kmp-wasm-gc-native-interop-lifetime-boundary?format=claude","cursorMdc":"/api/rules/kmp-wasm-gc-native-interop-lifetime-boundary?format=mdc","cursorrules":"/api/rules/kmp-wasm-gc-native-interop-lifetime-boundary?format=cursor","windsurf":"/api/rules/kmp-wasm-gc-native-interop-lifetime-boundary?format=windsurf","agents":"/api/rules/kmp-wasm-gc-native-interop-lifetime-boundary?format=agents"}},{"id":"opentelemetry-genai-token-budget-span-invariants","title":"OpenTelemetry GenAI Semantic Conventions and Token Budget Span Invariants","category":"devops","severity":"critical","description":"Enforces strict OpenTelemetry GenAI semantic conventions across autonomous agent loops by propagating token consumption budgets through distributed trace baggage and spans. Every agent reasoning step must validate and deduct from a deterministic token allocation budget, halting execution cascades immediately upon budget breach.","antiPatternHeadline":"Unbounded Agentic Feedback Loops Without Distributed Token Budget Propagation and GenAI Spans","stars_count":53,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","genai","observability","distributed-tracing","token-budget"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-genai-token-budget-span-invariants?format=claude","cursorMdc":"/api/rules/opentelemetry-genai-token-budget-span-invariants?format=mdc","cursorrules":"/api/rules/opentelemetry-genai-token-budget-span-invariants?format=cursor","windsurf":"/api/rules/opentelemetry-genai-token-budget-span-invariants?format=windsurf","agents":"/api/rules/opentelemetry-genai-token-budget-span-invariants?format=agents"}},{"id":"k8s-132-dra-gpu-partitioning-contracts","title":"Deterministic Dynamic Resource Allocation (DRA) Multi-Tenant GPU Partitioning and Teardown","category":"devops","severity":"critical","description":"Enforces declarative Kubernetes 1.32 Dynamic Resource Allocation (resource.k8s.io/v1beta1) specifications for hardware-level sub-GPU slice provisioning (e.g., NVIDIA MIG, MPS, or vendor equivalents). Mandates deterministic ResourceClaim lifecycle parameters and preStop/finalizer teardown patterns to eliminate GPU memory leaks, compute engine fragmentation, and the need for node-level recycles across heterogeneous multi-tenant inference workloads.","antiPatternHeadline":"Over-subscribing shared GPUs via legacy limits or unmanaged host mounts leading to memory fragmentation and node draining","stars_count":49,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","kubernetes","k8s-132","dra","gpu","multi-tenancy","cuda","infrastructure-as-code"],"exportEndpoints":{"claude":"/api/rules/k8s-132-dra-gpu-partitioning-contracts?format=claude","cursorMdc":"/api/rules/k8s-132-dra-gpu-partitioning-contracts?format=mdc","cursorrules":"/api/rules/k8s-132-dra-gpu-partitioning-contracts?format=cursor","windsurf":"/api/rules/k8s-132-dra-gpu-partitioning-contracts?format=windsurf","agents":"/api/rules/k8s-132-dra-gpu-partitioning-contracts?format=agents"}},{"id":"amd-sev-snp-remote-attestation-secretless-bootstrapping","title":"AMD SEV-SNP Remote Attestation & Secretless Workload Bootstrapping","category":"security","severity":"critical","description":"Enforces strict validation of AMD SEV-SNP cryptographic hardware attestation before provisioning secrets or granting workload identities. Guarantees measurement integrity against golden digests, validates the AMD VCEK certificate chain against the AMD Root Key, binds report data to fresh ephemeral session keys, and strictly rejects debug-enabled or outdated TCB states.","antiPatternHeadline":"Trusting Host-Supplied Secrets Without Cryptographic Measurement and Nonce-Bound VCEK Attestation","stars_count":50,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","confidential-computing","amd-sev-snp","remote-attestation","zero-trust","secretless"],"exportEndpoints":{"claude":"/api/rules/amd-sev-snp-remote-attestation-secretless-bootstrapping?format=claude","cursorMdc":"/api/rules/amd-sev-snp-remote-attestation-secretless-bootstrapping?format=mdc","cursorrules":"/api/rules/amd-sev-snp-remote-attestation-secretless-bootstrapping?format=cursor","windsurf":"/api/rules/amd-sev-snp-remote-attestation-secretless-bootstrapping?format=windsurf","agents":"/api/rules/amd-sev-snp-remote-attestation-secretless-bootstrapping?format=agents"}},{"id":"go-124-weak-pointer-ephemeral-cache-routing","title":"Go 1.24 Weak Pointer Invalidation for Ephemeral Routing Caches","category":"backend","severity":"critical","description":"Mandates the use of Go 1.24 weak pointers (package weak) for transient routing and middleware cache registries. Prevents unbounded heap growth and circular reference retention where long-lived router caches retain short-lived HTTP request contexts and payloads past lifecycle termination.","antiPatternHeadline":"Strong Reference Pinning of Ephemeral Request Payloads in Long-Lived Routing Pipelines","stars_count":69,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","golang","go-1.24","memory-management","http-routing","weak-pointers"],"exportEndpoints":{"claude":"/api/rules/go-124-weak-pointer-ephemeral-cache-routing?format=claude","cursorMdc":"/api/rules/go-124-weak-pointer-ephemeral-cache-routing?format=mdc","cursorrules":"/api/rules/go-124-weak-pointer-ephemeral-cache-routing?format=cursor","windsurf":"/api/rules/go-124-weak-pointer-ephemeral-cache-routing?format=windsurf","agents":"/api/rules/go-124-weak-pointer-ephemeral-cache-routing?format=agents"}},{"id":"svelte-5-async-derived-race-condition-guardrail","title":"Svelte 5 Runes Async State & Effect Cancellation Fence Guardrail","category":"frontend","severity":"critical","description":"Enforces deterministic cancellation fences and monotonic generation checks for asynchronous operations driven by Svelte 5 runes. Prevents state tearing, out-of-order promise settlement, and microtask memory leaks during rapid client-side transitions by requiring AbortController cleanups in effects and custom resource runes.","antiPatternHeadline":"Unfenced Async Invocations within Runes Resulting in Stale Promise Overwrites and State Tearing","stars_count":61,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","concurrency","race-conditions","state-management"],"exportEndpoints":{"claude":"/api/rules/svelte-5-async-derived-race-condition-guardrail?format=claude","cursorMdc":"/api/rules/svelte-5-async-derived-race-condition-guardrail?format=mdc","cursorrules":"/api/rules/svelte-5-async-derived-race-condition-guardrail?format=cursor","windsurf":"/api/rules/svelte-5-async-derived-race-condition-guardrail?format=windsurf","agents":"/api/rules/svelte-5-async-derived-race-condition-guardrail?format=agents"}},{"id":"nextjs-15-ppr-boundary-isolation-contract","title":"Next.js 15 Partial Prerendering (PPR) Boundary Isolation Contract","category":"frontend","severity":"critical","description":"Enforces strict isolation between static pre-rendered HTML shells and dynamic React 19 streaming slots within Next.js 15 PPR architectures. Prevents accidental dynamic context leakage that causes entire page trees to de-optimize to dynamic SSR and trigger cascading hydration bailouts under high concurrency. Mandates explicit React Suspense boundaries around all dynamic I/O primitives including headers(), cookies(), and uncached fetch invocations.","antiPatternHeadline":"Dynamic Hook Leakage Inducing Full-Route Static Shell Bailout","stars_count":48,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs","react-19","ppr","performance","streaming"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-ppr-boundary-isolation-contract?format=claude","cursorMdc":"/api/rules/nextjs-15-ppr-boundary-isolation-contract?format=mdc","cursorrules":"/api/rules/nextjs-15-ppr-boundary-isolation-contract?format=cursor","windsurf":"/api/rules/nextjs-15-ppr-boundary-isolation-contract?format=windsurf","agents":"/api/rules/nextjs-15-ppr-boundary-isolation-contract?format=agents"}},{"id":"postgres-17-failover-replication-slot-sync-invariant","title":"PostgreSQL 17 Synchronized Failover Replication Slot Invariant","category":"backend","severity":"critical","description":"Enforces PostgreSQL 17 synchronized logical replication slot configurations (`failover = true` and `synchronized_standby_slots`) to ensure Change Data Capture (CDC) streams survive physical failover without message loss or slot rewinds. Standby promotion pipelines must verify slot synchronization convergence prior to triggering promotion.","antiPatternHeadline":"Promoting Physical Standbys or Creating Logical Slots Without Failover Synchronization","stars_count":65,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","cdc","database-reliability","high-availability","pg17"],"exportEndpoints":{"claude":"/api/rules/postgres-17-failover-replication-slot-sync-invariant?format=claude","cursorMdc":"/api/rules/postgres-17-failover-replication-slot-sync-invariant?format=mdc","cursorrules":"/api/rules/postgres-17-failover-replication-slot-sync-invariant?format=cursor","windsurf":"/api/rules/postgres-17-failover-replication-slot-sync-invariant?format=windsurf","agents":"/api/rules/postgres-17-failover-replication-slot-sync-invariant?format=agents"}},{"id":"fastapi-pydantic-v2-native-validation-firewall","title":"FastAPI Pydantic v2 Zero-Copy Native Validation Firewall","category":"backend","severity":"critical","description":"Protects ASGI endpoints against memory-exhaustion and JSON-bomb denial-of-service (DoS) attacks by enforcing strict stream-level byte caps prior to native Rust-based deserialization. Bypassing Starlette's unmetered `request.json()` and buffering streams directly into `pydantic-core` without ingress size guardrails allows malicious actors to crash worker runtimes via unbounded allocation.","antiPatternHeadline":"Unmetered Ingress Buffering into Pydantic-Core Native Deserializers","stars_count":77,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","pydantic-v2","security","dos-prevention","rust-ffi"],"exportEndpoints":{"claude":"/api/rules/fastapi-pydantic-v2-native-validation-firewall?format=claude","cursorMdc":"/api/rules/fastapi-pydantic-v2-native-validation-firewall?format=mdc","cursorrules":"/api/rules/fastapi-pydantic-v2-native-validation-firewall?format=cursor","windsurf":"/api/rules/fastapi-pydantic-v2-native-validation-firewall?format=windsurf","agents":"/api/rules/fastapi-pydantic-v2-native-validation-firewall?format=agents"}},{"id":"bun-sqlite-multi-worker-wal-coordinator","title":"Bun 1.2 Multi-Worker SQLite Isolated WAL Checkpoint Coordinator Standard","category":"backend","severity":"critical","description":"Enforces architectural isolation of SQLite WAL checkpoint execution in multi-threaded Bun 1.2 deployments to prevent unbounded WAL bloat and unrecoverable SQLITE_BUSY starvation. Mandates explicit disabling of worker-level auto-checkpoints and directs all PRAGMA wal_checkpoint operations through a singleton background coordinator worker.","antiPatternHeadline":"Concurrent Worker Checkpoints Causing SQLITE_BUSY Cascades and Unbounded WAL Bloat","stars_count":45,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","sqlite","wal","concurrency","workers"],"exportEndpoints":{"claude":"/api/rules/bun-sqlite-multi-worker-wal-coordinator?format=claude","cursorMdc":"/api/rules/bun-sqlite-multi-worker-wal-coordinator?format=mdc","cursorrules":"/api/rules/bun-sqlite-multi-worker-wal-coordinator?format=cursor","windsurf":"/api/rules/bun-sqlite-multi-worker-wal-coordinator?format=windsurf","agents":"/api/rules/bun-sqlite-multi-worker-wal-coordinator?format=agents"}},{"id":"kmp-swift-arc-cycle-detection-guardrail","title":"KMP to Swift-ObjC ARC Retain Cycle & Background Suspension Guardrail","category":"mobile","severity":"critical","description":"Enforces strict weak-proxy patterns and explicit teardown protocols across the Kotlin/Native and Swift ARC boundary. Prevents zombie memory retention and background jetsam termination (EXC_RESOURCE CPUMONITOR / 0x8badf00d) caused by cross-runtime circular references bridging tracing GC and reference counting.","antiPatternHeadline":"Direct Strong Bi-Directional Bridging Across Kotlin/Native and Swift Reference Boundaries","stars_count":91,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","swift","arc","ios","memory-leak"],"exportEndpoints":{"claude":"/api/rules/kmp-swift-arc-cycle-detection-guardrail?format=claude","cursorMdc":"/api/rules/kmp-swift-arc-cycle-detection-guardrail?format=mdc","cursorrules":"/api/rules/kmp-swift-arc-cycle-detection-guardrail?format=cursor","windsurf":"/api/rules/kmp-swift-arc-cycle-detection-guardrail?format=windsurf","agents":"/api/rules/kmp-swift-arc-cycle-detection-guardrail?format=agents"}},{"id":"openfga-distributed-tuple-invalidation-consensus-standard","title":"OpenFGA Distributed Tuple Invalidation Consensus Standard","category":"security","severity":"critical","description":"Enforces deterministic authorization consistency across distributed edge workers by binding OpenFGA relationship tuple mutations to transactional Change-Data-Capture (CDC) invalidation streams. Guarantees zero-staleness authorization evaluations by requiring cryptographic or monotonic sequence-token fencing on edge-cached check decisions, eliminating the 'New Enemy' stale privilege elevation window.","antiPatternHeadline":"Unsequenced Asynchronous Invalidation Allowing Edge Authorization Desynchronization and Privilege Drift","stars_count":82,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","fine-grained-authorization","distributed-cache","cdc","zanzibar"],"exportEndpoints":{"claude":"/api/rules/openfga-distributed-tuple-invalidation-consensus-standard?format=claude","cursorMdc":"/api/rules/openfga-distributed-tuple-invalidation-consensus-standard?format=mdc","cursorrules":"/api/rules/openfga-distributed-tuple-invalidation-consensus-standard?format=cursor","windsurf":"/api/rules/openfga-distributed-tuple-invalidation-consensus-standard?format=windsurf","agents":"/api/rules/openfga-distributed-tuple-invalidation-consensus-standard?format=agents"}},{"id":"webauthn-hardware-bound-stepup-attestation","title":"Hardware-Bound WebAuthn Step-Up Protocol with Secure Enclave Attestation & Backup Flag Enforcement","category":"security","severity":"critical","description":"Enforces non-exportable, hardware-attested platform credentials (Secure Enclave, TPM, StrongBox) for high-risk transactional boundaries. Rejects multi-device synced passkeys by cryptographically validating WebAuthn authenticator data Backup Eligibility (BE) and Backup State (BS) flags alongside cryptographic root-of-trust hardware attestation.","antiPatternHeadline":"Permitting Synced Passkeys (BE=1) or Unverified Attestation for High-Risk Transaction Boundaries","stars_count":72,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","fido2","passkeys","secure-enclave","step-up-auth","cryptography"],"exportEndpoints":{"claude":"/api/rules/webauthn-hardware-bound-stepup-attestation?format=claude","cursorMdc":"/api/rules/webauthn-hardware-bound-stepup-attestation?format=mdc","cursorrules":"/api/rules/webauthn-hardware-bound-stepup-attestation?format=cursor","windsurf":"/api/rules/webauthn-hardware-bound-stepup-attestation?format=windsurf","agents":"/api/rules/webauthn-hardware-bound-stepup-attestation?format=agents"}},{"id":"k8s-in-place-resize-memory-headroom-standard","title":"Kubernetes In-Place Pod Resize Dynamic Memory Headroom Standard","category":"devops","severity":"critical","description":"Enforces a two-phase staging protocol for live vertical scaling under KEP-1287 (In-Place Pod Vertical Scaling). Prevents kernel OOM-killer invocations by guaranteeing that container runtime cgroup v2 memory.max boundaries and kubelet allocated status are observed before expanding workload memory allocations (e.g., JVM heap, V8 heap, or cache pools).","antiPatternHeadline":"Simultaneously Increasing Workload Heap Consumption and Pod Resource Limits Triggering Instant cgroup v2 OOM Kills","stars_count":78,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","kubernetes","cgroups-v2","oom-killer","vertical-scaling","pod-resize"],"exportEndpoints":{"claude":"/api/rules/k8s-in-place-resize-memory-headroom-standard?format=claude","cursorMdc":"/api/rules/k8s-in-place-resize-memory-headroom-standard?format=mdc","cursorrules":"/api/rules/k8s-in-place-resize-memory-headroom-standard?format=cursor","windsurf":"/api/rules/k8s-in-place-resize-memory-headroom-standard?format=windsurf","agents":"/api/rules/k8s-in-place-resize-memory-headroom-standard?format=agents"}},{"id":"vite-6-ssr-environment-module-partitioning","title":"Vite 6 Environment API Multi-Runtime Module Partitioning and State Isolation","category":"frontend","severity":"critical","description":"Enforces strict runtime module graph partitioning and dedicated execution environments using the Vite 6 Environment API. Prevents cross-environment memory pollution, platform global contamination (e.g., Node.js built-ins in Workerd/Edge runtimes), and split-brain singleton states across Universal SSR targets.","antiPatternHeadline":"Monolithic Module Graph Evaluation and Cross-Runtime State Bleed in Multi-Target SSR","stars_count":68,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","vite","vite6","ssr","edge","node","environment-api","module-federation"],"exportEndpoints":{"claude":"/api/rules/vite-6-ssr-environment-module-partitioning?format=claude","cursorMdc":"/api/rules/vite-6-ssr-environment-module-partitioning?format=mdc","cursorrules":"/api/rules/vite-6-ssr-environment-module-partitioning?format=cursor","windsurf":"/api/rules/vite-6-ssr-environment-module-partitioning?format=windsurf","agents":"/api/rules/vite-6-ssr-environment-module-partitioning?format=agents"}},{"id":"svelte-5-runes-async-state-mutation-drain-guardrail","title":"Svelte 5 Runes Async State Mutation & Reactive Graph Drain Guardrail","category":"frontend","severity":"critical","description":"Enforces strict boundaries on asynchronous state mutations within Svelte 5 rune-based reactivity ($effect, $state, and $derived). Prevents unbounded microtask-driven signal cascades, infinite reactive graph flush loops, and orphaned state writes across component teardown or hydration transitions.","antiPatternHeadline":"Unbounded Async State Mutation Inside $effect Inducing Infinite Microtask Flush Loops","stars_count":57,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["svelte5","runes","signals","async-state","reactive-graph","frontend"],"exportEndpoints":{"claude":"/api/rules/svelte-5-runes-async-state-mutation-drain-guardrail?format=claude","cursorMdc":"/api/rules/svelte-5-runes-async-state-mutation-drain-guardrail?format=mdc","cursorrules":"/api/rules/svelte-5-runes-async-state-mutation-drain-guardrail?format=cursor","windsurf":"/api/rules/svelte-5-runes-async-state-mutation-drain-guardrail?format=windsurf","agents":"/api/rules/svelte-5-runes-async-state-mutation-drain-guardrail?format=agents"}},{"id":"bun-websocket-low-watermark-backpressure-invariant","title":"Bun 1.2 Native WebSocket Low-Watermark Backpressure Invariant","category":"backend","severity":"critical","description":"Enforces strict producer suspension and deterministic TCP drain coordination for Bun 1.2 native WebSockets using low/high watermark thresholds on `ws.bufferedAmount`. Prevents unbounded V8/JSC heap exhaustion caused by slow socket consumers during high-throughput binary and text streaming. Mandates cooperative yielding via the native `drain(ws)` socket lifecycle hook rather than fire-and-forget message dispatching.","antiPatternHeadline":"Unbounded Fire-and-Forget `ws.send()` Dispatching Ignoring Native `bufferedAmount` Accumulation","stars_count":43,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","websockets","backpressure","networking","concurrency","performance"],"exportEndpoints":{"claude":"/api/rules/bun-websocket-low-watermark-backpressure-invariant?format=claude","cursorMdc":"/api/rules/bun-websocket-low-watermark-backpressure-invariant?format=mdc","cursorrules":"/api/rules/bun-websocket-low-watermark-backpressure-invariant?format=cursor","windsurf":"/api/rules/bun-websocket-low-watermark-backpressure-invariant?format=windsurf","agents":"/api/rules/bun-websocket-low-watermark-backpressure-invariant?format=agents"}},{"id":"postgres-17-streaming-io-prefetch-cap-standard","title":"PostgreSQL 17 Streaming I/O Vector Read Prefetch Buffer Cap Standard","category":"backend","severity":"critical","description":"Enforces strict prefetch depth boundaries and session-level concurrency caps on PostgreSQL 17 streaming asynchronous vector read operations. Prevents concurrent sequential and bitmap heap scans from saturating storage queues, thrashing the OS page cache, and evicting latency-critical OLTP working sets from shared buffers.","antiPatternHeadline":"Unbounded Streaming Read Prefetching Squelching Concurrent OLTP Buffer Pools","stars_count":94,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql-17","streaming-io","buffer-cache","performance","concurrency"],"exportEndpoints":{"claude":"/api/rules/postgres-17-streaming-io-prefetch-cap-standard?format=claude","cursorMdc":"/api/rules/postgres-17-streaming-io-prefetch-cap-standard?format=mdc","cursorrules":"/api/rules/postgres-17-streaming-io-prefetch-cap-standard?format=cursor","windsurf":"/api/rules/postgres-17-streaming-io-prefetch-cap-standard?format=windsurf","agents":"/api/rules/postgres-17-streaming-io-prefetch-cap-standard?format=agents"}},{"id":"capacitor-7-zero-copy-arraybuffer-transfer-standard","title":"Capacitor 7 Zero-Copy ArrayBuffer Native Bridge Standard","category":"mobile","severity":"critical","description":"Enforces direct typed memory transfer across the Capacitor 7 JavaScript-to-Native bridge for binary payloads without intermediate Base64 serialization. Eliminates high-frequency garbage collection pauses, bridge payload inflation, and main-thread frame drops during large binary I/O operations.","antiPatternHeadline":"Serializing Raw Binary Buffers to Base64 Strings Within Capacitor Plugin Call Payloads","stars_count":95,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","ios","android","performance","memory-management","arraybuffer"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-zero-copy-arraybuffer-transfer-standard?format=claude","cursorMdc":"/api/rules/capacitor-7-zero-copy-arraybuffer-transfer-standard?format=mdc","cursorrules":"/api/rules/capacitor-7-zero-copy-arraybuffer-transfer-standard?format=cursor","windsurf":"/api/rules/capacitor-7-zero-copy-arraybuffer-transfer-standard?format=windsurf","agents":"/api/rules/capacitor-7-zero-copy-arraybuffer-transfer-standard?format=agents"}},{"id":"rn-bridgeless-turbomodule-jsi-hostobject-retention","title":"React Native 0.78 Bridgeless TurboModule JSI Host Object Retention Guardrail","category":"mobile","severity":"critical","description":"Mandates explicit native teardown semantics and lifecycle coordination for C++ JSI HostObjects in React Native 0.78 Bridgeless mode. Because Hermes GC runs non-deterministically, relying on HostObject C++ destructors for native resources causes memory spikes, native memory exhaustion, and OOM crashes across rapidly unmounted React native views.","antiPatternHeadline":"Relying on Non-Deterministic Hermes Garbage Collection to Free C++ Native Resources in Bridgeless JSI HostObjects","stars_count":68,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","react-native","turbomodules","jsi","memory-management","cpp"],"exportEndpoints":{"claude":"/api/rules/rn-bridgeless-turbomodule-jsi-hostobject-retention?format=claude","cursorMdc":"/api/rules/rn-bridgeless-turbomodule-jsi-hostobject-retention?format=mdc","cursorrules":"/api/rules/rn-bridgeless-turbomodule-jsi-hostobject-retention?format=cursor","windsurf":"/api/rules/rn-bridgeless-turbomodule-jsi-hostobject-retention?format=windsurf","agents":"/api/rules/rn-bridgeless-turbomodule-jsi-hostobject-retention?format=agents"}},{"id":"webauthn-l3-rp-id-top-level-assertion-isolation","title":"WebAuthn L3 Cross-Origin RP ID Top-Level Assertion Isolation Policy","category":"security","severity":"critical","description":"Enforces strict top-level browsing context isolation and relying party ID (RP ID) verification in accordance with WebAuthn Level 3 specifications. Mandates explicit Permissions-Policy directives to block unauthorized cross-origin iframe credential assertions and guarantees cryptographically enforced origin binding during server-side verification.","antiPatternHeadline":"Unrestricted Cross-Origin WebAuthn Assertions in Embedded Contexts without Permissions-Policy Isolation","stars_count":90,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","fido2","rp-id","permissions-policy","authentication"],"exportEndpoints":{"claude":"/api/rules/webauthn-l3-rp-id-top-level-assertion-isolation?format=claude","cursorMdc":"/api/rules/webauthn-l3-rp-id-top-level-assertion-isolation?format=mdc","cursorrules":"/api/rules/webauthn-l3-rp-id-top-level-assertion-isolation?format=cursor","windsurf":"/api/rules/webauthn-l3-rp-id-top-level-assertion-isolation?format=windsurf","agents":"/api/rules/webauthn-l3-rp-id-top-level-assertion-isolation?format=agents"}},{"id":"openfga-contextual-tuple-canonicalization-depth-budget","title":"OpenFGA Contextual Tuple Canonicalization and Depth-Budget Guardrail","category":"security","severity":"critical","description":"Enforces pre-evaluation canonicalization, cycle detection, and strict depth-budget limits on user-supplied OpenFGA contextual tuples. Prevents algorithmic complexity Denial-of-Service (DoS) and infinite graph traversal attacks in Relationship-Based Access Control (ReBAC) engines by rejecting non-canonical identifiers and contextual relationship loops before invoking the authorization engine.","antiPatternHeadline":"Passing unvalidated, cyclic, or unbounded user-supplied contextual tuples directly to OpenFGA Check or ListObjects APIs.","stars_count":40,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","rebac","authorization","dos-prevention","graph-algorithms"],"exportEndpoints":{"claude":"/api/rules/openfga-contextual-tuple-canonicalization-depth-budget?format=claude","cursorMdc":"/api/rules/openfga-contextual-tuple-canonicalization-depth-budget?format=mdc","cursorrules":"/api/rules/openfga-contextual-tuple-canonicalization-depth-budget?format=cursor","windsurf":"/api/rules/openfga-contextual-tuple-canonicalization-depth-budget?format=windsurf","agents":"/api/rules/openfga-contextual-tuple-canonicalization-depth-budget?format=agents"}},{"id":"cilium-ebpf-tail-call-stack-budget-standard","title":"Cilium eBPF BPF-to-BPF Tail-Call Stack Frame Depth Budget Standard","category":"devops","severity":"critical","description":"Enforces strict limits on combined stack frame depth and nested programmable tail-call chains within Cilium eBPF datapath hooks. Eliminates kernel-level packet drops, latency jitter, and BPF verifier complexity aborts across high-throughput multi-tenant ingress nodes.","antiPatternHeadline":"Unbounded Stack Allocations Across Nested BPF-to-BPF Calls Combined with Runtime Datapath Tail-Calls","stars_count":103,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","cilium","linux-kernel","networking","kubernetes","performance"],"exportEndpoints":{"claude":"/api/rules/cilium-ebpf-tail-call-stack-budget-standard?format=claude","cursorMdc":"/api/rules/cilium-ebpf-tail-call-stack-budget-standard?format=mdc","cursorrules":"/api/rules/cilium-ebpf-tail-call-stack-budget-standard?format=cursor","windsurf":"/api/rules/cilium-ebpf-tail-call-stack-budget-standard?format=windsurf","agents":"/api/rules/cilium-ebpf-tail-call-stack-budget-standard?format=agents"}},{"id":"k8s-132-dra-atomic-eviction-barrier","title":"Deterministic Dynamic Resource Allocation (DRA) Eviction & Claim Deallocation Guardrail","category":"devops","severity":"critical","description":"Enforces strict ResourceClaim lifecycles, structured pre-stop termination hooks, and atomic pod disruption barriers during Kubernetes 1.32 Dynamic Resource Allocation (DRA) workload transitions. Guarantees deterministic driver unbinding and deallocation of hardware accelerators (GPUs, LPUs, TPUs) before surge replica scheduling to prevent resource deadlocks and orphaned device claims.","antiPatternHeadline":"Surge-First Rolling Updates with Inline ResourceClaimTemplates Leading to Accelerator Depletion Deadlocks","stars_count":45,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","kubernetes","dra","gpu","scheduling","k8s-1-32"],"exportEndpoints":{"claude":"/api/rules/k8s-132-dra-atomic-eviction-barrier?format=claude","cursorMdc":"/api/rules/k8s-132-dra-atomic-eviction-barrier?format=mdc","cursorrules":"/api/rules/k8s-132-dra-atomic-eviction-barrier?format=cursor","windsurf":"/api/rules/k8s-132-dra-atomic-eviction-barrier?format=windsurf","agents":"/api/rules/k8s-132-dra-atomic-eviction-barrier?format=agents"}},{"id":"nextjs-15-dynamic-io-taint-isolation","title":"Next.js 15 Dynamic I/O & React Taint Cryptographic Boundary Standard","category":"frontend","severity":"critical","description":"Guarantees cryptographic and contextual isolation between server-only sensitive data and client-serialized component boundaries during Next.js 15 Dynamic I/O prerendering. Mandates strict usage of React Taint APIs at Data Access Layers (DAL) to prevent runtime serialization of secrets into React Server Component (RSC) flight data payloads.","antiPatternHeadline":"Leaking Raw Domain Secrets and Un-cached Request Primitives Across RSC Serialization Boundaries","stars_count":98,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs15","react19","dynamic-io","taint-api","rsc-security","data-access-layer"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-dynamic-io-taint-isolation?format=claude","cursorMdc":"/api/rules/nextjs-15-dynamic-io-taint-isolation?format=mdc","cursorrules":"/api/rules/nextjs-15-dynamic-io-taint-isolation?format=cursor","windsurf":"/api/rules/nextjs-15-dynamic-io-taint-isolation?format=windsurf","agents":"/api/rules/nextjs-15-dynamic-io-taint-isolation?format=agents"}},{"id":"module-federation-2-remote-integrity-singleton-guardrail","title":"Module Federation 2.0 Dynamic Remote Integrity & Shared Dependency Guardrail","category":"frontend","severity":"critical","description":"Enforces cryptographic manifest validation, subresource integrity (SRI), and strict semver singleton resolution when dynamically loading Module Federation 2.0 remotes across heterogeneous CDNs. Prevents supply-chain remote hijacking and dual-instantiation runtime crashes in shared runtime singletons like React, React-DOM, and state managers. Mandates centralized federation runtime plugins for dynamic URL ingestion and error boundary fallbacks.","antiPatternHeadline":"Unvalidated Remote Script Injection with Unpinned Shared Singleton Collisions","stars_count":81,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","module-federation","micro-frontends","security","subresource-integrity","typescript"],"exportEndpoints":{"claude":"/api/rules/module-federation-2-remote-integrity-singleton-guardrail?format=claude","cursorMdc":"/api/rules/module-federation-2-remote-integrity-singleton-guardrail?format=mdc","cursorrules":"/api/rules/module-federation-2-remote-integrity-singleton-guardrail?format=cursor","windsurf":"/api/rules/module-federation-2-remote-integrity-singleton-guardrail?format=windsurf","agents":"/api/rules/module-federation-2-remote-integrity-singleton-guardrail?format=agents"}},{"id":"bun-zero-copy-websocket-buffer-pooling-standard","title":"Bun 1.2 Zero-Copy WebSocket Frame Buffer Pooling Standard","category":"backend","severity":"critical","description":"Enforces deterministic slab-allocated buffer pooling and zero-copy transmission semantics for Bun WebSocket servers. Prevents microsecond-latency degradation caused by per-message heap allocation, V8/JSC GC thrashing, and intermediate memory cloning during high-frequency bidirectional streaming.","antiPatternHeadline":"Ad-Hoc Uint8Array Allocation and String Payload Serialization in High-Throughput WebSocket Broadcasts","stars_count":86,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","websockets","memory-management","performance","networking"],"exportEndpoints":{"claude":"/api/rules/bun-zero-copy-websocket-buffer-pooling-standard?format=claude","cursorMdc":"/api/rules/bun-zero-copy-websocket-buffer-pooling-standard?format=mdc","cursorrules":"/api/rules/bun-zero-copy-websocket-buffer-pooling-standard?format=cursor","windsurf":"/api/rules/bun-zero-copy-websocket-buffer-pooling-standard?format=windsurf","agents":"/api/rules/bun-zero-copy-websocket-buffer-pooling-standard?format=agents"}},{"id":"go-124-swiss-table-map-compaction-worker-isolation","title":"Go 1.24 Swiss Table Map Memory Compaction & Worker Isolation Invariant","category":"backend","severity":"critical","description":"Enforces strict memory compaction and tenant-worker isolation for Go 1.24+ runtime Swiss Table maps in high-throughput network proxy paths. Prevents catastrophic tail-latency blowups and unbounded resident set size (RSS) heap fragmentation caused by map tombstone accumulation and unbounded key-retention churn across concurrent goroutines.","antiPatternHeadline":"Unbounded Map Churn with In-Place Delete Generating Silent Heap Bloat and Swiss Table Control-Word Poisoning","stars_count":65,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","golang","go124","swiss-tables","concurrency","memory-compaction","networking"],"exportEndpoints":{"claude":"/api/rules/go-124-swiss-table-map-compaction-worker-isolation?format=claude","cursorMdc":"/api/rules/go-124-swiss-table-map-compaction-worker-isolation?format=mdc","cursorrules":"/api/rules/go-124-swiss-table-map-compaction-worker-isolation?format=cursor","windsurf":"/api/rules/go-124-swiss-table-map-compaction-worker-isolation?format=windsurf","agents":"/api/rules/go-124-swiss-table-map-compaction-worker-isolation?format=agents"}},{"id":"react-native-bridgeless-jsi-memory-boundary","title":"React Native 0.76 Bridgeless C++ JSI Memory Boundary & Smart Pointer Lifecycle Standard","category":"mobile","severity":"critical","description":"Enforces strict C++ smart pointer lifecycles and thread-isolation boundaries when authoring React Native 0.76 Bridgeless TurboModules. Prevents undefined behavior, heap corruption, and Use-After-Free crashes caused by escaping jsi::Value references across threads without CallInvoker synchronization.","antiPatternHeadline":"Escaping Raw JSI References and Pointer State Across Asynchronous Thread Boundaries","stars_count":48,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","react-native","turbomodules","jsi","cpp","bridgeless","memory-management"],"exportEndpoints":{"claude":"/api/rules/react-native-bridgeless-jsi-memory-boundary?format=claude","cursorMdc":"/api/rules/react-native-bridgeless-jsi-memory-boundary?format=mdc","cursorrules":"/api/rules/react-native-bridgeless-jsi-memory-boundary?format=cursor","windsurf":"/api/rules/react-native-bridgeless-jsi-memory-boundary?format=windsurf","agents":"/api/rules/react-native-bridgeless-jsi-memory-boundary?format=agents"}},{"id":"capacitor-secure-enclave-webcrypto-attestation-bridge","title":"Hardware-Backed WebCrypto Enclave Bridge Invariants and Attestation Guardrails","category":"mobile","severity":"critical","description":"Enforces hardware-backed cryptographic key generation and signing isolation within iOS Secure Enclave and Android Keystore (StrongBox) through Capacitor 7 native bridges. Ensures asymmetric private keys are strictly non-exportable and never materialized inside the hybrid WebView JavaScript execution context, while enforcing cryptographic hardware attestation tokens on all signing operations.","antiPatternHeadline":"Exporting Private Key Material to Hybrid WebViews or Bypassing Hardware Attestation Proofs","stars_count":42,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","webcrypto","security","secure-enclave","strongbox","attestation"],"exportEndpoints":{"claude":"/api/rules/capacitor-secure-enclave-webcrypto-attestation-bridge?format=claude","cursorMdc":"/api/rules/capacitor-secure-enclave-webcrypto-attestation-bridge?format=mdc","cursorrules":"/api/rules/capacitor-secure-enclave-webcrypto-attestation-bridge?format=cursor","windsurf":"/api/rules/capacitor-secure-enclave-webcrypto-attestation-bridge?format=windsurf","agents":"/api/rules/capacitor-secure-enclave-webcrypto-attestation-bridge?format=agents"}},{"id":"post-quantum-mlkem-tls13-ingress-enforcement","title":"Post-Quantum ML-KEM TLS 1.3 Hybrid Key Encapsulation Ingress Enforcement","category":"security","severity":"critical","description":"Enforces strict post-quantum hybrid key encapsulation (specifically ML-KEM / FIPS 203 combinations such as X25519MLKEM768) on TLS 1.3 ingress boundaries. Prevents Store-Now-Decrypt-Later (SNDL) passive interception of enterprise traffic by rejecting non-quantum-resistant handshakes and enforcing cryptographic agility invariants across network listeners.","antiPatternHeadline":"Permitting Classical-Only Ephemeral Key Exchange (ECDH/DH) or TLS < 1.3 on Sensitive Ingress","stars_count":44,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","post-quantum","ml-kem","tls-1-3","cryptography","sndl-defense"],"exportEndpoints":{"claude":"/api/rules/post-quantum-mlkem-tls13-ingress-enforcement?format=claude","cursorMdc":"/api/rules/post-quantum-mlkem-tls13-ingress-enforcement?format=mdc","cursorrules":"/api/rules/post-quantum-mlkem-tls13-ingress-enforcement?format=cursor","windsurf":"/api/rules/post-quantum-mlkem-tls13-ingress-enforcement?format=windsurf","agents":"/api/rules/post-quantum-mlkem-tls13-ingress-enforcement?format=agents"}},{"id":"cilium-ebpf-spiffe-spire-socket-mtls-standard","title":"Cilium eBPF Socket-Level SPIFFE/SPIRE Identity mTLS Standard","category":"devops","severity":"critical","description":"Mandates transparent socket-level mutual TLS and cryptographic workload identity attestation via Cilium eBPF and SPIRE without injecting Envoy sidecar proxies. Eliminates container CPU/memory overhead by terminating cryptographic handshakes at the Linux kernel socket layer while validating SPIFFE IDs.","antiPatternHeadline":"Injecting CPU-intensive user-space sidecar proxies for mTLS or relying on spoofable IP/label-based network policies without cryptographic SPIFFE attestation.","stars_count":109,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","cilium","ebpf","spiffe-spire","mtls","zero-trust","kubernetes"],"exportEndpoints":{"claude":"/api/rules/cilium-ebpf-spiffe-spire-socket-mtls-standard?format=claude","cursorMdc":"/api/rules/cilium-ebpf-spiffe-spire-socket-mtls-standard?format=mdc","cursorrules":"/api/rules/cilium-ebpf-spiffe-spire-socket-mtls-standard?format=cursor","windsurf":"/api/rules/cilium-ebpf-spiffe-spire-socket-mtls-standard?format=windsurf","agents":"/api/rules/cilium-ebpf-spiffe-spire-socket-mtls-standard?format=agents"}},{"id":"opentelemetry-otlp-arrow-columnar-ingestion-pipeline","title":"OpenTelemetry OTLP Arrow Columnar Ingestion Pipeline Guardrail","category":"devops","severity":"critical","description":"Enforces deterministic memory bounds, stream multiplexing parameters, and memory limiter pipeline order for OpenTelemetry OTLP/Arrow ingestion. Prevents out-of-memory (OOM) crashes and CPU starvation by guaranteeing strict columnar batch ceilings, Arrow record dictionary reuse, and resilient protobuf fallbacks across collector topologies.","antiPatternHeadline":"Unbounded Arrow Stream Buffering and Missing Memory-Limiter Interceptors Triggering Ingestion OOMs","stars_count":64,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","apache-arrow","otlp","observability","collector"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-otlp-arrow-columnar-ingestion-pipeline?format=claude","cursorMdc":"/api/rules/opentelemetry-otlp-arrow-columnar-ingestion-pipeline?format=mdc","cursorrules":"/api/rules/opentelemetry-otlp-arrow-columnar-ingestion-pipeline?format=cursor","windsurf":"/api/rules/opentelemetry-otlp-arrow-columnar-ingestion-pipeline?format=windsurf","agents":"/api/rules/opentelemetry-otlp-arrow-columnar-ingestion-pipeline?format=agents"}},{"id":"wicg-dbsc-session-attestation-guardrail","title":"WICG Device Bound Session Credentials (DBSC) Hardware PoP and Anti-Replay Guardrail","category":"security","severity":"critical","description":"Protects authentication sessions against infostealer malware by binding session cookies directly to TPM or Secure Enclave hardware keys via WICG Device Bound Session Credentials (DBSC). Mandates server-side validation of client challenge signatures, cryptographic nonce freshness, and strict session invalidation upon proof-of-possession mismatch to prevent downgrade and token-replay attacks.","antiPatternHeadline":"Silent downgrade or replay vulnerability via unverified DBSC challenge responses, stale nonces, or permissive fallback to standard bearer cookies","stars_count":70,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","dbsc","wicg","hardware-attestation","session-management","zero-trust"],"exportEndpoints":{"claude":"/api/rules/wicg-dbsc-session-attestation-guardrail?format=claude","cursorMdc":"/api/rules/wicg-dbsc-session-attestation-guardrail?format=mdc","cursorrules":"/api/rules/wicg-dbsc-session-attestation-guardrail?format=cursor","windsurf":"/api/rules/wicg-dbsc-session-attestation-guardrail?format=windsurf","agents":"/api/rules/wicg-dbsc-session-attestation-guardrail?format=agents"}},{"id":"android-15-16kb-page-alignment-ndk-memory-boundary-invariant","title":"Android 15 16KB Page Alignment NDK Memory Boundary Invariant","category":"mobile","severity":"critical","description":"Mandates strict 16KB (0x4000) ELF segment alignment across all compiled native C/C++ mobile shared libraries (.so) and build scripts targeting Android 15 (API level 35) and beyond. Failure to align ELF load segments to 16KB boundaries results in dynamic linker (linker64) aborts and fatal SIGSEGV/SIGBUS page fault panics when loaded into 16KB page size kernel runtimes on modern ARM64 hardware.","antiPatternHeadline":"Shipping 4KB-Aligned Native Binaries or Unaligned Custom Memory Mappings to 16KB Page-Size Devices","stars_count":45,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","android","ndk","memory-management","arm64","android-15","cmake","c-plus-plus"],"exportEndpoints":{"claude":"/api/rules/android-15-16kb-page-alignment-ndk-memory-boundary-invariant?format=claude","cursorMdc":"/api/rules/android-15-16kb-page-alignment-ndk-memory-boundary-invariant?format=mdc","cursorrules":"/api/rules/android-15-16kb-page-alignment-ndk-memory-boundary-invariant?format=cursor","windsurf":"/api/rules/android-15-16kb-page-alignment-ndk-memory-boundary-invariant?format=windsurf","agents":"/api/rules/android-15-16kb-page-alignment-ndk-memory-boundary-invariant?format=agents"}},{"id":"otel-arrow-streaming-buffer-backpressure-guardrail","title":"OpenTelemetry Arrow Streaming Buffer Backpressure and Memory Limiting Standard","category":"devops","severity":"critical","description":"Enforces strict columnar record batch sizing, bounded channel queuing, and memory-aware backpressure limits on OTLP/Arrow streams within OpenTelemetry Collector deployments. Prevents catastrophic GC pauses and Out-Of-Memory (OOM) fatal crashes when ingesting millions of telemetry events per second. Mandates explicit memory limiter processor ordering and Arrow record allocation caps to safeguard the collector pipeline.","antiPatternHeadline":"Unbounded Arrow record allocation and unbuffered streaming causing sudden OOM collector crashes under sustained ingest bursts","stars_count":61,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","apache-arrow","backpressure","kubernetes","collector","high-throughput"],"exportEndpoints":{"claude":"/api/rules/otel-arrow-streaming-buffer-backpressure-guardrail?format=claude","cursorMdc":"/api/rules/otel-arrow-streaming-buffer-backpressure-guardrail?format=mdc","cursorrules":"/api/rules/otel-arrow-streaming-buffer-backpressure-guardrail?format=cursor","windsurf":"/api/rules/otel-arrow-streaming-buffer-backpressure-guardrail?format=windsurf","agents":"/api/rules/otel-arrow-streaming-buffer-backpressure-guardrail?format=agents"}},{"id":"fastapi-anyio-structured-concurrency-exceptiongroup-invariant","title":"FastAPI AnyIO Structured Concurrency and ExceptionGroup Invariant","category":"backend","severity":"critical","description":"Enforces strict structured concurrency in FastAPI ASGI event loops using AnyIO task groups and Python 3.11+ ExceptionGroup semantics. Prevents orphaned coroutines, unhandled task cancellation leaks, and dangling socket descriptors caused by improper concurrent fan-out or raw asyncio primitives.","antiPatternHeadline":"Unstructured asyncio.gather or BackgroundTasks Masking Concurrency Exceptions and Leaking Sockets","stars_count":70,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","anyio","asyncio","structured-concurrency","python"],"exportEndpoints":{"claude":"/api/rules/fastapi-anyio-structured-concurrency-exceptiongroup-invariant?format=claude","cursorMdc":"/api/rules/fastapi-anyio-structured-concurrency-exceptiongroup-invariant?format=mdc","cursorrules":"/api/rules/fastapi-anyio-structured-concurrency-exceptiongroup-invariant?format=cursor","windsurf":"/api/rules/fastapi-anyio-structured-concurrency-exceptiongroup-invariant?format=windsurf","agents":"/api/rules/fastapi-anyio-structured-concurrency-exceptiongroup-invariant?format=agents"}},{"id":"capacitor-7-biometric-keystore-hardware-attestation","title":"Capacitor 7 Hardware-Backed Biometric Keystore and Attestation Standard","category":"mobile","severity":"critical","description":"Enforces hardware-backed cryptographic key isolation using platform Secure Enclaves and StrongBox KeyStore implementations under Capacitor 7. Prohibits exposing raw private key material or long-lived authentication tokens to the JavaScript runtime heap and mandates native biometric hardware gates and server-verified attestation nonces.","antiPatternHeadline":"Exposing Raw Private Keys Across the Webview Bridge and Persisting Secrets in Unattested Unbound Storage","stars_count":76,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","security","biometrics","cryptography","secure-enclave"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-biometric-keystore-hardware-attestation?format=claude","cursorMdc":"/api/rules/capacitor-7-biometric-keystore-hardware-attestation?format=mdc","cursorrules":"/api/rules/capacitor-7-biometric-keystore-hardware-attestation?format=cursor","windsurf":"/api/rules/capacitor-7-biometric-keystore-hardware-attestation?format=windsurf","agents":"/api/rules/capacitor-7-biometric-keystore-hardware-attestation?format=agents"}},{"id":"k8s-dra-multi-accelerator-claim-guardrail","title":"Kubernetes Dynamic Resource Allocation (DRA) Multi-Accelerator Claim Guardrail","category":"devops","severity":"critical","description":"Governs atomic, lock-free GPU and NPU device allocation at the kubelet and scheduler level to prevent fractional allocation leaks and deadlocks across distributed AI inference workloads. Mandates structured ResourceClaim templates with atomic all-or-nothing allocation semantics and explicit device sharing policies instead of legacy fragmented extended resources.","antiPatternHeadline":"Partial GPU/NPU Allocation via Fragmented Extended Resources Inducing Distributed Deadlocks and Orphaned Device Leaks","stars_count":51,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","kubernetes","dra","accelerators","gpu","inference","resourceclaims"],"exportEndpoints":{"claude":"/api/rules/k8s-dra-multi-accelerator-claim-guardrail?format=claude","cursorMdc":"/api/rules/k8s-dra-multi-accelerator-claim-guardrail?format=mdc","cursorrules":"/api/rules/k8s-dra-multi-accelerator-claim-guardrail?format=cursor","windsurf":"/api/rules/k8s-dra-multi-accelerator-claim-guardrail?format=windsurf","agents":"/api/rules/k8s-dra-multi-accelerator-claim-guardrail?format=agents"}},{"id":"bun-sqlite-statement-finalization-invariant","title":"Bun 1.2 Isolated Native SQLite Prepared Statement Finalization Invariant","category":"backend","severity":"critical","description":"Enforces deterministic statement finalization and strict per-worker database isolation when using bun:sqlite in concurrent Bun 1.2 workloads. Failing to explicitly finalize prepared statements or attempting to share Database instances across concurrent Bun worker threads triggers native memory leaks, segmentation faults, and unresolved SQLITE_BUSY locking contention.","antiPatternHeadline":"Leaking unfinalized native SQLite statement pointers and sharing database handles across Bun worker threads","stars_count":97,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","sqlite","concurrency","memory-leaks"],"exportEndpoints":{"claude":"/api/rules/bun-sqlite-statement-finalization-invariant?format=claude","cursorMdc":"/api/rules/bun-sqlite-statement-finalization-invariant?format=mdc","cursorrules":"/api/rules/bun-sqlite-statement-finalization-invariant?format=cursor","windsurf":"/api/rules/bun-sqlite-statement-finalization-invariant?format=windsurf","agents":"/api/rules/bun-sqlite-statement-finalization-invariant?format=agents"}},{"id":"tanstack-query-v5-offline-mutation-optimistic-rollback-standard","title":"Deterministic TanStack Query v5 Offline Mutation Queuing and Optimistic Rollback","category":"frontend","severity":"critical","description":"Enforces strict mutation context snapshotting, deterministic rollback chains, and queue-aware cache invalidations in TanStack Query v5 during offline replay. Prevents client-state tearing and phantom cache overwrites when synchronizing persisted mutation queues against eventually consistent backend services. Ensures optimistic updates preserve immutable snapshots and cancel in-flight queries before mutating the QueryClient cache.","antiPatternHeadline":"Unbounded Optimistic Cache Mutation without In-Flight Query Cancellation or Immutable Snapshot Rollback","stars_count":86,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","tanstack-query","react-query","offline-first","optimistic-ui","state-management","typescript"],"exportEndpoints":{"claude":"/api/rules/tanstack-query-v5-offline-mutation-optimistic-rollback-standard?format=claude","cursorMdc":"/api/rules/tanstack-query-v5-offline-mutation-optimistic-rollback-standard?format=mdc","cursorrules":"/api/rules/tanstack-query-v5-offline-mutation-optimistic-rollback-standard?format=cursor","windsurf":"/api/rules/tanstack-query-v5-offline-mutation-optimistic-rollback-standard?format=windsurf","agents":"/api/rules/tanstack-query-v5-offline-mutation-optimistic-rollback-standard?format=agents"}},{"id":"react-19-rsc-taint-api-guardrail","title":"React 19 Server Components Taint API Serialization Guardrail","category":"frontend","severity":"critical","description":"Enforces strict boundary isolation between Server Components and Client Components by mandating the use of React 19's experimental_taintObjectReference and experimental_taintUniqueValue APIs. Prevents inadvertent serialization and wire-format exfiltration of server-only secrets, credentials, user PII, and session tokens across the RSC boundary into client-accessible bundles. Requires explicit taint registration at the data-access layer for any object or scalar value containing sensitive material.","antiPatternHeadline":"Passing Untainted Server Credentials, Raw Database Records, or Auth Tokens Across the RSC Wire Boundary","stars_count":94,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","rsc","security","taint-api","serialization"],"exportEndpoints":{"claude":"/api/rules/react-19-rsc-taint-api-guardrail?format=claude","cursorMdc":"/api/rules/react-19-rsc-taint-api-guardrail?format=mdc","cursorrules":"/api/rules/react-19-rsc-taint-api-guardrail?format=cursor","windsurf":"/api/rules/react-19-rsc-taint-api-guardrail?format=windsurf","agents":"/api/rules/react-19-rsc-taint-api-guardrail?format=agents"}},{"id":"module-federation-2-dynamic-remote-abi-versioning","title":"Module Federation 2.0 Dynamic Remote ABI Versioning and Singleton Integrity Guardrail","category":"frontend","severity":"critical","description":"Enforces strict singleton resolution and explicit ABI runtime contract negotiation across Module Federation 2.0 dynamic remotes. Eliminates catastrophic cross-container failures caused by multiple shared instance initialization (e.g., React contexts, design systems, state managers) and semantic contract drift across independently deployed micro-frontends.","antiPatternHeadline":"Permissive Shared Scope Resolution and Unchecked Dynamic Remote Invocations Causing Split-Brain Singletons and Silent Runtime ABI Desynchronization","stars_count":73,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","module-federation","micro-frontends","typescript","architecture","runtime-safety"],"exportEndpoints":{"claude":"/api/rules/module-federation-2-dynamic-remote-abi-versioning?format=claude","cursorMdc":"/api/rules/module-federation-2-dynamic-remote-abi-versioning?format=mdc","cursorrules":"/api/rules/module-federation-2-dynamic-remote-abi-versioning?format=cursor","windsurf":"/api/rules/module-federation-2-dynamic-remote-abi-versioning?format=windsurf","agents":"/api/rules/module-federation-2-dynamic-remote-abi-versioning?format=agents"}},{"id":"clickhouse-replacingmergetree-partition-dedup-invariant","title":"ClickHouse ReplacingMergeTree Partition Invariance and Non-FINAL Deduplication","category":"backend","severity":"critical","description":"Enforces strict partition key immutability and argMax aggregation semantics for ClickHouse ReplacingMergeTree engines. Prevents silent duplicate record leakage across partition boundaries and eliminates thread starvation caused by unconstrained SELECT FINAL executions on high-throughput event streaming tables.","antiPatternHeadline":"Executing SELECT FINAL on distributed wide tables or partitioning by mutable timestamps causing cross-partition duplicate pollution.","stars_count":60,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","clickhouse","distributed-systems","database","streaming"],"exportEndpoints":{"claude":"/api/rules/clickhouse-replacingmergetree-partition-dedup-invariant?format=claude","cursorMdc":"/api/rules/clickhouse-replacingmergetree-partition-dedup-invariant?format=mdc","cursorrules":"/api/rules/clickhouse-replacingmergetree-partition-dedup-invariant?format=cursor","windsurf":"/api/rules/clickhouse-replacingmergetree-partition-dedup-invariant?format=windsurf","agents":"/api/rules/clickhouse-replacingmergetree-partition-dedup-invariant?format=agents"}},{"id":"react-native-turbo-module-jsi-lifetime-production-standard","title":"React Native 0.78 C++ TurboModule JSI Cross-Boundary Lifetime & Memory Safety Standard","category":"mobile","severity":"critical","description":"Enforces strict native memory safety and thread affinity across the JSI boundary in React Native 0.78 New Architecture C++ TurboModules. Eliminates use-after-free segmentation faults and untraceable cross-engine circular memory retention between the Hermes garbage collector and C++ host objects. Requires explicit CallInvoker scheduling, weak reference semantics, and prohibited persistence of unpinned jsi::Value instances across asynchronous boundaries.","antiPatternHeadline":"Capturing Raw jsi::Value or jsi::Object in Long-Lived C++ Closures and Thread Pools Causing GC Use-After-Free and Circular Leaks","stars_count":89,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","react-native","turbomodules","jsi","hermes","cpp","memory-management"],"exportEndpoints":{"claude":"/api/rules/react-native-turbo-module-jsi-lifetime-production-standard?format=claude","cursorMdc":"/api/rules/react-native-turbo-module-jsi-lifetime-production-standard?format=mdc","cursorrules":"/api/rules/react-native-turbo-module-jsi-lifetime-production-standard?format=cursor","windsurf":"/api/rules/react-native-turbo-module-jsi-lifetime-production-standard?format=windsurf","agents":"/api/rules/react-native-turbo-module-jsi-lifetime-production-standard?format=agents"}},{"id":"openfga-zanzibar-cyclic-traversal-depth-invariant","title":"OpenFGA Zanzibar Cyclic Graph Traversal & Contextual Tuple Invariant","category":"security","severity":"critical","description":"Enforces strict bounds, cycle detection, and contextual tuple sanitization for OpenFGA relationship-based access control (ReBAC) evaluations. Prevents algorithmic denial-of-service (Graph DoS) and unbounded recursive expansion attacks triggered by deep or circular relationship graphs.","antiPatternHeadline":"Unvalidated Contextual Tuple Injection Permitting Unbounded Recursive Graph Traversal and ReBAC Exhaustion","stars_count":73,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","zanzibar","rebac","dos-mitigation","graph-traversal"],"exportEndpoints":{"claude":"/api/rules/openfga-zanzibar-cyclic-traversal-depth-invariant?format=claude","cursorMdc":"/api/rules/openfga-zanzibar-cyclic-traversal-depth-invariant?format=mdc","cursorrules":"/api/rules/openfga-zanzibar-cyclic-traversal-depth-invariant?format=cursor","windsurf":"/api/rules/openfga-zanzibar-cyclic-traversal-depth-invariant?format=windsurf","agents":"/api/rules/openfga-zanzibar-cyclic-traversal-depth-invariant?format=agents"}},{"id":"pq-tls13-mlkem-hybrid-downgrade-mitigation-guardrail","title":"Post-Quantum TLS 1.3 ML-KEM Hybrid Key Exchange Downgrade Mitigation Guardrail","category":"security","severity":"critical","description":"Enforces strict post-quantum hybrid key encapsulation (ML-KEM with classical curves such as X25519MLKEM768) across all enterprise edge ingress configurations and client TLS stacks. Eliminates retrospective decryption risks ('Harvest Now, Decrypt Later') by categorically prohibiting classical-only key exchange fallbacks and enforcing TLS 1.3 minimum protocol versions. Implements continuous cryptographic telemetry to audit and abort handshakes negotiating downgraded curves.","antiPatternHeadline":"Permitting Classical-Only TLS Fallback or Omission of ML-KEM Hybrid Key Encapsulation in Edge Ingress","stars_count":107,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","cryptography","post-quantum","ml-kem","tls-1.3","zero-trust","hndl-mitigation"],"exportEndpoints":{"claude":"/api/rules/pq-tls13-mlkem-hybrid-downgrade-mitigation-guardrail?format=claude","cursorMdc":"/api/rules/pq-tls13-mlkem-hybrid-downgrade-mitigation-guardrail?format=mdc","cursorrules":"/api/rules/pq-tls13-mlkem-hybrid-downgrade-mitigation-guardrail?format=cursor","windsurf":"/api/rules/pq-tls13-mlkem-hybrid-downgrade-mitigation-guardrail?format=windsurf","agents":"/api/rules/pq-tls13-mlkem-hybrid-downgrade-mitigation-guardrail?format=agents"}},{"id":"otel-kafka-tracecontext-propagation-standard","title":"Mandatory W3C TraceContext & Baggage Propagation Across Kafka Event Meshes","category":"devops","severity":"critical","description":"Enforces strict distributed context propagation using W3C TraceContext (traceparent/tracestate) and W3C Baggage across asynchronous Kafka pub/sub boundaries. Ensures that message producers inject serialized tracing headers and consumer pipelines extract parent spans without orphaning distributed traces, swallowing baggage, or causing telemetry link fragmentation.","antiPatternHeadline":"Orphaned distributed traces and lost transactional context due to missing or improper traceparent header injection/extraction in Kafka message headers.","stars_count":50,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","distributed-tracing","kafka","w3c-trace-context","observability"],"exportEndpoints":{"claude":"/api/rules/otel-kafka-tracecontext-propagation-standard?format=claude","cursorMdc":"/api/rules/otel-kafka-tracecontext-propagation-standard?format=mdc","cursorrules":"/api/rules/otel-kafka-tracecontext-propagation-standard?format=cursor","windsurf":"/api/rules/otel-kafka-tracecontext-propagation-standard?format=windsurf","agents":"/api/rules/otel-kafka-tracecontext-propagation-standard?format=agents"}},{"id":"ebpf-k8s-ephemeral-port-exhaustion-socket-guardrail","title":"eBPF-Driven Kubernetes Node Ephemeral Port Exhaustion Socket Guardrail","category":"devops","severity":"critical","description":"Intercepts and regulates rapid SNAT allocation churn and ephemeral port depletion at the Linux kernel socket layer before pod traffic degrades. Prevents node-level silent socket drops and Conntrack table thrashing caused by un-pooled HTTP/gRPC egress clients and misconfigured conntrack sysctls.","antiPatternHeadline":"Un-pooled TCP/UDP Pod Egress Triggering Node Ephemeral Port Exhaustion and Silent Kernel Drops","stars_count":99,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","kubernetes","networking","kernel","conntrack","cilium"],"exportEndpoints":{"claude":"/api/rules/ebpf-k8s-ephemeral-port-exhaustion-socket-guardrail?format=claude","cursorMdc":"/api/rules/ebpf-k8s-ephemeral-port-exhaustion-socket-guardrail?format=mdc","cursorrules":"/api/rules/ebpf-k8s-ephemeral-port-exhaustion-socket-guardrail?format=cursor","windsurf":"/api/rules/ebpf-k8s-ephemeral-port-exhaustion-socket-guardrail?format=windsurf","agents":"/api/rules/ebpf-k8s-ephemeral-port-exhaustion-socket-guardrail?format=agents"}},{"id":"react19-server-actions-idempotency-optimistic-replay-standard","title":"React 19 Server Actions Idempotency Key & Optimistic Subtree Replay Standard","category":"frontend","severity":"critical","description":"Enforces client-generated idempotency keys and deterministic optimistic subtree reconciliation for React 19 Server Actions. Guarantees deduplicated backend execution during edge network retransmissions and eliminates optimistic UI layout shifts or dropped state transitions during server reconciliation.","antiPatternHeadline":"Naive Server Action Invocations Lacking Client-Side Idempotency Keys and Stable Optimistic Identity Reconciliation","stars_count":58,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react19","server-actions","optimistic-ui","idempotency","nextjs"],"exportEndpoints":{"claude":"/api/rules/react19-server-actions-idempotency-optimistic-replay-standard?format=claude","cursorMdc":"/api/rules/react19-server-actions-idempotency-optimistic-replay-standard?format=mdc","cursorrules":"/api/rules/react19-server-actions-idempotency-optimistic-replay-standard?format=cursor","windsurf":"/api/rules/react19-server-actions-idempotency-optimistic-replay-standard?format=windsurf","agents":"/api/rules/react19-server-actions-idempotency-optimistic-replay-standard?format=agents"}},{"id":"axum-http3-quic-0rtt-anti-replay","title":"Axum 0.8 HTTP/3 QUIC 0-RTT Anti-Replay State Fencing","category":"backend","severity":"critical","description":"Enforces transport and application-layer defenses against QUIC 0-RTT replay attacks on state-mutating HTTP/3 routes in Axum 0.8. Non-idempotent methods (POST, PUT, PATCH, DELETE) received during 0-RTT handshakes must be rejected with HTTP 425 Too Early or gated by anti-replay middleware to protect transactional state.","antiPatternHeadline":"Permitting State-Mutating 0-RTT Early Data over QUIC Handshakes Without Replay Fencing","stars_count":92,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","http3","quic","security","zero-rtt"],"exportEndpoints":{"claude":"/api/rules/axum-http3-quic-0rtt-anti-replay?format=claude","cursorMdc":"/api/rules/axum-http3-quic-0rtt-anti-replay?format=mdc","cursorrules":"/api/rules/axum-http3-quic-0rtt-anti-replay?format=cursor","windsurf":"/api/rules/axum-http3-quic-0rtt-anti-replay?format=windsurf","agents":"/api/rules/axum-http3-quic-0rtt-anti-replay?format=agents"}},{"id":"postgres17-combinebackup-lsn-fencing-standard","title":"PostgreSQL 17 Block-Level Incremental Backup LSN Fencing and Manifest Validation Standard","category":"backend","severity":"critical","description":"Enforces strict monotonic Log Sequence Number (LSN) fencing, manifest checksum parsing, and timeline continuity before invoking PostgreSQL 17's pg_combinebackup utility. Synthesizing synthetic full backups across fractured WAL streams or mismatched backup manifests causes silent, irremediable block-level database corruption during disaster recovery.","antiPatternHeadline":"Blind invocation of pg_combinebackup without pre-flight manifest LSN sequence and SHA-256 checksum boundary fencing","stars_count":84,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql17","backup-recovery","disaster-recovery","pg-combinebackup","infrastructure-automation"],"exportEndpoints":{"claude":"/api/rules/postgres17-combinebackup-lsn-fencing-standard?format=claude","cursorMdc":"/api/rules/postgres17-combinebackup-lsn-fencing-standard?format=mdc","cursorrules":"/api/rules/postgres17-combinebackup-lsn-fencing-standard?format=cursor","windsurf":"/api/rules/postgres17-combinebackup-lsn-fencing-standard?format=windsurf","agents":"/api/rules/postgres17-combinebackup-lsn-fencing-standard?format=agents"}},{"id":"capacitor-7-webauthn-prf-vault-cryptography","title":"Capacitor 7 Hardware-Derived WebAuthn PRF Vault Cryptography Standard","category":"mobile","severity":"critical","description":"Mandates hardware-bound client-side cryptographic vault operations in Capacitor 7 using the WebAuthn PRF (Pseudo-Random Function) extension. Eliminates persistent symmetric master keys by deriving non-extractable CryptoKey instances on-demand via hardware authenticators (iOS Secure Enclave and Android Keystore passkeys) combined with HKDF key stretching.","antiPatternHeadline":"Persisting Static Symmetric Keys in Local Storage or Directly Exposing Raw PRF Buffers without HKDF Expansion and Buffer Zeroization","stars_count":54,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","webauthn","prf","cryptography","aes-gcm","passkeys","security"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-webauthn-prf-vault-cryptography?format=claude","cursorMdc":"/api/rules/capacitor-7-webauthn-prf-vault-cryptography?format=mdc","cursorrules":"/api/rules/capacitor-7-webauthn-prf-vault-cryptography?format=cursor","windsurf":"/api/rules/capacitor-7-webauthn-prf-vault-cryptography?format=windsurf","agents":"/api/rules/capacitor-7-webauthn-prf-vault-cryptography?format=agents"}},{"id":"tauri-v2-mobile-ipc-zero-copy-arraybuffer-boundary","title":"Tauri 2.0 Zero-Copy Binary IPC Buffer Boundary Enforcement","category":"mobile","severity":"critical","description":"Enforces raw binary buffer transfers between the WebView JavaScript runtime and Rust backend in Tauri 2.0 mobile applications. Mandates the use of raw ArrayBuffer, Uint8Array, and Tauri IPC Channels or raw Responses, eliminating JSON serialization and deserialization overhead that causes main-thread frame drops and memory spikes during high-frequency telemetry or binary streaming.","antiPatternHeadline":"Serializing High-Frequency Binary Streams into JSON Arrays or Base64 Strings Across Tauri IPC","stars_count":67,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri-v2","ipc","zero-copy","performance","rust"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-mobile-ipc-zero-copy-arraybuffer-boundary?format=claude","cursorMdc":"/api/rules/tauri-v2-mobile-ipc-zero-copy-arraybuffer-boundary?format=mdc","cursorrules":"/api/rules/tauri-v2-mobile-ipc-zero-copy-arraybuffer-boundary?format=cursor","windsurf":"/api/rules/tauri-v2-mobile-ipc-zero-copy-arraybuffer-boundary?format=windsurf","agents":"/api/rules/tauri-v2-mobile-ipc-zero-copy-arraybuffer-boundary?format=agents"}},{"id":"bpf-lsm-dynamic-capability-fencing-standard","title":"BPF-LSM Dynamic Container Capability Fencing & Syscall Mediation Standard","category":"security","severity":"critical","description":"Mandates in-kernel eBPF LSM mediation hooks over static seccomp profiles to enforce dynamic, phase-aware capability fencing and syscall authorization for containerized workloads. Tracks container cgroups to enforce strict phase transitions directly in kernel memory, eliminating TOCTOU race conditions and neutralizing privilege-escalation vectors at runtime.","antiPatternHeadline":"Permissive Static Seccomp Allowlisting and Unphased Runtime Privileges Enabling Post-Initialization Escalation","stars_count":42,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","ebpf","bpf-lsm","containers","kernel","privilege-escalation"],"exportEndpoints":{"claude":"/api/rules/bpf-lsm-dynamic-capability-fencing-standard?format=claude","cursorMdc":"/api/rules/bpf-lsm-dynamic-capability-fencing-standard?format=mdc","cursorrules":"/api/rules/bpf-lsm-dynamic-capability-fencing-standard?format=cursor","windsurf":"/api/rules/bpf-lsm-dynamic-capability-fencing-standard?format=windsurf","agents":"/api/rules/bpf-lsm-dynamic-capability-fencing-standard?format=agents"}},{"id":"otel-tail-sampling-buffer-guardrail","title":"OpenTelemetry Collector Tail-Based Trace Sampling Buffer Allocation Guardrail","category":"devops","severity":"critical","description":"Imposes deterministic decision windows, bounded in-memory trace buffers, and memory ballast limits on distributed tail-based samplers to capture 100% of P99 tail anomalies without collector out-of-memory cascading failures. Tail sampling processors accumulate spans across distributed trace boundaries before committing drop/keep evaluations, making memory consumption a function of span throughput, trace duration, and evaluation latency. Without explicit memory limiter thresholds, max_traces bounds, and consistent trace-ID hashing across collector topologies, asymmetric routing causes heap saturation and catastrophic OOM kills.","antiPatternHeadline":"Unbounded Trace Buffer Accumulation and Missing Memory Limiter Extension Causing Collector OOM Collapse","stars_count":98,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","observability","distributed-tracing","tail-sampling","kubernetes"],"exportEndpoints":{"claude":"/api/rules/otel-tail-sampling-buffer-guardrail?format=claude","cursorMdc":"/api/rules/otel-tail-sampling-buffer-guardrail?format=mdc","cursorrules":"/api/rules/otel-tail-sampling-buffer-guardrail?format=cursor","windsurf":"/api/rules/otel-tail-sampling-buffer-guardrail?format=windsurf","agents":"/api/rules/otel-tail-sampling-buffer-guardrail?format=agents"}},{"id":"fastapi-anyio-task-shield-isolation","title":"FastAPI & AnyIO Structured Concurrency Async Task Shield Isolation Guardrail","category":"backend","severity":"critical","description":"Enforces strict structured concurrency in FastAPI applications running atop AnyIO by prohibiting raw asyncio background task spawning and unshielded async coroutines. Requires multi-tenant asynchronous tasks to execute within explicit, supervised task groups encapsulated by cancellation shields with bounded timeouts to prevent orphaned tasks, partial writes, and exhausted database connection pools.","antiPatternHeadline":"Spawning raw background tasks or using unshielded coroutines that leak connections and leave partial tenant mutations upon client disconnect","stars_count":52,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","anyio","asyncio","structured-concurrency","cancellation-shield","multi-tenancy"],"exportEndpoints":{"claude":"/api/rules/fastapi-anyio-task-shield-isolation?format=claude","cursorMdc":"/api/rules/fastapi-anyio-task-shield-isolation?format=mdc","cursorrules":"/api/rules/fastapi-anyio-task-shield-isolation?format=cursor","windsurf":"/api/rules/fastapi-anyio-task-shield-isolation?format=windsurf","agents":"/api/rules/fastapi-anyio-task-shield-isolation?format=agents"}},{"id":"k8s-gateway-api-wasm-sandbox-circuit-breaker","title":"Kubernetes Gateway API Wasm Sandbox Memory Bounds and Host-Call Circuit Breaker","category":"devops","severity":"critical","description":"Enforces strict linear memory limits, deterministic execution deadlines, and host-call circuit breakers for Envoy WebAssembly (Wasm) filters deployed via Kubernetes Gateway API extensions. Prevents rogue Wasm plugins from crashing data-plane worker threads, starving host memory pools, or destabilizing ingress edge proxies during runtime faults.","antiPatternHeadline":"Deploying Unbounded Wasm Plugins with Fail-Closed Policies and Blocking Host Calls","stars_count":69,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","kubernetes","gateway-api","envoy","wasm","service-mesh","resilience"],"exportEndpoints":{"claude":"/api/rules/k8s-gateway-api-wasm-sandbox-circuit-breaker?format=claude","cursorMdc":"/api/rules/k8s-gateway-api-wasm-sandbox-circuit-breaker?format=mdc","cursorrules":"/api/rules/k8s-gateway-api-wasm-sandbox-circuit-breaker?format=cursor","windsurf":"/api/rules/k8s-gateway-api-wasm-sandbox-circuit-breaker?format=windsurf","agents":"/api/rules/k8s-gateway-api-wasm-sandbox-circuit-breaker?format=agents"}},{"id":"spiffe-spire-x509-svid-continuous-rotation","title":"SPIFFE/SPIRE In-Memory X.509 SVID Continuous Rotation Fence","category":"security","severity":"critical","description":"Mandates dynamic, memory-only consumption of sub-hour ephemeral X.509 SVIDs via the SPIFFE Workload API Unix Domain Socket (UDS). Prohibits writing private keys or certificates to persistent storage, preventing credential leakage in zero-trust mesh architectures. Enforces real-time TLS SecureContext hot-swapping without connection termination or process restarts.","antiPatternHeadline":"Persisting SVID Private Keys to Disk or Initializing Static, Non-Rotating TLS Contexts","stars_count":44,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","spiffe","spire","zero-trust","mtls","x509","svid"],"exportEndpoints":{"claude":"/api/rules/spiffe-spire-x509-svid-continuous-rotation?format=claude","cursorMdc":"/api/rules/spiffe-spire-x509-svid-continuous-rotation?format=mdc","cursorrules":"/api/rules/spiffe-spire-x509-svid-continuous-rotation?format=cursor","windsurf":"/api/rules/spiffe-spire-x509-svid-continuous-rotation?format=windsurf","agents":"/api/rules/spiffe-spire-x509-svid-continuous-rotation?format=agents"}},{"id":"react-19-optimistic-rollback-boundary","title":"React 19 Optimistic State Transition Rollback Boundary Invariants","category":"frontend","severity":"critical","description":"Enforces transactional rollback guarantees when mutating optimistic state via useOptimistic and useActionState in React 19 concurrent pipelines. Eliminates split-brain UI desynchronization caused by unhandled Server Action rejections, concurrent transition clobbering, and uncoordinated local state mutation outside the transition lifecycle.","antiPatternHeadline":"Split-Brain UI Drift via Unbound Optimistic State Mutation and Missing Transition Rollback Barriers","stars_count":89,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","use-optimistic","server-actions","concurrency"],"exportEndpoints":{"claude":"/api/rules/react-19-optimistic-rollback-boundary?format=claude","cursorMdc":"/api/rules/react-19-optimistic-rollback-boundary?format=mdc","cursorrules":"/api/rules/react-19-optimistic-rollback-boundary?format=cursor","windsurf":"/api/rules/react-19-optimistic-rollback-boundary?format=windsurf","agents":"/api/rules/react-19-optimistic-rollback-boundary?format=agents"}},{"id":"vite-6-environment-api-cross-runtime-isolation","title":"Vite 6 Environment API Cross-Runtime Shared Memory & Module Graph Isolation","category":"frontend","severity":"critical","description":"Vite 6 introduces multi-environment orchestration allowing concurrent execution of client, SSR (Node), and edge/workerd runtimes within a unified dev server. This rule enforces strict module execution and heap boundaries between environments, prohibiting cross-runtime in-memory singleton access, cross-environment module graph contamination, and non-serializable IPC payloads.","antiPatternHeadline":"Cross-Runtime Memory Leakage and Module Graph Contamination via Unscoped Singletons in Vite 6 DevEnvironments","stars_count":80,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","vite","vite6","environment-api","ssr","workerd","isolation"],"exportEndpoints":{"claude":"/api/rules/vite-6-environment-api-cross-runtime-isolation?format=claude","cursorMdc":"/api/rules/vite-6-environment-api-cross-runtime-isolation?format=mdc","cursorrules":"/api/rules/vite-6-environment-api-cross-runtime-isolation?format=cursor","windsurf":"/api/rules/vite-6-environment-api-cross-runtime-isolation?format=windsurf","agents":"/api/rules/vite-6-environment-api-cross-runtime-isolation?format=agents"}},{"id":"axum-bounded-zero-copy-streaming-multipart-boundary","title":"Axum 0.8 Bounded Zero-Copy Streaming Multipart Boundary","category":"backend","severity":"critical","description":"Protects Tokio async runtimes from memory exhaustion (OOM) and Slowloris-style degradation by enforcing bounded, zero-copy streaming multipart ingestion. Replaces unbounded memory accumulation (e.g., to_bytes, Vec<u8> collection) with fixed chunk backpressure, explicit per-field byte limits, and strict read timeouts.","antiPatternHeadline":"Unbounded In-Memory Multipart Buffering and Unconstrained Chunk Allocation","stars_count":60,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tokio","security","streaming"],"exportEndpoints":{"claude":"/api/rules/axum-bounded-zero-copy-streaming-multipart-boundary?format=claude","cursorMdc":"/api/rules/axum-bounded-zero-copy-streaming-multipart-boundary?format=mdc","cursorrules":"/api/rules/axum-bounded-zero-copy-streaming-multipart-boundary?format=cursor","windsurf":"/api/rules/axum-bounded-zero-copy-streaming-multipart-boundary?format=windsurf","agents":"/api/rules/axum-bounded-zero-copy-streaming-multipart-boundary?format=agents"}},{"id":"postgres-17-failover-logical-slot-sync-standard","title":"Postgres 17 Failover Logical Replication Slot Synchronization Guardrail","category":"backend","severity":"critical","description":"Enforces Postgres 17 native failover-enabled logical replication slots and slot synchronization workers across high-availability physical standbys. Prevents unrecoverable downstream CDC stream corruption, message duplication storms, and silent data loss caused by non-synchronized restart LSN positions during database failover events.","antiPatternHeadline":"Unsynchronized Logical Slots Causing Downstream CDC Replication Panics Post-Failover","stars_count":108,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres17","logical-replication","cdc","high-availability","database-reliability"],"exportEndpoints":{"claude":"/api/rules/postgres-17-failover-logical-slot-sync-standard?format=claude","cursorMdc":"/api/rules/postgres-17-failover-logical-slot-sync-standard?format=mdc","cursorrules":"/api/rules/postgres-17-failover-logical-slot-sync-standard?format=cursor","windsurf":"/api/rules/postgres-17-failover-logical-slot-sync-standard?format=windsurf","agents":"/api/rules/postgres-17-failover-logical-slot-sync-standard?format=agents"}},{"id":"compose-multiplatform-skiko-gpu-surface-lifecycle-guardrail","title":"Compose Multiplatform Skiko GPU Surface Lifecycle Invariant","category":"mobile","severity":"critical","description":"Enforces deterministic teardown and re-instantiation of Skiko rendering delegates and hardware surfaces across Android and iOS lifecycle transitions. Prevents fatal GPU driver termination (SIGKILL 0xdead10cc on iOS Metal, VK_ERROR_DEVICE_LOST/EGL_BAD_SURFACE on Android) caused by mid-flight draw calls dispatched to invalidated swapchains during rapid background-foreground swaps.","antiPatternHeadline":"Orphaned Skia Metal/OpenGL swapchains attempting buffer presentation after OS lifecycle backgrounding","stars_count":61,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","compose-multiplatform","skiko","graphics","metal","vulkan","lifecycle"],"exportEndpoints":{"claude":"/api/rules/compose-multiplatform-skiko-gpu-surface-lifecycle-guardrail?format=claude","cursorMdc":"/api/rules/compose-multiplatform-skiko-gpu-surface-lifecycle-guardrail?format=mdc","cursorrules":"/api/rules/compose-multiplatform-skiko-gpu-surface-lifecycle-guardrail?format=cursor","windsurf":"/api/rules/compose-multiplatform-skiko-gpu-surface-lifecycle-guardrail?format=windsurf","agents":"/api/rules/compose-multiplatform-skiko-gpu-surface-lifecycle-guardrail?format=agents"}},{"id":"capacitor-7-hardware-keystore-invalidation-recovery-pattern","title":"Capacitor 7 Hardware Keystore Invalidation Recovery and Session Eviction Standard","category":"mobile","severity":"critical","description":"Enforces deterministic handling of hardware-backed cryptographic key invalidations resulting from biometric enrollment changes (Android KeyPermanentlyInvalidatedException and iOS errSecAuthFailed/errSecItemNotFound) in Capacitor 7 applications. Guarantees that poisoned, invalidated keystore entries trigger atomic purge of downstream auth state, prevent infinite authentication loops, and route users through clean re-enrollment.","antiPatternHeadline":"Swallowing Keystore Invalidation Errors as Transient Network or Decryption Failures","stars_count":101,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","biometrics","keystore","security","keychain","cryptography"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-hardware-keystore-invalidation-recovery-pattern?format=claude","cursorMdc":"/api/rules/capacitor-7-hardware-keystore-invalidation-recovery-pattern?format=mdc","cursorrules":"/api/rules/capacitor-7-hardware-keystore-invalidation-recovery-pattern?format=cursor","windsurf":"/api/rules/capacitor-7-hardware-keystore-invalidation-recovery-pattern?format=windsurf","agents":"/api/rules/capacitor-7-hardware-keystore-invalidation-recovery-pattern?format=agents"}},{"id":"openfga-graph-traversal-depth-and-cycle-guard","title":"OpenFGA Graph Evaluation Depth and Cyclic Tuple Resolution Boundary","category":"security","severity":"critical","description":"Zanzibar-style authorization models are susceptible to algorithmic Denial of Service (DoS) and stack exhaustion via deeply nested group hierarchies or self-referential cyclic relationship tuples. This rule enforces deterministic graph evaluation bounds through strict max-depth traversal budgets, cycle detection caches, and contextual check timeouts at both model definition and client evaluation layers.","antiPatternHeadline":"Unbounded Recursive Tuple Expansion and Missing Cycle Detection in Zanzibar Checks","stars_count":96,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","authorization","zanzibar","dos-prevention","graph-algorithms"],"exportEndpoints":{"claude":"/api/rules/openfga-graph-traversal-depth-and-cycle-guard?format=claude","cursorMdc":"/api/rules/openfga-graph-traversal-depth-and-cycle-guard?format=mdc","cursorrules":"/api/rules/openfga-graph-traversal-depth-and-cycle-guard?format=cursor","windsurf":"/api/rules/openfga-graph-traversal-depth-and-cycle-guard?format=windsurf","agents":"/api/rules/openfga-graph-traversal-depth-and-cycle-guard?format=agents"}},{"id":"webauthn-hybrid-nonce-replay-guardrail","title":"WebAuthn Hybrid Cross-Device Ephemeral Nonce & Session-Binding Replay Guardrail","category":"security","severity":"critical","description":"Mandates cryptographic binding, atomic single-use consumption, and strict ephemeral rotation (TTL <= 60s) for FIDO hybrid cross-device authentication sessions. Enforces zero-trust QR payload generation tied directly to the initiator's TLS-bound session to neutralize MITM relay attacks and stale credential harvesting.","antiPatternHeadline":"Long-Lived Static QR Codes and Unbound Hybrid WebAuthn Nonces Susceptible to Adversary Relay and Replay","stars_count":97,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","passkeys","fido2","mitm-prevention","replay-protection"],"exportEndpoints":{"claude":"/api/rules/webauthn-hybrid-nonce-replay-guardrail?format=claude","cursorMdc":"/api/rules/webauthn-hybrid-nonce-replay-guardrail?format=mdc","cursorrules":"/api/rules/webauthn-hybrid-nonce-replay-guardrail?format=cursor","windsurf":"/api/rules/webauthn-hybrid-nonce-replay-guardrail?format=windsurf","agents":"/api/rules/webauthn-hybrid-nonce-replay-guardrail?format=agents"}},{"id":"cilium-ebpf-host-routing-snat-exhaustion-mitigation","title":"Cilium eBPF Host-Routing NodePort SNAT Exhaustion Mitigation","category":"devops","severity":"critical","description":"Enforces Direct Server Return (DSR) or Local external traffic policies alongside scaled BPF connection tracking maps and deterministic ephemeral port ranges. This prevents silent packet drops, connection blackholing, and cascading node partitions under high-concurrency connection churn in Cilium-managed Kubernetes clusters.","antiPatternHeadline":"Default SNAT NodePort Routing with Default BPF Conntrack Table Limits Under High Concurrency","stars_count":56,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","cilium","ebpf","kubernetes","networking","conntrack","snat"],"exportEndpoints":{"claude":"/api/rules/cilium-ebpf-host-routing-snat-exhaustion-mitigation?format=claude","cursorMdc":"/api/rules/cilium-ebpf-host-routing-snat-exhaustion-mitigation?format=mdc","cursorrules":"/api/rules/cilium-ebpf-host-routing-snat-exhaustion-mitigation?format=cursor","windsurf":"/api/rules/cilium-ebpf-host-routing-snat-exhaustion-mitigation?format=windsurf","agents":"/api/rules/cilium-ebpf-host-routing-snat-exhaustion-mitigation?format=agents"}},{"id":"k8s-gateway-api-referencegrant-hardening","title":"Kubernetes Gateway API v1.2 ReferenceGrant Zero-Trust Cross-Namespace Boundary Enforcement","category":"devops","severity":"critical","description":"In Kubernetes Gateway API v1.2+, cross-namespace references between Gateways, Routes, Services, and Secrets are strictly denied by default under zero-trust networking boundaries. Target namespaces containing backend Services or TLS Secrets must explicitly authorize caller namespaces via a collocated ReferenceGrant CRD. Misconfigured, omitted, or wildcarded ReferenceGrants cause silent route detachment ('ResolvedRefs: False') or catastrophic multi-tenant credential exfiltration.","antiPatternHeadline":"Cross-Namespace Ingress Referencing Without Target-Namespace ReferenceGrant Authorization","stars_count":64,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","kubernetes","gateway-api","zero-trust","reference-grant","security"],"exportEndpoints":{"claude":"/api/rules/k8s-gateway-api-referencegrant-hardening?format=claude","cursorMdc":"/api/rules/k8s-gateway-api-referencegrant-hardening?format=mdc","cursorrules":"/api/rules/k8s-gateway-api-referencegrant-hardening?format=cursor","windsurf":"/api/rules/k8s-gateway-api-referencegrant-hardening?format=windsurf","agents":"/api/rules/k8s-gateway-api-referencegrant-hardening?format=agents"}},{"id":"react-19-action-state-optimistic-mutation-invariant","title":"React 19 Action State Transition and Optimistic Mutation Queue Invariant","category":"frontend","severity":"critical","description":"Enforces strict queue serialization and deterministic rollback reconciliation when combining React 19's useActionState and useOptimistic primitives during concurrent server actions. Guarantees that optimistic UI state branches cleanly reconcile against server-committed state without race conditions, stale closure overwrites, or out-of-order rollbacks.","antiPatternHeadline":"Unserialized Concurrent Mutations with Orphaned Optimistic States and Desynchronized Rollbacks","stars_count":63,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","useActionState","useOptimistic","concurrency","server-actions"],"exportEndpoints":{"claude":"/api/rules/react-19-action-state-optimistic-mutation-invariant?format=claude","cursorMdc":"/api/rules/react-19-action-state-optimistic-mutation-invariant?format=mdc","cursorrules":"/api/rules/react-19-action-state-optimistic-mutation-invariant?format=cursor","windsurf":"/api/rules/react-19-action-state-optimistic-mutation-invariant?format=windsurf","agents":"/api/rules/react-19-action-state-optimistic-mutation-invariant?format=agents"}},{"id":"go-weak-pointer-addcleanup-cache-standard","title":"Go 1.24 weak.Pointer and runtime.AddCleanup Concurrent Cache Standard","category":"backend","severity":"critical","description":"Enforces deterministic weak reference caching and resource cleanup introduced in Go 1.24 using weak.Pointer and runtime.AddCleanup. Eliminates memory leaks from unbounded key retention and removes finalizer-induced object resurrection bugs in high-throughput concurrent services.","antiPatternHeadline":"Retaining strong heap references in caches or passing target pointers to legacy SetFinalizer closures.","stars_count":110,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","concurrency","memory-management","caching","go1.24"],"exportEndpoints":{"claude":"/api/rules/go-weak-pointer-addcleanup-cache-standard?format=claude","cursorMdc":"/api/rules/go-weak-pointer-addcleanup-cache-standard?format=mdc","cursorrules":"/api/rules/go-weak-pointer-addcleanup-cache-standard?format=cursor","windsurf":"/api/rules/go-weak-pointer-addcleanup-cache-standard?format=windsurf","agents":"/api/rules/go-weak-pointer-addcleanup-cache-standard?format=agents"}},{"id":"postgres-17-direct-io-memory-guardrail","title":"PostgreSQL 17 Direct I/O and Memory Accounting Guardrail","category":"backend","severity":"critical","description":"Enforces strict memory budgeting and I/O engine configuration for PostgreSQL 17 workloads to prevent kernel page-cache double-buffering and Out-Of-Memory (OOM) failures under heavy analytical concurrency. Mandates explicit session-level work_mem budgeting per parallel worker and ensures database connection pools dynamically constrain concurrent analytical execution based on physical memory thresholds.","antiPatternHeadline":"Unbounded Parallel Query Execution and Global work_mem Reliance Leading to OS OOM-Killer Invocations","stars_count":45,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql-17","direct-io","memory-accounting","database-tuning","performance"],"exportEndpoints":{"claude":"/api/rules/postgres-17-direct-io-memory-guardrail?format=claude","cursorMdc":"/api/rules/postgres-17-direct-io-memory-guardrail?format=mdc","cursorrules":"/api/rules/postgres-17-direct-io-memory-guardrail?format=cursor","windsurf":"/api/rules/postgres-17-direct-io-memory-guardrail?format=windsurf","agents":"/api/rules/postgres-17-direct-io-memory-guardrail?format=agents"}},{"id":"axum-tower-async-cancellation-raii-cleanup","title":"Axum 0.8 & Tower Async Cancellation and RAII Transaction Invariant","category":"backend","severity":"critical","description":"Enforces deterministic cancellation safety and structured RAII resource cleanup in Axum 0.8 / Tower async streaming endpoints over HTTP/3. Prevents mid-stream client disconnects from silently terminating in-flight transactional updates or leaking non-rolled-back pool connections.","antiPatternHeadline":"Interleaving Async Yield Points Across Non-Atomic Transaction Steps Causing State Corruption on Client Disconnect","stars_count":60,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tokio","tower","sqlx","http3"],"exportEndpoints":{"claude":"/api/rules/axum-tower-async-cancellation-raii-cleanup?format=claude","cursorMdc":"/api/rules/axum-tower-async-cancellation-raii-cleanup?format=mdc","cursorrules":"/api/rules/axum-tower-async-cancellation-raii-cleanup?format=cursor","windsurf":"/api/rules/axum-tower-async-cancellation-raii-cleanup?format=windsurf","agents":"/api/rules/axum-tower-async-cancellation-raii-cleanup?format=agents"}},{"id":"capacitor-7-android-15-predictive-back-window-inset-standard","title":"Capacitor 7 Android 15 Predictive Back and Window Inset Synchronization Standard","category":"mobile","severity":"critical","description":"Hardens hybrid mobile architectures against layout shifts, safe area collapse, and gesture navigation conflicts under Android 15 (API 35). Mandates edge-to-edge WindowInsets synchronization with Chromium viewport CSS environment variables while properly binding predictive back gesture state without breaking SPA routing lifecycles.","antiPatternHeadline":"Unsynchronized Edge-to-Edge Insets and Monolithic Back Handlers Causing Viewport Clipping and Predictive Back Freezes","stars_count":45,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["capacitor","android-15","predictive-back","window-insets","mobile-architecture","edge-to-edge"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-android-15-predictive-back-window-inset-standard?format=claude","cursorMdc":"/api/rules/capacitor-7-android-15-predictive-back-window-inset-standard?format=mdc","cursorrules":"/api/rules/capacitor-7-android-15-predictive-back-window-inset-standard?format=cursor","windsurf":"/api/rules/capacitor-7-android-15-predictive-back-window-inset-standard?format=windsurf","agents":"/api/rules/capacitor-7-android-15-predictive-back-window-inset-standard?format=agents"}},{"id":"webauthn-prf-zk-local-storage-invariant","title":"WebAuthn PRF Client-Side Zero-Knowledge Storage Invariant","category":"security","severity":"critical","description":"Enforces zero-knowledge local storage encryption derived via WebAuthn PRF (Pseudo-Random Function) extension hardware seeds. Mandates transient in-memory derivation, strict domain separation via HKDF, total prevention of PRF output leakage to backend servers, and non-extractable CryptoKey management.","antiPatternHeadline":"Transmitting WebAuthn PRF output to backend authentication endpoints and caching derived raw keys in persistent browser storage","stars_count":53,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","prf-extension","zero-knowledge","web-crypto","e2ee"],"exportEndpoints":{"claude":"/api/rules/webauthn-prf-zk-local-storage-invariant?format=claude","cursorMdc":"/api/rules/webauthn-prf-zk-local-storage-invariant?format=mdc","cursorrules":"/api/rules/webauthn-prf-zk-local-storage-invariant?format=cursor","windsurf":"/api/rules/webauthn-prf-zk-local-storage-invariant?format=windsurf","agents":"/api/rules/webauthn-prf-zk-local-storage-invariant?format=agents"}},{"id":"fedcm-identity-isolation-standard","title":"FedCM Enterprise Identity Isolation and Origin Guardrail","category":"security","severity":"critical","description":"Enforces strict browser-mediated Federated Credential Management (FedCM) protocols across enterprise Relying Parties (RP) and Identity Providers (IdP). Eliminates fallback reliance on degraded third-party storage access or silent iframe redirect chains by anchoring cross-origin session initialization to validated FedCM manifest trust boundaries and explicit user-mediated credential assertions.","antiPatternHeadline":"Silent Iframe PostMessage Loops and Third-Party Cookie Dependent SSO Flows","stars_count":92,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","fedcm","identity","authentication","browser-security","oauth2","oidc"],"exportEndpoints":{"claude":"/api/rules/fedcm-identity-isolation-standard?format=claude","cursorMdc":"/api/rules/fedcm-identity-isolation-standard?format=mdc","cursorrules":"/api/rules/fedcm-identity-isolation-standard?format=cursor","windsurf":"/api/rules/fedcm-identity-isolation-standard?format=windsurf","agents":"/api/rules/fedcm-identity-isolation-standard?format=agents"}},{"id":"tetragon-namespace-integrity-execution-kill-guardrail","title":"eBPF Tetragon Namespace Integrity and Kernel Execution Kill Guardrail","category":"devops","severity":"critical","description":"Enforces synchronous, kernel-level process termination via eBPF Tetragon TracingPolicies to instantly halt binary drift, namespace escapes, and privilege escalations before userspace alerts process. Mandates deterministic in-kernel Sigkill actions over passive asynchronous audit streams to prevent container compromise windows.","antiPatternHeadline":"Relying on Passive Userspace Audit Logs While Permitting Arbitrary Container Execution and Namespace Drifts","stars_count":75,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","tetragon","kubernetes","runtime-security","zero-trust"],"exportEndpoints":{"claude":"/api/rules/tetragon-namespace-integrity-execution-kill-guardrail?format=claude","cursorMdc":"/api/rules/tetragon-namespace-integrity-execution-kill-guardrail?format=mdc","cursorrules":"/api/rules/tetragon-namespace-integrity-execution-kill-guardrail?format=cursor","windsurf":"/api/rules/tetragon-namespace-integrity-execution-kill-guardrail?format=windsurf","agents":"/api/rules/tetragon-namespace-integrity-execution-kill-guardrail?format=agents"}},{"id":"envoy-gateway-dynamic-ephemeral-cell-routing","title":"Envoy Gateway 1.2 Ephemeral Cell Routing via Metadata Extraction","category":"devops","severity":"critical","description":"Enforces tenant-scoped ephemeral pull request (PR) environment isolation at the network edge using declarative Envoy dynamic metadata extraction. Bypasses Kubernetes API churn and cluster-wide Envoy Gateway route reconciliations by dynamically rewriting destinations using EnvoyFilter/EnvoyExtensionPolicy metadata injection rather than provisioning per-PR HTTPRoutes.","antiPatternHeadline":"Creating Static HTTPRoute Resources Per Ephemeral PR Causing Control Plane Reconciliation Storms","stars_count":68,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","envoy-gateway","kubernetes","routing","ephemeral-environments"],"exportEndpoints":{"claude":"/api/rules/envoy-gateway-dynamic-ephemeral-cell-routing?format=claude","cursorMdc":"/api/rules/envoy-gateway-dynamic-ephemeral-cell-routing?format=mdc","cursorrules":"/api/rules/envoy-gateway-dynamic-ephemeral-cell-routing?format=cursor","windsurf":"/api/rules/envoy-gateway-dynamic-ephemeral-cell-routing?format=windsurf","agents":"/api/rules/envoy-gateway-dynamic-ephemeral-cell-routing?format=agents"}},{"id":"svelte-5-runes-ssr-universal-store-leak-prevention","title":"Svelte 5 Runes Universal Store Cross-Request State Leakage Prevention","category":"frontend","severity":"critical","description":"Enforces strict per-request isolation for Svelte 5 reactive runes ($state) in universal and server-side rendering (SSR) environments. In persistent runtime worker environments (Node.js, Bun, Cloudflare Workers), module-level reactive singletons bleed authenticated sessions, PII, and request mutations across concurrent user requests. Engineers must encapsulate mutable state within component contexts or per-request lifecycle factories.","antiPatternHeadline":"Module-Scoped $state() Singletons Leaking Concurrent User Sessions During SSR","stars_count":113,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","sveltekit","ssr","concurrency","security","memory-leak"],"exportEndpoints":{"claude":"/api/rules/svelte-5-runes-ssr-universal-store-leak-prevention?format=claude","cursorMdc":"/api/rules/svelte-5-runes-ssr-universal-store-leak-prevention?format=mdc","cursorrules":"/api/rules/svelte-5-runes-ssr-universal-store-leak-prevention?format=cursor","windsurf":"/api/rules/svelte-5-runes-ssr-universal-store-leak-prevention?format=windsurf","agents":"/api/rules/svelte-5-runes-ssr-universal-store-leak-prevention?format=agents"}},{"id":"go-weak-pointer-ephemeral-cache-contract","title":"Go 1.24 Weak Pointer Ephemeral Cache Eviction and Epoch Boundary Contract","category":"backend","severity":"critical","description":"Isolates Go 1.24 `weak.Pointer` dereferences behind deterministic epoch boundaries to prevent silent memory resurrection, finalizer deadlocks, and stale slot retention. Mandates synchronized read promotion and epoch-gated cleanup loops to guarantee GC reclamation in high-throughput microservices.","antiPatternHeadline":"Unsynchronized weak.Pointer dereference with inline map mutation and lock acquisition inside GC cleanup callbacks","stars_count":97,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","weak-pointer","memory-management","cache","concurrency"],"exportEndpoints":{"claude":"/api/rules/go-weak-pointer-ephemeral-cache-contract?format=claude","cursorMdc":"/api/rules/go-weak-pointer-ephemeral-cache-contract?format=mdc","cursorrules":"/api/rules/go-weak-pointer-ephemeral-cache-contract?format=cursor","windsurf":"/api/rules/go-weak-pointer-ephemeral-cache-contract?format=windsurf","agents":"/api/rules/go-weak-pointer-ephemeral-cache-contract?format=agents"}},{"id":"postgres-17-parallel-apply-deadlock-avoidance-standard","title":"Postgres 17 Logical Replication Parallel Apply Deadlock Avoidance Standard","category":"backend","severity":"critical","description":"Enforces deterministic dependency ordering and partition-aware foreign key schema designs to prevent inter-worker transaction lock deadlocks under Postgres 17 parallel apply mode (`streaming = parallel`). Guarantees that concurrent apply workers resolving streaming in-progress transactions never acquire conflicting relation row-exclusive locks in non-canonical order across parent-child or inter-dependent tables.","antiPatternHeadline":"Non-Deterministic Cross-Table Writes and Bidirectional Foreign Key Chains Triggering Worker Apply Deadlocks","stars_count":75,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","postgres-17","logical-replication","parallel-apply","database-concurrency"],"exportEndpoints":{"claude":"/api/rules/postgres-17-parallel-apply-deadlock-avoidance-standard?format=claude","cursorMdc":"/api/rules/postgres-17-parallel-apply-deadlock-avoidance-standard?format=mdc","cursorrules":"/api/rules/postgres-17-parallel-apply-deadlock-avoidance-standard?format=cursor","windsurf":"/api/rules/postgres-17-parallel-apply-deadlock-avoidance-standard?format=windsurf","agents":"/api/rules/postgres-17-parallel-apply-deadlock-avoidance-standard?format=agents"}},{"id":"bun-worker-zerocopy-ringbuffer-production-standard","title":"Bun 1.2 Multi-Threaded Worker Zero-Copy Ring Buffer Standard","category":"backend","severity":"critical","description":"Enforces zero-copy, lock-free inter-thread communication in Bun 1.2 runtimes using SharedArrayBuffer and atomic synchronization primitives. Prevents V8/JSC structured clone serialization overhead and eliminates event-loop microtask starvation under high-throughput data streaming. Guarantees cache-line padded atomic indices and strictly bounded contiguous memory layouts between the main reactor and native worker threads.","antiPatternHeadline":"Starving the Main Event Loop via High-Frequency postMessage Structured Cloning and Unbounded Microtask Enqueueing","stars_count":92,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","sharedarraybuffer","atomics","concurrency","performance"],"exportEndpoints":{"claude":"/api/rules/bun-worker-zerocopy-ringbuffer-production-standard?format=claude","cursorMdc":"/api/rules/bun-worker-zerocopy-ringbuffer-production-standard?format=mdc","cursorrules":"/api/rules/bun-worker-zerocopy-ringbuffer-production-standard?format=cursor","windsurf":"/api/rules/bun-worker-zerocopy-ringbuffer-production-standard?format=windsurf","agents":"/api/rules/bun-worker-zerocopy-ringbuffer-production-standard?format=agents"}},{"id":"compose-skiko-vulkan-surface-lifecycle-guardrail","title":"Compose Multiplatform Skiko Vulkan Surface Lifecycle Synchronization Guardrail","category":"mobile","severity":"critical","description":"Prevents catastrophic render pipeline panics, SIGSEGV crashes, and VK_ERROR_SURFACE_LOST_KHR exceptions during rapid Android activity teardown, configuration changes, or background transitions. Guarantees that the native ANativeWindow surface destruction is synchronously fenced against Skiko render loop dispatches and Skia GPU context flushes.","antiPatternHeadline":"Asynchronous Surface Teardown Allowing Skiko Render Threads to Draw to Deallocated Native Surfaces","stars_count":114,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","compose-multiplatform","skiko","vulkan","android-lifecycle","concurrency"],"exportEndpoints":{"claude":"/api/rules/compose-skiko-vulkan-surface-lifecycle-guardrail?format=claude","cursorMdc":"/api/rules/compose-skiko-vulkan-surface-lifecycle-guardrail?format=mdc","cursorrules":"/api/rules/compose-skiko-vulkan-surface-lifecycle-guardrail?format=cursor","windsurf":"/api/rules/compose-skiko-vulkan-surface-lifecycle-guardrail?format=windsurf","agents":"/api/rules/compose-skiko-vulkan-surface-lifecycle-guardrail?format=agents"}},{"id":"react-native-fabric-shadowtree-mutation-fence-standard","title":"React Native 0.77 Fabric ShadowTree Concurrent Mutation Fence","category":"mobile","severity":"critical","description":"Enforces strict mutation fencing in React Native 0.77's Fabric renderer to eliminate C++ ShadowTree commit clobbering. Guarantees that continuous high-frequency gesture interactions executing via Reanimated worklets do not interleave non-atomically with concurrent background Yoga layout passes or asynchronous React state transactions. Prevents dropped frames, ShadowNode revision desynchronization, and silent layout rollbacks.","antiPatternHeadline":"Interleaving Imperative JS State Transitions Inside High-Frequency Gesture Loops Triggering ShadowTree Commit Clashes","stars_count":58,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","react-native","fabric","shadowtree","reanimated","concurrency"],"exportEndpoints":{"claude":"/api/rules/react-native-fabric-shadowtree-mutation-fence-standard?format=claude","cursorMdc":"/api/rules/react-native-fabric-shadowtree-mutation-fence-standard?format=mdc","cursorrules":"/api/rules/react-native-fabric-shadowtree-mutation-fence-standard?format=cursor","windsurf":"/api/rules/react-native-fabric-shadowtree-mutation-fence-standard?format=windsurf","agents":"/api/rules/react-native-fabric-shadowtree-mutation-fence-standard?format=agents"}},{"id":"w3c-dbsc-session-binding-guardrail","title":"W3C Device Bound Session Credentials (DBSC) Hardware-Enforced Cryptographic Rotation Invariant","category":"security","severity":"critical","description":"Enforces strict server-side validation and lifecycle management of W3C Device Bound Session Credentials (DBSC) to neutralize infostealer-driven cookie hijacking. Binds short-lived session cookies to hardware-backed TPM or Secure Enclave asymmetric keypairs per origin via cryptographic challenge-response rotations. Mandates verification of single-use challenge nonces and proof-of-possession signatures before refreshing or honoring session states.","antiPatternHeadline":"Trusting Ambient Bearer Cookies Without Cryptographic Proof-of-Possession and Hardware Key Binding","stars_count":91,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","dbsc","cryptography","infostealer-prevention","session-management","w3c"],"exportEndpoints":{"claude":"/api/rules/w3c-dbsc-session-binding-guardrail?format=claude","cursorMdc":"/api/rules/w3c-dbsc-session-binding-guardrail?format=mdc","cursorrules":"/api/rules/w3c-dbsc-session-binding-guardrail?format=cursor","windsurf":"/api/rules/w3c-dbsc-session-binding-guardrail?format=windsurf","agents":"/api/rules/w3c-dbsc-session-binding-guardrail?format=agents"}},{"id":"wasmtime-capability-component-isolation-standard","title":"Wasmtime Capability-Based Component Model Zero-Trust Isolation Standard","category":"security","severity":"critical","description":"Enforces deterministic capability-based security across all WebAssembly Component Model runtimes using Wasmtime. Untrusted guest extensions are strictly isolated from ambient POSIX capabilities, host filesystems, environment variables, and raw sockets through explicitly mediated WASI 0.2 interfaces and rigid resource limits.","antiPatternHeadline":"Leaking Ambient Host POSIX Resources and Ambient Network Context into Untrusted WebAssembly Guests","stars_count":62,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","wasmtime","wasm","wasi","component-model","sandboxing","zero-trust"],"exportEndpoints":{"claude":"/api/rules/wasmtime-capability-component-isolation-standard?format=claude","cursorMdc":"/api/rules/wasmtime-capability-component-isolation-standard?format=mdc","cursorrules":"/api/rules/wasmtime-capability-component-isolation-standard?format=cursor","windsurf":"/api/rules/wasmtime-capability-component-isolation-standard?format=windsurf","agents":"/api/rules/wasmtime-capability-component-isolation-standard?format=agents"}},{"id":"ebpf-tetragon-kernel-namespace-escape-prevention-standard","title":"Tetragon In-Kernel Synchronous Boundary Enforcement & Namespace Escape Prevention","category":"devops","severity":"critical","description":"Enforces synchronous kernel-space process termination via eBPF Tetragon TracingPolicies for unauthorized namespace switches and privilege boundary traversal. Mandates deterministic in-kernel Sigkill actions at tracepoint and kprobe dispatchers to prevent race-window exploitation inherent to asynchronous userspace detection engines.","antiPatternHeadline":"Asynchronous User-Space Audit-Only Monitoring of Container Namespace Traversal and Privilege Escalation","stars_count":109,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","tetragon","kubernetes","container-security","kernel-hardening"],"exportEndpoints":{"claude":"/api/rules/ebpf-tetragon-kernel-namespace-escape-prevention-standard?format=claude","cursorMdc":"/api/rules/ebpf-tetragon-kernel-namespace-escape-prevention-standard?format=mdc","cursorrules":"/api/rules/ebpf-tetragon-kernel-namespace-escape-prevention-standard?format=cursor","windsurf":"/api/rules/ebpf-tetragon-kernel-namespace-escape-prevention-standard?format=windsurf","agents":"/api/rules/ebpf-tetragon-kernel-namespace-escape-prevention-standard?format=agents"}},{"id":"tanstack-query-v5-structural-sharing-gc-guardrail","title":"TanStack Query v5 Structural Sharing & GC Boundary Guardrail","category":"frontend","severity":"critical","description":"Enforces strict immutability boundaries and explicit structural sharing controls for TanStack Query v5 in long-lived client sessions. Prevents catastrophic heap fragmentation, runaway replaceEqualDeep recursive traversals, and detached DOM retention caused by unbounded high-frequency cache invalidations.","antiPatternHeadline":"Unbounded replaceEqualDeep traversals and stale reference closures across high-frequency cache writes.","stars_count":48,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","tanstack-query","react-query","memory-management","garbage-collection","performance"],"exportEndpoints":{"claude":"/api/rules/tanstack-query-v5-structural-sharing-gc-guardrail?format=claude","cursorMdc":"/api/rules/tanstack-query-v5-structural-sharing-gc-guardrail?format=mdc","cursorrules":"/api/rules/tanstack-query-v5-structural-sharing-gc-guardrail?format=cursor","windsurf":"/api/rules/tanstack-query-v5-structural-sharing-gc-guardrail?format=windsurf","agents":"/api/rules/tanstack-query-v5-structural-sharing-gc-guardrail?format=agents"}},{"id":"coop-atomics-sharedarraybuffer-fencing","title":"Cross-Origin Isolation and Atomics Fencing for SharedArrayBuffer Concurrency","category":"frontend","severity":"critical","description":"Mandates strict cross-origin isolation headers (COOP/COEP) to safely instantiate SharedArrayBuffer without Spectre exposure, combined with explicit Atomics memory fencing between main-thread rendering pipelines and WebAssembly worker pools. Forbids un-synchronized shared memory mutation and illegal main-thread Atomics.wait calls to prevent browser freezing and torn reads.","antiPatternHeadline":"Unsynchronized SharedArrayBuffer Access and Main-Thread Blocking Atomics Under Insecure Origin Isolation","stars_count":56,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","webassembly","sharedarraybuffer","atomics","concurrency","security","web-workers"],"exportEndpoints":{"claude":"/api/rules/coop-atomics-sharedarraybuffer-fencing?format=claude","cursorMdc":"/api/rules/coop-atomics-sharedarraybuffer-fencing?format=mdc","cursorrules":"/api/rules/coop-atomics-sharedarraybuffer-fencing?format=cursor","windsurf":"/api/rules/coop-atomics-sharedarraybuffer-fencing?format=windsurf","agents":"/api/rules/coop-atomics-sharedarraybuffer-fencing?format=agents"}},{"id":"go-chi-http3-0rtt-anti-replay-idempotency","title":"Go Chi HTTP/3 0-RTT Anti-Replay Idempotency Standard","category":"backend","severity":"critical","description":"Enforces deterministic anti-replay protection across HTTP/3 QUIC 0-RTT early-data handshakes in Go Chi routing topologies. Eliminates duplicate state mutations during volatile mobile edge reconnects by pairing RFC 8470 Early-Data validation with distributed atomic nonce reservations.","antiPatternHeadline":"Blind Execution of State-Mutating Handshake Requests Over HTTP/3 0-RTT Early Data","stars_count":95,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","chi","http3","quic","zero-rtt","idempotency"],"exportEndpoints":{"claude":"/api/rules/go-chi-http3-0rtt-anti-replay-idempotency?format=claude","cursorMdc":"/api/rules/go-chi-http3-0rtt-anti-replay-idempotency?format=mdc","cursorrules":"/api/rules/go-chi-http3-0rtt-anti-replay-idempotency?format=cursor","windsurf":"/api/rules/go-chi-http3-0rtt-anti-replay-idempotency?format=windsurf","agents":"/api/rules/go-chi-http3-0rtt-anti-replay-idempotency?format=agents"}},{"id":"fastapi-async-lifespan-structured-teardown","title":"FastAPI Async Lifespan Structured Concurrency & Deterministic Resource Teardown","category":"backend","severity":"critical","description":"Enforces strict structured concurrency and deterministic two-phase resource teardown using ASGI Lifespan context managers in FastAPI applications. Mandates explicit cancellation and completion of asynchronous background tasks alongside ordered draining and closing of distributed connection pools (PostgreSQL, Redis, RabbitMQ) to eliminate socket exhaustion, orphaned coroutines, and dirty process termination.","antiPatternHeadline":"Ad-Hoc Startup Event Handlers and Fire-and-Forget Background Tasks Causing Silent Socket Leaks","stars_count":55,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","asyncio","lifespan","concurrency","python"],"exportEndpoints":{"claude":"/api/rules/fastapi-async-lifespan-structured-teardown?format=claude","cursorMdc":"/api/rules/fastapi-async-lifespan-structured-teardown?format=mdc","cursorrules":"/api/rules/fastapi-async-lifespan-structured-teardown?format=cursor","windsurf":"/api/rules/fastapi-async-lifespan-structured-teardown?format=windsurf","agents":"/api/rules/fastapi-async-lifespan-structured-teardown?format=agents"}},{"id":"capacitor-7-biometric-secure-storage-ephemerality","title":"Capacitor 7 Hardware-Backed Biometric Storage and In-Memory Session Ephemerality","category":"mobile","severity":"critical","description":"Enforces strict hardware-backed Secure Enclave and Android Keystore cryptographic credential management using Capacitor 7 security primitives. Mandates immediate deterministic sanitization of in-memory symmetric session keys, token references, and decrypted cryptographic state upon mobile OS backgrounding or lifecycle suspension to prevent cold-boot and runtime heap-inspection attacks.","antiPatternHeadline":"Retaining Plaintext Tokens in JavaScript Memory Across App State Transitions or Persisting Cryptographic Keys in Unencrypted Local Storage","stars_count":52,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","biometrics","secure-enclave","session-management","cryptography"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-biometric-secure-storage-ephemerality?format=claude","cursorMdc":"/api/rules/capacitor-7-biometric-secure-storage-ephemerality?format=mdc","cursorrules":"/api/rules/capacitor-7-biometric-secure-storage-ephemerality?format=cursor","windsurf":"/api/rules/capacitor-7-biometric-secure-storage-ephemerality?format=windsurf","agents":"/api/rules/capacitor-7-biometric-secure-storage-ephemerality?format=agents"}},{"id":"kmp-sqldelight-thread-confined-isolation","title":"KMP SQLDelight Thread-Confined Isolation & Zero-Deadlock Concurrency","category":"mobile","severity":"critical","description":"Enforces deterministic, thread-confined transaction boundaries and isolated driver instances across Kotlin Multiplatform targets. Prevents SQLite POSIX-thread deadlocks (SQLITE_BUSY/SQLITE_LOCKED) caused by Coroutine worker hopping on Android Dispatchers.IO and native iOS Grand Central Dispatch queue context switching during active transaction locks.","antiPatternHeadline":"Dispatching Suspending SQLDelight Transactions Across Multi-Threaded Dispatchers Causing SQLite Thread-Ownership Violation","stars_count":90,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","sqldelight","sqlite","coroutines","ios","android"],"exportEndpoints":{"claude":"/api/rules/kmp-sqldelight-thread-confined-isolation?format=claude","cursorMdc":"/api/rules/kmp-sqldelight-thread-confined-isolation?format=mdc","cursorrules":"/api/rules/kmp-sqldelight-thread-confined-isolation?format=cursor","windsurf":"/api/rules/kmp-sqldelight-thread-confined-isolation?format=windsurf","agents":"/api/rules/kmp-sqldelight-thread-confined-isolation?format=agents"}},{"id":"pqc-mlkem-kyber-tls13-mandate","title":"Post-Quantum Cryptography (ML-KEM/Kyber) TLS 1.3 Mandate","category":"security","severity":"critical","description":"Enforces post-quantum hybrid key exchange (ML-KEM/Kyber with classical elliptic curves) on all TLS 1.3 ingress and egress communication channels. Defends against 'Harvest Now, Decrypt Later' (HNDL) adversarial operations targeting enterprise APIs and data-in-transit boundaries. Disallows legacy TLS protocols (< 1.3) and classical-only key agreement configurations across all perimeter endpoints.","antiPatternHeadline":"Using classical-only key exchanges (ECDHE/RSA) or permitting TLS versions below 1.3 on public-facing gateways.","stars_count":64,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","cryptography","tls","post-quantum","kyber","ml-kem","zero-trust"],"exportEndpoints":{"claude":"/api/rules/pqc-mlkem-kyber-tls13-mandate?format=claude","cursorMdc":"/api/rules/pqc-mlkem-kyber-tls13-mandate?format=mdc","cursorrules":"/api/rules/pqc-mlkem-kyber-tls13-mandate?format=cursor","windsurf":"/api/rules/pqc-mlkem-kyber-tls13-mandate?format=windsurf","agents":"/api/rules/pqc-mlkem-kyber-tls13-mandate?format=agents"}},{"id":"slsa-l3-cosign-intoto-attestation-gate","title":"SLSA Build Level 3 In-Toto & Sigstore Cosign Provenance Verification Gate","category":"security","severity":"critical","description":"Mandates cryptographic verification of hermetic build provenance (SLSA Build Level 3) using in-toto attestations and Sigstore Cosign keyless signatures prior to deploying workloads to container runtimes. Guarantees that production images originate strictly from authorized, tamper-evident CI/CD pipelines with immutable Rekor transparency log proofs, preventing runner poisoning and unauthorized binary deployment.","antiPatternHeadline":"Deploying Mutable or Unverified Container Images Without Non-Forgeable SLSA Provenance Attestations","stars_count":117,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","slsa-l3","sigstore","cosign","in-toto","supply-chain-security","admission-controller","rekor"],"exportEndpoints":{"claude":"/api/rules/slsa-l3-cosign-intoto-attestation-gate?format=claude","cursorMdc":"/api/rules/slsa-l3-cosign-intoto-attestation-gate?format=mdc","cursorrules":"/api/rules/slsa-l3-cosign-intoto-attestation-gate?format=cursor","windsurf":"/api/rules/slsa-l3-cosign-intoto-attestation-gate?format=windsurf","agents":"/api/rules/slsa-l3-cosign-intoto-attestation-gate?format=agents"}},{"id":"k8s-gateway-canary-baggage-propagation","title":"Kubernetes Gateway API Dynamic Canary Routing with W3C Baggage Header Propagation","category":"devops","severity":"critical","description":"Mandates that all progressive canary delivery workflows utilizing Kubernetes Gateway API HTTPRoutes enforce deterministic L7 header matching coupled with W3C Distributed Baggage context propagation. Guarantees zero-misroute execution across distributed, multi-cluster service meshes by strictly synchronizing ingress split rules with downstream egress header injection.","antiPatternHeadline":"Edge-Only Header Evaluation with Downstream Baggage Drop Causing Asymmetrical Canary Leaks","stars_count":51,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","kubernetes","gateway-api","opentelemetry","canary","service-mesh"],"exportEndpoints":{"claude":"/api/rules/k8s-gateway-canary-baggage-propagation?format=claude","cursorMdc":"/api/rules/k8s-gateway-canary-baggage-propagation?format=mdc","cursorrules":"/api/rules/k8s-gateway-canary-baggage-propagation?format=cursor","windsurf":"/api/rules/k8s-gateway-canary-baggage-propagation?format=windsurf","agents":"/api/rules/k8s-gateway-canary-baggage-propagation?format=agents"}},{"id":"opentelemetry-weaver-semantic-convention-lockstep-ci","title":"OpenTelemetry Weaver Semantic Convention Lockstep CI Telemetry Contract Enforcement","category":"devops","severity":"critical","description":"Enforces declarative OpenTelemetry Semantic Convention contracts using OpenTelemetry Weaver within CI/CD pipelines to eliminate cross-service telemetry schema drift. Guarantees that polyglot microservices strictly bind to versioned, Weaver-generated attribute definitions and pass backward-compatibility linting before release artifacts are published.","antiPatternHeadline":"Ad-Hoc Unvalidated Telemetry Attributes and Unpinned Schema URL Deployments","stars_count":67,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","weaver","semantic-conventions","observability","ci-cd"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-weaver-semantic-convention-lockstep-ci?format=claude","cursorMdc":"/api/rules/opentelemetry-weaver-semantic-convention-lockstep-ci?format=mdc","cursorrules":"/api/rules/opentelemetry-weaver-semantic-convention-lockstep-ci?format=cursor","windsurf":"/api/rules/opentelemetry-weaver-semantic-convention-lockstep-ci?format=windsurf","agents":"/api/rules/opentelemetry-weaver-semantic-convention-lockstep-ci?format=agents"}},{"id":"nextjs-15-ppr-streaming-backpressure-controller","title":"Next.js 15 PPR Streaming Backpressure & Memory Bounded Flow Control","category":"frontend","severity":"critical","description":"Mandates explicit backpressure management and bounded queue controls for dynamic streaming slots under Next.js 15 Partial Prerendering (PPR). Prevents edge memory exhaustion and event-loop blocking caused by unthrottled producer push-streams outpacing slow client TCP windows during static shell flushes.","antiPatternHeadline":"Unthrottled Push-Streaming to Edge Response Pipes Without Desired-Size Flow Control","stars_count":94,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["nextjs-15","ppr","react-19","web-streams","edge-runtime","backpressure","memory-leak"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-ppr-streaming-backpressure-controller?format=claude","cursorMdc":"/api/rules/nextjs-15-ppr-streaming-backpressure-controller?format=mdc","cursorrules":"/api/rules/nextjs-15-ppr-streaming-backpressure-controller?format=cursor","windsurf":"/api/rules/nextjs-15-ppr-streaming-backpressure-controller?format=windsurf","agents":"/api/rules/nextjs-15-ppr-streaming-backpressure-controller?format=agents"}},{"id":"tauri-v2-granular-ipc-capability-sandboxing","title":"Mandatory Declarative ACL Capability Sandboxing for Tauri 2.0 IPC Invocations","category":"frontend","severity":"critical","description":"Tauri 2.0 deprecates global allowlists in favor of compile-time Access Control List (ACL) capabilities and scoped permission sets. Frontend webview calls to core commands and official plugins must map strictly to explicit, minimal capability manifests defined under src-tauri/capabilities. Arbitrary shell execution, unscoped filesystem operations, and unvalidated dynamic invoke targets are strictly prohibited to prevent complete host compromise via XSS.","antiPatternHeadline":"Unrestricted IPC Invocations and Permissive Wildcard Capabilities Enabling Host-Level Compromise","stars_count":74,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","tauri","tauri-v2","security","ipc","acl","capabilities"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-granular-ipc-capability-sandboxing?format=claude","cursorMdc":"/api/rules/tauri-v2-granular-ipc-capability-sandboxing?format=mdc","cursorrules":"/api/rules/tauri-v2-granular-ipc-capability-sandboxing?format=cursor","windsurf":"/api/rules/tauri-v2-granular-ipc-capability-sandboxing?format=windsurf","agents":"/api/rules/tauri-v2-granular-ipc-capability-sandboxing?format=agents"}},{"id":"fastapi-py313-free-threaded-memory-isolation","title":"FastAPI Python 3.13 Free-Threaded Shared Memory and Subinterpreter Isolation","category":"backend","severity":"critical","description":"Enforces thread-safe in-memory state synchronization and subinterpreter isolation guarantees for FastAPI services running on Python 3.13 free-threaded (no-GIL) runtimes. Eliminates data races, memory tearing, and lost updates caused by legacy assumptions of Global Interpreter Lock atomicity.","antiPatternHeadline":"Unsynchronized Mutable Global State and Composite Operations in Python 3.13 Free-Threaded Runtimes","stars_count":90,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["fastapi","python313","free-threaded","nogil","concurrency","backend","multithreading"],"exportEndpoints":{"claude":"/api/rules/fastapi-py313-free-threaded-memory-isolation?format=claude","cursorMdc":"/api/rules/fastapi-py313-free-threaded-memory-isolation?format=mdc","cursorrules":"/api/rules/fastapi-py313-free-threaded-memory-isolation?format=cursor","windsurf":"/api/rules/fastapi-py313-free-threaded-memory-isolation?format=windsurf","agents":"/api/rules/fastapi-py313-free-threaded-memory-isolation?format=agents"}},{"id":"bun-websocket-slab-allocation-guardrail","title":"Bun 1.2 Zero-Copy WebSocket Slab Allocation & Off-Heap Ring Buffers","category":"backend","severity":"critical","description":"Enforces zero-copy slab allocation patterns and pre-allocated ring buffers for Bun 1.2 WebSocket handlers under saturated bidirectional streaming. Eliminates JavaScriptCore GC thrashing and RSS explosion by strictly prohibiting transient buffer instantiation, per-message string encoding, and unbounded in-memory broadcast queues.","antiPatternHeadline":"Allocating Per-Message Buffers and Unbounded Transient Strings Under Saturated WebSocket Throughput","stars_count":54,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["bun","websockets","memory-management","zero-copy","performance","backend"],"exportEndpoints":{"claude":"/api/rules/bun-websocket-slab-allocation-guardrail?format=claude","cursorMdc":"/api/rules/bun-websocket-slab-allocation-guardrail?format=mdc","cursorrules":"/api/rules/bun-websocket-slab-allocation-guardrail?format=cursor","windsurf":"/api/rules/bun-websocket-slab-allocation-guardrail?format=windsurf","agents":"/api/rules/bun-websocket-slab-allocation-guardrail?format=agents"}},{"id":"pgvector-hnsw-mmap-prewarm-boundary","title":"pgvector 0.8 HNSW Index Deterministic Mmap and Buffer Prewarming Boundary","category":"backend","severity":"critical","description":"Enforces deterministic prewarming of pgvector HNSW index pages into Postgres shared_buffers and OS page cache before routing production vector search traffic. Eliminates cold-start synchronous page faults, disk I/O thrashing, and p99 tail latency spikes during deployments, failovers, and index maintenance.","antiPatternHeadline":"Routing Production Search Queries to Cold HNSW Indexes Causing Page Fault Storms and Disk I/O Thrashing","stars_count":97,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","pgvector","hnsw","performance","database","latency"],"exportEndpoints":{"claude":"/api/rules/pgvector-hnsw-mmap-prewarm-boundary?format=claude","cursorMdc":"/api/rules/pgvector-hnsw-mmap-prewarm-boundary?format=mdc","cursorrules":"/api/rules/pgvector-hnsw-mmap-prewarm-boundary?format=cursor","windsurf":"/api/rules/pgvector-hnsw-mmap-prewarm-boundary?format=windsurf","agents":"/api/rules/pgvector-hnsw-mmap-prewarm-boundary?format=agents"}},{"id":"compose-multiplatform-skiko-buffer-reclaim-guardrail","title":"Compose Multiplatform Skiko Offscreen Buffer Reclaim Invariant","category":"mobile","severity":"critical","description":"Enforces deterministic GPU framebuffer, render target, and Skia surface disposal when native iOS (UIKit) and Android (Activity/Fragment) lifecycles transition to stopped or background states. Skiko offscreen buffers retain significant uncompressed VRAM that the OS compositor cannot evict under memory pressure, triggering jetsam (iOS) or Low Memory Killer (Android) terminations. This guardrail mandates explicit lifecycle-bound surface tearing and context suspension.","antiPatternHeadline":"Retaining Skiko Render Targets and Skia Metal/OpenGL Surfaces Across Native App Pauses","stars_count":101,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","compose-multiplatform","skiko","memory-management","gpu","ios","android"],"exportEndpoints":{"claude":"/api/rules/compose-multiplatform-skiko-buffer-reclaim-guardrail?format=claude","cursorMdc":"/api/rules/compose-multiplatform-skiko-buffer-reclaim-guardrail?format=mdc","cursorrules":"/api/rules/compose-multiplatform-skiko-buffer-reclaim-guardrail?format=cursor","windsurf":"/api/rules/compose-multiplatform-skiko-buffer-reclaim-guardrail?format=windsurf","agents":"/api/rules/compose-multiplatform-skiko-buffer-reclaim-guardrail?format=agents"}},{"id":"capacitor-7-background-task-watchdog-fence","title":"Capacitor 7 Background Task Execution Watchdog Fence","category":"mobile","severity":"critical","description":"Enforces deterministic watchdog fencing, cooperative task abortion, and atomic state checkpointing for Capacitor 7 hybrid background operations. Prevents data corruption, dangling database locks, and OS watchdog terminations (iOS 0x8badf00d) caused by abrupt mobile thread freezing.","antiPatternHeadline":"Unbounded Background Workloads Relying on Indefinite Web Runtime Execution Without Proactive Fencing","stars_count":52,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","ios","android","concurrency","lifecycle","performance"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-background-task-watchdog-fence?format=claude","cursorMdc":"/api/rules/capacitor-7-background-task-watchdog-fence?format=mdc","cursorrules":"/api/rules/capacitor-7-background-task-watchdog-fence?format=cursor","windsurf":"/api/rules/capacitor-7-background-task-watchdog-fence?format=windsurf","agents":"/api/rules/capacitor-7-background-task-watchdog-fence?format=agents"}},{"id":"fido-dbsc-session-binding-guardrail","title":"FIDO Device-Bound Session Credentials (DBSC) Hardware Token Invariant","category":"security","severity":"critical","description":"Enforces cryptographic binding of HTTP session credentials to client-side hardware keystores (TPM 2.0 or Apple Secure Enclave) according to the W3C/IETF Device-Bound Session Credentials (DBSC) specification. Eliminates infostealer malware extraction and adversary-in-the-middle session hijacking by issuing ultra short-lived transactional cookies that can only be refreshed via hardware-signed proof-of-possession challenges.","antiPatternHeadline":"Relying on Unbound Bearer Session Cookies Vulnerable to Exfiltration and Replay Attacks","stars_count":80,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","dbsc","fido","tpm","session-hijacking","zero-trust","cryptography"],"exportEndpoints":{"claude":"/api/rules/fido-dbsc-session-binding-guardrail?format=claude","cursorMdc":"/api/rules/fido-dbsc-session-binding-guardrail?format=mdc","cursorrules":"/api/rules/fido-dbsc-session-binding-guardrail?format=cursor","windsurf":"/api/rules/fido-dbsc-session-binding-guardrail?format=windsurf","agents":"/api/rules/fido-dbsc-session-binding-guardrail?format=agents"}},{"id":"slsa-v1-in-toto-kernel-witnessed-hermetic-attestation","title":"Kernel-Witnessed Hermetic Build Provenance & In-Toto v1.0 Attestation Guardrail","category":"security","severity":"critical","description":"Enforces non-falsifiable SLSA v1.0 provenance generation via continuous kernel-level build tracing (eBPF/auditd). Mandates that in-toto build attestations derive directly from verified kernel syscall trees (process lineage, file I/O, network socket isolation) rather than unauthenticated user-space build scripts or ambient environment variables.","antiPatternHeadline":"Self-Reported Post-Hoc CI Build Metadata and Ambient Provenance Generation","stars_count":65,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","slsa-v1","in-toto","ebpf","supply-chain","provenance","hermetic-builds"],"exportEndpoints":{"claude":"/api/rules/slsa-v1-in-toto-kernel-witnessed-hermetic-attestation?format=claude","cursorMdc":"/api/rules/slsa-v1-in-toto-kernel-witnessed-hermetic-attestation?format=mdc","cursorrules":"/api/rules/slsa-v1-in-toto-kernel-witnessed-hermetic-attestation?format=cursor","windsurf":"/api/rules/slsa-v1-in-toto-kernel-witnessed-hermetic-attestation?format=windsurf","agents":"/api/rules/slsa-v1-in-toto-kernel-witnessed-hermetic-attestation?format=agents"}},{"id":"otel-genai-token-redaction-standard","title":"OpenTelemetry GenAI Semantic Convention Token Redaction Standard","category":"devops","severity":"critical","description":"Enforces deterministic, pre-export sanitization and masking of PII, secrets, and raw vector payloads within OpenTelemetry GenAI semantic convention span attributes. Prohibits direct ingestion of unredacted prompt and completion telemetry into collectors, requiring custom span processors to scrub sensitive tokens before transport.","antiPatternHeadline":"Exporting Unredacted Customer PII and Secrets in OpenTelemetry GenAI Span Attributes","stars_count":99,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","genai","pii-masking","security","observability"],"exportEndpoints":{"claude":"/api/rules/otel-genai-token-redaction-standard?format=claude","cursorMdc":"/api/rules/otel-genai-token-redaction-standard?format=mdc","cursorrules":"/api/rules/otel-genai-token-redaction-standard?format=cursor","windsurf":"/api/rules/otel-genai-token-redaction-standard?format=windsurf","agents":"/api/rules/otel-genai-token-redaction-standard?format=agents"}},{"id":"react-19-server-actions-concurrent-hydration-barrier","title":"React 19 Server Actions Concurrent Hydration Barrier Standard","category":"frontend","severity":"critical","description":"Enforces deterministic queue-and-rollback boundaries for React 19 Server Actions triggered during selective or streaming hydration. Eliminates client-server state desynchronization and tearing by ensuring optimistic updates and server action transitions maintain strict transactional invariants prior to full DOM hydration.","antiPatternHeadline":"Unbounded Server Action Invocations and Direct State Mutations Before Complete Hydration","stars_count":93,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["react-19","server-actions","concurrent-react","hydration-barrier","optimistic-ui"],"exportEndpoints":{"claude":"/api/rules/react-19-server-actions-concurrent-hydration-barrier?format=claude","cursorMdc":"/api/rules/react-19-server-actions-concurrent-hydration-barrier?format=mdc","cursorrules":"/api/rules/react-19-server-actions-concurrent-hydration-barrier?format=cursor","windsurf":"/api/rules/react-19-server-actions-concurrent-hydration-barrier?format=windsurf","agents":"/api/rules/react-19-server-actions-concurrent-hydration-barrier?format=agents"}},{"id":"tauri-v2-mobile-ipc-capability-manifest-enforcement","title":"Tauri 2.0 Scoped Mobile IPC Capability Manifest Enforcement","category":"mobile","severity":"critical","description":"Enforces principle-of-least-privilege IPC capabilities across mobile WebView contexts in Tauri 2.0. Prohibits global wildcards, unisolated capabilities, and unconstrained native plugin bindings by mandating granular, window-scoped capability manifests with strict parameter validation.","antiPatternHeadline":"Wildcard or Unscoped Native Plugin Permissions in Tauri 2.0 Mobile WebViews","stars_count":42,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri","ipc","security","rust","capabilities","ios","android"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-mobile-ipc-capability-manifest-enforcement?format=claude","cursorMdc":"/api/rules/tauri-v2-mobile-ipc-capability-manifest-enforcement?format=mdc","cursorrules":"/api/rules/tauri-v2-mobile-ipc-capability-manifest-enforcement?format=cursor","windsurf":"/api/rules/tauri-v2-mobile-ipc-capability-manifest-enforcement?format=windsurf","agents":"/api/rules/tauri-v2-mobile-ipc-capability-manifest-enforcement?format=agents"}},{"id":"fastapi-python-313-nogil-concurrency-boundary","title":"FastAPI Python 3.13 Free-Threaded Concurrency Boundary Standard","category":"backend","severity":"critical","description":"Enforces strict memory isolation, atomic updates, and thread-safe shared state primitives within FastAPI services compiled and executed under Python 3.13 free-threaded (nogil) runtimes. Eliminates shared mutable state corruption, race conditions in sub-millisecond ASGI pipelines, and thread-unsafe caching layers. Mandates immutable data structures, concurrent-safe primitives, and thread-local state management across concurrent request workers.","antiPatternHeadline":"Unsynchronized Global State Mutation in Python 3.13 Free-Threaded ASGI Request Pipelines","stars_count":54,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","python-313","nogil","free-threaded","concurrency","multithreading"],"exportEndpoints":{"claude":"/api/rules/fastapi-python-313-nogil-concurrency-boundary?format=claude","cursorMdc":"/api/rules/fastapi-python-313-nogil-concurrency-boundary?format=mdc","cursorrules":"/api/rules/fastapi-python-313-nogil-concurrency-boundary?format=cursor","windsurf":"/api/rules/fastapi-python-313-nogil-concurrency-boundary?format=windsurf","agents":"/api/rules/fastapi-python-313-nogil-concurrency-boundary?format=agents"}},{"id":"kmp-swift6-strict-concurrency-sendable-arc-isolation","title":"KMP to Swift 6 Strict Concurrency & ARC Actor Boundary Standard","category":"mobile","severity":"critical","description":"Enforces thread-safe, deadlock-free interop between Kotlin Multiplatform (KMP) coroutines and Swift 6 Strict Concurrency. Eliminates ARC reference leaks, cross-runtime actor deadlocks, and Sendable violations across Kotlin/Native runtime boundaries and Swift cooperative thread pools.","antiPatternHeadline":"Crossing Swift 6 Actor Boundaries with Raw Kotlin Reference Types and Unisolated Completion Closures","stars_count":46,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kmp","swift6","concurrency","sendable","kotlin-native","arc"],"exportEndpoints":{"claude":"/api/rules/kmp-swift6-strict-concurrency-sendable-arc-isolation?format=claude","cursorMdc":"/api/rules/kmp-swift6-strict-concurrency-sendable-arc-isolation?format=mdc","cursorrules":"/api/rules/kmp-swift6-strict-concurrency-sendable-arc-isolation?format=cursor","windsurf":"/api/rules/kmp-swift6-strict-concurrency-sendable-arc-isolation?format=windsurf","agents":"/api/rules/kmp-swift6-strict-concurrency-sendable-arc-isolation?format=agents"}},{"id":"hybrid-post-quantum-tls13-ingress-negotiation-standard","title":"Enforce Hybrid Post-Quantum TLS 1.3 ML-KEM/X25519 Ingress Negotiation","category":"security","severity":"critical","description":"Shields enterprise communications against harvest-now, decrypt-later (HNDL) attacks by enforcing dual-key encapsulation mechanisms at cloud edge terminators. Ingress listeners must prioritize hybrid ML-KEM-768 with classical X25519 key exchange over TLS 1.3 while deprecating pure classical ephemeral curves without PQ encapsulation.","antiPatternHeadline":"Negotiating Classical-Only ECDHE/Curves (P-256, X25519) or Permitting TLS 1.2 Ingress Fallbacks","stars_count":50,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","post-quantum","cryptography","tls13","ml-kem","x25519","zero-trust"],"exportEndpoints":{"claude":"/api/rules/hybrid-post-quantum-tls13-ingress-negotiation-standard?format=claude","cursorMdc":"/api/rules/hybrid-post-quantum-tls13-ingress-negotiation-standard?format=mdc","cursorrules":"/api/rules/hybrid-post-quantum-tls13-ingress-negotiation-standard?format=cursor","windsurf":"/api/rules/hybrid-post-quantum-tls13-ingress-negotiation-standard?format=windsurf","agents":"/api/rules/hybrid-post-quantum-tls13-ingress-negotiation-standard?format=agents"}},{"id":"ebpf-lsm-socket-scoping-guardrail","title":"Deterministic eBPF LSM Socket Bind and Connect Zero-Trust Boundary Standard","category":"security","severity":"critical","description":"Enforces kernel-level egress and ingress network isolation using eBPF Linux Security Module (LSM) hooks without reliance on sidecar proxy redirection. Mandates deterministic container cgroup identification, safe BTF CO-RE socket dereferencing, dual-stack IPv4/IPv6 normalization, and fail-closed evaluation within socket lifecycle entry points.","antiPatternHeadline":"Bypassing Kernel Invariants via Permissive User-Space Proxying or Unscoped Socket LSM Hooks","stars_count":53,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","ebpf","lsm","kernel","zero-trust","cgroups","co-re"],"exportEndpoints":{"claude":"/api/rules/ebpf-lsm-socket-scoping-guardrail?format=claude","cursorMdc":"/api/rules/ebpf-lsm-socket-scoping-guardrail?format=mdc","cursorrules":"/api/rules/ebpf-lsm-socket-scoping-guardrail?format=cursor","windsurf":"/api/rules/ebpf-lsm-socket-scoping-guardrail?format=windsurf","agents":"/api/rules/ebpf-lsm-socket-scoping-guardrail?format=agents"}},{"id":"opentelemetry-cardinality-budget-exemplar-guardrail","title":"OpenTelemetry Metric Cardinality Budgeting and Exemplar Correlation Standard","category":"devops","severity":"critical","description":"Enforces strict metric attribute sanitization and dynamic cardinality bounding to prevent TSDB out-of-memory (OOM) failures. Ensures high-cardinality identifiers (UUIDs, raw URLs, user IDs) are stripped from metric label sets while deterministically retaining distributed trace context via OpenTelemetry Exemplar reservoirs on high-latency buckets.","antiPatternHeadline":"Injecting Unbounded High-Cardinality Dimensions into Metric Labels Causing TSDB Meltdowns","stars_count":91,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","metrics","cardinality","exemplars","observability","prometheus"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-cardinality-budget-exemplar-guardrail?format=claude","cursorMdc":"/api/rules/opentelemetry-cardinality-budget-exemplar-guardrail?format=mdc","cursorrules":"/api/rules/opentelemetry-cardinality-budget-exemplar-guardrail?format=cursor","windsurf":"/api/rules/opentelemetry-cardinality-budget-exemplar-guardrail?format=windsurf","agents":"/api/rules/opentelemetry-cardinality-budget-exemplar-guardrail?format=agents"}},{"id":"vite-6-module-federation-isolated-singleton-standard","title":"Vite 6 Module Federation Isolated Dependency Singleton Standard","category":"frontend","severity":"critical","description":"Enforces strict singleton configuration and shared dependency isolation across Vite 6 federated remotes and hosts using modern Module Federation. Prevents dual-engine runtime collisions, broken React Context trees, invalid hook invocations, and desynchronized state stores caused by unconstrained ESM bundle resolution.","antiPatternHeadline":"Unpinned and Non-Singleton Federated ESM Dependencies Inducing Dual Runtime Instantiation and Broken React Context","stars_count":116,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","vite6","module-federation","micro-frontends","singleton","react"],"exportEndpoints":{"claude":"/api/rules/vite-6-module-federation-isolated-singleton-standard?format=claude","cursorMdc":"/api/rules/vite-6-module-federation-isolated-singleton-standard?format=mdc","cursorrules":"/api/rules/vite-6-module-federation-isolated-singleton-standard?format=cursor","windsurf":"/api/rules/vite-6-module-federation-isolated-singleton-standard?format=windsurf","agents":"/api/rules/vite-6-module-federation-isolated-singleton-standard?format=agents"}},{"id":"postgres17-streaming-io-direct-buffer-pinning-invariant","title":"PostgreSQL 17 Streaming I/O Direct Buffer Memory Pinning Invariant","category":"devops","severity":"critical","description":"PostgreSQL 17 introduces modernized Streaming I/O and direct I/O capabilities for sequential scans, index scans, and vector embeddings. This invariant mandates deterministic shared memory and direct I/O buffer management, preventing OS page cache double-buffering, memory exhaustion under concurrent scans, and unpinned buffer lock contention.","antiPatternHeadline":"Unthrottled Concurrent Scans with Default I/O Invoking Kernel Page Cache Thrashing and OOM Kills","stars_count":72,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","postgresql","postgres-17","streaming-io","direct-io","vector-search","buffer-cache"],"exportEndpoints":{"claude":"/api/rules/postgres17-streaming-io-direct-buffer-pinning-invariant?format=claude","cursorMdc":"/api/rules/postgres17-streaming-io-direct-buffer-pinning-invariant?format=mdc","cursorrules":"/api/rules/postgres17-streaming-io-direct-buffer-pinning-invariant?format=cursor","windsurf":"/api/rules/postgres17-streaming-io-direct-buffer-pinning-invariant?format=windsurf","agents":"/api/rules/postgres17-streaming-io-direct-buffer-pinning-invariant?format=agents"}},{"id":"react-19-server-action-idempotency-key-pipeline","title":"Deterministic Server Action Idempotency Transport and Replay-Safety Pipeline","category":"frontend","severity":"critical","description":"Enforces deterministic client-side generation and transport of cryptographically secure idempotency keys across React 19 useActionState transitions, optimistic updates, and automatic network retries. Prevents double-mutations, race conditions, and corrupted optimistic states by mandating distributed cache reservation tokens coupled to payload hashes.","antiPatternHeadline":"Ad-Hoc Server Actions Vulnerable to Duplicate Mutations Under Flaky Networks and Optimistic Transitions","stars_count":112,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","server-actions","idempotency","distributed-systems","optimistic-ui"],"exportEndpoints":{"claude":"/api/rules/react-19-server-action-idempotency-key-pipeline?format=claude","cursorMdc":"/api/rules/react-19-server-action-idempotency-key-pipeline?format=mdc","cursorrules":"/api/rules/react-19-server-action-idempotency-key-pipeline?format=cursor","windsurf":"/api/rules/react-19-server-action-idempotency-key-pipeline?format=windsurf","agents":"/api/rules/react-19-server-action-idempotency-key-pipeline?format=agents"}},{"id":"vite-6-environment-api-boundary-enforcement","title":"Vite 6 Environment API Multi-Runtime Module Boundary Guardrails","category":"frontend","severity":"critical","description":"Enforces strict module separation across client DOM, Node.js SSR, and Edge Worker compilation environments using the Vite 6 Environment API. Prevents runtime-specific symbol leaks, illegal module graph bridging, and non-deterministic tree-shaking failures across disparate execution targets.","antiPatternHeadline":"Cross-Runtime Symbol Contamination via Shared Module Graphs and Permissive Conditional Resolvers","stars_count":53,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","vite-6","environment-api","ssr","edge-worker","module-boundaries"],"exportEndpoints":{"claude":"/api/rules/vite-6-environment-api-boundary-enforcement?format=claude","cursorMdc":"/api/rules/vite-6-environment-api-boundary-enforcement?format=mdc","cursorrules":"/api/rules/vite-6-environment-api-boundary-enforcement?format=cursor","windsurf":"/api/rules/vite-6-environment-api-boundary-enforcement?format=windsurf","agents":"/api/rules/vite-6-environment-api-boundary-enforcement?format=agents"}},{"id":"tauri-v2-granular-ipc-capability-scoping","title":"Tauri 2.0 Granular IPC Capability Scoping and ACL Isolation","category":"mobile","severity":"critical","description":"Enforces strict isolation of Tauri 2.0 Inter-Process Communication (IPC) by scoping capabilities to explicit window labels and origins. Prohibits global wildcard capability bindings, mandating fine-grained access control lists (ACLs) to prevent untrusted or embedded webviews from executing privileged native host commands on mobile and desktop runtimes.","antiPatternHeadline":"Wildcard Window Scoping and Over-Permissioned IPC Capabilities in Multi-Window or Mobile Webview Contexts","stars_count":40,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri-2","security","ipc","acl","capabilities"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-granular-ipc-capability-scoping?format=claude","cursorMdc":"/api/rules/tauri-v2-granular-ipc-capability-scoping?format=mdc","cursorrules":"/api/rules/tauri-v2-granular-ipc-capability-scoping?format=cursor","windsurf":"/api/rules/tauri-v2-granular-ipc-capability-scoping?format=windsurf","agents":"/api/rules/tauri-v2-granular-ipc-capability-scoping?format=agents"}},{"id":"kmp-skia-renderpass-lifecycle-guardrail","title":"Kotlin Multiplatform Skia Native RenderPass Context Lifecycle Guardrail","category":"mobile","severity":"critical","description":"Enforces strict acquisition, synchronization, and tear-down barriers for native Skia DirectContext (GrDirectContext) and Metal/Vulkan hardware render targets across iOS and Android lifecycle shifts. Prevents SIGSEGV crashes, invalid surface access, and unrecoverable GPU driver memory leaks during rapid background-to-foreground transitions.","antiPatternHeadline":"Dangling Native GPU Surfaces and Context Execution During Lifecycle Suspensions","stars_count":109,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","skia","gpu","vulkan","metal","lifecycle"],"exportEndpoints":{"claude":"/api/rules/kmp-skia-renderpass-lifecycle-guardrail?format=claude","cursorMdc":"/api/rules/kmp-skia-renderpass-lifecycle-guardrail?format=mdc","cursorrules":"/api/rules/kmp-skia-renderpass-lifecycle-guardrail?format=cursor","windsurf":"/api/rules/kmp-skia-renderpass-lifecycle-guardrail?format=windsurf","agents":"/api/rules/kmp-skia-renderpass-lifecycle-guardrail?format=agents"}},{"id":"go-1-24-range-func-http-stream-backpressure","title":"Go 1.24 Range-Over-Func HTTP Chunked Streaming Invariant","category":"backend","severity":"critical","description":"Enforces deterministic heap memory limits and cooperative backpressure during multi-gigabyte NDJSON HTTP chunked response streams via Go 1.24 standard library iterators (iter.Seq / iter.Seq2). Mandates zero-allocation buffer reuse, immediate flush verification, and fail-fast context propagation to prevent unbounded memory growth and goroutine leaks on slow or disconnected clients.","antiPatternHeadline":"Buffering Unbounded Iterator Batches or Ignoring Flusher Deadlock & Client Disconnects in HTTP Range Loops","stars_count":75,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","golang","go-1.24","range-over-func","http-streaming","backpressure","ndjson"],"exportEndpoints":{"claude":"/api/rules/go-1-24-range-func-http-stream-backpressure?format=claude","cursorMdc":"/api/rules/go-1-24-range-func-http-stream-backpressure?format=mdc","cursorrules":"/api/rules/go-1-24-range-func-http-stream-backpressure?format=cursor","windsurf":"/api/rules/go-1-24-range-func-http-stream-backpressure?format=windsurf","agents":"/api/rules/go-1-24-range-func-http-stream-backpressure?format=agents"}},{"id":"postgres-17-pg-createsubscriber-cutover-standard","title":"Postgres 17 pg_createsubscriber Physical-to-Logical Replica Cutover Standard","category":"backend","severity":"critical","description":"Governs zero-downtime database migrations by enforcing safe physical-to-logical replica cutovers using PostgreSQL 17's pg_createsubscriber. Mandates pre-flight replication invariants—including wal_level=logical, slot headroom, and replica identities—to eliminate copy-phase lag and catastrophic data loss during major upgrades.","antiPatternHeadline":"Executing Unvalidated pg_createsubscriber Invocations or Falling Back to Initial-Data pg_dump Logical Subscriptions","stars_count":79,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["postgres","postgresql-17","replication","pg-createsubscriber","zero-downtime","database-migration"],"exportEndpoints":{"claude":"/api/rules/postgres-17-pg-createsubscriber-cutover-standard?format=claude","cursorMdc":"/api/rules/postgres-17-pg-createsubscriber-cutover-standard?format=mdc","cursorrules":"/api/rules/postgres-17-pg-createsubscriber-cutover-standard?format=cursor","windsurf":"/api/rules/postgres-17-pg-createsubscriber-cutover-standard?format=windsurf","agents":"/api/rules/postgres-17-pg-createsubscriber-cutover-standard?format=agents"}},{"id":"bun-sab-worker-cross-origin-isolation-guardrail","title":"Bun 1.2 SharedArrayBuffer Worker Pool Cross-Origin Isolation Guardrail","category":"backend","severity":"critical","description":"Enforces strict memory isolation, Cross-Origin Isolation HTTP headers (COOP/COEP), and Atomics-based synchronization when leveraging SharedArrayBuffer across worker pools in Bun 1.2. Prevents speculative execution side-channel leaks (Spectre) and unsynchronized data races in high-throughput multi-tenant edge runtimes.","antiPatternHeadline":"Sharing raw SharedArrayBuffer instances across worker threads without cross-origin isolation headers, tenant partition bounds, and Atomics synchronization.","stars_count":55,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","sharedarraybuffer","workers","concurrency","security","atomics"],"exportEndpoints":{"claude":"/api/rules/bun-sab-worker-cross-origin-isolation-guardrail?format=claude","cursorMdc":"/api/rules/bun-sab-worker-cross-origin-isolation-guardrail?format=mdc","cursorrules":"/api/rules/bun-sab-worker-cross-origin-isolation-guardrail?format=cursor","windsurf":"/api/rules/bun-sab-worker-cross-origin-isolation-guardrail?format=windsurf","agents":"/api/rules/bun-sab-worker-cross-origin-isolation-guardrail?format=agents"}},{"id":"fido2-device-public-key-tpm-attestation-standard","title":"FIDO2 Device Public Key (DPK) Hardware-Bound Attestation Invariant","category":"security","severity":"critical","description":"Enforces cryptographic binding of WebAuthn passkey assertion ceremonies to physical endpoint hardware state using the W3C devicePubKey extension and TPM/Secure Enclave attestation. Prevents enterprise compromise from synced passkey exfiltration across unmanaged personal devices by validating hardware-rooted device identity on every authentication ceremony.","antiPatternHeadline":"Trusting Synced Multi-Device Passkeys Without Hardware-Bound Device Public Key Validation","stars_count":42,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","fido2","device-public-key","tpm","passkeys","zero-trust"],"exportEndpoints":{"claude":"/api/rules/fido2-device-public-key-tpm-attestation-standard?format=claude","cursorMdc":"/api/rules/fido2-device-public-key-tpm-attestation-standard?format=mdc","cursorrules":"/api/rules/fido2-device-public-key-tpm-attestation-standard?format=cursor","windsurf":"/api/rules/fido2-device-public-key-tpm-attestation-standard?format=windsurf","agents":"/api/rules/fido2-device-public-key-tpm-attestation-standard?format=agents"}},{"id":"opentelemetry-baggage-tenant-cardinality-fence","title":"OpenTelemetry Baggage Ingress Sanitization and Tenant Cardinality Fencing","category":"devops","severity":"critical","description":"Enforces strict boundary sanitization, key allowlisting, and cryptographic validation on inbound W3C Baggage headers at network ingress. Prevents downstream OpenTelemetry collector Denial-of-Service (DoS) and metric storage explosions caused by malicious or unbounded tenant-injected baggage context.","antiPatternHeadline":"Blind Ingestion and Metric Promotion of Untrusted W3C Baggage Headers at Ingress Boundaries","stars_count":62,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","observability","distributed-tracing","cardinality-fencing","security"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-baggage-tenant-cardinality-fence?format=claude","cursorMdc":"/api/rules/opentelemetry-baggage-tenant-cardinality-fence?format=mdc","cursorrules":"/api/rules/opentelemetry-baggage-tenant-cardinality-fence?format=cursor","windsurf":"/api/rules/opentelemetry-baggage-tenant-cardinality-fence?format=windsurf","agents":"/api/rules/opentelemetry-baggage-tenant-cardinality-fence?format=agents"}},{"id":"slsa-v1-level-3-hermetic-container-build-attestation","title":"SLSA v1.0 Level 3 Hermetic Container Build & In-Toto Attestation Standard","category":"devops","severity":"critical","description":"Enforces SLSA (Supply-chain Levels for Software Artifacts) v1.0 Level 3 compliance across all production container images. Mandates isolated, ephemeral build environments with strict network sandboxing during compilation and requires non-forgeable, cryptographically signed in-toto provenance generated by an authenticated build platform.","antiPatternHeadline":"Non-Hermetic Container Builds with Self-Generated, Mutable Provenance","stars_count":61,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","slsa","supply-chain-security","in-toto","cosign","hermetic-builds","containers"],"exportEndpoints":{"claude":"/api/rules/slsa-v1-level-3-hermetic-container-build-attestation?format=claude","cursorMdc":"/api/rules/slsa-v1-level-3-hermetic-container-build-attestation?format=mdc","cursorrules":"/api/rules/slsa-v1-level-3-hermetic-container-build-attestation?format=cursor","windsurf":"/api/rules/slsa-v1-level-3-hermetic-container-build-attestation?format=windsurf","agents":"/api/rules/slsa-v1-level-3-hermetic-container-build-attestation?format=agents"}},{"id":"react-19-action-transition-abort-controller-propagation","title":"Deterministic AbortController Propagation in React 19 Action Transitions","category":"frontend","severity":"critical","description":"Enforces explicit AbortController signal propagation and deterministic teardown across React 19 asynchronous action transitions. Prevents zombie state resolutions, out-of-order race conditions, and catastrophic layout thrashing across concurrent View Transitions during rapid user interactions.","antiPatternHeadline":"Firing detached asynchronous fetches inside React 19 startTransition without lifecycle-bound AbortSignal propagation.","stars_count":90,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","concurrency","transitions","abort-controller","view-transitions"],"exportEndpoints":{"claude":"/api/rules/react-19-action-transition-abort-controller-propagation?format=claude","cursorMdc":"/api/rules/react-19-action-transition-abort-controller-propagation?format=mdc","cursorrules":"/api/rules/react-19-action-transition-abort-controller-propagation?format=cursor","windsurf":"/api/rules/react-19-action-transition-abort-controller-propagation?format=windsurf","agents":"/api/rules/react-19-action-transition-abort-controller-propagation?format=agents"}},{"id":"duckdb-wasm-memory-spilling-guardrail","title":"DuckDB-WASM Linear Memory Arena Ceilings and Disk Spilling Guardrail","category":"frontend","severity":"critical","description":"Enforces strict WebAssembly linear memory limits and Origin Private File System (OPFS)/IndexedDB disk-spilling configurations for DuckDB-WASM instances. Prevents browser tab crashes and uncatchable WebAssembly.Memory out-of-bounds faults by setting hard memory budgets and redirecting intermediate query scratch buffers to browser-backed storage.","antiPatternHeadline":"Unbounded DuckDB-WASM In-Memory Execution Without Memory Limits or Scratch Filesystem Tiering","stars_count":55,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","duckdb-wasm","webassembly","opfs","indexeddb","memory-management","olap"],"exportEndpoints":{"claude":"/api/rules/duckdb-wasm-memory-spilling-guardrail?format=claude","cursorMdc":"/api/rules/duckdb-wasm-memory-spilling-guardrail?format=mdc","cursorrules":"/api/rules/duckdb-wasm-memory-spilling-guardrail?format=cursor","windsurf":"/api/rules/duckdb-wasm-memory-spilling-guardrail?format=windsurf","agents":"/api/rules/duckdb-wasm-memory-spilling-guardrail?format=agents"}},{"id":"pg17-failover-slot-sync-boundary","title":"PostgreSQL 17 Failover Slot Synchronization Boundary for Event-Driven CDC Pipelines","category":"backend","severity":"critical","description":"Enforces deterministic physical-to-logical replication slot synchronization across Patroni high-availability boundaries in PostgreSQL 17. Guarantees zero data loss and prevents duplicate CDC replay during planned or unplanned primary failovers by mandating synchronized failover slots and strict LSN watermark gating before consumer reconnections.","antiPatternHeadline":"Unsynchronized Logical Slot Orphanage and LSN Regressions During HA Standby Promotion","stars_count":42,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","cdc","debezium","patroni","replication","high-availability"],"exportEndpoints":{"claude":"/api/rules/pg17-failover-slot-sync-boundary?format=claude","cursorMdc":"/api/rules/pg17-failover-slot-sync-boundary?format=mdc","cursorrules":"/api/rules/pg17-failover-slot-sync-boundary?format=cursor","windsurf":"/api/rules/pg17-failover-slot-sync-boundary?format=windsurf","agents":"/api/rules/pg17-failover-slot-sync-boundary?format=agents"}},{"id":"go-http3-0rtt-early-data-anti-replay-guardrail","title":"Go 1.24 HTTP/3 0-RTT Early-Data Anti-Replay Guardrail","category":"backend","severity":"critical","description":"Fences off non-idempotent HTTP routes from QUIC/TLS 1.3 0-RTT early data to prevent replay attacks from corrupting state or executing duplicate transactions. Ensures that any mutating or non-idempotent operation transmitted within early data is rejected with HTTP 425 Too Early, forcing the client to retransmit after the handshake confirms 1-RTT completion.","antiPatternHeadline":"Blindly processing state-mutating HTTP requests over QUIC 0-RTT early data without checking TLS/QUIC handshake completion status","stars_count":113,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","http3","quic","tls","security","replay-attack"],"exportEndpoints":{"claude":"/api/rules/go-http3-0rtt-early-data-anti-replay-guardrail?format=claude","cursorMdc":"/api/rules/go-http3-0rtt-early-data-anti-replay-guardrail?format=mdc","cursorrules":"/api/rules/go-http3-0rtt-early-data-anti-replay-guardrail?format=cursor","windsurf":"/api/rules/go-http3-0rtt-early-data-anti-replay-guardrail?format=windsurf","agents":"/api/rules/go-http3-0rtt-early-data-anti-replay-guardrail?format=agents"}},{"id":"valkey-8-dual-channel-migration-atomicity","title":"Valkey 8 Dual-Channel Cluster Slot Migration Atomicity Guardrail","category":"backend","severity":"critical","description":"Maintains distributed cache linearizability and guarantees zero cross-slot key drift during horizontal node re-sharding in multi-terabyte Valkey 8 clusters. Enforces strict dual-channel slot synchronization by locking slot routing states, rejecting non-deterministic multi-key atomic mutations during the MIGRATING/IMPORTING handshake, and ensuring deterministic fallbacks upon ASK and MOVED redirections.","antiPatternHeadline":"Unchecked Cross-Slot Command Execution and Blind Client Writes During Active Dual-Channel Slot Re-Sharding","stars_count":113,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","valkey","redis","clustering","distributed-systems","sharding"],"exportEndpoints":{"claude":"/api/rules/valkey-8-dual-channel-migration-atomicity?format=claude","cursorMdc":"/api/rules/valkey-8-dual-channel-migration-atomicity?format=mdc","cursorrules":"/api/rules/valkey-8-dual-channel-migration-atomicity?format=cursor","windsurf":"/api/rules/valkey-8-dual-channel-migration-atomicity?format=windsurf","agents":"/api/rules/valkey-8-dual-channel-migration-atomicity?format=agents"}},{"id":"swift6-actor-reentrancy-state-invariants","title":"Swift 6 Actor Reentrancy State Mutability Invariant Guardrail","category":"mobile","severity":"critical","description":"Enforces strict isolation and validation of mutable actor state across asynchronous suspension points (await) within high-concurrency native engine bindings. Prevents silent state corruption, interleaved race conditions, and uncoordinated bridge state updates caused by Swift actor reentrancy semantics.","antiPatternHeadline":"Interleaved Actor State Mutation Across Async Suspension Points","stars_count":64,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","swift6","concurrency","actors","reentrancy","cxx-interop"],"exportEndpoints":{"claude":"/api/rules/swift6-actor-reentrancy-state-invariants?format=claude","cursorMdc":"/api/rules/swift6-actor-reentrancy-state-invariants?format=mdc","cursorrules":"/api/rules/swift6-actor-reentrancy-state-invariants?format=cursor","windsurf":"/api/rules/swift6-actor-reentrancy-state-invariants?format=windsurf","agents":"/api/rules/swift6-actor-reentrancy-state-invariants?format=agents"}},{"id":"nitro-modules-jsi-memory-ownership-protocol","title":"Expo SDK 52 Nitro Modules C++ JSI Memory Ownership Protocol","category":"mobile","severity":"critical","description":"Enforces strict zero-copy lifetime ownership semantics for high-frequency binary telemetry transferred between native C++ engines and Hermes via Nitro Modules. Prevents catastrophic double-free faults, dangling raw pointer reads, and Hermes young-generation heap fragmentation by enforcing ref-counted smart pointers and non-copying ArrayBuffer wrappers with explicit lifecycle invalidation.","antiPatternHeadline":"Uncontrolled raw pointer exposure and unmanaged ArrayBuffer allocation across C++ and Hermes runtime boundaries.","stars_count":82,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","expo-sdk-52","nitro-modules","jsi","c++","hermes","memory-management"],"exportEndpoints":{"claude":"/api/rules/nitro-modules-jsi-memory-ownership-protocol?format=claude","cursorMdc":"/api/rules/nitro-modules-jsi-memory-ownership-protocol?format=mdc","cursorrules":"/api/rules/nitro-modules-jsi-memory-ownership-protocol?format=cursor","windsurf":"/api/rules/nitro-modules-jsi-memory-ownership-protocol?format=windsurf","agents":"/api/rules/nitro-modules-jsi-memory-ownership-protocol?format=agents"}},{"id":"oauth2-rfc9449-dpop-sender-constrained-tokens","title":"OAuth 2.0 RFC 9449 DPoP Cryptographic Token Binding Invariant","category":"security","severity":"critical","description":"Enforces strict implementation of OAuth 2.0 Demonstrating Proof-of-Possession (DPoP, RFC 9449) across authorization servers and resource servers. Eliminates credential exfiltration vulnerabilities by cryptographically binding access and refresh tokens to client-held ephemeral asymmetric keys, strictly verifying the ath hash, htm method, htu URI, and jwk thumbprint matching the token's cnf.jkt claim.","antiPatternHeadline":"Accepting DPoP Proofs Without ath Binding, Permitting Bearer Downgrades, or Skipping Proof Replay and URL Normalization Checks","stars_count":89,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","oauth2","dpop","rfc9449","cryptography","jwt","sender-constrained"],"exportEndpoints":{"claude":"/api/rules/oauth2-rfc9449-dpop-sender-constrained-tokens?format=claude","cursorMdc":"/api/rules/oauth2-rfc9449-dpop-sender-constrained-tokens?format=mdc","cursorrules":"/api/rules/oauth2-rfc9449-dpop-sender-constrained-tokens?format=cursor","windsurf":"/api/rules/oauth2-rfc9449-dpop-sender-constrained-tokens?format=windsurf","agents":"/api/rules/oauth2-rfc9449-dpop-sender-constrained-tokens?format=agents"}},{"id":"kyverno-oci-cryptographic-attestation-intoto-sbom-gate","title":"Enforce Kyverno OCI Cryptographic Attestations and in-toto SBOM Admission Gates","category":"devops","severity":"critical","description":"Enforces immutable cryptographic verification of container images, SLSA provenance, and in-toto software bill of materials (SBOM) predicates within Kubernetes admission webhooks. Blocks execution of untrusted, unsigned, or non-attested artifacts prior to pod scheduling by strictly enforcing Sigstore/Cosign Rekor transparency logs and Fulcio OIDC identities. Mandates continuous validation of dependency supply chain integrity and automatic image digest resolution to eliminate tag mutation vectors.","antiPatternHeadline":"Deploying Untrusted Container Images with Mutable Tags and Missing Cryptographic SBOM/Provenance Attestations","stars_count":81,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","kubernetes","kyverno","sigstore","cosign","supply-chain-security","sbom","slsa"],"exportEndpoints":{"claude":"/api/rules/kyverno-oci-cryptographic-attestation-intoto-sbom-gate?format=claude","cursorMdc":"/api/rules/kyverno-oci-cryptographic-attestation-intoto-sbom-gate?format=mdc","cursorrules":"/api/rules/kyverno-oci-cryptographic-attestation-intoto-sbom-gate?format=cursor","windsurf":"/api/rules/kyverno-oci-cryptographic-attestation-intoto-sbom-gate?format=windsurf","agents":"/api/rules/kyverno-oci-cryptographic-attestation-intoto-sbom-gate?format=agents"}},{"id":"opentelemetry-exemplar-reservoir-memory-bounds","title":"OpenTelemetry OTLP Exemplar Reservoir Memory Bound Invariant","category":"devops","severity":"critical","description":"Enforces deterministic memory bounds and fixed-size reservoir sampling for OpenTelemetry metric exemplars exported via OTLP and Prometheus. Prevents unbounded heap growth and catastrophic Out-Of-Memory (OOM) failures caused by high-cardinality trace exemplar attachments under high-throughput traffic.","antiPatternHeadline":"Unbounded Exemplar Allocation and Dynamic Baggage Attachment Causing Runtime Heap Exhaustion","stars_count":115,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","metrics","prometheus","memory-management","observability"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-exemplar-reservoir-memory-bounds?format=claude","cursorMdc":"/api/rules/opentelemetry-exemplar-reservoir-memory-bounds?format=mdc","cursorrules":"/api/rules/opentelemetry-exemplar-reservoir-memory-bounds?format=cursor","windsurf":"/api/rules/opentelemetry-exemplar-reservoir-memory-bounds?format=windsurf","agents":"/api/rules/opentelemetry-exemplar-reservoir-memory-bounds?format=agents"}},{"id":"nextjs-15-ppr-dynamic-fallback-boundary-isolation","title":"Next.js 15 PPR Dynamic Fallback Boundary Isolation and Stream Resiliency","category":"frontend","severity":"critical","description":"Enforces strict boundary encapsulation of dynamic runtime access within React Suspense during Next.js 15 Partial Prerendering (PPR). Prevents dynamic context leakage from de-optimizing the static pre-rendered shell and mandates edge-resilient stream termination with deterministic static fallbacks.","antiPatternHeadline":"Unenclosed Dynamic Context Ingestion Collapsing PPR Static Shells and Causing Edge Worker Stream Hangs","stars_count":51,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs-15","partial-prerendering","react-server-components","suspense","edge-runtime"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-ppr-dynamic-fallback-boundary-isolation?format=claude","cursorMdc":"/api/rules/nextjs-15-ppr-dynamic-fallback-boundary-isolation?format=mdc","cursorrules":"/api/rules/nextjs-15-ppr-dynamic-fallback-boundary-isolation?format=cursor","windsurf":"/api/rules/nextjs-15-ppr-dynamic-fallback-boundary-isolation?format=windsurf","agents":"/api/rules/nextjs-15-ppr-dynamic-fallback-boundary-isolation?format=agents"}},{"id":"fastapi-anyio-taskgroup-cancellation-guardrail","title":"FastAPI AnyIO Structured TaskGroup Lifecycle & Orphan Mitigation Guardrail","category":"backend","severity":"critical","description":"Guarantees that all concurrent subtasks spawned during a FastAPI request are managed via AnyIO TaskGroups strictly bounded to the HTTP connection lifecycle. Prevents unbounded background task execution, lingering database connection locks, and memory leaks caused by client disconnects or unhandled task exceptions.","antiPatternHeadline":"Spawning Unstructured Asyncio Background Tasks Within FastAPI Endpoints","stars_count":108,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","anyio","asyncio","structured-concurrency","python"],"exportEndpoints":{"claude":"/api/rules/fastapi-anyio-taskgroup-cancellation-guardrail?format=claude","cursorMdc":"/api/rules/fastapi-anyio-taskgroup-cancellation-guardrail?format=mdc","cursorrules":"/api/rules/fastapi-anyio-taskgroup-cancellation-guardrail?format=cursor","windsurf":"/api/rules/fastapi-anyio-taskgroup-cancellation-guardrail?format=windsurf","agents":"/api/rules/fastapi-anyio-taskgroup-cancellation-guardrail?format=agents"}},{"id":"pgvector-hnsw-iterative-search-memory-standard","title":"pgvector 0.8 HNSW Iterative Scan Memory & work_mem Sizing Standard","category":"backend","severity":"critical","description":"Enforces transaction-scoped work_mem budgeting and strict hnsw.max_scan_tuples bounds when using pgvector 0.8+ iterative index scans. Prevents PostgreSQL backend worker OOM termination caused by unbounded candidate queues and memory accumulation during high-concurrency filtered RAG retrieval.","antiPatternHeadline":"Unbounded HNSW Iterative Scans under Default/Excessive work_mem Inducing Worker Process OOM Kills","stars_count":77,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres","pgvector","hnsw","rag","memory-management","database-reliability"],"exportEndpoints":{"claude":"/api/rules/pgvector-hnsw-iterative-search-memory-standard?format=claude","cursorMdc":"/api/rules/pgvector-hnsw-iterative-search-memory-standard?format=mdc","cursorrules":"/api/rules/pgvector-hnsw-iterative-search-memory-standard?format=cursor","windsurf":"/api/rules/pgvector-hnsw-iterative-search-memory-standard?format=windsurf","agents":"/api/rules/pgvector-hnsw-iterative-search-memory-standard?format=agents"}},{"id":"bun-native-websocket-backpressure-ring-buffer","title":"Bun 1.2 Native WebSocket Backpressure Ring-Buffer Invariant","category":"backend","severity":"critical","description":"Enforces deterministic backpressure handling and explicit frame shedding for Bun 1.2 native WebSockets during high-throughput broadcast fan-outs. Prevents process heap exhaustion and native Zig transport buffer crashes by monitoring socket buffer levels and dropping stale unacknowledged messages via a bounded ring buffer.","antiPatternHeadline":"Unchecked Fan-Out Broadcasts Overwhelming Slow WebSocket Consumers into Native OOM","stars_count":98,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["bun","websockets","backpressure","memory-management","fan-out","zig-runtime"],"exportEndpoints":{"claude":"/api/rules/bun-native-websocket-backpressure-ring-buffer?format=claude","cursorMdc":"/api/rules/bun-native-websocket-backpressure-ring-buffer?format=mdc","cursorrules":"/api/rules/bun-native-websocket-backpressure-ring-buffer?format=cursor","windsurf":"/api/rules/bun-native-websocket-backpressure-ring-buffer?format=windsurf","agents":"/api/rules/bun-native-websocket-backpressure-ring-buffer?format=agents"}},{"id":"android-15-16kb-page-size-elf-alignment-guardrail","title":"Android 15 16KB Native Page Size ELF Memory Alignment Guardrail","category":"mobile","severity":"critical","description":"Android 15 introduces support for devices configured with 16KB memory page sizes, departing from the legacy 4KB standard. Native C/C++ and Rust shared libraries (.so) packaged in APKs or AABs must align their ELF PT_LOAD segments to 16KB (0x4000) boundaries, and zip archives must store uncompressed native libraries aligned to 16KB boundaries. Failure to enforce these constraints results in immediate kernel memory mapping failure and linker crash (SIGSEGV or dlopen abort) during process initialization on 16KB-configured devices.","antiPatternHeadline":"Compiling Native JNI Libraries with Default 4KB ELF Segment Alignment or Packaging Unaligned .so Files in APKs","stars_count":105,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","android","android-15","ndk","jni","cpp","rust","elf-alignment"],"exportEndpoints":{"claude":"/api/rules/android-15-16kb-page-size-elf-alignment-guardrail?format=claude","cursorMdc":"/api/rules/android-15-16kb-page-size-elf-alignment-guardrail?format=mdc","cursorrules":"/api/rules/android-15-16kb-page-size-elf-alignment-guardrail?format=cursor","windsurf":"/api/rules/android-15-16kb-page-size-elf-alignment-guardrail?format=windsurf","agents":"/api/rules/android-15-16kb-page-size-elf-alignment-guardrail?format=agents"}},{"id":"capacitor-7-hardware-webauthn-keystore-interceptor","title":"Capacitor 7 Hardware-Backed WebAuthn Keystore Interceptor Standard","category":"mobile","severity":"critical","description":"Mandates that hybrid mobile applications built on Capacitor 7 bind all privileged API session operations to hardware-backed Secure Enclave or Android Keystore/StrongBox cryptographic attestations. Prohibits persistent storage of raw bearer tokens in unprivileged WebView storage, enforcing hardware-isolated WebAuthn/Passkey signatures for state-mutating requests.","antiPatternHeadline":"Persisting Long-Lived Session Tokens in WebView Storage and Emitting Plaintext Authorization Headers","stars_count":88,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor7","webauthn","secure-enclave","android-keystore","cryptography","zero-trust"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-hardware-webauthn-keystore-interceptor?format=claude","cursorMdc":"/api/rules/capacitor-7-hardware-webauthn-keystore-interceptor?format=mdc","cursorrules":"/api/rules/capacitor-7-hardware-webauthn-keystore-interceptor?format=cursor","windsurf":"/api/rules/capacitor-7-hardware-webauthn-keystore-interceptor?format=windsurf","agents":"/api/rules/capacitor-7-hardware-webauthn-keystore-interceptor?format=agents"}},{"id":"webauthn-prf-zk-encryption-standard","title":"WebAuthn PRF Client-Side Zero-Knowledge Symmetric Key Derivation Standard","category":"security","severity":"critical","description":"Enforces strict client-side evaluation of WebAuthn Pseudo-Random Function (PRF) extension inputs to derive deterministic symmetric encryption keys directly within client memory. Mandates that raw PRF outputs and derived key material are never exposed to the authentication backend, ensuring hardware-bound zero-knowledge encryption guarantees.","antiPatternHeadline":"Transmitting raw WebAuthn PRF extension results to backend authentication services or deriving encryption keys server-side.","stars_count":88,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","prf","zero-knowledge","web-crypto","cryptography"],"exportEndpoints":{"claude":"/api/rules/webauthn-prf-zk-encryption-standard?format=claude","cursorMdc":"/api/rules/webauthn-prf-zk-encryption-standard?format=mdc","cursorrules":"/api/rules/webauthn-prf-zk-encryption-standard?format=cursor","windsurf":"/api/rules/webauthn-prf-zk-encryption-standard?format=windsurf","agents":"/api/rules/webauthn-prf-zk-encryption-standard?format=agents"}},{"id":"fapi2-mtls-client-certificate-binding-invariant","title":"FAPI 2.0 Sender-Constrained mTLS Certificate-Bound Token Enforcement","category":"security","severity":"critical","description":"Enforces FAPI 2.0 Security Profile and RFC 8705 sender-constrained token invariants by cryptographically binding access tokens to the client TLS certificate. Mandates that resource servers reject requests where the SHA-256 thumbprint of the presented client certificate fails to match the token's confirmation claim ('cnf.x5t#S256').","antiPatternHeadline":"Accepting sender-constrained mTLS tokens as unvalidated bearer tokens without matching client certificate thumbprints","stars_count":76,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","fapi2","oauth2","mtls","rfc8705","sender-constrained","zero-trust"],"exportEndpoints":{"claude":"/api/rules/fapi2-mtls-client-certificate-binding-invariant?format=claude","cursorMdc":"/api/rules/fapi2-mtls-client-certificate-binding-invariant?format=mdc","cursorrules":"/api/rules/fapi2-mtls-client-certificate-binding-invariant?format=cursor","windsurf":"/api/rules/fapi2-mtls-client-certificate-binding-invariant?format=windsurf","agents":"/api/rules/fapi2-mtls-client-certificate-binding-invariant?format=agents"}},{"id":"k8s-dra-gpu-nvlink-topology-fencing-standard","title":"Kubernetes 1.32 DRA Structured Parameters and NVLink Clique Affinity Fencing","category":"devops","severity":"critical","description":"Enforces deterministic multi-GPU allocation via Kubernetes 1.32 Dynamic Resource Allocation (DRA) Structured Parameters (resource.k8s.io/v1beta1). Requires explicit NVLink interconnect clique constraints and fabric partition matching within ResourceClaims to prevent cross-NUMA or cross-PCIe-switch fallback that triggers catastrophic interconnect bandwidth degradation in distributed inference workloads.","antiPatternHeadline":"Unfenced multi-GPU scheduling across fragmented NVLink partitions causing catastrophic all-reduce throughput collapse","stars_count":107,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","kubernetes","dra","gpu","nvlink","distributed-inference","resource-claims"],"exportEndpoints":{"claude":"/api/rules/k8s-dra-gpu-nvlink-topology-fencing-standard?format=claude","cursorMdc":"/api/rules/k8s-dra-gpu-nvlink-topology-fencing-standard?format=mdc","cursorrules":"/api/rules/k8s-dra-gpu-nvlink-topology-fencing-standard?format=cursor","windsurf":"/api/rules/k8s-dra-gpu-nvlink-topology-fencing-standard?format=windsurf","agents":"/api/rules/k8s-dra-gpu-nvlink-topology-fencing-standard?format=agents"}},{"id":"otel-otlp-cardinality-circuit-breaker-standard","title":"OpenTelemetry OTLP High-Cardinality Dynamic Attribute Scrubbing & Circuit Breaker Guardrail","category":"devops","severity":"critical","description":"Protects downstream telemetry collector pipelines, ClickHouse/Tempo backends, and in-memory trace buffers from catastrophic OOM crashes by dynamically bounding, hashing, and shedding unindexed dynamic runtime span attributes. Implements runtime span processors with token bucket rate limiters, strict key allowlists, and deterministic truncated SHA-256 hashing for dynamic entity identifiers.","antiPatternHeadline":"Unbounded Runtime Span Attribute Injection Inducing OTLP Collector Memory Exhaustion and Storage Explosion","stars_count":111,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","observability","otlp","cardinality","circuit-breaker","resilience"],"exportEndpoints":{"claude":"/api/rules/otel-otlp-cardinality-circuit-breaker-standard?format=claude","cursorMdc":"/api/rules/otel-otlp-cardinality-circuit-breaker-standard?format=mdc","cursorrules":"/api/rules/otel-otlp-cardinality-circuit-breaker-standard?format=cursor","windsurf":"/api/rules/otel-otlp-cardinality-circuit-breaker-standard?format=windsurf","agents":"/api/rules/otel-otlp-cardinality-circuit-breaker-standard?format=agents"}},{"id":"nextjs-15-dynamic-io-async-context-invariants","title":"Next.js 15 Dynamic I/O Async Request Context Unwrapping Invariant","category":"frontend","severity":"critical","description":"Under Next.js 15's Dynamic I/O execution model, request-bound contexts (`cookies()`, `headers()`, `params`, `searchParams`) yield asynchronous promises that must be consumed through granular boundaries. Unconditional top-level awaiting or premature promise unwrapping in layout or page shells blocks prerender waterfalls, invalidates Partial Prerendering (PPR), and triggers cross-request data pollution. Strict leaf-node unwrapping wrapped in explicit React Suspense boundaries is mandated to preserve static pre-generation guarantees.","antiPatternHeadline":"Awaiting Dynamic Request Promises at Root Shells Without Suspense Isolation Under Dynamic I/O","stars_count":105,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs","react-server-components","dynamic-io","partial-prerendering"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-dynamic-io-async-context-invariants?format=claude","cursorMdc":"/api/rules/nextjs-15-dynamic-io-async-context-invariants?format=mdc","cursorrules":"/api/rules/nextjs-15-dynamic-io-async-context-invariants?format=cursor","windsurf":"/api/rules/nextjs-15-dynamic-io-async-context-invariants?format=windsurf","agents":"/api/rules/nextjs-15-dynamic-io-async-context-invariants?format=agents"}},{"id":"axum-bounded-sse-backpressure-engine","title":"Axum 0.8 Bounded SSE Streaming Backpressure Engine","category":"backend","severity":"critical","description":"Enforces strict bounded channel capacities, explicit lagged-consumer eviction, and non-blocking stream adapters for Axum 0.8 Server-Sent Events (SSE). Prevents unbounded heap growth, slow-client socket buffer bloat, and Tokio worker thread pool starvation caused by unconstrained broadcast fanout.","antiPatternHeadline":"Unbounded MPSC channels and unhandled broadcast lag leading to OOM crashes and runtime executor stalls during SSE fanout","stars_count":102,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tokio","sse","concurrency","backpressure"],"exportEndpoints":{"claude":"/api/rules/axum-bounded-sse-backpressure-engine?format=claude","cursorMdc":"/api/rules/axum-bounded-sse-backpressure-engine?format=mdc","cursorrules":"/api/rules/axum-bounded-sse-backpressure-engine?format=cursor","windsurf":"/api/rules/axum-bounded-sse-backpressure-engine?format=windsurf","agents":"/api/rules/axum-bounded-sse-backpressure-engine?format=agents"}},{"id":"postgres-17-streaming-io-direct-buffering-invariant","title":"Postgres 17 Streaming I/O Direct Buffering and Page Cache Isolation Invariant","category":"backend","severity":"critical","description":"Enforces configuration, transaction isolation, and query execution standards leveraging Postgres 17 streaming read primitives and direct buffering controls. Bypasses kernel page cache lockups and dirty page writeback starvation during high-throughput concurrent writes, ensuring deterministic latency for pgvector scans and large sequential sweeps.","antiPatternHeadline":"Unbounded Vector and Table Scans Polluting Shared Buffers and Triggering Kernel Page Cache Eviction Thrashing Under Write Saturation","stars_count":44,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","postgres-17","pgvector","streaming-io","performance","database"],"exportEndpoints":{"claude":"/api/rules/postgres-17-streaming-io-direct-buffering-invariant?format=claude","cursorMdc":"/api/rules/postgres-17-streaming-io-direct-buffering-invariant?format=mdc","cursorrules":"/api/rules/postgres-17-streaming-io-direct-buffering-invariant?format=cursor","windsurf":"/api/rules/postgres-17-streaming-io-direct-buffering-invariant?format=windsurf","agents":"/api/rules/postgres-17-streaming-io-direct-buffering-invariant?format=agents"}},{"id":"go-1-24-swiss-table-heap-pacing-invariant","title":"Go 1.24 Swiss Table Preallocation and Heap Pacing Guardrail","category":"backend","severity":"critical","description":"Go 1.24 adopts Swiss Tables for runtime map internals, shifting collision resolution to SIMD-accelerated metadata groups while altering reallocation growth characteristics and memory fragmentation profiles. During multi-gigabit ingestion pipelines, un-hinted maps undergoing continuous dynamic growth trigger frequent bucket group splits, saturating write barriers, ballooning the heap pacing target (GOGC), and inducing catastrophic GC STW mark-assist pauses.","antiPatternHeadline":"Dynamic un-hinted map resizing under sustained high-throughput workloads triggering GC mark-assist storms and L1/L2 cache evictions","stars_count":48,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","performance","memory-management","garbage-collection","swiss-tables"],"exportEndpoints":{"claude":"/api/rules/go-1-24-swiss-table-heap-pacing-invariant?format=claude","cursorMdc":"/api/rules/go-1-24-swiss-table-heap-pacing-invariant?format=mdc","cursorrules":"/api/rules/go-1-24-swiss-table-heap-pacing-invariant?format=cursor","windsurf":"/api/rules/go-1-24-swiss-table-heap-pacing-invariant?format=windsurf","agents":"/api/rules/go-1-24-swiss-table-heap-pacing-invariant?format=agents"}},{"id":"kmp-21-stateflow-thread-confinement-standard","title":"Kotlin Multiplatform 2.1 StateFlow Thread Confinement and Dispatcher Synchronization","category":"mobile","severity":"critical","description":"Enforces strict thread confinement and atomic mutation boundaries for Coroutine StateFlow across Darwin Grand Central Dispatch and Android UI dispatchers in Kotlin Multiplatform 2.1. Eliminates memory tearing, re-entrancy deadlocks, and Swift/Kotlin memory model race conditions when bridge layers evaluate shared reactive state.","antiPatternHeadline":"Cross-Thread MutableStateFlow Mutation and Unconfined Dispatcher Bridges Across Darwin GCD and Android Main","stars_count":85,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kmp","kotlin-multiplatform","coroutines","stateflow","darwin","gcd","android"],"exportEndpoints":{"claude":"/api/rules/kmp-21-stateflow-thread-confinement-standard?format=claude","cursorMdc":"/api/rules/kmp-21-stateflow-thread-confinement-standard?format=mdc","cursorrules":"/api/rules/kmp-21-stateflow-thread-confinement-standard?format=cursor","windsurf":"/api/rules/kmp-21-stateflow-thread-confinement-standard?format=windsurf","agents":"/api/rules/kmp-21-stateflow-thread-confinement-standard?format=agents"}},{"id":"capacitor-7-secure-enclave-session-vault-standard","title":"Capacitor 7 Hardware-Backed Secure Enclave Session Vault Invariant","category":"mobile","severity":"critical","description":"Enforces that high-privilege authentication credentials and cryptographic tokens within Capacitor 7 hybrid applications are strictly isolated to platform-native hardware security modules (Apple Secure Enclave and Android StrongBox/TEE). Prohibits persisting session secrets within Chromium or WebKit storage partitions such as localStorage, sessionStorage, or IndexedDB, which are prone to extraction via WebView XSS or unencrypted filesystem inspectability. Mandates transient in-memory handling and hardware-backed biometric authentication gateways for token retrieval.","antiPatternHeadline":"Persisting Session Tokens and Refresh Credentials in WebView Local Storage or Unencrypted Preferences","stars_count":45,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","secure-enclave","keystore","hardware-security","auth","ios","android"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-secure-enclave-session-vault-standard?format=claude","cursorMdc":"/api/rules/capacitor-7-secure-enclave-session-vault-standard?format=mdc","cursorrules":"/api/rules/capacitor-7-secure-enclave-session-vault-standard?format=cursor","windsurf":"/api/rules/capacitor-7-secure-enclave-session-vault-standard?format=windsurf","agents":"/api/rules/capacitor-7-secure-enclave-session-vault-standard?format=agents"}},{"id":"w3c-fedcm-identity-assertion-sandboxing-guardrail","title":"W3C FedCM Assertion Sandboxing & Anti-Tracking Guardrail","category":"security","severity":"critical","description":"Enforces strict origin isolation, cryptographic nonce binding, and deterministic timing protections when interacting with the W3C Federated Credential Management (FedCM) API. Eliminates silent cross-site timing deanonymization while maintaining Enterprise SSO session continuity without fallback to third-party or partitioned cookies.","antiPatternHeadline":"Unsandboxed FedCM Invocation with Leaked RP Context and Timing-Dependent Assertion Responses","stars_count":91,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","fedcm","identity","authentication","oidc","privacy","web-crypto"],"exportEndpoints":{"claude":"/api/rules/w3c-fedcm-identity-assertion-sandboxing-guardrail?format=claude","cursorMdc":"/api/rules/w3c-fedcm-identity-assertion-sandboxing-guardrail?format=mdc","cursorrules":"/api/rules/w3c-fedcm-identity-assertion-sandboxing-guardrail?format=cursor","windsurf":"/api/rules/w3c-fedcm-identity-assertion-sandboxing-guardrail?format=windsurf","agents":"/api/rules/w3c-fedcm-identity-assertion-sandboxing-guardrail?format=agents"}},{"id":"cilium-ebpf-host-routing-xdp-transit-invariant","title":"Cilium eBPF Host Routing and Native XDP Transit Verification","category":"devops","severity":"critical","description":"Enforces eBPF-based host routing and native XDP acceleration invariants to bypass the Linux kernel netfilter/conntrack stack in dense Kubernetes clusters. Prevents silent fallback to standard TCP/IP network stack processing, guaranteeing deterministic sub-millisecond pod-to-pod and node-to-node overlay latencies.","antiPatternHeadline":"Silent Netfilter Fallback Caused by Misconfigured MTU, Incompatible NIC Driver XDP Modes, or Stale Iptables Masquerading","stars_count":84,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","cilium","ebpf","xdp","kubernetes","networking","cni"],"exportEndpoints":{"claude":"/api/rules/cilium-ebpf-host-routing-xdp-transit-invariant?format=claude","cursorMdc":"/api/rules/cilium-ebpf-host-routing-xdp-transit-invariant?format=mdc","cursorrules":"/api/rules/cilium-ebpf-host-routing-xdp-transit-invariant?format=cursor","windsurf":"/api/rules/cilium-ebpf-host-routing-xdp-transit-invariant?format=windsurf","agents":"/api/rules/cilium-ebpf-host-routing-xdp-transit-invariant?format=agents"}},{"id":"opentelemetry-w3c-trace-dlq-causality-guardrail","title":"Deterministic W3C TraceContext Lineage and Span Link Causality in DLQ Lifecycles","category":"devops","severity":"critical","description":"Enforces deterministic distributed tracing lineage across asynchronous retry topics and Dead-Letter Queues (DLQ). Guarantees that W3C TraceContext headers are preserved, propagated through broker envelopes, and re-attached via OpenTelemetry Span Links rather than corruptive direct-parent hierarchy or context drops.","antiPatternHeadline":"Trace Severing and Direct-Parent Graph Corruption During Asynchronous Message Retry and Dead-Letter Forwarding","stars_count":95,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["opentelemetry","w3c-tracecontext","dead-letter-queue","distributed-tracing","kafka","message-brokers","event-driven"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-w3c-trace-dlq-causality-guardrail?format=claude","cursorMdc":"/api/rules/opentelemetry-w3c-trace-dlq-causality-guardrail?format=mdc","cursorrules":"/api/rules/opentelemetry-w3c-trace-dlq-causality-guardrail?format=cursor","windsurf":"/api/rules/opentelemetry-w3c-trace-dlq-causality-guardrail?format=windsurf","agents":"/api/rules/opentelemetry-w3c-trace-dlq-causality-guardrail?format=agents"}},{"id":"nextjs-15-ppr-dynamic-static-quarantine","title":"Next.js 15 PPR Dynamic-Static Boundary Quarantine & Context Isolation","category":"frontend","severity":"critical","description":"Enforces strict isolation between edge-cached static shells and runtime dynamic segments under Next.js 15 Partial Prerendering (PPR). Prevents request-bound primitives like cookies, headers, and authentication claims from leaking into statically prerendered ASTs, and ensures dynamic data holes are strictly enclosed within explicit React Suspense boundaries.","antiPatternHeadline":"Accessing Request-Scoped Dynamic Context Outside Suspense Boundaries in PPR Shells","stars_count":104,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs","react-server-components","partial-prerendering","security"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-ppr-dynamic-static-quarantine?format=claude","cursorMdc":"/api/rules/nextjs-15-ppr-dynamic-static-quarantine?format=mdc","cursorrules":"/api/rules/nextjs-15-ppr-dynamic-static-quarantine?format=cursor","windsurf":"/api/rules/nextjs-15-ppr-dynamic-static-quarantine?format=windsurf","agents":"/api/rules/nextjs-15-ppr-dynamic-static-quarantine?format=agents"}},{"id":"postgres-17-json-table-bounded-memory-allocation-standard","title":"Postgres 17 JSON_TABLE Bounded Memory Allocation and Relational Ingestion Standard","category":"backend","severity":"critical","description":"Enforces strict payload chunking, typed column projection boundaries, and session-level memory constraints when utilizing PostgreSQL 17's SQL/JSON JSON_TABLE feature. Prevents unindexed lateral expansions of monolithic JSON documents from exceeding backend work_mem or triggering operating system OOM killer process termination.","antiPatternHeadline":"Unbounded In-Memory Relational Explosion via Monolithic JSON_TABLE Document Parsing","stars_count":88,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","postgres-17","sql-json","json-table","memory-management","database-performance"],"exportEndpoints":{"claude":"/api/rules/postgres-17-json-table-bounded-memory-allocation-standard?format=claude","cursorMdc":"/api/rules/postgres-17-json-table-bounded-memory-allocation-standard?format=mdc","cursorrules":"/api/rules/postgres-17-json-table-bounded-memory-allocation-standard?format=cursor","windsurf":"/api/rules/postgres-17-json-table-bounded-memory-allocation-standard?format=windsurf","agents":"/api/rules/postgres-17-json-table-bounded-memory-allocation-standard?format=agents"}},{"id":"go-chi-context-cancellation-propagation-guardrail","title":"Go Chi Context Propagation & Upstream Resource Cancellation Invariant","category":"backend","severity":"critical","description":"Enforces deterministic cancellation propagation from Go Chi HTTP request contexts to downstream database connection pools, transactions, and child goroutines. Guarantees that premature client disconnections immediately terminate in-flight queries and release database connection leases, preventing connection pool starvation and orphaned backend execution.","antiPatternHeadline":"Orphaned DB Leases and Zombie Goroutines via context.Background() or Unpropagated Chi Request Contexts","stars_count":89,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","chi","context","sql","concurrency","performance"],"exportEndpoints":{"claude":"/api/rules/go-chi-context-cancellation-propagation-guardrail?format=claude","cursorMdc":"/api/rules/go-chi-context-cancellation-propagation-guardrail?format=mdc","cursorrules":"/api/rules/go-chi-context-cancellation-propagation-guardrail?format=cursor","windsurf":"/api/rules/go-chi-context-cancellation-propagation-guardrail?format=windsurf","agents":"/api/rules/go-chi-context-cancellation-propagation-guardrail?format=agents"}},{"id":"bun-tcp-zerocopy-direct-io-guardrail","title":"Bun 1.2 TCP Zero-Copy Direct I/O and Backpressure Guardrail","category":"backend","severity":"critical","description":"Enforces zero-copy binary forwarding and rigorous backpressure control across Bun 1.2 TCP/TLS sockets. Eliminates JavaScriptCore heap allocation churn, native-to-runtime buffer duplication, and runaway memory inflation during sustained high-throughput microservice proxying.","antiPatternHeadline":"Heap-allocating intermediate buffers and bypassing TCP backpressure drainage in Bun proxy pipelines","stars_count":45,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","tcp","zero-copy","performance","networking","memory-management"],"exportEndpoints":{"claude":"/api/rules/bun-tcp-zerocopy-direct-io-guardrail?format=claude","cursorMdc":"/api/rules/bun-tcp-zerocopy-direct-io-guardrail?format=mdc","cursorrules":"/api/rules/bun-tcp-zerocopy-direct-io-guardrail?format=cursor","windsurf":"/api/rules/bun-tcp-zerocopy-direct-io-guardrail?format=windsurf","agents":"/api/rules/bun-tcp-zerocopy-direct-io-guardrail?format=agents"}},{"id":"tauri-mobile-secure-enclave-ipc-attestation","title":"Tauri 2.0 Mobile Secure Enclave Keystore IPC Attestation Standard","category":"mobile","severity":"critical","description":"Enforces cryptographic hardware-backed attestation for high-privilege Tauri 2.0 mobile IPC operations. Eliminates trust in client-side boolean biometric verification by mandating server- or core-generated challenge nonces signed directly within the iOS Secure Enclave or Android Keystore before native Rust plugin dispatch.","antiPatternHeadline":"Trusting Client-Side Boolean Biometric Prompts to Authorize High-Privilege IPC Commands","stars_count":47,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri-2","secure-enclave","android-keystore","ipc-security","cryptography","rust"],"exportEndpoints":{"claude":"/api/rules/tauri-mobile-secure-enclave-ipc-attestation?format=claude","cursorMdc":"/api/rules/tauri-mobile-secure-enclave-ipc-attestation?format=mdc","cursorrules":"/api/rules/tauri-mobile-secure-enclave-ipc-attestation?format=cursor","windsurf":"/api/rules/tauri-mobile-secure-enclave-ipc-attestation?format=windsurf","agents":"/api/rules/tauri-mobile-secure-enclave-ipc-attestation?format=agents"}},{"id":"kmp-room-sqlite-atomic-migration-standard","title":"Kotlin Multiplatform Room SQLite Atomic Migration Standard","category":"mobile","severity":"critical","description":"Enforces strict transactional atomicity and defensive foreign key management for Room database migrations across Android and iOS targets. Guarantees that any unexpected mid-migration process death rolls back schema changes completely without leaving the client SQLite database in an inconsistent or unrecoverable bricked state.","antiPatternHeadline":"Non-Transactional Multi-Statement Migrations Leading to Unrecoverable Client Database Corruption","stars_count":119,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","room","sqlite","offline-first","database-migration"],"exportEndpoints":{"claude":"/api/rules/kmp-room-sqlite-atomic-migration-standard?format=claude","cursorMdc":"/api/rules/kmp-room-sqlite-atomic-migration-standard?format=mdc","cursorrules":"/api/rules/kmp-room-sqlite-atomic-migration-standard?format=cursor","windsurf":"/api/rules/kmp-room-sqlite-atomic-migration-standard?format=windsurf","agents":"/api/rules/kmp-room-sqlite-atomic-migration-standard?format=agents"}},{"id":"rfc-9449-dpop-asymmetric-token-binding-invariant","title":"Mandating RFC 9449 Demonstrating Proof-of-Possession (DPoP) Cryptographic Binding","category":"security","severity":"critical","description":"RFC 9449 DPoP tethers OAuth 2.0 access and refresh tokens to an ephemeral, client-held asymmetric key pair, rendering exfiltrated bearer tokens unusable without the private key. Resource servers and OAuth clients must strictly validate the DPoP proof header (`typ: dpop+jwt`), bound thumbprint (`jkt`), HTTP method, URI target (`htu`/`htm`), and anti-replay nonces (`jti` and server-issued nonces).","antiPatternHeadline":"Accepting Unbound Bearer Tokens or Incomplete DPoP Proof Validation Subject to Token Theft and Replay","stars_count":56,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","oauth2","rfc9449","dpop","jwt","zero-trust","cryptography"],"exportEndpoints":{"claude":"/api/rules/rfc-9449-dpop-asymmetric-token-binding-invariant?format=claude","cursorMdc":"/api/rules/rfc-9449-dpop-asymmetric-token-binding-invariant?format=mdc","cursorrules":"/api/rules/rfc-9449-dpop-asymmetric-token-binding-invariant?format=cursor","windsurf":"/api/rules/rfc-9449-dpop-asymmetric-token-binding-invariant?format=windsurf","agents":"/api/rules/rfc-9449-dpop-asymmetric-token-binding-invariant?format=agents"}},{"id":"cosign-keyless-oidc-attestation-policy","title":"Enforce Sigstore Cosign Keyless OIDC Container Attestations & Transparency Log Verification","category":"security","severity":"critical","description":"Eliminates long-lived CI/CD cryptographic private keys by enforcing ephemeral Fulcio-issued x509 certificate signing anchored in the Rekor transparency log. Mandates Kubernetes admission controllers verify the immutable OIDC issuer, Subject Alternative Name (SAN), Rekor inclusion proof, and in-toto provenance attestations before pod scheduling.","antiPatternHeadline":"Persisting static private signing keys in CI secrets and verifying unpinned images without OIDC identity checks or Rekor transparency audits","stars_count":42,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","sigstore","cosign","kubernetes","supply-chain","admission-controller","rekor","fulcio"],"exportEndpoints":{"claude":"/api/rules/cosign-keyless-oidc-attestation-policy?format=claude","cursorMdc":"/api/rules/cosign-keyless-oidc-attestation-policy?format=mdc","cursorrules":"/api/rules/cosign-keyless-oidc-attestation-policy?format=cursor","windsurf":"/api/rules/cosign-keyless-oidc-attestation-policy?format=windsurf","agents":"/api/rules/cosign-keyless-oidc-attestation-policy?format=agents"}},{"id":"otel-baggage-ingress-sanitization-pii-boundary","title":"OpenTelemetry Ingress Baggage Sanitization & Strict PII Redaction Boundary","category":"devops","severity":"critical","description":"Enforces boundary verification and deterministic key allowlisting on all incoming OpenTelemetry Baggage contexts. Prevents cross-tenant context injection, unauthorized privilege escalation via telemetry metadata, and inadvertent transit of PII or credentials down distributed service call chains.","antiPatternHeadline":"Trusting Ingress W3C Baggage Headers Blindly Without Allowlist Filtering or Cryptographic Verification","stars_count":108,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","distributed-tracing","security","pii-redaction","service-mesh"],"exportEndpoints":{"claude":"/api/rules/otel-baggage-ingress-sanitization-pii-boundary?format=claude","cursorMdc":"/api/rules/otel-baggage-ingress-sanitization-pii-boundary?format=mdc","cursorrules":"/api/rules/otel-baggage-ingress-sanitization-pii-boundary?format=cursor","windsurf":"/api/rules/otel-baggage-ingress-sanitization-pii-boundary?format=windsurf","agents":"/api/rules/otel-baggage-ingress-sanitization-pii-boundary?format=agents"}},{"id":"react-19-use-optimistic-rollback-sync","title":"React 19 useOptimistic Rollback Synchronization and Concurrency Protocol","category":"frontend","severity":"critical","description":"Enforces deterministic optimistic reconciliation, monotonic revision sequencing, and active transaction lifecycle tracking when executing concurrent React 19 Server Actions. Guarantees that out-of-order network resolutions or transient network failures cannot roll back subsequent forward state or introduce ghost writes into the UI.","antiPatternHeadline":"Unsequenced useOptimistic mutations permitting out-of-order action resolutions to revert newer client states","stars_count":72,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","useOptimistic","server-actions","concurrency","state-rollback"],"exportEndpoints":{"claude":"/api/rules/react-19-use-optimistic-rollback-sync?format=claude","cursorMdc":"/api/rules/react-19-use-optimistic-rollback-sync?format=mdc","cursorrules":"/api/rules/react-19-use-optimistic-rollback-sync?format=cursor","windsurf":"/api/rules/react-19-use-optimistic-rollback-sync?format=windsurf","agents":"/api/rules/react-19-use-optimistic-rollback-sync?format=agents"}},{"id":"svelte-5-effect-abortsignal-lifetime-binding-standard","title":"Svelte 5 $effect AbortSignal Lifecycle Binding & Zombie Execution Guardrail","category":"frontend","severity":"critical","description":"Enforces deterministic cancellation and resource deallocation across all asynchronous or event-driven Svelte 5 $effect and $effect.pre invocations. Mandates binding an AbortController instance to the effect's synchronous teardown function to prevent memory leaks, race conditions, and zombie execution trees during rapid reactive graph invalidations.","antiPatternHeadline":"Unbounded Async Operations in $effect Producing Zombie Execution and State Invalidation Races","stars_count":92,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte-5","runes","effects","abort-controller","memory-leaks","reactivity"],"exportEndpoints":{"claude":"/api/rules/svelte-5-effect-abortsignal-lifetime-binding-standard?format=claude","cursorMdc":"/api/rules/svelte-5-effect-abortsignal-lifetime-binding-standard?format=mdc","cursorrules":"/api/rules/svelte-5-effect-abortsignal-lifetime-binding-standard?format=cursor","windsurf":"/api/rules/svelte-5-effect-abortsignal-lifetime-binding-standard?format=windsurf","agents":"/api/rules/svelte-5-effect-abortsignal-lifetime-binding-standard?format=agents"}},{"id":"postgres-17-json-table-zero-copy-projection","title":"Postgres 17 JSON_TABLE Zero-Copy Streaming Materialization Boundary","category":"backend","severity":"critical","description":"Enforces plan-level streaming projection boundaries when querying JSONB with PostgreSQL 17 standard JSON_TABLE. Eliminates executor tuple spilling into disk-backed Tuplestore buffers and work_mem exhaustion by forbidding intermediate JSON re-serialization, untyped recordset expansions, and unbounded cartesian nested paths.","antiPatternHeadline":"Unbounded Executor Spill and Tuplestore Disk Thrashing via Legacy jsonb_to_recordset and FORMAT JSON Re-Serialization","stars_count":109,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres","postgresql-17","json-table","database-performance","sql"],"exportEndpoints":{"claude":"/api/rules/postgres-17-json-table-zero-copy-projection?format=claude","cursorMdc":"/api/rules/postgres-17-json-table-zero-copy-projection?format=mdc","cursorrules":"/api/rules/postgres-17-json-table-zero-copy-projection?format=cursor","windsurf":"/api/rules/postgres-17-json-table-zero-copy-projection?format=windsurf","agents":"/api/rules/postgres-17-json-table-zero-copy-projection?format=agents"}},{"id":"go-chi-http3-zero-rtt-anti-replay-guardrail","title":"Go 1.24 Chi HTTP/3 0-RTT Anti-Replay Mitigation Invariant","category":"backend","severity":"critical","description":"Enforces strict TLS 1.3 / QUIC 0-RTT early data inspection across Go Chi HTTP/3 routers. Rejects non-idempotent early requests with HTTP 425 (Too Early) to eliminate replay attack vectors against state-mutating endpoints.","antiPatternHeadline":"Executing Mutating Endpoints via Unchecked QUIC 0-RTT Handshakes Subject to Replay Attacks","stars_count":94,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","http3","quic","chi","tls13","security","anti-replay"],"exportEndpoints":{"claude":"/api/rules/go-chi-http3-zero-rtt-anti-replay-guardrail?format=claude","cursorMdc":"/api/rules/go-chi-http3-zero-rtt-anti-replay-guardrail?format=mdc","cursorrules":"/api/rules/go-chi-http3-zero-rtt-anti-replay-guardrail?format=cursor","windsurf":"/api/rules/go-chi-http3-zero-rtt-anti-replay-guardrail?format=windsurf","agents":"/api/rules/go-chi-http3-zero-rtt-anti-replay-guardrail?format=agents"}},{"id":"tauri-v2-mobile-ipc-capability-isolation","title":"Tauri 2.0 Mobile IPC Webview-Scoped Capability Isolation","category":"mobile","severity":"critical","description":"Enforces strict zero-trust principle of least privilege for Tauri 2.0 Inter-Process Communication (IPC) on iOS and Android. Rejects global, wildcard, and ambient permission assignments by mandating deterministic, window-scoped capability files in src-tauri/capabilities/ with explicit remote origin validations and granular command mappings.","antiPatternHeadline":"Ambient Core IPC Commands and Wildcard Permissions Assigned to Mobile Webviews","stars_count":108,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri","rust","ipc","security","ios","android"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-mobile-ipc-capability-isolation?format=claude","cursorMdc":"/api/rules/tauri-v2-mobile-ipc-capability-isolation?format=mdc","cursorrules":"/api/rules/tauri-v2-mobile-ipc-capability-isolation?format=cursor","windsurf":"/api/rules/tauri-v2-mobile-ipc-capability-isolation?format=windsurf","agents":"/api/rules/tauri-v2-mobile-ipc-capability-isolation?format=agents"}},{"id":"android-ndk-16kb-page-alignment-memory-fence","title":"Android 15 NDK 16KB Page Alignment and Dynamic Memory Fence Architecture","category":"mobile","severity":"critical","description":"Enforces 16KB ELF segment alignment and dynamic runtime page-size querying for Android 15 compatibility across native C/C++, Rust, and Kotlin Multiplatform binaries. Prevents fatal SIGBUS and SIGSEGV memory faults by forbidding hardcoded 4KB assumptions, static PAGE_SIZE macros, and misaligned mmap/mprotect boundaries.","antiPatternHeadline":"Hardcoding 4KB Page Sizes or Omitting 16KB Linker Flags Causing Critical Android 15 Native Crashes","stars_count":44,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["android","ndk","android-15","16kb-pages","c-cpp","kotlin-multiplatform","memory-safety"],"exportEndpoints":{"claude":"/api/rules/android-ndk-16kb-page-alignment-memory-fence?format=claude","cursorMdc":"/api/rules/android-ndk-16kb-page-alignment-memory-fence?format=mdc","cursorrules":"/api/rules/android-ndk-16kb-page-alignment-memory-fence?format=cursor","windsurf":"/api/rules/android-ndk-16kb-page-alignment-memory-fence?format=windsurf","agents":"/api/rules/android-ndk-16kb-page-alignment-memory-fence?format=agents"}},{"id":"webauthn-prf-zk-key-derivation-standard-webauthn-prf-zer-308","title":"WebAuthn PRF Zero-Knowledge Client Key Derivation Standard","category":"security","severity":"critical","description":"Enforces strict client-side evaluation and non-extractable isolation of deterministic cryptographic keys derived via the WebAuthn PRF (Pseudo-Random Function) extension. Guarantees that authenticator-derived seeds, intermediate outputs, and derived encryption keys never leak into relying party network payloads, DOM storage, or extractable memory contexts.","antiPatternHeadline":"Transmitting WebAuthn PRF evaluation outputs to authentication servers or storing derived zero-knowledge keys in extractable memory","stars_count":81,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","prf","zero-knowledge","cryptography","webcrypto"],"exportEndpoints":{"claude":"/api/rules/webauthn-prf-zk-key-derivation-standard-webauthn-prf-zer-308?format=claude","cursorMdc":"/api/rules/webauthn-prf-zk-key-derivation-standard-webauthn-prf-zer-308?format=mdc","cursorrules":"/api/rules/webauthn-prf-zk-key-derivation-standard-webauthn-prf-zer-308?format=cursor","windsurf":"/api/rules/webauthn-prf-zk-key-derivation-standard-webauthn-prf-zer-308?format=windsurf","agents":"/api/rules/webauthn-prf-zk-key-derivation-standard-webauthn-prf-zer-308?format=agents"}},{"id":"openfga-ephemeral-contextual-tuple-ttl-validation","title":"OpenFGA Ephemeral Contextual Tuple Cryptographic TTL and Replay Guardrail","category":"security","severity":"critical","description":"Mandates that all contextual tuples injected into OpenFGA Check and ListObjects queries originate from cryptographically verified ephemeral grants with strict time-to-live (TTL) bounds and replay verification. Prevents privilege escalation and persistent authorization bypasses caused by passing arbitrary, stale, or replayed dynamic authorization tuples directly into OpenFGA evaluation pipelines.","antiPatternHeadline":"Unvalidated Pass-Through of Arbitrary or Stale Contextual Tuples to OpenFGA Check APIs","stars_count":58,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","authorization","rebac","zero-trust","ttl","cryptography"],"exportEndpoints":{"claude":"/api/rules/openfga-ephemeral-contextual-tuple-ttl-validation?format=claude","cursorMdc":"/api/rules/openfga-ephemeral-contextual-tuple-ttl-validation?format=mdc","cursorrules":"/api/rules/openfga-ephemeral-contextual-tuple-ttl-validation?format=cursor","windsurf":"/api/rules/openfga-ephemeral-contextual-tuple-ttl-validation?format=windsurf","agents":"/api/rules/openfga-ephemeral-contextual-tuple-ttl-validation?format=agents"}},{"id":"otel-ebpf-unwind-budget-guardrail","title":"OpenTelemetry Continuous Profiling eBPF Unwind Budget and Stack Depth Guardrail","category":"devops","severity":"critical","description":"Enforces strict instruction budgets, stack-depth bounds, and tail-call execution limits on eBPF continuous profiling probes. Prevents NMI-watchdog lockups, CPU pipeline saturation, and tail latency regressions in mission-critical, low-latency microservices by constraining DWARF/frame-pointer walking iterations. Guarantees predictable agent resource consumption under high-frequency sample rates across Linux kernel fleets.","antiPatternHeadline":"Unbounded or Deep DWARF Unwinding in eBPF Probes Inducing Kernel Preemption Latency Spikes","stars_count":111,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","opentelemetry","profiling","linux-kernel","observability"],"exportEndpoints":{"claude":"/api/rules/otel-ebpf-unwind-budget-guardrail?format=claude","cursorMdc":"/api/rules/otel-ebpf-unwind-budget-guardrail?format=mdc","cursorrules":"/api/rules/otel-ebpf-unwind-budget-guardrail?format=cursor","windsurf":"/api/rules/otel-ebpf-unwind-budget-guardrail?format=windsurf","agents":"/api/rules/otel-ebpf-unwind-budget-guardrail?format=agents"}},{"id":"react-19-use-optimistic-rollback-reconciliation","title":"React 19 Deterministic useOptimistic Rollback and Concurrency Reconciliation","category":"frontend","severity":"critical","description":"Enforces transactional optimistic state management in React 19 by binding useOptimistic directly to canonical base states managed by useActionState or props within startTransition boundaries. Prevents race conditions, phantom rollbacks, and torn UI renders during concurrent, out-of-order Server Action rejections by requiring immutable monotonic action envelopes and disallowing parallel imperative local state mutations.","antiPatternHeadline":"Imperative State Mirroring and Non-Monotonic Optimistic Queuing Leading to Torn UI Rollbacks","stars_count":82,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","useOptimistic","server-actions","concurrency","state-reconciliation"],"exportEndpoints":{"claude":"/api/rules/react-19-use-optimistic-rollback-reconciliation?format=claude","cursorMdc":"/api/rules/react-19-use-optimistic-rollback-reconciliation?format=mdc","cursorrules":"/api/rules/react-19-use-optimistic-rollback-reconciliation?format=cursor","windsurf":"/api/rules/react-19-use-optimistic-rollback-reconciliation?format=windsurf","agents":"/api/rules/react-19-use-optimistic-rollback-reconciliation?format=agents"}},{"id":"axum-codel-adaptive-concurrency-limit","title":"Axum 0.8 CoDel Adaptive Concurrency Limiting and Bufferbloat Mitigation","category":"backend","severity":"critical","description":"Enforces deterministic tail latency in Axum 0.8 services by applying Controlled Delay (CoDel) adaptive concurrency limiting. Tracks queue residency (sojourn) time rather than static concurrency thresholds, dynamically shedding excess traffic with HTTP 503 when minimum queue delays exceed targets across sliding observation windows.","antiPatternHeadline":"Static Concurrency Limits and Unbounded Buffering Inducing Bufferbloat and Latency Collapse","stars_count":92,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tower","concurrency","codel","load-shedding"],"exportEndpoints":{"claude":"/api/rules/axum-codel-adaptive-concurrency-limit?format=claude","cursorMdc":"/api/rules/axum-codel-adaptive-concurrency-limit?format=mdc","cursorrules":"/api/rules/axum-codel-adaptive-concurrency-limit?format=cursor","windsurf":"/api/rules/axum-codel-adaptive-concurrency-limit?format=windsurf","agents":"/api/rules/axum-codel-adaptive-concurrency-limit?format=agents"}},{"id":"go-1-24-weak-pointer-cache-invalidation-invariant","title":"Go 1.24 Weak Pointer Invalidation and Non-Retaining Cache Standard","category":"backend","severity":"critical","description":"Enforces memory-safe cross-goroutine caching architectures using Go 1.24 core 'weak' package pointers. Eliminates unbounded heap retention, cyclic reference leaks, and GC mark-phase latency spikes by ensuring caches do not artificially extend the lifetime of transient heap allocations.","antiPatternHeadline":"Strong-Reference Cache Maps Preventing GC Reclamation and Causing Heap Exhaustion","stars_count":83,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","golang","go-1-24","weak-pointers","memory-management","gc-latency"],"exportEndpoints":{"claude":"/api/rules/go-1-24-weak-pointer-cache-invalidation-invariant?format=claude","cursorMdc":"/api/rules/go-1-24-weak-pointer-cache-invalidation-invariant?format=mdc","cursorrules":"/api/rules/go-1-24-weak-pointer-cache-invalidation-invariant?format=cursor","windsurf":"/api/rules/go-1-24-weak-pointer-cache-invalidation-invariant?format=windsurf","agents":"/api/rules/go-1-24-weak-pointer-cache-invalidation-invariant?format=agents"}},{"id":"pgvector-08-hnsw-filtered-query-guardrail","title":"pgvector 0.8+ HNSW Filtered Query Iterative Search Guardrail","category":"backend","severity":"critical","description":"Enforces strict bounds on dynamic search-list expansion and mandatory fallback routing for filtered HNSW index scans in pgvector 0.8+. Prevents catastrophic tail-latency blowups caused by iterative index scanning exhausting ef_search when filter selectivity drops below index partition thresholds.","antiPatternHeadline":"Unbounded Iterative HNSW Traversal on High-Selectivity Predicates Without Fallbacks","stars_count":83,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres","pgvector","hnsw","vector-search","performance"],"exportEndpoints":{"claude":"/api/rules/pgvector-08-hnsw-filtered-query-guardrail?format=claude","cursorMdc":"/api/rules/pgvector-08-hnsw-filtered-query-guardrail?format=mdc","cursorrules":"/api/rules/pgvector-08-hnsw-filtered-query-guardrail?format=cursor","windsurf":"/api/rules/pgvector-08-hnsw-filtered-query-guardrail?format=windsurf","agents":"/api/rules/pgvector-08-hnsw-filtered-query-guardrail?format=agents"}},{"id":"capacitor-7-native-bridge-memory-zeroization","title":"Capacitor 7 Native Bridge Memory Zeroization Standard","category":"mobile","severity":"critical","description":"Enforces deterministic in-memory cryptographic zeroization of transient biometric payloads, cryptographic keys, and authentication tokens across the Capacitor 7 JavaScript-to-Native bridge. Mandates byte-array manipulation over immutable strings to eliminate memory retention risks in V8/JSC heaps and native memory segments. Prohibits persistence or garbage-collector dependence for high-entropy secrets.","antiPatternHeadline":"Passing Secrets via Immutable JS Strings and Un-Zeroed Bridge Dictionaries","stars_count":47,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","memory-zeroization","bridge-security","biometrics","cryptography","ios","android"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-native-bridge-memory-zeroization?format=claude","cursorMdc":"/api/rules/capacitor-7-native-bridge-memory-zeroization?format=mdc","cursorrules":"/api/rules/capacitor-7-native-bridge-memory-zeroization?format=cursor","windsurf":"/api/rules/capacitor-7-native-bridge-memory-zeroization?format=windsurf","agents":"/api/rules/capacitor-7-native-bridge-memory-zeroization?format=agents"}},{"id":"compose-multiplatform-skiko-vsync-pipeline-synchronization","title":"Compose Multiplatform Skiko VSync Pipeline Synchronization Standard","category":"mobile","severity":"critical","description":"Enforces strict alignment between Skiko's Skia rendering loop and native platform refresh hardware via iOS CADisplayLink and Android Choreographer. Prevents unsynchronized frame pumping, thread contention, and display pipeline desynchronization that causes frame hitching and jank on heterogeneous refresh displays (e.g., Apple ProMotion 120Hz and Android variable refresh rate).","antiPatternHeadline":"Decoupled Render-Loop Free-Running and Unbound Frame Dispatching","stars_count":65,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","compose-multiplatform","skiko","vsync","cadisplaylink","choreographer","rendering"],"exportEndpoints":{"claude":"/api/rules/compose-multiplatform-skiko-vsync-pipeline-synchronization?format=claude","cursorMdc":"/api/rules/compose-multiplatform-skiko-vsync-pipeline-synchronization?format=mdc","cursorrules":"/api/rules/compose-multiplatform-skiko-vsync-pipeline-synchronization?format=cursor","windsurf":"/api/rules/compose-multiplatform-skiko-vsync-pipeline-synchronization?format=windsurf","agents":"/api/rules/compose-multiplatform-skiko-vsync-pipeline-synchronization?format=agents"}},{"id":"openfga-recursive-tuple-evaluation-budget-guardrail","title":"OpenFGA Recursive Tuple Evaluation Budget & Traversal Depth Invariant","category":"security","severity":"critical","description":"Deeply nested authorization graphs and cyclic relation tuples can trigger unbounded recursive tree traversals during OpenFGA evaluation, precipitating CPU starvation and cascading denial-of-service vulnerabilities. Systems must strictly enforce relationship traversal depth ceilings, resolve-node evaluation limits, and bounded contextual tuple arrays across both server runtime configurations and client SDK call sites.","antiPatternHeadline":"Unbounded ReBAC Graph Traversal Without Node Budget Limits or Timeout Controls","stars_count":51,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","rebac","authorization","dos-prevention","graph-traversal"],"exportEndpoints":{"claude":"/api/rules/openfga-recursive-tuple-evaluation-budget-guardrail?format=claude","cursorMdc":"/api/rules/openfga-recursive-tuple-evaluation-budget-guardrail?format=mdc","cursorrules":"/api/rules/openfga-recursive-tuple-evaluation-budget-guardrail?format=cursor","windsurf":"/api/rules/openfga-recursive-tuple-evaluation-budget-guardrail?format=windsurf","agents":"/api/rules/openfga-recursive-tuple-evaluation-budget-guardrail?format=agents"}},{"id":"cilium-tetragon-bpf-lsm-escape-kill-standard","title":"Cilium Tetragon BPF-LSM Synchronous Container Escape Mitigation Standard","category":"security","severity":"critical","description":"Enforces synchronous kernel-level process termination using Tetragon TracingPolicies backed by BPF-LSM hooks whenever unauthorized namespace manipulation syscalls (e.g., setns, unshare) are invoked. Replaces asynchronous userspace audit-and-kill pipelines with in-kernel SIGKILL enforcement executed prior to namespace context swapping.","antiPatternHeadline":"Asynchronous Userspace Alerting and Non-Blocking Kprobe Hooks for Namespace Transitions","stars_count":93,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","ebpf","cilium-tetragon","bpf-lsm","container-security","kubernetes"],"exportEndpoints":{"claude":"/api/rules/cilium-tetragon-bpf-lsm-escape-kill-standard?format=claude","cursorMdc":"/api/rules/cilium-tetragon-bpf-lsm-escape-kill-standard?format=mdc","cursorrules":"/api/rules/cilium-tetragon-bpf-lsm-escape-kill-standard?format=cursor","windsurf":"/api/rules/cilium-tetragon-bpf-lsm-escape-kill-standard?format=windsurf","agents":"/api/rules/cilium-tetragon-bpf-lsm-escape-kill-standard?format=agents"}},{"id":"oci-1-1-referrers-cyclonedx-sbom-admission-policy","title":"OCI 1.1 Referrers Cryptographic CycloneDX SBOM Admission Guardrail","category":"devops","severity":"critical","description":"Enforces mandatory cryptographic verification of CycloneDX SBOM attestations attached natively via the OCI 1.1 Referrers API prior to workload admission. Blocks deployment of container images identified solely by mutable tags or lacking signed, schema-compliant SBOM attestations linked directly through the OCI subject manifest descriptor.","antiPatternHeadline":"Deploying Mutable Container Images Lacking Cryptographically Signed OCI 1.1 Referrer SBOMs","stars_count":61,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","oci-referrers","cyclonedx","sbom","supply-chain-security","admission-controller","cosign"],"exportEndpoints":{"claude":"/api/rules/oci-1-1-referrers-cyclonedx-sbom-admission-policy?format=claude","cursorMdc":"/api/rules/oci-1-1-referrers-cyclonedx-sbom-admission-policy?format=mdc","cursorrules":"/api/rules/oci-1-1-referrers-cyclonedx-sbom-admission-policy?format=cursor","windsurf":"/api/rules/oci-1-1-referrers-cyclonedx-sbom-admission-policy?format=windsurf","agents":"/api/rules/oci-1-1-referrers-cyclonedx-sbom-admission-policy?format=agents"}},{"id":"svelte-5-async-signal-tear-prevention","title":"Svelte 5 Runes Async Signal Tear Prevention Guardrail","category":"frontend","severity":"critical","description":"Prevents state tearing and non-deterministic dependency tracking across microtask turns in Svelte 5 fine-grained reactivity. Guarantees that $state signals mutate synchronously in atomic transactions or explicitly untracked contexts when crossing Promise boundaries. Mandates untrack() for reads after await within effects to prevent zombie listeners and inconsistent reactive graph transitions.","antiPatternHeadline":"Mutating and Reading $state Runes Across Microtask Continuations in Untracked $effect Lifecycles","stars_count":47,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["svelte","svelte-5","runes","signals","reactivity","async"],"exportEndpoints":{"claude":"/api/rules/svelte-5-async-signal-tear-prevention?format=claude","cursorMdc":"/api/rules/svelte-5-async-signal-tear-prevention?format=mdc","cursorrules":"/api/rules/svelte-5-async-signal-tear-prevention?format=cursor","windsurf":"/api/rules/svelte-5-async-signal-tear-prevention?format=windsurf","agents":"/api/rules/svelte-5-async-signal-tear-prevention?format=agents"}},{"id":"vite-6-ssr-modulerunner-isolated-realm-cleanup","title":"Vite 6 SSR ModuleRunner Isolated Realm Cleanup and Heap Invariant","category":"frontend","severity":"critical","description":"Enforces deterministic heap boundary teardown, explicit runner destruction, and cross-request cache eviction when utilizing Vite 6 Environment API and ModuleRunner. Prevents cascading memory leaks and cross-tenant state pollution caused by lingering module evaluations, unevicted module caches, and orphaned evaluation contexts in long-running development and edge SSR runtimes.","antiPatternHeadline":"Retaining persistent ModuleRunner instances across SSR request boundaries without realm teardown or explicit cache eviction.","stars_count":54,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["vite","vite-6","ssr","environment-api","module-runner","memory-management","v8-realms"],"exportEndpoints":{"claude":"/api/rules/vite-6-ssr-modulerunner-isolated-realm-cleanup?format=claude","cursorMdc":"/api/rules/vite-6-ssr-modulerunner-isolated-realm-cleanup?format=mdc","cursorrules":"/api/rules/vite-6-ssr-modulerunner-isolated-realm-cleanup?format=cursor","windsurf":"/api/rules/vite-6-ssr-modulerunner-isolated-realm-cleanup?format=windsurf","agents":"/api/rules/vite-6-ssr-modulerunner-isolated-realm-cleanup?format=agents"}},{"id":"go-chi-rfc-8470-early-data-anti-replay","title":"Go Chi RFC 8470 TLS 0-RTT Early-Data Anti-Replay Guardrail","category":"backend","severity":"critical","description":"Enforces RFC 8470 compliance on Go Chi routers by strictly fencing TLS 1.3 and QUIC 0-RTT early data against non-safe HTTP methods. Prevents replay-based state corruption and duplicate transactions on distributed HTTP/3 endpoints by deterministically terminating early requests with HTTP 425 Too Early.","antiPatternHeadline":"Permitting Non-Idempotent HTTP/3 0-RTT Early Data Execution Without RFC 8470 Fencing","stars_count":112,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","golang","chi","http3","quic","tls13","rfc8470","security"],"exportEndpoints":{"claude":"/api/rules/go-chi-rfc-8470-early-data-anti-replay?format=claude","cursorMdc":"/api/rules/go-chi-rfc-8470-early-data-anti-replay?format=mdc","cursorrules":"/api/rules/go-chi-rfc-8470-early-data-anti-replay?format=cursor","windsurf":"/api/rules/go-chi-rfc-8470-early-data-anti-replay?format=windsurf","agents":"/api/rules/go-chi-rfc-8470-early-data-anti-replay?format=agents"}},{"id":"postgres-17-jsontable-streaming-memory-ceiling","title":"Postgres 17 JSON_TABLE Virtual Tuple Streaming Memory Ceiling","category":"backend","severity":"critical","description":"Enforces strict memory ceilings and pagination bounds when executing SQL/JSON JSON_TABLE queries with nested path expansions in PostgreSQL 17. Unconstrained nested path evaluations generate unbounded in-memory virtual tuple projections that trigger Linux kernel OOM kills (SIGKILL) on containerized database backends.","antiPatternHeadline":"Unbounded Cartesian NESTED PATH expansions in JSON_TABLE buffering millions of virtual tuples into memory.","stars_count":69,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql-17","json-table","oom-prevention","memory-management","performance"],"exportEndpoints":{"claude":"/api/rules/postgres-17-jsontable-streaming-memory-ceiling?format=claude","cursorMdc":"/api/rules/postgres-17-jsontable-streaming-memory-ceiling?format=mdc","cursorrules":"/api/rules/postgres-17-jsontable-streaming-memory-ceiling?format=cursor","windsurf":"/api/rules/postgres-17-jsontable-streaming-memory-ceiling?format=windsurf","agents":"/api/rules/postgres-17-jsontable-streaming-memory-ceiling?format=agents"}},{"id":"bun-uds-zero-copy-socket-handoff","title":"Bun 1.2 Zero-Copy UDS Cluster Socket Handoff Standard","category":"backend","severity":"critical","description":"Mandates zero-copy socket file descriptor migration across multi-process worker pools in Bun 1.2 using Unix Domain Sockets and transferable native socket handles. Eliminates user-space IPC frame serialization, double-buffering, and primary-process event-loop saturation during high-throughput WebSocket ingress.","antiPatternHeadline":"Proxying WebSocket Byte Streams via IPC Pipes Instead of Delegating Underlying Sockets via UDS","stars_count":75,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","websockets","ipc","zero-copy","clustering","concurrency"],"exportEndpoints":{"claude":"/api/rules/bun-uds-zero-copy-socket-handoff?format=claude","cursorMdc":"/api/rules/bun-uds-zero-copy-socket-handoff?format=mdc","cursorrules":"/api/rules/bun-uds-zero-copy-socket-handoff?format=cursor","windsurf":"/api/rules/bun-uds-zero-copy-socket-handoff?format=windsurf","agents":"/api/rules/bun-uds-zero-copy-socket-handoff?format=agents"}},{"id":"kmp-swift-export-structured-concurrency-bridge-kotlin-multiplat-543","title":"Bidirectional Structured Concurrency and Cancellation Propagation in KMP Swift Export","category":"mobile","severity":"critical","description":"Enforces strict cooperative cancellation bridging between Kotlin Coroutines (Job/Deferred) and Swift Concurrency (Task/AsyncStream) across KMP Swift Export boundaries. Prevents uncollected Job leaks in Kotlin and unmanaged Task retain cycles in Swift by mandating explicit CancellationHandler attachments and DisposableHandle cleanup lifecycle management.","antiPatternHeadline":"Fire-and-forget Swift Task wrappers that orphan active Kotlin Coroutines upon Task cancellation","stars_count":119,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","swift-concurrency","coroutines","cancellation-propagation","memory-leaks"],"exportEndpoints":{"claude":"/api/rules/kmp-swift-export-structured-concurrency-bridge-kotlin-multiplat-543?format=claude","cursorMdc":"/api/rules/kmp-swift-export-structured-concurrency-bridge-kotlin-multiplat-543?format=mdc","cursorrules":"/api/rules/kmp-swift-export-structured-concurrency-bridge-kotlin-multiplat-543?format=cursor","windsurf":"/api/rules/kmp-swift-export-structured-concurrency-bridge-kotlin-multiplat-543?format=windsurf","agents":"/api/rules/kmp-swift-export-structured-concurrency-bridge-kotlin-multiplat-543?format=agents"}},{"id":"w3c-dbsc-hardware-bound-session-attestation-guardrail","title":"W3C Device Bound Session Credentials (DBSC) Hardware-Bound Attestation Guardrail","category":"security","severity":"critical","description":"Enforces W3C Device Bound Session Credentials (DBSC) to bind HTTP sessions to platform hardware security modules (Apple Secure Enclave, Windows TPM, Android StrongBox). Neutralizes session cookie exfiltration (infostealers, AiTM proxies) by requiring cryptographic proof-of-possession (PoP) signatures for session establishment, sensitive operations, and cookie refresh cycles. Rejects any session renewal or high-privilege action that relies purely on bearer cookies without verifying asymmetric hardware key signatures and nonce freshness.","antiPatternHeadline":"Unvalidated Bearer Token Refresh Permitting Exfiltrated Cookie Reuse Without Hardware Key Proof-of-Possession","stars_count":104,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","dbsc","tpm","secure-enclave","session-hijacking","zero-trust","cryptography"],"exportEndpoints":{"claude":"/api/rules/w3c-dbsc-hardware-bound-session-attestation-guardrail?format=claude","cursorMdc":"/api/rules/w3c-dbsc-hardware-bound-session-attestation-guardrail?format=mdc","cursorrules":"/api/rules/w3c-dbsc-hardware-bound-session-attestation-guardrail?format=cursor","windsurf":"/api/rules/w3c-dbsc-hardware-bound-session-attestation-guardrail?format=windsurf","agents":"/api/rules/w3c-dbsc-hardware-bound-session-attestation-guardrail?format=agents"}},{"id":"ietf-sd-jwt-nonce-replay-verification-standard","title":"IETF SD-JWT Key Binding Nonce & Digest Replay Prevention Guardrail","category":"security","severity":"critical","description":"Verifiers processing IETF SD-JWT presentations must enforce strict validation of Key Binding JWTs (KB-JWT), matching the presentation's sd_hash against the serialized SD-JWT disclosures and verifying a high-entropy, verifier-generated nonce via atomic single-use consumption. Failing to enforce ephemeral nonce lifecycle semantics exposes claim-level cryptographic digests to cross-verifier correlation attacks and replay forgery.","antiPatternHeadline":"Stateless or Permissive Key Binding Verification Allowing Replay of Disclosed Claim Digests","stars_count":114,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","sd-jwt","decentralized-identity","replay-prevention","cryptography","zero-trust"],"exportEndpoints":{"claude":"/api/rules/ietf-sd-jwt-nonce-replay-verification-standard?format=claude","cursorMdc":"/api/rules/ietf-sd-jwt-nonce-replay-verification-standard?format=mdc","cursorrules":"/api/rules/ietf-sd-jwt-nonce-replay-verification-standard?format=cursor","windsurf":"/api/rules/ietf-sd-jwt-nonce-replay-verification-standard?format=windsurf","agents":"/api/rules/ietf-sd-jwt-nonce-replay-verification-standard?format=agents"}},{"id":"opentelemetry-multi-agent-tool-call-context-lineage-invariant","title":"Deterministic OpenTelemetry Context Lineage Across Multi-Agent Tool Calls","category":"devops","severity":"critical","description":"Preserves distributed trace context and deterministic causal parentage across autonomous, non-deterministic agentic LLM tool execution graphs. Mandates explicit W3C TraceContext propagation across asynchronous dispatch loops, sub-agent handoffs, and side-effecting tool boundaries without relying on fragile thread-local or Node.js implicit AsyncLocalStorage boundaries.","antiPatternHeadline":"Orphaned spans and severed trace DAGs caused by ambient context loss in multi-agent tool loops","stars_count":86,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","distributed-tracing","multi-agent","w3c-trace-context","llm-observability"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-multi-agent-tool-call-context-lineage-invariant?format=claude","cursorMdc":"/api/rules/opentelemetry-multi-agent-tool-call-context-lineage-invariant?format=mdc","cursorrules":"/api/rules/opentelemetry-multi-agent-tool-call-context-lineage-invariant?format=cursor","windsurf":"/api/rules/opentelemetry-multi-agent-tool-call-context-lineage-invariant?format=windsurf","agents":"/api/rules/opentelemetry-multi-agent-tool-call-context-lineage-invariant?format=agents"}},{"id":"ebpf-ringbuf-backpressure-invariant","title":"Kernel eBPF RingBuffer Allocation and Consumer Backpressure Bounding","category":"devops","severity":"critical","description":"Enforces strict memory isolation, zero-allocation safety, and non-blocking backpressure contracts across kernel-to-userspace eBPF RingBuffer pipelines. Prohibits silent telemetry drops by mandating atomic per-CPU counter accounting on buffer starvation and enforces adaptive userspace wakeup thresholds to prevent CPU exhaustion.","antiPatternHeadline":"Unchecked RingBuffer Reservations and Silent Drop Telemetry Starvation Under Consumer Lag","stars_count":116,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","linux-kernel","observability","backpressure","telemetry"],"exportEndpoints":{"claude":"/api/rules/ebpf-ringbuf-backpressure-invariant?format=claude","cursorMdc":"/api/rules/ebpf-ringbuf-backpressure-invariant?format=mdc","cursorrules":"/api/rules/ebpf-ringbuf-backpressure-invariant?format=cursor","windsurf":"/api/rules/ebpf-ringbuf-backpressure-invariant?format=windsurf","agents":"/api/rules/ebpf-ringbuf-backpressure-invariant?format=agents"}},{"id":"openfga-zanzibar-cycle-depth-fencing-standard","title":"OpenFGA Zanzibar Relation Cycle & Depth Fencing Standard","category":"security","severity":"critical","description":"Enforces strict traversal-depth caps and non-reentrant visited-set circuit breakers across recursive Zanzibar relationship graph evaluations. Prevents catastrophic denial of service (DoS), infinite cycle loops, and thread starvation in authorization checks across nested organizational and resource hierarchies. Guarantees deterministic, sub-millisecond access evaluation bounds through defensive client-side fences and OpenFGA query resolution ceilings.","antiPatternHeadline":"Unbounded Recursive Graph Traversal and Cyclic Group Resolution Causing Authorization Exhaustion","stars_count":91,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","authorization","zanzibar","rebac","graph-theory"],"exportEndpoints":{"claude":"/api/rules/openfga-zanzibar-cycle-depth-fencing-standard?format=claude","cursorMdc":"/api/rules/openfga-zanzibar-cycle-depth-fencing-standard?format=mdc","cursorrules":"/api/rules/openfga-zanzibar-cycle-depth-fencing-standard?format=cursor","windsurf":"/api/rules/openfga-zanzibar-cycle-depth-fencing-standard?format=windsurf","agents":"/api/rules/openfga-zanzibar-cycle-depth-fencing-standard?format=agents"}},{"id":"postgres-17-async-direct-io-ring-buffer-tuning","title":"Postgres 17 Direct I/O Ring Buffer and Async Read-Ahead Concurrency Tuning","category":"backend","severity":"critical","description":"Postgres 17 deployments on enterprise NVMe tiers must explicitly configure Direct I/O (`io_direct`) and tune vectorized asynchronous read-ahead ring buffers to eliminate OS page cache double-buffering. Unbounded asynchronous I/O concurrency or unaligned buffer allocations saturate NVMe submission queues and trigger kernel lock contention during sequential scans and bulk operations. Applications and infrastructure automation must enforce sector-aligned block sizes, bounded `io_combine_limit`, and constrained worker ring buffers.","antiPatternHeadline":"Unbounded Async Read-Ahead and Unaligned Direct I/O Ring Buffers Inducing NVMe Queue Saturation","stars_count":93,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres-17","direct-io","nvme","performance","storage-engine"],"exportEndpoints":{"claude":"/api/rules/postgres-17-async-direct-io-ring-buffer-tuning?format=claude","cursorMdc":"/api/rules/postgres-17-async-direct-io-ring-buffer-tuning?format=mdc","cursorrules":"/api/rules/postgres-17-async-direct-io-ring-buffer-tuning?format=cursor","windsurf":"/api/rules/postgres-17-async-direct-io-ring-buffer-tuning?format=windsurf","agents":"/api/rules/postgres-17-async-direct-io-ring-buffer-tuning?format=agents"}},{"id":"vite-6-environment-api-runtime-scope-fencing","title":"Vite 6 Environment API Runtime Scope Fencing and Realm Isolation","category":"frontend","severity":"critical","description":"Enforces strict module execution graph isolation and condition boundaries across distinct client, server (Node.js), and edge runtime realms using Vite 6 Environment API. Prevents silent SSR secret exfiltration, invalid cross-realm tree-shaking, and global pollution caused by deprecated ssrLoadModule invocation and shared module runners.","antiPatternHeadline":"Leaking SSR secrets and cross-realm globals via legacy ssrLoadModule and unfenced Vite environment graphs","stars_count":93,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","vite6","ssr","security","environment-api","module-graph"],"exportEndpoints":{"claude":"/api/rules/vite-6-environment-api-runtime-scope-fencing?format=claude","cursorMdc":"/api/rules/vite-6-environment-api-runtime-scope-fencing?format=mdc","cursorrules":"/api/rules/vite-6-environment-api-runtime-scope-fencing?format=cursor","windsurf":"/api/rules/vite-6-environment-api-runtime-scope-fencing?format=windsurf","agents":"/api/rules/vite-6-environment-api-runtime-scope-fencing?format=agents"}},{"id":"kmp-swift-concurrency-cooperative-cancellation-bridge","title":"Kotlin Multiplatform Swift Concurrency Cooperative Cancellation Invariant","category":"mobile","severity":"critical","description":"Mandates bidirectional cooperative cancellation across the Swift-to-Kotlin Native C-interop boundary. Every Swift Task consuming Kotlin Coroutine suspend functions or Flows must bind its lifecycle to the underlying Kotlin Job via withTaskCancellationHandler to guarantee deterministic teardown of unmanaged native allocations and background workloads.","antiPatternHeadline":"Orphaned Kotlin Coroutine Jobs and Leaked Native Memory via Naive Swift Async Bridging","stars_count":97,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kmp","kotlin-multiplatform","swift-concurrency","coroutines","ios"],"exportEndpoints":{"claude":"/api/rules/kmp-swift-concurrency-cooperative-cancellation-bridge?format=claude","cursorMdc":"/api/rules/kmp-swift-concurrency-cooperative-cancellation-bridge?format=mdc","cursorrules":"/api/rules/kmp-swift-concurrency-cooperative-cancellation-bridge?format=cursor","windsurf":"/api/rules/kmp-swift-concurrency-cooperative-cancellation-bridge?format=windsurf","agents":"/api/rules/kmp-swift-concurrency-cooperative-cancellation-bridge?format=agents"}},{"id":"ebpf-xdp-lru-syn-flood-guardrail","title":"eBPF XDP In-Kernel LRU Map SYN-Flood Mitigation Guardrail","category":"devops","severity":"critical","description":"Enforces early L4 packet filtering directly in the network driver layer via eBPF XDP before Linux kernel sk_buff allocation. Mandates bounded BPF_MAP_TYPE_LRU_HASH tables and verifier-compliant pointer bounds checks to drop volumetric spoofed SYN floods at line rate without exhausting host kernel memory.","antiPatternHeadline":"Deferred Userspace Filtering and Unbounded BPF Hash Maps Under SYN Floods","stars_count":51,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","xdp","ddos","networking","kernel","security"],"exportEndpoints":{"claude":"/api/rules/ebpf-xdp-lru-syn-flood-guardrail?format=claude","cursorMdc":"/api/rules/ebpf-xdp-lru-syn-flood-guardrail?format=mdc","cursorrules":"/api/rules/ebpf-xdp-lru-syn-flood-guardrail?format=cursor","windsurf":"/api/rules/ebpf-xdp-lru-syn-flood-guardrail?format=windsurf","agents":"/api/rules/ebpf-xdp-lru-syn-flood-guardrail?format=agents"}},{"id":"capacitor-7-background-runner-task-lifecycle-isolation","title":"Capacitor 7 Background Runner Headless Task Lifecycle Isolation","category":"mobile","severity":"critical","description":"Enforces strict memory isolation, bounded execution timeouts, and state teardown for Capacitor 7 Background Runner headless JavaScript tasks. Prevents iOS Watchdog terminations (0x8badf00d) and Android ANR or Battery Historian broadcast receiver timeouts by isolating worker contexts and enforcing finite execution limits.","antiPatternHeadline":"Unbounded Asynchronous Execution and Shared Memory Leaks in Capacitor Background Runner","stars_count":92,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","background-runner","ios","android","battery-optimization","memory-leak"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-background-runner-task-lifecycle-isolation?format=claude","cursorMdc":"/api/rules/capacitor-7-background-runner-task-lifecycle-isolation?format=mdc","cursorrules":"/api/rules/capacitor-7-background-runner-task-lifecycle-isolation?format=cursor","windsurf":"/api/rules/capacitor-7-background-runner-task-lifecycle-isolation?format=windsurf","agents":"/api/rules/capacitor-7-background-runner-task-lifecycle-isolation?format=agents"}},{"id":"go-synctest-deterministic-concurrency-testing","title":"Go 1.24 synctest Virtual Clock Concurrency Standard","category":"backend","severity":"critical","description":"Enforces deterministic testing of concurrent and time-sensitive Go backend code using Go 1.24's testing/synctest package. Prevents test flakiness, wall-clock sleeps, and unbounded async polling by executing goroutine topologies inside isolated synthetic bubbles with instant virtual time advancement.","antiPatternHeadline":"Relying on arbitrary wall-clock time.Sleep and flaky poll loops for concurrent synchronization","stars_count":84,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","golang","go124","synctest","concurrency","testing","deterministic"],"exportEndpoints":{"claude":"/api/rules/go-synctest-deterministic-concurrency-testing?format=claude","cursorMdc":"/api/rules/go-synctest-deterministic-concurrency-testing?format=mdc","cursorrules":"/api/rules/go-synctest-deterministic-concurrency-testing?format=cursor","windsurf":"/api/rules/go-synctest-deterministic-concurrency-testing?format=windsurf","agents":"/api/rules/go-synctest-deterministic-concurrency-testing?format=agents"}},{"id":"opentelemetry-inbound-baggage-scrubbing-guardrail","title":"OpenTelemetry Inbound W3C Baggage Scrubbing and Size Partitioning Standard","category":"devops","severity":"critical","description":"Mandates strict allowlisting, key-level length validation, and cumulative payload size partitioning for incoming W3C Baggage in distributed tracing setups. Prevents cross-tenant context injection, metadata privilege escalation, and downstream HTTP 431 (Request Header Fields Too Large) outages caused by unconstrained baggage propagation across trust boundaries.","antiPatternHeadline":"Blind Inbound Baggage Passthrough Causing Header Poisoning and Downgrade Overflows","stars_count":101,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","distributed-tracing","w3c-baggage","security","context-propagation"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-inbound-baggage-scrubbing-guardrail?format=claude","cursorMdc":"/api/rules/opentelemetry-inbound-baggage-scrubbing-guardrail?format=mdc","cursorrules":"/api/rules/opentelemetry-inbound-baggage-scrubbing-guardrail?format=cursor","windsurf":"/api/rules/opentelemetry-inbound-baggage-scrubbing-guardrail?format=windsurf","agents":"/api/rules/opentelemetry-inbound-baggage-scrubbing-guardrail?format=agents"}},{"id":"tauri-v2-dynamic-ipc-canonical-path-resolution","title":"Tauri 2.0 Dynamic IPC Capability Canonical Path Resolution","category":"security","severity":"critical","description":"Enforces strict canonical path resolution and cryptographically verified runtime scope enforcement for Tauri 2.0 IPC invocations involving filesystem access. Eliminates symlink-based path traversal and Time-of-Check to Time-of-Use (TOCTOU) exploits by validating fully resolved, real canonical paths against authorized capability scopes on the Rust backend prior to executing any file I/O operations.","antiPatternHeadline":"Trusting Raw Frontend-Supplied File Paths in Tauri IPC Commands Without Backend Canonicalization and Scope Re-Verification","stars_count":53,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","tauri-2","ipc","path-traversal","symlinks","rust"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-dynamic-ipc-canonical-path-resolution?format=claude","cursorMdc":"/api/rules/tauri-v2-dynamic-ipc-canonical-path-resolution?format=mdc","cursorrules":"/api/rules/tauri-v2-dynamic-ipc-canonical-path-resolution?format=cursor","windsurf":"/api/rules/tauri-v2-dynamic-ipc-canonical-path-resolution?format=windsurf","agents":"/api/rules/tauri-v2-dynamic-ipc-canonical-path-resolution?format=agents"}},{"id":"webauthn-passkey-device-binding-downgrade-prevention","title":"WebAuthn Bound Device-State Verification & Downgrade Prevention","category":"security","severity":"critical","description":"Enforces strict server-side validation of WebAuthn authenticator data bitwise flags (User Presence, User Verification, Backup State) during step-up and high-assurance transactions. Prohibits silent downgrade or exception-driven fallback to phishing-susceptible legacy factors (e.g., SMS OTP, standard TOTP) once a bound credential has been enrolled.","antiPatternHeadline":"Silent Fallback to Phishing-Susceptible Factors and Unchecked Authenticator Flag Bitmasks","stars_count":116,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","fido2","passkeys","authentication","cryptography"],"exportEndpoints":{"claude":"/api/rules/webauthn-passkey-device-binding-downgrade-prevention?format=claude","cursorMdc":"/api/rules/webauthn-passkey-device-binding-downgrade-prevention?format=mdc","cursorrules":"/api/rules/webauthn-passkey-device-binding-downgrade-prevention?format=cursor","windsurf":"/api/rules/webauthn-passkey-device-binding-downgrade-prevention?format=windsurf","agents":"/api/rules/webauthn-passkey-device-binding-downgrade-prevention?format=agents"}},{"id":"svelte-5-runes-effect-teardown-standard","title":"Svelte 5 Runes Reactive Effect Teardown and Boundary Invariant","category":"frontend","severity":"critical","description":"Enforces strict disposal mechanics and teardown callbacks for root-level and asynchronous $effect executions within dynamic microfrontend architectures. In dynamically unmounted host boundaries, unhandled $effect triggers and nested asynchronous subscriptions bypass automatic component garbage collection, causing catastrophic heap leaks and detached DOM node retention. All asynchronous observables, EventTarget listeners, and polling loops initialized inside $effect blocks must return synchronous teardown functions or execute inside explicit $effect.root wrappers.","antiPatternHeadline":"Dangling Root $effect Subscriptions and Missing Synchronous Teardowns in Dynamic Mounts","stars_count":43,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","microfrontends","memory-leaks"],"exportEndpoints":{"claude":"/api/rules/svelte-5-runes-effect-teardown-standard?format=claude","cursorMdc":"/api/rules/svelte-5-runes-effect-teardown-standard?format=mdc","cursorrules":"/api/rules/svelte-5-runes-effect-teardown-standard?format=cursor","windsurf":"/api/rules/svelte-5-runes-effect-teardown-standard?format=windsurf","agents":"/api/rules/svelte-5-runes-effect-teardown-standard?format=agents"}},{"id":"react-19-server-actions-idempotency-key-barrier","title":"React 19 Server Actions Idempotency Key Barrier Standard","category":"frontend","severity":"critical","description":"Enforces deterministic client-generated mutation tokens across React 19 optimistic transitions and server action invocations. Guarantees that transient cellular network dropouts, automated browser retries, and rapid multi-tap events do not cause duplicate backend execution, double charges, or inconsistent state transitions.","antiPatternHeadline":"Unbounded Server Action Invocation Without Deterministic Client Mutation Tokens","stars_count":49,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","server-actions","idempotency","optimistic-ui","network-resilience"],"exportEndpoints":{"claude":"/api/rules/react-19-server-actions-idempotency-key-barrier?format=claude","cursorMdc":"/api/rules/react-19-server-actions-idempotency-key-barrier?format=mdc","cursorrules":"/api/rules/react-19-server-actions-idempotency-key-barrier?format=cursor","windsurf":"/api/rules/react-19-server-actions-idempotency-key-barrier?format=windsurf","agents":"/api/rules/react-19-server-actions-idempotency-key-barrier?format=agents"}},{"id":"fastapi-pydantic-v2-streaming-memory-ceiling-standard","title":"FastAPI Pydantic V2 Streaming Memory Ceiling and Zero-Allocation Invariant","category":"backend","severity":"critical","description":"Establishes a bounded O(1) memory envelope for FastAPI endpoints streaming unbounded NDJSON and SSE payloads. Mandates cursor-driven async generators utilizing direct byte serialization via Pydantic V2 TypeAdapter to eliminate full-graph heap allocations and prevent Linux OOM-killer terminations under high-concurrency streams.","antiPatternHeadline":"Buffering Unbounded Datasets and Materializing Full Model Graphs in StreamingResponse","stars_count":44,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","pydantic-v2","streaming","memory-leak","performance"],"exportEndpoints":{"claude":"/api/rules/fastapi-pydantic-v2-streaming-memory-ceiling-standard?format=claude","cursorMdc":"/api/rules/fastapi-pydantic-v2-streaming-memory-ceiling-standard?format=mdc","cursorrules":"/api/rules/fastapi-pydantic-v2-streaming-memory-ceiling-standard?format=cursor","windsurf":"/api/rules/fastapi-pydantic-v2-streaming-memory-ceiling-standard?format=windsurf","agents":"/api/rules/fastapi-pydantic-v2-streaming-memory-ceiling-standard?format=agents"}},{"id":"go-chi-http3-0rtt-anti-replay-fence","title":"Go Chi HTTP/3 0-RTT Anti-Replay Idempotency Fence Guardrail","category":"backend","severity":"critical","description":"Enforces deterministic early-data rejection and atomic idempotency fencing for HTTP/3 QUIC 0-RTT handshakes in Go Chi services. Unfenced early data allows network-level replay attacks against non-idempotent endpoints before TLS 1.3 handshake finalization. All mutating Chi routes must emit HTTP 425 (Too Early) or validate against an atomic linearizable token fence prior to execution.","antiPatternHeadline":"Executing Mutating State Operations over HTTP/3 0-RTT Early Data Without Replay Detection","stars_count":106,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","chi","http3","quic","0-rtt","idempotency","anti-replay","security"],"exportEndpoints":{"claude":"/api/rules/go-chi-http3-0rtt-anti-replay-fence?format=claude","cursorMdc":"/api/rules/go-chi-http3-0rtt-anti-replay-fence?format=mdc","cursorrules":"/api/rules/go-chi-http3-0rtt-anti-replay-fence?format=cursor","windsurf":"/api/rules/go-chi-http3-0rtt-anti-replay-fence?format=windsurf","agents":"/api/rules/go-chi-http3-0rtt-anti-replay-fence?format=agents"}},{"id":"tauri-v2-mobile-multi-origin-capability-scope-isolation","title":"Tauri 2.0 Mobile Multi-Origin Capability Scope Isolation and IPC Boundary Enforcement","category":"mobile","severity":"critical","description":"Enforces strict origin-to-capability boundary isolation in Tauri 2.0 mobile architectures. Prevents privilege escalation and unauthorized native device API invocation by segregating remote webview contexts from local application bundles through fine-grained capability descriptors and remote URL pinning.","antiPatternHeadline":"Assigning Overly Permissive Wildcard Capabilities to Remote Webview Contexts Leaking Device APIs","stars_count":69,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri","tauri-v2","security","ipc","capabilities","permissions"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-mobile-multi-origin-capability-scope-isolation?format=claude","cursorMdc":"/api/rules/tauri-v2-mobile-multi-origin-capability-scope-isolation?format=mdc","cursorrules":"/api/rules/tauri-v2-mobile-multi-origin-capability-scope-isolation?format=cursor","windsurf":"/api/rules/tauri-v2-mobile-multi-origin-capability-scope-isolation?format=windsurf","agents":"/api/rules/tauri-v2-mobile-multi-origin-capability-scope-isolation?format=agents"}},{"id":"kmp-sqldelight-wal-read-pool-invariant","title":"KMP SQLDelight SQLite WAL Multi-Threaded Read-Pool and Affinity Invariant","category":"mobile","severity":"critical","description":"Enforces strict background thread affinity, single-writer confinement, and bounded multi-threaded read-pool leasing in Kotlin Multiplatform (KMP) SQLDelight when operating in SQLite Write-Ahead Logging (WAL) mode. Prevents SQLITE_BUSY, SQLITE_LOCKED, and POSIX thread-affinity deadlocks across concurrent iOS (NativeSqliteDriver) and Android (AndroidSqliteDriver) background coroutines. Guarantees non-blocking concurrent reads while isolating transactional mutations to an explicit serialized dispatcher.","antiPatternHeadline":"Global Unbounded Driver Access with Unsynchronized Concurrent Reads and Mutating Transactions on Unconfined Coroutine Dispatchers","stars_count":80,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","sqldelight","sqlite-wal","concurrency","ios","android"],"exportEndpoints":{"claude":"/api/rules/kmp-sqldelight-wal-read-pool-invariant?format=claude","cursorMdc":"/api/rules/kmp-sqldelight-wal-read-pool-invariant?format=mdc","cursorrules":"/api/rules/kmp-sqldelight-wal-read-pool-invariant?format=cursor","windsurf":"/api/rules/kmp-sqldelight-wal-read-pool-invariant?format=windsurf","agents":"/api/rules/kmp-sqldelight-wal-read-pool-invariant?format=agents"}},{"id":"openfga-cdc-consistency-barrier-guardrail","title":"OpenFGA CDC Eventual Consistency Barrier & Contextual Fencing","category":"security","severity":"critical","description":"Enforces transactional fencing tokens and contextual tuple injection during authorization checks in distributed CQRS architectures. Prevents stale authorization exploits and unauthorized window execution caused by Change Data Capture (CDC) replication lag between the write model and OpenFGA tuple stores.","antiPatternHeadline":"Unfenced OpenFGA Authorization Checks Subject to Asynchronous CDC Replication Lag","stars_count":59,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","authorization","cqrs","cdc","distributed-systems","consistency"],"exportEndpoints":{"claude":"/api/rules/openfga-cdc-consistency-barrier-guardrail?format=claude","cursorMdc":"/api/rules/openfga-cdc-consistency-barrier-guardrail?format=mdc","cursorrules":"/api/rules/openfga-cdc-consistency-barrier-guardrail?format=cursor","windsurf":"/api/rules/openfga-cdc-consistency-barrier-guardrail?format=windsurf","agents":"/api/rules/openfga-cdc-consistency-barrier-guardrail?format=agents"}},{"id":"webauthn-hybrid-transport-ble-proximity-boundary","title":"WebAuthn Hybrid Transport Cross-Device BLE Proximity and Channel-Binding Guardrail","category":"security","severity":"critical","description":"Enforces strict proximity and cryptographic channel-binding verification for WebAuthn hybrid transport (caBLE / QR code cross-device flows). Defeats hybrid Adversary-in-the-Middle (AitM) phishing proxies by validating authenticator data flags, immutable RP ID hashes, ephemeral session key bindings, and transport-layer attestation boundaries.","antiPatternHeadline":"Accepting Relayed Hybrid QR Assertions Without Strict Origin Pinning and Ephemeral Channel Binding","stars_count":71,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","passkeys","hybrid-transport","cable","fido2","anti-phishing"],"exportEndpoints":{"claude":"/api/rules/webauthn-hybrid-transport-ble-proximity-boundary?format=claude","cursorMdc":"/api/rules/webauthn-hybrid-transport-ble-proximity-boundary?format=mdc","cursorrules":"/api/rules/webauthn-hybrid-transport-ble-proximity-boundary?format=cursor","windsurf":"/api/rules/webauthn-hybrid-transport-ble-proximity-boundary?format=windsurf","agents":"/api/rules/webauthn-hybrid-transport-ble-proximity-boundary?format=agents"}},{"id":"otel-ebpf-tracecontext-injection-guardrail","title":"Deterministic W3C TraceContext eBPF Socket Buffer Injection Standard","category":"devops","severity":"critical","description":"Mandates protocol-aware boundary verification, safe socket buffer expansion, and L4 checksum reconciliation when injecting W3C TraceContext headers into uninstrumented egress traffic via eBPF programs. Prevents TCP sequence desynchronization, kernel memory faults, and payload corruption across legacy egress streams bridging to OpenTelemetry fabrics.","antiPatternHeadline":"Blind TCP Payload Splicing Without L4 Checksum Recalculation or Stream Boundary Verification","stars_count":56,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","ebpf","networking","tracing"],"exportEndpoints":{"claude":"/api/rules/otel-ebpf-tracecontext-injection-guardrail?format=claude","cursorMdc":"/api/rules/otel-ebpf-tracecontext-injection-guardrail?format=mdc","cursorrules":"/api/rules/otel-ebpf-tracecontext-injection-guardrail?format=cursor","windsurf":"/api/rules/otel-ebpf-tracecontext-injection-guardrail?format=windsurf","agents":"/api/rules/otel-ebpf-tracecontext-injection-guardrail?format=agents"}},{"id":"cilium-ebpf-wireguard-mtu-clamping-invariant","title":"Cilium eBPF Host Routing WireGuard MTU Clamping & Encapsulation Invariant","category":"devops","severity":"critical","description":"Mandates explicit encapsulation headroom deduction, eBPF TCP MSS clamping, and interface MTU parity in Cilium deployments running eBPF host routing with transparent WireGuard encryption. This invariant eliminates silent PMTU blackholes, packet drop storms during TLS handshakes, and unrecoverable throughput degradation caused by eBPF bypass of netfilter MSS clamping.","antiPatternHeadline":"Default 1500 MTU with Transparent WireGuard and eBPF Host Routing Bypassing Netfilter Clamping","stars_count":53,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","cilium","ebpf","wireguard","kubernetes","networking","mtu"],"exportEndpoints":{"claude":"/api/rules/cilium-ebpf-wireguard-mtu-clamping-invariant?format=claude","cursorMdc":"/api/rules/cilium-ebpf-wireguard-mtu-clamping-invariant?format=mdc","cursorrules":"/api/rules/cilium-ebpf-wireguard-mtu-clamping-invariant?format=cursor","windsurf":"/api/rules/cilium-ebpf-wireguard-mtu-clamping-invariant?format=windsurf","agents":"/api/rules/cilium-ebpf-wireguard-mtu-clamping-invariant?format=agents"}},{"id":"kmp-swift-export-arc-boundary-governor","title":"Kotlin Multiplatform 2.1 Swift-Export ARC & Coroutine Lifecycle Boundary Governor","category":"mobile","severity":"critical","description":"Governs interop memory safety across Kotlin/Native GC and Swift ARC when consuming stateful asynchronous flows and coroutines via Swift-Export. Enforces explicit lifecycle detachment, structured cancellation propagation, and weak closure binding to prevent cross-runtime retain cycles and unbounded coroutine execution.","antiPatternHeadline":"Unbounded Coroutine Scope Rooting and Cross-Runtime Strong Retain Cycles Across Swift-Export Boundaries","stars_count":49,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kmp","kotlin-native","swift-export","arc","coroutines","ios","memory-management"],"exportEndpoints":{"claude":"/api/rules/kmp-swift-export-arc-boundary-governor?format=claude","cursorMdc":"/api/rules/kmp-swift-export-arc-boundary-governor?format=mdc","cursorrules":"/api/rules/kmp-swift-export-arc-boundary-governor?format=cursor","windsurf":"/api/rules/kmp-swift-export-arc-boundary-governor?format=windsurf","agents":"/api/rules/kmp-swift-export-arc-boundary-governor?format=agents"}},{"id":"opentelemetry-span-link-sampling-async-saga","title":"OpenTelemetry W3C Span Link Invariant for Decoupled Asynchronous Saga Tracing","category":"devops","severity":"critical","description":"Enforces causal trace lineage decoupling in asynchronous sagas by mandating OpenTelemetry W3C span links over direct parent-child span propagation. This prevents runaway trace cascades and downstream APM storage quota exhaustion while preserving distributed provenance across message brokers.","antiPatternHeadline":"Direct Child Span Inheritance Across Asynchronous Message Boundaries Causing APM Quota Blowout","stars_count":80,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","distributed-tracing","event-driven","kafka","sagas","observability"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-span-link-sampling-async-saga?format=claude","cursorMdc":"/api/rules/opentelemetry-span-link-sampling-async-saga?format=mdc","cursorrules":"/api/rules/opentelemetry-span-link-sampling-async-saga?format=cursor","windsurf":"/api/rules/opentelemetry-span-link-sampling-async-saga?format=windsurf","agents":"/api/rules/opentelemetry-span-link-sampling-async-saga?format=agents"}},{"id":"capacitor7-biometric-secure-enclave-key-derivation","title":"Capacitor 7 Biometric Secure Enclave Key Derivation & Non-Exportability Invariant","category":"mobile","severity":"critical","description":"Enforces that cryptographic client credentials in Capacitor 7 hybrid applications are generated directly within hardware-isolated subsystems (Apple Secure Enclave and Android Hardware-backed Keystore) protected by biometric access-control flags (`kSecAccessControlBiometryAny` / `UserAuthenticationValidityDurationSeconds`). Strictly forbids JavaScript-layer key derivation, runtime exportability, or in-memory persistence of raw keys across WKWebView or Android WebView process terminations and reloads.","antiPatternHeadline":"Exporting or Deriving Cryptographic Private Keys in WebCore/V8 JavaScript Memory Instead of Hardware-Isolated Enclave Signing","stars_count":98,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","biometrics","secure-enclave","cryptography","security","ios","android"],"exportEndpoints":{"claude":"/api/rules/capacitor7-biometric-secure-enclave-key-derivation?format=claude","cursorMdc":"/api/rules/capacitor7-biometric-secure-enclave-key-derivation?format=mdc","cursorrules":"/api/rules/capacitor7-biometric-secure-enclave-key-derivation?format=cursor","windsurf":"/api/rules/capacitor7-biometric-secure-enclave-key-derivation?format=windsurf","agents":"/api/rules/capacitor7-biometric-secure-enclave-key-derivation?format=agents"}},{"id":"react-19-action-transition-concurrent-abort-governor","title":"React 19 Action Transition Cascading Abort Governor","category":"frontend","severity":"critical","description":"Enforces deterministic cancellation and cleanup of interrupted React 19 Action transitions by binding monotonic sequence IDs and cascading AbortController signals to every concurrent Server Action execution. Guarantees that fast-following user actions preempt and immediately abort in-flight asynchronous operations, preventing stale out-of-order mutations from clobbering concurrent optimistic state transitions.","antiPatternHeadline":"Un-aborted Interrupted Server Actions Mutating State and Clashing with Optimistic Updates","stars_count":100,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","transitions","use-optimistic","abort-controller","concurrency","server-actions"],"exportEndpoints":{"claude":"/api/rules/react-19-action-transition-concurrent-abort-governor?format=claude","cursorMdc":"/api/rules/react-19-action-transition-concurrent-abort-governor?format=mdc","cursorrules":"/api/rules/react-19-action-transition-concurrent-abort-governor?format=cursor","windsurf":"/api/rules/react-19-action-transition-concurrent-abort-governor?format=windsurf","agents":"/api/rules/react-19-action-transition-concurrent-abort-governor?format=agents"}},{"id":"axum-0-8-tower-load-shedding-backpressure-invariant","title":"Axum 0.8 Tower Service Load-Shedding Backpressure Invariant","category":"backend","severity":"critical","description":"Protects Tokio work-stealing thread pools from executor saturation by enforcing bounded buffer drop policies before request deserialization. Mandates placement of Tower load shedding and concurrency limit layers at the outermost edge of Axum 0.8 routers with explicit 503 Service Unavailable mapping.","antiPatternHeadline":"Deserializing Payloads or Buffering In-Flight Requests Without Upstream Edge Load-Shedding","stars_count":57,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tokio","tower","concurrency"],"exportEndpoints":{"claude":"/api/rules/axum-0-8-tower-load-shedding-backpressure-invariant?format=claude","cursorMdc":"/api/rules/axum-0-8-tower-load-shedding-backpressure-invariant?format=mdc","cursorrules":"/api/rules/axum-0-8-tower-load-shedding-backpressure-invariant?format=cursor","windsurf":"/api/rules/axum-0-8-tower-load-shedding-backpressure-invariant?format=windsurf","agents":"/api/rules/axum-0-8-tower-load-shedding-backpressure-invariant?format=agents"}},{"id":"webauthn-prf-zk-client-key-derivation-standard","title":"WebAuthn PRF Extension Zero-Knowledge Client Key Derivation Standard","category":"security","severity":"critical","description":"Mandates strict zero-knowledge client-side key derivation from WebAuthn PRF (pseudo-random function) extension outputs. Enforces fail-closed validation for non-supporting authenticators, memory zeroization of raw PRF output buffers, non-extractable WebCrypto key imports, and explicit exclusion of cryptographic derivation artifacts from relying party network payloads.","antiPatternHeadline":"Exfiltrating PRF Output to Relying Party Servers or Storing Extractable Master Key Material in Persistent Client Storage","stars_count":66,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","prf-extension","zero-knowledge","cryptography","webcrypto"],"exportEndpoints":{"claude":"/api/rules/webauthn-prf-zk-client-key-derivation-standard?format=claude","cursorMdc":"/api/rules/webauthn-prf-zk-client-key-derivation-standard?format=mdc","cursorrules":"/api/rules/webauthn-prf-zk-client-key-derivation-standard?format=cursor","windsurf":"/api/rules/webauthn-prf-zk-client-key-derivation-standard?format=windsurf","agents":"/api/rules/webauthn-prf-zk-client-key-derivation-standard?format=agents"}},{"id":"arrow-flight-sql-contiguous-memory-alignment","title":"Arrow Flight SQL Zero-Copy Contiguous Memory Alignment Invariant","category":"backend","severity":"critical","description":"Arrow Flight SQL exchanges IPC RecordBatches across distributed analytical runtimes via gRPC streams. To guarantee true zero-copy data transfer and prevent costly deserialization overhead or SIMD bus errors, all exported and ingested Arrow buffers must strictly conform to 64-byte memory boundary alignments and continuous contiguous layouts. Any misaligned slice or intermediary buffer copy destroys query execution speed and breaks the distributed memory fabric.","antiPatternHeadline":"Unaligned Buffer Slicing and Row-Level Serialization in Arrow Flight SQL Endpoints","stars_count":72,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","apache-arrow","flight-sql","zero-copy","memory-alignment","ipc","simd"],"exportEndpoints":{"claude":"/api/rules/arrow-flight-sql-contiguous-memory-alignment?format=claude","cursorMdc":"/api/rules/arrow-flight-sql-contiguous-memory-alignment?format=mdc","cursorrules":"/api/rules/arrow-flight-sql-contiguous-memory-alignment?format=cursor","windsurf":"/api/rules/arrow-flight-sql-contiguous-memory-alignment?format=windsurf","agents":"/api/rules/arrow-flight-sql-contiguous-memory-alignment?format=agents"}},{"id":"svelte-5-universal-runes-ssr-isolation","title":"Svelte 5 Universal Runes SSR Request-State Isolation Guardrail","category":"frontend","severity":"critical","description":"Enforces strict request-scoped lifecycle boundaries for Svelte 5 universal runes ($state, $derived) within server-side rendering (SSR) environments. Prevents module-level reactive singletons from retaining and leaking cross-tenant state, session tokens, or user data across concurrent Node.js/Edge render cycles. Mandates that all universal rune state containers are bound to component tree contexts or request lifecycles.","antiPatternHeadline":"Exporting Module-Level Universal Rune Singletons in .svelte.ts Files During SSR","stars_count":75,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","ssr","multi-tenant","security","state-management"],"exportEndpoints":{"claude":"/api/rules/svelte-5-universal-runes-ssr-isolation?format=claude","cursorMdc":"/api/rules/svelte-5-universal-runes-ssr-isolation?format=mdc","cursorrules":"/api/rules/svelte-5-universal-runes-ssr-isolation?format=cursor","windsurf":"/api/rules/svelte-5-universal-runes-ssr-isolation?format=windsurf","agents":"/api/rules/svelte-5-universal-runes-ssr-isolation?format=agents"}},{"id":"ebpf-tc-pod-egress-segmentation-invariant","title":"Linux eBPF TC Egress Packet Classification & Segmentation Invariant","category":"devops","severity":"critical","description":"Enforces deterministic, non-bypassable egress network segmentation at the Traffic Control (TC) hook on host-side container veth interfaces before socket buffers enter Linux host routing. Mandates atomic packet classification, skb linearization, fail-closed drop semantics, and cryptographic/policy tag validation directly within the kernel datapath.","antiPatternHeadline":"Attaching egress policies downstream on physical interfaces or failing open on eBPF parser errors","stars_count":40,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","traffic-control","kernel","networking","security","kubernetes"],"exportEndpoints":{"claude":"/api/rules/ebpf-tc-pod-egress-segmentation-invariant?format=claude","cursorMdc":"/api/rules/ebpf-tc-pod-egress-segmentation-invariant?format=mdc","cursorrules":"/api/rules/ebpf-tc-pod-egress-segmentation-invariant?format=cursor","windsurf":"/api/rules/ebpf-tc-pod-egress-segmentation-invariant?format=windsurf","agents":"/api/rules/ebpf-tc-pod-egress-segmentation-invariant?format=agents"}},{"id":"pg17-json-table-memory-guardrail","title":"PostgreSQL 17 JSON_TABLE Memory Quota & Path Execution Guardrail","category":"backend","severity":"critical","description":"Enforces strict query planning limits, plan-node memory boundaries, and structural constraints on PostgreSQL 17 JSON_TABLE queries within OLTP transaction paths. Unbounded nested path projections over arbitrary-depth JSONB columns bypass default work_mem quotas, triggering memory ballooning, buffer cache churn, and cascading node OOM events.","antiPatternHeadline":"Unbounded Nested JSON_TABLE Projections Without Explicit work_mem Isolation and Path-Depth Constraints","stars_count":89,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","json-table","database-performance","memory-management"],"exportEndpoints":{"claude":"/api/rules/pg17-json-table-memory-guardrail?format=claude","cursorMdc":"/api/rules/pg17-json-table-memory-guardrail?format=mdc","cursorrules":"/api/rules/pg17-json-table-memory-guardrail?format=cursor","windsurf":"/api/rules/pg17-json-table-memory-guardrail?format=windsurf","agents":"/api/rules/pg17-json-table-memory-guardrail?format=agents"}},{"id":"svelte-5-runes-deep-effect-resource-disposal-pattern","title":"Svelte 5 Runes Deep Effect Resource Disposal Pattern","category":"frontend","severity":"critical","description":"Enforces synchronous return-based cleanup contracts and AbortController scoping inside Svelte 5 `$effect` and `$effect.root` runes. Eliminates orphaned subscriptions, memory leaks, and cross-boundary event pollutions in long-lived isomorphic micro-frontends undergoing dynamic mounting cycles. Prevents asynchronous unhandled teardowns across complex signal trees.","antiPatternHeadline":"Dangling Subscriptions and Asynchronous Void Cleanup in Svelte 5 $effect Blocks","stars_count":71,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","memory-leaks","micro-frontends","reactivity"],"exportEndpoints":{"claude":"/api/rules/svelte-5-runes-deep-effect-resource-disposal-pattern?format=claude","cursorMdc":"/api/rules/svelte-5-runes-deep-effect-resource-disposal-pattern?format=mdc","cursorrules":"/api/rules/svelte-5-runes-deep-effect-resource-disposal-pattern?format=cursor","windsurf":"/api/rules/svelte-5-runes-deep-effect-resource-disposal-pattern?format=windsurf","agents":"/api/rules/svelte-5-runes-deep-effect-resource-disposal-pattern?format=agents"}},{"id":"tauri-mobile-plugin-acl-permission-matrix-standard","title":"Tauri 2.0 Mobile Plugin Scoped Capability & ACL Enforcement","category":"mobile","severity":"critical","description":"Enforces granular compile-time capabilities and runtime ACL scoping for Tauri 2.0 iOS and Android plugin bridges. Prevents arbitrary IPC bridge privilege escalation by prohibiting un-scoped default plugin sets and wildcards across webview execution contexts.","antiPatternHeadline":"Over-privileged IPC bridges granting broad runtime filesystem, biometric, or hardware access across mobile webview boundaries.","stars_count":118,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri-2","security","ipc","acl","capabilities","ios","android"],"exportEndpoints":{"claude":"/api/rules/tauri-mobile-plugin-acl-permission-matrix-standard?format=claude","cursorMdc":"/api/rules/tauri-mobile-plugin-acl-permission-matrix-standard?format=mdc","cursorrules":"/api/rules/tauri-mobile-plugin-acl-permission-matrix-standard?format=cursor","windsurf":"/api/rules/tauri-mobile-plugin-acl-permission-matrix-standard?format=windsurf","agents":"/api/rules/tauri-mobile-plugin-acl-permission-matrix-standard?format=agents"}},{"id":"tetragon-ebpf-callstack-syscall-guardrail","title":"Tetragon eBPF Call-Stack Syscall Anomaly Guardrail","category":"security","severity":"critical","description":"Enforces strict eBPF TracingPolicy definitions in Cilium Tetragon to validate userspace and kernel call stacks prior to authorizing execve and execveat syscalls. Detects and neutralizes ROP/JOP payloads, reflective code loading, and container breakouts by terminating processes executing syscalls outside verified text segments or inside writable memory ranges.","antiPatternHeadline":"Unvalidated Syscall Interception Permitting Return-Oriented Execution and In-Memory Breakouts","stars_count":43,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","ebpf","tetragon","kubernetes","runtime-security","zero-trust"],"exportEndpoints":{"claude":"/api/rules/tetragon-ebpf-callstack-syscall-guardrail?format=claude","cursorMdc":"/api/rules/tetragon-ebpf-callstack-syscall-guardrail?format=mdc","cursorrules":"/api/rules/tetragon-ebpf-callstack-syscall-guardrail?format=cursor","windsurf":"/api/rules/tetragon-ebpf-callstack-syscall-guardrail?format=windsurf","agents":"/api/rules/tetragon-ebpf-callstack-syscall-guardrail?format=agents"}},{"id":"nextjs15-dynamic-io-async-fencing","title":"Next.js 15 Dynamic I/O Async Request and Metric Fencing","category":"frontend","severity":"critical","description":"Enforces strict boundary isolation between compile-time prerendering and deferred runtime I/O in Next.js 15 with dynamicIO enabled. Prevents unintentional route-wide dynamic de-optimizations by mandating explicit Suspense fencing and caching directives around asynchronous request hooks and telemetry emitters.","antiPatternHeadline":"Unfenced Async Request Hooks and Runtime Telemetry Collapsing Prerendered Shells","stars_count":89,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs-15","dynamic-io","react-server-components","suspense","caching"],"exportEndpoints":{"claude":"/api/rules/nextjs15-dynamic-io-async-fencing?format=claude","cursorMdc":"/api/rules/nextjs15-dynamic-io-async-fencing?format=mdc","cursorrules":"/api/rules/nextjs15-dynamic-io-async-fencing?format=cursor","windsurf":"/api/rules/nextjs15-dynamic-io-async-fencing?format=windsurf","agents":"/api/rules/nextjs15-dynamic-io-async-fencing?format=agents"}},{"id":"kmp-skie-flow-asyncstream-bridging-invariant","title":"KMP SKIE Flow-to-Swift AsyncStream Cooperative Cancellation & Backpressure Invariant","category":"mobile","severity":"critical","description":"Enforces deterministic bidirectional cancellation and bounded backpressure propagation across the Kotlin Multiplatform and Swift boundary using SKIE. Prevents orphan coroutine leaks, memory bloat from uncollected buffers, and actor deadlocks when consuming Kotlin Flows via Swift modern concurrency.","antiPatternHeadline":"Leaked Kotlin Coroutine Jobs and Swift Actor Stalls via Unbound Flow Bridging or Unscoped Task Wrappers","stars_count":48,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","skie","swift-concurrency","asyncstream","coroutines","reactive"],"exportEndpoints":{"claude":"/api/rules/kmp-skie-flow-asyncstream-bridging-invariant?format=claude","cursorMdc":"/api/rules/kmp-skie-flow-asyncstream-bridging-invariant?format=mdc","cursorrules":"/api/rules/kmp-skie-flow-asyncstream-bridging-invariant?format=cursor","windsurf":"/api/rules/kmp-skie-flow-asyncstream-bridging-invariant?format=windsurf","agents":"/api/rules/kmp-skie-flow-asyncstream-bridging-invariant?format=agents"}},{"id":"prometheus-3-otlp-backpressure-governor","title":"Prometheus 3.0 OTLP Exemplar Ingestion Governor & TSDB Backpressure Invariant","category":"devops","severity":"critical","description":"Enforces strict rate-limiting, exemplar truncation, and dynamic backpressure at the network boundary for Prometheus 3.0 native OTLP ingestion pipelines. Prevents catastrophic TSDB Write-Ahead Log (WAL) fragmentation, exemplar storage thrashing, and out-of-memory (OOM) heap exhaustion during uncoordinated telemetry microbursts. Mandates deterministic HTTP 429 status code emission with adaptive retry-after semantics before exemplar buffers breach bounded memory ceilings.","antiPatternHeadline":"Unbounded OTLP Exemplar Forwarding and Head-of-Line TSDB WAL Saturation","stars_count":105,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["prometheus","opentelemetry","otlp","exemplars","tsdb","backpressure","site-reliability"],"exportEndpoints":{"claude":"/api/rules/prometheus-3-otlp-backpressure-governor?format=claude","cursorMdc":"/api/rules/prometheus-3-otlp-backpressure-governor?format=mdc","cursorrules":"/api/rules/prometheus-3-otlp-backpressure-governor?format=cursor","windsurf":"/api/rules/prometheus-3-otlp-backpressure-governor?format=windsurf","agents":"/api/rules/prometheus-3-otlp-backpressure-governor?format=agents"}},{"id":"axum-0-8-subtree-state-tenant-partitioning","title":"Axum 0.8 Subtree State Isolation & Tenant Context Partitioning","category":"backend","severity":"critical","description":"Enforces compile-time type-safe separation between root infrastructure state and tenant-isolated routing subtrees in Axum 0.8. Eliminates cross-tenant data contamination and runtime extractor panics by replacing monolithic state bags with strictly bounded Tower service hierarchies and scoped state transformations.","antiPatternHeadline":"Monolithic AppState Anti-Pattern with Dynamic Runtime Tenant Pool Resolution and Extractor Panics","stars_count":94,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tower","multi-tenancy","type-safety","architecture"],"exportEndpoints":{"claude":"/api/rules/axum-0-8-subtree-state-tenant-partitioning?format=claude","cursorMdc":"/api/rules/axum-0-8-subtree-state-tenant-partitioning?format=mdc","cursorrules":"/api/rules/axum-0-8-subtree-state-tenant-partitioning?format=cursor","windsurf":"/api/rules/axum-0-8-subtree-state-tenant-partitioning?format=windsurf","agents":"/api/rules/axum-0-8-subtree-state-tenant-partitioning?format=agents"}},{"id":"webauthn-conditional-ui-binding-attestation","title":"WebAuthn Conditional UI Authenticator Binding Attestation Standard","category":"security","severity":"critical","description":"Mandates cryptographic binding of WebAuthn Conditional UI assertions to origin-scoped, ephemeral device trust sessions. Prevents cross-context assertion replay, credential relaying, and passkey autofill session fixation by enforcing strictly consumed nonces, exact origin validation, and mandatory user verification.","antiPatternHeadline":"Ambient Passkey Autofill Without Cryptographic Device Session Nonce Binding and UV Enforcement","stars_count":105,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","passkeys","authentication","conditional-ui","fido2"],"exportEndpoints":{"claude":"/api/rules/webauthn-conditional-ui-binding-attestation?format=claude","cursorMdc":"/api/rules/webauthn-conditional-ui-binding-attestation?format=mdc","cursorrules":"/api/rules/webauthn-conditional-ui-binding-attestation?format=cursor","windsurf":"/api/rules/webauthn-conditional-ui-binding-attestation?format=windsurf","agents":"/api/rules/webauthn-conditional-ui-binding-attestation?format=agents"}},{"id":"go-chi-http3-early-hints-quic-lifecycle","title":"Go Chi HTTP/3 Early Hints QUIC Stream Lifecycle Synchronizer","category":"backend","severity":"critical","description":"Mandates deterministic propagation of QUIC stream terminations (e.g., client STOP_SENDING, stream reset) to all asynchronous HTTP 103 Early Hints pipelines within Go Chi services. Eliminates phantom worker routines, goroutine leaks, and wasted compute by binding worker lifecycles strictly to the request context and verifying stream health prior to non-blocking 103 header flushes.","antiPatternHeadline":"Detached Early Hint Dispatch Yielding Phantom Compute and Resource Starvation on Aborted QUIC Streams","stars_count":90,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","chi","http3","quic","early-hints","goroutine-leaks"],"exportEndpoints":{"claude":"/api/rules/go-chi-http3-early-hints-quic-lifecycle?format=claude","cursorMdc":"/api/rules/go-chi-http3-early-hints-quic-lifecycle?format=mdc","cursorrules":"/api/rules/go-chi-http3-early-hints-quic-lifecycle?format=cursor","windsurf":"/api/rules/go-chi-http3-early-hints-quic-lifecycle?format=windsurf","agents":"/api/rules/go-chi-http3-early-hints-quic-lifecycle?format=agents"}},{"id":"tauri2-mobile-ipc-capability-guardrails","title":"Tauri 2.0 Mobile IPC Capability-Based Access Control and Bridge Isolation","category":"mobile","severity":"critical","description":"Enforces strict capability-based access control (CBAC) manifests and deterministic command mapping between mobile webviews and the Tauri 2.0 Rust runtime on iOS and Android. Precludes arbitrary IPC command injection, overprivileged default permissions, and cross-webview bridge escalation by requiring granular capability boundaries, scoped remote origin controls, and typed runtime payload validation.","antiPatternHeadline":"Overprivileged Default Capability Sets and Unscoped Invoke Handlers in Mobile Webviews","stars_count":114,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri-2","security","ipc","capabilities","ios","android","rust"],"exportEndpoints":{"claude":"/api/rules/tauri2-mobile-ipc-capability-guardrails?format=claude","cursorMdc":"/api/rules/tauri2-mobile-ipc-capability-guardrails?format=mdc","cursorrules":"/api/rules/tauri2-mobile-ipc-capability-guardrails?format=cursor","windsurf":"/api/rules/tauri2-mobile-ipc-capability-guardrails?format=windsurf","agents":"/api/rules/tauri2-mobile-ipc-capability-guardrails?format=agents"}},{"id":"nextjs-15-ppr-dynamic-hole-auth-leak-guardrail","title":"Next.js 15 PPR Dynamic Hole Isolation and Request Context Boundary Guardrail","category":"frontend","severity":"critical","description":"Enforces strict physical boundary separation between static prerender shells and dynamic streaming holes under Next.js 15 Partial Prerendering (PPR). Prevents dynamic APIs such as cookies(), headers(), and authenticated session resolution from de-optimizing static prerender shells or leaking request-scoped identity artifacts into globally cached assets.","antiPatternHeadline":"Evaluating dynamic request context outside Suspense boundaries in Next.js 15 PPR routes","stars_count":71,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["nextjs","nextjs15","ppr","react-server-components","suspense","security","authentication"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-ppr-dynamic-hole-auth-leak-guardrail?format=claude","cursorMdc":"/api/rules/nextjs-15-ppr-dynamic-hole-auth-leak-guardrail?format=mdc","cursorrules":"/api/rules/nextjs-15-ppr-dynamic-hole-auth-leak-guardrail?format=cursor","windsurf":"/api/rules/nextjs-15-ppr-dynamic-hole-auth-leak-guardrail?format=windsurf","agents":"/api/rules/nextjs-15-ppr-dynamic-hole-auth-leak-guardrail?format=agents"}},{"id":"react-19-compiler-interior-mutation-isolation","title":"React 19 Compiler Interior Mutation & Reactive Subgraph Isolation","category":"frontend","severity":"critical","description":"Enforces absolute immutability of props, hook inputs, and shared state within components optimized by the React 19 Compiler (Forget). Prevents silent rendering desynchronization, broken reactive memoization scopes, and memory leaks caused when downstream interior mutations escape compiler tracking boundaries or taint upstream cached references.","antiPatternHeadline":"Mutating Shared Props or Intermediate Scoped Structures Breaking React 19 Auto-Memoization","stars_count":116,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["react-19","react-compiler","immutability","reactivity","memoization"],"exportEndpoints":{"claude":"/api/rules/react-19-compiler-interior-mutation-isolation?format=claude","cursorMdc":"/api/rules/react-19-compiler-interior-mutation-isolation?format=mdc","cursorrules":"/api/rules/react-19-compiler-interior-mutation-isolation?format=cursor","windsurf":"/api/rules/react-19-compiler-interior-mutation-isolation?format=windsurf","agents":"/api/rules/react-19-compiler-interior-mutation-isolation?format=agents"}},{"id":"vite-6-environment-api-multi-runtime-isolation-vite-6-environme-493","title":"Vite 6 Multi-Runtime Environment API Module Graph Isolation Standard","category":"frontend","severity":"critical","description":"Enforces strict module graph isolation across distinct execution targets (client, ssr, workerd/edge) using Vite 6's Environment API. Prevents cross-runtime symbol contamination, invalid module caching across disparate compilation contexts, and broken HMR state synchronizations during concurrent SSR and client dev cycles.","antiPatternHeadline":"Monolithic Module Graph Leaks and Deprecated ssrLoadModule Traversal in Heterogeneous Runtimes","stars_count":99,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["vite","vite6","environment-api","ssr","workerd","multi-runtime","hmr"],"exportEndpoints":{"claude":"/api/rules/vite-6-environment-api-multi-runtime-isolation-vite-6-environme-493?format=claude","cursorMdc":"/api/rules/vite-6-environment-api-multi-runtime-isolation-vite-6-environme-493?format=mdc","cursorrules":"/api/rules/vite-6-environment-api-multi-runtime-isolation-vite-6-environme-493?format=cursor","windsurf":"/api/rules/vite-6-environment-api-multi-runtime-isolation-vite-6-environme-493?format=windsurf","agents":"/api/rules/vite-6-environment-api-multi-runtime-isolation-vite-6-environme-493?format=agents"}},{"id":"axum-tokio-cancellation-safety-state-mutations","title":"Axum 0.8 / Tokio Async Cancellation Safety in State Mutations","category":"backend","severity":"critical","description":"Enforces cancellation safety across asynchronous state mutations, transactional database operations, and shared resource acquisitions in Axum 0.8 handlers. Eliminates silent state corruption, partial writes, and orphaned transaction locks caused by dropped futures during client disconnects or tokio::select! branch termination.","antiPatternHeadline":"Awaiting multi-step database mutations or shared state locks directly inside cancellation-vulnerable request futures","stars_count":59,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tokio","cancellation-safety","concurrency"],"exportEndpoints":{"claude":"/api/rules/axum-tokio-cancellation-safety-state-mutations?format=claude","cursorMdc":"/api/rules/axum-tokio-cancellation-safety-state-mutations?format=mdc","cursorrules":"/api/rules/axum-tokio-cancellation-safety-state-mutations?format=cursor","windsurf":"/api/rules/axum-tokio-cancellation-safety-state-mutations?format=windsurf","agents":"/api/rules/axum-tokio-cancellation-safety-state-mutations?format=agents"}},{"id":"bun-zero-copy-tcp-corking-standard","title":"Bun 1.2 Zero-Copy TCP Streaming & Kernel Corking Standard","category":"backend","severity":"critical","description":"Enforces zero-copy stream piping and kernel-level socket corking (`TCP_CORK` / `TCP_NOPUSH`) for multi-gigabit reverse proxying and streaming ingest in Bun 1.2+. Prevents high-frequency V8/JSC buffer allocations and micro-chunk fragmentation that starve the event loop under heavy I/O backpressure.","antiPatternHeadline":"Chunk-by-chunk user-space buffer allocation and un-corked streaming socket writes under backpressure","stars_count":110,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","networking","zero-copy","tcp","performance"],"exportEndpoints":{"claude":"/api/rules/bun-zero-copy-tcp-corking-standard?format=claude","cursorMdc":"/api/rules/bun-zero-copy-tcp-corking-standard?format=mdc","cursorrules":"/api/rules/bun-zero-copy-tcp-corking-standard?format=cursor","windsurf":"/api/rules/bun-zero-copy-tcp-corking-standard?format=windsurf","agents":"/api/rules/bun-zero-copy-tcp-corking-standard?format=agents"}},{"id":"capacitor7-native-bridge-background-execution-boundary","title":"Capacitor 7 Native Bridge Background Task Execution & OS Watchdog Invariants","category":"mobile","severity":"critical","description":"Enforces deterministic off-thread execution boundaries for prolonged native bridge operations, cryptographic handshakes, and synchronization routines in Capacitor 7. Prevents WebKit/Chromium main-thread UI freeze and immediate OS watchdog terminations (iOS 0x8badf00d, Android ANR) during lifecycle background transitions. Mandates explicit OS background task token acquisition, native thread offloading, and deterministic execution budgeting.","antiPatternHeadline":"Dispatching blocking crypto or sync tasks directly over the bridge without native background token allocation or thread isolation","stars_count":99,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","ios","android","concurrency","performance"],"exportEndpoints":{"claude":"/api/rules/capacitor7-native-bridge-background-execution-boundary?format=claude","cursorMdc":"/api/rules/capacitor7-native-bridge-background-execution-boundary?format=mdc","cursorrules":"/api/rules/capacitor7-native-bridge-background-execution-boundary?format=cursor","windsurf":"/api/rules/capacitor7-native-bridge-background-execution-boundary?format=windsurf","agents":"/api/rules/capacitor7-native-bridge-background-execution-boundary?format=agents"}},{"id":"webauthn-conditional-ui-rpid-binding-guardrail","title":"Strict Origin and RP ID Cryptographic Binding for WebAuthn Conditional UI","category":"security","severity":"critical","description":"Enforces strict canonical Origin and Relying Party Identifier (RP ID) validation during passkey authentication, specifically under WebAuthn Conditional UI (autofill) flows. Mandates that server-side ceremony verifiers evaluate cryptographically bound client data against hardcoded or strictly allowlisted canonical origins rather than dynamic Host/Origin HTTP request headers, mitigating reverse-proxy interception and MitM credential harvesting.","antiPatternHeadline":"Trusting Dynamic Client Request Headers for WebAuthn Origin and RP ID Verification","stars_count":94,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","fido2","passkeys","authentication","mitm-prevention"],"exportEndpoints":{"claude":"/api/rules/webauthn-conditional-ui-rpid-binding-guardrail?format=claude","cursorMdc":"/api/rules/webauthn-conditional-ui-rpid-binding-guardrail?format=mdc","cursorrules":"/api/rules/webauthn-conditional-ui-rpid-binding-guardrail?format=cursor","windsurf":"/api/rules/webauthn-conditional-ui-rpid-binding-guardrail?format=windsurf","agents":"/api/rules/webauthn-conditional-ui-rpid-binding-guardrail?format=agents"}},{"id":"cilium-ebpf-spiffe-mtls-kernel-attestation","title":"Cilium eBPF Kernel mTLS Decoupling with SPIFFE Pod Attestation Standard","category":"security","severity":"critical","description":"Enforces cryptographic mTLS handshake decoupling into node-level Cilium agents using kernel-space eBPF redirection while maintaining cryptographic zero-trust identity via SPIRE/SPIFFE attestation. Eliminates vulnerable user-space sidecar proxies and private key leakage by delegating authentication verification to the kernel-attested node infrastructure.","antiPatternHeadline":"Bypassing Kernel-Attested mTLS via Insecure User-Space Sidecars or Unvalidated SPIFFE Identity Selectors","stars_count":46,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","cilium","ebpf","spiffe","spire","mtls","zero-trust","kubernetes"],"exportEndpoints":{"claude":"/api/rules/cilium-ebpf-spiffe-mtls-kernel-attestation?format=claude","cursorMdc":"/api/rules/cilium-ebpf-spiffe-mtls-kernel-attestation?format=mdc","cursorrules":"/api/rules/cilium-ebpf-spiffe-mtls-kernel-attestation?format=cursor","windsurf":"/api/rules/cilium-ebpf-spiffe-mtls-kernel-attestation?format=windsurf","agents":"/api/rules/cilium-ebpf-spiffe-mtls-kernel-attestation?format=agents"}},{"id":"opentelemetry-w3c-kafka-tracecontext-baggage-propagation","title":"W3C TraceContext and Baggage Propagation Continuity for Kafka and Outbox Pipelines","category":"devops","severity":"critical","description":"Enforces strict W3C TraceContext (`traceparent`, `tracestate`) and Baggage wire-level propagation across transactional outbox storage and Kafka producer/consumer records. Guarantees immutable propagation of multi-tenant baggage and causal trace links across asynchronous message boundaries without header dropping, buffer corruption, or thread-context leakage.","antiPatternHeadline":"Dropping Trace Context Across Outbox Boundaries or Mutating Active Baggage via Unpropagated Kafka Headers","stars_count":63,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","kafka","distributed-tracing","baggage","outbox-pattern"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-w3c-kafka-tracecontext-baggage-propagation?format=claude","cursorMdc":"/api/rules/opentelemetry-w3c-kafka-tracecontext-baggage-propagation?format=mdc","cursorrules":"/api/rules/opentelemetry-w3c-kafka-tracecontext-baggage-propagation?format=cursor","windsurf":"/api/rules/opentelemetry-w3c-kafka-tracecontext-baggage-propagation?format=windsurf","agents":"/api/rules/opentelemetry-w3c-kafka-tracecontext-baggage-propagation?format=agents"}},{"id":"react-19-server-actions-optimistic-reconciliation-react-19-server--668","title":"Deterministic Optimistic Reconciliation and Race-Condition Prevention in React 19 Server Actions","category":"frontend","severity":"critical","description":"Enforces strict atomicity and deterministic rollback guarantees during concurrent React 19 Server Action dispatches via `useActionState` and `useOptimistic`. Prevents UI tearing, stale server payloads overwriting in-flight optimistic layers, and state desynchronization without relying on external global stores.","antiPatternHeadline":"Unbounded Optimistic UI Tearing and Desynchronized Rollbacks via Naked Server Action Mutations","stars_count":67,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","server-actions","optimistic-ui","use-action-state","use-optimistic","concurrency"],"exportEndpoints":{"claude":"/api/rules/react-19-server-actions-optimistic-reconciliation-react-19-server--668?format=claude","cursorMdc":"/api/rules/react-19-server-actions-optimistic-reconciliation-react-19-server--668?format=mdc","cursorrules":"/api/rules/react-19-server-actions-optimistic-reconciliation-react-19-server--668?format=cursor","windsurf":"/api/rules/react-19-server-actions-optimistic-reconciliation-react-19-server--668?format=windsurf","agents":"/api/rules/react-19-server-actions-optimistic-reconciliation-react-19-server--668?format=agents"}},{"id":"svelte-5-universal-runes-micro-frontend-reactive-boundary","title":"Svelte 5 Universal Runes Cross-MFE Fine-Grained Reactive Boundary Protocol","category":"frontend","severity":"critical","description":"Enforces fine-grained signal reactivity boundaries across micro-frontend (MFE) integrations using Svelte 5 universal runes (.svelte.ts). Prohibits coarse-grained serialized state snapshot exchange across custom element boundaries that trigger redundant Virtual DOM reconciliation passes and destroy granular signal tracking.","antiPatternHeadline":"Monolithic State Snapshot Bridging Inducing Host Virtual DOM Reconciliation Cascades","stars_count":47,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","micro-frontends","signals","performance"],"exportEndpoints":{"claude":"/api/rules/svelte-5-universal-runes-micro-frontend-reactive-boundary?format=claude","cursorMdc":"/api/rules/svelte-5-universal-runes-micro-frontend-reactive-boundary?format=mdc","cursorrules":"/api/rules/svelte-5-universal-runes-micro-frontend-reactive-boundary?format=cursor","windsurf":"/api/rules/svelte-5-universal-runes-micro-frontend-reactive-boundary?format=windsurf","agents":"/api/rules/svelte-5-universal-runes-micro-frontend-reactive-boundary?format=agents"}},{"id":"postgres-17-partitioned-vector-async-io","title":"Deterministic Sub-10ms Partitioned HNSW Vector Search with PG17 Streaming I/O","category":"backend","severity":"critical","description":"Mandates declarative partition-local HNSW vector indexing paired with Postgres 17 asynchronous streaming I/O configuration. Guarantees deterministic partition pruning, eliminating global index lock contention and maintaining sub-10ms P99 search latencies during continuous high-throughput vector ingestion.","antiPatternHeadline":"Monolithic Global HNSW Indexes Without Partition Pruning or PG17 Streaming I/O Configuration","stars_count":111,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres-17","pgvector","hnsw","streaming-io","partitioning"],"exportEndpoints":{"claude":"/api/rules/postgres-17-partitioned-vector-async-io?format=claude","cursorMdc":"/api/rules/postgres-17-partitioned-vector-async-io?format=mdc","cursorrules":"/api/rules/postgres-17-partitioned-vector-async-io?format=cursor","windsurf":"/api/rules/postgres-17-partitioned-vector-async-io?format=windsurf","agents":"/api/rules/postgres-17-partitioned-vector-async-io?format=agents"}},{"id":"axum-08-backpressure-sse-drain-standard","title":"Axum 0.8 Zero-Allocation Backpressure & SSE Connection Drain Standard","category":"backend","severity":"critical","description":"Mandates asynchronous stream cancellation invariants, bounded backpressure pipelines, and zero-allocation socket teardowns for Server-Sent Events (SSE) in Axum 0.8. Eliminates heap fragmentation and OS socket starvation by guaranteeing task drop semantics propagate upstream during client disconnection cascades.","antiPatternHeadline":"Unbounded Channel Buffering and Detached Producer Tasks During High-Concurrency SSE Disconnects","stars_count":43,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","sse","tokio","backpressure","networking"],"exportEndpoints":{"claude":"/api/rules/axum-08-backpressure-sse-drain-standard?format=claude","cursorMdc":"/api/rules/axum-08-backpressure-sse-drain-standard?format=mdc","cursorrules":"/api/rules/axum-08-backpressure-sse-drain-standard?format=cursor","windsurf":"/api/rules/axum-08-backpressure-sse-drain-standard?format=windsurf","agents":"/api/rules/axum-08-backpressure-sse-drain-standard?format=agents"}},{"id":"openfga-real-time-contextual-rebac-validation","title":"Mandatory Real-Time OpenFGA Contextual Tuple Graph Resolution at Gateway","category":"security","severity":"critical","description":"Enforces real-time Relationship-Based Access Control (ReBAC) authorization checks via OpenFGA at the API gateway layer to eliminate stale JWT claims and privilege escalation windows. Mandates the dynamic injection of ephemeral request attributes as contextual tuples into OpenFGA check evaluations rather than relying on cached, static token scopes or mutable client state.","antiPatternHeadline":"Authorizing mutations using stale JWT scopes or local database lookups instead of real-time OpenFGA contextual graph evaluation","stars_count":47,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","rebac","authorization","zero-trust","api-gateway"],"exportEndpoints":{"claude":"/api/rules/openfga-real-time-contextual-rebac-validation?format=claude","cursorMdc":"/api/rules/openfga-real-time-contextual-rebac-validation?format=mdc","cursorrules":"/api/rules/openfga-real-time-contextual-rebac-validation?format=cursor","windsurf":"/api/rules/openfga-real-time-contextual-rebac-validation?format=windsurf","agents":"/api/rules/openfga-real-time-contextual-rebac-validation?format=agents"}},{"id":"webauthn-conditional-mediation-prf-vault-derivation","title":"Enforce WebAuthn PRF Zero-Knowledge Key Derivation and Conditional Mediation Hygiene","category":"security","severity":"critical","description":"Enforces zero-knowledge client-side encryption architectures utilizing WebAuthn Pseudo-Random Function (PRF) extensions and Conditional Mediation. Guarantees that authenticator-derived symmetric roots are never exposed to the server, never persisted unencrypted in local storage, and strictly isolated as non-extractable cryptographic keys.","antiPatternHeadline":"Exposing raw PRF outputs to the network, failing to isolate derived keys, or persisting authenticator roots in browser storage.","stars_count":86,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","passkeys","prf-extension","zero-knowledge","cryptography"],"exportEndpoints":{"claude":"/api/rules/webauthn-conditional-mediation-prf-vault-derivation?format=claude","cursorMdc":"/api/rules/webauthn-conditional-mediation-prf-vault-derivation?format=mdc","cursorrules":"/api/rules/webauthn-conditional-mediation-prf-vault-derivation?format=cursor","windsurf":"/api/rules/webauthn-conditional-mediation-prf-vault-derivation?format=windsurf","agents":"/api/rules/webauthn-conditional-mediation-prf-vault-derivation?format=agents"}},{"id":"kmp-swift-arc-memory-interop-guardrail","title":"Kotlin Multiplatform Swift-ARC Native Memory Boundary Interop Standard","category":"mobile","severity":"critical","description":"Establishes strict thread-confinement and reference lifecycle invariants across the Kotlin Native GC and Swift ARC bridge. Prevents silent cyclic reference memory leaks and retain cycles caused by cross-runtime listener delegation and closure capturing. Mandates weak reference wrappers, explicit cancellation tokens, and structural bridge teardown routines on iOS targets.","antiPatternHeadline":"Cross-Runtime Retain Cycles Between Swift ARC and Kotlin Native Tracing Collector","stars_count":82,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","swift","memory-management","arc","ios","concurrency"],"exportEndpoints":{"claude":"/api/rules/kmp-swift-arc-memory-interop-guardrail?format=claude","cursorMdc":"/api/rules/kmp-swift-arc-memory-interop-guardrail?format=mdc","cursorrules":"/api/rules/kmp-swift-arc-memory-interop-guardrail?format=cursor","windsurf":"/api/rules/kmp-swift-arc-memory-interop-guardrail?format=windsurf","agents":"/api/rules/kmp-swift-arc-memory-interop-guardrail?format=agents"}},{"id":"tauri-v2-mobile-zerocopy-ipc-protocol","title":"Tauri 2.0 Mobile Zero-Copy Binary IPC Buffer Transfer Protocol","category":"mobile","severity":"critical","description":"Enforces zero-copy binary ArrayBuffer transfers over Tauri 2.0 mobile IPC boundaries to eliminate JSON serialization and GC pauses during high-throughput edge inference and raw audio streaming. Mandates typed array memory pooling and binary protocol handlers over WKWebView and Android WebView bridge layers.","antiPatternHeadline":"Serializing High-Frequency Tensor or PCM Audio Buffers to JSON or Base64 Across Tauri Mobile IPC","stars_count":100,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri-2","ipc","zero-copy","arraybuffer","audio-worklet","tflite"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-mobile-zerocopy-ipc-protocol?format=claude","cursorMdc":"/api/rules/tauri-v2-mobile-zerocopy-ipc-protocol?format=mdc","cursorrules":"/api/rules/tauri-v2-mobile-zerocopy-ipc-protocol?format=cursor","windsurf":"/api/rules/tauri-v2-mobile-zerocopy-ipc-protocol?format=windsurf","agents":"/api/rules/tauri-v2-mobile-zerocopy-ipc-protocol?format=agents"}},{"id":"bun-hermetic-standalone-coldstart-guardrail","title":"Bun 1.2 Hermetic Standalone Binary Embedding & Cold-Start Isolation","category":"devops","severity":"critical","description":"Enforces immutable, zero-dependency standalone binary compilation via `bun build --compile` combined with embedded asset loading and deferred runtime evaluation. This guarantees sub-millisecond container cold starts and deterministic execution across ephemeral serverless fleets without relying on host-level Node.js runtimes or dynamic filesystem node_modules resolution.","antiPatternHeadline":"Dynamic filesystem traversal and runtime node_modules resolution in production serverless containers","stars_count":76,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["bun","devops","serverless","cold-start","hermetic-build","standalone-binary"],"exportEndpoints":{"claude":"/api/rules/bun-hermetic-standalone-coldstart-guardrail?format=claude","cursorMdc":"/api/rules/bun-hermetic-standalone-coldstart-guardrail?format=mdc","cursorrules":"/api/rules/bun-hermetic-standalone-coldstart-guardrail?format=cursor","windsurf":"/api/rules/bun-hermetic-standalone-coldstart-guardrail?format=windsurf","agents":"/api/rules/bun-hermetic-standalone-coldstart-guardrail?format=agents"}},{"id":"opentelemetry-1-28-tail-sampling-invariant","title":"OpenTelemetry 1.28 Semantic Conventions & Tail-Based Trace Sampling Guardrail","category":"devops","severity":"critical","description":"Enforces strict compliance with OpenTelemetry Semantic Conventions v1.28 across span attributes and collector pipelines. Guarantees deterministic 100% trace capture for anomalous P99 latency regressions and 5xx cascading errors while preventing cardinality explosion caused by unbounded span names, legacy attributes, and unparameterized URLs.","antiPatternHeadline":"Cardinally Unbounded Head-Sampling with Deprecated v1.20 Attributes and Silently Dropped Failure Outliers","stars_count":101,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","observability","tracing","tail-sampling","otel-collector"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-1-28-tail-sampling-invariant?format=claude","cursorMdc":"/api/rules/opentelemetry-1-28-tail-sampling-invariant?format=mdc","cursorrules":"/api/rules/opentelemetry-1-28-tail-sampling-invariant?format=cursor","windsurf":"/api/rules/opentelemetry-1-28-tail-sampling-invariant?format=windsurf","agents":"/api/rules/opentelemetry-1-28-tail-sampling-invariant?format=agents"}},{"id":"react-19-server-taint-boundary-enforcement","title":"React 19 RSC Taint Boundary Enforcement for Secrets and Sensitive Domain Entities","category":"frontend","severity":"critical","description":"Enforces strict runtime serialization barriers across the React Server Component (RSC) boundary using React 19's taint APIs to prevent credentials, secrets, and raw database entities from crossing into Client Components. Mandates immediate tainting of sensitive values and object references at the data-access layer alongside explicit Data Transfer Object (DTO) projections. Eliminates accidental exposure through prop spreading, implicit serialization, or Server Action returns.","antiPatternHeadline":"Passing Untainted Raw Database Entities or Server Secrets Directly to Client Component Props","stars_count":47,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","rsc","taint-api","security","nextjs"],"exportEndpoints":{"claude":"/api/rules/react-19-server-taint-boundary-enforcement?format=claude","cursorMdc":"/api/rules/react-19-server-taint-boundary-enforcement?format=mdc","cursorrules":"/api/rules/react-19-server-taint-boundary-enforcement?format=cursor","windsurf":"/api/rules/react-19-server-taint-boundary-enforcement?format=windsurf","agents":"/api/rules/react-19-server-taint-boundary-enforcement?format=agents"}},{"id":"python-313-nogil-fastapi-state-invariant","title":"Python 3.13 Free-Threaded FastAPI Thread-Safe State & C-Extension Invariant","category":"backend","severity":"critical","description":"Enforces strict concurrency boundaries and thread synchronization primitives for FastAPI services running on Python 3.13 free-threaded (PEP 703, PYTHON_GIL=0) runtimes. Prevents silent memory corruption, race conditions in standard collection mutations, and segmentation faults originating from non-thread-safe C-extensions and shared in-memory state across parallel ASGI worker threads.","antiPatternHeadline":"Unsynchronized Global Mutations and Non-Reentrant C-Extension Invocations in Free-Threaded FastAPI","stars_count":95,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","python313","fastapi","free-threaded","concurrency","thread-safety","nogil"],"exportEndpoints":{"claude":"/api/rules/python-313-nogil-fastapi-state-invariant?format=claude","cursorMdc":"/api/rules/python-313-nogil-fastapi-state-invariant?format=mdc","cursorrules":"/api/rules/python-313-nogil-fastapi-state-invariant?format=cursor","windsurf":"/api/rules/python-313-nogil-fastapi-state-invariant?format=windsurf","agents":"/api/rules/python-313-nogil-fastapi-state-invariant?format=agents"}},{"id":"axum-tokio-task-local-cancellation-safety","title":"Axum 0.8 Tokio Task-Local Extraction and Cancellation Safety Standard","category":"backend","severity":"critical","description":"Enforces strict drop-safety, RAII cleanup guarantees, and scoped Tokio task-local context propagation across nested Tower middleware and Axum 0.8 request pipelines. Prevents resource leaks, orphaned database transactions, and corrupted task-local states when client connections abort unexpectedly mid-flight.","antiPatternHeadline":"Unprotected mutable state and non-RAII resource cleanup across cancellation points in Axum request pipelines","stars_count":92,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tokio","tower","async-cancellation"],"exportEndpoints":{"claude":"/api/rules/axum-tokio-task-local-cancellation-safety?format=claude","cursorMdc":"/api/rules/axum-tokio-task-local-cancellation-safety?format=mdc","cursorrules":"/api/rules/axum-tokio-task-local-cancellation-safety?format=cursor","windsurf":"/api/rules/axum-tokio-task-local-cancellation-safety?format=windsurf","agents":"/api/rules/axum-tokio-task-local-cancellation-safety?format=agents"}},{"id":"bun-sqlite-wal-checkpoint-reader-barrier-standard","title":"Bun 1.2 Embedded SQLite WAL Checkpointing and Reader Barrier Isolation","category":"backend","severity":"critical","description":"Enforces strict read/write connection segregation and deterministic out-of-band WAL checkpointing for Bun 1.2 embedded SQLite workloads. Prevents SQLITE_BUSY errors, disk lock contention, and unbounded WAL file inflation under high concurrent request volumes by isolating read-only handles and managing WAL size through non-blocking checkpoints.","antiPatternHeadline":"Monolithic Read-Write DB Handles Executing Inline WAL Checkpoints on Concurrent Hot Paths","stars_count":99,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","sqlite","wal","concurrency","performance"],"exportEndpoints":{"claude":"/api/rules/bun-sqlite-wal-checkpoint-reader-barrier-standard?format=claude","cursorMdc":"/api/rules/bun-sqlite-wal-checkpoint-reader-barrier-standard?format=mdc","cursorrules":"/api/rules/bun-sqlite-wal-checkpoint-reader-barrier-standard?format=cursor","windsurf":"/api/rules/bun-sqlite-wal-checkpoint-reader-barrier-standard?format=windsurf","agents":"/api/rules/bun-sqlite-wal-checkpoint-reader-barrier-standard?format=agents"}},{"id":"kmp-atomic-statemachine-dispatcher-boundary","title":"Kotlin Multiplatform 2.1 Atomic State Machine & Darwin/Android Dispatcher Boundary","category":"mobile","severity":"critical","description":"Enforces strict confinement of state machine mutative transitions to dedicated single-threaded dispatcher boundaries while using atomic primitives and immutable snapshots across Android ART and Apple Darwin GCD runtimes. Precludes invalid memory access, cross-thread mutation crashes (SIGSEGV/IllegalState), and coroutine deadlocks when synchronizing offline-first persistent states across platform boundaries in Kotlin Multiplatform 2.1.","antiPatternHeadline":"Unconfined MutableStateFlow Mutations Across Native GCD Worker Threads and ART Thread Pools","stars_count":85,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","coroutines","darwin-gcd","android-art","state-machine","concurrency"],"exportEndpoints":{"claude":"/api/rules/kmp-atomic-statemachine-dispatcher-boundary?format=claude","cursorMdc":"/api/rules/kmp-atomic-statemachine-dispatcher-boundary?format=mdc","cursorrules":"/api/rules/kmp-atomic-statemachine-dispatcher-boundary?format=cursor","windsurf":"/api/rules/kmp-atomic-statemachine-dispatcher-boundary?format=windsurf","agents":"/api/rules/kmp-atomic-statemachine-dispatcher-boundary?format=agents"}},{"id":"swift-6-complete-concurrency-networking-standard","title":"Swift 6 Complete Data-Race Safety and Global Actor Isolation Standard","category":"mobile","severity":"critical","description":"Guarantees complete compile-time data race safety in Swift 6 by strictly enforcing Sendable conformance, explicit isolation boundaries, and nonisolated crossing patterns across networking pipelines. Prohibits unchecked shared mutable state and silent main-thread stalls during JSON parsing or background session execution.","antiPatternHeadline":"Unchecked Sendable Bypasses and Implicit Main-Actor Capture in Asynchronous Networking Pipelines","stars_count":117,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","ios","swift6","concurrency","actors","networking"],"exportEndpoints":{"claude":"/api/rules/swift-6-complete-concurrency-networking-standard?format=claude","cursorMdc":"/api/rules/swift-6-complete-concurrency-networking-standard?format=mdc","cursorrules":"/api/rules/swift-6-complete-concurrency-networking-standard?format=cursor","windsurf":"/api/rules/swift-6-complete-concurrency-networking-standard?format=windsurf","agents":"/api/rules/swift-6-complete-concurrency-networking-standard?format=agents"}},{"id":"tls13-hybrid-pq-ml-kem-guardrail","title":"Enforce TLS 1.3 Hybrid Post-Quantum ML-KEM Key Encapsulation","category":"security","severity":"critical","description":"Enforces hybrid classical and post-quantum key encapsulation (X25519MLKEM768 / SecP256r1MLKEM768) across all TLS 1.3 edge terminators, reverse proxies, and microservice clients. Defends ingress and egress channels against 'Harvest Now, Decrypt Later' (HNDL) adversarial vectors by disallowing pure classical elliptic curve key exchanges and mandating modern cryptographic library configurations.","antiPatternHeadline":"Defaulting to Classical-Only ECDHE Key Exchanges in Modern TLS 1.3 Endpoints","stars_count":90,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","tls","cryptography","post-quantum","ml-kem","zero-trust"],"exportEndpoints":{"claude":"/api/rules/tls13-hybrid-pq-ml-kem-guardrail?format=claude","cursorMdc":"/api/rules/tls13-hybrid-pq-ml-kem-guardrail?format=mdc","cursorrules":"/api/rules/tls13-hybrid-pq-ml-kem-guardrail?format=cursor","windsurf":"/api/rules/tls13-hybrid-pq-ml-kem-guardrail?format=windsurf","agents":"/api/rules/tls13-hybrid-pq-ml-kem-guardrail?format=agents"}},{"id":"k8s-gateway-v1-2-spiffe-workload-identity-attestation","title":"Kubernetes Gateway API v1.2 SPIFFE Workload Identity Attestation and Dynamic mTLS Invariants","category":"devops","severity":"critical","description":"Enforces strict zero-trust cryptographic workload identity verification between ingress gateways and internal mesh services using Kubernetes Gateway API v1.2 BackendTLSPolicy and SPIFFE SAN validation. Prevents perimeter-only token spoofing, cleartext internal hops, and unauthenticated downstream backend connections.","antiPatternHeadline":"Cleartext Service Backend Routing and Insecure Trust-on-First-Use (TOFU) Gateway Forwarding","stars_count":115,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","kubernetes","gateway-api","spiffe","spire","zero-trust","mtls","backend-tls-policy"],"exportEndpoints":{"claude":"/api/rules/k8s-gateway-v1-2-spiffe-workload-identity-attestation?format=claude","cursorMdc":"/api/rules/k8s-gateway-v1-2-spiffe-workload-identity-attestation?format=mdc","cursorrules":"/api/rules/k8s-gateway-v1-2-spiffe-workload-identity-attestation?format=cursor","windsurf":"/api/rules/k8s-gateway-v1-2-spiffe-workload-identity-attestation?format=windsurf","agents":"/api/rules/k8s-gateway-v1-2-spiffe-workload-identity-attestation?format=agents"}},{"id":"opentofu-client-side-state-encryption-kms-barrier","title":"OpenTofu 1.9 Client-Side State Envelope Encryption and KMS Key Rotation Barrier","category":"devops","severity":"critical","description":"Enforces mandatory client-side envelope encryption for OpenTofu state and plan files before persistence to remote backends using OpenTofu 1.9 native encryption blocks. Mandates AES-GCM encryption with managed hardware KMS key providers (AWS KMS, GCP KMS, Azure Key Vault, or HashiCorp Vault) and explicit fallback decryption barriers to guarantee uninterrupted cryptographic key rotation without plaintext leakage.","antiPatternHeadline":"Persisting Plaintext or Backend-Only Encrypted State Without Client-Side KMS Envelope Barriers","stars_count":63,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentofu","kms","state-encryption","security","iac","envelope-encryption"],"exportEndpoints":{"claude":"/api/rules/opentofu-client-side-state-encryption-kms-barrier?format=claude","cursorMdc":"/api/rules/opentofu-client-side-state-encryption-kms-barrier?format=mdc","cursorrules":"/api/rules/opentofu-client-side-state-encryption-kms-barrier?format=cursor","windsurf":"/api/rules/opentofu-client-side-state-encryption-kms-barrier?format=windsurf","agents":"/api/rules/opentofu-client-side-state-encryption-kms-barrier?format=agents"}},{"id":"react19-useactionstate-transactional-ordering","title":"React 19 useActionState Transactional Mutation Ordering & Rollback Guardrail","category":"frontend","severity":"critical","description":"Enforces strict monotonic sequence numbering, idempotent mutation tickets, and exact rollback invariants across concurrent React 19 useActionState and useOptimistic transitions. Prevents out-of-order race conditions from clobbering fresher client-side states when parallel server actions resolve unpredictably.","antiPatternHeadline":"Unsequenced concurrent server action resolutions clobbering optimistic states with stale remote snapshots","stars_count":63,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react19","useActionState","useOptimistic","concurrency","state-machine"],"exportEndpoints":{"claude":"/api/rules/react19-useactionstate-transactional-ordering?format=claude","cursorMdc":"/api/rules/react19-useactionstate-transactional-ordering?format=mdc","cursorrules":"/api/rules/react19-useactionstate-transactional-ordering?format=cursor","windsurf":"/api/rules/react19-useactionstate-transactional-ordering?format=windsurf","agents":"/api/rules/react19-useactionstate-transactional-ordering?format=agents"}},{"id":"postgres-17-logical-replication-failover-slot-sync-postgres-17-logi-754","title":"Postgres 17 Logical Replication Failover Slot Sync Determinism","category":"backend","severity":"critical","description":"Enforces synchronous logical replication slot synchronization on standby instances using PostgreSQL 17 failover slot capabilities (`failover = true` and `sync_replication_slots = true`). Guarantees that consumer subscribers and outbox processors avoid missing transactions or suffering unconstrained rewind replay cascades during automated physical HA failover.","antiPatternHeadline":"Unsynchronized Logical Slots Causing Silent Message Loss or Catastrophic Replay During Primary Failover","stars_count":107,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres","logical-replication","high-availability","outbox-pattern","distributed-systems"],"exportEndpoints":{"claude":"/api/rules/postgres-17-logical-replication-failover-slot-sync-postgres-17-logi-754?format=claude","cursorMdc":"/api/rules/postgres-17-logical-replication-failover-slot-sync-postgres-17-logi-754?format=mdc","cursorrules":"/api/rules/postgres-17-logical-replication-failover-slot-sync-postgres-17-logi-754?format=cursor","windsurf":"/api/rules/postgres-17-logical-replication-failover-slot-sync-postgres-17-logi-754?format=windsurf","agents":"/api/rules/postgres-17-logical-replication-failover-slot-sync-postgres-17-logi-754?format=agents"}},{"id":"connect-rpc-http3-flow-control-guardrail","title":"Connect-RPC HTTP/3 Multiplexed Flow Control & Backpressure Invariant","category":"backend","severity":"critical","description":"Mandates strict synchronous backpressure, bounded stream buffering, and context-cancellation propagation across Connect-RPC bidirectional streams over HTTP/3. Prevents QUIC stream-level window starvation and unconstrained heap memory ballooning during high-concurrency browser-to-server multiplexing.","antiPatternHeadline":"Unbounded Stream Ingestion and Detached Concurrent Yielding in Bidirectional RPC Handlers","stars_count":99,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","connect-rpc","http3","quic","streaming","flow-control","grpc"],"exportEndpoints":{"claude":"/api/rules/connect-rpc-http3-flow-control-guardrail?format=claude","cursorMdc":"/api/rules/connect-rpc-http3-flow-control-guardrail?format=mdc","cursorrules":"/api/rules/connect-rpc-http3-flow-control-guardrail?format=cursor","windsurf":"/api/rules/connect-rpc-http3-flow-control-guardrail?format=windsurf","agents":"/api/rules/connect-rpc-http3-flow-control-guardrail?format=agents"}},{"id":"kmp-swift-export-memory-lifecycle-guardrail","title":"KMP 2.1 Swift Export Cross-Runtime ARC-to-GC Memory Lifecycle Guardrail","category":"mobile","severity":"critical","description":"Enforces strict lifecycle boundaries and bridge patterns between Apple ARC and Kotlin Native Garbage Collection (GC) in KMP 2.1+ Swift Export environments. Eliminates cross-language retain cycles, dangling Swift closure references, and premature deallocation of asynchronous Kotlin Coroutine Scopes bridged into iOS native runtimes.","antiPatternHeadline":"Retaining Strong Kotlin Native References in Swift Closures and Escaping Native Observers Without ARC Disposables","stars_count":87,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","swift","ios","memory-management","arc","kotlin-native"],"exportEndpoints":{"claude":"/api/rules/kmp-swift-export-memory-lifecycle-guardrail?format=claude","cursorMdc":"/api/rules/kmp-swift-export-memory-lifecycle-guardrail?format=mdc","cursorrules":"/api/rules/kmp-swift-export-memory-lifecycle-guardrail?format=cursor","windsurf":"/api/rules/kmp-swift-export-memory-lifecycle-guardrail?format=windsurf","agents":"/api/rules/kmp-swift-export-memory-lifecycle-guardrail?format=agents"}},{"id":"tauri2-origin-bound-acl-ipc-sandbox-guardrail","title":"Tauri 2.0 Capability-Based Multi-Webview IPC Sandbox & Origin ACL Enforcement","category":"mobile","severity":"critical","description":"Enforces strict origin-bound, capability-scoped Access Control Lists (ACLs) across multi-window desktop and mobile hybrid runtimes in Tauri 2.0. Prevents lateral host privilege escalation from secondary, auth, or remote webviews by eliminating wildcard capability assignments and mandating granular command-level authorization.","antiPatternHeadline":"Wildcard capability assignment allowing secondary or remote webviews to invoke privileged host IPC commands","stars_count":103,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri","security","ipc","acl","sandbox"],"exportEndpoints":{"claude":"/api/rules/tauri2-origin-bound-acl-ipc-sandbox-guardrail?format=claude","cursorMdc":"/api/rules/tauri2-origin-bound-acl-ipc-sandbox-guardrail?format=mdc","cursorrules":"/api/rules/tauri2-origin-bound-acl-ipc-sandbox-guardrail?format=cursor","windsurf":"/api/rules/tauri2-origin-bound-acl-ipc-sandbox-guardrail?format=windsurf","agents":"/api/rules/tauri2-origin-bound-acl-ipc-sandbox-guardrail?format=agents"}},{"id":"webauthn-l3-prf-hardware-isolated-key-derivation-standard","title":"WebAuthn Level 3 PRF Hardware-Isolated Key Derivation and Memory Sanitization Standard","category":"security","severity":"critical","description":"Enforces strict hardware-isolated key derivation and ephemeral memory zeroization for WebAuthn Level 3 Pseudo-Random Function (PRF) extension implementations. Guarantees that derived symmetric keys remain non-extractable in WebCrypto SubtleCrypto boundaries, zero-knowledge domain separation salts are cryptographically robust, and ephemeral assertion buffers are wiped immediately to prevent memory scraping.","antiPatternHeadline":"Persisting Raw PRF Output in Application Memory or Importing Extractable Cryptographic Keys","stars_count":86,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","prf","passkeys","webcrypto","zero-knowledge","hardware-security"],"exportEndpoints":{"claude":"/api/rules/webauthn-l3-prf-hardware-isolated-key-derivation-standard?format=claude","cursorMdc":"/api/rules/webauthn-l3-prf-hardware-isolated-key-derivation-standard?format=mdc","cursorrules":"/api/rules/webauthn-l3-prf-hardware-isolated-key-derivation-standard?format=cursor","windsurf":"/api/rules/webauthn-l3-prf-hardware-isolated-key-derivation-standard?format=windsurf","agents":"/api/rules/webauthn-l3-prf-hardware-isolated-key-derivation-standard?format=agents"}},{"id":"sigstore-cosign-ephemeral-keyless-attestation-pinning","title":"Cosign Ephemeral Keyless Attestation and OIDC Identity Pinning","category":"security","severity":"critical","description":"Enforces strict cryptographic verification of short-lived Fulcio X.509 certificates and Rekor transparency log entries for all container images and software artifacts. Prevents supply chain spoofing by mandating exact matches on the Subject Alternative Name (SAN) certificate identity and OIDC issuer URL, forbidding unpinned or static key-based verification.","antiPatternHeadline":"Executing keyless verification without pinning the Fulcio certificate identity and OIDC issuer","stars_count":49,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","sigstore","cosign","supply-chain","attestation","rekor","fulcio"],"exportEndpoints":{"claude":"/api/rules/sigstore-cosign-ephemeral-keyless-attestation-pinning?format=claude","cursorMdc":"/api/rules/sigstore-cosign-ephemeral-keyless-attestation-pinning?format=mdc","cursorrules":"/api/rules/sigstore-cosign-ephemeral-keyless-attestation-pinning?format=cursor","windsurf":"/api/rules/sigstore-cosign-ephemeral-keyless-attestation-pinning?format=windsurf","agents":"/api/rules/sigstore-cosign-ephemeral-keyless-attestation-pinning?format=agents"}},{"id":"k8s-cel-mutating-admission-policy-determinism-standard","title":"Kubernetes CEL Mutating Admission Policy Determinism and Idempotency Standard","category":"devops","severity":"critical","description":"Enforces strict idempotency, bounded CEL runtime cost, and deterministic convergence for in-process MutatingAdmissionPolicies in Kubernetes. Replaces brittle out-of-process admission webhooks to eliminate webhook-induced latency spikes, kube-apiserver connection timeouts, and control-plane split-brain states during network partitions.","antiPatternHeadline":"Non-Idempotent Reinjection Loops and Fragile External Mutating Webhooks","stars_count":81,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","kubernetes","admission-control","cel","security","infrastructure"],"exportEndpoints":{"claude":"/api/rules/k8s-cel-mutating-admission-policy-determinism-standard?format=claude","cursorMdc":"/api/rules/k8s-cel-mutating-admission-policy-determinism-standard?format=mdc","cursorrules":"/api/rules/k8s-cel-mutating-admission-policy-determinism-standard?format=cursor","windsurf":"/api/rules/k8s-cel-mutating-admission-policy-determinism-standard?format=windsurf","agents":"/api/rules/k8s-cel-mutating-admission-policy-determinism-standard?format=agents"}},{"id":"cilium-bpf-host-routing-pmtu-clamping","title":"Cilium eBPF Host-Routing Path MTU Discovery & MSS Clamping Boundary","category":"devops","severity":"critical","description":"Enforces strict TCP MSS clamping, PMTU discovery enablement, and interface-level MTU alignment when Cilium bpf.hostRouting is active in hybrid cloud or multi-cloud topologies. When eBPF bypasses the host iptables/netfilter stack, jumbo frames and tunnel encapsulation overhead (Geneve, VXLAN, WireGuard) cause silent packet blackholes due to dropped ICMP Type 3 Code 4 fragmentation needed signals. Infrastructure-as-code manifests and Helm configurations must explicitly enforce automated MSS clamping and precise tunnel overhead accounting across all routing boundaries.","antiPatternHeadline":"Bypassing iptables TCP MSS clamping via bpf.hostRouting=true without BPF-native MSS clamping or proper MTU headroom calculation.","stars_count":116,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","cilium","ebpf","kubernetes","networking","mtu","hybrid-cloud"],"exportEndpoints":{"claude":"/api/rules/cilium-bpf-host-routing-pmtu-clamping?format=claude","cursorMdc":"/api/rules/cilium-bpf-host-routing-pmtu-clamping?format=mdc","cursorrules":"/api/rules/cilium-bpf-host-routing-pmtu-clamping?format=cursor","windsurf":"/api/rules/cilium-bpf-host-routing-pmtu-clamping?format=windsurf","agents":"/api/rules/cilium-bpf-host-routing-pmtu-clamping?format=agents"}},{"id":"bun-websocket-backpressure-highwatermark-guardrail","title":"Bun Native WebSocket Backpressure & High-Watermark Memory Guardrail","category":"backend","severity":"critical","description":"Enforces deterministic backpressure handling in Bun 1.2+ native WebSockets by tracking socket kernel send buffers via ws.bufferedAmount and integrating the native drain lifecycle hook. Prevents catastrophic native and engine heap bloat caused by fast streaming producers overwhelming slow TCP consumers.","antiPatternHeadline":"Unbounded WebSocket Message Dispatching Without Native Drain Suspension Causing Silent OOM Crashes","stars_count":45,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","websockets","backpressure","memory-management","performance"],"exportEndpoints":{"claude":"/api/rules/bun-websocket-backpressure-highwatermark-guardrail?format=claude","cursorMdc":"/api/rules/bun-websocket-backpressure-highwatermark-guardrail?format=mdc","cursorrules":"/api/rules/bun-websocket-backpressure-highwatermark-guardrail?format=cursor","windsurf":"/api/rules/bun-websocket-backpressure-highwatermark-guardrail?format=windsurf","agents":"/api/rules/bun-websocket-backpressure-highwatermark-guardrail?format=agents"}},{"id":"postgres-17-logical-replication-parallel-apply-invariants","title":"Postgres 17 Logical Replication Parallel Apply Transaction Ordering & FK Deadlock Prevention","category":"backend","severity":"critical","description":"Enforces publisher transactional boundary discipline and subscriber schema indexing to guarantee causal consistency under Postgres 17's parallel apply engine (streaming = parallel). Prevents cross-worker foreign-key deadlocks, commit-order stalls, and replication slot divergence during sustained high-throughput write bursts.","antiPatternHeadline":"Splitting Interdependent Writes Across Uncoordinated Concurrent Transactions Causing Subscriber Parallel Apply Worker Deadlocks","stars_count":52,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres-17","logical-replication","distributed-systems","database-concurrency"],"exportEndpoints":{"claude":"/api/rules/postgres-17-logical-replication-parallel-apply-invariants?format=claude","cursorMdc":"/api/rules/postgres-17-logical-replication-parallel-apply-invariants?format=mdc","cursorrules":"/api/rules/postgres-17-logical-replication-parallel-apply-invariants?format=cursor","windsurf":"/api/rules/postgres-17-logical-replication-parallel-apply-invariants?format=windsurf","agents":"/api/rules/postgres-17-logical-replication-parallel-apply-invariants?format=agents"}},{"id":"go-swisstable-concurrent-pointer-stability","title":"Go 1.24 SwissTable Memory Invariant: Concurrent Pointer Stability & Table Resizing Guardrails","category":"backend","severity":"critical","description":"Enforces strict memory isolation and synchronization boundaries for Go 1.24+ SwissTable-backed maps during concurrent execution. Prevents fatal runtime panics, torn reads, and memory corruption triggered by slot table reallocations, group control byte shifts, and stale interior pointer dereferencing across goroutine worker pools.","antiPatternHeadline":"Passing direct map value pointers or unsynchronized map references across goroutine boundaries during concurrent table growth","stars_count":103,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","concurrency","swisstable","memory-safety","goroutines"],"exportEndpoints":{"claude":"/api/rules/go-swisstable-concurrent-pointer-stability?format=claude","cursorMdc":"/api/rules/go-swisstable-concurrent-pointer-stability?format=mdc","cursorrules":"/api/rules/go-swisstable-concurrent-pointer-stability?format=cursor","windsurf":"/api/rules/go-swisstable-concurrent-pointer-stability?format=windsurf","agents":"/api/rules/go-swisstable-concurrent-pointer-stability?format=agents"}},{"id":"capacitor-7-wasm-cross-origin-isolation-guardrail","title":"Capacitor 7 WebAssembly SharedArrayBuffer & Cross-Origin Isolation Architecture","category":"mobile","severity":"critical","description":"Mandates native WebView header synthesis (COOP/COEP) and isolated worker contexts for multi-threaded WebAssembly in Capacitor 7. Guarantees zero-copy SharedArrayBuffer stability while preventing UI thread deadlocks and native bridge message queue stalls.","antiPatternHeadline":"Instantiating Multi-Threaded WASM on Main UI Thread Without Native COOP/COEP Header Interception","stars_count":86,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","webassembly","sharedarraybuffer","webworkers","ios","android"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-wasm-cross-origin-isolation-guardrail?format=claude","cursorMdc":"/api/rules/capacitor-7-wasm-cross-origin-isolation-guardrail?format=mdc","cursorrules":"/api/rules/capacitor-7-wasm-cross-origin-isolation-guardrail?format=cursor","windsurf":"/api/rules/capacitor-7-wasm-cross-origin-isolation-guardrail?format=windsurf","agents":"/api/rules/capacitor-7-wasm-cross-origin-isolation-guardrail?format=agents"}},{"id":"webauthn-prf-client-zero-knowledge-encryption","title":"WebAuthn Level 3 PRF Zero-Knowledge Hardware Key Derivation Standard","category":"security","severity":"critical","description":"Enforces client-side zero-knowledge encryption using WebAuthn Level 3 Pseudo-Random Function (PRF) extension outputs (HMAC-SHA-256) combined with HKDF for symmetric key derivation. Guarantees that raw PRF outputs and derived symmetric encryption keys never traverse network boundaries, remain strictly scoped to hardware authenticator bounds, and use ephemeral salt challenges to prevent replay and key-reuse vulnerabilities.","antiPatternHeadline":"Transmitting Raw PRF Outputs or Deriving Symmetrical Payload Keys on the Server","stars_count":62,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","prf-extension","zero-knowledge","cryptography","hkdf","aes-gcm"],"exportEndpoints":{"claude":"/api/rules/webauthn-prf-client-zero-knowledge-encryption?format=claude","cursorMdc":"/api/rules/webauthn-prf-client-zero-knowledge-encryption?format=mdc","cursorrules":"/api/rules/webauthn-prf-client-zero-knowledge-encryption?format=cursor","windsurf":"/api/rules/webauthn-prf-client-zero-knowledge-encryption?format=windsurf","agents":"/api/rules/webauthn-prf-client-zero-knowledge-encryption?format=agents"}},{"id":"oauth2-dpop-nonce-replay-fence-standard","title":"OAuth 2.1 DPoP Nonce Validation & Ephemeral Proof Replay Fence","category":"security","severity":"critical","description":"Enforces RFC 9449 Demonstrating Proof-of-Possession (DPoP) binding across OAuth 2.1 authorization servers and resource servers. Mandates strict cryptographic verification of the public key thumbprint (jkt), proof replay neutralization via distributed atomic single-use JTI fences, explicit HTTP method and normalized URI binding, and cryptographic server-nonce rotation.","antiPatternHeadline":"Accepting Unbound Bearer Tokens or Stateless DPoP Proofs Lacking Server-Nonce Cycling and Distributed Atomic JTI Fences","stars_count":65,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","oauth2","dpop","rfc9449","replay-prevention","zero-trust","distributed-systems"],"exportEndpoints":{"claude":"/api/rules/oauth2-dpop-nonce-replay-fence-standard?format=claude","cursorMdc":"/api/rules/oauth2-dpop-nonce-replay-fence-standard?format=mdc","cursorrules":"/api/rules/oauth2-dpop-nonce-replay-fence-standard?format=cursor","windsurf":"/api/rules/oauth2-dpop-nonce-replay-fence-standard?format=windsurf","agents":"/api/rules/oauth2-dpop-nonce-replay-fence-standard?format=agents"}},{"id":"cilium-ebpf-transparent-mtls-spiffe-assertion-standard","title":"Cilium eBPF Datapath Transparent mTLS & SPIFFE Cryptographic Assertion","category":"devops","severity":"critical","description":"Enforces cryptographic SPIFFE workload identity validation and transparent mutual TLS directly inside the Cilium eBPF datapath. Non-conforming packets MUST be dropped at the kernel tc/XDP ingress hooks, completely eliminating user-space context switches and protecting L7 proxy stacks against unauthorized traffic.","antiPatternHeadline":"Bypassing Kernel Datapath Cryptographic Filters and Deferring mTLS to User-Space Envoy Proxies","stars_count":76,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","cilium","ebpf","spiffe","mtls","zero-trust","kubernetes-security"],"exportEndpoints":{"claude":"/api/rules/cilium-ebpf-transparent-mtls-spiffe-assertion-standard?format=claude","cursorMdc":"/api/rules/cilium-ebpf-transparent-mtls-spiffe-assertion-standard?format=mdc","cursorrules":"/api/rules/cilium-ebpf-transparent-mtls-spiffe-assertion-standard?format=cursor","windsurf":"/api/rules/cilium-ebpf-transparent-mtls-spiffe-assertion-standard?format=windsurf","agents":"/api/rules/cilium-ebpf-transparent-mtls-spiffe-assertion-standard?format=agents"}},{"id":"otel-metric-exemplar-ring-buffer-cardinality-pinning","title":"OpenTelemetry Metric Exemplar Ring-Buffer Cardinality Pinning Standard","category":"devops","severity":"critical","description":"Enforces strict bounded ring-buffer reservoirs for dynamic OpenTelemetry trace-to-metric exemplars across all metrics collection pipelines. Unbounded exemplar allocation during distributed cascading failures degrades runtime performance and induces Out-Of-Memory (OOM) fatal crashes due to unbounded heap retention of span contexts. All exemplar filter implementations must enforce deterministic, pre-allocated reservoir sizes and drop policies under burst loads.","antiPatternHeadline":"Unbounded or Default Trace-to-Metric Exemplar Sampling Leading to Heap Exhaustion During Telemetry Surges","stars_count":106,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","metrics","exemplars","cardinality","resilience","memory-management"],"exportEndpoints":{"claude":"/api/rules/otel-metric-exemplar-ring-buffer-cardinality-pinning?format=claude","cursorMdc":"/api/rules/otel-metric-exemplar-ring-buffer-cardinality-pinning?format=mdc","cursorrules":"/api/rules/otel-metric-exemplar-ring-buffer-cardinality-pinning?format=cursor","windsurf":"/api/rules/otel-metric-exemplar-ring-buffer-cardinality-pinning?format=windsurf","agents":"/api/rules/otel-metric-exemplar-ring-buffer-cardinality-pinning?format=agents"}},{"id":"nextjs-ppr-static-shell-isolation-guardrail","title":"Next.js 15 PPR Static Shell Isolation & Dynamic Boundary Guardrail","category":"frontend","severity":"critical","description":"Enforces strict encapsulation of dynamic runtime primitives (cookies(), headers(), searchParams) within dedicated React Suspense boundaries when targeting Next.js 15 Partial Prerendering (PPR). Guarantees that root layouts and marketing chrome are compiled to immutable static HTML at the edge, eliminating runtime cache de-optimization and route-level dynamic bailout.","antiPatternHeadline":"Unbounded Dynamic I/O Hoisting Causing Premature PPR Bailout and Edge De-optimization","stars_count":77,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs","react-19","partial-prerendering","suspense","edge-cache","web-vitals"],"exportEndpoints":{"claude":"/api/rules/nextjs-ppr-static-shell-isolation-guardrail?format=claude","cursorMdc":"/api/rules/nextjs-ppr-static-shell-isolation-guardrail?format=mdc","cursorrules":"/api/rules/nextjs-ppr-static-shell-isolation-guardrail?format=cursor","windsurf":"/api/rules/nextjs-ppr-static-shell-isolation-guardrail?format=windsurf","agents":"/api/rules/nextjs-ppr-static-shell-isolation-guardrail?format=agents"}},{"id":"axum-0-8-tower-cancellation-and-drop-safety-guardrail","title":"Axum 0.8 & Tower Async Cancellation and Downstream Drop Safety Invariants","category":"backend","severity":"critical","description":"Enforces deterministic teardown of downstream asynchronous tasks and RAII guard patterns when client disconnects or request bodies drop prematurely in Axum 0.8. Prevents background CPU starvation, orphan unbounded execution, and lingering pooled database connection checkouts caused by unhandled Rust async cancellation points. Mandates tokio::select! drop awareness, cancellation tokens, and explicit transaction rollbacks.","antiPatternHeadline":"Spawning detached unbounded futures or holding unmonitored RAII transactional leases across cancellation-vulnerable await points","stars_count":103,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tokio","tower","async-cancellation","concurrency"],"exportEndpoints":{"claude":"/api/rules/axum-0-8-tower-cancellation-and-drop-safety-guardrail?format=claude","cursorMdc":"/api/rules/axum-0-8-tower-cancellation-and-drop-safety-guardrail?format=mdc","cursorrules":"/api/rules/axum-0-8-tower-cancellation-and-drop-safety-guardrail?format=cursor","windsurf":"/api/rules/axum-0-8-tower-cancellation-and-drop-safety-guardrail?format=windsurf","agents":"/api/rules/axum-0-8-tower-cancellation-and-drop-safety-guardrail?format=agents"}},{"id":"fastapi-async-streaming-zero-copy-serialization-invariant","title":"FastAPI Async Zero-Copy Buffer Streaming for High-Throughput Inference","category":"backend","severity":"critical","description":"Enforces zero-copy memory-mapped buffer streaming for high-throughput AI/ML model inference responses in FastAPI. Prohibits intermediate Python object instantiation, Pydantic serialization, and byte concatenation on the critical path to eliminate pymalloc lock contention and GIL latency spikes.","antiPatternHeadline":"Pydantic Serialization and Byte Concatenation of High-Dimensional Inference Buffers","stars_count":118,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","zero-copy","asyncio","streaming","memoryview","arrow","inference"],"exportEndpoints":{"claude":"/api/rules/fastapi-async-streaming-zero-copy-serialization-invariant?format=claude","cursorMdc":"/api/rules/fastapi-async-streaming-zero-copy-serialization-invariant?format=mdc","cursorrules":"/api/rules/fastapi-async-streaming-zero-copy-serialization-invariant?format=cursor","windsurf":"/api/rules/fastapi-async-streaming-zero-copy-serialization-invariant?format=windsurf","agents":"/api/rules/fastapi-async-streaming-zero-copy-serialization-invariant?format=agents"}},{"id":"pgvector-hnsw-halfvec-vacuum-guardrail","title":"pgvector 0.8 HNSW Halfvec Quantization & Autovacuum Isolation Guardrail","category":"backend","severity":"critical","description":"Mandates 16-bit scalar quantization (halfvec) for high-dimensional vector embeddings and strict table-level autovacuum throttling and worker isolation in PostgreSQL with pgvector 0.8+. Prevents severe buffer pool cache thrashing, out-of-memory kernel kills, and catalog/index lock contention under high-throughput concurrent vector ingestion.","antiPatternHeadline":"Unquantized FP32 HNSW indexing with default shared autovacuum worker limits during concurrent embeddings ingestion.","stars_count":41,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","pgvector","hnsw","vector-databases","database-performance"],"exportEndpoints":{"claude":"/api/rules/pgvector-hnsw-halfvec-vacuum-guardrail?format=claude","cursorMdc":"/api/rules/pgvector-hnsw-halfvec-vacuum-guardrail?format=mdc","cursorrules":"/api/rules/pgvector-hnsw-halfvec-vacuum-guardrail?format=cursor","windsurf":"/api/rules/pgvector-hnsw-halfvec-vacuum-guardrail?format=windsurf","agents":"/api/rules/pgvector-hnsw-halfvec-vacuum-guardrail?format=agents"}},{"id":"react-native-bridgeless-hostobject-raii-guardrail","title":"React Native 0.77 Bridgeless Fabric C++ TurboModule Memory Boundary Guardrail","category":"mobile","severity":"critical","description":"Enforces deterministic lifetime management for JSI HostObjects and C++ TurboModule state crossing JavaScript VM and native thread boundaries in React Native 0.77 Bridgeless mode. Direct raw pointers crossing the JSI boundary without RAII reference counting (std::shared_ptr, jsi::WeakObject, or std::enable_shared_from_this) lead to use-after-free and double-free panics during garbage collection or concurrent UI fabric mutations.","antiPatternHeadline":"Exposing Unmanaged C++ Raw Pointers or Dangling References Across JSI HostObjects in Bridgeless Runtime","stars_count":105,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","react-native","cpp","turbomodules","bridgeless","fabric","jsi","memory-safety"],"exportEndpoints":{"claude":"/api/rules/react-native-bridgeless-hostobject-raii-guardrail?format=claude","cursorMdc":"/api/rules/react-native-bridgeless-hostobject-raii-guardrail?format=mdc","cursorrules":"/api/rules/react-native-bridgeless-hostobject-raii-guardrail?format=cursor","windsurf":"/api/rules/react-native-bridgeless-hostobject-raii-guardrail?format=windsurf","agents":"/api/rules/react-native-bridgeless-hostobject-raii-guardrail?format=agents"}},{"id":"spiffe-spire-x509-svid-autorotation-standard","title":"SPIFFE/SPIRE Microsegmentation X.509 SVID Auto-Rotation Standard","category":"security","severity":"critical","description":"Enforces sub-hour automated cryptographic identity rotation for containerized services across multi-cloud meshes via the SPIFFE Workload API. Eliminates long-lived TLS certificates and static credentials by mandating streaming in-memory mTLS credential renewal without process restarts or disk-persisted private keys.","antiPatternHeadline":"Persisting Long-Lived Static Certificates to Disk or Failing to Dynamically Reload Expiring X.509 SVIDs","stars_count":50,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","spiffe","spire","mtls","zero-trust","cryptography"],"exportEndpoints":{"claude":"/api/rules/spiffe-spire-x509-svid-autorotation-standard?format=claude","cursorMdc":"/api/rules/spiffe-spire-x509-svid-autorotation-standard?format=mdc","cursorrules":"/api/rules/spiffe-spire-x509-svid-autorotation-standard?format=cursor","windsurf":"/api/rules/spiffe-spire-x509-svid-autorotation-standard?format=windsurf","agents":"/api/rules/spiffe-spire-x509-svid-autorotation-standard?format=agents"}},{"id":"fedcm-passkey-conditional-mediation-replay-defense-standard","title":"FedCM & Passkey Conditional Mediation Replay Defense via Distributed Atomic Nonce Ring Buffers","category":"security","severity":"critical","description":"Enforces mandatory single-use cryptographic nonce validation within clientDataJSON for Federated Credential Management (FedCM) and Passkey Conditional UI flows. Requires server-side verification to atomically consume assertion nonces against a distributed TTL-bounded ring buffer (e.g., Redis atomics) to definitively prevent cross-origin relay and replay attacks during silent browser identity assertions.","antiPatternHeadline":"Stateless Nonce Acceptance or Non-Atomic Challenge Verification in Federated/Conditional WebAuthn Assertions","stars_count":67,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","passkeys","fedcm","replay-prevention","distributed-systems","zero-trust"],"exportEndpoints":{"claude":"/api/rules/fedcm-passkey-conditional-mediation-replay-defense-standard?format=claude","cursorMdc":"/api/rules/fedcm-passkey-conditional-mediation-replay-defense-standard?format=mdc","cursorrules":"/api/rules/fedcm-passkey-conditional-mediation-replay-defense-standard?format=cursor","windsurf":"/api/rules/fedcm-passkey-conditional-mediation-replay-defense-standard?format=windsurf","agents":"/api/rules/fedcm-passkey-conditional-mediation-replay-defense-standard?format=agents"}},{"id":"cilium-ebpf-xdp-hardware-offload-l4-filter-invariant","title":"Cilium eBPF XDP Hardware-Offloaded Layer-4 Filter Invariant","category":"devops","severity":"critical","description":"Enforces Cilium eBPF XDP (eXpress Data Path) acceleration at the NIC driver or SmartNIC hardware level to intercept and drop volumetric SYN floods and malformed L4 packets prior to kernel socket buffer (sk_buff) allocation. Bypassing socket buffer allocation is mandatory to eliminate memory exhaustion, softirq contention, and OS kernel lock serialization under extreme packet-per-second (Mpps) DDoS conditions. All network policies targeting border ingress interfaces must validate XDP hardware/driver mode compatibility and fail closed.","antiPatternHeadline":"Processing Ingress L4 Traffic via iptables, IPVS, or Standard TC-eBPF Allowing sk_buff Exhaustion Under Volumetric Attacks","stars_count":103,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","cilium","ebpf","xdp","kubernetes","ddos-mitigation","networking"],"exportEndpoints":{"claude":"/api/rules/cilium-ebpf-xdp-hardware-offload-l4-filter-invariant?format=claude","cursorMdc":"/api/rules/cilium-ebpf-xdp-hardware-offload-l4-filter-invariant?format=mdc","cursorrules":"/api/rules/cilium-ebpf-xdp-hardware-offload-l4-filter-invariant?format=cursor","windsurf":"/api/rules/cilium-ebpf-xdp-hardware-offload-l4-filter-invariant?format=windsurf","agents":"/api/rules/cilium-ebpf-xdp-hardware-offload-l4-filter-invariant?format=agents"}},{"id":"otel-ebpf-profiler-cpu-budgeting-guardrail","title":"OpenTelemetry eBPF Continuous Profiler Dynamic CPU Budgeting & Throttling Guardrail","category":"devops","severity":"critical","description":"Enforces dynamic stack-unwinding frequency throttling and adaptive sampling circuit breakers on OpenTelemetry eBPF profiling agents. Guarantees that agent host-level CPU consumption remains strictly below a 1% threshold, preventing kernel lock contention and scheduling latency degradation on mission-critical cluster nodes.","antiPatternHeadline":"Static high-frequency eBPF stack-unwinding causing unconstrained host CPU spikes and kernel mmap lock contention under heavy system load","stars_count":64,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","opentelemetry","continuous-profiling","cpu-budgeting","kubernetes"],"exportEndpoints":{"claude":"/api/rules/otel-ebpf-profiler-cpu-budgeting-guardrail?format=claude","cursorMdc":"/api/rules/otel-ebpf-profiler-cpu-budgeting-guardrail?format=mdc","cursorrules":"/api/rules/otel-ebpf-profiler-cpu-budgeting-guardrail?format=cursor","windsurf":"/api/rules/otel-ebpf-profiler-cpu-budgeting-guardrail?format=windsurf","agents":"/api/rules/otel-ebpf-profiler-cpu-budgeting-guardrail?format=agents"}},{"id":"web-locks-client-state-sync-standard","title":"Web Locks API State Synchronization and Concurrency Control Guardrail","category":"frontend","severity":"critical","description":"Enforces deterministic cross-tab synchronization and prevents IndexedDB write-skew anomalies during high-frequency optimistic state mutations and queue drains. Mandates atomic, scoped synchronization via the native Web Locks API (`navigator.locks.request`) paired with cross-context invalidation signals across concurrent browsing contexts (tabs, dedicated workers, and service workers).","antiPatternHeadline":"Unsynchronized Read-Modify-Write Cycles and Optimistic Queue Drains Across Concurrent Tabs Causing IndexedDB Write-Skew and State Regression","stars_count":112,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","web-locks-api","indexeddb","concurrency","cross-tab-sync","offline-first","race-conditions"],"exportEndpoints":{"claude":"/api/rules/web-locks-client-state-sync-standard?format=claude","cursorMdc":"/api/rules/web-locks-client-state-sync-standard?format=mdc","cursorrules":"/api/rules/web-locks-client-state-sync-standard?format=cursor","windsurf":"/api/rules/web-locks-client-state-sync-standard?format=windsurf","agents":"/api/rules/web-locks-client-state-sync-standard?format=agents"}},{"id":"postgres-17-hnsw-partition-memory-budget-invariant","title":"Postgres 17 Partitioned HNSW Vector Memory Budget & Worker Concurrency Invariant","category":"backend","severity":"critical","description":"Enforces deterministic memory ceiling budgeting across maintenance_work_mem, max_parallel_maintenance_workers, and shared_buffers when indexing high-dimensional HNSW vectors across partitioned tables. Prevents fatal container cgroup OOM killer panics (SIGKILL) triggered by unthrottled concurrent partition DDL operations.","antiPatternHeadline":"Parallel Partition Indexing with Uncapped maintenance_work_mem Triggering Host OOM Panics","stars_count":47,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres-17","pgvector","hnsw","database-reliability","memory-management"],"exportEndpoints":{"claude":"/api/rules/postgres-17-hnsw-partition-memory-budget-invariant?format=claude","cursorMdc":"/api/rules/postgres-17-hnsw-partition-memory-budget-invariant?format=mdc","cursorrules":"/api/rules/postgres-17-hnsw-partition-memory-budget-invariant?format=cursor","windsurf":"/api/rules/postgres-17-hnsw-partition-memory-budget-invariant?format=windsurf","agents":"/api/rules/postgres-17-hnsw-partition-memory-budget-invariant?format=agents"}},{"id":"fastapi-asgi-token-streaming-backpressure-standard","title":"FastAPI ASGI Token-Streaming Backpressure and Heartbeat Standard","category":"backend","severity":"critical","description":"Enforces proactive client disconnection detection, bounded ASGI queue backpressure, and periodic SSE heartbeats for token-streaming endpoints. Prevents runaway upstream LLM costs, kernel socket buffer exhaustion, and zombie generator memory leaks when downstream clients hang or disconnect.","antiPatternHeadline":"Unbounded StreamingResponse generator lacking disconnect checks, heartbeats, and upstream task cancellation","stars_count":77,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["fastapi","asgi","token-streaming","llm","backpressure","sse","python"],"exportEndpoints":{"claude":"/api/rules/fastapi-asgi-token-streaming-backpressure-standard?format=claude","cursorMdc":"/api/rules/fastapi-asgi-token-streaming-backpressure-standard?format=mdc","cursorrules":"/api/rules/fastapi-asgi-token-streaming-backpressure-standard?format=cursor","windsurf":"/api/rules/fastapi-asgi-token-streaming-backpressure-standard?format=windsurf","agents":"/api/rules/fastapi-asgi-token-streaming-backpressure-standard?format=agents"}},{"id":"axum-tower-middleware-panic-isolation-invariant","title":"Axum Tower Middleware Panic Isolation and Cancellation Invariant","category":"backend","severity":"critical","description":"Enforces strict panic isolation, cancellation safety, and RAII cleanup invariants across Axum and Tower middleware layers. Prevents Tokio task cancellation drops and thread unwinds from poisoning shared state Mutexes, leaking telemetry contexts, or leaving distributed transactional handles dangling.","antiPatternHeadline":"Unprotected Tower Middleware State Mutation and Unhandled Panics Poisoning Shared State on Task Drop","stars_count":47,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tokio","tower","concurrency"],"exportEndpoints":{"claude":"/api/rules/axum-tower-middleware-panic-isolation-invariant?format=claude","cursorMdc":"/api/rules/axum-tower-middleware-panic-isolation-invariant?format=mdc","cursorrules":"/api/rules/axum-tower-middleware-panic-isolation-invariant?format=cursor","windsurf":"/api/rules/axum-tower-middleware-panic-isolation-invariant?format=windsurf","agents":"/api/rules/axum-tower-middleware-panic-isolation-invariant?format=agents"}},{"id":"kmp-sqlite-wal-threading-boundary","title":"Strict Threading Isolation for KMP SQLite WAL Mode across Native Apple Queues and Coroutines","category":"mobile","severity":"critical","description":"Enforces a strict single-writer, dedicated-reader thread boundary for SQLite Write-Ahead Logging (WAL) in Kotlin Multiplatform targets. Prevents priority inversion, thread pool starvation, and hard database lock deadlocks between Apple Grand Central Dispatch (GCD) workloops and Kotlin Coroutine dispatchers by isolating SQLite connections to specialized, confined dispatchers.","antiPatternHeadline":"Dispatching SQLite WAL Mutations Across Unconfined Coroutine Pools and Native Apple GCD Queues","stars_count":92,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","sqlite","ios","coroutines","wal"],"exportEndpoints":{"claude":"/api/rules/kmp-sqlite-wal-threading-boundary?format=claude","cursorMdc":"/api/rules/kmp-sqlite-wal-threading-boundary?format=mdc","cursorrules":"/api/rules/kmp-sqlite-wal-threading-boundary?format=cursor","windsurf":"/api/rules/kmp-sqlite-wal-threading-boundary?format=windsurf","agents":"/api/rules/kmp-sqlite-wal-threading-boundary?format=agents"}},{"id":"openfga-conditional-tuple-mutation-atomicity","title":"OpenFGA Atomic Conditional Tuple Mutation and Consistency Standard","category":"security","severity":"critical","description":"Enforces atomic batch execution and strict consistency preferences for OpenFGA relationship tuple mutations involving conditional grants. Eliminates privilege escalation windows, lockouts, and authorization leaks during high-concurrency ReBAC lifecycle transitions across distributed decision points.","antiPatternHeadline":"Sequential Non-Atomic Tuple Operations Causing Transient Privilege Leaks and Stale Grant Windows","stars_count":81,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","rebac","authorization","distributed-systems","concurrency"],"exportEndpoints":{"claude":"/api/rules/openfga-conditional-tuple-mutation-atomicity?format=claude","cursorMdc":"/api/rules/openfga-conditional-tuple-mutation-atomicity?format=mdc","cursorrules":"/api/rules/openfga-conditional-tuple-mutation-atomicity?format=cursor","windsurf":"/api/rules/openfga-conditional-tuple-mutation-atomicity?format=windsurf","agents":"/api/rules/openfga-conditional-tuple-mutation-atomicity?format=agents"}},{"id":"fido2-device-bound-origin-attestation-invariant","title":"FIDO2 WebAuthn Canonical Origin & Discovery Attestation Invariant","category":"security","severity":"critical","description":"Enforces cryptographic and exact validation of clientDataJSON origin strings against immutable server-side discovery manifests and canonical RP origin sets during FIDO2/WebAuthn ceremonies. Prevents adversary-in-the-middle (AiTM) reverse-proxy phishing and credential relay attacks by eliminating dynamic host header derivations, loose regexes, and unverified multi-tenant origin reflections.","antiPatternHeadline":"Dynamic Host Derivation or Loose Origin Pattern Matching in WebAuthn Client Data Verification","stars_count":68,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","fido2","passkeys","aitm-mitigation","cryptography"],"exportEndpoints":{"claude":"/api/rules/fido2-device-bound-origin-attestation-invariant?format=claude","cursorMdc":"/api/rules/fido2-device-bound-origin-attestation-invariant?format=mdc","cursorrules":"/api/rules/fido2-device-bound-origin-attestation-invariant?format=cursor","windsurf":"/api/rules/fido2-device-bound-origin-attestation-invariant?format=windsurf","agents":"/api/rules/fido2-device-bound-origin-attestation-invariant?format=agents"}},{"id":"otel-baggage-sanitization-sizing-guardrail","title":"OpenTelemetry W3C Baggage Ingress Sanitization and Size Bounding Protocol","category":"devops","severity":"critical","description":"Mandates strict byte-length ceilings, key-cardinality limits, and allowlist-based redaction for incoming W3C Baggage headers at ingress proxies. Prevents memory-exhaustion header-stuffing DoS attacks and stops sensitive credential or PII leakage across zero-trust network boundaries.","antiPatternHeadline":"Unbounded, Transparent Ingress Baggage Propagation and Deserialization","stars_count":96,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","security","baggage","w3c","zero-trust","api-gateway"],"exportEndpoints":{"claude":"/api/rules/otel-baggage-sanitization-sizing-guardrail?format=claude","cursorMdc":"/api/rules/otel-baggage-sanitization-sizing-guardrail?format=mdc","cursorrules":"/api/rules/otel-baggage-sanitization-sizing-guardrail?format=cursor","windsurf":"/api/rules/otel-baggage-sanitization-sizing-guardrail?format=windsurf","agents":"/api/rules/otel-baggage-sanitization-sizing-guardrail?format=agents"}},{"id":"ebpf-ktls-socket-splicing-nonblocking-standard","title":"eBPF kTLS Socket Splicing Non-Blocking and Session State Verification Guardrail","category":"devops","severity":"critical","description":"Mandates non-blocking zero-copy in-kernel socket splicing across eBPF sockmap redirects and kTLS offload pipelines. Prevents TCP window collapse, write buffer deadlocks, and silent stream desynchronization by strictly validating cryptographic session boundaries and enforcing explicit userspace backpressure fallback loops.","antiPatternHeadline":"Synchronous Socket Splicing with Silent eBPF Redirect Drops and Unmonitored kTLS Sequence Overflows","stars_count":98,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","ktls","networking","zero-copy","linux-kernel","socket-programming"],"exportEndpoints":{"claude":"/api/rules/ebpf-ktls-socket-splicing-nonblocking-standard?format=claude","cursorMdc":"/api/rules/ebpf-ktls-socket-splicing-nonblocking-standard?format=mdc","cursorrules":"/api/rules/ebpf-ktls-socket-splicing-nonblocking-standard?format=cursor","windsurf":"/api/rules/ebpf-ktls-socket-splicing-nonblocking-standard?format=windsurf","agents":"/api/rules/ebpf-ktls-socket-splicing-nonblocking-standard?format=agents"}},{"id":"nextjs15-ppr-dynamic-hole-containment","title":"Next.js 15 Partial Prerendering (PPR) Dynamic Hole Boundary Isolation","category":"frontend","severity":"critical","description":"Enforces strict React Suspense encapsulation and dynamic context isolation for Next.js 15 Partial Prerendering (PPR) routes. Prevents dynamic APIs (cookies, headers, uncached fetches) from escaping leaf boundaries and deoptimizing the pre-rendered static shell into blocking dynamic server rendering.","antiPatternHeadline":"Uncontained Dynamic API Access Deoptimizing Static PPR Shells into Blocking SSR","stars_count":55,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["nextjs","nextjs-15","ppr","react-suspense","streaming","web-performance"],"exportEndpoints":{"claude":"/api/rules/nextjs15-ppr-dynamic-hole-containment?format=claude","cursorMdc":"/api/rules/nextjs15-ppr-dynamic-hole-containment?format=mdc","cursorrules":"/api/rules/nextjs15-ppr-dynamic-hole-containment?format=cursor","windsurf":"/api/rules/nextjs15-ppr-dynamic-hole-containment?format=windsurf","agents":"/api/rules/nextjs15-ppr-dynamic-hole-containment?format=agents"}},{"id":"postgres-17-pg-combinebackup-chain-verification","title":"Postgres 17 Incremental Backup Chain and LSN Continuity Verification","category":"backend","severity":"critical","description":"Postgres 17 native block-level incremental backups reconstructed via pg_combinebackup require absolute continuity in Log Sequence Numbers (LSN) and valid manifest checksums across every delta in the chain. Failure to cryptographically verify backup manifests and validate start/end LSN bounds before combination risks synthesizing corrupt clusters and unrecoverable point-in-time recovery (PITR) states.","antiPatternHeadline":"Blind Reconstruction of Incremental Backup Chains Without Manifest Checksums and LSN Continuity Validation","stars_count":110,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres","backups","pg-combinebackup","pitr","database-reliability"],"exportEndpoints":{"claude":"/api/rules/postgres-17-pg-combinebackup-chain-verification?format=claude","cursorMdc":"/api/rules/postgres-17-pg-combinebackup-chain-verification?format=mdc","cursorrules":"/api/rules/postgres-17-pg-combinebackup-chain-verification?format=cursor","windsurf":"/api/rules/postgres-17-pg-combinebackup-chain-verification?format=windsurf","agents":"/api/rules/postgres-17-pg-combinebackup-chain-verification?format=agents"}},{"id":"bun-sqlite-multi-worker-concurrency-wal-lease","title":"Bun 1.2 Multi-Worker SQLite Handle Isolation and WAL Write-Lease Protocol","category":"backend","severity":"critical","description":"Enforces thread-isolated native SQLite connection handles across Bun Web Workers and mandates deterministic WAL write-lease arbitration. Prevents native pointer corruption, segfaults from cross-thread handle transfers, and unrecoverable SQLITE_BUSY deadlocks during concurrent multi-worker writes.","antiPatternHeadline":"Sharing Native bun:sqlite Instances Across Workers or Executing Uncoordinated Concurrent Transactions","stars_count":42,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","sqlite","wal-mode","concurrency","web-workers","database"],"exportEndpoints":{"claude":"/api/rules/bun-sqlite-multi-worker-concurrency-wal-lease?format=claude","cursorMdc":"/api/rules/bun-sqlite-multi-worker-concurrency-wal-lease?format=mdc","cursorrules":"/api/rules/bun-sqlite-multi-worker-concurrency-wal-lease?format=cursor","windsurf":"/api/rules/bun-sqlite-multi-worker-concurrency-wal-lease?format=windsurf","agents":"/api/rules/bun-sqlite-multi-worker-concurrency-wal-lease?format=agents"}},{"id":"tauri-v2-mobile-ipc-zero-copy-binary-transfer","title":"Mandate Zero-Copy Binary ArrayBuffer Transfers for Tauri 2.0 Mobile IPC","category":"mobile","severity":"critical","description":"High-frequency telemetry, media buffers, and sensor streams across the Tauri 2.0 Rust-webview boundary must bypass serde_json serialization in favor of raw binary byte slices and typed ArrayBuffers. Serializing binary payloads into JSON arrays or Base64 strings incurs severe memory allocation overhead, WebKit/Android WebView bridge serialization stalls, and catastrophic garbage collector thrashing on mobile hardware.","antiPatternHeadline":"Serializing raw byte arrays and telemetry into JSON number vectors or Base64 over the mobile IPC bridge","stars_count":45,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri","rust","ipc","performance","arraybuffer"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-mobile-ipc-zero-copy-binary-transfer?format=claude","cursorMdc":"/api/rules/tauri-v2-mobile-ipc-zero-copy-binary-transfer?format=mdc","cursorrules":"/api/rules/tauri-v2-mobile-ipc-zero-copy-binary-transfer?format=cursor","windsurf":"/api/rules/tauri-v2-mobile-ipc-zero-copy-binary-transfer?format=windsurf","agents":"/api/rules/tauri-v2-mobile-ipc-zero-copy-binary-transfer?format=agents"}},{"id":"axum-sse-backpressure-drain-guardrail","title":"Axum 0.8 Bounded SSE Stream Draining and Heartbeat Backpressure","category":"backend","severity":"critical","description":"Server-Sent Events (SSE) in Axum 0.8 must use strictly bounded channels combined with proactive keep-alive heartbeats to handle slow or hung HTTP/2 and HTTP/3 consumers. Failure to apply backpressure or monitor disconnect states leads to unbounded memory growth from queued events and leaked asynchronous streaming tasks.","antiPatternHeadline":"Unbounded Tokio MPSC channels paired with unmonitored SSE streams causing OOM crashes during slow-client stalls","stars_count":113,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","sse","tokio","backpressure","http2"],"exportEndpoints":{"claude":"/api/rules/axum-sse-backpressure-drain-guardrail?format=claude","cursorMdc":"/api/rules/axum-sse-backpressure-drain-guardrail?format=mdc","cursorrules":"/api/rules/axum-sse-backpressure-drain-guardrail?format=cursor","windsurf":"/api/rules/axum-sse-backpressure-drain-guardrail?format=windsurf","agents":"/api/rules/axum-sse-backpressure-drain-guardrail?format=agents"}},{"id":"opentelemetry-baggage-pii-redaction-envelope-guardrail","title":"OpenTelemetry Baggage PII Redaction & Byte-Budget Envelope Standard","category":"security","severity":"critical","description":"Enforces strict payload byte-budget caps and automated PII/credential sanitization on OpenTelemetry W3C Baggage entries. Unrestricted baggage propagation induces downstream HTTP 431 Request Header Fields Too Large outages via header amplification and leaks sensitive data across service trust boundaries.","antiPatternHeadline":"Unbounded and Unredacted OpenTelemetry Baggage Header Propagation Across Network Boundaries","stars_count":60,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","opentelemetry","observability","distributed-tracing","pii-masking","dos-prevention"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-baggage-pii-redaction-envelope-guardrail?format=claude","cursorMdc":"/api/rules/opentelemetry-baggage-pii-redaction-envelope-guardrail?format=mdc","cursorrules":"/api/rules/opentelemetry-baggage-pii-redaction-envelope-guardrail?format=cursor","windsurf":"/api/rules/opentelemetry-baggage-pii-redaction-envelope-guardrail?format=windsurf","agents":"/api/rules/opentelemetry-baggage-pii-redaction-envelope-guardrail?format=agents"}},{"id":"react-19-activity-offscreen-state-isolation","title":"React 19 Activity (Offscreen) Subtree & Layout Suspension Isolation","category":"frontend","severity":"critical","description":"Enforces strict isolation of deferred component subtrees encapsulated within React 19 Activity boundaries. Prevents layout thrashing, desynchronized UI hydration, and torn concurrent state reads by disallowing synchronous DOM layout measurements and direct global store writes while the subtree is deferred or hidden.","antiPatternHeadline":"Executing Synchronous DOM Measurements and Global Store Mutations Inside Inactive React 19 Activity Subtrees","stars_count":116,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","activity","offscreen","concurrent-rendering","state-management"],"exportEndpoints":{"claude":"/api/rules/react-19-activity-offscreen-state-isolation?format=claude","cursorMdc":"/api/rules/react-19-activity-offscreen-state-isolation?format=mdc","cursorrules":"/api/rules/react-19-activity-offscreen-state-isolation?format=cursor","windsurf":"/api/rules/react-19-activity-offscreen-state-isolation?format=windsurf","agents":"/api/rules/react-19-activity-offscreen-state-isolation?format=agents"}},{"id":"ebpf-xdp-hardware-offload-syn-flood-mitigation","title":"Linux eBPF XDP Hardware-Offload Ingress SYN Flood Mitigation","category":"devops","severity":"critical","description":"Enforces deterministic packet processing invariants for eBPF XDP programs configured for hardware-offload (`XDP_FLAGS_HW_MODE`) and native driver modes. Eliminates host CPU softIRQ starvation and memory bus saturation during multi-gigabit TCP SYN floods by strictly avoiding `sk_buff` allocation and ensuring verifier-compliant hardware-constrained execution.","antiPatternHeadline":"Attaching XDP in generic SKB mode or utilizing host-bound BPF helpers that trigger softIRQ saturation","stars_count":60,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","xdp","ddos-mitigation","linux-kernel","networking"],"exportEndpoints":{"claude":"/api/rules/ebpf-xdp-hardware-offload-syn-flood-mitigation?format=claude","cursorMdc":"/api/rules/ebpf-xdp-hardware-offload-syn-flood-mitigation?format=mdc","cursorrules":"/api/rules/ebpf-xdp-hardware-offload-syn-flood-mitigation?format=cursor","windsurf":"/api/rules/ebpf-xdp-hardware-offload-syn-flood-mitigation?format=windsurf","agents":"/api/rules/ebpf-xdp-hardware-offload-syn-flood-mitigation?format=agents"}},{"id":"compose-multiplatform-skiko-render-loop-synchronization","title":"Compose Multiplatform Skiko Render Loop & UI Thread Synchronization Guardrail","category":"mobile","severity":"critical","description":"Enforces strict decoupling of Compose snapshot state mutations from Skiko GPU rasterization cycles across iOS, Desktop, and Android targets. Eliminates rendering thread deadlocks, CADisplayLink/Choreographer stalls, and VSync drops caused by synchronous state reconciliation or bridge blocking during Skia frame rendering.","antiPatternHeadline":"Mutating Compose State or Invoking Synchronous Main Thread Dispatchers Inside Skiko Render Passes","stars_count":84,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","compose-multiplatform","skiko","kotlin","graphics","concurrency"],"exportEndpoints":{"claude":"/api/rules/compose-multiplatform-skiko-render-loop-synchronization?format=claude","cursorMdc":"/api/rules/compose-multiplatform-skiko-render-loop-synchronization?format=mdc","cursorrules":"/api/rules/compose-multiplatform-skiko-render-loop-synchronization?format=cursor","windsurf":"/api/rules/compose-multiplatform-skiko-render-loop-synchronization?format=windsurf","agents":"/api/rules/compose-multiplatform-skiko-render-loop-synchronization?format=agents"}},{"id":"react-19-server-action-idempotency-key-guardrail","title":"React 19 Server Action Idempotency Key Guardrail","category":"frontend","severity":"critical","description":"Enforces deterministic deduplication of state mutations across React 19 Server Actions interacting with optimistic UI transitions. Unmanaged optimistic rollbacks and automatic form resubmissions cause duplicate side-effects (e.g., double billing, duplicate records) across asynchronous network boundaries. All mutating Server Actions MUST require and validate client-generated UUIDv7 or cryptographic idempotency keys cached in a distributed transactional store.","antiPatternHeadline":"Executing non-idempotent Server Actions inside useActionState or useOptimistic without persistent transaction keys","stars_count":87,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","server-actions","idempotency","nextjs","distributed-transactions"],"exportEndpoints":{"claude":"/api/rules/react-19-server-action-idempotency-key-guardrail?format=claude","cursorMdc":"/api/rules/react-19-server-action-idempotency-key-guardrail?format=mdc","cursorrules":"/api/rules/react-19-server-action-idempotency-key-guardrail?format=cursor","windsurf":"/api/rules/react-19-server-action-idempotency-key-guardrail?format=windsurf","agents":"/api/rules/react-19-server-action-idempotency-key-guardrail?format=agents"}},{"id":"vite-6-environment-dual-runtime-boundary","title":"Vite 6 Environment API Dual-Runtime Isolation Guardrail","category":"frontend","severity":"critical","description":"Enforces strict isolation between Workerd (Edge) and Node.js environments during full-stack SSR compilation using Vite 6's Environment API. Prevents leaking Node.js built-ins, process state, and host-specific globals into edge isolates while guaranteeing deterministic module resolution boundaries.","antiPatternHeadline":"Leaking Node.js runtime primitives and ambient process state into Workerd edge SSR execution contexts.","stars_count":114,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","vite6","environment-api","workerd","cloudflare-workers","ssr","runtime-isolation"],"exportEndpoints":{"claude":"/api/rules/vite-6-environment-dual-runtime-boundary?format=claude","cursorMdc":"/api/rules/vite-6-environment-dual-runtime-boundary?format=mdc","cursorrules":"/api/rules/vite-6-environment-dual-runtime-boundary?format=cursor","windsurf":"/api/rules/vite-6-environment-dual-runtime-boundary?format=windsurf","agents":"/api/rules/vite-6-environment-dual-runtime-boundary?format=agents"}},{"id":"webauthn-prf-client-side-zk-encryption-standard","title":"WebAuthn PRF Zero-Knowledge Client-Side Key Derivation Standard","category":"security","severity":"critical","description":"Enforces strict client-side key derivation using the WebAuthn Pseudo-Random Function (PRF) extension (HMAC-secret) to derive hardware-bound symmetric encryption keys directly within the client sandbox. Prohibits transmission of PRF raw outputs, unhashed inputs, or derived master keys to remote backends, maintaining strict zero-knowledge security guarantees against server-side credential escrow vulnerabilities.","antiPatternHeadline":"Transmitting WebAuthn PRF Outputs or Deriving Cryptographic Storage Keys on the Backend","stars_count":114,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","prf","zero-knowledge","cryptography","passkeys","webcrypto"],"exportEndpoints":{"claude":"/api/rules/webauthn-prf-client-side-zk-encryption-standard?format=claude","cursorMdc":"/api/rules/webauthn-prf-client-side-zk-encryption-standard?format=mdc","cursorrules":"/api/rules/webauthn-prf-client-side-zk-encryption-standard?format=cursor","windsurf":"/api/rules/webauthn-prf-client-side-zk-encryption-standard?format=windsurf","agents":"/api/rules/webauthn-prf-client-side-zk-encryption-standard?format=agents"}},{"id":"openfga-contextual-tuple-evaluation-guardrail","title":"OpenFGA Real-Time Contextual Tuple Evaluation and Read-Amplification Invariant","category":"security","severity":"critical","description":"Enforces deterministic, sub-millisecond relationship authorization decisions by leveraging ephemeral OpenFGA contextual tuples at check time rather than persisting transient state to datastores. Mitigates recursive graph read amplification and database write churn while enforcing strict bounds on contextual tuple payload size.","antiPatternHeadline":"Persisting Ephemeral Request State to OpenFGA Storage or Omitting Contextual Tuples Causing Recursive Traversal Latency","stars_count":97,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","authorization","rebac","zanzibar","latency-optimization"],"exportEndpoints":{"claude":"/api/rules/openfga-contextual-tuple-evaluation-guardrail?format=claude","cursorMdc":"/api/rules/openfga-contextual-tuple-evaluation-guardrail?format=mdc","cursorrules":"/api/rules/openfga-contextual-tuple-evaluation-guardrail?format=cursor","windsurf":"/api/rules/openfga-contextual-tuple-evaluation-guardrail?format=windsurf","agents":"/api/rules/openfga-contextual-tuple-evaluation-guardrail?format=agents"}},{"id":"pg17-failover-synchronized-logical-replication-slots","title":"Postgres 17 Failover-Synchronized Logical Replication Slots Guardrail","category":"backend","severity":"critical","description":"Enforces failover-synchronized logical replication slot configurations and consumer reconnection contracts introduced in PostgreSQL 17. Guarantees zero data loss and eliminates manual slot rewinding or schema re-syncing during physical replica promotion.","antiPatternHeadline":"Creating unflagged logical replication slots without failover coordination or primary synchronized standby validation","stars_count":40,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","postgres-17","cdc","logical-replication","high-availability"],"exportEndpoints":{"claude":"/api/rules/pg17-failover-synchronized-logical-replication-slots?format=claude","cursorMdc":"/api/rules/pg17-failover-synchronized-logical-replication-slots?format=mdc","cursorrules":"/api/rules/pg17-failover-synchronized-logical-replication-slots?format=cursor","windsurf":"/api/rules/pg17-failover-synchronized-logical-replication-slots?format=windsurf","agents":"/api/rules/pg17-failover-synchronized-logical-replication-slots?format=agents"}},{"id":"go-chi-http3-0rtt-anti-replay-guardrail","title":"QUIC HTTP/3 0-RTT Early Data Anti-Replay Verification in Go Chi","category":"backend","severity":"critical","description":"Defends non-idempotent mutation routes in Go Chi HTTP/3 applications against network-level replay attacks via TLS 1.3 / QUIC 0-RTT early data. Enforces mandatory HTTP 425 (Too Early) rejections on unsafe methods or strict atomic distributed sliding-window replay caches keyed by TLS early data exporters and idempotency signatures.","antiPatternHeadline":"Executing Non-Idempotent Mutations on Unchecked QUIC 0-RTT Early Data Handshakes","stars_count":42,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","chi","http3","quic","0-rtt","anti-replay","security"],"exportEndpoints":{"claude":"/api/rules/go-chi-http3-0rtt-anti-replay-guardrail?format=claude","cursorMdc":"/api/rules/go-chi-http3-0rtt-anti-replay-guardrail?format=mdc","cursorrules":"/api/rules/go-chi-http3-0rtt-anti-replay-guardrail?format=cursor","windsurf":"/api/rules/go-chi-http3-0rtt-anti-replay-guardrail?format=windsurf","agents":"/api/rules/go-chi-http3-0rtt-anti-replay-guardrail?format=agents"}},{"id":"bun-isolated-heap-snapshot-multitenant-sandbox","title":"Bun 1.2 Isolated Heap Snapshot Multi-Tenant Sandbox Standard","category":"backend","severity":"critical","description":"Enforces cryptographic and memory tenant boundary isolation within high-density Bun 1.2 runtimes using pre-warmed deterministic V8 heap snapshots and Web Worker/Node VM boundaries. Prevents cross-tenant state poisoning, prototype mutation leakage, and unmetered execution cycles during multi-tenant execution without container overhead.","antiPatternHeadline":"Global Scope Mutation and Cross-Tenant State Pollution in Reused Bun Runtime Sandboxes","stars_count":72,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["bun","v8-snapshots","sandboxing","multi-tenancy","memory-isolation"],"exportEndpoints":{"claude":"/api/rules/bun-isolated-heap-snapshot-multitenant-sandbox?format=claude","cursorMdc":"/api/rules/bun-isolated-heap-snapshot-multitenant-sandbox?format=mdc","cursorrules":"/api/rules/bun-isolated-heap-snapshot-multitenant-sandbox?format=cursor","windsurf":"/api/rules/bun-isolated-heap-snapshot-multitenant-sandbox?format=windsurf","agents":"/api/rules/bun-isolated-heap-snapshot-multitenant-sandbox?format=agents"}},{"id":"kmp-zero-copy-pinned-buffer-invariant","title":"KMP Zero-Copy Direct Pinned Buffer Invariant for High-Throughput Streams","category":"mobile","severity":"critical","description":"Enforces deterministic zero-copy memory transfers between native C/POSIX/Apple APIs and Kotlin Multiplatform runtimes without triggering garbage collection pressure or cross-heap allocations. Mandates scoped memory pinning using `usePinned` or direct non-managed arena buffers for high-frequency media and sensor streaming. Prohibits converting native byte buffers into intermediary managed `ByteArray` instances within tight processing loops.","antiPatternHeadline":"Intermediary Managed ByteArray Allocations in High-Frequency C-Interop Pipelines","stars_count":44,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","c-interop","memory-management","zero-copy","performance"],"exportEndpoints":{"claude":"/api/rules/kmp-zero-copy-pinned-buffer-invariant?format=claude","cursorMdc":"/api/rules/kmp-zero-copy-pinned-buffer-invariant?format=mdc","cursorrules":"/api/rules/kmp-zero-copy-pinned-buffer-invariant?format=cursor","windsurf":"/api/rules/kmp-zero-copy-pinned-buffer-invariant?format=windsurf","agents":"/api/rules/kmp-zero-copy-pinned-buffer-invariant?format=agents"}},{"id":"opentelemetry-in-process-exemplar-rate-limiter-guardrail","title":"OpenTelemetry In-Process Tail-Based Exemplar Sampling Rate-Limiter","category":"devops","severity":"critical","description":"Enforces deterministic, in-process rate limiting and tail-based filtering for OpenTelemetry metric exemplars prior to export. Unconstrained exemplar attachment during high-throughput bursts injects unbounded high-cardinality trace contexts into metric series, exhausting collector memory and triggering OOM cascading failures across observability pipelines.","antiPatternHeadline":"Unchecked Metric Exemplar Attachment and Unbounded In-Memory Cardinality Spikes Under High QPS","stars_count":92,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","metrics","tracing","exemplars","rate-limiting"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-in-process-exemplar-rate-limiter-guardrail?format=claude","cursorMdc":"/api/rules/opentelemetry-in-process-exemplar-rate-limiter-guardrail?format=mdc","cursorrules":"/api/rules/opentelemetry-in-process-exemplar-rate-limiter-guardrail?format=cursor","windsurf":"/api/rules/opentelemetry-in-process-exemplar-rate-limiter-guardrail?format=windsurf","agents":"/api/rules/opentelemetry-in-process-exemplar-rate-limiter-guardrail?format=agents"}},{"id":"cilium-ebpf-socket-mtls-guardrail","title":"Cilium eBPF Host-Level Kernel Socket mTLS & Zero-Trust Invariant","category":"devops","severity":"critical","description":"Enforces sidecarless, kernel-space mutual authentication and transparent cryptographic encapsulation using Cilium eBPF sockops, WireGuard/IPsec acceleration, and SPIRE/SPIFFE attestation. Prohibits the injection of legacy user-space sidecar proxies that induce memory fragmentation and double-serialization penalties. Guarantees that socket-level redirection (sockmap/bpf_msg) remains unbroken across all pod-to-pod communication channels.","antiPatternHeadline":"Deploying Heavyweight User-Space Sidecar Proxies That Break eBPF Sockops Acceleration and Induce Memory Bloat","stars_count":100,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","cilium","ebpf","mtls","kubernetes","zero-trust","networking"],"exportEndpoints":{"claude":"/api/rules/cilium-ebpf-socket-mtls-guardrail?format=claude","cursorMdc":"/api/rules/cilium-ebpf-socket-mtls-guardrail?format=mdc","cursorrules":"/api/rules/cilium-ebpf-socket-mtls-guardrail?format=cursor","windsurf":"/api/rules/cilium-ebpf-socket-mtls-guardrail?format=windsurf","agents":"/api/rules/cilium-ebpf-socket-mtls-guardrail?format=agents"}},{"id":"w3c-dbsc-session-binding-guardrail-w3c-device-bound-219","title":"W3C Device Bound Session Credentials (DBSC) TPM/Enclave Invariant Standard","category":"security","severity":"critical","description":"Enforces strict server-side validation and client-side lifecycle management for W3C Device Bound Session Credentials (DBSC). Protects against session hijacking, adversary-in-the-middle (AitM) attacks, and malware infostealer cookie exfiltration by cryptographically binding HTTP session cookies to a public key anchored in the device's hardware security module (TPM or Apple Secure Enclave). Requires rigorous verification of session challenge-response JWT proofs, short-lived cookie lifetimes, and atomic session termination upon signature or challenge mismatch.","antiPatternHeadline":"Bearer-Only Session Issuance Without Hardware Proof of Possession Verification","stars_count":79,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","dbsc","cryptography","authentication","tpm","secure-enclave"],"exportEndpoints":{"claude":"/api/rules/w3c-dbsc-session-binding-guardrail-w3c-device-bound-219?format=claude","cursorMdc":"/api/rules/w3c-dbsc-session-binding-guardrail-w3c-device-bound-219?format=mdc","cursorrules":"/api/rules/w3c-dbsc-session-binding-guardrail-w3c-device-bound-219?format=cursor","windsurf":"/api/rules/w3c-dbsc-session-binding-guardrail-w3c-device-bound-219?format=windsurf","agents":"/api/rules/w3c-dbsc-session-binding-guardrail-w3c-device-bound-219?format=agents"}},{"id":"k8s-dra-gpu-partitioning-boundary-standard","title":"Deterministic PCIe Topology Isolation and Memory Reservation in Kubernetes DRA","category":"devops","severity":"critical","description":"Enforces strict hardware-aligned partition boundaries using Kubernetes Dynamic Resource Allocation (DRA) resource claims for multi-tenant GPU workloads. Prevents non-deterministic host-to-device PCIe bandwidth saturation, cross-NUMA cross-talk, and OOM cascades caused by unreserved MIG slices or unpinned NVLink topologies in multi-tenant heterogenous clusters.","antiPatternHeadline":"Unconstrained Multi-Tenant GPU Allocation via Legacy Extended Resources Bypassing PCIe Topology and Memory Hard Limits","stars_count":79,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","kubernetes","dra","gpu-partitioning","pcie-topology","mlops"],"exportEndpoints":{"claude":"/api/rules/k8s-dra-gpu-partitioning-boundary-standard?format=claude","cursorMdc":"/api/rules/k8s-dra-gpu-partitioning-boundary-standard?format=mdc","cursorrules":"/api/rules/k8s-dra-gpu-partitioning-boundary-standard?format=cursor","windsurf":"/api/rules/k8s-dra-gpu-partitioning-boundary-standard?format=windsurf","agents":"/api/rules/k8s-dra-gpu-partitioning-boundary-standard?format=agents"}},{"id":"pg17-failover-slot-synchronization-protocol","title":"PostgreSQL 17 Failover Slot Synchronization and Invalidation Protocol","category":"backend","severity":"critical","description":"Enforces PostgreSQL 17 native failover-capable logical replication slot management, physical standby alignment via standby_slot_names, and strict monitoring of slot invalidation states. Guarantees zero logical data divergence and prevents silent consumer stalls during high-availability primary failover events.","antiPatternHeadline":"Creating Non-Failover Logical Replication Slots Without Physical Standby Alignment and Invalidation Auditing","stars_count":79,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql-17","logical-replication","high-availability","failover-slots"],"exportEndpoints":{"claude":"/api/rules/pg17-failover-slot-synchronization-protocol?format=claude","cursorMdc":"/api/rules/pg17-failover-slot-synchronization-protocol?format=mdc","cursorrules":"/api/rules/pg17-failover-slot-synchronization-protocol?format=cursor","windsurf":"/api/rules/pg17-failover-slot-synchronization-protocol?format=windsurf","agents":"/api/rules/pg17-failover-slot-synchronization-protocol?format=agents"}},{"id":"webgpu-pipeline-compilation-memory-budgeting","title":"WebGPU Asynchronous Pipeline Pre-warming and Deterministic VRAM Budgeting","category":"frontend","severity":"critical","description":"Enforces non-blocking WebGPU initialization and deterministic resource allocation to prevent runtime frame drops and browser GPU process termination. Mandates explicit asynchronous pipeline pre-compilation via createRenderPipelineAsync/createComputePipelineAsync and strict VRAM accounting with deterministic buffer and texture lifecycle disposal.","antiPatternHeadline":"Synchronous Pipeline Creation in Render Paths and Unbudgeted VRAM Allocation Leading to Tab Crashes","stars_count":98,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","webgpu","graphics","performance","memory-management","vram"],"exportEndpoints":{"claude":"/api/rules/webgpu-pipeline-compilation-memory-budgeting?format=claude","cursorMdc":"/api/rules/webgpu-pipeline-compilation-memory-budgeting?format=mdc","cursorrules":"/api/rules/webgpu-pipeline-compilation-memory-budgeting?format=cursor","windsurf":"/api/rules/webgpu-pipeline-compilation-memory-budgeting?format=windsurf","agents":"/api/rules/webgpu-pipeline-compilation-memory-budgeting?format=agents"}},{"id":"compose-skiko-surface-synchronization-standard","title":"Compose Multiplatform Skiko Vulkan/Metal Surface Synchronization Guardrail","category":"mobile","severity":"critical","description":"Enforces deterministic synchronization between off-screen GPU texture updates and native platform presentation surfaces (Metal CAMetalLayer and Vulkan VkSwapchainKHR) in Compose Multiplatform. Prevents visual tearing, thread deadlocks, and presentation jitter by mandating non-blocking Skiko render delegate synchronization and asynchronous command buffer completion fences.","antiPatternHeadline":"Mutating GPU textures synchronously on application dispatchers without Skia GrDirectContext flush synchronization or native swapchain fences.","stars_count":62,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","compose-multiplatform","skiko","metal","vulkan","gpu-rendering"],"exportEndpoints":{"claude":"/api/rules/compose-skiko-surface-synchronization-standard?format=claude","cursorMdc":"/api/rules/compose-skiko-surface-synchronization-standard?format=mdc","cursorrules":"/api/rules/compose-skiko-surface-synchronization-standard?format=cursor","windsurf":"/api/rules/compose-skiko-surface-synchronization-standard?format=windsurf","agents":"/api/rules/compose-skiko-surface-synchronization-standard?format=agents"}},{"id":"spiffe-spire-ephemeral-svid-attestation-gate","title":"Short-Lived SPIFFE X.509 SVID Attestation and In-Memory Rotation Gate","category":"security","severity":"critical","description":"Eliminates static secrets and long-lived credentials by enforcing dynamic, sub-minute X.509 SVID identity issuance through the SPIRE Workload API. Mandates stream-backed in-memory TLS context rotation over local UNIX domain sockets with strict SPIFFE ID SAN validation, explicitly barring certificate caching to persistent disk storage.","antiPatternHeadline":"Persisting Workload Certificates to Disk or Using Static TLS Bundles Instead of SPIRE Workload API In-Memory Watchers","stars_count":69,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","spiffe","spire","zero-trust","mtls","x509","microsegmentation"],"exportEndpoints":{"claude":"/api/rules/spiffe-spire-ephemeral-svid-attestation-gate?format=claude","cursorMdc":"/api/rules/spiffe-spire-ephemeral-svid-attestation-gate?format=mdc","cursorrules":"/api/rules/spiffe-spire-ephemeral-svid-attestation-gate?format=cursor","windsurf":"/api/rules/spiffe-spire-ephemeral-svid-attestation-gate?format=windsurf","agents":"/api/rules/spiffe-spire-ephemeral-svid-attestation-gate?format=agents"}},{"id":"bun-websocket-backpressure-drain-protocol","title":"Bun 1.2 Native WebSocket Zero-Loss Backpressure Drain Protocol","category":"backend","severity":"critical","description":"Guarantees process resilience under high-concurrency event bursts by wiring kernel socket drain readiness directly to async iterator flow-control. Prevents silent message drops and memory bloat caused by unmonitored uWebSockets buffers in Bun.serve.","antiPatternHeadline":"Fire-and-forget ws.send in unthrottled loops triggering uSockets buffer overflow and process OOM.","stars_count":54,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","websocket","backpressure","concurrency","performance"],"exportEndpoints":{"claude":"/api/rules/bun-websocket-backpressure-drain-protocol?format=claude","cursorMdc":"/api/rules/bun-websocket-backpressure-drain-protocol?format=mdc","cursorrules":"/api/rules/bun-websocket-backpressure-drain-protocol?format=cursor","windsurf":"/api/rules/bun-websocket-backpressure-drain-protocol?format=windsurf","agents":"/api/rules/bun-websocket-backpressure-drain-protocol?format=agents"}},{"id":"angular-19-zoneless-signal-graph-reactive-consistency-boundary","title":"Angular 19 Zoneless Signal-Graph Reactive Consistency Boundary","category":"frontend","severity":"critical","description":"Enforces an acyclic, glitch-free signal derivation graph in Angular 19 zoneless runtimes. Eliminates diamond-dependency inconsistencies, circular microtask queuing, and SSR hydration mismatches by banning signal-writing side-effects in favor of pure derivations and linked signals.","antiPatternHeadline":"Mutating writable signals inside effects to synchronize state, inducing diamond-dependency microtask tearing and broken hydration.","stars_count":58,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","angular","angular19","zoneless","signals","hydration","reactivity"],"exportEndpoints":{"claude":"/api/rules/angular-19-zoneless-signal-graph-reactive-consistency-boundary?format=claude","cursorMdc":"/api/rules/angular-19-zoneless-signal-graph-reactive-consistency-boundary?format=mdc","cursorrules":"/api/rules/angular-19-zoneless-signal-graph-reactive-consistency-boundary?format=cursor","windsurf":"/api/rules/angular-19-zoneless-signal-graph-reactive-consistency-boundary?format=windsurf","agents":"/api/rules/angular-19-zoneless-signal-graph-reactive-consistency-boundary?format=agents"}},{"id":"capacitor7-android15-edge-to-edge-windowinsets-invariant","title":"Capacitor 7 Android 15 Edge-to-Edge Dynamic WindowInsets and IME Synchronization Invariant","category":"mobile","severity":"critical","description":"Android 15 (API 35) strictly enforces edge-to-edge display by default, causing Capacitor 7 WebViews to render behind system bars and the soft keyboard (IME). This guardrail mandates binding platform WindowInsetsCompat events to atomic CSS custom properties via coordinated requestAnimationFrame updates to prevent viewport occlusion, layout jumps, and visual thrashing.","antiPatternHeadline":"Relying on Stale env(safe-area-inset-*) or Unsynchronized Window Resizing During Android 15 Edge-to-Edge Transitions","stars_count":84,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["capacitor","android15","windowinsets","edge-to-edge","viewport","keyboard","mobile"],"exportEndpoints":{"claude":"/api/rules/capacitor7-android15-edge-to-edge-windowinsets-invariant?format=claude","cursorMdc":"/api/rules/capacitor7-android15-edge-to-edge-windowinsets-invariant?format=mdc","cursorrules":"/api/rules/capacitor7-android15-edge-to-edge-windowinsets-invariant?format=cursor","windsurf":"/api/rules/capacitor7-android15-edge-to-edge-windowinsets-invariant?format=windsurf","agents":"/api/rules/capacitor7-android15-edge-to-edge-windowinsets-invariant?format=agents"}},{"id":"cilium-tetragon-lsm-privilege-escalation-guardrail","title":"Synchronous eBPF LSM Namespace and Unshare Privilege Escalation Prevention","category":"devops","severity":"critical","description":"Enforces synchronous in-kernel blocking of container breakout and unshare privilege escalation attempts via Cilium Tetragon eBPF Linux Security Module (LSM) hooks. Prevents kernel execution of unauthorized namespace creation (CLONE_NEWUSER) and capability escalation by triggering immediate SIGKILL actions prior to syscall completion.","antiPatternHeadline":"Relying on Asynchronous Audit-Only Kprobes for Container Breakout Detection","stars_count":114,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","cilium","tetragon","ebpf","lsm","security","kubernetes"],"exportEndpoints":{"claude":"/api/rules/cilium-tetragon-lsm-privilege-escalation-guardrail?format=claude","cursorMdc":"/api/rules/cilium-tetragon-lsm-privilege-escalation-guardrail?format=mdc","cursorrules":"/api/rules/cilium-tetragon-lsm-privilege-escalation-guardrail?format=cursor","windsurf":"/api/rules/cilium-tetragon-lsm-privilege-escalation-guardrail?format=windsurf","agents":"/api/rules/cilium-tetragon-lsm-privilege-escalation-guardrail?format=agents"}},{"id":"fastapi-lifespan-taskgroup-drain-invariant","title":"FastAPI Lifespan TaskGroup ExceptionGroup Drain Invariant","category":"backend","severity":"critical","description":"Guarantees that background workers, message consumers, and persistent coroutines managed within FastAPI lifespan contexts utilize Python 3.12+ asyncio.TaskGroup with graceful cancellation and comprehensive ExceptionGroup unwinding. Prevents silent coroutine abandonment, zombie connection leaks, and SIGTERM worker deadlocks during graceful shutdown. Enforces clean context drain before the ASGI application server finalizes process termination.","antiPatternHeadline":"Fire-and-Forget asyncio.create_task Inside FastAPI Lifespan Without TaskGroup Drain or ExceptionGroup Handlers","stars_count":88,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","asyncio","python312","concurrency","error-handling"],"exportEndpoints":{"claude":"/api/rules/fastapi-lifespan-taskgroup-drain-invariant?format=claude","cursorMdc":"/api/rules/fastapi-lifespan-taskgroup-drain-invariant?format=mdc","cursorrules":"/api/rules/fastapi-lifespan-taskgroup-drain-invariant?format=cursor","windsurf":"/api/rules/fastapi-lifespan-taskgroup-drain-invariant?format=windsurf","agents":"/api/rules/fastapi-lifespan-taskgroup-drain-invariant?format=agents"}},{"id":"react19-use-action-state-transition-coalescing-invariant","title":"React 19 useActionState Concurrent Transition Queue Coalescing Invariant","category":"frontend","severity":"critical","description":"Enforces strict deterministic sequential resolution of overlapping concurrent transitions triggered by rapid user actions in React 19. Prevents UI tearing, optimistic state corruption, and race conditions by ensuring asynchronous action handlers consumed by useActionState never bypass React's internal fiber transition queue with uncoordinated external mutable state or unsynchronized ref access.","antiPatternHeadline":"Bypassing React 19 Fiber Transition Queueing with Unsynchronized Refs or Non-Transitioned Async Mutators","stars_count":104,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react19","useActionState","concurrency","transitions","state-coalescing"],"exportEndpoints":{"claude":"/api/rules/react19-use-action-state-transition-coalescing-invariant?format=claude","cursorMdc":"/api/rules/react19-use-action-state-transition-coalescing-invariant?format=mdc","cursorrules":"/api/rules/react19-use-action-state-transition-coalescing-invariant?format=cursor","windsurf":"/api/rules/react19-use-action-state-transition-coalescing-invariant?format=windsurf","agents":"/api/rules/react19-use-action-state-transition-coalescing-invariant?format=agents"}},{"id":"bun-websocket-backpressure-drain-protocol-bun-1-2-websocke-336","title":"Bun 1.2 WebSocket Backpressure High-Watermark Drain Protocol","category":"backend","severity":"critical","description":"Enforces mandatory backpressure inspection via ServerWebSocket.getBufferedAmount() and asynchronous drain checkpoint synchronization in Bun 1.2 native WebSocket servers. High-throughput fan-out broadcasts without backpressure tracking queue unbounded native payloads in the underlying C++/JavaScriptCore boundary, triggering silent OOM termination under load. Adherence guarantees deterministic flow control and bounded heap allocations across concurrent subscriber sets.","antiPatternHeadline":"Unchecked Fire-and-Forget ServerWebSocket.send() in Mass Broadcast Loops","stars_count":58,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","websockets","backpressure","memory-management","performance"],"exportEndpoints":{"claude":"/api/rules/bun-websocket-backpressure-drain-protocol-bun-1-2-websocke-336?format=claude","cursorMdc":"/api/rules/bun-websocket-backpressure-drain-protocol-bun-1-2-websocke-336?format=mdc","cursorrules":"/api/rules/bun-websocket-backpressure-drain-protocol-bun-1-2-websocke-336?format=cursor","windsurf":"/api/rules/bun-websocket-backpressure-drain-protocol-bun-1-2-websocke-336?format=windsurf","agents":"/api/rules/bun-websocket-backpressure-drain-protocol-bun-1-2-websocke-336?format=agents"}},{"id":"postgres-17-logical-failover-slot-sync-production-standard","title":"Postgres 17 Logical Replication Failover Slot Synchronization Boundary","category":"backend","severity":"critical","description":"Enforces strict failover configuration and synchronization boundaries for logical replication slots in PostgreSQL 17. Guarantees zero data loss and prevents duplicated change data capture (CDC) streaming events during physical replica failover by requiring failover-enabled slots and synchronized standby slot verification before consumer consumption.","antiPatternHeadline":"Unsynchronized Standby Failovers Causing Slot Dropping, Re-Streaming Storms, or Data Gaps","stars_count":52,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql-17","logical-replication","cdc","failover","high-availability"],"exportEndpoints":{"claude":"/api/rules/postgres-17-logical-failover-slot-sync-production-standard?format=claude","cursorMdc":"/api/rules/postgres-17-logical-failover-slot-sync-production-standard?format=mdc","cursorrules":"/api/rules/postgres-17-logical-failover-slot-sync-production-standard?format=cursor","windsurf":"/api/rules/postgres-17-logical-failover-slot-sync-production-standard?format=windsurf","agents":"/api/rules/postgres-17-logical-failover-slot-sync-production-standard?format=agents"}},{"id":"cmp-direct-memory-render-buffer-pacing-guardrail","title":"Compose Multiplatform Direct-Memory Render Buffer Pacing Guardrail","category":"mobile","severity":"critical","description":"Prevents catastrophic off-heap native memory exhaustion and micro-stutter during rapid vector path and bitmap render loops across Skia, Metal, and Vulkan backends. Enforces synchronous native surface handle recycling, double-buffering cadence synchronization, and strict disposal of intermediate org.jetbrains.skia graphics objects within Compose Multiplatform drawing routines.","antiPatternHeadline":"Unmanaged Off-Heap Skia Allocations and Unthrottled Native Pixel Buffer Reallocations in Canvas Draw Loops","stars_count":114,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","compose-multiplatform","skiko","skia","metal","memory-management","render-pacing"],"exportEndpoints":{"claude":"/api/rules/cmp-direct-memory-render-buffer-pacing-guardrail?format=claude","cursorMdc":"/api/rules/cmp-direct-memory-render-buffer-pacing-guardrail?format=mdc","cursorrules":"/api/rules/cmp-direct-memory-render-buffer-pacing-guardrail?format=cursor","windsurf":"/api/rules/cmp-direct-memory-render-buffer-pacing-guardrail?format=windsurf","agents":"/api/rules/cmp-direct-memory-render-buffer-pacing-guardrail?format=agents"}},{"id":"fedcm-multi-idp-disconnect-autoreauth-boundary","title":"FedCM Multi-IdP Disconnect & Auto-Reauth Token Boundary Enforcement","category":"security","severity":"critical","description":"Enforces cryptographically bound nonces, explicit IdentityCredential.disconnect invocations upon session revocation, and strict mediation policy controls across Multi-IdP FedCM flows. Prevents cross-account token fixation, unauthenticated auto-reauth bypasses, and cross-site tracking across federated identity boundaries.","antiPatternHeadline":"Permissive Multi-IdP Auto-Reauth without Nonce Binding and Missing IdentityCredential.disconnect Cleanup","stars_count":68,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","fedcm","identity","authentication","web-crypto","oauth-oidc"],"exportEndpoints":{"claude":"/api/rules/fedcm-multi-idp-disconnect-autoreauth-boundary?format=claude","cursorMdc":"/api/rules/fedcm-multi-idp-disconnect-autoreauth-boundary?format=mdc","cursorrules":"/api/rules/fedcm-multi-idp-disconnect-autoreauth-boundary?format=cursor","windsurf":"/api/rules/fedcm-multi-idp-disconnect-autoreauth-boundary?format=windsurf","agents":"/api/rules/fedcm-multi-idp-disconnect-autoreauth-boundary?format=agents"}},{"id":"sigstore-rekor-intoto-ephemeral-identity-verification","title":"Sigstore Rekor In-Toto Attestation & Ephemeral OIDC Verification Standard","category":"security","severity":"critical","description":"Mandates strict cryptographic provenance verification of keyless Sigstore signatures, Rekor transparency log inclusion proofs, and In-Toto attestations before container image admission. Validates short-lived Fulcio X.509 certificates against sub-second ephemeral OIDC claims to prevent supply-chain spoofing, compromised long-lived credentials, and admission of unverified container digests.","antiPatternHeadline":"Trusting unverified image digests, ignoring Rekor inclusion proofs, or bypassing ephemeral OIDC SAN identity matching in admission controllers.","stars_count":48,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","sigstore","rekor","cosign","in-toto","supply-chain","kubernetes-admission","oidc"],"exportEndpoints":{"claude":"/api/rules/sigstore-rekor-intoto-ephemeral-identity-verification?format=claude","cursorMdc":"/api/rules/sigstore-rekor-intoto-ephemeral-identity-verification?format=mdc","cursorrules":"/api/rules/sigstore-rekor-intoto-ephemeral-identity-verification?format=cursor","windsurf":"/api/rules/sigstore-rekor-intoto-ephemeral-identity-verification?format=windsurf","agents":"/api/rules/sigstore-rekor-intoto-ephemeral-identity-verification?format=agents"}},{"id":"otel-profiling-dynamic-adaptive-sampling-rate-sharding-standard","title":"OpenTelemetry Continuous Profiling Dynamic Adaptive Sampling & eBPF Budget Invariant","category":"devops","severity":"critical","description":"Continuous eBPF and runtime pprof CPU profilers must enforce dynamic adaptive sampling frequency scaling and hash-ring profile sharding based on real-time tail-latency (p99/p999) degradation and kernel overhead metrics. Unregulated static kernel-level sampling rates (e.g., rigid 99Hz timers across all cores) cause catastrophic cascading CPU cache eviction and ring-buffer drop events during tail-latency saturation events.","antiPatternHeadline":"Static Unsharded eBPF/Pprof Profiling Rates Inducing Observer Overhead Cascades Under Load","stars_count":101,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","ebpf","continuous-profiling","adaptive-sampling","pprof"],"exportEndpoints":{"claude":"/api/rules/otel-profiling-dynamic-adaptive-sampling-rate-sharding-standard?format=claude","cursorMdc":"/api/rules/otel-profiling-dynamic-adaptive-sampling-rate-sharding-standard?format=mdc","cursorrules":"/api/rules/otel-profiling-dynamic-adaptive-sampling-rate-sharding-standard?format=cursor","windsurf":"/api/rules/otel-profiling-dynamic-adaptive-sampling-rate-sharding-standard?format=windsurf","agents":"/api/rules/otel-profiling-dynamic-adaptive-sampling-rate-sharding-standard?format=agents"}},{"id":"k8s-dra-gpu-partition-quota-boundary","title":"Deterministic GPU Slice Quota Boundaries via Kubernetes Dynamic Resource Allocation","category":"devops","severity":"critical","description":"Preempts CUDA out-of-memory cascading node failures and resource starvation by enforcing strict Kubernetes Dynamic Resource Allocation (DRA) resource claims. Mandates hardware-isolated sub-GPU slice configurations (such as NVIDIA MIG or compute slices) within ResourceClaimTemplates and ResourceClaims at pod scheduling time, eliminating oversubscription and non-deterministic memory boundaries.","antiPatternHeadline":"Unbounded GPU Sharing and Legacy Limits Leading to CUDA OOM Cascades","stars_count":107,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","kubernetes","dra","gpu-partitioning","cuda","mig","infrastructure-as-code"],"exportEndpoints":{"claude":"/api/rules/k8s-dra-gpu-partition-quota-boundary?format=claude","cursorMdc":"/api/rules/k8s-dra-gpu-partition-quota-boundary?format=mdc","cursorrules":"/api/rules/k8s-dra-gpu-partition-quota-boundary?format=cursor","windsurf":"/api/rules/k8s-dra-gpu-partition-quota-boundary?format=windsurf","agents":"/api/rules/k8s-dra-gpu-partition-quota-boundary?format=agents"}},{"id":"react19-rsc-taint-boundary-guardrail","title":"React 19 Server Component Cryptographic & Credential Taint Boundary Invariants","category":"frontend","severity":"critical","description":"Enforces strict cryptographic and identity isolation by utilizing React 19's experimental taint APIs alongside server-only boundary declarations. Prevents accidental serialization of raw user records, API keys, and sensitive tokens across the React Server Components (RSC) Flight protocol payload boundary to client components. Mandates explicit data projection patterns to sanitize all payloads traversing the server-client boundary.","antiPatternHeadline":"Leaking Sensitive Entity Objects and Tokens Across RSC Serialization Boundaries Without Taint Traps","stars_count":113,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react19","rsc","security","taint-api","nextjs"],"exportEndpoints":{"claude":"/api/rules/react19-rsc-taint-boundary-guardrail?format=claude","cursorMdc":"/api/rules/react19-rsc-taint-boundary-guardrail?format=mdc","cursorrules":"/api/rules/react19-rsc-taint-boundary-guardrail?format=cursor","windsurf":"/api/rules/react19-rsc-taint-boundary-guardrail?format=windsurf","agents":"/api/rules/react19-rsc-taint-boundary-guardrail?format=agents"}},{"id":"vite6-environment-runtime-leakage-fence","title":"Vite 6 Environment API Cross-Runtime Module Graph Isolation & Secret Fence","category":"frontend","severity":"critical","description":"Enforces strict isolation between Vite 6 client, edge, and SSR runtime module graphs using the Environment API. Prevents server-only credentials, platform bindings, and unpolyfilled Node.js built-ins from traversing the module boundary into client-facing bundles.","antiPatternHeadline":"Unfenced Module Sharing Between SSR/Edge and Client Graphs Leading to Token Exfiltration and Runtime Failures","stars_count":113,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","vite6","environment-api","ssr","security","module-graph"],"exportEndpoints":{"claude":"/api/rules/vite6-environment-runtime-leakage-fence?format=claude","cursorMdc":"/api/rules/vite6-environment-runtime-leakage-fence?format=mdc","cursorrules":"/api/rules/vite6-environment-runtime-leakage-fence?format=cursor","windsurf":"/api/rules/vite6-environment-runtime-leakage-fence?format=windsurf","agents":"/api/rules/vite6-environment-runtime-leakage-fence?format=agents"}},{"id":"bun-isolated-worker-memory-quarantine","title":"Bun 1.2 Isolated Worker Memory Quarantine & Heap Ceiling Enforcement","category":"backend","severity":"critical","description":"Enforces strict heap resource boundaries and deterministic lifecycle quarantine on isolated Bun Worker threads in multi-tenant runtimes. Prevents single-tenant runaway memory allocations or memory leaks from triggering OS-level OOM killer (SIGKILL) signals that terminate the primary parent Bun HTTP cluster.","antiPatternHeadline":"Spawning Unbounded Multi-Tenant Workers Without Heap Caps, Smol Mode, or Watchdog Eviction","stars_count":104,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["bun","worker-threads","multi-tenant","memory-quarantine","oom-prevention","backend"],"exportEndpoints":{"claude":"/api/rules/bun-isolated-worker-memory-quarantine?format=claude","cursorMdc":"/api/rules/bun-isolated-worker-memory-quarantine?format=mdc","cursorrules":"/api/rules/bun-isolated-worker-memory-quarantine?format=cursor","windsurf":"/api/rules/bun-isolated-worker-memory-quarantine?format=windsurf","agents":"/api/rules/bun-isolated-worker-memory-quarantine?format=agents"}},{"id":"fastapi-pydantic-v2-strict-extra-forbid-guardrail","title":"Pydantic V2 Strict-Mode and Extra-Field Forbid Enforcement in FastAPI","category":"backend","severity":"critical","description":"Enforces strict validation mode and extra='forbid' across all Pydantic v2 schemas ingested by FastAPI endpoints. Mitigates mass-assignment vulnerabilities, prototype pollution equivalents, and polymorphic payload smuggling across high-throughput ingress pipelines by terminating requests carrying unmodeled fields with an HTTP 422 Unprocessable Entity.","antiPatternHeadline":"Implicit Permissiveness via Default Model Config Allowing Unmodeled Attributes and Type Coercion Exploits","stars_count":95,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["fastapi","pydantic-v2","security","mass-assignment","input-validation","python"],"exportEndpoints":{"claude":"/api/rules/fastapi-pydantic-v2-strict-extra-forbid-guardrail?format=claude","cursorMdc":"/api/rules/fastapi-pydantic-v2-strict-extra-forbid-guardrail?format=mdc","cursorrules":"/api/rules/fastapi-pydantic-v2-strict-extra-forbid-guardrail?format=cursor","windsurf":"/api/rules/fastapi-pydantic-v2-strict-extra-forbid-guardrail?format=windsurf","agents":"/api/rules/fastapi-pydantic-v2-strict-extra-forbid-guardrail?format=agents"}},{"id":"kmp-secure-native-memory-zeroization-standard","title":"Kotlin Multiplatform Deterministic Cryptographic Memory Zeroization Guardrail","category":"mobile","severity":"critical","description":"Enforces deterministic cryptographic key and biometric token zeroization across Android ART and iOS native runtimes. Mandates pinned, off-heap, or mutable byte buffer allocations purged via volatile compiler-barrier memory wiping immediately after use to eliminate retention in swap space, core dumps, or compacting garbage collection passes.","antiPatternHeadline":"Leaking Ephemeral Cryptographic Secrets to Unmanaged GC Heaps via Immutable Strings or Unscrubbed ByteArrays","stars_count":75,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","kmp","cryptography","memory-safety","ios","android"],"exportEndpoints":{"claude":"/api/rules/kmp-secure-native-memory-zeroization-standard?format=claude","cursorMdc":"/api/rules/kmp-secure-native-memory-zeroization-standard?format=mdc","cursorrules":"/api/rules/kmp-secure-native-memory-zeroization-standard?format=cursor","windsurf":"/api/rules/kmp-secure-native-memory-zeroization-standard?format=windsurf","agents":"/api/rules/kmp-secure-native-memory-zeroization-standard?format=agents"}},{"id":"capacitor-7-universal-link-integrity-guardrail","title":"Capacitor 7 Universal Link App-Site Association Integrity Guardrail","category":"mobile","severity":"critical","description":"Enforces strict origin validation and association integrity for Capacitor 7 Universal Links (iOS) and Android App Links. Mitigates rogue deep-link intent hijacking and parameter tampering by mandating runtime domain verification, strict HTTPS enforcement, and origin-bound deep-link payload sanitization.","antiPatternHeadline":"Blind Deep-Link Ingestion via Unvalidated App URL Handlers","stars_count":86,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["capacitor","mobile-security","deep-linking","universal-links","app-links","intent-hijacking"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-universal-link-integrity-guardrail?format=claude","cursorMdc":"/api/rules/capacitor-7-universal-link-integrity-guardrail?format=mdc","cursorrules":"/api/rules/capacitor-7-universal-link-integrity-guardrail?format=cursor","windsurf":"/api/rules/capacitor-7-universal-link-integrity-guardrail?format=windsurf","agents":"/api/rules/capacitor-7-universal-link-integrity-guardrail?format=agents"}},{"id":"openfga-signed-contextual-tuples-invariant","title":"Mandatory Cryptographic Verification for Ephemeral OpenFGA Contextual Tuples","category":"security","severity":"critical","description":"Enforces asymmetric Ed25519 or HMAC-SHA256 signature verification on all client-provided contextual tuples before passing them to OpenFGA check evaluations. Unsigned or arbitrary contextual claims allow untrusted clients to synthesize ad-hoc relationship assertions (e.g., dynamic roles, tenant elevation) and bypass fine-grained access control boundaries.","antiPatternHeadline":"Injecting Untrusted Client-Supplied Contextual Tuples Directly into OpenFGA Check Calls","stars_count":56,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","authorization","cryptography","zero-trust","ed25519"],"exportEndpoints":{"claude":"/api/rules/openfga-signed-contextual-tuples-invariant?format=claude","cursorMdc":"/api/rules/openfga-signed-contextual-tuples-invariant?format=mdc","cursorrules":"/api/rules/openfga-signed-contextual-tuples-invariant?format=cursor","windsurf":"/api/rules/openfga-signed-contextual-tuples-invariant?format=windsurf","agents":"/api/rules/openfga-signed-contextual-tuples-invariant?format=agents"}},{"id":"ebpf-lsm-bprm-exec-lockdown-guardrail","title":"eBPF LSM bprm_creds_for_exec Ephemeral Binary Lockdown","category":"security","severity":"critical","description":"Intercepts kernel bprm_creds_for_exec hooks via eBPF Linux Security Modules (LSM) to enforce immutable execution boundaries within zero-trust distroless containers. Prevents post-exploitation arbitrary binary execution, fileless payload spawning via memfd_create, and runtime process drift by enforcing cryptographic hash verification or strict cgroup-pinned execution allowlists in ring 0. Enforces immediate kernel-level denial with -EPERM and zero-allocation ringbuffer telemetry before process credential transitions finalize.","antiPatternHeadline":"Relying on Userspace Namespaces or Read-Only Rootfs Without Kernel-Enforced Execution Verification","stars_count":96,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","ebpf","lsm","kernel","zero-trust","container-hardening"],"exportEndpoints":{"claude":"/api/rules/ebpf-lsm-bprm-exec-lockdown-guardrail?format=claude","cursorMdc":"/api/rules/ebpf-lsm-bprm-exec-lockdown-guardrail?format=mdc","cursorrules":"/api/rules/ebpf-lsm-bprm-exec-lockdown-guardrail?format=cursor","windsurf":"/api/rules/ebpf-lsm-bprm-exec-lockdown-guardrail?format=windsurf","agents":"/api/rules/ebpf-lsm-bprm-exec-lockdown-guardrail?format=agents"}},{"id":"otel-genai-token-circuit-breaker","title":"OpenTelemetry GenAI Token Budget & Financial Circuit Breaker Standard","category":"devops","severity":"critical","description":"Enforces real-time aggregation of OpenTelemetry semantic convention GenAI span metrics (`gen_ai.usage.input_tokens`, `gen_ai.usage.output_tokens`) across agentic execution graphs. Mandates immediate circuit breaker trips and graceful loop termination when cumulative financial costs or sliding-window latency bounds breach predefined envelopes.","antiPatternHeadline":"Unbounded Agentic Execution Loops Without In-Flight Telemetry-Driven Cost Circuit Breakers","stars_count":88,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","genai","circuit-breaker","resilience","observability"],"exportEndpoints":{"claude":"/api/rules/otel-genai-token-circuit-breaker?format=claude","cursorMdc":"/api/rules/otel-genai-token-circuit-breaker?format=mdc","cursorrules":"/api/rules/otel-genai-token-circuit-breaker?format=cursor","windsurf":"/api/rules/otel-genai-token-circuit-breaker?format=windsurf","agents":"/api/rules/otel-genai-token-circuit-breaker?format=agents"}},{"id":"tauri-v2-scoped-ipc-capability-manifest-enforcement","title":"Tauri 2.0 Scoped IPC Capability Manifest Enforcement","category":"mobile","severity":"critical","description":"Enforces least-privilege IPC capability manifests and granular path scoping in Tauri 2.0 mobile applications. Unscoped IPC capabilities allow compromised WebViews to access native Android/iOS runtime APIs, bypass sandbox boundaries, and exfiltrate private mobile app storage.","antiPatternHeadline":"Blanket Wildcard Plugin Permissions and Unscoped Native IPC Bindings in Mobile WebViews","stars_count":108,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri","ipc","security","rust"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-scoped-ipc-capability-manifest-enforcement?format=claude","cursorMdc":"/api/rules/tauri-v2-scoped-ipc-capability-manifest-enforcement?format=mdc","cursorrules":"/api/rules/tauri-v2-scoped-ipc-capability-manifest-enforcement?format=cursor","windsurf":"/api/rules/tauri-v2-scoped-ipc-capability-manifest-enforcement?format=windsurf","agents":"/api/rules/tauri-v2-scoped-ipc-capability-manifest-enforcement?format=agents"}},{"id":"vite6-multiruntime-environment-boundary-isolation","title":"Vite 6 Environment API: Strict Multi-Runtime Module Boundary Isolation","category":"frontend","severity":"critical","description":"Enforces strict runtime module isolation using Vite 6 Environment API across Client, Node.js, and Workerd compilation targets. Eliminates server-side secret exposure, platform-specific polyfill contamination, and native runtime module leakage into browser asset graphs through dedicated environment pipelines and conditional resolution.","antiPatternHeadline":"Monolithic Multi-Target Vite Configurations Leaking Server Secrets and Node Runtimes into Browser Bundles","stars_count":90,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","vite6","environments-api","workerd","nodejs","security","bundling"],"exportEndpoints":{"claude":"/api/rules/vite6-multiruntime-environment-boundary-isolation?format=claude","cursorMdc":"/api/rules/vite6-multiruntime-environment-boundary-isolation?format=mdc","cursorrules":"/api/rules/vite6-multiruntime-environment-boundary-isolation?format=cursor","windsurf":"/api/rules/vite6-multiruntime-environment-boundary-isolation?format=windsurf","agents":"/api/rules/vite6-multiruntime-environment-boundary-isolation?format=agents"}},{"id":"postgres-17-json-table-zero-copy-projection-postgresql-17-js-302","title":"PostgreSQL 17 JSON_TABLE Zero-Copy Relational Projection Standard","category":"backend","severity":"critical","description":"Mandates the use of PostgreSQL 17 standard SQL/JSON JSON_TABLE projections for high-throughput semi-structured ingestion pipelines instead of client-side array deserialization or legacy jsonb_array_elements expansions. This eliminates Node.js heap exhaustion and database backend palloc bloat by transforming JSON payloads directly into typed relational tuples in-engine with zero intermediate allocations.","antiPatternHeadline":"Client-Side JSON Array Unpacking and Quadratic Cartesian jsonb_array_elements Ingestion","stars_count":104,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","json-table","zero-copy","performance","sql"],"exportEndpoints":{"claude":"/api/rules/postgres-17-json-table-zero-copy-projection-postgresql-17-js-302?format=claude","cursorMdc":"/api/rules/postgres-17-json-table-zero-copy-projection-postgresql-17-js-302?format=mdc","cursorrules":"/api/rules/postgres-17-json-table-zero-copy-projection-postgresql-17-js-302?format=cursor","windsurf":"/api/rules/postgres-17-json-table-zero-copy-projection-postgresql-17-js-302?format=windsurf","agents":"/api/rules/postgres-17-json-table-zero-copy-projection-postgresql-17-js-302?format=agents"}},{"id":"openfga-contextual-tuple-cache-consistency-standard","title":"OpenFGA Linearizable ReBAC Evaluation & Contextual Cache Invalidation","category":"security","severity":"critical","description":"Guarantees linearizable relationship-based access control (ReBAC) evaluations across distributed caches without introducing read-after-write authorization race conditions. Mandates strict consistency fences, contextual tuple propagation on in-flight mutations, and deterministic cache invalidation boundaries.","antiPatternHeadline":"Asynchronous tuple writes followed by unversioned cached checks causing authorization bypass or revocation lag.","stars_count":53,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","rebac","zanzibar","cache-consistency","distributed-systems"],"exportEndpoints":{"claude":"/api/rules/openfga-contextual-tuple-cache-consistency-standard?format=claude","cursorMdc":"/api/rules/openfga-contextual-tuple-cache-consistency-standard?format=mdc","cursorrules":"/api/rules/openfga-contextual-tuple-cache-consistency-standard?format=cursor","windsurf":"/api/rules/openfga-contextual-tuple-cache-consistency-standard?format=windsurf","agents":"/api/rules/openfga-contextual-tuple-cache-consistency-standard?format=agents"}},{"id":"fastapi-asyncio-taskgroup-structured-concurrency","title":"FastAPI Asyncio TaskGroup Structured Concurrency Guardrail","category":"backend","severity":"critical","description":"Enforces strict structured concurrency in FastAPI and Python 3.11+ services using asyncio.TaskGroup instead of fire-and-forget asyncio.create_task or unsupervised asyncio.gather. Guarantees that failure in any concurrent sub-task immediately triggers cooperative cancellation across sibling coroutines and propagates an ExceptionGroup, eliminating silent coroutine leaks, orphaned database connections, and zombie processing loops.","antiPatternHeadline":"Unsupervised fire-and-forget asyncio.create_task or unconstrained asyncio.gather leading to zombie coroutines and swallowed exceptions","stars_count":89,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","asyncio","python","concurrency","reliability"],"exportEndpoints":{"claude":"/api/rules/fastapi-asyncio-taskgroup-structured-concurrency?format=claude","cursorMdc":"/api/rules/fastapi-asyncio-taskgroup-structured-concurrency?format=mdc","cursorrules":"/api/rules/fastapi-asyncio-taskgroup-structured-concurrency?format=cursor","windsurf":"/api/rules/fastapi-asyncio-taskgroup-structured-concurrency?format=windsurf","agents":"/api/rules/fastapi-asyncio-taskgroup-structured-concurrency?format=agents"}},{"id":"axum-h3-quic-stream-cancellation-guardrail","title":"Axum HTTP/3 QUIC Unilateral Stream Cancellation & Socket Buffer Bounding Standard","category":"backend","severity":"critical","description":"Enforces strict bounds on concurrent QUIC streams, stream cancellation velocity, and transport-level buffer allocation in Rust Axum/h3 services. Prevents memory exhaustion and edge-node CPU saturation caused by malicious client-side rapid stream reset floods (RESET_STREAM and STOP_SENDING frames).","antiPatternHeadline":"Unbounded QUIC Stream Concurrency and Unmonitored Stream Resets Allowing Hyper-Scale Edge DoS","stars_count":65,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","http3","quic","dos-mitigation","security"],"exportEndpoints":{"claude":"/api/rules/axum-h3-quic-stream-cancellation-guardrail?format=claude","cursorMdc":"/api/rules/axum-h3-quic-stream-cancellation-guardrail?format=mdc","cursorrules":"/api/rules/axum-h3-quic-stream-cancellation-guardrail?format=cursor","windsurf":"/api/rules/axum-h3-quic-stream-cancellation-guardrail?format=windsurf","agents":"/api/rules/axum-h3-quic-stream-cancellation-guardrail?format=agents"}},{"id":"ebpf-sockops-zerocopy-transit-guardrail","title":"eBPF Sockops Zero-Copy Inter-Pod Transit & Identity Attestation","category":"devops","severity":"critical","description":"Enforces deterministic socket redirection via eBPF sockops (BPF_PROG_TYPE_SOCK_OPS) and sockhash (BPF_MAP_TYPE_SOCKHASH) for co-located intra-node Kubernetes pod networking. Mandates that local TCP/IP stack bypass maintains mutual identity attestation, SPIFFE/SPIRE SVID contextual integrity, and fallback egress telemetry without short-circuiting network security policies.","antiPatternHeadline":"Unconditional BPF sk_msg Redirect Bypassing Netfilter Without Cryptographic Identity and Socket Policy Attestation","stars_count":40,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","sockops","kubernetes","cilium","zero-copy","networking"],"exportEndpoints":{"claude":"/api/rules/ebpf-sockops-zerocopy-transit-guardrail?format=claude","cursorMdc":"/api/rules/ebpf-sockops-zerocopy-transit-guardrail?format=mdc","cursorrules":"/api/rules/ebpf-sockops-zerocopy-transit-guardrail?format=cursor","windsurf":"/api/rules/ebpf-sockops-zerocopy-transit-guardrail?format=windsurf","agents":"/api/rules/ebpf-sockops-zerocopy-transit-guardrail?format=agents"}},{"id":"kmp-ios-coroutine-cancellation-propagation","title":"KMP Structured Coroutine Cancellation Propagation on iOS Main RunLoop","category":"mobile","severity":"critical","description":"Standardizes Swift-Kotlin task cancellation bridging across the Kotlin/Native boundary to prevent unhandled CancellationException termination on the iOS Main RunLoop. Enforces explicit Task.withTaskCancellationHandler lifecycle coupling and translates Kotlin CancellationException into Swift's native CancellationError during high-frequency UI navigation transitions.","antiPatternHeadline":"Leaking Orphaned Kotlin Coroutines and Crashing iOS Runtimes via Unhandled CancellationException Across Swift Concurrency Bridges","stars_count":48,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kmp","kotlin-multiplatform","swift","coroutines","concurrency","ios"],"exportEndpoints":{"claude":"/api/rules/kmp-ios-coroutine-cancellation-propagation?format=claude","cursorMdc":"/api/rules/kmp-ios-coroutine-cancellation-propagation?format=mdc","cursorrules":"/api/rules/kmp-ios-coroutine-cancellation-propagation?format=cursor","windsurf":"/api/rules/kmp-ios-coroutine-cancellation-propagation?format=windsurf","agents":"/api/rules/kmp-ios-coroutine-cancellation-propagation?format=agents"}},{"id":"wasi-p2-component-sandbox-security","title":"Deterministic Capability-Based WASI 0.2 Sandboxing for Multi-Tenant Runtimes","category":"security","severity":"critical","description":"Enforces strict capability-based isolation for WASI 0.2 (Preview 2) Component Model runtimes embedded in multi-tenant services. Mandates zero ambient authority inheritance by forbidding default host filesystem, socket, and stdio bindings, requiring isolated per-tenant WasiCtx instances with explicit resource table quotas, fuel limits, and epoch interruption.","antiPatternHeadline":"Ambient Authority Leakage via Unrestricted WASI Context and Inherited Host Capabilities","stars_count":90,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","wasm","wasi-preview-2","wasmtime","sandboxing","multi-tenant"],"exportEndpoints":{"claude":"/api/rules/wasi-p2-component-sandbox-security?format=claude","cursorMdc":"/api/rules/wasi-p2-component-sandbox-security?format=mdc","cursorrules":"/api/rules/wasi-p2-component-sandbox-security?format=cursor","windsurf":"/api/rules/wasi-p2-component-sandbox-security?format=windsurf","agents":"/api/rules/wasi-p2-component-sandbox-security?format=agents"}},{"id":"slsa-level-3-intoto-provenance-gate","title":"SLSA Level 3 In-Toto Hermetic Provenance Verification Gate","category":"devops","severity":"critical","description":"Enforces strict cluster admission control requiring all container workloads to carry cryptographically verifiable SLSA Level 3 in-toto provenance generated by isolated, ephemeral build environments. Deployments are rejected at reconciliation if OCI digest signatures, transparency log entries, or builder identities fail verification against defined supply chain invariants.","antiPatternHeadline":"Admitting OCI Artifacts with Unverified Provenance or Mutable Tag Referencing","stars_count":85,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","slsa","sigstore","in-toto","security","admission-control","supply-chain"],"exportEndpoints":{"claude":"/api/rules/slsa-level-3-intoto-provenance-gate?format=claude","cursorMdc":"/api/rules/slsa-level-3-intoto-provenance-gate?format=mdc","cursorrules":"/api/rules/slsa-level-3-intoto-provenance-gate?format=cursor","windsurf":"/api/rules/slsa-level-3-intoto-provenance-gate?format=windsurf","agents":"/api/rules/slsa-level-3-intoto-provenance-gate?format=agents"}},{"id":"react-19-server-action-optimistic-reconciliation","title":"Deterministic Optimistic State Reconciliation and Rollback Invariant","category":"frontend","severity":"critical","description":"Enforces deterministic reconciliation and transactional rollback of client optimistic states during aborted, timed-out, or failed React 19 Server Actions. Eliminates state tearing, uncoordinated multi-state resets, and cascading layout thrashing by mandating idiomatic use of useOptimistic alongside useActionState within transition boundaries.","antiPatternHeadline":"Ad-Hoc Imperative Optimistic State Management with Manual Rollbacks Triggering Layout Thrashing","stars_count":95,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react19","server-actions","use-optimistic","transitions","performance"],"exportEndpoints":{"claude":"/api/rules/react-19-server-action-optimistic-reconciliation?format=claude","cursorMdc":"/api/rules/react-19-server-action-optimistic-reconciliation?format=mdc","cursorrules":"/api/rules/react-19-server-action-optimistic-reconciliation?format=cursor","windsurf":"/api/rules/react-19-server-action-optimistic-reconciliation?format=windsurf","agents":"/api/rules/react-19-server-action-optimistic-reconciliation?format=agents"}},{"id":"svelte-5-runes-async-effect-teardown-guardrail","title":"Svelte 5 Runes Microtask & Async $effect Lifecycle Teardown Guardrail","category":"frontend","severity":"critical","description":"Enforces strict synchronous cleanup return contracts and AbortController cancellation patterns within Svelte 5 $effect runes. Prevents detached DOM tree leaks, race conditions, and orphaned microtasks in long-lived single-page dashboards.","antiPatternHeadline":"Passing Async Functions to $effect or Omitting Microtask Abort Mechanisms Leading to Leaked Closures","stars_count":91,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","memory-leaks","lifecycle","performance"],"exportEndpoints":{"claude":"/api/rules/svelte-5-runes-async-effect-teardown-guardrail?format=claude","cursorMdc":"/api/rules/svelte-5-runes-async-effect-teardown-guardrail?format=mdc","cursorrules":"/api/rules/svelte-5-runes-async-effect-teardown-guardrail?format=cursor","windsurf":"/api/rules/svelte-5-runes-async-effect-teardown-guardrail?format=windsurf","agents":"/api/rules/svelte-5-runes-async-effect-teardown-guardrail?format=agents"}},{"id":"axum-tower-service-backpressure-invariant","title":"Axum 0.8 Tower Service Backpressure and Buffer Saturation Isolation","category":"backend","severity":"critical","description":"Enforces strict per-route backpressure isolation in Axum 0.8 using Tower's poll_ready flow control and bounded mpsc buffers. Prevents sudden traffic bursts on unbuffered routes from saturating the shared Tokio multi-threaded runtime and starving adjacent tenant workloads.","antiPatternHeadline":"Global Unbounded Ingestion and Missing poll_ready Propagation Causing Tokio Thread Pool Starvation","stars_count":96,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tower","concurrency","tokio","backpressure"],"exportEndpoints":{"claude":"/api/rules/axum-tower-service-backpressure-invariant?format=claude","cursorMdc":"/api/rules/axum-tower-service-backpressure-invariant?format=mdc","cursorrules":"/api/rules/axum-tower-service-backpressure-invariant?format=cursor","windsurf":"/api/rules/axum-tower-service-backpressure-invariant?format=windsurf","agents":"/api/rules/axum-tower-service-backpressure-invariant?format=agents"}},{"id":"bun-ffi-pointer-lifecycle-pinning","title":"Bun 1.2 Native C-FFI Pointer Lifecycle Pinning & GC Anchoring","category":"backend","severity":"critical","description":"Enforces strict heap anchoring for typed arrays, buffers, and native pointers bridged to C dynamic libraries via `bun:ffi`. Prevents catastrophic use-after-free, memory corruption, and silent segmentation faults triggered by JavaScriptCore garbage collection sweeps during zero-copy asynchronous native execution.","antiPatternHeadline":"Passing Unanchored JavaScript Allocations as Zero-Copy Raw C-Pointers Across Async FFI Boundaries","stars_count":99,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","ffi","memory-safety","c-interop","jsc"],"exportEndpoints":{"claude":"/api/rules/bun-ffi-pointer-lifecycle-pinning?format=claude","cursorMdc":"/api/rules/bun-ffi-pointer-lifecycle-pinning?format=mdc","cursorrules":"/api/rules/bun-ffi-pointer-lifecycle-pinning?format=cursor","windsurf":"/api/rules/bun-ffi-pointer-lifecycle-pinning?format=windsurf","agents":"/api/rules/bun-ffi-pointer-lifecycle-pinning?format=agents"}},{"id":"valkey-8-tiered-storage-vector-eviction-guardrail","title":"Valkey 8.0 Tiered Storage: Isolate Vector Slabs from Hot Cluster Routing Metadata","category":"backend","severity":"critical","description":"Enforces strict memory arena segregation and eviction exclusion for cluster routing metadata during NVMe flash-tier offload surges in Valkey 8.0. Prevents vector index graph slabs and embedding payloads from starving the cluster bus, causing hash slot routing amnesia, or evicting topology tables under flash I/O pressure.","antiPatternHeadline":"Evicting hot cluster routing metadata and slot tables under vector indexing memory spikes during NVMe tiered-storage saturation","stars_count":104,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","valkey","tiered-storage","vector-search","nvme-offload","cluster-topology","memory-management"],"exportEndpoints":{"claude":"/api/rules/valkey-8-tiered-storage-vector-eviction-guardrail?format=claude","cursorMdc":"/api/rules/valkey-8-tiered-storage-vector-eviction-guardrail?format=mdc","cursorrules":"/api/rules/valkey-8-tiered-storage-vector-eviction-guardrail?format=cursor","windsurf":"/api/rules/valkey-8-tiered-storage-vector-eviction-guardrail?format=windsurf","agents":"/api/rules/valkey-8-tiered-storage-vector-eviction-guardrail?format=agents"}},{"id":"webauthn-hybrid-transport-relay-guardrail","title":"WebAuthn Hybrid Transport Cross-Device Relay and Session-Pinning Guardrail","category":"security","severity":"critical","description":"Enforces cryptographic client-data verification and ephemeral session-binding invariants during WebAuthn cross-device (hybrid/caBLE) authentication. Prevents adversary-in-the-middle (AiTM) QR-code passkey relay attacks by mandating strict origin pinning, server-side challenge-to-session tying, and crossOrigin flag validation.","antiPatternHeadline":"Unpinned Hybrid Passkey Relay Permitting Adversary-in-the-Middle Origin Masquerading","stars_count":84,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","passkeys","fido2","hybrid-transport","relay-defense","origin-binding"],"exportEndpoints":{"claude":"/api/rules/webauthn-hybrid-transport-relay-guardrail?format=claude","cursorMdc":"/api/rules/webauthn-hybrid-transport-relay-guardrail?format=mdc","cursorrules":"/api/rules/webauthn-hybrid-transport-relay-guardrail?format=cursor","windsurf":"/api/rules/webauthn-hybrid-transport-relay-guardrail?format=windsurf","agents":"/api/rules/webauthn-hybrid-transport-relay-guardrail?format=agents"}},{"id":"openid-federation-trust-chain-pop-standard","title":"OpenID Federation 1.0 Trust Chain Dynamic Resolution and Proof-of-Possession","category":"security","severity":"critical","description":"Enforces dynamic, cryptographic trust verification for cross-domain identity assertions using OpenID Federation 1.0 trust chains, strictly eliminating long-lived, static OAuth client secrets across multi-cloud meshes. Requires recursive cryptographic validation of signed Entity Statements up to an explicitly pinned Trust Anchor, paired with ephemeral asymmetric Proof-of-Possession (PoP) DPoP/mTLS key-binding.","antiPatternHeadline":"Bypassing Dynamic Trust Chains with Static Shared Secrets or Unanchored Entity Statements","stars_count":115,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","oauth2","openid-federation","trust-chain","proof-of-possession","jwt","zero-trust"],"exportEndpoints":{"claude":"/api/rules/openid-federation-trust-chain-pop-standard?format=claude","cursorMdc":"/api/rules/openid-federation-trust-chain-pop-standard?format=mdc","cursorrules":"/api/rules/openid-federation-trust-chain-pop-standard?format=cursor","windsurf":"/api/rules/openid-federation-trust-chain-pop-standard?format=windsurf","agents":"/api/rules/openid-federation-trust-chain-pop-standard?format=agents"}},{"id":"envoy-gateway-wasm-linear-memory-hard-cap-invariant","title":"Envoy Gateway 1.3 WebAssembly Linear Memory Hard-Cap and Isolation Bounds","category":"devops","severity":"critical","description":"Enforces strict Wasm guest virtual machine linear memory boundaries and resource isolation inside Envoy Gateway 1.3 EnvoyExtensionPolicy manifests. Unbounded dynamic WebAssembly heap allocations cause Envoy worker thread memory fragmentation, OOM killer evictions, and host process segmentation core dumps under load spikes. Mandates explicit memory limits, fail-open/fail-closed isolation policies, and validated runtime configuration parameters.","antiPatternHeadline":"Uncapped Wasm VM Linear Heap Allocation Triggering Envoy Worker SIGSEGV and Host OOM Kills","stars_count":65,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","envoy-gateway","webassembly","proxy-wasm","memory-management","kubernetes"],"exportEndpoints":{"claude":"/api/rules/envoy-gateway-wasm-linear-memory-hard-cap-invariant?format=claude","cursorMdc":"/api/rules/envoy-gateway-wasm-linear-memory-hard-cap-invariant?format=mdc","cursorrules":"/api/rules/envoy-gateway-wasm-linear-memory-hard-cap-invariant?format=cursor","windsurf":"/api/rules/envoy-gateway-wasm-linear-memory-hard-cap-invariant?format=windsurf","agents":"/api/rules/envoy-gateway-wasm-linear-memory-hard-cap-invariant?format=agents"}},{"id":"cilium-hardware-attested-spiffe-wireguard-standard","title":"Cilium 1.17 TPM-Attested SPIFFE ID WireGuard Transit Standard","category":"devops","severity":"critical","description":"Enforces hardware-rooted TPM 2.0 cryptographic attestation for SPIFFE IDs across Cilium 1.17 WireGuard mesh tunnels. Prevents cross-cluster pod identity spoofing on heterogeneous edge nodes by strictly binding pod SVID issuance to validated node PCR states and mandating mutual SPIRE authentication within CiliumNetworkPolicies.","antiPatternHeadline":"Unattested Soft Token Mesh Joins and Unauthenticated WireGuard Transit","stars_count":88,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","cilium","spiffe","spire","tpm","wireguard","kubernetes","zero-trust","security"],"exportEndpoints":{"claude":"/api/rules/cilium-hardware-attested-spiffe-wireguard-standard?format=claude","cursorMdc":"/api/rules/cilium-hardware-attested-spiffe-wireguard-standard?format=mdc","cursorrules":"/api/rules/cilium-hardware-attested-spiffe-wireguard-standard?format=cursor","windsurf":"/api/rules/cilium-hardware-attested-spiffe-wireguard-standard?format=windsurf","agents":"/api/rules/cilium-hardware-attested-spiffe-wireguard-standard?format=agents"}},{"id":"react-19-server-components-secret-taint-invariant","title":"React 19 Server Components Secret Taint Invariant","category":"frontend","severity":"critical","description":"Enforces server-side cryptographic and PII memory tainting using React 19's experimental_taintUniqueValue and experimental_taintObjectReference APIs. Guarantees that sensitive environment secrets, credentials, and raw PII records are structurally barred from serializing across the React Server Components (RSC) client-server network boundary.","antiPatternHeadline":"Passing Un-tainted Raw Database Records or API Credentials Through Server Components to Client Boundaries","stars_count":111,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","rsc","security","taint-api","pii"],"exportEndpoints":{"claude":"/api/rules/react-19-server-components-secret-taint-invariant?format=claude","cursorMdc":"/api/rules/react-19-server-components-secret-taint-invariant?format=mdc","cursorrules":"/api/rules/react-19-server-components-secret-taint-invariant?format=cursor","windsurf":"/api/rules/react-19-server-components-secret-taint-invariant?format=windsurf","agents":"/api/rules/react-19-server-components-secret-taint-invariant?format=agents"}},{"id":"vite6-environment-api-cross-runtime-sandbox-invariant","title":"Vite 6 Environment API Cross-Runtime Sandbox Invariant","category":"frontend","severity":"critical","description":"Enforces strict execution boundaries across heterogeneous runtimes (Browser, Node.js SSR, and Edge/Workerd) managed by the Vite 6 Environment API. Prohibits ambient global state pollution, cross-runtime module graph leakage, and legacy non-scoped SSR hooks during build and HMR cycles. Guarantees deterministic module evaluation across concurrently active DevEnvironment instances.","antiPatternHeadline":"Ambient Global Mutation and Cross-Environment Module Graph Coupling in Multi-Runtime Vite Applications","stars_count":97,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["vite","vite-6","environment-api","ssr","workerd","runtime-isolation","hmr"],"exportEndpoints":{"claude":"/api/rules/vite6-environment-api-cross-runtime-sandbox-invariant?format=claude","cursorMdc":"/api/rules/vite6-environment-api-cross-runtime-sandbox-invariant?format=mdc","cursorrules":"/api/rules/vite6-environment-api-cross-runtime-sandbox-invariant?format=cursor","windsurf":"/api/rules/vite6-environment-api-cross-runtime-sandbox-invariant?format=windsurf","agents":"/api/rules/vite6-environment-api-cross-runtime-sandbox-invariant?format=agents"}},{"id":"go-chi-http3-early-data-anti-replay-go-chi-http-3-ea-558","title":"Go Chi HTTP/3 Early-Data 0-RTT Anti-Replay Guardrail","category":"backend","severity":"critical","description":"Protects state-mutating HTTP endpoints against TLS 1.3 and QUIC HTTP/3 0-RTT early data replay attacks by enforcing RFC 8470 compliance. Mandates edge multiplexer middleware in Go Chi to reject non-idempotent early-data requests with HTTP 425 Too Early or validate them against a distributed single-use replay cache.","antiPatternHeadline":"Executing state-mutating operations over unvalidated 0-RTT QUIC/TLS early data without replay gating","stars_count":89,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","chi","http3","quic","tls13","replay-attack","security"],"exportEndpoints":{"claude":"/api/rules/go-chi-http3-early-data-anti-replay-go-chi-http-3-ea-558?format=claude","cursorMdc":"/api/rules/go-chi-http3-early-data-anti-replay-go-chi-http-3-ea-558?format=mdc","cursorrules":"/api/rules/go-chi-http3-early-data-anti-replay-go-chi-http-3-ea-558?format=cursor","windsurf":"/api/rules/go-chi-http3-early-data-anti-replay-go-chi-http-3-ea-558?format=windsurf","agents":"/api/rules/go-chi-http3-early-data-anti-replay-go-chi-http-3-ea-558?format=agents"}},{"id":"tauri-v2-mobile-ipc-capability-scoping-tauri-2-0-ipc-gr-504","title":"Tauri 2.0 Mobile IPC Capability Manifest and Permission Boundary Enforcement","category":"mobile","severity":"critical","description":"Enforces strict principle-of-least-privilege capability manifests and explicit permission files in Tauri 2.0 mobile architectures. Disallows wildcard IPC exposure, unconstrained remote origins, and global command access to prevent cross-origin privilege escalation and remote code execution via mobile WebViews.","antiPatternHeadline":"Wildcard Capability Manifests Exposing Native Rust Commands to Untrusted Web Contexts","stars_count":71,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["tauri","mobile","security","ipc","rust","capabilities"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-mobile-ipc-capability-scoping-tauri-2-0-ipc-gr-504?format=claude","cursorMdc":"/api/rules/tauri-v2-mobile-ipc-capability-scoping-tauri-2-0-ipc-gr-504?format=mdc","cursorrules":"/api/rules/tauri-v2-mobile-ipc-capability-scoping-tauri-2-0-ipc-gr-504?format=cursor","windsurf":"/api/rules/tauri-v2-mobile-ipc-capability-scoping-tauri-2-0-ipc-gr-504?format=windsurf","agents":"/api/rules/tauri-v2-mobile-ipc-capability-scoping-tauri-2-0-ipc-gr-504?format=agents"}},{"id":"capacitor-7-native-bridge-thread-concurrency-invariant","title":"Capacitor 7 Native Bridge Thread Concurrency Invariant","category":"mobile","severity":"critical","description":"Mandates asynchronous background worker offloading for all custom native Capacitor 7 plugin implementations to prevent native main UI thread starvation. Heavy file operations, cryptographic calculations, database transactions, and network I/O must execute on dedicated background queues or coroutine dispatchers before resolving back through the Capacitor bridge.","antiPatternHeadline":"Executing Blocking I/O or Compute Directly on the Native UI/Main Dispatch Thread in Capacitor Plugins","stars_count":51,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","ios","android","concurrency","native-bridge"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-native-bridge-thread-concurrency-invariant?format=claude","cursorMdc":"/api/rules/capacitor-7-native-bridge-thread-concurrency-invariant?format=mdc","cursorrules":"/api/rules/capacitor-7-native-bridge-thread-concurrency-invariant?format=cursor","windsurf":"/api/rules/capacitor-7-native-bridge-thread-concurrency-invariant?format=windsurf","agents":"/api/rules/capacitor-7-native-bridge-thread-concurrency-invariant?format=agents"}},{"id":"webauthn-conditional-ui-replay-guardrail-standard","title":"WebAuthn Conditional UI Mediation and Replay-Resistant Challenge Standard","category":"security","severity":"critical","description":"Enforces cryptographic replay resistance and atomic invalidation for WebAuthn autofill (Conditional Mediation) flows. Prevents credential stuffing, passkey enumeration, and token replay attacks by strictly binding autofill credentials to single-use, server-anchored ephemeral challenges tied to an authenticated session state.","antiPatternHeadline":"Unbound Ephemeral Challenges and Static Re-used Nonces in Conditional Autofill WebAuthn Requests","stars_count":49,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","fido2","passkeys","replay-attack","authentication"],"exportEndpoints":{"claude":"/api/rules/webauthn-conditional-ui-replay-guardrail-standard?format=claude","cursorMdc":"/api/rules/webauthn-conditional-ui-replay-guardrail-standard?format=mdc","cursorrules":"/api/rules/webauthn-conditional-ui-replay-guardrail-standard?format=cursor","windsurf":"/api/rules/webauthn-conditional-ui-replay-guardrail-standard?format=windsurf","agents":"/api/rules/webauthn-conditional-ui-replay-guardrail-standard?format=agents"}},{"id":"openfga-modular-schema-migration-invariant","title":"OpenFGA Modular Schema Migration and Staged Dual-Model Deployment Invariant","category":"security","severity":"critical","description":"Enforces backward-compatible Relationship-Based Access Control (ReBAC) evaluations across distributed OpenFGA topologies during modular schema evolution. Prohibits in-place relation deprecation and immediate default authorization model re-pointing without dual-writing tuples and executing staged shadow-evaluation phases. Eliminates transient authorization denial-of-service, split-brain graph resolution, and privilege escalation during asynchronous multi-region cutovers.","antiPatternHeadline":"Direct Model Cutover and Immediate Tuple Re-Typing Without Dual-Model Ingestion Staging","stars_count":66,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","rebac","authorization","schema-migrations","distributed-systems"],"exportEndpoints":{"claude":"/api/rules/openfga-modular-schema-migration-invariant?format=claude","cursorMdc":"/api/rules/openfga-modular-schema-migration-invariant?format=mdc","cursorrules":"/api/rules/openfga-modular-schema-migration-invariant?format=cursor","windsurf":"/api/rules/openfga-modular-schema-migration-invariant?format=windsurf","agents":"/api/rules/openfga-modular-schema-migration-invariant?format=agents"}},{"id":"cilium-ebpf-wireguard-mesh-encryption-standard","title":"Cilium eBPF Host-to-Host WireGuard Mesh Encryption Standard","category":"devops","severity":"critical","description":"Enforces zero-overhead, in-kernel WireGuard transport encryption across Kubernetes pod-to-pod and host-to-host fabrics using Cilium eBPF. Eliminates userspace proxy sidecar memory and latency penalties while ensuring full network fabric privacy without packet fragmentation. Mandates strict kernel prerequisites, MTU headrooms, and complete node-to-node encryption coverage.","antiPatternHeadline":"Partial Pod-Only Mesh Encryption with Unadjusted MTU and Userspace Sidecar Duplication","stars_count":49,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","cilium","ebpf","wireguard","kubernetes","networking","security"],"exportEndpoints":{"claude":"/api/rules/cilium-ebpf-wireguard-mesh-encryption-standard?format=claude","cursorMdc":"/api/rules/cilium-ebpf-wireguard-mesh-encryption-standard?format=mdc","cursorrules":"/api/rules/cilium-ebpf-wireguard-mesh-encryption-standard?format=cursor","windsurf":"/api/rules/cilium-ebpf-wireguard-mesh-encryption-standard?format=windsurf","agents":"/api/rules/cilium-ebpf-wireguard-mesh-encryption-standard?format=agents"}},{"id":"opentelemetry-async-span-linking-boundary-standard","title":"OpenTelemetry Asynchronous Span Linking & Trace Context Boundary Standard","category":"devops","severity":"critical","description":"Mandates explicit OpenTelemetry span linking across asynchronous message queues, event brokers, and detached background jobs instead of forging synthetic parent-child hierarchies. Ensures consumer execution latency is decoupled from producer trace lifespans while maintaining full bidirectional causal graph integrity in distributed telemetry backends.","antiPatternHeadline":"Forging direct parent-child trace spans across decoupled messaging brokers causing corrupted trace graphs and unbounded parent durations.","stars_count":104,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","distributed-tracing","observability","message-brokers","event-driven"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-async-span-linking-boundary-standard?format=claude","cursorMdc":"/api/rules/opentelemetry-async-span-linking-boundary-standard?format=mdc","cursorrules":"/api/rules/opentelemetry-async-span-linking-boundary-standard?format=cursor","windsurf":"/api/rules/opentelemetry-async-span-linking-boundary-standard?format=windsurf","agents":"/api/rules/opentelemetry-async-span-linking-boundary-standard?format=agents"}},{"id":"nextjs-15-ppr-streaming-shell-isolation-invariant","title":"Next.js 15 PPR Streaming Shell & Dynamic Context Isolation Invariant","category":"frontend","severity":"critical","description":"Enforces strict structural boundaries between static CDN-cacheable shells and dynamic user-context suspense holes under Next.js 15 Partial Prerendering (PPR). Prevents dynamic request APIs (cookies, headers, authentication session tokens) from bubbling up to the static prerender phase, eliminating edge cache poisoning and authentication context leaks.","antiPatternHeadline":"Accessing Dynamic Request APIs Outside Suspense Boundaries in PPR Routes","stars_count":42,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["nextjs","nextjs-15","partial-prerendering","ppr","react-19","security","caching","edge"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-ppr-streaming-shell-isolation-invariant?format=claude","cursorMdc":"/api/rules/nextjs-15-ppr-streaming-shell-isolation-invariant?format=mdc","cursorrules":"/api/rules/nextjs-15-ppr-streaming-shell-isolation-invariant?format=cursor","windsurf":"/api/rules/nextjs-15-ppr-streaming-shell-isolation-invariant?format=windsurf","agents":"/api/rules/nextjs-15-ppr-streaming-shell-isolation-invariant?format=agents"}},{"id":"postgres-17-hash-join-json-table-execution-guardrail","title":"PostgreSQL 17 Memory-Optimized Hash Join and JSON_TABLE Execution Standard","category":"backend","severity":"critical","description":"Mandates the use of PostgreSQL 17 native JSON_TABLE with explicit typed column definitions and disciplined work_mem boundaries to leverage memory-optimized hash joins. Prevents catastrophic multi-batch disk spilling, plan regressions, and disk I/O exhaustion under heavy concurrent OLTP extraction of nested JSONB documents.","antiPatternHeadline":"Unconstrained Lateral JSONB Unnesting Spilling Multi-Batch Hash Joins to Disk Temp Files","stars_count":50,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","jsonb","sql-json","performance","oltp"],"exportEndpoints":{"claude":"/api/rules/postgres-17-hash-join-json-table-execution-guardrail?format=claude","cursorMdc":"/api/rules/postgres-17-hash-join-json-table-execution-guardrail?format=mdc","cursorrules":"/api/rules/postgres-17-hash-join-json-table-execution-guardrail?format=cursor","windsurf":"/api/rules/postgres-17-hash-join-json-table-execution-guardrail?format=windsurf","agents":"/api/rules/postgres-17-hash-join-json-table-execution-guardrail?format=agents"}},{"id":"axum-tower-adaptive-backpressure-load-shedding","title":"Axum 0.8 Tower Middleware Adaptive Backpressure and Load-Shedding Standard","category":"backend","severity":"critical","description":"Enforces deterministic p99 latency boundaries and prevents Tokio async executor threadpool starvation in Axum 0.8 microservices. Mandates explicit Tower load-shedding, bounded concurrency limits, and fail-fast admission controls returning HTTP 503 over unbounded task queuing.","antiPatternHeadline":"Unbounded Request Buffering Causing Tokio Executor Starvation, P99 Latency Spikes, and OOM Crashes","stars_count":67,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tower","concurrency","tokio","backpressure","resilience"],"exportEndpoints":{"claude":"/api/rules/axum-tower-adaptive-backpressure-load-shedding?format=claude","cursorMdc":"/api/rules/axum-tower-adaptive-backpressure-load-shedding?format=mdc","cursorrules":"/api/rules/axum-tower-adaptive-backpressure-load-shedding?format=cursor","windsurf":"/api/rules/axum-tower-adaptive-backpressure-load-shedding?format=windsurf","agents":"/api/rules/axum-tower-adaptive-backpressure-load-shedding?format=agents"}},{"id":"kmp-darwin-memory-coroutine-cancellation-guardrail","title":"KMP Native Memory Alignment and Swift Async/Await Cooperative Cancellation Guardrail","category":"mobile","severity":"critical","description":"Enforces strict cooperative cancellation semantics and native object lifetime management across the Kotlin/Native and Swift ABI boundary. Eliminates unmanaged reference cycles in Darwin GC integration and prevents task suspension leaks by binding Swift Task cancellations directly to Kotlin Job lifecycles. Mandates defensive dispatch patterns to protect the Darwin main thread from JNI-like frozen pointer deadlocks and unbounded ARC retention.","antiPatternHeadline":"Bridging Kotlin Suspend Functions to Swift Async via Unbounded Task Wrappers and Unmanaged Closures","stars_count":92,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","swift","ios","coroutines","concurrency","memory-management"],"exportEndpoints":{"claude":"/api/rules/kmp-darwin-memory-coroutine-cancellation-guardrail?format=claude","cursorMdc":"/api/rules/kmp-darwin-memory-coroutine-cancellation-guardrail?format=mdc","cursorrules":"/api/rules/kmp-darwin-memory-coroutine-cancellation-guardrail?format=cursor","windsurf":"/api/rules/kmp-darwin-memory-coroutine-cancellation-guardrail?format=windsurf","agents":"/api/rules/kmp-darwin-memory-coroutine-cancellation-guardrail?format=agents"}},{"id":"capacitor-7-hardware-webauthn-biometric-bridge-invariant","title":"Capacitor 7 Secure Hardware-Backed WebAuthn Biometric Bridge Invariant","category":"mobile","severity":"critical","description":"Enforces that FIDO2/WebAuthn cryptographic key generation and assertion signing never cross into the Capacitor JavaScript WebView runtime. All biometric cryptographic operations must bind directly to native platform authenticators (iOS Secure Enclave via AuthenticationServices and Android StrongBox/TEE via Credential Manager), treating the JavaScript runtime strictly as a blind challenge-response relay.","antiPatternHeadline":"Simulating WebAuthn Credentials or Emulating Key Material in JavaScript Memory","stars_count":88,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","webauthn","fido2","passkeys","secure-enclave","strongbox"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-hardware-webauthn-biometric-bridge-invariant?format=claude","cursorMdc":"/api/rules/capacitor-7-hardware-webauthn-biometric-bridge-invariant?format=mdc","cursorrules":"/api/rules/capacitor-7-hardware-webauthn-biometric-bridge-invariant?format=cursor","windsurf":"/api/rules/capacitor-7-hardware-webauthn-biometric-bridge-invariant?format=windsurf","agents":"/api/rules/capacitor-7-hardware-webauthn-biometric-bridge-invariant?format=agents"}},{"id":"openfga-contextual-traversal-budgeting-standard","title":"OpenFGA Graph Traversal Budgeting and Deadlock Prevention Standard","category":"security","severity":"critical","description":"Enforces strict upper bounds on OpenFGA graph expansion depth, query budgets, and contextual tuple payloads during real-time authorization checks. Eliminates recursive relationship exhaustion and cascading distributed database deadlocks across high-throughput check pipelines by mandating deterministic timeouts, concurrency bounding, and pre-evaluated contextual assertions.","antiPatternHeadline":"Unbounded Recursive Evaluation and Massive Contextual Tuple Injection Inducing Database Lock Contention","stars_count":54,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","authorization","distributed-systems","concurrency"],"exportEndpoints":{"claude":"/api/rules/openfga-contextual-traversal-budgeting-standard?format=claude","cursorMdc":"/api/rules/openfga-contextual-traversal-budgeting-standard?format=mdc","cursorrules":"/api/rules/openfga-contextual-traversal-budgeting-standard?format=cursor","windsurf":"/api/rules/openfga-contextual-traversal-budgeting-standard?format=windsurf","agents":"/api/rules/openfga-contextual-traversal-budgeting-standard?format=agents"}},{"id":"ebpf-sidecarless-mesh-l7-mtls-standard","title":"eBPF Sidecarless Mesh L7 Microsegmentation and Kernel-Attested mTLS Enforcement Standard","category":"devops","severity":"critical","description":"Enforces strict kernel-space microsegmentation and transparent wire encryption via eBPF without injecting userspace Envoy sidecar proxies. By compiling L7 protocol inspection into sock_ops/sk_msg programs and offloading cryptographic transport to node-level WireGuard/IPsec kernels, this standard guarantees zero-copy socket redirection, sub-millisecond p99 latencies, and immune-to-tamper identity attestation.","antiPatternHeadline":"Injecting Userspace Envoy Sidecars and Default-Permissive L4 NetworkPolicies with Terminated Userland TLS","stars_count":41,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","cilium","microsegmentation","mtls","kubernetes","security"],"exportEndpoints":{"claude":"/api/rules/ebpf-sidecarless-mesh-l7-mtls-standard?format=claude","cursorMdc":"/api/rules/ebpf-sidecarless-mesh-l7-mtls-standard?format=mdc","cursorrules":"/api/rules/ebpf-sidecarless-mesh-l7-mtls-standard?format=cursor","windsurf":"/api/rules/ebpf-sidecarless-mesh-l7-mtls-standard?format=windsurf","agents":"/api/rules/ebpf-sidecarless-mesh-l7-mtls-standard?format=agents"}},{"id":"otel-continuous-profiling-trace-correlation-standard","title":"Deterministic Trace-to-Profile Correlation for Continuous CPU and Allocation Invariants","category":"devops","severity":"critical","description":"Continuous profilers and distributed tracers must not operate in isolation. Low-overhead continuous CPU and memory profilers must deterministically propagate active OpenTelemetry TraceId and SpanId into profiling sample tags or pprof labels across all asynchronous execution contexts to guarantee sub-millisecond call-stack attribution for tail-latency outliers.","antiPatternHeadline":"Decoupled Wall-Clock Profiling Without Active Trace-Span Context Propagation","stars_count":85,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","profiling","pprof","distributed-tracing","tail-latency","sre"],"exportEndpoints":{"claude":"/api/rules/otel-continuous-profiling-trace-correlation-standard?format=claude","cursorMdc":"/api/rules/otel-continuous-profiling-trace-correlation-standard?format=mdc","cursorrules":"/api/rules/otel-continuous-profiling-trace-correlation-standard?format=cursor","windsurf":"/api/rules/otel-continuous-profiling-trace-correlation-standard?format=windsurf","agents":"/api/rules/otel-continuous-profiling-trace-correlation-standard?format=agents"}},{"id":"react-19-server-action-idempotency-rollback","title":"React 19 Server Action Idempotency and Atomic Optimistic Rollback Standard","category":"frontend","severity":"critical","description":"Enforces strict end-to-end idempotency semantics and atomic client-side state reconciliation for React 19 Server Actions. Guarantees that concurrent dispatches and network partitions neither execute duplicate backend mutations nor leave optimistic client UI in an unrecoverable, desynchronized state.","antiPatternHeadline":"Non-idempotent Server Actions dispatched across concurrent transitions with decoupled, unrolled optimistic state","stars_count":90,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","server-actions","optimistic-ui","idempotency","useActionState","useOptimistic"],"exportEndpoints":{"claude":"/api/rules/react-19-server-action-idempotency-rollback?format=claude","cursorMdc":"/api/rules/react-19-server-action-idempotency-rollback?format=mdc","cursorrules":"/api/rules/react-19-server-action-idempotency-rollback?format=cursor","windsurf":"/api/rules/react-19-server-action-idempotency-rollback?format=windsurf","agents":"/api/rules/react-19-server-action-idempotency-rollback?format=agents"}},{"id":"svelte5-mfe-signal-lifecycle-boundary-guardrail","title":"Svelte 5 Micro-Frontend Signal Lifecycle Boundary & Root Teardown Invariant","category":"frontend","severity":"critical","description":"Enforces strict signal boundaries and deterministic teardown contracts for federated Svelte 5 micro-frontends. Prevents cross-boundary reactivity leakage and orphaned reactive subscriptions by mandating $effect.root isolation and explicit unmount execution during micro-frontend detachment.","antiPatternHeadline":"Leaking Svelte 5 Module-Level Runes and Untracked Signal Graphs Across Federated Host Boundaries","stars_count":42,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","micro-frontends","reactivity-isolation","memory-leak-prevention"],"exportEndpoints":{"claude":"/api/rules/svelte5-mfe-signal-lifecycle-boundary-guardrail?format=claude","cursorMdc":"/api/rules/svelte5-mfe-signal-lifecycle-boundary-guardrail?format=mdc","cursorrules":"/api/rules/svelte5-mfe-signal-lifecycle-boundary-guardrail?format=cursor","windsurf":"/api/rules/svelte5-mfe-signal-lifecycle-boundary-guardrail?format=windsurf","agents":"/api/rules/svelte5-mfe-signal-lifecycle-boundary-guardrail?format=agents"}},{"id":"openfga-zanzibar-zookie-consistency-token-standard","title":"OpenFGA Zanzibar Zookie Consistency Token & New Enemy Anomaly Prevention","category":"backend","severity":"critical","description":"Enforces strict causal ordering across OpenFGA authorization checks and relational mutations to eliminate the Zanzibar 'New Enemy' problem. Writes must capture transactional consistency tokens and propagate them across distributed request boundaries so subsequent read-checks guarantee snapshot evaluation at least as fresh as the mutation.","antiPatternHeadline":"Unsynchronized Eventual-Consistency Checks Causing Stale ACL Reads and Privilege Leaks","stars_count":83,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","openfga","zanzibar","authorization","distributed-systems","concurrency"],"exportEndpoints":{"claude":"/api/rules/openfga-zanzibar-zookie-consistency-token-standard?format=claude","cursorMdc":"/api/rules/openfga-zanzibar-zookie-consistency-token-standard?format=mdc","cursorrules":"/api/rules/openfga-zanzibar-zookie-consistency-token-standard?format=cursor","windsurf":"/api/rules/openfga-zanzibar-zookie-consistency-token-standard?format=windsurf","agents":"/api/rules/openfga-zanzibar-zookie-consistency-token-standard?format=agents"}},{"id":"fastapi-taskgroup-concurrency-boundary-standard","title":"FastAPI Structured Concurrency TaskGroup Exception Boundary Standard","category":"backend","severity":"critical","description":"Enforces structured concurrency boundaries in FastAPI applications using Python 3.11+ asyncio.TaskGroup. Prevents orphaned coroutines, silent task failures, and database connection pool starvation caused by fire-and-forget tasks or improperly shared AsyncSession lifecycles.","antiPatternHeadline":"Fire-and-forget asyncio.create_task and passing active AsyncSession instances to unbounded background coroutines.","stars_count":118,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","asyncio","structured-concurrency","sqlalchemy","python"],"exportEndpoints":{"claude":"/api/rules/fastapi-taskgroup-concurrency-boundary-standard?format=claude","cursorMdc":"/api/rules/fastapi-taskgroup-concurrency-boundary-standard?format=mdc","cursorrules":"/api/rules/fastapi-taskgroup-concurrency-boundary-standard?format=cursor","windsurf":"/api/rules/fastapi-taskgroup-concurrency-boundary-standard?format=windsurf","agents":"/api/rules/fastapi-taskgroup-concurrency-boundary-standard?format=agents"}},{"id":"react-native-bridgeless-jsi-hostobject-memory-boundary","title":"Bridgeless JSI HostObject Memory Safety & Hermes GC Boundary","category":"mobile","severity":"critical","description":"Enforces strict memory boundary protocols between Hermes garbage collection sweeps and C++ JSI HostObjects in React Native Bridgeless mode. Eliminates fatal use-after-free errors, heap corruption, and background thread dereferences by requiring explicit handle invalidation and forbidding raw JSI value retention across asynchronous thread boundaries.","antiPatternHeadline":"Retaining Raw JSI Value References and C++ HostObject Pointers Across Asynchronous TurboModule Thread Boundaries","stars_count":57,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","react-native","jsi","hermes","turbomodules","c++","memory-safety"],"exportEndpoints":{"claude":"/api/rules/react-native-bridgeless-jsi-hostobject-memory-boundary?format=claude","cursorMdc":"/api/rules/react-native-bridgeless-jsi-hostobject-memory-boundary?format=mdc","cursorrules":"/api/rules/react-native-bridgeless-jsi-hostobject-memory-boundary?format=cursor","windsurf":"/api/rules/react-native-bridgeless-jsi-hostobject-memory-boundary?format=windsurf","agents":"/api/rules/react-native-bridgeless-jsi-hostobject-memory-boundary?format=agents"}},{"id":"wasi-02-component-model-capability-isolation-standard","title":"WASI 0.2 Component Model Capability Isolation Standard","category":"security","severity":"critical","description":"Enforces strict principle-of-least-privilege capability passing for WASI 0.2 dynamic tenant plugins via Wasmtime/Wasm-tools runtime bindings. Mandates virtualized in-memory root filesystems without host directory passthroughs, explicit outbound HTTP authority delegation, and complete isolation of clocks, environment variables, and pre-opened descriptor handles.","antiPatternHeadline":"Ambient Host Capability Leaks via Default WasiCtxBuilder and Inherited Descriptors","stars_count":85,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webassembly","wasi-02","component-model","sandboxing","rust","wasmtime"],"exportEndpoints":{"claude":"/api/rules/wasi-02-component-model-capability-isolation-standard?format=claude","cursorMdc":"/api/rules/wasi-02-component-model-capability-isolation-standard?format=mdc","cursorrules":"/api/rules/wasi-02-component-model-capability-isolation-standard?format=cursor","windsurf":"/api/rules/wasi-02-component-model-capability-isolation-standard?format=windsurf","agents":"/api/rules/wasi-02-component-model-capability-isolation-standard?format=agents"}},{"id":"fido2-passkey-conditional-ui-overlay-isolation-standard","title":"FIDO2 Passkey Conditional UI DOM Overlay Isolation and Mediation Standard","category":"security","severity":"critical","description":"Enforces strict DOM Shadow Boundary isolation and explicit cryptographic mediation for WebAuthn Conditional Mediation (`navigator.credentials.get` with conditional mediation). Mitigates passkey autofill hijacking, credential exfiltration via third-party DOM scripts, and clickjacking overlay attacks on WebAuthn-enabled input elements.","antiPatternHeadline":"Exposing Passkey Conditional UI Inputs to Unbounded DOM Scripting and Unmediated Autocomplete Invocations","stars_count":66,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","fido2","webauthn","passkeys","dom-isolation","clickjacking","shadow-dom"],"exportEndpoints":{"claude":"/api/rules/fido2-passkey-conditional-ui-overlay-isolation-standard?format=claude","cursorMdc":"/api/rules/fido2-passkey-conditional-ui-overlay-isolation-standard?format=mdc","cursorrules":"/api/rules/fido2-passkey-conditional-ui-overlay-isolation-standard?format=cursor","windsurf":"/api/rules/fido2-passkey-conditional-ui-overlay-isolation-standard?format=windsurf","agents":"/api/rules/fido2-passkey-conditional-ui-overlay-isolation-standard?format=agents"}},{"id":"cilium-ebpf-socket-l7-mtls-proxy-standard","title":"Cilium eBPF Socket-Level L7 mTLS Transparent Proxy Standard","category":"devops","severity":"critical","description":"Enforces sidecarless zero-trust networking using Cilium eBPF socket-level programs (sockops, sock_msg) to redirect traffic directly at the Linux kernel socket layer. Eliminates Envoy sidecar memory and latency tax while automating L7 mTLS, SPIFFE/SPIRE cryptographic workload identity assertion, and wire-level protocol parsing without application-layer changes.","antiPatternHeadline":"Injecting heavyweight Envoy sidecar containers with duplicate TCP stacks and user-space context switches for L7 mTLS","stars_count":90,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","cilium","ebpf","mtls","servicemesh","kubernetes","networking"],"exportEndpoints":{"claude":"/api/rules/cilium-ebpf-socket-l7-mtls-proxy-standard?format=claude","cursorMdc":"/api/rules/cilium-ebpf-socket-l7-mtls-proxy-standard?format=mdc","cursorrules":"/api/rules/cilium-ebpf-socket-l7-mtls-proxy-standard?format=cursor","windsurf":"/api/rules/cilium-ebpf-socket-l7-mtls-proxy-standard?format=windsurf","agents":"/api/rules/cilium-ebpf-socket-l7-mtls-proxy-standard?format=agents"}},{"id":"otel-ebpf-profiling-cpu-budget-invariant","title":"OpenTelemetry eBPF Continuous Profiling 1% CPU Budget Guardrail","category":"devops","severity":"critical","description":"Enforces a strict deterministic cap on OpenTelemetry eBPF stack unwinding and perf-event sampling frequency to ensure kernel profiling CPU utilization remains below 1.0% per node. Prevents cascading tail-latency degradation and lock contention in high-throughput production microservices by dynamically tuning sample rates, unwinder cache depths, and burst throttling.","antiPatternHeadline":"Uncapped 100Hz+ eBPF DWARF stack unwinding causing high kernel CPU overhead and application tail-latency spikes","stars_count":63,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","opentelemetry","continuous-profiling","observability","performance"],"exportEndpoints":{"claude":"/api/rules/otel-ebpf-profiling-cpu-budget-invariant?format=claude","cursorMdc":"/api/rules/otel-ebpf-profiling-cpu-budget-invariant?format=mdc","cursorrules":"/api/rules/otel-ebpf-profiling-cpu-budget-invariant?format=cursor","windsurf":"/api/rules/otel-ebpf-profiling-cpu-budget-invariant?format=windsurf","agents":"/api/rules/otel-ebpf-profiling-cpu-budget-invariant?format=agents"}},{"id":"drizzle-multitenant-prepared-statement-cache-partitioning-drizzle-orm-mult-177","title":"Drizzle ORM Multi-Tenant Prepared Statement Cache Partitioning Standard","category":"backend","severity":"critical","description":"Enforces strict namespacing, query plan isolation, and bounded lifecycle management for Drizzle ORM prepared statements across multi-tenant architectures. Prevents cross-tenant query plan pollution, statement collisions, and database connection memory exhaustion in shared-process multi-tenant pools.","antiPatternHeadline":"Global Unpartitioned Prepared Statement Naming & Unbounded Cache Leakage in Shared Multi-Tenant Pools","stars_count":109,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","drizzle-orm","postgresql","multi-tenancy","connection-pooling","database-performance"],"exportEndpoints":{"claude":"/api/rules/drizzle-multitenant-prepared-statement-cache-partitioning-drizzle-orm-mult-177?format=claude","cursorMdc":"/api/rules/drizzle-multitenant-prepared-statement-cache-partitioning-drizzle-orm-mult-177?format=mdc","cursorrules":"/api/rules/drizzle-multitenant-prepared-statement-cache-partitioning-drizzle-orm-mult-177?format=cursor","windsurf":"/api/rules/drizzle-multitenant-prepared-statement-cache-partitioning-drizzle-orm-mult-177?format=windsurf","agents":"/api/rules/drizzle-multitenant-prepared-statement-cache-partitioning-drizzle-orm-mult-177?format=agents"}},{"id":"nextjs-15-async-request-context-unwrapping","title":"Next.js 15 Async Request Context Unwrapping and Request-Scope Isolation","category":"frontend","severity":"critical","description":"Next.js 15 converts dynamic server APIs (cookies, headers, params, and searchParams) into asynchronous promises to optimize edge rendering and Partial Prerendering (PPR). Accessing these APIs synchronously or leaking request context into module-scoped variables causes cross-request data contamination and race conditions in concurrent runtimes.","antiPatternHeadline":"Synchronous Access to Dynamic APIs and Module-Level Request Context Leaks","stars_count":79,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs","react-server-components","edge-runtime","concurrency","security"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-async-request-context-unwrapping?format=claude","cursorMdc":"/api/rules/nextjs-15-async-request-context-unwrapping?format=mdc","cursorrules":"/api/rules/nextjs-15-async-request-context-unwrapping?format=cursor","windsurf":"/api/rules/nextjs-15-async-request-context-unwrapping?format=windsurf","agents":"/api/rules/nextjs-15-async-request-context-unwrapping?format=agents"}},{"id":"tanstack-router-search-schema-ssr-guardrail","title":"Deterministic Search Param Validation & SSR Hydration Boundaries in TanStack Router v1","category":"frontend","severity":"critical","description":"Mandates explicit runtime schema validation with bidirectional coercion (via Zod or Valibot) for all TanStack Router v1 route search parameters. Guarantees deterministic server-side serialization and client-side hydration by requiring fallback boundaries and `.catch()` defaults to prevent React SSR hydration mismatches and unhandled route crashes from malformed query strings.","antiPatternHeadline":"Uncoerced, Non-Resilient Search Param Schemas Triggering SSR Hydration Mismatches and Route Deserialization Crashes","stars_count":50,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","tanstack-router","ssr","hydration","zod","valibot","typescript"],"exportEndpoints":{"claude":"/api/rules/tanstack-router-search-schema-ssr-guardrail?format=claude","cursorMdc":"/api/rules/tanstack-router-search-schema-ssr-guardrail?format=mdc","cursorrules":"/api/rules/tanstack-router-search-schema-ssr-guardrail?format=cursor","windsurf":"/api/rules/tanstack-router-search-schema-ssr-guardrail?format=windsurf","agents":"/api/rules/tanstack-router-search-schema-ssr-guardrail?format=agents"}},{"id":"axum-hyper-v1-graceful-drain-guardrail","title":"Axum 0.8 Hyper-v1 Connection Termination and Graceful Drain Guardrail","category":"backend","severity":"critical","description":"Enforces deterministic hyper-v1 connection draining, dual-signal interception (SIGINT and SIGTERM), and background task coordination in Axum 0.8 services. Eliminates abrupt TCP resets (RST packets) and truncated HTTP/2 streams during Kubernetes rolling deployments and blue-green rollouts.","antiPatternHeadline":"Immediate Task Dropping via Naive tokio::select! and Omission of Unix SIGTERM Interception","stars_count":63,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","hyper","tokio","kubernetes"],"exportEndpoints":{"claude":"/api/rules/axum-hyper-v1-graceful-drain-guardrail?format=claude","cursorMdc":"/api/rules/axum-hyper-v1-graceful-drain-guardrail?format=mdc","cursorrules":"/api/rules/axum-hyper-v1-graceful-drain-guardrail?format=cursor","windsurf":"/api/rules/axum-hyper-v1-graceful-drain-guardrail?format=windsurf","agents":"/api/rules/axum-hyper-v1-graceful-drain-guardrail?format=agents"}},{"id":"pg17-iterative-hnsw-hybrid-optimizer-standard","title":"PostgreSQL 17 Iterative Index Scan Guardrail for Vector-HNSW Hybrid Search","category":"backend","severity":"critical","description":"Enforces deterministic bounded-memory iterative index scan execution paths on PostgreSQL 17 when combining pgvector HNSW similarity queries with restrictive relational predicates or BM25 text rankers. Prevents catastrophic query planner regression to unindexed full sequential scans when filtering selectivity drops below standard cost thresholds. Requires strict session- or transaction-level tuning of hnsw.iterative_scan and work_mem to eliminate OOM kills and high-latency table sweeps.","antiPatternHeadline":"Unchecked Predicate Selectivity Forcing HNSW Planner Fallback to Full Table Sequential Scans","stars_count":68,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","pgvector","hnsw","hybrid-search","performance"],"exportEndpoints":{"claude":"/api/rules/pg17-iterative-hnsw-hybrid-optimizer-standard?format=claude","cursorMdc":"/api/rules/pg17-iterative-hnsw-hybrid-optimizer-standard?format=mdc","cursorrules":"/api/rules/pg17-iterative-hnsw-hybrid-optimizer-standard?format=cursor","windsurf":"/api/rules/pg17-iterative-hnsw-hybrid-optimizer-standard?format=windsurf","agents":"/api/rules/pg17-iterative-hnsw-hybrid-optimizer-standard?format=agents"}},{"id":"kmp-skiko-gpu-surface-loss-recovery-standard","title":"KMP Compose Skiko Render Thread GPU Surface Loss Recovery Standard","category":"mobile","severity":"critical","description":"Enforces deterministic teardown and re-instantiation of hardware-accelerated Skia surfaces during Android configuration changes and iOS lifecycle suspensions. Prevents fatal native GPU context corruption, driver deadlocks, and Metal/Vulkan memory leaks across cross-platform render delegate transitions.","antiPatternHeadline":"Asynchronous Surface Teardown and Leaked Skia DirectContext Across Lifecycle Transitions","stars_count":69,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kmp","compose-multiplatform","skiko","vulkan","metal","graphics"],"exportEndpoints":{"claude":"/api/rules/kmp-skiko-gpu-surface-loss-recovery-standard?format=claude","cursorMdc":"/api/rules/kmp-skiko-gpu-surface-loss-recovery-standard?format=mdc","cursorrules":"/api/rules/kmp-skiko-gpu-surface-loss-recovery-standard?format=cursor","windsurf":"/api/rules/kmp-skiko-gpu-surface-loss-recovery-standard?format=windsurf","agents":"/api/rules/kmp-skiko-gpu-surface-loss-recovery-standard?format=agents"}},{"id":"capacitor-7-background-workmanager-budgeting-guardrail","title":"Capacitor 7 Background Fetch and WorkManager Adaptive Budgeting Guardrail","category":"mobile","severity":"critical","description":"Enforces strict synchronization between Capacitor 7 JavaScript runtime tasks and native mobile background executors (Android WorkManager and iOS BackgroundTasks). Prevents OS watchdog terminations (such as iOS 0x8badf00d) and Android App Standby Bucket demotions by enforcing explicit task completion signals, cancellation propagation via AbortController, and battery-aware chunked execution budgets.","antiPatternHeadline":"Unbounded Webview Execution and Orphaned Background Tasks Leading to OS SIGKILL","stars_count":66,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","workmanager","background-fetch","battery-optimization","ios-backgroundtasks"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-background-workmanager-budgeting-guardrail?format=claude","cursorMdc":"/api/rules/capacitor-7-background-workmanager-budgeting-guardrail?format=mdc","cursorrules":"/api/rules/capacitor-7-background-workmanager-budgeting-guardrail?format=cursor","windsurf":"/api/rules/capacitor-7-background-workmanager-budgeting-guardrail?format=windsurf","agents":"/api/rules/capacitor-7-background-workmanager-budgeting-guardrail?format=agents"}},{"id":"openfga-epoch-invalidation-consistency-standard","title":"OpenFGA Distributed Cache Invalidation and Read-After-Write Consistency Standard","category":"security","severity":"critical","description":"Enforces strict read-after-write consistency across globally distributed OpenFGA evaluation caches by requiring transactional tuple mutations to emit monotonic epoch sequence barriers. Prevents stale authorization grants and unauthorized access propagation when distributed sidecar engines or evaluation caches evaluate relationships immediately after grant or revoke operations.","antiPatternHeadline":"Unsynchronized Tuple Writes and Unbounded Cache TTLs Causing Stale Authorization Decisions","stars_count":102,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","authorization","distributed-systems","cache-invalidation","zero-trust"],"exportEndpoints":{"claude":"/api/rules/openfga-epoch-invalidation-consistency-standard?format=claude","cursorMdc":"/api/rules/openfga-epoch-invalidation-consistency-standard?format=mdc","cursorrules":"/api/rules/openfga-epoch-invalidation-consistency-standard?format=cursor","windsurf":"/api/rules/openfga-epoch-invalidation-consistency-standard?format=windsurf","agents":"/api/rules/openfga-epoch-invalidation-consistency-standard?format=agents"}},{"id":"pq-tls-mlkem-hybrid-key-exchange-edge-invariant","title":"Post-Quantum TLS 1.3 ML-KEM (Kyber) Hybrid Key Exchange Edge Invariant","category":"security","severity":"critical","description":"Enforces mandatory dual classical and post-quantum hybrid key encapsulation (X25519MLKEM768 or X25519Kyber768Draft00) across all public-facing reverse proxies and edge ingress endpoints. Mitigates Store-Now-Decrypt-Later (SNDL) attacks by guaranteeing TLS 1.3 sessions are protected against future cryptanalytically relevant quantum computers while maintaining backward compatibility with legacy clients.","antiPatternHeadline":"Deploying Classical-Only ECDH Key Exchanges on Public Edge Terminations Susceptible to SNDL Harvesting","stars_count":109,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","cryptography","tls13","ml-kem","kyber","post-quantum","zero-trust"],"exportEndpoints":{"claude":"/api/rules/pq-tls-mlkem-hybrid-key-exchange-edge-invariant?format=claude","cursorMdc":"/api/rules/pq-tls-mlkem-hybrid-key-exchange-edge-invariant?format=mdc","cursorrules":"/api/rules/pq-tls-mlkem-hybrid-key-exchange-edge-invariant?format=cursor","windsurf":"/api/rules/pq-tls-mlkem-hybrid-key-exchange-edge-invariant?format=windsurf","agents":"/api/rules/pq-tls-mlkem-hybrid-key-exchange-edge-invariant?format=agents"}},{"id":"k8s-dra-gpu-slicing-policy-production-standard","title":"Deterministic GPU/NPU Slicing via Dynamic Resource Allocation (DRA) Structured Parameters","category":"devops","severity":"critical","description":"Enforces Kubernetes Dynamic Resource Allocation (DRA) structured parameters and ResourceClaimTemplates over legacy device-plugin integer limits. Guarantees deterministic hardware isolation, prevents accelerator memory fragmentation in Multi-Instance GPU (MIG) and NPU partitions, and ensures topology-aware scheduling and preemption safety.","antiPatternHeadline":"Monolithic Integer Device-Plugin Scheduling and Uncoordinated Multi-Instance GPU Partitioning","stars_count":70,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","kubernetes","dra","gpu-slicing","mig","infrastructure-as-code","scheduling"],"exportEndpoints":{"claude":"/api/rules/k8s-dra-gpu-slicing-policy-production-standard?format=claude","cursorMdc":"/api/rules/k8s-dra-gpu-slicing-policy-production-standard?format=mdc","cursorrules":"/api/rules/k8s-dra-gpu-slicing-policy-production-standard?format=cursor","windsurf":"/api/rules/k8s-dra-gpu-slicing-policy-production-standard?format=windsurf","agents":"/api/rules/k8s-dra-gpu-slicing-policy-production-standard?format=agents"}},{"id":"ebpf-tetragon-lsm-privilege-escalation-guardrail","title":"Synchronous eBPF Tetragon LSM Hooks for Privilege Escalation and Container Escape Prevention","category":"devops","severity":"critical","description":"Enforces synchronous kernel-space execution boundaries using Tetragon TracingPolicies hooked into Linux Security Modules (LSM) rather than asynchronous kprobes. Guarantees immediate process termination (SIGKILL) within the kernel execution context upon unauthorized credential modification (commit_creds, setns) or container namespace traversal before userspace telemetry triggers.","antiPatternHeadline":"Asynchronous Userspace-Dependent Detection of Kernel Privilege Escalation via Non-Blocking Kprobes","stars_count":57,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","tetragon","lsm","kubernetes","security-hardening"],"exportEndpoints":{"claude":"/api/rules/ebpf-tetragon-lsm-privilege-escalation-guardrail?format=claude","cursorMdc":"/api/rules/ebpf-tetragon-lsm-privilege-escalation-guardrail?format=mdc","cursorrules":"/api/rules/ebpf-tetragon-lsm-privilege-escalation-guardrail?format=cursor","windsurf":"/api/rules/ebpf-tetragon-lsm-privilege-escalation-guardrail?format=windsurf","agents":"/api/rules/ebpf-tetragon-lsm-privilege-escalation-guardrail?format=agents"}},{"id":"webgpu-compute-workgroup-barrier-memory-coherency","title":"WebGPU Workgroup Barrier Synchronization and Memory Layout Invariant","category":"frontend","severity":"critical","description":"Mandates explicit workgroup barrier synchronization and strict memory layout alignments (16-byte struct alignment and 256-byte dynamic offset boundaries) in WebGPU compute pipelines. Prevents GPU race conditions, torn reads, and device loss during high-frequency client-side neural network tensor operations. Enforces deterministic coherency between cooperative thread loads into workgroup shared memory and subsequent compute passes.","antiPatternHeadline":"Missing workgroupBarrier() and unpadded WGSL uniform structs causing GPU race conditions and silent output corruption","stars_count":98,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","webgpu","wgsl","concurrency","machine-learning","graphics-programming"],"exportEndpoints":{"claude":"/api/rules/webgpu-compute-workgroup-barrier-memory-coherency?format=claude","cursorMdc":"/api/rules/webgpu-compute-workgroup-barrier-memory-coherency?format=mdc","cursorrules":"/api/rules/webgpu-compute-workgroup-barrier-memory-coherency?format=cursor","windsurf":"/api/rules/webgpu-compute-workgroup-barrier-memory-coherency?format=windsurf","agents":"/api/rules/webgpu-compute-workgroup-barrier-memory-coherency?format=agents"}},{"id":"tanstack-start-streaming-loader-context-isolation-guardrail","title":"TanStack Start Streaming Loader Request-Scoped Context Isolation","category":"frontend","severity":"critical","description":"Enforces strict request-scoped context isolation during TanStack Start deferred SSR streaming. Prevents cross-tenant state pollution, leaked server-side caches, and async context interleaving when resolving deferred loader promises across concurrent HTTP chunks.","antiPatternHeadline":"Module-Level Shared State and Unscoped Singletons in Deferred Streaming Loaders","stars_count":76,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","tanstack-start","tanstack-router","ssr-streaming","multi-tenancy","async-local-storage"],"exportEndpoints":{"claude":"/api/rules/tanstack-start-streaming-loader-context-isolation-guardrail?format=claude","cursorMdc":"/api/rules/tanstack-start-streaming-loader-context-isolation-guardrail?format=mdc","cursorrules":"/api/rules/tanstack-start-streaming-loader-context-isolation-guardrail?format=cursor","windsurf":"/api/rules/tanstack-start-streaming-loader-context-isolation-guardrail?format=windsurf","agents":"/api/rules/tanstack-start-streaming-loader-context-isolation-guardrail?format=agents"}},{"id":"pg17-streaming-io-parallel-scan-budget","title":"PostgreSQL 17 Streaming I/O Engine Parallel Scan & Buffer Ring Isolation","category":"backend","severity":"critical","description":"PostgreSQL 17 introduces a modernized asynchronous streaming I/O subsystem that aggressively prefetches sequential scan blocks using unified read streams. In hybrid transactional/analytical workloads, unconstrained parallel sequential scans will monopolize storage controller queue depths and exhaust worker-specific ring buffer strategies (BAS_BULKREAD), directly inducing latency spikes across concurrently executing OLTP transactions. Application services executing large sequential analytics must enforce deterministic session-level parallel worker limits, prefetch batch caps, and replica routing invariants.","antiPatternHeadline":"Unbounded Parallel Analytics Saturating PG17 Streaming I/O Prefetch Queues and Starving OLTP Shared Buffers","stars_count":117,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql-17","streaming-io","parallel-query","buffer-cache","database-performance"],"exportEndpoints":{"claude":"/api/rules/pg17-streaming-io-parallel-scan-budget?format=claude","cursorMdc":"/api/rules/pg17-streaming-io-parallel-scan-budget?format=mdc","cursorrules":"/api/rules/pg17-streaming-io-parallel-scan-budget?format=cursor","windsurf":"/api/rules/pg17-streaming-io-parallel-scan-budget?format=windsurf","agents":"/api/rules/pg17-streaming-io-parallel-scan-budget?format=agents"}},{"id":"fastapi-taskgroup-structured-concurrency-standard","title":"FastAPI AnyIO TaskGroup Lifetime Boundaries & Python 3.12+ ExceptionGroup Handling","category":"backend","severity":"critical","description":"Enforces strict structured concurrency using AnyIO TaskGroups within FastAPI request-response lifecycles to prevent coroutine leakage during concurrent fan-out. Mandates Python 3.12+ except* syntax or explicit ExceptionGroup unwrapping to safely handle partial failures without leaving orphaned background tasks running on the event loop.","antiPatternHeadline":"Unbounded asyncio.create_task Fan-Out and Broad Exception Swallowing in Concurrent Endpoints","stars_count":83,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","anyio","structured-concurrency","python312","asyncio","concurrency"],"exportEndpoints":{"claude":"/api/rules/fastapi-taskgroup-structured-concurrency-standard?format=claude","cursorMdc":"/api/rules/fastapi-taskgroup-structured-concurrency-standard?format=mdc","cursorrules":"/api/rules/fastapi-taskgroup-structured-concurrency-standard?format=cursor","windsurf":"/api/rules/fastapi-taskgroup-structured-concurrency-standard?format=windsurf","agents":"/api/rules/fastapi-taskgroup-structured-concurrency-standard?format=agents"}},{"id":"tauri-v2-ipc-capability-scoping-standard-tauri-2-0-contex-975","title":"Tauri 2.0 Context-Isolated IPC Capability Scoping Standard","category":"mobile","severity":"critical","description":"Enforces strict compile-time capability scoping for Tauri 2.0 multi-webview mobile architectures by disallowing wildcard IPC invocation permissions and unauthenticated runtime origins. Mandates explicit window and webview label isolation paired with granular JSON capability manifests to prevent cross-webview command execution attacks.","antiPatternHeadline":"Permissive Wildcard IPC Commands Across Multi-Webview Mobile Boundaries","stars_count":91,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri","rust","security","ipc","capabilities"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-ipc-capability-scoping-standard-tauri-2-0-contex-975?format=claude","cursorMdc":"/api/rules/tauri-v2-ipc-capability-scoping-standard-tauri-2-0-contex-975?format=mdc","cursorrules":"/api/rules/tauri-v2-ipc-capability-scoping-standard-tauri-2-0-contex-975?format=cursor","windsurf":"/api/rules/tauri-v2-ipc-capability-scoping-standard-tauri-2-0-contex-975?format=windsurf","agents":"/api/rules/tauri-v2-ipc-capability-scoping-standard-tauri-2-0-contex-975?format=agents"}},{"id":"capacitor-7-jsi-bridge-memory-alignment-invariant","title":"Capacitor 7 Synchronous JSI Native Bridge Memory Alignment Invariant","category":"mobile","severity":"critical","description":"Mandates strict zero-copy memory alignment and deterministic ArrayBuffer recycling for high-frequency native telemetry through Capacitor 7 JSI bridge interfaces. Prohibits JSON serialization, asynchronous message queuing, and unaligned byte-offset memory operations across the native runtime boundary to eliminate main-thread UI stalls.","antiPatternHeadline":"Streaming high-frequency hardware sensor data across the legacy asynchronous JSON bridge with unaligned, continuously re-allocated buffers.","stars_count":90,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","jsi","memory-alignment","zero-copy","performance"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-jsi-bridge-memory-alignment-invariant?format=claude","cursorMdc":"/api/rules/capacitor-7-jsi-bridge-memory-alignment-invariant?format=mdc","cursorrules":"/api/rules/capacitor-7-jsi-bridge-memory-alignment-invariant?format=cursor","windsurf":"/api/rules/capacitor-7-jsi-bridge-memory-alignment-invariant?format=windsurf","agents":"/api/rules/capacitor-7-jsi-bridge-memory-alignment-invariant?format=agents"}},{"id":"webauthn-l3-hardware-bound-attestation-guardrail","title":"Mandatory Hardware-Bound Attestation and Enterprise Backup Flag Enforcement in WebAuthn Registration","category":"security","severity":"critical","description":"Enforces strict Level 3 cryptographic hardware-bound attestation verification and authenticator data flag validation during WebAuthn passkey registration. Prohibits multi-device syncable credentials on corporate boundaries by asserting direct attestation trust roots via FIDO Metadata Service (MDS3) and strictly rejecting registrations with the Authenticator Backup Eligibility (BE) flag enabled. Guarantees non-exportable, hardware-isolated credential enrollment across zero-trust enterprise surfaces.","antiPatternHeadline":"Permitting Synced/Multi-Device Passkeys with 'none' Attestation on Enterprise Systems","stars_count":96,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","fido2","passkeys","cryptography","zero-trust","attestation"],"exportEndpoints":{"claude":"/api/rules/webauthn-l3-hardware-bound-attestation-guardrail?format=claude","cursorMdc":"/api/rules/webauthn-l3-hardware-bound-attestation-guardrail?format=mdc","cursorrules":"/api/rules/webauthn-l3-hardware-bound-attestation-guardrail?format=cursor","windsurf":"/api/rules/webauthn-l3-hardware-bound-attestation-guardrail?format=windsurf","agents":"/api/rules/webauthn-l3-hardware-bound-attestation-guardrail?format=agents"}},{"id":"caep-sse-ingress-revocation-standard","title":"OpenID Shared Signals and Events (CAEP/SSE) Ingress Revocation Standard","category":"security","severity":"critical","description":"Enforces deterministic, sub-second token invalidation propagation and distributed session teardown across decoupled microservice perimeters upon receiving OpenID Continuous Access Evaluation Profile (CAEP) and Shared Signals and Events (SSE) webhook triggers. Mandates non-blocking cryptographic verification of Security Event Tokens (SETs), transactional cache denylisting with bounded TTLs, and cluster-wide revocation broadcasts via synchronized pub/sub backplanes. Prohibits lazy polling architectures and unauthenticated webhook endpoints that allow compromised credentials to remain valid within downstream services.","antiPatternHeadline":"Decoupled Edge Services Relying on Statelot JWT Expiration Without Real-Time Ingress Push-Revocation","stars_count":98,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","caep","openid-sse","jwt-revocation","zero-trust","distributed-systems","microservices"],"exportEndpoints":{"claude":"/api/rules/caep-sse-ingress-revocation-standard?format=claude","cursorMdc":"/api/rules/caep-sse-ingress-revocation-standard?format=mdc","cursorrules":"/api/rules/caep-sse-ingress-revocation-standard?format=cursor","windsurf":"/api/rules/caep-sse-ingress-revocation-standard?format=windsurf","agents":"/api/rules/caep-sse-ingress-revocation-standard?format=agents"}},{"id":"cilium-ebpf-host-routing-ring-buffer-backpressure","title":"Cilium eBPF Host-Routing BPF Ring Buffer Deterministic Backpressure Guardrail","category":"devops","severity":"critical","description":"Enforces strict user-space consumption pacing, bounded epoll wake-up semantics, and memory watermark alerting for Cilium eBPF ring buffers in 100GbE host-routing datapathes. Eliminates unmitigated kernel drops (`BPF_RINGBUF_BUSY` / `ENOSPC`), softirq starvation, and silent drops during high-volume ingress network bursts.","antiPatternHeadline":"Unbounded User-Space Polling and Missing Backpressure Watermarks Causing eBPF Ring Buffer Overflow and Host-Routing Packet Drops","stars_count":92,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","cilium","ebpf","networking","100gbe","kernel","observability"],"exportEndpoints":{"claude":"/api/rules/cilium-ebpf-host-routing-ring-buffer-backpressure?format=claude","cursorMdc":"/api/rules/cilium-ebpf-host-routing-ring-buffer-backpressure?format=mdc","cursorrules":"/api/rules/cilium-ebpf-host-routing-ring-buffer-backpressure?format=cursor","windsurf":"/api/rules/cilium-ebpf-host-routing-ring-buffer-backpressure?format=windsurf","agents":"/api/rules/cilium-ebpf-host-routing-ring-buffer-backpressure?format=agents"}},{"id":"opentelemetry-exemplar-cardinality-fencing-standard","title":"OpenTelemetry Distributed Exemplar Cardinality Fencing and Reservoir Bounding","category":"devops","severity":"critical","description":"Enforces strict reservoir sampling bounds and attribute fencing on OpenTelemetry metric exemplars to prevent memory leaks and downstream time-series database (TSDB) indexing explosions. Unbounded exemplar propagation or injecting high-cardinality business labels into metric exemplar buffers compromises Prometheus, Mimir, and Thanos aggregators. All metric providers must explicitly define exemplar filters, bound reservoir cell sizes, and restrict exemplar baggage strictly to standardized W3C trace identifiers.","antiPatternHeadline":"Attaching raw user or request metadata as un-sampled exemplar baggage inside metric aggregators without cardinality filters","stars_count":78,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","metrics","prometheus","observability","cardinality"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-exemplar-cardinality-fencing-standard?format=claude","cursorMdc":"/api/rules/opentelemetry-exemplar-cardinality-fencing-standard?format=mdc","cursorrules":"/api/rules/opentelemetry-exemplar-cardinality-fencing-standard?format=cursor","windsurf":"/api/rules/opentelemetry-exemplar-cardinality-fencing-standard?format=windsurf","agents":"/api/rules/opentelemetry-exemplar-cardinality-fencing-standard?format=agents"}},{"id":"nextjs-15-ppr-shell-dynamic-boundary-guardrail","title":"Deterministic Separation of Static Shell and Dynamic Streaming in Next.js 15 PPR","category":"frontend","severity":"critical","description":"Enforces strict structural isolation between pre-rendered static edge shells and runtime dynamic streaming promises in Next.js 15 Partial Prerendering (PPR). Dynamic runtime evaluations—such as reading request headers, cookies, or calling un-cached auth APIs—must be encapsulated strictly within React Suspense boundaries to prevent dynamic user credentials from leaking into globally cached CDN pre-renders or causing runtime de-opts.","antiPatternHeadline":"Dynamic Request Introspection Executing Outside Explicit Suspense Boundaries in PPR Shells","stars_count":103,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs-15","ppr","react-suspense","security","cache-poisoning"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-ppr-shell-dynamic-boundary-guardrail?format=claude","cursorMdc":"/api/rules/nextjs-15-ppr-shell-dynamic-boundary-guardrail?format=mdc","cursorrules":"/api/rules/nextjs-15-ppr-shell-dynamic-boundary-guardrail?format=cursor","windsurf":"/api/rules/nextjs-15-ppr-shell-dynamic-boundary-guardrail?format=windsurf","agents":"/api/rules/nextjs-15-ppr-shell-dynamic-boundary-guardrail?format=agents"}},{"id":"openfga-relationship-tuple-consistency-barrier","title":"OpenFGA Causal Consistency Token Barrier and TOCTOU Mitigation","category":"backend","severity":"critical","description":"Enforces strict causal relationship consistency tokens (Zanzibar zookies / OpenFGA consistency checkpoints) prior to authorization evaluations. Mandates that any mutation creating, updating, or revoking access tuples synchronously obtains and threads a consistency token or write transaction boundary through subsequent check evaluations to eliminate time-of-check to time-of-use (TOCTOU) race conditions.","antiPatternHeadline":"Firing Asynchronous Authorizations or Read Checks Without Causal Consistency Tokens Post-Tuple Mutation","stars_count":57,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","openfga","authorization","zanzibar","security","concurrency"],"exportEndpoints":{"claude":"/api/rules/openfga-relationship-tuple-consistency-barrier?format=claude","cursorMdc":"/api/rules/openfga-relationship-tuple-consistency-barrier?format=mdc","cursorrules":"/api/rules/openfga-relationship-tuple-consistency-barrier?format=cursor","windsurf":"/api/rules/openfga-relationship-tuple-consistency-barrier?format=windsurf","agents":"/api/rules/openfga-relationship-tuple-consistency-barrier?format=agents"}},{"id":"go-chi-context-bounded-goroutine-tree-termination","title":"Go Chi Context-Bounded Goroutine Tree Termination Invariant","category":"backend","severity":"critical","description":"Enforces strict cancellation propagation and deterministic drain guarantees for all worker goroutine trees spawned within Go Chi HTTP handlers. Ensures goroutine hierarchies honor r.Context().Done(), decouple unbuffered channels to eliminate deadlocks, and use sync.WaitGroup or errgroup.Group to guarantee complete sub-task draining prior to handler return when clients abruptly disconnect.","antiPatternHeadline":"Spawning Uncoordinated Goroutines Consuming Chi r.Context() with Unbuffered Channel Writes and Dangling Leaks","stars_count":41,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","chi","concurrency","goroutines","context-leak"],"exportEndpoints":{"claude":"/api/rules/go-chi-context-bounded-goroutine-tree-termination?format=claude","cursorMdc":"/api/rules/go-chi-context-bounded-goroutine-tree-termination?format=mdc","cursorrules":"/api/rules/go-chi-context-bounded-goroutine-tree-termination?format=cursor","windsurf":"/api/rules/go-chi-context-bounded-goroutine-tree-termination?format=windsurf","agents":"/api/rules/go-chi-context-bounded-goroutine-tree-termination?format=agents"}},{"id":"drizzle-pgbouncer-prepared-statement-multiplexing-guardrail","title":"Drizzle ORM Prepared Statement Multiplexing & PgBouncer Safety Standard","category":"backend","severity":"critical","description":"Enforces safe execution semantics for Drizzle ORM when operating over PgBouncer in transaction-pooling mode. Mandates driver-level disabling of persistent named prepared statements and isolates session-level bindings to prevent cross-tenant statement collisions and state pollution.","antiPatternHeadline":"Persisting static named prepared statements across multiplexed PgBouncer transaction-mode pools, causing 'prepared statement already exists' crashes and cross-tenant session leaks.","stars_count":117,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","drizzle-orm","pgbouncer","postgresql","multi-tenancy","connection-pooling"],"exportEndpoints":{"claude":"/api/rules/drizzle-pgbouncer-prepared-statement-multiplexing-guardrail?format=claude","cursorMdc":"/api/rules/drizzle-pgbouncer-prepared-statement-multiplexing-guardrail?format=mdc","cursorrules":"/api/rules/drizzle-pgbouncer-prepared-statement-multiplexing-guardrail?format=cursor","windsurf":"/api/rules/drizzle-pgbouncer-prepared-statement-multiplexing-guardrail?format=windsurf","agents":"/api/rules/drizzle-pgbouncer-prepared-statement-multiplexing-guardrail?format=agents"}},{"id":"tauri-v2-granular-ipc-capability-contract","title":"Tauri 2.0 Granular IPC Capability & Scoped Permission Contract","category":"security","severity":"critical","description":"Enforces strict compile-time remote procedure call capability binding and path/process scoping in Tauri 2.0. Eliminates arbitrary command execution, directory traversal, and unauthorized system access resulting from compromised or injected WebView scripts.","antiPatternHeadline":"Wildcard Plugin Permissions and Unscoped Dynamic Shell/FS Invocations","stars_count":49,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","tauri","rust","ipc","capabilities","least-privilege"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-granular-ipc-capability-contract?format=claude","cursorMdc":"/api/rules/tauri-v2-granular-ipc-capability-contract?format=mdc","cursorrules":"/api/rules/tauri-v2-granular-ipc-capability-contract?format=cursor","windsurf":"/api/rules/tauri-v2-granular-ipc-capability-contract?format=windsurf","agents":"/api/rules/tauri-v2-granular-ipc-capability-contract?format=agents"}},{"id":"android-16kb-page-size-alignment-standard-android-15-kmp-1-727","title":"Android 15 / KMP 16KB Page Size Native Memory-Mapping Alignment Standard","category":"mobile","severity":"critical","description":"Enforces strict 16KB memory page boundary alignment across all native binaries (.so shared objects), JNI bridge interfaces, POSIX mmap allocations, and direct ByteBuffers. Android 15 introduces support for 16KB physical page sizes on ARM64 kernels, making unaligned ELF load segments and legacy 4KB-aligned mmap calls fatal causes of SIGBUS and SIGSEGV runtime aborts.","antiPatternHeadline":"Compiling with legacy 4KB ELF max-page-size or hardcoding 4096-byte alignment in POSIX mmap and direct buffer calculations.","stars_count":88,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","android15","kmp","ndk","memory-alignment","arm64","jni"],"exportEndpoints":{"claude":"/api/rules/android-16kb-page-size-alignment-standard-android-15-kmp-1-727?format=claude","cursorMdc":"/api/rules/android-16kb-page-size-alignment-standard-android-15-kmp-1-727?format=mdc","cursorrules":"/api/rules/android-16kb-page-size-alignment-standard-android-15-kmp-1-727?format=cursor","windsurf":"/api/rules/android-16kb-page-size-alignment-standard-android-15-kmp-1-727?format=windsurf","agents":"/api/rules/android-16kb-page-size-alignment-standard-android-15-kmp-1-727?format=agents"}},{"id":"opentelemetry-baggage-integrity-secret-redaction","title":"OpenTelemetry Baggage Cryptographic Integrity and Secret Redaction Standard","category":"devops","severity":"critical","description":"Enforces boundary-level cryptographic HMAC verification and strict PII/secret scrubbing on W3C Baggage context before inbound extraction and outbound cross-service propagation. Prevents telemetry injection attacks, downstream trace poisoning, and accidental exfiltration of confidential credentials across distributed service boundaries.","antiPatternHeadline":"Unvalidated and Unredacted W3C Baggage Forwarding Across Distributed Trust Boundaries","stars_count":78,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","distributed-tracing","security","baggage","pii-redaction"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-baggage-integrity-secret-redaction?format=claude","cursorMdc":"/api/rules/opentelemetry-baggage-integrity-secret-redaction?format=mdc","cursorrules":"/api/rules/opentelemetry-baggage-integrity-secret-redaction?format=cursor","windsurf":"/api/rules/opentelemetry-baggage-integrity-secret-redaction?format=windsurf","agents":"/api/rules/opentelemetry-baggage-integrity-secret-redaction?format=agents"}},{"id":"k8s-132-oci-helm-digest-provenance-guardrail","title":"Kubernetes 1.32 OCI-Artifact Helm Strict Digest Provenance & Cosign Verification","category":"devops","severity":"critical","description":"Enforces strict immutable SHA256 digest resolution and cryptographic Cosign provenance verification for all OCI-based Helm chart artifacts deployed via GitOps controllers and native admission controllers in Kubernetes 1.32. Prevents tag-mutation vulnerabilities, supply-chain tampering, and non-deterministic reconciliations by requiring content-addressable identifiers and signed Sigstore attestations prior to admission.","antiPatternHeadline":"Deploying OCI Helm Charts via Mutable Semver Tags Without SHA256 Digest Pinning or Cosign Verification","stars_count":87,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","kubernetes","helm","oci","cosign","gitops","fluxcd","supply-chain-security"],"exportEndpoints":{"claude":"/api/rules/k8s-132-oci-helm-digest-provenance-guardrail?format=claude","cursorMdc":"/api/rules/k8s-132-oci-helm-digest-provenance-guardrail?format=mdc","cursorrules":"/api/rules/k8s-132-oci-helm-digest-provenance-guardrail?format=cursor","windsurf":"/api/rules/k8s-132-oci-helm-digest-provenance-guardrail?format=windsurf","agents":"/api/rules/k8s-132-oci-helm-digest-provenance-guardrail?format=agents"}},{"id":"react-19-action-state-optimistic-reconciliation","title":"React 19 Action State Optimistic Reconciliation and Rollback Barrier","category":"frontend","severity":"critical","description":"Mandates monotonic transaction sequencing and immutable rollback barriers when pairing React 19 useActionState with useOptimistic. Prevents state corruption, ghost rollbacks, and out-of-order resolution artifacts during concurrent asynchronous server mutations.","antiPatternHeadline":"Unsequenced optimistic mutations and ad-hoc state rollbacks causing race-condition clobbering and state tearing.","stars_count":106,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["react-19","useOptimistic","useActionState","server-actions","concurrency","optimistic-ui","frontend"],"exportEndpoints":{"claude":"/api/rules/react-19-action-state-optimistic-reconciliation?format=claude","cursorMdc":"/api/rules/react-19-action-state-optimistic-reconciliation?format=mdc","cursorrules":"/api/rules/react-19-action-state-optimistic-reconciliation?format=cursor","windsurf":"/api/rules/react-19-action-state-optimistic-reconciliation?format=windsurf","agents":"/api/rules/react-19-action-state-optimistic-reconciliation?format=agents"}},{"id":"tanstack-router-preload-quota-guardrail","title":"TanStack Router Dynamic Preload Rate & Memory Budget Guardrail","category":"frontend","severity":"critical","description":"Enforces adaptive, connection-aware, and LRU-capped route preloading within TanStack Router applications. Prevents browser main-thread jank, client-side memory blowup, and mobile cellular data exhaustion by wrapping default route preloading hooks with Save-Data awareness, concurrency throttling, and type-safe cache eviction budgets.","antiPatternHeadline":"Unbounded Link Preloading Under High Route Tree Complexity Leading to Network Thrashing and Out-of-Memory Crashes","stars_count":85,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","tanstack-router","performance","memory-management","type-safety"],"exportEndpoints":{"claude":"/api/rules/tanstack-router-preload-quota-guardrail?format=claude","cursorMdc":"/api/rules/tanstack-router-preload-quota-guardrail?format=mdc","cursorrules":"/api/rules/tanstack-router-preload-quota-guardrail?format=cursor","windsurf":"/api/rules/tanstack-router-preload-quota-guardrail?format=windsurf","agents":"/api/rules/tanstack-router-preload-quota-guardrail?format=agents"}},{"id":"fastapi-anyio-taskgroup-exception-barrier","title":"FastAPI AnyIO Structured TaskGroup Exception Barrier Standard","category":"backend","severity":"critical","description":"Enforces strict structured concurrency in FastAPI services by replacing unbounded fire-and-forget background tasks with AnyIO TaskGroups. This eliminates silent async task failures, guarantees deterministic cancellation propagation, and prevents socket descriptor and connection pool leaks under peak concurrency. Every spawned concurrent task must be explicitly bounded to a managed lifecycle scope with an aggregate exception barrier.","antiPatternHeadline":"Spawning detached coroutines with asyncio.create_task or unbounded Starlette BackgroundTasks that drop unhandled exceptions and leak network sockets","stars_count":119,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","anyio","structured-concurrency","python","asyncio"],"exportEndpoints":{"claude":"/api/rules/fastapi-anyio-taskgroup-exception-barrier?format=claude","cursorMdc":"/api/rules/fastapi-anyio-taskgroup-exception-barrier?format=mdc","cursorrules":"/api/rules/fastapi-anyio-taskgroup-exception-barrier?format=cursor","windsurf":"/api/rules/fastapi-anyio-taskgroup-exception-barrier?format=windsurf","agents":"/api/rules/fastapi-anyio-taskgroup-exception-barrier?format=agents"}},{"id":"bun-v12-postgres-pipelining-batch-invariant","title":"Bun 1.2 Native PostgreSQL Pipelining and Batching Architectural Invariant","category":"backend","severity":"critical","description":"Enforces bounded pipelined SQL command execution using Bun 1.2's native `bun:sql` driver to eliminate N+1 network round-trip query serialization bottlenecks under microservice workloads. Prohibits sequential async/await round-trips over pooled connections and requires transactional batching or pipelined query dispatches within bounded queue limits.","antiPatternHeadline":"Sequential Network Round-Trip Awaits and Unbounded Connection Hoarding in High-Throughput Handlers","stars_count":62,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","postgresql","pipelining","performance","database"],"exportEndpoints":{"claude":"/api/rules/bun-v12-postgres-pipelining-batch-invariant?format=claude","cursorMdc":"/api/rules/bun-v12-postgres-pipelining-batch-invariant?format=mdc","cursorrules":"/api/rules/bun-v12-postgres-pipelining-batch-invariant?format=cursor","windsurf":"/api/rules/bun-v12-postgres-pipelining-batch-invariant?format=windsurf","agents":"/api/rules/bun-v12-postgres-pipelining-batch-invariant?format=agents"}},{"id":"kmp-2-1-swift-export-arc-cycle-sentinel","title":"Kotlin Multiplatform 2.1 Swift Export ARC Cycle Sentinel","category":"mobile","severity":"critical","description":"Enforces strict memory boundary decoupling between Swift Automatic Reference Counting (ARC) and Kotlin/Native tracing GC across Kotlin 2.1 Swift Export boundaries. Cross-runtime strong references form uncollectible islands because neither Swift ARC nor Kotlin GC can traverse the foreign runtime heap. Mandates unidirectional event streaming and explicit RAII cancellation tokens over bidirectional callback or delegate retention.","antiPatternHeadline":"Cross-Runtime Retain Cycles Between Swift ARC and Kotlin/Native Tracing Garbage Collector","stars_count":56,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","swift-export","arc","memory-leaks","kotlin-native"],"exportEndpoints":{"claude":"/api/rules/kmp-2-1-swift-export-arc-cycle-sentinel?format=claude","cursorMdc":"/api/rules/kmp-2-1-swift-export-arc-cycle-sentinel?format=mdc","cursorrules":"/api/rules/kmp-2-1-swift-export-arc-cycle-sentinel?format=cursor","windsurf":"/api/rules/kmp-2-1-swift-export-arc-cycle-sentinel?format=windsurf","agents":"/api/rules/kmp-2-1-swift-export-arc-cycle-sentinel?format=agents"}},{"id":"tauri-v2-mobile-ipc-capability-isolation-grid","title":"Tauri 2.0 Mobile Plugin IPC Capability Isolation Grid","category":"mobile","severity":"critical","description":"Enforces strict compile-time Access Control List (ACL) manifests and fine-grained capability isolation for Tauri 2.0 mobile bridges. Prohibits global wildcards, unvalidated plugin identifiers, and ambient native API execution to prevent compromised webview contexts from invoking privileged device subsystems.","antiPatternHeadline":"Wildcard Capability Manifests and Ambient IPC Bridges Exposing Native Mobile Hardware APIs","stars_count":63,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri","security","ipc","acl","capabilities","rust"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-mobile-ipc-capability-isolation-grid?format=claude","cursorMdc":"/api/rules/tauri-v2-mobile-ipc-capability-isolation-grid?format=mdc","cursorrules":"/api/rules/tauri-v2-mobile-ipc-capability-isolation-grid?format=cursor","windsurf":"/api/rules/tauri-v2-mobile-ipc-capability-isolation-grid?format=windsurf","agents":"/api/rules/tauri-v2-mobile-ipc-capability-isolation-grid?format=agents"}},{"id":"rfc-9449-dpop-ephemeral-key-rotation-standard","title":"RFC 9449 DPoP Ephemeral Asymmetric Key-Bound Token Rotation Standard","category":"security","severity":"critical","description":"Enforces RFC 9449 Demonstrating Proof-of-Possession (DPoP) across all microservice client interactions and ingress gateways. Every outbound request must cryptographically bind access and refresh tokens to an ephemeral, client-held asymmetric key pair with single-use nonce tracking and strict thumbprint confirmation (`cnf.jkt`). This strictly eliminates bearer token exfiltration, cross-service relay, and replay attacks.","antiPatternHeadline":"Transmitting Unbound Bearer Tokens or Accepting DPoP Proofs Without Nonce and `ath` Verification","stars_count":42,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","oauth2","rfc9449","dpop","cryptography","zero-trust","microservices"],"exportEndpoints":{"claude":"/api/rules/rfc-9449-dpop-ephemeral-key-rotation-standard?format=claude","cursorMdc":"/api/rules/rfc-9449-dpop-ephemeral-key-rotation-standard?format=mdc","cursorrules":"/api/rules/rfc-9449-dpop-ephemeral-key-rotation-standard?format=cursor","windsurf":"/api/rules/rfc-9449-dpop-ephemeral-key-rotation-standard?format=windsurf","agents":"/api/rules/rfc-9449-dpop-ephemeral-key-rotation-standard?format=agents"}},{"id":"ebpf-lsm-container-breakout-prevention-guardrail","title":"eBPF LSM Kernel-Boundary Container Breakout and Host Namespace Tampering Guardrail","category":"security","severity":"critical","description":"Enforces synchronous, kernel-boundary authorization using eBPF Linux Security Module (LSM) hooks to block container breakout, host namespace tampering, and privilege escalation attempts before syscall commitment. Prohibits vulnerable tracepoint/kprobe-based non-blocking inspection and mandates CO-RE (Compile Once – Run Everywhere) namespace comparison with zero-allocation ring-buffer security auditing.","antiPatternHeadline":"Post-Mortem Syscall Tracepoints or Unverified Kprobes for Container Access Control","stars_count":113,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","ebpf","lsm","containers","linux-kernel","co-re","bpf-lsm"],"exportEndpoints":{"claude":"/api/rules/ebpf-lsm-container-breakout-prevention-guardrail?format=claude","cursorMdc":"/api/rules/ebpf-lsm-container-breakout-prevention-guardrail?format=mdc","cursorrules":"/api/rules/ebpf-lsm-container-breakout-prevention-guardrail?format=cursor","windsurf":"/api/rules/ebpf-lsm-container-breakout-prevention-guardrail?format=windsurf","agents":"/api/rules/ebpf-lsm-container-breakout-prevention-guardrail?format=agents"}},{"id":"otel-ebpf-profiling-budget-standard","title":"OpenTelemetry Continuous eBPF Profiling Overhead Budgeting and Trace Correlation","category":"devops","severity":"critical","description":"Enforces deterministic CPU sampling budgets for OpenTelemetry continuous eBPF profiling, capping aggregate agent overhead strictly beneath 1% total CPU core utilization. Ensures lockless BPF ring buffer consumption, dynamic frequency shedding under host saturation, and seamless trace-span context propagation into user-kernel call stacks.","antiPatternHeadline":"Unbounded high-frequency eBPF sampling with synchronous unwinding or missing trace context injection.","stars_count":61,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","opentelemetry","profiling","observability","kernel","performance"],"exportEndpoints":{"claude":"/api/rules/otel-ebpf-profiling-budget-standard?format=claude","cursorMdc":"/api/rules/otel-ebpf-profiling-budget-standard?format=mdc","cursorrules":"/api/rules/otel-ebpf-profiling-budget-standard?format=cursor","windsurf":"/api/rules/otel-ebpf-profiling-budget-standard?format=windsurf","agents":"/api/rules/otel-ebpf-profiling-budget-standard?format=agents"}},{"id":"cilium-ebpf-ambient-mesh-wire-speed-mtls-invariant","title":"Cilium eBPF Ambient Mesh In-Kernel Cryptographic Identity and Wire-Speed mTLS Invariant","category":"devops","severity":"critical","description":"Guarantees non-bypassable pod-to-pod cryptographic identity validation (SPIFFE ID) and transparent wire-speed mutual authentication executed directly inside Linux kernel eBPF socket layers. Prohibits fallback to unauthenticated plaintext transport, hostNetwork bypasses, or legacy resource-heavy user-space sidecar proxies.","antiPatternHeadline":"Permitting Insecure Plaintext Socket Fallbacks or Injecting Latency-Inducing User-Space Sidecars","stars_count":80,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","cilium","ebpf","mtls","service-mesh","spiffe","kubernetes","zero-trust"],"exportEndpoints":{"claude":"/api/rules/cilium-ebpf-ambient-mesh-wire-speed-mtls-invariant?format=claude","cursorMdc":"/api/rules/cilium-ebpf-ambient-mesh-wire-speed-mtls-invariant?format=mdc","cursorrules":"/api/rules/cilium-ebpf-ambient-mesh-wire-speed-mtls-invariant?format=cursor","windsurf":"/api/rules/cilium-ebpf-ambient-mesh-wire-speed-mtls-invariant?format=windsurf","agents":"/api/rules/cilium-ebpf-ambient-mesh-wire-speed-mtls-invariant?format=agents"}},{"id":"axum-0-8-cooperative-load-shedding-cancellation","title":"Axum 0.8 Cooperative Workload Shedding and Client Cancellation Invariant","category":"backend","severity":"critical","description":"Mandates explicit cooperative yielding, deterministic cancellation propagation via Tokio cancellation tokens, and bounded queue admission within Axum 0.8 HTTP pipelines. Eliminates runtime worker thread starvation and unbounded heap allocations during cascading upstream retries and abrupt client disconnects.","antiPatternHeadline":"Unbounded detached background spawning and unbudgeted async loops ignoring HTTP client disconnects.","stars_count":76,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tokio","concurrency","load-shedding","resilience"],"exportEndpoints":{"claude":"/api/rules/axum-0-8-cooperative-load-shedding-cancellation?format=claude","cursorMdc":"/api/rules/axum-0-8-cooperative-load-shedding-cancellation?format=mdc","cursorrules":"/api/rules/axum-0-8-cooperative-load-shedding-cancellation?format=cursor","windsurf":"/api/rules/axum-0-8-cooperative-load-shedding-cancellation?format=windsurf","agents":"/api/rules/axum-0-8-cooperative-load-shedding-cancellation?format=agents"}},{"id":"webauthn-prf-client-key-derivation-standard-webauthn-prf-ext-301","title":"WebAuthn PRF Deterministic Zero-Knowledge Symmetric Key Derivation Guardrails","category":"security","severity":"critical","description":"Enforces strict client-side isolation and standard-compliant key derivation when using the WebAuthn PRF (Pseudo-Random Function) extension. Ensures zero-knowledge client-side encryption by guaranteeing raw authenticator PRF outputs are never transmitted to relying parties and are rigorously expanded via HKDF into non-extractable Web Crypto keys.","antiPatternHeadline":"Transmitting Raw PRF Outputs to Relying Parties or Direct Symmetric Cipher Initialization Without HKDF","stars_count":89,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","prf-extension","zero-knowledge","hkdf","web-crypto","e2ee"],"exportEndpoints":{"claude":"/api/rules/webauthn-prf-client-key-derivation-standard-webauthn-prf-ext-301?format=claude","cursorMdc":"/api/rules/webauthn-prf-client-key-derivation-standard-webauthn-prf-ext-301?format=mdc","cursorrules":"/api/rules/webauthn-prf-client-key-derivation-standard-webauthn-prf-ext-301?format=cursor","windsurf":"/api/rules/webauthn-prf-client-key-derivation-standard-webauthn-prf-ext-301?format=windsurf","agents":"/api/rules/webauthn-prf-client-key-derivation-standard-webauthn-prf-ext-301?format=agents"}},{"id":"tauri-v2-multiwindow-ipc-capability-scoping-standard","title":"Tauri 2.0 Multi-Window IPC Capability Scoping Standard","category":"mobile","severity":"critical","description":"Enforces granular, least-privilege capability isolation across distinct WebviewWindow instances in Tauri 2.0 hybrid mobile and desktop runtimes. Prohibits global wildcard capability allocations to prevent cross-origin or untrusted secondary window contexts from executing privileged host IPC commands.","antiPatternHeadline":"Global Window Wildcards and Ambient Host Permissions in Multi-Webview Architectures","stars_count":63,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri","ipc","rust","security","capabilities"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-multiwindow-ipc-capability-scoping-standard?format=claude","cursorMdc":"/api/rules/tauri-v2-multiwindow-ipc-capability-scoping-standard?format=mdc","cursorrules":"/api/rules/tauri-v2-multiwindow-ipc-capability-scoping-standard?format=cursor","windsurf":"/api/rules/tauri-v2-multiwindow-ipc-capability-scoping-standard?format=windsurf","agents":"/api/rules/tauri-v2-multiwindow-ipc-capability-scoping-standard?format=agents"}},{"id":"bun-websocket-backpressure-drain-invariant-bun-1-2-high-thr-371","title":"Bun 1.2 WebSocket Backpressure Drain & High-Cardinality Invariant","category":"backend","severity":"critical","description":"Enforces deterministic non-blocking socket backpressure handling in Bun 1.2+ native WebSockets during high-cardinality broadcast spikes. Prevents silent internal C++ heap bloat and unmonitored dropped frames by verifying `ws.send()` return codes, maintaining per-socket pending ring buffers, and listening to the `drain(ws)` event hook before resuming socket writes.","antiPatternHeadline":"Blind ws.send() Broadcasting Causing Silent C++ Heap Ballooning and OOM Crashes","stars_count":49,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","websockets","backpressure","memory-management","concurrency"],"exportEndpoints":{"claude":"/api/rules/bun-websocket-backpressure-drain-invariant-bun-1-2-high-thr-371?format=claude","cursorMdc":"/api/rules/bun-websocket-backpressure-drain-invariant-bun-1-2-high-thr-371?format=mdc","cursorrules":"/api/rules/bun-websocket-backpressure-drain-invariant-bun-1-2-high-thr-371?format=cursor","windsurf":"/api/rules/bun-websocket-backpressure-drain-invariant-bun-1-2-high-thr-371?format=windsurf","agents":"/api/rules/bun-websocket-backpressure-drain-invariant-bun-1-2-high-thr-371?format=agents"}},{"id":"otel-otlp-arrow-columnar-compaction-standard","title":"OTel OTLP Arrow Columnar Stream Compaction & Memory Standardization","category":"devops","severity":"critical","description":"Standardizes OpenTelemetry OTLP/Arrow columnar stream batching across edge and aggregator tiers to eliminate row-based protobuf serialization overhead and Go runtime GC fragmentation. Enforces dictionary encoding, bounded memory allocators, and Zstandard compression on high-cardinality distributed trace streams to reduce cross-AZ network egress costs by up to 70%.","antiPatternHeadline":"Shipping Uncompacted Row-Oriented Protobuf OTLP Streams Over High-Egress Tiers","stars_count":104,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","apache-arrow","otlp","collector","tracing","finops"],"exportEndpoints":{"claude":"/api/rules/otel-otlp-arrow-columnar-compaction-standard?format=claude","cursorMdc":"/api/rules/otel-otlp-arrow-columnar-compaction-standard?format=mdc","cursorrules":"/api/rules/otel-otlp-arrow-columnar-compaction-standard?format=cursor","windsurf":"/api/rules/otel-otlp-arrow-columnar-compaction-standard?format=windsurf","agents":"/api/rules/otel-otlp-arrow-columnar-compaction-standard?format=agents"}},{"id":"svelte-5-reactive-graph-cycle-derived-mutation","title":"Svelte 5 Reactive Graph Cycle & Derived Mutation Guardrail","category":"frontend","severity":"critical","description":"Enforces strict mathematical purity in Svelte 5 reactive derivations and prevents cyclic dependency graphs. Prohibits state mutation side effects inside `$derived` and `$derived.by` blocks while mandating termination bounds and untracked reads in `$effect` synchronizations.","antiPatternHeadline":"Mutating $state Inside $derived Blocks or Creating Unbounded $effect Feedback Loops","stars_count":89,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","reactive-graph","state-management"],"exportEndpoints":{"claude":"/api/rules/svelte-5-reactive-graph-cycle-derived-mutation?format=claude","cursorMdc":"/api/rules/svelte-5-reactive-graph-cycle-derived-mutation?format=mdc","cursorrules":"/api/rules/svelte-5-reactive-graph-cycle-derived-mutation?format=cursor","windsurf":"/api/rules/svelte-5-reactive-graph-cycle-derived-mutation?format=windsurf","agents":"/api/rules/svelte-5-reactive-graph-cycle-derived-mutation?format=agents"}},{"id":"kmp-sqlite-atomic-mutex-concurrency-invariant","title":"KMP Multiplatform Atomic File Mutex & Concurrent SQLite Lock Invariant","category":"mobile","severity":"critical","description":"Enforces strict serialized write dispatching, proper WAL journal mode initialization, and atomic inter-process file locking across Kotlin Multiplatform targets. Prevents catastrophic SQLite corruption, POSIX lock poisoning, and unrecoverable SQLITE_BUSY deadlocks between background workers (Android WorkManager, iOS BGAppRefreshTask) and foreground UI threads.","antiPatternHeadline":"Uncoordinated Multi-Handle SQLite Writes and Missing WAL PRAGMA Mutex in KMP Background Workers","stars_count":51,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kmp","kotlin-multiplatform","sqlite","concurrency","ios","android","sqldelight"],"exportEndpoints":{"claude":"/api/rules/kmp-sqlite-atomic-mutex-concurrency-invariant?format=claude","cursorMdc":"/api/rules/kmp-sqlite-atomic-mutex-concurrency-invariant?format=mdc","cursorrules":"/api/rules/kmp-sqlite-atomic-mutex-concurrency-invariant?format=cursor","windsurf":"/api/rules/kmp-sqlite-atomic-mutex-concurrency-invariant?format=windsurf","agents":"/api/rules/kmp-sqlite-atomic-mutex-concurrency-invariant?format=agents"}},{"id":"module-federation-2-strict-singleton-reconciliation-barrier","title":"Strict Singleton Version Reconciliation and Split-Brain Prevention Barrier in Module Federation 2.0","category":"frontend","severity":"critical","description":"Enforces strict singleton version reconciliation, explicit shared scope initialization barriers, and fail-fast failover strategies across Module Federation 2.0 micro-frontends. Prevents split-brain state mutations, duplicate event bus instances, and runtime React/Zustand context degradation caused by loose semver fallbacks or uncoordinated remotes. Mandates runtime assertions and deterministic host-driven container registration.","antiPatternHeadline":"Uncoordinated Eager Imports and Loose Semver Sharing Permitting Multi-Instance Context Partitioning","stars_count":62,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","module-federation","micro-frontends","singletons","state-management","webpack","rspack"],"exportEndpoints":{"claude":"/api/rules/module-federation-2-strict-singleton-reconciliation-barrier?format=claude","cursorMdc":"/api/rules/module-federation-2-strict-singleton-reconciliation-barrier?format=mdc","cursorrules":"/api/rules/module-federation-2-strict-singleton-reconciliation-barrier?format=cursor","windsurf":"/api/rules/module-federation-2-strict-singleton-reconciliation-barrier?format=windsurf","agents":"/api/rules/module-federation-2-strict-singleton-reconciliation-barrier?format=agents"}},{"id":"oauth-2-1-dpop-cryptographic-token-binding-standard","title":"OAuth 2.1 RFC 9449 DPoP Cryptographic Proof-of-Possession Token Binding Standard","category":"security","severity":"critical","description":"Enforces strict implementation of OAuth 2.0/2.1 Demonstrating Proof-of-Possession (DPoP) at the Application Layer (RFC 9449). Eliminates bearer token exfiltration and replay attacks by binding tokens to asymmetric client public key thumbprints and validating ephemeral request signatures against normalized URIs, HTTP methods, server nonces, and single-use JTI identifiers.","antiPatternHeadline":"Unbound Bearer Token Acceptance and Superficial DPoP Proof Verification Lacking JWK Thumbprint and Nonce Binding","stars_count":56,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","oauth2","dpop","cryptography","jwt","rfc9449","zero-trust"],"exportEndpoints":{"claude":"/api/rules/oauth-2-1-dpop-cryptographic-token-binding-standard?format=claude","cursorMdc":"/api/rules/oauth-2-1-dpop-cryptographic-token-binding-standard?format=mdc","cursorrules":"/api/rules/oauth-2-1-dpop-cryptographic-token-binding-standard?format=cursor","windsurf":"/api/rules/oauth-2-1-dpop-cryptographic-token-binding-standard?format=windsurf","agents":"/api/rules/oauth-2-1-dpop-cryptographic-token-binding-standard?format=agents"}},{"id":"k8s-gateway-api-v1-2-cross-namespace-attachment-guardrail","title":"Kubernetes Gateway API v1.2 Cross-Namespace Route Attachment & Tenant Isolation","category":"devops","severity":"critical","description":"Enforces strict cryptographic and architectural tenant isolation for Kubernetes Gateway API v1.2 by prohibiting global wildcard route attachments and unvalidated URI paths. Mandates namespace label selector boundaries on Gateway listeners, explicit ReferenceGrant resources for cross-namespace backend references, and strict tenant-scoped hostname matching to prevent malicious URI hijacking and route shadowing.","antiPatternHeadline":"Unrestricted Gateway Listener Attachment and Permissive Cross-Namespace Service Referencing","stars_count":84,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","kubernetes","gateway-api","multi-tenancy","zero-trust","security"],"exportEndpoints":{"claude":"/api/rules/k8s-gateway-api-v1-2-cross-namespace-attachment-guardrail?format=claude","cursorMdc":"/api/rules/k8s-gateway-api-v1-2-cross-namespace-attachment-guardrail?format=mdc","cursorrules":"/api/rules/k8s-gateway-api-v1-2-cross-namespace-attachment-guardrail?format=cursor","windsurf":"/api/rules/k8s-gateway-api-v1-2-cross-namespace-attachment-guardrail?format=windsurf","agents":"/api/rules/k8s-gateway-api-v1-2-cross-namespace-attachment-guardrail?format=agents"}},{"id":"react-19-use-action-state-optimistic-rollback-isolation","title":"React 19 useActionState Deterministic Optimistic Rollback & Transition Isolation","category":"frontend","severity":"critical","description":"Enforces strict pairing of React 19 useActionState with useOptimistic to guarantee deterministic rollback semantics and eliminate state tearing under concurrent network partitions. Prohibits ad-hoc useState dual-bookkeeping for optimistic UI and requires monotonic sequence validation to prevent stale server responses from overwriting newer local state.","antiPatternHeadline":"Manual useState Dual-Bookkeeping and Uncoordinated useActionState Inducing State Tearing on Action Failure","stars_count":78,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","useActionState","useOptimistic","concurrency","state-isolation","fault-tolerance"],"exportEndpoints":{"claude":"/api/rules/react-19-use-action-state-optimistic-rollback-isolation?format=claude","cursorMdc":"/api/rules/react-19-use-action-state-optimistic-rollback-isolation?format=mdc","cursorrules":"/api/rules/react-19-use-action-state-optimistic-rollback-isolation?format=cursor","windsurf":"/api/rules/react-19-use-action-state-optimistic-rollback-isolation?format=windsurf","agents":"/api/rules/react-19-use-action-state-optimistic-rollback-isolation?format=agents"}},{"id":"vite-6-environment-api-multi-runtime-isolation-vite-6-environme-825","title":"Vite 6 Environment API Multi-Runtime Module Execution Boundary","category":"frontend","severity":"critical","description":"Enforces strict isolation between client, worker/edge (e.g., Workerd), and Node.js execution runtimes when configuring Vite 6 multi-environment pipelines. Prevents cross-environment module graph leakage, improper resolve condition inheritance, and runtime host crash hazards caused by calling legacy SSR APIs in multi-target architectures.","antiPatternHeadline":"Leaking Node.js Built-ins and Shared Module Graphs into Edge Runtimes via Legacy Vite SSR APIs","stars_count":42,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["vite","vite-6","environment-api","ssr","edge-runtime","workerd"],"exportEndpoints":{"claude":"/api/rules/vite-6-environment-api-multi-runtime-isolation-vite-6-environme-825?format=claude","cursorMdc":"/api/rules/vite-6-environment-api-multi-runtime-isolation-vite-6-environme-825?format=mdc","cursorrules":"/api/rules/vite-6-environment-api-multi-runtime-isolation-vite-6-environme-825?format=cursor","windsurf":"/api/rules/vite-6-environment-api-multi-runtime-isolation-vite-6-environme-825?format=windsurf","agents":"/api/rules/vite-6-environment-api-multi-runtime-isolation-vite-6-environme-825?format=agents"}},{"id":"axum-tower-service-lease-concurrency-guardrail","title":"Axum 0.8 Tower Service Lease Concurrency & Backpressure Guardrail","category":"backend","severity":"critical","description":"Mandates deterministic concurrency leasing, backpressure, and cancellation-safe permit management across Axum 0.8 and Tower middleware pipelines. Prevents async worker thread starvation, unbounded memory growth from implicit buffering, and catastrophic load shedding deadlocks under saturation.","antiPatternHeadline":"Unbounded Middleware Buffering and Unleased Inner Service Dispatch Under High Concurrency","stars_count":51,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tower","tokio","concurrency","load-shedding"],"exportEndpoints":{"claude":"/api/rules/axum-tower-service-lease-concurrency-guardrail?format=claude","cursorMdc":"/api/rules/axum-tower-service-lease-concurrency-guardrail?format=mdc","cursorrules":"/api/rules/axum-tower-service-lease-concurrency-guardrail?format=cursor","windsurf":"/api/rules/axum-tower-service-lease-concurrency-guardrail?format=windsurf","agents":"/api/rules/axum-tower-service-lease-concurrency-guardrail?format=agents"}},{"id":"fastapi-pydantic-v2-strict-type-coercion-guardrail","title":"FastAPI Pydantic v2 Rust-Core Strict Type Coercion and Deserialization Guardrail","category":"backend","severity":"critical","description":"Mandates strict-mode validation across all Pydantic v2 ingress schemas in FastAPI services to prevent silent type mutation, truncation, and injection vulnerabilities. Enforces the Rust-core validator's strict mode (strict=True) to reject loose type casting such as float-to-int rounding, string-to-boolean truthiness evaluation, and precision-lossy float deserialization for monetary figures. Guarantees deterministic cryptographic and financial data contracts before request payloads touch business logic.","antiPatternHeadline":"Lax Deserialization Allowing Silent Numeric Truncation, Falsy String Coercion, and IEEE-754 Precision Decay","stars_count":78,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","pydantic-v2","financial-systems","type-safety","data-integrity"],"exportEndpoints":{"claude":"/api/rules/fastapi-pydantic-v2-strict-type-coercion-guardrail?format=claude","cursorMdc":"/api/rules/fastapi-pydantic-v2-strict-type-coercion-guardrail?format=mdc","cursorrules":"/api/rules/fastapi-pydantic-v2-strict-type-coercion-guardrail?format=cursor","windsurf":"/api/rules/fastapi-pydantic-v2-strict-type-coercion-guardrail?format=windsurf","agents":"/api/rules/fastapi-pydantic-v2-strict-type-coercion-guardrail?format=agents"}},{"id":"capacitor-7-hardware-enclave-webcrypto-bridge-invariant","title":"Capacitor 7 Hardware Enclave WebCrypto Bridge Invariant","category":"mobile","severity":"critical","description":"Enforces that all cryptographic key generation, signing, and decryption operations in Capacitor 7 hybrid applications delegate directly to hardware-backed isolated environments (Apple Secure Enclave and Android StrongBox/TEE Keystore) via native bridge plugins. Strictly prohibits the use of pure JavaScript WebCrypto polyfills, userland crypto libraries, or in-memory key representations inside the WebView context to eliminate DOM-based key exfiltration vectors. Mandates non-exportable private key handles where cryptographic material never traverses the bridge boundary.","antiPatternHeadline":"Executing Cryptographic Operations in WebView Memory or Relying on Software-Only WebCrypto Polyfills","stars_count":88,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","security","webcrypto","secure-enclave","keystore"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-hardware-enclave-webcrypto-bridge-invariant?format=claude","cursorMdc":"/api/rules/capacitor-7-hardware-enclave-webcrypto-bridge-invariant?format=mdc","cursorrules":"/api/rules/capacitor-7-hardware-enclave-webcrypto-bridge-invariant?format=cursor","windsurf":"/api/rules/capacitor-7-hardware-enclave-webcrypto-bridge-invariant?format=windsurf","agents":"/api/rules/capacitor-7-hardware-enclave-webcrypto-bridge-invariant?format=agents"}},{"id":"skiko-metal-lifecycle-sync","title":"Compose Multiplatform Skiko Metal Surface Lifecycle Synchronization","category":"mobile","severity":"critical","description":"Enforces strict synchronization between iOS application lifecycle notifications (UIApplicationDidEnterBackgroundNotification / UIApplicationWillEnterForegroundNotification) and Skiko's Metal surface rendering loop. Prevents GPU command buffer execution after background suspension, which triggers iOS termination code 0x8badf00d and Metal device invalidation (MTLDeviceWasRemoved). Mandates blocking synchronous wait-for-completion on pending Metal command buffers prior to background transition acknowledgment.","antiPatternHeadline":"Asynchronous or Uncoordinated iOS Background Transitions During Active Metal Draw Cycles","stars_count":97,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","compose-multiplatform","skiko","metal","ios"],"exportEndpoints":{"claude":"/api/rules/skiko-metal-lifecycle-sync?format=claude","cursorMdc":"/api/rules/skiko-metal-lifecycle-sync?format=mdc","cursorrules":"/api/rules/skiko-metal-lifecycle-sync?format=cursor","windsurf":"/api/rules/skiko-metal-lifecycle-sync?format=windsurf","agents":"/api/rules/skiko-metal-lifecycle-sync?format=agents"}},{"id":"oauth21-rar-fine-grained-assertion","title":"OAuth 2.1 Rich Authorization Requests (RFC 9396) Fine-Grained Assertion Guardrail","category":"security","severity":"critical","description":"Eliminates privilege escalation and confused deputy vulnerabilities by replacing coarse OAuth 2.0 scopes with RFC 9396 Rich Authorization Requests (RAR). Mandates cryptographically sender-constrained access token verification with explicit, transactional equality and threshold validation between API request parameters and token authorization_details payloads.","antiPatternHeadline":"Authorizing High-Value Mutations with Coarse Scopes Instead of RFC 9396 authorization_details Assertions","stars_count":48,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","oauth2.1","rfc9396","rar","authorization","zero-trust","fintech"],"exportEndpoints":{"claude":"/api/rules/oauth21-rar-fine-grained-assertion?format=claude","cursorMdc":"/api/rules/oauth21-rar-fine-grained-assertion?format=mdc","cursorrules":"/api/rules/oauth21-rar-fine-grained-assertion?format=cursor","windsurf":"/api/rules/oauth21-rar-fine-grained-assertion?format=windsurf","agents":"/api/rules/oauth21-rar-fine-grained-assertion?format=agents"}},{"id":"cilium-ebpf-wireguard-mesh-encryption","title":"Cilium eBPF Identity-Aware WireGuard Transparent Mesh Encryption Standard","category":"security","severity":"critical","description":"Enforces deterministic, kernel-space WireGuard encryption integrated with Cilium eBPF dynamic security identities across the cluster mesh. Eliminates user-space proxy encapsulation overhead and prevents IP spoofing by binding cryptographic keys to numeric Cilium identities and dropping unencrypted bypass traffic in the eBPF datapath.","antiPatternHeadline":"Plaintext Datapath Fallback, Missing Node-to-Node Encryption, and IP-Based Policy Bypasses","stars_count":45,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","cilium","ebpf","wireguard","kubernetes","mesh-encryption","zero-trust"],"exportEndpoints":{"claude":"/api/rules/cilium-ebpf-wireguard-mesh-encryption?format=claude","cursorMdc":"/api/rules/cilium-ebpf-wireguard-mesh-encryption?format=mdc","cursorrules":"/api/rules/cilium-ebpf-wireguard-mesh-encryption?format=cursor","windsurf":"/api/rules/cilium-ebpf-wireguard-mesh-encryption?format=windsurf","agents":"/api/rules/cilium-ebpf-wireguard-mesh-encryption?format=agents"}},{"id":"k8s-dra-structured-gpu-claim-isolation","title":"Kubernetes Dynamic Resource Allocation (DRA) Structured GPU Claim Isolation","category":"devops","severity":"critical","description":"Enforces strict Kubernetes Dynamic Resource Allocation (DRA) ResourceClaim parameters for multi-tenant GPU workloads using Structured Parameters. Guarantees deterministic NUMA node affinity, PCIe switch boundary isolation, and explicit interconnect interconnectivity attributes to prevent cross-tenant interconnect degradation and noisy-neighbor memory bandwidth starvation.","antiPatternHeadline":"Unstructured Legacy Extended Resource Over-Subscription & Topology-Agnostic GPU Scheduling","stars_count":102,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","kubernetes","dynamic-resource-allocation","dra","nvidia-gpu","resource-claims","topology-isolation"],"exportEndpoints":{"claude":"/api/rules/k8s-dra-structured-gpu-claim-isolation?format=claude","cursorMdc":"/api/rules/k8s-dra-structured-gpu-claim-isolation?format=mdc","cursorrules":"/api/rules/k8s-dra-structured-gpu-claim-isolation?format=cursor","windsurf":"/api/rules/k8s-dra-structured-gpu-claim-isolation?format=windsurf","agents":"/api/rules/k8s-dra-structured-gpu-claim-isolation?format=agents"}},{"id":"react-19-server-taint-boundary","title":"React 19 Server Taint API Object-Reference Boundary Enforcement","category":"frontend","severity":"critical","description":"Enforces strict secret and credential boundary encapsulation across the React Server Component (RSC) serialization perimeter using React 19's experimental_taintObjectReference and experimental_taintUniqueValue APIs. Prevents inadvertent transmission of cryptographic keys, access tokens, and sensitive infrastructure config payloads across the wire to Client Component trees through runtime and build-time serialization assertions.","antiPatternHeadline":"Exposing Raw Server-Side Secret Contexts or Unsanitized User-Profile Records Directly to Client Component Trees","stars_count":60,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","rsc","security","taint-api","serialization"],"exportEndpoints":{"claude":"/api/rules/react-19-server-taint-boundary?format=claude","cursorMdc":"/api/rules/react-19-server-taint-boundary?format=mdc","cursorrules":"/api/rules/react-19-server-taint-boundary?format=cursor","windsurf":"/api/rules/react-19-server-taint-boundary?format=windsurf","agents":"/api/rules/react-19-server-taint-boundary?format=agents"}},{"id":"vite-6-environment-api-worker-runtime-isolation","title":"Vite 6 Environment API Worker-Runtime Context Isolation Standard","category":"frontend","severity":"critical","description":"Enforces strict runtime module isolation and global scope compartmentalization between client, Node SSR, and Edge/Worker execution environments using Vite 6's Environment API. Prevents cross-environment prototype pollution, global scope bleed, and single-module-graph invalidation bugs during unified full-stack HMR and production bundling passes.","antiPatternHeadline":"Global Scope Bleed and Shared Module Graph Pollution Across Heterogeneous Runtimes","stars_count":66,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","vite6","environment-api","ssr","web-workers","runtime-isolation"],"exportEndpoints":{"claude":"/api/rules/vite-6-environment-api-worker-runtime-isolation?format=claude","cursorMdc":"/api/rules/vite-6-environment-api-worker-runtime-isolation?format=mdc","cursorrules":"/api/rules/vite-6-environment-api-worker-runtime-isolation?format=cursor","windsurf":"/api/rules/vite-6-environment-api-worker-runtime-isolation?format=windsurf","agents":"/api/rules/vite-6-environment-api-worker-runtime-isolation?format=agents"}},{"id":"axum-0-8-streaming-body-fused-timeout-guardrail","title":"Axum 0.8 Streaming Body Atomic Deadline and Fused-Timeout Invariant","category":"backend","severity":"critical","description":"Enforces an absolute, atomic deadline across chunked asynchronous request payload streams in Axum 0.8. Mitigates Slowloris Denial of Service (DoS) attacks and heap exhaustion by wrapping the Body stream in a fused, monotonic timeout that decrements continuously rather than resetting per-chunk.","antiPatternHeadline":"Per-Chunk Timeout Resets Enabling Infinite-Duration Slowloris Payload Streams","stars_count":109,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","security","dos-prevention","tokio","async-streams"],"exportEndpoints":{"claude":"/api/rules/axum-0-8-streaming-body-fused-timeout-guardrail?format=claude","cursorMdc":"/api/rules/axum-0-8-streaming-body-fused-timeout-guardrail?format=mdc","cursorrules":"/api/rules/axum-0-8-streaming-body-fused-timeout-guardrail?format=cursor","windsurf":"/api/rules/axum-0-8-streaming-body-fused-timeout-guardrail?format=windsurf","agents":"/api/rules/axum-0-8-streaming-body-fused-timeout-guardrail?format=agents"}},{"id":"postgres-17-wal-summarizer-consistency-guardrail","title":"Postgres 17 WAL Summarizer Incremental Backup Consistency and LSN Monotonicity Guardrail","category":"backend","severity":"critical","description":"Mandates block-level WAL summary validation and strict LSN monotonicity enforcement across streaming replicas during PostgreSQL 17 incremental backups. Prevents broken restore chains and corrupted block delta states during pg_combinebackup operations caused by summarizer lag, missing summary spans, or timeline divergence.","antiPatternHeadline":"Executing Incremental Backups Without WAL Summary Range Continuity and Replica Replay Monotonicity Validation","stars_count":47,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql-17","wal-summarizer","disaster-recovery","database-reliability","high-availability"],"exportEndpoints":{"claude":"/api/rules/postgres-17-wal-summarizer-consistency-guardrail?format=claude","cursorMdc":"/api/rules/postgres-17-wal-summarizer-consistency-guardrail?format=mdc","cursorrules":"/api/rules/postgres-17-wal-summarizer-consistency-guardrail?format=cursor","windsurf":"/api/rules/postgres-17-wal-summarizer-consistency-guardrail?format=windsurf","agents":"/api/rules/postgres-17-wal-summarizer-consistency-guardrail?format=agents"}},{"id":"bun-websocket-hibernation-state-retention-standard","title":"Bun 1.2 Native WebSocket Server Hibernation State Retention Standard","category":"backend","severity":"critical","description":"Bun 1.2 native WebSocket server hibernation achieves extreme connection density by garbage collecting idle JavaScriptCore connection wrappers and persisting socket descriptors at the native C++/kernel level. Storing active ServerWebSocket references in JavaScript heaps (such as Maps or Sets) defeats hibernation, leading to rapid memory bloat and process termination under high concurrency. All connection lifecycle state must be bound to the native upgrade context and mutated solely via ws.data, while fan-out messaging must leverage native C++ topic pub/sub.","antiPatternHeadline":"Retaining JavaScript ServerWebSocket references in module-scoped collections and manually iterating sockets for broadcasting instead of native hibernation and topic pub/sub.","stars_count":118,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","websockets","hibernation","memory-management","zero-allocation"],"exportEndpoints":{"claude":"/api/rules/bun-websocket-hibernation-state-retention-standard?format=claude","cursorMdc":"/api/rules/bun-websocket-hibernation-state-retention-standard?format=mdc","cursorrules":"/api/rules/bun-websocket-hibernation-state-retention-standard?format=cursor","windsurf":"/api/rules/bun-websocket-hibernation-state-retention-standard?format=windsurf","agents":"/api/rules/bun-websocket-hibernation-state-retention-standard?format=agents"}},{"id":"tauri2-multi-webview-ipc-origin-guardrail","title":"Tauri 2.0 Multi-Webview Context-Isolated IPC Origin Guardrail","category":"mobile","severity":"critical","description":"Enforces strict origin cryptographic binding and permission scoping across multi-webview Tauri 2.0 mobile architectures. Prevents cross-frame script injection and privilege escalation by prohibiting wildcard IPC capability declarations and requiring webview-label validation on all native command invocations.","antiPatternHeadline":"Pervasive Wildcard IPC Capabilities and Unvalidated Multi-Webview Command Invocation","stars_count":74,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri-2","security","ipc","webview-isolation"],"exportEndpoints":{"claude":"/api/rules/tauri2-multi-webview-ipc-origin-guardrail?format=claude","cursorMdc":"/api/rules/tauri2-multi-webview-ipc-origin-guardrail?format=mdc","cursorrules":"/api/rules/tauri2-multi-webview-ipc-origin-guardrail?format=cursor","windsurf":"/api/rules/tauri2-multi-webview-ipc-origin-guardrail?format=windsurf","agents":"/api/rules/tauri2-multi-webview-ipc-origin-guardrail?format=agents"}},{"id":"kmp-metal-vulkan-surface-lifecycle-drain-standard","title":"KMP Metal/Vulkan GPU Swapchain Lifecycle Eviction & Surface Drain Standard","category":"mobile","severity":"critical","description":"Enforces deterministic tearing down and recreation of Skia/Metal and Vulkan rendering surfaces during mobile app backgrounding transitions. Eliminates OS-level Jetsam termination (iOS 0x8badf00d/memory pressure kill) and Android VK_ERROR_SURFACE_LOST_KHR crashes by synchronously draining inflight GPU command buffers and purging GPU-backed swapchains.","antiPatternHeadline":"Retaining active CAMetalLayer/VkSwapchainKHR buffers across lifecycle background transitions","stars_count":93,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kmp","metal","vulkan","skia","compose-multiplatform","memory-management"],"exportEndpoints":{"claude":"/api/rules/kmp-metal-vulkan-surface-lifecycle-drain-standard?format=claude","cursorMdc":"/api/rules/kmp-metal-vulkan-surface-lifecycle-drain-standard?format=mdc","cursorrules":"/api/rules/kmp-metal-vulkan-surface-lifecycle-drain-standard?format=cursor","windsurf":"/api/rules/kmp-metal-vulkan-surface-lifecycle-drain-standard?format=windsurf","agents":"/api/rules/kmp-metal-vulkan-surface-lifecycle-drain-standard?format=agents"}},{"id":"mlkem768-hybrid-tls-handshake-invariant","title":"Post-Quantum ML-KEM-768 Hybrid TLS 1.3 Handshake Enforcement","category":"security","severity":"critical","description":"Enforces post-quantum hybrid key encapsulation (X25519MLKEM768 / SecP256r1MLKEM768) as mandatory supported groups across all enterprise TLS 1.3 client agents and server termination listeners. Mitigates harvest-now-decrypt-later (HNDL) cryptographic attacks by rejecting classical-only ephemeral key exchanges on high-assurance zero-trust mesh ingress and egress paths. Mandates deterministic configuration of FIPS 203 ML-KEM-768 hybrid groups with strict fallback prevention.","antiPatternHeadline":"Permitting Classical-Only Ephemeral Key Exchange in Zero-Trust TLS Handshakes","stars_count":102,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","post-quantum","fips-203","ml-kem-768","tls13","cryptography","zero-trust"],"exportEndpoints":{"claude":"/api/rules/mlkem768-hybrid-tls-handshake-invariant?format=claude","cursorMdc":"/api/rules/mlkem768-hybrid-tls-handshake-invariant?format=mdc","cursorrules":"/api/rules/mlkem768-hybrid-tls-handshake-invariant?format=cursor","windsurf":"/api/rules/mlkem768-hybrid-tls-handshake-invariant?format=windsurf","agents":"/api/rules/mlkem768-hybrid-tls-handshake-invariant?format=agents"}},{"id":"openfga-rebac-traversal-memoization-cycle-guardrail","title":"OpenFGA Recursive Traversal Memoization & Cycle Guardrail","category":"security","severity":"critical","description":"Enforces strict cycle detection, visited-set tracking, max-depth boundaries, and memoization for custom OpenFGA and ReBAC graph traversal evaluations. Prevents thread exhaustion, stack overflows, and algorithmic denial-of-service (DoS) caused by circular group memberships, nested relation sets, and combinatorial graph path explosions.","antiPatternHeadline":"Unbounded Recursive ReBAC Traversal Lacking Visited Sets, Depth Caps, and Resolution Memoization","stars_count":57,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","rebac","authorization","cycle-detection","memoization","dos-prevention"],"exportEndpoints":{"claude":"/api/rules/openfga-rebac-traversal-memoization-cycle-guardrail?format=claude","cursorMdc":"/api/rules/openfga-rebac-traversal-memoization-cycle-guardrail?format=mdc","cursorrules":"/api/rules/openfga-rebac-traversal-memoization-cycle-guardrail?format=cursor","windsurf":"/api/rules/openfga-rebac-traversal-memoization-cycle-guardrail?format=windsurf","agents":"/api/rules/openfga-rebac-traversal-memoization-cycle-guardrail?format=agents"}},{"id":"ebpf-sockmap-zero-copy-flow-control-standard","title":"eBPF Sockmap Zero-Copy Socket Redirection Flow-Control Standard","category":"devops","severity":"critical","description":"Bypasses the full TCP/IP kernel stack overhead for node-local service-mesh sidecar hops using verified BPF sockops redirection with active backpressure detection. Mandates sk_msg redirection bounds checking, write-buffer occupancy telemetry, and explicit fallback paths to prevent silent socket stall and ring-buffer starvation.","antiPatternHeadline":"Blind BPF_SOCK_OPS socket redirection without write-queue backpressure monitoring and fallback routing","stars_count":40,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","sockmap","networking","service-mesh","performance","linux-kernel"],"exportEndpoints":{"claude":"/api/rules/ebpf-sockmap-zero-copy-flow-control-standard?format=claude","cursorMdc":"/api/rules/ebpf-sockmap-zero-copy-flow-control-standard?format=mdc","cursorrules":"/api/rules/ebpf-sockmap-zero-copy-flow-control-standard?format=cursor","windsurf":"/api/rules/ebpf-sockmap-zero-copy-flow-control-standard?format=windsurf","agents":"/api/rules/ebpf-sockmap-zero-copy-flow-control-standard?format=agents"}},{"id":"svelte-5-effect-root-scope-teardown-invariant","title":"Svelte 5 Runes $effect.root Dynamic Scope Teardown Invariant","category":"frontend","severity":"critical","description":"Dynamic reactive computations spawned outside a component's lifecycle via $effect.root must register explicit teardown callbacks and expose an idempotent disposal contract. Failing to invoke cleanup functions returned by $effect.root creates orphaned reactive nodes that persist inside the runtime signal graph, leading to unbound memory leaks and duplicate micro-task executions in long-running SPAs.","antiPatternHeadline":"Unbounded Reactive Root Instantiation Without Idempotent Lifecycle Cleanup","stars_count":68,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["svelte5","runes","reactivity","memory-leaks","signals","lifecycle"],"exportEndpoints":{"claude":"/api/rules/svelte-5-effect-root-scope-teardown-invariant?format=claude","cursorMdc":"/api/rules/svelte-5-effect-root-scope-teardown-invariant?format=mdc","cursorrules":"/api/rules/svelte-5-effect-root-scope-teardown-invariant?format=cursor","windsurf":"/api/rules/svelte-5-effect-root-scope-teardown-invariant?format=windsurf","agents":"/api/rules/svelte-5-effect-root-scope-teardown-invariant?format=agents"}},{"id":"go-chi-http3-0rtt-anti-replay-guardrail-go-chi-http-3-0--378","title":"Go Chi HTTP/3 0-RTT Anti-Replay Verification and Method Whitelisting","category":"backend","severity":"critical","description":"QUIC and HTTP/3 0-RTT (Early Data) handshakes introduce severe replay attack vulnerabilities where on-path network adversaries can duplicate non-idempotent TLS records. This guardrail mandates strict HTTP method whitelisting and cryptographic anti-replay verification within Go Chi middleware, rejecting unverified mutating requests with HTTP 425 Too Early. Production services must guarantee that early data is restricted exclusively to safe, idempotent operations and verified against replay caches before execution.","antiPatternHeadline":"Unconditional Execution of State-Mutating Handlers on QUIC 0-RTT Early-Data Payloads","stars_count":95,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","chi","http3","quic","zero-rtt","anti-replay","security"],"exportEndpoints":{"claude":"/api/rules/go-chi-http3-0rtt-anti-replay-guardrail-go-chi-http-3-0--378?format=claude","cursorMdc":"/api/rules/go-chi-http3-0rtt-anti-replay-guardrail-go-chi-http-3-0--378?format=mdc","cursorrules":"/api/rules/go-chi-http3-0rtt-anti-replay-guardrail-go-chi-http-3-0--378?format=cursor","windsurf":"/api/rules/go-chi-http3-0rtt-anti-replay-guardrail-go-chi-http-3-0--378?format=windsurf","agents":"/api/rules/go-chi-http3-0rtt-anti-replay-guardrail-go-chi-http-3-0--378?format=agents"}},{"id":"bun-sqlite-wal-shm-concurrency-standard","title":"Bun 1.2 Embedded SQLite WAL Shared-Memory Concurrency & Busy-Handler Guardrail","category":"backend","severity":"critical","description":"Enforces strict configuration and concurrency semantics for bun:sqlite across multi-worker Bun clusters accessing shared WAL and SHM files. Mitigates SQLITE_BUSY lock exhaustion and uncoordinated write contention by enforcing explicit busy timeout pragmas, synchronous transaction modes (IMMEDIATE/EXCLUSIVE), and pooled single-writer multi-reader isolation invariants over shared memory mappings.","antiPatternHeadline":"Default Deferred Transactions and Zero-Timeout Pragmas Causing SQLITE_BUSY Deadlocks Across Bun Cluster Workers","stars_count":49,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","sqlite","wal","concurrency","shared-memory","transactions"],"exportEndpoints":{"claude":"/api/rules/bun-sqlite-wal-shm-concurrency-standard?format=claude","cursorMdc":"/api/rules/bun-sqlite-wal-shm-concurrency-standard?format=mdc","cursorrules":"/api/rules/bun-sqlite-wal-shm-concurrency-standard?format=cursor","windsurf":"/api/rules/bun-sqlite-wal-shm-concurrency-standard?format=windsurf","agents":"/api/rules/bun-sqlite-wal-shm-concurrency-standard?format=agents"}},{"id":"tauri-mobile-zero-copy-ipc-guardrail","title":"Tauri 2.0 Mobile SharedArrayBuffer IPC Zero-Copy Guardrail","category":"mobile","severity":"critical","description":"Enforces 64-bit memory alignment and zero-copy binary IPC response handling across the Tauri 2.0 Rust-WebKit/WebView bridge. Eliminates severe garbage collection thrashing, thread starvation, and IPC payload fragmentation caused by serializing high-frequency hardware sensor streams into JSON or Base64 strings.","antiPatternHeadline":"Serializing High-Frequency Sensor Stream Buffers via JSON IPC Bridge Causing GC Thrashing and UI Thread Starvation","stars_count":71,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri","ipc","zero-copy","sharedarraybuffer","rust","webkit","performance"],"exportEndpoints":{"claude":"/api/rules/tauri-mobile-zero-copy-ipc-guardrail?format=claude","cursorMdc":"/api/rules/tauri-mobile-zero-copy-ipc-guardrail?format=mdc","cursorrules":"/api/rules/tauri-mobile-zero-copy-ipc-guardrail?format=cursor","windsurf":"/api/rules/tauri-mobile-zero-copy-ipc-guardrail?format=windsurf","agents":"/api/rules/tauri-mobile-zero-copy-ipc-guardrail?format=agents"}},{"id":"kmp-direct-swift-export-abi-reference-invariant","title":"KMP Direct Swift-Export ABI Memory Safety and Actor Isolation Invariants","category":"mobile","severity":"critical","description":"Enforces strict memory ownership boundaries and isolation semantics across the direct Kotlin/Native Swift-Export boundary without Objective-C wrapper bridging. Prevents fatal retain cycles between Kotlin ARC and Swift modern concurrency tasks, along with bridging panics caused by transferring unpinned or mutable reference graphs across Swift actors.","antiPatternHeadline":"Bidirectional ARC leaks and runtime bridge panics from capturing Kotlin objects in isolated Swift actors","stars_count":116,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","swift","concurrency","memory-management","abi"],"exportEndpoints":{"claude":"/api/rules/kmp-direct-swift-export-abi-reference-invariant?format=claude","cursorMdc":"/api/rules/kmp-direct-swift-export-abi-reference-invariant?format=mdc","cursorrules":"/api/rules/kmp-direct-swift-export-abi-reference-invariant?format=cursor","windsurf":"/api/rules/kmp-direct-swift-export-abi-reference-invariant?format=windsurf","agents":"/api/rules/kmp-direct-swift-export-abi-reference-invariant?format=agents"}},{"id":"webauthn-l3-conditional-mediation-cross-origin-boundary-standard","title":"WebAuthn Level 3 Conditional Mediation Cross-Origin Boundary Standard","category":"security","severity":"critical","description":"Enforces strict cryptographic origin binding and Permission-Policy verification for WebAuthn Level 3 conditional UI mediation embedded in cross-origin frames. Mandates server-side validation of clientDataJSON crossOrigin and topOrigin attributes alongside deterministic AbortController lifecycle management to eliminate credential harvesting and autofill mediation races.","antiPatternHeadline":"Unvalidated Cross-Origin Conditional Mediation and Unbounded Autofill Race Conditions","stars_count":111,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","passkeys","conditional-ui","cross-origin","fido2"],"exportEndpoints":{"claude":"/api/rules/webauthn-l3-conditional-mediation-cross-origin-boundary-standard?format=claude","cursorMdc":"/api/rules/webauthn-l3-conditional-mediation-cross-origin-boundary-standard?format=mdc","cursorrules":"/api/rules/webauthn-l3-conditional-mediation-cross-origin-boundary-standard?format=cursor","windsurf":"/api/rules/webauthn-l3-conditional-mediation-cross-origin-boundary-standard?format=windsurf","agents":"/api/rules/webauthn-l3-conditional-mediation-cross-origin-boundary-standard?format=agents"}},{"id":"openfga-recursive-graph-evaluation-budget-guardrail-production-standard","title":"OpenFGA Graph Evaluation Budget, Depth Limiting, and Cycle-Detection Standard","category":"security","severity":"critical","description":"Unbounded recursive relation evaluation in fine-grained authorization (ReBAC) graphs induces algorithmic denial-of-service, goroutine/thread starvation, and cascading microservice failures. This standard mandates explicit evaluation budgets, hard relation traversal depth limits, visited-node cycle detection invariants, and deterministic context deadline timeouts across all OpenFGA client dispatchers and schema models.","antiPatternHeadline":"Unconstrained recursive graph resolution and circular relation self-nesting without traversal ceilings or context timeouts.","stars_count":93,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","rebac","authorization","dos-prevention","graph-algorithms"],"exportEndpoints":{"claude":"/api/rules/openfga-recursive-graph-evaluation-budget-guardrail-production-standard?format=claude","cursorMdc":"/api/rules/openfga-recursive-graph-evaluation-budget-guardrail-production-standard?format=mdc","cursorrules":"/api/rules/openfga-recursive-graph-evaluation-budget-guardrail-production-standard?format=cursor","windsurf":"/api/rules/openfga-recursive-graph-evaluation-budget-guardrail-production-standard?format=windsurf","agents":"/api/rules/openfga-recursive-graph-evaluation-budget-guardrail-production-standard?format=agents"}},{"id":"ebpf-cilium-ringbuffer-nonblocking-invariant","title":"Cilium eBPF Ring Buffer Non-Blocking Telemetry & Drop Invariant","category":"devops","severity":"critical","description":"Mandates non-blocking, zero-contention ring buffer reservation patterns across Cilium datapath hooks to prevent kernel latency spikes and packet loss during telemetry saturation. Prohibits blocking calls, retry loops, and packet dropping due to telemetry exhaustion by enforcing atomic metrics increment and immediate event drops under backpressure.","antiPatternHeadline":"Blocking or Unbounded BPF Ring Buffer Submissions Inducing Datapath Packet Drops Under Ingress Storms","stars_count":101,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","cilium","kernel","ringbuffer","xdp","networking"],"exportEndpoints":{"claude":"/api/rules/ebpf-cilium-ringbuffer-nonblocking-invariant?format=claude","cursorMdc":"/api/rules/ebpf-cilium-ringbuffer-nonblocking-invariant?format=mdc","cursorrules":"/api/rules/ebpf-cilium-ringbuffer-nonblocking-invariant?format=cursor","windsurf":"/api/rules/ebpf-cilium-ringbuffer-nonblocking-invariant?format=windsurf","agents":"/api/rules/ebpf-cilium-ringbuffer-nonblocking-invariant?format=agents"}},{"id":"react-19-actions-optimistic-rollback","title":"React 19 Concurrent Action Lifecycle & Optimistic State Rollback Invariants","category":"frontend","severity":"critical","description":"Enforces deterministic transactional boundaries between client-side optimistic UI state and server actions in React 19. Prevents split-brain state desynchronization by strictly coupling useOptimistic updates to useActionState action dispatch lifecycles, ensuring automatic atomic rollback during transient mutation failures.","antiPatternHeadline":"Manual State Reversion and Ad-Hoc Promise Catching Bypassing React 19 Transactional Action Lifecycles","stars_count":88,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react19","actions","useOptimistic","useActionState","concurrency"],"exportEndpoints":{"claude":"/api/rules/react-19-actions-optimistic-rollback?format=claude","cursorMdc":"/api/rules/react-19-actions-optimistic-rollback?format=mdc","cursorrules":"/api/rules/react-19-actions-optimistic-rollback?format=cursor","windsurf":"/api/rules/react-19-actions-optimistic-rollback?format=windsurf","agents":"/api/rules/react-19-actions-optimistic-rollback?format=agents"}},{"id":"svelte5-runes-async-reactive-graph-isolation","title":"Svelte 5 Runes Async Reactive Graph Lifecycle Isolation in Hybrid SSR Hydration","category":"frontend","severity":"critical","description":"Mandates strict boundary isolation for asynchronous microfrontend state transitions within Svelte 5's signal-based rune reactivity graph. Precludes unbounded circular dependency loops, untracked cross-boundary signal subscriptions, and SSR hydration memory leaks by requiring explicit teardown signals and decoupled async state boundaries.","antiPatternHeadline":"Unbounded Cross-Boundary Reactive Loops via Implicit Untracked Async Rune Subscription During Hydration","stars_count":113,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","microfrontends","ssr-hydration","signals"],"exportEndpoints":{"claude":"/api/rules/svelte5-runes-async-reactive-graph-isolation?format=claude","cursorMdc":"/api/rules/svelte5-runes-async-reactive-graph-isolation?format=mdc","cursorrules":"/api/rules/svelte5-runes-async-reactive-graph-isolation?format=cursor","windsurf":"/api/rules/svelte5-runes-async-reactive-graph-isolation?format=windsurf","agents":"/api/rules/svelte5-runes-async-reactive-graph-isolation?format=agents"}},{"id":"postgres-17-memory-bounded-hashagg-streaming-io","title":"PostgreSQL 17 Memory-Bounded Hash Aggregation & Streaming I/O Execution Guardrails","category":"backend","severity":"critical","description":"Enforces strict session-level memory budgeting and streaming read engine primitives in PostgreSQL 17 to prevent disk-spill buffer degradation during concurrent aggregations. Mandates scoped work_mem and hash_mem_multiplier governance alongside EXPLAIN (ANALYZE, BUFFERS, MEMORY) verification to eliminate buffer contention and query latency spikes. Prohibits global work_mem inflation that induces OOM kills under concurrent heavy analytic load.","antiPatternHeadline":"Global work_mem Inflation and Unbounded Hash Aggregation Disk Spills Causing Severe I/O Wait Cascades","stars_count":118,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","postgres-17","query-optimization","database-tuning","performance"],"exportEndpoints":{"claude":"/api/rules/postgres-17-memory-bounded-hashagg-streaming-io?format=claude","cursorMdc":"/api/rules/postgres-17-memory-bounded-hashagg-streaming-io?format=mdc","cursorrules":"/api/rules/postgres-17-memory-bounded-hashagg-streaming-io?format=cursor","windsurf":"/api/rules/postgres-17-memory-bounded-hashagg-streaming-io?format=windsurf","agents":"/api/rules/postgres-17-memory-bounded-hashagg-streaming-io?format=agents"}},{"id":"fastapi-anyio-structured-taskgroup-cancellation-standard","title":"FastAPI AnyIO Structured TaskGroup Exception Cancellation Standard","category":"backend","severity":"critical","description":"Enforces strict structured concurrency using AnyIO TaskGroups for intra-request parallel coroutine execution within FastAPI endpoints. Guarantees deterministic cancellation cascading of sibling coroutines upon partial failure or client disconnection, preventing orphaned async workloads and database connection pool exhaustion.","antiPatternHeadline":"Unbounded asyncio.gather and Fire-and-Forget asyncio.create_task Leaking DB Sessions on Partial Request Failure","stars_count":98,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","anyio","asyncio","structured-concurrency","connection-pooling"],"exportEndpoints":{"claude":"/api/rules/fastapi-anyio-structured-taskgroup-cancellation-standard?format=claude","cursorMdc":"/api/rules/fastapi-anyio-structured-taskgroup-cancellation-standard?format=mdc","cursorrules":"/api/rules/fastapi-anyio-structured-taskgroup-cancellation-standard?format=cursor","windsurf":"/api/rules/fastapi-anyio-structured-taskgroup-cancellation-standard?format=windsurf","agents":"/api/rules/fastapi-anyio-structured-taskgroup-cancellation-standard?format=agents"}},{"id":"go-chi-context-bound-errgroup-pipeline","title":"Go Chi Context-Bound Goroutine Lifecycle and Distributed Deadline Propagation","category":"backend","severity":"critical","description":"Enforces strict deadline and cancellation propagation across fan-out goroutines spawned within Go Chi HTTP handlers. Requires the use of context-derived error groups (e.g., errgroup.WithContext) and non-blocking channel selects to guarantee zero goroutine leaks and deterministic resource cleanup upon client disconnects or downstream RPC timeouts.","antiPatternHeadline":"Unbounded Goroutine Spawning with context.Background() or Unsynchronized Channel Receives in Chi Handlers","stars_count":102,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","chi","concurrency","errgroup","context-propagation"],"exportEndpoints":{"claude":"/api/rules/go-chi-context-bound-errgroup-pipeline?format=claude","cursorMdc":"/api/rules/go-chi-context-bound-errgroup-pipeline?format=mdc","cursorrules":"/api/rules/go-chi-context-bound-errgroup-pipeline?format=cursor","windsurf":"/api/rules/go-chi-context-bound-errgroup-pipeline?format=windsurf","agents":"/api/rules/go-chi-context-bound-errgroup-pipeline?format=agents"}},{"id":"webauthn-prf-zk-key-derivation","title":"WebAuthn PRF Hardware Key Derivation and Zero-Knowledge Storage Standard","category":"security","severity":"critical","description":"Enforces cryptographic invariants when deriving client-side zero-knowledge encryption keys via the WebAuthn PRF (Pseudo-Random Function) extension. Requires non-extractable WebCrypto handles, HKDF domain separation, strict authenticator capability validation, and explicit zeroing of raw PRF output to prevent hardware-backed secrets from leaking to networks or storage.","antiPatternHeadline":"Exposing Raw PRF Outputs, Omitting HKDF Domain Separation, or Allowing Extractable Hardware-Derived Keys","stars_count":69,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","prf-extension","zero-knowledge","cryptography","webcrypto"],"exportEndpoints":{"claude":"/api/rules/webauthn-prf-zk-key-derivation?format=claude","cursorMdc":"/api/rules/webauthn-prf-zk-key-derivation?format=mdc","cursorrules":"/api/rules/webauthn-prf-zk-key-derivation?format=cursor","windsurf":"/api/rules/webauthn-prf-zk-key-derivation?format=windsurf","agents":"/api/rules/webauthn-prf-zk-key-derivation?format=agents"}},{"id":"slsa-l3-hermetic-oidc-attestation","title":"SLSA Build L3 Hermetic Provenance Attestation via Ephemeral OIDC Identity","category":"security","severity":"critical","description":"Enforces isolated, bit-for-bit reproducible artifact builds and non-forgeable provenance attestation anchored in ephemeral OIDC workload identities (e.g., Sigstore Fulcio, GitHub Actions OIDC). Prevents supply-chain compromise by eliminating static signing keys and segregating the build execution environment from provenance generation and signing.","antiPatternHeadline":"Self-Attesting Artifacts with Long-Lived Runner Credentials in Non-Hermetic Networked Environments","stars_count":68,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","slsa","supply-chain","provenance","oidc","cosign","sigstore"],"exportEndpoints":{"claude":"/api/rules/slsa-l3-hermetic-oidc-attestation?format=claude","cursorMdc":"/api/rules/slsa-l3-hermetic-oidc-attestation?format=mdc","cursorrules":"/api/rules/slsa-l3-hermetic-oidc-attestation?format=cursor","windsurf":"/api/rules/slsa-l3-hermetic-oidc-attestation?format=windsurf","agents":"/api/rules/slsa-l3-hermetic-oidc-attestation?format=agents"}},{"id":"android-15-fgs-runtime-sandbox-budgeting","title":"Android 15 Foreground Service Runtime Sandbox & Task Budget Partitioning","category":"mobile","severity":"critical","description":"Android 15 (API 35) introduces strict 6-hour runtime execution caps for dataSync and mediaProcessing foreground services alongside stringent hardware acceleration and memory quota sandboxes. Violations immediately trigger Process Exit Info (REASON_ANR / STATUS_KILLED) via OS watchdog signals. Background architectures must enforce strict task budget partitioning, state checkpointing, and automatic fallback to WorkManager Expedited Jobs before quota exhaustion.","antiPatternHeadline":"Unbounded Long-Running Foreground Services Without Type Partitioning or Sandboxed Time Budgets","stars_count":42,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","android-15","foreground-services","workmanager","anr-prevention","battery-optimization"],"exportEndpoints":{"claude":"/api/rules/android-15-fgs-runtime-sandbox-budgeting?format=claude","cursorMdc":"/api/rules/android-15-fgs-runtime-sandbox-budgeting?format=mdc","cursorrules":"/api/rules/android-15-fgs-runtime-sandbox-budgeting?format=cursor","windsurf":"/api/rules/android-15-fgs-runtime-sandbox-budgeting?format=windsurf","agents":"/api/rules/android-15-fgs-runtime-sandbox-budgeting?format=agents"}},{"id":"otel-ebpf-profiling-low-overhead-guardrail","title":"OpenTelemetry eBPF Continuous Profiling Sub-1% CPU Overhead Guardrail","category":"devops","severity":"critical","description":"Enforces strict limits on kernel-space stack sampling rates, BPF map allocations, and asynchronous userspace symbol resolution to cap eBPF profiling overhead below 1% CPU utilization. Prevents cluster-wide performance degradation caused by synchronous DWARF unwinding, unthrottled perf event sampling, and high-frequency in-kernel hash table lookups.","antiPatternHeadline":"High-Frequency In-Kernel Stack Sampling with Synchronous Host-Side Symbol Resolution","stars_count":102,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","opentelemetry","continuous-profiling","linux-kernel","observability"],"exportEndpoints":{"claude":"/api/rules/otel-ebpf-profiling-low-overhead-guardrail?format=claude","cursorMdc":"/api/rules/otel-ebpf-profiling-low-overhead-guardrail?format=mdc","cursorrules":"/api/rules/otel-ebpf-profiling-low-overhead-guardrail?format=cursor","windsurf":"/api/rules/otel-ebpf-profiling-low-overhead-guardrail?format=windsurf","agents":"/api/rules/otel-ebpf-profiling-low-overhead-guardrail?format=agents"}},{"id":"gitops-ebpf-canary-metric-gates","title":"Kernel-Level eBPF Metric-Gated GitOps Canary Rollbacks","category":"devops","severity":"critical","description":"Enforces sub-second progressive canary delivery rollbacks by decoupling promotion decisions from aggregated application log collectors and relying on real-time kernel-level eBPF socket tracing. Monitors raw TCP RTT latency deltas and kernel HTTP error transitions via ring-buffers directly in the host transport layer, triggering zero-trust rollbacks before corrupted payloads propagate across user-space mesh networks.","antiPatternHeadline":"User-Space Log-Scraped Progressive Delivery with Delayed Rollback Horizons","stars_count":64,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","gitops","canary-deployment","flagger","argo-rollouts","observability"],"exportEndpoints":{"claude":"/api/rules/gitops-ebpf-canary-metric-gates?format=claude","cursorMdc":"/api/rules/gitops-ebpf-canary-metric-gates?format=mdc","cursorrules":"/api/rules/gitops-ebpf-canary-metric-gates?format=cursor","windsurf":"/api/rules/gitops-ebpf-canary-metric-gates?format=windsurf","agents":"/api/rules/gitops-ebpf-canary-metric-gates?format=agents"}},{"id":"nextjs-15-taint-object-api-guardrail","title":"Next.js 15 Taint Object API Data-Boundary Leakage Guardrail","category":"frontend","severity":"critical","description":"Enforces deterministic data-boundary isolation using React and Next.js 15 Taint APIs (`experimental_taintObjectReference` and `experimental_taintUniqueValue`) across all Data Access Layers (DAL). Programmatically prevents raw ORM entities, cryptographic secrets, and internal identifiers from crossing the Server Component serialization barrier into client RSC Flight payloads.","antiPatternHeadline":"Passing Raw Database Records or Cryptographic Secrets across Server-Client Component Boundaries","stars_count":70,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs","react-server-components","taint-api","security","data-access-layer"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-taint-object-api-guardrail?format=claude","cursorMdc":"/api/rules/nextjs-15-taint-object-api-guardrail?format=mdc","cursorrules":"/api/rules/nextjs-15-taint-object-api-guardrail?format=cursor","windsurf":"/api/rules/nextjs-15-taint-object-api-guardrail?format=windsurf","agents":"/api/rules/nextjs-15-taint-object-api-guardrail?format=agents"}},{"id":"react-19-optimistic-action-reconciliation-standard","title":"React 19 Action-Driven Optimistic UI Rollback & Monotonic State Reconciliation","category":"frontend","severity":"critical","description":"Guarantees deterministic state reconciliation and eliminates orphaned visual mutations when concurrent optimistic updates resolve out-of-order over lossy networks. Enforces React 19 native action boundaries, useOptimistic immutability, and monotonic sequence tracking to eliminate race-induced UI corruption.","antiPatternHeadline":"Imperative State Rollbacks and Unversioned Optimistic Mutations in React 19 Transitions","stars_count":109,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react19","useOptimistic","useActionState","concurrency","state-reconciliation"],"exportEndpoints":{"claude":"/api/rules/react-19-optimistic-action-reconciliation-standard?format=claude","cursorMdc":"/api/rules/react-19-optimistic-action-reconciliation-standard?format=mdc","cursorrules":"/api/rules/react-19-optimistic-action-reconciliation-standard?format=cursor","windsurf":"/api/rules/react-19-optimistic-action-reconciliation-standard?format=windsurf","agents":"/api/rules/react-19-optimistic-action-reconciliation-standard?format=agents"}},{"id":"fastapi-python313-free-threaded-memory-invariants","title":"FastAPI on Python 3.13 Free-Threaded (PEP 703) Memory and State Guardrails","category":"backend","severity":"critical","description":"Enforces immutable request-scoped state buffers and strict isolation protocols for FastAPI running on free-threaded Python 3.13 (nogil). In the absence of the Global Interpreter Lock, multi-threaded ASGI servers (e.g., Uvicorn/Granian with native threads) will encounter native memory corruption, data races, and torn reads if mutable state leaks across task boundaries or shared memory buffers. All request-scoped data structures must use immutability primitives, contextvars with deep-copy boundaries, or explicit synchronization locks.","antiPatternHeadline":"Cross-Thread Data Races and Memory Corruption via Mutable State Leakage in Free-Threaded Python 3.13","stars_count":99,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","python313","pep703","nogil","concurrency","asgi"],"exportEndpoints":{"claude":"/api/rules/fastapi-python313-free-threaded-memory-invariants?format=claude","cursorMdc":"/api/rules/fastapi-python313-free-threaded-memory-invariants?format=mdc","cursorrules":"/api/rules/fastapi-python313-free-threaded-memory-invariants?format=cursor","windsurf":"/api/rules/fastapi-python313-free-threaded-memory-invariants?format=windsurf","agents":"/api/rules/fastapi-python313-free-threaded-memory-invariants?format=agents"}},{"id":"bun-isolated-worker-pool-max-rss-recycle-standard","title":"Bun 1.2 Isolated Worker Pool Max-RSS Auto-Recycle Standard","category":"backend","severity":"critical","description":"Enforces strict memory isolation and deterministic lifecycle recycling for Bun 1.2 Worker pools in high-concurrency multi-tenant runtimes. Mandates post-task Resident Set Size (RSS) telemetry verification, draining thresholds, and non-blocking worker recreation to preempt JavaScriptCore heap fragmentation and OS thread starvation.","antiPatternHeadline":"Unbounded Worker Lifespans Causing JSC Heap Fragmentation and Process SIGKILL","stars_count":76,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","workers","concurrency","memory-leak","multi-tenant"],"exportEndpoints":{"claude":"/api/rules/bun-isolated-worker-pool-max-rss-recycle-standard?format=claude","cursorMdc":"/api/rules/bun-isolated-worker-pool-max-rss-recycle-standard?format=mdc","cursorrules":"/api/rules/bun-isolated-worker-pool-max-rss-recycle-standard?format=cursor","windsurf":"/api/rules/bun-isolated-worker-pool-max-rss-recycle-standard?format=windsurf","agents":"/api/rules/bun-isolated-worker-pool-max-rss-recycle-standard?format=agents"}},{"id":"kmp-coroutine-cancellation-ios-lifecycle-guardrail","title":"KMP Shared Coroutine and Swift Async Cancellation Hierarchy Guardrail","category":"mobile","severity":"critical","description":"Enforces deterministic coroutine cancellation and memory reclamation when bridging Kotlin StateFlow/SharedFlow to Swift concurrency on iOS. Prevents zombie coroutine jobs, retain cycles, and background thread leakage caused by unstructured Swift Task allocation and uncancelled Kotlin CoroutineScopes during native view controller deallocation.","antiPatternHeadline":"Unstructured Swift Task bridging to KMP flows without propagating lifecycle cancellation signals to Kotlin CoroutineScopes","stars_count":115,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kmp","kotlin-multiplatform","swift","coroutines","memory-leaks","ios"],"exportEndpoints":{"claude":"/api/rules/kmp-coroutine-cancellation-ios-lifecycle-guardrail?format=claude","cursorMdc":"/api/rules/kmp-coroutine-cancellation-ios-lifecycle-guardrail?format=mdc","cursorrules":"/api/rules/kmp-coroutine-cancellation-ios-lifecycle-guardrail?format=cursor","windsurf":"/api/rules/kmp-coroutine-cancellation-ios-lifecycle-guardrail?format=windsurf","agents":"/api/rules/kmp-coroutine-cancellation-ios-lifecycle-guardrail?format=agents"}},{"id":"cilium-tetragon-namespace-escape-guardrail-production-standard","title":"Cilium Tetragon eBPF Synchronous Namespace Escape & Syscall Boundary Enforcement","category":"security","severity":"critical","description":"Enforces kernel-level syscall boundary validation via Cilium Tetragon TracingPolicy resources to prevent container breakouts. Intercepts privileged namespace transitions such as sys_enter_setns, sys_enter_unshare, and sys_enter_pivot_root directly in kernel space, issuing synchronous Sigkill actions before host namespaces are compromised. Guarantees deterministic runtime containment by eliminating the latency gap inherent to user-space audit daemons.","antiPatternHeadline":"Passive Audit-Only Logging or Unenforced Syscall Filtering on Namespace Transition Boundaries","stars_count":112,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","tetragon","ebpf","cilium","container-security","kubernetes","zero-trust"],"exportEndpoints":{"claude":"/api/rules/cilium-tetragon-namespace-escape-guardrail-production-standard?format=claude","cursorMdc":"/api/rules/cilium-tetragon-namespace-escape-guardrail-production-standard?format=mdc","cursorrules":"/api/rules/cilium-tetragon-namespace-escape-guardrail-production-standard?format=cursor","windsurf":"/api/rules/cilium-tetragon-namespace-escape-guardrail-production-standard?format=windsurf","agents":"/api/rules/cilium-tetragon-namespace-escape-guardrail-production-standard?format=agents"}},{"id":"oauth-2-1-rfc-9207-issuer-identification-enforcement","title":"OAuth 2.1 RFC 9207 Issuer Identification and Multi-IdP Mix-Up Defense","category":"security","severity":"critical","description":"Enforces strict OAuth 2.1 and RFC 9207 Authorization Server Issuer Identification across federated identity clients to neutralize multi-IdP authorization mix-up attacks. Authorization callback handlers MUST validate that the returned 'iss' parameter identically matches the expected issuer anchored to the initiated transaction state before dispatching code exchange requests. Any response with a missing or mismatched issuer MUST be rejected immediately to prevent credential forwarding to attacker-controlled endpoints.","antiPatternHeadline":"Exchanging Authorization Codes Without Validating RFC 9207 Issuer Identity Against Session State","stars_count":63,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","oauth2","rfc9207","authentication","zero-trust","identity-federation"],"exportEndpoints":{"claude":"/api/rules/oauth-2-1-rfc-9207-issuer-identification-enforcement?format=claude","cursorMdc":"/api/rules/oauth-2-1-rfc-9207-issuer-identification-enforcement?format=mdc","cursorrules":"/api/rules/oauth-2-1-rfc-9207-issuer-identification-enforcement?format=cursor","windsurf":"/api/rules/oauth-2-1-rfc-9207-issuer-identification-enforcement?format=windsurf","agents":"/api/rules/oauth-2-1-rfc-9207-issuer-identification-enforcement?format=agents"}},{"id":"karpenter-v1-topology-spread-consolidation-invariant","title":"Karpenter v1.0 Quorum-Aware Topology Spread and Consolidation Guardrails","category":"devops","severity":"critical","description":"Enforces deterministic, multi-availability-zone resilience during autonomous Karpenter v1.0 Spot instance consolidation. Prevents simultaneous cross-AZ pod evictions by binding Karpenter disruption budgets with Kubernetes topologySpreadConstraints and strict PodDisruptionBudgets.","antiPatternHeadline":"Unbounded NodePool Consolidation Draining Cross-AZ Workloads Concurrently During Spot Reclamation","stars_count":108,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","karpenter","kubernetes","aws","spot-instances","high-availability"],"exportEndpoints":{"claude":"/api/rules/karpenter-v1-topology-spread-consolidation-invariant?format=claude","cursorMdc":"/api/rules/karpenter-v1-topology-spread-consolidation-invariant?format=mdc","cursorrules":"/api/rules/karpenter-v1-topology-spread-consolidation-invariant?format=cursor","windsurf":"/api/rules/karpenter-v1-topology-spread-consolidation-invariant?format=windsurf","agents":"/api/rules/karpenter-v1-topology-spread-consolidation-invariant?format=agents"}},{"id":"webauthn-l3-prf-key-derivation-guardrail","title":"WebAuthn L3 PRF Hardware-Bound Symmetric Key Derivation Standards","category":"security","severity":"critical","description":"Enforces deterministic, zero-knowledge client-side encryption key derivation using the W3C WebAuthn Level 3 Pseudo-Random Function (PRF) extension. Mandates HKDF domain separation, strict 32-byte PRF salt validation, explicit hardware PRF support verification, and secure memory zeroization of raw PRF secrets.","antiPatternHeadline":"Using raw WebAuthn PRF extension output directly as a symmetric key without HKDF expansion and missing authenticator PRF support verification","stars_count":74,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","prf-extension","zero-knowledge","cryptography","hkdf","passkeys"],"exportEndpoints":{"claude":"/api/rules/webauthn-l3-prf-key-derivation-guardrail?format=claude","cursorMdc":"/api/rules/webauthn-l3-prf-key-derivation-guardrail?format=mdc","cursorrules":"/api/rules/webauthn-l3-prf-key-derivation-guardrail?format=cursor","windsurf":"/api/rules/webauthn-l3-prf-key-derivation-guardrail?format=windsurf","agents":"/api/rules/webauthn-l3-prf-key-derivation-guardrail?format=agents"}},{"id":"capacitor-7-jsi-direct-memory-arraybuffer-bridge","title":"Capacitor 7 JSI Zero-Copy ArrayBuffer Direct Memory Bridge","category":"mobile","severity":"critical","description":"Enforces direct-memory off-heap ArrayBuffer communication across the web-to-native boundary in Capacitor 7, eliminating JSON serialization latency and memory thrashing. Mandates typed binary schemas, memory alignment, and non-blocking ring-buffer dispatch for high-frequency sensor and biometrics telemetry.","antiPatternHeadline":"Marshalling High-Frequency Sensor Telemetry Through JSON-Serialized Bridge Messages","stars_count":99,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","jsi","arraybuffer","telemetry","performance"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-jsi-direct-memory-arraybuffer-bridge?format=claude","cursorMdc":"/api/rules/capacitor-7-jsi-direct-memory-arraybuffer-bridge?format=mdc","cursorrules":"/api/rules/capacitor-7-jsi-direct-memory-arraybuffer-bridge?format=cursor","windsurf":"/api/rules/capacitor-7-jsi-direct-memory-arraybuffer-bridge?format=windsurf","agents":"/api/rules/capacitor-7-jsi-direct-memory-arraybuffer-bridge?format=agents"}},{"id":"nextjs-15-use-cache-salt-tenant-isolation","title":"Next.js 15 'use cache' Salt-Isolated Multi-Tenant Keying and Tagging","category":"frontend","severity":"critical","description":"Next.js 15's 'use cache' directive evaluates functions in isolated boundaries without ambient request cookies or session headers. Multi-tenant data functions must explicitly accept cryptographically salted and verified tenant identifiers in function arguments and tag calls with HMAC-derived tenant prefixes to prevent catastrophic cross-tenant cache poisoning and leakage.","antiPatternHeadline":"Unsalted Tenant IDs or Ambient Session Assumptions in Next.js 15 'use cache' Scopes","stars_count":72,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs15","use-cache","multi-tenant","cache-tag","hmac-salting","data-isolation"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-use-cache-salt-tenant-isolation?format=claude","cursorMdc":"/api/rules/nextjs-15-use-cache-salt-tenant-isolation?format=mdc","cursorrules":"/api/rules/nextjs-15-use-cache-salt-tenant-isolation?format=cursor","windsurf":"/api/rules/nextjs-15-use-cache-salt-tenant-isolation?format=windsurf","agents":"/api/rules/nextjs-15-use-cache-salt-tenant-isolation?format=agents"}},{"id":"bun-sqlite-wal2-mutex-cluster-isolation","title":"Bun 1.2 SQLite WAL2 Mutex Isolation and Descriptor Allocation in Cluster Workers","category":"backend","severity":"critical","description":"Enforces non-blocking concurrent reader execution and prevents file descriptor pool exhaustion in Bun 1.2 cluster worker topologies executing SQLite write-intensive operations. Mandates strict WAL2 pragma configuration alongside centralized cross-worker mutex delegation to eliminate busy-lock timeouts and cascading fd starvation across multithreaded edge runtimes.","antiPatternHeadline":"Direct Multi-Worker Concurrent SQLite Mutations Causing WAL Contention, SQLITE_BUSY Cascades, and FD Leaks","stars_count":66,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","sqlite","wal2","concurrency","clustering"],"exportEndpoints":{"claude":"/api/rules/bun-sqlite-wal2-mutex-cluster-isolation?format=claude","cursorMdc":"/api/rules/bun-sqlite-wal2-mutex-cluster-isolation?format=mdc","cursorrules":"/api/rules/bun-sqlite-wal2-mutex-cluster-isolation?format=cursor","windsurf":"/api/rules/bun-sqlite-wal2-mutex-cluster-isolation?format=windsurf","agents":"/api/rules/bun-sqlite-wal2-mutex-cluster-isolation?format=agents"}},{"id":"cilium-ebpf-sockops-host-routing-bypass","title":"Cilium eBPF Host-Routing and Socket Layer (sockops) Bypass Standard","category":"devops","severity":"critical","description":"Enforces kernel-level eBPF socket-layer redirection (sockops) and native eBPF host routing to eliminate TCP/IP network stack traversal, veth pairs, and Netfilter connection tracking overhead. Prevents netfilter conntrack table exhaustion and microsegmentation latency spikes across same-node pod communication and direct routing topologies. Requires precise Cilium Helm values, native interface binding, and Linux kernel cgroup v2 mount validation.","antiPatternHeadline":"Permitting Standard Veth/Netfilter TCP Stack Traversal for Same-Node and East-West Mesh Traffic Leading to Conntrack Exhaustion","stars_count":56,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","cilium","ebpf","networking","kubernetes","sockops"],"exportEndpoints":{"claude":"/api/rules/cilium-ebpf-sockops-host-routing-bypass?format=claude","cursorMdc":"/api/rules/cilium-ebpf-sockops-host-routing-bypass?format=mdc","cursorrules":"/api/rules/cilium-ebpf-sockops-host-routing-bypass?format=cursor","windsurf":"/api/rules/cilium-ebpf-sockops-host-routing-bypass?format=windsurf","agents":"/api/rules/cilium-ebpf-sockops-host-routing-bypass?format=agents"}},{"id":"vite6-rolldown-ast-worker-isolation","title":"Vite 6 Rolldown AST Multi-Thread Worker Isolation and Serialization","category":"frontend","severity":"critical","description":"Enforces strict thread-local AST serialization and immutable data boundaries across Rolldown parallel Rust worker threads in Vite 6 enterprise monorepos. Prevents V8 heap fragmentation, N-API deadlocks, and cross-thread memory churn by forbidding shared mutable JS AST representations across worker pools during parallel transform passes. Mandates zero-copy binary buffers or structured cloning for thread boundaries.","antiPatternHeadline":"Cross-Thread Shared AST References and Mutable Global Module Graph Leaks","stars_count":106,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","vite6","rolldown","oxc","web-workers","concurrency","performance"],"exportEndpoints":{"claude":"/api/rules/vite6-rolldown-ast-worker-isolation?format=claude","cursorMdc":"/api/rules/vite6-rolldown-ast-worker-isolation?format=mdc","cursorrules":"/api/rules/vite6-rolldown-ast-worker-isolation?format=cursor","windsurf":"/api/rules/vite6-rolldown-ast-worker-isolation?format=windsurf","agents":"/api/rules/vite6-rolldown-ast-worker-isolation?format=agents"}},{"id":"kmp-swift6-actor-isolated-boundary-invariant","title":"KMP Swift 6 Strict Concurrency and Kotlin Native ARC Boundary Guardrail","category":"mobile","severity":"critical","description":"Enforces strict Sendable crossing boundaries and prevents cross-runtime memory leaks between Swift 6 actor-isolated contexts and Kotlin/Native ARC. Mandates immutable data transfer objects, explicit lifecycle invalidation of Kotlin CoroutineScopes bridging to Swift AsyncStream, and prohibits raw pointer or mutable reference sharing across task boundaries.","antiPatternHeadline":"Leaking Non-Sendable Kotlin Native Objects Across Swift 6 Actor Boundaries Without Invalidation","stars_count":91,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","swift6","concurrency","arc","memory-safety"],"exportEndpoints":{"claude":"/api/rules/kmp-swift6-actor-isolated-boundary-invariant?format=claude","cursorMdc":"/api/rules/kmp-swift6-actor-isolated-boundary-invariant?format=mdc","cursorrules":"/api/rules/kmp-swift6-actor-isolated-boundary-invariant?format=cursor","windsurf":"/api/rules/kmp-swift6-actor-isolated-boundary-invariant?format=windsurf","agents":"/api/rules/kmp-swift6-actor-isolated-boundary-invariant?format=agents"}},{"id":"drizzle-orm-038-postgres-17-pipelining-leak-fence","title":"Drizzle ORM 0.38 & Postgres 17 Pipeline Mode Prepared Statement Leak Fencing","category":"backend","severity":"critical","description":"Fences against severe connection pool memory exhaustion and backend process bloat caused by dangling prepared statement handles during Postgres 17 pipeline execution under Drizzle ORM 0.38. When multiplexing concurrent batch requests over pipelined sockets, prepared statement metadata and portal references must be explicitly scoped, bound to named deallocation barriers, or isolated to ephemeral single-query lifecycle gates. Failure to control portal lifecycles in pipelined batches leads to uncollectable memory leakage in both pgBouncer/backend server heaps and Node.js driver buffers.","antiPatternHeadline":"Unbounded Anonymous Prepared Statements in Multiplexed Pipeline Mode","stars_count":74,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","drizzle-orm","postgres-17","pipelining","connection-pooling","memory-leak"],"exportEndpoints":{"claude":"/api/rules/drizzle-orm-038-postgres-17-pipelining-leak-fence?format=claude","cursorMdc":"/api/rules/drizzle-orm-038-postgres-17-pipelining-leak-fence?format=mdc","cursorrules":"/api/rules/drizzle-orm-038-postgres-17-pipelining-leak-fence?format=cursor","windsurf":"/api/rules/drizzle-orm-038-postgres-17-pipelining-leak-fence?format=windsurf","agents":"/api/rules/drizzle-orm-038-postgres-17-pipelining-leak-fence?format=agents"}},{"id":"openfga-temporal-dual-write-barrier","title":"Deterministic Temporal Saga Barrier for OpenFGA Authorization Tuples","category":"security","severity":"critical","description":"Prohibits direct, uncoordinated dual-writes between primary application datastores and OpenFGA relationship-based access control (ReBAC) stores. Enforces deterministic Temporal sagas with idempotent tuple synchronization, explicit compensation boundaries, and transactional outbox guarantees to eliminate authorization drift windows.","antiPatternHeadline":"Non-Transactional Inline Tuples Dual-Writing and Fire-and-Forget ReBAC Mutation","stars_count":94,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","temporal","rebac","authorization","saga-pattern","distributed-systems"],"exportEndpoints":{"claude":"/api/rules/openfga-temporal-dual-write-barrier?format=claude","cursorMdc":"/api/rules/openfga-temporal-dual-write-barrier?format=mdc","cursorrules":"/api/rules/openfga-temporal-dual-write-barrier?format=cursor","windsurf":"/api/rules/openfga-temporal-dual-write-barrier?format=windsurf","agents":"/api/rules/openfga-temporal-dual-write-barrier?format=agents"}},{"id":"react19-concurrent-action-optimistic-rollback-invariant","title":"React 19 Concurrent useActionState Monotonic Optimistic Rollback Invariant","category":"frontend","severity":"critical","description":"Enforces strict monotonic sequencing and transactional consistency between React 19 useActionState and useOptimistic hooks. Prevents UI state tearing and stale rollback cascades caused by out-of-order execution and resolution of concurrent Server Actions across optimistic component subtrees.","antiPatternHeadline":"Unsequenced useOptimistic updates torn by out-of-order useActionState server action rejections","stars_count":93,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["react19","useactionstate","useoptimistic","concurrency","server-actions","frontend-architecture"],"exportEndpoints":{"claude":"/api/rules/react19-concurrent-action-optimistic-rollback-invariant?format=claude","cursorMdc":"/api/rules/react19-concurrent-action-optimistic-rollback-invariant?format=mdc","cursorrules":"/api/rules/react19-concurrent-action-optimistic-rollback-invariant?format=cursor","windsurf":"/api/rules/react19-concurrent-action-optimistic-rollback-invariant?format=windsurf","agents":"/api/rules/react19-concurrent-action-optimistic-rollback-invariant?format=agents"}},{"id":"vite6-ssr-environment-runtime-isolation","title":"Vite 6 Environment API Multi-Runtime SSR Isolation & Memory Leak Prevention","category":"frontend","severity":"critical","description":"Enforces strict heap separation and lifecycle boundary governance across Vite 6 DevEnvironment instances (e.g., Node.js and Edge/workerd runtimes). Guarantees that concurrent SSR module evaluations, HMR invalidations, and singleton states do not cross-contaminate or leak heap memory across runtime compilation contexts.","antiPatternHeadline":"Cross-Runtime Global Mutation and Uncollected ModuleRunner Closures in Multi-Environment SSR","stars_count":118,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["vite","vite-6","ssr","environment-api","memory-isolation","edge-worker","hmr"],"exportEndpoints":{"claude":"/api/rules/vite6-ssr-environment-runtime-isolation?format=claude","cursorMdc":"/api/rules/vite6-ssr-environment-runtime-isolation?format=mdc","cursorrules":"/api/rules/vite6-ssr-environment-runtime-isolation?format=cursor","windsurf":"/api/rules/vite6-ssr-environment-runtime-isolation?format=windsurf","agents":"/api/rules/vite6-ssr-environment-runtime-isolation?format=agents"}},{"id":"postgres-17-json-table-workmem-streaming-projection","title":"Postgres 17 JSON_TABLE WorkMem Bounded Streaming Projection","category":"backend","severity":"critical","description":"Enforces deterministic memory bounds and streaming execution paths when projecting massive JSON/JSONB payloads using PostgreSQL 17's SQL/JSON JSON_TABLE standard. Unbounded in-memory materialization of nested JSON arrays during concurrent OLTP operations bypasses work_mem limits, precipitating backend worker Out-Of-Memory (OOM) termination and connection drops. Queries must enforce pre-chunked streaming projections, typed scalar extraction without intermediate subquery buffering, and explicit memory limits via session parameters.","antiPatternHeadline":"Unbounded jsonb_to_recordset or Materializing JSON_TABLE Evaluation on Multi-Megabyte Payloads","stars_count":97,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","postgres-17","json-table","work-mem","database-performance"],"exportEndpoints":{"claude":"/api/rules/postgres-17-json-table-workmem-streaming-projection?format=claude","cursorMdc":"/api/rules/postgres-17-json-table-workmem-streaming-projection?format=mdc","cursorrules":"/api/rules/postgres-17-json-table-workmem-streaming-projection?format=cursor","windsurf":"/api/rules/postgres-17-json-table-workmem-streaming-projection?format=windsurf","agents":"/api/rules/postgres-17-json-table-workmem-streaming-projection?format=agents"}},{"id":"fastapi-anyio-connection-drop-shielding","title":"FastAPI AnyIO TaskGroup Connection-Drop Shielding & Cleanup Invariant","category":"backend","severity":"critical","description":"Enforces AnyIO structured concurrency task groups and shielded cleanup scopes across all streaming and long-lived FastAPI endpoints. Guarantees complete transactional rollbacks, external resource deallocation, and state auditing when clients abruptly terminate HTTP connections, completely preventing unhandled coroutine leaks and orphaned background tasks.","antiPatternHeadline":"Unshielded Cleanup Routines and Unstructured asyncio.create_task Leaks on Abrupt Client Disconnects","stars_count":103,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","anyio","asyncio","streaming","concurrency","resource-management"],"exportEndpoints":{"claude":"/api/rules/fastapi-anyio-connection-drop-shielding?format=claude","cursorMdc":"/api/rules/fastapi-anyio-connection-drop-shielding?format=mdc","cursorrules":"/api/rules/fastapi-anyio-connection-drop-shielding?format=cursor","windsurf":"/api/rules/fastapi-anyio-connection-drop-shielding?format=windsurf","agents":"/api/rules/fastapi-anyio-connection-drop-shielding?format=agents"}},{"id":"go-chi-context-aware-drain-boundary","title":"Go Chi Context-Aware In-Flight Connection Drain Boundary","category":"backend","severity":"critical","description":"Enforces strict two-phase graceful shutdown semantics in Go Chi HTTP services operating within container orchestrators. Guarantees zero dropped in-flight requests by synchronizing OS signal interception, readiness probe failure propagation, bounded connection draining via http.Server.Shutdown, and root request context cancellation propagation to downstream resources.","antiPatternHeadline":"Immediate process termination via os.Exit or unbounded http.Server.Shutdown without readiness probe de-registration or request context inheritance.","stars_count":65,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","chi","graceful-shutdown","kubernetes","zero-downtime","concurrency"],"exportEndpoints":{"claude":"/api/rules/go-chi-context-aware-drain-boundary?format=claude","cursorMdc":"/api/rules/go-chi-context-aware-drain-boundary?format=mdc","cursorrules":"/api/rules/go-chi-context-aware-drain-boundary?format=cursor","windsurf":"/api/rules/go-chi-context-aware-drain-boundary?format=windsurf","agents":"/api/rules/go-chi-context-aware-drain-boundary?format=agents"}},{"id":"kmp-skie-swift-concurrency-bidirectional-cancellation","title":"KMP SKIE Swift Concurrency Bidirectional Cancellation and Thread Invariant","category":"mobile","severity":"critical","description":"Enforces cooperative, bidirectional cancellation propagation across the Kotlin Multiplatform (KMP) coroutine and Swift Task runtime boundary using Touchlab SKIE. Prevents Swift cooperative pool starvation and Kotlin Native Worker deadlocks by strictly forbidding synchronous bridge blocking, unmanaged Job wrapping, and detached Swift task unbinding.","antiPatternHeadline":"Unchecked Swift Task bridging leaking orphaned Kotlin coroutines and starving the Swift cooperative thread pool via blocking await calls.","stars_count":93,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kmp","kotlin-native","skie","swift-concurrency","coroutines","cancellation"],"exportEndpoints":{"claude":"/api/rules/kmp-skie-swift-concurrency-bidirectional-cancellation?format=claude","cursorMdc":"/api/rules/kmp-skie-swift-concurrency-bidirectional-cancellation?format=mdc","cursorrules":"/api/rules/kmp-skie-swift-concurrency-bidirectional-cancellation?format=cursor","windsurf":"/api/rules/kmp-skie-swift-concurrency-bidirectional-cancellation?format=windsurf","agents":"/api/rules/kmp-skie-swift-concurrency-bidirectional-cancellation?format=agents"}},{"id":"tauri-v2-multiwindow-webview-ipc-origin-binding","title":"Tauri 2.0 Multi-Window Webview IPC Channel Origin-Binding Guardrail","category":"mobile","severity":"critical","description":"Enforces explicit webview context validation and capability partitioning in Tauri 2.0 multi-window applications. Restricts high-privilege IPC command execution strictly to authorized webview labels, preventing capability escalation from secondary popups, OAuth windows, or auxiliary webviews.","antiPatternHeadline":"Ambient IPC Execution Permitting Secondary Webviews to Invoke Privileged Core Commands","stars_count":61,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri","security","ipc","webview"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-multiwindow-webview-ipc-origin-binding?format=claude","cursorMdc":"/api/rules/tauri-v2-multiwindow-webview-ipc-origin-binding?format=mdc","cursorrules":"/api/rules/tauri-v2-multiwindow-webview-ipc-origin-binding?format=cursor","windsurf":"/api/rules/tauri-v2-multiwindow-webview-ipc-origin-binding?format=windsurf","agents":"/api/rules/tauri-v2-multiwindow-webview-ipc-origin-binding?format=agents"}},{"id":"webauthn-synced-passkey-reauth-uv-guardrail","title":"Mandatory User Verification (UV) and Challenge Freshness in WebAuthn Step-Up Re-Authentication","category":"security","severity":"critical","description":"Enforces strict User Verification (UV) flags and tight challenge freshness windows on WebAuthn assertion ceremonies for high-privilege operations. Prevents credential misuse and silent step-up bypasses on multi-device synced passkeys where platform autofill might satisfy User Presence (UP) without explicit biometric or PIN verification.","antiPatternHeadline":"Permitting 'preferred' user verification and omitting the authData UV bit check during privileged re-authentication","stars_count":64,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","passkeys","fido2","step-up-auth","cryptography"],"exportEndpoints":{"claude":"/api/rules/webauthn-synced-passkey-reauth-uv-guardrail?format=claude","cursorMdc":"/api/rules/webauthn-synced-passkey-reauth-uv-guardrail?format=mdc","cursorrules":"/api/rules/webauthn-synced-passkey-reauth-uv-guardrail?format=cursor","windsurf":"/api/rules/webauthn-synced-passkey-reauth-uv-guardrail?format=windsurf","agents":"/api/rules/webauthn-synced-passkey-reauth-uv-guardrail?format=agents"}},{"id":"ebpf-xdp-linerate-ddos-guardrail","title":"Zero-Allocation Driver-Native XDP Filter Invariants for 100Gbps Line-Rate Mitigation","category":"devops","severity":"critical","description":"Enforces strict native-driver XDP execution patterns that discard malicious traffic before SKB (socket buffer) allocation. Prevents CPU exhaustion and softIRQ lockups across Kubernetes worker nodes during multi-terabit volumetric attacks by mandating bounded loops, constant-time LPM lookups, and per-CPU map primitives.","antiPatternHeadline":"Generic XDP Skb-Fallback and Unbounded Packet Iteration Causing Host SoftIRQ Starvation","stars_count":108,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","xdp","ddos","kubernetes","linux-kernel"],"exportEndpoints":{"claude":"/api/rules/ebpf-xdp-linerate-ddos-guardrail?format=claude","cursorMdc":"/api/rules/ebpf-xdp-linerate-ddos-guardrail?format=mdc","cursorrules":"/api/rules/ebpf-xdp-linerate-ddos-guardrail?format=cursor","windsurf":"/api/rules/ebpf-xdp-linerate-ddos-guardrail?format=windsurf","agents":"/api/rules/ebpf-xdp-linerate-ddos-guardrail?format=agents"}},{"id":"openfga-cdc-outbox-consistency-standard","title":"OpenFGA 1.8 Transactional CDC Outbox & Check Evaluation Consistency","category":"security","severity":"critical","description":"Enforces zero authorization drift between relational domain models and OpenFGA 1.8 relationship tuples by eliminating dual-writes across microservices. Mandates that all tuple mutations occur atomically within the primary database transaction via a transactional outbox table streamed to OpenFGA via CDC (Change Data Capture) log tailing, while pairing read-after-write checks with contextual tuples or HIGHEST_CONSISTENCY evaluation parameters.","antiPatternHeadline":"Dual-Writing Application-Layer Authorization Tuples to OpenFGA Alongside Relational Transactions","stars_count":63,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","authorization","cdc","outbox-pattern","distributed-systems","rebac"],"exportEndpoints":{"claude":"/api/rules/openfga-cdc-outbox-consistency-standard?format=claude","cursorMdc":"/api/rules/openfga-cdc-outbox-consistency-standard?format=mdc","cursorrules":"/api/rules/openfga-cdc-outbox-consistency-standard?format=cursor","windsurf":"/api/rules/openfga-cdc-outbox-consistency-standard?format=windsurf","agents":"/api/rules/openfga-cdc-outbox-consistency-standard?format=agents"}},{"id":"svelte-5-state-raw-high-frequency-telemetry","title":"Svelte 5 $state.raw Proxy Bypass for High-Frequency Telemetry Invariant","category":"frontend","severity":"critical","description":"Enforces shallow reactivity via $state.raw for streaming telemetry, WebSockets, WebRTC streams, and high-throughput real-time dashboards in Svelte 5. Bypasses recursive reactive proxy allocation on dense arrays and nested objects to eliminate GC thrashing and microtask queue saturation. Guarantees 60fps rendering budgets by treating streaming updates as atomic buffer replacements or coupled with animation-frame throttling.","antiPatternHeadline":"Deep Reactive Proxy Trapping of High-Throughput Streaming Datasets Causing GC Stalls and Frame Dropping","stars_count":47,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","state-raw","telemetry","performance","memory-leak"],"exportEndpoints":{"claude":"/api/rules/svelte-5-state-raw-high-frequency-telemetry?format=claude","cursorMdc":"/api/rules/svelte-5-state-raw-high-frequency-telemetry?format=mdc","cursorrules":"/api/rules/svelte-5-state-raw-high-frequency-telemetry?format=cursor","windsurf":"/api/rules/svelte-5-state-raw-high-frequency-telemetry?format=windsurf","agents":"/api/rules/svelte-5-state-raw-high-frequency-telemetry?format=agents"}},{"id":"nextjs-15-async-request-context-quarantine","title":"Next.js 15 Async Request Context Quarantine Standard","category":"frontend","severity":"critical","description":"Enforces strict isolation boundaries between dynamic async request APIs (headers, cookies) and prerenderable layout segments in Next.js 15. Prevents dynamic bailout cascade and edge-cache poisoning where dynamic customer identity leaks into shared static edge caches.","antiPatternHeadline":"Awaiting Dynamic Request Headers or Cookies in Root/Shared Layouts Causing Cache De-opt or Identity Poisoning","stars_count":49,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs-15","caching","partial-prerendering","security","app-router"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-async-request-context-quarantine?format=claude","cursorMdc":"/api/rules/nextjs-15-async-request-context-quarantine?format=mdc","cursorrules":"/api/rules/nextjs-15-async-request-context-quarantine?format=cursor","windsurf":"/api/rules/nextjs-15-async-request-context-quarantine?format=windsurf","agents":"/api/rules/nextjs-15-async-request-context-quarantine?format=agents"}},{"id":"bun-ffi-zero-copy-lifetime-pinning","title":"Bun 1.2 Zero-Copy FFI Pointer Pinning and GC Anchor Invariant","category":"backend","severity":"critical","description":"Mandates deterministic GC anchoring and buffer lifecycle management for all zero-copy pointers passed into native asynchronous or threaded C-ABI functions in Bun 1.2. Failure to pin the underlying ArrayBuffer in JavaScriptCore heap during native execution causes non-deterministic Use-After-Free (UAF) and memory corruption.","antiPatternHeadline":"Passing Ephemeral TypedArray Pointers to Asynchronous Native FFI Functions Without GC Anchors","stars_count":72,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","ffi","memory-safety","c-abi","rust"],"exportEndpoints":{"claude":"/api/rules/bun-ffi-zero-copy-lifetime-pinning?format=claude","cursorMdc":"/api/rules/bun-ffi-zero-copy-lifetime-pinning?format=mdc","cursorrules":"/api/rules/bun-ffi-zero-copy-lifetime-pinning?format=cursor","windsurf":"/api/rules/bun-ffi-zero-copy-lifetime-pinning?format=windsurf","agents":"/api/rules/bun-ffi-zero-copy-lifetime-pinning?format=agents"}},{"id":"postgres-17-synchronized-logical-failover-slot-invariant","title":"PostgreSQL 17 Synchronized Logical Replication Failover Slot Invariant","category":"backend","severity":"critical","description":"Enforces failover-enabled logical replication slots and synchronized standby slot topologies introduced in PostgreSQL 17 for Change Data Capture (CDC) pipelines. Prevents message duplication, dual-write divergence, and unrecoverable data loss by guaranteeing logical slot offsets (confirmed_flush_lsn) are continuously mirrored to physical standbys prior to failover or promotion.","antiPatternHeadline":"Provisioning un-synchronized logical replication slots that are dropped or rewound upon physical standby failover.","stars_count":108,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql-17","cdc","logical-replication","high-availability","streaming"],"exportEndpoints":{"claude":"/api/rules/postgres-17-synchronized-logical-failover-slot-invariant?format=claude","cursorMdc":"/api/rules/postgres-17-synchronized-logical-failover-slot-invariant?format=mdc","cursorrules":"/api/rules/postgres-17-synchronized-logical-failover-slot-invariant?format=cursor","windsurf":"/api/rules/postgres-17-synchronized-logical-failover-slot-invariant?format=windsurf","agents":"/api/rules/postgres-17-synchronized-logical-failover-slot-invariant?format=agents"}},{"id":"ebpf-lsm-runtime-immutability-drift-enforcement-production-standard","title":"eBPF LSM Container Runtime Immutability and Executable Drift Enforcement","category":"security","severity":"critical","description":"Enforces strict runtime immutability and blocks container binary drift directly in the Linux kernel using Linux Security Module (LSM) eBPF probes. Intercepts file execution, memory mappings, and namespace-scoped process transitions to guarantee W^X violations (PROT_WRITE | PROT_EXEC) and untrusted fileless executions (e.g., memfd_create) are dropped before reaching userspace.","antiPatternHeadline":"Post-Execution Userspace Auditing and Tolerating In-Memory W^X Code Modification","stars_count":85,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","ebpf","lsm","kernel","container-security","runtime-immutability"],"exportEndpoints":{"claude":"/api/rules/ebpf-lsm-runtime-immutability-drift-enforcement-production-standard?format=claude","cursorMdc":"/api/rules/ebpf-lsm-runtime-immutability-drift-enforcement-production-standard?format=mdc","cursorrules":"/api/rules/ebpf-lsm-runtime-immutability-drift-enforcement-production-standard?format=cursor","windsurf":"/api/rules/ebpf-lsm-runtime-immutability-drift-enforcement-production-standard?format=windsurf","agents":"/api/rules/ebpf-lsm-runtime-immutability-drift-enforcement-production-standard?format=agents"}},{"id":"opentelemetry-span-link-lineage-boundary","title":"OpenTelemetry Span-Link Lineage Boundary for Event-Driven Microservices","category":"devops","severity":"critical","description":"Enforces lifecycle decoupling across asynchronous event broker boundaries by isolating consumer trace trees from upstream producers. Mandates the use of OpenTelemetry span links rather than direct child parentage for consumed messages to eliminate distributed trace context explosion, duration skew, and invalid parent-child sampling dependencies.","antiPatternHeadline":"Setting Extracted Message Context as Direct Span Parent in Asynchronous Consumers","stars_count":49,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["opentelemetry","observability","distributed-tracing","event-driven-architecture","kafka","microservices"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-span-link-lineage-boundary?format=claude","cursorMdc":"/api/rules/opentelemetry-span-link-lineage-boundary?format=mdc","cursorrules":"/api/rules/opentelemetry-span-link-lineage-boundary?format=cursor","windsurf":"/api/rules/opentelemetry-span-link-lineage-boundary?format=windsurf","agents":"/api/rules/opentelemetry-span-link-lineage-boundary?format=agents"}},{"id":"cmp-ios-cadisplaylink-sync-production-standard","title":"Compose Multiplatform iOS CADisplayLink ProMotion Render Loop Synchronization","category":"mobile","severity":"critical","description":"Enforces strict synchronization between Skiko's Metal surface flushes and iOS CADisplayLink frame callbacks. Mandates the binding of Compose Multiplatform render loops to NSRunLoop common modes with dynamic CAFrameRateRange configurations to eliminate frame tearing, sub-frame jitter, and micro-stutter on Apple ProMotion displays.","antiPatternHeadline":"Unsynchronized Free-Running Compose Render Dispatchers Decoupled from ProMotion VSync","stars_count":78,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","compose-multiplatform","ios","skiko","metal","promotion","cadisplaylink"],"exportEndpoints":{"claude":"/api/rules/cmp-ios-cadisplaylink-sync-production-standard?format=claude","cursorMdc":"/api/rules/cmp-ios-cadisplaylink-sync-production-standard?format=mdc","cursorrules":"/api/rules/cmp-ios-cadisplaylink-sync-production-standard?format=cursor","windsurf":"/api/rules/cmp-ios-cadisplaylink-sync-production-standard?format=windsurf","agents":"/api/rules/cmp-ios-cadisplaylink-sync-production-standard?format=agents"}},{"id":"svelte5-runes-signal-graph-cycle-isolation","title":"Svelte 5 Runes Signal Graph Cycle Isolation & Teardown Invariant","category":"frontend","severity":"critical","description":"Enforces strict unidirectional data flow and deterministic cleanup within Svelte 5 runes ($state, $derived, $effect, and untrack) across long-running enterprise dashboards. Prohibits state mutations inside reactive contexts that read the same signal graph, preventing cyclic dependency cascades and unbounded microtask queue exhaustion.","antiPatternHeadline":"Bi-directional State Mutation and Missing Teardown in Svelte 5 Runes Triggering Microtask Death-Spirals","stars_count":42,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["svelte5","runes","signals","reactivity","memory-leak","frontend-performance"],"exportEndpoints":{"claude":"/api/rules/svelte5-runes-signal-graph-cycle-isolation?format=claude","cursorMdc":"/api/rules/svelte5-runes-signal-graph-cycle-isolation?format=mdc","cursorrules":"/api/rules/svelte5-runes-signal-graph-cycle-isolation?format=cursor","windsurf":"/api/rules/svelte5-runes-signal-graph-cycle-isolation?format=windsurf","agents":"/api/rules/svelte5-runes-signal-graph-cycle-isolation?format=agents"}},{"id":"axum-tower-backpressure-propagation-standard","title":"Axum 0.8 & Tower Service Cooperative Cancellation and Backpressure Standard","category":"backend","severity":"critical","description":"Enforces strict cooperative cancellation, explicit client disconnect handling, and bounded frame backpressure across Axum 0.8 and hyper 1.x streaming pipelines. Guarantees that HTTP/2 RST_STREAM and HTTP/3 stream cancellations instantly terminate upstream processing and abort downstream allocations to prevent tail-latency memory exhaustion.","antiPatternHeadline":"Detached Asynchronous Spawns and Unbounded Channel Buffers in Streaming HTTP Handlers","stars_count":45,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tower","hyper","backpressure","concurrency"],"exportEndpoints":{"claude":"/api/rules/axum-tower-backpressure-propagation-standard?format=claude","cursorMdc":"/api/rules/axum-tower-backpressure-propagation-standard?format=mdc","cursorrules":"/api/rules/axum-tower-backpressure-propagation-standard?format=cursor","windsurf":"/api/rules/axum-tower-backpressure-propagation-standard?format=windsurf","agents":"/api/rules/axum-tower-backpressure-propagation-standard?format=agents"}},{"id":"kmp-swift-export-memory-ownership-invariant","title":"Kotlin Multiplatform Swift Export Memory Ownership & ARC-GC Bridge Invariants","category":"mobile","severity":"critical","description":"Enforces strict memory boundary management between Swift ARC and Kotlin Native GC across Swift Export boundaries. Guarantees deterministic deallocation and eliminates bidirectional retain cycles by mandating unidirectional state flow, serializable value-type snapshots, and explicit handle lifecycles instead of bidirectional object-reference graphs.","antiPatternHeadline":"Bidirectional Long-Lived References Between Swift ViewModels and Kotlin Native Singletons Causing Silent Native Heap Leaks","stars_count":106,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","swift","ios","memory-management","arc","garbage-collection"],"exportEndpoints":{"claude":"/api/rules/kmp-swift-export-memory-ownership-invariant?format=claude","cursorMdc":"/api/rules/kmp-swift-export-memory-ownership-invariant?format=mdc","cursorrules":"/api/rules/kmp-swift-export-memory-ownership-invariant?format=cursor","windsurf":"/api/rules/kmp-swift-export-memory-ownership-invariant?format=windsurf","agents":"/api/rules/kmp-swift-export-memory-ownership-invariant?format=agents"}},{"id":"rfc-9449-dpop-key-binding-nonce-guardrail","title":"RFC 9449 DPoP Ephemeral Nonce and Cryptographic Key-Binding Invariant","category":"security","severity":"critical","description":"Enforces strict RFC 9449 Demonstrating Proof-of-Possession (DPoP) at zero-trust edge boundaries and microservice gateways. Mandates cryptographic thumbprint binding (jkt) between asymmetric client key pairs and access tokens, alongside distributed ephemeral nonce verification to eliminate token replay and exfiltration vectors.","antiPatternHeadline":"Accepting Bearer Tokens or Unbound DPoP Proofs with Stale or Missing Nonce Verification","stars_count":104,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","oauth2","dpop","rfc9449","zero-trust","cryptography","jwt"],"exportEndpoints":{"claude":"/api/rules/rfc-9449-dpop-key-binding-nonce-guardrail?format=claude","cursorMdc":"/api/rules/rfc-9449-dpop-key-binding-nonce-guardrail?format=mdc","cursorrules":"/api/rules/rfc-9449-dpop-key-binding-nonce-guardrail?format=cursor","windsurf":"/api/rules/rfc-9449-dpop-key-binding-nonce-guardrail?format=windsurf","agents":"/api/rules/rfc-9449-dpop-key-binding-nonce-guardrail?format=agents"}},{"id":"bun-sqlite-wal-multiprocess-concurrency","title":"Bun 1.2 Native SQLite WAL Multi-Process Concurrency Guardrail","category":"backend","severity":"critical","description":"Enforces single-writer architectural topologies, explicit PRAGMA configurations, and async-free transaction boundaries across clustered Bun 1.2 processes using native bun:sqlite. Eliminates lock escalation cascades (SQLITE_BUSY) and unbounded WAL checkpoint starvation under concurrent multi-process workloads.","antiPatternHeadline":"Uncoordinated multi-process write transactions triggering SQLITE_BUSY cascade deadlocks and unbounded WAL disk growth","stars_count":86,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["bun","sqlite","wal","concurrency","multiprocess","database"],"exportEndpoints":{"claude":"/api/rules/bun-sqlite-wal-multiprocess-concurrency?format=claude","cursorMdc":"/api/rules/bun-sqlite-wal-multiprocess-concurrency?format=mdc","cursorrules":"/api/rules/bun-sqlite-wal-multiprocess-concurrency?format=cursor","windsurf":"/api/rules/bun-sqlite-wal-multiprocess-concurrency?format=windsurf","agents":"/api/rules/bun-sqlite-wal-multiprocess-concurrency?format=agents"}},{"id":"view-transitions-l2-cross-document-guardrail","title":"View Transitions API Level 2 Cross-Document Coordination & Containment Standard","category":"frontend","severity":"critical","description":"Enforces strict pseudo-element allocation budgets, explicit viewport containment, and declarative lifecycle coordination across cross-document (MPA) navigations. Prevents GPU memory saturation, compositing thrashing, and sub-16ms frame drops caused by unbounded view-transition-name registration and unconstrained off-screen texture snapshots.","antiPatternHeadline":"Unbounded Pseudo-Element Allocation and Uncontained Full-Document Snapshots Inducing Compositor Stalls During Cross-Document Navigation","stars_count":41,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","view-transitions","performance","css","mpa","web-perf"],"exportEndpoints":{"claude":"/api/rules/view-transitions-l2-cross-document-guardrail?format=claude","cursorMdc":"/api/rules/view-transitions-l2-cross-document-guardrail?format=mdc","cursorrules":"/api/rules/view-transitions-l2-cross-document-guardrail?format=cursor","windsurf":"/api/rules/view-transitions-l2-cross-document-guardrail?format=windsurf","agents":"/api/rules/view-transitions-l2-cross-document-guardrail?format=agents"}},{"id":"ebpf-tcx-egress-traffic-shaping-guardrail","title":"Linux eBPF TCX Egress Scheduling and EDT Bufferbloat Prevention","category":"devops","severity":"critical","description":"Enforces BPF link-managed TCX (BPF_TCX_EGRESS) kernel-level packet scheduling on container veth interfaces using Earliest Departure Time (EDT) pacing. Prevents multi-tenant TCP bufferbloat and noisy-neighbor latency degradation by obsoleting legacy clsact netlink filter management in favor of deterministic skb->tstamp egress regulation.","antiPatternHeadline":"Attaching Legacy Unmanaged Netlink Clsact Filters Without skb->tstamp EDT Pacing","stars_count":71,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","tcx","kubernetes","networking","traffic-control","linux-kernel"],"exportEndpoints":{"claude":"/api/rules/ebpf-tcx-egress-traffic-shaping-guardrail?format=claude","cursorMdc":"/api/rules/ebpf-tcx-egress-traffic-shaping-guardrail?format=mdc","cursorrules":"/api/rules/ebpf-tcx-egress-traffic-shaping-guardrail?format=cursor","windsurf":"/api/rules/ebpf-tcx-egress-traffic-shaping-guardrail?format=windsurf","agents":"/api/rules/ebpf-tcx-egress-traffic-shaping-guardrail?format=agents"}},{"id":"sigstore-cosign-keyless-admission-control-standard","title":"Sigstore Cosign Keyless Ephemeral Certificate Admission Control Standard","category":"security","severity":"critical","description":"Enforces cryptographically verifiable, OIDC-bound ephemeral provenance signatures and immutable digest pinning on all container workloads before runtime orchestration. Mandates verifying Fulcio root-of-trust, Rekor transparency log proof of inclusion, and exact workload identity (SAN issuer and subject) within admission webhook pipelines before permitting pod scheduling.","antiPatternHeadline":"Bypassing OIDC Claims Verification, Neglecting Rekor Inclusion Proofs, or Relying on Mutable Tags During Admission","stars_count":44,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","kubernetes","sigstore","cosign","admission-control","supply-chain","container-security"],"exportEndpoints":{"claude":"/api/rules/sigstore-cosign-keyless-admission-control-standard?format=claude","cursorMdc":"/api/rules/sigstore-cosign-keyless-admission-control-standard?format=mdc","cursorrules":"/api/rules/sigstore-cosign-keyless-admission-control-standard?format=cursor","windsurf":"/api/rules/sigstore-cosign-keyless-admission-control-standard?format=windsurf","agents":"/api/rules/sigstore-cosign-keyless-admission-control-standard?format=agents"}},{"id":"capacitor7-wkwebview-partition-keychain-sync","title":"Capacitor 7 WKWebView Partitioned Storage & Keychain Sync Invariant","category":"mobile","severity":"critical","description":"Enforces hardware-backed Secure Enclave (iOS Keychain / Android KeyStore) persistence for sensitive credentials to bypass WebKit partitioned storage evictions. WebKit storage APIs (localStorage, IndexedDB) are subject to iOS ITP, low-memory purge, and OS upgrades, requiring credentials to be held in an isolated native enclave and synced ephemerally to memory.","antiPatternHeadline":"Persisting Sensitive Auth Tokens in WebKit LocalStorage or Plaintext IndexedDB Subject to iOS Cache Eviction and Sandbox Leaks","stars_count":75,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor7","ios","wkwebview","keychain","secure-enclave","security"],"exportEndpoints":{"claude":"/api/rules/capacitor7-wkwebview-partition-keychain-sync?format=claude","cursorMdc":"/api/rules/capacitor7-wkwebview-partition-keychain-sync?format=mdc","cursorrules":"/api/rules/capacitor7-wkwebview-partition-keychain-sync?format=cursor","windsurf":"/api/rules/capacitor7-wkwebview-partition-keychain-sync?format=windsurf","agents":"/api/rules/capacitor7-wkwebview-partition-keychain-sync?format=agents"}},{"id":"react-19-taint-api-memory-isolation-standard","title":"React 19 Taint API & Server Component Memory Isolation Standard","category":"frontend","severity":"critical","description":"Enforces strict boundaries around cryptographic secrets, raw database entity models, and sensitive environment variables to prevent accidental serialization into React Server Component (RSC) Flight payload streams. Mandates the use of experimental_taintObjectReference and experimental_taintUniqueValue alongside Data Transfer Object (DTO) projection patterns at all boundary seams.","antiPatternHeadline":"Leaking Raw Database Records or Cryptographic Secrets into Client Component Props and RSC Flight Streams","stars_count":55,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","rsc","nextjs","security","taint-api"],"exportEndpoints":{"claude":"/api/rules/react-19-taint-api-memory-isolation-standard?format=claude","cursorMdc":"/api/rules/react-19-taint-api-memory-isolation-standard?format=mdc","cursorrules":"/api/rules/react-19-taint-api-memory-isolation-standard?format=cursor","windsurf":"/api/rules/react-19-taint-api-memory-isolation-standard?format=windsurf","agents":"/api/rules/react-19-taint-api-memory-isolation-standard?format=agents"}},{"id":"vite-6-rolldown-environment-api-boundary-invariant","title":"Vite 6 Rolldown Environment API Isomorphic Boundary Invariant","category":"frontend","severity":"critical","description":"Mandates absolute runtime module isolation across Vite 6 Environment API compilation units (Client, SSR, Edge/Workerd, WebWorker) to prevent cross-runtime module graph pollution. Prohibits heuristic runtime environment branch sniffing in shared bundles and enforces strict Rolldown build-time condition mapping and chunk graph separation.","antiPatternHeadline":"Ambient Runtime Guards and Monolithic Chunks Polluting Vite 6 Multi-Environment Graphs","stars_count":78,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["vite","vite6","rolldown","environment-api","ssr","edge-runtime","webworker"],"exportEndpoints":{"claude":"/api/rules/vite-6-rolldown-environment-api-boundary-invariant?format=claude","cursorMdc":"/api/rules/vite-6-rolldown-environment-api-boundary-invariant?format=mdc","cursorrules":"/api/rules/vite-6-rolldown-environment-api-boundary-invariant?format=cursor","windsurf":"/api/rules/vite-6-rolldown-environment-api-boundary-invariant?format=windsurf","agents":"/api/rules/vite-6-rolldown-environment-api-boundary-invariant?format=agents"}},{"id":"fastapi-python313-freethreaded-memory-guardrail","title":"FastAPI 0.115 & Python 3.13t Free-Threaded Memory Safety & Concurrency Primitives","category":"backend","severity":"critical","description":"Enforces thread-safe memory fencing, synchronization primitives, and immutable access patterns for FastAPI 0.115+ applications running on Python 3.13 free-threaded (GIL-less) runtimes. Prevents data races, torn reads, and memory corruption across parallel worker threads executing high-throughput ML inference pipelines.","antiPatternHeadline":"Unsynchronized Shared In-Memory State and Compound Mutex-Free Updates Across GIL-less Worker Threads","stars_count":59,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","python-3-13","free-threaded","concurrency","ml-inference","memory-safety"],"exportEndpoints":{"claude":"/api/rules/fastapi-python313-freethreaded-memory-guardrail?format=claude","cursorMdc":"/api/rules/fastapi-python313-freethreaded-memory-guardrail?format=mdc","cursorrules":"/api/rules/fastapi-python313-freethreaded-memory-guardrail?format=cursor","windsurf":"/api/rules/fastapi-python313-freethreaded-memory-guardrail?format=windsurf","agents":"/api/rules/fastapi-python313-freethreaded-memory-guardrail?format=agents"}},{"id":"pg17-failover-slot-sync-cdc-standby-invariant","title":"PostgreSQL 17 Failover Slot Synchronization & CDC Standby Invariants","category":"backend","severity":"critical","description":"Mandates PostgreSQL 17 failover-enabled logical replication slots and synchronized physical standby topologies. Guarantees downstream Change Data Capture (CDC) pipelines maintain strict Log Sequence Number (LSN) monotonicity without stream invalidation or duplicate event floods during primary-standby failovers.","antiPatternHeadline":"Creating Logical Slots Without Failover Synchronization Causing Catastrophic CDC Stream Halts on Standby Promotion","stars_count":112,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql-17","cdc","logical-replication","high-availability","event-driven-architecture"],"exportEndpoints":{"claude":"/api/rules/pg17-failover-slot-sync-cdc-standby-invariant?format=claude","cursorMdc":"/api/rules/pg17-failover-slot-sync-cdc-standby-invariant?format=mdc","cursorrules":"/api/rules/pg17-failover-slot-sync-cdc-standby-invariant?format=cursor","windsurf":"/api/rules/pg17-failover-slot-sync-cdc-standby-invariant?format=windsurf","agents":"/api/rules/pg17-failover-slot-sync-cdc-standby-invariant?format=agents"}},{"id":"otel-v1-28-genai-tracing-token-budgeting-standard","title":"OpenTelemetry v1.28 GenAI Span Lineage & Distributed Token Budget Governance","category":"backend","severity":"critical","description":"Mandates strict adherence to OpenTelemetry Semantic Conventions v1.28 for GenAI operations across all multi-agent orchestration spans. Enforces deterministic prompt template hashing, pre-execution token budget validation, and standard semantic attribute emission to prevent unbounded operational spend and broken telemetry lineage.","antiPatternHeadline":"Ad-Hoc LLM Invocations with Unmonitored Spans, Unhashed Prompts, and Unbounded Token Consumption","stars_count":79,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","opentelemetry","genai","tracing","distributed-tracing","token-governance"],"exportEndpoints":{"claude":"/api/rules/otel-v1-28-genai-tracing-token-budgeting-standard?format=claude","cursorMdc":"/api/rules/otel-v1-28-genai-tracing-token-budgeting-standard?format=mdc","cursorrules":"/api/rules/otel-v1-28-genai-tracing-token-budgeting-standard?format=cursor","windsurf":"/api/rules/otel-v1-28-genai-tracing-token-budgeting-standard?format=windsurf","agents":"/api/rules/otel-v1-28-genai-tracing-token-budgeting-standard?format=agents"}},{"id":"capacitor-7-secure-keystore-crypto-rpc-handshake","title":"Capacitor 7 Hardware-Attested Keystore Cryptographic RPC Handshake","category":"mobile","severity":"critical","description":"Mandates that all privileged bridge executions in Capacitor 7 undergo a two-phase challenge-response handshake backed by hardware keystores (Android StrongBox Keymaster and iOS Secure Enclave). Prevents arbitrary bridge dispatch from compromised WebView contexts by requiring single-use hardware-signed nonces and cryptographic payload envelopes before executing sensitive native operations.","antiPatternHeadline":"Direct WebView Bridge Invocation Without Hardware-Attested Cryptographic Nonce Envelopes","stars_count":83,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["capacitor","mobile-security","secure-enclave","strongbox","cryptography","zero-trust-webview"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-secure-keystore-crypto-rpc-handshake?format=claude","cursorMdc":"/api/rules/capacitor-7-secure-keystore-crypto-rpc-handshake?format=mdc","cursorrules":"/api/rules/capacitor-7-secure-keystore-crypto-rpc-handshake?format=cursor","windsurf":"/api/rules/capacitor-7-secure-keystore-crypto-rpc-handshake?format=windsurf","agents":"/api/rules/capacitor-7-secure-keystore-crypto-rpc-handshake?format=agents"}},{"id":"kmp-2-1-swift-export-arc-pinning-standard","title":"Kotlin Multiplatform 2.1 Swift-Export ARC Boundary Memory Pinning & Deallocation Standard","category":"mobile","severity":"critical","description":"Enforces strict lifecycle ownership, StableRef pinning invariants, and weak delegation patterns across the Kotlin/Native and Swift Automatic Reference Counting (ARC) boundary via Direct Swift Export in KMP 2.1. Eliminates silent native memory leaks caused by bidirectional strong-reference cycles between ARC-managed Swift objects and GC-managed Kotlin runtimes, and prevents unpinned raw pointer dereferencing crashes during asynchronous dispatch.","antiPatternHeadline":"Bidirectional Strong-Reference Cycles Across ARC and Kotlin Runtimes Causing Permanent Memory Leaks and Dangling StableRef Deference Crashes","stars_count":108,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kmp","kotlin-native","swift-export","memory-management","arc","ios"],"exportEndpoints":{"claude":"/api/rules/kmp-2-1-swift-export-arc-pinning-standard?format=claude","cursorMdc":"/api/rules/kmp-2-1-swift-export-arc-pinning-standard?format=mdc","cursorrules":"/api/rules/kmp-2-1-swift-export-arc-pinning-standard?format=cursor","windsurf":"/api/rules/kmp-2-1-swift-export-arc-pinning-standard?format=windsurf","agents":"/api/rules/kmp-2-1-swift-export-arc-pinning-standard?format=agents"}},{"id":"webauthn-prf-zk-hardware-key-derivation-guardrail","title":"WebAuthn PRF Zero-Knowledge Hardware Key Derivation Invariant","category":"security","severity":"critical","description":"Enforces strict cryptographic domain separation, zero-knowledge isolation, and memory sanitization when using the WebAuthn Pseudo-Random Function (PRF) extension. Guarantees that raw PRF outputs and derived symmetric encryption keys never leave volatile client memory, are never transmitted to relying party servers, and undergo mandatory HKDF expansion.","antiPatternHeadline":"Transmitting raw PRF outputs to the server, omitting HKDF context separation, or caching hardware-derived keys in unencrypted browser storage.","stars_count":75,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","prf-extension","zero-knowledge","cryptography","hkdf","client-side-encryption"],"exportEndpoints":{"claude":"/api/rules/webauthn-prf-zk-hardware-key-derivation-guardrail?format=claude","cursorMdc":"/api/rules/webauthn-prf-zk-hardware-key-derivation-guardrail?format=mdc","cursorrules":"/api/rules/webauthn-prf-zk-hardware-key-derivation-guardrail?format=cursor","windsurf":"/api/rules/webauthn-prf-zk-hardware-key-derivation-guardrail?format=windsurf","agents":"/api/rules/webauthn-prf-zk-hardware-key-derivation-guardrail?format=agents"}},{"id":"ebpf-lsm-cgroup-syscall-barrier-production-standard","title":"eBPF-LSM Cgroup-Scoped Dynamic Syscall Barrier and Privilege Escalation Invariant","category":"security","severity":"critical","description":"Enforces immutable kernel-level Linux Security Module (LSM) attachment directly scoped to container cgroups using BPF LSM programs. Dynamically detects and terminates unauthorized runtime capability acquisitions, namespace transitions (such as setns or pivot_root), and anomalous syscall sequencing before the operation commits to kernel state. Prohibits reliance on passive tracepoints or static seccomp profiles for active container breakout prevention.","antiPatternHeadline":"Passive Tracing or Unscoped LSM Probes Permitting Namespace Escapes and TOCTOU Capability Transitions","stars_count":77,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","ebpf","lsm","cgroups","container-hardening","linux-kernel","zero-trust"],"exportEndpoints":{"claude":"/api/rules/ebpf-lsm-cgroup-syscall-barrier-production-standard?format=claude","cursorMdc":"/api/rules/ebpf-lsm-cgroup-syscall-barrier-production-standard?format=mdc","cursorrules":"/api/rules/ebpf-lsm-cgroup-syscall-barrier-production-standard?format=cursor","windsurf":"/api/rules/ebpf-lsm-cgroup-syscall-barrier-production-standard?format=windsurf","agents":"/api/rules/ebpf-lsm-cgroup-syscall-barrier-production-standard?format=agents"}},{"id":"k8s-gateway-api-cross-namespace-referencegrant-isolation-standard","title":"Kubernetes Gateway API 1.2 Cross-Namespace ParentRef Tenant Isolation Standard","category":"devops","severity":"critical","description":"Enforces strict tenant isolation and ReferenceGrant validation across Gateway API 1.2 multi-tenant environments. Prevents cross-namespace traffic hijacking, unauthorized parentRef attachments, and backend service exposures by mandating explicit ReferenceGrant policies, namespace selector constraints, and cryptographic policy verification.","antiPatternHeadline":"Wildcard Cross-Namespace Route Attachment Allowing Ingress Traffic Hijacking Without ReferenceGrant Governance","stars_count":53,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","kubernetes","gateway-api","security","multi-tenancy","zero-trust"],"exportEndpoints":{"claude":"/api/rules/k8s-gateway-api-cross-namespace-referencegrant-isolation-standard?format=claude","cursorMdc":"/api/rules/k8s-gateway-api-cross-namespace-referencegrant-isolation-standard?format=mdc","cursorrules":"/api/rules/k8s-gateway-api-cross-namespace-referencegrant-isolation-standard?format=cursor","windsurf":"/api/rules/k8s-gateway-api-cross-namespace-referencegrant-isolation-standard?format=windsurf","agents":"/api/rules/k8s-gateway-api-cross-namespace-referencegrant-isolation-standard?format=agents"}},{"id":"react-19-server-components-taint-api-boundary","title":"React 19 Server Components Experimental Taint API Boundary Enforcement","category":"frontend","severity":"critical","description":"Enforces strict runtime serialization boundaries using React 19's experimental taint APIs (experimental_taintObjectReference and experimental_taintUniqueValue) alongside 'server-only' package barriers. Prevents accidental leakage of cryptographic secrets, tokens, PII, and full database entity models into React Server Component (RSC) Flight streams transmitted to the client.","antiPatternHeadline":"Leaking Raw Server Secrets or Hydrated Database Entities Directly into Client Flight Payloads","stars_count":52,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","nextjs","security","rsc","taint-api"],"exportEndpoints":{"claude":"/api/rules/react-19-server-components-taint-api-boundary?format=claude","cursorMdc":"/api/rules/react-19-server-components-taint-api-boundary?format=mdc","cursorrules":"/api/rules/react-19-server-components-taint-api-boundary?format=cursor","windsurf":"/api/rules/react-19-server-components-taint-api-boundary?format=windsurf","agents":"/api/rules/react-19-server-components-taint-api-boundary?format=agents"}},{"id":"svelte-5-runes-ssr-cross-request-leak-prevention","title":"Svelte 5 Runes Cross-Request SSR Scope Isolation Standard","category":"frontend","severity":"critical","description":"Enforces strict request-level boundary isolation for Svelte 5 runes ($state, $derived) during Server-Side Rendering (SSR) and asynchronous streaming. Prohibits module-level reactive rune singletons that persist in Node/worker process memory across concurrent HTTP requests, preventing cross-user data contamination and race conditions.","antiPatternHeadline":"Module-Level Rune State Instantiation in SSR Contexts Leaking Cross-Request Data","stars_count":80,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","sveltekit","ssr","security","concurrency"],"exportEndpoints":{"claude":"/api/rules/svelte-5-runes-ssr-cross-request-leak-prevention?format=claude","cursorMdc":"/api/rules/svelte-5-runes-ssr-cross-request-leak-prevention?format=mdc","cursorrules":"/api/rules/svelte-5-runes-ssr-cross-request-leak-prevention?format=cursor","windsurf":"/api/rules/svelte-5-runes-ssr-cross-request-leak-prevention?format=windsurf","agents":"/api/rules/svelte-5-runes-ssr-cross-request-leak-prevention?format=agents"}},{"id":"openfga-subgraph-memoization-depth-limiting","title":"OpenFGA Transitive Depth Limiting and Sub-Graph Memoization Guardrails","category":"backend","severity":"critical","description":"Enforces strict recursion depth boundaries and request-scoped sub-graph memoization during OpenFGA relationship-based access control (ReBAC) evaluations. Prevents algorithmic complexity denial-of-service (Graph-DoS) and tail-latency degradation caused by cyclic hierarchies, deep transitive inheritance, and redundant node expansions. Guarantees deterministic evaluation cost and O(1) retrieval for previously traversed authorization paths.","antiPatternHeadline":"Unbounded Recursive Traversal and Duplicate Sub-Tree Fan-Out in Relationship Checks","stars_count":64,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","openfga","rebac","authorization","performance","memoization","security"],"exportEndpoints":{"claude":"/api/rules/openfga-subgraph-memoization-depth-limiting?format=claude","cursorMdc":"/api/rules/openfga-subgraph-memoization-depth-limiting?format=mdc","cursorrules":"/api/rules/openfga-subgraph-memoization-depth-limiting?format=cursor","windsurf":"/api/rules/openfga-subgraph-memoization-depth-limiting?format=windsurf","agents":"/api/rules/openfga-subgraph-memoization-depth-limiting?format=agents"}},{"id":"pgvector-hnsw-autovacuum-fencing-guardrail","title":"PostgreSQL 17 pgvector HNSW Autovacuum Fencing & Query Determinism","category":"backend","severity":"critical","description":"Enforces table-level autovacuum storage parameter fencing, non-blocking index cleanup thresholds, and isolated ingest partitioning for pgvector HNSW indexes on PostgreSQL 17. Guarantees bounded p99/p99.9 cosine distance retrieval latencies by preventing worker buffer cache thrashing and relation lock contention.","antiPatternHeadline":"Unthrottled Default Autovacuum Starving Real-Time HNSW Cosine Search Queries","stars_count":70,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","pgvector","hnsw","performance","database"],"exportEndpoints":{"claude":"/api/rules/pgvector-hnsw-autovacuum-fencing-guardrail?format=claude","cursorMdc":"/api/rules/pgvector-hnsw-autovacuum-fencing-guardrail?format=mdc","cursorrules":"/api/rules/pgvector-hnsw-autovacuum-fencing-guardrail?format=cursor","windsurf":"/api/rules/pgvector-hnsw-autovacuum-fencing-guardrail?format=windsurf","agents":"/api/rules/pgvector-hnsw-autovacuum-fencing-guardrail?format=agents"}},{"id":"axum-tokio-cooperative-cancellation-pipeline","title":"Axum 0.8 & Tokio Cooperative Task Budgeting and Cancellation Architecture","category":"backend","severity":"critical","description":"Eliminates Tokio worker thread starvation and orphan resource leaks in Axum 0.8 streaming and reverse-proxy handlers by enforcing cooperative task yielding and hierarchical CancellationToken propagation. Ensures unbounded byte-stream iteration respects runtime execution budgets and cleanly unbinds upstream connections when downstream clients abort.","antiPatternHeadline":"Unbounded Async Stream Loops Without Yielding or Hierarchical Cancellation Propagation","stars_count":73,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tokio","concurrency","performance","streaming"],"exportEndpoints":{"claude":"/api/rules/axum-tokio-cooperative-cancellation-pipeline?format=claude","cursorMdc":"/api/rules/axum-tokio-cooperative-cancellation-pipeline?format=mdc","cursorrules":"/api/rules/axum-tokio-cooperative-cancellation-pipeline?format=cursor","windsurf":"/api/rules/axum-tokio-cooperative-cancellation-pipeline?format=windsurf","agents":"/api/rules/axum-tokio-cooperative-cancellation-pipeline?format=agents"}},{"id":"android-16kb-page-size-alignment-standard-android-15-16kb--422","title":"Android 15 16KB Page Size NDK Memory Alignment Standard","category":"mobile","severity":"critical","description":"Enforces 16KB (16384 bytes) ELF segment alignment and memory allocation constraints for Android NDK native libraries on Android 15+. Prevents fatal runtime SIGBUS crashes, mmap mapping failures, and dynamic linker rejections caused by legacy 4KB page assumptions on modern ARM64 and x86_64 hardware.","antiPatternHeadline":"Compiling NDK Binaries with Hardcoded 4KB Max Page Size and Unaligned Native mmap Offsets","stars_count":113,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","android","ndk","android-15","memory-alignment","cpp","cmake"],"exportEndpoints":{"claude":"/api/rules/android-16kb-page-size-alignment-standard-android-15-16kb--422?format=claude","cursorMdc":"/api/rules/android-16kb-page-size-alignment-standard-android-15-16kb--422?format=mdc","cursorrules":"/api/rules/android-16kb-page-size-alignment-standard-android-15-16kb--422?format=cursor","windsurf":"/api/rules/android-16kb-page-size-alignment-standard-android-15-16kb--422?format=windsurf","agents":"/api/rules/android-16kb-page-size-alignment-standard-android-15-16kb--422?format=agents"}},{"id":"tauri2-granular-capability-acl-partitioning","title":"Tauri 2.0 Granular Capability ACL and Multi-Window Partitioning","category":"mobile","severity":"critical","description":"Enforces strict privilege separation across webview boundaries by mandating isolated capability sets for secondary and auxiliary webviews. Prevents unauthorized IPC command execution and core plugin inheritance by forbidding wildcard window selectors in capability manifests and isolating untrusted content to scoped permission boundaries.","antiPatternHeadline":"Assigning global capabilities with wildcard window selectors that expose privileged core plugins to untrusted auxiliary webviews","stars_count":78,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri-2","security","acl","ipc","capabilities"],"exportEndpoints":{"claude":"/api/rules/tauri2-granular-capability-acl-partitioning?format=claude","cursorMdc":"/api/rules/tauri2-granular-capability-acl-partitioning?format=mdc","cursorrules":"/api/rules/tauri2-granular-capability-acl-partitioning?format=cursor","windsurf":"/api/rules/tauri2-granular-capability-acl-partitioning?format=windsurf","agents":"/api/rules/tauri2-granular-capability-acl-partitioning?format=agents"}},{"id":"tls-1-3-ech-ingress-guardrail","title":"TLS 1.3 Encrypted Client Hello (ECH) Split-Mode Ingress Enforcement","category":"security","severity":"critical","description":"Enforces strict TLS 1.3 Encrypted Client Hello (ECH) ingress policies to prevent plaintext Server Name Indication (SNI) leakage across transit networks. Mandates split-mode client-facing termination with DNS-over-HTTPS (DoH) HTTPS RR (RFC 9460) validation, rejecting insecure unencrypted SNI fallback.","antiPatternHeadline":"Permitting Plaintext Outer SNI Fallback and Missing ECHConfig DoH Record Validation","stars_count":95,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","tls-1-3","ech","sni-privacy","edge-gateway","dns-over-https"],"exportEndpoints":{"claude":"/api/rules/tls-1-3-ech-ingress-guardrail?format=claude","cursorMdc":"/api/rules/tls-1-3-ech-ingress-guardrail?format=mdc","cursorrules":"/api/rules/tls-1-3-ech-ingress-guardrail?format=cursor","windsurf":"/api/rules/tls-1-3-ech-ingress-guardrail?format=windsurf","agents":"/api/rules/tls-1-3-ech-ingress-guardrail?format=agents"}},{"id":"sigstore-keyless-ephemeral-attestation-webhook","title":"Enforce Sigstore Keyless Ephemeral Attestation & Rekor Transparency Admission","category":"security","severity":"critical","description":"Validates short-lived Fulcio X.509 code signing certificates and Rekor transparency log inclusion proofs at Kubernetes admission time. Mandates strict Subject Alternative Name (SAN) regex matching, trusted root TUF distribution anchor pinning, and cryptographic offline verification before admitting any container workload.","antiPatternHeadline":"Trusting Unverified Image Digests, Bypassing Rekor Inclusion Proofs, or Performing Soft-Fail Ephemeral Certificate Verification","stars_count":76,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","sigstore","admission-controller","cosign","supply-chain","kubernetes"],"exportEndpoints":{"claude":"/api/rules/sigstore-keyless-ephemeral-attestation-webhook?format=claude","cursorMdc":"/api/rules/sigstore-keyless-ephemeral-attestation-webhook?format=mdc","cursorrules":"/api/rules/sigstore-keyless-ephemeral-attestation-webhook?format=cursor","windsurf":"/api/rules/sigstore-keyless-ephemeral-attestation-webhook?format=windsurf","agents":"/api/rules/sigstore-keyless-ephemeral-attestation-webhook?format=agents"}},{"id":"opentelemetry-baggage-quota-sanitization-boundary","title":"OpenTelemetry W3C Baggage Ingress Quota and Sanitization Boundary","category":"devops","severity":"critical","description":"Enforces strict ingress size boundaries, allowlist filtering, and character sanitization on W3C Baggage headers entering distributed service perimeters. Prevents telemetry poisoning, header injection attacks, and memory exhaustion caused by unconstrained baggage propagation.","antiPatternHeadline":"Blind Ingestion and Unbounded Propagation of Untrusted W3C Baggage Headers","stars_count":118,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","tracing","security","distributed-systems","w3c-baggage"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-baggage-quota-sanitization-boundary?format=claude","cursorMdc":"/api/rules/opentelemetry-baggage-quota-sanitization-boundary?format=mdc","cursorrules":"/api/rules/opentelemetry-baggage-quota-sanitization-boundary?format=cursor","windsurf":"/api/rules/opentelemetry-baggage-quota-sanitization-boundary?format=windsurf","agents":"/api/rules/opentelemetry-baggage-quota-sanitization-boundary?format=agents"}},{"id":"nextjs15-ppr-dynamic-io-boundary-quarantine","title":"Next.js 15 PPR Dynamic IO Boundary Quarantine Invariant","category":"frontend","severity":"critical","description":"Enforces strict isolation of dynamic asynchronous operations, headers, cookies, and un-cached fetch calls within dedicated React Suspense boundaries under Next.js 15 Partial Prerendering (PPR) and experimental dynamicIO. Guarantees that dynamic runtime data fetching never de-optimizes the enclosing static layout shell into dynamic-render mode or causes unhandled microtask rejections during static export passes.","antiPatternHeadline":"Leaking dynamic I/O across un-quarantined React Server Component boundaries, de-optimizing the PPR static shell to dynamic runtime rendering.","stars_count":46,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs","react19","partial-prerendering","dynamic-io","performance"],"exportEndpoints":{"claude":"/api/rules/nextjs15-ppr-dynamic-io-boundary-quarantine?format=claude","cursorMdc":"/api/rules/nextjs15-ppr-dynamic-io-boundary-quarantine?format=mdc","cursorrules":"/api/rules/nextjs15-ppr-dynamic-io-boundary-quarantine?format=cursor","windsurf":"/api/rules/nextjs15-ppr-dynamic-io-boundary-quarantine?format=windsurf","agents":"/api/rules/nextjs15-ppr-dynamic-io-boundary-quarantine?format=agents"}},{"id":"axum-graceful-draining-mpsc-backpressure","title":"Axum Graceful Drain Synchronization with Bounded MPSC Channel Backpressure","category":"backend","severity":"critical","description":"Guarantees zero dropped in-flight HTTP requests and zero lost background buffer operations during Kubernetes rolling deployments. Synchronizes hyper/axum graceful listener termination (sending HTTP/2 GOAWAY frames and waiting for active transport sockets to close) with deterministic bounded Tokio MPSC channel closure, tracking active task references via CancellationToken and task trackers.","antiPatternHeadline":"Abrupt Tokio Runtime Abort or Uncoordinated Channel Producer Drops Causing Dropped In-Flight Requests and 502 Bad Gateway / Broken Pipe Errors","stars_count":62,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tokio","kubernetes","graceful-shutdown","concurrency"],"exportEndpoints":{"claude":"/api/rules/axum-graceful-draining-mpsc-backpressure?format=claude","cursorMdc":"/api/rules/axum-graceful-draining-mpsc-backpressure?format=mdc","cursorrules":"/api/rules/axum-graceful-draining-mpsc-backpressure?format=cursor","windsurf":"/api/rules/axum-graceful-draining-mpsc-backpressure?format=windsurf","agents":"/api/rules/axum-graceful-draining-mpsc-backpressure?format=agents"}},{"id":"postgres-17-parallel-vacuum-memory-cap-guardrail","title":"Postgres 17 Parallel Vacuum Maintenance Work Memory Cap Allocation","category":"backend","severity":"critical","description":"Prevents catastrophic Out-Of-Memory (OOM) events and severe disk I/O thrashing during heavy write surges by governing PostgreSQL 17 vacuum worker allocations. Enforces dynamic ceilings across maintenance_work_mem, autovacuum_max_workers, and max_parallel_maintenance_workers, utilizing PG17's internal vacuum memory limits rather than unbounded global memory assignments. Eliminates multi-gigabyte memory exhaustion where concurrent index scans and parallel vacuum worker allocations cause cascading backend evictions.","antiPatternHeadline":"Global Uncapped Maintenance Work Memory Allocation Across Concurrent Parallel Vacuum Workers","stars_count":109,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres-17","database-reliability","autovacuum","memory-management"],"exportEndpoints":{"claude":"/api/rules/postgres-17-parallel-vacuum-memory-cap-guardrail?format=claude","cursorMdc":"/api/rules/postgres-17-parallel-vacuum-memory-cap-guardrail?format=mdc","cursorrules":"/api/rules/postgres-17-parallel-vacuum-memory-cap-guardrail?format=cursor","windsurf":"/api/rules/postgres-17-parallel-vacuum-memory-cap-guardrail?format=windsurf","agents":"/api/rules/postgres-17-parallel-vacuum-memory-cap-guardrail?format=agents"}},{"id":"capacitor7-secure-enclave-app-attest-integrity-validation","title":"Capacitor 7 Hardware-Backed KeyStore & App Attest Integrity Validation","category":"mobile","severity":"critical","description":"Cryptographic key pairs generated on mobile devices must reside strictly within hardware-isolated boundaries (iOS Secure Enclave and Android StrongBox/TEE) and possess verifiable server-validated attestations. Capacitor applications must never store unencrypted or software-backed credentials in WebView storage or execute client-only root/jailbreak checks. All high-privilege operations must enforce Apple DCAppAttest or Google Play Integrity cryptographic challenge-response handshakes validated server-side.","antiPatternHeadline":"Trusting Client-Side Integrity Flags and Software Keystores for Private Key Material","stars_count":107,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","security","secure-enclave","app-attest","play-integrity","cryptography"],"exportEndpoints":{"claude":"/api/rules/capacitor7-secure-enclave-app-attest-integrity-validation?format=claude","cursorMdc":"/api/rules/capacitor7-secure-enclave-app-attest-integrity-validation?format=mdc","cursorrules":"/api/rules/capacitor7-secure-enclave-app-attest-integrity-validation?format=cursor","windsurf":"/api/rules/capacitor7-secure-enclave-app-attest-integrity-validation?format=windsurf","agents":"/api/rules/capacitor7-secure-enclave-app-attest-integrity-validation?format=agents"}},{"id":"webauthn-prf-zk-symmetric-key-derivation","title":"Zero-Knowledge Hardware-Bound Key Derivation via WebAuthn PRF Extension","category":"security","severity":"critical","description":"Enforces strict cryptographic boundaries when deriving symmetric encryption keys using the WebAuthn Pseudo-Random Function (PRF) extension (HMAC-secret). Raw PRF outputs must be treated as volatile cryptographic material, fed immediately into an HKDF pipeline to produce ephemeral CryptoKey instances, and zeroized in memory to prevent credential and key leakage.","antiPatternHeadline":"Leaking Raw PRF Outputs, Static Salts, or Un-zeroized Crypto Material in Application Memory","stars_count":72,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","prf-extension","cryptography","hkdf","zero-knowledge","fido2"],"exportEndpoints":{"claude":"/api/rules/webauthn-prf-zk-symmetric-key-derivation?format=claude","cursorMdc":"/api/rules/webauthn-prf-zk-symmetric-key-derivation?format=mdc","cursorrules":"/api/rules/webauthn-prf-zk-symmetric-key-derivation?format=cursor","windsurf":"/api/rules/webauthn-prf-zk-symmetric-key-derivation?format=windsurf","agents":"/api/rules/webauthn-prf-zk-symmetric-key-derivation?format=agents"}},{"id":"openfga-realtime-tuple-invalidation-cdc","title":"OpenFGA CDC-Driven Real-Time Contextual Tuple Invalidation","category":"security","severity":"critical","description":"Maintains sub-millisecond authorization correctness across distributed application caches by binding Change Data Capture (CDC) mutation streams directly to transactional OpenFGA tuple writes and local cache invalidation pipelines. Prevents authorization bypass and stale privilege windows by enforcing transactional outbox patterns with strict monotonic sequence tracking for contextual tuple eviction.","antiPatternHeadline":"Dual-Write Race Conditions and Unsynchronized Cache Eviction in OpenFGA Relationship Tuples","stars_count":111,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","authorization","cdc","cache-invalidation","distributed-systems"],"exportEndpoints":{"claude":"/api/rules/openfga-realtime-tuple-invalidation-cdc?format=claude","cursorMdc":"/api/rules/openfga-realtime-tuple-invalidation-cdc?format=mdc","cursorrules":"/api/rules/openfga-realtime-tuple-invalidation-cdc?format=cursor","windsurf":"/api/rules/openfga-realtime-tuple-invalidation-cdc?format=windsurf","agents":"/api/rules/openfga-realtime-tuple-invalidation-cdc?format=agents"}},{"id":"otel-collector-arrow-cardinality-suppression-standard","title":"OTel Collector Apache Arrow Stream Cardinality Suppression Standard","category":"devops","severity":"critical","description":"Enforces edge-level dimension masking, dynamic attribute truncation, and columnar Apache Arrow encoding within OpenTelemetry Collector pipelines. Prevents upstream TSDB time-series index explosion and catastrophic OOMs by sanitizing unbounded runtime attributes prior to cross-network transmission.","antiPatternHeadline":"Direct OTLP Ingestion of Unsanitized High-Cardinality Metrics Leading to TSDB Index Exhaustion and Pipeline OOM","stars_count":83,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","apache-arrow","cardinality","observability","metrics"],"exportEndpoints":{"claude":"/api/rules/otel-collector-arrow-cardinality-suppression-standard?format=claude","cursorMdc":"/api/rules/otel-collector-arrow-cardinality-suppression-standard?format=mdc","cursorrules":"/api/rules/otel-collector-arrow-cardinality-suppression-standard?format=cursor","windsurf":"/api/rules/otel-collector-arrow-cardinality-suppression-standard?format=windsurf","agents":"/api/rules/otel-collector-arrow-cardinality-suppression-standard?format=agents"}},{"id":"openfga-cdc-cache-coherence-standard","title":"OpenFGA Real-Time CDC Authorization Cache Coherence Standard","category":"security","severity":"critical","description":"Enforces sub-millisecond distributed cache invalidation for OpenFGA check evaluations via PostgreSQL Logical Decoding (CDC) or Debezium outbox streams. Guarantees that transactional relation-tuple mutations publish strongly-ordered invalidation events, preventing authorization read-after-write privilege desynchronization vulnerabilities.","antiPatternHeadline":"Dual-Writing Cache Invalidations Directly in Application Handlers Without Transactional CDC","stars_count":84,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","cdc","cache-coherence","authorization","distributed-systems"],"exportEndpoints":{"claude":"/api/rules/openfga-cdc-cache-coherence-standard?format=claude","cursorMdc":"/api/rules/openfga-cdc-cache-coherence-standard?format=mdc","cursorrules":"/api/rules/openfga-cdc-cache-coherence-standard?format=cursor","windsurf":"/api/rules/openfga-cdc-cache-coherence-standard?format=windsurf","agents":"/api/rules/openfga-cdc-cache-coherence-standard?format=agents"}},{"id":"react-19-rsc-suspense-deadlock-mitigation","title":"React 19 RSC Suspense Deadlock Mitigation & Bounded Streaming Invariants","category":"frontend","severity":"critical","description":"Enforces strict deadline-driven AbortSignal timeouts and deterministic boundary fallbacks on all asynchronous React Server Components (RSC). Prevents unresolved server-side promises from stalling edge chunked transfer streams and exhausting HTTP/3 QUIC connection pools.","antiPatternHeadline":"Unbounded Async RSC Evaluation Inducing Edge Stream Stalls and Connection Exhaustion","stars_count":71,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","rsc","suspense","streaming-ssr","performance"],"exportEndpoints":{"claude":"/api/rules/react-19-rsc-suspense-deadlock-mitigation?format=claude","cursorMdc":"/api/rules/react-19-rsc-suspense-deadlock-mitigation?format=mdc","cursorrules":"/api/rules/react-19-rsc-suspense-deadlock-mitigation?format=cursor","windsurf":"/api/rules/react-19-rsc-suspense-deadlock-mitigation?format=windsurf","agents":"/api/rules/react-19-rsc-suspense-deadlock-mitigation?format=agents"}},{"id":"webauthn-l3-conditional-mediation-sanitization","title":"WebAuthn Level 3 Conditional Mediation & Passkey Autofill Sanitization","category":"security","severity":"critical","description":"Enforces strict isolation, challenge lifecycle management, and AbortController synchronization during WebAuthn Level 3 Conditional UI mediation. Mitigates credential hijacking, replay vulnerabilities, and race conditions between autofill requests, modal biometric prompts, and hostile embedded webview contexts.","antiPatternHeadline":"Uncoordinated navigator.credentials.get calls with unverified origins, shared AbortSignals, and dangling conditional UI promises.","stars_count":79,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","passkeys","authentication","conditional-mediation"],"exportEndpoints":{"claude":"/api/rules/webauthn-l3-conditional-mediation-sanitization?format=claude","cursorMdc":"/api/rules/webauthn-l3-conditional-mediation-sanitization?format=mdc","cursorrules":"/api/rules/webauthn-l3-conditional-mediation-sanitization?format=cursor","windsurf":"/api/rules/webauthn-l3-conditional-mediation-sanitization?format=windsurf","agents":"/api/rules/webauthn-l3-conditional-mediation-sanitization?format=agents"}},{"id":"bun-worker-heap-budget-cancellation-protocol","title":"Bun 1.2 Native Worker Heap Budgeting and Cooperative Cancellation Protocol","category":"backend","severity":"critical","description":"Mandates deterministic heap memory quotas, cooperative AbortSignal-driven cancellation, and proactive teardown routines for Bun isolated native workers. Prevents unmonitored JavaScriptCore heap growth from triggering kernel OOM-killer panics and event-loop thread starvation under high concurrency.","antiPatternHeadline":"Spawning Unconstrained Bun Workers Without Heap Telemetry, Backpressure, or Cooperative Cancellation","stars_count":89,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["bun","workers","concurrency","memory-management","backpressure","jsc"],"exportEndpoints":{"claude":"/api/rules/bun-worker-heap-budget-cancellation-protocol?format=claude","cursorMdc":"/api/rules/bun-worker-heap-budget-cancellation-protocol?format=mdc","cursorrules":"/api/rules/bun-worker-heap-budget-cancellation-protocol?format=cursor","windsurf":"/api/rules/bun-worker-heap-budget-cancellation-protocol?format=windsurf","agents":"/api/rules/bun-worker-heap-budget-cancellation-protocol?format=agents"}},{"id":"ebpf-tetragon-namespace-escape-guardrail-ebpf-tetragon-ke-763","title":"eBPF Tetragon Synchronous In-Kernel Namespace Escape and Privilege Escalation Enforcement","category":"devops","severity":"critical","description":"Enforces synchronous kernel-probe tracing and automated SIGKILL actuation on unauthorized container namespace transitions (e.g., setns, unshare) before process privilege escalation can establish persistence. Prohibits asynchronous userspace-only event notification patterns that introduce a race window between container breakout execution and post-facto containment.","antiPatternHeadline":"Asynchronous Userspace Alerting on Container Escape Syscalls Permitting Breakout Persistence","stars_count":85,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","tetragon","kubernetes-security","runtime-security","zero-trust"],"exportEndpoints":{"claude":"/api/rules/ebpf-tetragon-namespace-escape-guardrail-ebpf-tetragon-ke-763?format=claude","cursorMdc":"/api/rules/ebpf-tetragon-namespace-escape-guardrail-ebpf-tetragon-ke-763?format=mdc","cursorrules":"/api/rules/ebpf-tetragon-namespace-escape-guardrail-ebpf-tetragon-ke-763?format=cursor","windsurf":"/api/rules/ebpf-tetragon-namespace-escape-guardrail-ebpf-tetragon-ke-763?format=windsurf","agents":"/api/rules/ebpf-tetragon-namespace-escape-guardrail-ebpf-tetragon-ke-763?format=agents"}},{"id":"kmp-swift-concurrency-cooperative-cancellation-bridging","title":"Bi-directional Structured Cancellation Bridging for Swift Tasks and Kotlin Coroutines","category":"mobile","severity":"critical","description":"Enforces deterministic, bidirectional cooperative cancellation bridging across the Swift/Native-Kotlin ABI boundary. Ensures Kotlin Coroutine Job lifecycles bind strictly to Swift Task cancellation handlers and vice versa to eliminate uncollected background threads, orphaned network requests, and native memory leaks in KMP applications.","antiPatternHeadline":"Fire-and-Forget Suspend Bridging and Unbound Continuation Handlers in Swift/Kotlin Boundaries","stars_count":112,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","swift-concurrency","coroutines","structured-concurrency","ios"],"exportEndpoints":{"claude":"/api/rules/kmp-swift-concurrency-cooperative-cancellation-bridging?format=claude","cursorMdc":"/api/rules/kmp-swift-concurrency-cooperative-cancellation-bridging?format=mdc","cursorrules":"/api/rules/kmp-swift-concurrency-cooperative-cancellation-bridging?format=cursor","windsurf":"/api/rules/kmp-swift-concurrency-cooperative-cancellation-bridging?format=windsurf","agents":"/api/rules/kmp-swift-concurrency-cooperative-cancellation-bridging?format=agents"}},{"id":"tauri-v2-deep-link-signature-origin-sanitization","title":"Tauri 2.0 Deep Link Cryptographic Signature & Webview Ingestion Guardrails","category":"mobile","severity":"critical","description":"Enforces cryptographic HMAC/Ed25519 signature validation and strict scheme/path canonicalization for all Tauri 2.0 deep links and app links prior to webview routing. Prevents malicious intent injection, path traversal, and unauthorized Tauri IPC command invocations initiated via untrusted external mobile application intents.","antiPatternHeadline":"Direct Webview Routing of Unauthenticated and Unsanitized Mobile Deep Links","stars_count":45,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri-2.0","deep-links","security","cryptography","ipc-sanitization","rust"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-deep-link-signature-origin-sanitization?format=claude","cursorMdc":"/api/rules/tauri-v2-deep-link-signature-origin-sanitization?format=mdc","cursorrules":"/api/rules/tauri-v2-deep-link-signature-origin-sanitization?format=cursor","windsurf":"/api/rules/tauri-v2-deep-link-signature-origin-sanitization?format=windsurf","agents":"/api/rules/tauri-v2-deep-link-signature-origin-sanitization?format=agents"}},{"id":"hyper-http3-0rtt-anti-replay-mitigation-standard","title":"Hyper HTTP/3 0-RTT Anti-Replay Mitigation Standard","category":"backend","severity":"critical","description":"Enforces strict isolation of QUIC and TLS 1.3 0-RTT early data frames to idempotent read operations across Hyper HTTP/3 edge pipelines. Neutralizes replay vulnerabilities during connection migrations and 0-RTT handshakes by mandating HTTP 425 (Too Early) rejections or handshake deferral on all state-mutating requests.","antiPatternHeadline":"Executing state-mutating or non-idempotent operations across 0-RTT early data without 1-RTT cryptographic completion","stars_count":107,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","http3","quic","tls13","zero-rtt","replay-attacks","hyper","rust"],"exportEndpoints":{"claude":"/api/rules/hyper-http3-0rtt-anti-replay-mitigation-standard?format=claude","cursorMdc":"/api/rules/hyper-http3-0rtt-anti-replay-mitigation-standard?format=mdc","cursorrules":"/api/rules/hyper-http3-0rtt-anti-replay-mitigation-standard?format=cursor","windsurf":"/api/rules/hyper-http3-0rtt-anti-replay-mitigation-standard?format=windsurf","agents":"/api/rules/hyper-http3-0rtt-anti-replay-mitigation-standard?format=agents"}},{"id":"envoy-gateway-extauthz-fail-closed-circuit-breaker","title":"Envoy Gateway 1.2 ExtAuthz Fail-Closed & Dynamic Circuit Breaker Guardrail","category":"devops","severity":"critical","description":"Enforces deterministic fail-closed states and granular upstream circuit breakers for External Authorization (ExtAuthz) policy decision points in Envoy Gateway 1.2. Eliminates authorization bypass and thread pool exhaustion during PDP latency spikes by instantly severing degraded auth uplinks and returning explicit HTTP 403/500 responses.","antiPatternHeadline":"Configuring Permissive ExtAuthz Fail-Open or Omitting Dynamic Circuit Breakers on Policy Decision Points","stars_count":96,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","envoy-gateway","extauthz","circuit-breaker","zero-trust","kubernetes"],"exportEndpoints":{"claude":"/api/rules/envoy-gateway-extauthz-fail-closed-circuit-breaker?format=claude","cursorMdc":"/api/rules/envoy-gateway-extauthz-fail-closed-circuit-breaker?format=mdc","cursorrules":"/api/rules/envoy-gateway-extauthz-fail-closed-circuit-breaker?format=cursor","windsurf":"/api/rules/envoy-gateway-extauthz-fail-closed-circuit-breaker?format=windsurf","agents":"/api/rules/envoy-gateway-extauthz-fail-closed-circuit-breaker?format=agents"}},{"id":"webgpu-device-loss-recovery-buffer-reclamation","title":"WebGPU Device Loss Recovery and Idempotent VRAM Buffer Reclamation Standard","category":"frontend","severity":"critical","description":"Mandates asynchronous WebGPU context restoration and idempotent VRAM buffer staging pipelines to guarantee UI resilience against OS-level compositor drops, GPU driver resets (TDR), and system sleep/wake cycles. Enforces complete resource tracking and explicit buffer destruction to prevent GPU memory leaks and client runtime crashes.","antiPatternHeadline":"Monolithic GPU Resource Initialization Assuming Indestructible GPUDevice Lifetimes Without Loss Recovery Or Explicit Reclamation","stars_count":47,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","webgpu","graphics","vram","resilience","lifecycle"],"exportEndpoints":{"claude":"/api/rules/webgpu-device-loss-recovery-buffer-reclamation?format=claude","cursorMdc":"/api/rules/webgpu-device-loss-recovery-buffer-reclamation?format=mdc","cursorrules":"/api/rules/webgpu-device-loss-recovery-buffer-reclamation?format=cursor","windsurf":"/api/rules/webgpu-device-loss-recovery-buffer-reclamation?format=windsurf","agents":"/api/rules/webgpu-device-loss-recovery-buffer-reclamation?format=agents"}},{"id":"pg17-failover-slot-logical-replication-standard","title":"PostgreSQL 17 Failover Slot Logical Replication High-Availability Standard","category":"backend","severity":"critical","description":"Enforces PostgreSQL 17 failover slot logical replication topologies to guarantee zero data loss, prevent downstream consumer divergence, and eliminate full-table resynchronizations during primary failover. Mandates synchronized slots across streaming physical standbys, explicit pg_sync_replication_slots sync mechanics, coordinated LSN tracking, and verified failover validation before promoting standby targets.","antiPatternHeadline":"Creating unmanaged logical replication slots without pg_create_logical_replication_slot(failover => true) and synchronized standby slots","stars_count":117,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql-17","logical-replication","failover-slots","high-availability","database"],"exportEndpoints":{"claude":"/api/rules/pg17-failover-slot-logical-replication-standard?format=claude","cursorMdc":"/api/rules/pg17-failover-slot-logical-replication-standard?format=mdc","cursorrules":"/api/rules/pg17-failover-slot-logical-replication-standard?format=cursor","windsurf":"/api/rules/pg17-failover-slot-logical-replication-standard?format=windsurf","agents":"/api/rules/pg17-failover-slot-logical-replication-standard?format=agents"}},{"id":"go-http3-quic-stream-pool-congestion-bounding","title":"Go 1.24 HTTP/3 Stream Memory Pooling and Congestion Bounding Standard","category":"backend","severity":"critical","description":"Enforces strict limits on concurrent QUIC stream allocations using bounded slab allocators and admission semaphores to prevent unbounded goroutine stack inflation and memory starvation. Mandates explicit transport-level backpressure and pooled I/O buffers during high-packet-loss ingress bursts.","antiPatternHeadline":"Unbounded Per-Stream Goroutine Spawning with Dynamic Heap Allocations During QUIC Burst Ingress","stars_count":65,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","http3","quic","concurrency","memory-pooling"],"exportEndpoints":{"claude":"/api/rules/go-http3-quic-stream-pool-congestion-bounding?format=claude","cursorMdc":"/api/rules/go-http3-quic-stream-pool-congestion-bounding?format=mdc","cursorrules":"/api/rules/go-http3-quic-stream-pool-congestion-bounding?format=cursor","windsurf":"/api/rules/go-http3-quic-stream-pool-congestion-bounding?format=windsurf","agents":"/api/rules/go-http3-quic-stream-pool-congestion-bounding?format=agents"}},{"id":"android-15-16kb-page-alignment-memory-standard","title":"Android 15 16 KB Virtual Memory Page Alignment & Native Allocation Standard","category":"mobile","severity":"critical","description":"Enforces runtime page-size resolution and ELF 16 KB segment alignment across all Android NDK binaries, third-party C/C++ libraries, and custom virtual memory allocators. Eliminates unaligned mmap offsets and hardcoded 4096-byte assumptions that induce immediate SIGSEGV signal 11 crashes on Android 15 ARM64 hardware running 16 KB kernel pages.","antiPatternHeadline":"Hardcoded 4 KB Page Sizing and Unaligned Dynamic Allocations Causing Fatal SIGSEGV on Android 15 ARM64 Devices","stars_count":83,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","android","ndk","arm64","memory-alignment","16kb-pages","cplusplus"],"exportEndpoints":{"claude":"/api/rules/android-15-16kb-page-alignment-memory-standard?format=claude","cursorMdc":"/api/rules/android-15-16kb-page-alignment-memory-standard?format=mdc","cursorrules":"/api/rules/android-15-16kb-page-alignment-memory-standard?format=cursor","windsurf":"/api/rules/android-15-16kb-page-alignment-memory-standard?format=windsurf","agents":"/api/rules/android-15-16kb-page-alignment-memory-standard?format=agents"}},{"id":"swift6-strict-concurrency-hybrid-bridge-isolation-swift-6-strict-c-699","title":"Swift 6 Strict Concurrency Bridge Isolation for Cross-Platform Runtimes","category":"mobile","severity":"critical","description":"Enforces compiler-verified actor boundaries, Sendable serialization invariants, and non-blocking backpressure controls when bridging high-frequency native OS events to hybrid runtimes (React Native TurboModules, Flutter Platform Channels, WKWebView, JNI). Eliminates data races, thread starvation on @MainActor, and runtime crashes induced by Swift 6 complete concurrency checking.","antiPatternHeadline":"Bypassing Strict Concurrency with @unchecked Sendable on Mutable Bridge State and Invoking Hybrid Callbacks Across Arbitrary Contexts","stars_count":118,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","swift6","concurrency","ios","react-native","flutter","cross-platform"],"exportEndpoints":{"claude":"/api/rules/swift6-strict-concurrency-hybrid-bridge-isolation-swift-6-strict-c-699?format=claude","cursorMdc":"/api/rules/swift6-strict-concurrency-hybrid-bridge-isolation-swift-6-strict-c-699?format=mdc","cursorrules":"/api/rules/swift6-strict-concurrency-hybrid-bridge-isolation-swift-6-strict-c-699?format=cursor","windsurf":"/api/rules/swift6-strict-concurrency-hybrid-bridge-isolation-swift-6-strict-c-699?format=windsurf","agents":"/api/rules/swift6-strict-concurrency-hybrid-bridge-isolation-swift-6-strict-c-699?format=agents"}},{"id":"fido2-enterprise-attestation-aaguid-validation-production-standard","title":"Enforce FIDO2 Enterprise Attestation and Cryptographic AAGUID Verification","category":"security","severity":"critical","description":"Enforces cryptographic verification of FIDO2 Authenticator Attestation GUIDs (AAGUID) and enterprise attestation statements during WebAuthn registration. Mandates that server-side registration handlers parse verified authenticator data, match the AAGUID against a strict corporate hardware allowlist (such as FIPS 140-2/3 Level 2+ security keys), and reject consumer software passkeys or unverified roots of trust. Prevents zero-trust perimeter bypass caused by accepting unverified or consumer-synced authenticators.","antiPatternHeadline":"Trusting WebAuthn Registration Responses Without Cryptographic AAGUID and Attestation Trust Chain Verification","stars_count":83,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","fido2","zero-trust","enterprise-attestation","fips-140-2"],"exportEndpoints":{"claude":"/api/rules/fido2-enterprise-attestation-aaguid-validation-production-standard?format=claude","cursorMdc":"/api/rules/fido2-enterprise-attestation-aaguid-validation-production-standard?format=mdc","cursorrules":"/api/rules/fido2-enterprise-attestation-aaguid-validation-production-standard?format=cursor","windsurf":"/api/rules/fido2-enterprise-attestation-aaguid-validation-production-standard?format=windsurf","agents":"/api/rules/fido2-enterprise-attestation-aaguid-validation-production-standard?format=agents"}},{"id":"rfc-8693-workload-token-downscoping-invariant","title":"RFC 8693 Token Exchange: Mandatory Audience and Scope Attenuation at Inter-Service Hops","category":"security","severity":"critical","description":"Enforces cryptographic audience, scope, and lifetime downscoping at every distributed microservice boundary using RFC 8693 OAuth 2.0 Token Exchange. Prevents lateral ambient authority and confused deputy vulnerabilities by strictly forbidding the propagation of unmodified upstream bearer tokens across service hops.","antiPatternHeadline":"Ambient Authority Propagation via Direct Upstream Bearer Token Forwarding","stars_count":80,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","oauth2","rfc8693","zero-trust","jwt","microservices"],"exportEndpoints":{"claude":"/api/rules/rfc-8693-workload-token-downscoping-invariant?format=claude","cursorMdc":"/api/rules/rfc-8693-workload-token-downscoping-invariant?format=mdc","cursorrules":"/api/rules/rfc-8693-workload-token-downscoping-invariant?format=cursor","windsurf":"/api/rules/rfc-8693-workload-token-downscoping-invariant?format=windsurf","agents":"/api/rules/rfc-8693-workload-token-downscoping-invariant?format=agents"}},{"id":"opentelemetry-continuous-profiling-otlp-standard","title":"OpenTelemetry Continuous Profiling (OTLP/Profiles) Ingestion and Trace Correlation","category":"devops","severity":"critical","description":"Standardizes continuous CPU and memory profiling ingestion utilizing eBPF-based low-overhead collection over native OTLP/Profiles (v1development). Mandates explicit trace-to-profile context propagation via thread/task registration or stack sampling to correlate trace latency outliers directly to line-level allocations and CPU cycles.","antiPatternHeadline":"Uncorrelated Standalone Profilers or High-Overhead Runtime Hooks Without Trace Association","stars_count":103,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","continuous-profiling","ebpf","otlp-profiles","observability"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-continuous-profiling-otlp-standard?format=claude","cursorMdc":"/api/rules/opentelemetry-continuous-profiling-otlp-standard?format=mdc","cursorrules":"/api/rules/opentelemetry-continuous-profiling-otlp-standard?format=cursor","windsurf":"/api/rules/opentelemetry-continuous-profiling-otlp-standard?format=windsurf","agents":"/api/rules/opentelemetry-continuous-profiling-otlp-standard?format=agents"}},{"id":"k8s-gateway-api-v1-2-cross-namespace-referencegrant-invariant","title":"Kubernetes Gateway API v1.2 Cross-Namespace Route Attachment Invariant","category":"devops","severity":"critical","description":"Enforces strict bi-directional boundary verification for Kubernetes Gateway API v1.2 deployments across namespace perimeters. Eliminates cross-tenant traffic blackholing and route hijacking by requiring platform Gateways to scope listener attachments via namespace selectors and application namespaces to explicitly permit routing via ReferenceGrant resources.","antiPatternHeadline":"Cross-Namespace Gateway Binding via Permissive Wildcards or Missing ReferenceGrant Handshakes","stars_count":98,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","kubernetes","gateway-api","referencegrant","security","zero-trust","multi-tenancy"],"exportEndpoints":{"claude":"/api/rules/k8s-gateway-api-v1-2-cross-namespace-referencegrant-invariant?format=claude","cursorMdc":"/api/rules/k8s-gateway-api-v1-2-cross-namespace-referencegrant-invariant?format=mdc","cursorrules":"/api/rules/k8s-gateway-api-v1-2-cross-namespace-referencegrant-invariant?format=cursor","windsurf":"/api/rules/k8s-gateway-api-v1-2-cross-namespace-referencegrant-invariant?format=windsurf","agents":"/api/rules/k8s-gateway-api-v1-2-cross-namespace-referencegrant-invariant?format=agents"}},{"id":"svelte-5-runes-ssr-context-isolation","title":"Svelte 5 Runes SSR Reactive Context Isolation Standard","category":"frontend","severity":"critical","description":"Enforces strict isolation of Svelte 5 runes ($state, $derived) and signal graphs to component subtrees and request boundaries during Server-Side Rendering (SSR). Prohibits module-level reactive singletons in shared modules to prevent cross-tenant state leaks and uncollected signal nodes across concurrent HTTP requests.","antiPatternHeadline":"Module-Scope $state Singletons Causing Cross-Request Data Leaks in SSR","stars_count":58,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","ssr","reactive-context","data-isolation"],"exportEndpoints":{"claude":"/api/rules/svelte-5-runes-ssr-context-isolation?format=claude","cursorMdc":"/api/rules/svelte-5-runes-ssr-context-isolation?format=mdc","cursorrules":"/api/rules/svelte-5-runes-ssr-context-isolation?format=cursor","windsurf":"/api/rules/svelte-5-runes-ssr-context-isolation?format=windsurf","agents":"/api/rules/svelte-5-runes-ssr-context-isolation?format=agents"}},{"id":"vite6-environment-api-secret-guardrail","title":"Vite 6 Environment API Dual-Target Compilation Secret Guardrail","category":"frontend","severity":"critical","description":"Enforces strict module graph boundary validation across Vite 6 environments (client, ssr, workerd) using the Environment API. Prevents private server credentials, database connections, and server-only modules from bridging into client and edge workerd compilation targets during multi-environment builds.","antiPatternHeadline":"Cross-environment leakage of server secrets into client bundle via unpartitioned Vite 6 Environment module graphs","stars_count":85,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","vite","vite-6","environment-api","security","module-graph","secrets-prevention"],"exportEndpoints":{"claude":"/api/rules/vite6-environment-api-secret-guardrail?format=claude","cursorMdc":"/api/rules/vite6-environment-api-secret-guardrail?format=mdc","cursorrules":"/api/rules/vite6-environment-api-secret-guardrail?format=cursor","windsurf":"/api/rules/vite6-environment-api-secret-guardrail?format=windsurf","agents":"/api/rules/vite6-environment-api-secret-guardrail?format=agents"}},{"id":"axum-0-8-zero-copy-streaming-backpressure-invariant","title":"Axum 0.8 Zero-Copy Streaming Body Backpressure and Teardown Invariant","category":"backend","severity":"critical","description":"Enforces bounded memory allocations and deterministic connection lifecycle management for asynchronous HTTP request/response bodies in Axum 0.8. Prohibits unbounded payload buffering into memory and mandates explicit downstream stream backpressure propagation with deterministic cancellation semantics during early aborts.","antiPatternHeadline":"Unbounded In-Memory Body Ingestion and Unhandled Stream Aborts Leading to Socket and Memory Leaks","stars_count":55,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","streaming","backpressure","zero-copy"],"exportEndpoints":{"claude":"/api/rules/axum-0-8-zero-copy-streaming-backpressure-invariant?format=claude","cursorMdc":"/api/rules/axum-0-8-zero-copy-streaming-backpressure-invariant?format=mdc","cursorrules":"/api/rules/axum-0-8-zero-copy-streaming-backpressure-invariant?format=cursor","windsurf":"/api/rules/axum-0-8-zero-copy-streaming-backpressure-invariant?format=windsurf","agents":"/api/rules/axum-0-8-zero-copy-streaming-backpressure-invariant?format=agents"}},{"id":"postgres-17-failover-slot-synchronization-standard","title":"PostgreSQL 17 Failover Logical Slot Synchronization & Standby Persistence Invariant","category":"backend","severity":"critical","description":"Mandates standard configuration and programmatic slot creation semantics introduced in PostgreSQL 17 for zero-data-loss logical replication failover. Enforces the use of the failover flag during slot instantiation and validates primary/standby coordination through synchronized_standby_slots and sync_replication_slots. Prevents subscriber desynchronization, replay stream divergence, and downstream message corruption during physical primary failovers.","antiPatternHeadline":"Uncoordinated Logical Slots Lacking Failover Propagation and Standby Sync Gating","stars_count":100,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","replication","postgres-17","high-availability","cdc"],"exportEndpoints":{"claude":"/api/rules/postgres-17-failover-slot-synchronization-standard?format=claude","cursorMdc":"/api/rules/postgres-17-failover-slot-synchronization-standard?format=mdc","cursorrules":"/api/rules/postgres-17-failover-slot-synchronization-standard?format=cursor","windsurf":"/api/rules/postgres-17-failover-slot-synchronization-standard?format=windsurf","agents":"/api/rules/postgres-17-failover-slot-synchronization-standard?format=agents"}},{"id":"tauri2-ipc-zero-trust-capability-scoping-guardrail","title":"Tauri 2.0 Zero-Trust IPC Capability Scoping and Granular ACL Guardrail","category":"mobile","severity":"critical","description":"Enforces strict principle-of-least-privilege access control list (ACL) definitions and granular capability scoping in Tauri 2.0 applications. Prohibits wildcard permissions, unbounded filesystem access, and untyped dynamic IPC invokers across mobile webview-to-Rust native execution boundaries.","antiPatternHeadline":"Over-privileged IPC Surface via Wildcard Capabilities and Arbitrary Native Command Invocation","stars_count":109,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri2","rust","ipc-security","zero-trust","capabilities"],"exportEndpoints":{"claude":"/api/rules/tauri2-ipc-zero-trust-capability-scoping-guardrail?format=claude","cursorMdc":"/api/rules/tauri2-ipc-zero-trust-capability-scoping-guardrail?format=mdc","cursorrules":"/api/rules/tauri2-ipc-zero-trust-capability-scoping-guardrail?format=cursor","windsurf":"/api/rules/tauri2-ipc-zero-trust-capability-scoping-guardrail?format=windsurf","agents":"/api/rules/tauri2-ipc-zero-trust-capability-scoping-guardrail?format=agents"}},{"id":"capacitor-7-biometric-keystore-invalidation","title":"Capacitor 7 Hardware-Backed Keystore Invalidation Standard","category":"mobile","severity":"critical","description":"Enforces hardware-backed cryptographic key invalidation across iOS Secure Enclave and Android KeyStore whenever device biometric enrollments change. Mandates kSecAccessControlBiometryCurrentSet on iOS and setInvalidatedByBiometricEnrollment(true) on Android to prevent rogue biometric additions from decrypting persisted session tokens. Requires deterministic detection of permanent key invalidation errors with mandatory local secret eviction and re-authentication workflows in Capacitor 7 plugins.","antiPatternHeadline":"Permitting Persistent Secret Access Across Biometric Enrollment Changes via BiometryAny or Unconstrained Keystore Flags","stars_count":41,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","biometrics","security","android-keystore","secure-enclave","cryptography"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-biometric-keystore-invalidation?format=claude","cursorMdc":"/api/rules/capacitor-7-biometric-keystore-invalidation?format=mdc","cursorrules":"/api/rules/capacitor-7-biometric-keystore-invalidation?format=cursor","windsurf":"/api/rules/capacitor-7-biometric-keystore-invalidation?format=windsurf","agents":"/api/rules/capacitor-7-biometric-keystore-invalidation?format=agents"}},{"id":"openfga-realtime-tuple-revocation-invalidation","title":"OpenFGA Real-Time Tuple Revocation & Deterministic Cache Invalidation","category":"security","severity":"critical","description":"Enforces deterministic, instantaneous cache and materialized read-model invalidation upon OpenFGA relationship tuple deletion or privilege downgrade. Prevents authorization decision lag and Time-of-Check to Time-of-Use (TOCTOU) privilege lingering by mandating atomic outbox emission, distributed cache purge, and strict consistency preferences.","antiPatternHeadline":"Passive TTL Caching and Fire-and-Forget Tuple Deletions Allowing Stale Authorization Checks","stars_count":65,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","authorization","cache-invalidation","zero-trust","rebac"],"exportEndpoints":{"claude":"/api/rules/openfga-realtime-tuple-revocation-invalidation?format=claude","cursorMdc":"/api/rules/openfga-realtime-tuple-revocation-invalidation?format=mdc","cursorrules":"/api/rules/openfga-realtime-tuple-revocation-invalidation?format=cursor","windsurf":"/api/rules/openfga-realtime-tuple-revocation-invalidation?format=windsurf","agents":"/api/rules/openfga-realtime-tuple-revocation-invalidation?format=agents"}},{"id":"passkey-fido2-hybrid-transport-mitm-relay-guardrail","title":"Passkey FIDO2 Hybrid Transport Origin Binding & Proximity Relay Defense","category":"security","severity":"critical","description":"Enforces strict origin binding, cryptographic proximity assertions, and client data verification on WebAuthn cross-device (hybrid/caBLE) authentication ceremonies. Prevents Man-in-the-Middle (MitM) credential relay attacks where a remote attacker tricks a victim into authorizing a malicious session using QR code or cross-device flows. Mandates verification of the clientDataJSON origin, top-origin bindings, session-bound challenges, and hybrid transport flags on the relying party backend.","antiPatternHeadline":"Blind Relying Party Authentication Accepting Unbound Challenges and Ignored Hybrid Transport State","stars_count":57,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","passkeys","fido2","webauthn","hybrid-transport","mitm-defense","cryptography"],"exportEndpoints":{"claude":"/api/rules/passkey-fido2-hybrid-transport-mitm-relay-guardrail?format=claude","cursorMdc":"/api/rules/passkey-fido2-hybrid-transport-mitm-relay-guardrail?format=mdc","cursorrules":"/api/rules/passkey-fido2-hybrid-transport-mitm-relay-guardrail?format=cursor","windsurf":"/api/rules/passkey-fido2-hybrid-transport-mitm-relay-guardrail?format=windsurf","agents":"/api/rules/passkey-fido2-hybrid-transport-mitm-relay-guardrail?format=agents"}},{"id":"ebpf-continuous-profiler-kernel-memory-budgeting-invariant","title":"eBPF Continuous Profiler Kernel Memory Budgeting and Backpressure Invariant","category":"devops","severity":"critical","description":"Enforces deterministic, non-expandable kernel memory ceilings for continuous eBPF stack unwinding and ring buffer telemetry to eliminate kernel starvation during high-frequency burst events. Mandates explicit allocation sizing of BPF maps (BPF_MAP_TYPE_RINGBUF and BPF_MAP_TYPE_STACK_TRACE), hard pre-allocation without runtime growth, and kernel-side drop accounting instead of userspace unbounded queue accumulation.","antiPatternHeadline":"Unbounded BPF Map Sizing and Ring-Buffer Channel Saturation Inducing Kernel OOM Panic","stars_count":78,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","profiling","linux-kernel","memory-budgeting","observability"],"exportEndpoints":{"claude":"/api/rules/ebpf-continuous-profiler-kernel-memory-budgeting-invariant?format=claude","cursorMdc":"/api/rules/ebpf-continuous-profiler-kernel-memory-budgeting-invariant?format=mdc","cursorrules":"/api/rules/ebpf-continuous-profiler-kernel-memory-budgeting-invariant?format=cursor","windsurf":"/api/rules/ebpf-continuous-profiler-kernel-memory-budgeting-invariant?format=windsurf","agents":"/api/rules/ebpf-continuous-profiler-kernel-memory-budgeting-invariant?format=agents"}},{"id":"opentelemetry-w3c-baggage-context-mutation-guardrail","title":"OpenTelemetry W3C Baggage Sanitization and Header Mutation Invariant","category":"devops","severity":"critical","description":"Enforces deterministic sanitization, allowlisting, and byte-budget validation on W3C Baggage context mutations prior to distributed propagation. Unchecked baggage accumulation causes downstream HTTP 431 (Request Header Fields Too Large) outages and propagates unvetted tenant or security context across external trust boundaries.","antiPatternHeadline":"Blind Baggage Forwarding and Unbounded Context Mutation Inducing Cascading Gateway 431s and Boundary Injection","stars_count":103,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","observability","distributed-tracing","security"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-w3c-baggage-context-mutation-guardrail?format=claude","cursorMdc":"/api/rules/opentelemetry-w3c-baggage-context-mutation-guardrail?format=mdc","cursorrules":"/api/rules/opentelemetry-w3c-baggage-context-mutation-guardrail?format=cursor","windsurf":"/api/rules/opentelemetry-w3c-baggage-context-mutation-guardrail?format=windsurf","agents":"/api/rules/opentelemetry-w3c-baggage-context-mutation-guardrail?format=agents"}},{"id":"svelte-5-snippet-context-teardown-guardrail","title":"Svelte 5 Snippet Context Scoping and Effect Teardown Guardrail","category":"frontend","severity":"critical","description":"Enforces deterministic reactive signal disposal and DOM lifecycle isolation when Svelte 5 snippets cross asynchronous, deferred, or portal boundaries. Prevents uncollected fine-grained reactive subscriptions, detached DOM nodes, and memory leaks caused by snippets capturing parent reactive scopes that outlive rendering contexts.","antiPatternHeadline":"Escaping Snippet Closures to Asynchronous Registries Without Controlled Reactive Ownership Roots","stars_count":116,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","snippets","signals","memory-leaks"],"exportEndpoints":{"claude":"/api/rules/svelte-5-snippet-context-teardown-guardrail?format=claude","cursorMdc":"/api/rules/svelte-5-snippet-context-teardown-guardrail?format=mdc","cursorrules":"/api/rules/svelte-5-snippet-context-teardown-guardrail?format=cursor","windsurf":"/api/rules/svelte-5-snippet-context-teardown-guardrail?format=windsurf","agents":"/api/rules/svelte-5-snippet-context-teardown-guardrail?format=agents"}},{"id":"axum-08-tower-stream-cancellation-protocol","title":"Axum 0.8 Tower Service Connection Shedding and Stream Cancellation Protocol","category":"backend","severity":"critical","description":"Enforces deterministic async task cancellation propagation across Axum 0.8 route handlers and Tower middleware layers during client disconnects or load shedding. Prevents kernel socket descriptor exhaustion, zombie Tokio workers, and half-open TLS states by anchoring streaming bodies to RAII drop semantics and cooperative cancellation tokens.","antiPatternHeadline":"Detaching Streaming Tasks via tokio::spawn Without Drop Guard or CancellationToken Propagation","stars_count":43,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tokio","tower","networking"],"exportEndpoints":{"claude":"/api/rules/axum-08-tower-stream-cancellation-protocol?format=claude","cursorMdc":"/api/rules/axum-08-tower-stream-cancellation-protocol?format=mdc","cursorrules":"/api/rules/axum-08-tower-stream-cancellation-protocol?format=cursor","windsurf":"/api/rules/axum-08-tower-stream-cancellation-protocol?format=windsurf","agents":"/api/rules/axum-08-tower-stream-cancellation-protocol?format=agents"}},{"id":"bun-ffi-memory-pinning-gc-lifespan","title":"Bun 1.2 Native FFI Heap Pointer Pinning and GC Lifespan Management","category":"backend","severity":"critical","description":"Enforces strict heap memory pinning and explicit reference anchoring during zero-copy asynchronous native FFI invocations in Bun 1.2. JavaScriptCore's garbage collector will eagerly collect unreferenced TypedArrays, reallocating or zeroing underlying memory pages while native C/Rust worker threads read or write to raw pointers, leading to catastrophic memory corruption and segmentation faults.","antiPatternHeadline":"Ephemeral TypedArray Zero-Copy Transfer to Background Native Threads Causing Use-After-Free","stars_count":96,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","ffi","memory-management","systems-programming","c-interop"],"exportEndpoints":{"claude":"/api/rules/bun-ffi-memory-pinning-gc-lifespan?format=claude","cursorMdc":"/api/rules/bun-ffi-memory-pinning-gc-lifespan?format=mdc","cursorrules":"/api/rules/bun-ffi-memory-pinning-gc-lifespan?format=cursor","windsurf":"/api/rules/bun-ffi-memory-pinning-gc-lifespan?format=windsurf","agents":"/api/rules/bun-ffi-memory-pinning-gc-lifespan?format=agents"}},{"id":"go-chi-context-buffer-pool-quota-standard","title":"Go Chi Context-Bound Buffer Pooling and Allocation Quota Standard","category":"backend","severity":"critical","description":"Enforces strict buffer pooling lifecycle management and per-request allocation quotas within Go Chi HTTP services. Eliminates catastrophic GC pauses, stop-the-world spikes, and sync.Pool heap fragmentation caused by unbounded allocations and oversized buffer retention during fragmented multipart and chunked payload ingestion.","antiPatternHeadline":"Unbounded io.ReadAll and Naked Buffer Allocations Inducing Memory Fragmentation and GC Spikes","stars_count":108,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","chi","memory-management","sync-pool","concurrency"],"exportEndpoints":{"claude":"/api/rules/go-chi-context-buffer-pool-quota-standard?format=claude","cursorMdc":"/api/rules/go-chi-context-buffer-pool-quota-standard?format=mdc","cursorrules":"/api/rules/go-chi-context-buffer-pool-quota-standard?format=cursor","windsurf":"/api/rules/go-chi-context-buffer-pool-quota-standard?format=windsurf","agents":"/api/rules/go-chi-context-buffer-pool-quota-standard?format=agents"}},{"id":"compose-multiplatform-skiko-displaylink-vsync-invariant","title":"Compose Multiplatform Skiko CADisplayLink VSync Frame Pacing Invariant","category":"mobile","severity":"critical","description":"Enforces strict synchronization between iOS CADisplayLink callbacks and Skiko rendering pipelines on ProMotion displays. Prevents compositor thread contention, tearing, and micro-stutter by binding Skia Metal draw passes directly to native display refresh cycles with explicit CAFrameRateRange parameters.","antiPatternHeadline":"Decoupled Timer-Driven or Asynchronous Redraw Invocations Causing Metal Compositor Stalls","stars_count":88,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","compose-multiplatform","skiko","ios","cadisplaylink","metal","promotion"],"exportEndpoints":{"claude":"/api/rules/compose-multiplatform-skiko-displaylink-vsync-invariant?format=claude","cursorMdc":"/api/rules/compose-multiplatform-skiko-displaylink-vsync-invariant?format=mdc","cursorrules":"/api/rules/compose-multiplatform-skiko-displaylink-vsync-invariant?format=cursor","windsurf":"/api/rules/compose-multiplatform-skiko-displaylink-vsync-invariant?format=windsurf","agents":"/api/rules/compose-multiplatform-skiko-displaylink-vsync-invariant?format=agents"}},{"id":"webauthn-conditional-mediation-dpop-binding","title":"WebAuthn Conditional Mediation with RFC 9449 DPoP Cryptographic Token Binding","category":"security","severity":"critical","description":"Enforces immutable cryptographic binding between WebAuthn conditional mediation (passkey autofill) assertions and RFC 9449 Demonstrating Proof-of-Possession (DPoP) key pairs. Eliminates bearer token replay, session fixation, and adversary-in-the-middle (AiTM) hijacking by anchoring issued session tokens to an ephemeral, client-held private key thumbprint (jkt) verified on every downstream request.","antiPatternHeadline":"Exchanging WebAuthn passkey assertions for unbound bearer tokens or ambient cookies vulnerable to AiTM replay and exfiltration","stars_count":114,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","fido2","dpop","rfc9449","passkeys","authentication","zero-trust"],"exportEndpoints":{"claude":"/api/rules/webauthn-conditional-mediation-dpop-binding?format=claude","cursorMdc":"/api/rules/webauthn-conditional-mediation-dpop-binding?format=mdc","cursorrules":"/api/rules/webauthn-conditional-mediation-dpop-binding?format=cursor","windsurf":"/api/rules/webauthn-conditional-mediation-dpop-binding?format=windsurf","agents":"/api/rules/webauthn-conditional-mediation-dpop-binding?format=agents"}},{"id":"ebpf-lsm-pid-reuse-cgroup-lineage-standard","title":"eBPF-LSM Kernel Security Hook Ephemeral PID Reuse Verification Standard","category":"security","severity":"critical","description":"Enforces deterministic zero-trust container workload identity verification within eBPF-LSM security hooks by anchoring access decisions to immutable cgroupv2 inode lineage rather than ephemeral host PIDs. Ephemeral process identifiers are subject to high-frequency kernel recycling and PID collision race conditions under heavy fork/exec churn. eBPF programs and user-space control planes MUST resolve identity via bpf_get_current_cgroup_id() combined with kernel task start-time tracking to prevent unauthorized admission.","antiPatternHeadline":"Trusting Recycled Host PIDs in eBPF Security Maps Instead of Inode-Bound Cgroup Lineage","stars_count":85,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","ebpf","lsm","linux-kernel","zero-trust","cgroupv2","systems-programming"],"exportEndpoints":{"claude":"/api/rules/ebpf-lsm-pid-reuse-cgroup-lineage-standard?format=claude","cursorMdc":"/api/rules/ebpf-lsm-pid-reuse-cgroup-lineage-standard?format=mdc","cursorrules":"/api/rules/ebpf-lsm-pid-reuse-cgroup-lineage-standard?format=cursor","windsurf":"/api/rules/ebpf-lsm-pid-reuse-cgroup-lineage-standard?format=windsurf","agents":"/api/rules/ebpf-lsm-pid-reuse-cgroup-lineage-standard?format=agents"}},{"id":"opentelemetry-log-bridge-dynamic-checkpointing-guardrail","title":"OpenTelemetry Log Bridge Native Dynamic Checkpointing and Atomic Offset Commit Guardrail","category":"devops","severity":"critical","description":"Enforces synchronous, durable offset checkpointing and atomic write-ahead log (WAL) synchronization for OpenTelemetry Log Bridge pipelines. Guarantees zero-data-loss harvesting and deterministic at-least-once with deduplication idempotency under SIGTERM, rapid Kubernetes pod evictions, and ephemeral volume detach events.","antiPatternHeadline":"Asynchronous fire-and-forget log batching and local volatile offset storage causing log drops and duplicate re-ingestion during pod preemption","stars_count":104,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","kubernetes","logging","checkpointing","resilience"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-log-bridge-dynamic-checkpointing-guardrail?format=claude","cursorMdc":"/api/rules/opentelemetry-log-bridge-dynamic-checkpointing-guardrail?format=mdc","cursorrules":"/api/rules/opentelemetry-log-bridge-dynamic-checkpointing-guardrail?format=cursor","windsurf":"/api/rules/opentelemetry-log-bridge-dynamic-checkpointing-guardrail?format=windsurf","agents":"/api/rules/opentelemetry-log-bridge-dynamic-checkpointing-guardrail?format=agents"}},{"id":"react19-server-actions-idempotency-key-quarantine","title":"React 19 Server Actions Idempotency Key & Replay Quarantine Guardrail","category":"frontend","severity":"critical","description":"Enforces mandatory cryptographic client-generated idempotency tokens and atomic server-side mutation deduplication across React 19 Server Actions. Guarantees that network retries, optimistic re-triggers, and flaky transport reconciliations execute mutations exactly once while returning cached determinism for replayed requests. Quarantines concurrent re-entrancy and prevents phantom duplicate resource creation in distributed backends.","antiPatternHeadline":"Executing naked non-idempotent React 19 Server Actions without cryptographic mutation keys, risking duplicate side effects during transport retry storms","stars_count":91,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react19","server-actions","idempotency","replay-protection","concurrency","distributed-systems"],"exportEndpoints":{"claude":"/api/rules/react19-server-actions-idempotency-key-quarantine?format=claude","cursorMdc":"/api/rules/react19-server-actions-idempotency-key-quarantine?format=mdc","cursorrules":"/api/rules/react19-server-actions-idempotency-key-quarantine?format=cursor","windsurf":"/api/rules/react19-server-actions-idempotency-key-quarantine?format=windsurf","agents":"/api/rules/react19-server-actions-idempotency-key-quarantine?format=agents"}},{"id":"svelte-5-runes-async-untrack-guardrail","title":"Svelte 5 Runes Asynchronous Effect Isolation and Untrack Guardrail","category":"frontend","severity":"critical","description":"Enforces strict isolation of fine-grained reactive signals within asynchronous Svelte 5 runes ($effect, $derived). Mandates untrack() for non-triggering dependencies and requires AbortController cancellation patterns to permanently eliminate post-microtask race conditions and cyclic dependency loops.","antiPatternHeadline":"Unquarantined Asynchronous State Mutation and Post-Await Signal Leaks in Svelte 5 Runes","stars_count":76,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","reactivity","async","untrack"],"exportEndpoints":{"claude":"/api/rules/svelte-5-runes-async-untrack-guardrail?format=claude","cursorMdc":"/api/rules/svelte-5-runes-async-untrack-guardrail?format=mdc","cursorrules":"/api/rules/svelte-5-runes-async-untrack-guardrail?format=cursor","windsurf":"/api/rules/svelte-5-runes-async-untrack-guardrail?format=windsurf","agents":"/api/rules/svelte-5-runes-async-untrack-guardrail?format=agents"}},{"id":"axum-0-8-tower-graceful-shedding-payload-streaming-memory-cap","title":"Axum 0.8 Tower Service Graceful Shedding & Payload Streaming Memory Cap Standard","category":"backend","severity":"critical","description":"Enforces strict heap-bound backpressure, explicit payload streaming limits, and graceful load shedding in Axum 0.8 applications. Prevents Tokio worker pool starvation and Out-Of-Memory (OOM) cascading failures by combining Tower LoadShedLayer with deterministic byte-stream caps and fail-fast backpressure mechanisms.","antiPatternHeadline":"Unbounded Payload Buffering and Missing Load Shedding Leading to Tokio Worker Pool Starvation","stars_count":73,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tower","tokio","backpressure","security"],"exportEndpoints":{"claude":"/api/rules/axum-0-8-tower-graceful-shedding-payload-streaming-memory-cap?format=claude","cursorMdc":"/api/rules/axum-0-8-tower-graceful-shedding-payload-streaming-memory-cap?format=mdc","cursorrules":"/api/rules/axum-0-8-tower-graceful-shedding-payload-streaming-memory-cap?format=cursor","windsurf":"/api/rules/axum-0-8-tower-graceful-shedding-payload-streaming-memory-cap?format=windsurf","agents":"/api/rules/axum-0-8-tower-graceful-shedding-payload-streaming-memory-cap?format=agents"}},{"id":"postgres-17-vector-hnsw-memory-partition-pruning-standard","title":"Postgres 17 Vector HNSW Memory Budgeting & Partition Pruning Standard","category":"backend","severity":"critical","description":"Enforces strict session-level maintenance_work_mem quotas and deterministic partition pruning for HNSW vector indexes on Postgres 17. Prevents kernel OOM killer panics caused by multi-worker graph construction across partitioned billion-scale vector collections. Guarantees predictable memory footprints during concurrent index builds and hybrid semantic search executions.","antiPatternHeadline":"Unbounded Parallel HNSW Indexing on Parent Partition Tables with Default System Memory Budgets","stars_count":91,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres","pgvector","hnsw","memory-management","performance"],"exportEndpoints":{"claude":"/api/rules/postgres-17-vector-hnsw-memory-partition-pruning-standard?format=claude","cursorMdc":"/api/rules/postgres-17-vector-hnsw-memory-partition-pruning-standard?format=mdc","cursorrules":"/api/rules/postgres-17-vector-hnsw-memory-partition-pruning-standard?format=cursor","windsurf":"/api/rules/postgres-17-vector-hnsw-memory-partition-pruning-standard?format=windsurf","agents":"/api/rules/postgres-17-vector-hnsw-memory-partition-pruning-standard?format=agents"}},{"id":"bun-ffi-pointer-lifetime-gc-safety-standard","title":"Bun 1.2 Native FFI Puddle Pointer Lifetime and GC Safety Standard","category":"backend","severity":"critical","description":"Enforces strict memory safety and pinned handle lifetimes across Bun 1.2 native Foreign Function Interface (FFI) boundaries. JavaScriptCore (JSC) garbage collection sweeps and compacting phases can evict or relocate backing buffers while asynchronous or long-lived native C ABI code retains raw pointer references. This guardrail mandates deterministic handle pinning, pointer derivation lifecycle bounds, and explicit finalizer cleanup to eliminate use-after-free and silent memory corruption.","antiPatternHeadline":"Passing unpinned TypedArray pointers across asynchronous or deferred C ABI boundaries subject to JSC GC sweeps","stars_count":49,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","ffi","memory-safety","c-abi","garbage-collection"],"exportEndpoints":{"claude":"/api/rules/bun-ffi-pointer-lifetime-gc-safety-standard?format=claude","cursorMdc":"/api/rules/bun-ffi-pointer-lifetime-gc-safety-standard?format=mdc","cursorrules":"/api/rules/bun-ffi-pointer-lifetime-gc-safety-standard?format=cursor","windsurf":"/api/rules/bun-ffi-pointer-lifetime-gc-safety-standard?format=windsurf","agents":"/api/rules/bun-ffi-pointer-lifetime-gc-safety-standard?format=agents"}},{"id":"capacitor-7-secure-enclave-webauthn-bridge-guardrail","title":"Capacitor 7 Hardware-Backed WebAuthn Level-3 Enclave Bridge Guardrail","category":"mobile","severity":"critical","description":"Enforces strict isolation between Capacitor 7 hybrid WebViews and underlying hardware-backed authentication modules (Apple Secure Enclave and Android KeyStore StrongBox). All credential generation, assertion signatures, and biometric user verifications must be handled via native bridge calls returning opaque attestation payloads and WebAuthn-compliant signatures without ever exposing raw asymmetric keys, private seeds, or plaintext biometric claims to the WebView DOM or JavaScript runtime.","antiPatternHeadline":"Exposing Raw Cryptographic Key Material or Simulated Biometric Tokens in Hybrid WebView DOM","stars_count":66,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","webauthn","secure-enclave","strongbox","biometrics"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-secure-enclave-webauthn-bridge-guardrail?format=claude","cursorMdc":"/api/rules/capacitor-7-secure-enclave-webauthn-bridge-guardrail?format=mdc","cursorrules":"/api/rules/capacitor-7-secure-enclave-webauthn-bridge-guardrail?format=cursor","windsurf":"/api/rules/capacitor-7-secure-enclave-webauthn-bridge-guardrail?format=windsurf","agents":"/api/rules/capacitor-7-secure-enclave-webauthn-bridge-guardrail?format=agents"}},{"id":"kmp-skiko-render-loop-frame-budget-isolation","title":"KMP Skiko Render Loop Frame Budget Isolation Guardrail","category":"mobile","severity":"critical","description":"Isolates Skiko render loop dispatchers and Compose Multiplatform UI thread schedules from shared background coroutine pools (Dispatchers.Default and Dispatchers.IO). Prevents thread starvation and priority inversion during heavy network synchronization or disk I/O, guaranteeing a deterministic 16ms (60 FPS) / 8.33ms (120 FPS) VSync frame deadline across iOS, Android, and Desktop targets.","antiPatternHeadline":"Executing Unbounded Data Synchronization or Shared Coroutine Dispatches on UI/Skiko Rendering Contexts","stars_count":82,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","compose-multiplatform","skiko","concurrency","frame-budget"],"exportEndpoints":{"claude":"/api/rules/kmp-skiko-render-loop-frame-budget-isolation?format=claude","cursorMdc":"/api/rules/kmp-skiko-render-loop-frame-budget-isolation?format=mdc","cursorrules":"/api/rules/kmp-skiko-render-loop-frame-budget-isolation?format=cursor","windsurf":"/api/rules/kmp-skiko-render-loop-frame-budget-isolation?format=windsurf","agents":"/api/rules/kmp-skiko-render-loop-frame-budget-isolation?format=agents"}},{"id":"cilium-ebpf-xdp-reassembly-quarantine-standard","title":"Cilium eBPF Host-Routing XDP Fast-Path Packet Re-assembly Quarantine Standard","category":"devops","severity":"critical","description":"Enforces strict pre-stack kernel packet re-assembly boundaries in native eBPF XDP drivers to neutralize IP fragmentation memory amplification exploits before ingress traffic traverses into container network namespaces. Mandates bounded BPF map allocation, strict fragment offset verification, and deterministic drop-quarantine policies for non-conforming or overlapping datagrams.","antiPatternHeadline":"Blind XDP_PASS Delegation of Ingress Fragments to Host Stack Without Pre-Stack Quarantine Maps","stars_count":63,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","cilium","xdp","kernel-security","kubernetes"],"exportEndpoints":{"claude":"/api/rules/cilium-ebpf-xdp-reassembly-quarantine-standard?format=claude","cursorMdc":"/api/rules/cilium-ebpf-xdp-reassembly-quarantine-standard?format=mdc","cursorrules":"/api/rules/cilium-ebpf-xdp-reassembly-quarantine-standard?format=cursor","windsurf":"/api/rules/cilium-ebpf-xdp-reassembly-quarantine-standard?format=windsurf","agents":"/api/rules/cilium-ebpf-xdp-reassembly-quarantine-standard?format=agents"}},{"id":"ebpf-dwarf-unwinder-frame-budget-throttle-guardrail","title":"eBPF Continuous Profiler DWARF Frame-Budget & 5% CPU Ceiling Guardrail","category":"devops","severity":"critical","description":"Enforces a strict 5% host CPU utilization ceiling and deterministic frame-budget quotas for eBPF continuous stack unwinding across high-density container nodes. Prevents kernel-space unwind loops from dominating sampled PMU interrupts, preemptively truncating stack walking and dynamically attenuating sample frequencies to eliminate latency spikes.","antiPatternHeadline":"Unbounded DWARF Unwind Loops and Static PMU Sampling Inducing Host Kernel Latency Spikes","stars_count":79,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","continuous-profiling","dwarf","observability","linux-kernel","performance"],"exportEndpoints":{"claude":"/api/rules/ebpf-dwarf-unwinder-frame-budget-throttle-guardrail?format=claude","cursorMdc":"/api/rules/ebpf-dwarf-unwinder-frame-budget-throttle-guardrail?format=mdc","cursorrules":"/api/rules/ebpf-dwarf-unwinder-frame-budget-throttle-guardrail?format=cursor","windsurf":"/api/rules/ebpf-dwarf-unwinder-frame-budget-throttle-guardrail?format=windsurf","agents":"/api/rules/ebpf-dwarf-unwinder-frame-budget-throttle-guardrail?format=agents"}},{"id":"vite6-environment-api-module-isolation-standard","title":"Vite 6 Environment API Multi-Runtime Module Isolation Invariant","category":"frontend","severity":"critical","description":"Enforces complete memory, module graph, and execution isolation across compilation targets (client, edge/workerd, node) via the Vite 6 Environment API. Prevents cross-runtime prototype pollution, server secret leakage into client bundles, and broken transform caches caused by shared plugin state. Deprecates legacy monolithic SSR primitives in favor of per-environment module runners and isolated graph invalidation.","antiPatternHeadline":"Leaking Shared Plugin State and Cross-Executing Code Across Vite Runtime Environments","stars_count":108,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","vite","vite-6","environment-api","multi-runtime","ssr","security"],"exportEndpoints":{"claude":"/api/rules/vite6-environment-api-module-isolation-standard?format=claude","cursorMdc":"/api/rules/vite6-environment-api-module-isolation-standard?format=mdc","cursorrules":"/api/rules/vite6-environment-api-module-isolation-standard?format=cursor","windsurf":"/api/rules/vite6-environment-api-module-isolation-standard?format=windsurf","agents":"/api/rules/vite6-environment-api-module-isolation-standard?format=agents"}},{"id":"svelte-5-signal-diamond-settling-standard","title":"Svelte 5 Fine-Grained Signal Topological Diamond Dependency Settling Standard","category":"frontend","severity":"critical","description":"Enforces synchronous topological graph evaluation across Svelte 5 runes ($state, $derived, $effect) to eliminate diamond dependency glitches and torn reads. Prohibits breaking the reactive directed acyclic graph (DAG) via side-effect-driven state mutations and asynchronous signal propagation.","antiPatternHeadline":"Mutating $state inside $effect to bridge derived branches, introducing diamond torn reads and cascading microtask churn","stars_count":40,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","signals","reactivity","runes","architecture"],"exportEndpoints":{"claude":"/api/rules/svelte-5-signal-diamond-settling-standard?format=claude","cursorMdc":"/api/rules/svelte-5-signal-diamond-settling-standard?format=mdc","cursorrules":"/api/rules/svelte-5-signal-diamond-settling-standard?format=cursor","windsurf":"/api/rules/svelte-5-signal-diamond-settling-standard?format=windsurf","agents":"/api/rules/svelte-5-signal-diamond-settling-standard?format=agents"}},{"id":"bun-native-socket-zero-copy-lifetime-guardrail","title":"Bun 1.2 Native Socket Zero-Copy Pipe Lifetime Guardrail","category":"backend","severity":"critical","description":"Enforces strict buffer lifecycle ownership and backpressure synchronization when using Bun 1.2 native TCP sockets with zero-copy stream transformations. Eliminates use-after-free conditions and memory corruption caused by referencing internal socket slab buffers after async ticks or uncoordinated pipe drains.","antiPatternHeadline":"Retaining or Mutating Kernel-Mapped Slab Buffers Across Microtask Boundaries During Native Pipe Transfers","stars_count":51,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","zero-copy","sockets","memory-safety","streams"],"exportEndpoints":{"claude":"/api/rules/bun-native-socket-zero-copy-lifetime-guardrail?format=claude","cursorMdc":"/api/rules/bun-native-socket-zero-copy-lifetime-guardrail?format=mdc","cursorrules":"/api/rules/bun-native-socket-zero-copy-lifetime-guardrail?format=cursor","windsurf":"/api/rules/bun-native-socket-zero-copy-lifetime-guardrail?format=windsurf","agents":"/api/rules/bun-native-socket-zero-copy-lifetime-guardrail?format=agents"}},{"id":"go-chi-context-deadline-propagation-standard-go-chi-structure-947","title":"Go Chi Structured Context Deadline Propagation & Goroutine Leak Prevention","category":"backend","severity":"critical","description":"Enforces strict parent context propagation across Chi HTTP middleware, downstream gRPC/SQL boundaries, and fan-out worker goroutines. Prevents catastrophic goroutine accumulation, resource leaks, and orphan RPC execution when client HTTP/3 multiplexed QUIC streams cancel or reset abruptly.","antiPatternHeadline":"Detaching context or launching unmonitored goroutines inside Chi handlers during HTTP/3 stream cancellation","stars_count":104,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","golang","go-chi","http3","concurrency","context-propagation","goroutine-leak"],"exportEndpoints":{"claude":"/api/rules/go-chi-context-deadline-propagation-standard-go-chi-structure-947?format=claude","cursorMdc":"/api/rules/go-chi-context-deadline-propagation-standard-go-chi-structure-947?format=mdc","cursorrules":"/api/rules/go-chi-context-deadline-propagation-standard-go-chi-structure-947?format=cursor","windsurf":"/api/rules/go-chi-context-deadline-propagation-standard-go-chi-structure-947?format=windsurf","agents":"/api/rules/go-chi-context-deadline-propagation-standard-go-chi-structure-947?format=agents"}},{"id":"kmp-skie-swift-task-cancellation-propagation-guardrail","title":"KMP SKIE Swift Concurrency Cancellation Propagation Standard","category":"mobile","severity":"critical","description":"Enforces strict integration between Apple Swift Structured Concurrency and Kotlin Coroutines via SKIE-generated async bridges. Guarantees that Swift Task cancellation immediately and cooperatively propagates down to Kotlin Job hierarchies, preventing orphaned network calls, zombie background execution, and memory leaks across the Foreign Function Interface (FFI).","antiPatternHeadline":"Bypassing SKIE Structured Bridges with Manual Completion Blocks or Detached Tasks Leading to Orphaned Coroutine Jobs","stars_count":100,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kmp","kotlin-multiplatform","skie","swift-concurrency","coroutines","ios"],"exportEndpoints":{"claude":"/api/rules/kmp-skie-swift-task-cancellation-propagation-guardrail?format=claude","cursorMdc":"/api/rules/kmp-skie-swift-task-cancellation-propagation-guardrail?format=mdc","cursorrules":"/api/rules/kmp-skie-swift-task-cancellation-propagation-guardrail?format=cursor","windsurf":"/api/rules/kmp-skie-swift-task-cancellation-propagation-guardrail?format=windsurf","agents":"/api/rules/kmp-skie-swift-task-cancellation-propagation-guardrail?format=agents"}},{"id":"tauri2-ipc-binary-channel-backpressure-protocol","title":"Tauri 2.0 IPC Zero-Copy Binary Channel Backpressure Protocol","category":"mobile","severity":"critical","description":"Enforces credit-based flow control and raw binary ArrayBuffer payload delivery via Tauri 2.0 Channels for high-frequency hardware sensor streams. Prevents unbounded native-to-webview IPC message queue allocation, serialization overhead, and frame drops on Android WebView and iOS WebKit runtimes.","antiPatternHeadline":"Unbounded JSON Event Emitter Flooding WebView IPC Without Consumer Flow Control","stars_count":51,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri-2","ipc","backpressure","binary-channel","performance"],"exportEndpoints":{"claude":"/api/rules/tauri2-ipc-binary-channel-backpressure-protocol?format=claude","cursorMdc":"/api/rules/tauri2-ipc-binary-channel-backpressure-protocol?format=mdc","cursorrules":"/api/rules/tauri2-ipc-binary-channel-backpressure-protocol?format=cursor","windsurf":"/api/rules/tauri2-ipc-binary-channel-backpressure-protocol?format=windsurf","agents":"/api/rules/tauri2-ipc-binary-channel-backpressure-protocol?format=agents"}},{"id":"webauthn-prf-ephemeral-key-zeroization-standard","title":"WebAuthn L3 PRF Ephemeral Key Zeroization and Memory Invariant Standard","category":"security","severity":"critical","description":"Enforces deterministic, instant memory zeroization of raw WebAuthn PRF (Pseudo-Random Function) extension outputs and derived symmetric encryption keys. Eliminates retention of plaintext key material in browser heap allocations to mitigate memory dump exfiltration, heap inspection, and side-channel extraction.","antiPatternHeadline":"Retaining raw WebAuthn PRF output buffers or converting symmetric keys to immutable strings without deterministic zeroization in try/finally blocks","stars_count":97,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","prf-extension","zeroization","web-crypto","cryptography"],"exportEndpoints":{"claude":"/api/rules/webauthn-prf-ephemeral-key-zeroization-standard?format=claude","cursorMdc":"/api/rules/webauthn-prf-ephemeral-key-zeroization-standard?format=mdc","cursorrules":"/api/rules/webauthn-prf-ephemeral-key-zeroization-standard?format=cursor","windsurf":"/api/rules/webauthn-prf-ephemeral-key-zeroization-standard?format=windsurf","agents":"/api/rules/webauthn-prf-ephemeral-key-zeroization-standard?format=agents"}},{"id":"rfc-9449-dpop-replay-window-bound-guardrail","title":"RFC 9449 DPoP Ephemeral Proof Replay Window & Distributed Nonce Bound","category":"security","severity":"critical","description":"Enforces strict RFC 9449 Demonstrating Proof-of-Possession (DPoP) verification standards across distributed microservices. Mandates sub-second clock drift validation, cryptographically bound HTTP request context (htm, htu, ath), and distributed atomic single-use nonce/jti verification via storage-layer race-condition-safe primitives to guarantee zero-replay tolerance of ephemeral proof tokens.","antiPatternHeadline":"Accepting DPoP Proofs with Wide Clock Skew, Process-Local Nonce Validation, or Unchecked JTI Uniqueness","stars_count":101,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","oauth2","rfc9449","dpop","zero-trust","distributed-systems"],"exportEndpoints":{"claude":"/api/rules/rfc-9449-dpop-replay-window-bound-guardrail?format=claude","cursorMdc":"/api/rules/rfc-9449-dpop-replay-window-bound-guardrail?format=mdc","cursorrules":"/api/rules/rfc-9449-dpop-replay-window-bound-guardrail?format=cursor","windsurf":"/api/rules/rfc-9449-dpop-replay-window-bound-guardrail?format=windsurf","agents":"/api/rules/rfc-9449-dpop-replay-window-bound-guardrail?format=agents"}},{"id":"cilium-ebpf-socket-identity-attribution-guardrail","title":"eBPF-Enforced Cilium Socket-Level Identity Attribution Invariant","category":"devops","severity":"critical","description":"Enforces deterministic cryptographic workload identity attribution directly within the Linux kernel via eBPF sockops and sock_addr programs, completely superseding user-space sidecar proxy redirection. Guarantees that socket allocation (TCP connect/accept) enforces identity validation, Mutual Authentication (WireGuard/IPsec), and L3/L4 network policies without context switching into userspace data planes. Prevents sidecar-induced tail latency, CPU cache thrashing, and unauthenticated socket leakage across multi-tenant container boundaries.","antiPatternHeadline":"Bypassing Kernel-Native eBPF Socket Hooks via User-Space Envoy Sidecar Injection and Permissive Host Networking","stars_count":115,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","cilium","kubernetes","service-mesh","security","kernel"],"exportEndpoints":{"claude":"/api/rules/cilium-ebpf-socket-identity-attribution-guardrail?format=claude","cursorMdc":"/api/rules/cilium-ebpf-socket-identity-attribution-guardrail?format=mdc","cursorrules":"/api/rules/cilium-ebpf-socket-identity-attribution-guardrail?format=cursor","windsurf":"/api/rules/cilium-ebpf-socket-identity-attribution-guardrail?format=windsurf","agents":"/api/rules/cilium-ebpf-socket-identity-attribution-guardrail?format=agents"}},{"id":"opentelemetry-v1-29-db-pool-wait-exponential-histogram-standard","title":"OpenTelemetry v1.29 DB Connection Wait Time Exponential Histogram Guardrail","category":"devops","severity":"critical","description":"Database connection acquisition latency distribution must be captured using Base-2 exponential histogram aggregation rather than coarse explicit buckets. Default explicit bucket boundaries obscure sub-millisecond micro-starvation and latency tail creep in connection pools, preventing detection of impending connection exhaustion cascades. OpenTelemetry v1.29 metrics semantic conventions mandate uniform high-resolution distribution instrumentation for database wait queues.","antiPatternHeadline":"Coarse Explicit Histogram Buckets Masking Database Connection Pool Micro-Starvation","stars_count":107,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","observability","database-pooling","metrics-sdk","reliability"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-v1-29-db-pool-wait-exponential-histogram-standard?format=claude","cursorMdc":"/api/rules/opentelemetry-v1-29-db-pool-wait-exponential-histogram-standard?format=mdc","cursorrules":"/api/rules/opentelemetry-v1-29-db-pool-wait-exponential-histogram-standard?format=cursor","windsurf":"/api/rules/opentelemetry-v1-29-db-pool-wait-exponential-histogram-standard?format=windsurf","agents":"/api/rules/opentelemetry-v1-29-db-pool-wait-exponential-histogram-standard?format=agents"}},{"id":"axum-tower-graceful-drain-loadshed-invariant","title":"Axum 0.8 & Tower Deterministic Worker Drain and Load-Shedding Invariant","category":"backend","severity":"critical","description":"Enforces deterministic termination of in-flight requests and immediate upstream backpressure propagation during Kubernetes rolling updates under extreme concurrency. Mandates readiness probe degradation before socket close, Tower load-shedding layers with explicit 503 Service Unavailable responses, and bounded graceful drain timeouts to prevent TCP RST drops.","antiPatternHeadline":"Naive axum::serve Graceful Shutdown Lacking Readiness De-registration, Pre-Stop Delay, and Tower Load-Shedding","stars_count":69,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tower","kubernetes","concurrency","resilience"],"exportEndpoints":{"claude":"/api/rules/axum-tower-graceful-drain-loadshed-invariant?format=claude","cursorMdc":"/api/rules/axum-tower-graceful-drain-loadshed-invariant?format=mdc","cursorrules":"/api/rules/axum-tower-graceful-drain-loadshed-invariant?format=cursor","windsurf":"/api/rules/axum-tower-graceful-drain-loadshed-invariant?format=windsurf","agents":"/api/rules/axum-tower-graceful-drain-loadshed-invariant?format=agents"}},{"id":"nextjs-15-dynamic-io-boundary-standard","title":"Next.js 15 Dynamic I/O Async Request Context Boundary Standard","category":"frontend","severity":"critical","description":"Enforces strict structural isolation between prerendered layout/component trees and Next.js 15 asynchronous dynamic request primitives (cookies, headers, dynamic route params, searchParams). Prevents dynamic de-opt waterfalls, cross-request cache pollution, and build-time dynamic server usage exceptions under the Dynamic I/O compiler.","antiPatternHeadline":"Top-Level Awaiting of Dynamic Primitives Poisoning Prerender Trees and De-opting Static Layout Shells","stars_count":56,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs","react-server-components","dynamic-io","caching","performance"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-dynamic-io-boundary-standard?format=claude","cursorMdc":"/api/rules/nextjs-15-dynamic-io-boundary-standard?format=mdc","cursorrules":"/api/rules/nextjs-15-dynamic-io-boundary-standard?format=cursor","windsurf":"/api/rules/nextjs-15-dynamic-io-boundary-standard?format=windsurf","agents":"/api/rules/nextjs-15-dynamic-io-boundary-standard?format=agents"}},{"id":"ebpf-sock-ops-zero-copy-redirection-policy","title":"eBPF SOCK_OPS and SK_MSG Zero-Copy Kernel Socket Redirection Guardrail","category":"devops","severity":"critical","description":"Enforces zero-copy stream redirection via eBPF BPF_PROG_TYPE_SOCK_OPS and BPF_PROG_TYPE_SK_MSG between co-located network namespaces. Prevents userspace context switching through sidecar proxies by maintaining strict sockmap lifecycle hooks and 4-tuple connection symmetry in kernel space.","antiPatternHeadline":"Traversing Complete TCP/IP Network Stack and Context Switching into Userspace Proxy for Co-located Pod Communication","stars_count":67,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","networking","cillium","linux-kernel","zero-copy","kubernetes"],"exportEndpoints":{"claude":"/api/rules/ebpf-sock-ops-zero-copy-redirection-policy?format=claude","cursorMdc":"/api/rules/ebpf-sock-ops-zero-copy-redirection-policy?format=mdc","cursorrules":"/api/rules/ebpf-sock-ops-zero-copy-redirection-policy?format=cursor","windsurf":"/api/rules/ebpf-sock-ops-zero-copy-redirection-policy?format=windsurf","agents":"/api/rules/ebpf-sock-ops-zero-copy-redirection-policy?format=agents"}},{"id":"react19-use-action-state-optimistic-vector-rollback","title":"React 19 useActionState and useOptimistic Deterministic Vector Rollback Standard","category":"frontend","severity":"critical","description":"Enforces strict monotonic state vector pairing between React 19's useActionState and useOptimistic primitives. Guarantees deterministic state reconciliation and prevents DOM visual desynchronization or UI tearing when asynchronous Server Actions reject, time out, or abort mid-flight. Mandates immutable payload tracking and explicit error channel propagation rather than silent unhandled optimistic drift.","antiPatternHeadline":"Dangling optimistic state accumulation and UI visual tearing on Server Action rejection","stars_count":57,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react19","actions","optimistic-ui","useActionState","useOptimistic","state-reconciliation"],"exportEndpoints":{"claude":"/api/rules/react19-use-action-state-optimistic-vector-rollback?format=claude","cursorMdc":"/api/rules/react19-use-action-state-optimistic-vector-rollback?format=mdc","cursorrules":"/api/rules/react19-use-action-state-optimistic-vector-rollback?format=cursor","windsurf":"/api/rules/react19-use-action-state-optimistic-vector-rollback?format=windsurf","agents":"/api/rules/react19-use-action-state-optimistic-vector-rollback?format=agents"}},{"id":"postgres-17-parallel-logical-replication-worker-memory-boundary","title":"Postgres 17 Streaming Parallel Logical Replication Worker Memory Boundary","category":"backend","severity":"critical","description":"Enforces strict memory boundaries and worker concurrency quotas for PostgreSQL 17 parallel apply background workers during streaming logical replication. Prevents node-level OOM-killer cascade failures by explicitly capping logical_decoding_work_mem, constraining max_parallel_apply_workers_per_subscription, and configuring disk-spill fallback parameters during multi-gigabyte transactional changesets.","antiPatternHeadline":"Unbounded Parallel Apply Workers with Uncapped Buffer Memory Triggering OOM-Killer Failures","stars_count":105,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres-17","logical-replication","parallel-apply","memory-management","high-availability"],"exportEndpoints":{"claude":"/api/rules/postgres-17-parallel-logical-replication-worker-memory-boundary?format=claude","cursorMdc":"/api/rules/postgres-17-parallel-logical-replication-worker-memory-boundary?format=mdc","cursorrules":"/api/rules/postgres-17-parallel-logical-replication-worker-memory-boundary?format=cursor","windsurf":"/api/rules/postgres-17-parallel-logical-replication-worker-memory-boundary?format=windsurf","agents":"/api/rules/postgres-17-parallel-logical-replication-worker-memory-boundary?format=agents"}},{"id":"openfga-ephemeral-contextual-tuple-horizon","title":"OpenFGA Ephemeral Contextual Tuple Horizon Enforcement","category":"security","severity":"critical","description":"Enforces zero-staleness dynamic authorization decisions by restricting high-churn, transient attributes (such as break-glass elevation, device posture, and session-scoped geo/IP conditions) to in-memory contextual tuples during OpenFGA Check operations. Prohibits persisting ephemeral authorization state to durable tuple storage, preventing tuple store bloat, cross-region replication lag, and window-of-exposure race conditions.","antiPatternHeadline":"Persisting Volatile Session and Environmental State into Durable OpenFGA Tuples Instead of Contextual Check Tuples","stars_count":75,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","authorization","fine-grained-access-control","zanzibar","zero-trust"],"exportEndpoints":{"claude":"/api/rules/openfga-ephemeral-contextual-tuple-horizon?format=claude","cursorMdc":"/api/rules/openfga-ephemeral-contextual-tuple-horizon?format=mdc","cursorrules":"/api/rules/openfga-ephemeral-contextual-tuple-horizon?format=cursor","windsurf":"/api/rules/openfga-ephemeral-contextual-tuple-horizon?format=windsurf","agents":"/api/rules/openfga-ephemeral-contextual-tuple-horizon?format=agents"}},{"id":"tauri-v2-multi-webview-capability-fence-channel-isolation","title":"Tauri 2.0 Multi-WebView Capability Fencing and Channel Isolation","category":"mobile","severity":"critical","description":"Enforces strict compile-time capability scoping and runtime IPC channel boundaries across distinct Tauri 2.0 WebViews. Prevents lateral privilege escalation by isolating native Rust bridge commands, restricting wildcard window permissions, and preventing secondary or embedded webviews (e.g., OAuth modals, remote content previews) from invoking high-privilege native device APIs.","antiPatternHeadline":"Assigning global IPC capabilities or leaking streaming channels to auxiliary webviews via wildcard permissions","stars_count":43,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri-2","security","rust","ipc","webview-isolation"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-multi-webview-capability-fence-channel-isolation?format=claude","cursorMdc":"/api/rules/tauri-v2-multi-webview-capability-fence-channel-isolation?format=mdc","cursorrules":"/api/rules/tauri-v2-multi-webview-capability-fence-channel-isolation?format=cursor","windsurf":"/api/rules/tauri-v2-multi-webview-capability-fence-channel-isolation?format=windsurf","agents":"/api/rules/tauri-v2-multi-webview-capability-fence-channel-isolation?format=agents"}},{"id":"bun-sqlite-wal-mmap-concurrency-guardrail","title":"Bun 1.2 Multithreaded SQLite WAL Memory-Mapped Synchronization Standard","category":"backend","severity":"critical","description":"Enforces strict isolation, WAL journal mode configuration, and single-writer coordination across Bun 1.2 multithreaded worker pools accessing SQLite databases. Prevents database lock contention (SQLITE_BUSY), memory-mapped (mmap) dirty page corruption, and inconsistent file descriptors when multiple concurrent workers access local and edge-replicated SQLite instances.","antiPatternHeadline":"Uncoordinated Multi-Worker Writes and Unbounded MMAP Allocations Causing SQLITE_BUSY Deadlocks and Corrupted WAL Buffers","stars_count":50,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","sqlite","wal","concurrency","multithreading","mmap"],"exportEndpoints":{"claude":"/api/rules/bun-sqlite-wal-mmap-concurrency-guardrail?format=claude","cursorMdc":"/api/rules/bun-sqlite-wal-mmap-concurrency-guardrail?format=mdc","cursorrules":"/api/rules/bun-sqlite-wal-mmap-concurrency-guardrail?format=cursor","windsurf":"/api/rules/bun-sqlite-wal-mmap-concurrency-guardrail?format=windsurf","agents":"/api/rules/bun-sqlite-wal-mmap-concurrency-guardrail?format=agents"}},{"id":"capacitor-7-enclave-biometric-session-attestation","title":"Hardware-Backed Enclave Biometric Session Attestation for Capacitor 7 Bridge RPCs","category":"mobile","severity":"critical","description":"Capacitor 7 hybrid WebViews must never trust raw boolean biometric flags returned over the bridge. High-privilege native bridge RPC operations require hardware-level cryptographic session attestation where the iOS Secure Enclave or Android StrongBox/TEE signs an ephemeral server-originated challenge upon biometric unlock, guaranteeing proof of physical presence.","antiPatternHeadline":"Trusting Boolean Bridge Results ({ authenticated: true }) for Sensitive RPC Operations","stars_count":80,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","security","secure-enclave","tee","biometrics","zero-trust"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-enclave-biometric-session-attestation?format=claude","cursorMdc":"/api/rules/capacitor-7-enclave-biometric-session-attestation?format=mdc","cursorrules":"/api/rules/capacitor-7-enclave-biometric-session-attestation?format=cursor","windsurf":"/api/rules/capacitor-7-enclave-biometric-session-attestation?format=windsurf","agents":"/api/rules/capacitor-7-enclave-biometric-session-attestation?format=agents"}},{"id":"otel-ebpf-profiler-frame-pointerless-unwinding","title":"OpenTelemetry eBPF Continuous Profiler Frame-Pointerless Stack Unwinding Standard","category":"devops","severity":"critical","description":"Mandates build pipeline configuration, kernel capability scoping, and unwinding table preservation for OpenTelemetry eBPF continuous profiling across hybrid Go, Rust, and V8 workloads. Ensures zero-overhead out-of-band unwinding without frame pointers while preventing broken call chains and kernel verifier rejections.","antiPatternHeadline":"Stripping Unwind Tables and Missing Host Process Namespace Access in Profiler DaemonSets","stars_count":41,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","opentelemetry","continuous-profiling","rust","golang","v8","kubernetes"],"exportEndpoints":{"claude":"/api/rules/otel-ebpf-profiler-frame-pointerless-unwinding?format=claude","cursorMdc":"/api/rules/otel-ebpf-profiler-frame-pointerless-unwinding?format=mdc","cursorrules":"/api/rules/otel-ebpf-profiler-frame-pointerless-unwinding?format=cursor","windsurf":"/api/rules/otel-ebpf-profiler-frame-pointerless-unwinding?format=windsurf","agents":"/api/rules/otel-ebpf-profiler-frame-pointerless-unwinding?format=agents"}},{"id":"react19-use-action-state-mutation-serialization","title":"React 19 useActionState Optimistic Mutation Serialization Guardrail","category":"frontend","severity":"critical","description":"Enforces monotonic state versioning and optimistic rollback safety when utilizing React 19 useActionState alongside useOptimistic. Unordered asynchronous resolution of concurrent server actions leads to state tearing, phantom mutations, and desynchronized form state unless mutations carry serialized epoch identifiers and deterministic rebase mechanics.","antiPatternHeadline":"Concurrent useActionState Invocations Overwriting Newer Optimistic UI State via Out-of-Order Server Resolutions","stars_count":64,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","useActionState","useOptimistic","server-actions","concurrency"],"exportEndpoints":{"claude":"/api/rules/react19-use-action-state-mutation-serialization?format=claude","cursorMdc":"/api/rules/react19-use-action-state-mutation-serialization?format=mdc","cursorrules":"/api/rules/react19-use-action-state-mutation-serialization?format=cursor","windsurf":"/api/rules/react19-use-action-state-mutation-serialization?format=windsurf","agents":"/api/rules/react19-use-action-state-mutation-serialization?format=agents"}},{"id":"postgres-17-hnsw-memory-budget-guardrail","title":"Postgres 17 Streaming HNSW Vector Index Memory-Budget Guardrail","category":"backend","severity":"critical","description":"Enforces strict bounded memory allocation and concurrency constraints for pgvector HNSW indexing during active database workloads. Prevents aggressive buffer pool thrashing, query-path latency spikes, and vector recall degradation caused by unconstrained maintenance work memory and parallel worker oversubscription.","antiPatternHeadline":"Unbounded Parallel Maintenance Memory Exhausting Shared Buffers and Starving Query Paths","stars_count":51,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres","pgvector","hnsw","memory-management","performance"],"exportEndpoints":{"claude":"/api/rules/postgres-17-hnsw-memory-budget-guardrail?format=claude","cursorMdc":"/api/rules/postgres-17-hnsw-memory-budget-guardrail?format=mdc","cursorrules":"/api/rules/postgres-17-hnsw-memory-budget-guardrail?format=cursor","windsurf":"/api/rules/postgres-17-hnsw-memory-budget-guardrail?format=windsurf","agents":"/api/rules/postgres-17-hnsw-memory-budget-guardrail?format=agents"}},{"id":"go-iter-seq-zero-alloc-middleware","title":"Go 1.24 iter.Seq Zero-Allocation HTTP Middleware Pipeline Standard","category":"backend","severity":"critical","description":"Mandates functional iterator-based middleware chains utilizing Go 1.24's iter.Seq to eliminate slice allocations, closure heap escapes, and dynamic dispatch overhead in high-throughput gateway routing. Guarantees zero-allocation execution paths through compiler-inlined range-over-func loops that terminate via deterministic boolean yield semantics.","antiPatternHeadline":"Slice-Based Recursive Handler Chaining Forcing Closure Heap Escapes Under High QPS","stars_count":112,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","iter-seq","zero-allocation","http-middleware","performance"],"exportEndpoints":{"claude":"/api/rules/go-iter-seq-zero-alloc-middleware?format=claude","cursorMdc":"/api/rules/go-iter-seq-zero-alloc-middleware?format=mdc","cursorrules":"/api/rules/go-iter-seq-zero-alloc-middleware?format=cursor","windsurf":"/api/rules/go-iter-seq-zero-alloc-middleware?format=windsurf","agents":"/api/rules/go-iter-seq-zero-alloc-middleware?format=agents"}},{"id":"bun-sqlite-wal-concurrency-invariant","title":"Bun 1.2 Clustered SQLite WAL Read-Replica Affinity & Truncation Barrier Standard","category":"backend","severity":"critical","description":"Enforces strict process-level separation between solitary write-coordinator threads and read-replica worker pools when leveraging bun:sqlite under high concurrency. Prevents SQLite busy timeouts and unconstrained WAL log explosion by mandating explicit query-only PRAGMAs on read threads alongside deterministic checkpoint barriers via the primary engine thread.","antiPatternHeadline":"Unpartitioned Multi-Threaded Read/Write Contention Leading to SQLITE_BUSY Starvation and Unbounded WAL Expansion","stars_count":90,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","sqlite","concurrency","wal","workers"],"exportEndpoints":{"claude":"/api/rules/bun-sqlite-wal-concurrency-invariant?format=claude","cursorMdc":"/api/rules/bun-sqlite-wal-concurrency-invariant?format=mdc","cursorrules":"/api/rules/bun-sqlite-wal-concurrency-invariant?format=cursor","windsurf":"/api/rules/bun-sqlite-wal-concurrency-invariant?format=windsurf","agents":"/api/rules/bun-sqlite-wal-concurrency-invariant?format=agents"}},{"id":"rn-077-bridgeless-jsi-memory-pinning-standard","title":"React Native 0.77 Bridgeless TurboModule JSI Memory Pinning Standard","category":"mobile","severity":"critical","description":"Enforces safe C++ HostObject reference pinning and deterministic lifecycle management across concurrent native-to-Hermes execution boundaries in React Native 0.77 bridgeless mode. Prevents Hermes heap corruption, race conditions, and use-after-free crashes caused by capturing raw JSI values across asynchronous native threads without CallInvoker synchronization.","antiPatternHeadline":"Capturing Unpinned JSI Value Pointers Across Asynchronous Native Threads and Retaining Leaked HostObjects","stars_count":44,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","react-native","turbomodules","jsi","hermes","bridgeless","memory-management"],"exportEndpoints":{"claude":"/api/rules/rn-077-bridgeless-jsi-memory-pinning-standard?format=claude","cursorMdc":"/api/rules/rn-077-bridgeless-jsi-memory-pinning-standard?format=mdc","cursorrules":"/api/rules/rn-077-bridgeless-jsi-memory-pinning-standard?format=cursor","windsurf":"/api/rules/rn-077-bridgeless-jsi-memory-pinning-standard?format=windsurf","agents":"/api/rules/rn-077-bridgeless-jsi-memory-pinning-standard?format=agents"}},{"id":"tauri2-mobile-ipc-arraybuffer-streaming-standard","title":"Tauri 2.0 Scoped IPC Shared-Memory & ArrayBuffer Streaming Standard","category":"mobile","severity":"critical","description":"Enforces zero-copy, non-blocking binary data transfer between Tauri 2.0 Rust core commands and mobile WebViews (iOS WKWebView and Android WebView). Prohibits base64 stringification and numeric array serialization of binary payloads to eliminate main thread garbage collection pauses and UI frame dropping. Mandates raw IPC binary channels or custom asset protocol streaming for payloads exceeding 64KB.","antiPatternHeadline":"Base64 or JSON-Array Serialization of Multi-Megabyte Binary Payloads Across Mobile IPC","stars_count":102,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri-2","rust","ipc","performance","memory-management"],"exportEndpoints":{"claude":"/api/rules/tauri2-mobile-ipc-arraybuffer-streaming-standard?format=claude","cursorMdc":"/api/rules/tauri2-mobile-ipc-arraybuffer-streaming-standard?format=mdc","cursorrules":"/api/rules/tauri2-mobile-ipc-arraybuffer-streaming-standard?format=cursor","windsurf":"/api/rules/tauri2-mobile-ipc-arraybuffer-streaming-standard?format=windsurf","agents":"/api/rules/tauri2-mobile-ipc-arraybuffer-streaming-standard?format=agents"}},{"id":"post-quantum-ml-kem-768-tls-enforcement","title":"Post-Quantum ML-KEM-768 TLS 1.3 Handshake Enforcement Invariant","category":"security","severity":"critical","description":"Enforces hybrid post-quantum key encapsulation mechanisms (X25519MLKEM768 or SecP256r1MLKEM768) exclusively over TLS 1.3 on all edge reverse proxies and ingress controllers. Eliminates classical-only key exchange fallback pathways to guarantee immunity against harvest-now-decrypt-later (HNDL) cryptographic attacks across internal and external microservice meshes.","antiPatternHeadline":"Permitting Classical-Only TLS Key Exchange Groups (e.g., ECDHE X25519/secp256r1) Without Quantum-Resistant Hybrid Encapsulation","stars_count":71,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","cryptography","tls-1.3","post-quantum","ml-kem","zero-trust","reverse-proxy"],"exportEndpoints":{"claude":"/api/rules/post-quantum-ml-kem-768-tls-enforcement?format=claude","cursorMdc":"/api/rules/post-quantum-ml-kem-768-tls-enforcement?format=mdc","cursorrules":"/api/rules/post-quantum-ml-kem-768-tls-enforcement?format=cursor","windsurf":"/api/rules/post-quantum-ml-kem-768-tls-enforcement?format=windsurf","agents":"/api/rules/post-quantum-ml-kem-768-tls-enforcement?format=agents"}},{"id":"ebpf-xdp-stateless-token-bucket-guardrail","title":"eBPF XDP Ingress Token Bucket Rate Limiting Production Standard","category":"devops","severity":"critical","description":"Enforces bare-metal NIC-level packet filtering via eBPF XDP driver mode to drop volumetric ingress traffic before socket buffer (sk_buff) allocation. Eliminates ksoftirqd CPU starvation and nf_conntrack table exhaustion by utilizing lockless token bucket algorithms with strictly bounded verifier memory access.","antiPatternHeadline":"Delegating Volumetric L7 Flood Mitigation to Userspace Proxies or Kernel Conntrack","stars_count":75,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","xdp","ddos-mitigation","linux-kernel","performance"],"exportEndpoints":{"claude":"/api/rules/ebpf-xdp-stateless-token-bucket-guardrail?format=claude","cursorMdc":"/api/rules/ebpf-xdp-stateless-token-bucket-guardrail?format=mdc","cursorrules":"/api/rules/ebpf-xdp-stateless-token-bucket-guardrail?format=cursor","windsurf":"/api/rules/ebpf-xdp-stateless-token-bucket-guardrail?format=windsurf","agents":"/api/rules/ebpf-xdp-stateless-token-bucket-guardrail?format=agents"}},{"id":"otel-arrow-zero-copy-ingestion-pipeline","title":"OpenTelemetry OTLP Arrow Zero-Copy Telemetry Ingestion Pipeline Invariants","category":"devops","severity":"critical","description":"Standardizes OpenTelemetry Collector pipelines to ingest and process columnar telemetry records via Apache Arrow memory layouts without intermediary Protobuf deserialization. Eliminates CPU spikes and heap thrashing caused by row-oriented deserialization loops in high-throughput collector gateways. Mandates zero-copy handoffs, aligned dictionary encoding, and stream-aware memory pool allocations across collector components.","antiPatternHeadline":"Falling Back to Row-Oriented Protobuf Deserialization in High-Throughput OTLP Ingestion Paths","stars_count":119,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","apache-arrow","zero-copy","performance","observability","kubernetes"],"exportEndpoints":{"claude":"/api/rules/otel-arrow-zero-copy-ingestion-pipeline?format=claude","cursorMdc":"/api/rules/otel-arrow-zero-copy-ingestion-pipeline?format=mdc","cursorrules":"/api/rules/otel-arrow-zero-copy-ingestion-pipeline?format=cursor","windsurf":"/api/rules/otel-arrow-zero-copy-ingestion-pipeline?format=windsurf","agents":"/api/rules/otel-arrow-zero-copy-ingestion-pipeline?format=agents"}},{"id":"nextjs-15-ppr-boundary-guardrail-production-standard","title":"Next.js 15 Partial Prerendering (PPR) Static-Dynamic Isolation Guardrail","category":"frontend","severity":"critical","description":"Enforces strict isolation boundaries between pre-rendered static shells and dynamic asynchronous streaming holes under Next.js 15 Partial Prerendering. Prevents dynamic bailout cascade where accessing dynamic functions (cookies, headers, searchParams, uncached I/O) outside explicit Suspense boundaries de-optimizes static pre-renders into full SSR or triggers micro-hydration mismatches.","antiPatternHeadline":"Accessing Dynamic Contexts or Uncached I/O Outside Explicit Suspense Boundaries in PPR Routes","stars_count":111,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs","react19","partial-prerendering","hydration","suspense","performance"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-ppr-boundary-guardrail-production-standard?format=claude","cursorMdc":"/api/rules/nextjs-15-ppr-boundary-guardrail-production-standard?format=mdc","cursorrules":"/api/rules/nextjs-15-ppr-boundary-guardrail-production-standard?format=cursor","windsurf":"/api/rules/nextjs-15-ppr-boundary-guardrail-production-standard?format=windsurf","agents":"/api/rules/nextjs-15-ppr-boundary-guardrail-production-standard?format=agents"}},{"id":"bun-sqlite-worker-wal-affinity-standard","title":"Bun 1.2 Worker Thread SQLite WAL Affinity and Concurrency Guardrail","category":"backend","severity":"critical","description":"Enforces strict database connection isolation, WAL (Write-Ahead Logging) configuration, and single-writer thread affinity across concurrent native Bun worker threads. Prevents SQLITE_BUSY lock starvation, database corruption, and shared-memory descriptor desynchronization caused by uncoordinated concurrent write transactions.","antiPatternHeadline":"Uncoordinated Multi-Threaded Read-Write SQLite Connections Without WAL Affinity or Busy Timeouts","stars_count":44,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","sqlite","wal","worker-threads","concurrency"],"exportEndpoints":{"claude":"/api/rules/bun-sqlite-worker-wal-affinity-standard?format=claude","cursorMdc":"/api/rules/bun-sqlite-worker-wal-affinity-standard?format=mdc","cursorrules":"/api/rules/bun-sqlite-worker-wal-affinity-standard?format=cursor","windsurf":"/api/rules/bun-sqlite-worker-wal-affinity-standard?format=windsurf","agents":"/api/rules/bun-sqlite-worker-wal-affinity-standard?format=agents"}},{"id":"capacitor7-secure-enclave-webauthn-zero-seed-storage","title":"Capacitor 7 Hardware-Backed Secure Enclave Biometric Key Zero-Storage Invariant","category":"mobile","severity":"critical","description":"Enforces hardware-backed WebAuthn and passkey attestation synchronization strictly across native platform boundaries without exposing or persisting cryptographic seeds in WebKit or Chromium storage. Ensures that private key operations remain strictly confined to the Apple Secure Enclave and Android StrongBox/KeyStore, with zero intermediate key material crossing into webview-managed memory or storage engines.","antiPatternHeadline":"Persisting Cryptographic Seeds, Ephemeral Keypairs, or Private Keys in Webview Storage Layers","stars_count":118,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","security","webauthn","biometrics","secure-enclave","cryptography"],"exportEndpoints":{"claude":"/api/rules/capacitor7-secure-enclave-webauthn-zero-seed-storage?format=claude","cursorMdc":"/api/rules/capacitor7-secure-enclave-webauthn-zero-seed-storage?format=mdc","cursorrules":"/api/rules/capacitor7-secure-enclave-webauthn-zero-seed-storage?format=cursor","windsurf":"/api/rules/capacitor7-secure-enclave-webauthn-zero-seed-storage?format=windsurf","agents":"/api/rules/capacitor7-secure-enclave-webauthn-zero-seed-storage?format=agents"}},{"id":"openfga-cdc-outbox-rebac-cache-invalidation-standard","title":"OpenFGA CDC-Driven Eventual ReBAC Cache Invalidation Standard","category":"security","severity":"critical","description":"Eliminates authorization drift and stale permission evaluations by strictly forbidding direct dual-writes to OpenFGA and authorization caches during application requests. Enforces an atomic transactional outbox pattern paired with Change Data Capture (CDC) streaming to synchronize relational tuple mutations, OpenFGA writes, and distributed ReBAC cache evictions deterministically.","antiPatternHeadline":"Dual-Writing Authorization Tuples and In-Memory/Redis Caches Directly from Application Request Handlers","stars_count":42,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","rebac","cdc","outbox-pattern","authorization","distributed-systems"],"exportEndpoints":{"claude":"/api/rules/openfga-cdc-outbox-rebac-cache-invalidation-standard?format=claude","cursorMdc":"/api/rules/openfga-cdc-outbox-rebac-cache-invalidation-standard?format=mdc","cursorrules":"/api/rules/openfga-cdc-outbox-rebac-cache-invalidation-standard?format=cursor","windsurf":"/api/rules/openfga-cdc-outbox-rebac-cache-invalidation-standard?format=windsurf","agents":"/api/rules/openfga-cdc-outbox-rebac-cache-invalidation-standard?format=agents"}},{"id":"cilium-ebpf-pmtud-mss-clamping-wireguard","title":"Cilium eBPF Dynamic TCP MSS Clamping for WireGuard Meshes","category":"devops","severity":"critical","description":"Enforces Cilium dynamic eBPF Path MTU Discovery (PMTUD) and TCP Maximum Segment Size (MSS) clamping across hybrid multi-cloud WireGuard overlays. Eliminates silent TCP blackholing, broken TLS handshakes, and packet fragmentation caused by disparate underlay MTUs and cryptographic encapsulation overhead.","antiPatternHeadline":"Unclamped Overlay Encapsulation Causing Silent TCP Packet Blackholing Across Heterogeneous Cloud Underlays","stars_count":116,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","cilium","ebpf","wireguard","kubernetes","networking","mtu","pmtud"],"exportEndpoints":{"claude":"/api/rules/cilium-ebpf-pmtud-mss-clamping-wireguard?format=claude","cursorMdc":"/api/rules/cilium-ebpf-pmtud-mss-clamping-wireguard?format=mdc","cursorrules":"/api/rules/cilium-ebpf-pmtud-mss-clamping-wireguard?format=cursor","windsurf":"/api/rules/cilium-ebpf-pmtud-mss-clamping-wireguard?format=windsurf","agents":"/api/rules/cilium-ebpf-pmtud-mss-clamping-wireguard?format=agents"}},{"id":"ebpf-otel-span-profiling-correlation-standard","title":"Continuous eBPF Wall-Clock Profiling to OTel Span Correlation Standard","category":"devops","severity":"critical","description":"Enforces deterministic injection of active OpenTelemetry trace and span context into kernel-readable user-space memory locations or thread naming registries. Guarantees continuous eBPF wall-clock profilers can sample on-CPU and off-CPU stack traces correlated directly to OpenTelemetry span IDs without sampling bias or kernel tracing loss.","antiPatternHeadline":"Decoupled tracing and continuous profiling resulting in uncorrelatable tail-latency root causes","stars_count":94,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","opentelemetry","continuous-profiling","observability","tail-latency"],"exportEndpoints":{"claude":"/api/rules/ebpf-otel-span-profiling-correlation-standard?format=claude","cursorMdc":"/api/rules/ebpf-otel-span-profiling-correlation-standard?format=mdc","cursorrules":"/api/rules/ebpf-otel-span-profiling-correlation-standard?format=cursor","windsurf":"/api/rules/ebpf-otel-span-profiling-correlation-standard?format=windsurf","agents":"/api/rules/ebpf-otel-span-profiling-correlation-standard?format=agents"}},{"id":"axum-streaming-cancellation-barrier","title":"Axum 0.8 Streaming Extractor Task Cancellation Barrier","category":"backend","severity":"critical","description":"Mandates deterministic cancellation boundaries for all Axum 0.8 streaming responses, SSE, and WebSocket loops. When hyper drops an active response stream upon client disconnect, detached background worker tasks must be proactively terminated via CancellationToken or RAII drop guards to prevent unbounded memory and thread leaks.","antiPatternHeadline":"Spawning Detached Background Producers Without Cancellation Barriers in Streaming Handlers","stars_count":117,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tokio","concurrency","sse","websockets"],"exportEndpoints":{"claude":"/api/rules/axum-streaming-cancellation-barrier?format=claude","cursorMdc":"/api/rules/axum-streaming-cancellation-barrier?format=mdc","cursorrules":"/api/rules/axum-streaming-cancellation-barrier?format=cursor","windsurf":"/api/rules/axum-streaming-cancellation-barrier?format=windsurf","agents":"/api/rules/axum-streaming-cancellation-barrier?format=agents"}},{"id":"react-19-server-action-idempotency-key-replay-barrier","title":"React 19 Server Action Idempotency Key and Replay Barrier Architecture","category":"frontend","severity":"critical","description":"Enforces deterministic client-side generation of cryptographic idempotency keys coupled with atomic server-side mutation verification across React 19 Server Actions. Prevents duplicate state execution and race conditions during network retries, optimistic UI rollbacks, and rapid client-side transitions.","antiPatternHeadline":"Executing non-idempotent Server Actions without client-anchored replay barriers during concurrent transitions and network failures","stars_count":114,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","server-actions","idempotency","optimistic-ui","network-resilience"],"exportEndpoints":{"claude":"/api/rules/react-19-server-action-idempotency-key-replay-barrier?format=claude","cursorMdc":"/api/rules/react-19-server-action-idempotency-key-replay-barrier?format=mdc","cursorrules":"/api/rules/react-19-server-action-idempotency-key-replay-barrier?format=cursor","windsurf":"/api/rules/react-19-server-action-idempotency-key-replay-barrier?format=windsurf","agents":"/api/rules/react-19-server-action-idempotency-key-replay-barrier?format=agents"}},{"id":"tauri2-mobile-ipc-arraybuffer-lifetime-pinning","title":"Tauri 2.0 Mobile IPC ArrayBuffer Lifetime Pinning & Zero-Copy Stability","category":"mobile","severity":"critical","description":"Enforces strict memory pinning and explicit ownership handshakes across the Tauri 2.0 Rust-to-WebKit mobile IPC bridge during high-throughput camera and biometric sensor streaming. Prevents use-after-free, double-free, and silent buffer truncation caused by premature JavaScript garbage collection or Rust slice deallocation during asynchronous channel transmission. Mandates explicit transfer-list semantics, channel detachment protocols, and backpressure-regulated frame acknowledgments.","antiPatternHeadline":"Unpinned Ephemeral ArrayBuffer Transmutation Across Mobile WebKit Bridge Leading to SIGSEGV and Silent Memory Corruption","stars_count":57,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri","ipc","arraybuffer","rust","memory-safety","zero-copy"],"exportEndpoints":{"claude":"/api/rules/tauri2-mobile-ipc-arraybuffer-lifetime-pinning?format=claude","cursorMdc":"/api/rules/tauri2-mobile-ipc-arraybuffer-lifetime-pinning?format=mdc","cursorrules":"/api/rules/tauri2-mobile-ipc-arraybuffer-lifetime-pinning?format=cursor","windsurf":"/api/rules/tauri2-mobile-ipc-arraybuffer-lifetime-pinning?format=windsurf","agents":"/api/rules/tauri2-mobile-ipc-arraybuffer-lifetime-pinning?format=agents"}},{"id":"ebpf-xdp-stateless-tls-early-data-filter","title":"Deterministic XDP Invalidation for Stateless TLS 1.3 0-RTT Amplification Vectors","category":"devops","severity":"critical","description":"Enforces pre-allocation filtering of TLS 1.3 0-RTT early data packets inside the native XDP driver hook to mitigate packet amplification and state-exhaustion replay attacks. Requires strict verifier-compliant bounds checking, zero sk_buff allocations, and deterministic drop mechanics (XDP_DROP) within the NIC driver ring buffer before traversing the Linux networking stack.","antiPatternHeadline":"Processing Untrusted TLS Early Data via Kernel Socket Layer or State-Holding Maps Without Pre-Allocation Ring Buffer Invalidation","stars_count":56,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","xdp","tls13","networking","ddos-mitigation","kernel"],"exportEndpoints":{"claude":"/api/rules/ebpf-xdp-stateless-tls-early-data-filter?format=claude","cursorMdc":"/api/rules/ebpf-xdp-stateless-tls-early-data-filter?format=mdc","cursorrules":"/api/rules/ebpf-xdp-stateless-tls-early-data-filter?format=cursor","windsurf":"/api/rules/ebpf-xdp-stateless-tls-early-data-filter?format=windsurf","agents":"/api/rules/ebpf-xdp-stateless-tls-early-data-filter?format=agents"}},{"id":"postgres-17-pgvector-parallel-hnsw-memory-fencing","title":"Postgres 17 pgvector Parallel HNSW Index Build Memory Fencing","category":"backend","severity":"critical","description":"PostgreSQL allocates maintenance_work_mem per parallel worker during index creation, which can easily trigger Linux kernel Out-Of-Memory (OOM) killer terminations during concurrent HNSW vector indexing. Engineers must strictly calculate and fence session-level memory budgets and worker ceilings before executing CREATE INDEX statements for pgvector embeddings.","antiPatternHeadline":"Unbounded parallel maintenance worker allocation causing host OOM panic and shared buffer eviction during HNSW index construction","stars_count":58,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres","pgvector","hnsw","memory-fencing","database-migrations"],"exportEndpoints":{"claude":"/api/rules/postgres-17-pgvector-parallel-hnsw-memory-fencing?format=claude","cursorMdc":"/api/rules/postgres-17-pgvector-parallel-hnsw-memory-fencing?format=mdc","cursorrules":"/api/rules/postgres-17-pgvector-parallel-hnsw-memory-fencing?format=cursor","windsurf":"/api/rules/postgres-17-pgvector-parallel-hnsw-memory-fencing?format=windsurf","agents":"/api/rules/postgres-17-pgvector-parallel-hnsw-memory-fencing?format=agents"}},{"id":"fapi2-dpop-nonce-refresh-boundary-invariants","title":"FAPI 2.0 DPoP Sender-Constrained Nonce Refresh Boundary & Anti-Replay Guardrail","category":"security","severity":"critical","description":"Enforces FAPI 2.0 and RFC 9449 Demonstrating Proof-of-Possession (DPoP) cryptographic sender-constraining and atomic nonce renegotiation across distributed microservices. Mandates single-attempt nonce boundary retry semantics, fresh cryptographically secure JTI generation on every retry, SHA-256 access token hash (ath) binding, and distributed JTI replay defense under clock skew.","antiPatternHeadline":"Replaying Static DPoP Proofs with Stale JTIs Across Nonce Refreshes and Omitting Token Hash Binding","stars_count":48,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","fapi2","oauth2","dpop","sender-constraining","zero-trust"],"exportEndpoints":{"claude":"/api/rules/fapi2-dpop-nonce-refresh-boundary-invariants?format=claude","cursorMdc":"/api/rules/fapi2-dpop-nonce-refresh-boundary-invariants?format=mdc","cursorrules":"/api/rules/fapi2-dpop-nonce-refresh-boundary-invariants?format=cursor","windsurf":"/api/rules/fapi2-dpop-nonce-refresh-boundary-invariants?format=windsurf","agents":"/api/rules/fapi2-dpop-nonce-refresh-boundary-invariants?format=agents"}},{"id":"capacitor-7-scoped-storage-photopicker-sandbox","title":"Capacitor 7 Scoped Storage PhotoPicker Sandbox Fencing & Descriptor Recycling","category":"mobile","severity":"critical","description":"Enforces strict Scoped Storage fencing, explicit URI permission acquisition, and immediate native FileDescriptor recycling for Capacitor 7 running on modern Android target SDKs (34+). Prevents silent process death from kernel file descriptor exhaustion and invalid URI persistence failures across Android activity recreation.","antiPatternHeadline":"Leaking Transient Content URIs and Raw File Descriptors Across the Capacitor Web-Native Bridge","stars_count":68,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","android","scoped-storage","photopicker","memory-management"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-scoped-storage-photopicker-sandbox?format=claude","cursorMdc":"/api/rules/capacitor-7-scoped-storage-photopicker-sandbox?format=mdc","cursorrules":"/api/rules/capacitor-7-scoped-storage-photopicker-sandbox?format=cursor","windsurf":"/api/rules/capacitor-7-scoped-storage-photopicker-sandbox?format=windsurf","agents":"/api/rules/capacitor-7-scoped-storage-photopicker-sandbox?format=agents"}},{"id":"otel-ottl-cardinality-fencing","title":"OTTL Cardinality Fencing and Dynamic Path Normalization","category":"devops","severity":"critical","description":"Enforces boundary-level telemetry sanitation using OpenTelemetry Transformation Language (OTTL) to scrub unbounded REST paths, numeric identifiers, UUIDs, and GraphQL variable payloads. Prevents downstream TSDB (e.g., Prometheus, M3DB, VictoriaMetrics) indexing degradation and OOM panics caused by high-cardinality metric label explosions.","antiPatternHeadline":"Leaking Unparameterized URI Paths and Unbounded Query Strings Directly into TSDB Metric Dimensions","stars_count":74,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","ottl","tsdb","cardinality","observability"],"exportEndpoints":{"claude":"/api/rules/otel-ottl-cardinality-fencing?format=claude","cursorMdc":"/api/rules/otel-ottl-cardinality-fencing?format=mdc","cursorrules":"/api/rules/otel-ottl-cardinality-fencing?format=cursor","windsurf":"/api/rules/otel-ottl-cardinality-fencing?format=windsurf","agents":"/api/rules/otel-ottl-cardinality-fencing?format=agents"}},{"id":"vite-6-environment-runtime-isolation-boundary-standard","title":"Vite 6 Environment API Runtime Isolation and Prototype Boundary Guardrail","category":"frontend","severity":"critical","description":"Enforces strict runtime boundary isolation when configuring multi-environment applications using Vite 6's Environment API and ModuleRunner. Prevents cross-target global scope pollution, host-level prototype mutation, and shared module cache contamination across heterogeneous SSR runtimes (Node.js, Edge/Workerd, Browser micro-frontends).","antiPatternHeadline":"Global Scope Mutation and Cross-Environment Prototype Contamination via Unisolated Vite 6 Module Runners","stars_count":73,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","vite-6","environment-api","module-runner","ssr","micro-frontends","runtime-isolation"],"exportEndpoints":{"claude":"/api/rules/vite-6-environment-runtime-isolation-boundary-standard?format=claude","cursorMdc":"/api/rules/vite-6-environment-runtime-isolation-boundary-standard?format=mdc","cursorrules":"/api/rules/vite-6-environment-runtime-isolation-boundary-standard?format=cursor","windsurf":"/api/rules/vite-6-environment-runtime-isolation-boundary-standard?format=windsurf","agents":"/api/rules/vite-6-environment-runtime-isolation-boundary-standard?format=agents"}},{"id":"openfga-contextual-tuple-rebac-barrier","title":"OpenFGA Real-Time Contextual Tuple ReBAC Evaluation Barrier","category":"security","severity":"critical","description":"Enforces strict segregation between persistent graph-store tuples and dynamic request-time attributes using OpenFGA contextual tuples and CEL context evaluation. Prevents tuple store pollution, race conditions, stale authorization state leaks, and latency degradation by evaluating ephemeral claims strictly in-memory during check requests.","antiPatternHeadline":"Persisting Ephemeral Request Attributes to the OpenFGA Central Tuple Store Instead of Using Contextual Tuples","stars_count":114,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","rebac","authorization","zero-trust","contextual-tuples"],"exportEndpoints":{"claude":"/api/rules/openfga-contextual-tuple-rebac-barrier?format=claude","cursorMdc":"/api/rules/openfga-contextual-tuple-rebac-barrier?format=mdc","cursorrules":"/api/rules/openfga-contextual-tuple-rebac-barrier?format=cursor","windsurf":"/api/rules/openfga-contextual-tuple-rebac-barrier?format=windsurf","agents":"/api/rules/openfga-contextual-tuple-rebac-barrier?format=agents"}},{"id":"react-19-actions-optimistic-state-rollback-invariants","title":"React 19 Actions and Optimistic State Rollback Invariants","category":"frontend","severity":"critical","description":"Enforces strict transactional boundaries for React 19 optimistic mutations using useOptimistic and useActionState inside concurrent transitions. Eliminates silent data drift, UI tearing, and race conditions caused by manual ad-hoc rollback mechanisms.","antiPatternHeadline":"Imperative State Rollback via Ad-Hoc useState/useRef Bypassing React 19 Transition Lifecycles","stars_count":114,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["react-19","actions","use-optimistic","use-action-state","concurrency","transactions"],"exportEndpoints":{"claude":"/api/rules/react-19-actions-optimistic-state-rollback-invariants?format=claude","cursorMdc":"/api/rules/react-19-actions-optimistic-state-rollback-invariants?format=mdc","cursorrules":"/api/rules/react-19-actions-optimistic-state-rollback-invariants?format=cursor","windsurf":"/api/rules/react-19-actions-optimistic-state-rollback-invariants?format=windsurf","agents":"/api/rules/react-19-actions-optimistic-state-rollback-invariants?format=agents"}},{"id":"svelte-5-runes-effect-root-memory-barrier","title":"Svelte 5 Runes: Explicit Cleanup Boundaries for Dynamic $effect.root Outside Component Tree","category":"frontend","severity":"critical","description":"Enforces strict explicit cleanup boundaries and deterministic disposal contracts on dynamic $effect.root instances created outside standard component trees. Prevents signal dependency retention, orphaned subscriptions, and catastrophic heap exhaustion in long-lived SSR instances and detached stateful singletons.","antiPatternHeadline":"Orphaned $effect.root allocations in shared modules and SSR contexts without lifecycle-bound teardown handlers.","stars_count":107,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","memory-leaks","ssr","reactive-signals"],"exportEndpoints":{"claude":"/api/rules/svelte-5-runes-effect-root-memory-barrier?format=claude","cursorMdc":"/api/rules/svelte-5-runes-effect-root-memory-barrier?format=mdc","cursorrules":"/api/rules/svelte-5-runes-effect-root-memory-barrier?format=cursor","windsurf":"/api/rules/svelte-5-runes-effect-root-memory-barrier?format=windsurf","agents":"/api/rules/svelte-5-runes-effect-root-memory-barrier?format=agents"}},{"id":"axum-tower-graceful-inflight-request-drain-guardrail","title":"Axum 0.8 Tower Service Graceful In-Flight Request Drain Guardrail","category":"backend","severity":"critical","description":"Enforces deterministic connection draining and cancellation token propagation across streaming HTTP/2, HTTP/3, and WebSocket channels during zero-downtime container rollouts in Axum 0.8. Prevents abrupt socket termination and state corruption by coordinating OS signal interception with tokio-util CancellationToken injection into Tower layered services. Guarantees that short-lived requests complete within a bounded deadline while long-lived bidirectional streams receive protocol-level close frames.","antiPatternHeadline":"Hard-aborted async streams and hung container deployments caused by uncoordinated axum::serve graceful_shutdown hooks.","stars_count":73,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tower","tokio","zero-downtime","http3","websockets"],"exportEndpoints":{"claude":"/api/rules/axum-tower-graceful-inflight-request-drain-guardrail?format=claude","cursorMdc":"/api/rules/axum-tower-graceful-inflight-request-drain-guardrail?format=mdc","cursorrules":"/api/rules/axum-tower-graceful-inflight-request-drain-guardrail?format=cursor","windsurf":"/api/rules/axum-tower-graceful-inflight-request-drain-guardrail?format=windsurf","agents":"/api/rules/axum-tower-graceful-inflight-request-drain-guardrail?format=agents"}},{"id":"pg17-logical-replication-rls-sync","title":"Postgres 17 Logical Replication Tenant RLS Synchronization and Boundary Enforcement","category":"backend","severity":"critical","description":"PostgreSQL logical replication worker processes bypass Row-Level Security (RLS) by default on subscriber tables unless explicitly governed by publication row filters, replica RLS policies, and non-superuser subscription owners. This rule enforces cryptographic tenant boundary propagation across logical replication streams, requiring explicit publication `WHERE` clauses, subscriber-side `FORCE ROW LEVEL SECURITY`, and consumer session context hydration to prevent cross-tenant data leaks in CDC downstream systems.","antiPatternHeadline":"Unfiltered Logical Publications Replicating Global Data to RLS-Disabled Read Replicas","stars_count":102,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","postgres-17","logical-replication","row-level-security","multi-tenancy","cdc"],"exportEndpoints":{"claude":"/api/rules/pg17-logical-replication-rls-sync?format=claude","cursorMdc":"/api/rules/pg17-logical-replication-rls-sync?format=mdc","cursorrules":"/api/rules/pg17-logical-replication-rls-sync?format=cursor","windsurf":"/api/rules/pg17-logical-replication-rls-sync?format=windsurf","agents":"/api/rules/pg17-logical-replication-rls-sync?format=agents"}},{"id":"go-fips140-3-crypto-toolchain-boundary","title":"Go 1.24 FIPS 140-3 Cryptographic Toolchain Strict Boundary","category":"backend","severity":"critical","description":"Mandates compile-time build tags and fail-closed runtime module assertions to enforce Go 1.24+ FIPS 140-3 cryptographic boundaries. Prevents silent runtime fallbacks to unapproved standard library primitives or non-certified third-party cryptography in regulated zero-trust services.","antiPatternHeadline":"Silent Fallback to Non-Approved Cryptographic Primitives and Permissive FIPS Module Fallback","stars_count":117,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","golang","go124","fips140-3","cryptography","zero-trust","compliance"],"exportEndpoints":{"claude":"/api/rules/go-fips140-3-crypto-toolchain-boundary?format=claude","cursorMdc":"/api/rules/go-fips140-3-crypto-toolchain-boundary?format=mdc","cursorrules":"/api/rules/go-fips140-3-crypto-toolchain-boundary?format=cursor","windsurf":"/api/rules/go-fips140-3-crypto-toolchain-boundary?format=windsurf","agents":"/api/rules/go-fips140-3-crypto-toolchain-boundary?format=agents"}},{"id":"swift-6-complete-concurrency-offline-storage","title":"Swift 6 Complete Concurrency Invariant: Database Handle & Entity Actor Isolation","category":"mobile","severity":"critical","description":"Enforces complete compile-time concurrency safety under Swift 6 for offline-first storage architectures. Forbids passing non-Sendable native database handles, live record pointers, and mutable model contexts across actor boundaries into background replication or synchronization subsystems.","antiPatternHeadline":"Leaking Non-Sendable Database Pointers or Managed Context Objects Across Actor Boundaries","stars_count":96,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","swift6","concurrency","offline-first","sqlite","actors"],"exportEndpoints":{"claude":"/api/rules/swift-6-complete-concurrency-offline-storage?format=claude","cursorMdc":"/api/rules/swift-6-complete-concurrency-offline-storage?format=mdc","cursorrules":"/api/rules/swift-6-complete-concurrency-offline-storage?format=cursor","windsurf":"/api/rules/swift-6-complete-concurrency-offline-storage?format=windsurf","agents":"/api/rules/swift-6-complete-concurrency-offline-storage?format=agents"}},{"id":"webauthn-device-bound-session-assertion-invariant","title":"WebAuthn Device-Bound Session Assertion (DBA) Re-Authentication Invariant","category":"security","severity":"critical","description":"Cryptographically enforces adversary-in-the-middle (AiTM) session hijacking mitigation by binding continuous refresh-token rotations to hardware-backed platform authenticator assertions. Refresh token exchanges must require a fresh, server-issued cryptographic challenge signed by the registered WebAuthn credential keypair, strictly validating origin, RP ID, and signature counters before issuing subsequent credentials.","antiPatternHeadline":"Decoupling Refresh Token Rotation from Hardware-Backed WebAuthn Cryptographic Signatures","stars_count":59,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","dbsa","fido2","session-management","aitm-mitigation","cryptography"],"exportEndpoints":{"claude":"/api/rules/webauthn-device-bound-session-assertion-invariant?format=claude","cursorMdc":"/api/rules/webauthn-device-bound-session-assertion-invariant?format=mdc","cursorrules":"/api/rules/webauthn-device-bound-session-assertion-invariant?format=cursor","windsurf":"/api/rules/webauthn-device-bound-session-assertion-invariant?format=windsurf","agents":"/api/rules/webauthn-device-bound-session-assertion-invariant?format=agents"}},{"id":"spiffe-spire-x509-svid-rotation-barrier-standard","title":"Ephemeral X.509 SVID Non-Disruptive Zero-Trust Dynamic Rotation Guardrail","category":"security","severity":"critical","description":"Enforces hot-reloading of SPIFFE X.509 SVID certificates streamed via the SPIRE Workload API into running TLS listeners and client pools without restarting TCP transports. Guarantees that sub-hour ephemeral identities rotate atomically in-memory using dynamic TLS context callbacks while existing sessions drain naturally and subsequent handshakes adopt newly issued credentials. Prevents transient connection resets, handshake timeouts, and expired certificate outages across hybrid multi-cloud service meshes.","antiPatternHeadline":"Static Startup Certificate Initialization and Destructive Listener Restarts During Sub-Hour SVID Expiration","stars_count":118,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","spiffe","spire","zero-trust","mtls","tls","x509","rotation"],"exportEndpoints":{"claude":"/api/rules/spiffe-spire-x509-svid-rotation-barrier-standard?format=claude","cursorMdc":"/api/rules/spiffe-spire-x509-svid-rotation-barrier-standard?format=mdc","cursorrules":"/api/rules/spiffe-spire-x509-svid-rotation-barrier-standard?format=cursor","windsurf":"/api/rules/spiffe-spire-x509-svid-rotation-barrier-standard?format=windsurf","agents":"/api/rules/spiffe-spire-x509-svid-rotation-barrier-standard?format=agents"}},{"id":"kubernetes-inplace-pod-resizing-cgroupv2-invariant","title":"Kubernetes In-Place Pod Vertical Scaling and cgroup v2 Resizing Invariant","category":"devops","severity":"critical","description":"Enforces deterministic in-place pod vertical scaling patterns without triggering container restarts, cgroup freeze stalls, or sudden OOM kills under cgroup v2. Mandates explicit container resize policies, status-aware transition checks, and strict validation against active memory working sets.","antiPatternHeadline":"Patching Pod resource limits without NotRequired resize policies and active memory headroom checks, causing container restarts and OOM kills","stars_count":109,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","kubernetes","cgroups-v2","autoscaling","resource-management","performance"],"exportEndpoints":{"claude":"/api/rules/kubernetes-inplace-pod-resizing-cgroupv2-invariant?format=claude","cursorMdc":"/api/rules/kubernetes-inplace-pod-resizing-cgroupv2-invariant?format=mdc","cursorrules":"/api/rules/kubernetes-inplace-pod-resizing-cgroupv2-invariant?format=cursor","windsurf":"/api/rules/kubernetes-inplace-pod-resizing-cgroupv2-invariant?format=windsurf","agents":"/api/rules/kubernetes-inplace-pod-resizing-cgroupv2-invariant?format=agents"}},{"id":"react-19-rsc-streaming-serialization-resiliency-standard","title":"React 19 Server Components Streaming Serialization Resiliency Standard","category":"frontend","severity":"critical","description":"Enforces deterministic error handling and serialization boundaries across deep React Server Component (RSC) trees. Guarantees that unhandled promise rejections and non-serializable payload failures yield stable React Suspense/Error Boundary fallback chunks rather than terminating the HTTP chunked transfer-encoding stream mid-flight. Eliminates connection resets, malformed RSC payload wire states, and silent client-side hydration crashes in streaming environments.","antiPatternHeadline":"Streaming Unhandled Promise Rejections and Non-Serializable Types Across RSC Boundaries","stars_count":102,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","rsc","streaming","suspense","serialization","nextjs"],"exportEndpoints":{"claude":"/api/rules/react-19-rsc-streaming-serialization-resiliency-standard?format=claude","cursorMdc":"/api/rules/react-19-rsc-streaming-serialization-resiliency-standard?format=mdc","cursorrules":"/api/rules/react-19-rsc-streaming-serialization-resiliency-standard?format=cursor","windsurf":"/api/rules/react-19-rsc-streaming-serialization-resiliency-standard?format=windsurf","agents":"/api/rules/react-19-rsc-streaming-serialization-resiliency-standard?format=agents"}},{"id":"wasmgc-host-thread-memory-isolation-guardrail","title":"WebAssembly WasmGC Host-Thread Isolation and Cross-Heap Reference Bounds","category":"frontend","severity":"critical","description":"Enforces strict process and thread boundaries between the browser UI thread and garbage-collected WebAssembly (WasmGC) runtimes. Mandates execution within dedicated Web Workers and forbids retaining strong bidirectional host-guest references that trigger cross-heap cycles, main-thread jank, and uncollectable memory leaks.","antiPatternHeadline":"Executing WasmGC modules synchronously on the UI thread while retaining circular JS-to-Wasm externref references","stars_count":109,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","webassembly","wasmgc","web-workers","memory-management","concurrency"],"exportEndpoints":{"claude":"/api/rules/wasmgc-host-thread-memory-isolation-guardrail?format=claude","cursorMdc":"/api/rules/wasmgc-host-thread-memory-isolation-guardrail?format=mdc","cursorrules":"/api/rules/wasmgc-host-thread-memory-isolation-guardrail?format=cursor","windsurf":"/api/rules/wasmgc-host-thread-memory-isolation-guardrail?format=windsurf","agents":"/api/rules/wasmgc-host-thread-memory-isolation-guardrail?format=agents"}},{"id":"axum-tower-task-cancellation-reclamation-standard","title":"Axum 0.8 Tower Task Cancellation and Resource Reclamation Standard","category":"backend","severity":"critical","description":"Enforces strict cancellation propagation and RAII resource reclamation across Axum 0.8 handlers and Tower middleware stacks. Prevents connection leaks, orphaned database transactions, and CPU waste by ensuring Tokio futures abort safely upon client TCP termination or HTTP/2 stream reset. Mandates explicit cancellation token boundaries for intentional detached background tasks.","antiPatternHeadline":"Detached Tokio Spawns and Non-RAII Async State Causing Zombie Queries and Leaked Connection Leases on Client Disconnect","stars_count":116,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tokio","tower","cancellation-safety","resource-management"],"exportEndpoints":{"claude":"/api/rules/axum-tower-task-cancellation-reclamation-standard?format=claude","cursorMdc":"/api/rules/axum-tower-task-cancellation-reclamation-standard?format=mdc","cursorrules":"/api/rules/axum-tower-task-cancellation-reclamation-standard?format=cursor","windsurf":"/api/rules/axum-tower-task-cancellation-reclamation-standard?format=windsurf","agents":"/api/rules/axum-tower-task-cancellation-reclamation-standard?format=agents"}},{"id":"pg17-streaming-io-prefetch-guardrail","title":"PostgreSQL 17 Streaming I/O Vector Prefetch Memory Guardrails","category":"backend","severity":"critical","description":"PostgreSQL 17 introduces an asynchronous streaming I/O subsystem with vectorized sequential reads and vectorized index scans. Uncontrolled vector prefetch concurrency and unconstrained worker allocation cause kernel page-cache churn and buffer table lock contention under heavy analytics workloads. Applications and migration harnesses must enforce deterministic concurrency ceilings, session-scoped prefetch limits, and explicit memory bounds per parallel worker.","antiPatternHeadline":"Unbounded parallel vector prefetch and global default io_combine_limit inducing kernel page-cache thrashing","stars_count":100,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","performance","database","sql","io"],"exportEndpoints":{"claude":"/api/rules/pg17-streaming-io-prefetch-guardrail?format=claude","cursorMdc":"/api/rules/pg17-streaming-io-prefetch-guardrail?format=mdc","cursorrules":"/api/rules/pg17-streaming-io-prefetch-guardrail?format=cursor","windsurf":"/api/rules/pg17-streaming-io-prefetch-guardrail?format=windsurf","agents":"/api/rules/pg17-streaming-io-prefetch-guardrail?format=agents"}},{"id":"bun-ffi-pointer-lifecycle-invariant","title":"Bun 1.2 Zero-Copy Buffer C-FFI Pointer Lifecycle Invariant","category":"backend","severity":"critical","description":"Enforces strict pinning and deterministic lifecycle management of off-heap memory buffers passed across Bun's JavaScript runtime and native C-FFI boundaries. JavaScriptCore GC compaction can relocate or collect backed ArrayBuffers, causing use-after-free conditions and memory corruption when native async C code dereferences raw pointers.","antiPatternHeadline":"Ephemeral TypedArray Pointer Passing to Asynchronous C-FFI Invocations","stars_count":84,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","ffi","memory-safety","zero-copy","pointers"],"exportEndpoints":{"claude":"/api/rules/bun-ffi-pointer-lifecycle-invariant?format=claude","cursorMdc":"/api/rules/bun-ffi-pointer-lifecycle-invariant?format=mdc","cursorrules":"/api/rules/bun-ffi-pointer-lifecycle-invariant?format=cursor","windsurf":"/api/rules/bun-ffi-pointer-lifecycle-invariant?format=windsurf","agents":"/api/rules/bun-ffi-pointer-lifecycle-invariant?format=agents"}},{"id":"kmp-swift6-strict-concurrency-actor-bridge-kotlin-multiplat-967","title":"Kotlin Multiplatform to Swift 6 Strict Concurrency Actor Bridge Protocol","category":"mobile","severity":"critical","description":"Eliminates cross-runtime data races and Swift 6 complete concurrency diagnostics when bridging Kotlin Coroutines StateFlow emissions to native iOS UI layers. Mandates explicit actor isolation, Sendable boundary enforcement, and AsyncStream-based ingestion to prevent non-isolated memory corruption across the Kotlin/Native and Swift runtime boundary.","antiPatternHeadline":"Unchecked Raw Interop Flow Collection Across Swift 6 Actor Boundaries Causing Thread Sanitizer Violations and UI State Corruption","stars_count":115,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","swift6","concurrency","actors","stateflow","ios"],"exportEndpoints":{"claude":"/api/rules/kmp-swift6-strict-concurrency-actor-bridge-kotlin-multiplat-967?format=claude","cursorMdc":"/api/rules/kmp-swift6-strict-concurrency-actor-bridge-kotlin-multiplat-967?format=mdc","cursorrules":"/api/rules/kmp-swift6-strict-concurrency-actor-bridge-kotlin-multiplat-967?format=cursor","windsurf":"/api/rules/kmp-swift6-strict-concurrency-actor-bridge-kotlin-multiplat-967?format=windsurf","agents":"/api/rules/kmp-swift6-strict-concurrency-actor-bridge-kotlin-multiplat-967?format=agents"}},{"id":"tauri2-webview-memory-quarantine-lifecycle-standard","title":"Tauri 2.0 Webview Process Memory Quarantine and Lifecycle Teardown","category":"mobile","severity":"critical","description":"Mandates strict multi-window process boundary isolation, explicit channel disposal, and deterministic teardown protocols across Tauri 2.0 desktop and mobile webviews. Prevents cross-webview state bleeding, lingering Rust-to-JS event listeners, and uncollected native-DOM bridge memory in suspended and closed webview instances.","antiPatternHeadline":"Implicit Webview Destruction with Orphaned Rust Event Listeners and Leaked Native Process State","stars_count":100,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri","memory-isolation","webview-lifecycle","process-quarantine","rust"],"exportEndpoints":{"claude":"/api/rules/tauri2-webview-memory-quarantine-lifecycle-standard?format=claude","cursorMdc":"/api/rules/tauri2-webview-memory-quarantine-lifecycle-standard?format=mdc","cursorrules":"/api/rules/tauri2-webview-memory-quarantine-lifecycle-standard?format=cursor","windsurf":"/api/rules/tauri2-webview-memory-quarantine-lifecycle-standard?format=windsurf","agents":"/api/rules/tauri2-webview-memory-quarantine-lifecycle-standard?format=agents"}},{"id":"caep-sse-session-revocation-standard","title":"Continuous Access Evaluation Protocol (CAEP) Sub-Second Session Revocation Standard","category":"security","severity":"critical","description":"Enforces real-time push-based session invalidation and Continuous Access Evaluation Protocol (CAEP) Security Event Token (SET) processing across federated microservices. Mandates sub-millisecond local eviction cache lookups and cryptographically verified JWS SET ingestion to eliminate the revocation latency of stateless JWTs without relying on polling.","antiPatternHeadline":"Relying on Stateless JWT Expiration and Polling Instead of Cryptographically Verified CAEP Event Streams","stars_count":87,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","caep","sse","jwt-revocation","zero-trust","openid-shared-signals"],"exportEndpoints":{"claude":"/api/rules/caep-sse-session-revocation-standard?format=claude","cursorMdc":"/api/rules/caep-sse-session-revocation-standard?format=mdc","cursorrules":"/api/rules/caep-sse-session-revocation-standard?format=cursor","windsurf":"/api/rules/caep-sse-session-revocation-standard?format=windsurf","agents":"/api/rules/caep-sse-session-revocation-standard?format=agents"}},{"id":"spiffe-spire-hardware-workload-identity-federation","title":"Hardware-Attested SPIFFE/SPIRE Workload Identity & Cross-Domain Federation Standard","category":"security","severity":"critical","description":"Enforces short-lived, hardware-rooted (TPM 2.0 / platform attestation) X.509 SVID credentials obtained dynamically via the local SPIRE Workload API. Strictly prohibits static long-lived cross-cluster API keys, shared secrets, and unrotated credentials in multi-cloud mesh architectures.","antiPatternHeadline":"Hardcoding Static Cross-Cluster API Keys or Using Ephemeral In-Memory Secrets Lacking Hardware-Rooted Attestation","stars_count":109,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","spiffe","spire","zero-trust","cryptography","mtls","tpm"],"exportEndpoints":{"claude":"/api/rules/spiffe-spire-hardware-workload-identity-federation?format=claude","cursorMdc":"/api/rules/spiffe-spire-hardware-workload-identity-federation?format=mdc","cursorrules":"/api/rules/spiffe-spire-hardware-workload-identity-federation?format=cursor","windsurf":"/api/rules/spiffe-spire-hardware-workload-identity-federation?format=windsurf","agents":"/api/rules/spiffe-spire-hardware-workload-identity-federation?format=agents"}},{"id":"karpenter-v1-nodepool-drain-topology-spread","title":"Karpenter v1.0 Spot Drain, Topology Spread, and Disruption Budget Guardrail","category":"devops","severity":"critical","description":"Enforces strict synchronization between Karpenter v1.0 NodePool disruption policies, workload PodDisruptionBudgets (PDBs), and multi-zone topologySpreadConstraints. Prevents catastrophic cascading downtime and scheduling deadlocks caused by concurrent Spot reclamation, aggressive consolidation, and unfulfillable hard scheduling anti-affinities.","antiPatternHeadline":"Aggressive Spot Consolidation Clashing with Hard Topology Constraints and Misconfigured PDBs","stars_count":108,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","karpenter","kubernetes","spot-instances","topology-spread","high-availability"],"exportEndpoints":{"claude":"/api/rules/karpenter-v1-nodepool-drain-topology-spread?format=claude","cursorMdc":"/api/rules/karpenter-v1-nodepool-drain-topology-spread?format=mdc","cursorrules":"/api/rules/karpenter-v1-nodepool-drain-topology-spread?format=cursor","windsurf":"/api/rules/karpenter-v1-nodepool-drain-topology-spread?format=windsurf","agents":"/api/rules/karpenter-v1-nodepool-drain-topology-spread?format=agents"}},{"id":"axum-bounded-body-streaming-task-cancellation","title":"Axum 0.8 Bounded Body Streaming and Task Cancellation Guardrail","category":"backend","severity":"critical","description":"Enforces deterministic bounded streaming and task cancellation semantics in Axum 0.8 HTTP services. Guarantees immediate reclamation of intermediate request body buffers and aborts background processing upon client disconnect, eliminating silent Tokio task leakage and memory amplification under high concurrency.","antiPatternHeadline":"Unbounded Stream Buffering and Detached Tokio Tasks Leading to Memory Amplification and Silent Task Leakage on Client Disconnect","stars_count":60,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tokio","concurrency","memory-leak"],"exportEndpoints":{"claude":"/api/rules/axum-bounded-body-streaming-task-cancellation?format=claude","cursorMdc":"/api/rules/axum-bounded-body-streaming-task-cancellation?format=mdc","cursorrules":"/api/rules/axum-bounded-body-streaming-task-cancellation?format=cursor","windsurf":"/api/rules/axum-bounded-body-streaming-task-cancellation?format=windsurf","agents":"/api/rules/axum-bounded-body-streaming-task-cancellation?format=agents"}},{"id":"vite6-environment-api-runtime-isolation-boundary-vite-6-environme-855","title":"Vite 6 Environment API Cross-Runtime Module Isolation Boundary","category":"frontend","severity":"critical","description":"Mandates strict runtime module-resolution barriers between Edge, Node.js, and Browser execution graphs using Vite 6's Environment API. Eliminates Node built-in leakage, prevents isomorphic runtime pollution, and guarantees deterministic bundle isolation across heterogeneous target runtimes.","antiPatternHeadline":"Leaking Node.js Built-ins and Shared Module Graph Contamination via Imperfect SSR Separation","stars_count":106,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","vite6","environment-api","module-isolation","ssr","edge-runtime"],"exportEndpoints":{"claude":"/api/rules/vite6-environment-api-runtime-isolation-boundary-vite-6-environme-855?format=claude","cursorMdc":"/api/rules/vite6-environment-api-runtime-isolation-boundary-vite-6-environme-855?format=mdc","cursorrules":"/api/rules/vite6-environment-api-runtime-isolation-boundary-vite-6-environme-855?format=cursor","windsurf":"/api/rules/vite6-environment-api-runtime-isolation-boundary-vite-6-environme-855?format=windsurf","agents":"/api/rules/vite6-environment-api-runtime-isolation-boundary-vite-6-environme-855?format=agents"}},{"id":"kmp-swift-concurrency-continuation-bridging","title":"KMP Coroutine to Swift 6 Structured Concurrency Continuation Bridging Guardrails","category":"mobile","severity":"critical","description":"Enforces deterministic cancellation and strict single-resumption invariants when bridging Kotlin 2.1 suspend coroutines into Swift 6 async/await Task hierarchies. Prevents fatal runtime traps, memory leaks, and cooperative thread pool starvations caused by dropped or duplicated CheckedContinuations and unlinked Kotlin Job handles on iOS.","antiPatternHeadline":"Dangling CheckedContinuations and Unpropagated Swift 6 Task Cancellations Inducing Thread Exhaustion and Memory Leaks","stars_count":66,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","kmp","swift-6","concurrency","ios","coroutines"],"exportEndpoints":{"claude":"/api/rules/kmp-swift-concurrency-continuation-bridging?format=claude","cursorMdc":"/api/rules/kmp-swift-concurrency-continuation-bridging?format=mdc","cursorrules":"/api/rules/kmp-swift-concurrency-continuation-bridging?format=cursor","windsurf":"/api/rules/kmp-swift-concurrency-continuation-bridging?format=windsurf","agents":"/api/rules/kmp-swift-concurrency-continuation-bridging?format=agents"}},{"id":"hybrid-pq-tls-mlkem-downgrade-defense","title":"Hybrid Post-Quantum TLS 1.3 Key Exchange (X25519MLKEM768) and Strict Downgrade Defense","category":"security","severity":"critical","description":"Mandates quantum-resilient hybrid key encapsulation mechanisms (X25519MLKEM768 / X25519Kyber768Draft00) across all ingress reverse proxies, load balancers, and external service runtimes to thwart 'harvest-now-decrypt-later' (HNDL) vectors. Explicitly disallows fallback to classical-only key exchanges (pure ECDHE/DHE) or legacy TLS versions (< TLS 1.3) on external trust boundaries. Enforces runtime verification of negotiated cipher suites and group allocations.","antiPatternHeadline":"Accepting Classical-Only Key Exchange or Allowing Pre-TLS 1.3 Downgrades on External Ingress","stars_count":49,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","cryptography","post-quantum","tls1.3","ml-kem","kyber","zero-trust"],"exportEndpoints":{"claude":"/api/rules/hybrid-pq-tls-mlkem-downgrade-defense?format=claude","cursorMdc":"/api/rules/hybrid-pq-tls-mlkem-downgrade-defense?format=mdc","cursorrules":"/api/rules/hybrid-pq-tls-mlkem-downgrade-defense?format=cursor","windsurf":"/api/rules/hybrid-pq-tls-mlkem-downgrade-defense?format=windsurf","agents":"/api/rules/hybrid-pq-tls-mlkem-downgrade-defense?format=agents"}},{"id":"pgvector-partition-hnsw-memory-bounding-production-standard","title":"Postgres 17 pgvector Partition-Local HNSW Index Memory Bounding","category":"backend","severity":"critical","description":"Enforces strict partition-local memory isolation and dynamic maintenance_work_mem budgeting when generating Hierarchical Navigable Small World (HNSW) vector graph indexes on partitioned tables in Postgres 17. Prevents host kernel out-of-memory (OOM) killer invocations by disallowing global index creation across parent partitioned tables and bounding per-worker memory during parallel backfills.","antiPatternHeadline":"Global Unbounded HNSW Indexing on Parent Partitioned Tables Triggering OOM Terminations","stars_count":116,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres","pgvector","database","hnsw","vector-search","performance"],"exportEndpoints":{"claude":"/api/rules/pgvector-partition-hnsw-memory-bounding-production-standard?format=claude","cursorMdc":"/api/rules/pgvector-partition-hnsw-memory-bounding-production-standard?format=mdc","cursorrules":"/api/rules/pgvector-partition-hnsw-memory-bounding-production-standard?format=cursor","windsurf":"/api/rules/pgvector-partition-hnsw-memory-bounding-production-standard?format=windsurf","agents":"/api/rules/pgvector-partition-hnsw-memory-bounding-production-standard?format=agents"}},{"id":"ebpf-cgroupv2-psi-memory-stall-pod-throttling","title":"eBPF Cgroup v2 PSI-Driven Memory Stall Proactive Pod Throttling","category":"devops","severity":"critical","description":"Mandates kernel-level Pressure Stall Information (PSI) monitoring via eBPF on cgroup v2 hierarchies to proactively shed non-critical background jobs, telemetry, and caches before the Linux kernel OOM killer triggers. Prevents catastrophic OOM kill loops (exit code 137) and kernel direct reclaim CPU starvation through cooperative application-level backpressure.","antiPatternHeadline":"Relying on static RSS threshold polling or passive OOM-killer invocations instead of kernel memory pressure stall signals","stars_count":117,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","cgroupv2","psi","kubernetes","memory-management","resilience"],"exportEndpoints":{"claude":"/api/rules/ebpf-cgroupv2-psi-memory-stall-pod-throttling?format=claude","cursorMdc":"/api/rules/ebpf-cgroupv2-psi-memory-stall-pod-throttling?format=mdc","cursorrules":"/api/rules/ebpf-cgroupv2-psi-memory-stall-pod-throttling?format=cursor","windsurf":"/api/rules/ebpf-cgroupv2-psi-memory-stall-pod-throttling?format=windsurf","agents":"/api/rules/ebpf-cgroupv2-psi-memory-stall-pod-throttling?format=agents"}},{"id":"nextjs-15-ppr-dynamic-hole-isolation-next-js-15-parti-864","title":"Next.js 15 PPR Dynamic Hole Boundary Isolation & Static Shell Preservation","category":"frontend","severity":"critical","description":"Enforces strict isolation of runtime dynamic I/O (cookies, headers, uncached data) inside localized React Suspense boundaries under Next.js 15 Partial Prerendering (PPR). Guarantees an immutable static document shell emitted at build time for sub-50ms edge TTFB while streaming dynamic holes concurrently without execution waterfalls.","antiPatternHeadline":"Dynamic API Hoisting De-optimizing Static Shells into Blocking Dynamic SSR","stars_count":74,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs-15","ppr","react-suspense","streaming-ssr","ttfb-optimization"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-ppr-dynamic-hole-isolation-next-js-15-parti-864?format=claude","cursorMdc":"/api/rules/nextjs-15-ppr-dynamic-hole-isolation-next-js-15-parti-864?format=mdc","cursorrules":"/api/rules/nextjs-15-ppr-dynamic-hole-isolation-next-js-15-parti-864?format=cursor","windsurf":"/api/rules/nextjs-15-ppr-dynamic-hole-isolation-next-js-15-parti-864?format=windsurf","agents":"/api/rules/nextjs-15-ppr-dynamic-hole-isolation-next-js-15-parti-864?format=agents"}},{"id":"go-chi-zero-alloc-deadline-enforcement","title":"Go Chi Zero-Allocation Context-Propagated Deadline Enforcement","category":"backend","severity":"critical","description":"Enforces strict downstream deadline propagation, zero-allocation context key architectures, and fail-fast cancellation across Go Chi HTTP routing chains. Eliminates runaway background goroutines and thread pool exhaustion during cascading downstream microservice outages. Guarantees that request lifetimes, tracing baggage, and database/RPC calls unconditionally respect parent context deadlines without escaping to the heap.","antiPatternHeadline":"Orphaned Request Contexts, Heap-Allocated Context Keys, and Unbounded Runaway Goroutines","stars_count":79,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","chi","context","performance","goroutines","resilience"],"exportEndpoints":{"claude":"/api/rules/go-chi-zero-alloc-deadline-enforcement?format=claude","cursorMdc":"/api/rules/go-chi-zero-alloc-deadline-enforcement?format=mdc","cursorrules":"/api/rules/go-chi-zero-alloc-deadline-enforcement?format=cursor","windsurf":"/api/rules/go-chi-zero-alloc-deadline-enforcement?format=windsurf","agents":"/api/rules/go-chi-zero-alloc-deadline-enforcement?format=agents"}},{"id":"react-native-new-architecture-turbo-jsi-zerocopy-buffer","title":"React Native JSI C++ Zero-Copy Memory Buffer Protocol","category":"mobile","severity":"critical","description":"Eliminates serialization overhead across the Native-to-JS boundary by enforcing direct C++ HostObject shared ArrayBuffer allocations for high-frequency telemetry, video frames, and sensor data. Mandates pointer lifecycle synchronicity to prevent memory leaks and dangling pointer access across concurrent native worker threads and Hermes garbage collector sweeps.","antiPatternHeadline":"Base64 Encoding or Bridge-Serialized Byte Arrays for High-Frequency Frame and Sensor Payloads","stars_count":69,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","react-native","turbo-modules","jsi","cpp","zero-copy","hermes"],"exportEndpoints":{"claude":"/api/rules/react-native-new-architecture-turbo-jsi-zerocopy-buffer?format=claude","cursorMdc":"/api/rules/react-native-new-architecture-turbo-jsi-zerocopy-buffer?format=mdc","cursorrules":"/api/rules/react-native-new-architecture-turbo-jsi-zerocopy-buffer?format=cursor","windsurf":"/api/rules/react-native-new-architecture-turbo-jsi-zerocopy-buffer?format=windsurf","agents":"/api/rules/react-native-new-architecture-turbo-jsi-zerocopy-buffer?format=agents"}},{"id":"workload-identity-federation-session-boundary-production-standard","title":"Enforcing Ephemeral Workload Identity Federation & Step-Scoped Claim Boundaries","category":"devops","severity":"critical","description":"Eliminates static, long-lived CI/CD service account credentials across cloud providers by enforcing short-lived OpenID Connect (OIDC) federation. Invariant policies require strict cryptographic subject claim validation matching repository, ref, and execution environment scopes, coupled with bounded temporary credential issuance restricted to single-pipeline step lifespans.","antiPatternHeadline":"Persisting static long-lived cloud credentials or minting over-privileged wildcard OIDC tokens across CI/CD execution stages","stars_count":74,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","security","iam","oidc","workload-identity","github-actions","aws","gcp"],"exportEndpoints":{"claude":"/api/rules/workload-identity-federation-session-boundary-production-standard?format=claude","cursorMdc":"/api/rules/workload-identity-federation-session-boundary-production-standard?format=mdc","cursorrules":"/api/rules/workload-identity-federation-session-boundary-production-standard?format=cursor","windsurf":"/api/rules/workload-identity-federation-session-boundary-production-standard?format=windsurf","agents":"/api/rules/workload-identity-federation-session-boundary-production-standard?format=agents"}},{"id":"axum-tokio-graceful-cancellation-draining","title":"Axum 0.8 Tokio Cooperative Cancellation Token Propagation and Draining","category":"backend","severity":"critical","description":"Enforces cooperative cancellation token propagation and connection tracking across long-lived Axum 0.8 streaming connections (Server-Sent Events and WebSockets). Prevents uncoordinated termination and leaked Tokio tasks during Kubernetes SIGTERM rolling updates by tracking in-flight streams via CancellationToken trees and graceful shutdown drain sequences.","antiPatternHeadline":"Unbounded Tokio Task Spawning and Detached Loops in Streaming Handlers Causing Hung Deployments and Leaked Connections","stars_count":44,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tokio","concurrency","websockets","sse"],"exportEndpoints":{"claude":"/api/rules/axum-tokio-graceful-cancellation-draining?format=claude","cursorMdc":"/api/rules/axum-tokio-graceful-cancellation-draining?format=mdc","cursorrules":"/api/rules/axum-tokio-graceful-cancellation-draining?format=cursor","windsurf":"/api/rules/axum-tokio-graceful-cancellation-draining?format=windsurf","agents":"/api/rules/axum-tokio-graceful-cancellation-draining?format=agents"}},{"id":"vite6-rolldown-dynamic-sri-chaining","title":"Vite 6 Rolldown Cryptographic Dynamic ESM Chunk Integrity Chaining","category":"frontend","severity":"critical","description":"Enforces strict SHA-384 Subresource Integrity (SRI) validation across all static entry points and asynchronously imported ESM chunks compiled by Vite 6 and Rolldown. Guarantees an unbroken cryptographic chain of trust from initial HTML bootstrapping through runtime dynamic imports to prevent CDN supply-chain tampering and cache poisoning.","antiPatternHeadline":"Unvalidated Dynamic ESM Imports Permitting Malicious CDN Script Replacement","stars_count":106,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["vite6","rolldown","subresource-integrity","esm-security","supply-chain-security","cdn-hardening"],"exportEndpoints":{"claude":"/api/rules/vite6-rolldown-dynamic-sri-chaining?format=claude","cursorMdc":"/api/rules/vite6-rolldown-dynamic-sri-chaining?format=mdc","cursorrules":"/api/rules/vite6-rolldown-dynamic-sri-chaining?format=cursor","windsurf":"/api/rules/vite6-rolldown-dynamic-sri-chaining?format=windsurf","agents":"/api/rules/vite6-rolldown-dynamic-sri-chaining?format=agents"}},{"id":"capacitor-7-hardware-secure-enclave-pinning","title":"Capacitor 7 Hardware-Backed Secure Enclave & Keystore Cryptographic Pinning","category":"mobile","severity":"critical","description":"Enforces storage and cryptographic operations for sensitive credentials inside hardware-backed chips (Apple Secure Enclave, Android StrongBox Keymaster) via native Capacitor 7 bridge interfaces. Prohibits direct transit of raw private keys or plain bearer tokens into the JavaScript WebView heap to eliminate credential scraping from Cross-Site Scripting (XSS) or malicious bridge inspection.","antiPatternHeadline":"Persisting Raw Bearer Tokens in WebView-Accessible Storage or Bridge RAM","stars_count":45,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor-7","secure-enclave","android-keystore","hardware-security","zero-trust"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-hardware-secure-enclave-pinning?format=claude","cursorMdc":"/api/rules/capacitor-7-hardware-secure-enclave-pinning?format=mdc","cursorrules":"/api/rules/capacitor-7-hardware-secure-enclave-pinning?format=cursor","windsurf":"/api/rules/capacitor-7-hardware-secure-enclave-pinning?format=windsurf","agents":"/api/rules/capacitor-7-hardware-secure-enclave-pinning?format=agents"}},{"id":"envoy-gateway-http3-early-data-anti-replay","title":"Envoy Gateway HTTP/3 0-RTT Anti-Replay Defense for Mutation Endpoints","category":"devops","severity":"critical","description":"QUIC 0-RTT connection resumption permits clients to send early application data before the cryptographic handshake concludes, rendering requests vulnerable to network replay across distributed ingress zones. Envoy Gateway configurations and upstream services MUST enforce strict rejection or conditional deferral of non-idempotent HTTP methods (POST, PUT, PATCH, DELETE) arriving via 0-RTT Early-Data headers. Infrastructure and application layers must collaborate using RFC 8470 protocol semantics to guarantee that state-mutating transactions are never executed speculatively without forward secrecy.","antiPatternHeadline":"Executing Non-Idempotent HTTP Mutations over Unvalidated QUIC 0-RTT Early Data","stars_count":87,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","envoy-gateway","http3","quic","anti-replay","zero-rtt","security"],"exportEndpoints":{"claude":"/api/rules/envoy-gateway-http3-early-data-anti-replay?format=claude","cursorMdc":"/api/rules/envoy-gateway-http3-early-data-anti-replay?format=mdc","cursorrules":"/api/rules/envoy-gateway-http3-early-data-anti-replay?format=cursor","windsurf":"/api/rules/envoy-gateway-http3-early-data-anti-replay?format=windsurf","agents":"/api/rules/envoy-gateway-http3-early-data-anti-replay?format=agents"}},{"id":"react-19-server-components-taint-boundary-guardrail","title":"React 19 Server Components Taint Boundary and Secret Leakage Prevention","category":"frontend","severity":"critical","description":"Enforces static and runtime serialization boundaries in React 19 Server Components using experimental_taintObjectReference and experimental_taintUniqueValue. Guarantees that server-only entities, database records, and environment secrets cannot be serialized across the React Server Components (RSC) payload boundary into Client Component trees.","antiPatternHeadline":"Leaking Raw Server Objects or Tokens Across the RSC-to-Client Serialization Boundary","stars_count":40,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","rsc","security","nextjs","taint-api"],"exportEndpoints":{"claude":"/api/rules/react-19-server-components-taint-boundary-guardrail?format=claude","cursorMdc":"/api/rules/react-19-server-components-taint-boundary-guardrail?format=mdc","cursorrules":"/api/rules/react-19-server-components-taint-boundary-guardrail?format=cursor","windsurf":"/api/rules/react-19-server-components-taint-boundary-guardrail?format=windsurf","agents":"/api/rules/react-19-server-components-taint-boundary-guardrail?format=agents"}},{"id":"wasi-0-2-component-model-capability-attenuation-production-standard","title":"WASI 0.2 Component Model Capability Attenuation and Descriptor Confinement","category":"security","severity":"critical","description":"Enforces strict principle-of-least-privilege capability attenuation for untrusted third-party WebAssembly components running under WASI 0.2. Mandates explicit preopened directory sub-tree isolation, read-only descriptor constraints, and complete denial or deterministic proxying of raw socket network capabilities to prevent ambient authority leakage and host compromise.","antiPatternHeadline":"Granting ambient host authority via inherit_stdio, unconstrained filesystem preopens, or unattenuated socket permissions to untrusted guest components.","stars_count":105,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","wasm","wasi-0-2","component-model","sandbox","wasmtime","capability-security"],"exportEndpoints":{"claude":"/api/rules/wasi-0-2-component-model-capability-attenuation-production-standard?format=claude","cursorMdc":"/api/rules/wasi-0-2-component-model-capability-attenuation-production-standard?format=mdc","cursorrules":"/api/rules/wasi-0-2-component-model-capability-attenuation-production-standard?format=cursor","windsurf":"/api/rules/wasi-0-2-component-model-capability-attenuation-production-standard?format=windsurf","agents":"/api/rules/wasi-0-2-component-model-capability-attenuation-production-standard?format=agents"}},{"id":"fastapi-pydantic-bounded-stream-invariant","title":"FastAPI & Pydantic-Core Zero-Copy Bounded Stream Invariant","category":"backend","severity":"critical","description":"Defends asynchronous FastAPI endpoints against memory-inflation and recursion exhaustion Denial of Service (DoS) attacks. Mandates bounded chunked stream consumption with hard byte caps prior to model deserialization and configures pydantic-core depth limits. Prevents monolithic in-memory buffering and stack overflow crashes from malicious deeply nested JSON payloads.","antiPatternHeadline":"Buffering Unbounded HTTP Streams into Monolithic In-Memory Pydantic Deserializers","stars_count":63,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","pydantic","pydantic-core","security","stream-processing"],"exportEndpoints":{"claude":"/api/rules/fastapi-pydantic-bounded-stream-invariant?format=claude","cursorMdc":"/api/rules/fastapi-pydantic-bounded-stream-invariant?format=mdc","cursorrules":"/api/rules/fastapi-pydantic-bounded-stream-invariant?format=cursor","windsurf":"/api/rules/fastapi-pydantic-bounded-stream-invariant?format=windsurf","agents":"/api/rules/fastapi-pydantic-bounded-stream-invariant?format=agents"}},{"id":"kmp-compose-semantics-parity-barrier","title":"KMP Compose Multiplatform Semantics Parity Barrier for Dual-Platform WCAG Compliance","category":"mobile","severity":"critical","description":"Enforces deterministic accessibility semantics tree configuration in Kotlin Multiplatform (Compose Multiplatform) UI components. Bridges behavioral discrepancies between Android AccessibilityNodeInfo and iOS UIAccessibilityElement representations by enforcing descendant merging, explicit semantic roles, and unified state descriptions. Prevents silent screen reader regressions, fragmented accessibility focus rings, and WCAG 2.1/2.2 AA non-compliance across TalkBack and VoiceOver.","antiPatternHeadline":"Fragmented Semantics Hierarchy and Implicit Platform Trait Mapping","stars_count":112,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kmp","compose-multiplatform","accessibility","wcag","talkback","voiceover"],"exportEndpoints":{"claude":"/api/rules/kmp-compose-semantics-parity-barrier?format=claude","cursorMdc":"/api/rules/kmp-compose-semantics-parity-barrier?format=mdc","cursorrules":"/api/rules/kmp-compose-semantics-parity-barrier?format=cursor","windsurf":"/api/rules/kmp-compose-semantics-parity-barrier?format=windsurf","agents":"/api/rules/kmp-compose-semantics-parity-barrier?format=agents"}},{"id":"bun-strict-tls-alpn-service-mesh-downgrade-defense","title":"Bun 1.2 Strict TLS ALPN Service Mesh Downgrade Defense","category":"devops","severity":"critical","description":"Enforces deterministic Application-Layer Protocol Negotiation (ALPN) and post-handshake protocol verification across all internal microservice mTLS sockets in Bun 1.2. Eliminates silent protocol downgrades, TLS stripping, and cross-protocol smuggling by enforcing TLS 1.3, strict mTLS client certificate validation, and zero-tolerance ALPN matching.","antiPatternHeadline":"Permissive mTLS listeners omitting ALPN validation or allowing implicit protocol downgrades in mesh traffic.","stars_count":56,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","bun","tls","alpn","mtls","service-mesh","zero-trust"],"exportEndpoints":{"claude":"/api/rules/bun-strict-tls-alpn-service-mesh-downgrade-defense?format=claude","cursorMdc":"/api/rules/bun-strict-tls-alpn-service-mesh-downgrade-defense?format=mdc","cursorrules":"/api/rules/bun-strict-tls-alpn-service-mesh-downgrade-defense?format=cursor","windsurf":"/api/rules/bun-strict-tls-alpn-service-mesh-downgrade-defense?format=windsurf","agents":"/api/rules/bun-strict-tls-alpn-service-mesh-downgrade-defense?format=agents"}},{"id":"nextjs-15-after-lifecycle-quarantine","title":"Next.js 15 after() Async Execution Quarantine and Error Isolation","category":"frontend","severity":"critical","description":"Ensures background tasks scheduled via Next.js 15's after() cannot cause uncaught exceptions, exceed serverless execution timeouts, or leak resources across requests. Mandates deterministic timeouts, error isolation boundaries, and decoupled telemetry sinks so that deferred post-response work never destabilizes runtime workers.","antiPatternHeadline":"Unbounded, Unhandled Async Execution in Next.js 15 after() Causing Server Worker Crashes and Zombie Runtimes","stars_count":110,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs","nextjs-15","async","after","serverless","runtime-safety"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-after-lifecycle-quarantine?format=claude","cursorMdc":"/api/rules/nextjs-15-after-lifecycle-quarantine?format=mdc","cursorrules":"/api/rules/nextjs-15-after-lifecycle-quarantine?format=cursor","windsurf":"/api/rules/nextjs-15-after-lifecycle-quarantine?format=windsurf","agents":"/api/rules/nextjs-15-after-lifecycle-quarantine?format=agents"}},{"id":"axum-08-hyper-v1-graceful-draining-standard","title":"Axum 0.8 & Hyper v1 Deterministic Graceful Connection Draining","category":"backend","severity":"critical","description":"Enforces deterministic TCP socket teardown, HTTP/1.1 connection draining, and HTTP/2 GOAWAY frame propagation for Axum 0.8 services built on Hyper v1. Eliminates client-perceived TCP resets (ECONNRESET) and 502 Bad Gateway ingress errors during Kubernetes rolling pod deployments.","antiPatternHeadline":"Unbounded or Unguarded Server Teardown Dropping In-Flight Traffic and Active Keep-Alives on SIGTERM","stars_count":101,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","hyper","kubernetes","networking"],"exportEndpoints":{"claude":"/api/rules/axum-08-hyper-v1-graceful-draining-standard?format=claude","cursorMdc":"/api/rules/axum-08-hyper-v1-graceful-draining-standard?format=mdc","cursorrules":"/api/rules/axum-08-hyper-v1-graceful-draining-standard?format=cursor","windsurf":"/api/rules/axum-08-hyper-v1-graceful-draining-standard?format=windsurf","agents":"/api/rules/axum-08-hyper-v1-graceful-draining-standard?format=agents"}},{"id":"go-chi-otel-context-cancellation-guardrail","title":"Go Chi v5 Structured Context Cancellation & OpenTelemetry Lifecycle Propagation","category":"backend","severity":"critical","description":"Enforces deterministic context cancellation propagation across Go Chi v5 HTTP middleware pipelines and downstream RPC/database calls. Prevents orphaned downstream executions, goroutine leaks, and broken OpenTelemetry trace lineage by binding client connection terminations directly to derived execution contexts and span finalization.","antiPatternHeadline":"Detaching r.Context() or Leaking Unbounded Goroutines During Chi HTTP Request Lifecycles","stars_count":106,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","golang","go-chi","opentelemetry","concurrency","goroutine-leak"],"exportEndpoints":{"claude":"/api/rules/go-chi-otel-context-cancellation-guardrail?format=claude","cursorMdc":"/api/rules/go-chi-otel-context-cancellation-guardrail?format=mdc","cursorrules":"/api/rules/go-chi-otel-context-cancellation-guardrail?format=cursor","windsurf":"/api/rules/go-chi-otel-context-cancellation-guardrail?format=windsurf","agents":"/api/rules/go-chi-otel-context-cancellation-guardrail?format=agents"}},{"id":"kmp-compose-metal-swapchain-allocation-guardrail","title":"KMP Compose Multiplatform Metal Swapchain and Texture Allocation Guardrail","category":"mobile","severity":"critical","description":"Enforces pre-allocated, unmanaged Metal texture pools and stable native handles for Skiko rendering pipelines on iOS. Prevents transient CAMetalDrawable allocations within the Kotlin/Native memory manager sweep path, eliminating frame-pacing drops and GC-induced display stutter.","antiPatternHeadline":"Allocating Ephemeral Metal Textures or Skia Surfaces Inside Compose Draw Scopes Subject to Kotlin/Native GC Sweeps","stars_count":102,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kmp","compose-multiplatform","ios","metal","skiko","performance"],"exportEndpoints":{"claude":"/api/rules/kmp-compose-metal-swapchain-allocation-guardrail?format=claude","cursorMdc":"/api/rules/kmp-compose-metal-swapchain-allocation-guardrail?format=mdc","cursorrules":"/api/rules/kmp-compose-metal-swapchain-allocation-guardrail?format=cursor","windsurf":"/api/rules/kmp-compose-metal-swapchain-allocation-guardrail?format=windsurf","agents":"/api/rules/kmp-compose-metal-swapchain-allocation-guardrail?format=agents"}},{"id":"capacitor-7-biometric-hardware-key-isolation","title":"Capacitor 7 Hardware-Backed Biometric Authentication & Cryptographic Attestation Standard","category":"mobile","severity":"critical","description":"Enforces hardware-backed cryptographic key isolation for biometric authentication in Capacitor 7 hybrid mobile applications. Mandates that biometric verification produces an asymmetric hardware-signed challenge-response generated strictly within Apple Secure Enclave or Android StrongBox Keymaster/KeyMint, preventing client-side boolean spoofing and runtime memory tampering via Frida or Objection.","antiPatternHeadline":"Client-Side Boolean Trust Pattern (Vulnerable to Runtime Hooking & Injection)","stars_count":70,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor-7","biometrics","secure-enclave","strongbox","zero-trust","cryptography"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-biometric-hardware-key-isolation?format=claude","cursorMdc":"/api/rules/capacitor-7-biometric-hardware-key-isolation?format=mdc","cursorrules":"/api/rules/capacitor-7-biometric-hardware-key-isolation?format=cursor","windsurf":"/api/rules/capacitor-7-biometric-hardware-key-isolation?format=windsurf","agents":"/api/rules/capacitor-7-biometric-hardware-key-isolation?format=agents"}},{"id":"webauthn-device-bound-attestation-escalation-guardrail","title":"WebAuthn Device-Bound Attestation and Step-Up Escalation Guardrail","category":"security","severity":"critical","description":"Enforces cryptographic verification of WebAuthn attestation statements, authenticator data flags (BE/BS), and AAGUIDs against the FIDO Metadata Service (MDS) during registration and step-up flows. Prevents synced multi-device passkeys from masquerading as hardware-isolated, non-exportable security keys on high-risk transaction escalation boundaries.","antiPatternHeadline":"Accepting Synced Passkeys for Privileged Transactions Without Verifying Backup Eligibility and MDS Attestation Chains","stars_count":97,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","fido2","passkeys","attestation","cryptography","zero-trust"],"exportEndpoints":{"claude":"/api/rules/webauthn-device-bound-attestation-escalation-guardrail?format=claude","cursorMdc":"/api/rules/webauthn-device-bound-attestation-escalation-guardrail?format=mdc","cursorrules":"/api/rules/webauthn-device-bound-attestation-escalation-guardrail?format=cursor","windsurf":"/api/rules/webauthn-device-bound-attestation-escalation-guardrail?format=windsurf","agents":"/api/rules/webauthn-device-bound-attestation-escalation-guardrail?format=agents"}},{"id":"sigstore-slsa3-attestation-admission-invariant","title":"Sigstore Keyless Cryptographic Attestation and SLSA Level 3 Admission Invariant","category":"security","severity":"critical","description":"Enforces pre-deployment verification of SLSA Level 3 provenance, Rekor transparency log inclusion, and keyless Fulcio OIDC cryptographic identity attestations across all container images and serverless artifacts. Artifacts lacking validated in-toto cryptographic supply-chain envelopes or relying on static long-lived signing keys are rejected prior to pipeline promotion or cluster admission.","antiPatternHeadline":"Deploying Untrusted Artifacts via Digest Pinning Alone or Long-Lived Symmetric/Asymmetric Keys Without Transparency Logging","stars_count":96,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","sigstore","cosign","slsa-provenance","in-toto","supply-chain-security","rekor","fulcio"],"exportEndpoints":{"claude":"/api/rules/sigstore-slsa3-attestation-admission-invariant?format=claude","cursorMdc":"/api/rules/sigstore-slsa3-attestation-admission-invariant?format=mdc","cursorrules":"/api/rules/sigstore-slsa3-attestation-admission-invariant?format=cursor","windsurf":"/api/rules/sigstore-slsa3-attestation-admission-invariant?format=windsurf","agents":"/api/rules/sigstore-slsa3-attestation-admission-invariant?format=agents"}},{"id":"ebpf-tc-egress-telemetry-rate-limiting-guardrail","title":"eBPF TC Egress Telemetry Rate-Limiting & Ring Buffer Overflow Guardrail","category":"devops","severity":"critical","description":"Enforces bounded eBPF ring buffer reservations, non-blocking telemetry drops, and token-bucket rate limiting in Traffic Control (TC) egress hook paths. Prevents kernel memory exhaustion, NET_TX softirq CPU starvation, and network egress throughput degradation during high-volume packet bursts. Mandates that telemetry failures never fail open to packet rejection.","antiPatternHeadline":"Unbounded per-packet eBPF ring buffer emissions in TC egress paths without drop counters or sampling, causing packet drop and softirq stalls.","stars_count":42,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","networking","traffic-control","kernel","telemetry"],"exportEndpoints":{"claude":"/api/rules/ebpf-tc-egress-telemetry-rate-limiting-guardrail?format=claude","cursorMdc":"/api/rules/ebpf-tc-egress-telemetry-rate-limiting-guardrail?format=mdc","cursorrules":"/api/rules/ebpf-tc-egress-telemetry-rate-limiting-guardrail?format=cursor","windsurf":"/api/rules/ebpf-tc-egress-telemetry-rate-limiting-guardrail?format=windsurf","agents":"/api/rules/ebpf-tc-egress-telemetry-rate-limiting-guardrail?format=agents"}},{"id":"axum-tokio-cancellation-token-stream-draining","title":"Axum 0.8 Cooperative SSE and WebSocket Stream Draining via Tokio CancellationToken","category":"backend","severity":"critical","description":"Mandates cooperative stream draining using tokio_util::sync::CancellationToken and bounded timeouts for Axum 0.8 long-lived SSE and WebSocket connections. Ensures graceful close frame dispatching, buffer flushes, and state finalization without abrupt socket severance or infinite shutdown hangs.","antiPatternHeadline":"Abrupt Socket Severance and Unbounded Process Leaks via Uncoordinated Stream Drops During Shutdown","stars_count":77,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["rust","axum","tokio","websockets","sse","graceful-shutdown","async"],"exportEndpoints":{"claude":"/api/rules/axum-tokio-cancellation-token-stream-draining?format=claude","cursorMdc":"/api/rules/axum-tokio-cancellation-token-stream-draining?format=mdc","cursorrules":"/api/rules/axum-tokio-cancellation-token-stream-draining?format=cursor","windsurf":"/api/rules/axum-tokio-cancellation-token-stream-draining?format=windsurf","agents":"/api/rules/axum-tokio-cancellation-token-stream-draining?format=agents"}},{"id":"react-19-use-action-state-optimistic-rollback-boundary","title":"React 19 useActionState Optimistic Mutation Rollback Boundary","category":"frontend","severity":"critical","description":"Enforces deterministic transactional client state reconciliation across concurrent React 19 async transitions. Mandates pairing useActionState with useOptimistic under atomic state boundaries to guarantee zero-drift rollback during network failures or server rejections.","antiPatternHeadline":"Mutating independent useState mirrors alongside useActionState transitions, leading to phantom optimistic UI and irreversible desynchronization on network failure.","stars_count":64,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["react-19","useActionState","useOptimistic","concurrent-react","state-rollback","frontend"],"exportEndpoints":{"claude":"/api/rules/react-19-use-action-state-optimistic-rollback-boundary?format=claude","cursorMdc":"/api/rules/react-19-use-action-state-optimistic-rollback-boundary?format=mdc","cursorrules":"/api/rules/react-19-use-action-state-optimistic-rollback-boundary?format=cursor","windsurf":"/api/rules/react-19-use-action-state-optimistic-rollback-boundary?format=windsurf","agents":"/api/rules/react-19-use-action-state-optimistic-rollback-boundary?format=agents"}},{"id":"postgres-17-vectorized-streaming-io-buffer-governor","title":"Postgres 17 Vectorized Streaming I/O and Buffer Ring Governor","category":"backend","severity":"critical","description":"Enforces strict session-level buffer isolation and concurrency caps for Postgres 17 streaming read operations and analytical workloads interleaved with OLTP traffic. Prevents OS page-cache thrashing, shared_buffers eviction cascades, and out-of-memory kernel faults triggered by unthrottled parallel worker allocation.","antiPatternHeadline":"Executing heavy analytical batch scans over default OLTP connection pools with unconstrained work_mem and parallel worker settings.","stars_count":108,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql-17","buffer-cache","direct-io","connection-pooling","oltp-olap-isolation"],"exportEndpoints":{"claude":"/api/rules/postgres-17-vectorized-streaming-io-buffer-governor?format=claude","cursorMdc":"/api/rules/postgres-17-vectorized-streaming-io-buffer-governor?format=mdc","cursorrules":"/api/rules/postgres-17-vectorized-streaming-io-buffer-governor?format=cursor","windsurf":"/api/rules/postgres-17-vectorized-streaming-io-buffer-governor?format=windsurf","agents":"/api/rules/postgres-17-vectorized-streaming-io-buffer-governor?format=agents"}},{"id":"bun-native-connection-pool-backpressure-isolation","title":"Bun 1.2 Native Connection Pool Backpressure Isolation & Thread Starvation Guardrail","category":"backend","severity":"critical","description":"Bun 1.2 leverages native Zig/C++ async I/O primitives and uSockets underneath the JavaScript runtime. Unbounded asynchronous native operations—such as unthrottled fetch dispatches, unmetered native socket allocations, and limitless database pool acquisitions—exhaust native file descriptors and starve worker threads during traffic bursts. This standard mandates deterministic semaphore bounds, acquisition deadlines, and native backpressure isolation across all outbound I/O layers.","antiPatternHeadline":"Unbounded Asynchronous Native I/O Dispatch Inducing Zig Worker Pool Starvation and FD Exhaustion","stars_count":56,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","concurrency","backpressure","resilience","microservices"],"exportEndpoints":{"claude":"/api/rules/bun-native-connection-pool-backpressure-isolation?format=claude","cursorMdc":"/api/rules/bun-native-connection-pool-backpressure-isolation?format=mdc","cursorrules":"/api/rules/bun-native-connection-pool-backpressure-isolation?format=cursor","windsurf":"/api/rules/bun-native-connection-pool-backpressure-isolation?format=windsurf","agents":"/api/rules/bun-native-connection-pool-backpressure-isolation?format=agents"}},{"id":"tauri-v2-dynamic-capability-acl-guardrail","title":"Tauri 2.0 Dynamic Capability ACL Multi-Origin Webview Guardrail","category":"mobile","severity":"critical","description":"Enforces strict origin-scoped capabilities and cryptographic context verification across disparate webviews in Tauri 2.0 desktop and mobile builds. Prevents lateral privilege escalation and cross-frame capability leakage by ensuring dynamic webview instances cannot inherit high-privilege native plugin permissions assigned to the primary application frame.","antiPatternHeadline":"Global Plugin Exposure and Wildcard ACL Grants across Heterogeneous Webview Contexts","stars_count":65,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri","security","ipc","capabilities","rust"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-dynamic-capability-acl-guardrail?format=claude","cursorMdc":"/api/rules/tauri-v2-dynamic-capability-acl-guardrail?format=mdc","cursorrules":"/api/rules/tauri-v2-dynamic-capability-acl-guardrail?format=cursor","windsurf":"/api/rules/tauri-v2-dynamic-capability-acl-guardrail?format=windsurf","agents":"/api/rules/tauri-v2-dynamic-capability-acl-guardrail?format=agents"}},{"id":"webauthn-prf-zk-key-derivation-standard-webauthn-prf-ext-422","title":"WebAuthn PRF Extension Zero-Knowledge Key Derivation Standard","category":"security","severity":"critical","description":"Enforces hardware-bound cryptographic key derivation using the WebAuthn Pseudo-Random Function (PRF) extension (hmac-secret) for zero-knowledge client-side encryption. Mandates strict salt uniqueness per domain context, HKDF sub-key expansion, deterministic client-side credential verification, and explicit rejection of insecure fallbacks when hardware-backed PRF fails or is unsupported.","antiPatternHeadline":"Deriving E2EE encryption keys directly from raw WebAuthn signatures, predictable salts, or unverified PRF inputs without HKDF separation","stars_count":116,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","prf-extension","zero-knowledge","cryptography","hkdf","passkeys"],"exportEndpoints":{"claude":"/api/rules/webauthn-prf-zk-key-derivation-standard-webauthn-prf-ext-422?format=claude","cursorMdc":"/api/rules/webauthn-prf-zk-key-derivation-standard-webauthn-prf-ext-422?format=mdc","cursorrules":"/api/rules/webauthn-prf-zk-key-derivation-standard-webauthn-prf-ext-422?format=cursor","windsurf":"/api/rules/webauthn-prf-zk-key-derivation-standard-webauthn-prf-ext-422?format=windsurf","agents":"/api/rules/webauthn-prf-zk-key-derivation-standard-webauthn-prf-ext-422?format=agents"}},{"id":"opentelemetry-metric-exemplar-trace-coupling-standard","title":"OpenTelemetry Metric Exemplar Trace Coupling Standard","category":"devops","severity":"critical","description":"Guarantees deterministic, exact temporal alignment between high-percentile (p99/p99.9) latency histogram bucket anomalies and high-cardinality distributed trace contexts. Enforces continuous active span context propagation into metric recording invocations to eliminate decoupling between metric aggregations and root-cause trace exemplars.","antiPatternHeadline":"Decoupled Metric Recording Without Active Context Leading to Missing Exemplars During Tail Latency Anomalies","stars_count":42,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","metrics","tracing","exemplars","observability","tail-latency"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-metric-exemplar-trace-coupling-standard?format=claude","cursorMdc":"/api/rules/opentelemetry-metric-exemplar-trace-coupling-standard?format=mdc","cursorrules":"/api/rules/opentelemetry-metric-exemplar-trace-coupling-standard?format=cursor","windsurf":"/api/rules/opentelemetry-metric-exemplar-trace-coupling-standard?format=windsurf","agents":"/api/rules/opentelemetry-metric-exemplar-trace-coupling-standard?format=agents"}},{"id":"python-313-nogil-singleton-memory-barrier","title":"Python 3.13 Free-Threaded FastAPI Singleton Memory Barrier & State Synchronization","category":"backend","severity":"critical","description":"In Python 3.13 free-threaded (PEP 703 nogil) environments, FastAPI dependency singletons and in-memory caches execute across true OS threads without the Global Interpreter Lock. Unsynchronized mutable state, unsafely shared C-extensions, and naked double-checked locking introduce race conditions, torn reads, and reference-count/immortalization corruption. This standard mandates explicit synchronization primitives, double-checked locking with acquire/release barriers, and thread-local state isolation.","antiPatternHeadline":"Unsynchronized Global In-Memory Singletons in Python 3.13 Nogil Worker Pool","stars_count":99,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","python313","nogil","fastapi","concurrency","memory-barrier","multithreading"],"exportEndpoints":{"claude":"/api/rules/python-313-nogil-singleton-memory-barrier?format=claude","cursorMdc":"/api/rules/python-313-nogil-singleton-memory-barrier?format=mdc","cursorrules":"/api/rules/python-313-nogil-singleton-memory-barrier?format=cursor","windsurf":"/api/rules/python-313-nogil-singleton-memory-barrier?format=windsurf","agents":"/api/rules/python-313-nogil-singleton-memory-barrier?format=agents"}},{"id":"linux-landlock-lsm-runtime-confinement","title":"Linux Landlock LSM Container Runtime Confinement Standard","category":"security","severity":"critical","description":"Enforces unprivileged, kernel-level filesystem and network sandboxing for microservices and ephemeral workloads using the Linux Landlock LSM. Mandates setting PR_SET_NO_NEW_PRIVS and applying Landlock access rights before dispatching untrusted or user-supplied execution logic. Guarantees isolation without requiring root permissions or CAP_SYS_ADMIN capabilities.","antiPatternHeadline":"Relying on Userspace Path Sanitization or Incomplete DAC Without Kernel-Enforced Landlock Jailing","stars_count":98,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","linux","landlock","lsm","sandboxing","container-security","defense-in-depth"],"exportEndpoints":{"claude":"/api/rules/linux-landlock-lsm-runtime-confinement?format=claude","cursorMdc":"/api/rules/linux-landlock-lsm-runtime-confinement?format=mdc","cursorrules":"/api/rules/linux-landlock-lsm-runtime-confinement?format=cursor","windsurf":"/api/rules/linux-landlock-lsm-runtime-confinement?format=windsurf","agents":"/api/rules/linux-landlock-lsm-runtime-confinement?format=agents"}},{"id":"svelte5-runes-async-derived-dependency-isolation-standard","title":"Svelte 5 Runes Async Dependency Isolation & Boundary Standard","category":"frontend","severity":"critical","description":"Enforces strict synchronous dependency extraction boundaries when integrating asynchronous operations with Svelte 5 runes. Prevents reactive graph cycle contamination, untracked post-await signal mutations, and race-condition memory leaks by enforcing AbortController-guarded resource primitives.","antiPatternHeadline":"Post-Await Signal Dereferencing and Unbounded Async Execution in Rune Pipelines","stars_count":79,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","reactivity","memory-leaks","async"],"exportEndpoints":{"claude":"/api/rules/svelte5-runes-async-derived-dependency-isolation-standard?format=claude","cursorMdc":"/api/rules/svelte5-runes-async-derived-dependency-isolation-standard?format=mdc","cursorrules":"/api/rules/svelte5-runes-async-derived-dependency-isolation-standard?format=cursor","windsurf":"/api/rules/svelte5-runes-async-derived-dependency-isolation-standard?format=windsurf","agents":"/api/rules/svelte5-runes-async-derived-dependency-isolation-standard?format=agents"}},{"id":"react19-server-cache-life-dynamic-tag-invalidation","title":"React 19 Server Cache-Life & Multi-Tenant Dynamic Tag Invalidation Invariant","category":"frontend","severity":"critical","description":"Mandates cryptographically isolated, tenant-scoped dynamic cache tags and bounded cache-life profiles across React 19 Server Component caching boundaries. Eliminates multi-region edge cache desynchronization and prevents multi-tenant data bleed in distributed server environments.","antiPatternHeadline":"Unscoped Global Edge Caching and State Bleed via Ambient Server Component Cache Tags","stars_count":93,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","server-components","cache-life","cache-tag","multi-tenancy","edge-invalidation"],"exportEndpoints":{"claude":"/api/rules/react19-server-cache-life-dynamic-tag-invalidation?format=claude","cursorMdc":"/api/rules/react19-server-cache-life-dynamic-tag-invalidation?format=mdc","cursorrules":"/api/rules/react19-server-cache-life-dynamic-tag-invalidation?format=cursor","windsurf":"/api/rules/react19-server-cache-life-dynamic-tag-invalidation?format=windsurf","agents":"/api/rules/react19-server-cache-life-dynamic-tag-invalidation?format=agents"}},{"id":"openfga-contextual-tuple-causal-consistency","title":"OpenFGA Contextual Tuple Graph Evaluation and Causal Consistency Guardrail","category":"backend","severity":"critical","description":"Enforces strict causal consistency tokens (continuation tokens/zenith markers) and on-the-fly contextual tuple injection across OpenFGA authorization checks during rapid organizational tree reorganizations. Prevents stale authorization grants and unauthorized access drift resulting from out-of-order replication delays between the datastore and graph check engine.","antiPatternHeadline":"Unbounded Eventual Consistency Authorization Checks and Isolated Graph Evaluations During Tree Mutations","stars_count":115,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","openfga","authorization","fine-grained-access-control","causal-consistency","security"],"exportEndpoints":{"claude":"/api/rules/openfga-contextual-tuple-causal-consistency?format=claude","cursorMdc":"/api/rules/openfga-contextual-tuple-causal-consistency?format=mdc","cursorrules":"/api/rules/openfga-contextual-tuple-causal-consistency?format=cursor","windsurf":"/api/rules/openfga-contextual-tuple-causal-consistency?format=windsurf","agents":"/api/rules/openfga-contextual-tuple-causal-consistency?format=agents"}},{"id":"axum-io-uring-cancellation-buffer-quarantine","title":"Axum io_uring Zero-Copy Stream Cancellation Buffer Quarantine","category":"backend","severity":"critical","description":"Enforces deterministic buffer quarantine and completion queue reconciliation for zero-copy Axum streams backed by io_uring runtimes. Prevents kernel use-after-free, silent memory corruption, and file-descriptor leaks caused by dropping in-flight user-space buffers upon sudden client socket disconnects.","antiPatternHeadline":"Dropping io_uring-backed stream futures without buffer quarantine during client disconnects","stars_count":108,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","io-uring","memory-safety","zero-copy","tokio-uring"],"exportEndpoints":{"claude":"/api/rules/axum-io-uring-cancellation-buffer-quarantine?format=claude","cursorMdc":"/api/rules/axum-io-uring-cancellation-buffer-quarantine?format=mdc","cursorrules":"/api/rules/axum-io-uring-cancellation-buffer-quarantine?format=cursor","windsurf":"/api/rules/axum-io-uring-cancellation-buffer-quarantine?format=windsurf","agents":"/api/rules/axum-io-uring-cancellation-buffer-quarantine?format=agents"}},{"id":"bun-als-distributed-trace-propagation-boundary","title":"Bun 1.2 AsyncLocalStorage Context Isolation & Trace Propagation Invariant","category":"backend","severity":"critical","description":"Enforces strict AsyncLocalStorage boundary encapsulation across Bun 1.2 native event loop ticks, microtask queues, and Worker thread boundaries. Prevents cross-request context bleeding and orphaned OpenTelemetry spans caused by un-bound async callbacks and unsafe enterWith invocations.","antiPatternHeadline":"Context Bleeding via AsyncLocalStorage.enterWith and Un-bound Worker Thread Dispatches","stars_count":54,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","asynclocalstorage","opentelemetry","distributed-tracing","concurrency"],"exportEndpoints":{"claude":"/api/rules/bun-als-distributed-trace-propagation-boundary?format=claude","cursorMdc":"/api/rules/bun-als-distributed-trace-propagation-boundary?format=mdc","cursorrules":"/api/rules/bun-als-distributed-trace-propagation-boundary?format=cursor","windsurf":"/api/rules/bun-als-distributed-trace-propagation-boundary?format=windsurf","agents":"/api/rules/bun-als-distributed-trace-propagation-boundary?format=agents"}},{"id":"postgres-subtransaction-splintering-snapshot-quarantine","title":"Postgres Subtransaction Splintering and Snapshot Metadata Quarantine Guardrail","category":"backend","severity":"critical","description":"Enforces strict limits against nested subtransactions and savepoint proliferation in PostgreSQL OLTP workloads. Uncontrolled savepoint chains overflow backend ProcArray subxid caches (exceeding the 64-entry inline ceiling), triggering global SubtransSLRULock contention, snapshot bloat, and accelerated transaction ID (XID) wraparound exhaustion. High-throughput database clients must decouple transient failure handling from database-level savepoints using application-tier idempotent retries.","antiPatternHeadline":"Nested Savepoints and ORM Subtransaction Splintering Saturating PGPROC SubXID Caches and SLRU Locks","stars_count":106,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","transactions","oltp","prisma","performance","concurrency"],"exportEndpoints":{"claude":"/api/rules/postgres-subtransaction-splintering-snapshot-quarantine?format=claude","cursorMdc":"/api/rules/postgres-subtransaction-splintering-snapshot-quarantine?format=mdc","cursorrules":"/api/rules/postgres-subtransaction-splintering-snapshot-quarantine?format=cursor","windsurf":"/api/rules/postgres-subtransaction-splintering-snapshot-quarantine?format=windsurf","agents":"/api/rules/postgres-subtransaction-splintering-snapshot-quarantine?format=agents"}},{"id":"kmp-swift6-strict-concurrency-isolation-guardrail","title":"KMP 2.1 and Swift 6 Strict Concurrency Isolation and Sendable Interop Boundary","category":"mobile","severity":"critical","description":"Enforces complete data race safety across the Kotlin Multiplatform 2.1 and Swift 6 language boundary by isolating Objective-C export interfaces within strict Swift actors. Prevents passing non-Sendable Kotlin reference types across asynchronous boundaries and mandates thread-safe Sendable DTO contracts or SKIE-generated Swift concurrency wrappers for all exported Coroutine flows and suspend functions.","antiPatternHeadline":"Passing Non-Sendable Kotlin Reference Types and Unisolated Completion Handlers Across Swift 6 Actor Boundaries","stars_count":93,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","swift6","concurrency","actors","sendable","coroutines"],"exportEndpoints":{"claude":"/api/rules/kmp-swift6-strict-concurrency-isolation-guardrail?format=claude","cursorMdc":"/api/rules/kmp-swift6-strict-concurrency-isolation-guardrail?format=mdc","cursorrules":"/api/rules/kmp-swift6-strict-concurrency-isolation-guardrail?format=cursor","windsurf":"/api/rules/kmp-swift6-strict-concurrency-isolation-guardrail?format=windsurf","agents":"/api/rules/kmp-swift6-strict-concurrency-isolation-guardrail?format=agents"}},{"id":"capacitor-7-encrypted-sqlite-migration-rollback-standard","title":"Capacitor 7 Encrypted SQLite Cryptographic Migration Rollback Standard","category":"mobile","severity":"critical","description":"Enforces fail-safe atomic migrations and deterministic cryptographic rollbacks for @capacitor-community/sqlite on hardware-encrypted mobile storage. Guarantees zero database corruption when background app lifecycles, operating system watchdog timers, or biometric key revocations abort schema updates mid-execution.","antiPatternHeadline":"In-Place Non-Atomic DDL Execution on Encrypted SQLite Without Verified Cryptographic Snapshots","stars_count":119,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","sqlite","sqlcipher","migrations","cryptography"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-encrypted-sqlite-migration-rollback-standard?format=claude","cursorMdc":"/api/rules/capacitor-7-encrypted-sqlite-migration-rollback-standard?format=mdc","cursorrules":"/api/rules/capacitor-7-encrypted-sqlite-migration-rollback-standard?format=cursor","windsurf":"/api/rules/capacitor-7-encrypted-sqlite-migration-rollback-standard?format=windsurf","agents":"/api/rules/capacitor-7-encrypted-sqlite-migration-rollback-standard?format=agents"}},{"id":"fedcm-idp-partitioned-cookie-silent-token-exchange","title":"W3C FedCM IdP Partitioned Cookie and Silent Token Exchange Guardrail","category":"security","severity":"critical","description":"Enforces strict origin validation, Sec-Fetch-Dest verification, CHIPS-compliant partitioned cookie attributes, and constant-time responses on FedCM IdP endpoints under complete third-party cookie deprecation. Prevents cross-site timing side-channels, unauthorized account probing, and silent federated token exfiltration across untrusted Relying Parties.","antiPatternHeadline":"Unvalidated cross-origin FedCM endpoints with variable-time execution and legacy third-party cookie dependency","stars_count":45,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","fedcm","identity","chips","timing-attacks","privacy-sandbox"],"exportEndpoints":{"claude":"/api/rules/fedcm-idp-partitioned-cookie-silent-token-exchange?format=claude","cursorMdc":"/api/rules/fedcm-idp-partitioned-cookie-silent-token-exchange?format=mdc","cursorrules":"/api/rules/fedcm-idp-partitioned-cookie-silent-token-exchange?format=cursor","windsurf":"/api/rules/fedcm-idp-partitioned-cookie-silent-token-exchange?format=windsurf","agents":"/api/rules/fedcm-idp-partitioned-cookie-silent-token-exchange?format=agents"}},{"id":"envoy-wasm-fault-isolation-memory-circuit-breaker","title":"Envoy Dynamic Wasm Filter Fault Isolation and Memory Circuit Breaking Standard","category":"devops","severity":"critical","description":"Enforces strict fault isolation, resource bounding, and failure-mode configurations for dynamic WebAssembly (Wasm) HTTP filters deployed in Envoy service mesh sidecars. Prevents unhandled filter traps and guest runtime memory leaks from destabilizing the host Envoy proxy process or starving mesh data planes of critical network resources. Mandates explicit memory circuit breaker thresholds, fail-open routing safeguards, and sandboxed V8 runtime isolation.","antiPatternHeadline":"Unbounded Wasm Sandboxes Without Fail-Open Protections Causing Sidecar OOM Kills","stars_count":103,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","envoy","wasm","service-mesh","reliability","infrastructure-as-code"],"exportEndpoints":{"claude":"/api/rules/envoy-wasm-fault-isolation-memory-circuit-breaker?format=claude","cursorMdc":"/api/rules/envoy-wasm-fault-isolation-memory-circuit-breaker?format=mdc","cursorrules":"/api/rules/envoy-wasm-fault-isolation-memory-circuit-breaker?format=cursor","windsurf":"/api/rules/envoy-wasm-fault-isolation-memory-circuit-breaker?format=windsurf","agents":"/api/rules/envoy-wasm-fault-isolation-memory-circuit-breaker?format=agents"}},{"id":"svelte-5-runes-hydration-graph-teardown","title":"Svelte 5 Runes Reactive Graph Isolation and SSR Teardown Standard","category":"frontend","severity":"critical","description":"Enforces strict boundary encapsulation of Svelte 5 reactive signal graphs within component trees and explicit root scopes. Prohibits global module-scoped rune allocations and untracked dynamic subscriptions that lead to memory leaks in SSR worker threads and retained signal graphs post-hydration. Mandates explicit graph disposal via $effect.root cleanup functions and per-request context factories.","antiPatternHeadline":"Global Module-Level Runes and Unscoped Reactive Signal Graphs in Universal Code","stars_count":85,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","memory-leak","ssr","hydration","signals"],"exportEndpoints":{"claude":"/api/rules/svelte-5-runes-hydration-graph-teardown?format=claude","cursorMdc":"/api/rules/svelte-5-runes-hydration-graph-teardown?format=mdc","cursorrules":"/api/rules/svelte-5-runes-hydration-graph-teardown?format=cursor","windsurf":"/api/rules/svelte-5-runes-hydration-graph-teardown?format=windsurf","agents":"/api/rules/svelte-5-runes-hydration-graph-teardown?format=agents"}},{"id":"react-19-rsc-flight-stream-taint-sanitization","title":"React 19 Server Components Flight Stream Taint-Checking and Boundary Sanitization","category":"frontend","severity":"critical","description":"Enforces strict payload boundary sanitization and React 19 taint-checking primitives to prevent server-only data and credentials from leaking into the React Flight serialization stream. Requires all database records and secret tokens to be explicitly tainted upon acquisition and converted to explicit Data Transfer Objects (DTOs) before crossing RSC-to-Client component boundaries.","antiPatternHeadline":"Leaking Sensitive Server State and Unfiltered ORM Entities Directly into Client Flight Stream Payloads","stars_count":112,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","rsc","taint-api","flight-stream","security","nextjs"],"exportEndpoints":{"claude":"/api/rules/react-19-rsc-flight-stream-taint-sanitization?format=claude","cursorMdc":"/api/rules/react-19-rsc-flight-stream-taint-sanitization?format=mdc","cursorrules":"/api/rules/react-19-rsc-flight-stream-taint-sanitization?format=cursor","windsurf":"/api/rules/react-19-rsc-flight-stream-taint-sanitization?format=windsurf","agents":"/api/rules/react-19-rsc-flight-stream-taint-sanitization?format=agents"}},{"id":"axum-tower-buffer-bounded-concurrency-load-shedding","title":"Axum 0.8 Tower Buffer-Bounded Concurrency and Fail-Fast Load Shedding Protocol","category":"backend","severity":"critical","description":"Enforces deterministic backpressure and fail-fast load shedding in Axum 0.8 microservices by pairing Tower BufferLayer with LoadShedLayer and HandleErrorLayer. Guarantees saturating traffic spikes reject excess requests with HTTP 503 before streaming or buffering memory-intensive payloads.","antiPatternHeadline":"Unbounded task queuing and memory pre-allocation leading to OOM cascades under heavy load.","stars_count":69,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tower","concurrency","backpressure","load-shedding"],"exportEndpoints":{"claude":"/api/rules/axum-tower-buffer-bounded-concurrency-load-shedding?format=claude","cursorMdc":"/api/rules/axum-tower-buffer-bounded-concurrency-load-shedding?format=mdc","cursorrules":"/api/rules/axum-tower-buffer-bounded-concurrency-load-shedding?format=cursor","windsurf":"/api/rules/axum-tower-buffer-bounded-concurrency-load-shedding?format=windsurf","agents":"/api/rules/axum-tower-buffer-bounded-concurrency-load-shedding?format=agents"}},{"id":"bun-websocket-dynamic-deflate-backpressure","title":"Bun 1.2 Native WebSocket Dynamic PerMessage-Deflate Backpressure Enforcement","category":"backend","severity":"critical","description":"Enforces strict backpressure controls on Bun 1.2 native WebSocket servers streaming dense event payloads. Dynamically modulates compression and drops deflate frame wrapping when socket write buffers exceed kernel watermark thresholds to prevent severe heap bloat and unrecoverable OOM crashes.","antiPatternHeadline":"Unchecked PerMessage-Deflate Streaming Causing Catastrophic Memory Exhaustion via Buffered Zlib Contexts","stars_count":81,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","websockets","backpressure","memory-management","performance"],"exportEndpoints":{"claude":"/api/rules/bun-websocket-dynamic-deflate-backpressure?format=claude","cursorMdc":"/api/rules/bun-websocket-dynamic-deflate-backpressure?format=mdc","cursorrules":"/api/rules/bun-websocket-dynamic-deflate-backpressure?format=cursor","windsurf":"/api/rules/bun-websocket-dynamic-deflate-backpressure?format=windsurf","agents":"/api/rules/bun-websocket-dynamic-deflate-backpressure?format=agents"}},{"id":"pg17-logical-replication-failover-slot-sync-state-machine","title":"Postgres 17 Logical Replication Failover Slot Synchronization State Machine","category":"backend","severity":"critical","description":"Guarantees zero data loss across cross-region failover events by constraining physical standby promotion until all logical replication slots reconcile with the physical timeline. Enforces PostgreSQL 17 failover slot synchronization primitives (sync_replication_slots, pg_sync_replication_slots) via a deterministic, finite-state promotion supervisor that asserts slot LSN convergence and prevents split-brain subscriber consumption.","antiPatternHeadline":"Premature Standby Promotion without Logical Slot LSN Reconciliation","stars_count":78,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres-17","logical-replication","failover","ha-dr","zero-data-loss"],"exportEndpoints":{"claude":"/api/rules/pg17-logical-replication-failover-slot-sync-state-machine?format=claude","cursorMdc":"/api/rules/pg17-logical-replication-failover-slot-sync-state-machine?format=mdc","cursorrules":"/api/rules/pg17-logical-replication-failover-slot-sync-state-machine?format=cursor","windsurf":"/api/rules/pg17-logical-replication-failover-slot-sync-state-machine?format=windsurf","agents":"/api/rules/pg17-logical-replication-failover-slot-sync-state-machine?format=agents"}},{"id":"kmp-skiko-vsync-frame-pacing-interlock","title":"KMP Skiko Native VSync Clock Interlock & Dynamic Refresh Rate Frame Pacing","category":"mobile","severity":"critical","description":"Eliminates micro-stuttering and frame tearing across heterogeneous mobile displays by strictly locking Compose Multiplatform Skiko render loops to native platform VSync primitives (iOS CADisplayLink and Android Choreographer). Enforces direct hardware clock synchronization with dynamic variable refresh rates (10Hz–120Hz ProMotion/VRR) while preventing decoupled coroutine-based delay loops.","antiPatternHeadline":"Decoupled Coroutine Delay Loops & Fixed-Rate Invalidation in Skiko Render Pipelines","stars_count":53,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","compose-multiplatform","skiko","vsync","frame-pacing","promotion"],"exportEndpoints":{"claude":"/api/rules/kmp-skiko-vsync-frame-pacing-interlock?format=claude","cursorMdc":"/api/rules/kmp-skiko-vsync-frame-pacing-interlock?format=mdc","cursorrules":"/api/rules/kmp-skiko-vsync-frame-pacing-interlock?format=cursor","windsurf":"/api/rules/kmp-skiko-vsync-frame-pacing-interlock?format=windsurf","agents":"/api/rules/kmp-skiko-vsync-frame-pacing-interlock?format=agents"}},{"id":"tauri2-ipc-reentrancy-ringbuffer-guardrail","title":"Tauri 2.0 IPC Reentrancy Prevention & Bounded Ring-Buffer Bridge Invariant","category":"mobile","severity":"critical","description":"Enforces non-reentrant, backpressure-managed IPC streaming between Tauri 2.0 native Rust cores and mobile webview runtimes. Prevents webview main-thread starvation and IPC message-loop deadlocks by mandating bounded ring buffers, batched channel-based telemetry, and prohibiting synchronous reentrant invoke calls within event handlers.","antiPatternHeadline":"Unbounded Direct IPC Telemetry Flooding with Synchronous Reentrant Invocations Freezing Mobile Webviews","stars_count":61,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri-2","ipc","rust","ring-buffer","concurrency","react"],"exportEndpoints":{"claude":"/api/rules/tauri2-ipc-reentrancy-ringbuffer-guardrail?format=claude","cursorMdc":"/api/rules/tauri2-ipc-reentrancy-ringbuffer-guardrail?format=mdc","cursorrules":"/api/rules/tauri2-ipc-reentrancy-ringbuffer-guardrail?format=cursor","windsurf":"/api/rules/tauri2-ipc-reentrancy-ringbuffer-guardrail?format=windsurf","agents":"/api/rules/tauri2-ipc-reentrancy-ringbuffer-guardrail?format=agents"}},{"id":"otel-baggage-filtering-tenant-fencing","title":"OpenTelemetry Baggage Sanitization and Multi-Tenant Context Fencing","category":"devops","severity":"critical","description":"Enforces strict DLP and isolation guarantees by intercepting, validating, and filtering OpenTelemetry baggage items during cross-boundary propagation. Prevents cross-tenant context injection and credential leakage through unvetted distributed tracing metadata traversing zero-trust perimeter boundaries.","antiPatternHeadline":"Unrestricted Passthrough of OpenTelemetry Baggage Across Multi-Tenant Network Perimeters","stars_count":55,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","security","dlp","multi-tenant","tracing"],"exportEndpoints":{"claude":"/api/rules/otel-baggage-filtering-tenant-fencing?format=claude","cursorMdc":"/api/rules/otel-baggage-filtering-tenant-fencing?format=mdc","cursorrules":"/api/rules/otel-baggage-filtering-tenant-fencing?format=cursor","windsurf":"/api/rules/otel-baggage-filtering-tenant-fencing?format=windsurf","agents":"/api/rules/otel-baggage-filtering-tenant-fencing?format=agents"}},{"id":"ebpf-tcx-ingress-token-bucket-handshake-standard","title":"eBPF TCX Kernel Ingress Token-Bucket Shaping and L4 SYN Flood Mitigation Standard","category":"devops","severity":"critical","description":"Defines strict invariants for high-throughput packet filtering using modern eBPF TCX (Traffic Control BPF link) hooks on network device ingress. Enforces per-IP and per-CIDR atomic token-bucket rate limiting and stateless SYN-cookie verification directly in the eBPF layer before SKB allocation occurs in the Linux network stack.","antiPatternHeadline":"Naive Userspace or iptables Rate Limiting Incurring Kernel SKB Allocation Bottlenecks Under L4 Volumetric Floods","stars_count":116,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","tcx","kernel","ddos-mitigation","networking"],"exportEndpoints":{"claude":"/api/rules/ebpf-tcx-ingress-token-bucket-handshake-standard?format=claude","cursorMdc":"/api/rules/ebpf-tcx-ingress-token-bucket-handshake-standard?format=mdc","cursorrules":"/api/rules/ebpf-tcx-ingress-token-bucket-handshake-standard?format=cursor","windsurf":"/api/rules/ebpf-tcx-ingress-token-bucket-handshake-standard?format=windsurf","agents":"/api/rules/ebpf-tcx-ingress-token-bucket-handshake-standard?format=agents"}},{"id":"nextjs-15-async-request-context-memoization-isolation","title":"Next.js 15 Async Request Context & Request-Memoization Tenant Isolation","category":"frontend","severity":"critical","description":"Enforces strict execution boundary isolation for Next.js 15 React Server Components (RSC) and React 19 request memoization. Prohibits floating unawaited microtasks, global mutable tenant storage, and un-isolated React.cache usage that corrupts AsyncLocalStorage context across concurrent streaming boundaries.","antiPatternHeadline":"Leaking Cross-Tenant Context via Detached Microtasks and Module-Level State in RSC Streaming","stars_count":59,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs15","react19","rsc","async-local-storage","multi-tenancy","request-memoization","security"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-async-request-context-memoization-isolation?format=claude","cursorMdc":"/api/rules/nextjs-15-async-request-context-memoization-isolation?format=mdc","cursorrules":"/api/rules/nextjs-15-async-request-context-memoization-isolation?format=cursor","windsurf":"/api/rules/nextjs-15-async-request-context-memoization-isolation?format=windsurf","agents":"/api/rules/nextjs-15-async-request-context-memoization-isolation?format=agents"}},{"id":"vite6-mfe-sri-manifest-boundary-guardrail","title":"Vite 6 Federated Micro-Frontend Dynamic Subresource Integrity (SRI) Manifest Boundary","category":"frontend","severity":"critical","description":"Enforces runtime cryptographic verification (SHA-384/SHA-512) for all dynamically resolved remote micro-frontend entry chunks and federated modules in Vite 6 architectures. Mandates immutable manifest-driven hash validation with strict cross-origin policies prior to script execution, coupled with sandboxed fallback boundaries to prevent remote code injection and CDN poisoning.","antiPatternHeadline":"Unvalidated Dynamic Script Injection and Bare Dynamic Imports of Remote Micro-Frontend Chunks","stars_count":75,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","vite6","micro-frontends","subresource-integrity","module-federation","app-security"],"exportEndpoints":{"claude":"/api/rules/vite6-mfe-sri-manifest-boundary-guardrail?format=claude","cursorMdc":"/api/rules/vite6-mfe-sri-manifest-boundary-guardrail?format=mdc","cursorrules":"/api/rules/vite6-mfe-sri-manifest-boundary-guardrail?format=cursor","windsurf":"/api/rules/vite6-mfe-sri-manifest-boundary-guardrail?format=windsurf","agents":"/api/rules/vite6-mfe-sri-manifest-boundary-guardrail?format=agents"}},{"id":"fastapi-sse-disconnection-lifespan-invariant","title":"FastAPI Async Generator SSE Lifespan and Disconnection Invariant","category":"backend","severity":"critical","description":"Enforces proactive ASGI client disconnection polling and rigorous task cancellation cleanup in FastAPI Server-Sent Events (SSE) generators. Eliminates silent async connection pool exhaustion caused by orphaned generator tasks continuing to stream after abrupt client termination.","antiPatternHeadline":"Zombie Async Generators Silently Draining Connection Pools Post-Client Disconnect","stars_count":52,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","sse","asgi","asyncio","streaming","connection-pooling"],"exportEndpoints":{"claude":"/api/rules/fastapi-sse-disconnection-lifespan-invariant?format=claude","cursorMdc":"/api/rules/fastapi-sse-disconnection-lifespan-invariant?format=mdc","cursorrules":"/api/rules/fastapi-sse-disconnection-lifespan-invariant?format=cursor","windsurf":"/api/rules/fastapi-sse-disconnection-lifespan-invariant?format=windsurf","agents":"/api/rules/fastapi-sse-disconnection-lifespan-invariant?format=agents"}},{"id":"bun-multiworker-websocket-fd-multiplexing-guardrail","title":"Bun 1.2 Deterministic Worker Ring WebSocket Multiplexing Standard","category":"backend","severity":"critical","description":"In multi-worker Bun 1.2 runtimes, arbitrary socket handoffs and cross-worker native WebSocket upgrades cause file-descriptor epoll desynchronization, TLS session corruption, and unrecoverable renegotiation storms. WebSocket upgrades MUST be strictly pinned to deterministic CPU-affinity worker rings using consistent hashing prior to handshake initiation, guaranteeing that each native file descriptor remains bound to a single worker event loop throughout its lifecycle.","antiPatternHeadline":"Cross-Worker IPC Socket Handover and Post-Accept Desynchronized Upgrades","stars_count":54,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","websockets","concurrency","multithreading","linux-epoll"],"exportEndpoints":{"claude":"/api/rules/bun-multiworker-websocket-fd-multiplexing-guardrail?format=claude","cursorMdc":"/api/rules/bun-multiworker-websocket-fd-multiplexing-guardrail?format=mdc","cursorrules":"/api/rules/bun-multiworker-websocket-fd-multiplexing-guardrail?format=cursor","windsurf":"/api/rules/bun-multiworker-websocket-fd-multiplexing-guardrail?format=windsurf","agents":"/api/rules/bun-multiworker-websocket-fd-multiplexing-guardrail?format=agents"}},{"id":"postgres-17-parallel-apply-worker-isolation-invariant","title":"Postgres 17 Logical Replication Parallel Apply Worker Isolation Invariant","category":"backend","severity":"critical","description":"Enforces strict subscriber-side transaction ordering and dependency tracking when utilizing PostgreSQL 17 parallel apply workers for streaming transactions. Prevents foreign key constraint violations and write skew caused by out-of-order concurrent commit execution across apply workers through deterministic commit fences and transaction stream serialization boundaries.","antiPatternHeadline":"Unfenced Concurrent Transaction Streaming Across Parallel Apply Workers Violating Foreign Key Referential Integrity","stars_count":63,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres","logical-replication","concurrency","distributed-systems","database-migration"],"exportEndpoints":{"claude":"/api/rules/postgres-17-parallel-apply-worker-isolation-invariant?format=claude","cursorMdc":"/api/rules/postgres-17-parallel-apply-worker-isolation-invariant?format=mdc","cursorrules":"/api/rules/postgres-17-parallel-apply-worker-isolation-invariant?format=cursor","windsurf":"/api/rules/postgres-17-parallel-apply-worker-isolation-invariant?format=windsurf","agents":"/api/rules/postgres-17-parallel-apply-worker-isolation-invariant?format=agents"}},{"id":"kmp-atomic-stateflow-concurrency-confinement","title":"KMP Atomic StateFlow and Swift Concurrency Confinement Guardrail","category":"mobile","severity":"critical","description":"Enforces strict unidirectional data flow, bidirectional immutability, and thread confinement across Kotlin Multiplatform and Swift Concurrency boundary. Guarantees that StateFlow emissions are observed under MainActor isolation on Darwin while mutations within Kotlin Common code use atomic state updates, preventing torn reads and native runtime crashes.","antiPatternHeadline":"Exposing Unconfined MutableStateFlow Across the KMP Boundary Leading to Swift Data Races and Undefined State","stars_count":51,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","swift-concurrency","coroutines","stateflow"],"exportEndpoints":{"claude":"/api/rules/kmp-atomic-stateflow-concurrency-confinement?format=claude","cursorMdc":"/api/rules/kmp-atomic-stateflow-concurrency-confinement?format=mdc","cursorrules":"/api/rules/kmp-atomic-stateflow-concurrency-confinement?format=cursor","windsurf":"/api/rules/kmp-atomic-stateflow-concurrency-confinement?format=windsurf","agents":"/api/rules/kmp-atomic-stateflow-concurrency-confinement?format=agents"}},{"id":"tauri-v2-ipc-binary-fastpath-guardrail","title":"Tauri 2.0 Mobile IPC Binary Fast-Path & Zero-Copy Memory Guardrail","category":"mobile","severity":"critical","description":"Enforces raw binary ArrayBuffer boundaries across Tauri 2.0 IPC bridges for payloads exceeding 32KB or high-frequency operations on mobile runtimes. Prohibits base64 encoding and monolithic serde_json serialization over the mobile WebView message handler to eliminate bridge thread blocking and out-of-memory crashes.","antiPatternHeadline":"Base64-encoded strings and monolithic JSON arrays across Tauri 2.0 mobile WebView bridges.","stars_count":99,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri2","rust","ipc","memory-management","zero-copy"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-ipc-binary-fastpath-guardrail?format=claude","cursorMdc":"/api/rules/tauri-v2-ipc-binary-fastpath-guardrail?format=mdc","cursorrules":"/api/rules/tauri-v2-ipc-binary-fastpath-guardrail?format=cursor","windsurf":"/api/rules/tauri-v2-ipc-binary-fastpath-guardrail?format=windsurf","agents":"/api/rules/tauri-v2-ipc-binary-fastpath-guardrail?format=agents"}},{"id":"opentelemetry-w3c-baggage-bounded-propagation-guardrail-opentelemetry-w3-554","title":"OpenTelemetry W3C Baggage Bounded Propagation & Verification Guardrail","category":"devops","severity":"critical","description":"Unbounded propagation of W3C distributed tracing baggage risks HTTP 431 Request Header Fields Too Large errors across reverse proxies, high memory overhead, and context tampering. Services must enforce strict total-byte quotas, key allowlisting, and cryptographic verification on cross-boundary baggage propagation.","antiPatternHeadline":"Unrestricted W3C Baggage Injection Causing Header Explosion and Security Context Spoofing","stars_count":60,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","w3c-baggage","distributed-tracing","context-propagation","security"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-w3c-baggage-bounded-propagation-guardrail-opentelemetry-w3-554?format=claude","cursorMdc":"/api/rules/opentelemetry-w3c-baggage-bounded-propagation-guardrail-opentelemetry-w3-554?format=mdc","cursorrules":"/api/rules/opentelemetry-w3c-baggage-bounded-propagation-guardrail-opentelemetry-w3-554?format=cursor","windsurf":"/api/rules/opentelemetry-w3c-baggage-bounded-propagation-guardrail-opentelemetry-w3-554?format=windsurf","agents":"/api/rules/opentelemetry-w3c-baggage-bounded-propagation-guardrail-opentelemetry-w3-554?format=agents"}},{"id":"ebpf-xdp-hardware-offloaded-ddos-drop-standard","title":"eBPF XDP Hardware-Offloaded DDoS Early-Drop Standard","category":"devops","severity":"critical","description":"Guarantees wire-speed packet filtering and unroutable packet mitigation directly inside the NIC driver (Native XDP) or SmartNIC silicon (Offloaded XDP) prior to socket buffer (sk_buff) allocation. Eliminates CPU cache invalidation and page allocation starvation under line-rate volumetric DDoS floods by enforcing strictly bounded pointer validation, memory-safe map access, and zero-allocation SYN/ACK validation.","antiPatternHeadline":"Processing Ingress Packets via Generic SKB/tc Hook or Unchecked Pointer Arithmetic Causing CPU Core Exhaustion Under Volumetric Floods","stars_count":96,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","xdp","ddos","networking","kernel","linux","c"],"exportEndpoints":{"claude":"/api/rules/ebpf-xdp-hardware-offloaded-ddos-drop-standard?format=claude","cursorMdc":"/api/rules/ebpf-xdp-hardware-offloaded-ddos-drop-standard?format=mdc","cursorrules":"/api/rules/ebpf-xdp-hardware-offloaded-ddos-drop-standard?format=cursor","windsurf":"/api/rules/ebpf-xdp-hardware-offloaded-ddos-drop-standard?format=windsurf","agents":"/api/rules/ebpf-xdp-hardware-offloaded-ddos-drop-standard?format=agents"}},{"id":"react-19-server-actions-idempotency-replay-guardrail","title":"React 19 Server Actions Idempotency-Key Replay and Distributed Rollback Guardrail","category":"frontend","severity":"critical","description":"Mandates deterministic client-generated idempotency keys, network-partition retry buffers, and transactional optimistic state rollbacks across React 19 Server Actions. Guarantees that intermittent HTTP failures, duplicate submission races, and network reconnection replays never trigger duplicate mutations or stale phantom UI states in distributed environments.","antiPatternHeadline":"Naked Server Actions Without Client-Side Idempotency Tokens and Rollback Barriers","stars_count":79,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","server-actions","idempotency","distributed-systems","optimistic-updates"],"exportEndpoints":{"claude":"/api/rules/react-19-server-actions-idempotency-replay-guardrail?format=claude","cursorMdc":"/api/rules/react-19-server-actions-idempotency-replay-guardrail?format=mdc","cursorrules":"/api/rules/react-19-server-actions-idempotency-replay-guardrail?format=cursor","windsurf":"/api/rules/react-19-server-actions-idempotency-replay-guardrail?format=windsurf","agents":"/api/rules/react-19-server-actions-idempotency-replay-guardrail?format=agents"}},{"id":"postgres-17-parallel-apply-deadlock-fence","title":"Postgres 17 Logical Replication Parallel Apply Deadlock Fence Guardrails","category":"backend","severity":"critical","description":"Enforces architectural fences and subscriber schema invariants to prevent out-of-order foreign key deadlocks across multi-threaded subscription workers under Postgres 17 parallel apply ingestion. Mandates deferrable subscriber constraints, publication isolation boundaries, and fail-safe worker configurations to guarantee non-blocking concurrent replication streams.","antiPatternHeadline":"Unfenced immediate foreign keys on subscriber tables causing parallel apply workers to trigger fatal lock dependency cycles.","stars_count":57,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres","replication","concurrency","database-migration"],"exportEndpoints":{"claude":"/api/rules/postgres-17-parallel-apply-deadlock-fence?format=claude","cursorMdc":"/api/rules/postgres-17-parallel-apply-deadlock-fence?format=mdc","cursorrules":"/api/rules/postgres-17-parallel-apply-deadlock-fence?format=cursor","windsurf":"/api/rules/postgres-17-parallel-apply-deadlock-fence?format=windsurf","agents":"/api/rules/postgres-17-parallel-apply-deadlock-fence?format=agents"}},{"id":"bun-sqlite-concurrent-wal-checkpoint-sharding-standard","title":"Bun 1.2 SQLite Concurrent WAL Checkpoint Sharding Standard","category":"backend","severity":"critical","description":"Enforces strict isolation between write-ahead log (WAL) checkpoint operations and edge read paths in Bun 1.2 SQLite architectures. Prevents event-loop thread blocking and tail-latency spikes by mandating dedicated read-only connection pools, explicit PRAGMA tuning, and offloaded non-blocking passive checkpoints.","antiPatternHeadline":"Running Synchronous TRUNCATE Checkpoints on Shared Single-Connection SQLite Handles","stars_count":59,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","sqlite","wal","edge-computing","concurrency"],"exportEndpoints":{"claude":"/api/rules/bun-sqlite-concurrent-wal-checkpoint-sharding-standard?format=claude","cursorMdc":"/api/rules/bun-sqlite-concurrent-wal-checkpoint-sharding-standard?format=mdc","cursorrules":"/api/rules/bun-sqlite-concurrent-wal-checkpoint-sharding-standard?format=cursor","windsurf":"/api/rules/bun-sqlite-concurrent-wal-checkpoint-sharding-standard?format=windsurf","agents":"/api/rules/bun-sqlite-concurrent-wal-checkpoint-sharding-standard?format=agents"}},{"id":"kmp-swift-concurrency-cancellation-bridge-barrier","title":"Kotlin Multiplatform to Swift Structured Concurrency Bi-Directional Cancellation Guardrail","category":"mobile","severity":"critical","description":"Enforces deterministic, bidirectional propagation between Swift Structured Concurrency Task cancellation and Kotlin Coroutines Job cancellation across the Objective-C/C export boundary. Eliminates orphaned worker threads, uncollected completion closures, and unmanaged memory retention across Swift-KMP module boundaries.","antiPatternHeadline":"Orphaned Kotlin Coroutines and Leaked Native Continuations via Unhandled Swift Task Cancellation","stars_count":71,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kmp","swift-concurrency","coroutines","kotlin-native","memory-management"],"exportEndpoints":{"claude":"/api/rules/kmp-swift-concurrency-cancellation-bridge-barrier?format=claude","cursorMdc":"/api/rules/kmp-swift-concurrency-cancellation-bridge-barrier?format=mdc","cursorrules":"/api/rules/kmp-swift-concurrency-cancellation-bridge-barrier?format=cursor","windsurf":"/api/rules/kmp-swift-concurrency-cancellation-bridge-barrier?format=windsurf","agents":"/api/rules/kmp-swift-concurrency-cancellation-bridge-barrier?format=agents"}},{"id":"capacitor-7-origin-isolation-scheme-invariant","title":"Capacitor 7 Native Bridge Origin Isolation and Scheme Invariant Guardrail","category":"mobile","severity":"critical","description":"Capacitor 7 native bridge invocations must be cryptographically bound to immutable custom schemes and verified origin domains. Failure to enforce origin checks and scheme invariants exposes native host plugins (Keychain, Keystore, Camera, Filesystem) to untrusted third-party script injection via DOM XSS, MITM webviews, or arbitrary remote navigations.","antiPatternHeadline":"Permissive Remote Navigation with Unvalidated Native Bridge Invocations Across Arbitrary Origins","stars_count":53,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","security","ipc","webview","ios","android"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-origin-isolation-scheme-invariant?format=claude","cursorMdc":"/api/rules/capacitor-7-origin-isolation-scheme-invariant?format=mdc","cursorrules":"/api/rules/capacitor-7-origin-isolation-scheme-invariant?format=cursor","windsurf":"/api/rules/capacitor-7-origin-isolation-scheme-invariant?format=windsurf","agents":"/api/rules/capacitor-7-origin-isolation-scheme-invariant?format=agents"}},{"id":"w3c-vc-bitstring-status-list-revocation-invariant","title":"W3C VC Bitstring Status List v1.0 Privacy & Revocation Invariant","category":"security","severity":"critical","description":"Enforces strict compliance with the W3C Bitstring Status List v1.0 specification for privacy-preserving credential revocation. Mandates cryptographic verification of the status list credential, constant-time bitstring decompression and index resolution, aggressive caching with TTLs, and zero credential-specific tracking queries to prevent issuer correlation attacks.","antiPatternHeadline":"Interactive Per-Credential Revocation Lookups and Unverified Gzip Expansion Leaking Verifier Topology","stars_count":90,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","verifiable-credentials","w3c","cryptography","did","status-list-2021","bitstring"],"exportEndpoints":{"claude":"/api/rules/w3c-vc-bitstring-status-list-revocation-invariant?format=claude","cursorMdc":"/api/rules/w3c-vc-bitstring-status-list-revocation-invariant?format=mdc","cursorrules":"/api/rules/w3c-vc-bitstring-status-list-revocation-invariant?format=cursor","windsurf":"/api/rules/w3c-vc-bitstring-status-list-revocation-invariant?format=windsurf","agents":"/api/rules/w3c-vc-bitstring-status-list-revocation-invariant?format=agents"}},{"id":"cgroup-v2-memory-high-backpressure-production-standard","title":"Cgroup v2 Proactive memory.high Kernel Reclaim Backpressure Standard","category":"devops","severity":"critical","description":"Enforces proactive kernel reclaim and synchronous allocator throttling via cgroup v2 memory.high thresholds set below absolute hard ceilings (memory.max). This prevents sudden burst-induced Out-Of-Memory (OOM) killer terminations by inducing gradual backpressure, reclaim compaction, and application-level load shedding prior to unrecoverable SIGKILL events.","antiPatternHeadline":"Binary OOM Cliff Falloff Caused by Sole Reliance on memory.max Without memory.high Throttling Thresholds","stars_count":53,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","cgroup-v2","kubernetes","linux-kernel","reliability","infrastructure"],"exportEndpoints":{"claude":"/api/rules/cgroup-v2-memory-high-backpressure-production-standard?format=claude","cursorMdc":"/api/rules/cgroup-v2-memory-high-backpressure-production-standard?format=mdc","cursorrules":"/api/rules/cgroup-v2-memory-high-backpressure-production-standard?format=cursor","windsurf":"/api/rules/cgroup-v2-memory-high-backpressure-production-standard?format=windsurf","agents":"/api/rules/cgroup-v2-memory-high-backpressure-production-standard?format=agents"}},{"id":"otel-w3c-baggage-pii-boundary-guardrail","title":"OpenTelemetry W3C Baggage PII Boundary and Propagation Guardrail","category":"devops","severity":"critical","description":"Enforces strict compile-time schema validation and runtime redaction filters on OpenTelemetry W3C Baggage propagation across network boundaries. Prevents catastrophic compliance violations (GDPR, HIPAA, PCI-DSS) caused by leaking unsanitized user identity and sensitive contextual metadata down distributed trace graphs. Mandates custom TextMapPropagators with strict allowlists and automated entropy/pattern redaction.","antiPatternHeadline":"Unrestricted Propagation of Sensitive User Identity and Raw Context Keys in Outgoing W3C Baggage Headers","stars_count":110,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","distributed-tracing","security","pii-redaction","compliance"],"exportEndpoints":{"claude":"/api/rules/otel-w3c-baggage-pii-boundary-guardrail?format=claude","cursorMdc":"/api/rules/otel-w3c-baggage-pii-boundary-guardrail?format=mdc","cursorrules":"/api/rules/otel-w3c-baggage-pii-boundary-guardrail?format=cursor","windsurf":"/api/rules/otel-w3c-baggage-pii-boundary-guardrail?format=windsurf","agents":"/api/rules/otel-w3c-baggage-pii-boundary-guardrail?format=agents"}},{"id":"nextjs15-ppr-dynamic-hole-cache-poisoning-guardrail","title":"Next.js 15 PPR Dynamic Hole Cache Poisoning Guardrail","category":"frontend","severity":"critical","description":"Enforces strict boundary isolation between static shell generation and dynamic streaming holes in Next.js 15 Partial Prerendering (PPR). Prevents accidental evaluation and exposure of session identifiers, authorization tokens, or personalized tenant data inside statically prerendered shells and shared CDN edge caches.","antiPatternHeadline":"Leaking Personalized Tenant Context or Session Tokens into Prerendered Shell Fallbacks under Next.js 15 PPR","stars_count":76,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs","react","ppr","cache-poisoning","security","app-router"],"exportEndpoints":{"claude":"/api/rules/nextjs15-ppr-dynamic-hole-cache-poisoning-guardrail?format=claude","cursorMdc":"/api/rules/nextjs15-ppr-dynamic-hole-cache-poisoning-guardrail?format=mdc","cursorrules":"/api/rules/nextjs15-ppr-dynamic-hole-cache-poisoning-guardrail?format=cursor","windsurf":"/api/rules/nextjs15-ppr-dynamic-hole-cache-poisoning-guardrail?format=windsurf","agents":"/api/rules/nextjs15-ppr-dynamic-hole-cache-poisoning-guardrail?format=agents"}},{"id":"react-19-server-action-optimistic-envelope","title":"Deterministic Optimistic Mutation Envelope for Concurrent Server Actions","category":"frontend","severity":"critical","description":"Enforces monotonic sequence envelopes for React 19 optimistic updates and Server Action dispatches. Eliminates phantom UI rollbacks, state clobbering, and visual flickers caused by out-of-order resolution or rejection of concurrent asynchronous transitions.","antiPatternHeadline":"Unversioned Closure Snapshots and LIFO Rollback Collisions in Concurrent Server Actions","stars_count":113,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","server-actions","use-optimistic","concurrency","state-reconciliation"],"exportEndpoints":{"claude":"/api/rules/react-19-server-action-optimistic-envelope?format=claude","cursorMdc":"/api/rules/react-19-server-action-optimistic-envelope?format=mdc","cursorrules":"/api/rules/react-19-server-action-optimistic-envelope?format=cursor","windsurf":"/api/rules/react-19-server-action-optimistic-envelope?format=windsurf","agents":"/api/rules/react-19-server-action-optimistic-envelope?format=agents"}},{"id":"axum-graceful-shutdown-drain-barrier","title":"Axum 0.8 Cancel-Safe Graceful Shutdown and In-Flight Request Drain Barrier","category":"backend","severity":"critical","description":"Enforces cancel-safe execution guarantees, transactional commit protection, and streaming response drain barriers during rolling container evictions in Axum 0.8. Prevents silent rollback of in-flight business mutations and abrupt HTTP/2 RST_STREAM errors on active clients.","antiPatternHeadline":"Truncating in-flight streaming responses and rolling back database transactions via unmanaged future drops during SIGTERM","stars_count":119,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tokio","concurrency","zero-downtime"],"exportEndpoints":{"claude":"/api/rules/axum-graceful-shutdown-drain-barrier?format=claude","cursorMdc":"/api/rules/axum-graceful-shutdown-drain-barrier?format=mdc","cursorrules":"/api/rules/axum-graceful-shutdown-drain-barrier?format=cursor","windsurf":"/api/rules/axum-graceful-shutdown-drain-barrier?format=windsurf","agents":"/api/rules/axum-graceful-shutdown-drain-barrier?format=agents"}},{"id":"bun-websocket-backpressure-drain-watermark","title":"Bun 1.2 Native WebSocket Backpressure Drain Watermark Standard","category":"backend","severity":"critical","description":"Mandates explicit flow control, buffered byte inspection, and drain lifecycle management for native WebSockets in Bun 1.2. Prevents unbounded native C++ and JavaScriptCore heap expansion that causes silent Linux kernel OOM kills under bursty telemetry and high-throughput streaming workloads.","antiPatternHeadline":"Unchecked Fire-and-Forget ws.send() Under High-Frequency Ingestion Spikes","stars_count":56,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","websockets","backpressure","memory-management","real-time"],"exportEndpoints":{"claude":"/api/rules/bun-websocket-backpressure-drain-watermark?format=claude","cursorMdc":"/api/rules/bun-websocket-backpressure-drain-watermark?format=mdc","cursorrules":"/api/rules/bun-websocket-backpressure-drain-watermark?format=cursor","windsurf":"/api/rules/bun-websocket-backpressure-drain-watermark?format=windsurf","agents":"/api/rules/bun-websocket-backpressure-drain-watermark?format=agents"}},{"id":"pg17-halfvec-hnsw-memory-quarantine","title":"Postgres 17 Half-Precision HNSW Index Memory Quarantine & Resource Isolation","category":"backend","severity":"critical","description":"Enforces strict memory quarantine and session-level isolation for billion-scale halfvec HNSW index builds in PostgreSQL 17. Prevents shared buffer cache thrashing, backend worker memory starvation, and kernel OOM kills by constraining parallel maintenance workers, allocating bounded session-local maintenance_work_mem, and indexing across bounded partitions.","antiPatternHeadline":"Unquarantined Full-Precision HNSW Index Builds on Shared OLTP Connections Inducing Backend OOM Starvation","stars_count":95,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres-17","pgvector","hnsw","halfvec","memory-management","high-concurrency"],"exportEndpoints":{"claude":"/api/rules/pg17-halfvec-hnsw-memory-quarantine?format=claude","cursorMdc":"/api/rules/pg17-halfvec-hnsw-memory-quarantine?format=mdc","cursorrules":"/api/rules/pg17-halfvec-hnsw-memory-quarantine?format=cursor","windsurf":"/api/rules/pg17-halfvec-hnsw-memory-quarantine?format=windsurf","agents":"/api/rules/pg17-halfvec-hnsw-memory-quarantine?format=agents"}},{"id":"rn-bridgeless-jsi-arraybuffer-pinning-guardrail","title":"React Native 0.76 Bridgeless JSI Direct ArrayBuffer Pinning & Zero-Copy Guardrail","category":"mobile","severity":"critical","description":"Enforces strict native memory management and Hermes garbage collector lifecycle coordination for zero-copy 120fps camera frame pipelines in React Native 0.76 Bridgeless mode. Direct raw pointers wrapped into jsi::ArrayBuffer must be explicitly pinned or tracked using custom HostObject lifecycle managers to prevent SIGSEGV and silent heap corruption during GenGC compaction.","antiPatternHeadline":"Exposing Raw Native Camera Buffers to JSI ArrayBuffer Without Lifetime Pinning or Garbage Collector Synchronization","stars_count":96,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","react-native-0.76","hermes","jsi","memory-safety","zero-copy","camera-pipeline"],"exportEndpoints":{"claude":"/api/rules/rn-bridgeless-jsi-arraybuffer-pinning-guardrail?format=claude","cursorMdc":"/api/rules/rn-bridgeless-jsi-arraybuffer-pinning-guardrail?format=mdc","cursorrules":"/api/rules/rn-bridgeless-jsi-arraybuffer-pinning-guardrail?format=cursor","windsurf":"/api/rules/rn-bridgeless-jsi-arraybuffer-pinning-guardrail?format=windsurf","agents":"/api/rules/rn-bridgeless-jsi-arraybuffer-pinning-guardrail?format=agents"}},{"id":"cmp-offscreen-rendernode-graphic-buffer-disposal-invariant","title":"Compose Multiplatform Off-Screen RenderNode & Graphic Buffer Disposal Invariant","category":"mobile","severity":"critical","description":"Enforces deterministic lifecycle-bound GPU surface and RenderNode buffer reclamation during navigation transitions in Compose Multiplatform (CMP) across Android and iOS (Metal/Skiko). Prohibits the retention of hardware-accelerated graphic layers and off-screen render targets on inactive backstack destinations to eliminate VRAM bloat and prevent iOS jetsam kills.","antiPatternHeadline":"Retaining Hardware-Accelerated graphicsLayers and Unbounded Skia/Metal Surface Allocations on Backstack Routes","stars_count":49,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","compose-multiplatform","kotlin","metal","vram-management","memory-leaks"],"exportEndpoints":{"claude":"/api/rules/cmp-offscreen-rendernode-graphic-buffer-disposal-invariant?format=claude","cursorMdc":"/api/rules/cmp-offscreen-rendernode-graphic-buffer-disposal-invariant?format=mdc","cursorrules":"/api/rules/cmp-offscreen-rendernode-graphic-buffer-disposal-invariant?format=cursor","windsurf":"/api/rules/cmp-offscreen-rendernode-graphic-buffer-disposal-invariant?format=windsurf","agents":"/api/rules/cmp-offscreen-rendernode-graphic-buffer-disposal-invariant?format=agents"}},{"id":"openfga-transactional-consistency-token-propagation","title":"OpenFGA Causal Consistency Token Propagation Guardrail","category":"security","severity":"critical","description":"Enforces strict causal consistency across microservice boundaries by propagating OpenFGA transaction tokens (continuation tokens/consistency tokens) through RPC metadata. Prevents distributed authorization race conditions where immediate read-after-write operations hit read replicas before permission tuples replicate.","antiPatternHeadline":"Ignoring OpenFGA write consistency tokens leading to distributed authorization race conditions and stale access checks.","stars_count":44,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","authorization","distributed-systems","grpc","consistency"],"exportEndpoints":{"claude":"/api/rules/openfga-transactional-consistency-token-propagation?format=claude","cursorMdc":"/api/rules/openfga-transactional-consistency-token-propagation?format=mdc","cursorrules":"/api/rules/openfga-transactional-consistency-token-propagation?format=cursor","windsurf":"/api/rules/openfga-transactional-consistency-token-propagation?format=windsurf","agents":"/api/rules/openfga-transactional-consistency-token-propagation?format=agents"}},{"id":"fido2-webauthn-hybrid-relay-defense-standard","title":"FIDO2 WebAuthn Hybrid Transport Cross-Device Relay Defense","category":"security","severity":"critical","description":"Enforces strict origin-bound assertion verification, atomic single-use challenge consumption, and hybrid transport validation in WebAuthn servers. Defeats proximity-spoofed cross-device relay attacks (caBLE / QR-code phishing) by validating exact canonical origins, denying cross-origin iframe context, and enforcing short-lived hybrid challenge lifetimes.","antiPatternHeadline":"Permissive origin matching, non-atomic challenge checks, or missing crossOrigin flags during hybrid WebAuthn assertion verification.","stars_count":101,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","fido2","passkeys","hybrid-transport","cable","anti-phishing"],"exportEndpoints":{"claude":"/api/rules/fido2-webauthn-hybrid-relay-defense-standard?format=claude","cursorMdc":"/api/rules/fido2-webauthn-hybrid-relay-defense-standard?format=mdc","cursorrules":"/api/rules/fido2-webauthn-hybrid-relay-defense-standard?format=cursor","windsurf":"/api/rules/fido2-webauthn-hybrid-relay-defense-standard?format=windsurf","agents":"/api/rules/fido2-webauthn-hybrid-relay-defense-standard?format=agents"}},{"id":"k8s-132-dra-gpu-partitioning-guardrail","title":"Kubernetes 1.32 DRA GPU Partitioning and Memory Bus Contention Guardrail","category":"devops","severity":"critical","description":"Enforces Kubernetes 1.32 Dynamic Resource Allocation (DRA) structured parameters to partition co-located distributed LLM inference micro-slices into hardware-isolated compute and memory domains. Prevents unthrottled tensor engine bus contention, L2 cache thrashing, and kernel watchdog timeouts caused by unmanaged multi-tenant GPU overcommit. Mandates explicit DeviceClass configurations, Structured Parameter selectors, and ResourceClaim lifecycle controls across all deployment manifests.","antiPatternHeadline":"Unpartitioned MPS and Legacy Shared GPU Requests Inducing Host Kernel Watchdog Hangs and Cross-Tenant Cache Starvation","stars_count":67,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","kubernetes","dra","gpu","cuda","nvidia-mig","llm-inference"],"exportEndpoints":{"claude":"/api/rules/k8s-132-dra-gpu-partitioning-guardrail?format=claude","cursorMdc":"/api/rules/k8s-132-dra-gpu-partitioning-guardrail?format=mdc","cursorrules":"/api/rules/k8s-132-dra-gpu-partitioning-guardrail?format=cursor","windsurf":"/api/rules/k8s-132-dra-gpu-partitioning-guardrail?format=windsurf","agents":"/api/rules/k8s-132-dra-gpu-partitioning-guardrail?format=agents"}},{"id":"nextjs-15-ppr-dynamic-hole-boundary-guardrail","title":"Next.js 15 Partial Prerendering (PPR) Dynamic Hole Boundary Isolation","category":"frontend","severity":"critical","description":"Enforces strict isolation of dynamic runtime APIs (`cookies()`, `headers()`, `searchParams`, and un-cached data sources) inside dedicated React Suspense boundaries. Prevents unintended static shell de-optimizations where accessing dynamic functions at the route root converts the entire route into a dynamic runtime SSR request, negating PPR benefits.","antiPatternHeadline":"Accessing dynamic runtime APIs in top-level page components causing full static shell de-optimization","stars_count":102,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["nextjs","nextjs-15","react-server-components","ppr","suspense","performance"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-ppr-dynamic-hole-boundary-guardrail?format=claude","cursorMdc":"/api/rules/nextjs-15-ppr-dynamic-hole-boundary-guardrail?format=mdc","cursorrules":"/api/rules/nextjs-15-ppr-dynamic-hole-boundary-guardrail?format=cursor","windsurf":"/api/rules/nextjs-15-ppr-dynamic-hole-boundary-guardrail?format=windsurf","agents":"/api/rules/nextjs-15-ppr-dynamic-hole-boundary-guardrail?format=agents"}},{"id":"bun-native-socket-backpressure-buffer-recycling","title":"Bun 1.2 Native Socket Backpressure & ArrayBuffer Recycling Standard","category":"backend","severity":"critical","description":"Enforces strict write backpressure management and zero-allocation pooled ArrayBuffer recycling on Bun.listen and Bun.connect native sockets. Prevents unbounded heap growth and JavaScriptCore major GC pauses under sustained gigabit-scale ingestion by pairing socket.write return validation with drain-driven ring queues.","antiPatternHeadline":"Ignoring Socket Write Backpressure and Allocating Ephemeral Buffers Per Packet","stars_count":48,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","sockets","networking","performance","memory-management"],"exportEndpoints":{"claude":"/api/rules/bun-native-socket-backpressure-buffer-recycling?format=claude","cursorMdc":"/api/rules/bun-native-socket-backpressure-buffer-recycling?format=mdc","cursorrules":"/api/rules/bun-native-socket-backpressure-buffer-recycling?format=cursor","windsurf":"/api/rules/bun-native-socket-backpressure-buffer-recycling?format=windsurf","agents":"/api/rules/bun-native-socket-backpressure-buffer-recycling?format=agents"}},{"id":"drizzle-orm-prepared-statement-connection-lease-pinning","title":"Drizzle ORM Prepared Statement Connection-Lease Pinning in Transaction-Pooled Postgres","category":"backend","severity":"critical","description":"Enforces strict connection-lease lifecycle bounds on Drizzle ORM prepared statements when operating behind transaction-mode connection poolers like PgBouncer or Supabase Pooler. Prevents fatal PostgreSQL exceptions (error codes 42P05 'prepared statement already exists' and 26000 'prepared statement does not exist') and eliminates deallocation thrashing caused by leaking named statement handles across ephemeral physical connections.","antiPatternHeadline":"Registering persistent or named server-side prepared statements across transaction-pooled PostgreSQL connections.","stars_count":87,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","drizzle-orm","postgresql","pgbouncer","database-pooling","typescript"],"exportEndpoints":{"claude":"/api/rules/drizzle-orm-prepared-statement-connection-lease-pinning?format=claude","cursorMdc":"/api/rules/drizzle-orm-prepared-statement-connection-lease-pinning?format=mdc","cursorrules":"/api/rules/drizzle-orm-prepared-statement-connection-lease-pinning?format=cursor","windsurf":"/api/rules/drizzle-orm-prepared-statement-connection-lease-pinning?format=windsurf","agents":"/api/rules/drizzle-orm-prepared-statement-connection-lease-pinning?format=agents"}},{"id":"kmp-swift-export-concurrency-barrier","title":"KMP 2.1 Swift-Export Actor-Bound Concurrency Barrier Contract","category":"mobile","severity":"critical","description":"Enforces strict isolation barriers and actor boundaries when bridging Kotlin Coroutines Flows and suspend functions into Swift via KMP 2.1 Swift-Export. Unfenced consumption across direct native boundaries induces Swift 6 data races, untracked Task deallocations, and thread-pool pool desynchronization. Native bridge calls must explicitly establish AsyncSequence fences bound to explicit Swift Actors.","antiPatternHeadline":"Direct Unscoped Flow Collection and Unfenced Continuation Resumptions Across Native Swift-Export Boundaries","stars_count":58,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","swift6","concurrency","swift-export","coroutines"],"exportEndpoints":{"claude":"/api/rules/kmp-swift-export-concurrency-barrier?format=claude","cursorMdc":"/api/rules/kmp-swift-export-concurrency-barrier?format=mdc","cursorrules":"/api/rules/kmp-swift-export-concurrency-barrier?format=cursor","windsurf":"/api/rules/kmp-swift-export-concurrency-barrier?format=windsurf","agents":"/api/rules/kmp-swift-export-concurrency-barrier?format=agents"}},{"id":"rn-bridgeless-jsi-hostobject-lifetime-invariant","title":"React Native 0.77 Bridgeless JSI HostObject Lifetime and Thread Invariant","category":"mobile","severity":"critical","description":"Enforces strict thread-safe C++ memory management and reference tracking for JSI HostObjects in React Native 0.77 bridgeless mode. Prevents SIGSEGV crashes caused by Hermes garbage collection cycles deallocating native state while asynchronous background worker threads retain raw pointers or execute TurboModule callbacks. Mandates the use of thread-safe smart pointers, explicit invalidation tokens, and strict JS-thread dispatch for JSI runtime interactions.","antiPatternHeadline":"Accessing Dangling JSI HostObjects or Capturing Raw Native Pointers Across Concurrent TurboModule Threads","stars_count":46,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","react-native","jsi","turbomodules","hermes","c++","memory-safety"],"exportEndpoints":{"claude":"/api/rules/rn-bridgeless-jsi-hostobject-lifetime-invariant?format=claude","cursorMdc":"/api/rules/rn-bridgeless-jsi-hostobject-lifetime-invariant?format=mdc","cursorrules":"/api/rules/rn-bridgeless-jsi-hostobject-lifetime-invariant?format=cursor","windsurf":"/api/rules/rn-bridgeless-jsi-hostobject-lifetime-invariant?format=windsurf","agents":"/api/rules/rn-bridgeless-jsi-hostobject-lifetime-invariant?format=agents"}},{"id":"oauth2-dpop-rfc9449-nonce-replay-standard","title":"OAuth 2.0 DPoP (RFC 9449) Cryptographic Proof & Dynamic Nonce Lease Enforcement","category":"security","severity":"critical","description":"Enforces strict RFC 9449 Demonstrating Proof-of-Possession (DPoP) invariants by binding tokens to non-extractable client asymmetric key pairs. Mandates dynamic server-issued nonce rotation, single-use proof generation with cryptographically secure jti tracking, and mandatory access token hash (ath) verification to eliminate token replay and exfiltration.","antiPatternHeadline":"Reusing Cached DPoP Proofs or Relying on Unbound Bearer Tokens Without Nonce Verification","stars_count":93,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","oauth2","dpop","rfc9449","cryptography","tokens"],"exportEndpoints":{"claude":"/api/rules/oauth2-dpop-rfc9449-nonce-replay-standard?format=claude","cursorMdc":"/api/rules/oauth2-dpop-rfc9449-nonce-replay-standard?format=mdc","cursorrules":"/api/rules/oauth2-dpop-rfc9449-nonce-replay-standard?format=cursor","windsurf":"/api/rules/oauth2-dpop-rfc9449-nonce-replay-standard?format=windsurf","agents":"/api/rules/oauth2-dpop-rfc9449-nonce-replay-standard?format=agents"}},{"id":"sigstore-keyless-oidc-attestation-verification-standard","title":"Sigstore Keyless OIDC Attestation & Ephemeral Certificate Verification Guardrail","category":"security","severity":"critical","description":"Enforces strict admission-time cryptographic verification of Sigstore bundles for container images and build artifacts. Mandates exact OIDC Subject Alternative Name (SAN) regex matching, Fulcio OIDC issuer validation, and Rekor transparency log inclusion proof verification to guarantee signatures occurred during the ephemeral certificate validity window.","antiPatternHeadline":"Accepting Any Fulcio-Signed Artifact Without Strict OIDC Identity and Rekor Inclusion Verification","stars_count":77,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","sigstore","supply-chain","cosign","oidc","admission-controller"],"exportEndpoints":{"claude":"/api/rules/sigstore-keyless-oidc-attestation-verification-standard?format=claude","cursorMdc":"/api/rules/sigstore-keyless-oidc-attestation-verification-standard?format=mdc","cursorrules":"/api/rules/sigstore-keyless-oidc-attestation-verification-standard?format=cursor","windsurf":"/api/rules/sigstore-keyless-oidc-attestation-verification-standard?format=windsurf","agents":"/api/rules/sigstore-keyless-oidc-attestation-verification-standard?format=agents"}},{"id":"ebpf-frame-pointer-unwind-overhead-guardrail","title":"eBPF Continuous Profiling DWARF-less Frame Pointer Unwind Standard","category":"devops","severity":"critical","description":"Enforces frame-pointer preservation across all compiled production binaries and runtime flags to enable zero-overhead kernel-level eBPF stack unwinding. Replaces heavy user-space DWARF/`.eh_frame` stack-walking algorithms with native BPF helper unwinding (`bpf_get_stackid`), guaranteeing continuous profiling CPU overhead remains strictly under 1%.","antiPatternHeadline":"Omitted Frame Pointers Forcing Out-of-Band DWARF Stack Walks and High CPU Overhead","stars_count":68,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","profiling","observability","linux","performance","systems"],"exportEndpoints":{"claude":"/api/rules/ebpf-frame-pointer-unwind-overhead-guardrail?format=claude","cursorMdc":"/api/rules/ebpf-frame-pointer-unwind-overhead-guardrail?format=mdc","cursorrules":"/api/rules/ebpf-frame-pointer-unwind-overhead-guardrail?format=cursor","windsurf":"/api/rules/ebpf-frame-pointer-unwind-overhead-guardrail?format=windsurf","agents":"/api/rules/ebpf-frame-pointer-unwind-overhead-guardrail?format=agents"}},{"id":"nextjs-15-ppr-dynamic-boundary-guard","title":"Next.js 15 PPR Dynamic Boundary & Static Shell Leak Guard","category":"frontend","severity":"critical","description":"Enforces strict physical separation between statically prerendered edge shells and dynamically streamed SSR holes under Next.js 15 Partial Prerendering (PPR). Guarantees that request-bound dynamic APIs (cookies, headers, searchParams) and authenticated user state are encapsulated strictly within React Suspense boundaries, preventing auth session leaks into edge caches or dynamic bailout crashes.","antiPatternHeadline":"Dynamic Context Extraction Outside Suspense Boundaries in PPR Shells","stars_count":46,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["nextjs","nextjs-15","partial-prerendering","react-server-components","security","cache-isolation"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-ppr-dynamic-boundary-guard?format=claude","cursorMdc":"/api/rules/nextjs-15-ppr-dynamic-boundary-guard?format=mdc","cursorrules":"/api/rules/nextjs-15-ppr-dynamic-boundary-guard?format=cursor","windsurf":"/api/rules/nextjs-15-ppr-dynamic-boundary-guard?format=windsurf","agents":"/api/rules/nextjs-15-ppr-dynamic-boundary-guard?format=agents"}},{"id":"axum-tokio-cooperative-cancellation-invariant","title":"Axum 0.8 Tokio Cooperative Task Cancellation Invariant","category":"backend","severity":"critical","description":"Enforces deterministic cancellation token propagation and drop safety across Axum 0.8 handler trees and Tower middleware layers. Prevents orphaned database transactions, hung connection pools, and leaked socket handles caused by unmonitored client TCP disconnects and detached asynchronous task spawns.","antiPatternHeadline":"Detached Task Spawning and Cancellation-Unsafe Async Handlers Leaking DB Pool Resources on Client Disconnect","stars_count":58,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tokio","async","cancellation-safety","concurrency"],"exportEndpoints":{"claude":"/api/rules/axum-tokio-cooperative-cancellation-invariant?format=claude","cursorMdc":"/api/rules/axum-tokio-cooperative-cancellation-invariant?format=mdc","cursorrules":"/api/rules/axum-tokio-cooperative-cancellation-invariant?format=cursor","windsurf":"/api/rules/axum-tokio-cooperative-cancellation-invariant?format=windsurf","agents":"/api/rules/axum-tokio-cooperative-cancellation-invariant?format=agents"}},{"id":"capacitor-7-zero-copy-memory-channel-guardrail","title":"Capacitor 7 Native-to-WebView Zero-Copy Memory Channel and Ownership Transfer","category":"mobile","severity":"critical","description":"Enforces strict buffer ownership semantics across the native-to-WebView bridge in Capacitor 7 applications handling high-throughput telemetry or sensor feeds. Prohibits base64 serialization, repetitive allocation of typed arrays in hot event loops, and unmanaged native shared-buffer handles that trigger GC thrashing and frame drops. Mandates ring buffer recycling or explicit Transferable ArrayBuffer detachment patterns via Capacitor WebView asset handlers or customized WebKit/Android message channels.","antiPatternHeadline":"Base64 JSON Serialization and Hot-Loop TypedArray Reallocation on Bridge Interfaces","stars_count":114,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor7","zero-copy","memory-management","web-workers","performance"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-zero-copy-memory-channel-guardrail?format=claude","cursorMdc":"/api/rules/capacitor-7-zero-copy-memory-channel-guardrail?format=mdc","cursorrules":"/api/rules/capacitor-7-zero-copy-memory-channel-guardrail?format=cursor","windsurf":"/api/rules/capacitor-7-zero-copy-memory-channel-guardrail?format=windsurf","agents":"/api/rules/capacitor-7-zero-copy-memory-channel-guardrail?format=agents"}},{"id":"webauthn-l3-conditional-ui-binding","title":"WebAuthn Level 3 Strict Origin Binding & Single-Use Challenge Lifecycle","category":"security","severity":"critical","description":"Enforces cryptographically bound origin verification, strict RP ID matching, and atomic single-use challenge expiration for WebAuthn Level 3 Conditional UI (autofill) flows. Mitigates asynchronous replay attacks and credential forwarding across origins by mandating sub-minute TTLs, atomic challenge consumption, and topOrigin validation in nested contexts.","antiPatternHeadline":"Reusable Session Challenges and Permissive Origin Matching in Passkey Autofill Verification","stars_count":86,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","passkeys","fido2","authentication","conditional-ui","replay-prevention"],"exportEndpoints":{"claude":"/api/rules/webauthn-l3-conditional-ui-binding?format=claude","cursorMdc":"/api/rules/webauthn-l3-conditional-ui-binding?format=mdc","cursorrules":"/api/rules/webauthn-l3-conditional-ui-binding?format=cursor","windsurf":"/api/rules/webauthn-l3-conditional-ui-binding?format=windsurf","agents":"/api/rules/webauthn-l3-conditional-ui-binding?format=agents"}},{"id":"opentelemetry-w3c-baggage-propagation-isolation-standard","title":"OpenTelemetry W3C Baggage Sanitization and Propagation Isolation Standard","category":"devops","severity":"critical","description":"Enforces strict input validation, key allowlisting, and byte-budget limits on OpenTelemetry W3C Baggage propagation across distributed systems. Prevents header injection (CRLF), HTTP 431 (Request Header Fields Too Large) outages, and multi-tenant context leakage across trust boundaries.","antiPatternHeadline":"Unbounded, Raw Baggage Injection and Forwarding Across Untrusted Boundaries","stars_count":118,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","security","distributed-tracing","w3c-baggage","observability"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-w3c-baggage-propagation-isolation-standard?format=claude","cursorMdc":"/api/rules/opentelemetry-w3c-baggage-propagation-isolation-standard?format=mdc","cursorrules":"/api/rules/opentelemetry-w3c-baggage-propagation-isolation-standard?format=cursor","windsurf":"/api/rules/opentelemetry-w3c-baggage-propagation-isolation-standard?format=windsurf","agents":"/api/rules/opentelemetry-w3c-baggage-propagation-isolation-standard?format=agents"}},{"id":"react-19-server-action-idempotency-optimistic-rollback-react-19-server--369","title":"React 19 Server Action Idempotency and Deterministic Optimistic Rollback Boundaries","category":"frontend","severity":"critical","description":"Enforces deterministic client-side optimistic rollbacks and server-side mutation deduplication across React 19 Server Actions. Guarantees that optimistic updates via useOptimistic and useActionState bind directly to deterministic idempotency tokens, preventing ghost state commits and duplicate execution during transient network dropouts or browser reconnects.","antiPatternHeadline":"Executing non-idempotent Server Actions without deterministic rollback anchors or client mutation tokens","stars_count":54,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","server-actions","useOptimistic","useActionState","idempotency"],"exportEndpoints":{"claude":"/api/rules/react-19-server-action-idempotency-optimistic-rollback-react-19-server--369?format=claude","cursorMdc":"/api/rules/react-19-server-action-idempotency-optimistic-rollback-react-19-server--369?format=mdc","cursorrules":"/api/rules/react-19-server-action-idempotency-optimistic-rollback-react-19-server--369?format=cursor","windsurf":"/api/rules/react-19-server-action-idempotency-optimistic-rollback-react-19-server--369?format=windsurf","agents":"/api/rules/react-19-server-action-idempotency-optimistic-rollback-react-19-server--369?format=agents"}},{"id":"postgres-17-failover-slot-synchronization-guardrail","title":"PostgreSQL 17 Logical Replication Slot Failover Synchronization Invariant","category":"backend","severity":"critical","description":"Enforces PostgreSQL 17 native logical replication failover slot synchronization across high-availability architectures. Guarantees logical slots are synchronized to physical standbys via failover flags and synchronized standby lists, preventing slot invalidation, WAL truncation, and downstream consumer deadlocks during physical promotions.","antiPatternHeadline":"Provisioning logical slots or subscriptions without failover propagation across physical standbys","stars_count":47,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres","postgres-17","logical-replication","high-availability","wal"],"exportEndpoints":{"claude":"/api/rules/postgres-17-failover-slot-synchronization-guardrail?format=claude","cursorMdc":"/api/rules/postgres-17-failover-slot-synchronization-guardrail?format=mdc","cursorrules":"/api/rules/postgres-17-failover-slot-synchronization-guardrail?format=cursor","windsurf":"/api/rules/postgres-17-failover-slot-synchronization-guardrail?format=windsurf","agents":"/api/rules/postgres-17-failover-slot-synchronization-guardrail?format=agents"}},{"id":"dpop-rfc9449-gateway-proof-replay-defense","title":"OAuth 2.0 DPoP (RFC 9449) Gateway Proof Replay Defense & Distributed Nonce Invariants","category":"security","severity":"critical","description":"Enforces cryptographic verification of RFC 9449 Demonstrating Proof-of-Possession (DPoP) proof tokens at edge API gateways, binding requests to client public keys and token hash (ath). Mandates distributed, atomic single-use tracking of proof identifiers (jti) and low-latency server-generated nonces to guarantee strict replay defense across clustered gateway instances.","antiPatternHeadline":"Stateless DPoP Proof Validation Omitting Distributed JTI Tracking, URI/Method Binding, or Server-Provided Nonce Verification","stars_count":43,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","oauth2","rfc9449","dpop","api-gateway","replay-prevention"],"exportEndpoints":{"claude":"/api/rules/dpop-rfc9449-gateway-proof-replay-defense?format=claude","cursorMdc":"/api/rules/dpop-rfc9449-gateway-proof-replay-defense?format=mdc","cursorrules":"/api/rules/dpop-rfc9449-gateway-proof-replay-defense?format=cursor","windsurf":"/api/rules/dpop-rfc9449-gateway-proof-replay-defense?format=windsurf","agents":"/api/rules/dpop-rfc9449-gateway-proof-replay-defense?format=agents"}},{"id":"tauri-ipc-binary-channel-backpressure-invariant","title":"Tauri 2.0 IPC Binary Channel Streaming & Credit-Based Backpressure Invariant","category":"mobile","severity":"critical","description":"Governs ring-buffer backpressure between Rust host processes and multi-window webviews during high-throughput binary payload ingestion. Mandates credit-based pull acknowledgments over Tauri 2.0 Channel primitives to eliminate unbounded V8 microtask accumulation, UI thread starvation, and mobile OS out-of-memory terminations.","antiPatternHeadline":"Unbounded Fire-and-Forget Tauri Event/Channel Emission Leading to Mobile Webview Heap Exhaustion and UI Freezes","stars_count":74,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri-2","ipc","backpressure","rust","memory-leak"],"exportEndpoints":{"claude":"/api/rules/tauri-ipc-binary-channel-backpressure-invariant?format=claude","cursorMdc":"/api/rules/tauri-ipc-binary-channel-backpressure-invariant?format=mdc","cursorrules":"/api/rules/tauri-ipc-binary-channel-backpressure-invariant?format=cursor","windsurf":"/api/rules/tauri-ipc-binary-channel-backpressure-invariant?format=windsurf","agents":"/api/rules/tauri-ipc-binary-channel-backpressure-invariant?format=agents"}},{"id":"k8s-gateway-api-referencegrant-enforcement","title":"Kubernetes Gateway API ReferenceGrant Cross-Namespace Isolation","category":"devops","severity":"critical","description":"Enforces strict multi-tenant boundary isolation under the Kubernetes Gateway API specification by mandating explicit ReferenceGrant resources for all cross-namespace references. Prohibits unauthorized cross-namespace backendRefs and parentRefs to prevent traffic hijacking, data exfiltration, and cross-tenant credential or service exposure.","antiPatternHeadline":"Cross-Namespace Service Hijack via Unsanctioned Gateway Route Backends","stars_count":77,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","kubernetes","gateway-api","security","multi-tenancy","zero-trust"],"exportEndpoints":{"claude":"/api/rules/k8s-gateway-api-referencegrant-enforcement?format=claude","cursorMdc":"/api/rules/k8s-gateway-api-referencegrant-enforcement?format=mdc","cursorrules":"/api/rules/k8s-gateway-api-referencegrant-enforcement?format=cursor","windsurf":"/api/rules/k8s-gateway-api-referencegrant-enforcement?format=windsurf","agents":"/api/rules/k8s-gateway-api-referencegrant-enforcement?format=agents"}},{"id":"svelte-5-runes-microtask-reactivity-graph-standard","title":"Svelte 5 Runes Microtask Graph & Deterministic Signal Derivation Standard","category":"frontend","severity":"critical","description":"Enforces strict push-pull topological isolation within Svelte 5 runes ($state, $derived, $effect) during ultra-high-frequency state mutations (e.g., WebSocket feeds, canvas frame loops, high-rate telemetry). Mandates untracked boundary separation and explicit microtask-batched state transitions to eliminate cyclic signal re-entrancy and microtask starvation. Prevents catastrophic infinite notification cascades in Svelte's push-pull reactive dependency graph.","antiPatternHeadline":"Mutating reactive state inside an untracked $effect dependency or synchronous cross-signal mutation loop triggering runaway microtask cascade.","stars_count":117,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","reactivity","signals","performance"],"exportEndpoints":{"claude":"/api/rules/svelte-5-runes-microtask-reactivity-graph-standard?format=claude","cursorMdc":"/api/rules/svelte-5-runes-microtask-reactivity-graph-standard?format=mdc","cursorrules":"/api/rules/svelte-5-runes-microtask-reactivity-graph-standard?format=cursor","windsurf":"/api/rules/svelte-5-runes-microtask-reactivity-graph-standard?format=windsurf","agents":"/api/rules/svelte-5-runes-microtask-reactivity-graph-standard?format=agents"}},{"id":"vite-rolldown-federation-singleton-boundary","title":"Vite 6 Rolldown Module Federation Singleton & Symbol Isolation Invariant","category":"frontend","severity":"critical","description":"Enforces deterministic runtime singleton boundaries and strict AST tree-shaking across Vite 6 and Rolldown federated micro-frontends. Prevents dual-package hazards, duplicate React/state-store runtime instantiation, and catastrophic symbol leaks across asynchronous federated boundaries.","antiPatternHeadline":"Dual-Instance Leaks and Tree-Shaking Bailout via Unconstrained Federated Shared Dependencies","stars_count":81,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","vite6","rolldown","module-federation","micro-frontends","tree-shaking"],"exportEndpoints":{"claude":"/api/rules/vite-rolldown-federation-singleton-boundary?format=claude","cursorMdc":"/api/rules/vite-rolldown-federation-singleton-boundary?format=mdc","cursorrules":"/api/rules/vite-rolldown-federation-singleton-boundary?format=cursor","windsurf":"/api/rules/vite-rolldown-federation-singleton-boundary?format=windsurf","agents":"/api/rules/vite-rolldown-federation-singleton-boundary?format=agents"}},{"id":"fastapi-anyio-capacity-limiter-partitioning-standard","title":"FastAPI AnyIO Dynamic CapacityLimiter Partitioning Standard","category":"backend","severity":"critical","description":"Enforces isolated AnyIO CapacityLimiter instances across distinct FastAPI endpoint concurrency tiers to eliminate worker thread pool starvation. By default, AnyIO executes synchronous endpoints against a single global thread limiter (40 tokens), allowing slow, blocking I/O or legacy synchronous SDK calls to monopolize worker threads and starve latency-critical endpoints. Explicitly partitioning thread pool limiters by operational profile guarantees deterministic latency and resilient concurrency isolation.","antiPatternHeadline":"Global AnyIO Thread Pool Monopolization via Unpartitioned Synchronous Endpoints","stars_count":69,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["fastapi","anyio","asyncio","concurrency","thread-pool","capacity-limiter","python"],"exportEndpoints":{"claude":"/api/rules/fastapi-anyio-capacity-limiter-partitioning-standard?format=claude","cursorMdc":"/api/rules/fastapi-anyio-capacity-limiter-partitioning-standard?format=mdc","cursorrules":"/api/rules/fastapi-anyio-capacity-limiter-partitioning-standard?format=cursor","windsurf":"/api/rules/fastapi-anyio-capacity-limiter-partitioning-standard?format=windsurf","agents":"/api/rules/fastapi-anyio-capacity-limiter-partitioning-standard?format=agents"}},{"id":"postgres-17-json-table-vectorized-pushdown-guardrail","title":"Postgres 17 JSON_TABLE Projection Pushdown and SIMD Scan Optimization","category":"backend","severity":"critical","description":"Postgres 17 introduces SQL:2023 JSON_TABLE capabilities which allow tabular projection of jsonb data. When combined with functional indexes or targeted expressions, queries must be structured to ensure projection predicates push down to the storage engine (heap or index scan) rather than forcing full document retrieval and CPU-intensive serial JSON deserialization across thousands of rows.","antiPatternHeadline":"Unindexed JSON_TABLE Path Projections Triggering Per-Row CPU Deserialization and Memory Spills","stars_count":80,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres","postgresql-17","json-table","performance","query-optimization"],"exportEndpoints":{"claude":"/api/rules/postgres-17-json-table-vectorized-pushdown-guardrail?format=claude","cursorMdc":"/api/rules/postgres-17-json-table-vectorized-pushdown-guardrail?format=mdc","cursorrules":"/api/rules/postgres-17-json-table-vectorized-pushdown-guardrail?format=cursor","windsurf":"/api/rules/postgres-17-json-table-vectorized-pushdown-guardrail?format=windsurf","agents":"/api/rules/postgres-17-json-table-vectorized-pushdown-guardrail?format=agents"}},{"id":"openfga-cdc-distributed-rebac-invalidation-standard","title":"Transactional CDC-Driven ReBAC Cache Invalidation Standard","category":"security","severity":"critical","description":"Enforces deterministic, transactional log-driven cache invalidation across distributed edge Policy Decision Points (PDPs) during OpenFGA relationship tuple mutations. Eliminates authorization latency skew and the window of vulnerability inherent in dual-write caching by binding edge cache freshness directly to database write-ahead logs (WAL). Guarantees immediate revocation propagation and prevents stale authorization decisions across globally distributed edge nodes.","antiPatternHeadline":"Dual-Write Cache Eviction and Unsynchronized TTLs for ReBAC Decision Caching","stars_count":83,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","rebac","openfga","cdc","distributed-systems","edge-cache"],"exportEndpoints":{"claude":"/api/rules/openfga-cdc-distributed-rebac-invalidation-standard?format=claude","cursorMdc":"/api/rules/openfga-cdc-distributed-rebac-invalidation-standard?format=mdc","cursorrules":"/api/rules/openfga-cdc-distributed-rebac-invalidation-standard?format=cursor","windsurf":"/api/rules/openfga-cdc-distributed-rebac-invalidation-standard?format=windsurf","agents":"/api/rules/openfga-cdc-distributed-rebac-invalidation-standard?format=agents"}},{"id":"webauthn-conditional-mediation-session-binding-invariant","title":"WebAuthn Conditional Mediation Ephemeral Challenge Session-Binding Standard","category":"security","severity":"critical","description":"Enforces strict cryptographic binding between WebAuthn conditional mediation (autofill) authentication challenges and ephemeral, single-use pre-session nonces. Prevents passkey assertion replay, cross-tab challenge hijacking, and session fixation vulnerabilities during passive credential autofill flows.","antiPatternHeadline":"Global Challenge Pools, Unpinned Conditional Challenges, or Absent Post-Assertion Session Regeneration","stars_count":78,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","passkeys","session-management","cryptography","conditional-mediation"],"exportEndpoints":{"claude":"/api/rules/webauthn-conditional-mediation-session-binding-invariant?format=claude","cursorMdc":"/api/rules/webauthn-conditional-mediation-session-binding-invariant?format=mdc","cursorrules":"/api/rules/webauthn-conditional-mediation-session-binding-invariant?format=cursor","windsurf":"/api/rules/webauthn-conditional-mediation-session-binding-invariant?format=windsurf","agents":"/api/rules/webauthn-conditional-mediation-session-binding-invariant?format=agents"}},{"id":"react-native-bridgeless-jsi-handle-lifecycle-guardrail","title":"React Native Bridgeless TurboModule Zero-Leak JSI Memory Safety Standard","category":"mobile","severity":"critical","description":"Enforces strict zero-leak JSI handle lifecycles and explicit jsi::Scope isolation across React Native Bridgeless TurboModules. Prevents native heap fragmentation and Hermes/V8 GC exhaustion during high-throughput synchronous native-to-JS invocations by mandating typed buffers and forbidding persistent raw JSI pointer captures.","antiPatternHeadline":"Unscoped Synchronous JSI Value Retention and Unbounded Object Allocation in High-Frequency Native TurboModule Bridges","stars_count":50,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","react-native","turbomodules","jsi","bridgeless","memory-safety","hermes"],"exportEndpoints":{"claude":"/api/rules/react-native-bridgeless-jsi-handle-lifecycle-guardrail?format=claude","cursorMdc":"/api/rules/react-native-bridgeless-jsi-handle-lifecycle-guardrail?format=mdc","cursorrules":"/api/rules/react-native-bridgeless-jsi-handle-lifecycle-guardrail?format=cursor","windsurf":"/api/rules/react-native-bridgeless-jsi-handle-lifecycle-guardrail?format=windsurf","agents":"/api/rules/react-native-bridgeless-jsi-handle-lifecycle-guardrail?format=agents"}},{"id":"kmp-compose-direct-skia-render-pipeline","title":"Direct Skia Native Surface Render Pipeline for Variable Refresh Rate Displays","category":"mobile","severity":"critical","description":"Enforces direct unbuffered drawing through Skia native surfaces (SurfaceControl/ANativeWindow on Android and CAMetalLayer on iOS) in Kotlin Multiplatform Compose. Bypasses intermediate OS compositors and view hierarchy overlays to eliminate tearing, phase-shift jitter, and dropped frames on 120Hz+ ProMotion and Dynamic AMOLED displays.","antiPatternHeadline":"Route-through-View Compositor Bridging and Unsynchronized Skia Flush Deadlocks","stars_count":75,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kmp","compose-multiplatform","skia","metal","vulkan","promotion-120hz"],"exportEndpoints":{"claude":"/api/rules/kmp-compose-direct-skia-render-pipeline?format=claude","cursorMdc":"/api/rules/kmp-compose-direct-skia-render-pipeline?format=mdc","cursorrules":"/api/rules/kmp-compose-direct-skia-render-pipeline?format=cursor","windsurf":"/api/rules/kmp-compose-direct-skia-render-pipeline?format=windsurf","agents":"/api/rules/kmp-compose-direct-skia-render-pipeline?format=agents"}},{"id":"cilium-tetragon-ebpf-executable-integrity-attestation-standard","title":"Cilium Tetragon eBPF Continuous Executable Integrity & IMA Attestation Standard","category":"devops","severity":"critical","description":"Enforces continuous kernel-level cryptographic hash validation of running binaries via Cilium Tetragon TracingPolicies and Linux Integrity Measurement Architecture (IMA) before granting execution or namespace capabilities. Prevents in-memory binary tampering, unauthorized file mutations, and execution of untrusted artifacts inside hardened Kubernetes pods by terminating violating processes synchronously via Sigkill in the kernel.","antiPatternHeadline":"Permitting Unverified Binary Execution and Reliance on Post-Mortem User-Space Audit Logs Without In-Kernel eBPF Enforcement","stars_count":56,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","cilium","tetragon","ebpf","kubernetes","ima","security","zero-trust"],"exportEndpoints":{"claude":"/api/rules/cilium-tetragon-ebpf-executable-integrity-attestation-standard?format=claude","cursorMdc":"/api/rules/cilium-tetragon-ebpf-executable-integrity-attestation-standard?format=mdc","cursorrules":"/api/rules/cilium-tetragon-ebpf-executable-integrity-attestation-standard?format=cursor","windsurf":"/api/rules/cilium-tetragon-ebpf-executable-integrity-attestation-standard?format=windsurf","agents":"/api/rules/cilium-tetragon-ebpf-executable-integrity-attestation-standard?format=agents"}},{"id":"opentelemetry-exemplar-reservoir-budget-invariant","title":"OpenTelemetry Metrics Exemplar Reservoir Sampling Budget Invariant","category":"devops","severity":"critical","description":"Enforces deterministic memory bounds on OpenTelemetry exemplar reservoir allocators during metric aggregation. Prevents high-throughput trace-exemplar retention from causing Collector and SDK-process Out-Of-Memory (OOM) heap cascades during latency spikes and traffic bursts.","antiPatternHeadline":"Unbounded or Default Exemplar Allocation on High-Throughput Aggregations Inducing Process Heap Exhaustion","stars_count":112,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","metrics","observability","memory-management","site-reliability"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-exemplar-reservoir-budget-invariant?format=claude","cursorMdc":"/api/rules/opentelemetry-exemplar-reservoir-budget-invariant?format=mdc","cursorrules":"/api/rules/opentelemetry-exemplar-reservoir-budget-invariant?format=cursor","windsurf":"/api/rules/opentelemetry-exemplar-reservoir-budget-invariant?format=windsurf","agents":"/api/rules/opentelemetry-exemplar-reservoir-budget-invariant?format=agents"}},{"id":"react-19-taint-api-serialization-guard","title":"React 19 Object Taint API and Serialization Boundary Guardrail","category":"frontend","severity":"critical","description":"Enforces strict compile-time and runtime serialization boundaries between React Server Components (RSC) and Client Components. Mandates the explicit application of React 19 experimental_taintObjectReference and experimental_taintUniqueValue on sensitive domain entities, secrets, and raw database records to eliminate server-to-client credential and PII leakage.","antiPatternHeadline":"Leaking unredacted database entities or secrets across RSC boundary into Client Component props or Server Action responses","stars_count":50,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","rsc","taint-api","security","serialization"],"exportEndpoints":{"claude":"/api/rules/react-19-taint-api-serialization-guard?format=claude","cursorMdc":"/api/rules/react-19-taint-api-serialization-guard?format=mdc","cursorrules":"/api/rules/react-19-taint-api-serialization-guard?format=cursor","windsurf":"/api/rules/react-19-taint-api-serialization-guard?format=windsurf","agents":"/api/rules/react-19-taint-api-serialization-guard?format=agents"}},{"id":"nextjs-15-ppr-dynamic-hole-decoupling-standard","title":"Next.js 15 PPR Dynamic Hole Decoupling and Static Shell Isolation","category":"frontend","severity":"critical","description":"Enforces strict isolation of dynamic runtime APIs (cookies, headers, connection, dynamic fetch) within Suspense-bounded leaf components under Next.js 15 Partial Prerendering (PPR). Prevents dynamic context evaluation from bubbling up to layout shells, guaranteeing instant static shell delivery and resilient micro-hole streaming.","antiPatternHeadline":"Dynamic Request API Cascade Poisoning Static Shell Prerender","stars_count":115,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs","nextjs-15","partial-prerendering","react-suspense","performance"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-ppr-dynamic-hole-decoupling-standard?format=claude","cursorMdc":"/api/rules/nextjs-15-ppr-dynamic-hole-decoupling-standard?format=mdc","cursorrules":"/api/rules/nextjs-15-ppr-dynamic-hole-decoupling-standard?format=cursor","windsurf":"/api/rules/nextjs-15-ppr-dynamic-hole-decoupling-standard?format=windsurf","agents":"/api/rules/nextjs-15-ppr-dynamic-hole-decoupling-standard?format=agents"}},{"id":"bun-websocket-kernel-hibernation-contract","title":"Bun 1.2 Native WebSocket Kernel Hibernation & Zero-Heap Idle Sockets","category":"backend","severity":"critical","description":"Enforces Bun 1.2 native WebSocket server configuration patterns utilizing kernel-level epoll hibernation to eliminate V8/JSC heap bloat over massive concurrent connections. Mandates declarative pub/sub topics and context detachment to prevent socket retention leaks in userland memory, allowing idle connections to sleep entirely in the kernel until packet ingress.","antiPatternHeadline":"Retaining JavaScript WebSocket References in Userland Closures and In-Memory Registry Sets","stars_count":101,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","websockets","performance","networking","high-concurrency"],"exportEndpoints":{"claude":"/api/rules/bun-websocket-kernel-hibernation-contract?format=claude","cursorMdc":"/api/rules/bun-websocket-kernel-hibernation-contract?format=mdc","cursorrules":"/api/rules/bun-websocket-kernel-hibernation-contract?format=cursor","windsurf":"/api/rules/bun-websocket-kernel-hibernation-contract?format=windsurf","agents":"/api/rules/bun-websocket-kernel-hibernation-contract?format=agents"}},{"id":"axum-08-tower-stream-backpressure-invariant","title":"Axum 0.8 Tower Zero-Copy Body Stream Backpressure Invariant","category":"backend","severity":"critical","description":"Enforces strict end-to-end asynchronous backpressure across Axum 0.8 and Tower service pipelines to prevent unbounded memory growth during multi-gigabyte payload ingests. Prohibits eager body collection into heap buffers, mandating zero-copy streaming directly from the transport layer into rate-governed sinks to maintain HTTP/2 and TCP receive window constraints.","antiPatternHeadline":"Buffering Inbound Request Bodies into Unbounded Memory Buffers Without Transport Backpressure","stars_count":88,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tower","tokio","zero-copy","backpressure","memory-safety"],"exportEndpoints":{"claude":"/api/rules/axum-08-tower-stream-backpressure-invariant?format=claude","cursorMdc":"/api/rules/axum-08-tower-stream-backpressure-invariant?format=mdc","cursorrules":"/api/rules/axum-08-tower-stream-backpressure-invariant?format=cursor","windsurf":"/api/rules/axum-08-tower-stream-backpressure-invariant?format=windsurf","agents":"/api/rules/axum-08-tower-stream-backpressure-invariant?format=agents"}},{"id":"postgres-17-logical-replication-failover-slot-sync-postgres-17-logi-326","title":"Postgres 17 Logical Replication Failover Slot Sync Standard","category":"backend","severity":"critical","description":"Enforces Postgres 17 native logical replication slot synchronization across physical standbys using 'failover = true' and 'sync_replication_slots'. Eliminates LSN divergence, silent data loss, and downstream message replay storms in Change Data Capture (CDC) architectures during automated high-availability failover events.","antiPatternHeadline":"Creating Logical Slots Without Failover Synchronization Causing Catastrophic CDC Replay on Promotion","stars_count":84,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","cdc","replication","high-availability","database-reliability"],"exportEndpoints":{"claude":"/api/rules/postgres-17-logical-replication-failover-slot-sync-postgres-17-logi-326?format=claude","cursorMdc":"/api/rules/postgres-17-logical-replication-failover-slot-sync-postgres-17-logi-326?format=mdc","cursorrules":"/api/rules/postgres-17-logical-replication-failover-slot-sync-postgres-17-logi-326?format=cursor","windsurf":"/api/rules/postgres-17-logical-replication-failover-slot-sync-postgres-17-logi-326?format=windsurf","agents":"/api/rules/postgres-17-logical-replication-failover-slot-sync-postgres-17-logi-326?format=agents"}},{"id":"android-15-ndk-16kb-page-alignment","title":"Android 15 NDK 16KB Page Alignment and Memory Boundary Guardrail","category":"mobile","severity":"critical","description":"Enforces strict 16KB memory page boundary alignment for all native C/C++ shared objects (.so), linker flags, and JNI memory mappings targeting Android 15 (API 35+) and modern hardware. Failure to align ELF segments to 16KB boundaries results in runtime linker segmentation faults (SIGSEGV) and fatal dlopen crashes on modern arm64-v8a devices. Mandates automated ELF verification, linker configuration updates, and safe JNI direct buffer mapping.","antiPatternHeadline":"Compiling NDK Binaries with Default 4KB Alignment Leading to Silent SIGSEGV on Android 15+","stars_count":104,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","android","ndk","jni","c++","memory-alignment","android-15"],"exportEndpoints":{"claude":"/api/rules/android-15-ndk-16kb-page-alignment?format=claude","cursorMdc":"/api/rules/android-15-ndk-16kb-page-alignment?format=mdc","cursorrules":"/api/rules/android-15-ndk-16kb-page-alignment?format=cursor","windsurf":"/api/rules/android-15-ndk-16kb-page-alignment?format=windsurf","agents":"/api/rules/android-15-ndk-16kb-page-alignment?format=agents"}},{"id":"swift-6-complete-concurrency-actor-isolation","title":"Swift 6 Complete Concurrency & Sendable Actor Isolation Standard","category":"mobile","severity":"critical","description":"Enforces complete compile-time data-race safety across iOS/macOS runtime environments in Swift 6 mode. Mandates strict conformance to Sendable across actor and task execution domains, eliminating unsynchronized mutable state across concurrent threads.","antiPatternHeadline":"Bypassing Sendable Checks via @unchecked Sendable or Mutating Mutable Reference Types Across Task Boundaries","stars_count":61,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","swift6","concurrency","actors","sendable","ios"],"exportEndpoints":{"claude":"/api/rules/swift-6-complete-concurrency-actor-isolation?format=claude","cursorMdc":"/api/rules/swift-6-complete-concurrency-actor-isolation?format=mdc","cursorrules":"/api/rules/swift-6-complete-concurrency-actor-isolation?format=cursor","windsurf":"/api/rules/swift-6-complete-concurrency-actor-isolation?format=windsurf","agents":"/api/rules/swift-6-complete-concurrency-actor-isolation?format=agents"}},{"id":"pqc-hybrid-mlkem-x25519-tls13-standard","title":"Mandatory PQC Hybrid ML-KEM-768/X25519 TLS 1.3 Key Encapsulation Guardrail","category":"security","severity":"critical","description":"Enforces post-quantum hybrid key encapsulation (X25519MLKEM768 / SecP256r1MLKEM768) on all public ingress termination points and API gateways to neutralize 'Harvest Now, Decrypt Later' (HNDL) adversary campaigns. Requires strict TLS 1.3 minimum versions, explicit quantum-safe elliptic curve and KEM preferences, and rejection of legacy cipher negotiation suites.","antiPatternHeadline":"Accepting classical-only ECDH key exchanges (X25519, P-256) on public TLS 1.3 ingress points","stars_count":112,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","pqc","tls-1-3","cryptography","ml-kem","x25519"],"exportEndpoints":{"claude":"/api/rules/pqc-hybrid-mlkem-x25519-tls13-standard?format=claude","cursorMdc":"/api/rules/pqc-hybrid-mlkem-x25519-tls13-standard?format=mdc","cursorrules":"/api/rules/pqc-hybrid-mlkem-x25519-tls13-standard?format=cursor","windsurf":"/api/rules/pqc-hybrid-mlkem-x25519-tls13-standard?format=windsurf","agents":"/api/rules/pqc-hybrid-mlkem-x25519-tls13-standard?format=agents"}},{"id":"k8s-gateway-api-dynamic-route-policy-attachment-guardrail","title":"Kubernetes Gateway API Dynamic Route and Policy Attachment RBAC Guardrail","category":"devops","severity":"critical","description":"Enforces strict structural segregation between cluster-level infrastructure primitives (Gateway, ReferenceGrant, Direct Policy Attachments) managed by Platform Teams and application-level routing (HTTPRoute) managed by development teams. Eliminates insecure cross-namespace service leaks and replaces legacy Ingress controller mutation annotations with native Kubernetes Gateway API Policy Attachment semantics.","antiPatternHeadline":"Bypassing ReferenceGrant validation and conflating cluster-operator Gateway ownership with app-developer HTTPRoute definitions or legacy Ingress annotations","stars_count":84,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","kubernetes","gateway-api","rbac","security","networking"],"exportEndpoints":{"claude":"/api/rules/k8s-gateway-api-dynamic-route-policy-attachment-guardrail?format=claude","cursorMdc":"/api/rules/k8s-gateway-api-dynamic-route-policy-attachment-guardrail?format=mdc","cursorrules":"/api/rules/k8s-gateway-api-dynamic-route-policy-attachment-guardrail?format=cursor","windsurf":"/api/rules/k8s-gateway-api-dynamic-route-policy-attachment-guardrail?format=windsurf","agents":"/api/rules/k8s-gateway-api-dynamic-route-policy-attachment-guardrail?format=agents"}},{"id":"opentelemetry-ebpf-profiling-flamegraph-correlation-standard","title":"OpenTelemetry eBPF Continuous Profiling & Flamegraph Trace Correlation Standard","category":"devops","severity":"critical","description":"Enforces sub-1% CPU/memory overhead budgets for continuous eBPF kernel profiling in production while mandating deterministic correlation of runtime flamegraphs to OpenTelemetry trace spans. Prevents host performance degradation, harmonic sampling distortion, and orphaned profile telemetry by decoupling symbolication and synchronizing BPF task maps with distributed trace context.","antiPatternHeadline":"Unbounded In-Kernel Sampling and Detached Flamegraphs Lacking Distributed Trace Context","stars_count":69,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","ebpf","profiling","flamegraphs","tracing","observability","performance"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-ebpf-profiling-flamegraph-correlation-standard?format=claude","cursorMdc":"/api/rules/opentelemetry-ebpf-profiling-flamegraph-correlation-standard?format=mdc","cursorrules":"/api/rules/opentelemetry-ebpf-profiling-flamegraph-correlation-standard?format=cursor","windsurf":"/api/rules/opentelemetry-ebpf-profiling-flamegraph-correlation-standard?format=windsurf","agents":"/api/rules/opentelemetry-ebpf-profiling-flamegraph-correlation-standard?format=agents"}},{"id":"axum-0-8-h3-quic-stream-drain-termination","title":"Axum 0.8 HTTP/3 QUIC Stream Draining & Connection Termination Guardrail","category":"backend","severity":"critical","description":"Enforces graceful HTTP/3 connection lifecycle management during SIGTERM and rolling updates in Axum 0.8 / Quinn runtimes. Mandates emission of stepped HTTP/3 GOAWAY frames with stream cancellation shields to eliminate drops of in-flight and 0-RTT early-data requests.","antiPatternHeadline":"Abrupt QUIC Endpoint Teardown and Unshielded Tokio Task Aborts on SIGTERM","stars_count":100,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","http3","quic","quinn","tokio"],"exportEndpoints":{"claude":"/api/rules/axum-0-8-h3-quic-stream-drain-termination?format=claude","cursorMdc":"/api/rules/axum-0-8-h3-quic-stream-drain-termination?format=mdc","cursorrules":"/api/rules/axum-0-8-h3-quic-stream-drain-termination?format=cursor","windsurf":"/api/rules/axum-0-8-h3-quic-stream-drain-termination?format=windsurf","agents":"/api/rules/axum-0-8-h3-quic-stream-drain-termination?format=agents"}},{"id":"webauthn-l3-prf-device-bound-tokens","title":"WebAuthn Level 3 PRF Salted Client Assertion & Device-Bound Token Invariant","category":"security","severity":"critical","description":"Enforces hardware-backed session binding using WebAuthn Level 3 Pseudo-Random Function (PRF) extension outputs to derive symmetric cryptographic keys directly on the client. Prevents session hijacking, stolen cookie replay, and token exfiltration by requiring all authenticated application requests to carry an ephemeral assertion signed by keys derived from authenticator-evaluated salts.","antiPatternHeadline":"Bearer Token Decoupling from Hardware PRF Roots and Unsalted Client Assertion Generation","stars_count":51,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","prf-extension","zero-trust","cryptography","session-security"],"exportEndpoints":{"claude":"/api/rules/webauthn-l3-prf-device-bound-tokens?format=claude","cursorMdc":"/api/rules/webauthn-l3-prf-device-bound-tokens?format=mdc","cursorrules":"/api/rules/webauthn-l3-prf-device-bound-tokens?format=cursor","windsurf":"/api/rules/webauthn-l3-prf-device-bound-tokens?format=windsurf","agents":"/api/rules/webauthn-l3-prf-device-bound-tokens?format=agents"}},{"id":"capacitor-7-background-runner-sandbox-isolation","title":"Capacitor 7 Background Runner Sandbox Isolation & Memory Fence","category":"mobile","severity":"critical","description":"Enforces strict cooperative scheduling quotas, deterministic memory bounds, and defensive sandbox boundaries within Capacitor 7 Background Runner tasks. Prevents fatal OS watchdog terminations (such as iOS Jetsam memory kills and EXC_CRASH 0x8badf00d timeouts) by restricting payload sizes, avoiding native bridge serialization bottlenecks, and yielding execution cycles before OS budget exhaustion.","antiPatternHeadline":"Unbounded Heap Allocation and Monolithic Execution in Headless Background Runner Tasks","stars_count":112,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","background-runner","memory-fence","ios-jetsam","watchdog"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-background-runner-sandbox-isolation?format=claude","cursorMdc":"/api/rules/capacitor-7-background-runner-sandbox-isolation?format=mdc","cursorrules":"/api/rules/capacitor-7-background-runner-sandbox-isolation?format=cursor","windsurf":"/api/rules/capacitor-7-background-runner-sandbox-isolation?format=windsurf","agents":"/api/rules/capacitor-7-background-runner-sandbox-isolation?format=agents"}},{"id":"ebpf-tc-dsr-conntrack-bypass-guardrail","title":"eBPF TC Socket-Layer DSR Packet Scheduling & Conntrack Bypass Invariant","category":"devops","severity":"critical","description":"Mandates kernel-space eBPF TC and socket-layer hooks to implement Direct Server Return (DSR), completely bypassing Linux Netfilter connection tracking (nf_conntrack). Prevents conntrack table exhaustion, SNAT port starvation, and packet drops under multi-gigabit ingress loads by delegating reverse packet egress directly to backend nodes.","antiPatternHeadline":"Routing Multi-Gigabit Ingress Traffic Through Netfilter Conntrack and Reverse-Proxy SNAT","stars_count":79,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","networking","tc","dsr","conntrack","kernel"],"exportEndpoints":{"claude":"/api/rules/ebpf-tc-dsr-conntrack-bypass-guardrail?format=claude","cursorMdc":"/api/rules/ebpf-tc-dsr-conntrack-bypass-guardrail?format=mdc","cursorrules":"/api/rules/ebpf-tc-dsr-conntrack-bypass-guardrail?format=cursor","windsurf":"/api/rules/ebpf-tc-dsr-conntrack-bypass-guardrail?format=windsurf","agents":"/api/rules/ebpf-tc-dsr-conntrack-bypass-guardrail?format=agents"}},{"id":"nextjs15-ppr-dynamic-shell-suspense-boundary-standard","title":"Next.js 15 PPR Dynamic Shell Boundary & Suspense Fallback Quarantine Standard","category":"frontend","severity":"critical","description":"Enforces strict AST-level separation between statically prerendered layout shells and runtime streaming dynamic holes in Next.js 15 Partial Prerendering (PPR). Mandates complete quarantine of dynamic API invocations (cookies, headers, searchParams, and uncached dynamic data fetchers) inside explicit Suspense boundaries with deterministic, zero-dynamic fallback components to eliminate hydration cascades and accidental dynamic bailouts.","antiPatternHeadline":"Dynamic Hook Leaking Above Suspense Boundary Causing Full-Page Static Shell Eviction","stars_count":95,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs15","ppr","react-suspense","hydration","streaming","rsc"],"exportEndpoints":{"claude":"/api/rules/nextjs15-ppr-dynamic-shell-suspense-boundary-standard?format=claude","cursorMdc":"/api/rules/nextjs15-ppr-dynamic-shell-suspense-boundary-standard?format=mdc","cursorrules":"/api/rules/nextjs15-ppr-dynamic-shell-suspense-boundary-standard?format=cursor","windsurf":"/api/rules/nextjs15-ppr-dynamic-shell-suspense-boundary-standard?format=windsurf","agents":"/api/rules/nextjs15-ppr-dynamic-shell-suspense-boundary-standard?format=agents"}},{"id":"spiffe-spire-x509-svid-mtls-zero-downtime-rotation","title":"SPIFFE/SPIRE Dynamic X.509 SVID Sub-Hourly mTLS Rotation Invariant","category":"security","severity":"critical","description":"Enforces non-disruptive, dynamic rotation of short-lived SPIFFE X.509 SVIDs over sub-hourly TTL cycles via the SPIFFE Workload API. Mandates hot-swapping in-memory TLS SecureContext instances and trust bundles without terminating active TCP connections or restarting workload processes across heterogeneous cloud boundaries.","antiPatternHeadline":"Static Disk-Loaded Certificates or Process Restarts on SVID Expiration Leading to Connection Drops","stars_count":79,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","spiffe","spire","mtls","zero-trust","cryptography"],"exportEndpoints":{"claude":"/api/rules/spiffe-spire-x509-svid-mtls-zero-downtime-rotation?format=claude","cursorMdc":"/api/rules/spiffe-spire-x509-svid-mtls-zero-downtime-rotation?format=mdc","cursorrules":"/api/rules/spiffe-spire-x509-svid-mtls-zero-downtime-rotation?format=cursor","windsurf":"/api/rules/spiffe-spire-x509-svid-mtls-zero-downtime-rotation?format=windsurf","agents":"/api/rules/spiffe-spire-x509-svid-mtls-zero-downtime-rotation?format=agents"}},{"id":"tanstack-query-v5-stream-hydration-protocol","title":"TanStack Query v5 Progressive Suspense Chunk Hydration & Stream Ingestion Protocol","category":"frontend","severity":"critical","description":"Enforces deterministic ingestion of streaming SSR chunks into TanStack Query v5 client caches without duplicate network fetches or Suspense boundary layout thrashing. Coordinates progressive stream deserialization, non-zero cache stale time, and stable query client identity across progressive hydration boundaries.","antiPatternHeadline":"Hydration Refetch Storms and Suspense Boundary Tearing via Zero-Stale Streaming Chunk Ingestion","stars_count":62,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","tanstack-query","react-suspense","ssr-streaming","hydration","performance"],"exportEndpoints":{"claude":"/api/rules/tanstack-query-v5-stream-hydration-protocol?format=claude","cursorMdc":"/api/rules/tanstack-query-v5-stream-hydration-protocol?format=mdc","cursorrules":"/api/rules/tanstack-query-v5-stream-hydration-protocol?format=cursor","windsurf":"/api/rules/tanstack-query-v5-stream-hydration-protocol?format=windsurf","agents":"/api/rules/tanstack-query-v5-stream-hydration-protocol?format=agents"}},{"id":"postgres-17-pgvector-iterative-hnsw-workmem-protection","title":"Postgres 17 pgvector Iterative HNSW Work-Mem & Graph Scan Guardrail","category":"backend","severity":"critical","description":"Enforces transaction-scoped memory bounds (hnsw.max_scan_tuples, hnsw.iterative_scan, and work_mem) on Postgres 17 pgvector semantic queries. Prevents noisy-neighbor OOM crashes and server process terminations triggered by unbounded graph traversal across filtered multi-tenant vector indexes.","antiPatternHeadline":"Unbounded Iterative HNSW Index Traversal Under Filtered Multi-Tenant Queries","stars_count":80,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres-17","pgvector","hnsw","database-stability","multi-tenant","memory-management"],"exportEndpoints":{"claude":"/api/rules/postgres-17-pgvector-iterative-hnsw-workmem-protection?format=claude","cursorMdc":"/api/rules/postgres-17-pgvector-iterative-hnsw-workmem-protection?format=mdc","cursorrules":"/api/rules/postgres-17-pgvector-iterative-hnsw-workmem-protection?format=cursor","windsurf":"/api/rules/postgres-17-pgvector-iterative-hnsw-workmem-protection?format=windsurf","agents":"/api/rules/postgres-17-pgvector-iterative-hnsw-workmem-protection?format=agents"}},{"id":"android-15-native-16kb-page-alignment-standard","title":"Android 15 Native ELF 16KB Memory Page Alignment Boundary Standard","category":"mobile","severity":"critical","description":"Enforces 16KB (0x4000) memory page alignment for all compiled C/C++ native shared libraries (.so) and runtime memory allocations targeting Android 15 (API 35) and beyond. Eliminates fatal SIGBUS crashes, memory mapping faults, and runtime loader rejections on 16KB kernel page size hardware while preserving backward compatibility on 4KB devices.","antiPatternHeadline":"Compiling native binaries with legacy 4KB ELF segment alignment and hardcoded PAGE_SIZE assumptions.","stars_count":110,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","android","ndk","cpp","cmake","memory-alignment","android-15"],"exportEndpoints":{"claude":"/api/rules/android-15-native-16kb-page-alignment-standard?format=claude","cursorMdc":"/api/rules/android-15-native-16kb-page-alignment-standard?format=mdc","cursorrules":"/api/rules/android-15-native-16kb-page-alignment-standard?format=cursor","windsurf":"/api/rules/android-15-native-16kb-page-alignment-standard?format=windsurf","agents":"/api/rules/android-15-native-16kb-page-alignment-standard?format=agents"}},{"id":"react-19-preload-hoisting-hydration-order-guardrail","title":"React 19 Native Resource Hoisting & Streaming Preload Order Guardrail","category":"frontend","severity":"critical","description":"Enforces strict utilization of React 19 native document metadata and asset preloading primitives (preload, preconnect, prefetchDNS) within streaming server-rendered microfrontends. Prohibits dynamic imperative head mutation via external head managers or asynchronous useEffect injection to eliminate FOUC, cumulative layout shift (CLS), and head hydration mismatches during concurrent HTML stream chunks.","antiPatternHeadline":"Dynamic Imperative Head Injection and Late Client-Side Preloading During Streaming Suspense","stars_count":99,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","streaming-ssr","microfrontends","web-vitals","resource-hints"],"exportEndpoints":{"claude":"/api/rules/react-19-preload-hoisting-hydration-order-guardrail?format=claude","cursorMdc":"/api/rules/react-19-preload-hoisting-hydration-order-guardrail?format=mdc","cursorrules":"/api/rules/react-19-preload-hoisting-hydration-order-guardrail?format=cursor","windsurf":"/api/rules/react-19-preload-hoisting-hydration-order-guardrail?format=windsurf","agents":"/api/rules/react-19-preload-hoisting-hydration-order-guardrail?format=agents"}},{"id":"openfga-rebac-edge-cache-consistency-boundary","title":"OpenFGA Distributed ReBAC Edge Cache Invalidation & Consistency Boundary","category":"security","severity":"critical","description":"Enforces strict transactional consistency tokens and atomic cache invalidation semantics for OpenFGA relationship-based access control evaluations deployed at edge nodes. Eliminates stale authorization window vulnerabilities (the Zanzibar 'New Enemy' problem) by prohibiting unversioned TTL-only caching and requiring snapshot epoch validation across distributed evaluation points.","antiPatternHeadline":"Naive TTL Edge Caching of OpenFGA Evaluations Without Monotonic Consistency Token Validation","stars_count":99,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","rebac","zanzibar","edge-computing","cache-invalidation"],"exportEndpoints":{"claude":"/api/rules/openfga-rebac-edge-cache-consistency-boundary?format=claude","cursorMdc":"/api/rules/openfga-rebac-edge-cache-consistency-boundary?format=mdc","cursorrules":"/api/rules/openfga-rebac-edge-cache-consistency-boundary?format=cursor","windsurf":"/api/rules/openfga-rebac-edge-cache-consistency-boundary?format=windsurf","agents":"/api/rules/openfga-rebac-edge-cache-consistency-boundary?format=agents"}},{"id":"webauthn-prf-zk-envelope-encryption-standard","title":"WebAuthn PRF Extension Zero-Knowledge Envelope Encryption Standard","category":"security","severity":"critical","description":"Mandates that client-side zero-knowledge encryption powered by the WebAuthn PRF extension derives cryptographic keys strictly in-memory using HKDF with domain separation. Prohibits transmission of raw PRF outputs or derived Key Encryption Keys (KEKs) to remote servers and requires strict envelope encryption via ephemeral Data Encryption Keys (DEKs).","antiPatternHeadline":"Direct Encryption with Raw PRF Secret Outputs or Exposing Derived Keys to Server APIs","stars_count":65,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","prf-extension","zero-knowledge","envelope-encryption","passkeys","webcrypto"],"exportEndpoints":{"claude":"/api/rules/webauthn-prf-zk-envelope-encryption-standard?format=claude","cursorMdc":"/api/rules/webauthn-prf-zk-envelope-encryption-standard?format=mdc","cursorrules":"/api/rules/webauthn-prf-zk-envelope-encryption-standard?format=cursor","windsurf":"/api/rules/webauthn-prf-zk-envelope-encryption-standard?format=windsurf","agents":"/api/rules/webauthn-prf-zk-envelope-encryption-standard?format=agents"}},{"id":"postgres-17-json-table-memory-quota-standard","title":"Postgres 17 JSON_TABLE Streamed Pipeline Memory Quotas","category":"backend","severity":"critical","description":"Enforces deterministic batching, streaming evaluation, and session-level work_mem guardrails when projecting large JSON/JSONB payloads using PostgreSQL 17 JSON_TABLE. Unbounded relational projections over high-throughput JSON collections cause intermediate palloc allocations inside backend memory contexts that bypass standard executor work_mem, culminating in postmaster backend OOM process termination. All JSON_TABLE queries targeting variable-size collections must bound row outputs via strict path predicates, avoid nested array projections in a single execution step, and run within controlled chunked transactions.","antiPatternHeadline":"Unbounded JSON_TABLE Materialization Without Chunking or Memory Guardrails","stars_count":95,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres","json-table","memory-management","sql","performance"],"exportEndpoints":{"claude":"/api/rules/postgres-17-json-table-memory-quota-standard?format=claude","cursorMdc":"/api/rules/postgres-17-json-table-memory-quota-standard?format=mdc","cursorrules":"/api/rules/postgres-17-json-table-memory-quota-standard?format=cursor","windsurf":"/api/rules/postgres-17-json-table-memory-quota-standard?format=windsurf","agents":"/api/rules/postgres-17-json-table-memory-quota-standard?format=agents"}},{"id":"axum-graceful-connection-migration-sentinel","title":"Axum Persistent Transport Drain and Connection Migration Sentinel","category":"backend","severity":"critical","description":"Mandates coordinated draining and protocol-level handoff for persistent SSE and WebSocket connections during Axum rolling deploys. Enforces RAII connection tracking, shutdown broadcast propagation, and clean frame-level close handshakes (code 1001 Going Away) to prevent client-side socket resets.","antiPatternHeadline":"Abrupt Process Eviction Dropping Active WebSockets and SSE Streams via Socket RST","stars_count":119,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","websockets","sse","graceful-shutdown","tokio"],"exportEndpoints":{"claude":"/api/rules/axum-graceful-connection-migration-sentinel?format=claude","cursorMdc":"/api/rules/axum-graceful-connection-migration-sentinel?format=mdc","cursorrules":"/api/rules/axum-graceful-connection-migration-sentinel?format=cursor","windsurf":"/api/rules/axum-graceful-connection-migration-sentinel?format=windsurf","agents":"/api/rules/axum-graceful-connection-migration-sentinel?format=agents"}},{"id":"cmp-metal-skia-sync-pipeline-guardrail","title":"Compose Multiplatform Metal/Skia iOS Surface Presentation Synchronization Guardrail","category":"mobile","severity":"critical","description":"Enforces deterministic synchronization between Apple Metal command buffer presentation and Skia GPU drawing contexts in Compose Multiplatform. Prevents CAMetalLayer surface deadlocks, command queue starvation, and catastrophic frame pacing drops during concurrent UIKit navigation controller transitions and active Canvas invalidate loops.","antiPatternHeadline":"Unsynchronized CAMetalDrawable acquisition on the main runloop during concurrent UIKit transitions causing Metal thread deadlocks","stars_count":101,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","compose-multiplatform","ios","metal","skia"],"exportEndpoints":{"claude":"/api/rules/cmp-metal-skia-sync-pipeline-guardrail?format=claude","cursorMdc":"/api/rules/cmp-metal-skia-sync-pipeline-guardrail?format=mdc","cursorrules":"/api/rules/cmp-metal-skia-sync-pipeline-guardrail?format=cursor","windsurf":"/api/rules/cmp-metal-skia-sync-pipeline-guardrail?format=windsurf","agents":"/api/rules/cmp-metal-skia-sync-pipeline-guardrail?format=agents"}},{"id":"wasi-p2-socket-sandboxing-standard","title":"WASI 0.2 Component Model Socket Sandboxing & Capability Attestation","category":"devops","severity":"critical","description":"Enforces compile-time-attested capability descriptors and link-time virtualization for multi-tenant serverless WebAssembly components. Mandates that guest components must never import raw WASI 0.2 `wasi:sockets` interfaces directly without cryptographic capability validation, ensuring network egress is constrained exclusively to host-brokered virtual resources.","antiPatternHeadline":"Direct import or non-virtualized link-time binding of unconstrained wasi:sockets interfaces in multi-tenant WASI 0.2 components","stars_count":86,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","wasm","wasi-0.2","sandboxing","security","component-model","zero-trust"],"exportEndpoints":{"claude":"/api/rules/wasi-p2-socket-sandboxing-standard?format=claude","cursorMdc":"/api/rules/wasi-p2-socket-sandboxing-standard?format=mdc","cursorrules":"/api/rules/wasi-p2-socket-sandboxing-standard?format=cursor","windsurf":"/api/rules/wasi-p2-socket-sandboxing-standard?format=windsurf","agents":"/api/rules/wasi-p2-socket-sandboxing-standard?format=agents"}},{"id":"cilium-ebpf-wireguard-mtu-mss-clamping","title":"Cilium eBPF Host Routing MTU Clamping and WireGuard Overlay Guardrail","category":"devops","severity":"critical","description":"Mandates automated TCP MSS clamping and explicit datapath MTU calculation when enabling Cilium WireGuard node-to-node encryption and eBPF host routing. Prevents catastrophic TCP connection stalls and silent blackholing caused by dropped ICMP Fragmentation Needed (Type 3, Code 4) packets in cloud transit VPCs.","antiPatternHeadline":"Deploying Cilium WireGuard encryption on standard 1500 MTU fabrics without eBPF MSS clamping","stars_count":46,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","cilium","ebpf","wireguard","kubernetes","networking","mtu"],"exportEndpoints":{"claude":"/api/rules/cilium-ebpf-wireguard-mtu-mss-clamping?format=claude","cursorMdc":"/api/rules/cilium-ebpf-wireguard-mtu-mss-clamping?format=mdc","cursorrules":"/api/rules/cilium-ebpf-wireguard-mtu-mss-clamping?format=cursor","windsurf":"/api/rules/cilium-ebpf-wireguard-mtu-mss-clamping?format=windsurf","agents":"/api/rules/cilium-ebpf-wireguard-mtu-mss-clamping?format=agents"}},{"id":"svelte-5-effect-root-teardown-boundary","title":"Svelte 5 $effect.root Deterministic Teardown Boundary in Micro-Frontend Shells","category":"frontend","severity":"critical","description":"Enforces strict capture, storage, and deterministic invocation of the disposal function returned by $effect.root when creating reactive rune scopes outside the standard Svelte component tree. Prevents detached signal subgraphs, leaked runtime subscriptions, and cross-application memory growth inside long-lived single-page micro-frontend host containers.","antiPatternHeadline":"Discarding $effect.root Disposal Handles During Micro-Frontend Mounting and Service Instantiation","stars_count":57,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","micro-frontends","memory-leaks"],"exportEndpoints":{"claude":"/api/rules/svelte-5-effect-root-teardown-boundary?format=claude","cursorMdc":"/api/rules/svelte-5-effect-root-teardown-boundary?format=mdc","cursorrules":"/api/rules/svelte-5-effect-root-teardown-boundary?format=cursor","windsurf":"/api/rules/svelte-5-effect-root-teardown-boundary?format=windsurf","agents":"/api/rules/svelte-5-effect-root-teardown-boundary?format=agents"}},{"id":"nextjs-15-cache-life-distributed-stampede-prevention-standard","title":"Next.js 15 Cache Life Distributed Mutex Guardrail for Thundering-Herd Mitigation","category":"backend","severity":"critical","description":"Enforces distributed atomic mutex locks and graceful stale fallback across multi-region edge deployments during Next.js 15 'use cache' and unstable_cache revalidation cycles. Prevents cascading database outages and upstream thundering herds caused by unbounded concurrent cache revalidations when cached items expire under high traffic.","antiPatternHeadline":"Uncoordinated Parallel Edge Cache Revalidations Causing Upstream Saturation","stars_count":76,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","nextjs-15","cache-life","distributed-locks","redis","concurrency"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-cache-life-distributed-stampede-prevention-standard?format=claude","cursorMdc":"/api/rules/nextjs-15-cache-life-distributed-stampede-prevention-standard?format=mdc","cursorrules":"/api/rules/nextjs-15-cache-life-distributed-stampede-prevention-standard?format=cursor","windsurf":"/api/rules/nextjs-15-cache-life-distributed-stampede-prevention-standard?format=windsurf","agents":"/api/rules/nextjs-15-cache-life-distributed-stampede-prevention-standard?format=agents"}},{"id":"axum-0-8-hierarchical-cancellation-token-graceful-drain","title":"Axum 0.8 Hierarchical CancellationToken Graceful Drain Architecture","category":"backend","severity":"critical","description":"Enforces hierarchical Tokio CancellationToken pipelines in Axum 0.8 services to orchestrate deterministic teardown cascades across SSE connections and background tasks. Guarantees active streams emit protocol-compliant termination sequences and in-flight HTTP payloads complete cleanly before socket closure during rolling deployments.","antiPatternHeadline":"Abrupt Process Termination and Orphaned SSE Streams During SIGTERM Cascades","stars_count":114,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["rust","axum","tokio","sse","graceful-shutdown","concurrency"],"exportEndpoints":{"claude":"/api/rules/axum-0-8-hierarchical-cancellation-token-graceful-drain?format=claude","cursorMdc":"/api/rules/axum-0-8-hierarchical-cancellation-token-graceful-drain?format=mdc","cursorrules":"/api/rules/axum-0-8-hierarchical-cancellation-token-graceful-drain?format=cursor","windsurf":"/api/rules/axum-0-8-hierarchical-cancellation-token-graceful-drain?format=windsurf","agents":"/api/rules/axum-0-8-hierarchical-cancellation-token-graceful-drain?format=agents"}},{"id":"postgres-17-hash-index-lock-starvation-guardrail","title":"Postgres 17 Concurrent Hash Index Lock-Starvation Guardrail","category":"backend","severity":"critical","description":"Enforces strict lock-timeout limits, dead-tuple thresholds, and execution budgets on PostgreSQL 17 concurrent hash index workloads. Prevents high-throughput writer processes from monopolizing bucket-level buffer locks and starving autovacuum cleanup routines, preventing severe table bloat and query latency degradation.","antiPatternHeadline":"Unbounded Batch Ingestion Over Hash Indexes Starving Autovacuum Buffer Access","stars_count":85,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","postgres-17","hash-index","autovacuum","concurrency","database-optimization"],"exportEndpoints":{"claude":"/api/rules/postgres-17-hash-index-lock-starvation-guardrail?format=claude","cursorMdc":"/api/rules/postgres-17-hash-index-lock-starvation-guardrail?format=mdc","cursorrules":"/api/rules/postgres-17-hash-index-lock-starvation-guardrail?format=cursor","windsurf":"/api/rules/postgres-17-hash-index-lock-starvation-guardrail?format=windsurf","agents":"/api/rules/postgres-17-hash-index-lock-starvation-guardrail?format=agents"}},{"id":"tauri-android-jni-directbytebuffer-zero-copy-standard","title":"Tauri 2.0 Android JNI DirectByteBuffer Zero-Copy Streaming Standard","category":"mobile","severity":"critical","description":"Enforces zero-copy binary streaming between the Tauri 2.0 Rust backend and the Android WebView layer using JNI DirectByteBuffer and native memory mapping. Eliminates Dalvik/ART garbage collection pauses and IPC serialization overhead when handling high-throughput encrypted blob payloads.","antiPatternHeadline":"Base64-encoding byte payloads or allocating JVM jbyteArray buffers over Tauri IPC, causing fatal GC churn and OOM crashes.","stars_count":54,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri-2","android","jni","zero-copy","rust"],"exportEndpoints":{"claude":"/api/rules/tauri-android-jni-directbytebuffer-zero-copy-standard?format=claude","cursorMdc":"/api/rules/tauri-android-jni-directbytebuffer-zero-copy-standard?format=mdc","cursorrules":"/api/rules/tauri-android-jni-directbytebuffer-zero-copy-standard?format=cursor","windsurf":"/api/rules/tauri-android-jni-directbytebuffer-zero-copy-standard?format=windsurf","agents":"/api/rules/tauri-android-jni-directbytebuffer-zero-copy-standard?format=agents"}},{"id":"spire-ephemeral-agent-attestation-attenuation","title":"SPIRE Workload Attestation and Cryptographic Credential Attenuation for Ephemeral AI Agents","category":"security","severity":"critical","description":"Enforces short-lived, cryptographically attested X.509-SVID identities for autonomously spawned LLM agent processes via SPIRE. Mandates dynamic capability attenuation at the agent-workload boundary, strictly preventing parent process token inheritance and enduring ambient authority.","antiPatternHeadline":"Ambient Process Credential Inheritance and Long-Lived Static Tokens for Sub-Agent Delegation","stars_count":113,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","spire","svid","zero-trust","ai-agents","workload-attestation"],"exportEndpoints":{"claude":"/api/rules/spire-ephemeral-agent-attestation-attenuation?format=claude","cursorMdc":"/api/rules/spire-ephemeral-agent-attestation-attenuation?format=mdc","cursorrules":"/api/rules/spire-ephemeral-agent-attestation-attenuation?format=cursor","windsurf":"/api/rules/spire-ephemeral-agent-attestation-attenuation?format=windsurf","agents":"/api/rules/spire-ephemeral-agent-attestation-attenuation?format=agents"}},{"id":"otel-ebpf-continuous-profiling-overhead-budget-guardrail","title":"OpenTelemetry eBPF Continuous Profiling Dynamic Overhead Budget Guardrail","category":"devops","severity":"critical","description":"Enforces an autonomous negative-feedback loop that bounds OpenTelemetry eBPF stack-unwinding agent CPU utilization strictly below 1.0% of total host capacity. During host CPU saturation or burst contention, the profiling daemon must dynamically back off sampling frequency from standard targets (e.g., 19 Hz) down to a degraded floor (e.g., 1-5 Hz) or trigger an emergency circuit breaker to prevent compounding node exhaustion.","antiPatternHeadline":"Static Unthrottled eBPF Sampling Frequencies Causing Kernel Unwind Storms During Host CPU Contention","stars_count":115,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","ebpf","profiling","kernel","performance-budget","observability"],"exportEndpoints":{"claude":"/api/rules/otel-ebpf-continuous-profiling-overhead-budget-guardrail?format=claude","cursorMdc":"/api/rules/otel-ebpf-continuous-profiling-overhead-budget-guardrail?format=mdc","cursorrules":"/api/rules/otel-ebpf-continuous-profiling-overhead-budget-guardrail?format=cursor","windsurf":"/api/rules/otel-ebpf-continuous-profiling-overhead-budget-guardrail?format=windsurf","agents":"/api/rules/otel-ebpf-continuous-profiling-overhead-budget-guardrail?format=agents"}},{"id":"envoy-gateway-wasm-fault-isolation-circuit-breaker","title":"Envoy Gateway 1.2 WASM Filter Fault Isolation and Panic-Recovery Circuit Breaker","category":"devops","severity":"critical","description":"Enforces strict fault-isolation boundaries and deterministic failure semantics for custom WebAssembly (WASM) filters running on Envoy Gateway 1.2 data planes. Prevents data-plane worker crashes and control-plane cascading outages by mandating explicit fail-open/fail-closed states, execution timeouts, and consecutive panic trip limits within EnvoyExtensionPolicy resources.","antiPatternHeadline":"Deploying Unbounded WASM Policy Filters without Panic Fallbacks or Worker Crash Shields","stars_count":43,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","envoy-gateway","wasm","circuit-breaker","kubernetes","resilience"],"exportEndpoints":{"claude":"/api/rules/envoy-gateway-wasm-fault-isolation-circuit-breaker?format=claude","cursorMdc":"/api/rules/envoy-gateway-wasm-fault-isolation-circuit-breaker?format=mdc","cursorrules":"/api/rules/envoy-gateway-wasm-fault-isolation-circuit-breaker?format=cursor","windsurf":"/api/rules/envoy-gateway-wasm-fault-isolation-circuit-breaker?format=windsurf","agents":"/api/rules/envoy-gateway-wasm-fault-isolation-circuit-breaker?format=agents"}},{"id":"vite-6-environment-api-ssr-context-isolation-vite-6-environme-368","title":"Vite 6 Environment API Multi-Runtime SSR Context Isolation Invariant","category":"frontend","severity":"critical","description":"Enforces strict boundary isolation and module runner sandboxing across concurrent Vite 6 Environment API runtimes (Client, Node.js, and Workerd). Prevents mutable module-scoped singletons, global prototype pollution, and cross-runtime reference leakage during concurrent server-side evaluation. Mandates AsyncLocalStorage-backed context dispatching or explicit environment-scoped dependency injection containers.","antiPatternHeadline":"Cross-Runtime Global Pollution and Leaky Module-Level Singletons in Multi-Environment SSR","stars_count":116,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","vite-6","environment-api","ssr","workerd","isolation"],"exportEndpoints":{"claude":"/api/rules/vite-6-environment-api-ssr-context-isolation-vite-6-environme-368?format=claude","cursorMdc":"/api/rules/vite-6-environment-api-ssr-context-isolation-vite-6-environme-368?format=mdc","cursorrules":"/api/rules/vite-6-environment-api-ssr-context-isolation-vite-6-environme-368?format=cursor","windsurf":"/api/rules/vite-6-environment-api-ssr-context-isolation-vite-6-environme-368?format=windsurf","agents":"/api/rules/vite-6-environment-api-ssr-context-isolation-vite-6-environme-368?format=agents"}},{"id":"react-19-action-optimistic-state-reconciliation-boundary","title":"React 19 Action Optimistic State Reconciliation & Buffer Boundary","category":"frontend","severity":"critical","description":"Guarantees that concurrent asynchronous server action transitions rolling back optimistic state preserve active user input buffers, cursor positions, and pending microtasks without triggering layout recalculation race conditions or flash of uncommitted content (FOUC). Requires strict isolation between optimistic feed state and controlled form input models using non-blocking transitions.","antiPatternHeadline":"Binding Draft Input State Directly to useOptimistic Rollback Boundaries Causing Focus Loss and Dropped Keystrokes","stars_count":98,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","actions","optimistic-ui","useOptimistic","concurrency","state-reconciliation"],"exportEndpoints":{"claude":"/api/rules/react-19-action-optimistic-state-reconciliation-boundary?format=claude","cursorMdc":"/api/rules/react-19-action-optimistic-state-reconciliation-boundary?format=mdc","cursorrules":"/api/rules/react-19-action-optimistic-state-reconciliation-boundary?format=cursor","windsurf":"/api/rules/react-19-action-optimistic-state-reconciliation-boundary?format=windsurf","agents":"/api/rules/react-19-action-optimistic-state-reconciliation-boundary?format=agents"}},{"id":"bun-v12-ffi-buffer-pinning-zero-copy-guardrail","title":"Bun 1.2 Native FFI Buffer Pinning and Zero-Copy Lifecycle Guardrail","category":"backend","severity":"critical","description":"Prevents catastrophic JavaScriptCore (JSC) heap corruption and use-after-free conditions during non-blocking native C FFI calls in Bun 1.2+. When offloading zero-copy memory buffers across native thread boundaries, buffers must be explicitly pinned outside JSC GC compaction scopes using deterministic lifecycle fences or unmanaged heap pointers (Bun.raw / ptr). Passing raw TypedArray pointers directly across asynchronous FFI boundaries without retaining an active reference or managing an unmanaged lifecycle leads to silent pointer invalidation upon garbage collection.","antiPatternHeadline":"Passing Ephemeral JSC TypedArray Pointers Directly to Asynchronous or Off-Thread Native FFI Operations","stars_count":109,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","ffi","memory-management","zero-copy","c-interop"],"exportEndpoints":{"claude":"/api/rules/bun-v12-ffi-buffer-pinning-zero-copy-guardrail?format=claude","cursorMdc":"/api/rules/bun-v12-ffi-buffer-pinning-zero-copy-guardrail?format=mdc","cursorrules":"/api/rules/bun-v12-ffi-buffer-pinning-zero-copy-guardrail?format=cursor","windsurf":"/api/rules/bun-v12-ffi-buffer-pinning-zero-copy-guardrail?format=windsurf","agents":"/api/rules/bun-v12-ffi-buffer-pinning-zero-copy-guardrail?format=agents"}},{"id":"kmp-swift-export-arc-retain-cycle-boundary","title":"Kotlin Multiplatform Swift-Export ARC Retain-Cycle Deallocation Boundary","category":"mobile","severity":"critical","description":"Eliminates uncollectable cross-runtime memory leaks across Swift ARC and Kotlin/Native GC boundaries. Enforces deterministic weak-reference semantics, non-capturing bridge callbacks, and mandatory RAII/deinit detachment for Swift-Export interfaces.","antiPatternHeadline":"Cross-Runtime Retain Cycles via Direct Swift Listener References Captured by Kotlin/Native Objects","stars_count":79,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","swift-export","arc","memory-management","ios"],"exportEndpoints":{"claude":"/api/rules/kmp-swift-export-arc-retain-cycle-boundary?format=claude","cursorMdc":"/api/rules/kmp-swift-export-arc-retain-cycle-boundary?format=mdc","cursorrules":"/api/rules/kmp-swift-export-arc-retain-cycle-boundary?format=cursor","windsurf":"/api/rules/kmp-swift-export-arc-retain-cycle-boundary?format=windsurf","agents":"/api/rules/kmp-swift-export-arc-retain-cycle-boundary?format=agents"}},{"id":"android-15-predictive-back-gesture-state-reconciliation","title":"Android 15 Predictive Back Gesture Navigation State Restoration Invariant","category":"mobile","severity":"critical","description":"Enforces deterministic reconciliation of Fragment view hierarchies and navigation backstack states across predictive back gesture lifecycles in Android 15 (API 35). Prevents state desynchronization, phantom backstack pops, and orphaned view properties when interactive swipe-to-back gestures are canceled or interrupted mid-progress. Mandates strict separation between transient gesture-driven visual transformations and non-reversible navigation commits.","antiPatternHeadline":"Mutating Navigation State, Committing FragmentTransactions, or Failing to Revert View Interpolations During Canceled Predictive Back Progressions","stars_count":97,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","android","android-15","fragments","predictive-back","state-restoration","navigation"],"exportEndpoints":{"claude":"/api/rules/android-15-predictive-back-gesture-state-reconciliation?format=claude","cursorMdc":"/api/rules/android-15-predictive-back-gesture-state-reconciliation?format=mdc","cursorrules":"/api/rules/android-15-predictive-back-gesture-state-reconciliation?format=cursor","windsurf":"/api/rules/android-15-predictive-back-gesture-state-reconciliation?format=windsurf","agents":"/api/rules/android-15-predictive-back-gesture-state-reconciliation?format=agents"}},{"id":"webauthn-largeblob-secret-partitioning-standard","title":"WebAuthn LargeBlob Hardware-Bound Secret Partitioning & Exhaustion Guardrail","category":"security","severity":"critical","description":"Enforces AEAD encryption, strict byte budget allocation, and versioned envelope partitioning for WebAuthn largeBlob extension payloads. Prevents silent authenticator storage exhaustion, cross-tenant key corruption, and unauthenticated secret exfiltration from client memory.","antiPatternHeadline":"Writing Unbounded, Unencrypted Payloads Directly into WebAuthn largeBlob Extensions","stars_count":70,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["webauthn","fido2","largeblob","cryptography","security","passkeys"],"exportEndpoints":{"claude":"/api/rules/webauthn-largeblob-secret-partitioning-standard?format=claude","cursorMdc":"/api/rules/webauthn-largeblob-secret-partitioning-standard?format=mdc","cursorrules":"/api/rules/webauthn-largeblob-secret-partitioning-standard?format=cursor","windsurf":"/api/rules/webauthn-largeblob-secret-partitioning-standard?format=windsurf","agents":"/api/rules/webauthn-largeblob-secret-partitioning-standard?format=agents"}},{"id":"ebpf-tetragon-memfd-execveat-fileless-guardrail","title":"eBPF Tetragon Anonymous Memory Execution (memfd_create) Enforcement","category":"security","severity":"critical","description":"Enforces kernel-level interception via Cilium Tetragon TracingPolicies to detect and terminate fileless binary execution originating from anonymous memory descriptors. Prohibits unchecked combinations of memfd_create, fexecve, and execveat at the kernel boundary to prevent in-memory malware delivery within containerized workloads.","antiPatternHeadline":"Permissive Kernel Syscall Policies Enabling Fileless In-Memory Execution via Anonymous File Descriptors","stars_count":68,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["ebpf","tetragon","security","linux-kernel","fileless-malware","container-security","kubernetes"],"exportEndpoints":{"claude":"/api/rules/ebpf-tetragon-memfd-execveat-fileless-guardrail?format=claude","cursorMdc":"/api/rules/ebpf-tetragon-memfd-execveat-fileless-guardrail?format=mdc","cursorrules":"/api/rules/ebpf-tetragon-memfd-execveat-fileless-guardrail?format=cursor","windsurf":"/api/rules/ebpf-tetragon-memfd-execveat-fileless-guardrail?format=windsurf","agents":"/api/rules/ebpf-tetragon-memfd-execveat-fileless-guardrail?format=agents"}},{"id":"otel-filelog-checkpoint-persistence-invariant","title":"OpenTelemetry Collector High-Watermark Filelog Checkpoint Persistence Invariant","category":"devops","severity":"critical","description":"Mandates durable, disk-persisted read offsets via the file_storage extension and persistent volume mounts for the OpenTelemetry Collector filelog receiver. Prevents duplicate log ingestion floods and telemetry drops caused by ephemeral container restarts resetting in-memory high-watermarks during log rotation. Enforces explicit storage extension linkage and persistent node-local filesystem backing across all Collector deployments.","antiPatternHeadline":"Volatile In-Memory Filelog Checkpointing and Ephemeral Pod Storage Leading to Duplicate Telemetry Storms and Data Loss","stars_count":52,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","otel-collector","kubernetes","logging","data-integrity"],"exportEndpoints":{"claude":"/api/rules/otel-filelog-checkpoint-persistence-invariant?format=claude","cursorMdc":"/api/rules/otel-filelog-checkpoint-persistence-invariant?format=mdc","cursorrules":"/api/rules/otel-filelog-checkpoint-persistence-invariant?format=cursor","windsurf":"/api/rules/otel-filelog-checkpoint-persistence-invariant?format=windsurf","agents":"/api/rules/otel-filelog-checkpoint-persistence-invariant?format=agents"}},{"id":"argocd-rollout-analysis-step-lock","title":"Argo CD Progressive Rollout Analysis Step-Lock Invariant","category":"devops","severity":"critical","description":"Enforces mandatory inline AnalysisTemplate step-locks and automated abort thresholds within Argo Rollout canary and blue-green strategies. Automated progressive traffic weight advancement must strictly block and abort upon statistical anomaly detection in downstream service latencies (P95/P99) or error budgets.","antiPatternHeadline":"Blind Traffic Escalation Without Downstream Anomaly Analysis Step-Locks","stars_count":78,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","argocd","argo-rollouts","canary","kubernetes","observability","sre"],"exportEndpoints":{"claude":"/api/rules/argocd-rollout-analysis-step-lock?format=claude","cursorMdc":"/api/rules/argocd-rollout-analysis-step-lock?format=mdc","cursorrules":"/api/rules/argocd-rollout-analysis-step-lock?format=cursor","windsurf":"/api/rules/argocd-rollout-analysis-step-lock?format=windsurf","agents":"/api/rules/argocd-rollout-analysis-step-lock?format=agents"}},{"id":"bun-sqlite-wal-structured-concurrency","title":"Bun 1.2 Native SQLite WAL Structured Concurrency & Single-Writer Invariant","category":"backend","severity":"critical","description":"Enforces strict single-writer serialized queuing and concurrent multi-reader pools for Bun 1.2's native `bun:sqlite` engine under Write-Ahead Logging (WAL) mode. Prevents catastrophic SQLITE_BUSY / 'database is locked' panics in multi-threaded edge worker environments by decoupling write mutations into a dedicated serialization lane with structured concurrency controls.","antiPatternHeadline":"Unsynchronized Concurrent Multi-Threaded Writes directly opening 'bun:sqlite' in WAL Mode Triggering SQLITE_BUSY Exceptions","stars_count":81,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","sqlite","structured-concurrency","wal","edge"],"exportEndpoints":{"claude":"/api/rules/bun-sqlite-wal-structured-concurrency?format=claude","cursorMdc":"/api/rules/bun-sqlite-wal-structured-concurrency?format=mdc","cursorrules":"/api/rules/bun-sqlite-wal-structured-concurrency?format=cursor","windsurf":"/api/rules/bun-sqlite-wal-structured-concurrency?format=windsurf","agents":"/api/rules/bun-sqlite-wal-structured-concurrency?format=agents"}},{"id":"kmp-direct-swift-export-memory-alignment","title":"Kotlin Multiplatform 2.1 Direct Swift Export Memory Alignment Protocol","category":"mobile","severity":"critical","description":"Enforces strict 8-byte struct alignment, explicit C-interop memory layouts, and deterministic ARC ownership transfers across Direct Swift Export boundaries in Kotlin Multiplatform 2.1+. Prevents SIGBUS unaligned access crashes on ARM64 devices and eliminates bridge overhead caused by implicit dynamic boxing. Mandates explicit transfer semantics and stable native memory boundaries to avoid memory leaks and use-after-free conditions.","antiPatternHeadline":"Unaligned Native Struct Packing and Implicit ARC Ownership Leaks Across Direct Swift Export Bridges","stars_count":45,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","swift","direct-export","memory-alignment","c-interop","arc"],"exportEndpoints":{"claude":"/api/rules/kmp-direct-swift-export-memory-alignment?format=claude","cursorMdc":"/api/rules/kmp-direct-swift-export-memory-alignment?format=mdc","cursorrules":"/api/rules/kmp-direct-swift-export-memory-alignment?format=cursor","windsurf":"/api/rules/kmp-direct-swift-export-memory-alignment?format=windsurf","agents":"/api/rules/kmp-direct-swift-export-memory-alignment?format=agents"}},{"id":"capacitor-7-zero-serialization-binary-bridge-standard","title":"Capacitor 7 Zero-Serialization Binary Bridge Standard","category":"mobile","severity":"critical","description":"Mandates the usage of raw ArrayBuffer instances and TypedArray views over native-to-web bridges for high-frequency sensor and biometric telemetry. Eliminates IPC serialization overhead, garbage collection thrashing, and UI thread frame drops by prohibiting Base64 encoding and JSON stringification in streaming pipelines.","antiPatternHeadline":"Serializing High-Frequency Telemetry to Base64 or JSON Objects Across the Native-Web Bridge","stars_count":42,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","performance","binary-bridge","telemetry","typedarray"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-zero-serialization-binary-bridge-standard?format=claude","cursorMdc":"/api/rules/capacitor-7-zero-serialization-binary-bridge-standard?format=mdc","cursorrules":"/api/rules/capacitor-7-zero-serialization-binary-bridge-standard?format=cursor","windsurf":"/api/rules/capacitor-7-zero-serialization-binary-bridge-standard?format=windsurf","agents":"/api/rules/capacitor-7-zero-serialization-binary-bridge-standard?format=agents"}},{"id":"postgres-17-json-table-work-mem-streaming","title":"Postgres 17 JSON_TABLE Memory Ceiling & Cursor Streaming Guardrail","category":"backend","severity":"critical","description":"Enforces bounded memory ceilings and cursor-driven streaming semantics on Postgres 17 JSON_TABLE operations. Flattening high-cardinality JSON documents without explicit transaction-scoped memory limits and server-side cursors leads to backend process termination by the OS OOM killer and Node.js heap exhaustion.","antiPatternHeadline":"Unbounded In-Memory Materialization and Missing work_mem Bounds in Postgres 17 JSON_TABLE Queries","stars_count":48,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres","json-table","database-streaming","memory-leak","sql"],"exportEndpoints":{"claude":"/api/rules/postgres-17-json-table-work-mem-streaming?format=claude","cursorMdc":"/api/rules/postgres-17-json-table-work-mem-streaming?format=mdc","cursorrules":"/api/rules/postgres-17-json-table-work-mem-streaming?format=cursor","windsurf":"/api/rules/postgres-17-json-table-work-mem-streaming?format=windsurf","agents":"/api/rules/postgres-17-json-table-work-mem-streaming?format=agents"}},{"id":"go-chi-sub-deadline-budgeting-guardrail","title":"Go Chi v5 Context Sub-Deadline Budget Allocation Guardrail","category":"backend","severity":"critical","description":"Enforces deterministic context deadline budgeting and sub-deadline allocation across sequential and parallel outbound operations within Go Chi v5 HTTP handlers. Prevents cascade connection exhaustion and thread starvation caused by static timeouts that ignore remaining request lifetime budgets or lack defensive deadline propagation.","antiPatternHeadline":"Inheriting unbounded Chi request contexts or applying static outbound timeouts exceeding parent context deadlines","stars_count":51,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","chi-v5","context-budgeting","resilience","distributed-systems"],"exportEndpoints":{"claude":"/api/rules/go-chi-sub-deadline-budgeting-guardrail?format=claude","cursorMdc":"/api/rules/go-chi-sub-deadline-budgeting-guardrail?format=mdc","cursorrules":"/api/rules/go-chi-sub-deadline-budgeting-guardrail?format=cursor","windsurf":"/api/rules/go-chi-sub-deadline-budgeting-guardrail?format=windsurf","agents":"/api/rules/go-chi-sub-deadline-budgeting-guardrail?format=agents"}},{"id":"openfga-modular-schema-cyclic-ast-depth-guardrail","title":"OpenFGA Modular Schema Cyclic AST Depth and Recursion Guardrail","category":"security","severity":"critical","description":"Enforces static AST cycle detection and strict recursion depth bounds on modular OpenFGA authorization schemas and contextual tuple expansions. Prevents authorization engine exhaustion and Denial-of-Service (DoS) attacks caused by mutually referential tuple-to-userset relations across cross-module graph traversals.","antiPatternHeadline":"Unbounded Recursive Tuple Expansion and Undetected Cross-Module Cycles in OpenFGA Schemas","stars_count":57,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","authorization","fga","dos-prevention","ast-analysis"],"exportEndpoints":{"claude":"/api/rules/openfga-modular-schema-cyclic-ast-depth-guardrail?format=claude","cursorMdc":"/api/rules/openfga-modular-schema-cyclic-ast-depth-guardrail?format=mdc","cursorrules":"/api/rules/openfga-modular-schema-cyclic-ast-depth-guardrail?format=cursor","windsurf":"/api/rules/openfga-modular-schema-cyclic-ast-depth-guardrail?format=windsurf","agents":"/api/rules/openfga-modular-schema-cyclic-ast-depth-guardrail?format=agents"}},{"id":"webauthn-assertion-revocation-barrier","title":"FIDO2/WebAuthn Assertion Revocation & Real-Time Ephemeral Epoch Barrier","category":"security","severity":"critical","description":"Enforces real-time cryptographic revocation validation and stateful epoch barrier checks for all FIDO2/WebAuthn authentication assertions. Prevents ghost session creation and unauthorized lateral access originating from orphaned multi-device synced passkeys on deprovisioned, lost, or compromised client devices.","antiPatternHeadline":"Stateless FIDO2 Assertion Verification Lacking Synchronous Credential Revocation & Epoch Barriers","stars_count":43,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","fido2","passkeys","authentication","zero-trust"],"exportEndpoints":{"claude":"/api/rules/webauthn-assertion-revocation-barrier?format=claude","cursorMdc":"/api/rules/webauthn-assertion-revocation-barrier?format=mdc","cursorrules":"/api/rules/webauthn-assertion-revocation-barrier?format=cursor","windsurf":"/api/rules/webauthn-assertion-revocation-barrier?format=windsurf","agents":"/api/rules/webauthn-assertion-revocation-barrier?format=agents"}},{"id":"otel-tail-sampling-span-link-completeness-protocol","title":"OpenTelemetry Tail-Sampling Span-Link Completeness Protocol","category":"devops","severity":"critical","description":"Enforces distributed trace graph integrity by mandating that OpenTelemetry Collector pipelines and messaging clients preserve and evaluate span-linked asynchronous contexts before enacting lossy trace drop decisions. Eliminates causal fragmentation between producer and consumer spans across distributed message queues.","antiPatternHeadline":"Blind Tail-Sampling Drop of Fast Producer Traces Linked to Asynchronous Consumer Workflows","stars_count":114,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","tail-sampling","distributed-tracing","observability","span-links"],"exportEndpoints":{"claude":"/api/rules/otel-tail-sampling-span-link-completeness-protocol?format=claude","cursorMdc":"/api/rules/otel-tail-sampling-span-link-completeness-protocol?format=mdc","cursorrules":"/api/rules/otel-tail-sampling-span-link-completeness-protocol?format=cursor","windsurf":"/api/rules/otel-tail-sampling-span-link-completeness-protocol?format=windsurf","agents":"/api/rules/otel-tail-sampling-span-link-completeness-protocol?format=agents"}},{"id":"ebpf-xdp-hardware-offloaded-line-rate-drop-standard","title":"eBPF XDP Hardware-Offloaded Line-Rate Drop Standard","category":"devops","severity":"critical","description":"Enforces pre-stack packet processing at the physical NIC driver (XDP_DRV) and hardware-offloaded (XDP_OFFLOAD) tiers to neutralize volumetric L4 amplification vectors at true wire speed. Precludes Linux network stack socket buffer (sk_buff) allocation overhead by mandating strict packet pointer bounds verifications, lockless map evaluations, and early XDP_DROP verdicts.","antiPatternHeadline":"Deferring volumetric DDoS filtering to socket-layer firewalls or userspace daemons after kernel sk_buff allocation.","stars_count":66,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","xdp","ddos-mitigation","networking","kernel","linux"],"exportEndpoints":{"claude":"/api/rules/ebpf-xdp-hardware-offloaded-line-rate-drop-standard?format=claude","cursorMdc":"/api/rules/ebpf-xdp-hardware-offloaded-line-rate-drop-standard?format=mdc","cursorrules":"/api/rules/ebpf-xdp-hardware-offloaded-line-rate-drop-standard?format=cursor","windsurf":"/api/rules/ebpf-xdp-hardware-offloaded-line-rate-drop-standard?format=windsurf","agents":"/api/rules/ebpf-xdp-hardware-offloaded-line-rate-drop-standard?format=agents"}},{"id":"axum-0-8-tower-graceful-connection-draining","title":"Axum 0.8 Tower Service Graceful Connection Draining Invariant","category":"backend","severity":"critical","description":"Prevents dropped in-flight streaming requests, truncated SSE/WebSocket responses, and connection resets (ECONNRESET) during Kubernetes rolling upgrades. Enforces coordination between POSIX termination signals (SIGINT/SIGTERM), CancellationToken cascades across Tower middleware, and hyper-util connection graceful draining timeouts before binding closure.","antiPatternHeadline":"Naive axum::serve with_graceful_shutdown Drops In-Flight Hyper Streams and WebSocket Sessions on SIGTERM","stars_count":60,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tower","hyper","kubernetes","networking"],"exportEndpoints":{"claude":"/api/rules/axum-0-8-tower-graceful-connection-draining?format=claude","cursorMdc":"/api/rules/axum-0-8-tower-graceful-connection-draining?format=mdc","cursorrules":"/api/rules/axum-0-8-tower-graceful-connection-draining?format=cursor","windsurf":"/api/rules/axum-0-8-tower-graceful-connection-draining?format=windsurf","agents":"/api/rules/axum-0-8-tower-graceful-connection-draining?format=agents"}},{"id":"nextjs-15-server-action-idempotency-pipeline","title":"Next.js 15 Cryptographic Server Action Replay Prevention & Idempotency Pipeline","category":"frontend","severity":"critical","description":"Enforces an atomic, distributed idempotency pipeline for all state-mutating Next.js 15 Server Actions. Guarantees exactly-once execution semantics across network retries, browser re-submissions, and double-clicks by binding cryptographic payload digests and distributed lock caches to authenticated caller sessions.","antiPatternHeadline":"Executing state-mutating Server Actions directly from client calls without distributed lock acquisition and payload-bound idempotency keys.","stars_count":78,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs","server-actions","idempotency","redis","distributed-systems","security"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-server-action-idempotency-pipeline?format=claude","cursorMdc":"/api/rules/nextjs-15-server-action-idempotency-pipeline?format=mdc","cursorrules":"/api/rules/nextjs-15-server-action-idempotency-pipeline?format=cursor","windsurf":"/api/rules/nextjs-15-server-action-idempotency-pipeline?format=windsurf","agents":"/api/rules/nextjs-15-server-action-idempotency-pipeline?format=agents"}},{"id":"webauthn-prf-e2ee-key-derivation","title":"Enforce WebAuthn Level 3 PRF Extension for Zero-Knowledge E2EE Key Derivation","category":"security","severity":"critical","description":"Mandates client-side deterministic cryptographic key derivation via the WebAuthn Level 3 Pseudo-Random Function (PRF) extension for end-to-end encryption. Guarantees that neither raw authenticator PRF outputs nor derived encryption master keys are ever transmitted to Relying Parties (IdPs) or stored in unmanaged persistent client storage.","antiPatternHeadline":"Exposing Raw PRF Outputs to Identity Providers or Omitting HKDF Domain Separation","stars_count":61,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","prf-extension","e2ee","cryptography","zero-knowledge"],"exportEndpoints":{"claude":"/api/rules/webauthn-prf-e2ee-key-derivation?format=claude","cursorMdc":"/api/rules/webauthn-prf-e2ee-key-derivation?format=mdc","cursorrules":"/api/rules/webauthn-prf-e2ee-key-derivation?format=cursor","windsurf":"/api/rules/webauthn-prf-e2ee-key-derivation?format=windsurf","agents":"/api/rules/webauthn-prf-e2ee-key-derivation?format=agents"}},{"id":"cilium-ebpf-transparent-mtls-kernel-socket-bypass-guardrail","title":"Cilium eBPF Transparent mTLS & Kernel Socket-Level Bypass Prevention Guardrail","category":"devops","severity":"critical","description":"Enforces strict kernel-level cryptographic mutual TLS and L7 CiliumNetworkPolicy rules while forbidding unauthenticated fallback and eBPF socket-layer (sockops/sk_msg) bypasses. Prevents host-namespace socket leakage and guarantees non-bypassable identity verification across kernel-accelerated pod-to-pod data paths.","antiPatternHeadline":"Permitting Opportunistic Plaintext Fallback or Uninspected BPF Sockops Redirections Around Kernel mTLS Handshakes","stars_count":40,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","cilium","ebpf","mtls","kubernetes","network-security","zero-trust"],"exportEndpoints":{"claude":"/api/rules/cilium-ebpf-transparent-mtls-kernel-socket-bypass-guardrail?format=claude","cursorMdc":"/api/rules/cilium-ebpf-transparent-mtls-kernel-socket-bypass-guardrail?format=mdc","cursorrules":"/api/rules/cilium-ebpf-transparent-mtls-kernel-socket-bypass-guardrail?format=cursor","windsurf":"/api/rules/cilium-ebpf-transparent-mtls-kernel-socket-bypass-guardrail?format=windsurf","agents":"/api/rules/cilium-ebpf-transparent-mtls-kernel-socket-bypass-guardrail?format=agents"}},{"id":"kmp-cinterop-memory-ownership-deallocation-guardrail","title":"Kotlin Multiplatform Cinterop Native Memory Ownership & StableRef Deallocation Standard","category":"mobile","severity":"critical","description":"Mandates deterministic lifecycle management for native memory allocations and StableRef handles crossing Kotlin/Native and C/Objective-C/Swift boundaries. Eliminates native heap fragmentation, uncollected bridge references, and fatal SIGSEGV dangling pointer crashes by enforcing scoped arena lifecycles and explicit disposal invariants.","antiPatternHeadline":"Unbounded Native Heap Allocations and Undisposed StableRef Leaks Across FFI Boundaries","stars_count":103,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","cinterop","kotlin-native","memory-management","ios"],"exportEndpoints":{"claude":"/api/rules/kmp-cinterop-memory-ownership-deallocation-guardrail?format=claude","cursorMdc":"/api/rules/kmp-cinterop-memory-ownership-deallocation-guardrail?format=mdc","cursorrules":"/api/rules/kmp-cinterop-memory-ownership-deallocation-guardrail?format=cursor","windsurf":"/api/rules/kmp-cinterop-memory-ownership-deallocation-guardrail?format=windsurf","agents":"/api/rules/kmp-cinterop-memory-ownership-deallocation-guardrail?format=agents"}},{"id":"svelte-5-snippet-deterministic-serialization-invariant","title":"Svelte 5 Snippet Deterministic Slot Serialization and Recursive Hydration Guardrail","category":"frontend","severity":"critical","description":"Mandates deterministic invocation, stable key identity, and symmetric SSR-to-client fallback evaluation when composing recursive and dynamic component layouts with Svelte 5 first-class snippets. Prevents fatal DOM tree divergence, unhandled hydration mismatches, and layout thrashing triggered by ambient runtime divergence or non-deterministic snippet parameter evaluation.","antiPatternHeadline":"Ambient state evaluation, unkeyed recursive invocation, and asymmetric snippet fallback rendering causing SSR-to-client hydration divergence.","stars_count":89,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","snippets","ssr","hydration","runes"],"exportEndpoints":{"claude":"/api/rules/svelte-5-snippet-deterministic-serialization-invariant?format=claude","cursorMdc":"/api/rules/svelte-5-snippet-deterministic-serialization-invariant?format=mdc","cursorrules":"/api/rules/svelte-5-snippet-deterministic-serialization-invariant?format=cursor","windsurf":"/api/rules/svelte-5-snippet-deterministic-serialization-invariant?format=windsurf","agents":"/api/rules/svelte-5-snippet-deterministic-serialization-invariant?format=agents"}},{"id":"go-chi-context-cancellation-goroutine-leak-guardrail","title":"Go Chi Hierarchical Context Cancellation and Goroutine Leak Prevention Standard","category":"backend","severity":"critical","description":"Enforces strict propagation of Go Chi HTTP request contexts and structured cancellation causes across all downstream RPCs, database transactions, and spawned background workers. Prevents orphaned goroutine leaks and silent connection pool starvation caused by discarded or severed context trees during client disconnects. Mandates explicit context cause handling and synchronization via errgroup or worker pool lifecycles.","antiPatternHeadline":"Severing Chi Request Contexts with context.Background() and Spawning Unbounded Background Goroutines","stars_count":82,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","golang","chi","concurrency","goroutine-leaks","context-propagation"],"exportEndpoints":{"claude":"/api/rules/go-chi-context-cancellation-goroutine-leak-guardrail?format=claude","cursorMdc":"/api/rules/go-chi-context-cancellation-goroutine-leak-guardrail?format=mdc","cursorrules":"/api/rules/go-chi-context-cancellation-goroutine-leak-guardrail?format=cursor","windsurf":"/api/rules/go-chi-context-cancellation-goroutine-leak-guardrail?format=windsurf","agents":"/api/rules/go-chi-context-cancellation-goroutine-leak-guardrail?format=agents"}},{"id":"openfga-check-before-write-monotonic-consistency","title":"OpenFGA Transactional Check-Before-Write Monotonic Consistency Guardrail","category":"security","severity":"critical","description":"Enforces atomic transactional binding between OpenFGA authorization checks and state mutations using monotonic generation fencing tokens. Eliminates Time-of-Check to Time-of-Use (TOCTOU) authorization race conditions caused by asynchronous tuple revocation during concurrent writes.","antiPatternHeadline":"Stateless Non-Atomic Check-Then-Write TOCTOU Race Condition","stars_count":96,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","authorization","concurrency","toctou","distributed-systems"],"exportEndpoints":{"claude":"/api/rules/openfga-check-before-write-monotonic-consistency?format=claude","cursorMdc":"/api/rules/openfga-check-before-write-monotonic-consistency?format=mdc","cursorrules":"/api/rules/openfga-check-before-write-monotonic-consistency?format=cursor","windsurf":"/api/rules/openfga-check-before-write-monotonic-consistency?format=windsurf","agents":"/api/rules/openfga-check-before-write-monotonic-consistency?format=agents"}},{"id":"opentelemetry-ebpf-profiling-budget-guardrail","title":"OpenTelemetry Continuous Profiling eBPF Sampling Budget and Kernel Resource Guardrail","category":"devops","severity":"critical","description":"Enforces strict limits on eBPF continuous profiling sampling frequencies, unwinding stack depth, and BPF ring buffer allocations to guarantee continuous production profiling strictly consumes less than 1% aggregate CPU overhead. Prevents kernel lockups and ring-buffer-induced out-of-memory cascades during high thread-contention bursts.","antiPatternHeadline":"Unbounded eBPF sample rates and unconstrained stack-unwind buffer depths leading to high kernel CPU consumption and node instability.","stars_count":105,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","opentelemetry","continuous-profiling","observability","performance"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-ebpf-profiling-budget-guardrail?format=claude","cursorMdc":"/api/rules/opentelemetry-ebpf-profiling-budget-guardrail?format=mdc","cursorrules":"/api/rules/opentelemetry-ebpf-profiling-budget-guardrail?format=cursor","windsurf":"/api/rules/opentelemetry-ebpf-profiling-budget-guardrail?format=windsurf","agents":"/api/rules/opentelemetry-ebpf-profiling-budget-guardrail?format=agents"}},{"id":"nextjs-15-ppr-shell-boundary-invariant","title":"Next.js 15 Partial Prerendering (PPR) Shell Boundary Invariant","category":"frontend","severity":"critical","description":"Enforces strict physical decoupling between static edge prerendered layout shells and dynamic streaming Suspense holes under Next.js 15 PPR. Prevents accidental dynamic runtime de-opt (such as reading un-awaited searchParams, cookies, headers, or dynamic data at the shell level) which cascades TTFB penalties across entire route segments and triggers destructive hydration mismatches.","antiPatternHeadline":"Dynamic Scope Creep Poisoning Static Shell Prerendering","stars_count":72,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs15","ppr","react-server-components","suspense","performance"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-ppr-shell-boundary-invariant?format=claude","cursorMdc":"/api/rules/nextjs-15-ppr-shell-boundary-invariant?format=mdc","cursorrules":"/api/rules/nextjs-15-ppr-shell-boundary-invariant?format=cursor","windsurf":"/api/rules/nextjs-15-ppr-shell-boundary-invariant?format=windsurf","agents":"/api/rules/nextjs-15-ppr-shell-boundary-invariant?format=agents"}},{"id":"css-view-transitions-l2-prerender-isolation","title":"CSS View Transitions L2 Cross-Document Prerender Isolation Standard","category":"frontend","severity":"critical","description":"Prevents GPU surface buffer leaks, render-tree thrashing, and snapshot race conditions during Speculation Rules-driven multi-page navigations. Enforces explicit gating of pseudo-element capture states (`view-transition-name`) behind the `document.prerendering` lifecycle and requires deterministic resource release on aborted prerenders.","antiPatternHeadline":"Unconditional Static View-Transition Snapshot Binding During Speculative Prerender Lifecycles","stars_count":61,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","css-view-transitions","speculation-rules","performance","memory-leaks"],"exportEndpoints":{"claude":"/api/rules/css-view-transitions-l2-prerender-isolation?format=claude","cursorMdc":"/api/rules/css-view-transitions-l2-prerender-isolation?format=mdc","cursorrules":"/api/rules/css-view-transitions-l2-prerender-isolation?format=cursor","windsurf":"/api/rules/css-view-transitions-l2-prerender-isolation?format=windsurf","agents":"/api/rules/css-view-transitions-l2-prerender-isolation?format=agents"}},{"id":"axum-tower-adaptive-concurrency-gradient-limits","title":"Axum 0.8 Tower Adaptive Concurrency Limiting via Little's Law Gradient Descent","category":"backend","severity":"critical","description":"Static concurrency limits fail under downstream tail-latency degradation, causing cascading thread pool and connection starvation. Microservice boundaries must dynamically compute maximum inflight request limits using Little's Law and round-trip-time gradients to shed load before downstream buffers saturate.","antiPatternHeadline":"Deploying Fixed Concurrency Limits That Starve Connections and Propagate Tail-Latency Failures","stars_count":99,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tower","resilience","concurrency-limits"],"exportEndpoints":{"claude":"/api/rules/axum-tower-adaptive-concurrency-gradient-limits?format=claude","cursorMdc":"/api/rules/axum-tower-adaptive-concurrency-gradient-limits?format=mdc","cursorrules":"/api/rules/axum-tower-adaptive-concurrency-gradient-limits?format=cursor","windsurf":"/api/rules/axum-tower-adaptive-concurrency-gradient-limits?format=windsurf","agents":"/api/rules/axum-tower-adaptive-concurrency-gradient-limits?format=agents"}},{"id":"valkey-cluster-dual-channel-slot-migration-guardrail","title":"Valkey 8.0 Cluster Dual-Channel Slot Migration & Zero-Loss Rebalancing Guardrail","category":"backend","severity":"critical","description":"Enforces strict synchronization between client routing topology caches (MOVED/ASK tracking) and replica stream offsets during Valkey 8.0 slot live rebalancing. Prevents split-brain routing and phantom writes by coordinating cluster slot state updates across dual channels (active client protocol connection and asynchronous replica feed).","antiPatternHeadline":"Uncoordinated CLUSTER SETSLOT propagation leading to stale client routing, ASK/MOVED loops, and asynchronous replica drop","stars_count":87,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","valkey","cluster","slot-migration","distributed-systems","high-availability"],"exportEndpoints":{"claude":"/api/rules/valkey-cluster-dual-channel-slot-migration-guardrail?format=claude","cursorMdc":"/api/rules/valkey-cluster-dual-channel-slot-migration-guardrail?format=mdc","cursorrules":"/api/rules/valkey-cluster-dual-channel-slot-migration-guardrail?format=cursor","windsurf":"/api/rules/valkey-cluster-dual-channel-slot-migration-guardrail?format=windsurf","agents":"/api/rules/valkey-cluster-dual-channel-slot-migration-guardrail?format=agents"}},{"id":"fastapi-anyio-structured-concurrency-lifespan","title":"FastAPI 0.115+ AnyIO Structured Concurrency TaskGroup Lifespan Standard","category":"backend","severity":"critical","description":"Enforces deterministic cancellation and resource lifecycle management in FastAPI 0.115+ using AnyIO TaskGroups within lifespan contexts. Eliminates orphaned background worker coroutines, dangling database connections, and uncollected socket handles during server SIGTERM and SIGINT events.","antiPatternHeadline":"Fire-and-Forget asyncio.create_task Invocations During Lifespan Causing Silent Zombie Tasks and Resource Leaks","stars_count":118,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","anyio","structured-concurrency","python","lifespan"],"exportEndpoints":{"claude":"/api/rules/fastapi-anyio-structured-concurrency-lifespan?format=claude","cursorMdc":"/api/rules/fastapi-anyio-structured-concurrency-lifespan?format=mdc","cursorrules":"/api/rules/fastapi-anyio-structured-concurrency-lifespan?format=cursor","windsurf":"/api/rules/fastapi-anyio-structured-concurrency-lifespan?format=windsurf","agents":"/api/rules/fastapi-anyio-structured-concurrency-lifespan?format=agents"}},{"id":"swift-6-strict-concurrency-region-isolation","title":"Swift 6 Strict Concurrency & Region-Based Isolation Safety","category":"mobile","severity":"critical","description":"Enforces complete compile-time memory safety in high-throughput mobile runtimes under Swift 6 strict concurrency mode. Prohibits unsafe escaping of non-Sendable mutable references across actor isolation domains and mandates explicit disconnected region transfers via SE-0414 region-based isolation. Eliminates data races and forbids bypassing compiler verification with unchecked Sendable conformance.","antiPatternHeadline":"Bypassing Actor Isolation with Mutable Non-Sendable Reference Leakage or Unsafe Unchecked Sendable Conformance","stars_count":47,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","swift","concurrency","actors","ios","strict-concurrency"],"exportEndpoints":{"claude":"/api/rules/swift-6-strict-concurrency-region-isolation?format=claude","cursorMdc":"/api/rules/swift-6-strict-concurrency-region-isolation?format=mdc","cursorrules":"/api/rules/swift-6-strict-concurrency-region-isolation?format=cursor","windsurf":"/api/rules/swift-6-strict-concurrency-region-isolation?format=windsurf","agents":"/api/rules/swift-6-strict-concurrency-region-isolation?format=agents"}},{"id":"compose-multiplatform-skiko-render-decoupling","title":"Compose Multiplatform Skiko Main-Thread Render Lockstep Decoupling","category":"mobile","severity":"critical","description":"Mandates strict separation between high-frequency gesture processing and Skiko Canvas rasterization pipelines in Compose Multiplatform. Prevents touch-latency spikes, thread starvation, and missed vsync deadlines on 120Hz ProMotion/LTPO mobile displays by enforcing draw-phase transformation and non-blocking snapshot updates.","antiPatternHeadline":"Synchronous Canvas Invalidation and Path Allocation in Gesture Dispatch Loops","stars_count":94,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","compose-multiplatform","skiko","rendering","gestures","performance"],"exportEndpoints":{"claude":"/api/rules/compose-multiplatform-skiko-render-decoupling?format=claude","cursorMdc":"/api/rules/compose-multiplatform-skiko-render-decoupling?format=mdc","cursorrules":"/api/rules/compose-multiplatform-skiko-render-decoupling?format=cursor","windsurf":"/api/rules/compose-multiplatform-skiko-render-decoupling?format=windsurf","agents":"/api/rules/compose-multiplatform-skiko-render-decoupling?format=agents"}},{"id":"oauth21-dpop-ephemeral-key-binding-guardrail","title":"OAuth 2.1 DPoP Ephemeral Asymmetric Key Binding Invariant","category":"security","severity":"critical","description":"Enforces RFC 9449 Demonstrating Proof-of-Possession (DPoP) across all client authentication flows and distributed API gateway verifiers. Requires access and refresh tokens to be cryptographically bound to ephemeral client-generated asymmetric key pairs via JWK thumbprints (cnf.jkt), eliminating token exfiltration and replay attacks across untrusted network perimeters.","antiPatternHeadline":"Replay-Vulnerable Bearer Tokens and Unverified DPoP Proof Headers","stars_count":51,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","oauth2","dpop","jwt","zero-trust","cryptography"],"exportEndpoints":{"claude":"/api/rules/oauth21-dpop-ephemeral-key-binding-guardrail?format=claude","cursorMdc":"/api/rules/oauth21-dpop-ephemeral-key-binding-guardrail?format=mdc","cursorrules":"/api/rules/oauth21-dpop-ephemeral-key-binding-guardrail?format=cursor","windsurf":"/api/rules/oauth21-dpop-ephemeral-key-binding-guardrail?format=windsurf","agents":"/api/rules/oauth21-dpop-ephemeral-key-binding-guardrail?format=agents"}},{"id":"wasmtime-wasi-p2-capability-boundary-guardrail","title":"Wasmtime WASI 0.2 Capability Virtualization and Tenant Sandbox Enforcement","category":"security","severity":"critical","description":"Enforces strict capability-based security boundaries for untrusted tenant WASM modules running under WASI 0.2 (Preview 2) in Wasmtime hosts. Prohibits ambient system access by requiring explicit virtualization of filesystem directories, scoped network socket socket-bind/connect policies, monotonic clock allowances, and mandatory memory and fuel limits. Ensures no raw host file descriptors, ambient networking, or unbound execution run inside multi-tenant worker pools.","antiPatternHeadline":"Ambient Host Inheritance, Unbounded Fuel, and Indiscriminate Preopens in WASI 0.2 Contexts","stars_count":117,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","wasmtime","wasi","wasm","sandboxing","capability-security","multi-tenancy"],"exportEndpoints":{"claude":"/api/rules/wasmtime-wasi-p2-capability-boundary-guardrail?format=claude","cursorMdc":"/api/rules/wasmtime-wasi-p2-capability-boundary-guardrail?format=mdc","cursorrules":"/api/rules/wasmtime-wasi-p2-capability-boundary-guardrail?format=cursor","windsurf":"/api/rules/wasmtime-wasi-p2-capability-boundary-guardrail?format=windsurf","agents":"/api/rules/wasmtime-wasi-p2-capability-boundary-guardrail?format=agents"}},{"id":"cilium-ebpf-host-routing-socket-bypass-invariant","title":"Cilium eBPF Host-Routing & Socket Bypass Invariant","category":"devops","severity":"critical","description":"Enforces architectural compliance when deploying Cilium with eBPF host-routing and socket-layer switching (sockops) enabled. Because socket-level load balancing short-circuits kernel TCP/IP networking directly at the sock_ops level, traditional Netfilter/iptables rules, conntrack, and veth packet captures are bypassed, requiring security policies, egress controls, and telemetry to be declared via eBPF-native primitives.","antiPatternHeadline":"Deploying Cilium eBPF socket bypass while relying on legacy iptables, conntrack, or veth-level packet capture for security enforcement.","stars_count":97,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","cilium","ebpf","kubernetes","networking","security"],"exportEndpoints":{"claude":"/api/rules/cilium-ebpf-host-routing-socket-bypass-invariant?format=claude","cursorMdc":"/api/rules/cilium-ebpf-host-routing-socket-bypass-invariant?format=mdc","cursorrules":"/api/rules/cilium-ebpf-host-routing-socket-bypass-invariant?format=cursor","windsurf":"/api/rules/cilium-ebpf-host-routing-socket-bypass-invariant?format=windsurf","agents":"/api/rules/cilium-ebpf-host-routing-socket-bypass-invariant?format=agents"}},{"id":"nextjs-15-ppr-shell-streaming-guardrail","title":"Next.js 15 Partial Prerendering (PPR) Static Shell and Suspense Boundary Guardrail","category":"frontend","severity":"critical","description":"Enforces strict synchronous static shell boundaries around asynchronous streaming subtrees when Next.js 15 Partial Prerendering (PPR) is enabled. Unenclosed dynamic operations like cookies(), headers(), searchParams, or uncached fetches bubble up and trigger full-route dynamic SSR bailouts, destroying sub-50ms TTFB guarantees.","antiPatternHeadline":"Awaiting dynamic data directly inside page or layout roots without Suspense containment, collapsing the prerendered static shell.","stars_count":76,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs15","ppr","react-server-components","suspense","performance"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-ppr-shell-streaming-guardrail?format=claude","cursorMdc":"/api/rules/nextjs-15-ppr-shell-streaming-guardrail?format=mdc","cursorrules":"/api/rules/nextjs-15-ppr-shell-streaming-guardrail?format=cursor","windsurf":"/api/rules/nextjs-15-ppr-shell-streaming-guardrail?format=windsurf","agents":"/api/rules/nextjs-15-ppr-shell-streaming-guardrail?format=agents"}},{"id":"postgres-17-aio-worker-saturation-standard","title":"Postgres 17 Asynchronous Direct I/O (AIO) Worker Saturation and Direct Cache Bypassing","category":"backend","severity":"critical","description":"Regulates OS page cache bypass (O_DIRECT) and concurrent asynchronous I/O prefetch boundaries in PostgreSQL 17 environments. Prevents Linux kernel page cache lock contention and thread exhaustion by sizing io_uring queue depths, vectorized bulk scans, and maintenance worker limits relative to system NVMe queue capacities.","antiPatternHeadline":"Unconstrained Asynchronous Direct I/O Prefetch Triggering Kernel io_uring Ring Overflow and NVMe Queue Starvation","stars_count":104,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres","io_uring","direct-io","performance","linux-kernel"],"exportEndpoints":{"claude":"/api/rules/postgres-17-aio-worker-saturation-standard?format=claude","cursorMdc":"/api/rules/postgres-17-aio-worker-saturation-standard?format=mdc","cursorrules":"/api/rules/postgres-17-aio-worker-saturation-standard?format=cursor","windsurf":"/api/rules/postgres-17-aio-worker-saturation-standard?format=windsurf","agents":"/api/rules/postgres-17-aio-worker-saturation-standard?format=agents"}},{"id":"fastapi-lifespan-taskgroup-teardown-invariant","title":"FastAPI Lifespan Structured TaskGroup Teardown Invariant","category":"backend","severity":"critical","description":"Enforces structured concurrency inside ASGI lifespan context managers using anyio or asyncio TaskGroups. Prevents unmanaged fire-and-forget background tasks from leaking connections, corrupting state, or abruptly terminating upon SIGTERM by guaranteeing deterministic cancellation and resource draining.","antiPatternHeadline":"Spawning Unbounded Fire-and-Forget asyncio.create_task Inside Lifespans","stars_count":56,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","asyncio","anyio","lifespan","concurrency"],"exportEndpoints":{"claude":"/api/rules/fastapi-lifespan-taskgroup-teardown-invariant?format=claude","cursorMdc":"/api/rules/fastapi-lifespan-taskgroup-teardown-invariant?format=mdc","cursorrules":"/api/rules/fastapi-lifespan-taskgroup-teardown-invariant?format=cursor","windsurf":"/api/rules/fastapi-lifespan-taskgroup-teardown-invariant?format=windsurf","agents":"/api/rules/fastapi-lifespan-taskgroup-teardown-invariant?format=agents"}},{"id":"webauthn-prf-zk-salt-derivation-standard","title":"Hardware-Backed WebAuthn PRF Zero-Knowledge Key Derivation Standard","category":"security","severity":"critical","description":"Enforces deterministic, client-side symmetric key derivation strictly via the WebAuthn Level 3 PRF (Pseudo-Random Function) extension for zero-knowledge end-to-end encryption. Prohibits insecure software fallbacks, client-side disk persistence of derived root secrets, and transmission of hardware-derived entropy to remote servers.","antiPatternHeadline":"Persisting PRF Entropy or Deriving Zero-Knowledge Keys via Fallback Client-Side Hashes","stars_count":87,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","prf","cryptography","zero-knowledge","e2ee","fido2"],"exportEndpoints":{"claude":"/api/rules/webauthn-prf-zk-salt-derivation-standard?format=claude","cursorMdc":"/api/rules/webauthn-prf-zk-salt-derivation-standard?format=mdc","cursorrules":"/api/rules/webauthn-prf-zk-salt-derivation-standard?format=cursor","windsurf":"/api/rules/webauthn-prf-zk-salt-derivation-standard?format=windsurf","agents":"/api/rules/webauthn-prf-zk-salt-derivation-standard?format=agents"}},{"id":"bun-worker-zero-copy-transfer-guardrail","title":"Bun 1.2 Clustered Worker Zero-Copy ArrayBuffer Transfer Guardrail","category":"backend","severity":"critical","description":"Enforces explicit ownership transfer semantics and detachment verification for ArrayBuffer payloads sent across Bun worker threads. Eliminates multi-gigabyte structured clone serialization overhead and prevents invalid memory reads on detached ArrayBuffers under extreme messaging throughput.","antiPatternHeadline":"Implicit structured cloning of binary payloads and post-transfer access to detached ArrayBuffers","stars_count":53,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","workers","zero-copy","arraybuffer","concurrency","performance"],"exportEndpoints":{"claude":"/api/rules/bun-worker-zero-copy-transfer-guardrail?format=claude","cursorMdc":"/api/rules/bun-worker-zero-copy-transfer-guardrail?format=mdc","cursorrules":"/api/rules/bun-worker-zero-copy-transfer-guardrail?format=cursor","windsurf":"/api/rules/bun-worker-zero-copy-transfer-guardrail?format=windsurf","agents":"/api/rules/bun-worker-zero-copy-transfer-guardrail?format=agents"}},{"id":"tauri-webview-state-restoration-gpu-fallback","title":"Tauri 2.0 Webview State Restoration Hardware-Fallback Invariant","category":"mobile","severity":"critical","description":"Enforces deterministic lifecycle persistence, headless state snapshots, and automatic software-rendering fallback surfaces in Tauri 2.0 mobile deployments. Eliminates fatal black-screen freezing caused by WebGL/GPU context eviction during Android Activity pause/resume and iOS application background transitions.","antiPatternHeadline":"Unchecked Webview GPU Context Eviction Leading to Unrecoverable Mobile Black Screen","stars_count":87,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri-2.0","gpu-context-loss","state-restoration","webview","android","ios"],"exportEndpoints":{"claude":"/api/rules/tauri-webview-state-restoration-gpu-fallback?format=claude","cursorMdc":"/api/rules/tauri-webview-state-restoration-gpu-fallback?format=mdc","cursorrules":"/api/rules/tauri-webview-state-restoration-gpu-fallback?format=cursor","windsurf":"/api/rules/tauri-webview-state-restoration-gpu-fallback?format=windsurf","agents":"/api/rules/tauri-webview-state-restoration-gpu-fallback?format=agents"}},{"id":"sigstore-keyless-rekor-admission-barrier-standard","title":"Sigstore Ephemeral OIDC Keyless Rekor Admission Barrier Standard","category":"devops","severity":"critical","description":"All container workloads deployed to Kubernetes MUST cryptographically verify OIDC-backed short-lived Fulcio certificates and mandatory Rekor transparency log inclusion proofs prior to admission. Admission controllers MUST reject images signed with unpinned OIDC issuers or lacking cryptographic proof of Rekor transparency log commitment, preventing replay of expired or compromised ephemeral certificates.","antiPatternHeadline":"Permitting container admission with unverified Fulcio ephemeral certificates, omitted Rekor transparency log verification, or wildcard OIDC identities.","stars_count":84,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","kubernetes","sigstore","rekor","fulcio","kyverno","policy-controller","supply-chain-security"],"exportEndpoints":{"claude":"/api/rules/sigstore-keyless-rekor-admission-barrier-standard?format=claude","cursorMdc":"/api/rules/sigstore-keyless-rekor-admission-barrier-standard?format=mdc","cursorrules":"/api/rules/sigstore-keyless-rekor-admission-barrier-standard?format=cursor","windsurf":"/api/rules/sigstore-keyless-rekor-admission-barrier-standard?format=windsurf","agents":"/api/rules/sigstore-keyless-rekor-admission-barrier-standard?format=agents"}},{"id":"io-uring-provided-buffer-ring-recycling-standard","title":"Linux io_uring Provided Buffer Ring (PBUF) Replenishment & Low-Latency Recycling Standard","category":"devops","severity":"critical","description":"Standardizes kernel-managed buffer ring (IOU_PBUF_RING) replenishment rates and batching invariants in high-throughput network daemons. Enforces immediate tail-pointer synchronization with memory barriers to eliminate -ENOBUFS socket read drops, head-of-line blocking, and silent packet loss under burst ingress.","antiPatternHeadline":"Deferred Buffer Replenishment and Unfenced Ring Updates Causing ENOBUFS Ring Starvation","stars_count":81,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","linux","io_uring","networking","c","performance","systems"],"exportEndpoints":{"claude":"/api/rules/io-uring-provided-buffer-ring-recycling-standard?format=claude","cursorMdc":"/api/rules/io-uring-provided-buffer-ring-recycling-standard?format=mdc","cursorrules":"/api/rules/io-uring-provided-buffer-ring-recycling-standard?format=cursor","windsurf":"/api/rules/io-uring-provided-buffer-ring-recycling-standard?format=windsurf","agents":"/api/rules/io-uring-provided-buffer-ring-recycling-standard?format=agents"}},{"id":"opentelemetry-exemplar-cardinality-firewall","title":"OpenTelemetry Trace-Correlated Exemplar Reservoir Sampling and Cardinality Bounds","category":"devops","severity":"critical","description":"Enforces deterministic sliding-window reservoir sampling and strict retention filters on OpenTelemetry metric exemplars. Prevents trace ID cardinality explosions and Prometheus TSDB head-chunk memory exhaustion caused by unconstrained exemplar allocation during high-throughput metric updates.","antiPatternHeadline":"Unbounded Exemplar Attachment and Naive AlwaysOn Trace Sampling in High-Throughput Histograms","stars_count":85,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","prometheus","tsdb","observability","cardinality"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-exemplar-cardinality-firewall?format=claude","cursorMdc":"/api/rules/opentelemetry-exemplar-cardinality-firewall?format=mdc","cursorrules":"/api/rules/opentelemetry-exemplar-cardinality-firewall?format=cursor","windsurf":"/api/rules/opentelemetry-exemplar-cardinality-firewall?format=windsurf","agents":"/api/rules/opentelemetry-exemplar-cardinality-firewall?format=agents"}},{"id":"openfga-rebac-consistency-token-propagation","title":"OpenFGA Distributed ReBAC Bounded Consistency Token Propagation","category":"security","severity":"critical","description":"Enforces bounded read-after-write consistency for OpenFGA ReBAC checks across geo-distributed services. Prevents authorization bypass and stale permission errors (such as immediate 403 Forbidden regressions following grant mutations) without degrading cluster performance via blanket synchronous read-locks on primary databases.","antiPatternHeadline":"Global Unconditional Primary Synchronization or Asynchronous Edge Read-After-Write Stale Permissions","stars_count":51,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","rebac","consistency-tokens","distributed-systems","authorization"],"exportEndpoints":{"claude":"/api/rules/openfga-rebac-consistency-token-propagation?format=claude","cursorMdc":"/api/rules/openfga-rebac-consistency-token-propagation?format=mdc","cursorrules":"/api/rules/openfga-rebac-consistency-token-propagation?format=cursor","windsurf":"/api/rules/openfga-rebac-consistency-token-propagation?format=windsurf","agents":"/api/rules/openfga-rebac-consistency-token-propagation?format=agents"}},{"id":"nextjs-15-ppr-dynamic-boundary-isolation","title":"Next.js 15 Partial Prerendering Dynamic Boundary Isolation","category":"frontend","severity":"critical","description":"Guarantees that static shell emission remains decoupled from dynamic I/O operations under Partial Prerendering (PPR). Prevents dynamic execution contexts (cookies, headers, searchParams, uncached data) from leaking into root page/layout components, ensuring immediate TTFB delivery of pre-rendered shells while dynamic content streams in isolation.","antiPatternHeadline":"Dynamic Scope Leaks De-optimizing Static Route Shells into Blocking SSR Streams","stars_count":94,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs","react-19","partial-prerendering","performance","suspense"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-ppr-dynamic-boundary-isolation?format=claude","cursorMdc":"/api/rules/nextjs-15-ppr-dynamic-boundary-isolation?format=mdc","cursorrules":"/api/rules/nextjs-15-ppr-dynamic-boundary-isolation?format=cursor","windsurf":"/api/rules/nextjs-15-ppr-dynamic-boundary-isolation?format=windsurf","agents":"/api/rules/nextjs-15-ppr-dynamic-boundary-isolation?format=agents"}},{"id":"axum-async-stream-cancellation-safety","title":"Axum 0.8 Async Stream Cancellation and Resource Cleanup Guardrail","category":"backend","severity":"critical","description":"Enforces atomic state updates and deterministic resource teardown when handling premature HTTP client disconnects during Axum 0.8 response streaming. Prevents orphan Tokio tasks, leaked socket file descriptors, and corrupted partial database writes triggered by mid-stream future drops.","antiPatternHeadline":"Interleaving Non-Idempotent Mutations with Streaming Yields Across Unmonitored Cancellation Points","stars_count":67,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["rust","axum","tokio","async-stream","sse","resource-cleanup"],"exportEndpoints":{"claude":"/api/rules/axum-async-stream-cancellation-safety?format=claude","cursorMdc":"/api/rules/axum-async-stream-cancellation-safety?format=mdc","cursorrules":"/api/rules/axum-async-stream-cancellation-safety?format=cursor","windsurf":"/api/rules/axum-async-stream-cancellation-safety?format=windsurf","agents":"/api/rules/axum-async-stream-cancellation-safety?format=agents"}},{"id":"tauri-v2-granular-ipc-capability-scoping-tauri-2-0-granul-582","title":"Tauri 2.0 Granular IPC Capability and Origin Scoping","category":"mobile","severity":"critical","description":"Tauri 2.0 introduces an Access Control List (ACL) security model for native Rust commands and core plugins. In mobile and embedded webview environments, engineers must explicitly define granular capability boundaries, strictly binding high-privilege native capabilities to validated local bundle origins while prohibiting wildcard permissions on arbitrary remote web contexts.","antiPatternHeadline":"Assigning Default Wildcard Permissions and Unscoped Host Plugins to Webview Contexts","stars_count":114,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri","ipc","rust","security","capabilities"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-granular-ipc-capability-scoping-tauri-2-0-granul-582?format=claude","cursorMdc":"/api/rules/tauri-v2-granular-ipc-capability-scoping-tauri-2-0-granul-582?format=mdc","cursorrules":"/api/rules/tauri-v2-granular-ipc-capability-scoping-tauri-2-0-granul-582?format=cursor","windsurf":"/api/rules/tauri-v2-granular-ipc-capability-scoping-tauri-2-0-granul-582?format=windsurf","agents":"/api/rules/tauri-v2-granular-ipc-capability-scoping-tauri-2-0-granul-582?format=agents"}},{"id":"gateway-api-automated-canary-traffic-shifting","title":"Vendor-Neutral Declarative HTTPRoute Canary Shifting with Automated Rollback","category":"devops","severity":"critical","description":"Enforces Gateway API 1.2 HTTPRoute declarative traffic splitting for progressive delivery, replacing vendor-locked ingress annotations. Requires automated metric validation thresholds (P99 latency, HTTP 5xx error budget burn) with strict rollback triggers before promoting canary weights.","antiPatternHeadline":"Proprietary Ingress Annotations with Manual or Unvalidated Traffic Splitting","stars_count":87,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","kubernetes","gateway-api","progressive-delivery","canary","sre"],"exportEndpoints":{"claude":"/api/rules/gateway-api-automated-canary-traffic-shifting?format=claude","cursorMdc":"/api/rules/gateway-api-automated-canary-traffic-shifting?format=mdc","cursorrules":"/api/rules/gateway-api-automated-canary-traffic-shifting?format=cursor","windsurf":"/api/rules/gateway-api-automated-canary-traffic-shifting?format=windsurf","agents":"/api/rules/gateway-api-automated-canary-traffic-shifting?format=agents"}},{"id":"go-chi-zero-alloc-context-propagation","title":"Go Chi Zero-Allocation Context Value Propagation","category":"backend","severity":"critical","description":"Enforces single-allocation pointer propagation for request-scoped values in Go Chi HTTP middleware chains. Eliminates heap churn, cache thrashing, and GC pauses caused by nested context.WithValue wrapping and interface boxing of tenant claims and trace IDs.","antiPatternHeadline":"Nested context.WithValue Chaining and Interface Boxing Across HTTP Middleware Pipelines","stars_count":86,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","golang","chi","performance","memory-management","zero-allocation"],"exportEndpoints":{"claude":"/api/rules/go-chi-zero-alloc-context-propagation?format=claude","cursorMdc":"/api/rules/go-chi-zero-alloc-context-propagation?format=mdc","cursorrules":"/api/rules/go-chi-zero-alloc-context-propagation?format=cursor","windsurf":"/api/rules/go-chi-zero-alloc-context-propagation?format=windsurf","agents":"/api/rules/go-chi-zero-alloc-context-propagation?format=agents"}},{"id":"capacitor-secure-enclave-keystore-bridging","title":"Hardware Enclave Keystore Bridging for Cryptographic Operations","category":"mobile","severity":"critical","description":"Enforces strict delegation of authentication tokens and cryptographic operations to native platform hardware (iOS Secure Enclave and Android Hardware-backed Keystore / StrongBox) via Capacitor 7 bridges. Prevents persistent plaintext token storage or in-memory token reconstruction in the JavaScript runtime context where it remains vulnerable to heap inspection and XSS.","antiPatternHeadline":"Persisting Refresh Tokens in Web Storage or Extracting Raw Secrets into the WebView Runtime Memory","stars_count":52,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["capacitor","ios","android","secure-enclave","keystore","authentication"],"exportEndpoints":{"claude":"/api/rules/capacitor-secure-enclave-keystore-bridging?format=claude","cursorMdc":"/api/rules/capacitor-secure-enclave-keystore-bridging?format=mdc","cursorrules":"/api/rules/capacitor-secure-enclave-keystore-bridging?format=cursor","windsurf":"/api/rules/capacitor-secure-enclave-keystore-bridging?format=windsurf","agents":"/api/rules/capacitor-secure-enclave-keystore-bridging?format=agents"}},{"id":"cosign-keyless-oidc-admission-verification","title":"Cosign Keyless OIDC Container Verification Admission Gate","category":"security","severity":"critical","description":"Enforces cryptographic supply-chain integrity at the Kubernetes admission boundary by verifying container signatures using short-lived Fulcio certificates tied to OIDC workload identity and Rekor transparency logs. Requires immutable sha256 image digests and strictly asserts OIDC issuer and subject SANs while rejecting static long-lived keys and unsigned digests.","antiPatternHeadline":"Admitting Unsigned, Mutable Container Tags or Omitting OIDC Workload Subject and Issuer Identity Verification","stars_count":79,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","kubernetes","sigstore","cosign","admission-control","supply-chain"],"exportEndpoints":{"claude":"/api/rules/cosign-keyless-oidc-admission-verification?format=claude","cursorMdc":"/api/rules/cosign-keyless-oidc-admission-verification?format=mdc","cursorrules":"/api/rules/cosign-keyless-oidc-admission-verification?format=cursor","windsurf":"/api/rules/cosign-keyless-oidc-admission-verification?format=windsurf","agents":"/api/rules/cosign-keyless-oidc-admission-verification?format=agents"}},{"id":"pg17-subxact-spill-guardrails","title":"PostgreSQL 17 Subtransaction Spill & Snapshot Invalidation Guardrails","category":"backend","severity":"critical","description":"Enforces strict structural constraints on nested savepoints, ORM nested transactions, and PL/pgSQL exception blocks to prevent backend subtransaction overflow beyond the 64-subxid PGPROC memory cache. Prevents ProcArrayLock contention storms, SLRU cache thrashing, and snapshot invalidation latency spikes under high-concurrency workloads.","antiPatternHeadline":"Unbounded SAVEPOINT nesting and row-level try/catch exception loops overflowing backend PGPROC subxid caches","stars_count":115,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","transactions","concurrency","database-performance"],"exportEndpoints":{"claude":"/api/rules/pg17-subxact-spill-guardrails?format=claude","cursorMdc":"/api/rules/pg17-subxact-spill-guardrails?format=mdc","cursorrules":"/api/rules/pg17-subxact-spill-guardrails?format=cursor","windsurf":"/api/rules/pg17-subxact-spill-guardrails?format=windsurf","agents":"/api/rules/pg17-subxact-spill-guardrails?format=agents"}},{"id":"react-19-actions-idempotency-boundary","title":"React 19 Actions & useActionState Async Idempotency Boundary Standard","category":"frontend","severity":"critical","description":"Enforces strict mutation idempotency tokens and explicit abort propagation across React 19 transitions and useActionState boundaries. Prevents optimistic state tearing, ghost rollbacks, and concurrent double-dispatch races during high-latency network drops and rapid user interactions.","antiPatternHeadline":"Non-Idempotent useActionState Handlers Lacking In-Flight Abort Signals and Transaction Keys","stars_count":57,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["react19","actions","useactionstate","optimistic-updates","idempotency","concurrency"],"exportEndpoints":{"claude":"/api/rules/react-19-actions-idempotency-boundary?format=claude","cursorMdc":"/api/rules/react-19-actions-idempotency-boundary?format=mdc","cursorrules":"/api/rules/react-19-actions-idempotency-boundary?format=cursor","windsurf":"/api/rules/react-19-actions-idempotency-boundary?format=windsurf","agents":"/api/rules/react-19-actions-idempotency-boundary?format=agents"}},{"id":"pg17-failover-slot-sync-logical-decoding-fence","title":"PostgreSQL 17 Failover Slot Sync and Logical Decoding Fence Enforcement","category":"backend","severity":"critical","description":"Enforces synchronized logical replication slots via Postgres 17 failover slot mechanics and mandates a fencing token mechanism on subscriber consumers during physical topology changes. Prevents duplicate event emissions, sequence regressions, and silent consumer state corruption caused by physical replica promotion before slot synchronization completes.","antiPatternHeadline":"Unsynchronized Logical Decoding Across Uncoordinated Physical Failover Promoting State Divergence","stars_count":91,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres-17","logical-replication","failover-slots","cdc","high-availability"],"exportEndpoints":{"claude":"/api/rules/pg17-failover-slot-sync-logical-decoding-fence?format=claude","cursorMdc":"/api/rules/pg17-failover-slot-sync-logical-decoding-fence?format=mdc","cursorrules":"/api/rules/pg17-failover-slot-sync-logical-decoding-fence?format=cursor","windsurf":"/api/rules/pg17-failover-slot-sync-logical-decoding-fence?format=windsurf","agents":"/api/rules/pg17-failover-slot-sync-logical-decoding-fence?format=agents"}},{"id":"tauri-2-scoped-ipc-isolation-guardrail","title":"Tauri 2.0 Scoped IPC Capability and Isolated Webview Bridge Security","category":"security","severity":"critical","description":"Enforces least-privilege IPC execution boundaries between webviews and the Rust core runtime in Tauri 2.0 applications. Mandates explicit compile-time capability files, granular permission scopes, and strict payload validation to prevent remote code execution from malicious webview injections or compromised dependencies.","antiPatternHeadline":"Permissive Wildcard Core IPC Access and Global Window Invocation Bridges","stars_count":81,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","tauri-2","ipc","capability-security","rust","desktop-security"],"exportEndpoints":{"claude":"/api/rules/tauri-2-scoped-ipc-isolation-guardrail?format=claude","cursorMdc":"/api/rules/tauri-2-scoped-ipc-isolation-guardrail?format=mdc","cursorrules":"/api/rules/tauri-2-scoped-ipc-isolation-guardrail?format=cursor","windsurf":"/api/rules/tauri-2-scoped-ipc-isolation-guardrail?format=windsurf","agents":"/api/rules/tauri-2-scoped-ipc-isolation-guardrail?format=agents"}},{"id":"bun-worker-shared-memory-atomics-barrier-standard","title":"Bun 1.2 Native Worker Concurrency & Shared Memory Barrier Standard","category":"backend","severity":"critical","description":"Bun 1.2 executes native Web Workers with direct access to SharedArrayBuffer instances, enabling sub-millisecond inter-thread messaging. Unfenced mutations and unsynchronized reads across worker boundaries cause torn writes, cache incoherence, and process-terminating segment faults under heavy I/O pressure. This standard mandates explicit memory fences, typed layouts, and Atomics synchronization across all multi-threaded worker pipelines.","antiPatternHeadline":"Unsynchronized SharedArrayBuffer Mutation and Unfenced Worker Ring Buffer R/W Access","stars_count":100,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","concurrency","shared-memory","atomics","workers","performance"],"exportEndpoints":{"claude":"/api/rules/bun-worker-shared-memory-atomics-barrier-standard?format=claude","cursorMdc":"/api/rules/bun-worker-shared-memory-atomics-barrier-standard?format=mdc","cursorrules":"/api/rules/bun-worker-shared-memory-atomics-barrier-standard?format=cursor","windsurf":"/api/rules/bun-worker-shared-memory-atomics-barrier-standard?format=windsurf","agents":"/api/rules/bun-worker-shared-memory-atomics-barrier-standard?format=agents"}},{"id":"fastapi-pydantic-v2-streaming-deserialization-standard","title":"FastAPI & Pydantic V2 Zero-Copy Stream Deserialization Standard","category":"backend","severity":"critical","description":"Enforces incremental, zero-copy, Rust-accelerated streaming validation on ingress payloads to eliminate heap amplification and Out-Of-Memory (OOM) attack vectors during large-scale ingestion. Standard FastAPI parameter binding buffers entire payload bodies into contiguous memory, inducing 4x to 10x heap expansion through intermediate Python object allocation. High-throughput endpoints MUST process byte streams chunk-by-chunk using iterative parsers combined with Pydantic V2 micro-deserialization.","antiPatternHeadline":"Full-Payload In-Memory Buffering via Direct Schema Injection on Unbounded Ingress Routes","stars_count":92,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","pydantic-v2","streaming","memory-safety","rust-pydantic-core"],"exportEndpoints":{"claude":"/api/rules/fastapi-pydantic-v2-streaming-deserialization-standard?format=claude","cursorMdc":"/api/rules/fastapi-pydantic-v2-streaming-deserialization-standard?format=mdc","cursorrules":"/api/rules/fastapi-pydantic-v2-streaming-deserialization-standard?format=cursor","windsurf":"/api/rules/fastapi-pydantic-v2-streaming-deserialization-standard?format=windsurf","agents":"/api/rules/fastapi-pydantic-v2-streaming-deserialization-standard?format=agents"}},{"id":"vite6-multi-environment-module-isolation-guardrail","title":"Vite 6 Multi-Environment Module Isolation & Runtime Boundary Guardrail","category":"frontend","severity":"critical","description":"Enforces strict module boundary isolation across heterogeneous runtimes (Client, Node SSR, and Edge/Workerd) using the Vite 6 Environment API. Prevents runtime-specific API pollution, accidental credential leakage, and invalid cross-environment module evaluation across decoupled compilation matrices.","antiPatternHeadline":"Cross-Environment Module Bleed and Dynamic Dual-Runtime Imports across Heterogeneous Matrices","stars_count":83,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","vite6","module-isolation","environment-api","ssr","edge-runtime"],"exportEndpoints":{"claude":"/api/rules/vite6-multi-environment-module-isolation-guardrail?format=claude","cursorMdc":"/api/rules/vite6-multi-environment-module-isolation-guardrail?format=mdc","cursorrules":"/api/rules/vite6-multi-environment-module-isolation-guardrail?format=cursor","windsurf":"/api/rules/vite6-multi-environment-module-isolation-guardrail?format=windsurf","agents":"/api/rules/vite6-multi-environment-module-isolation-guardrail?format=agents"}},{"id":"compose-predictive-back-lifecycle-fence","title":"Jetpack Compose Predictive Back Stack Determinism & Lifecycle Fence","category":"mobile","severity":"critical","description":"Enforces atomic state restoration and strict Lifecycle fences during predictive back gesture interactions on Android 15+ (API 35). Prevents zombie ViewModels, desynchronized NavBackStackEntry states, and memory leaks caused by canceled or aborted multi-window predictive back gestures.","antiPatternHeadline":"Speculative State Mutating & Unfenced Coroutines During Aborted Predictive Back Transitions","stars_count":98,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","android","jetpack-compose","navigation","predictive-back","lifecycle"],"exportEndpoints":{"claude":"/api/rules/compose-predictive-back-lifecycle-fence?format=claude","cursorMdc":"/api/rules/compose-predictive-back-lifecycle-fence?format=mdc","cursorrules":"/api/rules/compose-predictive-back-lifecycle-fence?format=cursor","windsurf":"/api/rules/compose-predictive-back-lifecycle-fence?format=windsurf","agents":"/api/rules/compose-predictive-back-lifecycle-fence?format=agents"}},{"id":"openfga-conditional-tuple-transaction-isolation-standard","title":"OpenFGA Conditional Relationship Tuple & Transaction Isolation Standard","category":"security","severity":"critical","description":"Enforces atomic batch mutations and deterministic conditional evaluation for OpenFGA authorization tuples. Prevents transient privilege escalation, authorization bypass, and Time-of-Check to Time-of-Use (TOCTOU) exploits caused by eventual consistency lag and non-atomic state synchronization between primary persistence layers and the Fine-Grained Authorization engine.","antiPatternHeadline":"Non-Atomic Sequential Tuple Writes and Unbounded Ephemeral State Injection Inducing Authorization Desynchronization","stars_count":102,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","authorization","distributed-systems","concurrency","rbac","rebac"],"exportEndpoints":{"claude":"/api/rules/openfga-conditional-tuple-transaction-isolation-standard?format=claude","cursorMdc":"/api/rules/openfga-conditional-tuple-transaction-isolation-standard?format=mdc","cursorrules":"/api/rules/openfga-conditional-tuple-transaction-isolation-standard?format=cursor","windsurf":"/api/rules/openfga-conditional-tuple-transaction-isolation-standard?format=windsurf","agents":"/api/rules/openfga-conditional-tuple-transaction-isolation-standard?format=agents"}},{"id":"opentelemetry-baggage-size-quota-guardrail","title":"OpenTelemetry Baggage Size Quota & Context Propagation Guardrail","category":"devops","severity":"critical","description":"Enforces deterministic boundaries on W3C OpenTelemetry baggage context propagation to prevent HTTP 431 Request Header Fields Too Large cascades and memory exhaustion. Mandates strict key whitelisting, per-entry value size caps, and total payload limits across downstream distributed RPC hops.","antiPatternHeadline":"Unbounded distributed context propagation causing downstream 431 DOS and header inflation","stars_count":70,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","distributed-tracing","security","http-headers","reliability"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-baggage-size-quota-guardrail?format=claude","cursorMdc":"/api/rules/opentelemetry-baggage-size-quota-guardrail?format=mdc","cursorrules":"/api/rules/opentelemetry-baggage-size-quota-guardrail?format=cursor","windsurf":"/api/rules/opentelemetry-baggage-size-quota-guardrail?format=windsurf","agents":"/api/rules/opentelemetry-baggage-size-quota-guardrail?format=agents"}},{"id":"k8s-dra-device-claim-invariant-production-standard","title":"Kubernetes Dynamic Resource Allocation (DRA) Device Claim Invariant","category":"devops","severity":"critical","description":"Enforces strict structural and lifecycle invariants for Kubernetes Dynamic Resource Allocation (DRA v1alpha3/v1beta1) resource claims. Guarantees deterministic, NUMA-aware GPU/NPU device scheduling and atomic deallocation across co-located inference containers without triggering out-of-band pod evictions or device driver deadlocks.","antiPatternHeadline":"Ad-hoc Pod Resource Slicing via Ephemeral Device Requests Causing Unbound Topology Drift and Driver Leakage","stars_count":46,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","kubernetes","dra","gpu","inference","topology-manager","infrastructure"],"exportEndpoints":{"claude":"/api/rules/k8s-dra-device-claim-invariant-production-standard?format=claude","cursorMdc":"/api/rules/k8s-dra-device-claim-invariant-production-standard?format=mdc","cursorrules":"/api/rules/k8s-dra-device-claim-invariant-production-standard?format=cursor","windsurf":"/api/rules/k8s-dra-device-claim-invariant-production-standard?format=windsurf","agents":"/api/rules/k8s-dra-device-claim-invariant-production-standard?format=agents"}},{"id":"svelte-5-runes-proxy-demarcation-standard","title":"Svelte 5 Runes Signal Proxy Demarcation and Deep Mutation Boundary Standard","category":"frontend","severity":"critical","description":"Enforces strict signal demarcation boundaries across deep reactive $state proxies to eliminate microtask queue saturation and cascading fine-grained re-render thrashing. Mandates $state.raw for high-frequency or external telemetry streams and dictates $state.snapshot boundaries across module, web worker, and inter-service boundaries.","antiPatternHeadline":"Unbounded Deep In-Place Proxy Mutation in High-Frequency Event Pipelines","stars_count":78,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["svelte5","runes","signals","reactivity","frontend","performance"],"exportEndpoints":{"claude":"/api/rules/svelte-5-runes-proxy-demarcation-standard?format=claude","cursorMdc":"/api/rules/svelte-5-runes-proxy-demarcation-standard?format=mdc","cursorrules":"/api/rules/svelte-5-runes-proxy-demarcation-standard?format=cursor","windsurf":"/api/rules/svelte-5-runes-proxy-demarcation-standard?format=windsurf","agents":"/api/rules/svelte-5-runes-proxy-demarcation-standard?format=agents"}},{"id":"nextjs-15-dynamic-io-cache-life-invariants","title":"Next.js 15 Dynamic I/O and Cache-Life Invalidation Standard","category":"frontend","severity":"critical","description":"Governs deterministic `use cache` profiles and explicit `cacheTag` lifecycles under React 19 Dynamic I/O (`experimental.dynamicIO: true`). Eliminates silent stale data cross-contamination and un-tracked runtime dynamic leaks across hybrid streaming routes by enforcing strict isolation of caching scopes and revalidation boundaries.","antiPatternHeadline":"Implicit Caching via Ambiguous Dynamic Access and Missing Invalidation Tags Under Dynamic I/O","stars_count":81,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs15","react19","dynamic-io","cache-life","streaming"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-dynamic-io-cache-life-invariants?format=claude","cursorMdc":"/api/rules/nextjs-15-dynamic-io-cache-life-invariants?format=mdc","cursorrules":"/api/rules/nextjs-15-dynamic-io-cache-life-invariants?format=cursor","windsurf":"/api/rules/nextjs-15-dynamic-io-cache-life-invariants?format=windsurf","agents":"/api/rules/nextjs-15-dynamic-io-cache-life-invariants?format=agents"}},{"id":"axum-tokio-cooperative-budget-partitioning","title":"Axum 0.8 Tokio Cooperative Task-Budget Partitioning Invariant","category":"backend","severity":"critical","description":"Enforces explicit cooperative budget exhaustion fences via tokio::task::consume_budget inside high-throughput Axum 0.8 middleware, extractors, and request transform pipelines. Prevents asymmetric multi-threaded runtime worker starvation and tail latency spikes caused by CPU-bound or unbudgeted compute iterations executed directly on the Tokio async reactor loop.","antiPatternHeadline":"Unbudgeted In-Reactor Synchronous Compute Starving Tokio Worker Threads","stars_count":66,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tokio","concurrency","performance"],"exportEndpoints":{"claude":"/api/rules/axum-tokio-cooperative-budget-partitioning?format=claude","cursorMdc":"/api/rules/axum-tokio-cooperative-budget-partitioning?format=mdc","cursorrules":"/api/rules/axum-tokio-cooperative-budget-partitioning?format=cursor","windsurf":"/api/rules/axum-tokio-cooperative-budget-partitioning?format=windsurf","agents":"/api/rules/axum-tokio-cooperative-budget-partitioning?format=agents"}},{"id":"postgres-17-logical-slot-failover-boundary","title":"Postgres 17 Logical Replication Slot Failover Synchronization Boundary","category":"backend","severity":"critical","description":"Enforces failover-enabled logical slots and physical-to-logical coordination via sync_replication_slots and synchronized_standby_slots in PostgreSQL 17 HA topologies. Guarantees downstream consumers experience deterministic resumption without WAL gap corruption or silent event loss during Patroni failover events.","antiPatternHeadline":"Desynchronized Logical Replication Slots Causing Data Loss and Stream Gaps on Standby Failover","stars_count":119,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql-17","patroni","cdc","logical-replication","high-availability"],"exportEndpoints":{"claude":"/api/rules/postgres-17-logical-slot-failover-boundary?format=claude","cursorMdc":"/api/rules/postgres-17-logical-slot-failover-boundary?format=mdc","cursorrules":"/api/rules/postgres-17-logical-slot-failover-boundary?format=cursor","windsurf":"/api/rules/postgres-17-logical-slot-failover-boundary?format=windsurf","agents":"/api/rules/postgres-17-logical-slot-failover-boundary?format=agents"}},{"id":"bun-shared-array-buffer-worker-barrier-standard","title":"Bun 1.2 SharedArrayBuffer Cross-Worker Memory Barrier & Ring-Buffer Standard","category":"backend","severity":"critical","description":"Establishes lock-free ring-buffer atomic memory barriers across multithreaded Bun workers to ensure thread-safe, zero-copy deserialization of streaming WebSocket payloads. Guarantees that producers commit payload writes to the SharedArrayBuffer with release semantics before incrementing head pointers, while consumer workers enforce acquire fences before accessing buffer regions.","antiPatternHeadline":"Unsynchronized SharedArrayBuffer Mutations and Dirty Reads via Raw Pointer Traversal Without Atomics Barrier Fences","stars_count":107,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","sharedarraybuffer","multithreading","atomics","websockets","concurrency"],"exportEndpoints":{"claude":"/api/rules/bun-shared-array-buffer-worker-barrier-standard?format=claude","cursorMdc":"/api/rules/bun-shared-array-buffer-worker-barrier-standard?format=mdc","cursorrules":"/api/rules/bun-shared-array-buffer-worker-barrier-standard?format=cursor","windsurf":"/api/rules/bun-shared-array-buffer-worker-barrier-standard?format=windsurf","agents":"/api/rules/bun-shared-array-buffer-worker-barrier-standard?format=agents"}},{"id":"kmp-swift-export-cancellation-interlock-guardrail","title":"Kotlin Multiplatform Swift-Export Cancellation Interlock Standard","category":"mobile","severity":"critical","description":"Guarantees Swift Concurrency Task cancellation trees bidirectionally propagate into native Kotlin Multiplatform Job hierarchies and vice versa. Prevents orphaned background dispatchers, unmanaged CoroutineScopes, and native memory leaks caused by retained Cinterop/Obj-C blocks.","antiPatternHeadline":"Unlinked Swift Task wrapping that drops cooperative cancellation signals and leaks Kotlin Native worker threads","stars_count":81,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","swift-concurrency","coroutines","memory-management","cinterop"],"exportEndpoints":{"claude":"/api/rules/kmp-swift-export-cancellation-interlock-guardrail?format=claude","cursorMdc":"/api/rules/kmp-swift-export-cancellation-interlock-guardrail?format=mdc","cursorrules":"/api/rules/kmp-swift-export-cancellation-interlock-guardrail?format=cursor","windsurf":"/api/rules/kmp-swift-export-cancellation-interlock-guardrail?format=windsurf","agents":"/api/rules/kmp-swift-export-cancellation-interlock-guardrail?format=agents"}},{"id":"tauri-mobile-jni-ffi-envelope-memory-sandbox","title":"Tauri 2.0 Mobile JNI/FFI Zero-Copy Byte-Buffer Envelope Validation","category":"mobile","severity":"critical","description":"Enforces deterministic byte-buffer envelope validation and memory layout constraints across Tauri 2.0 Rust-to-mobile FFI boundaries (Android JNI DirectByteBuffer and iOS Swift UnsafeRawBufferPointer). Mandates strict validation of buffer length, alignment, capacity, and monotonic byte bounds to eliminate native buffer overruns and unaligned pointer dereferences during zero-copy IPC.","antiPatternHeadline":"Unvalidated Raw Pointer Casting and Direct Unchecked Slice Slicing Over Native IPC","stars_count":99,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri-v2","rust","jni","ffi","memory-safety","android","ios"],"exportEndpoints":{"claude":"/api/rules/tauri-mobile-jni-ffi-envelope-memory-sandbox?format=claude","cursorMdc":"/api/rules/tauri-mobile-jni-ffi-envelope-memory-sandbox?format=mdc","cursorrules":"/api/rules/tauri-mobile-jni-ffi-envelope-memory-sandbox?format=cursor","windsurf":"/api/rules/tauri-mobile-jni-ffi-envelope-memory-sandbox?format=windsurf","agents":"/api/rules/tauri-mobile-jni-ffi-envelope-memory-sandbox?format=agents"}},{"id":"openfga-outbox-cdc-transactional-consistency","title":"OpenFGA Outbox CDC Transactional Consistency Guardrail","category":"security","severity":"critical","description":"Enforces atomic synchronization between primary relational data stores and OpenFGA authorization relationship tuples using the Transactional Outbox Pattern and Change Data Capture (CDC). Prohibits direct, dual-write invocations to the OpenFGA API within application business logic to prevent state drift, orphaned permissions, and security bypasses during network partitions or transaction rollbacks.","antiPatternHeadline":"Dual-writing directly to OpenFGA and SQL databases within the same execution path without transactional guarantees","stars_count":69,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","authorization","cdc","transactional-outbox","distributed-systems"],"exportEndpoints":{"claude":"/api/rules/openfga-outbox-cdc-transactional-consistency?format=claude","cursorMdc":"/api/rules/openfga-outbox-cdc-transactional-consistency?format=mdc","cursorrules":"/api/rules/openfga-outbox-cdc-transactional-consistency?format=cursor","windsurf":"/api/rules/openfga-outbox-cdc-transactional-consistency?format=windsurf","agents":"/api/rules/openfga-outbox-cdc-transactional-consistency?format=agents"}},{"id":"webauthn-device-bound-step-up-attestation","title":"WebAuthn Device-Bound Step-Up Attestation & Synced-Passkey Differentiation Standard","category":"security","severity":"critical","description":"Enforces strict cryptographic verification of WebAuthn authenticator flags and client extensions to differentiate multi-device synced passkeys from enterprise hardware-bound security keys during privileged step-up operations. Mandates inspection of Backup Eligibility (BE), Backup State (BS), and device-bound public key extensions to prevent synced credential impersonation across security tiers.","antiPatternHeadline":"Treating Synced Passkeys Identically to Enterprise Hardware-Bound Authenticators in High-Assurance Step-Up Workflows","stars_count":87,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","fido2","passkeys","cryptography","zero-trust","step-up-auth"],"exportEndpoints":{"claude":"/api/rules/webauthn-device-bound-step-up-attestation?format=claude","cursorMdc":"/api/rules/webauthn-device-bound-step-up-attestation?format=mdc","cursorrules":"/api/rules/webauthn-device-bound-step-up-attestation?format=cursor","windsurf":"/api/rules/webauthn-device-bound-step-up-attestation?format=windsurf","agents":"/api/rules/webauthn-device-bound-step-up-attestation?format=agents"}},{"id":"ebpf-tc-ringbuf-packet-auditing-standard","title":"eBPF TC Ring-Buffer Zero-Copy Packet Auditing Invariant","category":"devops","severity":"critical","description":"Mandates kernel-space Traffic Control (TC) ingress/egress BPF-ringbuf allocations using zero-copy reservation primitives (bpf_ringbuf_reserve/bpf_ringbuf_submit) rather than legacy perf-event buffers. Guarantees container egress audits sustain high-rate network spikes with sub-microsecond latency, deterministic memory bounds, and zero socket packet drop rates under buffer saturation.","antiPatternHeadline":"Utilizing Legacy Perf-Event Arrays or Unchecked Ring-Buffer Allocations in High-Throughput TC Filters","stars_count":52,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","traffic-control","networking","kernel","bpf-ringbuf"],"exportEndpoints":{"claude":"/api/rules/ebpf-tc-ringbuf-packet-auditing-standard?format=claude","cursorMdc":"/api/rules/ebpf-tc-ringbuf-packet-auditing-standard?format=mdc","cursorrules":"/api/rules/ebpf-tc-ringbuf-packet-auditing-standard?format=cursor","windsurf":"/api/rules/ebpf-tc-ringbuf-packet-auditing-standard?format=windsurf","agents":"/api/rules/ebpf-tc-ringbuf-packet-auditing-standard?format=agents"}},{"id":"svelte-5-runes-raw-state-telemetry-guardrail","title":"Svelte 5 High-Frequency Telemetry Invariant: Enforce $state.raw Immutability Boundaries","category":"frontend","severity":"critical","description":"Mandates the usage of $state.raw for high-frequency telemetry streams, WebSockets, and sensor feeds to prevent fine-grained reactivity cascade storms and deep proxy-wrapping overhead. Enforces an immutable update paradigm where raw state is replaced via atomic reference assignment rather than in-place mutation.","antiPatternHeadline":"Deep Proxy Virtualization of Rapid Telemetry Payloads via Standard $state Triggering Reactive Micro-Storms and Heap Churn","stars_count":87,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","reactivity","performance","telemetry","websockets"],"exportEndpoints":{"claude":"/api/rules/svelte-5-runes-raw-state-telemetry-guardrail?format=claude","cursorMdc":"/api/rules/svelte-5-runes-raw-state-telemetry-guardrail?format=mdc","cursorrules":"/api/rules/svelte-5-runes-raw-state-telemetry-guardrail?format=cursor","windsurf":"/api/rules/svelte-5-runes-raw-state-telemetry-guardrail?format=windsurf","agents":"/api/rules/svelte-5-runes-raw-state-telemetry-guardrail?format=agents"}},{"id":"postgres-17-failover-slot-synchronization-invariant-postgres-17-fail-333","title":"PostgreSQL 17 Failover Slot Synchronization and CDC Loss Prevention Invariant","category":"backend","severity":"critical","description":"Enforces failover-safe logical replication slot synchronization across PostgreSQL 17 high-availability clusters using the native failover slot sync protocol (`sync_replication_slots` and `pg_sync_replication_slots`). Guarantees downstream Change Data Capture (CDC) engines avoid data loss, non-recoverable slot invalidation, or massive duplicate replay bursts upon standby promotion. Mandates strict verification of `synchronized = true` on hot standbys and physical slot synchronization prerequisites before promoting standby nodes.","antiPatternHeadline":"Unsynchronized Logical Replication Slots Triggering CDC Rewind, Duplicate Streaming, or Silent Event Loss Post-Failover","stars_count":111,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres-17","cdc","high-availability","replication-slots","debezium"],"exportEndpoints":{"claude":"/api/rules/postgres-17-failover-slot-synchronization-invariant-postgres-17-fail-333?format=claude","cursorMdc":"/api/rules/postgres-17-failover-slot-synchronization-invariant-postgres-17-fail-333?format=mdc","cursorrules":"/api/rules/postgres-17-failover-slot-synchronization-invariant-postgres-17-fail-333?format=cursor","windsurf":"/api/rules/postgres-17-failover-slot-synchronization-invariant-postgres-17-fail-333?format=windsurf","agents":"/api/rules/postgres-17-failover-slot-synchronization-invariant-postgres-17-fail-333?format=agents"}},{"id":"go-synctest-synthetic-time-concurrency","title":"Go 1.24 Synctest Synthetic Time Concurrency Invariant","category":"backend","severity":"critical","description":"Mandates encapsulating asynchronous and time-dependent concurrent test suites inside Go 1.24 synthetic time bubbles via testing/synctest. Eliminates non-deterministic wall-clock sleeps, instantaneous virtualized timer resolution, and guarantees that goroutine deadlocks and leaks trigger immediate, repeatable panics prior to production deployment.","antiPatternHeadline":"Arbitrary Wall-Clock Sleeping and Non-Deterministic Polling in Concurrent Tests","stars_count":64,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","concurrency","testing","synctest","goroutines"],"exportEndpoints":{"claude":"/api/rules/go-synctest-synthetic-time-concurrency?format=claude","cursorMdc":"/api/rules/go-synctest-synthetic-time-concurrency?format=mdc","cursorrules":"/api/rules/go-synctest-synthetic-time-concurrency?format=cursor","windsurf":"/api/rules/go-synctest-synthetic-time-concurrency?format=windsurf","agents":"/api/rules/go-synctest-synthetic-time-concurrency?format=agents"}},{"id":"capacitor7-credential-manager-passkey-attestation-protocol","title":"Capacitor 7 Native Credential Manager Passkey Attestation & Transient Zeroization Protocol","category":"mobile","severity":"critical","description":"Enforces strict hardware-backed WebAuthn attestation bridging between Capacitor 7 WebViews and native Android CredentialManager / iOS ASAuthorizationController. Mandates cryptographic challenge verification, atomic cross-bridge serialization, and immediate zeroization of transient cryptographic secrets to prevent retention in WebView memory pools.","antiPatternHeadline":"Bypassing Native Credential API Bridging via Polyfills and Retaining Attestation Tokens in Long-Lived Memory","stars_count":62,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor7","webauthn","passkeys","credential-manager","fido2","security"],"exportEndpoints":{"claude":"/api/rules/capacitor7-credential-manager-passkey-attestation-protocol?format=claude","cursorMdc":"/api/rules/capacitor7-credential-manager-passkey-attestation-protocol?format=mdc","cursorrules":"/api/rules/capacitor7-credential-manager-passkey-attestation-protocol?format=cursor","windsurf":"/api/rules/capacitor7-credential-manager-passkey-attestation-protocol?format=windsurf","agents":"/api/rules/capacitor7-credential-manager-passkey-attestation-protocol?format=agents"}},{"id":"swift-6-region-based-isolation-boundary","title":"Swift 6 Strict Concurrency Region-Based Isolation & Transfer Boundaries","category":"mobile","severity":"critical","description":"Enforces compile-time region-based isolation (SE-0414) under Swift 6 strict concurrency to safely transfer non-Sendable mutable types across actor boundaries. Prohibits unsafe escape hatches like @unchecked Sendable and eliminates expensive defensive copies by requiring disconnected isolation regions and explicit 'sending' parameter semantics.","antiPatternHeadline":"Bypassing Actor Isolation with @unchecked Sendable or Allocating Redundant Deep Copies","stars_count":117,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","swift6","concurrency","region-isolation","actors","sendable"],"exportEndpoints":{"claude":"/api/rules/swift-6-region-based-isolation-boundary?format=claude","cursorMdc":"/api/rules/swift-6-region-based-isolation-boundary?format=mdc","cursorrules":"/api/rules/swift-6-region-based-isolation-boundary?format=cursor","windsurf":"/api/rules/swift-6-region-based-isolation-boundary?format=windsurf","agents":"/api/rules/swift-6-region-based-isolation-boundary?format=agents"}},{"id":"webauthn-conditional-ui-device-bound-assertion-standard","title":"WebAuthn Conditional UI Device-Bound Assertion & Relay Protection Standard","category":"security","severity":"critical","description":"Enforces origin-bound, hardware-backed cryptographic validation for WebAuthn Conditional UI (autofill) ceremonies to neutralize passkey relay attacks and session spoofing. Mandates cryptographically random server challenges bound to ephemeral sessions, mandatory User Verification and User Presence flag checks, validation of non-exportable hardware flags, and deterministic AbortController lifecycle management.","antiPatternHeadline":"Permissive Conditional UI Autofill Permitting Synced Multi-Device Credentials and Unverified Relay Assertions","stars_count":79,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","passkeys","fido2","conditional-ui","cryptography"],"exportEndpoints":{"claude":"/api/rules/webauthn-conditional-ui-device-bound-assertion-standard?format=claude","cursorMdc":"/api/rules/webauthn-conditional-ui-device-bound-assertion-standard?format=mdc","cursorrules":"/api/rules/webauthn-conditional-ui-device-bound-assertion-standard?format=cursor","windsurf":"/api/rules/webauthn-conditional-ui-device-bound-assertion-standard?format=windsurf","agents":"/api/rules/webauthn-conditional-ui-device-bound-assertion-standard?format=agents"}},{"id":"otel-span-links-dag-causality-standard","title":"OpenTelemetry Distributed Span Links DAG Causality Standard for Asynchronous Message Fanout","category":"devops","severity":"critical","description":"Enforces the use of explicit OpenTelemetry span links instead of hierarchical parent-child trace context nesting in asynchronous message broker consumers and fan-out topologies. Hierarchical span parenting in deferred or batched messaging causes artificial latency inflation and distorts service-dependency DAGs by tying decoupled background job lifetimes to the original publisher trace. Asynchronous consumers MUST initiate root traces or localized parent contexts and link publisher spans via trace links to maintain causal accuracy without violating trace boundary constraints.","antiPatternHeadline":"Parenting Asynchronous Message Consumers Directly Under Producer Context Causing Graph Distortion and Artificial Latency Inflation","stars_count":61,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["opentelemetry","distributed-tracing","observability","kafka","rabbitmq","event-driven-architecture","apm"],"exportEndpoints":{"claude":"/api/rules/otel-span-links-dag-causality-standard?format=claude","cursorMdc":"/api/rules/otel-span-links-dag-causality-standard?format=mdc","cursorrules":"/api/rules/otel-span-links-dag-causality-standard?format=cursor","windsurf":"/api/rules/otel-span-links-dag-causality-standard?format=windsurf","agents":"/api/rules/otel-span-links-dag-causality-standard?format=agents"}},{"id":"k8s-gateway-v1-2-cross-namespace-policy-attachment-standard-kubernetes-gatew-776","title":"Hierarchical Policy Attachment and Cross-Namespace Route Isolation in Gateway API v1.2","category":"devops","severity":"critical","description":"Enforces strict tenant boundary isolation and non-overridable hierarchical routing policies within Kubernetes Gateway API v1.2. Prohibits wildcard listener bindings, mandates explicit ReferenceGrant contracts for cross-namespace backend references, and guarantees centralized security policies cannot be bypassed or overridden by child routes.","antiPatternHeadline":"Unrestricted Listener Bindings and Unguarded Cross-Namespace Route Hijacking","stars_count":58,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","kubernetes","gateway-api","networking","multi-tenancy","security"],"exportEndpoints":{"claude":"/api/rules/k8s-gateway-v1-2-cross-namespace-policy-attachment-standard-kubernetes-gatew-776?format=claude","cursorMdc":"/api/rules/k8s-gateway-v1-2-cross-namespace-policy-attachment-standard-kubernetes-gatew-776?format=mdc","cursorrules":"/api/rules/k8s-gateway-v1-2-cross-namespace-policy-attachment-standard-kubernetes-gatew-776?format=cursor","windsurf":"/api/rules/k8s-gateway-v1-2-cross-namespace-policy-attachment-standard-kubernetes-gatew-776?format=windsurf","agents":"/api/rules/k8s-gateway-v1-2-cross-namespace-policy-attachment-standard-kubernetes-gatew-776?format=agents"}},{"id":"openfga-contextual-tuple-cache-invalidation-standard","title":"OpenFGA 0.6 Ephemeral Context Isolation & Cache Invalidation Invariant","category":"security","severity":"critical","description":"Enforces strict separation between persistent relationship graphs and ephemeral contextual claims in OpenFGA 0.6 architectures. Prevents algorithmic denial-of-service (DoS) and cache thrashing at Policy Decision Points (PDPs) by bounding contextual tuple sets and avoiding persistent store pollution.","antiPatternHeadline":"Persisting Ephemeral Request State or Injecting Unbounded Contextual Tuples into OpenFGA Check Calls","stars_count":45,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","rebac","authorization","caching","latency"],"exportEndpoints":{"claude":"/api/rules/openfga-contextual-tuple-cache-invalidation-standard?format=claude","cursorMdc":"/api/rules/openfga-contextual-tuple-cache-invalidation-standard?format=mdc","cursorrules":"/api/rules/openfga-contextual-tuple-cache-invalidation-standard?format=cursor","windsurf":"/api/rules/openfga-contextual-tuple-cache-invalidation-standard?format=windsurf","agents":"/api/rules/openfga-contextual-tuple-cache-invalidation-standard?format=agents"}},{"id":"svelte-5-runes-async-effect-signal-cancellation","title":"Strict AbortController Signal Cancellation in Svelte 5 Runes Async Effects","category":"frontend","severity":"critical","description":"Enforces synchronous cleanup contract adherence and mandatory AbortController propagation inside Svelte 5 $effect and $effect.pre rune boundaries. Prevents stale closure race conditions, out-of-order state mutations, and orphaned async microtasks when reactive dependencies cycle rapidly.","antiPatternHeadline":"Uncontrolled Async Microtasks and Return of Promises in Svelte 5 $effect Rune Closures","stars_count":104,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","effects","concurrency","abort-controller","typescript"],"exportEndpoints":{"claude":"/api/rules/svelte-5-runes-async-effect-signal-cancellation?format=claude","cursorMdc":"/api/rules/svelte-5-runes-async-effect-signal-cancellation?format=mdc","cursorrules":"/api/rules/svelte-5-runes-async-effect-signal-cancellation?format=cursor","windsurf":"/api/rules/svelte-5-runes-async-effect-signal-cancellation?format=windsurf","agents":"/api/rules/svelte-5-runes-async-effect-signal-cancellation?format=agents"}},{"id":"tauri2-multiwindow-granular-capability-scoping","title":"Tauri 2.0 Multi-Window Granular Capability Scoping Standard","category":"mobile","severity":"critical","description":"Enforces compile-time Access Control List (ACL) capability partitioning and strict window label binding in Tauri 2.0 desktop and mobile targets. Eliminates privilege escalation by preventing auxiliary webviews (such as OAuth flows, document viewers, and untrusted embeds) from inheriting ambient native capabilities or wildcard IPC permissions.","antiPatternHeadline":"Wildcard Window Capability Granting Arbitrary IPC and Plugin Execution to Untrusted Child Webviews","stars_count":65,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri","security","ipc","capability-acl","webview"],"exportEndpoints":{"claude":"/api/rules/tauri2-multiwindow-granular-capability-scoping?format=claude","cursorMdc":"/api/rules/tauri2-multiwindow-granular-capability-scoping?format=mdc","cursorrules":"/api/rules/tauri2-multiwindow-granular-capability-scoping?format=cursor","windsurf":"/api/rules/tauri2-multiwindow-granular-capability-scoping?format=windsurf","agents":"/api/rules/tauri2-multiwindow-granular-capability-scoping?format=agents"}},{"id":"webauthn-prf-zk-key-derivation-guardrail-webauthn-prf-ext-831","title":"WebAuthn PRF Extension Zero-Knowledge Key Derivation Invariant","category":"security","severity":"critical","description":"Enforces strict cryptographic domain separation and client-side isolation when deriving symmetric keys via the WebAuthn PRF (pseudo-random function) extension. Guarantees that raw PRF outputs and derived symmetric encryption keys are non-extractable, zeroized immediately after initialization, and never exfiltrated to application backends, session storage, or telemetry streams.","antiPatternHeadline":"Exposing Raw PRF Outputs to Backends or Storing Extractable Derived Symmetric Keys","stars_count":81,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","prf-extension","cryptography","zero-knowledge","web-crypto-api"],"exportEndpoints":{"claude":"/api/rules/webauthn-prf-zk-key-derivation-guardrail-webauthn-prf-ext-831?format=claude","cursorMdc":"/api/rules/webauthn-prf-zk-key-derivation-guardrail-webauthn-prf-ext-831?format=mdc","cursorrules":"/api/rules/webauthn-prf-zk-key-derivation-guardrail-webauthn-prf-ext-831?format=cursor","windsurf":"/api/rules/webauthn-prf-zk-key-derivation-guardrail-webauthn-prf-ext-831?format=windsurf","agents":"/api/rules/webauthn-prf-zk-key-derivation-guardrail-webauthn-prf-ext-831?format=agents"}},{"id":"postgres17-vectorized-direct-io-buffer-guardrail","title":"PostgreSQL 17 Direct I/O & Shared Buffer Pool Thrash Prevention Guardrail","category":"backend","severity":"critical","description":"Mandates deterministic concurrency ceilings, session-scoped memory caps, and ring-buffer isolation for PostgreSQL 17 vectorized streaming reads and parallel scans. Prevents asynchronous I/O (AIO) kernel queue saturation, dirty page writeback starvation, and catastrophic shared buffer pool eviction cascades under sustained analytical load.","antiPatternHeadline":"Unbounded Parallel Analytical Scans Triggering Shared Buffer Cache Invalidation and AIO Ring Starvation","stars_count":55,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","database","performance","io","transactions"],"exportEndpoints":{"claude":"/api/rules/postgres17-vectorized-direct-io-buffer-guardrail?format=claude","cursorMdc":"/api/rules/postgres17-vectorized-direct-io-buffer-guardrail?format=mdc","cursorrules":"/api/rules/postgres17-vectorized-direct-io-buffer-guardrail?format=cursor","windsurf":"/api/rules/postgres17-vectorized-direct-io-buffer-guardrail?format=windsurf","agents":"/api/rules/postgres17-vectorized-direct-io-buffer-guardrail?format=agents"}},{"id":"ebpf-sockops-mesh-bypass-mitigation","title":"eBPF sock_ops Socket-Level Mesh Bypass Mitigation Standard","category":"devops","severity":"critical","description":"Mandates zero-bypass transport layer interception in eBPF sock_ops and sockhash/sockmap redirection routines. Enforces strict cgroup namespace isolation, caller UID validation, and mandatory proxy traversal to guarantee mutual TLS and L7 security policy inspection cannot be circumnavigated at the socket layer.","antiPatternHeadline":"Unvalidated BPF Sockmap Short-Circuiting Bypassing Service Mesh Proxy and mTLS Enforcement","stars_count":54,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","service-mesh","mtls","kernel-security","sockops"],"exportEndpoints":{"claude":"/api/rules/ebpf-sockops-mesh-bypass-mitigation?format=claude","cursorMdc":"/api/rules/ebpf-sockops-mesh-bypass-mitigation?format=mdc","cursorrules":"/api/rules/ebpf-sockops-mesh-bypass-mitigation?format=cursor","windsurf":"/api/rules/ebpf-sockops-mesh-bypass-mitigation?format=windsurf","agents":"/api/rules/ebpf-sockops-mesh-bypass-mitigation?format=agents"}},{"id":"compose-multiplatform-skiko-render-thread-isolation","title":"Compose Multiplatform Skiko Render Thread Isolation Invariant","category":"mobile","severity":"critical","description":"Enforces strict isolation of Compose Multiplatform Skiko hardware rendering contexts (DirectX, Metal, OpenGL, Software) from non-deterministic concurrent coroutine dispatches. Dispatches to background thread pools (e.g., Dispatchers.Default or Dispatchers.IO) must never acquire, manipulate, or await graphical surfaces directly, eliminating pipeline deadlocks, context thrashing, and frame drops.","antiPatternHeadline":"Interleaving Off-Thread Coroutine Processing with Skiko Graphics Layer Mutations","stars_count":115,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","compose-multiplatform","skiko","kotlin","rendering","coroutines"],"exportEndpoints":{"claude":"/api/rules/compose-multiplatform-skiko-render-thread-isolation?format=claude","cursorMdc":"/api/rules/compose-multiplatform-skiko-render-thread-isolation?format=mdc","cursorrules":"/api/rules/compose-multiplatform-skiko-render-thread-isolation?format=cursor","windsurf":"/api/rules/compose-multiplatform-skiko-render-thread-isolation?format=windsurf","agents":"/api/rules/compose-multiplatform-skiko-render-thread-isolation?format=agents"}},{"id":"fastapi-python-313t-free-threaded-thread-safety","title":"FastAPI Free-Threaded Python 3.13t Thread-Safety & Memory Invariant Standard","category":"backend","severity":"critical","description":"Enforces strict thread-safety invariants for FastAPI applications running on free-threaded Python 3.13t (no-GIL) runtimes. Prohibits unsynchronized mutable module-level state and mandates reentrant locks across async offloads invoking non-thread-safe C-extensions to prevent memory corruption and segmentation faults.","antiPatternHeadline":"Unsynchronized Global State Mutation and Unlocked C-Extension Invocations Under Free-Threaded (PEP 703) Python","stars_count":100,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","python313t","free-threaded","nogil","concurrency","thread-safety"],"exportEndpoints":{"claude":"/api/rules/fastapi-python-313t-free-threaded-thread-safety?format=claude","cursorMdc":"/api/rules/fastapi-python-313t-free-threaded-thread-safety?format=mdc","cursorrules":"/api/rules/fastapi-python-313t-free-threaded-thread-safety?format=cursor","windsurf":"/api/rules/fastapi-python-313t-free-threaded-thread-safety?format=windsurf","agents":"/api/rules/fastapi-python-313t-free-threaded-thread-safety?format=agents"}},{"id":"opentelemetry-baggage-dynamic-sampling-invariant","title":"OpenTelemetry Baggage Dynamic Head-and-Tail Sampling Invariant","category":"devops","severity":"critical","description":"Enforces strict distributed context propagation using W3C Baggage to dynamically adjust head-based trace sampling weights at ingress based on tenant tier SLA and downstream circuit breaker status. Prevents telemetry debt and silent data loss by synchronizing baggage-driven sampling probabilities across downstream tail-sampling collectors.","antiPatternHeadline":"Static Head-Sampling or Dropping W3C Baggage Resulting in Blind Spots and Ingestion Cost Explosions","stars_count":88,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","tracing","distributed-systems","observability","tail-sampling"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-baggage-dynamic-sampling-invariant?format=claude","cursorMdc":"/api/rules/opentelemetry-baggage-dynamic-sampling-invariant?format=mdc","cursorrules":"/api/rules/opentelemetry-baggage-dynamic-sampling-invariant?format=cursor","windsurf":"/api/rules/opentelemetry-baggage-dynamic-sampling-invariant?format=windsurf","agents":"/api/rules/opentelemetry-baggage-dynamic-sampling-invariant?format=agents"}},{"id":"wasi-component-memory-quota-boundary","title":"Deterministic Linear Memory Quotas and Capability Boundaries for WASI 0.2","category":"backend","severity":"critical","description":"Multi-tenant WASI 0.2 component execution requires explicit linear memory limits, pooled allocation limits, and non-blocking capability interfaces. Without strict host-enforced memory ceilings and deadman timers, untrusted guest components can induce host Out-Of-Memory (OOM) crashes and thread starvation through unmetered memory expansion.","antiPatternHeadline":"Unbounded Linear Memory Growth and Blocking Capability Execution in Multi-Tenant Component Runtimes","stars_count":67,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","wasi","wasm","component-model","sandboxing","resource-management"],"exportEndpoints":{"claude":"/api/rules/wasi-component-memory-quota-boundary?format=claude","cursorMdc":"/api/rules/wasi-component-memory-quota-boundary?format=mdc","cursorrules":"/api/rules/wasi-component-memory-quota-boundary?format=cursor","windsurf":"/api/rules/wasi-component-memory-quota-boundary?format=windsurf","agents":"/api/rules/wasi-component-memory-quota-boundary?format=agents"}},{"id":"vite6-environment-api-multi-runtime-isolation-vite-6-environme-241","title":"Vite 6 Environment API Multi-Runtime Module Graph & HMR Boundary Enforcement","category":"frontend","severity":"critical","description":"Enforces strict isolation between heterogeneous runtime environments (client, node SSR, edge/workerd, and RSC) using the Vite 6 Environment API. Guarantees that module graphs, transform pipelines, and hot-module replacement (HMR) boundaries do not leak state or trigger invalid cross-runtime graph mutations across isolated execution contexts.","antiPatternHeadline":"Cross-Runtime Module Graph Contamination and Unscoped Legacy SSR Invalidation","stars_count":53,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","vite6","environment-api","ssr","hmr","edge-runtime"],"exportEndpoints":{"claude":"/api/rules/vite6-environment-api-multi-runtime-isolation-vite-6-environme-241?format=claude","cursorMdc":"/api/rules/vite6-environment-api-multi-runtime-isolation-vite-6-environme-241?format=mdc","cursorrules":"/api/rules/vite6-environment-api-multi-runtime-isolation-vite-6-environme-241?format=cursor","windsurf":"/api/rules/vite6-environment-api-multi-runtime-isolation-vite-6-environme-241?format=windsurf","agents":"/api/rules/vite6-environment-api-multi-runtime-isolation-vite-6-environme-241?format=agents"}},{"id":"react-19-action-transition-async-cancellation-guardrail","title":"React 19 Async Transition Cancellation & Bailout Boundary Enforcement","category":"frontend","severity":"critical","description":"Enforces deterministic cancellation and boundary bailouts for React 19 async transitions (startTransition and useActionState). Ensures external network requests, caching, and imperative side effects abort cleanly when superseded by newer transitions or component unmounts, preventing zombie writes and race conditions.","antiPatternHeadline":"Dangling Un-aborted Async Promises and Stale External Side Effects in React 19 Transitions","stars_count":102,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","transitions","useActionState","concurrency","abort-controller"],"exportEndpoints":{"claude":"/api/rules/react-19-action-transition-async-cancellation-guardrail?format=claude","cursorMdc":"/api/rules/react-19-action-transition-async-cancellation-guardrail?format=mdc","cursorrules":"/api/rules/react-19-action-transition-async-cancellation-guardrail?format=cursor","windsurf":"/api/rules/react-19-action-transition-async-cancellation-guardrail?format=windsurf","agents":"/api/rules/react-19-action-transition-async-cancellation-guardrail?format=agents"}},{"id":"svelte5-runes-reactive-graph-cycle-push-pull-leak-guardrail","title":"Svelte 5 Runes Reactive Graph Cycle Prevention and Push-Pull Leak Guardrail","category":"frontend","severity":"critical","description":"Enforces strict structural constraints on Svelte 5 rune topologies ($state, $derived, $effect) to eliminate infinite evaluation loops and subscription leaks. Protects against memory bloat and microtask exhaustion under high-throughput telemetry updates by mandating untracked reads, bounded buffers, and decoupled frame rendering.","antiPatternHeadline":"Dynamic Graph Dependency Churn and Cyclic Invalidation Under High-Frequency Stream Mutation","stars_count":53,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["svelte5","runes","reactivity","memory-leak","telemetry","performance","frontend"],"exportEndpoints":{"claude":"/api/rules/svelte5-runes-reactive-graph-cycle-push-pull-leak-guardrail?format=claude","cursorMdc":"/api/rules/svelte5-runes-reactive-graph-cycle-push-pull-leak-guardrail?format=mdc","cursorrules":"/api/rules/svelte5-runes-reactive-graph-cycle-push-pull-leak-guardrail?format=cursor","windsurf":"/api/rules/svelte5-runes-reactive-graph-cycle-push-pull-leak-guardrail?format=windsurf","agents":"/api/rules/svelte5-runes-reactive-graph-cycle-push-pull-leak-guardrail?format=agents"}},{"id":"bun-zero-copy-sab-ipc-transfer-invariants","title":"Bun 1.2 Zero-Copy Buffer Transfer and SharedArrayBuffer IPC Invariants","category":"backend","severity":"critical","description":"Enforces strict zero-copy memory semantics during Inter-Process Communication (IPC) and Worker thread synchronization under Bun 1.2. Mandates explicit transfer list specifications for ArrayBuffer ownership transfers or coordinated SharedArrayBuffer regions to eliminate Structured Clone allocations, prevent garbage collection pauses, and avoid severe heap fragmentation under high throughput.","antiPatternHeadline":"Implicit Structured Cloning of Large Binary Payloads across Worker Threads","stars_count":108,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","ipc","zero-copy","performance","memory-management","concurrency"],"exportEndpoints":{"claude":"/api/rules/bun-zero-copy-sab-ipc-transfer-invariants?format=claude","cursorMdc":"/api/rules/bun-zero-copy-sab-ipc-transfer-invariants?format=mdc","cursorrules":"/api/rules/bun-zero-copy-sab-ipc-transfer-invariants?format=cursor","windsurf":"/api/rules/bun-zero-copy-sab-ipc-transfer-invariants?format=windsurf","agents":"/api/rules/bun-zero-copy-sab-ipc-transfer-invariants?format=agents"}},{"id":"capacitor-7-biometric-secure-enclave-bridge-standard","title":"Capacitor 7 Biometric Hardware-Backed Secure Enclave Bridge Standard","category":"mobile","severity":"critical","description":"Enforces cryptographic isolation between the hybrid Capacitor WebView and native secure hardware (iOS Secure Enclave and Android KeyStore StrongBox). Mandates that raw private keys, biometrically unlocked symmetric secrets, and plain credentials never cross the bridge into the dynamic JavaScript DOM runtime, mitigating XSS, malicious deep-link invocations, and unauthorized WebView inspections.","antiPatternHeadline":"Exporting Raw Private Keys or Cleartext Secrets Across the Capacitor Bridge into WebView Contexts","stars_count":42,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","security","biometrics","keychain","keystore"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-biometric-secure-enclave-bridge-standard?format=claude","cursorMdc":"/api/rules/capacitor-7-biometric-secure-enclave-bridge-standard?format=mdc","cursorrules":"/api/rules/capacitor-7-biometric-secure-enclave-bridge-standard?format=cursor","windsurf":"/api/rules/capacitor-7-biometric-secure-enclave-bridge-standard?format=windsurf","agents":"/api/rules/capacitor-7-biometric-secure-enclave-bridge-standard?format=agents"}},{"id":"kmp-swift-export-memory-boundary-guardrail","title":"KMP 2.1 Swift-Export and Swift 6 Actor Memory Domain Isolation","category":"mobile","severity":"critical","description":"Enforces strict memory domain boundaries between Kotlin Native garbage collection and Swift 6 Sendable/Actor concurrency domains across direct Swift-Export bridges. Prevents illegal cross-thread mutation of Kotlin reference types, ARC race conditions, and InvalidMutability/Segmentation Faults by mandating value-semantic DTO transfers, explicit @Sendable wrapping, and cancellation token propagation across the bridge.","antiPatternHeadline":"Leaking Mutable Kotlin Native Object Graphs Directly into Swift 6 Concurrency Domains Without Boundary Freezing or Value Projection","stars_count":53,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","swift-export","swift6","concurrency","memory-management"],"exportEndpoints":{"claude":"/api/rules/kmp-swift-export-memory-boundary-guardrail?format=claude","cursorMdc":"/api/rules/kmp-swift-export-memory-boundary-guardrail?format=mdc","cursorrules":"/api/rules/kmp-swift-export-memory-boundary-guardrail?format=cursor","windsurf":"/api/rules/kmp-swift-export-memory-boundary-guardrail?format=windsurf","agents":"/api/rules/kmp-swift-export-memory-boundary-guardrail?format=agents"}},{"id":"webauthn-conditional-ui-stepup-isolation","title":"WebAuthn Conditional UI Isolation and Cryptographic Step-Up Invariant","category":"security","severity":"critical","description":"Enforces strict cryptographic and contextual isolation between passive Conditional UI passkey autofill assertions and active step-up re-authentication ceremonies. Prevents session fixation, cross-context assertion replay, and downgrade attacks by mandating ephemeral transaction-bound challenges, explicit mediation, and compulsory User Verification (UV) flags for all privileged mutations.","antiPatternHeadline":"Conflating Passive Passkey Autofill Assertions with Explicit High-Privilege Step-Up Proofs","stars_count":59,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","fido2","passkeys","authentication","cryptography"],"exportEndpoints":{"claude":"/api/rules/webauthn-conditional-ui-stepup-isolation?format=claude","cursorMdc":"/api/rules/webauthn-conditional-ui-stepup-isolation?format=mdc","cursorrules":"/api/rules/webauthn-conditional-ui-stepup-isolation?format=cursor","windsurf":"/api/rules/webauthn-conditional-ui-stepup-isolation?format=windsurf","agents":"/api/rules/webauthn-conditional-ui-stepup-isolation?format=agents"}},{"id":"ebpf-tetragon-kernel-boundary-enforcement-standard","title":"eBPF Tetragon Synchronous In-Kernel Container Boundary and Privilege Escalation Enforcement","category":"security","severity":"critical","description":"Enforces synchronous in-kernel memory and boundary access controls using Cilium Tetragon TracingPolicy CRDs to preemptively block namespace-escape, kernel tampering, and unauthorized credential mutation. Replaces asynchronous post-exploit audit telemetry with deterministic in-kernel signal dispatch (SIGKILL) on forbidden system call invocations and kernel function entries. Mandates zero-trust namespace isolation by binding strict kprobe, tracepoint, and LSM hooks directly to container execution contexts.","antiPatternHeadline":"Relying on Asynchronous User-Space Alerting Without Synchronous In-Kernel Process Termination","stars_count":46,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","ebpf","tetragon","kubernetes","lsm","runtime-security"],"exportEndpoints":{"claude":"/api/rules/ebpf-tetragon-kernel-boundary-enforcement-standard?format=claude","cursorMdc":"/api/rules/ebpf-tetragon-kernel-boundary-enforcement-standard?format=mdc","cursorrules":"/api/rules/ebpf-tetragon-kernel-boundary-enforcement-standard?format=cursor","windsurf":"/api/rules/ebpf-tetragon-kernel-boundary-enforcement-standard?format=windsurf","agents":"/api/rules/ebpf-tetragon-kernel-boundary-enforcement-standard?format=agents"}},{"id":"opentelemetry-w3c-kafka-context-propagation-production-standard","title":"Deterministic W3C Trace Context Propagation in Asynchronous Kafka Consumer Batch Loops","category":"devops","severity":"critical","description":"Mandates strict extraction, scoping, and propagation of W3C Trace Context across high-throughput Kafka batch event loops. Prevents async context pollution and cross-partition trace fragmentation by requiring per-message contextual isolation and explicit span links for aggregate processing spans.","antiPatternHeadline":"Global Context Leakage and Ambient Trace Fragmentation in Async Kafka Batch Loops","stars_count":102,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","kafka","tracing","distributed-systems","typescript"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-w3c-kafka-context-propagation-production-standard?format=claude","cursorMdc":"/api/rules/opentelemetry-w3c-kafka-context-propagation-production-standard?format=mdc","cursorrules":"/api/rules/opentelemetry-w3c-kafka-context-propagation-production-standard?format=cursor","windsurf":"/api/rules/opentelemetry-w3c-kafka-context-propagation-production-standard?format=windsurf","agents":"/api/rules/opentelemetry-w3c-kafka-context-propagation-production-standard?format=agents"}},{"id":"react-19-compiler-ref-mutation-invariant","title":"React 19 Compiler Auto-Memoization: Ref Mutation and Render-Phase Invariant Guardrail","category":"frontend","severity":"critical","description":"Enforces strict compliance with React 19 Compiler memoization heuristics by prohibiting reads and writes to ref.current during client component render execution. Guarantees deterministic auto-memoization graphs and eliminates cache corruption caused by untracked mutable escapes outside React's reactive flow.","antiPatternHeadline":"Render-Phase Ref Mutation and Escape Analysis Invalidation in React 19","stars_count":89,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["react","react-19","react-compiler","memoization","hooks","typescript"],"exportEndpoints":{"claude":"/api/rules/react-19-compiler-ref-mutation-invariant?format=claude","cursorMdc":"/api/rules/react-19-compiler-ref-mutation-invariant?format=mdc","cursorrules":"/api/rules/react-19-compiler-ref-mutation-invariant?format=cursor","windsurf":"/api/rules/react-19-compiler-ref-mutation-invariant?format=windsurf","agents":"/api/rules/react-19-compiler-ref-mutation-invariant?format=agents"}},{"id":"nextjs15-ppr-shell-boundary-contract","title":"Next.js 15 Partial Prerendering (PPR) Shell Boundary & Dynamic Leak Isolation","category":"frontend","severity":"critical","description":"Enforces strict structural isolation between static prerendered HTML shells and dynamic streaming Suspense holes under Next.js 15 Partial Prerendering (PPR). Mandates that dynamic data lookups (cookies, headers, auth sessions, searchParams) are strictly quarantined inside explicit React Suspense boundaries to eliminate CDN/Edge-cache credential leakage and prevent dynamic bailout cascades across static shell components.","antiPatternHeadline":"Dynamic Authentication & Header Access Leaking into Static Prerender Shells","stars_count":107,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs15","ppr","suspense","security","caching"],"exportEndpoints":{"claude":"/api/rules/nextjs15-ppr-shell-boundary-contract?format=claude","cursorMdc":"/api/rules/nextjs15-ppr-shell-boundary-contract?format=mdc","cursorrules":"/api/rules/nextjs15-ppr-shell-boundary-contract?format=cursor","windsurf":"/api/rules/nextjs15-ppr-shell-boundary-contract?format=windsurf","agents":"/api/rules/nextjs15-ppr-shell-boundary-contract?format=agents"}},{"id":"axum-0-8-stream-cancellation-drain-standard","title":"Axum 0.8 Streaming Response Cancellation & Graceful Drain Standard","category":"backend","severity":"critical","description":"Enforces deterministic cancellation and resource reclamation for Server-Sent Events (SSE) and raw HTTP chunked streams in Axum 0.8. Streaming bodies must bind to client drop detection and tokio::sync::watch drain signals to prevent task leakage, orphaned database cursors, and socket descriptor exhaustion during Kubernetes pod terminations.","antiPatternHeadline":"Spawning detached stream generators that ignore client disconnects and SIGTERM drain barriers.","stars_count":70,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","sse","tokio","concurrency","http2"],"exportEndpoints":{"claude":"/api/rules/axum-0-8-stream-cancellation-drain-standard?format=claude","cursorMdc":"/api/rules/axum-0-8-stream-cancellation-drain-standard?format=mdc","cursorrules":"/api/rules/axum-0-8-stream-cancellation-drain-standard?format=cursor","windsurf":"/api/rules/axum-0-8-stream-cancellation-drain-standard?format=windsurf","agents":"/api/rules/axum-0-8-stream-cancellation-drain-standard?format=agents"}},{"id":"go-124-swiss-table-concurrency-gc-guardrail","title":"Go 1.24 Swiss Table Cache-Line Bouncing and Pointer-Free GC Optimization","category":"backend","severity":"critical","description":"Enforces cache-line padded sharding and pointer-free value layouts under Go 1.24's Swiss Table runtime. Prevents L1/L3 CPU cache-line bouncing caused by false sharing and eliminates GC mark-phase scan overhead across millions of concurrent read/write keys.","antiPatternHeadline":"Unpadded Sharded Mutexes with Pointer-Dense Maps Inducing Cache Invalidation and High GC Mark Stalls","stars_count":88,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","concurrency","performance","memory","gc","swiss-tables"],"exportEndpoints":{"claude":"/api/rules/go-124-swiss-table-concurrency-gc-guardrail?format=claude","cursorMdc":"/api/rules/go-124-swiss-table-concurrency-gc-guardrail?format=mdc","cursorrules":"/api/rules/go-124-swiss-table-concurrency-gc-guardrail?format=cursor","windsurf":"/api/rules/go-124-swiss-table-concurrency-gc-guardrail?format=windsurf","agents":"/api/rules/go-124-swiss-table-concurrency-gc-guardrail?format=agents"}},{"id":"kmp-skie-swift-concurrency-cancellation-standard","title":"KMP SKIE Bidirectional Structured Concurrency Cancellation Guardrail","category":"mobile","severity":"critical","description":"Enforces strict bidirectional cancellation propagation across the Kotlin Multiplatform (KMP) and Darwin Swift C-interop boundary using Touchlab SKIE. Unbridged Darwin FFI transitions default to fire-and-forget or orphan Job scopes, leading to memory leaks, background battery drain, and stale UI updates when Swift Tasks or Kotlin Coroutines cancel prematurely.","antiPatternHeadline":"Orphaned Coroutine Execution and Leaked Swift Task Subscriptions across KMP FFI Boundaries","stars_count":113,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kmp","kotlin-multiplatform","skie","swift-concurrency","ios"],"exportEndpoints":{"claude":"/api/rules/kmp-skie-swift-concurrency-cancellation-standard?format=claude","cursorMdc":"/api/rules/kmp-skie-swift-concurrency-cancellation-standard?format=mdc","cursorrules":"/api/rules/kmp-skie-swift-concurrency-cancellation-standard?format=cursor","windsurf":"/api/rules/kmp-skie-swift-concurrency-cancellation-standard?format=windsurf","agents":"/api/rules/kmp-skie-swift-concurrency-cancellation-standard?format=agents"}},{"id":"openfga-contextual-tuples-cache-invalidation-pipeline","title":"OpenFGA 1.8 Contextual Tuple Ingestion and Reactive Graph Invalidation Protocol","category":"security","severity":"critical","description":"Enforces deterministic, sub-millisecond Zanzibar-style authorization checks by combining request-scoped contextual tuples with reactive Redis cache bust protocols. Guarantees that ephemeral attributes (e.g., dynamic IP ranges, temporary access delegations, multi-tenant session contexts) are evaluated on the fly without database persistence, while persistent relational state changes trigger atomic cache invalidations across affected graph lineages.","antiPatternHeadline":"Persisting Ephemeral State to FGA Store and Serving Stale Authorization Graphs from Unbounded Caches","stars_count":112,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","zanzibar","authorization","caching","fine-grained-access-control"],"exportEndpoints":{"claude":"/api/rules/openfga-contextual-tuples-cache-invalidation-pipeline?format=claude","cursorMdc":"/api/rules/openfga-contextual-tuples-cache-invalidation-pipeline?format=mdc","cursorrules":"/api/rules/openfga-contextual-tuples-cache-invalidation-pipeline?format=cursor","windsurf":"/api/rules/openfga-contextual-tuples-cache-invalidation-pipeline?format=windsurf","agents":"/api/rules/openfga-contextual-tuples-cache-invalidation-pipeline?format=agents"}},{"id":"webauthn-conditional-mediation-origin-binding-guardrail","title":"Strict RP ID and Origin Cross-Binding Guardrail for WebAuthn Conditional Mediation","category":"security","severity":"critical","description":"Enforces cryptographic and structural validation of Relying Party ID (rpId) and clientDataJSON origin during WebAuthn conditional mediation (autofill). Eliminates cross-origin credential harvesting, subdomain credential confusion, and federated origin spoofing by requiring explicit origin allowlisting and canonical RP ID matching on server-side assertion verification.","antiPatternHeadline":"Permissive Subdomain Wildcarding or Unchecked clientDataJSON Origin in Conditional WebAuthn Verification","stars_count":50,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","fido2","passkeys","authentication","zero-trust"],"exportEndpoints":{"claude":"/api/rules/webauthn-conditional-mediation-origin-binding-guardrail?format=claude","cursorMdc":"/api/rules/webauthn-conditional-mediation-origin-binding-guardrail?format=mdc","cursorrules":"/api/rules/webauthn-conditional-mediation-origin-binding-guardrail?format=cursor","windsurf":"/api/rules/webauthn-conditional-mediation-origin-binding-guardrail?format=windsurf","agents":"/api/rules/webauthn-conditional-mediation-origin-binding-guardrail?format=agents"}},{"id":"tetragon-ebpf-inkernel-execve-enforcement-standard","title":"Tetragon eBPF In-Kernel Synchronous Execve Enforcement Standard","category":"devops","severity":"critical","description":"Mandates deterministic, synchronous in-kernel SIGKILL dispatch via Tetragon TracingPolicy CRDs at process execution boundaries. Eliminates Time-of-Check to Time-of-Use (TOCTOU) races and userspace notification latency that enable unauthorized binaries to execute privileged system calls before asynchronous userspace agents can react.","antiPatternHeadline":"Asynchronous Userspace Signal Dispatching and Post-Exec Audit-Only Probes","stars_count":42,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","tetragon","kubernetes","security","runtime-security"],"exportEndpoints":{"claude":"/api/rules/tetragon-ebpf-inkernel-execve-enforcement-standard?format=claude","cursorMdc":"/api/rules/tetragon-ebpf-inkernel-execve-enforcement-standard?format=mdc","cursorrules":"/api/rules/tetragon-ebpf-inkernel-execve-enforcement-standard?format=cursor","windsurf":"/api/rules/tetragon-ebpf-inkernel-execve-enforcement-standard?format=windsurf","agents":"/api/rules/tetragon-ebpf-inkernel-execve-enforcement-standard?format=agents"}},{"id":"otel-collector-tail-sampling-memory-buffer-guardrail","title":"OpenTelemetry Collector Tail-Based Sampling Bounded Memory & Backpressure Guardrail","category":"devops","severity":"critical","description":"Tail-based sampling requires buffering trace segments across a sliding evaluation window, creating extreme vulnerability to OOM termination during traffic spikes. Collector configurations must enforce hard byte-level thresholds via the memory_limiter processor preceding tail_sampling, explicitly bound trace buffer allocations, and align GOMEMLIMIT with container resource limits to prevent pod eviction.","antiPatternHeadline":"Unbounded tail-sampling buffers without memory-limiter placement causing fatal OOMKills during trace spikes","stars_count":44,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","otel-collector","tail-sampling","kubernetes","memory-management"],"exportEndpoints":{"claude":"/api/rules/otel-collector-tail-sampling-memory-buffer-guardrail?format=claude","cursorMdc":"/api/rules/otel-collector-tail-sampling-memory-buffer-guardrail?format=mdc","cursorrules":"/api/rules/otel-collector-tail-sampling-memory-buffer-guardrail?format=cursor","windsurf":"/api/rules/otel-collector-tail-sampling-memory-buffer-guardrail?format=windsurf","agents":"/api/rules/otel-collector-tail-sampling-memory-buffer-guardrail?format=agents"}},{"id":"react-19-taint-boundary-enforcement","title":"React 19 Server Component Tainted Value Boundary Enforcement","category":"frontend","severity":"critical","description":"Enforces compiler- and runtime-verified data boundary invariants in React 19 and Next.js App Router applications using experimental_taintObjectReference and experimental_taintUniqueValue. Guarantees that raw data-access objects, secrets, and database records containing sensitive customer domain models cannot cross the React Server Component serialization boundary to the client. Mandates explicit Data Transfer Object (DTO) mapping and immediate tainting at the Data Access Layer (DAL).","antiPatternHeadline":"Passing un-sanitized raw database entities, API tokens, or ORM model instances across the RSC serialization boundary to Client Components","stars_count":107,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","nextjs","server-components","rsc","security","taint-api"],"exportEndpoints":{"claude":"/api/rules/react-19-taint-boundary-enforcement?format=claude","cursorMdc":"/api/rules/react-19-taint-boundary-enforcement?format=mdc","cursorrules":"/api/rules/react-19-taint-boundary-enforcement?format=cursor","windsurf":"/api/rules/react-19-taint-boundary-enforcement?format=windsurf","agents":"/api/rules/react-19-taint-boundary-enforcement?format=agents"}},{"id":"svelte-5-effect-root-microfrontend-cleanup-invariant","title":"Svelte 5 Runes Effect Root Lifecycle Invariant in Micro-Frontends","category":"frontend","severity":"critical","description":"Enforces deterministic unmounting of Svelte 5 rune trees embedded in host shell micro-frontend architectures via explicit $effect.root cleanup invocations. Without wrapping imperative programmatic mount calls in $effect.root or retaining the disposal function for teardown, detached DOM trees, orphaned reactive signals, and memory leaks persist indefinitely across route switches.","antiPatternHeadline":"Uncontained Imperative Mount and Unmanaged Runes Scope in Micro-Frontend Wrappers","stars_count":49,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","micro-frontends","memory-leak","reactivity"],"exportEndpoints":{"claude":"/api/rules/svelte-5-effect-root-microfrontend-cleanup-invariant?format=claude","cursorMdc":"/api/rules/svelte-5-effect-root-microfrontend-cleanup-invariant?format=mdc","cursorrules":"/api/rules/svelte-5-effect-root-microfrontend-cleanup-invariant?format=cursor","windsurf":"/api/rules/svelte-5-effect-root-microfrontend-cleanup-invariant?format=windsurf","agents":"/api/rules/svelte-5-effect-root-microfrontend-cleanup-invariant?format=agents"}},{"id":"postgres-17-logical-replication-standby-slot-sync","title":"PostgreSQL 17 Failover Slot Synchronization & Physical Standby Synchronization","category":"backend","severity":"critical","description":"Postgres 17 introduces native logical slot failover support via synchronized replication slots. Downstream CDC/logical consumers encounter stream corruption, missing WAL offsets, or duplicate message explosions during a physical switchover if logical replication slots are not created with 'failover = true', synchronized via 'sync_replication_slots = true', and guarded via 'standby_slot_names' on the primary.","antiPatternHeadline":"Creating unsynced logical slots without standby_slot_names and failover flags leading to broken downstream CDC on primary promotion.","stars_count":70,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres","replication","cdc","database-ha"],"exportEndpoints":{"claude":"/api/rules/postgres-17-logical-replication-standby-slot-sync?format=claude","cursorMdc":"/api/rules/postgres-17-logical-replication-standby-slot-sync?format=mdc","cursorrules":"/api/rules/postgres-17-logical-replication-standby-slot-sync?format=cursor","windsurf":"/api/rules/postgres-17-logical-replication-standby-slot-sync?format=windsurf","agents":"/api/rules/postgres-17-logical-replication-standby-slot-sync?format=agents"}},{"id":"fastapi-anyio-worker-thread-pool-throttling","title":"FastAPI AnyIO Worker Thread Pool Throttling and Queue-Time Guardrail","category":"backend","severity":"critical","description":"Protects async event loops from catastrophic latency degradation and thread exhaustion caused by unbounded synchronous operations offloaded via AnyIO. Enforces explicit AnyIO CapacityLimiter instances, backpressure queues, and strict queue-time execution deadlines to prevent cascading task pileups under high concurrency.","antiPatternHeadline":"Unbounded anyio.to_thread.run_sync Dispatch Leading to Global Thread Pool Starvation and Event Loop Lag","stars_count":108,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","anyio","asyncio","concurrency","thread-pool","backpressure"],"exportEndpoints":{"claude":"/api/rules/fastapi-anyio-worker-thread-pool-throttling?format=claude","cursorMdc":"/api/rules/fastapi-anyio-worker-thread-pool-throttling?format=mdc","cursorrules":"/api/rules/fastapi-anyio-worker-thread-pool-throttling?format=cursor","windsurf":"/api/rules/fastapi-anyio-worker-thread-pool-throttling?format=windsurf","agents":"/api/rules/fastapi-anyio-worker-thread-pool-throttling?format=agents"}},{"id":"go-chi-zero-alloc-context-pooling-guardrail","title":"Go Chi Zero-Allocation Context Pooling Lifecycle Guardrail","category":"backend","severity":"critical","description":"Enforces strict lifecycle boundaries and sync.Pool reuse semantics for go-chi/chi/v5 URL context objects (chi.Context). High-throughput endpoints must recycle contexts back into the pool while preventing use-after-free, concurrent mutation, and context reference escapes across asynchronous goroutine boundaries.","antiPatternHeadline":"Escaping Chi Context References Across Goroutine Spawns or Missing Context Reset in Middleware Pools","stars_count":111,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","chi","concurrency","performance","memory-management"],"exportEndpoints":{"claude":"/api/rules/go-chi-zero-alloc-context-pooling-guardrail?format=claude","cursorMdc":"/api/rules/go-chi-zero-alloc-context-pooling-guardrail?format=mdc","cursorrules":"/api/rules/go-chi-zero-alloc-context-pooling-guardrail?format=cursor","windsurf":"/api/rules/go-chi-zero-alloc-context-pooling-guardrail?format=windsurf","agents":"/api/rules/go-chi-zero-alloc-context-pooling-guardrail?format=agents"}},{"id":"compose-skiko-render-buffer-preallocation-standard","title":"Compose Multiplatform Skiko Render Buffer Preallocation Invariant","category":"mobile","severity":"critical","description":"Enforces deterministic off-screen texture buffer reuse and bounds pre-allocation across Skiko Metal (iOS) and OpenGL/DirectX (desktop) targets. Eliminates main-thread frame pacing anomalies and JNI/interop garbage generation caused by dynamic image/surface allocations during active render draw loops.","antiPatternHeadline":"On-demand allocate-and-destroy cycles of org.jetbrains.skia.Image or Surface instances inside drawBehind, Canvas, or custom SkikoLayer render loops.","stars_count":110,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","compose-multiplatform","skiko","metal","rendering-pipeline"],"exportEndpoints":{"claude":"/api/rules/compose-skiko-render-buffer-preallocation-standard?format=claude","cursorMdc":"/api/rules/compose-skiko-render-buffer-preallocation-standard?format=mdc","cursorrules":"/api/rules/compose-skiko-render-buffer-preallocation-standard?format=cursor","windsurf":"/api/rules/compose-skiko-render-buffer-preallocation-standard?format=windsurf","agents":"/api/rules/compose-skiko-render-buffer-preallocation-standard?format=agents"}},{"id":"passkey-w3c-signal-api-invalidation-standard","title":"Passkey W3C Signal API Credential Invalidation Standard","category":"security","severity":"critical","description":"Mandates client- and server-side compliance with the W3C WebAuthn Signal API specification (`signalUnknownCredential` and `signalAllAcceptedCredentials`) upon passkey deletion, lifecycle revocation, or unrecognized assertion encounters. Prevents ghost passkeys and replay authentication attempts on de-provisioned hardware across distributed authenticator sync fabrics such as Apple iCloud Keychain, Google Password Manager, and third-party credential managers.","antiPatternHeadline":"Silent Server-Side Credential Revocation Without Authenticator Sync Fabric Signal Propagation","stars_count":82,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","passkeys","fido2","w3c-signal-api","cryptography","zero-trust"],"exportEndpoints":{"claude":"/api/rules/passkey-w3c-signal-api-invalidation-standard?format=claude","cursorMdc":"/api/rules/passkey-w3c-signal-api-invalidation-standard?format=mdc","cursorrules":"/api/rules/passkey-w3c-signal-api-invalidation-standard?format=cursor","windsurf":"/api/rules/passkey-w3c-signal-api-invalidation-standard?format=windsurf","agents":"/api/rules/passkey-w3c-signal-api-invalidation-standard?format=agents"}},{"id":"ebpf-lsm-runtime-syscall-capability-fence","title":"eBPF LSM In-Kernel Real-Time Capability Fence for Container Isolation","category":"security","severity":"critical","description":"Enforces synchronous, in-kernel privilege fencing via eBPF Linux Security Module (LSM) hooks to prevent container breakouts and unauthorized capability transitions. Eliminates Time-of-Check to Time-of-Use (TOCTOU) race conditions and user-space daemon latency by resolving security decisions entirely within kernel space before execution.","antiPatternHeadline":"Relying on Asynchronous User-Space Daemons or Kprobes for Security Enforcement","stars_count":80,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","ebpf","lsm","kernel","containers","zero-trust"],"exportEndpoints":{"claude":"/api/rules/ebpf-lsm-runtime-syscall-capability-fence?format=claude","cursorMdc":"/api/rules/ebpf-lsm-runtime-syscall-capability-fence?format=mdc","cursorrules":"/api/rules/ebpf-lsm-runtime-syscall-capability-fence?format=cursor","windsurf":"/api/rules/ebpf-lsm-runtime-syscall-capability-fence?format=windsurf","agents":"/api/rules/ebpf-lsm-runtime-syscall-capability-fence?format=agents"}},{"id":"opentelemetry-span-link-dag-invariant","title":"OpenTelemetry Span Link DAG Invariant for Decoupled Topologies","category":"devops","severity":"critical","description":"Preserves causality across asynchronous, fan-out, and event-driven choreographies by enforcing OpenTelemetry Span Links instead of synchronous parent-child hierarchies. Prevent trace graph corruption, artificial latency aggregation, and severed causal directed acyclic graphs (DAGs) across message brokers, job queues, and decoupled streams.","antiPatternHeadline":"Parenting Asynchronous Consumers Directly to Producer Spans via Synchronous Context Propagation","stars_count":66,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","distributed-tracing","event-driven","kafka","observability"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-span-link-dag-invariant?format=claude","cursorMdc":"/api/rules/opentelemetry-span-link-dag-invariant?format=mdc","cursorrules":"/api/rules/opentelemetry-span-link-dag-invariant?format=cursor","windsurf":"/api/rules/opentelemetry-span-link-dag-invariant?format=windsurf","agents":"/api/rules/opentelemetry-span-link-dag-invariant?format=agents"}},{"id":"angular-19-zoneless-signal-graph-boundary","title":"Angular 19 Zoneless Signal Graph Change Detection & Streaming Boundary Guardrail","category":"frontend","severity":"critical","description":"Enforces architectural boundaries for Angular 19 zoneless applications under high-frequency streaming workloads. Mandates that signal state mutations are pure, acyclic, and coalesced, forbidding synchronous signal writes inside computation graphs or rendering cycles to prevent infinite microtask loops and UI degradation.","antiPatternHeadline":"Synchronous Signal Writes Inside Reactive Graphs and Uncoalesced High-Frequency Stream Thrashing in Zoneless Runtimes","stars_count":95,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["angular","signals","zoneless","change-detection","streaming","microtasks"],"exportEndpoints":{"claude":"/api/rules/angular-19-zoneless-signal-graph-boundary?format=claude","cursorMdc":"/api/rules/angular-19-zoneless-signal-graph-boundary?format=mdc","cursorrules":"/api/rules/angular-19-zoneless-signal-graph-boundary?format=cursor","windsurf":"/api/rules/angular-19-zoneless-signal-graph-boundary?format=windsurf","agents":"/api/rules/angular-19-zoneless-signal-graph-boundary?format=agents"}},{"id":"vite-6-environment-api-multi-runtime-isolation-vite-6-environme-269","title":"Vite 6 Environment API Multi-Runtime State Partitioning & Module Graph Isolation","category":"frontend","severity":"critical","description":"Enforces strict isolation of module graphs, transform pipelines, and memory spaces between Edge (WinterCG) and Node.js SSR runtimes during concurrent compilation under Vite 6. Prevents cross-runtime symbol contamination, shared plugin closure state leaks, and invalid platform polyfill resolution in unified micro-frontend monorepos.","antiPatternHeadline":"Global Plugin State Sharing and Cross-Runtime Module Graph Pollution in Concurrent Environments","stars_count":54,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","vite-6","environment-api","ssr","edge-runtime","monorepo"],"exportEndpoints":{"claude":"/api/rules/vite-6-environment-api-multi-runtime-isolation-vite-6-environme-269?format=claude","cursorMdc":"/api/rules/vite-6-environment-api-multi-runtime-isolation-vite-6-environme-269?format=mdc","cursorrules":"/api/rules/vite-6-environment-api-multi-runtime-isolation-vite-6-environme-269?format=cursor","windsurf":"/api/rules/vite-6-environment-api-multi-runtime-isolation-vite-6-environme-269?format=windsurf","agents":"/api/rules/vite-6-environment-api-multi-runtime-isolation-vite-6-environme-269?format=agents"}},{"id":"go-124-weak-pointer-addcleanup-reclamation","title":"Go 1.24 weak.Pointer and runtime.AddCleanup Memory Reclamation Standard","category":"backend","severity":"critical","description":"Enforces Go 1.24 weak references (weak.Pointer) and non-resurrecting cleanup hooks (runtime.AddCleanup) over legacy runtime.SetFinalizer in high-throughput proxies and caching layers. Prevents GC pause spikes, object resurrection, multi-cycle sweep delays, and finalizer-induced memory leaks.","antiPatternHeadline":"Legacy runtime.SetFinalizer Object Resurrection and Strong-Reference Cache Bloat Inducing Tail Latency","stars_count":102,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","gc-tuning","weak-pointer","memory-management","performance"],"exportEndpoints":{"claude":"/api/rules/go-124-weak-pointer-addcleanup-reclamation?format=claude","cursorMdc":"/api/rules/go-124-weak-pointer-addcleanup-reclamation?format=mdc","cursorrules":"/api/rules/go-124-weak-pointer-addcleanup-reclamation?format=cursor","windsurf":"/api/rules/go-124-weak-pointer-addcleanup-reclamation?format=windsurf","agents":"/api/rules/go-124-weak-pointer-addcleanup-reclamation?format=agents"}},{"id":"fastapi-anyio-cancellation-scope-propagation-invariant","title":"FastAPI AnyIO Native Cancellation Scope Exception Propagation Invariant","category":"backend","severity":"critical","description":"Guarantees deterministic task teardown and structured concurrency cleanup across asynchronous HTTP pipelines without leaking unawaited coroutines or swallowing cancellation signals. Enforces strict propagation of AnyIO cancellation exceptions and mandates shielded cancel scopes for non-negotiable cleanup operations.","antiPatternHeadline":"Swallowing Cancellation Signals via Catch-All Handlers and Leaking Detached Coroutines","stars_count":84,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","anyio","asyncio","concurrency","python"],"exportEndpoints":{"claude":"/api/rules/fastapi-anyio-cancellation-scope-propagation-invariant?format=claude","cursorMdc":"/api/rules/fastapi-anyio-cancellation-scope-propagation-invariant?format=mdc","cursorrules":"/api/rules/fastapi-anyio-cancellation-scope-propagation-invariant?format=cursor","windsurf":"/api/rules/fastapi-anyio-cancellation-scope-propagation-invariant?format=windsurf","agents":"/api/rules/fastapi-anyio-cancellation-scope-propagation-invariant?format=agents"}},{"id":"kmp-swift-export-arc-weak-boundary-guardrail","title":"Kotlin Multiplatform Swift-Export ARC Weak-Boundary Guardrail","category":"mobile","severity":"critical","description":"Eliminates cross-runtime memory retention cycles between Apple Swift ARC and Kotlin/Native GC across direct Swift-Export interop boundaries. Mandates explicit weak references and structured cancellation handles on bidirectional state streams, listener interfaces, and async continuations. Enforces strict lifecycle-bound cleanup to prevent foreign-reference root leaks in Kotlin/Native's tracing garbage collector.","antiPatternHeadline":"Cross-Runtime Memory Leak via Strong Closure Capture of Swift Self in Kotlin Native StateFlow Observers","stars_count":66,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","swift-export","arc","memory-management","concurrency"],"exportEndpoints":{"claude":"/api/rules/kmp-swift-export-arc-weak-boundary-guardrail?format=claude","cursorMdc":"/api/rules/kmp-swift-export-arc-weak-boundary-guardrail?format=mdc","cursorrules":"/api/rules/kmp-swift-export-arc-weak-boundary-guardrail?format=cursor","windsurf":"/api/rules/kmp-swift-export-arc-weak-boundary-guardrail?format=windsurf","agents":"/api/rules/kmp-swift-export-arc-weak-boundary-guardrail?format=agents"}},{"id":"capacitor-webkit-memory-footprint-ceiling","title":"Capacitor 7 Isolated WebKit Memory Ceiling & Hardware Buffer Offload Guardrail","category":"mobile","severity":"critical","description":"Enforces strict memory ceiling controls and hardware buffer offloading on Capacitor 7 isolated renderer processes to eliminate OS-level Jetsam and low-memory killer (LMK) terminations. Mandates native file-system referencing, immediate Blob URL revocation, aggressive canvas cleanup, and zero-copy native plugin interfaces.","antiPatternHeadline":"Retaining High-Resolution Media Bitmaps and Unbounded Binary Payloads Inside WebKit Memory Heap","stars_count":111,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","webkit","memory-management","wkwebview","jetsam","ios","android"],"exportEndpoints":{"claude":"/api/rules/capacitor-webkit-memory-footprint-ceiling?format=claude","cursorMdc":"/api/rules/capacitor-webkit-memory-footprint-ceiling?format=mdc","cursorrules":"/api/rules/capacitor-webkit-memory-footprint-ceiling?format=cursor","windsurf":"/api/rules/capacitor-webkit-memory-footprint-ceiling?format=windsurf","agents":"/api/rules/capacitor-webkit-memory-footprint-ceiling?format=agents"}},{"id":"oauth21-dpop-replay-thumbprint-binding-standard","title":"OAuth 2.1 RFC 9449 DPoP Replay Window and JWK Thumbprint Binding Guardrail","category":"security","severity":"critical","description":"Enforces strict RFC 9449 Demonstrating Proof-of-Possession (DPoP) verification across all protected endpoints. Mandates cryptographic binding of access tokens to client ephemeral key thumbprints (jkt), strict replay protection with nonce rotation and bounded jitter windows, and verification of HTTP method and URI claims (htm, htu) to eradicate token export and cross-endpoint relay attacks.","antiPatternHeadline":"Accepting Unbound Bearer Tokens or DPoP Proofs with Unvalidated Nonces, Missing Thumbprints, or Loose Replay Windows","stars_count":69,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","oauth21","dpop","rfc9449","cryptography","zero-trust"],"exportEndpoints":{"claude":"/api/rules/oauth21-dpop-replay-thumbprint-binding-standard?format=claude","cursorMdc":"/api/rules/oauth21-dpop-replay-thumbprint-binding-standard?format=mdc","cursorrules":"/api/rules/oauth21-dpop-replay-thumbprint-binding-standard?format=cursor","windsurf":"/api/rules/oauth21-dpop-replay-thumbprint-binding-standard?format=windsurf","agents":"/api/rules/oauth21-dpop-replay-thumbprint-binding-standard?format=agents"}},{"id":"passkey-conditional-ui-credential-mediation-guardrail","title":"Passkey WebAuthn Conditional UI Credential Mediation & Session Isolation Guardrail","category":"security","severity":"critical","description":"Enforces strict lifecycle management, AbortController cancellation, challenge scoping, and userHandle validation for WebAuthn Conditional UI requests. Prevents autofill phishing, cross-origin ambient credential hijacking, and concurrent session collision by separating ambient autofill mediation from explicit platform and cross-device authentication flows.","antiPatternHeadline":"Unaborted Conditional UI Mediation with Permissive User Handle Binding and Challenge Replay","stars_count":90,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","passkeys","conditional-ui","fido2","session-management"],"exportEndpoints":{"claude":"/api/rules/passkey-conditional-ui-credential-mediation-guardrail?format=claude","cursorMdc":"/api/rules/passkey-conditional-ui-credential-mediation-guardrail?format=mdc","cursorrules":"/api/rules/passkey-conditional-ui-credential-mediation-guardrail?format=cursor","windsurf":"/api/rules/passkey-conditional-ui-credential-mediation-guardrail?format=windsurf","agents":"/api/rules/passkey-conditional-ui-credential-mediation-guardrail?format=agents"}},{"id":"spiffe-spire-envoy-sds-rotation-boundary","title":"SPIFFE/SPIRE Workload Identity Envoy SDS Automated Rotation Boundary","category":"devops","severity":"critical","description":"Enforces dynamic, zero-downtime X.509 SVID renewal through Envoy Secret Discovery Service (SDS) integrated with the SPIRE Workload API over Unix Domain Sockets. Prevents connection drops, cold restarts, and validation failures under ultra-short TTL (<= 5-minute) rotation boundaries in zero-trust mesh architectures.","antiPatternHeadline":"Mounting static SVID certificates from disk or triggering process restarts upon certificate expiry instead of streaming dynamic Envoy SDS updates.","stars_count":119,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","spiffe","spire","envoy","sds","zero-trust","mtls","security"],"exportEndpoints":{"claude":"/api/rules/spiffe-spire-envoy-sds-rotation-boundary?format=claude","cursorMdc":"/api/rules/spiffe-spire-envoy-sds-rotation-boundary?format=mdc","cursorrules":"/api/rules/spiffe-spire-envoy-sds-rotation-boundary?format=cursor","windsurf":"/api/rules/spiffe-spire-envoy-sds-rotation-boundary?format=windsurf","agents":"/api/rules/spiffe-spire-envoy-sds-rotation-boundary?format=agents"}},{"id":"react-19-asset-preloading-dedup-barrier","title":"React 19 Native Resource Preloading and Streaming Deduplication Barrier","category":"frontend","severity":"critical","description":"Enforces deterministic utilization of React 19 native react-dom resource preloading APIs (preload, preinit, preconnect) over manual DOM injection or unstructured link tags. Guarantees deterministic priority injection during concurrent streaming SSR while preventing duplicate network waterfalls, memory leaks, and hydration mismatch layout shifts.","antiPatternHeadline":"Imperative DOM Head Link Injection and Un-hoisted Custom Link Elements Bypassing React 19 Streaming Head Pipeline","stars_count":103,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","ssr","asset-preloading","performance","streaming"],"exportEndpoints":{"claude":"/api/rules/react-19-asset-preloading-dedup-barrier?format=claude","cursorMdc":"/api/rules/react-19-asset-preloading-dedup-barrier?format=mdc","cursorrules":"/api/rules/react-19-asset-preloading-dedup-barrier?format=cursor","windsurf":"/api/rules/react-19-asset-preloading-dedup-barrier?format=windsurf","agents":"/api/rules/react-19-asset-preloading-dedup-barrier?format=agents"}},{"id":"axum-0-8-load-shedding-cancellation-propagation","title":"Axum 0.8 Adaptive Load Shedding and Tower Cancellation Propagation","category":"backend","severity":"critical","description":"Enforces proactive concurrency limits and cancellation propagation across Axum 0.8 HTTP pipelines and Tower middleware layers. Prevents thread pool saturation, executor starvation, and orphaned distributed RPC calls when upstream clients terminate connections under extreme load spikes.","antiPatternHeadline":"Unbounded Request Queuing and Disconnected Background Tasks Without Drop-Driven Cancellation","stars_count":72,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tower","tokio","concurrency","resilience"],"exportEndpoints":{"claude":"/api/rules/axum-0-8-load-shedding-cancellation-propagation?format=claude","cursorMdc":"/api/rules/axum-0-8-load-shedding-cancellation-propagation?format=mdc","cursorrules":"/api/rules/axum-0-8-load-shedding-cancellation-propagation?format=cursor","windsurf":"/api/rules/axum-0-8-load-shedding-cancellation-propagation?format=windsurf","agents":"/api/rules/axum-0-8-load-shedding-cancellation-propagation?format=agents"}},{"id":"pg17-combinebackup-lsn-chain-validation","title":"Postgres 17 pg_combinebackup LSN Chain and Manifest Cryptographic Verification Standard","category":"backend","severity":"critical","description":"Enforces strict mathematical continuity and cryptographic checksum validation of Log Sequence Number (LSN) boundaries across cumulative and differential backup chains before executing Postgres 17 pg_combinebackup. Prevents silent Point-In-Time Recovery (PITR) corruption caused by orphaned WAL increments, timeline branch divergence, and manifest tampering during synthetic full backup reconstruction.","antiPatternHeadline":"Blind Execution of pg_combinebackup Across Disjoint LSN Ranges or Corrupted Backup Manifests","stars_count":70,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","postgres-17","backup-recovery","wal-lsn","data-integrity","infrastructure"],"exportEndpoints":{"claude":"/api/rules/pg17-combinebackup-lsn-chain-validation?format=claude","cursorMdc":"/api/rules/pg17-combinebackup-lsn-chain-validation?format=mdc","cursorrules":"/api/rules/pg17-combinebackup-lsn-chain-validation?format=cursor","windsurf":"/api/rules/pg17-combinebackup-lsn-chain-validation?format=windsurf","agents":"/api/rules/pg17-combinebackup-lsn-chain-validation?format=agents"}},{"id":"capacitor7-bridge-memory-buffer-pooling-guardrail","title":"Capacitor 7 Bi-directional Bridge Memory Buffer Pooling & High-Frequency Streaming Guardrail","category":"mobile","severity":"critical","description":"High-frequency native sensor and telemetry streams must never execute per-sample JSON serialization over the Capacitor 7 bridge or trigger unbounded JavaScript heap allocations. This guardrail mandates native-to-web ring-buffer chunking, typed array pooling, and zero-allocation deserialization patterns to eliminate bridge thread-hopping stalls and V8/JavaScriptCore garbage collection pauses.","antiPatternHeadline":"Unbatched per-tick JSON IPC serialization over notifyListeners causing bridge thread congestion and V8 GC thrashing","stars_count":114,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","performance","ipc","memory-pooling","typed-arrays"],"exportEndpoints":{"claude":"/api/rules/capacitor7-bridge-memory-buffer-pooling-guardrail?format=claude","cursorMdc":"/api/rules/capacitor7-bridge-memory-buffer-pooling-guardrail?format=mdc","cursorrules":"/api/rules/capacitor7-bridge-memory-buffer-pooling-guardrail?format=cursor","windsurf":"/api/rules/capacitor7-bridge-memory-buffer-pooling-guardrail?format=windsurf","agents":"/api/rules/capacitor7-bridge-memory-buffer-pooling-guardrail?format=agents"}},{"id":"webauthn-prf-client-key-derivation-security","title":"Hardware-Backed PRF Client-Side Zero-Knowledge Key Derivation","category":"security","severity":"critical","description":"Enforces strict WebAuthn Level 3 Pseudo-Random Function (PRF) extension invariants for local cryptographic key derivation. Guarantees that hardware-bound secrets evaluated via CTAP2 HMAC-secret remain isolated within client-side WebCrypto enclaves and are never transmitted to relying parties or stored extractably.","antiPatternHeadline":"Transmitting Raw PRF Outputs or Derived Encryption Keys to Relying Party Servers","stars_count":51,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","cryptography","prf-extension","zero-knowledge","webcrypto"],"exportEndpoints":{"claude":"/api/rules/webauthn-prf-client-key-derivation-security?format=claude","cursorMdc":"/api/rules/webauthn-prf-client-key-derivation-security?format=mdc","cursorrules":"/api/rules/webauthn-prf-client-key-derivation-security?format=cursor","windsurf":"/api/rules/webauthn-prf-client-key-derivation-security?format=windsurf","agents":"/api/rules/webauthn-prf-client-key-derivation-security?format=agents"}},{"id":"spiffe-spire-dynamic-svid-rotation-draining-standard","title":"SPIFFE/SPIRE Dynamic SVID Ephemeral Rotation and Connection Draining Invariant","category":"security","severity":"critical","description":"Enforces zero-downtime mTLS identity rotation via SPIFFE Workload API by requiring dynamic TLS context swapping and non-destructive connection draining. Systems must hot-swap X509-SVIDs and trust bundles atomically without dropping in-flight multiplexed HTTP/2 or gRPC streams or closing active sockets. Abrupt listener recreation or synchronous socket drops during SVID updates violate zero-trust availability guarantees.","antiPatternHeadline":"Hard Restart of Network Listeners or Abrupt Socket Termination on SPIFFE SVID Renewal","stars_count":93,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","spiffe","spire","mtls","zero-trust","http2","connection-draining"],"exportEndpoints":{"claude":"/api/rules/spiffe-spire-dynamic-svid-rotation-draining-standard?format=claude","cursorMdc":"/api/rules/spiffe-spire-dynamic-svid-rotation-draining-standard?format=mdc","cursorrules":"/api/rules/spiffe-spire-dynamic-svid-rotation-draining-standard?format=cursor","windsurf":"/api/rules/spiffe-spire-dynamic-svid-rotation-draining-standard?format=windsurf","agents":"/api/rules/spiffe-spire-dynamic-svid-rotation-draining-standard?format=agents"}},{"id":"opentelemetry-w3c-baggage-cardinality-bounding-standard","title":"OpenTelemetry W3C Baggage Context Propagation and Cardinality Bounding Standard","category":"devops","severity":"critical","description":"Enforces strict entry counts, byte-size quotas, and allowlisted schema definitions on W3C Baggage context propagation across distributed trace boundaries. Prevents propagation of unbounded user input, ephemeral session IDs, and oversized payloads that trigger HTTP 431 (Request Header Fields Too Large) outages or cause metric cardinality explosions in downstream telemetry backends.","antiPatternHeadline":"Unbounded Baggage Injection and Indiscriminate Metric Dimension Propagation","stars_count":56,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","distributed-tracing","observability","w3c-baggage","cardinality"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-w3c-baggage-cardinality-bounding-standard?format=claude","cursorMdc":"/api/rules/opentelemetry-w3c-baggage-cardinality-bounding-standard?format=mdc","cursorrules":"/api/rules/opentelemetry-w3c-baggage-cardinality-bounding-standard?format=cursor","windsurf":"/api/rules/opentelemetry-w3c-baggage-cardinality-bounding-standard?format=windsurf","agents":"/api/rules/opentelemetry-w3c-baggage-cardinality-bounding-standard?format=agents"}},{"id":"kmp-native-memory-arena-scoping-guardrail","title":"KMP Native Memory Cinterop Arena Scoping and Finalizer Guardrail","category":"mobile","severity":"critical","description":"Enforces strict native memory management invariants when bridging C/Objective-C pointers into Kotlin Multiplatform code via kotlinx.cinterop. Mandates explicit Arena/AutofreeScope lifetimes, forbids unmanaged native allocations escaping into common code, and requires atomic cleaner/finalizer disposal mechanisms to avoid use-after-free or native memory leaks.","antiPatternHeadline":"Escaping Raw C Pointers and Unscoped Native Allocations Across Common Code Boundaries","stars_count":48,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","cinterop","native-memory","ios","memory-leaks"],"exportEndpoints":{"claude":"/api/rules/kmp-native-memory-arena-scoping-guardrail?format=claude","cursorMdc":"/api/rules/kmp-native-memory-arena-scoping-guardrail?format=mdc","cursorrules":"/api/rules/kmp-native-memory-arena-scoping-guardrail?format=cursor","windsurf":"/api/rules/kmp-native-memory-arena-scoping-guardrail?format=windsurf","agents":"/api/rules/kmp-native-memory-arena-scoping-guardrail?format=agents"}},{"id":"fastapi-anyio-taskgroup-lifespan-concurrency","title":"FastAPI AnyIO TaskGroup Lifespan Structured Concurrency Standard","category":"backend","severity":"critical","description":"Enforces bounded lifecycle scoping and eager failure propagation across asynchronous background workers during server shutdown and reload events. Background tasks spawned during application execution must be bounded by an AnyIO TaskGroup managed inside the ASGI lifespan context to prevent unhandled background exceptions from being swallowed and avoid orphaned zombie tasks during graceful termination. Bypassing structured concurrency via raw asyncio background tasks leads to resource leaks, hung shutdown hooks, and silent runtime corruption.","antiPatternHeadline":"Spawning Unbounded Fire-and-Forget asyncio.create_task Workers Outside Lifespan TaskGroups","stars_count":49,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","anyio","asyncio","structured-concurrency","lifespan"],"exportEndpoints":{"claude":"/api/rules/fastapi-anyio-taskgroup-lifespan-concurrency?format=claude","cursorMdc":"/api/rules/fastapi-anyio-taskgroup-lifespan-concurrency?format=mdc","cursorrules":"/api/rules/fastapi-anyio-taskgroup-lifespan-concurrency?format=cursor","windsurf":"/api/rules/fastapi-anyio-taskgroup-lifespan-concurrency?format=windsurf","agents":"/api/rules/fastapi-anyio-taskgroup-lifespan-concurrency?format=agents"}},{"id":"vite6-deterministic-chunk-boundaries","title":"Deterministic Module Graph Chunk Boundary Invariant in Vite 6","category":"frontend","severity":"critical","description":"Enforces strict structural boundary isolation and deterministic content-hashing across Rollup/Rolldown chunks in Vite 6. Eliminates catastrophic cross-chunk cache-invalidation cascades across global CDN layers when incremental business-logic changes occur.","antiPatternHeadline":"Monolithic vendor bundling and unconstrained manualChunks predicates causing global CDN cache bust cascades","stars_count":55,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","vite","performance","bundling","cdn-caching","rollup"],"exportEndpoints":{"claude":"/api/rules/vite6-deterministic-chunk-boundaries?format=claude","cursorMdc":"/api/rules/vite6-deterministic-chunk-boundaries?format=mdc","cursorrules":"/api/rules/vite6-deterministic-chunk-boundaries?format=cursor","windsurf":"/api/rules/vite6-deterministic-chunk-boundaries?format=windsurf","agents":"/api/rules/vite6-deterministic-chunk-boundaries?format=agents"}},{"id":"postgres-17-direct-io-streaming-quarantine","title":"Postgres 17 Direct I/O and Streaming Buffer Quarantine Standard","category":"backend","severity":"critical","description":"Enforces architectural boundaries for Postgres 17 streaming reads and asynchronous vector pipelines to prevent OS page cache double buffering. Quarantines bulk analytical scans and high-dimensional vector traversals into dedicated memory ring buffers, preventing the eviction of critical OLTP pages from shared_buffers.","antiPatternHeadline":"Unbounded Vector and Analytical Scans Evicting OLTP shared_buffers via OS Page Cache Double Buffering","stars_count":70,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres-17","direct-io","pgvector","buffer-pool","memory-management"],"exportEndpoints":{"claude":"/api/rules/postgres-17-direct-io-streaming-quarantine?format=claude","cursorMdc":"/api/rules/postgres-17-direct-io-streaming-quarantine?format=mdc","cursorrules":"/api/rules/postgres-17-direct-io-streaming-quarantine?format=cursor","windsurf":"/api/rules/postgres-17-direct-io-streaming-quarantine?format=windsurf","agents":"/api/rules/postgres-17-direct-io-streaming-quarantine?format=agents"}},{"id":"react-19-server-actions-optimistic-rollback-invariant-react-19-server--448","title":"React 19 Server Actions Optimistic UI Rollback and Telemetry Invariant","category":"frontend","severity":"critical","description":"Guarantees deterministic rollback of client-side optimistic states and telemetry emission when non-idempotent Server Actions reject, abort, or race against React 19 concurrent router transitions. Mandates strict encapsulation using useActionState with useOptimistic, enforcing serial action execution and structured error envelopes to prevent orphaned UI states and client-server desynchronization.","antiPatternHeadline":"Ad-Hoc setState Optimism Colliding with Server Action Failures and Concurrent Navigation","stars_count":56,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","server-actions","optimistic-ui","telemetry","state-management"],"exportEndpoints":{"claude":"/api/rules/react-19-server-actions-optimistic-rollback-invariant-react-19-server--448?format=claude","cursorMdc":"/api/rules/react-19-server-actions-optimistic-rollback-invariant-react-19-server--448?format=mdc","cursorrules":"/api/rules/react-19-server-actions-optimistic-rollback-invariant-react-19-server--448?format=cursor","windsurf":"/api/rules/react-19-server-actions-optimistic-rollback-invariant-react-19-server--448?format=windsurf","agents":"/api/rules/react-19-server-actions-optimistic-rollback-invariant-react-19-server--448?format=agents"}},{"id":"fastapi-async-lifespan-taskgroup-standard","title":"FastAPI Async Lifespan Structured Concurrency & TaskGroup Lifecycle Guardrail","category":"backend","severity":"critical","description":"Mandates structured concurrency via Python 3.11+ TaskGroups or AnyIO task groups inside FastAPI lifespan context managers. Enforces deterministic worker draining and deferred database engine disposal during Kubernetes SIGTERM scale-in events to prevent orphaned coroutines and truncated database transactions.","antiPatternHeadline":"Fire-and-forget asyncio.create_task invocations coupled with uncoordinated database engine teardown during SIGTERM","stars_count":45,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["fastapi","python","structured-concurrency","asyncio","lifespan","kubernetes","backend"],"exportEndpoints":{"claude":"/api/rules/fastapi-async-lifespan-taskgroup-standard?format=claude","cursorMdc":"/api/rules/fastapi-async-lifespan-taskgroup-standard?format=mdc","cursorrules":"/api/rules/fastapi-async-lifespan-taskgroup-standard?format=cursor","windsurf":"/api/rules/fastapi-async-lifespan-taskgroup-standard?format=windsurf","agents":"/api/rules/fastapi-async-lifespan-taskgroup-standard?format=agents"}},{"id":"capacitor7-headless-background-sync-thread-safety","title":"Capacitor 7 Headless Native Background Sync Thread-Safety & Storage Invariant","category":"mobile","severity":"critical","description":"Enforces isolated native synchronization and queue management when background geofencing, push notifications, or periodic workers wake mobile apps in a headless state without an initialized Webview bridge. Prevents silent bridge dispatch failures, bridge memory corruption, and SQLite/Preferences file lock contention across OS native background threads and dormant Webview runtime contexts.","antiPatternHeadline":"Dispatching JS Bridge Calls or Accessing Shared Storage from Headless Native Background Handlers","stars_count":99,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","background-sync","thread-safety","sqlite","ios","android"],"exportEndpoints":{"claude":"/api/rules/capacitor7-headless-background-sync-thread-safety?format=claude","cursorMdc":"/api/rules/capacitor7-headless-background-sync-thread-safety?format=mdc","cursorrules":"/api/rules/capacitor7-headless-background-sync-thread-safety?format=cursor","windsurf":"/api/rules/capacitor7-headless-background-sync-thread-safety?format=windsurf","agents":"/api/rules/capacitor7-headless-background-sync-thread-safety?format=agents"}},{"id":"bun-standalone-vfs-boundary-guardrail","title":"Bun 1.2 Standalone Executable VFS Boundary Isolation and Asset Immutability Guardrail","category":"devops","severity":"critical","description":"Protects Bun 1.2 standalone compiled executables against arbitrary virtual filesystem (VFS) traversal, host filesystem escapes, and runtime panics caused by attempted mutations on embedded assets. Mandates strict boundary verification between the read-only embedded VFS (bunfs) and writable host storage.","antiPatternHeadline":"Unchecked Path Resolution Across Bun Virtual File System (bunfs) Leading to Host Escapes or Unhandled VFS Mutation Panics","stars_count":108,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","bun","vfs","security","standalone-executable","path-traversal"],"exportEndpoints":{"claude":"/api/rules/bun-standalone-vfs-boundary-guardrail?format=claude","cursorMdc":"/api/rules/bun-standalone-vfs-boundary-guardrail?format=mdc","cursorrules":"/api/rules/bun-standalone-vfs-boundary-guardrail?format=cursor","windsurf":"/api/rules/bun-standalone-vfs-boundary-guardrail?format=windsurf","agents":"/api/rules/bun-standalone-vfs-boundary-guardrail?format=agents"}},{"id":"ebpf-tc-ddow-rate-fencing-standard","title":"eBPF TC Ingress Rate-Fencing for L7 Distributed Denial-of-Wallet (DDoW) Prevention","category":"security","severity":"critical","description":"Enforces pre-socket drop semantics at the Linux Traffic Control (TC) clsact qdisc layer using eBPF maps to terminate unauthenticated, replay-heavy, or abusive LLM/serverless API traffic before TCP handshakes and user-space allocations occur. Protects downstream token generation and pay-per-execution cloud billing pipelines from algorithmic economic exhaustion attacks.","antiPatternHeadline":"Delegating High-Volume L7 Rate Limiting and Token Validation to User-Space Application Gateways","stars_count":46,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","ebpf","networking","ddos","rate-limiting","finops","infrastructure"],"exportEndpoints":{"claude":"/api/rules/ebpf-tc-ddow-rate-fencing-standard?format=claude","cursorMdc":"/api/rules/ebpf-tc-ddow-rate-fencing-standard?format=mdc","cursorrules":"/api/rules/ebpf-tc-ddow-rate-fencing-standard?format=cursor","windsurf":"/api/rules/ebpf-tc-ddow-rate-fencing-standard?format=windsurf","agents":"/api/rules/ebpf-tc-ddow-rate-fencing-standard?format=agents"}},{"id":"kmp-skiko-frame-deadline-allocation-guardrail","title":"KMP Skiko 120Hz Frame-Deadline Allocation and Native Resource Recycling Guardrail","category":"mobile","severity":"critical","description":"Enforces deterministic frame-time constraints and native Skiko resource pooling across Kotlin Multiplatform targets (iOS/Android). Prohibits on-demand Skia allocations, synchronous native shader/path compilations, and unbounded allocations within the 8.33ms 120Hz frame render budget.","antiPatternHeadline":"Allocating Skia Native Resources and Executing Expensive Graphics Transformations Inside Frame Draw Loops","stars_count":76,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","skiko","compose-multiplatform","performance","graphics"],"exportEndpoints":{"claude":"/api/rules/kmp-skiko-frame-deadline-allocation-guardrail?format=claude","cursorMdc":"/api/rules/kmp-skiko-frame-deadline-allocation-guardrail?format=mdc","cursorrules":"/api/rules/kmp-skiko-frame-deadline-allocation-guardrail?format=cursor","windsurf":"/api/rules/kmp-skiko-frame-deadline-allocation-guardrail?format=windsurf","agents":"/api/rules/kmp-skiko-frame-deadline-allocation-guardrail?format=agents"}},{"id":"opentelemetry-metric-exemplar-trace-sampling-governance","title":"Deterministic Metric Exemplar and Trace-Sampling Coupling Standard","category":"devops","severity":"critical","description":"Enforces deterministic coupling between high-cardinality tail-latency metric histograms and distributed trace sampling decisions. Guarantees that P99+ tail-latency metrics linked to trace exemplars resolve to fully materialized traces, eliminating 404 trace drops and ghost exemplars during production incident triage.","antiPatternHeadline":"Decoupled Probabilistic Head-Sampling Yielding Ghost Exemplars and Missing P99 Trace Context","stars_count":117,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","observability","distributed-tracing","metrics","exemplars","tail-sampling","sre"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-metric-exemplar-trace-sampling-governance?format=claude","cursorMdc":"/api/rules/opentelemetry-metric-exemplar-trace-sampling-governance?format=mdc","cursorrules":"/api/rules/opentelemetry-metric-exemplar-trace-sampling-governance?format=cursor","windsurf":"/api/rules/opentelemetry-metric-exemplar-trace-sampling-governance?format=windsurf","agents":"/api/rules/opentelemetry-metric-exemplar-trace-sampling-governance?format=agents"}},{"id":"go-124-weak-pointer-chi-route-cache-invariant","title":"Go 1.24 Weak-Pointer Zero-Allocation Route Cache Invariant in Go Chi","category":"backend","severity":"critical","description":"Enforces the use of Go 1.24 standard library weak pointers (weak.Pointer) when implementing dynamic, multi-tenant route resolution caches in Go Chi multiplexers. Prevents catastrophic heap retention spikes and out-of-memory cascades caused by strong-reference caches holding deprovisioned tenant routers. Ensures zero-allocation lookup paths and clean GC reclamation under high tenant churn.","antiPatternHeadline":"Retaining Strong References to Dynamic Chi Sub-Routers in Static Route Caches","stars_count":47,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["go","go-1.24","chi","weak-pointers","garbage-collection","memory-leaks","multi-tenancy"],"exportEndpoints":{"claude":"/api/rules/go-124-weak-pointer-chi-route-cache-invariant?format=claude","cursorMdc":"/api/rules/go-124-weak-pointer-chi-route-cache-invariant?format=mdc","cursorrules":"/api/rules/go-124-weak-pointer-chi-route-cache-invariant?format=cursor","windsurf":"/api/rules/go-124-weak-pointer-chi-route-cache-invariant?format=windsurf","agents":"/api/rules/go-124-weak-pointer-chi-route-cache-invariant?format=agents"}},{"id":"openfga-snapshot-token-causality-guardrail","title":"OpenFGA 1.8+ Snapshot Token Read-After-Write Causality Guardrail","category":"security","severity":"critical","description":"Mandates strict capture, propagation, and consumption of OpenFGA snapshot consistency tokens across distributed write-to-check boundaries. Eliminates authorization race conditions caused by database read-replica lag where authorization checks falsely deny legitimate requests immediately following tuple writes.","antiPatternHeadline":"Ignoring OpenFGA Write Consistency Tokens Leading to Read-After-Write Stale Authorization Failures","stars_count":108,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","authorization","distributed-systems","causal-consistency"],"exportEndpoints":{"claude":"/api/rules/openfga-snapshot-token-causality-guardrail?format=claude","cursorMdc":"/api/rules/openfga-snapshot-token-causality-guardrail?format=mdc","cursorrules":"/api/rules/openfga-snapshot-token-causality-guardrail?format=cursor","windsurf":"/api/rules/openfga-snapshot-token-causality-guardrail?format=windsurf","agents":"/api/rules/openfga-snapshot-token-causality-guardrail?format=agents"}},{"id":"react-19-server-action-multitenant-context-isolation","title":"React 19 Server Action Multi-Tenant Context Poisoning Invariant","category":"frontend","severity":"critical","description":"Enforces strict request-scoped isolation in React 19 Server Actions using immutable AsyncLocalStorage to prevent cross-tenant data leaks and state poisoning during concurrent asynchronous executions. Prohibits global singleton mutations and client-supplied tenant identifiers as authoritative context.","antiPatternHeadline":"Cross-tenant state bleeding via module-scoped state or client-spoofed tenant parameters in React 19 Server Actions.","stars_count":61,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","server-actions","multi-tenant","async-local-storage","security"],"exportEndpoints":{"claude":"/api/rules/react-19-server-action-multitenant-context-isolation?format=claude","cursorMdc":"/api/rules/react-19-server-action-multitenant-context-isolation?format=mdc","cursorrules":"/api/rules/react-19-server-action-multitenant-context-isolation?format=cursor","windsurf":"/api/rules/react-19-server-action-multitenant-context-isolation?format=windsurf","agents":"/api/rules/react-19-server-action-multitenant-context-isolation?format=agents"}},{"id":"postgres-17-pipeline-sync-boundary-invariants","title":"Postgres 17 Client-Side Pipeline Mode Command Synchronization Boundary Enforcement","category":"backend","severity":"critical","description":"Enforces strict command synchronization points and bounded pipeline queues in PostgreSQL 17 client-side pipeline mode. Prevents socket buffer deadlocks, cascading transaction state corruption, and non-deterministic error rollbacks by mandating explicit sync boundaries and complete result-drain loops.","antiPatternHeadline":"Unbounded Pipeline Query Accumulation Without Explicit Sync Boundaries or Sync-Drain Handlers","stars_count":115,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres","pipelining","database","concurrency","performance"],"exportEndpoints":{"claude":"/api/rules/postgres-17-pipeline-sync-boundary-invariants?format=claude","cursorMdc":"/api/rules/postgres-17-pipeline-sync-boundary-invariants?format=mdc","cursorrules":"/api/rules/postgres-17-pipeline-sync-boundary-invariants?format=cursor","windsurf":"/api/rules/postgres-17-pipeline-sync-boundary-invariants?format=windsurf","agents":"/api/rules/postgres-17-pipeline-sync-boundary-invariants?format=agents"}},{"id":"ebpf-tcx-multiprogram-reinjection-scheduling-invariant","title":"eBPF TCX Multi-Program Packet Re-Injection Scheduling & Deterministic Chain Ordering","category":"devops","severity":"critical","description":"Guarantees deterministic execution ordering across coexisting eBPF TCX (Traffic Control BPF link) attachments on network interfaces to eliminate silent packet loss and circular re-injection loops. Enforces explicit relative link positioning flags (BPF_F_BEFORE/BPF_F_AFTER) alongside strict packet-marking invariants to track re-injection depth across kernel ingress filter links.","antiPatternHeadline":"Non-Deterministic TCX Head Preemption and Unbounded Ingress Re-Injection Loops","stars_count":44,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","tcx","linux-kernel","networking","cilium"],"exportEndpoints":{"claude":"/api/rules/ebpf-tcx-multiprogram-reinjection-scheduling-invariant?format=claude","cursorMdc":"/api/rules/ebpf-tcx-multiprogram-reinjection-scheduling-invariant?format=mdc","cursorrules":"/api/rules/ebpf-tcx-multiprogram-reinjection-scheduling-invariant?format=cursor","windsurf":"/api/rules/ebpf-tcx-multiprogram-reinjection-scheduling-invariant?format=windsurf","agents":"/api/rules/ebpf-tcx-multiprogram-reinjection-scheduling-invariant?format=agents"}},{"id":"bun-native-websocket-backpressure-detachment-guardrail","title":"Bun 1.2 Native WebSocket Streaming Backpressure and ArrayBuffer Detachment Guardrail","category":"backend","severity":"critical","description":"Enforces non-blocking backpressure flow control and detached buffer safety on high-throughput Bun 1.2 native WebSocket pipelines. Prevents unbounded kernel buffer queueing, silent zero-byte transmissions from reused detached ArrayBuffers, and EventLoop thread starvation under asymmetric client throughput.","antiPatternHeadline":"Unchecked ws.send() Returns Causing Unbounded Memory Growth and Mutating Detached ArrayBuffers in Pipeline","stars_count":92,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","websockets","backpressure","arraybuffer","performance"],"exportEndpoints":{"claude":"/api/rules/bun-native-websocket-backpressure-detachment-guardrail?format=claude","cursorMdc":"/api/rules/bun-native-websocket-backpressure-detachment-guardrail?format=mdc","cursorrules":"/api/rules/bun-native-websocket-backpressure-detachment-guardrail?format=cursor","windsurf":"/api/rules/bun-native-websocket-backpressure-detachment-guardrail?format=windsurf","agents":"/api/rules/bun-native-websocket-backpressure-detachment-guardrail?format=agents"}},{"id":"cmp-ios-metal-presentation-sync-guardrail","title":"Compose Multiplatform iOS CAMetalLayer ProMotion Presentation Synchronization","category":"mobile","severity":"critical","description":"Enforces strict temporal alignment between Kotlin Compose state dispatches, Skiko render passes, and Apple Metal presentation deadlines. Prevents main-thread hitching and buffer-swap tearing on 120Hz ProMotion displays by coupling CADisplayLink frame pacing directly to CAMetalDrawable acquisition.","antiPatternHeadline":"Decoupled Coroutine State Mutations Causing VSYNC Drift and Metal Drawable Contention","stars_count":99,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","compose-multiplatform","metal","ios","promotion","skiko","cadisplaylink"],"exportEndpoints":{"claude":"/api/rules/cmp-ios-metal-presentation-sync-guardrail?format=claude","cursorMdc":"/api/rules/cmp-ios-metal-presentation-sync-guardrail?format=mdc","cursorrules":"/api/rules/cmp-ios-metal-presentation-sync-guardrail?format=cursor","windsurf":"/api/rules/cmp-ios-metal-presentation-sync-guardrail?format=windsurf","agents":"/api/rules/cmp-ios-metal-presentation-sync-guardrail?format=agents"}},{"id":"spiffe-spire-svid-rotation-zero-downtime","title":"SPIFFE/SPIRE Ephemeral SVID Dual-Buffer Zero-Downtime Rotation Guardrail","category":"security","severity":"critical","description":"Enforces dual-buffer active/standby X.509 SVID rotation to eliminate transient TLS handshake failures in zero-trust mesh topologies. Guarantees atomic certificate context swapping when ephemeral SVIDs enter their rotation window (>= 50% TTL elapsed) without terminating active sockets or dropping incoming client handshakes. Mandates that cryptographic material updates never mutate existing TLS contexts in-place during in-flight handshakes.","antiPatternHeadline":"Reactive Single-Buffer SVID In-Place Mutation Causing Dropped In-Flight TLS Handshakes","stars_count":44,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","spiffe","spire","zero-trust","mtls","svid","certificate-rotation"],"exportEndpoints":{"claude":"/api/rules/spiffe-spire-svid-rotation-zero-downtime?format=claude","cursorMdc":"/api/rules/spiffe-spire-svid-rotation-zero-downtime?format=mdc","cursorrules":"/api/rules/spiffe-spire-svid-rotation-zero-downtime?format=cursor","windsurf":"/api/rules/spiffe-spire-svid-rotation-zero-downtime?format=windsurf","agents":"/api/rules/spiffe-spire-svid-rotation-zero-downtime?format=agents"}},{"id":"opentelemetry-baggage-sanitization-standard","title":"OpenTelemetry Baggage Ingress Sanitization and Cryptographic Verification","category":"devops","severity":"critical","description":"Enforces strict boundary sanitization, payload size limits, and cryptographic HMAC signing on OpenTelemetry W3C Baggage across all network ingress points. Prevents denial-of-service via context-bloat (HTTP 431) and eliminates privilege escalation or secret exfiltration via unverified cross-process baggage injection. Mandates deterministic allowlisting and cryptographic signature verification before promoting inbound baggage entries to the active trace context.","antiPatternHeadline":"Blind Context Propagation of Untrusted, Unbounded Baggage Headers Across Ingress Boundaries","stars_count":68,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","security","distributed-tracing","headers"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-baggage-sanitization-standard?format=claude","cursorMdc":"/api/rules/opentelemetry-baggage-sanitization-standard?format=mdc","cursorrules":"/api/rules/opentelemetry-baggage-sanitization-standard?format=cursor","windsurf":"/api/rules/opentelemetry-baggage-sanitization-standard?format=windsurf","agents":"/api/rules/opentelemetry-baggage-sanitization-standard?format=agents"}},{"id":"react-19-taint-api-serialization-boundary","title":"Enforcing React 19 Experimental Taint API Data Serialization Boundaries","category":"frontend","severity":"critical","description":"Guarantees cryptographic-level runtime prevention of sensitive server-side objects, PII, and credentials leaking across Server Component boundaries into client bundles. Mandates proactive registration with React 19 experimental_taintObjectReference and experimental_taintUniqueValue across all server-side data access layers and secret retrieval paths.","antiPatternHeadline":"Leaking Raw Server State and Sensitive Primitive Secrets Across Server-to-Client Serialization Boundaries","stars_count":109,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","rsc","taint-api","security","server-components"],"exportEndpoints":{"claude":"/api/rules/react-19-taint-api-serialization-boundary?format=claude","cursorMdc":"/api/rules/react-19-taint-api-serialization-boundary?format=mdc","cursorrules":"/api/rules/react-19-taint-api-serialization-boundary?format=cursor","windsurf":"/api/rules/react-19-taint-api-serialization-boundary?format=windsurf","agents":"/api/rules/react-19-taint-api-serialization-boundary?format=agents"}},{"id":"vite6-environment-api-runtime-isolation-vite-6-environme-876","title":"Vite 6 Environment API Multi-Runtime State & Module Boundary Isolation","category":"frontend","severity":"critical","description":"Enforces strict module execution boundaries, module graph separation, and memory isolation between heterogeneous runtime targets (e.g., workerd/Cloudflare Workers, Node.js SSR runners, and Client DOM) using the Vite 6 Environment API. Prevents cross-environment reference leakage, dual-package hazard instantiation, and state pollution during unified SSR and dev orchestration.","antiPatternHeadline":"Cross-Environment State Leaks and Shared Module Graph Contamination in Unified SSR","stars_count":56,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","vite6","environment-api","ssr","workerd","runtime-isolation"],"exportEndpoints":{"claude":"/api/rules/vite6-environment-api-runtime-isolation-vite-6-environme-876?format=claude","cursorMdc":"/api/rules/vite6-environment-api-runtime-isolation-vite-6-environme-876?format=mdc","cursorrules":"/api/rules/vite6-environment-api-runtime-isolation-vite-6-environme-876?format=cursor","windsurf":"/api/rules/vite6-environment-api-runtime-isolation-vite-6-environme-876?format=windsurf","agents":"/api/rules/vite6-environment-api-runtime-isolation-vite-6-environme-876?format=agents"}},{"id":"postgres-17-streaming-io-vector-pinning-standard","title":"Postgres 17 Streaming I/O and Vector Scan Buffer Pinning Invariant","category":"backend","severity":"critical","description":"Enforces query-level buffer isolation, asynchronous streaming I/O prefetch boundaries, and strict index-scan enforcement for pgvector similarity searches under Postgres 17. Guarantees that concurrent vector scans utilize isolated BufferAccessStrategy rings and bounded prefetch queues, preventing shared buffer eviction storms and page pin exhaustion.","antiPatternHeadline":"Unconstrained Vector Scans Causing Shared Buffer Cache Eviction and Pin Lock Contention","stars_count":53,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres","pgvector","database","streaming-io","performance"],"exportEndpoints":{"claude":"/api/rules/postgres-17-streaming-io-vector-pinning-standard?format=claude","cursorMdc":"/api/rules/postgres-17-streaming-io-vector-pinning-standard?format=mdc","cursorrules":"/api/rules/postgres-17-streaming-io-vector-pinning-standard?format=cursor","windsurf":"/api/rules/postgres-17-streaming-io-vector-pinning-standard?format=windsurf","agents":"/api/rules/postgres-17-streaming-io-vector-pinning-standard?format=agents"}},{"id":"axum-tower-body-framing-trailer-integrity-guardrail","title":"Axum 0.8 Tower Service Body Framing and Chunked Trailer Integrity Guardrail","category":"backend","severity":"critical","description":"Enforces deterministic byte-budget limits and cryptographic checksum verifications across HTTP/2 and HTTP/3 chunked trailer streams within Tower middleware. Eliminates streaming DoS exploits, memory exhaustion from trailer bombs, and untrusted side-effect execution prior to payload integrity verification.","antiPatternHeadline":"Unbounded Stream Ingestion and Post-Consumption Trailer Verification Permitting Streaming DoS and Integrity Bypass","stars_count":92,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tower","http2","http3","security","dos-protection"],"exportEndpoints":{"claude":"/api/rules/axum-tower-body-framing-trailer-integrity-guardrail?format=claude","cursorMdc":"/api/rules/axum-tower-body-framing-trailer-integrity-guardrail?format=mdc","cursorrules":"/api/rules/axum-tower-body-framing-trailer-integrity-guardrail?format=cursor","windsurf":"/api/rules/axum-tower-body-framing-trailer-integrity-guardrail?format=windsurf","agents":"/api/rules/axum-tower-body-framing-trailer-integrity-guardrail?format=agents"}},{"id":"bun-ffi-struct-alignment-and-memory-pinning-guardrail","title":"Bun 1.2 FFI C-ABI Struct Alignment and Non-Moving Memory Pinning Standard","category":"backend","severity":"critical","description":"Mandates strict C-ABI layout alignment calculations and deterministic memory pinning when exchanging zero-copy pointers between Bun 1.2 (JavaScriptCore) and native Rust/C libraries. Prevents engine panics, ARM64 bus errors (SIGBUS), and heap corruption resulting from JSC garbage collection compaction or misaligned struct boundaries.","antiPatternHeadline":"Passing packed GC-managed buffers without host alignment padding or lifetime guarantees to native FFI pointers.","stars_count":79,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","ffi","memory-safety","c-abi","rust-interop"],"exportEndpoints":{"claude":"/api/rules/bun-ffi-struct-alignment-and-memory-pinning-guardrail?format=claude","cursorMdc":"/api/rules/bun-ffi-struct-alignment-and-memory-pinning-guardrail?format=mdc","cursorrules":"/api/rules/bun-ffi-struct-alignment-and-memory-pinning-guardrail?format=cursor","windsurf":"/api/rules/bun-ffi-struct-alignment-and-memory-pinning-guardrail?format=windsurf","agents":"/api/rules/bun-ffi-struct-alignment-and-memory-pinning-guardrail?format=agents"}},{"id":"kmp-swift-arc-gc-retain-cycle-interlock","title":"Kotlin/Native GC and Swift ARC Bidirectional Retain Cycle Interlock","category":"mobile","severity":"critical","description":"Enforces deterministic lifecycle boundaries between Kotlin/Native's garbage-collected runtime and Swift's Automatic Reference Counting engine across the Objective-C export bridge. Eliminates hidden circular strong references across runtime boundaries that blind tracing collectors and reference counting from reclamation, preventing cross-runtime memory leaks and zombie pointer dereferences in multi-threaded bridges.","antiPatternHeadline":"Cross-Boundary Strong Reference Pinning and Unsynchronized StableRef Leaks","stars_count":53,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","swift","arc","garbage-collection","memory-management","concurrency"],"exportEndpoints":{"claude":"/api/rules/kmp-swift-arc-gc-retain-cycle-interlock?format=claude","cursorMdc":"/api/rules/kmp-swift-arc-gc-retain-cycle-interlock?format=mdc","cursorrules":"/api/rules/kmp-swift-arc-gc-retain-cycle-interlock?format=cursor","windsurf":"/api/rules/kmp-swift-arc-gc-retain-cycle-interlock?format=windsurf","agents":"/api/rules/kmp-swift-arc-gc-retain-cycle-interlock?format=agents"}},{"id":"webauthn-prf-hardware-bound-key-derivation-contract","title":"WebAuthn Level 3 PRF Extension Hardware-Bound Symmetric Key Derivation Contract","category":"security","severity":"critical","description":"Enforces strict end-to-end zero-knowledge client-side symmetric key derivation using the WebAuthn Level 3 Pseudo-Random Function (PRF) extension (HMAC-secret). Mandates that PRF seed outputs never traverse the network, persistent storage, or telemetry streams, and requires continuous salt isolation, ephemeral memory hygiene, and constant-time key derivation via HKDF.","antiPatternHeadline":"Transmitting PRF Outputs or Deriving Persistent Root Keys in Plaintext Client/Server Memory","stars_count":49,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","prf-extension","zero-knowledge","cryptography","hkdf","web-crypto"],"exportEndpoints":{"claude":"/api/rules/webauthn-prf-hardware-bound-key-derivation-contract?format=claude","cursorMdc":"/api/rules/webauthn-prf-hardware-bound-key-derivation-contract?format=mdc","cursorrules":"/api/rules/webauthn-prf-hardware-bound-key-derivation-contract?format=cursor","windsurf":"/api/rules/webauthn-prf-hardware-bound-key-derivation-contract?format=windsurf","agents":"/api/rules/webauthn-prf-hardware-bound-key-derivation-contract?format=agents"}},{"id":"openfga-graph-traversal-depth-cycle-quarantine-standard","title":"OpenFGA Graph Traversal Depth and Dynamic Cycle Quarantine Standard","category":"security","severity":"critical","description":"Enforces strict Directed Acyclic Graph (DAG) invariants, traversal depth constraints, and real-time cycle detection for OpenFGA Relationship-Based Access Control (RebAC). Prevents authorization denial-of-service (DoS) and guarantees sub-millisecond evaluation bounds by intercepting cyclical tuple writes and binding check resolution budgets.","antiPatternHeadline":"Unbounded RebAC Tuple Ingestion and Unguarded Nested Graph Checks Causing Catastrophic Traversal Cycles","stars_count":81,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","rebac","authorization","graph-traversal","dos-prevention"],"exportEndpoints":{"claude":"/api/rules/openfga-graph-traversal-depth-cycle-quarantine-standard?format=claude","cursorMdc":"/api/rules/openfga-graph-traversal-depth-cycle-quarantine-standard?format=mdc","cursorrules":"/api/rules/openfga-graph-traversal-depth-cycle-quarantine-standard?format=cursor","windsurf":"/api/rules/openfga-graph-traversal-depth-cycle-quarantine-standard?format=windsurf","agents":"/api/rules/openfga-graph-traversal-depth-cycle-quarantine-standard?format=agents"}},{"id":"spiffe-spire-dynamic-svid-reloader-standard","title":"SPIFFE/SPIRE Dynamic In-Memory X.509 SVID Zero-Socket-Drop Reloader Standard","category":"devops","severity":"critical","description":"Enforces seamless in-memory dynamic rotation of X.509 SVIDs and trust bundles via the SPIFFE Workload API without tearing down active gRPC or HTTP/3 transport connections. Prevents credential write-to-disk vulnerabilities, hard connection resets, and race-induced TLS handshake dropouts during high-frequency mTLS certificate lifecycle events.","antiPatternHeadline":"Persisting Short-Lived SVIDs to Disk or Recycling Network Listeners on Certificate Expiry","stars_count":82,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","spiffe","spire","mtls","grpc","zero-downtime","security"],"exportEndpoints":{"claude":"/api/rules/spiffe-spire-dynamic-svid-reloader-standard?format=claude","cursorMdc":"/api/rules/spiffe-spire-dynamic-svid-reloader-standard?format=mdc","cursorrules":"/api/rules/spiffe-spire-dynamic-svid-reloader-standard?format=cursor","windsurf":"/api/rules/spiffe-spire-dynamic-svid-reloader-standard?format=windsurf","agents":"/api/rules/spiffe-spire-dynamic-svid-reloader-standard?format=agents"}},{"id":"ebpf-ringbuf-lossless-backpressure-protocol","title":"eBPF Ring Buffer Lossless Telemetry & Adaptive Backpressure Guardrail","category":"devops","severity":"critical","description":"Mandates zero-copy reservation (bpf_ringbuf_reserve) with atomic drop accounting and batched wake-up suppression (BPF_RB_NO_WAKEUP) to eliminate IRQ storms and event loss during line-rate microbursts. Userspace consumers must operate on power-of-two page-aligned buffers with epoll-driven drain loops to maintain sustained kernel-to-userspace throughput.","antiPatternHeadline":"Per-Event Wake-Up Storms and Unchecked Allocations in eBPF Ring Buffers Causing Microburst Silent Drops","stars_count":87,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","kernel","ringbuf","telemetry","performance","backpressure"],"exportEndpoints":{"claude":"/api/rules/ebpf-ringbuf-lossless-backpressure-protocol?format=claude","cursorMdc":"/api/rules/ebpf-ringbuf-lossless-backpressure-protocol?format=mdc","cursorrules":"/api/rules/ebpf-ringbuf-lossless-backpressure-protocol?format=cursor","windsurf":"/api/rules/ebpf-ringbuf-lossless-backpressure-protocol?format=windsurf","agents":"/api/rules/ebpf-ringbuf-lossless-backpressure-protocol?format=agents"}},{"id":"svelte-5-runes-effect-ownership-and-teardown","title":"Svelte 5 Runes Effect Ownership and Resource Teardown Standard","category":"frontend","severity":"critical","description":"Enforces deterministic lifecycle management and lexical root ownership for Svelte 5 runes ($effect, $effect.pre, $effect.root) in high-churn environments and micro-frontends. Prevents orphaned reactive loops, memory leaks, and dangling cross-application subscriptions caused by creating effects outside component initialization contexts or omitting explicit teardown handlers.","antiPatternHeadline":"Instantiating unbounded effects in asynchronous callbacks or omitting explicit teardown for unmanaged effect roots","stars_count":54,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","memory-management","micro-frontends","lifecycle"],"exportEndpoints":{"claude":"/api/rules/svelte-5-runes-effect-ownership-and-teardown?format=claude","cursorMdc":"/api/rules/svelte-5-runes-effect-ownership-and-teardown?format=mdc","cursorrules":"/api/rules/svelte-5-runes-effect-ownership-and-teardown?format=cursor","windsurf":"/api/rules/svelte-5-runes-effect-ownership-and-teardown?format=windsurf","agents":"/api/rules/svelte-5-runes-effect-ownership-and-teardown?format=agents"}},{"id":"wasi-component-model-host-memory-isolation","title":"WASI 0.2 Component Model Host Memory Isolation & Boundary Enforcement","category":"frontend","severity":"critical","description":"Enforces strict host-guest memory isolation and capability-based virtualization when executing third-party WASI 0.2 WebAssembly components in browser runtimes. Prohibits ambient authority exposure and mutable host memory sharing across the WebAssembly Canonical ABI boundary.","antiPatternHeadline":"Executing Third-Party Wasm Components on the Main Thread with Ambient Authority and Shared Linear Memory","stars_count":73,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","webassembly","wasi-0.2","component-model","sandboxing","zero-trust","web-workers"],"exportEndpoints":{"claude":"/api/rules/wasi-component-model-host-memory-isolation?format=claude","cursorMdc":"/api/rules/wasi-component-model-host-memory-isolation?format=mdc","cursorrules":"/api/rules/wasi-component-model-host-memory-isolation?format=cursor","windsurf":"/api/rules/wasi-component-model-host-memory-isolation?format=windsurf","agents":"/api/rules/wasi-component-model-host-memory-isolation?format=agents"}},{"id":"go-iter-pipeline-cancellation-propagation","title":"Go 1.24 Range-Over-Func Pipeline Cancellation Propagation Invariant","category":"backend","severity":"critical","description":"Enforces strict cooperative context cancellation and iterator yield-break propagation across Go 1.24 range-over-func (`iter.Seq` and `iter.Seq2`) processing pipelines. Failure to check `ctx.Done()` alongside `yield()` return values within continuous iterators triggers orphan background goroutines, blocked channel writes, and unbounded memory leaks. Mandates clean early returns, defensive deferred resource teardown, and deterministic propagation of loop termination signals across multi-stage iterator pipelines.","antiPatternHeadline":"Ignoring yield Boolean Return Values and Context Deadlines in Range-Over-Func Pipelines","stars_count":106,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","concurrency","iterators","context-propagation","goroutine-leaks"],"exportEndpoints":{"claude":"/api/rules/go-iter-pipeline-cancellation-propagation?format=claude","cursorMdc":"/api/rules/go-iter-pipeline-cancellation-propagation?format=mdc","cursorrules":"/api/rules/go-iter-pipeline-cancellation-propagation?format=cursor","windsurf":"/api/rules/go-iter-pipeline-cancellation-propagation?format=windsurf","agents":"/api/rules/go-iter-pipeline-cancellation-propagation?format=agents"}},{"id":"bun-websocket-backpressure-queue-bounding","title":"Bun 1.2 Native WebSocket Backpressure Queue Bounding Guardrail","category":"backend","severity":"critical","description":"Protects high-throughput Bun edge event gateways from out-of-memory (OOM) kills caused by unbounded native C++ socket buffering. Enforces strict inspection of ws.getBufferedAmount(), mandatory drain callback wiring, and deterministic client eviction when slow consumer buffers exceed memory limits.","antiPatternHeadline":"Unbounded WebSocket Publishing Without Buffer Inspection or Drain Handler Synchronization","stars_count":116,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","websockets","backpressure","memory-safety","high-throughput"],"exportEndpoints":{"claude":"/api/rules/bun-websocket-backpressure-queue-bounding?format=claude","cursorMdc":"/api/rules/bun-websocket-backpressure-queue-bounding?format=mdc","cursorrules":"/api/rules/bun-websocket-backpressure-queue-bounding?format=cursor","windsurf":"/api/rules/bun-websocket-backpressure-queue-bounding?format=windsurf","agents":"/api/rules/bun-websocket-backpressure-queue-bounding?format=agents"}},{"id":"capacitor-7-binary-ipc-serialization-invariant","title":"Capacitor 7 Structured Binary IPC Serialization Invariant","category":"mobile","severity":"critical","description":"Enforces zero-overhead binary IPC transfer over the Capacitor 7 native bridge for high-frequency or high-volume data streams. Prohibits base64 stringification and JSON text marshalling of binary payloads to eliminate WebView main-thread garbage collection churn, serialization latency, and 60/120 FPS frame drops.","antiPatternHeadline":"Base64 or JSON Stringification of High-Frequency Native Bridge Payloads","stars_count":54,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","performance","ipc","binary-serialization","memory-management"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-binary-ipc-serialization-invariant?format=claude","cursorMdc":"/api/rules/capacitor-7-binary-ipc-serialization-invariant?format=mdc","cursorrules":"/api/rules/capacitor-7-binary-ipc-serialization-invariant?format=cursor","windsurf":"/api/rules/capacitor-7-binary-ipc-serialization-invariant?format=windsurf","agents":"/api/rules/capacitor-7-binary-ipc-serialization-invariant?format=agents"}},{"id":"swift-6-kmp-sendable-actor-boundary","title":"Swift 6 Sendable Actor Boundary for Kotlin Multiplatform (KMP) Interop","category":"mobile","severity":"critical","description":"Enforces strict Swift 6 Sendable boundaries and actor isolation when handling Kotlin/Native Objective-C exported instances. Mitigates memory corruption, undefined thread execution, and Swift 6 compile-time concurrency errors caused by passing non-Sendable KMP reference types across Swift structured concurrency tasks or actor boundaries.","antiPatternHeadline":"Leaking Non-Sendable KMP Class References Across Swift Task and Actor Boundaries","stars_count":61,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","swift6","kmp","kotlin-multiplatform","concurrency","sendable","actors","ios"],"exportEndpoints":{"claude":"/api/rules/swift-6-kmp-sendable-actor-boundary?format=claude","cursorMdc":"/api/rules/swift-6-kmp-sendable-actor-boundary?format=mdc","cursorrules":"/api/rules/swift-6-kmp-sendable-actor-boundary?format=cursor","windsurf":"/api/rules/swift-6-kmp-sendable-actor-boundary?format=windsurf","agents":"/api/rules/swift-6-kmp-sendable-actor-boundary?format=agents"}},{"id":"otel-ingest-dynamic-cardinality-guardrail","title":"OpenTelemetry Ingest Attribute Dynamic Cardinality and Redaction Guardrail","category":"devops","severity":"critical","description":"Protects distributed telemetry storage backends (e.g., Prometheus, Mimir, ClickHouse, Tempo) from catastrophic cardinality explosions and out-of-memory (OOM) outages. Enforces collector-level regex normalization, key quotas, and runtime masking on high-entropy dimensions (UUIDs, raw URLs, user emails) before ingestion. Eliminates multi-thousand dollar telemetry cloud billing overages by shedding unbounded labels deterministically at ingress.","antiPatternHeadline":"Attaching Unbounded High-Entropy Dimensions Directly to Metrics and Distributed Spans","stars_count":85,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","observability","collector","cardinality","prometheus","tracing"],"exportEndpoints":{"claude":"/api/rules/otel-ingest-dynamic-cardinality-guardrail?format=claude","cursorMdc":"/api/rules/otel-ingest-dynamic-cardinality-guardrail?format=mdc","cursorrules":"/api/rules/otel-ingest-dynamic-cardinality-guardrail?format=cursor","windsurf":"/api/rules/otel-ingest-dynamic-cardinality-guardrail?format=windsurf","agents":"/api/rules/otel-ingest-dynamic-cardinality-guardrail?format=agents"}},{"id":"k8s-validating-admission-policy-cel-guardrail-production-standard","title":"Deterministic In-Tree CEL ValidatingAdmissionPolicy Standard","category":"devops","severity":"critical","description":"Mandates the replacement of out-of-process dynamic admission webhooks with native Kubernetes ValidatingAdmissionPolicy (VAP) driven by Common Expression Language (CEL). This eliminates control-plane chicken-and-egg failure loops during CNI cold starts, terminates out-of-band TLS handshakes, and enforces deterministic, zero-network-hop policy evaluation directly within kube-apiserver.","antiPatternHeadline":"Fragile Out-of-Process Webhook Configurations Inducing Control Plane Deadlocks and Latency Cascades","stars_count":75,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","kubernetes","validating-admission-policy","cel","security","admission-controllers"],"exportEndpoints":{"claude":"/api/rules/k8s-validating-admission-policy-cel-guardrail-production-standard?format=claude","cursorMdc":"/api/rules/k8s-validating-admission-policy-cel-guardrail-production-standard?format=mdc","cursorrules":"/api/rules/k8s-validating-admission-policy-cel-guardrail-production-standard?format=cursor","windsurf":"/api/rules/k8s-validating-admission-policy-cel-guardrail-production-standard?format=windsurf","agents":"/api/rules/k8s-validating-admission-policy-cel-guardrail-production-standard?format=agents"}},{"id":"axum-tokio-cancellation-safe-tx-guard","title":"Axum 0.8 Tokio Task-Local Cancellation-Safe Transaction Rollback Guard","category":"backend","severity":"critical","description":"Enforces cancellation-safe transaction semantics in Axum 0.8 handlers driven by Tokio runtimes. Eliminates orphaned locks, dirty pool connections, and leaked task-local state caused by abrupt client disconnects dropping handler futures at arbitrary await points.","antiPatternHeadline":"Procedural rollback in match arms bypassed by Tokio future drop on client disconnect","stars_count":79,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tokio","sqlx","concurrency"],"exportEndpoints":{"claude":"/api/rules/axum-tokio-cancellation-safe-tx-guard?format=claude","cursorMdc":"/api/rules/axum-tokio-cancellation-safe-tx-guard?format=mdc","cursorrules":"/api/rules/axum-tokio-cancellation-safe-tx-guard?format=cursor","windsurf":"/api/rules/axum-tokio-cancellation-safe-tx-guard?format=windsurf","agents":"/api/rules/axum-tokio-cancellation-safe-tx-guard?format=agents"}},{"id":"vite-rolldown-federation-sri-attestation","title":"Subresource Integrity Attestation and Contract Validation for Federated Micro-Frontends","category":"frontend","severity":"critical","description":"Enforces deterministic cryptographic digest verification and strict runtime schema contract validation on dynamic remote container manifests and emitted Rolldown ESM chunks. Prevents edge supply-chain injection attacks and poisoned dynamic imports by requiring immutable SHA-384/SHA-512 SRI attestation headers before hydrating cross-origin micro-frontend components. Guarantees fail-closed isolation if dynamic remote modules diverge from pre-attested cryptographic lockfiles.","antiPatternHeadline":"Blind Cross-Origin Remote Container Execution Without Cryptographic Digest Pinning and Runtime Type Enforcement","stars_count":49,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","vite6","rolldown","module-federation","subresource-integrity","supply-chain-security","runtime-attestation"],"exportEndpoints":{"claude":"/api/rules/vite-rolldown-federation-sri-attestation?format=claude","cursorMdc":"/api/rules/vite-rolldown-federation-sri-attestation?format=mdc","cursorrules":"/api/rules/vite-rolldown-federation-sri-attestation?format=cursor","windsurf":"/api/rules/vite-rolldown-federation-sri-attestation?format=windsurf","agents":"/api/rules/vite-rolldown-federation-sri-attestation?format=agents"}},{"id":"svelte5-async-derived-race-demuxing-protocol","title":"Svelte 5 Asynchronous State Race Demuxing & Abort Protocol","category":"frontend","severity":"critical","description":"Enforces deterministic demultiplexing and cancellation for asynchronous side-effects and resource mutations triggered by fine-grained Svelte 5 runes. Prevents out-of-order promise resolutions from clobbering active state runes during high-frequency dependency invalidations.","antiPatternHeadline":"Uncoordinated Asynchronous Side-Effects Overwriting Svelte 5 Reactive State with Stale Promise Resolutions","stars_count":91,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["svelte5","runes","async-state","race-conditions","frontend","concurrency"],"exportEndpoints":{"claude":"/api/rules/svelte5-async-derived-race-demuxing-protocol?format=claude","cursorMdc":"/api/rules/svelte5-async-derived-race-demuxing-protocol?format=mdc","cursorrules":"/api/rules/svelte5-async-derived-race-demuxing-protocol?format=cursor","windsurf":"/api/rules/svelte5-async-derived-race-demuxing-protocol?format=windsurf","agents":"/api/rules/svelte5-async-derived-race-demuxing-protocol?format=agents"}},{"id":"openfga-contextual-tuple-cryptographic-attestation-standard","title":"OpenFGA Ephemeral Contextual Tuple Cryptographic Signature Attestation","category":"security","severity":"critical","description":"Enforces that all ephemeral contextual tuples passed into real-time OpenFGA check evaluations carry verifiable asymmetric cryptographic signatures or tamper-evident claims issued by authorized upstream identity providers or trusted internal token brokers. Prevents caller-side privilege escalation and permission spoofing caused by unvalidated client-supplied tuples dynamically injected into evaluation trees.","antiPatternHeadline":"Trusting raw, unverified client-supplied contextual tuples directly in OpenFGA check queries","stars_count":42,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","authorization","cryptography","zero-trust","jwt"],"exportEndpoints":{"claude":"/api/rules/openfga-contextual-tuple-cryptographic-attestation-standard?format=claude","cursorMdc":"/api/rules/openfga-contextual-tuple-cryptographic-attestation-standard?format=mdc","cursorrules":"/api/rules/openfga-contextual-tuple-cryptographic-attestation-standard?format=cursor","windsurf":"/api/rules/openfga-contextual-tuple-cryptographic-attestation-standard?format=windsurf","agents":"/api/rules/openfga-contextual-tuple-cryptographic-attestation-standard?format=agents"}},{"id":"go-chi-context-pool-sanitization-guardrail","title":"Go Chi Zero-Allocation Context Pool Sanitization and Memory Scrubbing Guardrail","category":"backend","severity":"critical","description":"Mandates deterministic memory zeroing, pointer detachment, and deep field sanitization for pooled request contexts and custom state structs within Go Chi middleware pipelines. Prevents cross-tenant data bleeding, dangling reference retention, and silent authorization bypasses caused by dirty object reuse in high-throughput sync.Pool implementations.","antiPatternHeadline":"Recycling Unsanitized Request State and Chi Route Contexts via sync.Pool Across Tenant Boundaries","stars_count":95,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","chi","sync-pool","concurrency","memory-safety","multi-tenancy","security"],"exportEndpoints":{"claude":"/api/rules/go-chi-context-pool-sanitization-guardrail?format=claude","cursorMdc":"/api/rules/go-chi-context-pool-sanitization-guardrail?format=mdc","cursorrules":"/api/rules/go-chi-context-pool-sanitization-guardrail?format=cursor","windsurf":"/api/rules/go-chi-context-pool-sanitization-guardrail?format=windsurf","agents":"/api/rules/go-chi-context-pool-sanitization-guardrail?format=agents"}},{"id":"tauri-v2-mobile-biometric-deep-link-verification-standard","title":"Tauri 2.0 Mobile Biometric Intent Gating and Cryptographic Deep-Link Verification","category":"mobile","severity":"critical","description":"Mandates that incoming mobile deep-link payloads containing operational or authenticated actions are held in native Rust memory and gated behind OS-level biometric attestation before being bridged to the WebView. Prevents cross-app intent injection, parameter tampering, and unauthorized execution by requiring hardware-backed authentication (KeyStore/Secure Enclave) prior to IPC emission.","antiPatternHeadline":"Piping Unverified Deep-Link Intents Directly into the WebView via Unprotected Tauri IPC Events","stars_count":45,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri-v2","biometrics","deep-links","app-security","rust"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-mobile-biometric-deep-link-verification-standard?format=claude","cursorMdc":"/api/rules/tauri-v2-mobile-biometric-deep-link-verification-standard?format=mdc","cursorrules":"/api/rules/tauri-v2-mobile-biometric-deep-link-verification-standard?format=cursor","windsurf":"/api/rules/tauri-v2-mobile-biometric-deep-link-verification-standard?format=windsurf","agents":"/api/rules/tauri-v2-mobile-biometric-deep-link-verification-standard?format=agents"}},{"id":"wasi-02-canonical-abi-memory-governor","title":"WASI 0.2 Canonical ABI Boundary Memory Governor & Deterministic Resource Lifecycle Enforcement","category":"devops","severity":"critical","description":"Enforces strict linear memory quotas, deterministic post-return deallocations, and ResourceTable lifecycle boundaries between polyglot WebAssembly 0.2 component guests. Guarantees that Canonical ABI lowering allocations trigger corresponding post-return hooks and that linear memory growth is strictly bounded to prevent heap exhaustion in high-density serverless execution contexts.","antiPatternHeadline":"Bypassing cabi_post_* Cleanup and Omitting Host StoreLimits in Polyglot WASI 0.2 Guest Invocations","stars_count":71,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","wasm","wasi-0.2","component-model","wasmtime","memory-management","serverless"],"exportEndpoints":{"claude":"/api/rules/wasi-02-canonical-abi-memory-governor?format=claude","cursorMdc":"/api/rules/wasi-02-canonical-abi-memory-governor?format=mdc","cursorrules":"/api/rules/wasi-02-canonical-abi-memory-governor?format=cursor","windsurf":"/api/rules/wasi-02-canonical-abi-memory-governor?format=windsurf","agents":"/api/rules/wasi-02-canonical-abi-memory-governor?format=agents"}},{"id":"otel-genai-streaming-token-attribution-standard","title":"OpenTelemetry GenAI Semantic Convention Streaming Token Attribution Standard","category":"devops","severity":"critical","description":"Enforces strict compliance with OpenTelemetry GenAI semantic conventions across chunked LLM response streams by mandating monotonic token increment attribution and per-chunk latency metrics. Guarantees real-time token bucket deduction and runaway streaming execution termination before gateway buffering cascades into unrecoverable financial or compute exhaustion.","antiPatternHeadline":"Deferred End-of-Stream Telemetry and Batch Token Attribution","stars_count":103,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","genai","streaming","token-bucket","rate-limiting"],"exportEndpoints":{"claude":"/api/rules/otel-genai-streaming-token-attribution-standard?format=claude","cursorMdc":"/api/rules/otel-genai-streaming-token-attribution-standard?format=mdc","cursorrules":"/api/rules/otel-genai-streaming-token-attribution-standard?format=cursor","windsurf":"/api/rules/otel-genai-streaming-token-attribution-standard?format=windsurf","agents":"/api/rules/otel-genai-streaming-token-attribution-standard?format=agents"}},{"id":"kmp-skiko-vram-texture-recycling-protocol","title":"KMP Skiko VRAM Texture Recycling and Deterministic GPU Eviction","category":"mobile","severity":"critical","description":"Enforces explicit lifecycle-bound disposal and object pooling of Skia/Skiko ImageBitmap, Surface, and RenderTarget handles in Compose Multiplatform. Prevents low-tier mobile VRAM exhaustion and uncatchable native aborts caused by asynchronous finalizer delays across screen transitions.","antiPatternHeadline":"Relying on JVM/Kotlin Native Garbage Collection for Skiko Native GPU Textures and Bitmaps","stars_count":93,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","compose-multiplatform","skiko","kmp","vram-management","gpu-memory"],"exportEndpoints":{"claude":"/api/rules/kmp-skiko-vram-texture-recycling-protocol?format=claude","cursorMdc":"/api/rules/kmp-skiko-vram-texture-recycling-protocol?format=mdc","cursorrules":"/api/rules/kmp-skiko-vram-texture-recycling-protocol?format=cursor","windsurf":"/api/rules/kmp-skiko-vram-texture-recycling-protocol?format=windsurf","agents":"/api/rules/kmp-skiko-vram-texture-recycling-protocol?format=agents"}},{"id":"react19-rsc-tainted-object-boundary-enclosure","title":"React 19 Server Components Taint Boundary Enclosure Standard","category":"frontend","severity":"critical","description":"Enforces the cryptographic boundary protection of sensitive domain models and secret values in React 19 Server Components. Mandates the explicit application of React taint APIs (`experimental_taintObjectReference` and `experimental_taintUniqueValue`) within the Data Access Layer (DAL) to prevent runtime serialization of backend secrets across the RSC Flight protocol stream to Client Components.","antiPatternHeadline":"Leaking Raw Sensitive Domain Models and Secrets Across RSC Serialization Boundaries","stars_count":99,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["react19","rsc","taint-api","data-access-layer","security","frontend"],"exportEndpoints":{"claude":"/api/rules/react19-rsc-tainted-object-boundary-enclosure?format=claude","cursorMdc":"/api/rules/react19-rsc-tainted-object-boundary-enclosure?format=mdc","cursorrules":"/api/rules/react19-rsc-tainted-object-boundary-enclosure?format=cursor","windsurf":"/api/rules/react19-rsc-tainted-object-boundary-enclosure?format=windsurf","agents":"/api/rules/react19-rsc-tainted-object-boundary-enclosure?format=agents"}},{"id":"bun-worker-asynclocalstorage-context-isolation","title":"Bun 1.2 Worker Thread AsyncLocalStorage Tenant Context Isolation","category":"backend","severity":"critical","description":"Enforces strict tenant boundary isolation and distributed tracing propagation across pooled native Worker threads in Bun 1.2+. Guarantees that AsyncLocalStorage (ALS) store references are explicitly reinvoked per dispatched event and never shared across native thread boundaries or leaked via ambient parent worker scopes.","antiPatternHeadline":"Ambient or Cross-Dispatched AsyncLocalStorage State Bleed in Pooled Native Worker Threads","stars_count":112,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","multithreading","asynclocalstorage","security","tenancy"],"exportEndpoints":{"claude":"/api/rules/bun-worker-asynclocalstorage-context-isolation?format=claude","cursorMdc":"/api/rules/bun-worker-asynclocalstorage-context-isolation?format=mdc","cursorrules":"/api/rules/bun-worker-asynclocalstorage-context-isolation?format=cursor","windsurf":"/api/rules/bun-worker-asynclocalstorage-context-isolation?format=windsurf","agents":"/api/rules/bun-worker-asynclocalstorage-context-isolation?format=agents"}},{"id":"go-124-weak-pointer-concurrent-cache-standard","title":"Go 1.24 Weak Pointer Concurrent Cache Eviction Standard","category":"backend","severity":"critical","description":"Enforces deterministic memory reclamation in high-cardinality in-memory Go caches using Go 1.24 weak pointers (`weak.Pointer`) paired with finalizers or cleanups (`runtime.AddCleanup`). This architecture delegates unreferenced object eviction directly to the runtime garbage collector, completely eliminating memory leaks and cache-induced out-of-memory crashes without requiring stop-the-world eviction loops.","antiPatternHeadline":"Hard Reference Key/Value Map Caches Causing Silent OOM and Phantom Memory Retention","stars_count":108,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","golang","concurrency","weak-pointers","cache","memory-management"],"exportEndpoints":{"claude":"/api/rules/go-124-weak-pointer-concurrent-cache-standard?format=claude","cursorMdc":"/api/rules/go-124-weak-pointer-concurrent-cache-standard?format=mdc","cursorrules":"/api/rules/go-124-weak-pointer-concurrent-cache-standard?format=cursor","windsurf":"/api/rules/go-124-weak-pointer-concurrent-cache-standard?format=windsurf","agents":"/api/rules/go-124-weak-pointer-concurrent-cache-standard?format=agents"}},{"id":"skiko-vsync-frame-pacing-guardrail","title":"Skiko Frame Pacing and Native VSync Lock Invariant","category":"mobile","severity":"critical","description":"Enforces deterministic VSync synchronization between native hardware refresh cycles (CADisplayLink on iOS, platform display clocks on Desktop) and Skiko's Skia-backed rendering pipelines. Prevents frame tearing, dropped redraw buffers, jitter, and excessive GPU queue depth caused by unsynchronized polling loops or decoupled coroutine render drivers.","antiPatternHeadline":"Decoupled Coroutine Loop or Unthrottled Polling Driving Skiko Canvas Redraws","stars_count":114,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","compose-multiplatform","skiko","frame-pacing","vsync","ios","performance"],"exportEndpoints":{"claude":"/api/rules/skiko-vsync-frame-pacing-guardrail?format=claude","cursorMdc":"/api/rules/skiko-vsync-frame-pacing-guardrail?format=mdc","cursorrules":"/api/rules/skiko-vsync-frame-pacing-guardrail?format=cursor","windsurf":"/api/rules/skiko-vsync-frame-pacing-guardrail?format=windsurf","agents":"/api/rules/skiko-vsync-frame-pacing-guardrail?format=agents"}},{"id":"ebpf-tetragon-lsm-capability-escape-enforcement","title":"eBPF Tetragon Dynamic LSM Capability Escape Enforcement & Synchronous Termination","category":"security","severity":"critical","description":"Enforces synchronous in-kernel detection and immediate process termination via eBPF Tetragon TracingPolicies hooked into raw Linux Security Module (LSM) boundaries. Prevents container escape vectors and privilege escalations by blocking unprivileged-to-privileged namespace transitions before kernel capability handoff executes.","antiPatternHeadline":"Asynchronous Userspace Alerting or Syscall-Only Tracepoints for Privilege Escalation","stars_count":71,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","ebpf","tetragon","lsm","container-escape","kubernetes"],"exportEndpoints":{"claude":"/api/rules/ebpf-tetragon-lsm-capability-escape-enforcement?format=claude","cursorMdc":"/api/rules/ebpf-tetragon-lsm-capability-escape-enforcement?format=mdc","cursorrules":"/api/rules/ebpf-tetragon-lsm-capability-escape-enforcement?format=cursor","windsurf":"/api/rules/ebpf-tetragon-lsm-capability-escape-enforcement?format=windsurf","agents":"/api/rules/ebpf-tetragon-lsm-capability-escape-enforcement?format=agents"}},{"id":"webauthn-cross-device-hybrid-replay-guardrail","title":"WebAuthn Cross-Device Hybrid Transport Ephemeral Binding and Replay Prevention","category":"security","severity":"critical","description":"Mandates cryptographically bound ephemeral session identifiers, atomic challenge consumption, and strict origin/cross-origin validation during FIDO2/WebAuthn hybrid transport (caBLE) flows. Prevents QR-code phishing, cross-origin assertion forwarding, and race-condition replay attacks across disparate client contexts.","antiPatternHeadline":"Decoupled Hybrid Authentication Challenges and Non-Atomic Origin Verification","stars_count":53,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","fido2","passkeys","hybrid-transport","replay-prevention"],"exportEndpoints":{"claude":"/api/rules/webauthn-cross-device-hybrid-replay-guardrail?format=claude","cursorMdc":"/api/rules/webauthn-cross-device-hybrid-replay-guardrail?format=mdc","cursorrules":"/api/rules/webauthn-cross-device-hybrid-replay-guardrail?format=cursor","windsurf":"/api/rules/webauthn-cross-device-hybrid-replay-guardrail?format=windsurf","agents":"/api/rules/webauthn-cross-device-hybrid-replay-guardrail?format=agents"}},{"id":"k8s-gateway-api-cel-dynamic-route-validation","title":"Gateway API v1.2 CEL Declarative Route Isolation and Anti-Ambiguity Enforcement","category":"devops","severity":"critical","description":"Applies compile-time and admission-time Common Expression Language (CEL) assertions across Gateway API v1.2 HTTPRoute and Gateway resources to eliminate cross-tenant hostname shadowing and ambiguous path overlaps. Enforces deterministic traffic separation in federated multi-tenant service meshes by validating tenant-isolated namespace ownership directly within CRD validation schemas. Prevents accidental path collisions, privilege escalation via wildcard host hijack, and inter-namespace route hijacking prior to control plane reconciliation.","antiPatternHeadline":"Unconstrained Multi-Tenant HTTPRoute Host Bindings and Overlapping Prefix Collisions Causing Route Hijacking","stars_count":74,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","kubernetes","gateway-api","cel","security","multi-tenancy"],"exportEndpoints":{"claude":"/api/rules/k8s-gateway-api-cel-dynamic-route-validation?format=claude","cursorMdc":"/api/rules/k8s-gateway-api-cel-dynamic-route-validation?format=mdc","cursorrules":"/api/rules/k8s-gateway-api-cel-dynamic-route-validation?format=cursor","windsurf":"/api/rules/k8s-gateway-api-cel-dynamic-route-validation?format=windsurf","agents":"/api/rules/k8s-gateway-api-cel-dynamic-route-validation?format=agents"}},{"id":"otel-logs-bridge-native-span-linkage","title":"OpenTelemetry Logs Bridge Native Span Linkage Standard","category":"devops","severity":"critical","description":"Enforces direct in-process emission of structured telemetry through the OpenTelemetry Logs Bridge API instead of relying on stdout log scrapers. Ensures deterministic 128-bit TraceId and 64-bit SpanId contextual propagation directly to the OpenTelemetry LoggerProvider, eliminating brittle regex parsers and telemetry context truncation.","antiPatternHeadline":"Out-of-Process Regex Scraping and Unlinked Stdout String Logging","stars_count":117,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","logging","observability","tracing","distributed-systems"],"exportEndpoints":{"claude":"/api/rules/otel-logs-bridge-native-span-linkage?format=claude","cursorMdc":"/api/rules/otel-logs-bridge-native-span-linkage?format=mdc","cursorrules":"/api/rules/otel-logs-bridge-native-span-linkage?format=cursor","windsurf":"/api/rules/otel-logs-bridge-native-span-linkage?format=windsurf","agents":"/api/rules/otel-logs-bridge-native-span-linkage?format=agents"}},{"id":"svelte-5-dynamic-context-memory-guardrail","title":"Svelte 5 Runes Dynamic Context Memory Retention Guardrail","category":"frontend","severity":"critical","description":"Prevents catastrophic detached DOM nodes and cumulative heap memory leaks caused by unbound $state signals, root-less $effect.root closures, and shared module-level context references leaking across deeply nested, dynamically unmounted Svelte 5 component trees. Mandates strict lifecycle scoping, clean teardown of reactive context subscribers, and isolation of module-level reactive stores.","antiPatternHeadline":"Escaping Rune Subscriptions and Leaked Module-Level Context References in Dynamic Component Subtrees","stars_count":107,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","memory-leak","garbage-collection","reactivity"],"exportEndpoints":{"claude":"/api/rules/svelte-5-dynamic-context-memory-guardrail?format=claude","cursorMdc":"/api/rules/svelte-5-dynamic-context-memory-guardrail?format=mdc","cursorrules":"/api/rules/svelte-5-dynamic-context-memory-guardrail?format=cursor","windsurf":"/api/rules/svelte-5-dynamic-context-memory-guardrail?format=windsurf","agents":"/api/rules/svelte-5-dynamic-context-memory-guardrail?format=agents"}},{"id":"postgres-17-streaming-io-vector-buffer-quota-standard","title":"PostgreSQL 17 Streaming I/O Vectorization & Buffer Quota Guardrails","category":"backend","severity":"critical","description":"Enforces strict buffer ring allocations and streaming I/O concurrency budgets in PostgreSQL 17 to eliminate shared_buffers thrashing and LWLock convoys. Restricts high-dimensional vector index scans and bulk analytical queries to segregated buffer pools and bounded read-stream quotas, preventing eviction of hot OLTP cache lines.","antiPatternHeadline":"Unthrottled Parallel Vector Scans and Streaming Reads Evicting OLTP Working Sets from Shared Buffers","stars_count":72,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql-17","pgvector","streaming-io","buffer-cache","database-performance"],"exportEndpoints":{"claude":"/api/rules/postgres-17-streaming-io-vector-buffer-quota-standard?format=claude","cursorMdc":"/api/rules/postgres-17-streaming-io-vector-buffer-quota-standard?format=mdc","cursorrules":"/api/rules/postgres-17-streaming-io-vector-buffer-quota-standard?format=cursor","windsurf":"/api/rules/postgres-17-streaming-io-vector-buffer-quota-standard?format=windsurf","agents":"/api/rules/postgres-17-streaming-io-vector-buffer-quota-standard?format=agents"}},{"id":"webauthn-l3-syncable-passkey-attestation-standard","title":"WebAuthn Level 3 Syncable Passkey Authenticator-Bound Attestation Standard","category":"security","severity":"critical","description":"Enforces strict WebAuthn Level 3 cryptographic verification semantics for both hardware-bound and multi-device syncable passkeys. Mandates atomic single-use challenge consumption, exact clientDataHash reconstruction, bitwise authenticatorData flag validation (UP, UV, BE, BS), and transport-aware replay protection.","antiPatternHeadline":"Accepting unhashed clientData, bypassing UP/UV flags, or enforcing monotonic signCount on syncable passkeys","stars_count":51,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","passkeys","cryptography","fido2","authentication","zero-trust"],"exportEndpoints":{"claude":"/api/rules/webauthn-l3-syncable-passkey-attestation-standard?format=claude","cursorMdc":"/api/rules/webauthn-l3-syncable-passkey-attestation-standard?format=mdc","cursorrules":"/api/rules/webauthn-l3-syncable-passkey-attestation-standard?format=cursor","windsurf":"/api/rules/webauthn-l3-syncable-passkey-attestation-standard?format=windsurf","agents":"/api/rules/webauthn-l3-syncable-passkey-attestation-standard?format=agents"}},{"id":"tauri-v2-mobile-ipc-capability-sandboxing","title":"Tauri 2.0 Mobile Capability-Based IPC Permission Sandboxing","category":"mobile","severity":"critical","description":"Enforces strict principle-of-least-privilege IPC execution boundaries in Tauri 2.0 mobile runtimes (iOS/Android) via explicit capability manifests and scoped permission sets. Prevents embedded WebViews from invoking arbitrary host native APIs or escalating host OS privileges through wildcard IPC dispatchers and unvalidated custom command invocations.","antiPatternHeadline":"Permissive Wildcard Core Permissions and Unscoped Custom Command Invocation on Mobile Runtimes","stars_count":59,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri-2","security","ipc-sandboxing","rust","capabilities"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-mobile-ipc-capability-sandboxing?format=claude","cursorMdc":"/api/rules/tauri-v2-mobile-ipc-capability-sandboxing?format=mdc","cursorrules":"/api/rules/tauri-v2-mobile-ipc-capability-sandboxing?format=cursor","windsurf":"/api/rules/tauri-v2-mobile-ipc-capability-sandboxing?format=windsurf","agents":"/api/rules/tauri-v2-mobile-ipc-capability-sandboxing?format=agents"}},{"id":"k8s-dra-gpu-partitioning-invariant-kubernetes-dynam-238","title":"Kubernetes Dynamic Resource Allocation (DRA) GPU/NPU Partitioning Guardrail","category":"devops","severity":"critical","description":"Enforces deterministic structured parameters, CEL-based hardware constraint filtering, and localized lifecycle binding in Kubernetes Dynamic Resource Allocation (DRA) for heterogeneous GPU/NPU workloads. Prevents device memory fragmentation, interconnect topology mismatches, and scheduler starvation caused by legacy static device allocations during dynamic multi-tenant LLM inference batching.","antiPatternHeadline":"Unstructured static GPU slicing and unconstrained ResourceClaimTemplates causing device fragmentation and scheduler starvation.","stars_count":90,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","kubernetes","dra","gpu","npu","scheduling","vllm","mlops"],"exportEndpoints":{"claude":"/api/rules/k8s-dra-gpu-partitioning-invariant-kubernetes-dynam-238?format=claude","cursorMdc":"/api/rules/k8s-dra-gpu-partitioning-invariant-kubernetes-dynam-238?format=mdc","cursorrules":"/api/rules/k8s-dra-gpu-partitioning-invariant-kubernetes-dynam-238?format=cursor","windsurf":"/api/rules/k8s-dra-gpu-partitioning-invariant-kubernetes-dynam-238?format=windsurf","agents":"/api/rules/k8s-dra-gpu-partitioning-invariant-kubernetes-dynam-238?format=agents"}},{"id":"next15-ppr-streaming-hydration-barrier","title":"Next.js 15 PPR Streaming Shell Hydration Barrier and Suspense Boundary Contract","category":"frontend","severity":"critical","description":"Enforces strict boundary isolation when splicing dynamic streaming fragments into prerendered static shells under Next.js 15 Partial Prerendering (PPR). Guarantees zero Cumulative Layout Shift (CLS) and eliminates React hydration mismatch panics by requiring dimensionally locked, semantically identical Suspense fallbacks around every dynamic data hole. Mandates that all dynamic API accesses (cookies, headers, searchParams) are strictly quarantined beneath deterministic boundaries.","antiPatternHeadline":"Leaking Dynamic Accessors into Static Shells and Supplying Undimensioned Generic Suspense Fallbacks","stars_count":60,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs15","ppr","react-streaming","hydration","layout-shift","suspense"],"exportEndpoints":{"claude":"/api/rules/next15-ppr-streaming-hydration-barrier?format=claude","cursorMdc":"/api/rules/next15-ppr-streaming-hydration-barrier?format=mdc","cursorrules":"/api/rules/next15-ppr-streaming-hydration-barrier?format=cursor","windsurf":"/api/rules/next15-ppr-streaming-hydration-barrier?format=windsurf","agents":"/api/rules/next15-ppr-streaming-hydration-barrier?format=agents"}},{"id":"openfga-cdc-cache-invalidation-standard","title":"OpenFGA CDC-Driven Distributed Consistency Cache Invalidation Standard","category":"backend","severity":"critical","description":"Mandates that OpenFGA authorization check caching layers derive invalidations strictly through transactional Change Data Capture (CDC) streams rather than application-layer dual writes. Guarantees sub-millisecond decision latency with causal consistency by binding monotonic transaction logs to distributed cache eviction pipelines.","antiPatternHeadline":"Dual-Write Application-Level Cache Eviction for Authorization Tuples","stars_count":114,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["openfga","authorization","cdc","cache-invalidation","distributed-systems","redis","kafka"],"exportEndpoints":{"claude":"/api/rules/openfga-cdc-cache-invalidation-standard?format=claude","cursorMdc":"/api/rules/openfga-cdc-cache-invalidation-standard?format=mdc","cursorrules":"/api/rules/openfga-cdc-cache-invalidation-standard?format=cursor","windsurf":"/api/rules/openfga-cdc-cache-invalidation-standard?format=windsurf","agents":"/api/rules/openfga-cdc-cache-invalidation-standard?format=agents"}},{"id":"capacitor-7-background-task-os-budget-quarantine","title":"Capacitor 7 Background Task Execution OS Power-Budget Quarantine","category":"mobile","severity":"critical","description":"Enforces strict time-sliced execution budgets, thermal throttling, and atomic checkpointing for background jobs in Capacitor 7. Modern iOS (BGTaskScheduler) and Android (Doze/WorkManager) strictly enforce execution limits (~25-30s) and kill non-compliant runtimes without warning (0x8badf00d SIGKILL). This standard prevents silent background eviction by enforcing deterministic chunking and graceful task termination.","antiPatternHeadline":"Unbounded Background Synchronization Causing Silent OS Watchdog SIGKILL and Battery Quota Depletion","stars_count":47,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","background-task","ios","android","power-management"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-background-task-os-budget-quarantine?format=claude","cursorMdc":"/api/rules/capacitor-7-background-task-os-budget-quarantine?format=mdc","cursorrules":"/api/rules/capacitor-7-background-task-os-budget-quarantine?format=cursor","windsurf":"/api/rules/capacitor-7-background-task-os-budget-quarantine?format=windsurf","agents":"/api/rules/capacitor-7-background-task-os-budget-quarantine?format=agents"}},{"id":"wasi-02-capability-sandboxing-invariant","title":"WASI 0.2 Component Model Capability-Oriented Sandboxing Invariant","category":"security","severity":"critical","description":"Enforces strict capability-oriented security for WASI 0.2 (Preview 2) component hosts executing untrusted guest extensions. Forbids ambient authority by disallowing direct network socket binding, host filesystem preopens, and unfiltered host I/O, requiring explicit virtualized resource linkers and strict store memory limiters.","antiPatternHeadline":"Ambient Authority Leakage via Unrestricted WASI Preview 2 Host Linker and Context Preopens","stars_count":66,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","wasi","wasm","component-model","wasmtime","sandboxing"],"exportEndpoints":{"claude":"/api/rules/wasi-02-capability-sandboxing-invariant?format=claude","cursorMdc":"/api/rules/wasi-02-capability-sandboxing-invariant?format=mdc","cursorrules":"/api/rules/wasi-02-capability-sandboxing-invariant?format=cursor","windsurf":"/api/rules/wasi-02-capability-sandboxing-invariant?format=windsurf","agents":"/api/rules/wasi-02-capability-sandboxing-invariant?format=agents"}},{"id":"otel-collector-tail-sampling-heap-circuit-breaker","title":"OpenTelemetry Collector Tail Sampling Heap Eviction Circuit Breaker Standard","category":"devops","severity":"critical","description":"Enforces memory-bounded tail sampling and deterministic load-shedding circuit breakers within OpenTelemetry Collector pipelines. Mandates strict ordering where the memory_limiter processor executes before the tail_sampling processor, alongside bounded trace caches and exporter queue limits, to prevent container OOM-kills during cascading upstream traffic spikes.","antiPatternHeadline":"Unbounded Tail-Sampling Memory Buffers Inducing Collector SIGKILL Under Upstream Traffic Surges","stars_count":46,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","tail-sampling","resilience","circuit-breaker","memory-management"],"exportEndpoints":{"claude":"/api/rules/otel-collector-tail-sampling-heap-circuit-breaker?format=claude","cursorMdc":"/api/rules/otel-collector-tail-sampling-heap-circuit-breaker?format=mdc","cursorrules":"/api/rules/otel-collector-tail-sampling-heap-circuit-breaker?format=cursor","windsurf":"/api/rules/otel-collector-tail-sampling-heap-circuit-breaker?format=windsurf","agents":"/api/rules/otel-collector-tail-sampling-heap-circuit-breaker?format=agents"}},{"id":"postgres-17-logical-replication-slot-failover-sync-guardrail","title":"PostgreSQL 17 Logical Replication Slot Failover Synchronization Invariant","category":"backend","severity":"critical","description":"Enforces failover synchronization invariants for logical replication slots introduced in PostgreSQL 17 to prevent replica divergence, silent subscriber data skipping, and WAL retention bloat during primary-standby failovers. Demands strict verification of the `failover = true` slot configuration, mandatory `synchronized_standby_slots` alignment on the primary, and explicit barrier checks via `pg_sync_replication_slots()` prior to subscriber promotion or reconnection. Ensures zero-divergence high-availability topologies by blocking uncontrolled failovers when physical and logical slot watermarks are misaligned.","antiPatternHeadline":"Executing Standby Promotion Without Logical Slot Synchronization and Failover Flags","stars_count":99,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql-17","logical-replication","disaster-recovery","failover","database-reliability"],"exportEndpoints":{"claude":"/api/rules/postgres-17-logical-replication-slot-failover-sync-guardrail?format=claude","cursorMdc":"/api/rules/postgres-17-logical-replication-slot-failover-sync-guardrail?format=mdc","cursorrules":"/api/rules/postgres-17-logical-replication-slot-failover-sync-guardrail?format=cursor","windsurf":"/api/rules/postgres-17-logical-replication-slot-failover-sync-guardrail?format=windsurf","agents":"/api/rules/postgres-17-logical-replication-slot-failover-sync-guardrail?format=agents"}},{"id":"fastapi-py313-freethreaded-memory-fence","title":"FastAPI Python 3.13 Free-Threaded Shared-State Memory Fence","category":"backend","severity":"critical","description":"Enforces strict synchronization barriers, atomic primitives, and thread-safe dependency lifetimes in FastAPI applications deployed on free-threaded Python 3.13 (PEP 703). Prevents torn reads, check-then-act race conditions, and cross-thread memory corruption caused by the removal of the Global Interpreter Lock.","antiPatternHeadline":"Naked Global Mutation and Unsynchronized Shared State in No-GIL Runtimes","stars_count":88,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","python313","free-threaded","no-gil","concurrency","memory-barriers"],"exportEndpoints":{"claude":"/api/rules/fastapi-py313-freethreaded-memory-fence?format=claude","cursorMdc":"/api/rules/fastapi-py313-freethreaded-memory-fence?format=mdc","cursorrules":"/api/rules/fastapi-py313-freethreaded-memory-fence?format=cursor","windsurf":"/api/rules/fastapi-py313-freethreaded-memory-fence?format=windsurf","agents":"/api/rules/fastapi-py313-freethreaded-memory-fence?format=agents"}},{"id":"openfga-rebac-snapshot-consistency-barrier","title":"OpenFGA ReBAC Cryptographic Snapshot Isolation and Consistency Barrier Guardrail","category":"security","severity":"critical","description":"Enforces strict cryptographic snapshot tokenization and read-after-write consistency barriers when evaluating OpenFGA authorization checks. Eliminates time-of-check to time-of-use (TOCTOU) authorization vulnerabilities caused by replication lag, stale graph evaluation, and contextual tuple spoofing during distributed transactions.","antiPatternHeadline":"Stale Replica Evaluation and Unbound Contextual Tuples Causing TOCTOU Authorization Bypass","stars_count":108,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","rebac","authorization","toctou","snapshot-isolation","zanzibar"],"exportEndpoints":{"claude":"/api/rules/openfga-rebac-snapshot-consistency-barrier?format=claude","cursorMdc":"/api/rules/openfga-rebac-snapshot-consistency-barrier?format=mdc","cursorrules":"/api/rules/openfga-rebac-snapshot-consistency-barrier?format=cursor","windsurf":"/api/rules/openfga-rebac-snapshot-consistency-barrier?format=windsurf","agents":"/api/rules/openfga-rebac-snapshot-consistency-barrier?format=agents"}},{"id":"webauthn-prf-client-side-envelope-encryption-guardrail","title":"WebAuthn Level 3 PRF Salted Client-Side Envelope Encryption Invariant","category":"security","severity":"critical","description":"Enforces strict zero-knowledge envelope encryption invariants utilizing WebAuthn Level 3 Pseudo-Random Function (PRF) extension outputs combined with cryptographically secure application-specific salts. Guarantees deterministic, hardware-backed Root Key derivation exclusively within client memory, forbidding raw key transport, unauthenticated HKDF derivations, and server-side key custody.","antiPatternHeadline":"Leaking Raw Authenticator PRF Outputs to Backend or Relying on Server-Side Key Escrow","stars_count":107,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","prf-extension","envelope-encryption","zero-knowledge","cryptography"],"exportEndpoints":{"claude":"/api/rules/webauthn-prf-client-side-envelope-encryption-guardrail?format=claude","cursorMdc":"/api/rules/webauthn-prf-client-side-envelope-encryption-guardrail?format=mdc","cursorrules":"/api/rules/webauthn-prf-client-side-envelope-encryption-guardrail?format=cursor","windsurf":"/api/rules/webauthn-prf-client-side-envelope-encryption-guardrail?format=windsurf","agents":"/api/rules/webauthn-prf-client-side-envelope-encryption-guardrail?format=agents"}},{"id":"angular-19-zoneless-signal-cycle-guardrail","title":"Angular 19 Zoneless Signal Graph Cycle & Microtask Starvation Prevention","category":"frontend","severity":"critical","description":"Enforces strict Directed Acyclic Graph (DAG) topologies across Angular 19 zoneless signal architectures to prevent microtask queue starvation, continuous re-render churn, and runtime cycle exceptions (such as NG0600 or NG0103). Mandates unidirectional data flow by prohibiting cyclic signal mutations within effects and enforcing pure, derivation-based computed signals.","antiPatternHeadline":"Cyclic Signal Mutation in Effects or Cross-Signal Ping-Pong Starving the Microtask Queue","stars_count":110,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","angular-19","signals","zoneless","reactivity","performance"],"exportEndpoints":{"claude":"/api/rules/angular-19-zoneless-signal-cycle-guardrail?format=claude","cursorMdc":"/api/rules/angular-19-zoneless-signal-cycle-guardrail?format=mdc","cursorrules":"/api/rules/angular-19-zoneless-signal-cycle-guardrail?format=cursor","windsurf":"/api/rules/angular-19-zoneless-signal-cycle-guardrail?format=windsurf","agents":"/api/rules/angular-19-zoneless-signal-cycle-guardrail?format=agents"}},{"id":"wasi-02-canonical-abi-boundary-guardrail","title":"WASI 0.2 Component Model Canonical ABI Boundary & Memory Isolation","category":"frontend","severity":"critical","description":"Enforces strict sandboxed linear memory isolation and deterministic Canonical ABI serialization across polyglot WebAssembly micro-frontends executing in browser runtimes. Prohibits manual guest memory manipulation, direct ArrayBuffer pointer passing, and out-of-band heap mutation in favor of type-safe WIT (WebAssembly Interface Type) lifting and lowering operations.","antiPatternHeadline":"Bypassing Canonical ABI via Manual Linear Memory Slicing and Raw Heap Allocation","stars_count":47,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","webassembly","wasi-0.2","component-model","canonical-abi","micro-frontends","wit"],"exportEndpoints":{"claude":"/api/rules/wasi-02-canonical-abi-boundary-guardrail?format=claude","cursorMdc":"/api/rules/wasi-02-canonical-abi-boundary-guardrail?format=mdc","cursorrules":"/api/rules/wasi-02-canonical-abi-boundary-guardrail?format=cursor","windsurf":"/api/rules/wasi-02-canonical-abi-boundary-guardrail?format=windsurf","agents":"/api/rules/wasi-02-canonical-abi-boundary-guardrail?format=agents"}},{"id":"swift-6-strict-concurrency-actor-bridge-guardrail","title":"Swift 6 Actor Isolation and Sendable Boundaries for Native Bridge Interfaces","category":"mobile","severity":"critical","description":"Enforces Swift 6 complete strict concurrency checking across native platform hardware listeners and hybrid cross-platform runtimes (React Native, Flutter, Kotlin Multiplatform). Eliminates thread sanitizer (TSan) race conditions by mandating Sendable DTOs and isolating native bridge modules to dedicated actors or @MainActor boundaries.","antiPatternHeadline":"Accessing Mutable Native Sensor and Bridge State Across Arbitrary Hardware Callback Queues","stars_count":45,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","swift6","concurrency","actors","sendable","react-native","flutter"],"exportEndpoints":{"claude":"/api/rules/swift-6-strict-concurrency-actor-bridge-guardrail?format=claude","cursorMdc":"/api/rules/swift-6-strict-concurrency-actor-bridge-guardrail?format=mdc","cursorrules":"/api/rules/swift-6-strict-concurrency-actor-bridge-guardrail?format=cursor","windsurf":"/api/rules/swift-6-strict-concurrency-actor-bridge-guardrail?format=windsurf","agents":"/api/rules/swift-6-strict-concurrency-actor-bridge-guardrail?format=agents"}},{"id":"android-15-16kb-page-alignment-invariant-android-15-16kb--630","title":"Android 15 16KB ELF & Memory Page Boundary Alignment Invariant","category":"mobile","severity":"critical","description":"Android 15 devices support 16KB physical memory page sizes to boost performance on modern ARM64 silicon. Shared libraries (.so) compiled with legacy 4KB ELF segment boundaries trigger fatal runtime dlopen errors or SIGBUS/SIGSEGV memory aborts. All NDK toolchains, linker scripts, packaging pipelines, and native memory management routines must explicitly guarantee 16KB page alignment.","antiPatternHeadline":"Hardcoded 4096-Byte Page Constants and Legacy 4KB ELF Segment Alignment in Native NDK Binaries","stars_count":50,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","android","ndk","android-15","cpp","cmake","memory-management"],"exportEndpoints":{"claude":"/api/rules/android-15-16kb-page-alignment-invariant-android-15-16kb--630?format=claude","cursorMdc":"/api/rules/android-15-16kb-page-alignment-invariant-android-15-16kb--630?format=mdc","cursorrules":"/api/rules/android-15-16kb-page-alignment-invariant-android-15-16kb--630?format=cursor","windsurf":"/api/rules/android-15-16kb-page-alignment-invariant-android-15-16kb--630?format=windsurf","agents":"/api/rules/android-15-16kb-page-alignment-invariant-android-15-16kb--630?format=agents"}},{"id":"ebpf-xdp-packet-memory-recycling-invariant","title":"eBPF XDP Native Driver Packet Memory Recycling and Descriptor Ring Preservation","category":"devops","severity":"critical","description":"Enforces zero-allocation packet recycling invariants within eBPF XDP programs on multi-tenant Kubernetes edge nodes during volumetric DDoS events. Guarantees that dropping or redirecting malicious ingress traffic recycles network device ring descriptors in driver mode (XDP_DRV) without SKB allocation or page pool starvation. Prevents softIRQ lockups and NIC RX/TX queue exhaustions across multi-gigabit and terabit bare-metal ingress fabrics.","antiPatternHeadline":"Falling Back to Generic XDP SKB Allocations and Unbounded Tail-Calls Under Volumetric Surges","stars_count":73,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","xdp","kubernetes","networking","ddos-mitigation","kernel"],"exportEndpoints":{"claude":"/api/rules/ebpf-xdp-packet-memory-recycling-invariant?format=claude","cursorMdc":"/api/rules/ebpf-xdp-packet-memory-recycling-invariant?format=mdc","cursorrules":"/api/rules/ebpf-xdp-packet-memory-recycling-invariant?format=cursor","windsurf":"/api/rules/ebpf-xdp-packet-memory-recycling-invariant?format=windsurf","agents":"/api/rules/ebpf-xdp-packet-memory-recycling-invariant?format=agents"}},{"id":"opentelemetry-arrow-columnar-compression-barrier","title":"OpenTelemetry Arrow Protocol Columnar Compression Stream Barrier Enforcement","category":"devops","severity":"critical","description":"Enforces rigid Apache Arrow columnar batching and dictionary barrier boundaries on distributed OpenTelemetry exporter pipelines. Prevents micro-batch dictionary fragmentation, eliminates multi-gigabyte egress bandwidth overhead, and prevents downstream collector memory blowups via deterministic memory-bounded Arrow stream frames.","antiPatternHeadline":"Micro-batching Raw OTLP Streams with Premature Flushes and Fragmented Columnar Dictionaries","stars_count":46,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","apache-arrow","grpc","compression","observability","performance"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-arrow-columnar-compression-barrier?format=claude","cursorMdc":"/api/rules/opentelemetry-arrow-columnar-compression-barrier?format=mdc","cursorrules":"/api/rules/opentelemetry-arrow-columnar-compression-barrier?format=cursor","windsurf":"/api/rules/opentelemetry-arrow-columnar-compression-barrier?format=windsurf","agents":"/api/rules/opentelemetry-arrow-columnar-compression-barrier?format=agents"}},{"id":"axum-tokio-cancellation-safe-state-guardrail","title":"Axum 0.8 Tokio Cancellation-Safe State Mutation Guardrail","category":"backend","severity":"critical","description":"Enforces asynchronous cancellation safety across Axum 0.8 request handlers running on Tokio runtimes. Guarantees that abruptly terminated HTTP/2 and HTTP/3 client streams (e.g., RST_STREAM frames) or client disconnects cannot interrupt intermediate async yield points inside critical state-machine updates, multi-step atomic operations, or non-atomic transaction sequences.","antiPatternHeadline":"Interrupted In-Flight Awaits Causing Partial Multi-Phase State Mutations and Leaked Resources Upon Client Disconnect","stars_count":59,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tokio","concurrency","cancellation-safety","http2","http3"],"exportEndpoints":{"claude":"/api/rules/axum-tokio-cancellation-safe-state-guardrail?format=claude","cursorMdc":"/api/rules/axum-tokio-cancellation-safe-state-guardrail?format=mdc","cursorrules":"/api/rules/axum-tokio-cancellation-safe-state-guardrail?format=cursor","windsurf":"/api/rules/axum-tokio-cancellation-safe-state-guardrail?format=windsurf","agents":"/api/rules/axum-tokio-cancellation-safe-state-guardrail?format=agents"}},{"id":"pg17-logical-replication-failover-slot-sync-fence","title":"PostgreSQL 17 Logical Replication Failover Slot Synchronization Fence Guardrail","category":"backend","severity":"critical","description":"Mandates that all logical replication slots consumed by CDC workers, event streamers, and subscribers in PostgreSQL 17+ HA clusters explicitly enable failover synchronization and enforce physical standby fencing. Prevents logical subscribers from advancing past unapplied physical replica WAL positions, eliminating consumer offset skips and silent data loss upon primary failover.","antiPatternHeadline":"Unfenced Logical Slot Creation and Unguarded CDC Streaming Leading to Post-Failover Split-Brain and Data Skipping","stars_count":103,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","logical-replication","high-availability","cdc","database-reliability"],"exportEndpoints":{"claude":"/api/rules/pg17-logical-replication-failover-slot-sync-fence?format=claude","cursorMdc":"/api/rules/pg17-logical-replication-failover-slot-sync-fence?format=mdc","cursorrules":"/api/rules/pg17-logical-replication-failover-slot-sync-fence?format=cursor","windsurf":"/api/rules/pg17-logical-replication-failover-slot-sync-fence?format=windsurf","agents":"/api/rules/pg17-logical-replication-failover-slot-sync-fence?format=agents"}},{"id":"openfga-graph-traversal-depth-and-cycle-ceiling","title":"OpenFGA 1.6 Deterministic Graph Traversal Depth and Cycle Ceiling Enforcement","category":"security","severity":"critical","description":"Enforces deterministic boundaries on OpenFGA authorization graph traversals to prevent algorithmic denial-of-service (Graph-DoS) from unbounded recursive relations and cyclic group hierarchies. Mandates schema-level cycle guards, bounded resolution node caps, contextual tuple limits, and fail-closed timeout policies across all Check and ListObjects query paths.","antiPatternHeadline":"Unbounded Recursive Relationship Evaluation Permitting Algorithmic Graph Traversal Denial-of-Service","stars_count":98,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","authorization","graph-dos","zanzibar","access-control"],"exportEndpoints":{"claude":"/api/rules/openfga-graph-traversal-depth-and-cycle-ceiling?format=claude","cursorMdc":"/api/rules/openfga-graph-traversal-depth-and-cycle-ceiling?format=mdc","cursorrules":"/api/rules/openfga-graph-traversal-depth-and-cycle-ceiling?format=cursor","windsurf":"/api/rules/openfga-graph-traversal-depth-and-cycle-ceiling?format=windsurf","agents":"/api/rules/openfga-graph-traversal-depth-and-cycle-ceiling?format=agents"}},{"id":"w3c-dbsc-hardware-key-invariant","title":"W3C DBSC Hardware-Bound Session Credential Verification","category":"security","severity":"critical","description":"Enforces strict W3C Device Bound Session Credentials (DBSC) protocol semantics to eradicate token theft and session hijacking. Requires edge and identity layers to bind short-lived session cookies directly to client TPM or Secure Enclave asymmetric key pairs, validating hardware-signed challenge-response proofs on session renewal and mutating authorization state.","antiPatternHeadline":"Trusting Bearer Session Cookies Without Cryptographic Proof of Device Key Possession","stars_count":97,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","dbsc","session-management","cryptography","zero-trust","tpm"],"exportEndpoints":{"claude":"/api/rules/w3c-dbsc-hardware-key-invariant?format=claude","cursorMdc":"/api/rules/w3c-dbsc-hardware-key-invariant?format=mdc","cursorrules":"/api/rules/w3c-dbsc-hardware-key-invariant?format=cursor","windsurf":"/api/rules/w3c-dbsc-hardware-key-invariant?format=windsurf","agents":"/api/rules/w3c-dbsc-hardware-key-invariant?format=agents"}},{"id":"fastapi-pep703-free-threaded-dependency-barrier","title":"FastAPI Free-Threaded (PEP 703) Async Dependency Concurrency Barrier","category":"backend","severity":"critical","description":"Enforces strict thread-safe isolation and synchronization barriers for FastAPI dependency providers and shared singletons operating under Python 3.13 free-threaded (nogil) runtimes. Without the Global Interpreter Lock, multi-threaded event loop worker topologies trigger data races, non-atomic cache updates, and memory corruption in mutable stateful dependencies.","antiPatternHeadline":"Unsynchronized Singleton State Mutation Across Multi-Threaded Free-Threaded Workers","stars_count":64,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","pep-703","nogil","concurrency","python-3.13"],"exportEndpoints":{"claude":"/api/rules/fastapi-pep703-free-threaded-dependency-barrier?format=claude","cursorMdc":"/api/rules/fastapi-pep703-free-threaded-dependency-barrier?format=mdc","cursorrules":"/api/rules/fastapi-pep703-free-threaded-dependency-barrier?format=cursor","windsurf":"/api/rules/fastapi-pep703-free-threaded-dependency-barrier?format=windsurf","agents":"/api/rules/fastapi-pep703-free-threaded-dependency-barrier?format=agents"}},{"id":"wasi-02-component-memory-fence-production-standard","title":"WASI 0.2 Canonical ABI Sandboxed Memory Boundary and Resource Fencing","category":"devops","severity":"critical","description":"Enforces strict memory isolation, resource pooling, and typed WIT (WebAssembly Interface Type) boundaries between host microservices and untrusted multi-tenant WASI 0.2 components. Prohibits direct linear memory pointer passing, unbounded host store growth, and out-of-band memory mutation across tenant contexts. Mandates deterministic memory caps, reentrancy guards, and epoch-based engine preemption.","antiPatternHeadline":"Bypassing WIT Canonical ABI via Raw Pointer Offsets and Shared Unbounded Stores","stars_count":41,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","wasm","wasi-0.2","wasmtime","sandboxing","security","multi-tenant"],"exportEndpoints":{"claude":"/api/rules/wasi-02-component-memory-fence-production-standard?format=claude","cursorMdc":"/api/rules/wasi-02-component-memory-fence-production-standard?format=mdc","cursorrules":"/api/rules/wasi-02-component-memory-fence-production-standard?format=cursor","windsurf":"/api/rules/wasi-02-component-memory-fence-production-standard?format=windsurf","agents":"/api/rules/wasi-02-component-memory-fence-production-standard?format=agents"}},{"id":"cmp-skiko-swapchain-memory-recycling-standard","title":"Compose Multiplatform 1.8 Skiko Swapchain Surface Recycling and Native GPU Handle Invariant","category":"mobile","severity":"critical","description":"Prevents unmanaged CAMetalLayer and Vulkan VkSurfaceKHR/VkSwapchainKHR handle leaks during rapid NavigationStack or backstack pops in Compose Multiplatform 1.8. Enforces deterministic tear-down of Skiko render delegates, off-screen backing texture recycling, and hardware vsync synchronization across iOS Metal and Android Vulkan backends. Ensures zero frame-pacing drops and eliminates native heap fragmentation caused by dangling GPU surface listeners during UI state transitions.","antiPatternHeadline":"Orphaned Skiko Metal/Vulkan Swapchain Allocations and Unsynchronized Surface Disposal During Screen Transitions","stars_count":56,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","compose-multiplatform","skiko","metal","vulkan","memory-management","gpu-surface"],"exportEndpoints":{"claude":"/api/rules/cmp-skiko-swapchain-memory-recycling-standard?format=claude","cursorMdc":"/api/rules/cmp-skiko-swapchain-memory-recycling-standard?format=mdc","cursorrules":"/api/rules/cmp-skiko-swapchain-memory-recycling-standard?format=cursor","windsurf":"/api/rules/cmp-skiko-swapchain-memory-recycling-standard?format=windsurf","agents":"/api/rules/cmp-skiko-swapchain-memory-recycling-standard?format=agents"}},{"id":"af-xdp-umem-fill-ring-starvation-guardrail","title":"AF_XDP Zero-Copy UMEM Fill Ring Watermark and Proactive Replenishment Invariant","category":"devops","severity":"critical","description":"Prevents catastrophic packet drops during line-rate network microbursts by coupling hardware RX descriptors directly to userspace ring allocations. Mandates proactive UMEM Fill Ring replenishment and invariant watermark enforcement prior to packet processing in AF_XDP zero-copy mode.","antiPatternHeadline":"Deferred or Post-Processing Fill Ring Replenishment Leading to Hardware RX Descriptor Starvation","stars_count":102,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","af-xdp","zero-copy","kernel","networking","high-performance"],"exportEndpoints":{"claude":"/api/rules/af-xdp-umem-fill-ring-starvation-guardrail?format=claude","cursorMdc":"/api/rules/af-xdp-umem-fill-ring-starvation-guardrail?format=mdc","cursorrules":"/api/rules/af-xdp-umem-fill-ring-starvation-guardrail?format=cursor","windsurf":"/api/rules/af-xdp-umem-fill-ring-starvation-guardrail?format=windsurf","agents":"/api/rules/af-xdp-umem-fill-ring-starvation-guardrail?format=agents"}},{"id":"otel-genai-token-backpressure-mesh","title":"OpenTelemetry GenAI Semantic Token Backpressure and Non-Severing Trace Mesh","category":"devops","severity":"critical","description":"High-throughput GenAI workloads emitting fine-grained semantic convention spans (e.g., gen_ai.usage.input_tokens, gen_ai.usage.output_tokens) can saturate collector pipelines and exhaust memory buffers. Telemetry backpressure must throttle or downsample semantic token telemetry without dropping or severing downstream W3C traceparent and tracestate contexts.","antiPatternHeadline":"Dropping or Early-Exiting Spans Under Token Saturation Severing Downstream W3C Trace Contexts","stars_count":47,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","genai","w3c-trace-context","backpressure","observability"],"exportEndpoints":{"claude":"/api/rules/otel-genai-token-backpressure-mesh?format=claude","cursorMdc":"/api/rules/otel-genai-token-backpressure-mesh?format=mdc","cursorrules":"/api/rules/otel-genai-token-backpressure-mesh?format=cursor","windsurf":"/api/rules/otel-genai-token-backpressure-mesh?format=windsurf","agents":"/api/rules/otel-genai-token-backpressure-mesh?format=agents"}},{"id":"next15-ppr-dynamic-io-boundary-invariant","title":"Next.js 15 Partial Prerendering (PPR) and Dynamic-IO Boundary Isolation","category":"frontend","severity":"critical","description":"Enforces strict isolation between static prerendered shell hierarchies and asynchronous dynamic I/O micro-tasks in Next.js 15. Prevents dynamic data APIs (cookies, headers, searchParams, uncached queries) from de-optimizing parent route shells into runtime SSR waterfalls. Mandates explicit React Suspense boundaries around all dynamic leaf nodes with synchronous, deterministic fallback skeletons.","antiPatternHeadline":"Unwrapped Dynamic API Invocation at Route Root De-optimizing Static Shells into Blocking SSR","stars_count":54,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs15","react19","ppr","dynamic-io","suspense","streaming"],"exportEndpoints":{"claude":"/api/rules/next15-ppr-dynamic-io-boundary-invariant?format=claude","cursorMdc":"/api/rules/next15-ppr-dynamic-io-boundary-invariant?format=mdc","cursorrules":"/api/rules/next15-ppr-dynamic-io-boundary-invariant?format=cursor","windsurf":"/api/rules/next15-ppr-dynamic-io-boundary-invariant?format=windsurf","agents":"/api/rules/next15-ppr-dynamic-io-boundary-invariant?format=agents"}},{"id":"pg17-failover-slot-sync-ha-replication","title":"PostgreSQL 17 Failover Slot Sync for HA Logical Replication Invariant","category":"backend","severity":"critical","description":"PostgreSQL 17 introduces synchronized failover replication slots that guarantee logical slots are preserved and updated across physical streaming standbys during unplanned failovers. Applications and change data capture (CDC) consumers must enforce failover-enabled logical slots tied to physical standby confirmation via synchronized slots, preventing consumer LSN rewind, ghost slot drop, and data divergence downstream.","antiPatternHeadline":"Unsynchronized Logical Slots on Primary Causing Silent Data Loss or Mass Duplicate Replay Post-Failover","stars_count":43,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","logical-replication","cdc","high-availability","database-failover"],"exportEndpoints":{"claude":"/api/rules/pg17-failover-slot-sync-ha-replication?format=claude","cursorMdc":"/api/rules/pg17-failover-slot-sync-ha-replication?format=mdc","cursorrules":"/api/rules/pg17-failover-slot-sync-ha-replication?format=cursor","windsurf":"/api/rules/pg17-failover-slot-sync-ha-replication?format=windsurf","agents":"/api/rules/pg17-failover-slot-sync-ha-replication?format=agents"}},{"id":"axum-08-tower-gradient-descent-concurrency-standard","title":"Axum 0.8 Tower Adaptive Concurrency Limit via Latency Gradient Descent","category":"backend","severity":"critical","description":"Mitigates systemic microservice tail-latency degradation and queue bufferbloat by dynamically shedding load according to client-observed RTT latency gradients rather than static concurrency caps. Enforces continuous baseline RTT calculation against smoothed moving-average latencies to throttle inflight request limits dynamically in Axum 0.8 services.","antiPatternHeadline":"Hardcoded Static Concurrency Limits Causing Cascading Bufferbloat and Latency Spikes","stars_count":53,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["rust","axum","tower","load-shedding","concurrency","microservices"],"exportEndpoints":{"claude":"/api/rules/axum-08-tower-gradient-descent-concurrency-standard?format=claude","cursorMdc":"/api/rules/axum-08-tower-gradient-descent-concurrency-standard?format=mdc","cursorrules":"/api/rules/axum-08-tower-gradient-descent-concurrency-standard?format=cursor","windsurf":"/api/rules/axum-08-tower-gradient-descent-concurrency-standard?format=windsurf","agents":"/api/rules/axum-08-tower-gradient-descent-concurrency-standard?format=agents"}},{"id":"go-chi-context-deadline-propagation-leak-prevention","title":"Go Chi Context-Tree Deadline Propagation & Goroutine Leak Guardrail","category":"backend","severity":"critical","description":"Enforces strict context tree inheritance and cancellation propagation across HTTP/2 and HTTP/3 Chi handlers to eliminate zombie goroutines. Guarantees client disconnects, socket resets, and stream cancellations cascade instantly to downstream I/O calls, while ensuring post-response tasks utilize explicit decoupled bounded workers instead of orphaned goroutines.","antiPatternHeadline":"Spawning Untracked Goroutines from Chi Handler Contexts Causing Zombie Sockets and Memory Leaks","stars_count":45,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","chi","concurrency","context","goroutine-leaks"],"exportEndpoints":{"claude":"/api/rules/go-chi-context-deadline-propagation-leak-prevention?format=claude","cursorMdc":"/api/rules/go-chi-context-deadline-propagation-leak-prevention?format=mdc","cursorrules":"/api/rules/go-chi-context-deadline-propagation-leak-prevention?format=cursor","windsurf":"/api/rules/go-chi-context-deadline-propagation-leak-prevention?format=windsurf","agents":"/api/rules/go-chi-context-deadline-propagation-leak-prevention?format=agents"}},{"id":"capacitor-7-swift-concurrency-actor-isolation","title":"Capacitor 7 Swift 6 Actor-Isolated Plugin Boundary","category":"mobile","severity":"critical","description":"Enforces complete Swift 6 actor-isolation and structured concurrency boundaries across all Capacitor 7 WKWebView IPC bridge calls. Eliminates MainActor thread starvation and data races by strictly partitioning synchronous bridge receipt from asynchronous actor execution, forbidding mutable CAPPluginCall reference escaping across isolation domains.","antiPatternHeadline":"Executing Blocking I/O Directly on MainActor Bridge Threads and Escaping Unchecked Plugin Call State","stars_count":89,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","swift6","concurrency","ios","wkwebview","actors"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-swift-concurrency-actor-isolation?format=claude","cursorMdc":"/api/rules/capacitor-7-swift-concurrency-actor-isolation?format=mdc","cursorrules":"/api/rules/capacitor-7-swift-concurrency-actor-isolation?format=cursor","windsurf":"/api/rules/capacitor-7-swift-concurrency-actor-isolation?format=windsurf","agents":"/api/rules/capacitor-7-swift-concurrency-actor-isolation?format=agents"}},{"id":"webauthn-largeblob-session-storage-standard","title":"WebAuthn LargeBlob Hardware-Attested Deterministic Session Storage","category":"security","severity":"critical","description":"Enforces hardware-bound session bootstrapping via the FIDO2 WebAuthn largeBlob extension. Mandates cryptographic verification, fail-closed authenticator support checks, and strict prohibition of plaintext credential caching in vulnerable storage layers such as localStorage or unencrypted IndexedDB.","antiPatternHeadline":"Falling back to insecure localStorage or plaintext client storage when WebAuthn largeBlob extension operations fail or are unsupported.","stars_count":80,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","fido2","cryptography","session-management","zero-trust"],"exportEndpoints":{"claude":"/api/rules/webauthn-largeblob-session-storage-standard?format=claude","cursorMdc":"/api/rules/webauthn-largeblob-session-storage-standard?format=mdc","cursorrules":"/api/rules/webauthn-largeblob-session-storage-standard?format=cursor","windsurf":"/api/rules/webauthn-largeblob-session-storage-standard?format=windsurf","agents":"/api/rules/webauthn-largeblob-session-storage-standard?format=agents"}},{"id":"openfga-modular-model-migration-semver-guardrail","title":"OpenFGA Modular Model Migration & Semantic Versioning Invariant","category":"security","severity":"critical","description":"Mandates deterministic, zero-downtime phased schema transitions for OpenFGA modular authorization models across distributed micro-domains. Enforces semantic versioning, strict Expand-Contract tuple migration pipelines, and explicit authorization_model_id pinning during live evaluations to prevent authorization bypass or denial-of-service during schema cutovers.","antiPatternHeadline":"Destructive In-Place Schema Updates and Unpinned Model Evaluations Triggering Authorization Failures","stars_count":111,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","rebac","openfga","authorization","schema-migration","distributed-systems"],"exportEndpoints":{"claude":"/api/rules/openfga-modular-model-migration-semver-guardrail?format=claude","cursorMdc":"/api/rules/openfga-modular-model-migration-semver-guardrail?format=mdc","cursorrules":"/api/rules/openfga-modular-model-migration-semver-guardrail?format=cursor","windsurf":"/api/rules/openfga-modular-model-migration-semver-guardrail?format=windsurf","agents":"/api/rules/openfga-modular-model-migration-semver-guardrail?format=agents"}},{"id":"ebpf-tc-ringbuf-drop-safe-telemetry","title":"eBPF TC Ring-Buffer Non-Blocking Drop-Safe Telemetry Pipeline Standard","category":"devops","severity":"critical","description":"Mandates zero-copy, non-blocking telemetry event streaming using kernel ring buffers (BPF_MAP_TYPE_RINGBUF) within Traffic Control (TC) hooks. Guarantees that packet ingestion and forwarding remain at line rate during telemetry buffer saturation by strictly isolating telemetry drops from network datapath verdicts.","antiPatternHeadline":"Stalling or dropping network packets and leaking ring buffer allocations during telemetry ring buffer exhaustion","stars_count":119,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","tc","networking","linux-kernel","performance"],"exportEndpoints":{"claude":"/api/rules/ebpf-tc-ringbuf-drop-safe-telemetry?format=claude","cursorMdc":"/api/rules/ebpf-tc-ringbuf-drop-safe-telemetry?format=mdc","cursorrules":"/api/rules/ebpf-tc-ringbuf-drop-safe-telemetry?format=cursor","windsurf":"/api/rules/ebpf-tc-ringbuf-drop-safe-telemetry?format=windsurf","agents":"/api/rules/ebpf-tc-ringbuf-drop-safe-telemetry?format=agents"}},{"id":"otel-ottl-in-flight-pii-redaction-standard","title":"OpenTelemetry OTTL In-Flight PII Redaction and Sanitization Guardrails","category":"devops","severity":"critical","description":"Enforces strict, deterministic OpenTelemetry Transformation Language (OTTL) statements within the collector transform processor to redact and hash sensitive telemetry attributes at ingestion. Guarantees regulatory compliance (GDPR, HIPAA, PCI-DSS) by scrubbing high-entropy credentials, tokens, session cookies, and personal identifiers before export into downline distributed trace and log backends without degrading collector throughput.","antiPatternHeadline":"Exporting Unscrubbed Telemetry Payloads or Relying on Client-Side Ad-Hoc Masking","stars_count":112,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","ottl","security","pii","observability","compliance"],"exportEndpoints":{"claude":"/api/rules/otel-ottl-in-flight-pii-redaction-standard?format=claude","cursorMdc":"/api/rules/otel-ottl-in-flight-pii-redaction-standard?format=mdc","cursorrules":"/api/rules/otel-ottl-in-flight-pii-redaction-standard?format=cursor","windsurf":"/api/rules/otel-ottl-in-flight-pii-redaction-standard?format=windsurf","agents":"/api/rules/otel-ottl-in-flight-pii-redaction-standard?format=agents"}},{"id":"nextjs-15-ppr-dynamic-anchor-isolation","title":"Next.js 15 Partial Prerendering (PPR) Dynamic Anchor Isolation Guardrail","category":"frontend","severity":"critical","description":"Enforces deterministic boundaries between static shell prerendering and dynamic streaming holes in Next.js 15 PPR architectures. Prevents accidental de-opt of static page shells, edge cache pollution, and hydration mismatch cascades caused by unisolated dynamic data reads (e.g., cookies, headers, dynamic searchParams) leaking into static ancestors.","antiPatternHeadline":"Dynamic Anchor Leakage Causing Shell De-optimization and Hydration Mismatches","stars_count":82,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs15","ppr","react-suspense","edge-caching","streaming"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-ppr-dynamic-anchor-isolation?format=claude","cursorMdc":"/api/rules/nextjs-15-ppr-dynamic-anchor-isolation?format=mdc","cursorrules":"/api/rules/nextjs-15-ppr-dynamic-anchor-isolation?format=cursor","windsurf":"/api/rules/nextjs-15-ppr-dynamic-anchor-isolation?format=windsurf","agents":"/api/rules/nextjs-15-ppr-dynamic-anchor-isolation?format=agents"}},{"id":"svelte-5-runes-reactive-graph-teardown-invariant","title":"Svelte 5 Runes Reactive Graph Cycle Detection and Teardown Invariant","category":"frontend","severity":"critical","description":"Enforces strict lifecycle boundaries and disposal invariants for Svelte 5 fine-grained reactive graphs across client-side SPA route transitions. Prohibits orphaned module-level $effect.root allocations and cyclic signal updates to prevent memory leaks and graph thrashing.","antiPatternHeadline":"Orphaned Module-Level Effect Roots and Self-Triggering Reactive Cycles in Svelte 5 Runes","stars_count":80,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","memory-leaks","signals","performance"],"exportEndpoints":{"claude":"/api/rules/svelte-5-runes-reactive-graph-teardown-invariant?format=claude","cursorMdc":"/api/rules/svelte-5-runes-reactive-graph-teardown-invariant?format=mdc","cursorrules":"/api/rules/svelte-5-runes-reactive-graph-teardown-invariant?format=cursor","windsurf":"/api/rules/svelte-5-runes-reactive-graph-teardown-invariant?format=windsurf","agents":"/api/rules/svelte-5-runes-reactive-graph-teardown-invariant?format=agents"}},{"id":"axum-cancellation-safe-transactions","title":"Axum 0.8 Cancellation-Safe Transaction Lifecycle & Pool Starvation Prevention","category":"backend","severity":"critical","description":"Enforces strict cancellation safety invariants for database transactions in Axum 0.8 handlers under Tokio task abortion. Mandates atomic commit boundaries, isolated execution shields for non-idempotent mutations, and prohibits holding open transactions across unshielded external async yield points to eliminate connection pool starvation and orphaned locks.","antiPatternHeadline":"Holding Database Transactions Across Arbitrary Async Yield Points Subject to Abrupt TCP Client Drops","stars_count":109,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tokio","sqlx","concurrency","database"],"exportEndpoints":{"claude":"/api/rules/axum-cancellation-safe-transactions?format=claude","cursorMdc":"/api/rules/axum-cancellation-safe-transactions?format=mdc","cursorrules":"/api/rules/axum-cancellation-safe-transactions?format=cursor","windsurf":"/api/rules/axum-cancellation-safe-transactions?format=windsurf","agents":"/api/rules/axum-cancellation-safe-transactions?format=agents"}},{"id":"bun-worker-zero-copy-transfer-protocol","title":"Bun 1.2 Native Worker Zero-Copy ArrayBuffer Transfer Protocol","category":"backend","severity":"critical","description":"Mandates strict zero-copy ownership transfer of high-volume binary payloads between Bun native threads via ArrayBuffer transfer lists. Eliminates structured clone serialization overhead and memory duplication in compute-heavy background tasks. Requires immediate post-transfer validation to guard against use-after-transfer detached buffer access.","antiPatternHeadline":"Implicit Structured Cloning of TypedArrays Across Bun Worker Boundaries Causing Latency Spikes and Double-Memory Footprints","stars_count":61,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","web-workers","zero-copy","typedarray","performance"],"exportEndpoints":{"claude":"/api/rules/bun-worker-zero-copy-transfer-protocol?format=claude","cursorMdc":"/api/rules/bun-worker-zero-copy-transfer-protocol?format=mdc","cursorrules":"/api/rules/bun-worker-zero-copy-transfer-protocol?format=cursor","windsurf":"/api/rules/bun-worker-zero-copy-transfer-protocol?format=windsurf","agents":"/api/rules/bun-worker-zero-copy-transfer-protocol?format=agents"}},{"id":"kmp-swift-export-concurrency-isolation-standard","title":"Kotlin 2.1 Swift Export and Swift 6 Actor Boundary Isolation","category":"mobile","severity":"critical","description":"Enforces strict isolation boundaries and execution context affinity when bridging Kotlin Multiplatform (KMP) 2.1 Swift Export coroutine primitives into native Swift 6 Actor environments. Prevents cross-runtime thread pool corruption, un-isolated data races, and Swift 6 Sendable conformance violations by mandating disciplined AsyncStream transformations and explicit MainActor context dispatching.","antiPatternHeadline":"Leaking unconfined Kotlin coroutine jobs or un-isolated Flow collectors directly into Swift 6 actors, triggering silent data races and thread-pool deadlock.","stars_count":97,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","swift6","concurrency","coroutines","actors"],"exportEndpoints":{"claude":"/api/rules/kmp-swift-export-concurrency-isolation-standard?format=claude","cursorMdc":"/api/rules/kmp-swift-export-concurrency-isolation-standard?format=mdc","cursorrules":"/api/rules/kmp-swift-export-concurrency-isolation-standard?format=cursor","windsurf":"/api/rules/kmp-swift-export-concurrency-isolation-standard?format=windsurf","agents":"/api/rules/kmp-swift-export-concurrency-isolation-standard?format=agents"}},{"id":"capacitor-7-background-task-budgeting-wakelock-guardrails","title":"Capacitor 7 Background Task Budgeting and WakeLock Enforcement","category":"mobile","severity":"critical","description":"Enforces deterministic execution timeout fences and OS power governor compliance across iOS (BackgroundTasks/beginBackgroundTask) and Android (WorkManager/Doze Mode) in Capacitor 7. Mandates strict task budgeting fences (sub-25s on iOS), infallible completion handler dispatch via try/finally blocks, and idempotent Screen/CPU WakeLock acquisition-release cycles to prevent SIGKILL 0x8badf00d watchdog crashes and battery governor bans.","antiPatternHeadline":"Unbounded Background Tasks and Leaked WakeLocks Triggering OS Watchdog Terminations","stars_count":117,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","ios","android","wakelock","background-tasks","battery-governor"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-background-task-budgeting-wakelock-guardrails?format=claude","cursorMdc":"/api/rules/capacitor-7-background-task-budgeting-wakelock-guardrails?format=mdc","cursorrules":"/api/rules/capacitor-7-background-task-budgeting-wakelock-guardrails?format=cursor","windsurf":"/api/rules/capacitor-7-background-task-budgeting-wakelock-guardrails?format=windsurf","agents":"/api/rules/capacitor-7-background-task-budgeting-wakelock-guardrails?format=agents"}},{"id":"webauthn-conditional-ui-abortcontroller-standard","title":"WebAuthn Conditional Mediation AbortController Lifecycle Standard","category":"security","severity":"critical","description":"Enforces deterministic cancellation and resource cleanup for ambient WebAuthn Conditional UI (autofill) credential requests. Prevents DOMException InvalidStateError collisions, UI thread deadlocks, and race conditions when users switch from autofill to explicit modal authentication flows or navigate away.","antiPatternHeadline":"Uncontrolled Ambient WebAuthn Autofill Blocking Explicit Modal Authentication Invocations","stars_count":91,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","passkeys","abort-controller","conditional-ui","authentication"],"exportEndpoints":{"claude":"/api/rules/webauthn-conditional-ui-abortcontroller-standard?format=claude","cursorMdc":"/api/rules/webauthn-conditional-ui-abortcontroller-standard?format=mdc","cursorrules":"/api/rules/webauthn-conditional-ui-abortcontroller-standard?format=cursor","windsurf":"/api/rules/webauthn-conditional-ui-abortcontroller-standard?format=windsurf","agents":"/api/rules/webauthn-conditional-ui-abortcontroller-standard?format=agents"}},{"id":"ebpf-xdp-ratelimit-map-sync-guardrail","title":"eBPF XDP Line-Rate Rate-Limiting & Lockless Map Invariants","category":"devops","severity":"critical","description":"Enforces lockless eBPF LRU/Per-CPU map synchronization and atomic token bucket rate-limiting at the XDP driver hook to preserve host kernel CPU headroom during volumetric L4 DDoS attacks. Prohibits global spinlocks, non-per-cpu allocations, and blocking user-space batch synchronization operations that induce softirq tail drops.","antiPatternHeadline":"Global BPF Hash Map Mutations Under Volumetric L4 Ingress Inducing Softirq Saturation and Driver Ring Buffer Drops","stars_count":58,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","xdp","ddos-mitigation","networking","kernel","c"],"exportEndpoints":{"claude":"/api/rules/ebpf-xdp-ratelimit-map-sync-guardrail?format=claude","cursorMdc":"/api/rules/ebpf-xdp-ratelimit-map-sync-guardrail?format=mdc","cursorrules":"/api/rules/ebpf-xdp-ratelimit-map-sync-guardrail?format=cursor","windsurf":"/api/rules/ebpf-xdp-ratelimit-map-sync-guardrail?format=windsurf","agents":"/api/rules/ebpf-xdp-ratelimit-map-sync-guardrail?format=agents"}},{"id":"otel-baggage-cardinality-budget-sanitization","title":"OpenTelemetry Context Baggage Cardinality Budget and Sanitization Standard","category":"devops","severity":"critical","description":"Enforces strict entry limits, byte-size budgets, and key/value sanitization on OpenTelemetry Baggage across distributed service boundaries. Uncontrolled context propagation leads to HTTP 431 Request Header Fields Too Large errors, downstream edge gateway drops, and downstream telemetry storage cost explosions. All distributed context mutations must undergo schema validation, length truncation, and allowlist filtering before propagation.","antiPatternHeadline":"Unbounded Context Injection of Raw Customer Payloads and High-Cardinality Identifiers into W3C Baggage Headers","stars_count":59,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","observability","distributed-tracing","tracing","security"],"exportEndpoints":{"claude":"/api/rules/otel-baggage-cardinality-budget-sanitization?format=claude","cursorMdc":"/api/rules/otel-baggage-cardinality-budget-sanitization?format=mdc","cursorrules":"/api/rules/otel-baggage-cardinality-budget-sanitization?format=cursor","windsurf":"/api/rules/otel-baggage-cardinality-budget-sanitization?format=windsurf","agents":"/api/rules/otel-baggage-cardinality-budget-sanitization?format=agents"}},{"id":"react-19-server-action-idempotency-protocol","title":"React 19 Server Action Idempotency & Replay-Resilience Protocol","category":"frontend","severity":"critical","description":"Enforces client-originated idempotency tokens and atomic server-side deduplication for all mutating React 19 Server Actions. Guarantees strictly-once execution during transient network retries and optimistic UI reconciliation across useActionState and useOptimistic transitions.","antiPatternHeadline":"Server-Generated Keys and Naked Mutations Causing Duplicate Side-Effects and Phantom Re-executions","stars_count":44,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["react-19","server-actions","idempotency","useActionState","useOptimistic","distributed-systems"],"exportEndpoints":{"claude":"/api/rules/react-19-server-action-idempotency-protocol?format=claude","cursorMdc":"/api/rules/react-19-server-action-idempotency-protocol?format=mdc","cursorrules":"/api/rules/react-19-server-action-idempotency-protocol?format=cursor","windsurf":"/api/rules/react-19-server-action-idempotency-protocol?format=windsurf","agents":"/api/rules/react-19-server-action-idempotency-protocol?format=agents"}},{"id":"wasm-component-model-mfe-isolation-standard","title":"Wasm Component Model (WASI 0.2) Micro-Frontend Sandbox Isolation Standard","category":"frontend","severity":"critical","description":"Enforces strict linear-memory isolation and capability-attenuated WIT (WebAssembly Interface Type) host bindings for untrusted third-party micro-frontend UI widgets. Eliminates iframe DOM overhead while preventing untrusted code from accessing ambient globals, raw DOM handles, or host process memory. Mandates the use of the canonical ABI for structured UI rendering events over unidirectional virtual command buffers.","antiPatternHeadline":"Leaking Ambient DOM Handles and Unattenuated Host Capabilities to Untrusted Wasm Micro-Frontends","stars_count":55,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","wasm","component-model","wasi-0-2","micro-frontends","security-sandboxing"],"exportEndpoints":{"claude":"/api/rules/wasm-component-model-mfe-isolation-standard?format=claude","cursorMdc":"/api/rules/wasm-component-model-mfe-isolation-standard?format=mdc","cursorrules":"/api/rules/wasm-component-model-mfe-isolation-standard?format=cursor","windsurf":"/api/rules/wasm-component-model-mfe-isolation-standard?format=windsurf","agents":"/api/rules/wasm-component-model-mfe-isolation-standard?format=agents"}},{"id":"axum-08-tower-cancellation-abort-drain","title":"Axum 0.8 Request Cancellation Propagation & Client Disconnect Abort Drain","category":"backend","severity":"critical","description":"Mandates that Axum 0.8 request handlers, Tower middleware, and downstream database operations strictly honor HTTP/2 and HTTP/3 RST_STREAM disconnect signals. Prevents compute leaks, database connection pool starvation, and phantom transactional writes by enforcing Tokio cancellation propagation and RAII rollback semantics.","antiPatternHeadline":"Spawning Unlinked Background Tasks and Ignoring Stream Teardown in Long-Running Handlers","stars_count":71,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tower","tokio","sqlx","http2"],"exportEndpoints":{"claude":"/api/rules/axum-08-tower-cancellation-abort-drain?format=claude","cursorMdc":"/api/rules/axum-08-tower-cancellation-abort-drain?format=mdc","cursorrules":"/api/rules/axum-08-tower-cancellation-abort-drain?format=cursor","windsurf":"/api/rules/axum-08-tower-cancellation-abort-drain?format=windsurf","agents":"/api/rules/axum-08-tower-cancellation-abort-drain?format=agents"}},{"id":"bun-sqlite-wal-concurrency-fence","title":"Bun 1.2 Native SQLite WAL Read-Write Concurrency Fence & Checkpoint Isolation","category":"backend","severity":"critical","description":"Enforces strict architectural isolation between a single serialized writer connection and pooled read-only instances in Bun 1.2's native sqlite engine. Mandates WAL journal mode, explicit busy timeouts, synchronized normal durability, and non-blocking passive checkpointing to prevent MMAP thrashing, thread starvation, and SQLITE_BUSY deadlocks during high-throughput edge cache persistence.","antiPatternHeadline":"Shared Read-Write Database Handles with Default Rollback Journaling and Unfenced Checkpoints Stalling Event Loops","stars_count":87,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","sqlite","wal","concurrency","performance"],"exportEndpoints":{"claude":"/api/rules/bun-sqlite-wal-concurrency-fence?format=claude","cursorMdc":"/api/rules/bun-sqlite-wal-concurrency-fence?format=mdc","cursorrules":"/api/rules/bun-sqlite-wal-concurrency-fence?format=cursor","windsurf":"/api/rules/bun-sqlite-wal-concurrency-fence?format=windsurf","agents":"/api/rules/bun-sqlite-wal-concurrency-fence?format=agents"}},{"id":"go-chi-context-pool-zero-alloc-propagation","title":"Go Chi Context Pool Zero-Allocation Propagation Standard","category":"backend","severity":"critical","description":"Enforces zero-allocation context propagation across Go Chi edge routers by recycling route context structs and custom trace/deadline carriers via sync.Pool. Eliminates heap allocations during high-frequency extraction and injection of OpenTelemetry spans and downstream timeout metadata under high RPS loads.","antiPatternHeadline":"Chaining context.WithValue and re-allocating chi.Context wrappers on edge router request paths","stars_count":64,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","golang","chi","opentelemetry","zero-allocation","performance"],"exportEndpoints":{"claude":"/api/rules/go-chi-context-pool-zero-alloc-propagation?format=claude","cursorMdc":"/api/rules/go-chi-context-pool-zero-alloc-propagation?format=mdc","cursorrules":"/api/rules/go-chi-context-pool-zero-alloc-propagation?format=cursor","windsurf":"/api/rules/go-chi-context-pool-zero-alloc-propagation?format=windsurf","agents":"/api/rules/go-chi-context-pool-zero-alloc-propagation?format=agents"}},{"id":"kmp-native-flow-backpressure-fence","title":"KMP 2.1 Native Flow Backpressure & Memory Bounding Across Swift Runtime Boundary","category":"mobile","severity":"critical","description":"Enforces deterministic backpressure and bounded native buffer allocation when streaming high-throughput Kotlin Coroutines Flow instances across the Kotlin/Native Objective-C bridge to Swift. Prevents unmanaged native memory runaway and thread exhaustion caused by unbounded queueing across foreign function interfaces (FFI). Eliminates silent OOM crashes on iOS by mandating explicit suspension fences, buffer caps, and lifecycle-bound cancellation propagation.","antiPatternHeadline":"Unbounded Direct Flow Bridging Inducing Native Heap Bloat and Swift Task Desynchronization","stars_count":74,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kmp","kotlin-native","swift","coroutines","flow","backpressure","memory-management"],"exportEndpoints":{"claude":"/api/rules/kmp-native-flow-backpressure-fence?format=claude","cursorMdc":"/api/rules/kmp-native-flow-backpressure-fence?format=mdc","cursorrules":"/api/rules/kmp-native-flow-backpressure-fence?format=cursor","windsurf":"/api/rules/kmp-native-flow-backpressure-fence?format=windsurf","agents":"/api/rules/kmp-native-flow-backpressure-fence?format=agents"}},{"id":"oidc-caep-realtime-revocation-engine","title":"OpenID Shared Signals and Events (SSE) CAEP Sub-Second Revocation Guardrail","category":"security","severity":"critical","description":"Enforces deterministic, replay-resistant processing of Continuous Access Evaluation Profile (CAEP) and Shared Signals and Events (SSE) Security Event Tokens (SET). Mandates asynchronous push/pull SET ingestion, cryptographic verification via transmitter metadata, distributed low-latency revocation broadcasts (e.g., Redis Pub/Sub / Kafka), and local in-memory token cache purging across federated microservices within sub-second SLAs.","antiPatternHeadline":"Trusting Stateless JWT Expiry and Polling IdPs Without Fast-Path Invalidation","stars_count":49,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","oidc","caep","shared-signals","zero-trust","token-revocation","jwt"],"exportEndpoints":{"claude":"/api/rules/oidc-caep-realtime-revocation-engine?format=claude","cursorMdc":"/api/rules/oidc-caep-realtime-revocation-engine?format=mdc","cursorrules":"/api/rules/oidc-caep-realtime-revocation-engine?format=cursor","windsurf":"/api/rules/oidc-caep-realtime-revocation-engine?format=windsurf","agents":"/api/rules/oidc-caep-realtime-revocation-engine?format=agents"}},{"id":"confidential-computing-attestation-gate-production-standard","title":"Confidential Enclave Hardware Attestation and Measurement Verification Gate","category":"security","severity":"critical","description":"Cryptographically validates AMD SEV-SNP or Intel TDX hardware attestation evidence against vendor roots of trust and immutable workload launch measurements prior to provisioning production secrets. Mandates strict freshness nonce verification and ephemeral key-binding (ReportData) to prevent replay attacks and rogue pod impersonation.","antiPatternHeadline":"Trusting In-Memory Enclave Identity Without Cryptographic Measurement Validation and Freshness Nonces","stars_count":67,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","confidential-computing","sev-snp","intel-tdx","attestation","zero-trust","cryptography"],"exportEndpoints":{"claude":"/api/rules/confidential-computing-attestation-gate-production-standard?format=claude","cursorMdc":"/api/rules/confidential-computing-attestation-gate-production-standard?format=mdc","cursorrules":"/api/rules/confidential-computing-attestation-gate-production-standard?format=cursor","windsurf":"/api/rules/confidential-computing-attestation-gate-production-standard?format=windsurf","agents":"/api/rules/confidential-computing-attestation-gate-production-standard?format=agents"}},{"id":"otel-span-event-backpressure-circuit-breaker","title":"Deterministic Span-Event Throttling and Memory Circuit-Breakers for Telemetry Pipelines","category":"devops","severity":"critical","description":"Enforces strict cardinality ceilings, attribute size truncation, and memory circuit-breakers on structured OpenTelemetry span events. Prevents client-side heap exhaustion and cascading collector Out-Of-Memory (OOM) crashes during severe telemetry volume bursts and recursive error loops.","antiPatternHeadline":"Unbounded span.addEvent invocations within tight loops emitting deep unindexed objects without backpressure","stars_count":97,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","observability","distributed-tracing","backpressure","resilience"],"exportEndpoints":{"claude":"/api/rules/otel-span-event-backpressure-circuit-breaker?format=claude","cursorMdc":"/api/rules/otel-span-event-backpressure-circuit-breaker?format=mdc","cursorrules":"/api/rules/otel-span-event-backpressure-circuit-breaker?format=cursor","windsurf":"/api/rules/otel-span-event-backpressure-circuit-breaker?format=windsurf","agents":"/api/rules/otel-span-event-backpressure-circuit-breaker?format=agents"}},{"id":"nextjs-15-ppr-boundary-validation","title":"Next.js 15 Partial Prerendering (PPR) Dynamic Boundary and Fallback Isolation","category":"frontend","severity":"critical","description":"Mandates strict boundary encapsulation and pure static fallbacks for dynamic operations in Next.js 15 Partial Prerendering (PPR) routes. Prevents dynamic API calls like cookies(), headers(), and uncached I/O from bailing out static shell prerendering and de-optimizing edge cache hit ratios.","antiPatternHeadline":"Unbounded Dynamic API Invocations Triggering Global SSR Bailouts on Static Edge Shells","stars_count":46,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["nextjs","nextjs-15","ppr","react-server-components","suspense","edge-caching","performance"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-ppr-boundary-validation?format=claude","cursorMdc":"/api/rules/nextjs-15-ppr-boundary-validation?format=mdc","cursorrules":"/api/rules/nextjs-15-ppr-boundary-validation?format=cursor","windsurf":"/api/rules/nextjs-15-ppr-boundary-validation?format=windsurf","agents":"/api/rules/nextjs-15-ppr-boundary-validation?format=agents"}},{"id":"bun-websocket-hibernation-backpressure-control","title":"Bun 1.2 Native WebSocket Hibernation and Kernel-Level Backpressure Management","category":"backend","severity":"critical","description":"Enforces memory-safe WebSocket handling in Bun 1.2+ using native socket hibernation and kernel-level backpressure control. Sockets must never be retained in JavaScript heap structures, and egress message streaming must respect socket buffer thresholds and the native drain lifecycle to sustain millions of concurrent connections with near-zero idle resident memory footprint.","antiPatternHeadline":"Retaining ServerWebSocket references in heap collections and dispatching egress messages without drain backpressure handling.","stars_count":72,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","websockets","backpressure","hibernation","zero-copy"],"exportEndpoints":{"claude":"/api/rules/bun-websocket-hibernation-backpressure-control?format=claude","cursorMdc":"/api/rules/bun-websocket-hibernation-backpressure-control?format=mdc","cursorrules":"/api/rules/bun-websocket-hibernation-backpressure-control?format=cursor","windsurf":"/api/rules/bun-websocket-hibernation-backpressure-control?format=windsurf","agents":"/api/rules/bun-websocket-hibernation-backpressure-control?format=agents"}},{"id":"fido2-ror-cross-platform-origin-isolation-standard","title":"FIDO2 Related Origin Requests (ROR) Cross-Platform Isolation Guardrails","category":"security","severity":"critical","description":"Enforces strict cryptographic origin binding and bidirectional verification for WebAuthn Related Origin Requests (ROR) across federated web origins and native mobile applications. Mandates mutual verification via canonical manifests (/.well-known/webauthn, assetlinks.json, apple-app-site-association) with zero tolerance for origin relaxation, preventing subdomain credential hijacking in federated architectures.","antiPatternHeadline":"Unvalidated Cross-Subdomain WebAuthn Acceptance and Dynamic rpId Reflection","stars_count":72,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","fido2","webauthn","related-origin-requests","ror","app-isolation"],"exportEndpoints":{"claude":"/api/rules/fido2-ror-cross-platform-origin-isolation-standard?format=claude","cursorMdc":"/api/rules/fido2-ror-cross-platform-origin-isolation-standard?format=mdc","cursorrules":"/api/rules/fido2-ror-cross-platform-origin-isolation-standard?format=cursor","windsurf":"/api/rules/fido2-ror-cross-platform-origin-isolation-standard?format=windsurf","agents":"/api/rules/fido2-ror-cross-platform-origin-isolation-standard?format=agents"}},{"id":"bpf-lsm-kernel-mandatory-access-control","title":"Kernel-Space Mandatory Access Control via BPF-LSM Hooks for Rootless Containers","category":"devops","severity":"critical","description":"Enforce mandatory access control synchronously in kernel space using BPF-LSM hooks rather than asynchronous user-space security telemetry or seccomp-filter user notifications. Guarantees immutable, race-free boundary defense against privilege escalation, unauthorized binary execution, and capability manipulation within rootless container cgroups.","antiPatternHeadline":"Relying on Asynchronous User-Space Daemons or Tracepoints for Container Execution Blocking","stars_count":101,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","bpf-lsm","linux-security","containers","kernel"],"exportEndpoints":{"claude":"/api/rules/bpf-lsm-kernel-mandatory-access-control?format=claude","cursorMdc":"/api/rules/bpf-lsm-kernel-mandatory-access-control?format=mdc","cursorrules":"/api/rules/bpf-lsm-kernel-mandatory-access-control?format=cursor","windsurf":"/api/rules/bpf-lsm-kernel-mandatory-access-control?format=windsurf","agents":"/api/rules/bpf-lsm-kernel-mandatory-access-control?format=agents"}},{"id":"tauri-2-granular-capability-permission-scoping","title":"Tauri 2.0 Granular Capability Permission Scoping & IPC Isolation","category":"mobile","severity":"critical","description":"Enforces compile-time privilege minimization and scoped IPC boundaries across native plugins to completely block arbitrary command execution from webviews. Tauri 2.0 capability manifests must restrict plugin commands to discrete JSON schema-validated scopes, rejecting wildcard permissions and monolithic execution contexts. All IPC invocations on iOS and Android targets must validate parameter schemas and origin contexts to prevent privilege escalation via webview compromise.","antiPatternHeadline":"Monolithic Capability Wildcarding and Unscoped Native IPC Execution","stars_count":115,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri-2","security","ipc","rust","permissions"],"exportEndpoints":{"claude":"/api/rules/tauri-2-granular-capability-permission-scoping?format=claude","cursorMdc":"/api/rules/tauri-2-granular-capability-permission-scoping?format=mdc","cursorrules":"/api/rules/tauri-2-granular-capability-permission-scoping?format=cursor","windsurf":"/api/rules/tauri-2-granular-capability-permission-scoping?format=windsurf","agents":"/api/rules/tauri-2-granular-capability-permission-scoping?format=agents"}},{"id":"axum-08-cancellation-safe-streaming-pipeline-standard","title":"Axum 0.8 Cancellation-Safe Streaming Pipeline Standard","category":"backend","severity":"critical","description":"Axum request futures are dropped immediately at the nearest yield point when a client terminates the connection. Streaming upload pipelines must bind all intermediate resources to deterministic RAII rollback guards to eliminate orphaned temporary files and leaked file descriptors upon mid-stream aborts.","antiPatternHeadline":"Orphaned Partial Files and Leaked File Descriptors via Naked Async File Writes During Premature Client Disconnection","stars_count":113,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tokio","async-cancellation","streaming"],"exportEndpoints":{"claude":"/api/rules/axum-08-cancellation-safe-streaming-pipeline-standard?format=claude","cursorMdc":"/api/rules/axum-08-cancellation-safe-streaming-pipeline-standard?format=mdc","cursorrules":"/api/rules/axum-08-cancellation-safe-streaming-pipeline-standard?format=cursor","windsurf":"/api/rules/axum-08-cancellation-safe-streaming-pipeline-standard?format=windsurf","agents":"/api/rules/axum-08-cancellation-safe-streaming-pipeline-standard?format=agents"}},{"id":"otel-tracestate-cryptographic-tenant-attestation","title":"OpenTelemetry TraceState Cryptographic Tenant Attestation in Zero-Trust Meshes","category":"devops","severity":"critical","description":"Enforces cryptographic signing and verification of multi-tenant identifiers inside the W3C TraceState header across distributed service boundaries. Prevents cross-tenant telemetry injection, log poisoning, and unauthorized trace spoofing by mandating HMAC-SHA256/Ed25519 payload signatures verified during W3C context propagation.","antiPatternHeadline":"Trusting Raw Mutable TraceState Tenant Identifiers Without In-Mesh Cryptographic Attestation","stars_count":101,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","distributed-tracing","zero-trust","security","multi-tenancy"],"exportEndpoints":{"claude":"/api/rules/otel-tracestate-cryptographic-tenant-attestation?format=claude","cursorMdc":"/api/rules/otel-tracestate-cryptographic-tenant-attestation?format=mdc","cursorrules":"/api/rules/otel-tracestate-cryptographic-tenant-attestation?format=cursor","windsurf":"/api/rules/otel-tracestate-cryptographic-tenant-attestation?format=windsurf","agents":"/api/rules/otel-tracestate-cryptographic-tenant-attestation?format=agents"}},{"id":"openfga-temporal-tuple-lifecycle-guardrail","title":"OpenFGA Temporal Relationship Tuple Lifecycle and Eviction Invariant","category":"security","severity":"critical","description":"Enforces strict CEL conditional time-to-live (TTL) validation and automated tombstone eviction on time-bound OpenFGA authorization tuples. Eliminates privilege creep and unbounded graph degradation by mandating server-authoritative context evaluation at check time alongside active background compaction.","antiPatternHeadline":"Dangling Temporal Tuples and Context-Free Authorization Checks Enabling Privilege Creep","stars_count":80,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","rebac","authorization","temporal-tuples","zero-trust"],"exportEndpoints":{"claude":"/api/rules/openfga-temporal-tuple-lifecycle-guardrail?format=claude","cursorMdc":"/api/rules/openfga-temporal-tuple-lifecycle-guardrail?format=mdc","cursorrules":"/api/rules/openfga-temporal-tuple-lifecycle-guardrail?format=cursor","windsurf":"/api/rules/openfga-temporal-tuple-lifecycle-guardrail?format=windsurf","agents":"/api/rules/openfga-temporal-tuple-lifecycle-guardrail?format=agents"}},{"id":"react-19-async-context-suspension-boundary-standard","title":"React 19 Async Context Propagation and Suspension Boundary Standard","category":"frontend","severity":"critical","description":"Enforces request-scoped promise memoization and granular suspension boundary hierarchy when consuming asynchronous resources via the React 19 use() API in SSR environments. Prevents unmemoized promise re-allocations on re-render ticks from creating infinite suspension loops, stream stalls, and Node.js thread-pool exhaustion.","antiPatternHeadline":"Instantiating Uncached Promises Inline in Component Trees Consumed via use() During SSR Streaming","stars_count":96,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react19","ssr","streaming","suspense","performance"],"exportEndpoints":{"claude":"/api/rules/react-19-async-context-suspension-boundary-standard?format=claude","cursorMdc":"/api/rules/react-19-async-context-suspension-boundary-standard?format=mdc","cursorrules":"/api/rules/react-19-async-context-suspension-boundary-standard?format=cursor","windsurf":"/api/rules/react-19-async-context-suspension-boundary-standard?format=windsurf","agents":"/api/rules/react-19-async-context-suspension-boundary-standard?format=agents"}},{"id":"capacitor-7-hardware-biometric-keystore-attestation-standard","title":"Capacitor 7 Hardware-Backed Biometric Keystore Attestation Standard","category":"mobile","severity":"critical","description":"Mandates that webview-to-native IPC calls for privileged cryptographic operations, authorization, and sensitive transaction signing authenticate against hardware Enclave-backed keys rather than relying on software-level session tokens or bypassable boolean biometric checks. Protects against webview XSS, runtime injection, and bridge replay attacks by enforcing secure hardware asymmetric signature assertions on server-issued challenges.","antiPatternHeadline":"Trusting Webview Boolean Biometric Prompts and In-Memory Bearer Tokens for High-Privilege Native Bridge Operations","stars_count":73,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","biometrics","secure-enclave","keystore","attestation","webcrypto","security"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-hardware-biometric-keystore-attestation-standard?format=claude","cursorMdc":"/api/rules/capacitor-7-hardware-biometric-keystore-attestation-standard?format=mdc","cursorrules":"/api/rules/capacitor-7-hardware-biometric-keystore-attestation-standard?format=cursor","windsurf":"/api/rules/capacitor-7-hardware-biometric-keystore-attestation-standard?format=windsurf","agents":"/api/rules/capacitor-7-hardware-biometric-keystore-attestation-standard?format=agents"}},{"id":"oauth-dpop-nonce-synchronization-invariant","title":"OAuth 2.1 DPoP Client Key-Pair Binding and Distributed Nonce Synchronization","category":"security","severity":"critical","description":"Enforces cryptographically bound DPoP (RFC 9449) proof generation and automatic reactive nonce synchronization across all HTTP client requests. Guarantees that bearer tokens are bound to client-managed asymmetric key pairs and resilient against 'use_dpop_nonce' rejections across distributed multi-region edge gateways. Eliminates token replay vulnerabilities and thundering herd race conditions during concurrent nonce rotation.","antiPatternHeadline":"Unsynchronized DPoP proof generation without reactive nonce retry loops, or falling back to raw Bearer authorization","stars_count":67,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","oauth2","dpop","rfc9449","cryptography","distributed-systems"],"exportEndpoints":{"claude":"/api/rules/oauth-dpop-nonce-synchronization-invariant?format=claude","cursorMdc":"/api/rules/oauth-dpop-nonce-synchronization-invariant?format=mdc","cursorrules":"/api/rules/oauth-dpop-nonce-synchronization-invariant?format=cursor","windsurf":"/api/rules/oauth-dpop-nonce-synchronization-invariant?format=windsurf","agents":"/api/rules/oauth-dpop-nonce-synchronization-invariant?format=agents"}},{"id":"otel-ebpf-profiling-fleet-budget-standard","title":"OpenTelemetry eBPF Continuous Profiling Fleet Overhead Budget Guardrail","category":"devops","severity":"critical","description":"Enforces a strict sub-1% CPU and memory resource envelope for OpenTelemetry eBPF continuous profiling agents across multi-tenant Kubernetes clusters. Mandates off-beat prime sampling frequencies, restricted BPF ring-buffer sizing, Guaranteed QoS resource reservations, and deferred symbolization to eliminate kernel scheduler contention and node thrashing.","antiPatternHeadline":"Unthrottled 99Hz+ eBPF Stack-Walking with In-Agent Synchronous DWARF Symbolization and Unbounded Ring Buffers","stars_count":90,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","opentelemetry","continuous-profiling","kubernetes","resource-governance"],"exportEndpoints":{"claude":"/api/rules/otel-ebpf-profiling-fleet-budget-standard?format=claude","cursorMdc":"/api/rules/otel-ebpf-profiling-fleet-budget-standard?format=mdc","cursorrules":"/api/rules/otel-ebpf-profiling-fleet-budget-standard?format=cursor","windsurf":"/api/rules/otel-ebpf-profiling-fleet-budget-standard?format=windsurf","agents":"/api/rules/otel-ebpf-profiling-fleet-budget-standard?format=agents"}},{"id":"bun-sql-pool-eviction-session-reset-standard","title":"Bun 1.2 Native SQL Connection Pool Eviction and Session State Reset Standard","category":"backend","severity":"critical","description":"Enforces deterministic connection pool eviction, prepared statement invalidation, and session state reset for Bun 1.2 native SQL clients under high-concurrency and network partition recovery. Eliminates silent cross-tenant parameter leakage and stale session cache desynchronization caused by unhygienic socket reuse across multiplexed asynchronous worker contexts.","antiPatternHeadline":"Unchecked Connection Reuse Leaking Session Variables and Corrupted Prepared Statements Post-Partition","stars_count":106,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","sql","connection-pooling","postgresql","security"],"exportEndpoints":{"claude":"/api/rules/bun-sql-pool-eviction-session-reset-standard?format=claude","cursorMdc":"/api/rules/bun-sql-pool-eviction-session-reset-standard?format=mdc","cursorrules":"/api/rules/bun-sql-pool-eviction-session-reset-standard?format=cursor","windsurf":"/api/rules/bun-sql-pool-eviction-session-reset-standard?format=windsurf","agents":"/api/rules/bun-sql-pool-eviction-session-reset-standard?format=agents"}},{"id":"go-1-24-weak-pointer-cache-invalidation","title":"Go 1.24 Weak Pointer Cache Invalidation and Memory Safety Invariant","category":"backend","severity":"critical","description":"Governs the use of Go 1.24 weak pointers (weak.Pointer) within high-throughput in-memory cache indexing layers to eliminate memory retention cycles and GC pinning. Mandates atomic dereferencing through Pointer.Strong() and safe cleanup synchronizers to prevent use-after-free logic and dangling pointer race conditions under heavy concurrent GC pressure.","antiPatternHeadline":"Retaining Strong References in Secondary Indexes or Accessing Weak Pointers Without Immediate Strong Nil-Checks","stars_count":98,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","concurrency","garbage-collection","memory-safety","performance"],"exportEndpoints":{"claude":"/api/rules/go-1-24-weak-pointer-cache-invalidation?format=claude","cursorMdc":"/api/rules/go-1-24-weak-pointer-cache-invalidation?format=mdc","cursorrules":"/api/rules/go-1-24-weak-pointer-cache-invalidation?format=cursor","windsurf":"/api/rules/go-1-24-weak-pointer-cache-invalidation?format=windsurf","agents":"/api/rules/go-1-24-weak-pointer-cache-invalidation?format=agents"}},{"id":"swift-6-concurrency-native-bridge-isolation","title":"Swift 6 Complete Concurrency Domain Isolation for Native Mobile Bridges","category":"mobile","severity":"critical","description":"Enforces complete compile-time actor isolation and Sendable boundary compliance across C FFI, JNI, React Native TurboModules, and Flutter platform channels. Eliminates untracked foreign thread re-entrancy into Swift actors, preventing memory corruption and main-thread UI data races on iOS.","antiPatternHeadline":"Bypassing Swift 6 Complete Concurrency Checks via Unchecked Sendable Bridging Across Foreign C/C++ Engine Threads","stars_count":60,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","swift6","concurrency","actors","ffi","react-native","flutter","ios"],"exportEndpoints":{"claude":"/api/rules/swift-6-concurrency-native-bridge-isolation?format=claude","cursorMdc":"/api/rules/swift-6-concurrency-native-bridge-isolation?format=mdc","cursorrules":"/api/rules/swift-6-concurrency-native-bridge-isolation?format=cursor","windsurf":"/api/rules/swift-6-concurrency-native-bridge-isolation?format=windsurf","agents":"/api/rules/swift-6-concurrency-native-bridge-isolation?format=agents"}},{"id":"nextjs-15-server-only-module-leak-guardrail","title":"Next.js 15 Build-Time Dynamic Server-Only Module Leak Guardrail","category":"frontend","severity":"critical","description":"Enforces strict static isolation between Next.js 15 Server Component runtimes and client hydration manifests to prevent inadvertent bundling of secrets, DB clients, and native bindings. Mandates build-time fail-closed poison pills ('server-only') and structural module boundary isolation to eliminate client-side credential exposure and hydration bloat.","antiPatternHeadline":"Leaking Sensitive Server Runtime Modules or Native Secrets into Client Bundles via Transitive Barrel Imports","stars_count":115,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs","react-server-components","security","turbopack","server-only"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-server-only-module-leak-guardrail?format=claude","cursorMdc":"/api/rules/nextjs-15-server-only-module-leak-guardrail?format=mdc","cursorrules":"/api/rules/nextjs-15-server-only-module-leak-guardrail?format=cursor","windsurf":"/api/rules/nextjs-15-server-only-module-leak-guardrail?format=windsurf","agents":"/api/rules/nextjs-15-server-only-module-leak-guardrail?format=agents"}},{"id":"kubernetes-dra-deterministic-device-claims","title":"Kubernetes DRA Deterministic Device Claim and Topology Preservation Standard","category":"devops","severity":"critical","description":"Enforces deterministic DeviceClass constraints, strict CEL selector evaluation, and pod-scoped lifecycle management for Dynamic Resource Allocation (DRA) in Kubernetes AI inference infrastructure. Eliminates GPU memory fragmentation, non-NVLink interconnect allocations, and orphaned hardware slices across heterogeneous accelerator nodes.","antiPatternHeadline":"Ad-Hoc Unbounded Device Slicing and Standalone Unmanaged Resource Claims","stars_count":52,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","kubernetes","dra","gpu","resource-management","ai-infrastructure"],"exportEndpoints":{"claude":"/api/rules/kubernetes-dra-deterministic-device-claims?format=claude","cursorMdc":"/api/rules/kubernetes-dra-deterministic-device-claims?format=mdc","cursorrules":"/api/rules/kubernetes-dra-deterministic-device-claims?format=cursor","windsurf":"/api/rules/kubernetes-dra-deterministic-device-claims?format=windsurf","agents":"/api/rules/kubernetes-dra-deterministic-device-claims?format=agents"}},{"id":"tauri-v2-ipc-acl-capability-isolation","title":"Tauri 2.0 IPC Capability-Based Access Control and Input Verification Guardrail","category":"mobile","severity":"critical","description":"Enforces strict principle of least privilege across Tauri 2.0 mobile webviews by mandating granular capability definitions, explicit command permission scopes, and defensive argument schema validation. Prevents complete host device compromise and privilege escalation resulting from cross-site scripting (XSS) or untrusted content injections within Android and iOS webviews.","antiPatternHeadline":"Over-permissive wildcard capabilities with unconstrained custom IPC command execution in mobile webview environments","stars_count":61,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri","ipc-security","acl","rust","android","ios"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-ipc-acl-capability-isolation?format=claude","cursorMdc":"/api/rules/tauri-v2-ipc-acl-capability-isolation?format=mdc","cursorrules":"/api/rules/tauri-v2-ipc-acl-capability-isolation?format=cursor","windsurf":"/api/rules/tauri-v2-ipc-acl-capability-isolation?format=windsurf","agents":"/api/rules/tauri-v2-ipc-acl-capability-isolation?format=agents"}},{"id":"vite6-environment-api-boundary-isolation","title":"Vite 6 Environment API Runtime Graph Boundary Isolation","category":"frontend","severity":"critical","description":"Enforces strict runtime boundary isolation across heterogenous target environments (Client, Node SSR, Edge/Workerd, and RSC) using the Vite 6 Environment API. Prevents module graph pollution, illegal global polyfill sharing, and non-deterministic state leaks during multi-target evaluation.","antiPatternHeadline":"Cross-Environment Global State Leakage via Legacy ssrLoadModule and Shared Lexical Plugin Caches","stars_count":98,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["vite","vite-6","environment-api","ssr","edge-runtime","runtime-isolation"],"exportEndpoints":{"claude":"/api/rules/vite6-environment-api-boundary-isolation?format=claude","cursorMdc":"/api/rules/vite6-environment-api-boundary-isolation?format=mdc","cursorrules":"/api/rules/vite6-environment-api-boundary-isolation?format=cursor","windsurf":"/api/rules/vite6-environment-api-boundary-isolation?format=windsurf","agents":"/api/rules/vite6-environment-api-boundary-isolation?format=agents"}},{"id":"webauthn-prf-deterministic-key-derivation-boundary","title":"WebAuthn PRF Extension Deterministic Cryptographic Boundary Standard","category":"security","severity":"critical","description":"Enforces strict cryptographic domain separation and ephemeral memory isolation when deriving client-side keys via the WebAuthn Pseudo-Random Function (PRF) extension. Raw PRF outputs must strictly serve as Input Keying Material (IKM) to an authenticated HKDF pipeline and must never be used directly as symmetric ciphers or persisted to unencrypted client storage.","antiPatternHeadline":"Direct Symmetric Cipher Instantiation or Persistence of Raw WebAuthn PRF Evaluator Outputs","stars_count":64,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","prf-extension","zero-knowledge","hkdf","e2ee","cryptography"],"exportEndpoints":{"claude":"/api/rules/webauthn-prf-deterministic-key-derivation-boundary?format=claude","cursorMdc":"/api/rules/webauthn-prf-deterministic-key-derivation-boundary?format=mdc","cursorrules":"/api/rules/webauthn-prf-deterministic-key-derivation-boundary?format=cursor","windsurf":"/api/rules/webauthn-prf-deterministic-key-derivation-boundary?format=windsurf","agents":"/api/rules/webauthn-prf-deterministic-key-derivation-boundary?format=agents"}},{"id":"otel-genai-semantic-conventions-redaction-invariant","title":"OpenTelemetry GenAI Semantic Conventions Redaction & Truncation Invariant","category":"devops","severity":"critical","description":"Mandates strict deterministic token-level PII/secrets redaction and bounded context-window byte/token truncation prior to mutating OpenTelemetry GenAI spans. All spans implementing gen_ai.prompt and gen_ai.completion attributes must execute sanitization pipelines locally in-process before delegating to span processors, batch exporters, or downstream telemetry aggregators.","antiPatternHeadline":"Exporting raw prompts and completions directly into gen_ai.* attributes without pre-export redaction and bound checks","stars_count":47,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","genai","pii-scrubbing","security","data-sanitization"],"exportEndpoints":{"claude":"/api/rules/otel-genai-semantic-conventions-redaction-invariant?format=claude","cursorMdc":"/api/rules/otel-genai-semantic-conventions-redaction-invariant?format=mdc","cursorrules":"/api/rules/otel-genai-semantic-conventions-redaction-invariant?format=cursor","windsurf":"/api/rules/otel-genai-semantic-conventions-redaction-invariant?format=windsurf","agents":"/api/rules/otel-genai-semantic-conventions-redaction-invariant?format=agents"}},{"id":"axum-0-8-http3-zero-rtt-anti-replay-guardrail","title":"Axum 0.8 HTTP/3 0-RTT Anti-Replay Guardrail","category":"backend","severity":"critical","description":"Enforces deterministic rejection or strike-register validation of HTTP/3 QUIC 0-RTT early data on state-mutating and sensitive endpoints in Axum 0.8. Prevents network-level replay attacks inherent to TLS 1.3 early data by mandating HTTP 425 Too Early responses for unsafe methods and requiring bounded strike registers for early-data-tolerant routes.","antiPatternHeadline":"Executing state mutations or sensitive queries on replayed QUIC 0-RTT early data without 425 rejection or strike register validation","stars_count":88,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","http3","quic","security","anti-replay"],"exportEndpoints":{"claude":"/api/rules/axum-0-8-http3-zero-rtt-anti-replay-guardrail?format=claude","cursorMdc":"/api/rules/axum-0-8-http3-zero-rtt-anti-replay-guardrail?format=mdc","cursorrules":"/api/rules/axum-0-8-http3-zero-rtt-anti-replay-guardrail?format=cursor","windsurf":"/api/rules/axum-0-8-http3-zero-rtt-anti-replay-guardrail?format=windsurf","agents":"/api/rules/axum-0-8-http3-zero-rtt-anti-replay-guardrail?format=agents"}},{"id":"compose-multiplatform-skiko-gpu-context-lifespan","title":"Compose Multiplatform Skiko GPU Context Lifespan & VFS Synchronization Guardrail","category":"mobile","severity":"critical","description":"Enforces deterministic tear-down, invalidation, and recreation of Skia/Skiko graphics contexts across iOS (Metal/CALayer) and Android (Vulkan/GLES) lifecycle events. Failure to suspend draw loops and flush dirty VFS buffers prior to backgrounding causes hardware watchdog terminations (SIGKILL 0x8badf00d), Metal command buffer corruptions, and unrecoverable EGL surface leaks.","antiPatternHeadline":"Unsynchronized Backgrounding with Active Metal/OpenGL Render Loops and Dangling Skiko Hardware Contexts","stars_count":111,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["compose-multiplatform","skiko","metal","graphics","memory-management","lifecycle"],"exportEndpoints":{"claude":"/api/rules/compose-multiplatform-skiko-gpu-context-lifespan?format=claude","cursorMdc":"/api/rules/compose-multiplatform-skiko-gpu-context-lifespan?format=mdc","cursorrules":"/api/rules/compose-multiplatform-skiko-gpu-context-lifespan?format=cursor","windsurf":"/api/rules/compose-multiplatform-skiko-gpu-context-lifespan?format=windsurf","agents":"/api/rules/compose-multiplatform-skiko-gpu-context-lifespan?format=agents"}},{"id":"nextjs-15-server-action-host-header-csrf-guard","title":"Deterministic Origin and Host-Header Verification in Next.js 15 Server Actions","category":"frontend","severity":"critical","description":"Enforces strict origin-to-host cryptographic alignment and explicit allowed-origin whitelisting for Next.js 15 Server Actions in distributed multi-tenant environments. Prevents cross-site request forgery (CSRF), host-header cache poisoning, and tenant context confusion across layered reverse-proxy architectures.","antiPatternHeadline":"Trusting mutable Host or X-Forwarded-Host headers inside Server Actions without strict reverse-proxy sanitization and origin matching","stars_count":102,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs15","server-actions","security","csrf","multi-tenant","reverse-proxy"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-server-action-host-header-csrf-guard?format=claude","cursorMdc":"/api/rules/nextjs-15-server-action-host-header-csrf-guard?format=mdc","cursorrules":"/api/rules/nextjs-15-server-action-host-header-csrf-guard?format=cursor","windsurf":"/api/rules/nextjs-15-server-action-host-header-csrf-guard?format=windsurf","agents":"/api/rules/nextjs-15-server-action-host-header-csrf-guard?format=agents"}},{"id":"bpf-lsm-inode-execution-gatekeeper-standard","title":"BPF LSM Inode Execution Gatekeeper & VFS Boundary Standard","category":"security","severity":"critical","description":"Mandates authoritative VFS kernel-space mediation using BPF LSM hooks and immutable inode metadata matching rather than mutable string-based dentry heuristics. Enforces zero-trust execution boundaries by validating container mount namespace IDs, filesystem device numbers, and immutable inode identifiers prior to binary interpreter and ELF payload dispatch.","antiPatternHeadline":"TOCTOU Path Filtering and Deferred Execution Checks in BPF LSM Gatekeepers","stars_count":57,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","ebpf","lsm","kernel","containers","vfs"],"exportEndpoints":{"claude":"/api/rules/bpf-lsm-inode-execution-gatekeeper-standard?format=claude","cursorMdc":"/api/rules/bpf-lsm-inode-execution-gatekeeper-standard?format=mdc","cursorrules":"/api/rules/bpf-lsm-inode-execution-gatekeeper-standard?format=cursor","windsurf":"/api/rules/bpf-lsm-inode-execution-gatekeeper-standard?format=windsurf","agents":"/api/rules/bpf-lsm-inode-execution-gatekeeper-standard?format=agents"}},{"id":"drizzle-orm-serverless-prepared-statement-deallocation-standard","title":"Drizzle ORM Serverless Prepared Statement & Session State Deallocation Standard","category":"backend","severity":"critical","description":"Enforces deterministic deallocation of prepared statements and transaction-mode pooling compliance in Drizzle ORM across serverless micro-VM runtimes. Eliminates PostgreSQL 42P05 duplicate statement collisions, session state pollution, and connection starvation on PgBouncer, Neon, and AWS RDS Proxy during warm container reuse.","antiPatternHeadline":"Persisting server-side prepared statement handles across warm serverless micro-VM invocations connected to transaction poolers","stars_count":43,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","drizzle-orm","serverless","pgbouncer","database-connection","postgresql"],"exportEndpoints":{"claude":"/api/rules/drizzle-orm-serverless-prepared-statement-deallocation-standard?format=claude","cursorMdc":"/api/rules/drizzle-orm-serverless-prepared-statement-deallocation-standard?format=mdc","cursorrules":"/api/rules/drizzle-orm-serverless-prepared-statement-deallocation-standard?format=cursor","windsurf":"/api/rules/drizzle-orm-serverless-prepared-statement-deallocation-standard?format=windsurf","agents":"/api/rules/drizzle-orm-serverless-prepared-statement-deallocation-standard?format=agents"}},{"id":"react-19-server-actions-idempotency-rollback-react-19-server--252","title":"React 19 Server Actions Idempotency & Optimistic Rollback Invariant","category":"frontend","severity":"critical","description":"Enforces deterministic client-side mutation tracking, cryptographically secure idempotency keys, and strict rollback boundaries across concurrent React 19 transitions. Prevents UI state drift, phantom updates, and double-mutation execution during network retries or component re-renders.","antiPatternHeadline":"Non-Idempotent Server Actions with Unbounded Optimistic State Mutations and Silent Rollback Omission","stars_count":79,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","server-actions","use-optimistic","idempotency"],"exportEndpoints":{"claude":"/api/rules/react-19-server-actions-idempotency-rollback-react-19-server--252?format=claude","cursorMdc":"/api/rules/react-19-server-actions-idempotency-rollback-react-19-server--252?format=mdc","cursorrules":"/api/rules/react-19-server-actions-idempotency-rollback-react-19-server--252?format=cursor","windsurf":"/api/rules/react-19-server-actions-idempotency-rollback-react-19-server--252?format=windsurf","agents":"/api/rules/react-19-server-actions-idempotency-rollback-react-19-server--252?format=agents"}},{"id":"nextjs-15-ppr-request-scope-boundary-isolation","title":"Next.js 15 PPR Request-Scope Boundary Isolation and Dynamic Bailout Prevention","category":"frontend","severity":"critical","description":"Next.js 15 Partial Prerendering (PPR) combines static shell pre-generation with dynamic streaming within the same route. Request-scoped Dynamic APIs (e.g., cookies(), headers(), searchParams, connection()) must be isolated strictly inside dedicated leaf Server Components wrapped in React Suspense boundaries to prevent cascading dynamic bailouts that collapse the static prerender shell into full runtime SSR.","antiPatternHeadline":"Leaking Request-Scoped Dynamic APIs into Root Component Shells Collapsing the PPR Prerender Tree","stars_count":87,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs","nextjs-15","ppr","react-server-components","suspense"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-ppr-request-scope-boundary-isolation?format=claude","cursorMdc":"/api/rules/nextjs-15-ppr-request-scope-boundary-isolation?format=mdc","cursorrules":"/api/rules/nextjs-15-ppr-request-scope-boundary-isolation?format=cursor","windsurf":"/api/rules/nextjs-15-ppr-request-scope-boundary-isolation?format=windsurf","agents":"/api/rules/nextjs-15-ppr-request-scope-boundary-isolation?format=agents"}},{"id":"python-313t-fastapi-free-threaded-contention-guardrail","title":"Python 3.13 Free-Threaded FastAPI Thread-Safety & C-Extension Contention Guardrail","category":"backend","severity":"critical","description":"Enforces thread-safety invariants, synchronization primitives, and C-extension isolation under Python 3.13 free-threaded (PEP 703) runtimes running ASGI servers like Granian or Uvicorn. Mandates contextvars over thread-locals and eliminates unprotected global state mutations that previously relied on GIL atomicity guarantees.","antiPatternHeadline":"Relying on legacy GIL atomicity for shared mutable state and using threading.local() in free-threaded async workers.","stars_count":106,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","python313","free-threaded","fastapi","nogil","concurrency","performance"],"exportEndpoints":{"claude":"/api/rules/python-313t-fastapi-free-threaded-contention-guardrail?format=claude","cursorMdc":"/api/rules/python-313t-fastapi-free-threaded-contention-guardrail?format=mdc","cursorrules":"/api/rules/python-313t-fastapi-free-threaded-contention-guardrail?format=cursor","windsurf":"/api/rules/python-313t-fastapi-free-threaded-contention-guardrail?format=windsurf","agents":"/api/rules/python-313t-fastapi-free-threaded-contention-guardrail?format=agents"}},{"id":"pg17-json-table-workmem-spill-containment","title":"PostgreSQL 17 JSON_TABLE WorkMem Allocation & Spill Containment Standard","category":"backend","severity":"critical","description":"Governs execution bounds and streaming memory limits for PostgreSQL 17 SQL/JSON JSON_TABLE transformations over nested hierarchical documents. Mandates explicit work_mem thresholds, temp_file_limit spill containment, and keyset-chunked projection to prevent Linux OOM-killer invocations and cluster-wide postmaster panics.","antiPatternHeadline":"Unbounded Single-Query JSON_TABLE Materialization Triggering Fatal Backend Process OOM","stars_count":74,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","json-table","work-mem","database-reliability","oom-prevention"],"exportEndpoints":{"claude":"/api/rules/pg17-json-table-workmem-spill-containment?format=claude","cursorMdc":"/api/rules/pg17-json-table-workmem-spill-containment?format=mdc","cursorrules":"/api/rules/pg17-json-table-workmem-spill-containment?format=cursor","windsurf":"/api/rules/pg17-json-table-workmem-spill-containment?format=windsurf","agents":"/api/rules/pg17-json-table-workmem-spill-containment?format=agents"}},{"id":"tokio-cooperative-drop-safety-axum-production-standard","title":"Tokio Cooperative Scheduling Budget & Drop-Safety Invariant for Axum 0.8","category":"backend","severity":"critical","description":"Enforces deterministic cooperative scheduling budgets and strict drop-safety invariants across Axum 0.8 HTTP/3 stream lifecycles. Eliminates worker-thread starvation caused by unbounded stream polling loops and prevents persistent data corruption resulting from arbitrary task cancellation when HTTP/3 client streams reset mid-mutation.","antiPatternHeadline":"Unbounded Stream Polling Bypassing Tokio Budget and Multi-Stage Awaits Violating Future Drop-Safety During HTTP/3 Cancellation","stars_count":116,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","tokio","axum","http3","async","cancellation-safety"],"exportEndpoints":{"claude":"/api/rules/tokio-cooperative-drop-safety-axum-production-standard?format=claude","cursorMdc":"/api/rules/tokio-cooperative-drop-safety-axum-production-standard?format=mdc","cursorrules":"/api/rules/tokio-cooperative-drop-safety-axum-production-standard?format=cursor","windsurf":"/api/rules/tokio-cooperative-drop-safety-axum-production-standard?format=windsurf","agents":"/api/rules/tokio-cooperative-drop-safety-axum-production-standard?format=agents"}},{"id":"kmp-compose-hardware-vsync-pacing-guardrail","title":"Kotlin Multiplatform Compose Hardware VSync Frame Pacing Invariant","category":"mobile","severity":"critical","description":"Enforces deterministic frame pacing across platforms by binding Compose Multiplatform custom render loops and animation drivers directly to platform hardware VSync primitives. Disallows decoupled coroutine clocks and non-vsync periodic timers to guarantee zero frame-drift and jitter-free 120Hz ProMotion (iOS CADisplayLink) and Smooth Display (Android Choreographer) synchronization.","antiPatternHeadline":"Decoupled Wall-Clock Frame Dispatch Causing Display Jitter and Dropped VSync Cycles","stars_count":68,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","compose-multiplatform","cadisplaylink","choreographer","frame-pacing","rendering"],"exportEndpoints":{"claude":"/api/rules/kmp-compose-hardware-vsync-pacing-guardrail?format=claude","cursorMdc":"/api/rules/kmp-compose-hardware-vsync-pacing-guardrail?format=mdc","cursorrules":"/api/rules/kmp-compose-hardware-vsync-pacing-guardrail?format=cursor","windsurf":"/api/rules/kmp-compose-hardware-vsync-pacing-guardrail?format=windsurf","agents":"/api/rules/kmp-compose-hardware-vsync-pacing-guardrail?format=agents"}},{"id":"capacitor-7-biometric-enclave-ephemeral-session-pinning-standard","title":"Capacitor 7 Biometric Enclave Ephemeral Session Pinning Standard","category":"mobile","severity":"critical","description":"Enforces cryptographic hardware-backed session binding between native Secure Enclave/StrongBox key stores and the Capacitor 7 WebView runtime. Prohibits trivial boolean verification bridges by mandating challenge-response token unwrap operations held strictly in volatile, auto-zeroizing memory buffers.","antiPatternHeadline":"Trusting Boolean Biometric Bridge Responses and Storing Tokens in Persistent Storage","stars_count":109,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","biometrics","secure-enclave","memory-safety","cryptography"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-biometric-enclave-ephemeral-session-pinning-standard?format=claude","cursorMdc":"/api/rules/capacitor-7-biometric-enclave-ephemeral-session-pinning-standard?format=mdc","cursorrules":"/api/rules/capacitor-7-biometric-enclave-ephemeral-session-pinning-standard?format=cursor","windsurf":"/api/rules/capacitor-7-biometric-enclave-ephemeral-session-pinning-standard?format=windsurf","agents":"/api/rules/capacitor-7-biometric-enclave-ephemeral-session-pinning-standard?format=agents"}},{"id":"ebpf-lsm-tetragon-namespace-escape-containment","title":"eBPF LSM Tetragon Synchronous Kernel-Space Namespace Escape Containment","category":"security","severity":"critical","description":"Enforces in-kernel synchronous interception and termination of unauthorized container namespace crossings, capability gains, and privilege escalations using Cilium Tetragon and eBPF LSM hooks. Mandates proactive SIGKILL enforcement at the kernel level to eliminate asynchronous userspace audit bypasses and race conditions during container escapes.","antiPatternHeadline":"Relying on Asynchronous Userspace Audit Logs and Post-Facto SIEM Alerts for Container Namespace Escapes","stars_count":82,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","ebpf","tetragon","lsm","linux-kernel","container-security","kubernetes"],"exportEndpoints":{"claude":"/api/rules/ebpf-lsm-tetragon-namespace-escape-containment?format=claude","cursorMdc":"/api/rules/ebpf-lsm-tetragon-namespace-escape-containment?format=mdc","cursorrules":"/api/rules/ebpf-lsm-tetragon-namespace-escape-containment?format=cursor","windsurf":"/api/rules/ebpf-lsm-tetragon-namespace-escape-containment?format=windsurf","agents":"/api/rules/ebpf-lsm-tetragon-namespace-escape-containment?format=agents"}},{"id":"otel-arrow-batching-backpressure-standard","title":"OpenTelemetry Collector OTLP/Arrow Columnar Batching Backpressure Standard","category":"devops","severity":"critical","description":"Defines mandatory memory limits, queue sizing, and columnar batch constraints for OpenTelemetry Collector pipelines utilizing OTLP/Arrow. Prevents runaway memory allocation, heap fragmentation, and cascading node OOM crashes during telemetry bursts by coupling Arrow dictionary limits with strict upstream backpressure signaling.","antiPatternHeadline":"Unbounded Arrow record building with decoupled queue-per-worker pipelines triggering SIGKILL during incident trace storms","stars_count":70,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","arrow","kubernetes","observability","backpressure"],"exportEndpoints":{"claude":"/api/rules/otel-arrow-batching-backpressure-standard?format=claude","cursorMdc":"/api/rules/otel-arrow-batching-backpressure-standard?format=mdc","cursorrules":"/api/rules/otel-arrow-batching-backpressure-standard?format=cursor","windsurf":"/api/rules/otel-arrow-batching-backpressure-standard?format=windsurf","agents":"/api/rules/otel-arrow-batching-backpressure-standard?format=agents"}},{"id":"openfga-contextual-tuple-cdc-invalidation","title":"OpenFGA 1.8 Contextual Tuple Invalidation via Postgres CDC Guardrail","category":"security","severity":"critical","description":"Enforces deterministic consistency between PostgreSQL relationship mutations and OpenFGA 1.8 checks by eliminating the replication-lag authorization window. Mandates that in-flight or uncommitted transactional state must be evaluated using OpenFGA Contextual Tuples derived from transactional Outbox CDC events until Postgres write-ahead log (WAL) streams guarantee monotonic OpenFGA tuple persistence.","antiPatternHeadline":"Blind Trust in OpenFGA Eventual Consistency Without Contextual Tuples During Postgres Replication Lag","stars_count":88,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","authorization","cdc","postgres","debezium"],"exportEndpoints":{"claude":"/api/rules/openfga-contextual-tuple-cdc-invalidation?format=claude","cursorMdc":"/api/rules/openfga-contextual-tuple-cdc-invalidation?format=mdc","cursorrules":"/api/rules/openfga-contextual-tuple-cdc-invalidation?format=cursor","windsurf":"/api/rules/openfga-contextual-tuple-cdc-invalidation?format=windsurf","agents":"/api/rules/openfga-contextual-tuple-cdc-invalidation?format=agents"}},{"id":"svelte-5-runes-ownership-detached-effect-cleanup","title":"Svelte 5 Deep Signal Runes Ownership & Detached Effect Cleanup Guardrail","category":"frontend","severity":"critical","description":"Enforces strict reactive ownership boundaries and deterministic teardown for Svelte 5 runes ($state, $effect, $derived) instantiated across asynchronous boundaries or dynamic service scopes. Prevents runaway memory leaks and orphaned reactive computations in long-lived single-page applications by mandating explicit $effect.root scoping and deterministic lifecycle cleanup for unparented signals.","antiPatternHeadline":"Spawning un-scoped reactive effects and deep signal graphs across async boundaries without deterministic $effect.root disposal","stars_count":92,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte","svelte-5","runes","memory-leaks","reactivity"],"exportEndpoints":{"claude":"/api/rules/svelte-5-runes-ownership-detached-effect-cleanup?format=claude","cursorMdc":"/api/rules/svelte-5-runes-ownership-detached-effect-cleanup?format=mdc","cursorrules":"/api/rules/svelte-5-runes-ownership-detached-effect-cleanup?format=cursor","windsurf":"/api/rules/svelte-5-runes-ownership-detached-effect-cleanup?format=windsurf","agents":"/api/rules/svelte-5-runes-ownership-detached-effect-cleanup?format=agents"}},{"id":"tauri-v2-granular-capability-scoping-zero-copy-ipc","title":"Tauri 2.0 Granular Capability Scoping & Zero-Copy IPC ArrayBuffer Protocol","category":"mobile","severity":"critical","description":"Enforce principle-of-least-privilege capability manifests and zero-copy binary IPC transfer protocols for Tauri 2.0 mobile targets. Wildcard window permissions expose device native features (camera, biometric, filesystem) to cross-site script injection, while serialized JSON byte transport causes extreme memory duplication and thermal throttling on mobile ARM chipsets. Native commands must use scoped capability ACLs and return binary buffers directly wrapped in Tauri IPC Responses.","antiPatternHeadline":"Exposing native OS host capabilities via wildcard permissions while transferring bulk binary data over JSON-serialized numeric arrays.","stars_count":51,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri2","rust","ipc","security","zero-copy","capabilities"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-granular-capability-scoping-zero-copy-ipc?format=claude","cursorMdc":"/api/rules/tauri-v2-granular-capability-scoping-zero-copy-ipc?format=mdc","cursorrules":"/api/rules/tauri-v2-granular-capability-scoping-zero-copy-ipc?format=cursor","windsurf":"/api/rules/tauri-v2-granular-capability-scoping-zero-copy-ipc?format=windsurf","agents":"/api/rules/tauri-v2-granular-capability-scoping-zero-copy-ipc?format=agents"}},{"id":"wasi-02-component-sandbox-edge-worker-isolation","title":"WASI 0.2 Component Sandboxing & Deterministic Capability Budgets","category":"devops","severity":"critical","description":"Enforces strict capability-based isolation and deterministic resource limits for WASI 0.2 multi-tenant edge workers. Mandates explicit Store resource limiters, fuel/epoch compute metering, and zero-ambient-authority WASI contexts to prevent tenant escape and resource exhaustion without microVM overhead.","antiPatternHeadline":"Ambient Authority Inheritance and Unbounded Stores in Multi-Tenant Component Model Hosts","stars_count":41,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","wasi","wasm","security","component-model","edge-computing"],"exportEndpoints":{"claude":"/api/rules/wasi-02-component-sandbox-edge-worker-isolation?format=claude","cursorMdc":"/api/rules/wasi-02-component-sandbox-edge-worker-isolation?format=mdc","cursorrules":"/api/rules/wasi-02-component-sandbox-edge-worker-isolation?format=cursor","windsurf":"/api/rules/wasi-02-component-sandbox-edge-worker-isolation?format=windsurf","agents":"/api/rules/wasi-02-component-sandbox-edge-worker-isolation?format=agents"}},{"id":"go-1-24-weak-pointer-cache-eviction-invariants","title":"Go 1.24 Weak Pointer Cache Eviction and Memory Reclamation Guardrails","category":"backend","severity":"critical","description":"Mandates deterministic key reclamation and lifecycle coordination using Go 1.24's weak.Pointer and runtime.AddCleanup within high-churn routing tables. Prevents mark-sweep pointer-chasing GC stalls and unbounded map-entry leaks by decoupling entry lifetime from GC root sets.","antiPatternHeadline":"Retaining strong routing targets in canonicalization caches or failing to evict dead weak.Pointer entries from concurrent maps","stars_count":78,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","weak-pointer","garbage-collection","low-latency","memory-management"],"exportEndpoints":{"claude":"/api/rules/go-1-24-weak-pointer-cache-eviction-invariants?format=claude","cursorMdc":"/api/rules/go-1-24-weak-pointer-cache-eviction-invariants?format=mdc","cursorrules":"/api/rules/go-1-24-weak-pointer-cache-eviction-invariants?format=cursor","windsurf":"/api/rules/go-1-24-weak-pointer-cache-eviction-invariants?format=windsurf","agents":"/api/rules/go-1-24-weak-pointer-cache-eviction-invariants?format=agents"}},{"id":"pqc-hybrid-tls-mlkem-fallback-hardening","title":"PQC Hybrid TLS 1.3 ML-KEM Key Exchange Hardening & MTU Fragmentation Prevention","category":"security","severity":"critical","description":"Enforces quantum-safe hybrid key exchange (X25519MLKEM768) across TLS 1.3 ingresses while strictly mitigating MTU fragmentation and eliminating insecure client-side fallback loops. Prevents Harvest-Now-Decrypt-Later (HNDL) vector exposure and middlebox TCP blackholing by enforcing deterministic group preference and cryptographic downgrade protection.","antiPatternHeadline":"Unbounded TLS ClientHello Payload Bloat and Insecure Classical Fallback Loops Under PQC Negotiation","stars_count":101,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","tls-1-3","pqc","ml-kem","cryptography","zero-trust","mtu"],"exportEndpoints":{"claude":"/api/rules/pqc-hybrid-tls-mlkem-fallback-hardening?format=claude","cursorMdc":"/api/rules/pqc-hybrid-tls-mlkem-fallback-hardening?format=mdc","cursorrules":"/api/rules/pqc-hybrid-tls-mlkem-fallback-hardening?format=cursor","windsurf":"/api/rules/pqc-hybrid-tls-mlkem-fallback-hardening?format=windsurf","agents":"/api/rules/pqc-hybrid-tls-mlkem-fallback-hardening?format=agents"}},{"id":"capacitor-7-hardware-biometric-key-derivation","title":"Capacitor 7 Hardware-Backed Key Derivation and Biometric Prompt Invariants","category":"mobile","severity":"critical","description":"Guarantees offline cached access tokens remain cryptographically bound to the Secure Enclave or Android Keystore until explicit user presence is verified. Eliminates soft-gated authentication checks where biometric verification is merely an application-layer Boolean check rather than an cryptographic prerequisite for unwrapping AES-GCM encryption keys.","antiPatternHeadline":"Soft-Gating Biometrics via Client-Side Booleans and Static Device Storage","stars_count":103,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","biometrics","secure-enclave","cryptography","keychain"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-hardware-biometric-key-derivation?format=claude","cursorMdc":"/api/rules/capacitor-7-hardware-biometric-key-derivation?format=mdc","cursorrules":"/api/rules/capacitor-7-hardware-biometric-key-derivation?format=cursor","windsurf":"/api/rules/capacitor-7-hardware-biometric-key-derivation?format=windsurf","agents":"/api/rules/capacitor-7-hardware-biometric-key-derivation?format=agents"}},{"id":"opentelemetry-ebpf-profiling-symbolication-standard","title":"OpenTelemetry eBPF Continuous Profiling and Async Symbolication Standard","category":"devops","severity":"critical","description":"Enforces low-overhead eBPF stack sampling, in-kernel W3C trace context extraction, and asynchronous deferred symbolication via Build-ID caches. Mandates sub-one-percent CPU overhead and zero-allocation ring-buffer streaming into OTLP profiling pipelines under enterprise loads.","antiPatternHeadline":"Synchronous Stack Symbolization and Userspace Context Bouncing on Collection Paths","stars_count":101,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","ebpf","continuous-profiling","w3c-trace-context","observability"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-ebpf-profiling-symbolication-standard?format=claude","cursorMdc":"/api/rules/opentelemetry-ebpf-profiling-symbolication-standard?format=mdc","cursorrules":"/api/rules/opentelemetry-ebpf-profiling-symbolication-standard?format=cursor","windsurf":"/api/rules/opentelemetry-ebpf-profiling-symbolication-standard?format=windsurf","agents":"/api/rules/opentelemetry-ebpf-profiling-symbolication-standard?format=agents"}},{"id":"react19-asset-preloading-deduplication-standard","title":"React 19 Asset Preloading & Resource Hint Deduplication Standard","category":"frontend","severity":"critical","description":"Enforces deterministic, declarative priority dispatch using React 19's native resource loading APIs (preload, preinit, prefetchDNS, preconnect) across concurrent and streaming render boundaries. Eliminates critical request chains, stylesheet-driven render blocks, and duplicate head tag emissions caused by imperative or uncoordinated hint injection in deeply nested asynchronous server and client components.","antiPatternHeadline":"Ad-Hoc Imperative Head Mutators and Duplicative Preload Directives Across Streaming Boundaries","stars_count":102,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react19","performance","streaming-ssr","resource-hints"],"exportEndpoints":{"claude":"/api/rules/react19-asset-preloading-deduplication-standard?format=claude","cursorMdc":"/api/rules/react19-asset-preloading-deduplication-standard?format=mdc","cursorrules":"/api/rules/react19-asset-preloading-deduplication-standard?format=cursor","windsurf":"/api/rules/react19-asset-preloading-deduplication-standard?format=windsurf","agents":"/api/rules/react19-asset-preloading-deduplication-standard?format=agents"}},{"id":"fastapi-python313-freethreaded-shared-state-race-barrier","title":"Python 3.13 Free-Threaded Shared State Race Barrier and Memory Safety Invariant","category":"backend","severity":"critical","description":"Enforces strict immutability, thread synchronization barriers, and thread-safe data structures across un-GILed worker threads in Python 3.13 free-threaded (PEP 703) runtimes. Prevents silent data tearing, stale reads, and race conditions in FastAPI applications handling concurrent requests across multi-threaded thread pools.","antiPatternHeadline":"Unsynchronized Mutable Module-Level State and Non-Atomic Cache Updates Under Free-Threaded Python 3.13","stars_count":114,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","python313","nogil","concurrency","multithreading","synchronization"],"exportEndpoints":{"claude":"/api/rules/fastapi-python313-freethreaded-shared-state-race-barrier?format=claude","cursorMdc":"/api/rules/fastapi-python313-freethreaded-shared-state-race-barrier?format=mdc","cursorrules":"/api/rules/fastapi-python313-freethreaded-shared-state-race-barrier?format=cursor","windsurf":"/api/rules/fastapi-python313-freethreaded-shared-state-race-barrier?format=windsurf","agents":"/api/rules/fastapi-python313-freethreaded-shared-state-race-barrier?format=agents"}},{"id":"postgres-17-pgvector-hnsw-memory-fence","title":"Postgres 17 pgvector HNSW Index Build Memory Fence and Graph Ceilings","category":"backend","severity":"critical","description":"Enforces session-scoped maintenance_work_mem bounds, explicit worker ceilings, and bounded graph connectivity (m, ef_construction) during concurrent pgvector HNSW index creation on PostgreSQL 17. Prevents Linux cgroup kernel OOM-killer invocations caused by parallel maintenance worker multiplicative memory allocation under concurrent write-heavy hybrid workloads.","antiPatternHeadline":"Unbounded Global maintenance_work_mem with High Hyperparameters Triggering Parallel Worker Cgroup OOM","stars_count":101,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres","pgvector","database-migration","performance","hnsw"],"exportEndpoints":{"claude":"/api/rules/postgres-17-pgvector-hnsw-memory-fence?format=claude","cursorMdc":"/api/rules/postgres-17-pgvector-hnsw-memory-fence?format=mdc","cursorrules":"/api/rules/postgres-17-pgvector-hnsw-memory-fence?format=cursor","windsurf":"/api/rules/postgres-17-pgvector-hnsw-memory-fence?format=windsurf","agents":"/api/rules/postgres-17-pgvector-hnsw-memory-fence?format=agents"}},{"id":"go-chi-quic-stream-cancellation-standard","title":"Deterministic Child Goroutine and Channel Teardown on QUIC Stream Reset in Go Chi HTTP/3","category":"backend","severity":"critical","description":"Guarantees immediate and deterministic teardown of child worker goroutines, fan-out pipelines, and unbuffered channel interactions when receiving client-initiated QUIC stream resets (RESET_STREAM/STOP_SENDING). Mandates strict context propagation from Chi HTTP/3 request contexts and forbids unmultiplexed channel operations that cause permanent goroutine leaks.","antiPatternHeadline":"Permanent Goroutine Leaks and Channel Deadlocks via Unguarded HTTP/3 QUIC Stream Resets","stars_count":116,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","quic","http3","chi","concurrency","goroutines"],"exportEndpoints":{"claude":"/api/rules/go-chi-quic-stream-cancellation-standard?format=claude","cursorMdc":"/api/rules/go-chi-quic-stream-cancellation-standard?format=mdc","cursorrules":"/api/rules/go-chi-quic-stream-cancellation-standard?format=cursor","windsurf":"/api/rules/go-chi-quic-stream-cancellation-standard?format=windsurf","agents":"/api/rules/go-chi-quic-stream-cancellation-standard?format=agents"}},{"id":"capacitor-7-android-15-predictive-back-insets-sync","title":"Capacitor 7 Android 15 Predictive Back & WindowInsets Synchronization Protocol","category":"mobile","severity":"critical","description":"Enforces edge-to-edge layout invariants and Viewport synchronization for Capacitor 7 running on Android 15 (API 35+). Prevents WebView compositor clipping, frame drops, and touch-target misalignment during predictive back gestures, software keyboard (IME) animations, and dynamic display cutout transitions.","antiPatternHeadline":"Unsynchronized CSS Viewport and Native Inset Polling During Predictive Back and IME Transitions","stars_count":81,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","android-15","predictive-back","window-insets","webview"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-android-15-predictive-back-insets-sync?format=claude","cursorMdc":"/api/rules/capacitor-7-android-15-predictive-back-insets-sync?format=mdc","cursorrules":"/api/rules/capacitor-7-android-15-predictive-back-insets-sync?format=cursor","windsurf":"/api/rules/capacitor-7-android-15-predictive-back-insets-sync?format=windsurf","agents":"/api/rules/capacitor-7-android-15-predictive-back-insets-sync?format=agents"}},{"id":"webauthn-device-bound-attestation-step-up-standard","title":"WebAuthn Hardware-Backed UV and Device-Bound Attestation Step-Up Standard","category":"security","severity":"critical","description":"Mandates cryptographic validation of WebAuthn authenticator data flags, specifically verifying User Verification (UV=1) and device-bound credential constraints (backup eligibility flags BE=0, BS=0) before authorizing high-entropy, privileged, or financial transactions. Prohibits trusting client-asserted verification status, unverified authenticator counters, or multi-device synced passkeys when strict hardware isolation and enterprise non-repudiation are required.","antiPatternHeadline":"Trusting client-reported passkey verification without validating server-side authenticatorData UV flags and device-bound attestation properties.","stars_count":100,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","fido2","passkeys","cryptography","zero-trust"],"exportEndpoints":{"claude":"/api/rules/webauthn-device-bound-attestation-step-up-standard?format=claude","cursorMdc":"/api/rules/webauthn-device-bound-attestation-step-up-standard?format=mdc","cursorrules":"/api/rules/webauthn-device-bound-attestation-step-up-standard?format=cursor","windsurf":"/api/rules/webauthn-device-bound-attestation-step-up-standard?format=windsurf","agents":"/api/rules/webauthn-device-bound-attestation-step-up-standard?format=agents"}},{"id":"spiffe-spire-svid-rotation-atomic-reload","title":"SPIFFE/SPIRE Ephemeral SVID Rotation & In-Memory Reload Invariant","category":"security","severity":"critical","description":"Enforces sub-hour X.509 SVID lifecycles paired with non-blocking, atomic TLS configuration hot-reloads to eliminate connection stalls in zero-trust mesh architectures. Workloads must consume the SPIFFE Workload API stream and dynamically swap active TLS SecureContext instances in memory without dropping in-flight connections or requiring process restarts. Static certificate loading or blocking read/write locks during SVID rotation are strictly prohibited.","antiPatternHeadline":"Static TLS Context Initialization & Process Restart SVID Recycling","stars_count":93,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","spiffe","spire","mtls","zero-trust","tls-rotation"],"exportEndpoints":{"claude":"/api/rules/spiffe-spire-svid-rotation-atomic-reload?format=claude","cursorMdc":"/api/rules/spiffe-spire-svid-rotation-atomic-reload?format=mdc","cursorrules":"/api/rules/spiffe-spire-svid-rotation-atomic-reload?format=cursor","windsurf":"/api/rules/spiffe-spire-svid-rotation-atomic-reload?format=windsurf","agents":"/api/rules/spiffe-spire-svid-rotation-atomic-reload?format=agents"}},{"id":"opentelemetry-baggage-attenuation-gate","title":"OpenTelemetry Ingress W3C Baggage Attenuation and Cardinality Gate","category":"devops","severity":"critical","description":"Enforces strict attenuation, validation, and sanitization of incoming W3C baggage headers at ingress boundaries and API gateways. Prevents metric cardinality explosions and cross-tenant context injection by applying schema allowlists, length bounds, and identity verification before propagating context downstream.","antiPatternHeadline":"Unvalidated W3C Baggage Propagation Allowing High-Cardinality Metrics and Tenant Injection","stars_count":78,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","security","observability","distributed-tracing","api-gateway"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-baggage-attenuation-gate?format=claude","cursorMdc":"/api/rules/opentelemetry-baggage-attenuation-gate?format=mdc","cursorrules":"/api/rules/opentelemetry-baggage-attenuation-gate?format=cursor","windsurf":"/api/rules/opentelemetry-baggage-attenuation-gate?format=windsurf","agents":"/api/rules/opentelemetry-baggage-attenuation-gate?format=agents"}},{"id":"ebpf-xdp-l4-synflood-mitigation-standard","title":"eBPF XDP Layer-4 Line-Rate SYN Flood Mitigation Standard","category":"devops","severity":"critical","description":"Mandates stateless SYN cookie verification and direct packet bouncing via XDP native mode in the NIC driver ring buffer before socket buffer allocation. Prevents kernel backlog table exhaustion and CPU cache thrashing during multi-million packet-per-second spoofed TCP floods.","antiPatternHeadline":"Stateful Session Allocation and SKB Traversal During Unverified TCP Handshakes","stars_count":108,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","xdp","ddos-mitigation","linux-kernel","tcp"],"exportEndpoints":{"claude":"/api/rules/ebpf-xdp-l4-synflood-mitigation-standard?format=claude","cursorMdc":"/api/rules/ebpf-xdp-l4-synflood-mitigation-standard?format=mdc","cursorrules":"/api/rules/ebpf-xdp-l4-synflood-mitigation-standard?format=cursor","windsurf":"/api/rules/ebpf-xdp-l4-synflood-mitigation-standard?format=windsurf","agents":"/api/rules/ebpf-xdp-l4-synflood-mitigation-standard?format=agents"}},{"id":"react19-taint-object-api-boundary-enforcement-production-standard","title":"React 19 Taint Object API Boundary Enforcement for RSC Serialization","category":"frontend","severity":"critical","description":"Enforces strict application of React 19's experimental_taintObjectReference and experimental_taintUniqueValue APIs to prevent sensitive server-side data models and cryptographic secrets from crossing the React Server Component (RSC) boundary. This guardrail ensures that server-only entities trigger deterministic build-time or runtime Flight serialization aborts if inadvertently forwarded to Client Components.","antiPatternHeadline":"Leaking Raw Server Data Models and Sensitive Primitives Across Client Boundaries via RSC Flight Serialization","stars_count":42,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","react-server-components","taint-api","security"],"exportEndpoints":{"claude":"/api/rules/react19-taint-object-api-boundary-enforcement-production-standard?format=claude","cursorMdc":"/api/rules/react19-taint-object-api-boundary-enforcement-production-standard?format=mdc","cursorrules":"/api/rules/react19-taint-object-api-boundary-enforcement-production-standard?format=cursor","windsurf":"/api/rules/react19-taint-object-api-boundary-enforcement-production-standard?format=windsurf","agents":"/api/rules/react19-taint-object-api-boundary-enforcement-production-standard?format=agents"}},{"id":"nextjs-15-async-request-cache-isolation","title":"Next.js 15 Async Request Scope & Multi-Tenant Cache Isolation Guardrail","category":"frontend","severity":"critical","description":"Enforces strict boundary isolation between Next.js 15 asynchronous dynamic request APIs (await cookies(), await headers(), searchParams) and shared data caching mechanisms (unstable_cache, Data Cache, shared CDN edge layers). Prevents critical cross-tenant data poisoning and authorization bypasses caused by persisting tenant-scoped or user-scoped data into shared cache partitions.","antiPatternHeadline":"Persisting Tenant-Specific Data into Shared Data Caches via Dynamic Async Request Closures","stars_count":111,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["nextjs","nextjs-15","cache-poisoning","multi-tenancy","server-components","app-router"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-async-request-cache-isolation?format=claude","cursorMdc":"/api/rules/nextjs-15-async-request-cache-isolation?format=mdc","cursorrules":"/api/rules/nextjs-15-async-request-cache-isolation?format=cursor","windsurf":"/api/rules/nextjs-15-async-request-cache-isolation?format=windsurf","agents":"/api/rules/nextjs-15-async-request-cache-isolation?format=agents"}},{"id":"axum-tokio-cancellation-token-propagation","title":"Axum 0.8 In-Flight Cancellation Token Propagation Guardrail","category":"backend","severity":"critical","description":"Mandates deterministic propagation of tokio_util::sync::CancellationToken and TaskTracker through Axum 0.8 middleware layers and handlers. Prevents orphaned background tasks, exhausted database connection pools, and leaked socket handles during Kubernetes zero-downtime rolling deploys and unexpected client cancellations.","antiPatternHeadline":"Spawning detached tokio tasks and ignoring shutdown signals inside Axum handlers, producing unmanaged zombie workers during rolling deployments.","stars_count":69,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tokio","tower","graceful-shutdown","kubernetes"],"exportEndpoints":{"claude":"/api/rules/axum-tokio-cancellation-token-propagation?format=claude","cursorMdc":"/api/rules/axum-tokio-cancellation-token-propagation?format=mdc","cursorrules":"/api/rules/axum-tokio-cancellation-token-propagation?format=cursor","windsurf":"/api/rules/axum-tokio-cancellation-token-propagation?format=windsurf","agents":"/api/rules/axum-tokio-cancellation-token-propagation?format=agents"}},{"id":"pg17-streaming-io-buffer-allocation-boundary","title":"PostgreSQL 17 Vectorized Streaming I/O Buffer Allocation Boundary","category":"backend","severity":"critical","description":"PostgreSQL 17 introduces asynchronous vectorized streaming I/O and prefetching for sequential scans, bitmap heap scans, and vacuum operations. Unbounded or global increases to io_combine_limit, maintenance_io_concurrency, and effective_io_concurrency under concurrent OLAP workloads cause aggressive OS page cache eviction, dirty buffer thrashing, and storage queue starvation. Database clients and query orchestrators must enforce session-scoped prefetch boundaries, strict work_mem caps, and synchronous ring-buffer protections on bulk scan operations.","antiPatternHeadline":"Global Uncapped Prefetching and Shared Memory Sizing Under Concurrent Streaming Analytical Scans","stars_count":92,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","postgresql-17","database-performance","streaming-io","io-concurrency"],"exportEndpoints":{"claude":"/api/rules/pg17-streaming-io-buffer-allocation-boundary?format=claude","cursorMdc":"/api/rules/pg17-streaming-io-buffer-allocation-boundary?format=mdc","cursorrules":"/api/rules/pg17-streaming-io-buffer-allocation-boundary?format=cursor","windsurf":"/api/rules/pg17-streaming-io-buffer-allocation-boundary?format=windsurf","agents":"/api/rules/pg17-streaming-io-buffer-allocation-boundary?format=agents"}},{"id":"bun-sqlite-wal-checkpoint-starvation-guardrail","title":"Bun 1.2 Native SQLite WAL Concurrent Read-Transaction Invariant","category":"backend","severity":"critical","description":"Mandates strict deterministic lifecycle bounds for read transactions, prepared statements, and connection-level PRAGMA configurations in Bun 1.2 native SQLite (bun:sqlite). Eliminates WAL file ballooning, memory-mapped view fragmentation, and checkpoint starvation across concurrent microservices and worker threads.","antiPatternHeadline":"Leaking Long-Lived Read Transactions and Unfinalized Statements Across Async Event Loop Turns in WAL Mode","stars_count":111,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","sqlite","wal-mode","concurrency","performance"],"exportEndpoints":{"claude":"/api/rules/bun-sqlite-wal-checkpoint-starvation-guardrail?format=claude","cursorMdc":"/api/rules/bun-sqlite-wal-checkpoint-starvation-guardrail?format=mdc","cursorrules":"/api/rules/bun-sqlite-wal-checkpoint-starvation-guardrail?format=cursor","windsurf":"/api/rules/bun-sqlite-wal-checkpoint-starvation-guardrail?format=windsurf","agents":"/api/rules/bun-sqlite-wal-checkpoint-starvation-guardrail?format=agents"}},{"id":"capacitor7-zero-copy-bridge-buffer-standard","title":"Capacitor 7 Zero-Copy Native Bridge Buffer Serialization Standard","category":"mobile","severity":"critical","description":"Enforces off-main-thread direct memory-mapped buffer transfer between WebView and native code (Android JNI ByteBuffer and iOS ArrayBuffer / CVPixelBuffer) in Capacitor 7 plugins. Eliminates main UI thread serialization overhead and hitching when ingesting high-throughput sensor streams, camera frames, and audio PCM data.","antiPatternHeadline":"Base64 or JSON-stringified sensor stream payload marshaling over WebView JavaScript-to-Native bridge","stars_count":84,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","performance","buffers","threading","zero-copy"],"exportEndpoints":{"claude":"/api/rules/capacitor7-zero-copy-bridge-buffer-standard?format=claude","cursorMdc":"/api/rules/capacitor7-zero-copy-bridge-buffer-standard?format=mdc","cursorrules":"/api/rules/capacitor7-zero-copy-bridge-buffer-standard?format=cursor","windsurf":"/api/rules/capacitor7-zero-copy-bridge-buffer-standard?format=windsurf","agents":"/api/rules/capacitor7-zero-copy-bridge-buffer-standard?format=agents"}},{"id":"kmp-coroutine-priority-inversion-fence-swift6","title":"KMP Coroutine Priority Inversion Fence for Swift 6 Actor Interop","category":"mobile","severity":"critical","description":"Prevents catastrophic main-actor thread starvation when bridging Kotlin Multiplatform (KMP) coroutines on Dispatchers.Default with Swift 6 structured concurrency. Enforces non-blocking cooperative hops, thread pool bounds isolation, and strict async-bridge fences to ensure Kotlin coroutine dispatchers do not saturate libdispatch worker threads or invert MainActor priorities.","antiPatternHeadline":"Unbounded Dispatchers.Default Bridge Saturating Darwin Dispatch Queues and Inducing MainActor Starvation","stars_count":92,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kmp","kotlin-multiplatform","swift6","concurrency","ios"],"exportEndpoints":{"claude":"/api/rules/kmp-coroutine-priority-inversion-fence-swift6?format=claude","cursorMdc":"/api/rules/kmp-coroutine-priority-inversion-fence-swift6?format=mdc","cursorrules":"/api/rules/kmp-coroutine-priority-inversion-fence-swift6?format=cursor","windsurf":"/api/rules/kmp-coroutine-priority-inversion-fence-swift6?format=windsurf","agents":"/api/rules/kmp-coroutine-priority-inversion-fence-swift6?format=agents"}},{"id":"webauthn-l3-subdomain-partitioning-standard","title":"WebAuthn L3 Multi-Tenant Subdomain RP ID Partitioning & Digital Asset Link Standard","category":"security","severity":"critical","description":"Enforces strict partitioning of WebAuthn Relying Party IDs (RP ID) in multi-tenant enterprise architectures and mandates explicit origin-to-RP ID binding via WebAuthn Level 3 Digital Asset Links (/.well-known/webauthn). Prohibits fallback to apex eTLD+1 domains across shared tenant subdomains to prevent cross-tenant credential harvesting and passkey relay vulnerabilities.","antiPatternHeadline":"Relaxing RP ID to an apex domain across multi-tenant subdomains without strict Digital Asset Link origin partitioning.","stars_count":111,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","passkeys","multi-tenant","subdomain-takeover","digital-asset-links"],"exportEndpoints":{"claude":"/api/rules/webauthn-l3-subdomain-partitioning-standard?format=claude","cursorMdc":"/api/rules/webauthn-l3-subdomain-partitioning-standard?format=mdc","cursorrules":"/api/rules/webauthn-l3-subdomain-partitioning-standard?format=cursor","windsurf":"/api/rules/webauthn-l3-subdomain-partitioning-standard?format=windsurf","agents":"/api/rules/webauthn-l3-subdomain-partitioning-standard?format=agents"}},{"id":"cilium-ebpf-ambient-mesh-socket-auth-invariant","title":"Cilium eBPF Ambient Mesh Socket-Level Authorization Invariant","category":"devops","severity":"critical","description":"Enforces cryptographic mTLS identity verification directly inside Cilium sockops eBPF programs prior to TCP handshake establishment in sidecarless service meshes. Prevents unauthenticated socket short-circuiting and sockmap bypassing across mutual transport layers. Eliminates zero-trust perimeter holes caused by speculative connection forwarding at L4 before SPIFFE ID validation completes.","antiPatternHeadline":"Bypassing Cryptographic Mutual TLS Authentication via Premature Sockops L4 Fast-Path Redirection","stars_count":111,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","cilium","ebpf","ambient-mesh","mtls","spiffe","zero-trust","kubernetes"],"exportEndpoints":{"claude":"/api/rules/cilium-ebpf-ambient-mesh-socket-auth-invariant?format=claude","cursorMdc":"/api/rules/cilium-ebpf-ambient-mesh-socket-auth-invariant?format=mdc","cursorrules":"/api/rules/cilium-ebpf-ambient-mesh-socket-auth-invariant?format=cursor","windsurf":"/api/rules/cilium-ebpf-ambient-mesh-socket-auth-invariant?format=windsurf","agents":"/api/rules/cilium-ebpf-ambient-mesh-socket-auth-invariant?format=agents"}},{"id":"opentelemetry-w3c-baggage-scrubbing-production-standard","title":"OpenTelemetry W3C Baggage Ingress Sanitization and Boundary Mutation Fencing","category":"devops","severity":"critical","description":"Enforces strict allowlist validation, key-length constraints, and PII redaction on OpenTelemetry W3C Baggage headers at untrusted network and service boundaries. Prevents unbounded metric cardinality explosion, memory bloat, and cross-tenant data exfiltration across downstream microservice call graphs. Guarantees that only explicitly declared, schema-validated operational context is propagated through distributed trace contexts.","antiPatternHeadline":"Blind Ingress Baggage Extraction and Propagation Allowing Metric Explosion and Context Tainting","stars_count":75,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","distributed-tracing","baggage","security","cardinality-control","w3c-trace-context"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-w3c-baggage-scrubbing-production-standard?format=claude","cursorMdc":"/api/rules/opentelemetry-w3c-baggage-scrubbing-production-standard?format=mdc","cursorrules":"/api/rules/opentelemetry-w3c-baggage-scrubbing-production-standard?format=cursor","windsurf":"/api/rules/opentelemetry-w3c-baggage-scrubbing-production-standard?format=windsurf","agents":"/api/rules/opentelemetry-w3c-baggage-scrubbing-production-standard?format=agents"}},{"id":"kmp-2-1-swift-export-arc-invariants","title":"Kotlin Multiplatform 2.1 Swift Export ARC and Lifecycle Invariant","category":"mobile","severity":"critical","description":"Enforces deterministic lifecycle boundaries and weak reference semantics across Kotlin Multiplatform 2.1 Direct Swift Export interfaces. Prevents permanent cross-runtime memory leaks caused by retain cycles bridging Swift Automatic Reference Counting (ARC) and Kotlin Native Garbage Collection (GC).","antiPatternHeadline":"Cross-Runtime Retain Cycles via Strong Closures and Unscoped Kotlin Export References in Swift","stars_count":108,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","swift-export","arc","memory-management","ios"],"exportEndpoints":{"claude":"/api/rules/kmp-2-1-swift-export-arc-invariants?format=claude","cursorMdc":"/api/rules/kmp-2-1-swift-export-arc-invariants?format=mdc","cursorrules":"/api/rules/kmp-2-1-swift-export-arc-invariants?format=cursor","windsurf":"/api/rules/kmp-2-1-swift-export-arc-invariants?format=windsurf","agents":"/api/rules/kmp-2-1-swift-export-arc-invariants?format=agents"}},{"id":"opentelemetry-otlp-profiles-memory-bound-invariant","title":"OpenTelemetry Continuous Profiling eBPF Delta Buffer Memory Bounding","category":"devops","severity":"critical","description":"Continuous eBPF profiling creates high-frequency stack trace deltas that can rapidly exhaust system memory under sustained CPU pressure or collector backpressure. This guardrail enforces deterministic byte-bounded ring buffers, explicit drop-on-saturation policies, and memory limiter invariants across all OTLP/Profiles aggregation pipelines to prevent node OOM crashes.","antiPatternHeadline":"Unbounded stack-trace delta aggregation maps without hard memory limits or sample drop metrics under eBPF load spikes.","stars_count":101,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","ebpf","profiling","memory-management","otlp-profiles","observability"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-otlp-profiles-memory-bound-invariant?format=claude","cursorMdc":"/api/rules/opentelemetry-otlp-profiles-memory-bound-invariant?format=mdc","cursorrules":"/api/rules/opentelemetry-otlp-profiles-memory-bound-invariant?format=cursor","windsurf":"/api/rules/opentelemetry-otlp-profiles-memory-bound-invariant?format=windsurf","agents":"/api/rules/opentelemetry-otlp-profiles-memory-bound-invariant?format=agents"}},{"id":"svelte-5-runes-async-scheduling-boundary","title":"Svelte 5 Runes Async State Scheduling Boundary & Microtask Isolation","category":"frontend","severity":"critical","description":"Enforces strict synchronous execution invariants across Svelte 5 reactive graphs, prohibiting asynchronous execution within $derived and untracked microtask mutations in $effect. Prevents state bifurcations, unhandled rejection leaks, and out-of-order reactive graph tearing by establishing explicit AbortController teardowns and task boundary isolation.","antiPatternHeadline":"Asynchronous Contamination of Synchronous Reactive Derivations and Untracked Effect Race Conditions","stars_count":88,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["svelte","svelte-5","runes","reactivity","async","concurrency"],"exportEndpoints":{"claude":"/api/rules/svelte-5-runes-async-scheduling-boundary?format=claude","cursorMdc":"/api/rules/svelte-5-runes-async-scheduling-boundary?format=mdc","cursorrules":"/api/rules/svelte-5-runes-async-scheduling-boundary?format=cursor","windsurf":"/api/rules/svelte-5-runes-async-scheduling-boundary?format=windsurf","agents":"/api/rules/svelte-5-runes-async-scheduling-boundary?format=agents"}},{"id":"fastapi-python-313-free-threaded-context-isolation","title":"FastAPI Python 3.13 Free-Threaded Context Isolation & Concurrency Guardrail","category":"backend","severity":"critical","description":"Mandates thread-safe request context isolation and synchronization in FastAPI applications deployed on Python 3.13 free-threaded (no-GIL) runtimes. Enforces strict avoidance of unsynchronized module-level mutable state and requires contextvars.ContextVar or explicit synchronization primitives to prevent cross-request race conditions, tenant data leakage, and memory corruption.","antiPatternHeadline":"Leaking Cross-Request State via Unsynchronized Module-Level Globals in Python 3.13t","stars_count":105,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["fastapi","python3.13","free-threaded","no-gil","concurrency","thread-safety","contextvars"],"exportEndpoints":{"claude":"/api/rules/fastapi-python-313-free-threaded-context-isolation?format=claude","cursorMdc":"/api/rules/fastapi-python-313-free-threaded-context-isolation?format=mdc","cursorrules":"/api/rules/fastapi-python-313-free-threaded-context-isolation?format=cursor","windsurf":"/api/rules/fastapi-python-313-free-threaded-context-isolation?format=windsurf","agents":"/api/rules/fastapi-python-313-free-threaded-context-isolation?format=agents"}},{"id":"webauthn-largeblob-hardware-vault-standard","title":"WebAuthn LargeBlob Hardware-Bound Vault Security Standard","category":"security","severity":"critical","description":"Enforces zero-knowledge cryptographic persistence by binding user symmetric encryption keys strictly to platform authenticator hardware storage via WebAuthn Level 3 largeBlob extensions. Prohibits non-hardware fallbacks, unverified extension negotiation, and plaintext key persistence across client runtime memory.","antiPatternHeadline":"Silent fallback to software storage or unverified largeBlob extension negotiation leading to key compromise.","stars_count":56,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","cryptography","zero-knowledge","fido2","largeblob"],"exportEndpoints":{"claude":"/api/rules/webauthn-largeblob-hardware-vault-standard?format=claude","cursorMdc":"/api/rules/webauthn-largeblob-hardware-vault-standard?format=mdc","cursorrules":"/api/rules/webauthn-largeblob-hardware-vault-standard?format=cursor","windsurf":"/api/rules/webauthn-largeblob-hardware-vault-standard?format=windsurf","agents":"/api/rules/webauthn-largeblob-hardware-vault-standard?format=agents"}},{"id":"pg17-tidstore-vacuum-memory-invariant","title":"PostgreSQL 17 TidStore Vacuum Memory and Worker Concurrency Invariant","category":"backend","severity":"critical","description":"PostgreSQL 17 replaces flat dead-tuple arrays with an adaptive radix tree (TidStore) for vacuuming, fundamentally altering memory consumption dynamics under high write loads. This rule enforces deterministic calibration of maintenance_work_mem and autovacuum_max_workers to eliminate out-of-memory kernel panics and index bloat during concurrent streaming table cleanups.","antiPatternHeadline":"Over-allocating maintenance_work_mem with unbounded autovacuum workers triggering OOM termination during concurrent radix-tree dead tuple index passes","stars_count":109,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql-17","autovacuum","tidstore","memory-management","database-reliability"],"exportEndpoints":{"claude":"/api/rules/pg17-tidstore-vacuum-memory-invariant?format=claude","cursorMdc":"/api/rules/pg17-tidstore-vacuum-memory-invariant?format=mdc","cursorrules":"/api/rules/pg17-tidstore-vacuum-memory-invariant?format=cursor","windsurf":"/api/rules/pg17-tidstore-vacuum-memory-invariant?format=windsurf","agents":"/api/rules/pg17-tidstore-vacuum-memory-invariant?format=agents"}},{"id":"vite6-environment-api-runtime-isolation-standard-vite-6-environme-794","title":"Vite 6 Environment API Runtime Isolation and Module Graph Segregation","category":"frontend","severity":"critical","description":"Mandates strict runtime module graph isolation between heterogeneous client, edge, and server environments using the Vite 6 Environment API. Enforces separate resolution conditions and environment-scoped plugin hooks to prevent cross-runtime global pollution, token leakage, and SSR hydration corruption.","antiPatternHeadline":"Monolithic Legacy SSR Configuration and Cross-Environment Module Graph Bleed","stars_count":80,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","vite6","environment-api","ssr","hydration","runtime-isolation"],"exportEndpoints":{"claude":"/api/rules/vite6-environment-api-runtime-isolation-standard-vite-6-environme-794?format=claude","cursorMdc":"/api/rules/vite6-environment-api-runtime-isolation-standard-vite-6-environme-794?format=mdc","cursorrules":"/api/rules/vite6-environment-api-runtime-isolation-standard-vite-6-environme-794?format=cursor","windsurf":"/api/rules/vite6-environment-api-runtime-isolation-standard-vite-6-environme-794?format=windsurf","agents":"/api/rules/vite6-environment-api-runtime-isolation-standard-vite-6-environme-794?format=agents"}},{"id":"capacitor-7-strongbox-hardware-keystore-attestation-invariant","title":"Capacitor 7 StrongBox Hardware Keystore Attestation & Encryption Invariant","category":"mobile","severity":"critical","description":"Enforces hardware-backed encryption key derivation using Android StrongBox Keymaster and Apple Secure Enclave in Capacitor 7 hybrid mobile architectures. Guarantees that local persistent SQLite and key-value database keys are bound to cryptographic enclave hardware and verified through remote device attestation before storage unlocks, preventing extraction on compromised, rooted, or hooked runtimes.","antiPatternHeadline":"Deriving Local Storage Keys in Software Without StrongBox Hardware Enclave Attestation","stars_count":115,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor-7","strongbox","secure-enclave","sqlite-encryption","remote-attestation"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-strongbox-hardware-keystore-attestation-invariant?format=claude","cursorMdc":"/api/rules/capacitor-7-strongbox-hardware-keystore-attestation-invariant?format=mdc","cursorrules":"/api/rules/capacitor-7-strongbox-hardware-keystore-attestation-invariant?format=cursor","windsurf":"/api/rules/capacitor-7-strongbox-hardware-keystore-attestation-invariant?format=windsurf","agents":"/api/rules/capacitor-7-strongbox-hardware-keystore-attestation-invariant?format=agents"}},{"id":"cilium-ebpf-map-preallocation-cgroupv2-invariant","title":"Cilium eBPF Dynamic Map Preallocation and Cgroup v2 Slab Accounting Invariant","category":"devops","severity":"critical","description":"Enforces strict eBPF map sizing, preallocation invariants, and cgroup v2 memory controller accounting for Cilium deployments. Prevents unconstrained kernel slab allocations from dynamic BPF sockhash and connection tracking tables from evading container limits and causing silent node panics.","antiPatternHeadline":"Unbounded dynamic eBPF map allocation without cgroup v2 kernel memory tracking causing host slab exhaustion","stars_count":102,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","cilium","ebpf","kubernetes","cgroupv2","kernel-memory"],"exportEndpoints":{"claude":"/api/rules/cilium-ebpf-map-preallocation-cgroupv2-invariant?format=claude","cursorMdc":"/api/rules/cilium-ebpf-map-preallocation-cgroupv2-invariant?format=mdc","cursorrules":"/api/rules/cilium-ebpf-map-preallocation-cgroupv2-invariant?format=cursor","windsurf":"/api/rules/cilium-ebpf-map-preallocation-cgroupv2-invariant?format=windsurf","agents":"/api/rules/cilium-ebpf-map-preallocation-cgroupv2-invariant?format=agents"}},{"id":"go-1-24-synctest-virtual-clock-concurrency-invariant","title":"Go 1.24 synctest Virtual Clock Concurrency and Goroutine Determinism Guardrail","category":"backend","severity":"critical","description":"Go 1.24 introduces testing/synctest to isolate asynchronous code within deterministic synthetic time bubbles. Goroutines spawned inside a synctest bubble advance virtual clocks instantaneously when all bubble goroutines are durably blocked, eliminating wall-clock race conditions and nondeterministic sleeps. Tests must strictly confine concurrent state, avoid leaking bubble-bound goroutines, and prohibit unbuffered real I/O to prevent silent deadlocks.","antiPatternHeadline":"Non-deterministic Wall-Clock Sleeps and Unbound Goroutine Racing in Asynchronous Go Unit Tests","stars_count":107,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","golang","go-1-24","synctest","concurrency","goroutines","testing"],"exportEndpoints":{"claude":"/api/rules/go-1-24-synctest-virtual-clock-concurrency-invariant?format=claude","cursorMdc":"/api/rules/go-1-24-synctest-virtual-clock-concurrency-invariant?format=mdc","cursorrules":"/api/rules/go-1-24-synctest-virtual-clock-concurrency-invariant?format=cursor","windsurf":"/api/rules/go-1-24-synctest-virtual-clock-concurrency-invariant?format=windsurf","agents":"/api/rules/go-1-24-synctest-virtual-clock-concurrency-invariant?format=agents"}},{"id":"nextjs-15-ppr-streaming-boundary-isolation-next-js-15-parti-278","title":"Next.js 15 PPR Static Shell and Dynamic Streaming Boundary Isolation","category":"frontend","severity":"critical","description":"Enforces strict isolation between static prerendered HTML shells and dynamic streaming microtasks in Next.js 15 Partial Prerendering (PPR). Dynamic runtime APIs and non-cached data access must never leak into root layout/page entry points without an intervening Suspense boundary, preventing route-level de-optimization and catastrophic edge TTFB regressions.","antiPatternHeadline":"Un-isolated Dynamic Function Invocation Collapsing the Static Shell into Blocking SSR","stars_count":40,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["nextjs15","ppr","partial-prerendering","suspense","streaming","react-server-components","ttfb"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-ppr-streaming-boundary-isolation-next-js-15-parti-278?format=claude","cursorMdc":"/api/rules/nextjs-15-ppr-streaming-boundary-isolation-next-js-15-parti-278?format=mdc","cursorrules":"/api/rules/nextjs-15-ppr-streaming-boundary-isolation-next-js-15-parti-278?format=cursor","windsurf":"/api/rules/nextjs-15-ppr-streaming-boundary-isolation-next-js-15-parti-278?format=windsurf","agents":"/api/rules/nextjs-15-ppr-streaming-boundary-isolation-next-js-15-parti-278?format=agents"}},{"id":"svelte-5-runes-reactive-graph-untrack-invariant","title":"Svelte 5 Runes Reactive Graph Deep Mutation and Untrack Invariant","category":"frontend","severity":"critical","description":"Enforces deterministic signal dependency tracking in Svelte 5 by establishing strict boundaries between reactive triggers and non-reactive graph reads or deep mutations. Mandates the use of untrack() inside effects to prevent unintended dependency subscription loops, cyclic cascade thrashing, and memory degradation across high-frequency mutable UI graphs.","antiPatternHeadline":"Cyclic Signal Thrashing via Unbounded Reactive Reads in Deeply Mutated Svelte 5 Effects","stars_count":84,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","reactivity","signals","performance"],"exportEndpoints":{"claude":"/api/rules/svelte-5-runes-reactive-graph-untrack-invariant?format=claude","cursorMdc":"/api/rules/svelte-5-runes-reactive-graph-untrack-invariant?format=mdc","cursorrules":"/api/rules/svelte-5-runes-reactive-graph-untrack-invariant?format=cursor","windsurf":"/api/rules/svelte-5-runes-reactive-graph-untrack-invariant?format=windsurf","agents":"/api/rules/svelte-5-runes-reactive-graph-untrack-invariant?format=agents"}},{"id":"go-chi-http3-quic-stream-context-propagation","title":"Go 1.24 Chi Context-Propagated HTTP/3 Stream Multiplexing Guardrail","category":"backend","severity":"critical","description":"Enforces strict context propagation and QUIC stream-cancellation handling in Go 1.24 Chi HTTP/3 services. Prevents orphaned background goroutine leaks and unbounded memory expansion when multiplexed QUIC client streams abruptly reset under heavy ingress load.","antiPatternHeadline":"Spawning detached background workers or unmonitored channels from r.Context() during QUIC stream multiplexing resets","stars_count":103,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","http3","quic","chi","concurrency","performance"],"exportEndpoints":{"claude":"/api/rules/go-chi-http3-quic-stream-context-propagation?format=claude","cursorMdc":"/api/rules/go-chi-http3-quic-stream-context-propagation?format=mdc","cursorrules":"/api/rules/go-chi-http3-quic-stream-context-propagation?format=cursor","windsurf":"/api/rules/go-chi-http3-quic-stream-context-propagation?format=windsurf","agents":"/api/rules/go-chi-http3-quic-stream-context-propagation?format=agents"}},{"id":"bun-tcp-fastopen-connection-pool-invariants","title":"Bun 1.2 Native TCP FastOpen Client Connection Pooling and Lifecycle Invariant","category":"backend","severity":"critical","description":"Enforces strict TCP FastOpen (TFO) socket lifecycle management, bounded persistent pooling, and aggressive half-open cleanup across Bun 1.2 clustered runtimes. Prevents kernel socket starvation, hung SYN-sent states, and file descriptor leaks under high-throughput network churn.","antiPatternHeadline":"Unbounded Bun.connect() FastOpen invocations omitting deterministic handshake timeouts, keep-alive probes, and forced socket termination.","stars_count":103,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","networking","tcp","fast-open","connection-pooling"],"exportEndpoints":{"claude":"/api/rules/bun-tcp-fastopen-connection-pool-invariants?format=claude","cursorMdc":"/api/rules/bun-tcp-fastopen-connection-pool-invariants?format=mdc","cursorrules":"/api/rules/bun-tcp-fastopen-connection-pool-invariants?format=cursor","windsurf":"/api/rules/bun-tcp-fastopen-connection-pool-invariants?format=windsurf","agents":"/api/rules/bun-tcp-fastopen-connection-pool-invariants?format=agents"}},{"id":"kmp-shared-stateflow-coroutine-exception-boundary-standard","title":"KMP Shared StateFlow Cross-Platform Coroutine Exception Boundary Standard","category":"mobile","severity":"critical","description":"Enforces deterministic coroutine exception containment within Kotlin Multiplatform (KMP) shared state machines driving StateFlow observables. Prevents unhandled asynchronous exceptions from bypassing native boundary boundaries, which triggers uncaught fatal signals (SIGABRT/Crashlytics fatals) on iOS runtimes and unhandled ThreadDeath/Crash on Android UI main loops.","antiPatternHeadline":"Uncontained coroutine scope launches propagating uncaught exceptions across Swift/Kotlin boundaries causing instant iOS SIGABRT termination","stars_count":100,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kmp","kotlin-multiplatform","coroutines","stateflow","ios-crash-prevention"],"exportEndpoints":{"claude":"/api/rules/kmp-shared-stateflow-coroutine-exception-boundary-standard?format=claude","cursorMdc":"/api/rules/kmp-shared-stateflow-coroutine-exception-boundary-standard?format=mdc","cursorrules":"/api/rules/kmp-shared-stateflow-coroutine-exception-boundary-standard?format=cursor","windsurf":"/api/rules/kmp-shared-stateflow-coroutine-exception-boundary-standard?format=windsurf","agents":"/api/rules/kmp-shared-stateflow-coroutine-exception-boundary-standard?format=agents"}},{"id":"swift-6-observable-state-concurrency-boundary","title":"Swift 6 Strict Concurrency Observable State Mutation Boundary","category":"mobile","severity":"critical","description":"Enforces deterministic actor isolation boundaries when processing and committing state updates to `@Observable` trees under Swift 6 strict concurrency. Prohibits fine-grained main-actor hops inside background loops and unisolated graph mutation, mandating background processing of immutable Sendable transfer objects with atomic, non-suspending MainActor batch application.","antiPatternHeadline":"Interleaved MainActor hops and unisolated direct mutations of deep @Observable graphs from background tasks","stars_count":48,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","swift6","strict-concurrency","observation","mainactor","swift-concurrency"],"exportEndpoints":{"claude":"/api/rules/swift-6-observable-state-concurrency-boundary?format=claude","cursorMdc":"/api/rules/swift-6-observable-state-concurrency-boundary?format=mdc","cursorrules":"/api/rules/swift-6-observable-state-concurrency-boundary?format=cursor","windsurf":"/api/rules/swift-6-observable-state-concurrency-boundary?format=windsurf","agents":"/api/rules/swift-6-observable-state-concurrency-boundary?format=agents"}},{"id":"ml-kem-hybrid-tls13-pq-key-exchange","title":"ML-KEM Hybrid TLS 1.3 Post-Quantum Key Exchange Enforcement","category":"security","severity":"critical","description":"Enforces dual-key post-quantum hybrid key encapsulation (X25519MLKEM768 / FIPS 203) across all public edge ingress terminations and reverse proxies. Prevents Store-Now-Decrypt-Later (SNDL) exploitation by guaranteeing that quantum-capable adversaries cannot retroactively decrypt captured external sessions once cryptographically relevant quantum computers (CRQC) emerge.","antiPatternHeadline":"Classical-Only ECDH Negotiation Leaving External Ingress Vulnerable to SNDL Capture","stars_count":113,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","tls-1.3","post-quantum-cryptography","ml-kem","fips-203","cryptography","zero-trust"],"exportEndpoints":{"claude":"/api/rules/ml-kem-hybrid-tls13-pq-key-exchange?format=claude","cursorMdc":"/api/rules/ml-kem-hybrid-tls13-pq-key-exchange?format=mdc","cursorrules":"/api/rules/ml-kem-hybrid-tls13-pq-key-exchange?format=cursor","windsurf":"/api/rules/ml-kem-hybrid-tls13-pq-key-exchange?format=windsurf","agents":"/api/rules/ml-kem-hybrid-tls13-pq-key-exchange?format=agents"}},{"id":"openfga-bounded-traversal-cycle-detection-invariant","title":"OpenFGA Bounded Graph Traversal & Cycle-Detection Depth Invariant","category":"security","severity":"critical","description":"Protects distributed authorization engines against catastrophic query latency spikes, resource exhaustion, and Denial of Service (DoS) caused by circular or unbounded nested group expansions. Mandates deterministic max-depth limits, visited-set cycle detection, and strict timeouts for all relationship tuple lookups and custom graph expansions. Enforces validation guards in both application-layer tuple ingestion pipelines and custom authorization middleware.","antiPatternHeadline":"Unbounded recursive traversal of nested group tuples without visited-set tracking or hard depth caps","stars_count":83,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","authorization","graph-traversal","rebac","dos-prevention"],"exportEndpoints":{"claude":"/api/rules/openfga-bounded-traversal-cycle-detection-invariant?format=claude","cursorMdc":"/api/rules/openfga-bounded-traversal-cycle-detection-invariant?format=mdc","cursorrules":"/api/rules/openfga-bounded-traversal-cycle-detection-invariant?format=cursor","windsurf":"/api/rules/openfga-bounded-traversal-cycle-detection-invariant?format=windsurf","agents":"/api/rules/openfga-bounded-traversal-cycle-detection-invariant?format=agents"}},{"id":"opentelemetry-w3c-baggage-amplification-truncation-guardrail","title":"OpenTelemetry W3C Baggage Header Bounds and Amplification Guardrail","category":"devops","severity":"critical","description":"Propagating unconstrained W3C Baggage headers across microservice topologies induces header-bloat amplification attacks and triggers HTTP 431 (Request Header Fields Too Large) outages in ingress controllers and service mesh sidecars. This guardrail mandates bounded baggage propagation with strict aggregate byte-size limits, entry count caps, key allowlisting, and deterministic truncation before context injection.","antiPatternHeadline":"Unbounded Context Propagation Leading to Service Mesh Header Buffer Overflow (HTTP 431)","stars_count":51,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","observability","distributed-tracing","w3c-baggage","service-mesh","security"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-w3c-baggage-amplification-truncation-guardrail?format=claude","cursorMdc":"/api/rules/opentelemetry-w3c-baggage-amplification-truncation-guardrail?format=mdc","cursorrules":"/api/rules/opentelemetry-w3c-baggage-amplification-truncation-guardrail?format=cursor","windsurf":"/api/rules/opentelemetry-w3c-baggage-amplification-truncation-guardrail?format=windsurf","agents":"/api/rules/opentelemetry-w3c-baggage-amplification-truncation-guardrail?format=agents"}},{"id":"react-19-rsc-taint-boundary-standard-react-19-server--197","title":"React 19 Server Components Cryptographic Object Taint Boundary Standard","category":"frontend","severity":"critical","description":"Enforces strict cryptographic serialization boundaries across React 19 Server Components using experimental_taintObjectReference and experimental_taintUniqueValue primitives. Guarantees that raw data layer entities, credentials, and PII are structurally blocked from crossing RSC serialization boundaries into client bundles. Prevents silent data exfiltration by failing fast during RSC payload streaming if tainted memory references or scalar values are referenced in client props.","antiPatternHeadline":"Accidental Client Serialization of Raw DB Entities, Internal Auth Tokens, or PII Across RSC Boundaries","stars_count":93,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","rsc","taint-api","security","zero-leakage","nextjs"],"exportEndpoints":{"claude":"/api/rules/react-19-rsc-taint-boundary-standard-react-19-server--197?format=claude","cursorMdc":"/api/rules/react-19-rsc-taint-boundary-standard-react-19-server--197?format=mdc","cursorrules":"/api/rules/react-19-rsc-taint-boundary-standard-react-19-server--197?format=cursor","windsurf":"/api/rules/react-19-rsc-taint-boundary-standard-react-19-server--197?format=windsurf","agents":"/api/rules/react-19-rsc-taint-boundary-standard-react-19-server--197?format=agents"}},{"id":"vite-6-environment-api-multi-runtime-isolation-vite-6-environme-755","title":"Vite 6 Environment API Multi-Runtime SSR Isolation Protocol","category":"frontend","severity":"critical","description":"Enforces strict isolated execution boundaries and per-runtime ModuleRunner instances when leveraging the Vite 6 Environment API across heterogeneous targets (e.g., Client, Node.js SSR, and Cloudflare Workers). Eliminates cross-environment state leaks, shared module graph contamination, and illegal global namespace access between isolated worker runtimes and host processes.","antiPatternHeadline":"Global Module Graph Bleed and Shared ModuleRunner Execution Across Heterogeneous Runtimes","stars_count":69,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","vite6","ssr","environment-api","edge-workers","module-runner"],"exportEndpoints":{"claude":"/api/rules/vite-6-environment-api-multi-runtime-isolation-vite-6-environme-755?format=claude","cursorMdc":"/api/rules/vite-6-environment-api-multi-runtime-isolation-vite-6-environme-755?format=mdc","cursorrules":"/api/rules/vite-6-environment-api-multi-runtime-isolation-vite-6-environme-755?format=cursor","windsurf":"/api/rules/vite-6-environment-api-multi-runtime-isolation-vite-6-environme-755?format=windsurf","agents":"/api/rules/vite-6-environment-api-multi-runtime-isolation-vite-6-environme-755?format=agents"}},{"id":"svelte-5-runes-signal-graph-cycle-guardrail-svelte-5-runes-s-961","title":"Svelte 5 Runes Signal Graph Cycle and Deep State Mutation Guardrail","category":"frontend","severity":"critical","description":"Enforces strict signal purity and cycle-free reactive graphs across Svelte 5 enterprise applications. Prohibits state mutation side effects inside $derived expressions, eliminates recursive reactive loops within $effect blocks, and mandates explicit state boundary encapsulation for complex nested telemetry and dashboard models.","antiPatternHeadline":"Cyclic Signal Graph Cascades, Side-Effect Leaks in $derived Runes, and Untracked Deep Proxy Mutations","stars_count":114,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","signals","reactivity","state-management","performance"],"exportEndpoints":{"claude":"/api/rules/svelte-5-runes-signal-graph-cycle-guardrail-svelte-5-runes-s-961?format=claude","cursorMdc":"/api/rules/svelte-5-runes-signal-graph-cycle-guardrail-svelte-5-runes-s-961?format=mdc","cursorrules":"/api/rules/svelte-5-runes-signal-graph-cycle-guardrail-svelte-5-runes-s-961?format=cursor","windsurf":"/api/rules/svelte-5-runes-signal-graph-cycle-guardrail-svelte-5-runes-s-961?format=windsurf","agents":"/api/rules/svelte-5-runes-signal-graph-cycle-guardrail-svelte-5-runes-s-961?format=agents"}},{"id":"axum-hyper-graceful-connection-drain-axum-0-8-gracefu-205","title":"Axum 0.8 & Hyper Two-Phase Graceful Connection Drain Invariant","category":"backend","severity":"critical","description":"Mandates a deterministic two-phase connection drain architecture for Axum 0.8 and Hyper servers during rolling and blue-green deployments. Enforces an ingress propagation buffer before stopping the listener and coordinates Tokio cancellation tokens with Hyper HTTP/1.1 and HTTP/2 connection drain states to eliminate dropped TCP packets and HTTP 502 Bad Gateway errors.","antiPatternHeadline":"Immediate Listener Teardown on SIGTERM Causing Ingress Connection Drops and RST Packet Spikes","stars_count":110,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","hyper","tokio","kubernetes","zero-downtime"],"exportEndpoints":{"claude":"/api/rules/axum-hyper-graceful-connection-drain-axum-0-8-gracefu-205?format=claude","cursorMdc":"/api/rules/axum-hyper-graceful-connection-drain-axum-0-8-gracefu-205?format=mdc","cursorrules":"/api/rules/axum-hyper-graceful-connection-drain-axum-0-8-gracefu-205?format=cursor","windsurf":"/api/rules/axum-hyper-graceful-connection-drain-axum-0-8-gracefu-205?format=windsurf","agents":"/api/rules/axum-hyper-graceful-connection-drain-axum-0-8-gracefu-205?format=agents"}},{"id":"openfga-rebac-cycle-detection-bounded-depth","title":"OpenFGA Zanzibar-Style Cycle Detection & Bounded Depth Evaluation Standard","category":"backend","severity":"critical","description":"Enforces deterministic cycle detection, breadth/depth-budget constraints, and visited-node memoization during ReBAC relationship-tuple evaluation. Prevents Denial-of-Service, thread starvation, and call-stack exhaustion caused by circular group memberships, nested folder hierarchies, and unbounded userset graph expansions.","antiPatternHeadline":"Unbounded Recursive Traversal and Missing Visited-State Tracking in Graph Authorization Queries","stars_count":118,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","openfga","rebac","zanzibar","authorization","cycle-detection","security"],"exportEndpoints":{"claude":"/api/rules/openfga-rebac-cycle-detection-bounded-depth?format=claude","cursorMdc":"/api/rules/openfga-rebac-cycle-detection-bounded-depth?format=mdc","cursorrules":"/api/rules/openfga-rebac-cycle-detection-bounded-depth?format=cursor","windsurf":"/api/rules/openfga-rebac-cycle-detection-bounded-depth?format=windsurf","agents":"/api/rules/openfga-rebac-cycle-detection-bounded-depth?format=agents"}},{"id":"kmp-coroutine-dispatcher-thread-confinement-invariant","title":"KMP Coroutine Dispatcher Thread-Confinement Invariant Across Darwin and Android JNI Bridges","category":"mobile","severity":"critical","description":"Enforces strict dispatcher injection and platform thread-confinement invariants across Kotlin Multiplatform boundaries. Prevents Darwin main-thread freeze, JNI thread detachment deadlocks, and cross-isolate memory corruption by forbidding hardcoded standard dispatchers, unconfined bridge calls, and unmanaged GlobalScope instances across Kotlin/Native and Kotlin/JVM layers.","antiPatternHeadline":"Hardcoded Dispatchers.IO/Main Leaking Across Darwin and Android FFI Boundaries Causing Deadlocks and Crashes","stars_count":53,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","coroutines","ios-darwin","android-jni","threading"],"exportEndpoints":{"claude":"/api/rules/kmp-coroutine-dispatcher-thread-confinement-invariant?format=claude","cursorMdc":"/api/rules/kmp-coroutine-dispatcher-thread-confinement-invariant?format=mdc","cursorrules":"/api/rules/kmp-coroutine-dispatcher-thread-confinement-invariant?format=cursor","windsurf":"/api/rules/kmp-coroutine-dispatcher-thread-confinement-invariant?format=windsurf","agents":"/api/rules/kmp-coroutine-dispatcher-thread-confinement-invariant?format=agents"}},{"id":"pqc-ml-kem-hybrid-tls13-ingress-standard","title":"Post-Quantum Cryptography (PQC) ML-KEM Hybrid TLS 1.3 Ingress Standard","category":"security","severity":"critical","description":"Enforces post-quantum hybrid key encapsulation mechanisms (specifically X25519MLKEM768 / X25519Kyber768Draft00) and strict TLS 1.3 across all edge ingress listeners, API gateways, and microservice reverse proxies. Mitigates 'harvest now, decrypt later' (HNDL) attacks by rejecting pre-TLS 1.3 handshakes and preventing silent negotiation downgrade to classical-only key exchange groups.","antiPatternHeadline":"Permitting Classical-Only Key Exchange or TLS 1.2 on Edge Ingress Exposing Traffic to Retroactive Quantum Decryption","stars_count":67,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","cryptography","pqc","ml-kem","tls1.3","zero-trust","infrastructure"],"exportEndpoints":{"claude":"/api/rules/pqc-ml-kem-hybrid-tls13-ingress-standard?format=claude","cursorMdc":"/api/rules/pqc-ml-kem-hybrid-tls13-ingress-standard?format=mdc","cursorrules":"/api/rules/pqc-ml-kem-hybrid-tls13-ingress-standard?format=cursor","windsurf":"/api/rules/pqc-ml-kem-hybrid-tls13-ingress-standard?format=windsurf","agents":"/api/rules/pqc-ml-kem-hybrid-tls13-ingress-standard?format=agents"}},{"id":"cilium-tetragon-ebpf-capability-escalation-prevention-standard","title":"Cilium Tetragon eBPF Runtime Capability Escalation and Container Escape Prevention Standard","category":"security","severity":"critical","description":"Enforces deterministic, kernel-level eBPF TracingPolicy definitions with active SIGKILL overrides to block runtime privilege escalation, namespace pivots, and unauthorized kernel credential modification. Mandates that telemetry monitors commit_creds, setns, and cap_capable syscalls and kernel functions with explicit capability masks and in-kernel automated termination.","antiPatternHeadline":"Passive Audit-Only Tracing and Unconstrained Capability Checks Permitting In-Kernel Container Escapes","stars_count":100,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","cilium","tetragon","ebpf","kubernetes","runtime-security","container-escape"],"exportEndpoints":{"claude":"/api/rules/cilium-tetragon-ebpf-capability-escalation-prevention-standard?format=claude","cursorMdc":"/api/rules/cilium-tetragon-ebpf-capability-escalation-prevention-standard?format=mdc","cursorrules":"/api/rules/cilium-tetragon-ebpf-capability-escalation-prevention-standard?format=cursor","windsurf":"/api/rules/cilium-tetragon-ebpf-capability-escalation-prevention-standard?format=windsurf","agents":"/api/rules/cilium-tetragon-ebpf-capability-escalation-prevention-standard?format=agents"}},{"id":"opentelemetry-otlp-backpressure-adaptive-tail-drop-invariant","title":"OpenTelemetry OTLP Backpressure and Adaptive Tail-Drop Buffer Invariant","category":"devops","severity":"critical","description":"Enforces deterministic, non-blocking telemetry pipelines in high-throughput applications and collectors to prevent Out-Of-Memory (OOM) failures under sudden load spikes. Mandates strict queue size limits, adaptive tail-drop or reservoir-based head sampling, and non-blocking export behavior that prioritizes application execution over telemetry preservation. Prohibits unbounded in-memory queues and synchronous blocking calls during trace or metric dispatch.","antiPatternHeadline":"Unbounded Batch Span Processors and Blocking Export Queues Causing Process OOM Crashes","stars_count":87,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","observability","backpressure","resilience","otlp","memory-management"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-otlp-backpressure-adaptive-tail-drop-invariant?format=claude","cursorMdc":"/api/rules/opentelemetry-otlp-backpressure-adaptive-tail-drop-invariant?format=mdc","cursorrules":"/api/rules/opentelemetry-otlp-backpressure-adaptive-tail-drop-invariant?format=cursor","windsurf":"/api/rules/opentelemetry-otlp-backpressure-adaptive-tail-drop-invariant?format=windsurf","agents":"/api/rules/opentelemetry-otlp-backpressure-adaptive-tail-drop-invariant?format=agents"}},{"id":"tauri-v2-mobile-ipc-zerocopy-isolation","title":"Tauri 2.0 Mobile IPC Zero-Copy ArrayBuffer Transfer & Memory Isolation Guardrail","category":"mobile","severity":"critical","description":"Enforces strict transfer semantics, buffer detachment, and lifetime isolation when streaming high-bandwidth binary data across Tauri 2.0 IPC between Rust and mobile WebViews (WebKit/WKWebView and Android WebView). Prevents silent data corruption, use-after-free, and double-free conditions caused by concurrent mutations of shared memory buffers or improper JNI/WebKit FFI pointer lifecycle management.","antiPatternHeadline":"Mutating Shared ArrayBuffer Instances Post-IPC Dispatch or Unsafely Aliasing Raw JNI/WebKit Byte Buffers","stars_count":45,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri-v2","ipc","zero-copy","rust","arraybuffer","memory-safety"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-mobile-ipc-zerocopy-isolation?format=claude","cursorMdc":"/api/rules/tauri-v2-mobile-ipc-zerocopy-isolation?format=mdc","cursorrules":"/api/rules/tauri-v2-mobile-ipc-zerocopy-isolation?format=cursor","windsurf":"/api/rules/tauri-v2-mobile-ipc-zerocopy-isolation?format=windsurf","agents":"/api/rules/tauri-v2-mobile-ipc-zerocopy-isolation?format=agents"}},{"id":"kmp-skia-surface-destruction-synchronization","title":"KMP Skia Native Render Surface Lifecycle Synchronization","category":"mobile","severity":"critical","description":"Enforces synchronous teardown of Skia hardware render targets during Android SurfaceHolder lifecycle and iOS CAMetalLayer view controller teardown. Asynchronous deallocation permits the native OS compositor to destroy backing native windows while Skia render passes are still in flight, triggering headless graphics driver panics and SIGSEGV memory faults.","antiPatternHeadline":"Asynchronous or Unsynchronized Native GPU Render-Surface Teardown in Multiplatform Bindings","stars_count":64,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","compose-multiplatform","skia","metal","vulkan","surface-lifecycle"],"exportEndpoints":{"claude":"/api/rules/kmp-skia-surface-destruction-synchronization?format=claude","cursorMdc":"/api/rules/kmp-skia-surface-destruction-synchronization?format=mdc","cursorrules":"/api/rules/kmp-skia-surface-destruction-synchronization?format=cursor","windsurf":"/api/rules/kmp-skia-surface-destruction-synchronization?format=windsurf","agents":"/api/rules/kmp-skia-surface-destruction-synchronization?format=agents"}},{"id":"vite-6-environment-api-runtime-boundary-invariant","title":"Vite 6 Environment API Multi-Runtime Context Boundary Invariant","category":"frontend","severity":"critical","description":"Enforces strict physical isolation across execution environments (client, Node.js SSR, and edge runtimes) within the Vite 6 Environment API. Prevents cross-runtime module graph pollution, leaked global polyfills, and improper shared plugin state across disparate target runtimes during isomorphic build and dev evaluation.","antiPatternHeadline":"Conflating Module Resolution Contexts and Leaking Node Polyfills into Edge Runtimes via Legacy SSR Flags","stars_count":41,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","vite6","environment-api","ssr","edge-runtime","isomorphic-architecture"],"exportEndpoints":{"claude":"/api/rules/vite-6-environment-api-runtime-boundary-invariant?format=claude","cursorMdc":"/api/rules/vite-6-environment-api-runtime-boundary-invariant?format=mdc","cursorrules":"/api/rules/vite-6-environment-api-runtime-boundary-invariant?format=cursor","windsurf":"/api/rules/vite-6-environment-api-runtime-boundary-invariant?format=windsurf","agents":"/api/rules/vite-6-environment-api-runtime-boundary-invariant?format=agents"}},{"id":"webauthn-prf-symmetric-key-derivation-guardrail-webauthn-prf-ext-756","title":"WebAuthn PRF Cryptographically Bound Salt Rotation and HKDF Isolation","category":"security","severity":"critical","description":"Enforces cryptographically bound, context-specific salt rotation when deriving client-side symmetric encryption keys using the WebAuthn PRF (Pseudo-Random Function) extension. Prevents cross-service replay, credential correlation across multi-device passkey synchronizations, and dictionary attacks by requiring client-side HKDF domain separation with authenticated user and credential context.","antiPatternHeadline":"Deriving Symmetric Encryption Keys Using Static or Unbound PRF Salts Across Passkey Synchronizations","stars_count":78,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","prf-extension","cryptography","hkdf","passkeys"],"exportEndpoints":{"claude":"/api/rules/webauthn-prf-symmetric-key-derivation-guardrail-webauthn-prf-ext-756?format=claude","cursorMdc":"/api/rules/webauthn-prf-symmetric-key-derivation-guardrail-webauthn-prf-ext-756?format=mdc","cursorrules":"/api/rules/webauthn-prf-symmetric-key-derivation-guardrail-webauthn-prf-ext-756?format=cursor","windsurf":"/api/rules/webauthn-prf-symmetric-key-derivation-guardrail-webauthn-prf-ext-756?format=windsurf","agents":"/api/rules/webauthn-prf-symmetric-key-derivation-guardrail-webauthn-prf-ext-756?format=agents"}},{"id":"postgres-17-json-table-memory-bound-standard","title":"Postgres 17 JSON_TABLE Dynamic Execution Memory Bound Standard","category":"backend","severity":"critical","description":"Enforces deterministic memory bounds and query timeouts on Postgres 17 SQL/JSON JSON_TABLE projections across streaming ingest pipelines. Prevents adversarial, deep-nested, or oversized JSON payloads from triggering backend Out-Of-Memory (OOM) terminations and cascading worker evictions.","antiPatternHeadline":"Unbounded JSON_TABLE Projections on Untrusted Ingest Payloads Inducing Backend Worker OOM Kills","stars_count":68,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres-17","json-table","performance","memory-management","sql"],"exportEndpoints":{"claude":"/api/rules/postgres-17-json-table-memory-bound-standard?format=claude","cursorMdc":"/api/rules/postgres-17-json-table-memory-bound-standard?format=mdc","cursorrules":"/api/rules/postgres-17-json-table-memory-bound-standard?format=cursor","windsurf":"/api/rules/postgres-17-json-table-memory-bound-standard?format=windsurf","agents":"/api/rules/postgres-17-json-table-memory-bound-standard?format=agents"}},{"id":"go-chi-http3-early-data-anti-replay-defense","title":"Strict HTTP/3 0-RTT Early-Data Anti-Replay Guardrail for Go Chi 5.1","category":"backend","severity":"critical","description":"Enforces multiplexer-level quarantine against HTTP/3 0-RTT early-data replay attacks on non-idempotent endpoints in Go Chi 5.1 applications. Mandates immediate rejection with HTTP 425 Too Early for state-mutating HTTP methods arriving via 0-RTT early data frames before request bodies are buffered or business logic is reached. Prevents financial double-spend, duplicate resource creation, and unauthorized side effects caused by network-level packet retransmission.","antiPatternHeadline":"Executing state-mutating Chi handlers during 0-RTT early data without RFC 8470 425 rejection","stars_count":77,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","chi","http3","quic","zero-rtt","security","anti-replay"],"exportEndpoints":{"claude":"/api/rules/go-chi-http3-early-data-anti-replay-defense?format=claude","cursorMdc":"/api/rules/go-chi-http3-early-data-anti-replay-defense?format=mdc","cursorrules":"/api/rules/go-chi-http3-early-data-anti-replay-defense?format=cursor","windsurf":"/api/rules/go-chi-http3-early-data-anti-replay-defense?format=windsurf","agents":"/api/rules/go-chi-http3-early-data-anti-replay-defense?format=agents"}},{"id":"bun-vfs-path-traversal-isolation","title":"Bun 1.2 Standalone Executable VFS Path Traversal and Symlink Isolation","category":"backend","severity":"critical","description":"Enforces strict virtual file system (VFS) boundaries within Bun 1.2 standalone compiled executables (`bun build --compile`). Prevents canonicalized path traversal (`../`) and symlink dereference attacks from breaking out of `$bunfs/root` into host OS filesystems (`/etc`, `C:\\Windows`). Requires safe resolution primitives and explicit verification against embed roots before calling `Bun.file()` or `node:fs` APIs.","antiPatternHeadline":"Unsanitized Path Concatenation and Blind Symlink Resolution Escaping Bun Embedded VFS Root","stars_count":84,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","security","vfs","path-traversal","compilation"],"exportEndpoints":{"claude":"/api/rules/bun-vfs-path-traversal-isolation?format=claude","cursorMdc":"/api/rules/bun-vfs-path-traversal-isolation?format=mdc","cursorrules":"/api/rules/bun-vfs-path-traversal-isolation?format=cursor","windsurf":"/api/rules/bun-vfs-path-traversal-isolation?format=windsurf","agents":"/api/rules/bun-vfs-path-traversal-isolation?format=agents"}},{"id":"ebpf-tc-sockmesh-conntrack-sync-production-standard","title":"eBPF TC Socket-to-Socket Redirection Netfilter Conntrack State Synchronization","category":"devops","severity":"critical","description":"Enforces mandatory bidirectional Netfilter connection tracking (conntrack) synchronization whenever using eBPF TC (clsact) or sockops helpers for socket-to-socket fast-path redirection. Bypassing the host TCP/IP stack without atomically seeding and updating kernel conntrack tuples leads to catastrophic, silent packet drops via `INVALID` ctstate matches upon fallback, asymmetric routing, or connection termination.","antiPatternHeadline":"Bypassing Host TCP Stack via BPF Sockmesh Without Bidirectional Conntrack State Seeding","stars_count":55,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","networking","conntrack","tc","cilium","kernel"],"exportEndpoints":{"claude":"/api/rules/ebpf-tc-sockmesh-conntrack-sync-production-standard?format=claude","cursorMdc":"/api/rules/ebpf-tc-sockmesh-conntrack-sync-production-standard?format=mdc","cursorrules":"/api/rules/ebpf-tc-sockmesh-conntrack-sync-production-standard?format=cursor","windsurf":"/api/rules/ebpf-tc-sockmesh-conntrack-sync-production-standard?format=windsurf","agents":"/api/rules/ebpf-tc-sockmesh-conntrack-sync-production-standard?format=agents"}},{"id":"opentelemetry-baggage-hmac-attestation-invariant","title":"OpenTelemetry W3C Baggage HMAC Cryptographic Attestation Invariant","category":"devops","severity":"critical","description":"Enforces cryptographic signing and strict constant-time HMAC validation of cross-boundary OpenTelemetry W3C Baggage entries to prevent header spoofing and privilege escalation. Propagated multi-tenant metadata such as tenant IDs, user identities, and capability scopes must include a deterministic HMAC signature attribute that is verified at trust boundaries. Downstream services must discard unsigned or invalidly signed baggage entries prior to contextual decision-making or log enrichment.","antiPatternHeadline":"Blind Trust of Unsigned W3C Baggage Headers in Multi-Tenant Observability and Routing Pipelines","stars_count":114,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","w3c-baggage","security","cryptography","distributed-tracing","multi-tenancy"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-baggage-hmac-attestation-invariant?format=claude","cursorMdc":"/api/rules/opentelemetry-baggage-hmac-attestation-invariant?format=mdc","cursorrules":"/api/rules/opentelemetry-baggage-hmac-attestation-invariant?format=cursor","windsurf":"/api/rules/opentelemetry-baggage-hmac-attestation-invariant?format=windsurf","agents":"/api/rules/opentelemetry-baggage-hmac-attestation-invariant?format=agents"}},{"id":"openfga-ephemeral-lease-ttl-standard","title":"OpenFGA Ephemeral Relationship Lease & Cryptographic TTL Verification Standard","category":"security","severity":"critical","description":"Mandates that all temporary access entitlements in OpenFGA are modeled as conditional relationship tuples evaluated against cryptographically verified timestamps. Prevents authorization bypass caused by distributed storage replication lag where deleted tuples remain queryable in read replicas.","antiPatternHeadline":"Relying on Asynchronous Tuple Deletion or Unconditional Tuples for Ephemeral Authorization","stars_count":86,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","authorization","distributed-systems","ttl","cryptography"],"exportEndpoints":{"claude":"/api/rules/openfga-ephemeral-lease-ttl-standard?format=claude","cursorMdc":"/api/rules/openfga-ephemeral-lease-ttl-standard?format=mdc","cursorrules":"/api/rules/openfga-ephemeral-lease-ttl-standard?format=cursor","windsurf":"/api/rules/openfga-ephemeral-lease-ttl-standard?format=windsurf","agents":"/api/rules/openfga-ephemeral-lease-ttl-standard?format=agents"}},{"id":"postgres-17-json-table-relational-projection","title":"Postgres 17 JSON_TABLE In-Engine Relational Projection","category":"backend","severity":"critical","description":"Mandates the use of PostgreSQL 17 SQL/JSON standard JSON_TABLE projections for semi-structured document ingestion and querying. Prohibits transferring unparsed JSON payloads to middle-tier application runtimes for manual deserialization, flattening, and relational transformation, which degrades throughput and introduces compute engine memory pressure.","antiPatternHeadline":"Middle-Tier JSON Hydration and In-Memory Normalization Anti-Pattern","stars_count":90,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","sql-json","performance","database-design"],"exportEndpoints":{"claude":"/api/rules/postgres-17-json-table-relational-projection?format=claude","cursorMdc":"/api/rules/postgres-17-json-table-relational-projection?format=mdc","cursorrules":"/api/rules/postgres-17-json-table-relational-projection?format=cursor","windsurf":"/api/rules/postgres-17-json-table-relational-projection?format=windsurf","agents":"/api/rules/postgres-17-json-table-relational-projection?format=agents"}},{"id":"bun-websocket-backpressure-buffer-ring-invariant","title":"Bun 1.2 Zero-Copy WebSocket Backpressure and Buffer Ring Invariant","category":"backend","severity":"critical","description":"Enforces non-blocking WebSocket I/O through strict backpressure monitoring using ws.bufferedAmount, the drain lifecycle hook, and zero-copy circular buffer pools in Bun 1.2. Prevents catastrophic native memory leaks, unmonitored TCP socket buffer ballooning, and heap exhaustion under high-throughput broadcast fan-out workloads.","antiPatternHeadline":"Unchecked ws.send() Broadcasting and Ephemeral Buffer Allocations Causing Native Heap Exhaustion","stars_count":115,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","websockets","backpressure","zero-copy","buffer-pool"],"exportEndpoints":{"claude":"/api/rules/bun-websocket-backpressure-buffer-ring-invariant?format=claude","cursorMdc":"/api/rules/bun-websocket-backpressure-buffer-ring-invariant?format=mdc","cursorrules":"/api/rules/bun-websocket-backpressure-buffer-ring-invariant?format=cursor","windsurf":"/api/rules/bun-websocket-backpressure-buffer-ring-invariant?format=windsurf","agents":"/api/rules/bun-websocket-backpressure-buffer-ring-invariant?format=agents"}},{"id":"compose-skiko-vsync-frame-pacing-invariant-compose-multipla-363","title":"Compose Multiplatform 1.8+ Skiko VSync Frame Pacing Invariant","category":"mobile","severity":"critical","description":"Enforces strict alignment between Skiko rendering loops and native platform display synchronizers (CADisplayLink on iOS ProMotion and Choreographer on Android dynamic refresh displays). Prohibits unconstrained coroutine frame loops, decoupled ticker clocks, and unconfigured dynamic frame rate ranges in Compose Multiplatform 1.8+ to eliminate micro-stuttering and frame tearing on 120Hz variable refresh rate panels.","antiPatternHeadline":"Decoupled Coroutine Timers and Unconstrained Frame Ticking in Skiko/Compose Render Loops","stars_count":71,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","compose-multiplatform","skiko","ios","android","promotion","cadisplaylink","choreographer"],"exportEndpoints":{"claude":"/api/rules/compose-skiko-vsync-frame-pacing-invariant-compose-multipla-363?format=claude","cursorMdc":"/api/rules/compose-skiko-vsync-frame-pacing-invariant-compose-multipla-363?format=mdc","cursorrules":"/api/rules/compose-skiko-vsync-frame-pacing-invariant-compose-multipla-363?format=cursor","windsurf":"/api/rules/compose-skiko-vsync-frame-pacing-invariant-compose-multipla-363?format=windsurf","agents":"/api/rules/compose-skiko-vsync-frame-pacing-invariant-compose-multipla-363?format=agents"}},{"id":"oauth-rar-cryptographic-proof-binding-standard","title":"OAuth 2.1 RAR Sender-Constrained Cryptographic Proof Binding","category":"security","severity":"critical","description":"Enforces sender-constrained cryptographic proof binding (via RFC 9449 DPoP or RFC 8705 mTLS) on all OAuth 2.1 Rich Authorization Requests (RFC 9396). Guarantees that fine-grained authorization details are cryptographically coupled to the client's asymmetric key thumbprint and canonicalized payload hash to eliminate token replay, privilege escalation, and transaction substitution attacks.","antiPatternHeadline":"Accepting Unbound Bearer Tokens or Unvalidated Payloads for Rich Authorization Request (RAR) Transactions","stars_count":77,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","oauth2","rar","dpop","cryptography","zero-trust"],"exportEndpoints":{"claude":"/api/rules/oauth-rar-cryptographic-proof-binding-standard?format=claude","cursorMdc":"/api/rules/oauth-rar-cryptographic-proof-binding-standard?format=mdc","cursorrules":"/api/rules/oauth-rar-cryptographic-proof-binding-standard?format=cursor","windsurf":"/api/rules/oauth-rar-cryptographic-proof-binding-standard?format=windsurf","agents":"/api/rules/oauth-rar-cryptographic-proof-binding-standard?format=agents"}},{"id":"opentelemetry-ebpf-profiling-span-association-standard","title":"OpenTelemetry eBPF Continuous Profiling Span Trace Association Standard","category":"devops","severity":"critical","description":"Kernel-level eBPF continuous wall-clock and CPU profiling agents must correlate raw stack traces with active OpenTelemetry TraceID and SpanID contexts. Applications must maintain deterministic thread-level or fiber-level span markers in memory-accessible registers or thread-local storage to guarantee sub-millisecond CPU and lock-contention hot-path attribution.","antiPatternHeadline":"Decoupled Statistical eBPF Profiling Without Correlated Active Span Identifiers","stars_count":93,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","ebpf","continuous-profiling","observability","performance"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-ebpf-profiling-span-association-standard?format=claude","cursorMdc":"/api/rules/opentelemetry-ebpf-profiling-span-association-standard?format=mdc","cursorrules":"/api/rules/opentelemetry-ebpf-profiling-span-association-standard?format=cursor","windsurf":"/api/rules/opentelemetry-ebpf-profiling-span-association-standard?format=windsurf","agents":"/api/rules/opentelemetry-ebpf-profiling-span-association-standard?format=agents"}},{"id":"fastapi-pydantic-zero-copy-streaming-deserialization","title":"FastAPI / Pydantic Core Zero-Copy Streaming Deserialization Invariant","category":"backend","severity":"critical","description":"Enforces zero-copy buffer validation via Pydantic Core (Rust backend) during high-throughput multipart and chunked payload ingestion in FastAPI. Forbids Python-space chunk concatenation and intermediate UTF-8 string allocations to eliminate Global Interpreter Lock (GIL) thrashing and process-level memory bloat under saturated I/O conditions.","antiPatternHeadline":"Accumulating In-Flight Stream Chunks into Python-Managed Bytearrays Before Model Parsing","stars_count":71,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","pydantic-core","zero-copy","gil-contention","memory-optimization"],"exportEndpoints":{"claude":"/api/rules/fastapi-pydantic-zero-copy-streaming-deserialization?format=claude","cursorMdc":"/api/rules/fastapi-pydantic-zero-copy-streaming-deserialization?format=mdc","cursorrules":"/api/rules/fastapi-pydantic-zero-copy-streaming-deserialization?format=cursor","windsurf":"/api/rules/fastapi-pydantic-zero-copy-streaming-deserialization?format=windsurf","agents":"/api/rules/fastapi-pydantic-zero-copy-streaming-deserialization?format=agents"}},{"id":"capacitor-7-android-15-16kb-page-alignment","title":"Capacitor 7 Android 15 16KB Page-Size ELF Alignment Invariant","category":"mobile","severity":"critical","description":"Android 15 introduces architectural support for 16KB memory page sizes, causing immediate fatal SIGSEGV crashes during runtime dlopen() if bundled native (.so) binaries are aligned to legacy 4KB boundaries. In Capacitor 7 applications, all first-party C/C++ plugins, third-party prebuilt libraries, and CMake linkers must strictly enforce 16KB ELF segment alignment via NDK r27+ and explicit linker flags before artifact packaging.","antiPatternHeadline":"Bundling 4KB-Aligned Prebuilt Shared Libraries or Omitting 16KB Linker Flags in Capacitor Android Builds","stars_count":114,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["capacitor","android-15","ndk","16kb-pages","elf-alignment","native-libraries","mobile-architecture"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-android-15-16kb-page-alignment?format=claude","cursorMdc":"/api/rules/capacitor-7-android-15-16kb-page-alignment?format=mdc","cursorrules":"/api/rules/capacitor-7-android-15-16kb-page-alignment?format=cursor","windsurf":"/api/rules/capacitor-7-android-15-16kb-page-alignment?format=windsurf","agents":"/api/rules/capacitor-7-android-15-16kb-page-alignment?format=agents"}},{"id":"openfga-ephemeral-grant-contextual-tuple-fencing","title":"OpenFGA Ephemeral Grant Fencing via Dynamic Contextual Tuples","category":"security","severity":"critical","description":"Prohibits static persistent relation writes for short-lived or time-bounded authorizations in OpenFGA storage engines. Mandates that transient, emergency, or session-scoped grants are validated just-in-time (JIT) using cryptographically signed claims and injected dynamically as ephemeral contextual tuples during check evaluation.","antiPatternHeadline":"Persisting Short-Lived Access Grants into OpenFGA Stores with Async TTL-Based Deletions","stars_count":70,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","authorization","fine-grained-access-control","jwt","zero-trust"],"exportEndpoints":{"claude":"/api/rules/openfga-ephemeral-grant-contextual-tuple-fencing?format=claude","cursorMdc":"/api/rules/openfga-ephemeral-grant-contextual-tuple-fencing?format=mdc","cursorrules":"/api/rules/openfga-ephemeral-grant-contextual-tuple-fencing?format=cursor","windsurf":"/api/rules/openfga-ephemeral-grant-contextual-tuple-fencing?format=windsurf","agents":"/api/rules/openfga-ephemeral-grant-contextual-tuple-fencing?format=agents"}},{"id":"react19-useoptimistic-transactional-mutex-guardrail","title":"React 19 useOptimistic Monotonic Versioning and Mutex Reconciliation","category":"frontend","severity":"critical","description":"Enforces strict monotonic sequencing and transactional state tracking for React 19 useOptimistic hooks to prevent race conditions and UI ghost-rollbacks caused by out-of-order network resolutions. All optimistic operations must carry epoch timestamps or incremental sequence IDs, rejecting stale server reconciliations that arrive after newer optimistic actions have dispatched.","antiPatternHeadline":"Unversioned Concurrent Optimistic State Mutation with Out-of-Order Server Rollback","stars_count":56,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","useOptimistic","concurrency","race-conditions","state-management"],"exportEndpoints":{"claude":"/api/rules/react19-useoptimistic-transactional-mutex-guardrail?format=claude","cursorMdc":"/api/rules/react19-useoptimistic-transactional-mutex-guardrail?format=mdc","cursorrules":"/api/rules/react19-useoptimistic-transactional-mutex-guardrail?format=cursor","windsurf":"/api/rules/react19-useoptimistic-transactional-mutex-guardrail?format=windsurf","agents":"/api/rules/react19-useoptimistic-transactional-mutex-guardrail?format=agents"}},{"id":"nextjs-15-after-background-task-timeout-guardrail","title":"Next.js 15 after() Background Task Boundary and Execution Timeout Guardrail","category":"frontend","severity":"critical","description":"Governs the usage of the Next.js 15 after() API within Server Components, Server Actions, and Route Handlers. Mandates strict execution timeouts, comprehensive error isolation, and cancellation semantics to prevent unhandled promise rejections, stalled serverless microVM teardowns, and zombie telemetry tasks.","antiPatternHeadline":"Unbounded floating promises and unisolated after() callbacks starving serverless concurrency and throwing unhandled rejections","stars_count":115,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["nextjs","nextjs-15","after","serverless","background-tasks","telemetry","concurrency"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-after-background-task-timeout-guardrail?format=claude","cursorMdc":"/api/rules/nextjs-15-after-background-task-timeout-guardrail?format=mdc","cursorrules":"/api/rules/nextjs-15-after-background-task-timeout-guardrail?format=cursor","windsurf":"/api/rules/nextjs-15-after-background-task-timeout-guardrail?format=windsurf","agents":"/api/rules/nextjs-15-after-background-task-timeout-guardrail?format=agents"}},{"id":"tauri-v2-dynamic-ipc-scope-acl-enforcement","title":"Tauri 2.0 Fine-Grained Dynamic IPC Scope and Capability ACL Enforcement","category":"security","severity":"critical","description":"Enforces Tauri 2.0 multi-window and multi-webview isolation via explicit compile-time capability manifests, dynamic path scopes, and context-bound IPC command permissions. Prevents privilege escalation and unauthorized native OS primitive access by eliminating global wildcard capabilities and validating window/webview callers during runtime execution.","antiPatternHeadline":"Granting Global Capabilities or Wildcard Filesystem/Shell Access Across All Tauri Windows and Dynamic Webviews","stars_count":57,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","tauri-2","ipc","capabilities","acl","rust","least-privilege"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-dynamic-ipc-scope-acl-enforcement?format=claude","cursorMdc":"/api/rules/tauri-v2-dynamic-ipc-scope-acl-enforcement?format=mdc","cursorrules":"/api/rules/tauri-v2-dynamic-ipc-scope-acl-enforcement?format=cursor","windsurf":"/api/rules/tauri-v2-dynamic-ipc-scope-acl-enforcement?format=windsurf","agents":"/api/rules/tauri-v2-dynamic-ipc-scope-acl-enforcement?format=agents"}},{"id":"openfga-cyclic-expansion-depth-quota-invariant","title":"OpenFGA Relationship-Based Access Control Cyclic Expansion and Depth Quota Invariant","category":"backend","severity":"critical","description":"Enforces deterministic recursion limits and cycle detection when resolving nested relationship tuples across enterprise organizational hierarchies. Prevents unconstrained graph traversals, distributed CPU starvation, and query timeouts in OpenFGA Check and Expand calls through explicit context depth limits and schema validation.","antiPatternHeadline":"Unbounded recursive tuple resolution and cyclic parent-child delegations causing infinite graph traversal and denial of service","stars_count":110,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","openfga","authorization","rebac","graph-traversal","dos-prevention"],"exportEndpoints":{"claude":"/api/rules/openfga-cyclic-expansion-depth-quota-invariant?format=claude","cursorMdc":"/api/rules/openfga-cyclic-expansion-depth-quota-invariant?format=mdc","cursorrules":"/api/rules/openfga-cyclic-expansion-depth-quota-invariant?format=cursor","windsurf":"/api/rules/openfga-cyclic-expansion-depth-quota-invariant?format=windsurf","agents":"/api/rules/openfga-cyclic-expansion-depth-quota-invariant?format=agents"}},{"id":"bun-explicit-resource-management-db-pool-invariant","title":"Bun 1.2 Explicit Resource Management Disposable Database Pool Invariant","category":"backend","severity":"critical","description":"Enforces deterministic reclamation of acquired database connections and transactions using TC39 Explicit Resource Management (`using` and `await using` declarations) in Bun 1.2+. Guarantees that connection handles and transactional locks are disposed of synchronously or asynchronously upon scope exit, completely eliminating socket starvation and connection pool exhaustion caused by unhandled rejections, early returns, or uncaught exceptions.","antiPatternHeadline":"Manual Connection Release via Ad-Hoc Try/Finally Leading to Leaked Sockets on Premature Rejection","stars_count":91,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","typescript","database","resource-management","sql"],"exportEndpoints":{"claude":"/api/rules/bun-explicit-resource-management-db-pool-invariant?format=claude","cursorMdc":"/api/rules/bun-explicit-resource-management-db-pool-invariant?format=mdc","cursorrules":"/api/rules/bun-explicit-resource-management-db-pool-invariant?format=cursor","windsurf":"/api/rules/bun-explicit-resource-management-db-pool-invariant?format=windsurf","agents":"/api/rules/bun-explicit-resource-management-db-pool-invariant?format=agents"}},{"id":"axum-sse-stream-cancellation-socket-pruning","title":"Axum SSE Stream Cancellation Safety and Downstream Socket Pruning Guardrail","category":"backend","severity":"critical","description":"Mandates explicit cancellation propagation, active keep-alive probes, and RAII-bound task lifecycles for Server-Sent Events in Axum. Prevents orphaned Tokio tasks, unbounded memory leaks, and socket descriptor exhaustion under transient client disconnects and network partitions.","antiPatternHeadline":"Decoupling background producer tasks from Axum SSE stream drops without keep-alive probes, leaking Tokio tasks and socket descriptors.","stars_count":86,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tokio","sse","concurrency"],"exportEndpoints":{"claude":"/api/rules/axum-sse-stream-cancellation-socket-pruning?format=claude","cursorMdc":"/api/rules/axum-sse-stream-cancellation-socket-pruning?format=mdc","cursorrules":"/api/rules/axum-sse-stream-cancellation-socket-pruning?format=cursor","windsurf":"/api/rules/axum-sse-stream-cancellation-socket-pruning?format=windsurf","agents":"/api/rules/axum-sse-stream-cancellation-socket-pruning?format=agents"}},{"id":"capacitor7-biometric-attestation-replay-binding","title":"Hardware-Backed Biometric Attestation and Cryptographic Replay-Resistant Bridge Binding","category":"mobile","severity":"critical","description":"Requires all Capacitor 7 native biometric verification flows to utilize hardware-backed key attestation (Secure Enclave/StrongBox) with cryptographic challenge-response validation. Forbids relying on boolean bridge evaluation responses ({ success: true }), enforcing backend signature verification and strict session-nonce binding across native-to-web boundaries.","antiPatternHeadline":"Trusting Boolean Native Bridge Returns for Biometric Authorization Without Hardware-Backed Cryptographic Attestation","stars_count":106,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor7","biometrics","security","cryptography","secure-enclave","keystore"],"exportEndpoints":{"claude":"/api/rules/capacitor7-biometric-attestation-replay-binding?format=claude","cursorMdc":"/api/rules/capacitor7-biometric-attestation-replay-binding?format=mdc","cursorrules":"/api/rules/capacitor7-biometric-attestation-replay-binding?format=cursor","windsurf":"/api/rules/capacitor7-biometric-attestation-replay-binding?format=windsurf","agents":"/api/rules/capacitor7-biometric-attestation-replay-binding?format=agents"}},{"id":"cilium-ebpf-sockops-socket-acceleration-invariant","title":"Cilium eBPF Sockops Direct Pod-to-Pod Acceleration & Policy Preservation","category":"devops","severity":"critical","description":"Governs configuration and deployment invariants for Cilium eBPF sockops (sockmap and sk_msg) zero-copy socket acceleration. Ensures co-located pod-to-pod and pod-to-proxy traffic safely bypasses host TCP/IP stack traversal while strictly preserving cgroupv2 requirements, CiliumNetworkPolicy enforcement, and datapath observability.","antiPatternHeadline":"Enabling sockops on incompatible cgroup topologies or bypassing Layer 7 policy proxy chains.","stars_count":109,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","cilium","ebpf","kubernetes","networking","sockops","cgroupv2"],"exportEndpoints":{"claude":"/api/rules/cilium-ebpf-sockops-socket-acceleration-invariant?format=claude","cursorMdc":"/api/rules/cilium-ebpf-sockops-socket-acceleration-invariant?format=mdc","cursorrules":"/api/rules/cilium-ebpf-sockops-socket-acceleration-invariant?format=cursor","windsurf":"/api/rules/cilium-ebpf-sockops-socket-acceleration-invariant?format=windsurf","agents":"/api/rules/cilium-ebpf-sockops-socket-acceleration-invariant?format=agents"}},{"id":"opentelemetry-baggage-ingress-pii-sanitization","title":"OpenTelemetry W3C Baggage Ingress Sanitization and PII Redaction Invariant","category":"devops","severity":"critical","description":"Enforces deterministic schema validation, allowlist filtering, and PII redaction on inbound W3C Baggage headers at API gateways and service boundaries. Prevents unbounded header injection, credential leakage, and cross-microservice PII exfiltration across distributed OpenTelemetry traces.","antiPatternHeadline":"Unvalidated Forwarding of Raw Inbound W3C Baggage Headers to Downstream Trace Contexts","stars_count":44,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","security","distributed-tracing","pii-protection","api-gateway"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-baggage-ingress-pii-sanitization?format=claude","cursorMdc":"/api/rules/opentelemetry-baggage-ingress-pii-sanitization?format=mdc","cursorrules":"/api/rules/opentelemetry-baggage-ingress-pii-sanitization?format=cursor","windsurf":"/api/rules/opentelemetry-baggage-ingress-pii-sanitization?format=windsurf","agents":"/api/rules/opentelemetry-baggage-ingress-pii-sanitization?format=agents"}},{"id":"svelte5-runes-ssr-context-leak-prevention-standard","title":"Svelte 5 Runes SSR Reactive Context Leak Prevention Standard","category":"frontend","severity":"critical","description":"Enforces strict isolation of fine-grained reactive runes ($state, $derived) during Server-Side Rendering (SSR) to prevent cross-request tenant bleeding and memory leaks. Prohibits module-level singleton state instances and mandates scoped context encapsulation via Svelte's context API or per-request instantiation boundaries.","antiPatternHeadline":"Global Module-Level Runes Instantiation Permeating Concurrent Server Requests","stars_count":96,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["svelte","svelte5","runes","ssr","reactivity","memory-leak","security"],"exportEndpoints":{"claude":"/api/rules/svelte5-runes-ssr-context-leak-prevention-standard?format=claude","cursorMdc":"/api/rules/svelte5-runes-ssr-context-leak-prevention-standard?format=mdc","cursorrules":"/api/rules/svelte5-runes-ssr-context-leak-prevention-standard?format=cursor","windsurf":"/api/rules/svelte5-runes-ssr-context-leak-prevention-standard?format=windsurf","agents":"/api/rules/svelte5-runes-ssr-context-leak-prevention-standard?format=agents"}},{"id":"nextjs-15-ppr-dynamic-hole-streaming-fallback-standard","title":"Next.js 15 PPR Dynamic Micro-Segment Streaming and Timeout Invariants","category":"frontend","severity":"critical","description":"Next.js 15 Partial Prerendering (PPR) requires that dynamic micro-segments inside statically prerendered shells are isolated in discrete Suspense boundaries with bounded AbortSignal timeouts. Unbounded dynamic data fetching inside dynamic streaming holes exhausts edge worker concurrency, blocks stream completion, and degrades client perceived latency under downstream latency spikes. All dynamic holes must enforce deterministic fallback states when downstream dependencies breach strict latency budgets.","antiPatternHeadline":"Unbounded Dynamic Fetching Inside Unisolated or Non-Resilient Suspense Boundaries in PPR Routes","stars_count":66,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs","nextjs-15","ppr","react-server-components","streaming","performance"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-ppr-dynamic-hole-streaming-fallback-standard?format=claude","cursorMdc":"/api/rules/nextjs-15-ppr-dynamic-hole-streaming-fallback-standard?format=mdc","cursorrules":"/api/rules/nextjs-15-ppr-dynamic-hole-streaming-fallback-standard?format=cursor","windsurf":"/api/rules/nextjs-15-ppr-dynamic-hole-streaming-fallback-standard?format=windsurf","agents":"/api/rules/nextjs-15-ppr-dynamic-hole-streaming-fallback-standard?format=agents"}},{"id":"bun-websocket-backpressure-buffer-invariant","title":"Bun 1.2 WebSocket Backpressure & Memory-Bounded Buffer Invariant","category":"backend","severity":"critical","description":"Enforces deterministic backpressure monitoring and bounded native buffer limits across all Bun native WebSocket connections. Prevents fatal process termination via SIGKILL by eliminating unmonitored C++ socket write queue expansion under asymmetric client drain rates.","antiPatternHeadline":"Unchecked fire-and-forget ws.send() invocations causing unmonitored native memory bloat and Linux OOM killer termination","stars_count":88,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","websockets","backpressure","memory-safety","performance"],"exportEndpoints":{"claude":"/api/rules/bun-websocket-backpressure-buffer-invariant?format=claude","cursorMdc":"/api/rules/bun-websocket-backpressure-buffer-invariant?format=mdc","cursorrules":"/api/rules/bun-websocket-backpressure-buffer-invariant?format=cursor","windsurf":"/api/rules/bun-websocket-backpressure-buffer-invariant?format=windsurf","agents":"/api/rules/bun-websocket-backpressure-buffer-invariant?format=agents"}},{"id":"pgvector-hnsw-workmem-isolation-standard","title":"pgvector 0.8 HNSW Index Maintenance and WorkMem Isolation Guardrail","category":"backend","severity":"critical","description":"Enforces strict isolation of maintenance_work_mem and session work_mem during pgvector 0.8+ HNSW graph construction and parallel query execution. Prevents Linux OOM-killer invocations, buffer pool cache eviction, and OLTP transaction starvation by decoupling vector index builds into isolated administrative sessions with deterministic memory bounds.","antiPatternHeadline":"Global maintenance_work_mem Inflation and Inline DDL Execution in Transactional OLTP Connection Pools","stars_count":113,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","pgvector","hnsw","memory-isolation","oltp"],"exportEndpoints":{"claude":"/api/rules/pgvector-hnsw-workmem-isolation-standard?format=claude","cursorMdc":"/api/rules/pgvector-hnsw-workmem-isolation-standard?format=mdc","cursorrules":"/api/rules/pgvector-hnsw-workmem-isolation-standard?format=cursor","windsurf":"/api/rules/pgvector-hnsw-workmem-isolation-standard?format=windsurf","agents":"/api/rules/pgvector-hnsw-workmem-isolation-standard?format=agents"}},{"id":"tauri-mobile-scoped-ipc-sandboxing-standard","title":"Tauri 2.0 Scoped Mobile IPC Capability Sandboxing Standard","category":"mobile","severity":"critical","description":"Enforces strict compile-time permission scoping and origin boundary verification for Tauri 2.0 mobile applications. Prevents arbitrary native execution by restricting IPC capabilities to designated local webview windows and prohibiting wildcard plugin grants. Guarantees that external web content and deep links cannot invoke privileged Android/iOS bridge APIs.","antiPatternHeadline":"Over-privileged Wildcard Capabilities and Remote Origin IPC Invocation Vulnerabilities","stars_count":91,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri-2.0","ipc","security","sandboxing","rust"],"exportEndpoints":{"claude":"/api/rules/tauri-mobile-scoped-ipc-sandboxing-standard?format=claude","cursorMdc":"/api/rules/tauri-mobile-scoped-ipc-sandboxing-standard?format=mdc","cursorrules":"/api/rules/tauri-mobile-scoped-ipc-sandboxing-standard?format=cursor","windsurf":"/api/rules/tauri-mobile-scoped-ipc-sandboxing-standard?format=windsurf","agents":"/api/rules/tauri-mobile-scoped-ipc-sandboxing-standard?format=agents"}},{"id":"capacitor7-bridge-background-task-eviction","title":"Capacitor 7 Native Bridge Background Task Eviction and JSI Memory Recovery Protocol","category":"mobile","severity":"critical","description":"Enforces deterministic suspension handling, bridge listener teardown, and background task lifecycle resolution before OS-level execution limits expire. Prevents 0x8badf00d watchdog kills on iOS and low-memory killer (LMK) eviction on Android by releasing dangling JSI references and native promise callbacks prior to mobile thread suspension.","antiPatternHeadline":"Unbounded Async Bridge Calls and Dangling Plugin Listeners During OS App Backgrounding","stars_count":81,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","capacitor-7","ios","android","memory-management","lifecycle"],"exportEndpoints":{"claude":"/api/rules/capacitor7-bridge-background-task-eviction?format=claude","cursorMdc":"/api/rules/capacitor7-bridge-background-task-eviction?format=mdc","cursorrules":"/api/rules/capacitor7-bridge-background-task-eviction?format=cursor","windsurf":"/api/rules/capacitor7-bridge-background-task-eviction?format=windsurf","agents":"/api/rules/capacitor7-bridge-background-task-eviction?format=agents"}},{"id":"webauthn-l3-passkey-assertion-standard","title":"WebAuthn L3 Cryptographic Origin-Bound Assertion & Monotonic Verification Standard","category":"security","severity":"critical","description":"Enforces strict WebAuthn Level 3 server-side validation invariants for passkey registration and authentication ceremonies. Mandates precise clientDataJSON origin/RP ID matching, monotonic sign-count inspection to detect cloned authenticators, user verification enforcement, and complete sandboxing against cross-origin iframe token-relay attacks.","antiPatternHeadline":"Accepting unverified clientDataJSON origins, omitting sign-count regression checks, and permitting un-sandboxed passkey delegation","stars_count":50,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","passkeys","fido2","cryptography","authentication"],"exportEndpoints":{"claude":"/api/rules/webauthn-l3-passkey-assertion-standard?format=claude","cursorMdc":"/api/rules/webauthn-l3-passkey-assertion-standard?format=mdc","cursorrules":"/api/rules/webauthn-l3-passkey-assertion-standard?format=cursor","windsurf":"/api/rules/webauthn-l3-passkey-assertion-standard?format=windsurf","agents":"/api/rules/webauthn-l3-passkey-assertion-standard?format=agents"}},{"id":"slsa-l3-ephemeral-oidc-container-attestation-invariant","title":"SLSA Level 3 Ephemeral OIDC Container Attestation Invariant","category":"security","severity":"critical","description":"Enforces non-falsifiable, cryptographically signed SLSA Level 3 provenance attestations generated via ephemeral OpenID Connect (OIDC) workload identity federation. Eliminates long-lived CI/CD signing keys and prevents artifact deployment promotion without strictly validated in-toto provenance statements anchored in a tamper-evident transparency log.","antiPatternHeadline":"Promoting Container Artifacts Using Static Signing Keys or Unverified OIDC Issuer Claims Without Provenance Validation","stars_count":49,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","slsa-level-3","sigstore","cosign","oidc","supply-chain-security","container-security"],"exportEndpoints":{"claude":"/api/rules/slsa-l3-ephemeral-oidc-container-attestation-invariant?format=claude","cursorMdc":"/api/rules/slsa-l3-ephemeral-oidc-container-attestation-invariant?format=mdc","cursorrules":"/api/rules/slsa-l3-ephemeral-oidc-container-attestation-invariant?format=cursor","windsurf":"/api/rules/slsa-l3-ephemeral-oidc-container-attestation-invariant?format=windsurf","agents":"/api/rules/slsa-l3-ephemeral-oidc-container-attestation-invariant?format=agents"}},{"id":"cilium-tetragon-ebpf-synchronous-syscall-barrier","title":"Cilium Tetragon In-Kernel Synchronous Syscall Interception and TOCTOU Mitigation","category":"devops","severity":"critical","description":"Enforces synchronous kernel-level enforcement policies via Cilium Tetragon TracingPolicies utilizing bpf_override_return or SIGKILL actions on sensitive syscall boundaries. Asynchronous user-space audit logging introduces Time-of-Check to Time-of-Use (TOCTOU) race conditions where malicious payloads execute prior to alert ingestion; TracingPolicies must synchronously fail or terminate processes directly inside the kernel context.","antiPatternHeadline":"Relying on Asynchronous User-Space Telemetry Alerts Instead of Synchronous In-Kernel Syscall Overrides","stars_count":54,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","cilium","tetragon","ebpf","security","kubernetes","kernel"],"exportEndpoints":{"claude":"/api/rules/cilium-tetragon-ebpf-synchronous-syscall-barrier?format=claude","cursorMdc":"/api/rules/cilium-tetragon-ebpf-synchronous-syscall-barrier?format=mdc","cursorrules":"/api/rules/cilium-tetragon-ebpf-synchronous-syscall-barrier?format=cursor","windsurf":"/api/rules/cilium-tetragon-ebpf-synchronous-syscall-barrier?format=windsurf","agents":"/api/rules/cilium-tetragon-ebpf-synchronous-syscall-barrier?format=agents"}},{"id":"opentelemetry-dynamic-exemplar-quota-standard","title":"OpenTelemetry High-Cardinality Dynamic Exemplar Retention and Adaptive Quota Standard","category":"devops","severity":"critical","description":"Enforces adaptive exemplar sampling and dynamic rate-limiting on OpenTelemetry metric streams to prevent backend telemetry degradation during distributed incidents. Mandates deterministic exemplar reservation reservoirs bounded by leaky-bucket quotas that throttle high-cardinality trace associations during error spikes. Ensures metric collection pipelines maintain zero-allocation invariants and resist OOM crashes under downstream telemetry partition events.","antiPatternHeadline":"Unbounded Exemplar Sampling on Error Metrics Triggering Telemetry Backpressure and Collector OOM","stars_count":96,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","observability","metrics","tracing","site-reliability"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-dynamic-exemplar-quota-standard?format=claude","cursorMdc":"/api/rules/opentelemetry-dynamic-exemplar-quota-standard?format=mdc","cursorrules":"/api/rules/opentelemetry-dynamic-exemplar-quota-standard?format=cursor","windsurf":"/api/rules/opentelemetry-dynamic-exemplar-quota-standard?format=windsurf","agents":"/api/rules/opentelemetry-dynamic-exemplar-quota-standard?format=agents"}},{"id":"react-19-server-actions-cryptographic-replay-deduplication-standard","title":"React 19 Server Actions Cryptographic Replay Deduplication Standard","category":"frontend","severity":"critical","description":"Enforces mandatory client-generated cryptographically secure idempotency keys and server-side atomic state locking across distributed RPC boundaries for non-idempotent React 19 Server Actions. Prevents catastrophic double-execution of financial transactions, state mutations, and external API requests caused by network retry flaps, connection timeouts, or unconstrained client re-submissions. Guarantees linearizable mutation guarantees by unifying distributed atomic locks with deterministic response caching.","antiPatternHeadline":"Executing Non-Idempotent React 19 Server Actions Without Distributed Locks and Replay Nonces","stars_count":66,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","server-actions","idempotency","replay-attacks","distributed-systems","security"],"exportEndpoints":{"claude":"/api/rules/react-19-server-actions-cryptographic-replay-deduplication-standard?format=claude","cursorMdc":"/api/rules/react-19-server-actions-cryptographic-replay-deduplication-standard?format=mdc","cursorrules":"/api/rules/react-19-server-actions-cryptographic-replay-deduplication-standard?format=cursor","windsurf":"/api/rules/react-19-server-actions-cryptographic-replay-deduplication-standard?format=windsurf","agents":"/api/rules/react-19-server-actions-cryptographic-replay-deduplication-standard?format=agents"}},{"id":"bun-sqlite-wal2-worker-checkpoint-coordination","title":"Bun 1.2 Multi-Worker SQLite WAL2 Concurrency and Deterministic Checkpoint Coordination","category":"backend","severity":"critical","description":"Enforces deterministic checkpoint coordination and transaction boundaries across native Bun background workers using SQLite WAL2 mode. Prevents read-lock starvation, checkpoint livelocks, and uncommitted page corruption caused by uncoordinated PRAGMA wal_checkpoint execution across isolated thread runtimes.","antiPatternHeadline":"Uncoordinated Multi-Threaded Checkpointing and Concurrent Unsafe Write Allocations Under WAL2","stars_count":50,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","sqlite","wal2","workers","concurrency","multithreading"],"exportEndpoints":{"claude":"/api/rules/bun-sqlite-wal2-worker-checkpoint-coordination?format=claude","cursorMdc":"/api/rules/bun-sqlite-wal2-worker-checkpoint-coordination?format=mdc","cursorrules":"/api/rules/bun-sqlite-wal2-worker-checkpoint-coordination?format=cursor","windsurf":"/api/rules/bun-sqlite-wal2-worker-checkpoint-coordination?format=windsurf","agents":"/api/rules/bun-sqlite-wal2-worker-checkpoint-coordination?format=agents"}},{"id":"go-124-weak-pointer-non-resurrecting-cache-standard","title":"Go 1.24 Weak Pointer and Non-Resurrecting Cache Cleanup Standard","category":"backend","severity":"critical","description":"Standardizes high-throughput in-memory cache architectures to use Go 1.24 weak.Pointer and runtime.AddCleanup instead of legacy runtime.SetFinalizer or strong-reference maps. Prevents object resurrection, eliminates multi-cycle GC retention, and avoids stop-the-world latency spikes by decoupling cleanup tokens from collected heap allocations.","antiPatternHeadline":"Retaining strong references in cache maps or invoking runtime.SetFinalizer with self-referential closures causing object resurrection.","stars_count":80,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","weak-pointers","garbage-collection","memory-management","concurrency"],"exportEndpoints":{"claude":"/api/rules/go-124-weak-pointer-non-resurrecting-cache-standard?format=claude","cursorMdc":"/api/rules/go-124-weak-pointer-non-resurrecting-cache-standard?format=mdc","cursorrules":"/api/rules/go-124-weak-pointer-non-resurrecting-cache-standard?format=cursor","windsurf":"/api/rules/go-124-weak-pointer-non-resurrecting-cache-standard?format=windsurf","agents":"/api/rules/go-124-weak-pointer-non-resurrecting-cache-standard?format=agents"}},{"id":"pg17-vectorized-streaming-vacuum-worker-boundary","title":"PostgreSQL 17 Vectorized Streaming I/O Vacuum Worker Isolation","category":"backend","severity":"critical","description":"Enforces strict resource isolation and streaming I/O ring buffer boundaries for PostgreSQL 17 autovacuum workers scanning multi-terabyte heap tables. Prevents unbounded prefetching and OS page cache saturation from evicting active working sets in shared buffers during aggressive maintenance operations.","antiPatternHeadline":"Global Autovacuum Ring-Buffer Bypass and Unbounded Vectorized Prefetching on Multi-TB Heaps","stars_count":73,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql-17","database-reliability","autovacuum","performance"],"exportEndpoints":{"claude":"/api/rules/pg17-vectorized-streaming-vacuum-worker-boundary?format=claude","cursorMdc":"/api/rules/pg17-vectorized-streaming-vacuum-worker-boundary?format=mdc","cursorrules":"/api/rules/pg17-vectorized-streaming-vacuum-worker-boundary?format=cursor","windsurf":"/api/rules/pg17-vectorized-streaming-vacuum-worker-boundary?format=windsurf","agents":"/api/rules/pg17-vectorized-streaming-vacuum-worker-boundary?format=agents"}},{"id":"android-15-16kb-page-size-alignment-standard","title":"Android 15 16KB Page-Size Native ABI & Memory-Mapping Invariant","category":"mobile","severity":"critical","description":"Enforces 16KB ELF alignment for all native C/C++ shared libraries and dynamic runtimes to ensure compatibility with Android 15 page-agnostic kernels. Mandates dynamic page size querying via sysconf(_SC_PAGESIZE) or getpagesize() rather than hardcoded 4096-byte constants during native memory allocations (mmap/posix_memalign) and JNI transfers to prevent silent memory corruption and fatal SIGSEGV faults.","antiPatternHeadline":"Hardcoded 4KB Page Assumptions and 4KB-Aligned ELF Segments Causing SIGSEGV Crashes on Android 15 Devices","stars_count":61,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","android","c++","ndk","jni","kmp","android-15"],"exportEndpoints":{"claude":"/api/rules/android-15-16kb-page-size-alignment-standard?format=claude","cursorMdc":"/api/rules/android-15-16kb-page-size-alignment-standard?format=mdc","cursorrules":"/api/rules/android-15-16kb-page-size-alignment-standard?format=cursor","windsurf":"/api/rules/android-15-16kb-page-size-alignment-standard?format=windsurf","agents":"/api/rules/android-15-16kb-page-size-alignment-standard?format=agents"}},{"id":"capacitor-7-predictive-back-decoupling-invariant","title":"Capacitor 7 Predictive Back Gesture Navigation Decoupling Invariant","category":"mobile","severity":"critical","description":"Enforces strict transactional synchronization between native Android 15 OnBackInvokedCallback animations and the hybrid WebView routing state machine. Prevents deadlocked transitions, history desynchronization, and blank screen rendering caused by asynchronous bridge latency during predictive back gestures in Capacitor 7 applications.","antiPatternHeadline":"Unsynchronized Async BackButton Bridge Handlers Causing Dropped Frames, Blank Views, or Routing Desynchronization During Native Predictive Back","stars_count":56,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","android15","predictive-back","routing","typescript"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-predictive-back-decoupling-invariant?format=claude","cursorMdc":"/api/rules/capacitor-7-predictive-back-decoupling-invariant?format=mdc","cursorrules":"/api/rules/capacitor-7-predictive-back-decoupling-invariant?format=cursor","windsurf":"/api/rules/capacitor-7-predictive-back-decoupling-invariant?format=windsurf","agents":"/api/rules/capacitor-7-predictive-back-decoupling-invariant?format=agents"}},{"id":"tauri-2-per-origin-ipc-capability-scoping-standard","title":"Tauri 2.0 Per-Origin Dynamic IPC Capability Scoping Standard","category":"security","severity":"critical","description":"Enforces granular, cryptographically attested per-origin capability configurations and command masking in Tauri 2.0. Replaces legacy global plugin allowlists with strictly scoped window and webview capabilities to prevent Remote Code Execution (RCE) via compromised DOM contexts or subresource injection.","antiPatternHeadline":"Assigning wildcard permissions or global core capabilities to arbitrary webview windows","stars_count":102,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["tauri-2","security","ipc","least-privilege","capabilities"],"exportEndpoints":{"claude":"/api/rules/tauri-2-per-origin-ipc-capability-scoping-standard?format=claude","cursorMdc":"/api/rules/tauri-2-per-origin-ipc-capability-scoping-standard?format=mdc","cursorrules":"/api/rules/tauri-2-per-origin-ipc-capability-scoping-standard?format=cursor","windsurf":"/api/rules/tauri-2-per-origin-ipc-capability-scoping-standard?format=windsurf","agents":"/api/rules/tauri-2-per-origin-ipc-capability-scoping-standard?format=agents"}},{"id":"webauthn-prf-zk-client-key-derivation-invariant","title":"Zero-Knowledge Hardware-Bound Key Derivation via WebAuthn PRF Extension","category":"security","severity":"critical","description":"Enforces strict cryptographic boundaries when deriving symmetric client-side encryption keys from WebAuthn Pseudo-Random Function (PRF) extension outputs (HMAC-secret). Raw PRF outputs must never be persisted in browser storage, transmitted across network boundaries, or held long-term in JavaScript heap memory, requiring ephemeral Web Crypto HKDF derivation into non-extractable CryptoKeys.","antiPatternHeadline":"Exposing Raw Authenticator PRF Outputs or Storing Unsalted Symmetric Master Keys in Browser Storage","stars_count":57,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","prf-extension","webcrypto","zero-knowledge","hkdf","cryptography"],"exportEndpoints":{"claude":"/api/rules/webauthn-prf-zk-client-key-derivation-invariant?format=claude","cursorMdc":"/api/rules/webauthn-prf-zk-client-key-derivation-invariant?format=mdc","cursorrules":"/api/rules/webauthn-prf-zk-client-key-derivation-invariant?format=cursor","windsurf":"/api/rules/webauthn-prf-zk-client-key-derivation-invariant?format=windsurf","agents":"/api/rules/webauthn-prf-zk-client-key-derivation-invariant?format=agents"}},{"id":"otel-ebpf-flow-tail-sampling-governor","title":"OpenTelemetry eBPF Dynamic Flow Tail-Sampling Kernel Governor","category":"devops","severity":"critical","description":"Enforces in-kernel ring-buffer backpressure and dynamic tail-sampling for high-cardinality eBPF network flow telemetry during microbursts. Prevents user-space collector out-of-memory (OOM) crashes by shedding deterministic, healthy flow events in kernel space while guaranteeing 100% trace extraction for anomalous, high-latency, or errored socket transactions.","antiPatternHeadline":"Unbounded Head-Sampling Ring Buffer Emission Leading to Collector Node OOM","stars_count":51,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","opentelemetry","linux-kernel","tail-sampling","observability"],"exportEndpoints":{"claude":"/api/rules/otel-ebpf-flow-tail-sampling-governor?format=claude","cursorMdc":"/api/rules/otel-ebpf-flow-tail-sampling-governor?format=mdc","cursorrules":"/api/rules/otel-ebpf-flow-tail-sampling-governor?format=cursor","windsurf":"/api/rules/otel-ebpf-flow-tail-sampling-governor?format=windsurf","agents":"/api/rules/otel-ebpf-flow-tail-sampling-governor?format=agents"}},{"id":"react-19-optimistic-mutation-rollback-invariant","title":"React 19 Deterministic Optimistic Rollback and Transition Boundary Invariant","category":"frontend","severity":"critical","description":"Enforces deterministic, tear-free optimistic rollbacks under concurrent server mutations using React 19's useOptimistic and startTransition APIs. Precludes full-tree reconciliation cascades and state desynchronization caused by ad-hoc useState rollback flags or uncoordinated top-level context mutations during server action execution.","antiPatternHeadline":"Ad-Hoc Imperative State Rollback Cascades in Concurrent Transitions","stars_count":84,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","use-optimistic","start-transition","concurrency"],"exportEndpoints":{"claude":"/api/rules/react-19-optimistic-mutation-rollback-invariant?format=claude","cursorMdc":"/api/rules/react-19-optimistic-mutation-rollback-invariant?format=mdc","cursorrules":"/api/rules/react-19-optimistic-mutation-rollback-invariant?format=cursor","windsurf":"/api/rules/react-19-optimistic-mutation-rollback-invariant?format=windsurf","agents":"/api/rules/react-19-optimistic-mutation-rollback-invariant?format=agents"}},{"id":"angular-19-signal-graph-cycle-quarantine-standard","title":"Angular 19 Signal-Based Reactive Graph Cycle Quarantine Standard","category":"frontend","severity":"critical","description":"Enforces architectural quarantine mechanisms against reactive graph circularity and microtask starvation in zoneless Angular 19 applications. Eliminates cascading downstream signal writes, misuse of allowSignalWrites in effects, and un-isolated high-frequency event ingestion within the reactive graph. Mandates untracked boundary containment and computed derivation purity to ensure deterministic change detection passes.","antiPatternHeadline":"Cyclic Signal Mutations via Cascading Effects and Unbounded High-Frequency State Writes","stars_count":52,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","angular19","signals","zoneless","performance","reactivity"],"exportEndpoints":{"claude":"/api/rules/angular-19-signal-graph-cycle-quarantine-standard?format=claude","cursorMdc":"/api/rules/angular-19-signal-graph-cycle-quarantine-standard?format=mdc","cursorrules":"/api/rules/angular-19-signal-graph-cycle-quarantine-standard?format=cursor","windsurf":"/api/rules/angular-19-signal-graph-cycle-quarantine-standard?format=windsurf","agents":"/api/rules/angular-19-signal-graph-cycle-quarantine-standard?format=agents"}},{"id":"fastapi-freethreaded-asgi-thread-affinity-guardrail","title":"FastAPI Free-Threaded (Python 3.13t) Worker & Resource Affinity Invariants","category":"backend","severity":"critical","description":"Enforces strict connection pool isolation, thread-local lifecycle scoping, and synchronization primitives across FastAPI ASGI workers executing under Python 3.13+ free-threaded (GIL-disabled) mode. Prohibits sharing non-thread-safe state (such as standard asyncio loop constructs, raw database cursors, and socket wrappers) across concurrent native threads to prevent memory corruption, race conditions, and pool contamination. Mandates thread-safe pool implementations, explicit synchronization, and ASGI worker isolation.","antiPatternHeadline":"Global Mutable State and Leaked Connection Pools Across Free-Threaded Native Worker Threads","stars_count":58,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","python3.13t","free-threaded","concurrency","asgi","multithreading"],"exportEndpoints":{"claude":"/api/rules/fastapi-freethreaded-asgi-thread-affinity-guardrail?format=claude","cursorMdc":"/api/rules/fastapi-freethreaded-asgi-thread-affinity-guardrail?format=mdc","cursorrules":"/api/rules/fastapi-freethreaded-asgi-thread-affinity-guardrail?format=cursor","windsurf":"/api/rules/fastapi-freethreaded-asgi-thread-affinity-guardrail?format=windsurf","agents":"/api/rules/fastapi-freethreaded-asgi-thread-affinity-guardrail?format=agents"}},{"id":"kmp-native-memory-deallocation-boundary-standard","title":"Kotlin/Native Explicit Memory Reclamation and Autorelease Boundary Enforcement","category":"mobile","severity":"critical","description":"Enforces deterministic native memory boundaries and Objective-C autorelease pool wrapping across Kotlin/Native background processing on iOS. Prevents process termination by iOS Jetsam (OOM) caused by deferred Kotlin/Native garbage collector transitions and accumulated Objective-C bridged allocations during high-throughput loops.","antiPatternHeadline":"Unbounded Interop Allocations and Missing Autorelease Pools in KMP Background Coroutines","stars_count":113,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","kotlin-native","ios","memory-management","concurrency"],"exportEndpoints":{"claude":"/api/rules/kmp-native-memory-deallocation-boundary-standard?format=claude","cursorMdc":"/api/rules/kmp-native-memory-deallocation-boundary-standard?format=mdc","cursorrules":"/api/rules/kmp-native-memory-deallocation-boundary-standard?format=cursor","windsurf":"/api/rules/kmp-native-memory-deallocation-boundary-standard?format=windsurf","agents":"/api/rules/kmp-native-memory-deallocation-boundary-standard?format=agents"}},{"id":"capacitor-7-background-task-quota-quarantine","title":"Capacitor 7 Headless Background Task Quota Quarantine & Sanitization","category":"mobile","severity":"critical","description":"Enforces deterministic state serialization, hard deadline abort triggers, and in-memory cryptographic zeroing before mobile OS background execution quotas expire. iOS BGTaskScheduler and Android WorkManager kill non-responsive headless tasks without warning, causing SQLite database corruption and exposing lingering symmetric keys in volatile RAM snapshots. This guardrail mandates cooperative timeout budgets with graceful state commit and memory scrubbing.","antiPatternHeadline":"Unbounded Background Task Execution Leaking Plaintext Keys and Corrupting State on SIGKILL","stars_count":87,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","background-task","cryptography","memory-hygiene","ios","android"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-background-task-quota-quarantine?format=claude","cursorMdc":"/api/rules/capacitor-7-background-task-quota-quarantine?format=mdc","cursorrules":"/api/rules/capacitor-7-background-task-quota-quarantine?format=cursor","windsurf":"/api/rules/capacitor-7-background-task-quota-quarantine?format=windsurf","agents":"/api/rules/capacitor-7-background-task-quota-quarantine?format=agents"}},{"id":"post-quantum-hybrid-tls-mlkem-downgrade-guardrail","title":"Mandatory Post-Quantum Hybrid TLS 1.3 ML-KEM-768 Negotiation and Downgrade Defense","category":"security","severity":"critical","description":"Enforces strict client-to-edge cryptographic negotiation invariants combining X25519 with ML-KEM-768 (X25519MLKEM768) over TLS 1.3 to mitigate Store-Now-Decrypt-Later (SNDL) adversary strategies. Mandates deterministic aborts on cryptographic downgrade attempts, disallows non-hybrid key exchange fallbacks in designated zero-trust zones, and requires strict verification of negotiated supported_groups extensions.","antiPatternHeadline":"Permitting Classical-Only Fallbacks or Unchecked Key Share Downgrades During TLS 1.3 Handshake Negotiation","stars_count":47,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","tls13","post-quantum","ml-kem","cryptography","zero-trust"],"exportEndpoints":{"claude":"/api/rules/post-quantum-hybrid-tls-mlkem-downgrade-guardrail?format=claude","cursorMdc":"/api/rules/post-quantum-hybrid-tls-mlkem-downgrade-guardrail?format=mdc","cursorrules":"/api/rules/post-quantum-hybrid-tls-mlkem-downgrade-guardrail?format=cursor","windsurf":"/api/rules/post-quantum-hybrid-tls-mlkem-downgrade-guardrail?format=windsurf","agents":"/api/rules/post-quantum-hybrid-tls-mlkem-downgrade-guardrail?format=agents"}},{"id":"tauri2-cross-window-ipc-capability-partitioning-production-standard","title":"Tauri 2.0 Cross-Window IPC Capability Partitioning Standard","category":"security","severity":"critical","description":"Enforces strict origin and window-label binding for all Tauri 2.0 IPC commands within multi-webview architectures. Prevents privilege escalation and cross-context contamination by restricting sensitive Rust backend commands through isolated capability definitions and cryptographic webview labeling instead of wildcard window bindings.","antiPatternHeadline":"Wildcard Window Bindings Granting Auxiliary Windows Full Administrative IPC Access","stars_count":60,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","tauri-2","ipc-security","capability-partitioning","principle-of-least-privilege"],"exportEndpoints":{"claude":"/api/rules/tauri2-cross-window-ipc-capability-partitioning-production-standard?format=claude","cursorMdc":"/api/rules/tauri2-cross-window-ipc-capability-partitioning-production-standard?format=mdc","cursorrules":"/api/rules/tauri2-cross-window-ipc-capability-partitioning-production-standard?format=cursor","windsurf":"/api/rules/tauri2-cross-window-ipc-capability-partitioning-production-standard?format=windsurf","agents":"/api/rules/tauri2-cross-window-ipc-capability-partitioning-production-standard?format=agents"}},{"id":"tetragon-ebpf-namespace-escape-quarantine-standard","title":"Cilium Tetragon eBPF Synchronous Namespace Escape Quarantine Standard","category":"devops","severity":"critical","description":"Mandates the deployment of Cilium Tetragon TracingPolicies configured for synchronous in-kernel enforcement (action: Sigkill) upon unauthorized container namespace boundary traversal, such as setns and unshare invocations. Prevents time-of-check to time-of-use (TOCTOU) container breakouts by replacing asynchronous user-space alerting with immediate eBPF-driven process termination and real-time structured audit event emission.","antiPatternHeadline":"Post-Facto Asynchronous Alerting on Namespace Traversal Syscalls Without In-Kernel SIGKILL Enforcement","stars_count":48,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","tetragon","cilium","kubernetes","container-security","zero-trust"],"exportEndpoints":{"claude":"/api/rules/tetragon-ebpf-namespace-escape-quarantine-standard?format=claude","cursorMdc":"/api/rules/tetragon-ebpf-namespace-escape-quarantine-standard?format=mdc","cursorrules":"/api/rules/tetragon-ebpf-namespace-escape-quarantine-standard?format=cursor","windsurf":"/api/rules/tetragon-ebpf-namespace-escape-quarantine-standard?format=windsurf","agents":"/api/rules/tetragon-ebpf-namespace-escape-quarantine-standard?format=agents"}},{"id":"opentelemetry-w3c-baggage-tenant-isolation","title":"OpenTelemetry W3C Baggage Multi-Tenant Isolation and Ingress Sanitization","category":"devops","severity":"critical","description":"Enforces strict boundary sanitization and authenticated re-binding of OpenTelemetry W3C Baggage headers at API ingress boundaries. Forwarding raw, untrusted client-supplied baggage enables cross-tenant identity spoofing, downstream trace attribute poisoning, and data isolation breaches in observability pipelines. Ingress layers must drop or strictly validate client baggage and rebuild context exclusively from cryptographically verified authentication tokens.","antiPatternHeadline":"Blind Context Propagation of Untrusted W3C Inbound Baggage Across Multi-Tenant Microservice Boundaries","stars_count":112,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","security","multi-tenancy","tracing","w3c-baggage"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-w3c-baggage-tenant-isolation?format=claude","cursorMdc":"/api/rules/opentelemetry-w3c-baggage-tenant-isolation?format=mdc","cursorrules":"/api/rules/opentelemetry-w3c-baggage-tenant-isolation?format=cursor","windsurf":"/api/rules/opentelemetry-w3c-baggage-tenant-isolation?format=windsurf","agents":"/api/rules/opentelemetry-w3c-baggage-tenant-isolation?format=agents"}},{"id":"axum-08-tower-http3-multiplex-drain","title":"Axum 0.8 / HTTP/3 Zero-Drop Graceful Shutdown and Multiplexed Drain Guardrail","category":"backend","severity":"critical","description":"Enforces deterministic two-phase GOAWAY signaling, QUIC connection draining states, and synchronized Tower service pipeline completion in Axum 0.8 deployments. Guarantees zero dropped client requests and boundary-safe stream abortion during rolling container orchestrations over HTTP/3.","antiPatternHeadline":"Uncoordinated QUIC Endpoint Dropping Leading to Abrupt Stream Truncation and Rolling Deploy 502/504 Errors","stars_count":94,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","http3","quic","tower","zero-downtime"],"exportEndpoints":{"claude":"/api/rules/axum-08-tower-http3-multiplex-drain?format=claude","cursorMdc":"/api/rules/axum-08-tower-http3-multiplex-drain?format=mdc","cursorrules":"/api/rules/axum-08-tower-http3-multiplex-drain?format=cursor","windsurf":"/api/rules/axum-08-tower-http3-multiplex-drain?format=windsurf","agents":"/api/rules/axum-08-tower-http3-multiplex-drain?format=agents"}},{"id":"react19-action-transition-abortsignal-demuxing-standard","title":"Deterministic AbortSignal Demultiplexing for React 19 use() Transitions","category":"frontend","severity":"critical","description":"Enforces deterministic cancellation and cleanup of pending micro-tasks, asynchronous action transitions, and concurrent resource fetches consumed via React 19's use() API. Rapid route transitions and superseded useTransition calls must multiplex and demultiplex AbortSignals at route boundaries to prevent memory leaks, orphan micro-task execution, and out-of-order state settlement across nested Suspense boundaries.","antiPatternHeadline":"Ghost Promises and Stale Micro-Task Settlement via Unlinked use() Boundaries","stars_count":92,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["react19","transitions","abort-signal","concurrency","suspense"],"exportEndpoints":{"claude":"/api/rules/react19-action-transition-abortsignal-demuxing-standard?format=claude","cursorMdc":"/api/rules/react19-action-transition-abortsignal-demuxing-standard?format=mdc","cursorrules":"/api/rules/react19-action-transition-abortsignal-demuxing-standard?format=cursor","windsurf":"/api/rules/react19-action-transition-abortsignal-demuxing-standard?format=windsurf","agents":"/api/rules/react19-action-transition-abortsignal-demuxing-standard?format=agents"}},{"id":"capacitor-7-zero-copy-arraybuffer-jsi-bridge-isolation","title":"Capacitor 7 Zero-Copy ArrayBuffer JSI Bridge Isolation Standard","category":"mobile","severity":"critical","description":"Enforces strict Zero-Copy ArrayBuffer transfers across the native-to-web bridge using low-level typed buffers and isolated Web Workers. Prevents main-thread micro-stutter by eliminating base64/JSON string serialization overhead during high-frequency (>=60Hz) biometric and IMU sensor telemetry streaming. Guarantees 60/120 FPS rendering pipelines remain decoupled from incoming native hardware events.","antiPatternHeadline":"Streaming High-Frequency Sensor Packets as Base64/JSON Strings Across the Capacitor Bridge onto the Main Thread","stars_count":91,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","jsi","performance","arraybuffer","telemetry","web-workers"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-zero-copy-arraybuffer-jsi-bridge-isolation?format=claude","cursorMdc":"/api/rules/capacitor-7-zero-copy-arraybuffer-jsi-bridge-isolation?format=mdc","cursorrules":"/api/rules/capacitor-7-zero-copy-arraybuffer-jsi-bridge-isolation?format=cursor","windsurf":"/api/rules/capacitor-7-zero-copy-arraybuffer-jsi-bridge-isolation?format=windsurf","agents":"/api/rules/capacitor-7-zero-copy-arraybuffer-jsi-bridge-isolation?format=agents"}},{"id":"pg17-failover-slot-sync-wal-retention-quarantine","title":"Postgres 17 Failover Slot Sync WAL Retention Quarantine and Budget Bounding","category":"backend","severity":"critical","description":"Mandates strict WAL retention caps (`max_slot_wal_keep_size`) and automated quarantine controls for PostgreSQL 17 synchronized failover slots. Prevents catastrophic disk exhaustion on primary instances when logical replication subscribers or standby failover synchronization daemons stall. Enforces proactive invalidation and state tracking across `pg_replication_slots` to guarantee cluster availability over indefinite replication retention.","antiPatternHeadline":"Unbounded Synced Replication Slots Inducing Primary Disk Exhaustion During Standby or Subscriber Stalls","stars_count":85,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres","postgresql-17","replication","high-availability","database-reliability","wal-budget"],"exportEndpoints":{"claude":"/api/rules/pg17-failover-slot-sync-wal-retention-quarantine?format=claude","cursorMdc":"/api/rules/pg17-failover-slot-sync-wal-retention-quarantine?format=mdc","cursorrules":"/api/rules/pg17-failover-slot-sync-wal-retention-quarantine?format=cursor","windsurf":"/api/rules/pg17-failover-slot-sync-wal-retention-quarantine?format=windsurf","agents":"/api/rules/pg17-failover-slot-sync-wal-retention-quarantine?format=agents"}},{"id":"fastapi-free-threaded-cpython-313-native-thread-isolation","title":"FastAPI Free-Threaded CPython 3.13 Native Thread Isolation Standard","category":"backend","severity":"critical","description":"Enforces strict native memory isolation and thread-safe shared state primitives for high-throughput ASGI applications running on GIL-disabled CPython 3.13 (PEP 703). Prevents race conditions, data corruption, and GC allocator thrashing when handling concurrent ASGI requests across shared native OS threads without process boundaries.","antiPatternHeadline":"Global Mutability and Thread-Unsafe In-Memory State in GIL-Free ASGI Runtimes","stars_count":115,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","python3.13","free-threaded","pep703","multithreading","asgi"],"exportEndpoints":{"claude":"/api/rules/fastapi-free-threaded-cpython-313-native-thread-isolation?format=claude","cursorMdc":"/api/rules/fastapi-free-threaded-cpython-313-native-thread-isolation?format=mdc","cursorrules":"/api/rules/fastapi-free-threaded-cpython-313-native-thread-isolation?format=cursor","windsurf":"/api/rules/fastapi-free-threaded-cpython-313-native-thread-isolation?format=windsurf","agents":"/api/rules/fastapi-free-threaded-cpython-313-native-thread-isolation?format=agents"}},{"id":"cilium-ebpf-host-routing-wireguard-invariant","title":"Cilium eBPF Host-Routing Node-to-Node WireGuard Mesh & Pod Identity Guardrail","category":"devops","severity":"critical","description":"Enforces in-kernel cryptographic mesh encapsulation and transparent egress pod identity verification via Cilium eBPF host routing and WireGuard. Eliminates user-space proxy performance degradation by bypassing iptables connection tracking and routing encrypted transit directly through native eBPF tc/sockops programs.","antiPatternHeadline":"Routing Node Mesh Traffic Through User-Space Proxies or Forcing Conntrack Decryption Fallbacks","stars_count":102,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","cilium","ebpf","wireguard","kubernetes","networking","security"],"exportEndpoints":{"claude":"/api/rules/cilium-ebpf-host-routing-wireguard-invariant?format=claude","cursorMdc":"/api/rules/cilium-ebpf-host-routing-wireguard-invariant?format=mdc","cursorrules":"/api/rules/cilium-ebpf-host-routing-wireguard-invariant?format=cursor","windsurf":"/api/rules/cilium-ebpf-host-routing-wireguard-invariant?format=windsurf","agents":"/api/rules/cilium-ebpf-host-routing-wireguard-invariant?format=agents"}},{"id":"webauthn-conditional-ui-nonce-replay-barrier","title":"WebAuthn Conditional UI Ephemeral Challenge Ledger and Replay Barrier","category":"security","severity":"critical","description":"WebAuthn Conditional Mediation (passkey autofill) initiates asynchronous, prolonged authentication ceremonies that expose relying parties to challenge replay, token exhaustion, and enumeration attacks. To prevent cross-session assertion replays, all challenges issued for conditional UI must be bound to an ephemeral server session, tracked in an atomic single-use ledger, and irreversibly consumed immediately upon receipt before cryptographic verification begins.","antiPatternHeadline":"Persisting Long-Lived Reusable WebAuthn Challenges or Deferring Nonce Consumption Until After Signature Verification","stars_count":74,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","passkeys","authentication","cryptography","fido2"],"exportEndpoints":{"claude":"/api/rules/webauthn-conditional-ui-nonce-replay-barrier?format=claude","cursorMdc":"/api/rules/webauthn-conditional-ui-nonce-replay-barrier?format=mdc","cursorrules":"/api/rules/webauthn-conditional-ui-nonce-replay-barrier?format=cursor","windsurf":"/api/rules/webauthn-conditional-ui-nonce-replay-barrier?format=windsurf","agents":"/api/rules/webauthn-conditional-ui-nonce-replay-barrier?format=agents"}},{"id":"compose-multiplatform-metal-vulkan-fence-sync-production-standard","title":"Compose Multiplatform Metal/Vulkan GPU Fence Synchronization & VSync Alignment Standard","category":"mobile","severity":"critical","description":"Enforces deterministic hardware synchronization between off-thread layout/composition passes and GPU frame presentation across iOS Metal and Android Vulkan swapchains. Prevents dual-surface render tearing, out-of-order buffer swapchain presentation, and frame drops by anchoring presentation to VSync intervals using native GPU fences.","antiPatternHeadline":"Unsynchronized Cross-Thread Surface Mutations Causing Metal/Vulkan Presentation Tearing","stars_count":58,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","compose-multiplatform","metal","vulkan","gpu-synchronization","skiko","vsync"],"exportEndpoints":{"claude":"/api/rules/compose-multiplatform-metal-vulkan-fence-sync-production-standard?format=claude","cursorMdc":"/api/rules/compose-multiplatform-metal-vulkan-fence-sync-production-standard?format=mdc","cursorrules":"/api/rules/compose-multiplatform-metal-vulkan-fence-sync-production-standard?format=cursor","windsurf":"/api/rules/compose-multiplatform-metal-vulkan-fence-sync-production-standard?format=windsurf","agents":"/api/rules/compose-multiplatform-metal-vulkan-fence-sync-production-standard?format=agents"}},{"id":"otel-collector-cgroup-dynamic-backpressure-guardrail","title":"OpenTelemetry Collector Cgroup-Aware Dynamic Backpressure Guardrail","category":"devops","severity":"critical","description":"Enforces deterministic memory bounds and cgroup-coupled dynamic backpressure on OpenTelemetry Collector instances to eliminate OOM kills under burst traffic. Mandates strict positioning of the memory_limiter processor, alignment of GOMEMLIMIT with container cgroup limits, and explicit bounded queues across all pipelines.","antiPatternHeadline":"Unbounded Collector Queuing and Uncoupled Host-Relative Memory Limits Leading to Kernel OOM Termination","stars_count":56,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","kubernetes","cgroups","backpressure","observability"],"exportEndpoints":{"claude":"/api/rules/otel-collector-cgroup-dynamic-backpressure-guardrail?format=claude","cursorMdc":"/api/rules/otel-collector-cgroup-dynamic-backpressure-guardrail?format=mdc","cursorrules":"/api/rules/otel-collector-cgroup-dynamic-backpressure-guardrail?format=cursor","windsurf":"/api/rules/otel-collector-cgroup-dynamic-backpressure-guardrail?format=windsurf","agents":"/api/rules/otel-collector-cgroup-dynamic-backpressure-guardrail?format=agents"}},{"id":"react-19-server-actions-idempotency-optimistic-rollback","title":"React 19 Server Actions Idempotency & Optimistic State Rollback Invariant","category":"frontend","severity":"critical","description":"Enforces deterministic client-side state reconciliation across optimistic updates and asynchronous Server Actions in React 19. Mandates client-generated idempotency tokens and transactional transitions via useOptimistic and useActionState to prevent phantom state mutations and UI divergence on network failures or concurrent action rejections.","antiPatternHeadline":"Unbounded manual state mutation during asynchronous Server Actions without idempotency guards and deterministic optimistic rollback","stars_count":93,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","server-actions","optimistic-ui","idempotency","state-reconciliation"],"exportEndpoints":{"claude":"/api/rules/react-19-server-actions-idempotency-optimistic-rollback?format=claude","cursorMdc":"/api/rules/react-19-server-actions-idempotency-optimistic-rollback?format=mdc","cursorrules":"/api/rules/react-19-server-actions-idempotency-optimistic-rollback?format=cursor","windsurf":"/api/rules/react-19-server-actions-idempotency-optimistic-rollback?format=windsurf","agents":"/api/rules/react-19-server-actions-idempotency-optimistic-rollback?format=agents"}},{"id":"react-19-document-metadata-async-hoisting-standard","title":"React 19 Document Metadata Async Hoisting & Deduplication Standard","category":"frontend","severity":"critical","description":"Governs document metadata (<title>, <meta>, <link>) handling across streaming server-side rendering and async transitions in React 19. Eliminates hydration mismatches, document head mutation races, and metadata flashes by enforcing native React 19 metadata hoisting and deterministic deduplication invariants over legacy third-party wrappers or imperative DOM writes.","antiPatternHeadline":"Imperative head mutations and legacy third-party head wrappers inducing streaming metadata races and hydration flash.","stars_count":88,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","metadata","ssr","streaming","suspense"],"exportEndpoints":{"claude":"/api/rules/react-19-document-metadata-async-hoisting-standard?format=claude","cursorMdc":"/api/rules/react-19-document-metadata-async-hoisting-standard?format=mdc","cursorrules":"/api/rules/react-19-document-metadata-async-hoisting-standard?format=cursor","windsurf":"/api/rules/react-19-document-metadata-async-hoisting-standard?format=windsurf","agents":"/api/rules/react-19-document-metadata-async-hoisting-standard?format=agents"}},{"id":"axum-h3-quic-graceful-goaway-draining","title":"Axum 0.8 HTTP/3 QUIC Dual-Stage GOAWAY Stream Draining Standard","category":"backend","severity":"critical","description":"Enforces RFC 9114 Section 5.2 compliant dual-stage HTTP/3 GOAWAY frame sequencing across QUIC connections during SIGTERM events in Axum 0.8 services. Prevents silent request truncation, client-side 502/503 errors, and transport race conditions during rolling deployments by synchronizing stream drains across the QUIC connection pool.","antiPatternHeadline":"Abrupt QUIC Connection Severance Dropping In-Flight HTTP/3 Streams During Rolling Deployments","stars_count":74,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","http3","quic","zero-downtime","h3"],"exportEndpoints":{"claude":"/api/rules/axum-h3-quic-graceful-goaway-draining?format=claude","cursorMdc":"/api/rules/axum-h3-quic-graceful-goaway-draining?format=mdc","cursorrules":"/api/rules/axum-h3-quic-graceful-goaway-draining?format=cursor","windsurf":"/api/rules/axum-h3-quic-graceful-goaway-draining?format=windsurf","agents":"/api/rules/axum-h3-quic-graceful-goaway-draining?format=agents"}},{"id":"postgres-17-json-table-memory-guardrail-postgres-17-sql--916","title":"Postgres 17 SQL:2023 JSON_TABLE Streaming Projection & Memory Bounds","category":"backend","severity":"critical","description":"Enforces bounded memory projection and selective path materialization for Postgres 17 SQL:2023 JSON_TABLE queries. Prevents backend out-of-memory (OOM) failures and work_mem thrashing by mandating pre-filtered indexed scans, narrow column typing, and bounded sibling nested paths over large JSONB payloads.","antiPatternHeadline":"Unbounded JSON_TABLE Lateral Joins Triggering Memory Exhaustion via Deep Nested Path Materialization","stars_count":51,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres-17","json-table","sql-2023","jsonb","performance","memory-leak"],"exportEndpoints":{"claude":"/api/rules/postgres-17-json-table-memory-guardrail-postgres-17-sql--916?format=claude","cursorMdc":"/api/rules/postgres-17-json-table-memory-guardrail-postgres-17-sql--916?format=mdc","cursorrules":"/api/rules/postgres-17-json-table-memory-guardrail-postgres-17-sql--916?format=cursor","windsurf":"/api/rules/postgres-17-json-table-memory-guardrail-postgres-17-sql--916?format=windsurf","agents":"/api/rules/postgres-17-json-table-memory-guardrail-postgres-17-sql--916?format=agents"}},{"id":"capacitor-7-hardware-keystore-attestation-bridge-invariant","title":"Capacitor 7 Secure Hardware Keystore and Key Attestation Bridge Invariant","category":"mobile","severity":"critical","description":"Enforces non-exportable hardware-backed key isolation across the Capacitor 7 JavaScript-to-Native bridge. Mandates that private cryptographic keys residing in Android Keystore (StrongBox/TEE) and Apple Secure Enclave are strictly non-extractable, exposing only opaque key aliases, cryptographic challenges, and public attestation certificate chains to the WebView JavaScript runtime.","antiPatternHeadline":"Exposing Raw Private Keys or Symmetric Secrets Across the Capacitor Bridge to the WebView Context","stars_count":93,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","security","cryptography","key-attestation","secure-enclave"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-hardware-keystore-attestation-bridge-invariant?format=claude","cursorMdc":"/api/rules/capacitor-7-hardware-keystore-attestation-bridge-invariant?format=mdc","cursorrules":"/api/rules/capacitor-7-hardware-keystore-attestation-bridge-invariant?format=cursor","windsurf":"/api/rules/capacitor-7-hardware-keystore-attestation-bridge-invariant?format=windsurf","agents":"/api/rules/capacitor-7-hardware-keystore-attestation-bridge-invariant?format=agents"}},{"id":"ios-18-live-activity-token-invalidation-fence","title":"iOS 18 Live Activities Deterministic APNs Token Refresh and Invalidation Fence","category":"mobile","severity":"critical","description":"Enforces continuous asynchronous observation and transactional lifecycle synchronization for iOS 18 ActivityKit push-to-start and per-activity update tokens. Prevents orphaned lockscreen widgets, unbounded background wakeups, and APNs 410 Gone errors caused by unobserved token rotation and unmanaged activity termination.","antiPatternHeadline":"Persisting Stale Initial APNs Tokens Without Monitoring Async Sequences or Activity State Invalidation","stars_count":99,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","ios","swift","activitykit","apns","live-activities"],"exportEndpoints":{"claude":"/api/rules/ios-18-live-activity-token-invalidation-fence?format=claude","cursorMdc":"/api/rules/ios-18-live-activity-token-invalidation-fence?format=mdc","cursorrules":"/api/rules/ios-18-live-activity-token-invalidation-fence?format=cursor","windsurf":"/api/rules/ios-18-live-activity-token-invalidation-fence?format=windsurf","agents":"/api/rules/ios-18-live-activity-token-invalidation-fence?format=agents"}},{"id":"webauthn-conditional-ui-replay-guardrail","title":"WebAuthn Conditional UI Passkey Replay & Cross-Session Injection Guardrail","category":"security","severity":"critical","description":"Enforces single-use ephemeral challenge lifecycle management, atomic consumption, and strict session-to-challenge binding for WebAuthn Conditional Mediation ceremonies. Mitigates passkey autofill replay attacks, cross-session UI injection, and assertion race conditions across browser tabs.","antiPatternHeadline":"Non-Atomic Challenge Invalidation and Unbound Ephemeral Challenges in Passkey Conditional Autofill","stars_count":85,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","passkeys","conditional-ui","fido2","session-binding"],"exportEndpoints":{"claude":"/api/rules/webauthn-conditional-ui-replay-guardrail?format=claude","cursorMdc":"/api/rules/webauthn-conditional-ui-replay-guardrail?format=mdc","cursorrules":"/api/rules/webauthn-conditional-ui-replay-guardrail?format=cursor","windsurf":"/api/rules/webauthn-conditional-ui-replay-guardrail?format=windsurf","agents":"/api/rules/webauthn-conditional-ui-replay-guardrail?format=agents"}},{"id":"wasi-02-capability-filesystem-sandboxing","title":"WASI 0.2 Component Model Capability-Based File System Sandboxing","category":"security","severity":"critical","description":"Enforces strict compile-time and runtime POSIX capability boundaries to isolate untrusted third-party edge micro-plugins in serverless runtimes. Prohibits ambient host filesystem access and bypasses of wasi:filesystem/preopens by demanding explicit descriptor token passing and virtual directory mapping with least-privilege capability flags (read/write separation, append-only, symlink denial). Ensures untrusted guest components cannot escape directory scopes via path traversal or ambient POSIX handles.","antiPatternHeadline":"Ambient Filesystem Ingestion and Unconstrained Preopen Delegation in WASI 0.2 Guests","stars_count":95,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","wasi-02","webassembly","sandboxing","component-model","posix-isolation","edge-computing"],"exportEndpoints":{"claude":"/api/rules/wasi-02-capability-filesystem-sandboxing?format=claude","cursorMdc":"/api/rules/wasi-02-capability-filesystem-sandboxing?format=mdc","cursorrules":"/api/rules/wasi-02-capability-filesystem-sandboxing?format=cursor","windsurf":"/api/rules/wasi-02-capability-filesystem-sandboxing?format=windsurf","agents":"/api/rules/wasi-02-capability-filesystem-sandboxing?format=agents"}},{"id":"k8s-132-in-place-vpa-memory-invariant","title":"Kubernetes 1.32 In-Place Pod Resource Resizing and cgroup v2 Memory Invariant","category":"devops","severity":"critical","description":"Enforces deterministic specification of container `resizePolicy` for CPU and memory in Kubernetes 1.32+ workloads. Prevents abrupt pod restarts and cgroup v2 kernel Out-Of-Memory (OOM) kills triggered when memory limits are dynamically scaled down below current container working set sizes (`memory.current`). Ensures declarative alignment between Pod resources, container runtime limits, and Vertical Pod Autoscaler (VPA) in-place update configurations.","antiPatternHeadline":"Omitting explicit resizePolicy or dynamically lowering memory limits below working set size without restart safety gates, triggering instantaneous cgroup v2 OOM invocation.","stars_count":106,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["kubernetes","k8s-1-32","vpa","cgroupv2","devops","resource-management","finops"],"exportEndpoints":{"claude":"/api/rules/k8s-132-in-place-vpa-memory-invariant?format=claude","cursorMdc":"/api/rules/k8s-132-in-place-vpa-memory-invariant?format=mdc","cursorrules":"/api/rules/k8s-132-in-place-vpa-memory-invariant?format=cursor","windsurf":"/api/rules/k8s-132-in-place-vpa-memory-invariant?format=windsurf","agents":"/api/rules/k8s-132-in-place-vpa-memory-invariant?format=agents"}},{"id":"opentelemetry-genai-pii-sanitization-guardrail","title":"Mandatory In-Memory PII Scrubbing SpanProcessor for OpenTelemetry GenAI Conventions","category":"devops","severity":"critical","description":"Enforces deterministic, in-memory sanitization of OpenTelemetry GenAI semantic attributes (e.g., gen_ai.prompt, gen_ai.completion, and event payloads) prior to dispatching to OTLP batch processors. Prevents cross-region exfiltration of personally identifiable information (PII), protected health information (PHI), and credential secrets in AI observability pipelines.","antiPatternHeadline":"Attaching Raw Prompts and Model Outputs to OTLP Exporters Without Pre-Export Sanitization","stars_count":66,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","genai","pii-sanitization","data-governance","observability"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-genai-pii-sanitization-guardrail?format=claude","cursorMdc":"/api/rules/opentelemetry-genai-pii-sanitization-guardrail?format=mdc","cursorrules":"/api/rules/opentelemetry-genai-pii-sanitization-guardrail?format=cursor","windsurf":"/api/rules/opentelemetry-genai-pii-sanitization-guardrail?format=windsurf","agents":"/api/rules/opentelemetry-genai-pii-sanitization-guardrail?format=agents"}},{"id":"react-19-async-transition-abortsignal-invariant","title":"React 19 Async Transitions Deterministic AbortSignal DOM Disconnect Standard","category":"frontend","severity":"critical","description":"Enforces deterministic lifecycle-bound cancellation for asynchronous actions and transitions executed via React 19 transitions and action states. Guarantees that pending network I/O, server actions, and microtask pipelines register an explicit AbortSignal tied to component unmount and concurrent boundary re-renders, preventing post-unmount execution and memory retention across phantom DOM trees.","antiPatternHeadline":"Unbounded async transitions executing beyond component unmount, causing memory leaks and phantom reconciliation","stars_count":68,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["react-19","transitions","abortcontroller","memory-leaks","concurrency","frontend"],"exportEndpoints":{"claude":"/api/rules/react-19-async-transition-abortsignal-invariant?format=claude","cursorMdc":"/api/rules/react-19-async-transition-abortsignal-invariant?format=mdc","cursorrules":"/api/rules/react-19-async-transition-abortsignal-invariant?format=cursor","windsurf":"/api/rules/react-19-async-transition-abortsignal-invariant?format=windsurf","agents":"/api/rules/react-19-async-transition-abortsignal-invariant?format=agents"}},{"id":"nextjs15-ppr-dynamic-hole-timeout-standard","title":"Next.js 15 PPR Dynamic Hole Streaming Flush-Timeout Standard","category":"frontend","severity":"critical","description":"Enforces deterministic flush timeouts and boundary encapsulation for dynamic streaming holes in Next.js 15 Partial Prerendering (PPR). Prevents high-latency downstream microservices and slow dynamic queries from blocking early static shell edge delivery or stalling HTTP streaming responses. Mandates AbortController timeouts, granular React Suspense fallback boundaries, and non-blocking error fallbacks.","antiPatternHeadline":"Unbounded Async Hole Execution Stalling Edge Shell Delivery and HTTP Streaming","stars_count":70,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs15","ppr","streaming","suspense","performance","resilience"],"exportEndpoints":{"claude":"/api/rules/nextjs15-ppr-dynamic-hole-timeout-standard?format=claude","cursorMdc":"/api/rules/nextjs15-ppr-dynamic-hole-timeout-standard?format=mdc","cursorrules":"/api/rules/nextjs15-ppr-dynamic-hole-timeout-standard?format=cursor","windsurf":"/api/rules/nextjs15-ppr-dynamic-hole-timeout-standard?format=windsurf","agents":"/api/rules/nextjs15-ppr-dynamic-hole-timeout-standard?format=agents"}},{"id":"fastapi-anyio-thread-starvation-guardrail","title":"FastAPI AnyIO Worker Pool Capacity & Thread Starvation Guardrail","category":"backend","severity":"critical","description":"Enforces explicit thread pool capacity configuration and isolated AnyIO CapacityLimiter instances for blocking synchronous dependencies in FastAPI. Prevents default worker pool saturation from starving the event loop, deadlocking sync dependency resolution, and triggering health check failures under high concurrency.","antiPatternHeadline":"Exhausting Default AnyIO Thread Limiter with Unbounded Blocking I/O and Sync Dependencies","stars_count":117,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["fastapi","anyio","asyncio","python","performance","concurrency"],"exportEndpoints":{"claude":"/api/rules/fastapi-anyio-thread-starvation-guardrail?format=claude","cursorMdc":"/api/rules/fastapi-anyio-thread-starvation-guardrail?format=mdc","cursorrules":"/api/rules/fastapi-anyio-thread-starvation-guardrail?format=cursor","windsurf":"/api/rules/fastapi-anyio-thread-starvation-guardrail?format=windsurf","agents":"/api/rules/fastapi-anyio-thread-starvation-guardrail?format=agents"}},{"id":"bun-1-2-native-socket-splice-standard","title":"Bun 1.2 Native TCP Direct-Buffer Socket Splicing & Zero-Copy Proxy Standard","category":"backend","severity":"critical","description":"Mandates zero-copy direct-buffer transmission across Bun 1.2 native TCP sockets in high-throughput reverse proxies and streaming gateways. Enforces bypassing JavaScript runtime heap allocations and intermediate userland memory copying during packet forwarding to guarantee sub-millisecond latencies and eliminate GC pauses.","antiPatternHeadline":"Heap-Allocated Intermediate Buffers and Node-Stream Emulation in Bun Gateways","stars_count":64,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","networking","tcp","zero-copy","performance"],"exportEndpoints":{"claude":"/api/rules/bun-1-2-native-socket-splice-standard?format=claude","cursorMdc":"/api/rules/bun-1-2-native-socket-splice-standard?format=mdc","cursorrules":"/api/rules/bun-1-2-native-socket-splice-standard?format=cursor","windsurf":"/api/rules/bun-1-2-native-socket-splice-standard?format=windsurf","agents":"/api/rules/bun-1-2-native-socket-splice-standard?format=agents"}},{"id":"pgvector-quantized-in-memory-residency-invariant","title":"PostgreSQL 17 pgvector Quantized In-Memory Index Residency Invariant","category":"backend","severity":"critical","description":"Enforces that all HNSW and IVFFlat vector indexes deploy 1-byte scalar or binary quantization with mathematical bounds verification against shared_buffers. Graph traversal during approximate nearest neighbor search requires random pointer chasing across non-contiguous 8KB pages; if the working index set exceeds shared_buffers, query latency degrades by orders of magnitude due to random I/O stall cascades. All database deployments and migrations MUST prove index memory residency prior to cutover and enforce pg_prewarm at node initialization.","antiPatternHeadline":"Unquantized Float32 HNSW Vector Indexes Spilling to Disk Causing Catastrophic I/O Storms","stars_count":51,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","pgvector","performance","hnsw","database-reliability"],"exportEndpoints":{"claude":"/api/rules/pgvector-quantized-in-memory-residency-invariant?format=claude","cursorMdc":"/api/rules/pgvector-quantized-in-memory-residency-invariant?format=mdc","cursorrules":"/api/rules/pgvector-quantized-in-memory-residency-invariant?format=cursor","windsurf":"/api/rules/pgvector-quantized-in-memory-residency-invariant?format=windsurf","agents":"/api/rules/pgvector-quantized-in-memory-residency-invariant?format=agents"}},{"id":"openfga-consistency-token-pinning-guardrail","title":"OpenFGA Consistency Token Propagation and Read-After-Write Pinning","category":"security","severity":"critical","description":"Enforces strict propagation and validation of OpenFGA consistency tokens across distributed microservice boundaries. Eliminates Zanzibar 'New Enemy' stale-cache authorization races by mandating that write responses return a token or monotonic timestamp and downstream authorization checks evaluate against at least that snapshot state. Mitigates authorization bypasses where revoked permissions remain active during replication lag.","antiPatternHeadline":"Unpinned OpenFGA Check Executions Causing Stale Read Privilege Escalation","stars_count":95,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","authorization","zanzibar","consistency-token","race-conditions"],"exportEndpoints":{"claude":"/api/rules/openfga-consistency-token-pinning-guardrail?format=claude","cursorMdc":"/api/rules/openfga-consistency-token-pinning-guardrail?format=mdc","cursorrules":"/api/rules/openfga-consistency-token-pinning-guardrail?format=cursor","windsurf":"/api/rules/openfga-consistency-token-pinning-guardrail?format=windsurf","agents":"/api/rules/openfga-consistency-token-pinning-guardrail?format=agents"}},{"id":"tetragon-ebpf-lsm-inode-attestation-standard","title":"Cilium Tetragon eBPF LSM Process Inode Attestation Standard","category":"security","severity":"critical","description":"Enforces cryptographically signed binary provenance and strict inode attestation at the Linux Security Module (LSM) hook layer using Cilium Tetragon. Intercepts process initialization during bprm_check_security before memory mapping or execution occurs, deterministically killing unverified binaries to eliminate TOCTOU race conditions.","antiPatternHeadline":"Post-Execve Asynchronous Telemetry and Brittle Path-Based Filtering Without Inode Attestation","stars_count":97,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","ebpf","tetragon","lsm","binary-provenance","runtime-defense","kernel-security"],"exportEndpoints":{"claude":"/api/rules/tetragon-ebpf-lsm-inode-attestation-standard?format=claude","cursorMdc":"/api/rules/tetragon-ebpf-lsm-inode-attestation-standard?format=mdc","cursorrules":"/api/rules/tetragon-ebpf-lsm-inode-attestation-standard?format=cursor","windsurf":"/api/rules/tetragon-ebpf-lsm-inode-attestation-standard?format=windsurf","agents":"/api/rules/tetragon-ebpf-lsm-inode-attestation-standard?format=agents"}},{"id":"otel-exemplar-reservoir-memory-boundedness","title":"OpenTelemetry Exemplar Reservoir Memory Boundedness Standard","category":"devops","severity":"critical","description":"Enforces strict capacity and reservoir allocation controls on OpenTelemetry and Prometheus metric exemplars across instrumented applications and metric exporters. Unconstrained exemplar attachment to high-cardinality metric streams can cause unbounded memory growth and catastrophic Out-Of-Memory crashes in SDK runtimes and collector processes.","antiPatternHeadline":"Unbounded or default-leaking exemplar sampling causing metric stream heap exhaustion","stars_count":109,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","prometheus","observability","memory-management","metrics"],"exportEndpoints":{"claude":"/api/rules/otel-exemplar-reservoir-memory-boundedness?format=claude","cursorMdc":"/api/rules/otel-exemplar-reservoir-memory-boundedness?format=mdc","cursorrules":"/api/rules/otel-exemplar-reservoir-memory-boundedness?format=cursor","windsurf":"/api/rules/otel-exemplar-reservoir-memory-boundedness?format=windsurf","agents":"/api/rules/otel-exemplar-reservoir-memory-boundedness?format=agents"}},{"id":"kmp-swift-export-arc-retain-cycle-boundary-standard","title":"KMP Swift Export ARC Retain-Cycle Boundary Standard","category":"mobile","severity":"critical","description":"Enforces strict bidirectional weak-reference boxing and explicit closure detaching across the Kotlin Multiplatform (KMP) Swift Export boundary. Direct pointer retention between Swift ARC and Kotlin Native's tracing garbage collector creates uncollectible cross-runtime islands, leading to silent memory leaks and zombie presenter lifecycles on iOS.","antiPatternHeadline":"Direct Strong Reference Passing and Unboxed Observer Callbacks Across KMP Swift Export Boundary","stars_count":59,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kmp","kotlin-native","swift","arc","memory-management","ios"],"exportEndpoints":{"claude":"/api/rules/kmp-swift-export-arc-retain-cycle-boundary-standard?format=claude","cursorMdc":"/api/rules/kmp-swift-export-arc-retain-cycle-boundary-standard?format=mdc","cursorrules":"/api/rules/kmp-swift-export-arc-retain-cycle-boundary-standard?format=cursor","windsurf":"/api/rules/kmp-swift-export-arc-retain-cycle-boundary-standard?format=windsurf","agents":"/api/rules/kmp-swift-export-arc-retain-cycle-boundary-standard?format=agents"}},{"id":"android-15-16kb-page-alignment-native-elf","title":"Android 15 16KB Page Alignment Invariant for Native ELF Binaries","category":"mobile","severity":"critical","description":"Enforces explicit 16KB ELF load segment alignment across all cross-compiled native C, C++, and Rust libraries (.so) targeted for Android 15+. Prevents dynamic linker mapping failures, page boundary corruption, and fatal segmentation faults when running on modern 16KB memory page kernel architectures.","antiPatternHeadline":"Compiling Unaligned Native Binaries (4KB Defaults) Leading to Linker Crashes on Android 15","stars_count":63,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","android","ndk","rust","cmake","elf-alignment","android-15"],"exportEndpoints":{"claude":"/api/rules/android-15-16kb-page-alignment-native-elf?format=claude","cursorMdc":"/api/rules/android-15-16kb-page-alignment-native-elf?format=mdc","cursorrules":"/api/rules/android-15-16kb-page-alignment-native-elf?format=cursor","windsurf":"/api/rules/android-15-16kb-page-alignment-native-elf?format=windsurf","agents":"/api/rules/android-15-16kb-page-alignment-native-elf?format=agents"}},{"id":"nextjs-15-ppr-dynamic-hole-hydration-guardrail","title":"Next.js 15 PPR Dynamic Hole Hydration & Latency Boundary Guardrail","category":"frontend","severity":"critical","description":"Enforces strict isolation of dynamic runtime primitives within React Suspense boundaries paired with dimensionally-locked micro-skeletons for Next.js 15 Partial Prerendering (PPR). Prevents dynamic stream queries from blocking the static pre-rendered edge shell or inducing Cumulative Layout Shift (CLS) cascades upon hydration. Mandates strict latency timeouts on async dynamic holes to safeguard Time to First Byte (TTFB) and stream completion.","antiPatternHeadline":"Top-Level Dynamic Accessors and Naked Suspense Holes De-optimizing Static Edge Shells and Triggering Hydration Shifts","stars_count":73,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs15","partial-prerendering","react-suspense","streaming-ssr","core-web-vitals"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-ppr-dynamic-hole-hydration-guardrail?format=claude","cursorMdc":"/api/rules/nextjs-15-ppr-dynamic-hole-hydration-guardrail?format=mdc","cursorrules":"/api/rules/nextjs-15-ppr-dynamic-hole-hydration-guardrail?format=cursor","windsurf":"/api/rules/nextjs-15-ppr-dynamic-hole-hydration-guardrail?format=windsurf","agents":"/api/rules/nextjs-15-ppr-dynamic-hole-hydration-guardrail?format=agents"}},{"id":"openfga-rebac-contextual-tuple-depth-cycle-limit-standard","title":"OpenFGA 1.8 Contextual Tuple Depth and Cycle Guardrail","category":"security","severity":"critical","description":"Enforces strict structural constraints, acyclicity validation, and execution budgets on OpenFGA 1.8 contextual tuples and relationship queries. Prevents unbounded graph traversal, catastrophic algorithmic complexity, and goroutine/stack exhaustion in multi-tenant authorization evaluations.","antiPatternHeadline":"Injecting Unbounded or Cyclic Contextual Tuples into Authorization Checks Without Pre-Evaluation Graph Constraints and Traversal Budgets","stars_count":97,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","rebac","authorization","graph-traversal","dos-prevention"],"exportEndpoints":{"claude":"/api/rules/openfga-rebac-contextual-tuple-depth-cycle-limit-standard?format=claude","cursorMdc":"/api/rules/openfga-rebac-contextual-tuple-depth-cycle-limit-standard?format=mdc","cursorrules":"/api/rules/openfga-rebac-contextual-tuple-depth-cycle-limit-standard?format=cursor","windsurf":"/api/rules/openfga-rebac-contextual-tuple-depth-cycle-limit-standard?format=windsurf","agents":"/api/rules/openfga-rebac-contextual-tuple-depth-cycle-limit-standard?format=agents"}},{"id":"pg17-direct-io-wal-buffer-sizing-standard","title":"PostgreSQL 17 Direct I/O WAL Buffer Concurrency Sizing Standard","category":"backend","severity":"critical","description":"PostgreSQL 17 introduces direct I/O bypass options via io_direct to eliminate OS page-cache double-buffering. In high-throughput ingest systems, failing to size wal_buffers to hardware NVMe logical block address (LBA) boundaries under direct I/O causes unaligned block split-writes, severe WALInsertLock contention, and write amplification.","antiPatternHeadline":"Default Auto-Sized WAL Buffers with Active Direct I/O Inducing Sector Split-Write Thrashing","stars_count":45,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql-17","direct-io","wal-buffers","high-throughput","performance-engineering"],"exportEndpoints":{"claude":"/api/rules/pg17-direct-io-wal-buffer-sizing-standard?format=claude","cursorMdc":"/api/rules/pg17-direct-io-wal-buffer-sizing-standard?format=mdc","cursorrules":"/api/rules/pg17-direct-io-wal-buffer-sizing-standard?format=cursor","windsurf":"/api/rules/pg17-direct-io-wal-buffer-sizing-standard?format=windsurf","agents":"/api/rules/pg17-direct-io-wal-buffer-sizing-standard?format=agents"}},{"id":"kmp-skiko-ios-vsync-pacing-guardrail","title":"KMP Skiko iOS VSync CADisplayLink Deterministic RunLoop Pacing","category":"mobile","severity":"critical","description":"Eliminates micro-stutter, jank, and JNI/thread desynchronization on iOS 120Hz ProMotion displays in Compose Multiplatform / Skiko apps. Mandates deterministic CADisplayLink scheduling over NSRunLoopCommonModes with dynamic CAFrameRateRange configuration, preventing frame drop anomalies during user gestures.","antiPatternHeadline":"Unsynchronized Coroutine Delays or NSDefaultRunLoopMode Usage for iOS Skiko VSync Pacing","stars_count":93,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","compose-multiplatform","skiko","ios","promotion-120hz","vsync","cadisplaylink"],"exportEndpoints":{"claude":"/api/rules/kmp-skiko-ios-vsync-pacing-guardrail?format=claude","cursorMdc":"/api/rules/kmp-skiko-ios-vsync-pacing-guardrail?format=mdc","cursorrules":"/api/rules/kmp-skiko-ios-vsync-pacing-guardrail?format=cursor","windsurf":"/api/rules/kmp-skiko-ios-vsync-pacing-guardrail?format=windsurf","agents":"/api/rules/kmp-skiko-ios-vsync-pacing-guardrail?format=agents"}},{"id":"webauthn-prf-key-derivation-zeroization-standard","title":"WebAuthn PRF Deterministic Key Derivation and Zeroization Invariant","category":"security","severity":"critical","description":"Enforces strict memory zeroization and non-extractable cryptographic key lifecycles when using the WebAuthn PRF (pseudo-random function) extension for zero-knowledge client decryption. Guarantees that raw hardware-derived PRF seeds and intermediate key material are wiped from typed array buffers in finally blocks to prevent heap memory dump extraction.","antiPatternHeadline":"Retaining raw WebAuthn PRF output in garbage-collected string or buffer memory without deterministic zeroization","stars_count":67,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","prf","zeroization","cryptography","zero-knowledge"],"exportEndpoints":{"claude":"/api/rules/webauthn-prf-key-derivation-zeroization-standard?format=claude","cursorMdc":"/api/rules/webauthn-prf-key-derivation-zeroization-standard?format=mdc","cursorrules":"/api/rules/webauthn-prf-key-derivation-zeroization-standard?format=cursor","windsurf":"/api/rules/webauthn-prf-key-derivation-zeroization-standard?format=windsurf","agents":"/api/rules/webauthn-prf-key-derivation-zeroization-standard?format=agents"}},{"id":"bun-websocket-hibernation-backpressure-shedding","title":"Bun 1.2 Native WebSocket Hibernation Backpressure Threshold and Shedding","category":"backend","severity":"critical","description":"Enforces proactive backpressure management and aggressive connection shedding for Bun 1.2 native hibernated WebSockets. Prevents edge process heap exhaustion and unmanaged native memory bloat by mandating buffered amount checks and drain listeners before sockets return to dormant states.","antiPatternHeadline":"Unbounded WebSocket Broadcasting and Ignored Native Buffer Backpressure in Hibernated Sockets","stars_count":53,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","websockets","backpressure","memory-management","edge-workers"],"exportEndpoints":{"claude":"/api/rules/bun-websocket-hibernation-backpressure-shedding?format=claude","cursorMdc":"/api/rules/bun-websocket-hibernation-backpressure-shedding?format=mdc","cursorrules":"/api/rules/bun-websocket-hibernation-backpressure-shedding?format=cursor","windsurf":"/api/rules/bun-websocket-hibernation-backpressure-shedding?format=windsurf","agents":"/api/rules/bun-websocket-hibernation-backpressure-shedding?format=agents"}},{"id":"go-chi-arena-request-context-lifecycle","title":"Go Chi Arena-Backed Request Context Lifecycle Invariant","category":"backend","severity":"critical","description":"Enforces strict scope-bound memory arena reclamation within Go Chi HTTP middleware pipelines. Forbids arena-allocated pointers from escaping synchronous request boundaries into asynchronous goroutines, eradicating use-after-free memory corruption in zero-allocation services.","antiPatternHeadline":"Capturing Arena-Allocated Pointers in Asynchronous Goroutines After Deferred Middleware Arena Reclamation","stars_count":88,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["go","chi","memory-arena","concurrency","zero-allocation","use-after-free"],"exportEndpoints":{"claude":"/api/rules/go-chi-arena-request-context-lifecycle?format=claude","cursorMdc":"/api/rules/go-chi-arena-request-context-lifecycle?format=mdc","cursorrules":"/api/rules/go-chi-arena-request-context-lifecycle?format=cursor","windsurf":"/api/rules/go-chi-arena-request-context-lifecycle?format=windsurf","agents":"/api/rules/go-chi-arena-request-context-lifecycle?format=agents"}},{"id":"tauri-v2-deep-link-ipc-boundary-validation","title":"Tauri 2.0 Deep Link URI Validation & IPC Isolation Boundary","category":"mobile","severity":"critical","description":"Protects native core capabilities from malicious OS protocol handler injections by enforcing strict URI schema validation, origin allowlisting, and isolation boundaries before dispatching deep link payloads to privileged Tauri IPC commands. Unsanitized OS activations must never directly pass URI parameters into native plugins or arbitrary invoke handlers.","antiPatternHeadline":"Blind Pipeline Dispatch of Unsanitized OS Protocol URIs Directly into Privileged Native IPC Invokes","stars_count":82,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri-v2","deep-link","ipc-security","protocol-handler","input-validation"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-deep-link-ipc-boundary-validation?format=claude","cursorMdc":"/api/rules/tauri-v2-deep-link-ipc-boundary-validation?format=mdc","cursorrules":"/api/rules/tauri-v2-deep-link-ipc-boundary-validation?format=cursor","windsurf":"/api/rules/tauri-v2-deep-link-ipc-boundary-validation?format=windsurf","agents":"/api/rules/tauri-v2-deep-link-ipc-boundary-validation?format=agents"}},{"id":"opentelemetry-baggage-taint-tracking-size-ceiling","title":"OpenTelemetry W3C Baggage Ingress/Egress Taint-Tracking & Size Ceiling Enforcement","category":"devops","severity":"critical","description":"Mandates strict schema allowlists, size ceiling quotas, and taint-tracking for OpenTelemetry W3C Baggage propagation across microservice boundaries. Prevents distributed header amplification DoS vectors (HTTP 431 Request Header Fields Too Large) and lateral sensitive metadata exfiltration by pruning unverified baggage entries at ingress and egress gateways.","antiPatternHeadline":"Unfiltered Baggage Passthrough and Unbounded Distributed Header Accumulation","stars_count":75,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","distributed-tracing","w3c-baggage","security","taint-analysis"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-baggage-taint-tracking-size-ceiling?format=claude","cursorMdc":"/api/rules/opentelemetry-baggage-taint-tracking-size-ceiling?format=mdc","cursorrules":"/api/rules/opentelemetry-baggage-taint-tracking-size-ceiling?format=cursor","windsurf":"/api/rules/opentelemetry-baggage-taint-tracking-size-ceiling?format=windsurf","agents":"/api/rules/opentelemetry-baggage-taint-tracking-size-ceiling?format=agents"}},{"id":"react-19-multitab-optimistic-ledger-reconciliation","title":"React 19 Multi-Tab Optimistic Action Ledger Reconciliation via Web Locks and BroadcastChannel","category":"frontend","severity":"critical","description":"Enforces a transactional, monotonic action ledger across decoupled browser tabs using the Web Locks API and BroadcastChannel to govern React 19 optimistic updates. Guarantees deterministic rollback, prevents split-brain state divergence, and maintains eventual consistency across concurrent sessions during asynchronous server mutations and network failures.","antiPatternHeadline":"Decoupled Multi-Tab Divergence via Uncoordinated In-Memory Optimistic Mutations and Silent Remote Tab Failure","stars_count":81,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["react-19","useOptimistic","web-locks","broadcast-channel","distributed-state","frontend-architecture"],"exportEndpoints":{"claude":"/api/rules/react-19-multitab-optimistic-ledger-reconciliation?format=claude","cursorMdc":"/api/rules/react-19-multitab-optimistic-ledger-reconciliation?format=mdc","cursorrules":"/api/rules/react-19-multitab-optimistic-ledger-reconciliation?format=cursor","windsurf":"/api/rules/react-19-multitab-optimistic-ledger-reconciliation?format=windsurf","agents":"/api/rules/react-19-multitab-optimistic-ledger-reconciliation?format=agents"}},{"id":"nextjs-15-ppr-shell-fallback-boundary","title":"Next.js 15 PPR Shell Fallback Boundary & Static Shell Isolation","category":"frontend","severity":"critical","description":"Next.js 15 Partial Prerendering (PPR) combines static build-time shell delivery with dynamic HTTP streaming. Any request-bound dynamic API (such as cookies(), headers(), dynamic route parameters, or un-cached data fetching) accessed outside an explicit React Suspense boundary causes the static shell to block, destroying initial Byte-to-First-Chunk streaming guarantees. This standard mandates strict boundary encapsulation for all dynamic operations.","antiPatternHeadline":"Awaiting Dynamic APIs in Top-Level Page Shells Without Suspense Boundaries in PPR Routes","stars_count":56,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs","nextjs-15","ppr","react-suspense","streaming","performance"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-ppr-shell-fallback-boundary?format=claude","cursorMdc":"/api/rules/nextjs-15-ppr-shell-fallback-boundary?format=mdc","cursorrules":"/api/rules/nextjs-15-ppr-shell-fallback-boundary?format=cursor","windsurf":"/api/rules/nextjs-15-ppr-shell-fallback-boundary?format=windsurf","agents":"/api/rules/nextjs-15-ppr-shell-fallback-boundary?format=agents"}},{"id":"svelte-5-runes-ssr-module-state-isolation","title":"Svelte 5 Runes Server-Side Module State Isolation Standard","category":"frontend","severity":"critical","description":"Disallows root-level module-scoped $state and $derived runes in universal and server-evaluated files to prevent cross-request tenant memory pollution during Server-Side Rendering (SSR). In persistent runtime processes like Node.js, Bun, or Cloudflare Workers, module-level state survives individual request lifecycles and leaks sensitive tenant data across concurrent clients. All reactive state evaluated during SSR must be strictly scoped to the request lifecycle via Svelte Context or factory functions.","antiPatternHeadline":"Module-Scoped Top-Level $state in SSR Modules Causing Cross-Tenant Data Leakage","stars_count":59,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","ssr","security","multitenancy","sveltekit"],"exportEndpoints":{"claude":"/api/rules/svelte-5-runes-ssr-module-state-isolation?format=claude","cursorMdc":"/api/rules/svelte-5-runes-ssr-module-state-isolation?format=mdc","cursorrules":"/api/rules/svelte-5-runes-ssr-module-state-isolation?format=cursor","windsurf":"/api/rules/svelte-5-runes-ssr-module-state-isolation?format=windsurf","agents":"/api/rules/svelte-5-runes-ssr-module-state-isolation?format=agents"}},{"id":"react-native-76-jsi-hostobject-lifecycle-guardrail","title":"React Native 0.76+ JSI HostObject Native Memory Lifecycle Invariant","category":"mobile","severity":"critical","description":"Enforces deterministic reference retention, cross-thread synchronization, and explicit disposal protocols for C++ jsi::HostObject instances bridged to Hermes in React Native 0.76+. Eliminates fatal use-after-free (UAF) and SIGSEGV native memory faults caused by asynchronous worker threads accessing garbage-collected or runtime-invalidated native handles.","antiPatternHeadline":"Accessing Dangling jsi::HostObject Native Handles Across Async Boundaries Without Atomic Invalidation and Runtime Guarding","stars_count":91,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","react-native","jsi","hermes","memory-safety","turbomodules","cpp"],"exportEndpoints":{"claude":"/api/rules/react-native-76-jsi-hostobject-lifecycle-guardrail?format=claude","cursorMdc":"/api/rules/react-native-76-jsi-hostobject-lifecycle-guardrail?format=mdc","cursorrules":"/api/rules/react-native-76-jsi-hostobject-lifecycle-guardrail?format=cursor","windsurf":"/api/rules/react-native-76-jsi-hostobject-lifecycle-guardrail?format=windsurf","agents":"/api/rules/react-native-76-jsi-hostobject-lifecycle-guardrail?format=agents"}},{"id":"kmp-swift-export-dual-arc-gate","title":"Kotlin Multiplatform Swift Export Dual-ARC Reference Deallocation Gate","category":"mobile","severity":"critical","description":"Enforces strict memory boundary separation between Apple's Swift Automatic Reference Counting (ARC) and Kotlin/Native's garbage collector when using Swift Export. Prevents cross-runtime cyclic memory leaks and zombie wrapper retention caused by mutual strong references across Objective-C/Swift interop bindings. Mandates explicit lifecycle ownership gates, weak interop bridges, and deterministic scope teardown mechanisms.","antiPatternHeadline":"Cross-Runtime Circular Retain Cycles and Opaque Wrapper Pinning in Swift Export Bridges","stars_count":51,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","swift","ios","memory-management","arc","concurrency"],"exportEndpoints":{"claude":"/api/rules/kmp-swift-export-dual-arc-gate?format=claude","cursorMdc":"/api/rules/kmp-swift-export-dual-arc-gate?format=mdc","cursorrules":"/api/rules/kmp-swift-export-dual-arc-gate?format=cursor","windsurf":"/api/rules/kmp-swift-export-dual-arc-gate?format=windsurf","agents":"/api/rules/kmp-swift-export-dual-arc-gate?format=agents"}},{"id":"go-iter-pull-goroutine-leak-boundary","title":"Go 1.24 iter.Pull2 Mandatory Teardown and Goroutine Lifecycle Boundary","category":"backend","severity":"critical","description":"Enforces strict deferred invocation of the teardown closure returned by Go 1.24 iter.Pull and iter.Pull2 conversions. Converting push-based sequence iterators into pull consumers instantiates an underlying coroutine pair; failure to execute the stop closure on early breaks, errors, or panics permanently leaks producer goroutines.","antiPatternHeadline":"Omitting Immediate defer stop() on iter.Pull/iter.Pull2 Producer Coroutines","stars_count":92,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","concurrency","iterators","goroutine-leak","go124"],"exportEndpoints":{"claude":"/api/rules/go-iter-pull-goroutine-leak-boundary?format=claude","cursorMdc":"/api/rules/go-iter-pull-goroutine-leak-boundary?format=mdc","cursorrules":"/api/rules/go-iter-pull-goroutine-leak-boundary?format=cursor","windsurf":"/api/rules/go-iter-pull-goroutine-leak-boundary?format=windsurf","agents":"/api/rules/go-iter-pull-goroutine-leak-boundary?format=agents"}},{"id":"postgres-17-hashjoin-workmem-quota-guardrail","title":"PostgreSQL 17 Spill-to-Disk Hash Join Memory Quota Enforcement","category":"backend","severity":"critical","description":"Enforces deterministic, transaction-scoped memory budgets and parallel worker limits for PostgreSQL 17 optimized hash joins during high-throughput batch operations. Prevents process-level host OOM killer termination by containing concurrent work_mem allocations and enforcing explicit temp_file_limit disk spill boundaries.","antiPatternHeadline":"Unbounded Session-Level work_mem and Parallel Worker Multiplication Triggering Host OOM Panics","stars_count":102,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","performance","database","memory-management"],"exportEndpoints":{"claude":"/api/rules/postgres-17-hashjoin-workmem-quota-guardrail?format=claude","cursorMdc":"/api/rules/postgres-17-hashjoin-workmem-quota-guardrail?format=mdc","cursorrules":"/api/rules/postgres-17-hashjoin-workmem-quota-guardrail?format=cursor","windsurf":"/api/rules/postgres-17-hashjoin-workmem-quota-guardrail?format=windsurf","agents":"/api/rules/postgres-17-hashjoin-workmem-quota-guardrail?format=agents"}},{"id":"tower-hyper-concurrency-adaptive-shedding-invariant","title":"Tower & Hyper Concurrency Limiting with Adaptive Load Shedding","category":"backend","severity":"critical","description":"Protects async Rust edge services from Tokio event loop starvation and kernel socket queue exhaustion under saturating workloads. Enforces bounded concurrency gates and zero-allocation load shedding at the Tower service layer before socket buffer allocation or HTTP payload body ingestion.","antiPatternHeadline":"Spawning unbounded connection tasks without ready-check backpressure, triggering memory exhaustion and event loop stall","stars_count":102,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","tower","hyper","tokio","concurrency","backpressure"],"exportEndpoints":{"claude":"/api/rules/tower-hyper-concurrency-adaptive-shedding-invariant?format=claude","cursorMdc":"/api/rules/tower-hyper-concurrency-adaptive-shedding-invariant?format=mdc","cursorrules":"/api/rules/tower-hyper-concurrency-adaptive-shedding-invariant?format=cursor","windsurf":"/api/rules/tower-hyper-concurrency-adaptive-shedding-invariant?format=windsurf","agents":"/api/rules/tower-hyper-concurrency-adaptive-shedding-invariant?format=agents"}},{"id":"oauth2-dpop-rfc9449-proof-nonce-enforcement","title":"OAuth 2.0 DPoP (RFC 9449) Cryptographic Proof & Nonce Rotation Enforcement","category":"security","severity":"critical","description":"Mandates client-side asymmetric key-binding for all egress token and resource server requests in accordance with RFC 9449 (DPoP). Enforces strict single-use JTI proof generation, URI/method canonicalization, public-only JWK header exposure, and automatic RFC 9449 Section 4.3 DPoP-Nonce challenge retries to neutralize token theft and replay attacks.","antiPatternHeadline":"Statically Reusing Expired DPoP Proofs or Dropping Server DPoP-Nonce 401 Challenge Synchronization","stars_count":100,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","oauth2","rfc9449","dpop","cryptography","jwt","zero-trust"],"exportEndpoints":{"claude":"/api/rules/oauth2-dpop-rfc9449-proof-nonce-enforcement?format=claude","cursorMdc":"/api/rules/oauth2-dpop-rfc9449-proof-nonce-enforcement?format=mdc","cursorrules":"/api/rules/oauth2-dpop-rfc9449-proof-nonce-enforcement?format=cursor","windsurf":"/api/rules/oauth2-dpop-rfc9449-proof-nonce-enforcement?format=windsurf","agents":"/api/rules/oauth2-dpop-rfc9449-proof-nonce-enforcement?format=agents"}},{"id":"spiffe-spire-x509-svid-rotation-guardrail-spiffe-spire-eph-793","title":"SPIFFE/SPIRE Ephemeral X.509 SVID Zero-Trust Rotation Boundary","category":"security","severity":"critical","description":"Enforces short-lived mTLS X.509 SVID (SPIFFE Verifiable Identity Document) rotation via the SPIFFE Workload API with sub-hour validity windows. Strictly forbids static certificate persistence, long-lived trust bundles, or indefinite TLS context caching, ensuring fail-closed mutual authentication on SVID stream exhaustion.","antiPatternHeadline":"Static TLS Context Caching and Indefinite X.509 Lifetimes Bypassing SPIFFE Workload API Hot-Reloads","stars_count":115,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","spiffe","spire","mtls","zero-trust","x509","svid"],"exportEndpoints":{"claude":"/api/rules/spiffe-spire-x509-svid-rotation-guardrail-spiffe-spire-eph-793?format=claude","cursorMdc":"/api/rules/spiffe-spire-x509-svid-rotation-guardrail-spiffe-spire-eph-793?format=mdc","cursorrules":"/api/rules/spiffe-spire-x509-svid-rotation-guardrail-spiffe-spire-eph-793?format=cursor","windsurf":"/api/rules/spiffe-spire-x509-svid-rotation-guardrail-spiffe-spire-eph-793?format=windsurf","agents":"/api/rules/spiffe-spire-x509-svid-rotation-guardrail-spiffe-spire-eph-793?format=agents"}},{"id":"kubernetes-structured-authz-fail-closed-standard","title":"Kubernetes Structured Authorization Configuration and Fail-Closed Webhook Standard","category":"devops","severity":"critical","description":"Enforces strict fail-closed policies, granular timeout budgets, and immutable authorizer ordering within Kubernetes Structured Authorization configurations. Prevents cluster privilege escalation and silent perimeter bypasses caused by webhook timeouts, network partitions, or permissive authorizer chain fall-throughs.","antiPatternHeadline":"Permissive FailurePolicy or Missing Timeout Constraints in Kubernetes Authorization Webhook Chains","stars_count":116,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","kubernetes","security","authorization","control-plane","compliance"],"exportEndpoints":{"claude":"/api/rules/kubernetes-structured-authz-fail-closed-standard?format=claude","cursorMdc":"/api/rules/kubernetes-structured-authz-fail-closed-standard?format=mdc","cursorrules":"/api/rules/kubernetes-structured-authz-fail-closed-standard?format=cursor","windsurf":"/api/rules/kubernetes-structured-authz-fail-closed-standard?format=windsurf","agents":"/api/rules/kubernetes-structured-authz-fail-closed-standard?format=agents"}},{"id":"angular-19-defer-signal-decoupling-standard","title":"Angular 19 Signal-Based Defer Hydration Dependency Decoupling Standard","category":"frontend","severity":"critical","description":"Prevents client hydration deadlocks, circular signal evaluation cycles, and DOM layout thrashing during incremental hydration in Angular 19. Mandates strict decoupling between reactive signals driving @defer triggers (hydrate/when) and the internal signals consumed inside deferred component subtrees. Eliminates premature bundle fetching and hydration waterfalls caused by shared signal graph contamination across boundary scopes.","antiPatternHeadline":"Coupling @defer trigger conditions with internal component signal trees causing hydration deadlocks and bundle bloat","stars_count":43,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","angular","signals","hydration","performance","ssr"],"exportEndpoints":{"claude":"/api/rules/angular-19-defer-signal-decoupling-standard?format=claude","cursorMdc":"/api/rules/angular-19-defer-signal-decoupling-standard?format=mdc","cursorrules":"/api/rules/angular-19-defer-signal-decoupling-standard?format=cursor","windsurf":"/api/rules/angular-19-defer-signal-decoupling-standard?format=windsurf","agents":"/api/rules/angular-19-defer-signal-decoupling-standard?format=agents"}},{"id":"fastapi-anyio-cancellation-propagation-guardrail","title":"FastAPI AnyIO Structured Concurrency & Deterministic Cancellation Guardrail","category":"backend","severity":"critical","description":"Enforces AnyIO structured concurrency task groups and deterministic cancellation cascades across all asynchronous FastAPI endpoints. Guarantees that client disconnects immediately abort nested async I/O workloads and execute shielded cleanups without leaving orphaned database transactions or zombie worker tasks.","antiPatternHeadline":"Swallowing cancellation exceptions with broad try/except blocks and spawning unmanaged asyncio.create_task background jobs within request lifecycles.","stars_count":84,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","anyio","asyncio","structured-concurrency","python"],"exportEndpoints":{"claude":"/api/rules/fastapi-anyio-cancellation-propagation-guardrail?format=claude","cursorMdc":"/api/rules/fastapi-anyio-cancellation-propagation-guardrail?format=mdc","cursorrules":"/api/rules/fastapi-anyio-cancellation-propagation-guardrail?format=cursor","windsurf":"/api/rules/fastapi-anyio-cancellation-propagation-guardrail?format=windsurf","agents":"/api/rules/fastapi-anyio-cancellation-propagation-guardrail?format=agents"}},{"id":"postgres-17-failover-slot-sync-replication-barrier","title":"Postgres 17 Failover Slot Synchronization and Replication Barrier Guardrail","category":"backend","severity":"critical","description":"Enforces Postgres 17 logical replication slot synchronization across high-availability physical standby nodes via synchronized failover slots and synchronized replication barriers (`sync_replication_slots`). Guarantees zero message loss, eliminates duplicate message replay storms, and prevents downstream subscriber split-brain during standby promotion by blocking replication advancement past unconfirmed physical standby LSN barriers.","antiPatternHeadline":"Creating uncoordinated logical replication slots vulnerable to post-failover data loss or re-streaming duplicate message storms.","stars_count":96,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres-17","logical-replication","failover-slots","cdc","high-availability"],"exportEndpoints":{"claude":"/api/rules/postgres-17-failover-slot-sync-replication-barrier?format=claude","cursorMdc":"/api/rules/postgres-17-failover-slot-sync-replication-barrier?format=mdc","cursorrules":"/api/rules/postgres-17-failover-slot-sync-replication-barrier?format=cursor","windsurf":"/api/rules/postgres-17-failover-slot-sync-replication-barrier?format=windsurf","agents":"/api/rules/postgres-17-failover-slot-sync-replication-barrier?format=agents"}},{"id":"bun-cluster-worker-zero-loss-socket-handoff","title":"Bun 1.2 Cluster Worker Zero-Loss TCP Socket Handoff Invariant","category":"backend","severity":"critical","description":"Enforces atomic file descriptor synchronization and kernel-level socket queue draining across Bun 1.2 multi-worker lifecycles. Eliminates truncated TLS handshakes and connection resets (ECONNRESET) during continuous rolling deployments by orchestrating SO_REUSEPORT binding with phased IPC readiness and graceful listener unbinding.","antiPatternHeadline":"Uncoordinated worker termination and naive process cycling causing dropped SYN queues and truncated TLS handshakes.","stars_count":92,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","clustering","tcp-sockets","zero-downtime","tls-handoff"],"exportEndpoints":{"claude":"/api/rules/bun-cluster-worker-zero-loss-socket-handoff?format=claude","cursorMdc":"/api/rules/bun-cluster-worker-zero-loss-socket-handoff?format=mdc","cursorrules":"/api/rules/bun-cluster-worker-zero-loss-socket-handoff?format=cursor","windsurf":"/api/rules/bun-cluster-worker-zero-loss-socket-handoff?format=windsurf","agents":"/api/rules/bun-cluster-worker-zero-loss-socket-handoff?format=agents"}},{"id":"capacitor-biometric-enclave-ephemeral-nonce-production-standard","title":"Capacitor 7 Biometric Enclave Ephemeral Nonce Challenge Standard","category":"mobile","severity":"critical","description":"Enforces hardware-backed cryptographic attestation for biometric authentication flows in Capacitor 7 hybrid applications. Eliminates client-side boolean authentication vulnerabilities and credential replay attacks by requiring server-issued ephemeral nonces to be signed directly within the device Secure Enclave or Android KeyStore. Guarantees that compromised runtime environments cannot forge biometric assertions using dynamic instrumentation tools like Frida or Objection.","antiPatternHeadline":"Trusting Client-Side Boolean Biometric Prompts and Static Token Retrieval Without Enclave Nonce Signing","stars_count":116,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor7","biometrics","secure-enclave","cryptography","app-security","keystore"],"exportEndpoints":{"claude":"/api/rules/capacitor-biometric-enclave-ephemeral-nonce-production-standard?format=claude","cursorMdc":"/api/rules/capacitor-biometric-enclave-ephemeral-nonce-production-standard?format=mdc","cursorrules":"/api/rules/capacitor-biometric-enclave-ephemeral-nonce-production-standard?format=cursor","windsurf":"/api/rules/capacitor-biometric-enclave-ephemeral-nonce-production-standard?format=windsurf","agents":"/api/rules/capacitor-biometric-enclave-ephemeral-nonce-production-standard?format=agents"}},{"id":"spiffe-spire-x509-rotation-lease-floor-barrier","title":"SPIFFE/SPIRE Dynamic X.509 SVID Rotation Lease Floor and Jitter Barrier","category":"security","severity":"critical","description":"Enforces deterministic lease renewal barriers and dynamic randomized jitter algorithms for ultra-short-lived SPIFFE/SPIRE X.509 SVIDs across high-density service meshes. Prevents concurrent thundering herd renewal spikes against the SPIRE Workload API and eliminates premature connection drops during in-flight mTLS handshakes. Mandates minimum grace period lease floors so workloads retain valid cryptographic credentials until active connections fully cycle.","antiPatternHeadline":"Naive SVID Renewal on Fixed Expiration Threshold Without Lease Floor or Jitter","stars_count":83,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","spiffe","spire","mtls","zero-trust","cryptography"],"exportEndpoints":{"claude":"/api/rules/spiffe-spire-x509-rotation-lease-floor-barrier?format=claude","cursorMdc":"/api/rules/spiffe-spire-x509-rotation-lease-floor-barrier?format=mdc","cursorrules":"/api/rules/spiffe-spire-x509-rotation-lease-floor-barrier?format=cursor","windsurf":"/api/rules/spiffe-spire-x509-rotation-lease-floor-barrier?format=windsurf","agents":"/api/rules/spiffe-spire-x509-rotation-lease-floor-barrier?format=agents"}},{"id":"ebpf-xdp-stateful-ddos-quarantine-pipe","title":"eBPF XDP Line-Rate Stateful DDoS Quarantine and Pre-SKB Shedding","category":"security","severity":"critical","description":"Enforces pre-allocation packet filtering directly in the network driver RX ring buffer via eBPF XDP (eXpress Data Path). Eliminates Linux kernel socket buffer (sk_buff) allocation overhead and ksoftirqd CPU starvation under high-throughput Layer-4 amplification floods by tracking state inside LRU per-CPU maps and shedding malicious flows with XDP_DROP before kernel stack ingress.","antiPatternHeadline":"Deferring Volumetric Mitigation to Netfilter or Using Unbounded BPF Maps In Ingress Pipeline","stars_count":59,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","ebpf","xdp","ddos-mitigation","kernel","networking","c"],"exportEndpoints":{"claude":"/api/rules/ebpf-xdp-stateful-ddos-quarantine-pipe?format=claude","cursorMdc":"/api/rules/ebpf-xdp-stateful-ddos-quarantine-pipe?format=mdc","cursorrules":"/api/rules/ebpf-xdp-stateful-ddos-quarantine-pipe?format=cursor","windsurf":"/api/rules/ebpf-xdp-stateful-ddos-quarantine-pipe?format=windsurf","agents":"/api/rules/ebpf-xdp-stateful-ddos-quarantine-pipe?format=agents"}},{"id":"otel-tail-sampling-adaptive-memory-spillover-standard","title":"OpenTelemetry Collector Tail-Sampling Adaptive Memory Spillover Standard","category":"devops","severity":"critical","description":"Enforces deterministic memory safety in OpenTelemetry Collector deployments running tail-sampling processors. Prevents catastrophic OOMKilled crashes during trace volume surges by mandating upstream memory-limiter processors, bounded in-flight trace limits, and persistent disk-backed storage extensions for buffer spillover.","antiPatternHeadline":"Unbounded In-Memory Tail-Sampling Buffer Leading to Node Eviction and Collector OOMKills","stars_count":82,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","observability","tail-sampling","kubernetes","memory-management"],"exportEndpoints":{"claude":"/api/rules/otel-tail-sampling-adaptive-memory-spillover-standard?format=claude","cursorMdc":"/api/rules/otel-tail-sampling-adaptive-memory-spillover-standard?format=mdc","cursorrules":"/api/rules/otel-tail-sampling-adaptive-memory-spillover-standard?format=cursor","windsurf":"/api/rules/otel-tail-sampling-adaptive-memory-spillover-standard?format=windsurf","agents":"/api/rules/otel-tail-sampling-adaptive-memory-spillover-standard?format=agents"}},{"id":"go-arena-allocation-memory-escape-guardrail","title":"Go 1.24 Arena Allocation Memory Escape Verification Guardrail","category":"backend","severity":"critical","description":"Enforces strict lexical and lifetime scoping of Go 1.24 experiment arena allocations (GOEXPERIMENT=arenas) in ultra-low-latency gateway routing hot-paths. Prevents memory leaks, use-after-free conditions, and GC heap corruption by guaranteeing arena-allocated pointers never escape their request context or outlive arena.Free(). Requires compiler-level escape analysis verification and deep cloning for asynchronous downstream boundaries.","antiPatternHeadline":"Escaping arena-backed memory references past arena.Free() lifecycle or passing them into asynchronous goroutines","stars_count":98,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","arenas","memory-management","zero-alloc","latency"],"exportEndpoints":{"claude":"/api/rules/go-arena-allocation-memory-escape-guardrail?format=claude","cursorMdc":"/api/rules/go-arena-allocation-memory-escape-guardrail?format=mdc","cursorrules":"/api/rules/go-arena-allocation-memory-escape-guardrail?format=cursor","windsurf":"/api/rules/go-arena-allocation-memory-escape-guardrail?format=windsurf","agents":"/api/rules/go-arena-allocation-memory-escape-guardrail?format=agents"}},{"id":"react-19-use-optimistic-error-convergence","title":"React 19 useOptimistic Mutation Error State Convergence Invariant","category":"frontend","severity":"critical","description":"Enforces deterministic state reconciliation between optimistic UI branches and server rejection states in React 19. Guarantees that optimistic mutations strictly derive from authoritative base states inside React Transitions to eliminate phantom client states during network failures, retries, and race conditions.","antiPatternHeadline":"Detached Optimistic Mutation with Unsynchronized Error Rollback and Phantom State Drift","stars_count":46,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","useOptimistic","server-actions","concurrency","state-reconciliation"],"exportEndpoints":{"claude":"/api/rules/react-19-use-optimistic-error-convergence?format=claude","cursorMdc":"/api/rules/react-19-use-optimistic-error-convergence?format=mdc","cursorrules":"/api/rules/react-19-use-optimistic-error-convergence?format=cursor","windsurf":"/api/rules/react-19-use-optimistic-error-convergence?format=windsurf","agents":"/api/rules/react-19-use-optimistic-error-convergence?format=agents"}},{"id":"tauri-v2-mobile-ipc-zero-copy-buffer-isolation","title":"Tauri 2.0 Mobile IPC ArrayBuffer Isolation and Zero-Copy Binary Framing","category":"mobile","severity":"critical","description":"Enforces memory isolation, strict framing invariants, and zero-copy binary streaming between the Tauri 2.0 Rust runtime and mobile WebViews (WKWebView/Android WebView). Prevents base64 JSON serialization overhead, OOM crashes from uncontrolled buffer allocation, and detached buffer panics during high-throughput binary IPC.","antiPatternHeadline":"Serializing Raw Binary Payloads via Base64 JSON Strings or Mutating In-Flight ArrayBuffers","stars_count":111,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri-2","ipc","arraybuffer","zero-copy","memory-isolation","rust"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-mobile-ipc-zero-copy-buffer-isolation?format=claude","cursorMdc":"/api/rules/tauri-v2-mobile-ipc-zero-copy-buffer-isolation?format=mdc","cursorrules":"/api/rules/tauri-v2-mobile-ipc-zero-copy-buffer-isolation?format=cursor","windsurf":"/api/rules/tauri-v2-mobile-ipc-zero-copy-buffer-isolation?format=windsurf","agents":"/api/rules/tauri-v2-mobile-ipc-zero-copy-buffer-isolation?format=agents"}},{"id":"axum-0-8-tokio-hierarchical-cancellation-token-drain-guardrail","title":"Axum 0.8 Tokio Hierarchical CancellationToken Drain Guardrail","category":"backend","severity":"critical","description":"Enforces strict parent-child CancellationToken hierarchies across Axum 0.8 Tower middleware pipelines and streaming handlers. Prevents orphaned background tasks, zombie streaming connections (SSE/WebSockets), and unbounded graceful shutdown delays by binding request life-cycles to Tokio TaskTrackers and scoped child tokens.","antiPatternHeadline":"Spawning Detached Tokio Tasks or Unbounded Stream Pollers Without Child Cancellation Tokens Tied to Server Shutdown Hooks","stars_count":65,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tokio","concurrency","tower"],"exportEndpoints":{"claude":"/api/rules/axum-0-8-tokio-hierarchical-cancellation-token-drain-guardrail?format=claude","cursorMdc":"/api/rules/axum-0-8-tokio-hierarchical-cancellation-token-drain-guardrail?format=mdc","cursorrules":"/api/rules/axum-0-8-tokio-hierarchical-cancellation-token-drain-guardrail?format=cursor","windsurf":"/api/rules/axum-0-8-tokio-hierarchical-cancellation-token-drain-guardrail?format=windsurf","agents":"/api/rules/axum-0-8-tokio-hierarchical-cancellation-token-drain-guardrail?format=agents"}},{"id":"webauthn-l3-client-data-origin-binding-invariant","title":"WebAuthn Level 3 ClientDataJSON Origin Binding & Related Origin Validation","category":"security","severity":"critical","description":"Enforces strict canonical origin binding verification on deserialized WebAuthn Level 3 clientDataJSON payloads in federated multi-tenant edge architectures. Precludes sub-origin relay, cross-tenant impersonation, and conditional UI credential leakage by enforcing strict exact-match origin validation, scheme/port verification, and Related Origin Requests (ROR) explicit allowlisting across reverse-proxy layers.","antiPatternHeadline":"Lax or Regex-Based Origin Validation Allowing Subdomain Traversal and Cross-Tenant Credential Relay","stars_count":102,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","fido2","passkeys","authentication","edge-computing"],"exportEndpoints":{"claude":"/api/rules/webauthn-l3-client-data-origin-binding-invariant?format=claude","cursorMdc":"/api/rules/webauthn-l3-client-data-origin-binding-invariant?format=mdc","cursorrules":"/api/rules/webauthn-l3-client-data-origin-binding-invariant?format=cursor","windsurf":"/api/rules/webauthn-l3-client-data-origin-binding-invariant?format=windsurf","agents":"/api/rules/webauthn-l3-client-data-origin-binding-invariant?format=agents"}},{"id":"capacitor-7-jsi-bridge-retention-guardrail","title":"Capacitor 7 Native Bridge JSI Reference Retention & Listener Teardown Guardrail","category":"mobile","severity":"critical","description":"Enforces strict lifecycle management and explicit teardown of native plugin event listeners across Capacitor 7 native bridges. Prevents cross-runtime heap memory leaks in Android (V8) and iOS (JavaScriptCore) caused by circular retained references across JSI bridging boundaries.","antiPatternHeadline":"Dangling PluginListenerHandle References Retaining Native-to-JS Bridge Callbacks Across Component Lifecycles","stars_count":81,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["capacitor","ios","android","memory-leak","jsi","lifecycle"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-jsi-bridge-retention-guardrail?format=claude","cursorMdc":"/api/rules/capacitor-7-jsi-bridge-retention-guardrail?format=mdc","cursorrules":"/api/rules/capacitor-7-jsi-bridge-retention-guardrail?format=cursor","windsurf":"/api/rules/capacitor-7-jsi-bridge-retention-guardrail?format=windsurf","agents":"/api/rules/capacitor-7-jsi-bridge-retention-guardrail?format=agents"}},{"id":"openfga-cache-consistency-toctou-guardrail","title":"OpenFGA Distributed Cache Invalidation and Consistency Invariant","category":"security","severity":"critical","description":"Enforces synchronous distributed edge cache invalidation and explicit consistency levels during OpenFGA tuple mutations. Prevents authorization Time-of-Check to Time-of-Use (TOCTOU) race conditions where revoked access privileges persist in distributed edge caches or stale Zanzibar read replicas.","antiPatternHeadline":"Fire-and-forget cache eviction and weak-consistency checks following OpenFGA tuple revocations","stars_count":107,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","authorization","distributed-cache","toctou","zanzibar","redis"],"exportEndpoints":{"claude":"/api/rules/openfga-cache-consistency-toctou-guardrail?format=claude","cursorMdc":"/api/rules/openfga-cache-consistency-toctou-guardrail?format=mdc","cursorrules":"/api/rules/openfga-cache-consistency-toctou-guardrail?format=cursor","windsurf":"/api/rules/openfga-cache-consistency-toctou-guardrail?format=windsurf","agents":"/api/rules/openfga-cache-consistency-toctou-guardrail?format=agents"}},{"id":"ebpf-tc-ringbuf-drain-drop-telemetry-standard","title":"eBPF TC Ingress RingBuffer Memory Drain & Drop Telemetry Standard","category":"devops","severity":"critical","description":"Enforces deterministic memory allocation, power-of-two page-aligned ring buffer sizing, and non-blocking backpressure metrics for eBPF Traffic Control (TC) ingress filters. Guarantees zero silent drop under high-volume L7 DDoS amplification through explicit user-space draining SLAs and per-CPU drop telemetry export.","antiPatternHeadline":"Unbounded or Undersized BPF Ring Buffers with Silent Drops and Missing Drop Counters Under Ingress Spikes","stars_count":49,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","networking","kernel","telemetry","ddos-defense"],"exportEndpoints":{"claude":"/api/rules/ebpf-tc-ringbuf-drain-drop-telemetry-standard?format=claude","cursorMdc":"/api/rules/ebpf-tc-ringbuf-drain-drop-telemetry-standard?format=mdc","cursorrules":"/api/rules/ebpf-tc-ringbuf-drain-drop-telemetry-standard?format=cursor","windsurf":"/api/rules/ebpf-tc-ringbuf-drain-drop-telemetry-standard?format=windsurf","agents":"/api/rules/ebpf-tc-ringbuf-drain-drop-telemetry-standard?format=agents"}},{"id":"kmp-swift-concurrency-cancellation-bridge-guardrail-kmp-swift-concur-498","title":"KMP Swift Concurrency Cancellation Bridge & Thread Leak Invariant","category":"mobile","severity":"critical","description":"Enforces deterministic, bidirectional cancellation bridging between Kotlin Coroutines (Job) and Swift Structured Concurrency (Task/TaskGroup). Eliminates Darwin dispatch thread pool exhaustion and orphaned continuation memory leaks across the Kotlin/Native Objective-C interop boundary.","antiPatternHeadline":"Dangling Swift CheckedContinuation Leaking Darwin Threads on Unbridged Kotlin Coroutine Cancellation","stars_count":49,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kmp","kotlin-native","swift-concurrency","coroutines","thread-safety"],"exportEndpoints":{"claude":"/api/rules/kmp-swift-concurrency-cancellation-bridge-guardrail-kmp-swift-concur-498?format=claude","cursorMdc":"/api/rules/kmp-swift-concurrency-cancellation-bridge-guardrail-kmp-swift-concur-498?format=mdc","cursorrules":"/api/rules/kmp-swift-concurrency-cancellation-bridge-guardrail-kmp-swift-concur-498?format=cursor","windsurf":"/api/rules/kmp-swift-concurrency-cancellation-bridge-guardrail-kmp-swift-concur-498?format=windsurf","agents":"/api/rules/kmp-swift-concurrency-cancellation-bridge-guardrail-kmp-swift-concur-498?format=agents"}},{"id":"envoy-gateway-quic-stateless-reset-migration","title":"Envoy Gateway HTTP/3 QUIC Stateless Reset Token & Session Migration Invariant","category":"devops","severity":"critical","description":"Enforces deterministic, cryptographically shared QUIC stateless reset tokens and active connection migration routing across distributed Envoy ingress deployments. Prevents silent session termination, 4-way handshake restarts, and blackholed UDP packets when mobile clients transition across cellular and Wi-Fi networks.","antiPatternHeadline":"Ephemerally Seeded Stateless Reset Tokens and Uncoordinated QUIC Connection ID Routing","stars_count":111,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","envoy-gateway","http3","quic","session-migration","kubernetes"],"exportEndpoints":{"claude":"/api/rules/envoy-gateway-quic-stateless-reset-migration?format=claude","cursorMdc":"/api/rules/envoy-gateway-quic-stateless-reset-migration?format=mdc","cursorrules":"/api/rules/envoy-gateway-quic-stateless-reset-migration?format=cursor","windsurf":"/api/rules/envoy-gateway-quic-stateless-reset-migration?format=windsurf","agents":"/api/rules/envoy-gateway-quic-stateless-reset-migration?format=agents"}},{"id":"svelte-5-runes-ssr-boundary-isolation-standard","title":"Svelte 5 Runes SSR Boundary and Cross-Request Memory Isolation Guardrail","category":"frontend","severity":"critical","description":"Mandates deterministic request isolation in Svelte 5 applications by strictly forbidding module-scoped mutable rune state in SSR runtime environments. Enforces per-request context providers and factory-instantiated state boundaries to eliminate cross-request state pollution and race conditions during high-concurrency Node.js and Bun SSR hydration.","antiPatternHeadline":"Module-Level $state() Singletons Leaking User Sessions Across Concurrent SSR Requests","stars_count":69,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","ssr","memory-isolation","concurrency"],"exportEndpoints":{"claude":"/api/rules/svelte-5-runes-ssr-boundary-isolation-standard?format=claude","cursorMdc":"/api/rules/svelte-5-runes-ssr-boundary-isolation-standard?format=mdc","cursorrules":"/api/rules/svelte-5-runes-ssr-boundary-isolation-standard?format=cursor","windsurf":"/api/rules/svelte-5-runes-ssr-boundary-isolation-standard?format=windsurf","agents":"/api/rules/svelte-5-runes-ssr-boundary-isolation-standard?format=agents"}},{"id":"react-19-use-action-state-optimistic-reconciliation-guardrail","title":"React 19 useActionState Optimistic UI Reconciliation and State Tearing Shield","category":"frontend","severity":"critical","description":"Guarantees strict transactional consistency between useActionState and useOptimistic across concurrent asynchronous transitions. Prevents state tearing, phantom rollbacks, and race-condition regressions caused by out-of-order network resolutions via monotonically increasing transition sequencing and deterministic server state reconciliation.","antiPatternHeadline":"Interleaving Async Transitions Overwriting Fresh Optimistic State with Out-of-Order Stale Action Snapshots","stars_count":53,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","useActionState","useOptimistic","concurrency","state-tearing"],"exportEndpoints":{"claude":"/api/rules/react-19-use-action-state-optimistic-reconciliation-guardrail?format=claude","cursorMdc":"/api/rules/react-19-use-action-state-optimistic-reconciliation-guardrail?format=mdc","cursorrules":"/api/rules/react-19-use-action-state-optimistic-reconciliation-guardrail?format=cursor","windsurf":"/api/rules/react-19-use-action-state-optimistic-reconciliation-guardrail?format=windsurf","agents":"/api/rules/react-19-use-action-state-optimistic-reconciliation-guardrail?format=agents"}},{"id":"axum-cancellation-token-downstream-abort-propagation","title":"Axum 0.8 Cooperative Task Cancellation and Downstream Abort Propagation","category":"backend","severity":"critical","description":"Enforces deterministic cancellation token propagation and drop semantics across Axum 0.8 and Tower service stacks. Guarantees that TCP socket disconnects and downstream HTTP aborts immediately terminate in-flight database queries, external RPCs, and asynchronous worker tasks to prevent unmetered compute drain and resource pool exhaustion.","antiPatternHeadline":"Detached Background Spawning and Ignored Future Drops Inducing Phantom Compute and Connection Leaks","stars_count":81,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tokio","tower","concurrency","sqlx"],"exportEndpoints":{"claude":"/api/rules/axum-cancellation-token-downstream-abort-propagation?format=claude","cursorMdc":"/api/rules/axum-cancellation-token-downstream-abort-propagation?format=mdc","cursorrules":"/api/rules/axum-cancellation-token-downstream-abort-propagation?format=cursor","windsurf":"/api/rules/axum-cancellation-token-downstream-abort-propagation?format=windsurf","agents":"/api/rules/axum-cancellation-token-downstream-abort-propagation?format=agents"}},{"id":"bun-multiworker-prepared-statement-coherence-standard","title":"Bun 1.2 Multi-Worker Prepared Statement Cache Coherence Standard","category":"backend","severity":"critical","description":"Enforces strict lifecycle management, bounded caching, and cross-thread schema invalidation for prepared statements within Bun 1.2 multi-threaded worker pools. Prevents off-heap memory fragmentation, unbounded native statement allocations, and stale plan execution against distributed database replicas following dynamic schema alterations or failovers.","antiPatternHeadline":"Global Unbounded Statement Caching and Desynchronized Prepared Plans Across Isolated Bun Worker Threads","stars_count":116,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","bun-sql","sqlite","workers","concurrency","memory-management"],"exportEndpoints":{"claude":"/api/rules/bun-multiworker-prepared-statement-coherence-standard?format=claude","cursorMdc":"/api/rules/bun-multiworker-prepared-statement-coherence-standard?format=mdc","cursorrules":"/api/rules/bun-multiworker-prepared-statement-coherence-standard?format=cursor","windsurf":"/api/rules/bun-multiworker-prepared-statement-coherence-standard?format=windsurf","agents":"/api/rules/bun-multiworker-prepared-statement-coherence-standard?format=agents"}},{"id":"tauri-v2-scoped-ipc-capability-acl-origin-sandboxing","title":"Tauri 2.0 Scoped IPC Capability ACL and Origin Sandboxing Invariant","category":"mobile","severity":"critical","description":"Enforces strict origin-bound Access Control List (ACL) manifests and capability isolation in Tauri 2.0 mobile and desktop runtimes. Prohibits wildcard command permissions and unrestricted remote URL IPC invocation to prevent Arbitrary Code Execution (ACE) via webview compromised contexts or cross-origin script injection.","antiPatternHeadline":"Wildcard Capability Mapping and Unsandboxed Remote Origin IPC Invocation","stars_count":117,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri","rust","security","ipc","sandboxing"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-scoped-ipc-capability-acl-origin-sandboxing?format=claude","cursorMdc":"/api/rules/tauri-v2-scoped-ipc-capability-acl-origin-sandboxing?format=mdc","cursorrules":"/api/rules/tauri-v2-scoped-ipc-capability-acl-origin-sandboxing?format=cursor","windsurf":"/api/rules/tauri-v2-scoped-ipc-capability-acl-origin-sandboxing?format=windsurf","agents":"/api/rules/tauri-v2-scoped-ipc-capability-acl-origin-sandboxing?format=agents"}},{"id":"capacitor-7-wkwebview-state-persistence-memory-trim","title":"Capacitor 7 WKWebView Process Eviction State Persistence and Memory Trim Standard","category":"mobile","severity":"critical","description":"Enforces deterministic state serialization and memory trimming invariants for hybrid Capacitor 7 applications facing aggressive OS thermal throttling or iOS Jetsam process termination. Prevents silent WKWebView content process drops from causing catastrophic user data loss by binding native lifecycle events to resilient, schema-validated storage snapshots and proactive cache deallocation.","antiPatternHeadline":"Relying on In-Memory State and Window Lifecycle Events Under Aggressive Mobile OS WebProcess Termination","stars_count":58,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","ios","wkwebview","jetsam","state-persistence","memory-trim"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-wkwebview-state-persistence-memory-trim?format=claude","cursorMdc":"/api/rules/capacitor-7-wkwebview-state-persistence-memory-trim?format=mdc","cursorrules":"/api/rules/capacitor-7-wkwebview-state-persistence-memory-trim?format=cursor","windsurf":"/api/rules/capacitor-7-wkwebview-state-persistence-memory-trim?format=windsurf","agents":"/api/rules/capacitor-7-wkwebview-state-persistence-memory-trim?format=agents"}},{"id":"openfga-rebac-graph-cycle-depth-guardrail","title":"OpenFGA Graph Cycle and Query Depth Boundary Standard","category":"security","severity":"critical","description":"Mandates deterministic traversal depth ceilings, memoized path-cycle detection, and strict schema-level relation constraints across OpenFGA Zanzibar evaluations. Prevents adversarial tuple loop injection, recursive expansion cascades, and thread exhaustion across distributed authorization engines.","antiPatternHeadline":"Unbounded Graph Expansion and DoS via Cyclic ReBAC Tuples and Unconstrained Traversal Depth","stars_count":102,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","rebac","authorization","zanzibar","dos-prevention","graph-algorithms"],"exportEndpoints":{"claude":"/api/rules/openfga-rebac-graph-cycle-depth-guardrail?format=claude","cursorMdc":"/api/rules/openfga-rebac-graph-cycle-depth-guardrail?format=mdc","cursorrules":"/api/rules/openfga-rebac-graph-cycle-depth-guardrail?format=cursor","windsurf":"/api/rules/openfga-rebac-graph-cycle-depth-guardrail?format=windsurf","agents":"/api/rules/openfga-rebac-graph-cycle-depth-guardrail?format=agents"}},{"id":"pqc-hybrid-mlkem-x25519-ingress-invariant","title":"Mandatory Hybrid ML-KEM-768/X25519 Key Encapsulation on Edge Ingress","category":"security","severity":"critical","description":"Enforces a strict cryptographic invariant requiring all public edge ingress points and reverse proxies to mandate hybrid ML-KEM-768/X25519 (X25519MLKEM768) TLS 1.3 key exchange groups. This mitigates 'harvest-now-decrypt-later' (HNDL) quantum threats against high-value transactional flows by terminating legacy non-hybrid handshakes unconditionally on sensitive ingress pathways.","antiPatternHeadline":"Permitting Pure Classical TLS Key Exchange (ECDHE/RSA) on High-Value Ingress","stars_count":116,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","post-quantum-cryptography","ml-kem","x25519","tls13","ingress","hndl"],"exportEndpoints":{"claude":"/api/rules/pqc-hybrid-mlkem-x25519-ingress-invariant?format=claude","cursorMdc":"/api/rules/pqc-hybrid-mlkem-x25519-ingress-invariant?format=mdc","cursorrules":"/api/rules/pqc-hybrid-mlkem-x25519-ingress-invariant?format=cursor","windsurf":"/api/rules/pqc-hybrid-mlkem-x25519-ingress-invariant?format=windsurf","agents":"/api/rules/pqc-hybrid-mlkem-x25519-ingress-invariant?format=agents"}},{"id":"otel-baggage-pii-stripping-bloom-fencing-standard","title":"OpenTelemetry W3C Baggage PII Stripping and Header Bloom Fencing Standard","category":"devops","severity":"critical","description":"Enforces deterministic redaction of regulated personally identifiable information (PII) and strict byte-budget fencing on OpenTelemetry W3C baggage prior to egress serialization. Prevents upstream cascading memory bloat, HTTP 431 header overflow failures, and GDPR/HIPAA compliance violations across distributed perimeter boundaries.","antiPatternHeadline":"Unbounded PII Propagation and Giant Header Bloat in Distributed Trace Baggage","stars_count":110,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","distributed-tracing","pii-compliance","security","w3c-baggage"],"exportEndpoints":{"claude":"/api/rules/otel-baggage-pii-stripping-bloom-fencing-standard?format=claude","cursorMdc":"/api/rules/otel-baggage-pii-stripping-bloom-fencing-standard?format=mdc","cursorrules":"/api/rules/otel-baggage-pii-stripping-bloom-fencing-standard?format=cursor","windsurf":"/api/rules/otel-baggage-pii-stripping-bloom-fencing-standard?format=windsurf","agents":"/api/rules/otel-baggage-pii-stripping-bloom-fencing-standard?format=agents"}},{"id":"k8s-dra-vgpu-structured-parameter-fence","title":"Kubernetes Dynamic Resource Allocation (DRA) vGPU Structured Parameter Fence","category":"devops","severity":"critical","description":"Enforces vendor-agnostic fractional hardware acceleration partitioning via Kubernetes Dynamic Resource Allocation (DRA) structured parameters and ResourceClaimTemplates. Prevents multi-tenant GPU memory thrashing, unisolated VRAM leaks, and cold-start scheduling starvation by replacing opaque extended resources with deterministic Common Expression Language (CEL) device selectors and strict memory fencing.","antiPatternHeadline":"Opaque Extended Resource Allocation without Hardware Partitioning and Memory Fences","stars_count":116,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["kubernetes","dra","gpu","vgpu","devops","inference","multi-tenancy"],"exportEndpoints":{"claude":"/api/rules/k8s-dra-vgpu-structured-parameter-fence?format=claude","cursorMdc":"/api/rules/k8s-dra-vgpu-structured-parameter-fence?format=mdc","cursorrules":"/api/rules/k8s-dra-vgpu-structured-parameter-fence?format=cursor","windsurf":"/api/rules/k8s-dra-vgpu-structured-parameter-fence?format=windsurf","agents":"/api/rules/k8s-dra-vgpu-structured-parameter-fence?format=agents"}},{"id":"svelte-5-signal-teardown-boundary-invariant","title":"Svelte 5 Runes Signal Graph Boundary Teardown and Memory Isolation","category":"frontend","severity":"critical","description":"Mandates deterministic signal graph isolation and explicit $effect.root lifecycle containment for non-component reactive states across micro-frontend (MFE) boundaries. Prevents detached signal nodes, circular subscriber retention, and memory leaks caused by unbounded runes instantiations across independent host and remote runtime contexts.","antiPatternHeadline":"Unbounded Signal Graph Instantiation Across Isolated Host-Remote Lifecycle Boundaries","stars_count":103,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["svelte5","runes","signals","micro-frontends","memory-leaks","reactivity"],"exportEndpoints":{"claude":"/api/rules/svelte-5-signal-teardown-boundary-invariant?format=claude","cursorMdc":"/api/rules/svelte-5-signal-teardown-boundary-invariant?format=mdc","cursorrules":"/api/rules/svelte-5-signal-teardown-boundary-invariant?format=cursor","windsurf":"/api/rules/svelte-5-signal-teardown-boundary-invariant?format=windsurf","agents":"/api/rules/svelte-5-signal-teardown-boundary-invariant?format=agents"}},{"id":"nextjs-15-ppr-dynamic-io-leakage-guardrail","title":"Next.js 15 Partial Prerendering Dynamic I/O Leakage Guardrail","category":"frontend","severity":"critical","description":"Enforces strict isolation between static pre-rendered CDN shells and dynamic request-time boundaries under Next.js 15 Partial Prerendering (PPR) and Dynamic I/O. Prevents silent inclusion of personalized data into shared cache artifacts by requiring runtime storage access (headers, cookies, searchParams, uncached I/O) to be contained within explicit Suspense boundaries and async dynamic contracts.","antiPatternHeadline":"Leaking Request-Scoped State into Static Prerendered Shells via Unbounded Dynamic Access","stars_count":103,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs-15","react-server-components","partial-prerendering","dynamic-io","caching","security"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-ppr-dynamic-io-leakage-guardrail?format=claude","cursorMdc":"/api/rules/nextjs-15-ppr-dynamic-io-leakage-guardrail?format=mdc","cursorrules":"/api/rules/nextjs-15-ppr-dynamic-io-leakage-guardrail?format=cursor","windsurf":"/api/rules/nextjs-15-ppr-dynamic-io-leakage-guardrail?format=windsurf","agents":"/api/rules/nextjs-15-ppr-dynamic-io-leakage-guardrail?format=agents"}},{"id":"postgres-17-failover-slot-sync-guardrail","title":"Postgres 17 Logical Replication Slot Synchronization and Outbox Consumer Guardrail","category":"backend","severity":"critical","description":"Enforces failover-safe logical replication slot synchronization introduced in PostgreSQL 17 to prevent message re-ingestion, double processing, and consumer drift across High Availability (HA) switchovers. Mandates `failover = true` on logical slots, configuration of `synchronized_standby_slots` on the primary, and explicit LSN confirmation barriers before publishing outbox payloads.","antiPatternHeadline":"Unsynchronized Logical Slots Causing Replay Storms and Duplicate Outbox Events Post-HA Failover","stars_count":54,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres","distributed-systems","high-availability","outbox-pattern","replication"],"exportEndpoints":{"claude":"/api/rules/postgres-17-failover-slot-sync-guardrail?format=claude","cursorMdc":"/api/rules/postgres-17-failover-slot-sync-guardrail?format=mdc","cursorrules":"/api/rules/postgres-17-failover-slot-sync-guardrail?format=cursor","windsurf":"/api/rules/postgres-17-failover-slot-sync-guardrail?format=windsurf","agents":"/api/rules/postgres-17-failover-slot-sync-guardrail?format=agents"}},{"id":"openfga-zanzibar-consistency-token-propagation-barrier","title":"OpenFGA Consistency Token Propagation Barrier for Distributed Edge Mutation Guardrails","category":"security","severity":"critical","description":"Enforces strict read-after-write authorization consistency across distributed edge microservices interacting with OpenFGA or Google Zanzibar implementations. Mandates extracting, validating, and propagating the `consistency_token` (Zookiez/continuation token) across asynchronous message buses and edge boundaries before executing state mutations or subsequent access evaluations. Prevents the New Enemy Problem and stale authorization cache vulnerabilities in multi-region deployments.","antiPatternHeadline":"Executing edge mutations or checks using eventually consistent OpenFGA reads without propagated snapshot consistency tokens","stars_count":81,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","zanzibar","authorization","distributed-systems","consistency-token"],"exportEndpoints":{"claude":"/api/rules/openfga-zanzibar-consistency-token-propagation-barrier?format=claude","cursorMdc":"/api/rules/openfga-zanzibar-consistency-token-propagation-barrier?format=mdc","cursorrules":"/api/rules/openfga-zanzibar-consistency-token-propagation-barrier?format=cursor","windsurf":"/api/rules/openfga-zanzibar-consistency-token-propagation-barrier?format=windsurf","agents":"/api/rules/openfga-zanzibar-consistency-token-propagation-barrier?format=agents"}},{"id":"tauri-v2-ipc-capability-scoping-standard-tauri-2-0-multi--646","title":"Tauri 2.0 Multi-Process IPC Capability Scoping and Window Isolation Standard","category":"mobile","severity":"critical","description":"Enforces strict multi-process boundary security in Tauri 2.0 mobile architectures by binding IPC command executions exclusively to isolated window capability manifests. Prevents privilege escalation across decoupled webview runtimes by disallowing wildcard permission sets and mandating cryptographic context validation per webview label.","antiPatternHeadline":"Global IPC Bridge Access Permitting Cross-Webview Privilege Escalation via Shared Capabilities","stars_count":81,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri-2","ipc-security","capabilities","rust","webview-isolation"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-ipc-capability-scoping-standard-tauri-2-0-multi--646?format=claude","cursorMdc":"/api/rules/tauri-v2-ipc-capability-scoping-standard-tauri-2-0-multi--646?format=mdc","cursorrules":"/api/rules/tauri-v2-ipc-capability-scoping-standard-tauri-2-0-multi--646?format=cursor","windsurf":"/api/rules/tauri-v2-ipc-capability-scoping-standard-tauri-2-0-multi--646?format=windsurf","agents":"/api/rules/tauri-v2-ipc-capability-scoping-standard-tauri-2-0-multi--646?format=agents"}},{"id":"webauthn-hardware-device-bound-attestation-barrier","title":"Hardware-Backed Device-Bound Passkey Attestation Enforcement for Zero-Trust Boundaries","category":"security","severity":"critical","description":"Enforces direct hardware-backed attestation and strict inspection of AuthenticatorData flags during WebAuthn credential registration. Prevents cloud-synchronized credentials (iCloud Keychain, Google Password Manager) from accessing zero-trust administrative perimeters by verifying physical device-bound roots of trust against certified FIDO Metadata Service (MDS3) roots.","antiPatternHeadline":"Permitting Synced Multi-Device Passkeys (None Attestation / Unchecked Backup Flags) in Privileged Zero-Trust Workflows","stars_count":48,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","fido2","passkeys","zero-trust","attestation","fips-140"],"exportEndpoints":{"claude":"/api/rules/webauthn-hardware-device-bound-attestation-barrier?format=claude","cursorMdc":"/api/rules/webauthn-hardware-device-bound-attestation-barrier?format=mdc","cursorrules":"/api/rules/webauthn-hardware-device-bound-attestation-barrier?format=cursor","windsurf":"/api/rules/webauthn-hardware-device-bound-attestation-barrier?format=windsurf","agents":"/api/rules/webauthn-hardware-device-bound-attestation-barrier?format=agents"}},{"id":"otel-ebpf-tc-context-injection-standard","title":"OpenTelemetry eBPF Kernel-Bypassed Distributed Context Injection Standard","category":"devops","severity":"critical","description":"Enforces deterministic, non-intrusive W3C tracecontext and baggage propagation across legacy sidecars, kernel sockops, and tc/XDP egress hops without modifying user-space runtimes. Mandates strict BPF ring-buffer correlation, packet header expansion bounds, and seamless fallback handling when bypassing kernel network layers. Prevents distributed trace fragmentation caused by iptables/netfilter loops and socket redirection layers.","antiPatternHeadline":"Fragmenting Distributed Traces via User-Space Header Stripping or Unchecked Egress TC Packet Inflation","stars_count":74,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","opentelemetry","tracing","observability","linux-kernel","xdp"],"exportEndpoints":{"claude":"/api/rules/otel-ebpf-tc-context-injection-standard?format=claude","cursorMdc":"/api/rules/otel-ebpf-tc-context-injection-standard?format=mdc","cursorrules":"/api/rules/otel-ebpf-tc-context-injection-standard?format=cursor","windsurf":"/api/rules/otel-ebpf-tc-context-injection-standard?format=windsurf","agents":"/api/rules/otel-ebpf-tc-context-injection-standard?format=agents"}},{"id":"wasi-02-component-model-capability-virtualization","title":"WASI 0.2 Component Model Capability Virtualization and Isolation Standard","category":"devops","severity":"critical","description":"Multi-tenant WebAssembly serverless hosts must strictly enforce capability-based security using WASI 0.2 (`wasi:cli`, `wasi:filesystem`, `wasi:sockets`, `wasi:http`) virtualization without ambient host access. Host runtimes must construct ephemeral, capability-attenuated resource tables per execution, coupled with epoch-based interruption and memory growth limits, guaranteeing sub-millisecond cold starts alongside verifiable tenant isolation.","antiPatternHeadline":"Ambient Authority Inheritance and Unbounded Store Execution in WASI 0.2 Multi-Tenant Runtimes","stars_count":79,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","wasi","wasm","component-model","serverless","security","wasmtime"],"exportEndpoints":{"claude":"/api/rules/wasi-02-component-model-capability-virtualization?format=claude","cursorMdc":"/api/rules/wasi-02-component-model-capability-virtualization?format=mdc","cursorrules":"/api/rules/wasi-02-component-model-capability-virtualization?format=cursor","windsurf":"/api/rules/wasi-02-component-model-capability-virtualization?format=windsurf","agents":"/api/rules/wasi-02-component-model-capability-virtualization?format=agents"}},{"id":"svelte-5-untrack-effect-boundary-standard","title":"Svelte 5 Runes: Explicit Untrack Boundaries in Reactive Effects","category":"frontend","severity":"critical","description":"Enforces strict dependency isolation within Svelte 5 reactive effects by requiring explicit untrack boundaries for non-triggering state reads. In Svelte 5, $effect synchronously tracks all fine-grained signals accessed during execution, predisposing systems to catastrophic re-trigger cascades and cyclic graph thrashing if passive reads are left unbounded. Wrapping ambient reads, logging metadata, and external callbacks in untrack() ensures effects trigger deterministically only on explicit, intentional dependency shifts.","antiPatternHeadline":"Implicit Dependency Leakage and Cyclic Loop Explosions via Unbounded Signal Reads inside $effect","stars_count":63,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","reactivity","signals","performance"],"exportEndpoints":{"claude":"/api/rules/svelte-5-untrack-effect-boundary-standard?format=claude","cursorMdc":"/api/rules/svelte-5-untrack-effect-boundary-standard?format=mdc","cursorrules":"/api/rules/svelte-5-untrack-effect-boundary-standard?format=cursor","windsurf":"/api/rules/svelte-5-untrack-effect-boundary-standard?format=windsurf","agents":"/api/rules/svelte-5-untrack-effect-boundary-standard?format=agents"}},{"id":"vite-6-environment-api-isolated-runtime-boundary","title":"Strict Isolation of Client, Server, and Edge Runtime Environments in Vite 6","category":"frontend","severity":"critical","description":"Enforces strict runtime module isolation using the Vite 6 Environment API across client, SSR node, and edge runtimes. Prevents cross-environment module graph leakage, prototype pollution, and execution of server secrets in client bundles during development HMR and production compilation.","antiPatternHeadline":"Cross-Environment Module Graph Leakage and Unbound Shared State via Legacy ssrLoadModule","stars_count":60,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","vite-6","environment-api","ssr","runtime-isolation","hmr"],"exportEndpoints":{"claude":"/api/rules/vite-6-environment-api-isolated-runtime-boundary?format=claude","cursorMdc":"/api/rules/vite-6-environment-api-isolated-runtime-boundary?format=mdc","cursorrules":"/api/rules/vite-6-environment-api-isolated-runtime-boundary?format=cursor","windsurf":"/api/rules/vite-6-environment-api-isolated-runtime-boundary?format=windsurf","agents":"/api/rules/vite-6-environment-api-isolated-runtime-boundary?format=agents"}},{"id":"nextjs-15-after-background-quota-guardrail","title":"Next.js 15 after() Background Execution Quota and Telemetry Guardrail","category":"backend","severity":"critical","description":"Enforces strict timeout envelopes, error isolation, and telemetry boundaries on Next.js 15 after() callbacks in serverless runtimes. Mitigates silent worker termination, resource leakage, and runtime budget exhaustion by bounding execution and offloading oversized tasks to message queues.","antiPatternHeadline":"Unbounded Fire-and-Forget after() Callbacks Inducing Silent Lambda Freezes and Memory Eviction","stars_count":43,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","nextjs-15","after","serverless","telemetry","observability"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-after-background-quota-guardrail?format=claude","cursorMdc":"/api/rules/nextjs-15-after-background-quota-guardrail?format=mdc","cursorrules":"/api/rules/nextjs-15-after-background-quota-guardrail?format=cursor","windsurf":"/api/rules/nextjs-15-after-background-quota-guardrail?format=windsurf","agents":"/api/rules/nextjs-15-after-background-quota-guardrail?format=agents"}},{"id":"postgres-17-async-io-direct-buffer-alignment","title":"PostgreSQL 17 Async Streaming I/O Direct Buffer Page Alignment","category":"backend","severity":"critical","description":"Mandates strict kernel-level page and sector memory alignment (minimum 4096-byte boundaries) for all memory buffers used in PostgreSQL 17 asynchronous streaming read pipelines and direct I/O operations. Unaligned direct I/O buffers force the Linux kernel to fall back to synchronous bounce buffers and buffered copy paths, causing catastrophic cache thrashing and serialization under high-throughput NVMe workloads.","antiPatternHeadline":"Unaligned Heap Allocations in Direct Async I/O Causing Kernel Bounce-Buffer Fallbacks","stars_count":118,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres","async-io","io-uring","direct-io","nvme","performance"],"exportEndpoints":{"claude":"/api/rules/postgres-17-async-io-direct-buffer-alignment?format=claude","cursorMdc":"/api/rules/postgres-17-async-io-direct-buffer-alignment?format=mdc","cursorrules":"/api/rules/postgres-17-async-io-direct-buffer-alignment?format=cursor","windsurf":"/api/rules/postgres-17-async-io-direct-buffer-alignment?format=windsurf","agents":"/api/rules/postgres-17-async-io-direct-buffer-alignment?format=agents"}},{"id":"go-chi-slog-concurrency-context-tracing-standard","title":"Go 1.24 Chi slog Concurrency Context Tracing Standard","category":"backend","severity":"critical","description":"Mandates zero-allocation propagation of structured slog.Logger instances and telemetry context across synchronous and asynchronous goroutines in Go 1.24 Chi HTTP pipelines. Enforces the use of context.WithoutCancel for detached execution and typed, allocation-free context keys to eliminate data races, context cancellation panics, and telemetry loss.","antiPatternHeadline":"Leaking HTTP Request Contexts and Dynamic Heap Allocations Across Spawned Worker Goroutines","stars_count":102,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","golang","go124","slog","chi","concurrency","tracing"],"exportEndpoints":{"claude":"/api/rules/go-chi-slog-concurrency-context-tracing-standard?format=claude","cursorMdc":"/api/rules/go-chi-slog-concurrency-context-tracing-standard?format=mdc","cursorrules":"/api/rules/go-chi-slog-concurrency-context-tracing-standard?format=cursor","windsurf":"/api/rules/go-chi-slog-concurrency-context-tracing-standard?format=windsurf","agents":"/api/rules/go-chi-slog-concurrency-context-tracing-standard?format=agents"}},{"id":"kmp-swift-export-strict-concurrency-isolation","title":"KMP Swift Export Strict Concurrency and Actor Isolation Standard","category":"mobile","severity":"critical","description":"Enforces complete Swift 6 concurrency safety on Kotlin Multiplatform (KMP) exported boundaries by requiring explicit actor isolation and strict Sendable barriers. Prevents data races caused by crossing Swift actor domains with unconstrained, mutable Kotlin reference types bridged into native code.","antiPatternHeadline":"Leaking Uncontained Non-Sendable Kotlin Objects Across Swift 6 Concurrency Domains Without Actor Isolation","stars_count":48,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","swift-6","strict-concurrency","actor-isolation","ios"],"exportEndpoints":{"claude":"/api/rules/kmp-swift-export-strict-concurrency-isolation?format=claude","cursorMdc":"/api/rules/kmp-swift-export-strict-concurrency-isolation?format=mdc","cursorrules":"/api/rules/kmp-swift-export-strict-concurrency-isolation?format=cursor","windsurf":"/api/rules/kmp-swift-export-strict-concurrency-isolation?format=windsurf","agents":"/api/rules/kmp-swift-export-strict-concurrency-isolation?format=agents"}},{"id":"openid-sse-caep-realtime-session-revocation","title":"OpenID SSE-CAEP Real-Time Revocation and Continuous Access Enforcement","category":"security","severity":"critical","description":"Enforces deterministic sub-second session and token invalidation across distributed architectures by ingesting OpenID Continuous Access Evaluation Profile (CAEP) and Shared Signals and Events (SSE) Security Event Tokens (SETs, RFC 8417). Prohibits relying purely on passive JWT time-to-live (TTL) expiration for authorization state when credential compromise or revocation events occur.","antiPatternHeadline":"Passive JWT Expiration Reliance Without Active Shared Signal Revocation Ingestion","stars_count":52,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openid","caep","sse","jwt-revocation","zero-trust","session-invalidation"],"exportEndpoints":{"claude":"/api/rules/openid-sse-caep-realtime-session-revocation?format=claude","cursorMdc":"/api/rules/openid-sse-caep-realtime-session-revocation?format=mdc","cursorrules":"/api/rules/openid-sse-caep-realtime-session-revocation?format=cursor","windsurf":"/api/rules/openid-sse-caep-realtime-session-revocation?format=windsurf","agents":"/api/rules/openid-sse-caep-realtime-session-revocation?format=agents"}},{"id":"csp-level-3-dynamic-nonce-streaming-ssr-invariant","title":"CSP Level 3 Dynamic Nonce Propagation in Chunked Streaming SSR","category":"security","severity":"critical","description":"Enforces cryptographic nonce generation per HTTP request and continuous injection into both HTTP response headers and chunked HTML streaming boundaries. Prevents Cross-Site Scripting (XSS) bypasses and React/Next.js hydration mismatches caused by static nonce reuse or out-of-order asynchronous chunk rendering without proper nonce binding.","antiPatternHeadline":"Reusing Static Nonces Across Requests or Emitting Inline Scripts Without Contextual Nonce Binding in Streaming Chunks","stars_count":81,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","csp-level-3","streaming-ssr","xss-prevention","react-hydration","nextjs"],"exportEndpoints":{"claude":"/api/rules/csp-level-3-dynamic-nonce-streaming-ssr-invariant?format=claude","cursorMdc":"/api/rules/csp-level-3-dynamic-nonce-streaming-ssr-invariant?format=mdc","cursorrules":"/api/rules/csp-level-3-dynamic-nonce-streaming-ssr-invariant?format=cursor","windsurf":"/api/rules/csp-level-3-dynamic-nonce-streaming-ssr-invariant?format=windsurf","agents":"/api/rules/csp-level-3-dynamic-nonce-streaming-ssr-invariant?format=agents"}},{"id":"ebpf-tc-direct-host-routing-bypass-standard","title":"eBPF TC Direct Host Routing & Conntrack Bypass Guardrail","category":"devops","severity":"critical","description":"Enforces eBPF direct host routing at the Traffic Control (tc) clsact hook to bypass the netfilter conntrack engine for east-west container traffic. Ensures encapsulation headers, socket translation metadata, and fib_lookup flags are strictly verified to maintain deterministic sub-millisecond p99 latency without dropping stateful packet context.","antiPatternHeadline":"Routing Container East-West Traffic Through Netfilter Conntrack Stack and Default Veth Pair Queues","stars_count":61,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","tc","networking","conntrack","kubernetes","cilium"],"exportEndpoints":{"claude":"/api/rules/ebpf-tc-direct-host-routing-bypass-standard?format=claude","cursorMdc":"/api/rules/ebpf-tc-direct-host-routing-bypass-standard?format=mdc","cursorrules":"/api/rules/ebpf-tc-direct-host-routing-bypass-standard?format=cursor","windsurf":"/api/rules/ebpf-tc-direct-host-routing-bypass-standard?format=windsurf","agents":"/api/rules/ebpf-tc-direct-host-routing-bypass-standard?format=agents"}},{"id":"opentelemetry-metric-exemplar-fixed-reservoir-allocation-policy","title":"OpenTelemetry Metric Exemplar Fixed-Reservoir Allocation Policy","category":"devops","severity":"critical","description":"Enforces deterministic, upper-bounded memory consumption for metric exemplar storage across high-throughput telemetry pipelines. Prevents catastrophic garbage collection spikes and out-of-memory (OOM) failures under million-event-per-second ingestion by requiring fixed-capacity, trace-filtered reservoirs over default or unbounded exemplar sampling strategies.","antiPatternHeadline":"Unbounded or Naive Metric Exemplar Retention Causing Severe GC Pressure and Heap Exhaustion","stars_count":99,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","metrics","exemplars","observability","memory-management","high-throughput"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-metric-exemplar-fixed-reservoir-allocation-policy?format=claude","cursorMdc":"/api/rules/opentelemetry-metric-exemplar-fixed-reservoir-allocation-policy?format=mdc","cursorrules":"/api/rules/opentelemetry-metric-exemplar-fixed-reservoir-allocation-policy?format=cursor","windsurf":"/api/rules/opentelemetry-metric-exemplar-fixed-reservoir-allocation-policy?format=windsurf","agents":"/api/rules/opentelemetry-metric-exemplar-fixed-reservoir-allocation-policy?format=agents"}},{"id":"react-19-compiler-strict-structural-immutability","title":"React 19 Compiler Strict Structural Immutability Guardrail","category":"frontend","severity":"critical","description":"The React 19 Compiler relies on strict structural immutability across component render passes to synthesize fine-grained auto-memoization blocks and safe reactive scopes. Mutating props, hook returns, or intermediate state in-place violates the compiler's escape analysis assumptions, silently de-optimizing the memoization graph and inducing tearing or stale render cycles. All state transitions, array operations, and prop transforms must strictly adhere to functional updates, pure transformations, or non-destructive copying primitives.","antiPatternHeadline":"In-place mutation of props, hook return values, or referenced state that invalidates React 19 compiler memoization boundaries","stars_count":98,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react19","react-compiler","immutability","typescript"],"exportEndpoints":{"claude":"/api/rules/react-19-compiler-strict-structural-immutability?format=claude","cursorMdc":"/api/rules/react-19-compiler-strict-structural-immutability?format=mdc","cursorrules":"/api/rules/react-19-compiler-strict-structural-immutability?format=cursor","windsurf":"/api/rules/react-19-compiler-strict-structural-immutability?format=windsurf","agents":"/api/rules/react-19-compiler-strict-structural-immutability?format=agents"}},{"id":"postgres-17-logical-replication-parallel-apply-slot-affinity","title":"Postgres 17 Parallel Apply Slot-Affinity Invariant for High-Write Ingestion","category":"backend","severity":"critical","description":"Enforces deterministic entity hash partitioning across Postgres 17 logical replication subscriptions and parallel apply workers. Prevents inter-worker relational deadlocks on foreign key constraints and share-lock contention during high-throughput distributed CDC ingestion. Guarantees that interdependent transactional trees route to deterministic parallel stream channels.","antiPatternHeadline":"Non-deterministic worker distribution of transactional CDC events causing cross-worker foreign-key deadlocks in parallel apply pipelines.","stars_count":45,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","cdc","logical-replication","concurrency"],"exportEndpoints":{"claude":"/api/rules/postgres-17-logical-replication-parallel-apply-slot-affinity?format=claude","cursorMdc":"/api/rules/postgres-17-logical-replication-parallel-apply-slot-affinity?format=mdc","cursorrules":"/api/rules/postgres-17-logical-replication-parallel-apply-slot-affinity?format=cursor","windsurf":"/api/rules/postgres-17-logical-replication-parallel-apply-slot-affinity?format=windsurf","agents":"/api/rules/postgres-17-logical-replication-parallel-apply-slot-affinity?format=agents"}},{"id":"go-chi-http3-rfc9218-stream-prioritization-standard","title":"Deterministic RFC 9218 Extensible Prioritization and Rapid-Reset Mitigation in Go Chi HTTP/3","category":"backend","severity":"critical","description":"Enforces strict RFC 9218 Extensible Prioritization handling and stream frame budgeting in Go Chi HTTP/3 services. Mitigates HTTP/3 stream starvation and Rapid Reset (CVE-2023-44487 analogue) vectors by bounding stream concurrency, throttling stream cancellations, and parsing urgency/incremental parameters for deterministic resource allocation.","antiPatternHeadline":"Unbounded Goroutine Spawning and Unthrottled HTTP/3 Stream Resets Leading to Resource Starvation","stars_count":53,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","chi","http3","quic","rfc9218","dos-mitigation"],"exportEndpoints":{"claude":"/api/rules/go-chi-http3-rfc9218-stream-prioritization-standard?format=claude","cursorMdc":"/api/rules/go-chi-http3-rfc9218-stream-prioritization-standard?format=mdc","cursorrules":"/api/rules/go-chi-http3-rfc9218-stream-prioritization-standard?format=cursor","windsurf":"/api/rules/go-chi-http3-rfc9218-stream-prioritization-standard?format=windsurf","agents":"/api/rules/go-chi-http3-rfc9218-stream-prioritization-standard?format=agents"}},{"id":"bun-sqlite-zero-copy-off-heap-buffer-invariant","title":"Bun 1.2 Native SQLite Zero-Copy Off-Heap Buffer Invariant","category":"backend","severity":"critical","description":"Enforces strict buffer ownership transfer and zero-copy pinned allocations between the JavaScriptCore (JSC) heap and native SQLite pointers during high-throughput ingest in Bun 1.2+. Prevents JSC garbage collection stop-the-world pauses, double-free faults, and unaligned memory access by mandating direct Uint8Array slice reuse with SQLite native statement binding.","antiPatternHeadline":"Implicit JSC Heap Allocation and Buffer Cloning During High-Volume SQLite Ingestion","stars_count":60,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","sqlite","zero-copy","memory-management","jsc","off-heap"],"exportEndpoints":{"claude":"/api/rules/bun-sqlite-zero-copy-off-heap-buffer-invariant?format=claude","cursorMdc":"/api/rules/bun-sqlite-zero-copy-off-heap-buffer-invariant?format=mdc","cursorrules":"/api/rules/bun-sqlite-zero-copy-off-heap-buffer-invariant?format=cursor","windsurf":"/api/rules/bun-sqlite-zero-copy-off-heap-buffer-invariant?format=windsurf","agents":"/api/rules/bun-sqlite-zero-copy-off-heap-buffer-invariant?format=agents"}},{"id":"tauri-v2-multiwindow-ipc-capability-scoping-guardrail","title":"Tauri 2.0 Multi-Window IPC Capability Scoping and Window Isolation Guardrail","category":"mobile","severity":"critical","description":"Enforces strict isolation of Tauri 2.0 IPC capabilities across multi-window and mobile WebView contexts by prohibiting wildcard window targeting. Ensures that plugin and native capabilities are explicitly bound to distinct window labels with least-privilege ACL scopes, preventing privilege escalation and unauthorized command invocation from sandboxed, auxiliary, or third-party WebViews.","antiPatternHeadline":"Wildcard Capability Window Scoping Exposing Privileged IPC Handlers to Untrusted WebViews","stars_count":101,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri-2","security","ipc","acls","capabilities","rust"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-multiwindow-ipc-capability-scoping-guardrail?format=claude","cursorMdc":"/api/rules/tauri-v2-multiwindow-ipc-capability-scoping-guardrail?format=mdc","cursorrules":"/api/rules/tauri-v2-multiwindow-ipc-capability-scoping-guardrail?format=cursor","windsurf":"/api/rules/tauri-v2-multiwindow-ipc-capability-scoping-guardrail?format=windsurf","agents":"/api/rules/tauri-v2-multiwindow-ipc-capability-scoping-guardrail?format=agents"}},{"id":"android-15-predictive-back-gesture-state-preservation-standard","title":"Android 15 Predictive Back Gesture State Preservation Standard","category":"mobile","severity":"critical","description":"Enforces deterministic multi-stack state restoration and cancelable transitions for Android 15 predictive back navigation. Guarantees that transient UI state, focus hierarchies, and hardware-accelerated surfaces remain intact during back-gesture progress, preventing premature state commits, surface tearing, and view model corruption when gestures are cancelled.","antiPatternHeadline":"Mutating Backstack State or Triggering Terminal Side Effects During Gesture Progress","stars_count":79,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","android","android-15","jetpack-compose","predictive-back","navigation"],"exportEndpoints":{"claude":"/api/rules/android-15-predictive-back-gesture-state-preservation-standard?format=claude","cursorMdc":"/api/rules/android-15-predictive-back-gesture-state-preservation-standard?format=mdc","cursorrules":"/api/rules/android-15-predictive-back-gesture-state-preservation-standard?format=cursor","windsurf":"/api/rules/android-15-predictive-back-gesture-state-preservation-standard?format=windsurf","agents":"/api/rules/android-15-predictive-back-gesture-state-preservation-standard?format=agents"}},{"id":"spiffe-spire-workload-identity-federation-standard","title":"SPIFFE/SPIRE Dynamic X.509 SVID Workload Identity & Multi-Cloud Federation Guardrail","category":"security","severity":"critical","description":"Enforces dynamic, short-lived X.509 SVID issuance and automated rotation via the SPIFFE Workload API over a secure Unix Domain Socket (UDS). Prohibits long-lived static API tokens, disk-persisted credentials, and manual CA synchronization across heterogeneous multi-cloud Kubernetes clusters by mandating in-memory rotation and cryptographically verified SPIFFE Trust Domain Federation.","antiPatternHeadline":"Bypassing SPIFFE Workload API with Long-Lived Static Secrets, File-Persisted Certificates, or Missing In-Memory SVID Watchers","stars_count":106,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","spiffe","spire","zero-trust","kubernetes","mutual-tls","svid"],"exportEndpoints":{"claude":"/api/rules/spiffe-spire-workload-identity-federation-standard?format=claude","cursorMdc":"/api/rules/spiffe-spire-workload-identity-federation-standard?format=mdc","cursorrules":"/api/rules/spiffe-spire-workload-identity-federation-standard?format=cursor","windsurf":"/api/rules/spiffe-spire-workload-identity-federation-standard?format=windsurf","agents":"/api/rules/spiffe-spire-workload-identity-federation-standard?format=agents"}},{"id":"cilium-ebpf-host-routing-mtu-clamping-guardrail","title":"Cilium eBPF Host-Routing MTU Clamping and WireGuard Overlay Guardrail","category":"devops","severity":"critical","description":"Enforces deterministic MTU calculation and kernel-level MSS path discovery when Cilium native eBPF host-routing is coupled with WireGuard transparent encryption. Bypassing Linux netfilter through eBPF host-routing invalidates traditional iptables TCPMSS clamping, causing silent TCP blackholing when packets with the Don't Fragment (DF) bit exceed the effective overlay payload size. This guardrail mandates explicit MTU deduction for WireGuard headers, ensures ICMP 'Packet Too Big' generation, and eliminates asymmetric routing loops across inter-cluster and cross-subnet topologies.","antiPatternHeadline":"Unclamped 1500 MTU with Native eBPF Host Routing and WireGuard Encryption Inducing Silent TCP Blackholes","stars_count":74,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","cilium","ebpf","wireguard","kubernetes","networking","mtu","kernel"],"exportEndpoints":{"claude":"/api/rules/cilium-ebpf-host-routing-mtu-clamping-guardrail?format=claude","cursorMdc":"/api/rules/cilium-ebpf-host-routing-mtu-clamping-guardrail?format=mdc","cursorrules":"/api/rules/cilium-ebpf-host-routing-mtu-clamping-guardrail?format=cursor","windsurf":"/api/rules/cilium-ebpf-host-routing-mtu-clamping-guardrail?format=windsurf","agents":"/api/rules/cilium-ebpf-host-routing-mtu-clamping-guardrail?format=agents"}},{"id":"otel-tail-sampling-p999-retention","title":"Deterministic Ring-Buffered Tail Sampling with P99.9 Exemplar Retention","category":"devops","severity":"critical","description":"Enforces memory-bounded tail-based trace sampling in OpenTelemetry Collectors while guaranteeing 100% trace graph fidelity for P99.9 latency outliers and distributed errors. Mandates upstream memory-limiter guards coupled with deterministic ring-buffer windowing (`decision_wait`, `num_traces`, `expected_new_traces_per_sec`) to eliminate collector OOMs during incident traffic spikes.","antiPatternHeadline":"Unbounded Trace Buffering and Head-Based Sampling Discarding Tail Latency Root Causes","stars_count":48,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","tail-sampling","observability","distributed-tracing","sre"],"exportEndpoints":{"claude":"/api/rules/otel-tail-sampling-p999-retention?format=claude","cursorMdc":"/api/rules/otel-tail-sampling-p999-retention?format=mdc","cursorrules":"/api/rules/otel-tail-sampling-p999-retention?format=cursor","windsurf":"/api/rules/otel-tail-sampling-p999-retention?format=windsurf","agents":"/api/rules/otel-tail-sampling-p999-retention?format=agents"}},{"id":"nextjs-15-after-lifecycle-isolation-guardrail","title":"Next.js 15 after() Async Context Lifecycle Isolation & Bounded Execution","category":"frontend","severity":"critical","description":"Mandates that all post-response asynchronous side-effects in Next.js 15 Route Handlers and Server Actions use `after()` with deterministic timeout bounds and explicit error containment. Prevents frozen unhandled promises, container memory leaks, and runaway serverless compute billing caused by naked detached tasks.","antiPatternHeadline":"Spawning detached floating promises or unbounded async tasks in `after()` that trigger billing timeouts and leak serverless contexts.","stars_count":58,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs","serverless","after","async-lifecycle","performance"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-after-lifecycle-isolation-guardrail?format=claude","cursorMdc":"/api/rules/nextjs-15-after-lifecycle-isolation-guardrail?format=mdc","cursorrules":"/api/rules/nextjs-15-after-lifecycle-isolation-guardrail?format=cursor","windsurf":"/api/rules/nextjs-15-after-lifecycle-isolation-guardrail?format=windsurf","agents":"/api/rules/nextjs-15-after-lifecycle-isolation-guardrail?format=agents"}},{"id":"vite-6-environment-api-multi-runtime-isolation-vite-6-environme-276","title":"Vite 6 Environment API Multi-Runtime SSR Module Graph Isolation","category":"frontend","severity":"critical","description":"Enforces strict module graph and runtime isolation using the Vite 6 Environment API across heterogeneous deployment targets (browser, Node.js, and Edge/workerd). Prevents non-deterministic module resolution, runtime global pollution, and cross-runtime cache poisoning during unified full-stack compilation.","antiPatternHeadline":"Cross-contaminating runtime globals and unpartitioned module graphs via legacy monolithic Vite SSR APIs.","stars_count":43,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["vite","vite-6","ssr","environment-api","module-graph","edge-runtime","fullstack"],"exportEndpoints":{"claude":"/api/rules/vite-6-environment-api-multi-runtime-isolation-vite-6-environme-276?format=claude","cursorMdc":"/api/rules/vite-6-environment-api-multi-runtime-isolation-vite-6-environme-276?format=mdc","cursorrules":"/api/rules/vite-6-environment-api-multi-runtime-isolation-vite-6-environme-276?format=cursor","windsurf":"/api/rules/vite-6-environment-api-multi-runtime-isolation-vite-6-environme-276?format=windsurf","agents":"/api/rules/vite-6-environment-api-multi-runtime-isolation-vite-6-environme-276?format=agents"}},{"id":"postgres-17-failover-safe-logical-replication-sync","title":"Postgres 17 Failover-Safe Logical Replication Slot Synchronization","category":"backend","severity":"critical","description":"Mandates strict programmatic configuration and operational validation of PostgreSQL 17 failover-safe logical replication slots for downstream CDC and transactional outbox engines. Ensures logical slots specify failover enabled, primary instances enforce synchronized_standby_slots, and standby nodes sync slots to eliminate cursor corruption, dropped events, and duplicate stream bursts during replica failovers.","antiPatternHeadline":"Unsynchronized Ephemeral Logical Slots Lost or Rewound Following Primary-Replica Failovers","stars_count":90,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","postgres-17","cdc","logical-replication","outbox-pattern"],"exportEndpoints":{"claude":"/api/rules/postgres-17-failover-safe-logical-replication-sync?format=claude","cursorMdc":"/api/rules/postgres-17-failover-safe-logical-replication-sync?format=mdc","cursorrules":"/api/rules/postgres-17-failover-safe-logical-replication-sync?format=cursor","windsurf":"/api/rules/postgres-17-failover-safe-logical-replication-sync?format=windsurf","agents":"/api/rules/postgres-17-failover-safe-logical-replication-sync?format=agents"}},{"id":"fastapi-python313-nogil-concurrency-guardrail","title":"FastAPI Free-Threaded Python 3.13 (PEP 703) GIL-Free Concurrency Guardrail","category":"backend","severity":"critical","description":"Enforces strict thread-synchronization primitives, atomic operations, and native C-extension isolation for FastAPI services running on Python 3.13 free-threaded builds (PEP 703). Prevents silent data corruption, torn reads/writes in shared memory spaces, and segfaults caused by thread-unsafe C-extensions operating across concurrent OS threads.","antiPatternHeadline":"Unsynchronized Shared In-Memory State and Legacy C-Extensions in Free-Threaded Runtimes","stars_count":85,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","python313","pep703","nogil","concurrency","thread-safety"],"exportEndpoints":{"claude":"/api/rules/fastapi-python313-nogil-concurrency-guardrail?format=claude","cursorMdc":"/api/rules/fastapi-python313-nogil-concurrency-guardrail?format=mdc","cursorrules":"/api/rules/fastapi-python313-nogil-concurrency-guardrail?format=cursor","windsurf":"/api/rules/fastapi-python313-nogil-concurrency-guardrail?format=windsurf","agents":"/api/rules/fastapi-python313-nogil-concurrency-guardrail?format=agents"}},{"id":"axum-hyper-h2-goaway-drain-invariant","title":"Axum 0.8 / Hyper 1.x HTTP/2 Graceful GOAWAY Stream Drain Invariant","category":"backend","severity":"critical","description":"Enforces RFC 9113-compliant HTTP/2 graceful connection draining during rolling deployments in Axum 0.8 and Hyper 1.x. Prevents connection resets, ERR_HTTP2_PROTOCOL_ERROR, and 502 Bad Gateway errors by ensuring active multiplexed streams finish processing and GOAWAY frames propagate prior to socket closure.","antiPatternHeadline":"Abrupt TCP Socket Termination Dropping Inflight Multiplexed HTTP/2 Streams During Pod Termination","stars_count":65,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","hyper","http2","zero-downtime","kubernetes"],"exportEndpoints":{"claude":"/api/rules/axum-hyper-h2-goaway-drain-invariant?format=claude","cursorMdc":"/api/rules/axum-hyper-h2-goaway-drain-invariant?format=mdc","cursorrules":"/api/rules/axum-hyper-h2-goaway-drain-invariant?format=cursor","windsurf":"/api/rules/axum-hyper-h2-goaway-drain-invariant?format=windsurf","agents":"/api/rules/axum-hyper-h2-goaway-drain-invariant?format=agents"}},{"id":"room-kmp-sqlite-wal-concurrency-boundary","title":"Room 2.7 KMP Multiplatform SQLite WAL Concurrency Boundary","category":"mobile","severity":"critical","description":"Enforces strict Write-Ahead Logging (WAL) initialization, single-writer multi-reader coroutine dispatching, and POSIX-safe connection pool boundaries across iOS and Android in Room 2.7 Kotlin Multiplatform. Prevents SQLite multi-threading violations, fatal SQLITE_BUSY deadlocks, and cross-platform native thread lockups by isolating SQLite writes through a confined single-threaded coroutine context while allowing concurrent readers.","antiPatternHeadline":"Unconfined Concurrent Coroutine Dispatching on Native SQLite SQLiteDriver Without WAL Isolation","stars_count":107,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","kmp","room","sqlite","wal","ios","android"],"exportEndpoints":{"claude":"/api/rules/room-kmp-sqlite-wal-concurrency-boundary?format=claude","cursorMdc":"/api/rules/room-kmp-sqlite-wal-concurrency-boundary?format=mdc","cursorrules":"/api/rules/room-kmp-sqlite-wal-concurrency-boundary?format=cursor","windsurf":"/api/rules/room-kmp-sqlite-wal-concurrency-boundary?format=windsurf","agents":"/api/rules/room-kmp-sqlite-wal-concurrency-boundary?format=agents"}},{"id":"oauth2-dpop-rfc9449-cryptographic-attestation-boundary","title":"OAuth 2.0 DPoP (RFC 9449) Asymmetric Key Binding and Nonce Validation Boundary","category":"security","severity":"critical","description":"Enforces strict Demonstrating Proof-of-Possession (DPoP, RFC 9449) cryptographic verification across Backend-for-Frontend (BFF) layers and downstream service hops. Prevents token replay and demotion attacks by mandating verification of ephemeral public keys (`jwk`), access token binding (`ath`), method/URI matching (`htm`/`htu`), and stateful server-issued nonces (`DPoP-Nonce`).","antiPatternHeadline":"DPoP-to-Bearer Demotion Across Service Boundaries and Missing Nonce Replay Enforcements","stars_count":110,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","oauth2","dpop","rfc9449","cryptography","zero-trust","bff"],"exportEndpoints":{"claude":"/api/rules/oauth2-dpop-rfc9449-cryptographic-attestation-boundary?format=claude","cursorMdc":"/api/rules/oauth2-dpop-rfc9449-cryptographic-attestation-boundary?format=mdc","cursorrules":"/api/rules/oauth2-dpop-rfc9449-cryptographic-attestation-boundary?format=cursor","windsurf":"/api/rules/oauth2-dpop-rfc9449-cryptographic-attestation-boundary?format=windsurf","agents":"/api/rules/oauth2-dpop-rfc9449-cryptographic-attestation-boundary?format=agents"}},{"id":"openfga-contextual-tuple-recursion-depth-limiter","title":"OpenFGA Contextual Tuple Graph Recursion and Depth Limiter","category":"security","severity":"critical","description":"Enforces strict structural validation, depth bounding, and cycle detection on ad-hoc contextual tuples passed to OpenFGA Check and ListObjects operations. Unbounded or cyclic contextual tuples allow malicious actors to induce catastrophic ReBAC graph expansion, thread starvation, and service-level denial of service via adversarial graph structures.","antiPatternHeadline":"Unvalidated Contextual Tuple Injection Causing ReBAC Catastrophic Backtracking and CPU Starvation","stars_count":119,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","rebac","authorization","dos-prevention","graph-traversal"],"exportEndpoints":{"claude":"/api/rules/openfga-contextual-tuple-recursion-depth-limiter?format=claude","cursorMdc":"/api/rules/openfga-contextual-tuple-recursion-depth-limiter?format=mdc","cursorrules":"/api/rules/openfga-contextual-tuple-recursion-depth-limiter?format=cursor","windsurf":"/api/rules/openfga-contextual-tuple-recursion-depth-limiter?format=windsurf","agents":"/api/rules/openfga-contextual-tuple-recursion-depth-limiter?format=agents"}},{"id":"k8s-inplace-resize-cgroupv2-dynamic-memory","title":"Kubernetes In-Place Pod Resizing cgroup v2 Dynamic Memory Rebalancing","category":"devops","severity":"critical","description":"Enforces strict runtime synchronization between Kubernetes In-Place Pod Resizing (cgroup v2 `memory.max` / `memory.high`) and application runtime memory limits (Go `debug.SetMemoryLimit`, HotSpot JVM dynamic MXBeans/ZGC). Prevents immediate OOMKills during dynamic downscaling and eliminates severe memory underutilization during dynamic upscaling without pod restarts.","antiPatternHeadline":"Static Memory Initialization and Blind Downscaling Inducing Silent OOMKills","stars_count":67,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["kubernetes","cgroups-v2","in-place-resize","golang","jvm","devops","sre"],"exportEndpoints":{"claude":"/api/rules/k8s-inplace-resize-cgroupv2-dynamic-memory?format=claude","cursorMdc":"/api/rules/k8s-inplace-resize-cgroupv2-dynamic-memory?format=mdc","cursorrules":"/api/rules/k8s-inplace-resize-cgroupv2-dynamic-memory?format=cursor","windsurf":"/api/rules/k8s-inplace-resize-cgroupv2-dynamic-memory?format=windsurf","agents":"/api/rules/k8s-inplace-resize-cgroupv2-dynamic-memory?format=agents"}},{"id":"ebpf-ringbuf-backpressure-drop-audit-standard","title":"eBPF Ring Buffer Backpressure and Verifiable Drop Accounting Invariant","category":"devops","severity":"critical","description":"Enforces strict memory and CPU bounds on kernel-to-userspace telemetry pipelines using BPF ring buffers under extreme network saturation. Mandates deterministic reserve-commit semantics with non-blocking discard fallbacks coupled to atomic, verifiable drop metrics to preserve kernel stability.","antiPatternHeadline":"Unbounded bpf_ringbuf_output Allocation and Silent Packet Drop Without Audit Telemetry","stars_count":70,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","kernel","observability","performance","systems"],"exportEndpoints":{"claude":"/api/rules/ebpf-ringbuf-backpressure-drop-audit-standard?format=claude","cursorMdc":"/api/rules/ebpf-ringbuf-backpressure-drop-audit-standard?format=mdc","cursorrules":"/api/rules/ebpf-ringbuf-backpressure-drop-audit-standard?format=cursor","windsurf":"/api/rules/ebpf-ringbuf-backpressure-drop-audit-standard?format=windsurf","agents":"/api/rules/ebpf-ringbuf-backpressure-drop-audit-standard?format=agents"}},{"id":"openfga-contextual-tuples-depth-cycle-guardrail","title":"OpenFGA 1.8 Contextual Tuple Traversal Depth & Cycle Guardrail","category":"security","severity":"critical","description":"Enforces strict boundaries, cycle prevention, and volume capping on OpenFGA contextual tuples to prevent catastrophic graph traversals during Zanzibar authorization checks. Unbounded dynamic tuple injection leads to distributed denial of service, memory exhaustion, and breached sub-millisecond evaluation SLOs. Mandates deterministic graph evaluation constraints before dispatching runtime checks.","antiPatternHeadline":"Injecting Unsanitized Dynamic Contextual Tuples Causing Unbounded Graph Traversal and ReDoS-Style Exhaustion","stars_count":110,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","zanzibar","authorization","graph-traversal","rate-limiting"],"exportEndpoints":{"claude":"/api/rules/openfga-contextual-tuples-depth-cycle-guardrail?format=claude","cursorMdc":"/api/rules/openfga-contextual-tuples-depth-cycle-guardrail?format=mdc","cursorrules":"/api/rules/openfga-contextual-tuples-depth-cycle-guardrail?format=cursor","windsurf":"/api/rules/openfga-contextual-tuples-depth-cycle-guardrail?format=windsurf","agents":"/api/rules/openfga-contextual-tuples-depth-cycle-guardrail?format=agents"}},{"id":"pg17-vectorized-direct-io-worker-production-standard","title":"PostgreSQL 17 Vectorized Direct I/O and Parallel Worker Invariant","category":"backend","severity":"critical","description":"Enforces bounded kernel buffer lock contention and prevents worker exhaustion during concurrent vectorized sequential scans in PostgreSQL 17. Mandates deterministic tuning of io_combine_limit, io_direct, and max_parallel_workers_per_gather to prevent OS page-cache thrashing and worker pool starvation.","antiPatternHeadline":"Unbounded parallel sequential scans with uncontrolled block read combinations causing buffer lock saturation and worker exhaustion","stars_count":63,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql-17","direct-io","parallel-workers","database-performance","buffer-cache"],"exportEndpoints":{"claude":"/api/rules/pg17-vectorized-direct-io-worker-production-standard?format=claude","cursorMdc":"/api/rules/pg17-vectorized-direct-io-worker-production-standard?format=mdc","cursorrules":"/api/rules/pg17-vectorized-direct-io-worker-production-standard?format=cursor","windsurf":"/api/rules/pg17-vectorized-direct-io-worker-production-standard?format=windsurf","agents":"/api/rules/pg17-vectorized-direct-io-worker-production-standard?format=agents"}},{"id":"tauri-v2-mobile-plugin-acl-capability-scope","title":"Tauri 2.0 Mobile Plugin Granular Capability ACL Scope Enforcement","category":"mobile","severity":"critical","description":"Eliminates arbitrary remote code execution (RCE) and unauthorized IPC invoke vectors in Tauri 2.0 mobile webviews by enforcing compile-time Access Control List (ACL) manifests. Requires explicit window/webview capability mapping and deny-by-default granular scoping for all core and community plugins.","antiPatternHeadline":"Permissive Wildcard Plugin Permissions and Unscoped Cross-Origin Webview Invoke Bindings","stars_count":43,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri-2","security","acl","ipc","capabilities"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-mobile-plugin-acl-capability-scope?format=claude","cursorMdc":"/api/rules/tauri-v2-mobile-plugin-acl-capability-scope?format=mdc","cursorrules":"/api/rules/tauri-v2-mobile-plugin-acl-capability-scope?format=cursor","windsurf":"/api/rules/tauri-v2-mobile-plugin-acl-capability-scope?format=windsurf","agents":"/api/rules/tauri-v2-mobile-plugin-acl-capability-scope?format=agents"}},{"id":"react-19-concurrent-activity-boundary-preservation","title":"React 19 Concurrent Activity Boundary State Preservation Standard","category":"frontend","severity":"critical","description":"Governs state preservation, effect lifecycle invariants, and DOM isolation within React 19 Concurrent Activity boundaries. Enforces idempotent effect cleanups, prevents uncommitted background fiber side-effect leaks, and eliminates state desynchronization during hidden pre-rendering and route transitions.","antiPatternHeadline":"Leaking background subscriptions or corrupting external state during hidden Activity boundary lifecycles","stars_count":95,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","concurrent-react","activity-api","offscreen-rendering","fiber-lifecycle"],"exportEndpoints":{"claude":"/api/rules/react-19-concurrent-activity-boundary-preservation?format=claude","cursorMdc":"/api/rules/react-19-concurrent-activity-boundary-preservation?format=mdc","cursorrules":"/api/rules/react-19-concurrent-activity-boundary-preservation?format=cursor","windsurf":"/api/rules/react-19-concurrent-activity-boundary-preservation?format=windsurf","agents":"/api/rules/react-19-concurrent-activity-boundary-preservation?format=agents"}},{"id":"opamp-agent-config-reconciliation-quarantine-standard","title":"OpenTelemetry OpAMP Agent Configuration Reconciliation Quarantine & Canary Invariants","category":"devops","severity":"critical","description":"Enforces a mandatory quarantine and health verification state machine for all OpAMP (Open Agent Management Protocol) configuration updates across OpenTelemetry Collector fleets. Prevents fleet-wide telemetry dropouts by requiring staged canary evaluation, automated circuit-breaking on export failure metrics, and atomic fallback to Last Known Good (LKG) configurations before acknowledging remote config application.","antiPatternHeadline":"Global In-Place Remote Config Replacement Without Metric Health Probing or Atomic Rollback","stars_count":85,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","opamp","observability","canary","reliability"],"exportEndpoints":{"claude":"/api/rules/opamp-agent-config-reconciliation-quarantine-standard?format=claude","cursorMdc":"/api/rules/opamp-agent-config-reconciliation-quarantine-standard?format=mdc","cursorrules":"/api/rules/opamp-agent-config-reconciliation-quarantine-standard?format=cursor","windsurf":"/api/rules/opamp-agent-config-reconciliation-quarantine-standard?format=windsurf","agents":"/api/rules/opamp-agent-config-reconciliation-quarantine-standard?format=agents"}},{"id":"compose-ios-surface-cadisplaylink-sync","title":"Compose Multiplatform iOS Native Surface Synchronization Invariant","category":"mobile","severity":"critical","description":"Prevents main-thread micro-stutter, frame hitching, and visual tearing by strictly synchronizing Skiko rendering frames with CADisplayLink and iOS CATransaction state transitions. Eliminates out-of-phase Metal surface presentation when embedding UIKit views or coordinating animations between Compose and UIKit layer hierarchies. Mandates explicit frame-pacing hooks and transaction boundaries for all cross-platform surface interactions.","antiPatternHeadline":"Asynchronous Unsynchronized Skiko Metal Frame Submission Across UIKit Transitions","stars_count":99,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","compose-multiplatform","ios","skiko","cadisplaylink","metal","catransaction"],"exportEndpoints":{"claude":"/api/rules/compose-ios-surface-cadisplaylink-sync?format=claude","cursorMdc":"/api/rules/compose-ios-surface-cadisplaylink-sync?format=mdc","cursorrules":"/api/rules/compose-ios-surface-cadisplaylink-sync?format=cursor","windsurf":"/api/rules/compose-ios-surface-cadisplaylink-sync?format=windsurf","agents":"/api/rules/compose-ios-surface-cadisplaylink-sync?format=agents"}},{"id":"axum-tower-http2-graceful-goaway-invariant","title":"Axum 0.8 / Hyper HTTP/2 Dual GOAWAY Graceful Termination Invariant","category":"backend","severity":"critical","description":"Enforces deterministic HTTP/2 graceful shutdown sequencing during container termination in Axum 0.8 and Hyper 1.x. Prevents in-flight RPC loss and TCP RST injection by sequencing the dual GOAWAY advisory window, absorbing cross-wire streams, and draining Tokio worker tasks prior to socket termination.","antiPatternHeadline":"Abrupt TCP socket teardown during SIGTERM emitting premature RST_STREAM and dropped client RPCs.","stars_count":86,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","hyper","tower","http2","kubernetes"],"exportEndpoints":{"claude":"/api/rules/axum-tower-http2-graceful-goaway-invariant?format=claude","cursorMdc":"/api/rules/axum-tower-http2-graceful-goaway-invariant?format=mdc","cursorrules":"/api/rules/axum-tower-http2-graceful-goaway-invariant?format=cursor","windsurf":"/api/rules/axum-tower-http2-graceful-goaway-invariant?format=windsurf","agents":"/api/rules/axum-tower-http2-graceful-goaway-invariant?format=agents"}},{"id":"ebpf-lsm-userns-transition-guardrail","title":"eBPF LSM Kernel-Boundary Containment for Unauthorized User Namespace Transitions","category":"security","severity":"critical","description":"Enforces synchronous kernel-boundary interception of unauthorized user namespace transitions and capability escalations via eBPF LSM hooks before credential structures are mutated. Prohibits reliance on post-hoc userspace auditing or asynchronous seccomp notifications for container isolation guarantees. Guarantees that any transition across user namespace boundaries targeting the initial root namespace (init_user_ns) is synchronously denied with -EPERM.","antiPatternHeadline":"Post-Mutation Userspace Auditing of CLONE_NEWUSER and Capability Transitions","stars_count":91,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","ebpf","lsm","namespaces","containment","linux-kernel"],"exportEndpoints":{"claude":"/api/rules/ebpf-lsm-userns-transition-guardrail?format=claude","cursorMdc":"/api/rules/ebpf-lsm-userns-transition-guardrail?format=mdc","cursorrules":"/api/rules/ebpf-lsm-userns-transition-guardrail?format=cursor","windsurf":"/api/rules/ebpf-lsm-userns-transition-guardrail?format=windsurf","agents":"/api/rules/ebpf-lsm-userns-transition-guardrail?format=agents"}},{"id":"nextjs-15-async-request-context-unhandled-promise-isolation","title":"Next.js 15 Async Request Context Boundary & Unhandled Promise Isolation","category":"frontend","severity":"critical","description":"Enforces deterministic resolution and strict boundary isolation for Next.js 15 asynchronous request APIs (cookies, headers, params, and searchParams). Prevents dynamic AsyncLocalStorage context detachment, worker thread deadlocks, and unhandled promise rejections caused by floating promises crossing request lifecycle boundaries.","antiPatternHeadline":"Leaking Unresolved Dynamic Request Promises Across Async Boundaries or Background Tasks","stars_count":71,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs","react-server-components","concurrency","async-local-storage","typescript"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-async-request-context-unhandled-promise-isolation?format=claude","cursorMdc":"/api/rules/nextjs-15-async-request-context-unhandled-promise-isolation?format=mdc","cursorrules":"/api/rules/nextjs-15-async-request-context-unhandled-promise-isolation?format=cursor","windsurf":"/api/rules/nextjs-15-async-request-context-unhandled-promise-isolation?format=windsurf","agents":"/api/rules/nextjs-15-async-request-context-unhandled-promise-isolation?format=agents"}},{"id":"react-19-server-actions-idempotency-key-guardrail-react-19-server--856","title":"React 19 Server Actions Client Idempotency Keys & Optimistic Rollback Standard","category":"frontend","severity":"critical","description":"Enforces mandatory client-generated cryptographic idempotency keys and resilient rollback state boundaries for all mutating React 19 Server Actions. Guarantees that concurrent action replays, automated browser retries, and network reconnection storms cannot duplicate non-idempotent server-side side effects.","antiPatternHeadline":"Executing Non-Idempotent Server Actions Without Client-Seeded Cryptographic Tokens and Optimistic State Reconciliation","stars_count":109,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","server-actions","idempotency","optimistic-updates"],"exportEndpoints":{"claude":"/api/rules/react-19-server-actions-idempotency-key-guardrail-react-19-server--856?format=claude","cursorMdc":"/api/rules/react-19-server-actions-idempotency-key-guardrail-react-19-server--856?format=mdc","cursorrules":"/api/rules/react-19-server-actions-idempotency-key-guardrail-react-19-server--856?format=cursor","windsurf":"/api/rules/react-19-server-actions-idempotency-key-guardrail-react-19-server--856?format=windsurf","agents":"/api/rules/react-19-server-actions-idempotency-key-guardrail-react-19-server--856?format=agents"}},{"id":"vite6-environment-api-runtime-segregation-standard","title":"Vite 6 Environment API Multi-Runtime Module Segregation Standard","category":"frontend","severity":"critical","description":"Enforces strict module evaluation boundaries and environment isolation across Node.js, workerd, and edge runtimes in Vite 6 multi-environment setups. Prevents ambient Node globals, un-isolated Vite transform pipelines, and shared module graphs from leaking platform-specific capabilities across heterogeneous execution contexts.","antiPatternHeadline":"Cross-Runtime Global Leakage and Shared Module Graph Contamination in Heterogeneous Vite 6 Environments","stars_count":119,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","vite6","environment-api","ssr","workerd","edge-runtime"],"exportEndpoints":{"claude":"/api/rules/vite6-environment-api-runtime-segregation-standard?format=claude","cursorMdc":"/api/rules/vite6-environment-api-runtime-segregation-standard?format=mdc","cursorrules":"/api/rules/vite6-environment-api-runtime-segregation-standard?format=cursor","windsurf":"/api/rules/vite6-environment-api-runtime-segregation-standard?format=windsurf","agents":"/api/rules/vite6-environment-api-runtime-segregation-standard?format=agents"}},{"id":"axum-08-async-stream-backpressure-disconnect-guardrail","title":"Axum 0.8 Stream Backpressure & Cooperative Early Disconnect Invariant","category":"backend","severity":"critical","description":"Enforces deterministic cancellation and bounded backpressure across asynchronous HTTP/2 and HTTP/3 streaming pipelines in Axum 0.8. Ensures that downstream client disconnects (such as RST_STREAM or socket drops) immediately tear down upstream background workers, preventing resource leakage, memory exhaustion, and phantom query execution.","antiPatternHeadline":"Detached Background Task Spawning with Unbounded Channels Ignoring Receiver Drops","stars_count":74,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tokio","streaming","http2","backpressure"],"exportEndpoints":{"claude":"/api/rules/axum-08-async-stream-backpressure-disconnect-guardrail?format=claude","cursorMdc":"/api/rules/axum-08-async-stream-backpressure-disconnect-guardrail?format=mdc","cursorrules":"/api/rules/axum-08-async-stream-backpressure-disconnect-guardrail?format=cursor","windsurf":"/api/rules/axum-08-async-stream-backpressure-disconnect-guardrail?format=windsurf","agents":"/api/rules/axum-08-async-stream-backpressure-disconnect-guardrail?format=agents"}},{"id":"postgres-17-workmem-spill-circuit-breaker","title":"Postgres 17 Adaptive Parallel Hash Join WorkMem Allocation and OOM Circuit Breaker","category":"backend","severity":"critical","description":"Enforces deterministic per-worker memory quotas and adaptive query-level bounds during parallel hash joins in PostgreSQL 17. Prevents explosive memory growth across concurrent worker threads by dynamically scaling transaction-local work_mem and hash_mem_multiplier to force safe disk spilling rather than invoking the Linux kernel Out-Of-Memory (OOM) killer.","antiPatternHeadline":"Unbounded Global WorkMem Multiplied Across Parallel Workers Triggering Kernel OOM Cascades","stars_count":103,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres","postgres-17","memory-management","circuit-breaker","performance"],"exportEndpoints":{"claude":"/api/rules/postgres-17-workmem-spill-circuit-breaker?format=claude","cursorMdc":"/api/rules/postgres-17-workmem-spill-circuit-breaker?format=mdc","cursorrules":"/api/rules/postgres-17-workmem-spill-circuit-breaker?format=cursor","windsurf":"/api/rules/postgres-17-workmem-spill-circuit-breaker?format=windsurf","agents":"/api/rules/postgres-17-workmem-spill-circuit-breaker?format=agents"}},{"id":"oauth21-dpop-nonce-ephemeral-binding-invariant-production-standard","title":"OAuth 2.1 RFC 9449 DPoP Ephemeral Nonce & Asymmetric Thumbprint Binding Guardrail","category":"security","severity":"critical","description":"Mandates strict RFC 9449 Demonstrating Proof-of-Possession (DPoP) verification across all zero-trust resource servers, requiring cryptographic binding between the client's public key thumbprint (jkt) and the access token confirmation claim. Enforces stateful or cryptographically signed ephemeral server nonces with single-use replay protection and strict access token hash (ath) integrity checks on all RPC and HTTP endpoints.","antiPatternHeadline":"Accepting Unbound Bearer Tokens or Unverified DPoP Proofs Lacking Nonce and JWK Thumbprint Consensus","stars_count":89,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","oauth21","dpop","rfc9449","zero-trust","cryptography","jwk"],"exportEndpoints":{"claude":"/api/rules/oauth21-dpop-nonce-ephemeral-binding-invariant-production-standard?format=claude","cursorMdc":"/api/rules/oauth21-dpop-nonce-ephemeral-binding-invariant-production-standard?format=mdc","cursorrules":"/api/rules/oauth21-dpop-nonce-ephemeral-binding-invariant-production-standard?format=cursor","windsurf":"/api/rules/oauth21-dpop-nonce-ephemeral-binding-invariant-production-standard?format=windsurf","agents":"/api/rules/oauth21-dpop-nonce-ephemeral-binding-invariant-production-standard?format=agents"}},{"id":"openfga-dynamic-contextual-tuples-anti-pollution-invariant","title":"OpenFGA Ephemeral Contextual Tuples Anti-Pollution Guardrail","category":"security","severity":"critical","description":"Enforces that temporal, session-bound, and dynamic authorization assertions are supplied strictly as contextual tuples during OpenFGA evaluation queries rather than persisted to the tuple store. This prevents high-velocity database bloat, changelog table exhaustion, and critical privilege-retention vulnerabilities caused by orphaned revocation writes.","antiPatternHeadline":"Persisting Transient Grants to the Tuple Store Instead of Utilizing Ephemeral Contextual Tuples","stars_count":43,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","authorization","fine-grained-access-control","contextual-tuples"],"exportEndpoints":{"claude":"/api/rules/openfga-dynamic-contextual-tuples-anti-pollution-invariant?format=claude","cursorMdc":"/api/rules/openfga-dynamic-contextual-tuples-anti-pollution-invariant?format=mdc","cursorrules":"/api/rules/openfga-dynamic-contextual-tuples-anti-pollution-invariant?format=cursor","windsurf":"/api/rules/openfga-dynamic-contextual-tuples-anti-pollution-invariant?format=windsurf","agents":"/api/rules/openfga-dynamic-contextual-tuples-anti-pollution-invariant?format=agents"}},{"id":"kmp-skiko-hardware-canvas-frame-budget-guardrail","title":"KMP Skiko Hardware Canvas Direct Frame Budget and Thread Deadlock Guardrail","category":"mobile","severity":"critical","description":"Enforces strict sub-millisecond draw allocations, lock-free render pipelines, and asynchronous GPU texture synchronization across iOS (Metal) and Android (Vulkan/GLES) targets using Skiko and Compose Multiplatform. Prevents main-thread starvation, display-link deadlocks, and missed 120Hz VSYNC frame budgets during direct hardware canvas interop.","antiPatternHeadline":"Allocating Skia native objects and acquiring synchronous locks inside direct Skiko hardware canvas draw passes.","stars_count":64,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kmp","skiko","compose-multiplatform","metal","vulkan","performance"],"exportEndpoints":{"claude":"/api/rules/kmp-skiko-hardware-canvas-frame-budget-guardrail?format=claude","cursorMdc":"/api/rules/kmp-skiko-hardware-canvas-frame-budget-guardrail?format=mdc","cursorrules":"/api/rules/kmp-skiko-hardware-canvas-frame-budget-guardrail?format=cursor","windsurf":"/api/rules/kmp-skiko-hardware-canvas-frame-budget-guardrail?format=windsurf","agents":"/api/rules/kmp-skiko-hardware-canvas-frame-budget-guardrail?format=agents"}},{"id":"capacitor-7-secure-enclave-biometric-key-wrapping","title":"Capacitor 7 Hardware-Backed Secure Enclave Biometric Key Wrapping Standard","category":"mobile","severity":"critical","description":"Enforces hardware-backed cryptographic envelope encryption for all persisted mobile session state and sensitive credentials in Capacitor 7 applications. Session keys must be wrapped using Key Encryption Keys (KEKs) bound directly to the Apple Secure Enclave or Android StrongBox KeyStore with biometric authentication gating, preventing offline token extraction via cold-boot or root exploits.","antiPatternHeadline":"Persisting raw authentication tokens or encryption keys in Capacitor Preferences, UserDefaults, or unauthenticated Keychains","stars_count":50,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","security","cryptography","secure-enclave","biometrics"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-secure-enclave-biometric-key-wrapping?format=claude","cursorMdc":"/api/rules/capacitor-7-secure-enclave-biometric-key-wrapping?format=mdc","cursorrules":"/api/rules/capacitor-7-secure-enclave-biometric-key-wrapping?format=cursor","windsurf":"/api/rules/capacitor-7-secure-enclave-biometric-key-wrapping?format=windsurf","agents":"/api/rules/capacitor-7-secure-enclave-biometric-key-wrapping?format=agents"}},{"id":"bpf-lsm-container-exec-path-verification-invariant","title":"BPF-LSM Kernel Space Container Executable Path and In-Memory Payload Verification","category":"devops","severity":"critical","description":"Enforces synchronous in-kernel validation of all binary execution attempts across multi-tenant Kubernetes nodes via BPF-LSM hooks (e.g., bprm_check_security). Rejects execution before user-space instruction scheduling if binaries originate from unapproved container paths, anonymous memory descriptors (memfd_create), or mount namespaces with untrusted inode lineages.","antiPatternHeadline":"Asynchronous Userspace Auditd/Tracepoint Filtering and Naive Path String Matching Vulnerable to TOCTOU and Fileless Payloads","stars_count":65,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","bpf-lsm","kubernetes","linux-security","container-hardening"],"exportEndpoints":{"claude":"/api/rules/bpf-lsm-container-exec-path-verification-invariant?format=claude","cursorMdc":"/api/rules/bpf-lsm-container-exec-path-verification-invariant?format=mdc","cursorrules":"/api/rules/bpf-lsm-container-exec-path-verification-invariant?format=cursor","windsurf":"/api/rules/bpf-lsm-container-exec-path-verification-invariant?format=windsurf","agents":"/api/rules/bpf-lsm-container-exec-path-verification-invariant?format=agents"}},{"id":"opentelemetry-zero-allocation-log-engine-invariant","title":"OpenTelemetry Native Zero-Allocation Ring-Buffer Log Pipeline Invariant","category":"devops","severity":"critical","description":"Enforces pre-allocated circular ring buffers and zero-copy OTLP binary serialization for edge logging pipelines. Prohibits dynamic heap allocations, unbounded queues, and intermediate string formatting during high-volume log ingestion. Guarantees deterministic upper-bounded memory footprints and backpressure shedding to prevent out-of-memory crashes during cascading failure cascades.","antiPatternHeadline":"Dynamic Heap-Allocated OTLP Log Records and Unbounded In-Flight Queues","stars_count":83,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","zero-allocation","memory-safety","otlp","edge-computing"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-zero-allocation-log-engine-invariant?format=claude","cursorMdc":"/api/rules/opentelemetry-zero-allocation-log-engine-invariant?format=mdc","cursorrules":"/api/rules/opentelemetry-zero-allocation-log-engine-invariant?format=cursor","windsurf":"/api/rules/opentelemetry-zero-allocation-log-engine-invariant?format=windsurf","agents":"/api/rules/opentelemetry-zero-allocation-log-engine-invariant?format=agents"}},{"id":"nextjs-15-ppr-dynamic-boundary-quarantine","title":"Next.js 15 PPR Dynamic Fallback Boundary Quarantine","category":"frontend","severity":"critical","description":"Mandates strict architectural quarantine for dynamic component trees under Next.js 15 Partial Prerendering (PPR). Prevents dynamic API calls (headers, cookies, connection, and uncached data fetching) from poisoning prerendered static edge shells during prefetch and initial render passes.","antiPatternHeadline":"Unconfined Dynamic Execution Leaking Beyond Suspense Boundaries During Edge Prefetch","stars_count":87,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs","nextjs-15","ppr","suspense","edge-cache","streaming"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-ppr-dynamic-boundary-quarantine?format=claude","cursorMdc":"/api/rules/nextjs-15-ppr-dynamic-boundary-quarantine?format=mdc","cursorrules":"/api/rules/nextjs-15-ppr-dynamic-boundary-quarantine?format=cursor","windsurf":"/api/rules/nextjs-15-ppr-dynamic-boundary-quarantine?format=windsurf","agents":"/api/rules/nextjs-15-ppr-dynamic-boundary-quarantine?format=agents"}},{"id":"speculation-rules-prerender-isolation-standard","title":"Speculation Rules API Prerender Sandbox & Credential Isolation Standard","category":"frontend","severity":"critical","description":"Enforces strict origin isolation, side-effect gating, and ephemeral partition boundaries for Speculation Rules API prerender candidates. Prevents side-channel timing attacks, cross-origin unpartitioned credential exfiltration, and premature invocation of stateful mutations during hidden speculative rendering.","antiPatternHeadline":"Unbounded Cross-Origin Prerender Injection and Ungated Lifecycle Mutation Side-Effects","stars_count":49,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","speculation-rules","prerender","web-security","side-channels","credential-isolation"],"exportEndpoints":{"claude":"/api/rules/speculation-rules-prerender-isolation-standard?format=claude","cursorMdc":"/api/rules/speculation-rules-prerender-isolation-standard?format=mdc","cursorrules":"/api/rules/speculation-rules-prerender-isolation-standard?format=cursor","windsurf":"/api/rules/speculation-rules-prerender-isolation-standard?format=windsurf","agents":"/api/rules/speculation-rules-prerender-isolation-standard?format=agents"}},{"id":"bun-serve-zero-copy-socket-buffer-ownership-invariant","title":"Bun 1.2 Bun.serve() Zero-Copy Socket Buffer Ownership Invariant","category":"backend","severity":"critical","description":"Bun's high-throughput I/O engine relies on native C++ socket ring buffers for HTTP/1.1, HTTP/2, and HTTP/3 streaming payloads. When consuming chunked streams via Bun.serve(), references to zero-copy Uint8Array views must not outlive the native reader lifecycle without explicit memory ownership transfer. Retaining or queueing raw borrowed views across microtask turns results in silent memory corruption or native use-after-free crashes.","antiPatternHeadline":"Retaining borrowed native socket views across asynchronous boundaries without explicit buffer detachment or memory copying.","stars_count":59,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","zero-copy","memory-safety","http3","streams"],"exportEndpoints":{"claude":"/api/rules/bun-serve-zero-copy-socket-buffer-ownership-invariant?format=claude","cursorMdc":"/api/rules/bun-serve-zero-copy-socket-buffer-ownership-invariant?format=mdc","cursorrules":"/api/rules/bun-serve-zero-copy-socket-buffer-ownership-invariant?format=cursor","windsurf":"/api/rules/bun-serve-zero-copy-socket-buffer-ownership-invariant?format=windsurf","agents":"/api/rules/bun-serve-zero-copy-socket-buffer-ownership-invariant?format=agents"}},{"id":"pgvector-hnsw-avx512-memory-alignment-guardrail","title":"pgvector 0.8+ AVX-512 64-Byte Memory Alignment and SIMD Invariant Guardrail","category":"backend","severity":"critical","description":"Enforces strict 64-byte memory boundary alignment and 16-element float32 dimension padding for pgvector 0.8+ embeddings in PostgreSQL 17 shared buffers. Prevents CPU alignment check faults (#AC), SIGBUS traps, and split-cache line performance regressions during AVX-512 SIMD-accelerated HNSW index distance scans.","antiPatternHeadline":"Unaligned Vector Buffer Allocations and Non-Padded Embeddings Triggering AVX-512 CPU Traps and SIMD Degradation","stars_count":104,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","pgvector","hnsw","avx-512","simd","memory-alignment","performance"],"exportEndpoints":{"claude":"/api/rules/pgvector-hnsw-avx512-memory-alignment-guardrail?format=claude","cursorMdc":"/api/rules/pgvector-hnsw-avx512-memory-alignment-guardrail?format=mdc","cursorrules":"/api/rules/pgvector-hnsw-avx512-memory-alignment-guardrail?format=cursor","windsurf":"/api/rules/pgvector-hnsw-avx512-memory-alignment-guardrail?format=windsurf","agents":"/api/rules/pgvector-hnsw-avx512-memory-alignment-guardrail?format=agents"}},{"id":"tauri-mobile-granular-capability-scoping-standard","title":"Tauri 2.0 Mobile Granular IPC Capability and Command Scoping Standard","category":"mobile","severity":"critical","description":"Enforces strict compile-time capability scoping for Tauri 2.0 native IPC handlers across mobile platforms (Android and iOS). Prevents compromised webview components from executing unpermitted system APIs, filesystem modifications, or native mobile plugins by replacing blanket defaults with compartmentalized, platform-specific capability manifests and granular parameter scopes.","antiPatternHeadline":"Assigning global default permissions or unconstrained plugin capability scopes across mobile webviews","stars_count":58,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri-v2","ipc-security","capabilities","android","ios","access-control"],"exportEndpoints":{"claude":"/api/rules/tauri-mobile-granular-capability-scoping-standard?format=claude","cursorMdc":"/api/rules/tauri-mobile-granular-capability-scoping-standard?format=mdc","cursorrules":"/api/rules/tauri-mobile-granular-capability-scoping-standard?format=cursor","windsurf":"/api/rules/tauri-mobile-granular-capability-scoping-standard?format=windsurf","agents":"/api/rules/tauri-mobile-granular-capability-scoping-standard?format=agents"}},{"id":"skiko-gpu-surface-detach-guardrail","title":"Compose Multiplatform Skiko GPU Surface Detach Lifecycle Synchronization","category":"mobile","severity":"critical","description":"Enforces synchronous GPU fence completion and deterministic native surface teardown during Compose Multiplatform view transitions and window detachment. Prevents VK_ERROR_DEVICE_LOST, Metal command buffer failures, and catastrophic native Skia context memory leaks caused by tearing down surfaces with inflight draw calls.","antiPatternHeadline":"Asynchronous or Unsynchronized View Teardown Corrupting Native Skia/Skiko GPU State","stars_count":45,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","compose-multiplatform","skiko","metal","vulkan","graphics-pipeline"],"exportEndpoints":{"claude":"/api/rules/skiko-gpu-surface-detach-guardrail?format=claude","cursorMdc":"/api/rules/skiko-gpu-surface-detach-guardrail?format=mdc","cursorrules":"/api/rules/skiko-gpu-surface-detach-guardrail?format=cursor","windsurf":"/api/rules/skiko-gpu-surface-detach-guardrail?format=windsurf","agents":"/api/rules/skiko-gpu-surface-detach-guardrail?format=agents"}},{"id":"tls-mlkem-hybrid-downgrade-guardrail","title":"TLS 1.3 ML-KEM Post-Quantum Hybrid Key Exchange Downgrade Guardrail","category":"security","severity":"critical","description":"Enforces strict cryptographic abort invariants on edge ingress and reverse proxy layers when an active intermediary or configuration flaw attempts to downgrade ML-KEM hybrid key encapsulation. Edge termination services must reject classical-only key agreement whenever the client advertises post-quantum hybrid capabilities (e.g., X25519MLKEM768), preventing 'store now, decrypt later' exploits facilitated by silent handshake downgrades.","antiPatternHeadline":"Silent fallback to classical ECDH when clients advertise ML-KEM post-quantum hybrid key encapsulation.","stars_count":54,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","tls-1-3","ml-kem","post-quantum","cryptography","zero-trust"],"exportEndpoints":{"claude":"/api/rules/tls-mlkem-hybrid-downgrade-guardrail?format=claude","cursorMdc":"/api/rules/tls-mlkem-hybrid-downgrade-guardrail?format=mdc","cursorrules":"/api/rules/tls-mlkem-hybrid-downgrade-guardrail?format=cursor","windsurf":"/api/rules/tls-mlkem-hybrid-downgrade-guardrail?format=windsurf","agents":"/api/rules/tls-mlkem-hybrid-downgrade-guardrail?format=agents"}},{"id":"authzen-pep-pdp-signed-context-envelope-guardrail","title":"AuthZEN PEP-to-PDP Signed Dynamic Context Envelope Propagation","category":"security","severity":"critical","description":"Mandates that all dynamic contextual authorization payloads transmitted between Policy Enforcement Points (PEPs) and Policy Decision Points (PDPs) across microservice boundaries are encapsulated within cryptographically signed, immutable envelopes. Prevents PDP cache poisoning, context tampering, and Time-of-Check to Time-of-Use (TOCTOU) authorization drift by enforcing asymmetric JWS/PASETO validation and deterministic context-hash cache derivation.","antiPatternHeadline":"Propagating Mutable, Unsigned Raw JSON Authorization Context Across Distributed PEP-PDP Boundaries","stars_count":73,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","authzen","authorization","pep","pdp","cryptography","zero-trust"],"exportEndpoints":{"claude":"/api/rules/authzen-pep-pdp-signed-context-envelope-guardrail?format=claude","cursorMdc":"/api/rules/authzen-pep-pdp-signed-context-envelope-guardrail?format=mdc","cursorrules":"/api/rules/authzen-pep-pdp-signed-context-envelope-guardrail?format=cursor","windsurf":"/api/rules/authzen-pep-pdp-signed-context-envelope-guardrail?format=windsurf","agents":"/api/rules/authzen-pep-pdp-signed-context-envelope-guardrail?format=agents"}},{"id":"otel-otlp-arrow-columnar-batching-dynamic-backpressure-standard","title":"OTel OTLP-Arrow Adaptive Columnar Batching and Memory Buffer Rationing Standard","category":"devops","severity":"critical","description":"Enforces strict heap rationing, adaptive stream batch sizing, and proactive backpressure signaling for OTLP ingestion over Apache Arrow record batches. Prevents OpenTelemetry Collector out-of-memory (OOM) cascades caused by schema explosions and uncontrolled columnar dictionary allocations under high-cardinality telemetry loads.","antiPatternHeadline":"Unbounded Arrow Record Batching with Fixed-Size Ingestion Buffers Leading to Collector OOM Cascades","stars_count":84,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","apache-arrow","otlp","backpressure","observability","memory-management"],"exportEndpoints":{"claude":"/api/rules/otel-otlp-arrow-columnar-batching-dynamic-backpressure-standard?format=claude","cursorMdc":"/api/rules/otel-otlp-arrow-columnar-batching-dynamic-backpressure-standard?format=mdc","cursorrules":"/api/rules/otel-otlp-arrow-columnar-batching-dynamic-backpressure-standard?format=cursor","windsurf":"/api/rules/otel-otlp-arrow-columnar-batching-dynamic-backpressure-standard?format=windsurf","agents":"/api/rules/otel-otlp-arrow-columnar-batching-dynamic-backpressure-standard?format=agents"}},{"id":"ebpf-tail-call-stack-limit-standard","title":"eBPF BPF-to-BPF Tail-Call Recursion & Stack-Limit Standard","category":"devops","severity":"critical","description":"Enforces strict stack frame boundaries and deterministic execution limits across chained BPF programs to eliminate kernel stack exhaustion and verifier rejections during high-frequency L4 ingress tracing. Mitigates kernel panic vectors stemming from unbounded BPF-to-BPF function nesting combined with dynamic tail-call recursion. Mandates per-CPU scratchpad offloading for payload parsing buffers exceeding eBPF's 512-byte stack frame limit.","antiPatternHeadline":"Unbounded prog_array tail-call dispatch with deep stack-allocated L4 ingress parsing buffers","stars_count":64,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","kernel","tail-calls","xdp","networking"],"exportEndpoints":{"claude":"/api/rules/ebpf-tail-call-stack-limit-standard?format=claude","cursorMdc":"/api/rules/ebpf-tail-call-stack-limit-standard?format=mdc","cursorrules":"/api/rules/ebpf-tail-call-stack-limit-standard?format=cursor","windsurf":"/api/rules/ebpf-tail-call-stack-limit-standard?format=windsurf","agents":"/api/rules/ebpf-tail-call-stack-limit-standard?format=agents"}},{"id":"react-19-rsc-taint-cryptographic-boundary","title":"React 19 RSC Cryptographic Boundary & Tainted Values Quarantine","category":"frontend","severity":"critical","description":"Enforces strict isolation of cryptographic keys, sensitive credentials, and unhashed tokens within React 19 Server Components using experimental_taintUniqueValue and experimental_taintObjectReference. Guarantees that private server-side security primitives are never serialized across the RSC Flight protocol to client component trees.","antiPatternHeadline":"Exposing Raw Cryptographic Material and Plaintext Secrets to RSC Client Serialization Payloads","stars_count":73,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","rsc","taint-api","cryptography","security","flight-protocol"],"exportEndpoints":{"claude":"/api/rules/react-19-rsc-taint-cryptographic-boundary?format=claude","cursorMdc":"/api/rules/react-19-rsc-taint-cryptographic-boundary?format=mdc","cursorrules":"/api/rules/react-19-rsc-taint-cryptographic-boundary?format=cursor","windsurf":"/api/rules/react-19-rsc-taint-cryptographic-boundary?format=windsurf","agents":"/api/rules/react-19-rsc-taint-cryptographic-boundary?format=agents"}},{"id":"nextjs-15-distributed-cache-stampede-mutex","title":"Next.js 15 Distributed Cache Stampede Mutex Invariant","category":"frontend","severity":"critical","description":"Enforces distributed atomic locking with soft-lease mechanics across multi-region serverless runtimes during Next.js 15 Incremental Cache revalidation. Prevents catastrophic thundering herd database collapse by ensuring exactly one worker recomputes expired cache keys while concurrent serverless invocations serve soft-stale payloads.","antiPatternHeadline":"Uncoordinated Multi-Region Serverless Revalidation Triggering Database Connection Saturation and Outages","stars_count":43,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs","caching","serverless","distributed-systems","redis"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-distributed-cache-stampede-mutex?format=claude","cursorMdc":"/api/rules/nextjs-15-distributed-cache-stampede-mutex?format=mdc","cursorrules":"/api/rules/nextjs-15-distributed-cache-stampede-mutex?format=cursor","windsurf":"/api/rules/nextjs-15-distributed-cache-stampede-mutex?format=windsurf","agents":"/api/rules/nextjs-15-distributed-cache-stampede-mutex?format=agents"}},{"id":"fastapi-async-dependency-teardown-invariant","title":"FastAPI Async Dependency Lifecycle and Early-Disconnect Teardown Invariant","category":"backend","severity":"critical","description":"Enforces deterministic teardown execution for nested async generators and context managers (such as SQLAlchemy AsyncSessions or Redis transaction pipelines) used within FastAPI dependency injection trees. Prevents connection leaks, orphaned transactions, and hanging locks triggered when clients disconnect prematurely during request processing or async streaming. Mandates strict try/finally semantics, shielded background cleanup tasks, and ASGI-level disconnect handling.","antiPatternHeadline":"Unshielded Dependency Generators Leaking Connection Pool Handles on Cancelled Tasks During Client Disconnect","stars_count":84,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","asyncio","sqlalchemy","connection-pool","dependency-injection"],"exportEndpoints":{"claude":"/api/rules/fastapi-async-dependency-teardown-invariant?format=claude","cursorMdc":"/api/rules/fastapi-async-dependency-teardown-invariant?format=mdc","cursorrules":"/api/rules/fastapi-async-dependency-teardown-invariant?format=cursor","windsurf":"/api/rules/fastapi-async-dependency-teardown-invariant?format=windsurf","agents":"/api/rules/fastapi-async-dependency-teardown-invariant?format=agents"}},{"id":"postgres-17-streaming-direct-io-memory-boundary","title":"Postgres 17 Streaming Direct I/O Buffer Pool and Worker Memory Bounds","category":"backend","severity":"critical","description":"Postgres 17 introduces streaming read-ahead and direct I/O infrastructures that allocate asynchronous user-space buffers outside the traditional shared_buffers pool. Unbounded parallel analytic scans bypassing the OS page cache will rapidly multiply process resident set size (RSS) across concurrent backends, provoking Linux OOM killer termination of the postmaster. Database access layers and query engines must enforce session-scoped I/O concurrency caps, limit parallel gather workers, and enforce streaming chunk windows.","antiPatternHeadline":"Unbounded Direct I/O Read-Ahead and Parallelism Causing Kernel OOM Killer Panics","stars_count":84,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres","postgres-17","direct-io","memory-management","performance"],"exportEndpoints":{"claude":"/api/rules/postgres-17-streaming-direct-io-memory-boundary?format=claude","cursorMdc":"/api/rules/postgres-17-streaming-direct-io-memory-boundary?format=mdc","cursorrules":"/api/rules/postgres-17-streaming-direct-io-memory-boundary?format=cursor","windsurf":"/api/rules/postgres-17-streaming-direct-io-memory-boundary?format=windsurf","agents":"/api/rules/postgres-17-streaming-direct-io-memory-boundary?format=agents"}},{"id":"bun-ffi-pointer-ownership-lifecycle-standard","title":"Bun 1.2 Native FFI Deterministic Pointer Ownership and Deallocation Standard","category":"backend","severity":"critical","description":"Establishes strict boundaries between JavaScriptCore (JSC) garbage-collected references and native C/Rust heap memory managed through `bun:ffi`. Mandates explicit ownership transfer, deterministic disposal using `Symbol.dispose` via TypeScript 5.2+ explicit resource management, and double-free mitigation via nullification invariants.","antiPatternHeadline":"Implicit pointer lifetimes, unmanaged raw addresses, and asynchronous garbage-collection reliance causing memory leaks or use-after-free/double-free crashes.","stars_count":108,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","ffi","memory-management","c-interop","rust-interop"],"exportEndpoints":{"claude":"/api/rules/bun-ffi-pointer-ownership-lifecycle-standard?format=claude","cursorMdc":"/api/rules/bun-ffi-pointer-ownership-lifecycle-standard?format=mdc","cursorrules":"/api/rules/bun-ffi-pointer-ownership-lifecycle-standard?format=cursor","windsurf":"/api/rules/bun-ffi-pointer-ownership-lifecycle-standard?format=windsurf","agents":"/api/rules/bun-ffi-pointer-ownership-lifecycle-standard?format=agents"}},{"id":"go-chi-context-deadline-propagation-barrier","title":"Go Chi Context Deadline Propagation and Goroutine Barrier Standard","category":"backend","severity":"critical","description":"Enforces strict bidirectional context cancellation, monotonic deadline propagation, and bounded goroutine pool drainage across Go Chi HTTP middleware chains. Eliminates phantom processing, compute leaks, and connection exhaustion caused by orphaned goroutines continuing work after client disconnection or timeout triggers.","antiPatternHeadline":"Spawning detached goroutines or ignoring request context cancellation in deep Chi middleware and handlers.","stars_count":117,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","chi","concurrency","context","goroutines","performance"],"exportEndpoints":{"claude":"/api/rules/go-chi-context-deadline-propagation-barrier?format=claude","cursorMdc":"/api/rules/go-chi-context-deadline-propagation-barrier?format=mdc","cursorrules":"/api/rules/go-chi-context-deadline-propagation-barrier?format=cursor","windsurf":"/api/rules/go-chi-context-deadline-propagation-barrier?format=windsurf","agents":"/api/rules/go-chi-context-deadline-propagation-barrier?format=agents"}},{"id":"kmp-compose-texture-memory-lifecycle-guardrail","title":"KMP Compose Multiplatform Texture Memory Lifecycle Guardrail","category":"mobile","severity":"critical","description":"Enforces deterministic lifecycle management and cleanup for Skia/Skiko native graphic textures across iOS Metal and Android Vulkan backends. Prevents unbounded VRAM leaks and graphics pipeline hangs caused by decoupled Kotlin Native/JVM garbage collection during rapid view composition and navigation unmounts.","antiPatternHeadline":"Retaining Raw Skia/Platform Textures in Composition Without Deterministic Native Deallocation","stars_count":104,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kmp","compose-multiplatform","skiko","metal","vulkan","memory-leak"],"exportEndpoints":{"claude":"/api/rules/kmp-compose-texture-memory-lifecycle-guardrail?format=claude","cursorMdc":"/api/rules/kmp-compose-texture-memory-lifecycle-guardrail?format=mdc","cursorrules":"/api/rules/kmp-compose-texture-memory-lifecycle-guardrail?format=cursor","windsurf":"/api/rules/kmp-compose-texture-memory-lifecycle-guardrail?format=windsurf","agents":"/api/rules/kmp-compose-texture-memory-lifecycle-guardrail?format=agents"}},{"id":"webauthn-device-bound-attestation-verification-boundary","title":"Mandate Strict FIDO2 MDS3 Root-of-Trust Attestation for Device-Bound Enterprise Passkeys","category":"security","severity":"critical","description":"Enforces cryptographic authenticator attestation certificate chain validation against trusted FIDO Alliance Metadata Service (MDS) roots during WebAuthn enrollment. Rejects unvalidated attestation formats, software-backed credentials, and untrusted AAGUIDs to prevent unauthorized multi-device passkeys in zero-trust architectures.","antiPatternHeadline":"Accepting 'none' attestation or bypassing x5c trust anchor validation during credential registration","stars_count":102,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","fido2","passkeys","attestation","zero-trust","cryptography"],"exportEndpoints":{"claude":"/api/rules/webauthn-device-bound-attestation-verification-boundary?format=claude","cursorMdc":"/api/rules/webauthn-device-bound-attestation-verification-boundary?format=mdc","cursorrules":"/api/rules/webauthn-device-bound-attestation-verification-boundary?format=cursor","windsurf":"/api/rules/webauthn-device-bound-attestation-verification-boundary?format=windsurf","agents":"/api/rules/webauthn-device-bound-attestation-verification-boundary?format=agents"}},{"id":"openfga-cyclic-transitive-graph-evaluation-boundary","title":"Deterministic Recursion and Cycle Boundary Enforcement for OpenFGA ReBAC Graphs","category":"security","severity":"critical","description":"Enforces strict recursion depth limits, graph cycle detection, and compute budgets during relationship-based access control (ReBAC) graph resolution in OpenFGA. Prevents compute exhaustion and denial-of-service attacks caused by cyclic tuple insertions or deeply nested transitive relationship expansions.","antiPatternHeadline":"Unbounded Recursive Tuple Traversal and Unchecked Cyclic Relationship Expansions","stars_count":109,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","rebac","zanzibar","graph-security","dos-prevention"],"exportEndpoints":{"claude":"/api/rules/openfga-cyclic-transitive-graph-evaluation-boundary?format=claude","cursorMdc":"/api/rules/openfga-cyclic-transitive-graph-evaluation-boundary?format=mdc","cursorrules":"/api/rules/openfga-cyclic-transitive-graph-evaluation-boundary?format=cursor","windsurf":"/api/rules/openfga-cyclic-transitive-graph-evaluation-boundary?format=windsurf","agents":"/api/rules/openfga-cyclic-transitive-graph-evaluation-boundary?format=agents"}},{"id":"otel-w3c-baggage-pii-scrubbing-pipeline","title":"OpenTelemetry W3C Baggage PII Scrubbing and Quarantine Invariant","category":"devops","severity":"critical","description":"Enforces an automated, zero-trust schema validation and cryptographic sanitization pipeline on all outbound and inbound W3C Baggage headers across microservice perimeters. Precludes regulatory PII/PHI leakage by rejecting untyped passthrough propagation, stripping unapproved baggage keys, and routing malformed or suspicious baggage payloads into isolated telemetry quarantine sinks.","antiPatternHeadline":"Blind In-Flight Baggage Header Passthrough and Unchecked Context Injection","stars_count":117,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","security","pii-compliance","w3c-baggage","tracing"],"exportEndpoints":{"claude":"/api/rules/otel-w3c-baggage-pii-scrubbing-pipeline?format=claude","cursorMdc":"/api/rules/otel-w3c-baggage-pii-scrubbing-pipeline?format=mdc","cursorrules":"/api/rules/otel-w3c-baggage-pii-scrubbing-pipeline?format=cursor","windsurf":"/api/rules/otel-w3c-baggage-pii-scrubbing-pipeline?format=windsurf","agents":"/api/rules/otel-w3c-baggage-pii-scrubbing-pipeline?format=agents"}},{"id":"svelte5-runes-effect-scope-lifecycle-invariant","title":"Svelte 5 Runes Reactive Effect Scope Lifecycle and Cleanup Invariant","category":"frontend","severity":"critical","description":"Enforces strict scope boundaries and deterministic teardown for Svelte 5 $effect and $effect.root runes in long-lived client microfrontends. Guarantees that asynchronous operations, streaming subscriptions, and fine-grained signal dependencies register synchronous cleanup routines to prevent memory retention and detached subtree execution.","antiPatternHeadline":"Dangling Asynchronous Event Subscriptions and Unbounded Memory Leaks via Implicit Effect Context Loss","stars_count":78,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","memory-management","microfrontends","reactivity"],"exportEndpoints":{"claude":"/api/rules/svelte5-runes-effect-scope-lifecycle-invariant?format=claude","cursorMdc":"/api/rules/svelte5-runes-effect-scope-lifecycle-invariant?format=mdc","cursorrules":"/api/rules/svelte5-runes-effect-scope-lifecycle-invariant?format=cursor","windsurf":"/api/rules/svelte5-runes-effect-scope-lifecycle-invariant?format=windsurf","agents":"/api/rules/svelte5-runes-effect-scope-lifecycle-invariant?format=agents"}},{"id":"bun-websocket-zero-copy-backpressure-standard","title":"Bun 1.2 Native WebSocket Zero-Copy Kernel Backpressure Standard","category":"backend","severity":"critical","description":"Enforces deterministic zero-copy kernel backpressure propagation across Bun 1.2 native WebSockets by binding OS socket buffer high-water marks directly to upstream async iterable stream consumption. Eliminates silent userland heap queue ballooning and engine out-of-memory crashes during high-throughput producer-consumer velocity mismatches. Mandates reactive pause/resume mechanics keyed to socket buffer saturation and native drain event dispatch.","antiPatternHeadline":"Unbounded ws.send() stream iterations without drain-gate synchronization causing fatal heap exhaustion.","stars_count":106,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","websockets","backpressure","zero-copy","streams"],"exportEndpoints":{"claude":"/api/rules/bun-websocket-zero-copy-backpressure-standard?format=claude","cursorMdc":"/api/rules/bun-websocket-zero-copy-backpressure-standard?format=mdc","cursorrules":"/api/rules/bun-websocket-zero-copy-backpressure-standard?format=cursor","windsurf":"/api/rules/bun-websocket-zero-copy-backpressure-standard?format=windsurf","agents":"/api/rules/bun-websocket-zero-copy-backpressure-standard?format=agents"}},{"id":"axum-tower-concurrency-load-shedding-invariant","title":"Axum 0.8 Tower Concurrency Limit and Ingress Load-Shedding Invariant","category":"backend","severity":"critical","description":"Eliminates distributed thread starvation and Tokio executor deadlocks by strictly bounding middleware queue latency and ingress worker concurrency. Mandates deterministic load shedding with explicit HTTP 503 error handling to fail fast under cascade failure scenarios.","antiPatternHeadline":"Unbounded Task Buffering and Raw Concurrency Limits Causing Tokio Executor Deadlocks","stars_count":77,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tower","tokio","concurrency","resilience"],"exportEndpoints":{"claude":"/api/rules/axum-tower-concurrency-load-shedding-invariant?format=claude","cursorMdc":"/api/rules/axum-tower-concurrency-load-shedding-invariant?format=mdc","cursorrules":"/api/rules/axum-tower-concurrency-load-shedding-invariant?format=cursor","windsurf":"/api/rules/axum-tower-concurrency-load-shedding-invariant?format=windsurf","agents":"/api/rules/axum-tower-concurrency-load-shedding-invariant?format=agents"}},{"id":"postgres-17-json-table-streaming-memory-envelope","title":"Postgres 17 JSON_TABLE Streaming Projection Memory Envelope","category":"backend","severity":"critical","description":"Governs SQL/JSON JSON_TABLE transformations in PostgreSQL 17 to eliminate backend worker out-of-memory termination during high-cardinality JSONB shredding. Mandates explicit typed projections, bounded nested path evaluations, and chunked cursor-driven ingestion to ensure transformations execute strictly within designated backend working memory limits.","antiPatternHeadline":"Monolithic unpartitioned JSON_TABLE projections across unbounded JSONB datasets exhausting backend working memory and triggering OS OOM termination.","stars_count":105,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql-17","json-table","jsonb","memory-envelope","performance"],"exportEndpoints":{"claude":"/api/rules/postgres-17-json-table-streaming-memory-envelope?format=claude","cursorMdc":"/api/rules/postgres-17-json-table-streaming-memory-envelope?format=mdc","cursorrules":"/api/rules/postgres-17-json-table-streaming-memory-envelope?format=cursor","windsurf":"/api/rules/postgres-17-json-table-streaming-memory-envelope?format=windsurf","agents":"/api/rules/postgres-17-json-table-streaming-memory-envelope?format=agents"}},{"id":"tauri-v2-multiwindow-ipc-sandboxing-standard","title":"Tauri 2.0 Multi-Window IPC Capability Sandboxing Standard","category":"mobile","severity":"critical","description":"Enforces fine-grained, cryptographically verifiable Access Control Lists (ACL) on inter-process communication (IPC) bridges between multi-window Webview contexts and native host system APIs in Tauri 2.0. Prohibits global wildcard capability bindings and mandates window-scoped, remote-domain-isolated permission manifests to mitigate remote code execution via compromised webview instances. Guarantees that secondary webviews (including OAuth or mobile in-app browser contexts) operate in zero-trust sandboxes without access to native shell, filesystem, or sensitive hardware plugins.","antiPatternHeadline":"Assigning global wildcard permission capabilities to all webview labels and executing unscoped IPC invocations across privileged and unprivileged windows","stars_count":54,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri","ipc","sandboxing","rust","security"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-multiwindow-ipc-sandboxing-standard?format=claude","cursorMdc":"/api/rules/tauri-v2-multiwindow-ipc-sandboxing-standard?format=mdc","cursorrules":"/api/rules/tauri-v2-multiwindow-ipc-sandboxing-standard?format=cursor","windsurf":"/api/rules/tauri-v2-multiwindow-ipc-sandboxing-standard?format=windsurf","agents":"/api/rules/tauri-v2-multiwindow-ipc-sandboxing-standard?format=agents"}},{"id":"kmp-hardware-remote-attestation-standard","title":"KMP Secure Hardware Key Remote Attestation Invariant Standard","category":"mobile","severity":"critical","description":"Enforces strict cryptographic guarantees for Kotlin Multiplatform (KMP) remote attestation unifying Android KeyStore StrongBox and Apple Secure Enclave (DCAppAttestService). Requires strict separation of client-side key generation from attestation issuance, mandatory inclusion of server-provided cryptographically random nonces inside attestation extensions, and zero reliance on client-side certificate chain verification.","antiPatternHeadline":"Client-Side Self-Attestation Validation and Replayable Local Nonce Generation","stars_count":104,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kmp","cryptography","strongbox","secure-enclave","app-attest","hardware-security"],"exportEndpoints":{"claude":"/api/rules/kmp-hardware-remote-attestation-standard?format=claude","cursorMdc":"/api/rules/kmp-hardware-remote-attestation-standard?format=mdc","cursorrules":"/api/rules/kmp-hardware-remote-attestation-standard?format=cursor","windsurf":"/api/rules/kmp-hardware-remote-attestation-standard?format=windsurf","agents":"/api/rules/kmp-hardware-remote-attestation-standard?format=agents"}},{"id":"otel-genai-baggage-context-causality-invariant","title":"OpenTelemetry GenAI Semantic Protocol Baggage and Distributed Causality Invariant","category":"devops","severity":"critical","description":"Enforces strict distributed context propagation and W3C Baggage preservation across asynchronous streaming LLM pipelines and multi-agent DAGs. Mandates deterministic recording of OpenTelemetry GenAI semantic conventions, Time-to-First-Token (TTFT) metrics, and cost-attribution baggage across asynchronous yield boundaries without context detachment.","antiPatternHeadline":"Context bleed and detached trace causality during async generator stream iteration leading to unallocated token costs and missing TTFT metrics.","stars_count":119,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","genai","tracing","distributed-systems","streaming"],"exportEndpoints":{"claude":"/api/rules/otel-genai-baggage-context-causality-invariant?format=claude","cursorMdc":"/api/rules/otel-genai-baggage-context-causality-invariant?format=mdc","cursorrules":"/api/rules/otel-genai-baggage-context-causality-invariant?format=cursor","windsurf":"/api/rules/otel-genai-baggage-context-causality-invariant?format=windsurf","agents":"/api/rules/otel-genai-baggage-context-causality-invariant?format=agents"}},{"id":"k8s-1-32-inplace-pod-resize-state-machine","title":"Kubernetes 1.32 In-Place Pod Vertical Scaling State Machine and HPA Synchronization","category":"devops","severity":"critical","description":"Enforces strict conformance to Kubernetes 1.32 In-Place Pod Vertical Scaling state transitions (Proposed, InProgress, Deferred, Infeasible) and cgroup v2 dynamic reallocation without restart churn. Mandates explicit resizePolicy definitions and locks horizontal autoscaler stabilization windows to prevent dual-axis autoscaling race conditions.","antiPatternHeadline":"Unsynchronized Pod Resource Patching Triggering Silent Restarts and Autoscaler Thrashing","stars_count":80,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","kubernetes","cgroupv2","autoscaling","vpa","hpa","k8s-1-32"],"exportEndpoints":{"claude":"/api/rules/k8s-1-32-inplace-pod-resize-state-machine?format=claude","cursorMdc":"/api/rules/k8s-1-32-inplace-pod-resize-state-machine?format=mdc","cursorrules":"/api/rules/k8s-1-32-inplace-pod-resize-state-machine?format=cursor","windsurf":"/api/rules/k8s-1-32-inplace-pod-resize-state-machine?format=windsurf","agents":"/api/rules/k8s-1-32-inplace-pod-resize-state-machine?format=agents"}},{"id":"svelte-5-runes-async-lifecycle-effect-root-teardown","title":"Svelte 5 Runes Async Lifecycle & $effect.root Teardown Standard","category":"frontend","severity":"critical","description":"Enforces deterministic teardown of reactive dependencies and effects across asynchronous execution contexts and non-component modules in Svelte 5. Prevents catastrophic client-side memory leaks and zombie listeners caused by orphaned effects spawned across microtask boundaries or outside owner hierarchies.","antiPatternHeadline":"Orphaned Reactive Effects via Async Microtasks and Unscoped Non-Component Root Subscriptions","stars_count":51,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["svelte","svelte5","runes","memory-leaks","async-lifecycle","frontend"],"exportEndpoints":{"claude":"/api/rules/svelte-5-runes-async-lifecycle-effect-root-teardown?format=claude","cursorMdc":"/api/rules/svelte-5-runes-async-lifecycle-effect-root-teardown?format=mdc","cursorrules":"/api/rules/svelte-5-runes-async-lifecycle-effect-root-teardown?format=cursor","windsurf":"/api/rules/svelte-5-runes-async-lifecycle-effect-root-teardown?format=windsurf","agents":"/api/rules/svelte-5-runes-async-lifecycle-effect-root-teardown?format=agents"}},{"id":"nextjs-15-dynamic-io-ppr-suspense-boundaries","title":"Mandatory Suspense Encapsulation for Next.js 15 Dynamic IO and PPR","category":"frontend","severity":"critical","description":"Enforces that any uncached runtime data access, dynamic APIs (headers, cookies, searchParams), or uncached database operations under Next.js 15 dynamicIO/Partial Prerendering (PPR) are encapsulated within dedicated, isolated React Suspense boundaries. Prevents runtime de-optimization cascades where an uncached operation at a page or root layout level bubbles up and forces an entire static shell into dynamic runtime execution.","antiPatternHeadline":"Leaking Dynamic IO and Runtime APIs to Page-Level Shells De-optimizing Static Partial Prerendering","stars_count":97,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs","react19","dynamic-io","ppr","suspense","server-components"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-dynamic-io-ppr-suspense-boundaries?format=claude","cursorMdc":"/api/rules/nextjs-15-dynamic-io-ppr-suspense-boundaries?format=mdc","cursorrules":"/api/rules/nextjs-15-dynamic-io-ppr-suspense-boundaries?format=cursor","windsurf":"/api/rules/nextjs-15-dynamic-io-ppr-suspense-boundaries?format=windsurf","agents":"/api/rules/nextjs-15-dynamic-io-ppr-suspense-boundaries?format=agents"}},{"id":"openfga-zanzibar-cyclic-traversal-depth-governor","title":"Deterministic Traversal Depth and Cycle Governance for OpenFGA Contextual Tuples","category":"security","severity":"critical","description":"Enforces strict recursion depth bounding and deterministic cycle memoization during real-time OpenFGA and Zanzibar authorization checks. Prevents stack exhaustion, authorization service denial-of-service (DoS), and unbounded RPC fan-out caused by circular or deeply nested contextual relationships. Mandates fail-closed semantics and visited-node state tracking across all graph traversal boundaries.","antiPatternHeadline":"Unbounded Contextual Tuple Ingestion and Recursive Graph Traversal Without Cycle Detection","stars_count":55,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","zanzibar","authorization","graph-traversal","dos-prevention"],"exportEndpoints":{"claude":"/api/rules/openfga-zanzibar-cyclic-traversal-depth-governor?format=claude","cursorMdc":"/api/rules/openfga-zanzibar-cyclic-traversal-depth-governor?format=mdc","cursorrules":"/api/rules/openfga-zanzibar-cyclic-traversal-depth-governor?format=cursor","windsurf":"/api/rules/openfga-zanzibar-cyclic-traversal-depth-governor?format=windsurf","agents":"/api/rules/openfga-zanzibar-cyclic-traversal-depth-governor?format=agents"}},{"id":"pg17-replication-slot-failover-sync-invariant","title":"PostgreSQL 17 Replication Slot Failover Synchronization Invariant","category":"backend","severity":"critical","description":"Mandates explicit logical replication slot state synchronization across physical read replicas using PostgreSQL 17 slot failover primitives. Prevents downstream CDC data loss, replay holes, and broken subscriber streams during HA standby promotion.","antiPatternHeadline":"Creating Logical Slots Without Failover Capabilities or synchronized_standby_slots Interlocks","stars_count":71,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","database","high-availability","cdc","replication","pg17"],"exportEndpoints":{"claude":"/api/rules/pg17-replication-slot-failover-sync-invariant?format=claude","cursorMdc":"/api/rules/pg17-replication-slot-failover-sync-invariant?format=mdc","cursorrules":"/api/rules/pg17-replication-slot-failover-sync-invariant?format=cursor","windsurf":"/api/rules/pg17-replication-slot-failover-sync-invariant?format=windsurf","agents":"/api/rules/pg17-replication-slot-failover-sync-invariant?format=agents"}},{"id":"bun-subprocess-piped-stream-backpressure-quota","title":"Bun 1.2 Subprocess Piped Stream Backpressure & FD Quota Standard","category":"backend","severity":"critical","description":"Enforces bounded concurrency pooling, proactive pipe stream draining, and deterministic resource lifecycle disposal for Bun.spawn subprocesses. Prevents kernel pipe buffer deadlocks and silent file descriptor (FD) exhaustion under high-throughput IPC orchestration.","antiPatternHeadline":"Unbounded Bun Subprocess Spawning with Unconsumed Pipes Causing Buffer Deadlocks and EMFILE Starvation","stars_count":52,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","subprocesses","concurrency","streams","backpressure","ipc"],"exportEndpoints":{"claude":"/api/rules/bun-subprocess-piped-stream-backpressure-quota?format=claude","cursorMdc":"/api/rules/bun-subprocess-piped-stream-backpressure-quota?format=mdc","cursorrules":"/api/rules/bun-subprocess-piped-stream-backpressure-quota?format=cursor","windsurf":"/api/rules/bun-subprocess-piped-stream-backpressure-quota?format=windsurf","agents":"/api/rules/bun-subprocess-piped-stream-backpressure-quota?format=agents"}},{"id":"tauri-v2-multi-webview-ipc-scoped-quarantine-standard","title":"Tauri 2.0 Multi-Webview IPC Capability Scoping & Privilege Quarantine Standard","category":"mobile","severity":"critical","description":"Enforces strict principle-of-least-privilege capability mapping across distinct window and webview instances in Tauri 2.0 mobile and desktop architectures. Prevents cross-context native privilege escalation by isolating security-sensitive Rust IPC commands and plugin capabilities to explicitly targeted webview labels. Mandates default-deny capability files and rejects wildcard window bindings across multi-webview environments.","antiPatternHeadline":"Wildcard Capability Permissiveness and Shared Native Access Across Untrusted Auxiliary Webviews","stars_count":119,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri","tauri-v2","ipc-security","rust","capabilities"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-multi-webview-ipc-scoped-quarantine-standard?format=claude","cursorMdc":"/api/rules/tauri-v2-multi-webview-ipc-scoped-quarantine-standard?format=mdc","cursorrules":"/api/rules/tauri-v2-multi-webview-ipc-scoped-quarantine-standard?format=cursor","windsurf":"/api/rules/tauri-v2-multi-webview-ipc-scoped-quarantine-standard?format=windsurf","agents":"/api/rules/tauri-v2-multi-webview-ipc-scoped-quarantine-standard?format=agents"}},{"id":"kmp-swift6-strict-concurrency-sendable-guardrail","title":"Kotlin Multiplatform Swift 6 Complete Concurrency & Sendable Transfer Boundary","category":"mobile","severity":"critical","description":"Enforces compiler-verified isolation and explicit value semantics across the Kotlin/Native Objective-C bridge under Swift 6 strict concurrency checks. Prohibits unsynchronized reference passing of mutable state from Kotlin across actor boundaries, requiring explicit @Sendable bridging models, immutability, or actor isolation to prevent race conditions and Swift compiler diagnostics.","antiPatternHeadline":"Exposing Unchecked Kotlin Reference Types Across Swift 6 Actor Boundaries Causing Data Races","stars_count":77,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","swift-6","concurrency","sendable","kotlin-native"],"exportEndpoints":{"claude":"/api/rules/kmp-swift6-strict-concurrency-sendable-guardrail?format=claude","cursorMdc":"/api/rules/kmp-swift6-strict-concurrency-sendable-guardrail?format=mdc","cursorrules":"/api/rules/kmp-swift6-strict-concurrency-sendable-guardrail?format=cursor","windsurf":"/api/rules/kmp-swift6-strict-concurrency-sendable-guardrail?format=windsurf","agents":"/api/rules/kmp-swift6-strict-concurrency-sendable-guardrail?format=agents"}},{"id":"ebpf-tc-ingress-packet-slicing-loop-invariant","title":"eBPF TC Ingress Packet Slicing and Verifier-Bounded Loop Invariants","category":"devops","severity":"critical","description":"Enforces verifier-bounded loops and strict linear packet bounds verification for Layer 7 protocol parsing within Traffic Control (TC) ingress eBPF programs. Guarantees that packet pointers are recalculated after calls to bpf_skb_pull_data and prevents BPF verifier path explosion and tail-call stack overflows during high-throughput packet routing. Ensures production safety by maintaining the 512-byte BPF stack limit and restricting tail calls within kernel recursion limits.","antiPatternHeadline":"Unbounded L7 Header Parsing Loops with Stale SKB Data Pointers and Unchecked Tail Calls","stars_count":53,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","traffic-control","networking","kernel","bpf-verifier"],"exportEndpoints":{"claude":"/api/rules/ebpf-tc-ingress-packet-slicing-loop-invariant?format=claude","cursorMdc":"/api/rules/ebpf-tc-ingress-packet-slicing-loop-invariant?format=mdc","cursorrules":"/api/rules/ebpf-tc-ingress-packet-slicing-loop-invariant?format=cursor","windsurf":"/api/rules/ebpf-tc-ingress-packet-slicing-loop-invariant?format=windsurf","agents":"/api/rules/ebpf-tc-ingress-packet-slicing-loop-invariant?format=agents"}},{"id":"otel-exemplar-cardinality-governor","title":"OpenTelemetry Trace-to-Metric Exemplar Cardinality and Memory Governor","category":"devops","severity":"critical","description":"Enforces strict exemplar filtering and reservoir sampling policies on OpenTelemetry metric instruments to eliminate high-churn context attachments under burst conditions. Prevents downstream telemetry pipeline saturation (Prometheus, Mimir, Datadog) caused by unconstrained trace contextualization on high-frequency histograms and counters. Mandates explicit exemplar filter strategies coupled with bounded-capacity reservoirs to preserve backend stability and memory safety.","antiPatternHeadline":"Unbounded Exemplar Allocation on High-Throughput Histograms During Traffic Bursts","stars_count":106,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","observability","metrics","cardinality","reliability"],"exportEndpoints":{"claude":"/api/rules/otel-exemplar-cardinality-governor?format=claude","cursorMdc":"/api/rules/otel-exemplar-cardinality-governor?format=mdc","cursorrules":"/api/rules/otel-exemplar-cardinality-governor?format=cursor","windsurf":"/api/rules/otel-exemplar-cardinality-governor?format=windsurf","agents":"/api/rules/otel-exemplar-cardinality-governor?format=agents"}},{"id":"react-19-server-actions-cascading-abort-propagation","title":"React 19 Server Actions Cascading AbortController Propagation Standard","category":"frontend","severity":"critical","description":"Enforces deterministic client-to-server cancellation signal propagation across distributed React 19 Server Action boundaries. Prevents orphan execution threads, database connection exhaustion, and non-deterministic state mutations when users navigate away or unmount pending UI transitions.","antiPatternHeadline":"Fire-and-forget Server Action dispatch without cascading client abort signals to downstream upstream services","stars_count":110,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","server-actions","abort-controller","async-cancellation","nextjs"],"exportEndpoints":{"claude":"/api/rules/react-19-server-actions-cascading-abort-propagation?format=claude","cursorMdc":"/api/rules/react-19-server-actions-cascading-abort-propagation?format=mdc","cursorrules":"/api/rules/react-19-server-actions-cascading-abort-propagation?format=cursor","windsurf":"/api/rules/react-19-server-actions-cascading-abort-propagation?format=windsurf","agents":"/api/rules/react-19-server-actions-cascading-abort-propagation?format=agents"}},{"id":"svelte-5-polymorphic-snippet-layout-reentrancy-invariant","title":"Svelte 5 Snippet Monomorphism & Layout Re-entrancy Invariant","category":"frontend","severity":"critical","description":"Enforces strict monomorphic parameter signatures and non-reentrant termination guards for Svelte 5 Snippets within layout trees. Polymorphic snippet parameter bags and dynamically mutated slot contracts induce V8 hidden-class deoptimizations (megamorphic call sites) and trigger runaway microtask loops through recursive signal invalidations.","antiPatternHeadline":"Ad-Hoc Polymorphic Snippet Arguments and Unguarded Recursive Snippet Invocation","stars_count":64,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","snippets","v8-optimization","performance"],"exportEndpoints":{"claude":"/api/rules/svelte-5-polymorphic-snippet-layout-reentrancy-invariant?format=claude","cursorMdc":"/api/rules/svelte-5-polymorphic-snippet-layout-reentrancy-invariant?format=mdc","cursorrules":"/api/rules/svelte-5-polymorphic-snippet-layout-reentrancy-invariant?format=cursor","windsurf":"/api/rules/svelte-5-polymorphic-snippet-layout-reentrancy-invariant?format=windsurf","agents":"/api/rules/svelte-5-polymorphic-snippet-layout-reentrancy-invariant?format=agents"}},{"id":"openfga-zanzibar-consistency-token-standard","title":"OpenFGA Zanzibar Check-After-Write Consistency Token Standard","category":"backend","severity":"critical","description":"Mandates transactional snapshot token propagation and explicit consistency preferences across OpenFGA authorization checks following write mutations. Eliminates the Google Zanzibar 'New Enemy' stale-read anomaly where lagged authorization replicas grant unauthorized access to revoked subjects.","antiPatternHeadline":"Uncoordinated Write-Then-Check Invocations and Default Stale-Read Querying (The 'New Enemy' Anomaly)","stars_count":54,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","openfga","zanzibar","authorization","distributed-systems","security"],"exportEndpoints":{"claude":"/api/rules/openfga-zanzibar-consistency-token-standard?format=claude","cursorMdc":"/api/rules/openfga-zanzibar-consistency-token-standard?format=mdc","cursorrules":"/api/rules/openfga-zanzibar-consistency-token-standard?format=cursor","windsurf":"/api/rules/openfga-zanzibar-consistency-token-standard?format=windsurf","agents":"/api/rules/openfga-zanzibar-consistency-token-standard?format=agents"}},{"id":"postgres-17-vacuum-buffer-usage-limit-guardrail","title":"Postgres 17 Buffer-Constrained Vacuum Quota & Cache Isolation Guardrail","category":"backend","severity":"critical","description":"Enforces strict ring-buffer memory limits on autovacuum workers and programmatic maintenance jobs using Postgres 17's vacuum_buffer_usage_limit. Eliminates shared_buffers cache thrashing and OLTP query latency spikes caused by unrestricted table bloat remediation on high-churn relations.","antiPatternHeadline":"Unconstrained Vacuum Execution Evicting Hot Working Sets from Shared Buffers","stars_count":55,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres","postgresql-17","database-reliability","autovacuum","performance"],"exportEndpoints":{"claude":"/api/rules/postgres-17-vacuum-buffer-usage-limit-guardrail?format=claude","cursorMdc":"/api/rules/postgres-17-vacuum-buffer-usage-limit-guardrail?format=mdc","cursorrules":"/api/rules/postgres-17-vacuum-buffer-usage-limit-guardrail?format=cursor","windsurf":"/api/rules/postgres-17-vacuum-buffer-usage-limit-guardrail?format=windsurf","agents":"/api/rules/postgres-17-vacuum-buffer-usage-limit-guardrail?format=agents"}},{"id":"bun-websocket-kernel-backpressure-drain-boundary","title":"Bun 1.2 Native WebSocket Kernel Backpressure and Drain Boundary Standard","category":"backend","severity":"critical","description":"Enforces backpressure handling for Bun native WebSockets by strictly evaluating the byte-length return value of ws.send() and deferring dispatches during buffer saturation. Failure to park consumer-bound queues until the native drain() callback fires triggers unbounded heap growth and fatal OOM conditions under slow-client or high-throughput stalls.","antiPatternHeadline":"Unbounded fire-and-forget WebSocket broadcasting ignoring ws.send() buffer backpressure and drain lifecycles","stars_count":43,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","websockets","backpressure","memory-leak","kernel-buffers"],"exportEndpoints":{"claude":"/api/rules/bun-websocket-kernel-backpressure-drain-boundary?format=claude","cursorMdc":"/api/rules/bun-websocket-kernel-backpressure-drain-boundary?format=mdc","cursorrules":"/api/rules/bun-websocket-kernel-backpressure-drain-boundary?format=cursor","windsurf":"/api/rules/bun-websocket-kernel-backpressure-drain-boundary?format=windsurf","agents":"/api/rules/bun-websocket-kernel-backpressure-drain-boundary?format=agents"}},{"id":"kmp-swift-export-arc-cycle-prevention","title":"KMP 2.1 Swift Export ARC-to-GC Reference Cycle Guardrail","category":"mobile","severity":"critical","description":"Defines mandatory reference retention semantics and explicit lifetime unbinding between Kotlin/Native tracing GC and Apple Swift Automatic Reference Counting (ARC) under Kotlin 2.1 Swift Export. Eliminates cross-runtime uncollectible memory leaks caused by bidirectional strong retention across Swift delegates and long-lived Kotlin state holders.","antiPatternHeadline":"Bidirectional Strong Retention Between Swift Observers and Kotlin Exported Services","stars_count":111,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","swift-export","arc","memory-management","ios"],"exportEndpoints":{"claude":"/api/rules/kmp-swift-export-arc-cycle-prevention?format=claude","cursorMdc":"/api/rules/kmp-swift-export-arc-cycle-prevention?format=mdc","cursorrules":"/api/rules/kmp-swift-export-arc-cycle-prevention?format=cursor","windsurf":"/api/rules/kmp-swift-export-arc-cycle-prevention?format=windsurf","agents":"/api/rules/kmp-swift-export-arc-cycle-prevention?format=agents"}},{"id":"capacitor-7-android-16kb-page-alignment","title":"Capacitor 7 Android 16KB Page-Alignment Runtime Invariant","category":"mobile","severity":"critical","description":"Enforces that all bundled native NDK dependencies, custom C/C++ plugins, and third-party shared libraries (.so) in Capacitor 7 projects strictly comply with Android 15 (API level 35+) 16KB memory page alignment. Non-compliant 4KB-aligned ELF segments fail dynamic linker verification on 16KB kernels, leading to immediate SIGSEGV crashes at process startup.","antiPatternHeadline":"Shipping unaligned 4KB ELF dynamic libraries or unverified native NDK binaries that trigger SIGSEGV dynamic linker crashes on Android 15+ devices.","stars_count":83,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","android","ndk","16kb-pages","memory-alignment"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-android-16kb-page-alignment?format=claude","cursorMdc":"/api/rules/capacitor-7-android-16kb-page-alignment?format=mdc","cursorrules":"/api/rules/capacitor-7-android-16kb-page-alignment?format=cursor","windsurf":"/api/rules/capacitor-7-android-16kb-page-alignment?format=windsurf","agents":"/api/rules/capacitor-7-android-16kb-page-alignment?format=agents"}},{"id":"rfc-9449-dpop-key-binding-standard","title":"RFC 9449 Demonstrating Proof-of-Possession (DPoP) Invariant Enforcement","category":"security","severity":"critical","description":"Enforces RFC 9449 Demonstrating Proof-of-Possession (DPoP) asymmetric key-binding invariants across OAuth 2.0 client requests and resource server validations. Mandates client-side ephemeral cryptographic key generation, strict non-exportable storage, exact HTTP request-bound proof generation (htm, htu, jti, ath), and server-side replay prevention with nonce coordination.","antiPatternHeadline":"Bearer Token Fallback and Unbound In-Memory DPoP Proof Reuse","stars_count":102,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","oauth2","rfc9449","dpop","jwt","cryptography"],"exportEndpoints":{"claude":"/api/rules/rfc-9449-dpop-key-binding-standard?format=claude","cursorMdc":"/api/rules/rfc-9449-dpop-key-binding-standard?format=mdc","cursorrules":"/api/rules/rfc-9449-dpop-key-binding-standard?format=cursor","windsurf":"/api/rules/rfc-9449-dpop-key-binding-standard?format=windsurf","agents":"/api/rules/rfc-9449-dpop-key-binding-standard?format=agents"}},{"id":"otel-collector-cgroupv2-memory-limiter-hard-cap-standard","title":"OpenTelemetry Collector Cgroup v2 Memory Limiter and GOMEMLIMIT Hard-Cap Standard","category":"devops","severity":"critical","description":"Enforces strict mathematical alignment between Kubernetes Cgroup v2 container memory limits, the Go runtime GOMEMLIMIT parameter, and the OpenTelemetry Collector memory_limiter processor. Guarantees that telemetric shedding and garbage collection invoke before kernel memory.high or memory.max thresholds trigger an ungraceful OOMKilled (SIGKILL 137) container eviction.","antiPatternHeadline":"Misaligned or Absent memory_limiter Processor Causing Silent Container Eviction During Ingestion Bursts","stars_count":76,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","kubernetes","cgroupv2","sre","observability"],"exportEndpoints":{"claude":"/api/rules/otel-collector-cgroupv2-memory-limiter-hard-cap-standard?format=claude","cursorMdc":"/api/rules/otel-collector-cgroupv2-memory-limiter-hard-cap-standard?format=mdc","cursorrules":"/api/rules/otel-collector-cgroupv2-memory-limiter-hard-cap-standard?format=cursor","windsurf":"/api/rules/otel-collector-cgroupv2-memory-limiter-hard-cap-standard?format=windsurf","agents":"/api/rules/otel-collector-cgroupv2-memory-limiter-hard-cap-standard?format=agents"}},{"id":"k8s-gateway-api-referencegrant-isolation-gate","title":"Kubernetes Gateway API v1.2 ReferenceGrant Multi-Tenant Isolation Gate","category":"devops","severity":"critical","description":"Enforces strict validation of explicit ReferenceGrant resources whenever Kubernetes Gateway API objects reference services or secrets across namespace boundaries. Prevents lateral tenant traversal, unauthorized traffic routing, and cryptographic secret exfiltration in multi-tenant clusters.","antiPatternHeadline":"Cross-Namespace Ingress Routing Without Cryptographic or Service ReferenceGrants in Target Namespaces","stars_count":85,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","kubernetes","gateway-api","reference-grant","zero-trust","multi-tenancy"],"exportEndpoints":{"claude":"/api/rules/k8s-gateway-api-referencegrant-isolation-gate?format=claude","cursorMdc":"/api/rules/k8s-gateway-api-referencegrant-isolation-gate?format=mdc","cursorrules":"/api/rules/k8s-gateway-api-referencegrant-isolation-gate?format=cursor","windsurf":"/api/rules/k8s-gateway-api-referencegrant-isolation-gate?format=windsurf","agents":"/api/rules/k8s-gateway-api-referencegrant-isolation-gate?format=agents"}},{"id":"react-19-action-optimistic-rollback-reentrancy-invariant","title":"React 19 Optimistic Action Atomic Re-entrancy & Monotonic Rollback Invariant","category":"frontend","severity":"critical","description":"Enforces atomic, monotonically sequenced rollback handling within React 19 concurrent Actions and useOptimistic primitives. Guarantees that out-of-order completion or rejection of concurrent asynchronous actions does not corrupt optimistic UI state or induce stale re-render cascades.","antiPatternHeadline":"Ad-Hoc Imperative State Clobbering and Unsequenced Rollbacks in Concurrent React 19 Transitions","stars_count":75,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","useOptimistic","actions","concurrency","state-management"],"exportEndpoints":{"claude":"/api/rules/react-19-action-optimistic-rollback-reentrancy-invariant?format=claude","cursorMdc":"/api/rules/react-19-action-optimistic-rollback-reentrancy-invariant?format=mdc","cursorrules":"/api/rules/react-19-action-optimistic-rollback-reentrancy-invariant?format=cursor","windsurf":"/api/rules/react-19-action-optimistic-rollback-reentrancy-invariant?format=windsurf","agents":"/api/rules/react-19-action-optimistic-rollback-reentrancy-invariant?format=agents"}},{"id":"fastapi-python-313-freethreaded-concurrency-fence","title":"FastAPI Python 3.13 Free-Threaded Shared-Memory Concurrency Fence","category":"backend","severity":"critical","description":"Enforces strict memory fence, atomic synchronization, and immutability invariants for FastAPI services deployed on free-threaded Python 3.13 (PEP 703). Prevents silent data races, torn reads, and state corruption across OS worker threads running without the Global Interpreter Lock (GIL).","antiPatternHeadline":"Unsynchronized in-memory state mutations and naked dictionary read-modify-writes across free-threaded worker pools.","stars_count":105,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","python313","fastapi","nogil","concurrency","multithreading"],"exportEndpoints":{"claude":"/api/rules/fastapi-python-313-freethreaded-concurrency-fence?format=claude","cursorMdc":"/api/rules/fastapi-python-313-freethreaded-concurrency-fence?format=mdc","cursorrules":"/api/rules/fastapi-python-313-freethreaded-concurrency-fence?format=cursor","windsurf":"/api/rules/fastapi-python-313-freethreaded-concurrency-fence?format=windsurf","agents":"/api/rules/fastapi-python-313-freethreaded-concurrency-fence?format=agents"}},{"id":"pg17-logical-decoding-spill-ceiling","title":"PostgreSQL 17 Logical Decoding Spill-to-Disk Memory Ceiling Invariant","category":"backend","severity":"critical","description":"Enforces strict memory ceilings on PostgreSQL 17 logical decoding walsender processes via logical_decoding_work_mem and streaming pgoutput protocol parameters. Prevents Linux OOM-killer invocations and cascading failovers by forcing large in-flight transactions to spill to disk or stream in chunks to downstream CDC consumers. Mandates downstream stream-frame handling and storage quota guardrails on replication slots.","antiPatternHeadline":"Unbounded WalSender Shared Memory Buffering During Large Bulk DML Mutations","stars_count":59,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","cdc","logical-replication","memory-management","wal"],"exportEndpoints":{"claude":"/api/rules/pg17-logical-decoding-spill-ceiling?format=claude","cursorMdc":"/api/rules/pg17-logical-decoding-spill-ceiling?format=mdc","cursorrules":"/api/rules/pg17-logical-decoding-spill-ceiling?format=cursor","windsurf":"/api/rules/pg17-logical-decoding-spill-ceiling?format=windsurf","agents":"/api/rules/pg17-logical-decoding-spill-ceiling?format=agents"}},{"id":"go-chi-quic-stream-budget-allocation-standard","title":"Go Chi HTTP/3 Flow-Control Stream Budget Allocation Standard","category":"backend","severity":"critical","description":"Enforces bounded per-session stream concurrency and token-bucket bandwidth budgeting for HTTP/3 services running on Go Chi. Prevents protocol-level QUIC connection flow-control window exhaustion (MAX_DATA starvation) and connection-level head-of-line blocking under asymmetric stream bursts.","antiPatternHeadline":"Unbounded HTTP/3 Stream Multiplexing Leading to QUIC Connection Window Exhaustion and Stream Starvation","stars_count":50,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","chi","http3","quic","concurrency","flow-control"],"exportEndpoints":{"claude":"/api/rules/go-chi-quic-stream-budget-allocation-standard?format=claude","cursorMdc":"/api/rules/go-chi-quic-stream-budget-allocation-standard?format=mdc","cursorrules":"/api/rules/go-chi-quic-stream-budget-allocation-standard?format=cursor","windsurf":"/api/rules/go-chi-quic-stream-budget-allocation-standard?format=windsurf","agents":"/api/rules/go-chi-quic-stream-budget-allocation-standard?format=agents"}},{"id":"cmp-ios-metal-displaylink-sync-standard","title":"Compose Multiplatform iOS Metal Layer & CADisplayLink Synchronization Standard","category":"mobile","severity":"critical","description":"Enforces deterministic frame pacing and double/triple-buffered Metal texture presentation between Kotlin Native rendering loops and CADisplayLink. Prohibits blocking the main thread during CAMetalDrawable acquisition and mandates backpressure bounds to eliminate VSync deadline misses and frame hitches.","antiPatternHeadline":"Unbounded Main-Thread CAMetalDrawable Blocking & Asynchronous Kotlin Draw Loop Race","stars_count":69,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","ios","compose-multiplatform","metal","cadisplaylink","kotlin-native","graphics-performance"],"exportEndpoints":{"claude":"/api/rules/cmp-ios-metal-displaylink-sync-standard?format=claude","cursorMdc":"/api/rules/cmp-ios-metal-displaylink-sync-standard?format=mdc","cursorrules":"/api/rules/cmp-ios-metal-displaylink-sync-standard?format=cursor","windsurf":"/api/rules/cmp-ios-metal-displaylink-sync-standard?format=windsurf","agents":"/api/rules/cmp-ios-metal-displaylink-sync-standard?format=agents"}},{"id":"webauthn-l3-prf-client-key-derivation-fence","title":"WebAuthn L3 PRF Ephemeral Key-Derivation and Memory Fencing Standard","category":"security","severity":"critical","description":"Enforces strict zero-knowledge cryptographic boundaries for WebAuthn Level 3 Pseudo-Random Function (PRF) extension implementations. Mandates non-extractable client-side HKDF derivation, proactive buffer zeroization, and strictly prohibits the exfiltration or persistent storage of raw PRF seed material and derived symmetric wrapping keys.","antiPatternHeadline":"Exposing Raw Authenticator PRF Outputs or Persisting Extractable Symmetric Keys","stars_count":87,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","prf-extension","webcrypto","zero-knowledge","cryptography"],"exportEndpoints":{"claude":"/api/rules/webauthn-l3-prf-client-key-derivation-fence?format=claude","cursorMdc":"/api/rules/webauthn-l3-prf-client-key-derivation-fence?format=mdc","cursorrules":"/api/rules/webauthn-l3-prf-client-key-derivation-fence?format=cursor","windsurf":"/api/rules/webauthn-l3-prf-client-key-derivation-fence?format=windsurf","agents":"/api/rules/webauthn-l3-prf-client-key-derivation-fence?format=agents"}},{"id":"openfga-monotonic-consistency-token-invariant","title":"OpenFGA Monotonic Consistency Token Propagation and Verification Invariant","category":"security","severity":"critical","description":"Enforces deterministic capture, propagation, and validation of OpenFGA consistency tokens across distributed services and client sessions. Prevents critical authorization bypasses and privilege leaks resulting from read-after-write replication lag on read replicas during permission revocation or mutation.","antiPatternHeadline":"Discarding OpenFGA Mutation Consistency Tokens Leading to Read-After-Write Replication Authorization Bypass","stars_count":92,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","authorization","zanzibar","consistency-tokens","distributed-systems","cache-invalidation"],"exportEndpoints":{"claude":"/api/rules/openfga-monotonic-consistency-token-invariant?format=claude","cursorMdc":"/api/rules/openfga-monotonic-consistency-token-invariant?format=mdc","cursorrules":"/api/rules/openfga-monotonic-consistency-token-invariant?format=cursor","windsurf":"/api/rules/openfga-monotonic-consistency-token-invariant?format=windsurf","agents":"/api/rules/openfga-monotonic-consistency-token-invariant?format=agents"}},{"id":"envoy-gateway-spiffe-spire-svid-ratchet-standard","title":"Envoy Gateway SPIFFE/SPIRE Zero-Downtime mTLS SVID Ratchet Standard","category":"devops","severity":"critical","description":"Enforces seamless zero-downtime X.509 SVID rotation across Envoy Gateway managed ingress clusters integrated with SPIFFE/SPIRE. Mandates dynamic Secret Discovery Service (SDS) socket streaming, dual-bundle trust validation windows, and TLS listener drain coordination to eliminate transient connection reset bursts (ECONNRESET) during short-lived certificate lifecycles.","antiPatternHeadline":"Hard certificate swapping via static volume remounts or single-trust SDS pushes lacking graceful TLS drain intervals","stars_count":87,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","envoy-gateway","spiffe","spire","mtls","zero-trust","kubernetes"],"exportEndpoints":{"claude":"/api/rules/envoy-gateway-spiffe-spire-svid-ratchet-standard?format=claude","cursorMdc":"/api/rules/envoy-gateway-spiffe-spire-svid-ratchet-standard?format=mdc","cursorrules":"/api/rules/envoy-gateway-spiffe-spire-svid-ratchet-standard?format=cursor","windsurf":"/api/rules/envoy-gateway-spiffe-spire-svid-ratchet-standard?format=windsurf","agents":"/api/rules/envoy-gateway-spiffe-spire-svid-ratchet-standard?format=agents"}},{"id":"webauthn-l3-passkey-enterprise-attestation-boundary","title":"Mandatory Hardware-Bound Attestation and Authenticator Attachment Validation for Enterprise Passkeys","category":"security","severity":"critical","description":"Enforces strict FIDO2/WebAuthn Level 3 enterprise attestation verification, requiring direct or enterprise attestation statements and hardware authenticator flags. Prevents the enrollment and assertion of multi-device synchronized passkeys (e.g., iCloud Keychain, Google Password Manager) for administrative and zero-trust tiers by cryptographically validating AAGUID against an approved enterprise hardware registry and verifying the backup eligibility (BE) and backup state (BS) credential flags.","antiPatternHeadline":"Accepting 'none' attestation or missing flags allows soft/synced passkeys on high-privilege enterprise boundary endpoints","stars_count":47,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","fido2","passkeys","zero-trust","cryptography"],"exportEndpoints":{"claude":"/api/rules/webauthn-l3-passkey-enterprise-attestation-boundary?format=claude","cursorMdc":"/api/rules/webauthn-l3-passkey-enterprise-attestation-boundary?format=mdc","cursorrules":"/api/rules/webauthn-l3-passkey-enterprise-attestation-boundary?format=cursor","windsurf":"/api/rules/webauthn-l3-passkey-enterprise-attestation-boundary?format=windsurf","agents":"/api/rules/webauthn-l3-passkey-enterprise-attestation-boundary?format=agents"}},{"id":"istio-ambient-ztunnel-ebpf-l4-mtls-enforcement","title":"Istio Ambient ztunnel Zero-Copy eBPF L4 mTLS and SPIFFE Identity Guardrail","category":"devops","severity":"critical","description":"Enforces strict L4 cryptographic isolation and deterministic SPIFFE identity verification using Istio Ambient Mesh ztunnel and eBPF/CNI socket redirection. Mandates strict PeerAuthentication and prevents L7 policy leakage to the L4 transport layer while explicitly decoupling waypoint proxy assignments from transport encryption.","antiPatternHeadline":"Deploying Ambient Mesh With Permissive mTLS or Attempting L7 Filtering on Pure L4 ztunnel Nodes","stars_count":79,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","istio","ambient-mesh","ztunnel","ebpf","mtls","spiffe","kubernetes","zero-trust"],"exportEndpoints":{"claude":"/api/rules/istio-ambient-ztunnel-ebpf-l4-mtls-enforcement?format=claude","cursorMdc":"/api/rules/istio-ambient-ztunnel-ebpf-l4-mtls-enforcement?format=mdc","cursorrules":"/api/rules/istio-ambient-ztunnel-ebpf-l4-mtls-enforcement?format=cursor","windsurf":"/api/rules/istio-ambient-ztunnel-ebpf-l4-mtls-enforcement?format=windsurf","agents":"/api/rules/istio-ambient-ztunnel-ebpf-l4-mtls-enforcement?format=agents"}},{"id":"fastapi-anyio-bounded-zerocopy-streaming","title":"FastAPI AnyIO Concurrency-Bounded Zero-Copy Memory Streaming","category":"backend","severity":"critical","description":"Enforces strict chunked streaming of binary payloads using AnyIO concurrency primitives and zero-copy buffer protocols in FastAPI endpoints. Prevents catastrophic asyncio event-loop starvation and OOM crashes caused by reading unbounded request bodies into heap memory or saturating the default thread pool with blocking disk I/O under high concurrent load.","antiPatternHeadline":"Unbounded `await file.read()` and Unthrottled Disk I/O Ingestion in Asynchronous Endpoints","stars_count":73,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["fastapi","anyio","streaming","memory-management","backpressure","concurrency"],"exportEndpoints":{"claude":"/api/rules/fastapi-anyio-bounded-zerocopy-streaming?format=claude","cursorMdc":"/api/rules/fastapi-anyio-bounded-zerocopy-streaming?format=mdc","cursorrules":"/api/rules/fastapi-anyio-bounded-zerocopy-streaming?format=cursor","windsurf":"/api/rules/fastapi-anyio-bounded-zerocopy-streaming?format=windsurf","agents":"/api/rules/fastapi-anyio-bounded-zerocopy-streaming?format=agents"}},{"id":"tauri-android-jni-context-retain-cycle-elimination","title":"Tauri 2.0 Android JNI Context & Native Reference Retain-Cycle Elimination","category":"mobile","severity":"critical","description":"Enforces strict native memory hygiene across JNI boundaries in Tauri 2.0 Android Kotlin plugins. Prevents persistent Activity retain cycles and ART LocalRef table exhaustion during rapid WebView hot-reloads and navigation by mandating ApplicationContext capture, WeakReference wrapping for Activity instances, and deterministic JNI local reference cleanup.","antiPatternHeadline":"Hard Activity Reference Capture and Unbounded JNI LocalRefs Across Tauri Plugin Invocations","stars_count":72,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","android","tauri","jni","kotlin","memory-leaks"],"exportEndpoints":{"claude":"/api/rules/tauri-android-jni-context-retain-cycle-elimination?format=claude","cursorMdc":"/api/rules/tauri-android-jni-context-retain-cycle-elimination?format=mdc","cursorrules":"/api/rules/tauri-android-jni-context-retain-cycle-elimination?format=cursor","windsurf":"/api/rules/tauri-android-jni-context-retain-cycle-elimination?format=windsurf","agents":"/api/rules/tauri-android-jni-context-retain-cycle-elimination?format=agents"}},{"id":"opentelemetry-profiling-adaptive-sampling-budget","title":"Adaptive Sampling Budget and Dynamic Throttling for OpenTelemetry Continuous Profiling","category":"devops","severity":"critical","description":"Continuous stack profiling via OTLP/Pprof introduces measurable tail latency and collector ingestion bottlenecks if sampled at static rates during traffic surges. This policy enforces client-side adaptive sampling budgets that dynamically down-sample or suspend call-stack captures when CPU or memory headroom thresholds are breached. Production services must guarantee profiling overhead remains under 2% CPU and zero collector OTLP buffer dropouts.","antiPatternHeadline":"Static high-frequency profiling during CPU saturation causing self-inflicted tail latency cascades and collector buffer eviction","stars_count":41,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","continuous-profiling","pprof","performance","otlp"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-profiling-adaptive-sampling-budget?format=claude","cursorMdc":"/api/rules/opentelemetry-profiling-adaptive-sampling-budget?format=mdc","cursorrules":"/api/rules/opentelemetry-profiling-adaptive-sampling-budget?format=cursor","windsurf":"/api/rules/opentelemetry-profiling-adaptive-sampling-budget?format=windsurf","agents":"/api/rules/opentelemetry-profiling-adaptive-sampling-budget?format=agents"}},{"id":"ml-kem-hybrid-tls-downgrade-protection","title":"ML-KEM Hybrid TLS 1.3 Post-Quantum Forward Secrecy & Downgrade Prevention","category":"security","severity":"critical","description":"Enforces hybrid classical and post-quantum lattice key exchange (X25519MLKEM768/SecP256r1MLKEM768) within TLS 1.3 architectures to mitigate Store-Now-Decrypt-Later (SNDL) harvesting. Prevents active MitM cipher downgrade attacks by establishing mandatory post-quantum group constraints and verifying negotiated key encapsulation mechanisms post-handshake.","antiPatternHeadline":"Permissive TLS key-share negotiation allowing silent fallback to pure classical ECDHE without ML-KEM hybrid encapsulation","stars_count":84,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","tls13","post-quantum","ml-kem","cryptography","zero-trust"],"exportEndpoints":{"claude":"/api/rules/ml-kem-hybrid-tls-downgrade-protection?format=claude","cursorMdc":"/api/rules/ml-kem-hybrid-tls-downgrade-protection?format=mdc","cursorrules":"/api/rules/ml-kem-hybrid-tls-downgrade-protection?format=cursor","windsurf":"/api/rules/ml-kem-hybrid-tls-downgrade-protection?format=windsurf","agents":"/api/rules/ml-kem-hybrid-tls-downgrade-protection?format=agents"}},{"id":"nextjs-15-ppr-shell-streaming-boundary","title":"Next.js 15 PPR Shell Isolation and Zero-Waterfall Streaming Guardrail","category":"frontend","severity":"critical","description":"Next.js 15 Partial Prerendering (PPR) requires strict architectural isolation between prerendered static layout shells and dynamic server streams. Awaiting dynamic runtime data (headers, cookies, searchParams, or uncached database calls) at the layout or root page level blocks static shell extraction and degrades edge TTFB beyond the 50ms threshold. All dynamic asynchronous operations must be encapsulated inside distinct leaf server components wrapped in explicit React Suspense boundaries.","antiPatternHeadline":"Awaiting Dynamic APIs or Data at the Route Root De-opting PPR Shell Generation","stars_count":66,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs","react","ppr","streaming","performance"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-ppr-shell-streaming-boundary?format=claude","cursorMdc":"/api/rules/nextjs-15-ppr-shell-streaming-boundary?format=mdc","cursorrules":"/api/rules/nextjs-15-ppr-shell-streaming-boundary?format=cursor","windsurf":"/api/rules/nextjs-15-ppr-shell-streaming-boundary?format=windsurf","agents":"/api/rules/nextjs-15-ppr-shell-streaming-boundary?format=agents"}},{"id":"openfga-rebac-contextual-tuples-invalidation-standard","title":"OpenFGA ReBAC Contextual Tuple Resolution & Write-Consistency Standard","category":"security","severity":"critical","description":"Mandates deterministic, zero-staleness authorization guarantees across distributed transactions using OpenFGA. Enforces contextual tuple injection for in-flight state mutations and strict consistency configurations to prevent authorization bypasses caused by asynchronous replication lag.","antiPatternHeadline":"Asynchronous Tuple Write Race Inducing False-Negative Authorization and Read-After-Write Stale Checks","stars_count":95,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","rebac","authorization","distributed-systems","zanzibar"],"exportEndpoints":{"claude":"/api/rules/openfga-rebac-contextual-tuples-invalidation-standard?format=claude","cursorMdc":"/api/rules/openfga-rebac-contextual-tuples-invalidation-standard?format=mdc","cursorrules":"/api/rules/openfga-rebac-contextual-tuples-invalidation-standard?format=cursor","windsurf":"/api/rules/openfga-rebac-contextual-tuples-invalidation-standard?format=windsurf","agents":"/api/rules/openfga-rebac-contextual-tuples-invalidation-standard?format=agents"}},{"id":"bun-db-zerocopy-memory-fence","title":"Bun 1.2 Native Database Driver Zero-Copy Memory Allocation Fence","category":"backend","severity":"critical","description":"Enforces strict memory boundary fences when consuming zero-copy buffers from Bun 1.2 native database drivers (bun:sqlite, bun:sql). Mandates explicit detachment and heap copying before crossing asynchronous yields or advancing iterators to prevent use-after-free, memory corruption, and microsecond latency spikes caused by off-heap buffer aliasing.","antiPatternHeadline":"Retaining Native Zero-Copy Buffer Views Across Asynchronous Yields or Cursor Iterations","stars_count":107,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","sqlite","zero-copy","memory-fence","high-performance"],"exportEndpoints":{"claude":"/api/rules/bun-db-zerocopy-memory-fence?format=claude","cursorMdc":"/api/rules/bun-db-zerocopy-memory-fence?format=mdc","cursorrules":"/api/rules/bun-db-zerocopy-memory-fence?format=cursor","windsurf":"/api/rules/bun-db-zerocopy-memory-fence?format=windsurf","agents":"/api/rules/bun-db-zerocopy-memory-fence?format=agents"}},{"id":"cmp-skiko-render-pass-budget-guardrail","title":"Compose Multiplatform 1.8 Skiko Render-Pass Budget Guardrail","category":"mobile","severity":"critical","description":"Enforces strict render-pass time budgets across heterogeneous refresh rates (60Hz, 120Hz ProMotion, and high-refresh desktop monitors) in Compose Multiplatform 1.8. Prevents frame-drop cascades and UI thread starvation by eliminating object allocations inside Skiko draw loops and isolating hardware canvas operations into cache-backed layers. Guards against cascading redraw triggers and non-deterministic VSync stalls in cross-platform render pipelines.","antiPatternHeadline":"Unthrottled Intra-Draw Allocations and Direct Canvas Mutations Busting Skiko Frame Budgets","stars_count":51,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","compose-multiplatform","skiko","performance","graphics"],"exportEndpoints":{"claude":"/api/rules/cmp-skiko-render-pass-budget-guardrail?format=claude","cursorMdc":"/api/rules/cmp-skiko-render-pass-budget-guardrail?format=mdc","cursorrules":"/api/rules/cmp-skiko-render-pass-budget-guardrail?format=cursor","windsurf":"/api/rules/cmp-skiko-render-pass-budget-guardrail?format=windsurf","agents":"/api/rules/cmp-skiko-render-pass-budget-guardrail?format=agents"}},{"id":"otel-collector-tail-sampling-ringbuffer-guardrail","title":"OpenTelemetry Tail-Based Sampling Deterministic Ring-Buffer & Memory Boundary Standard","category":"devops","severity":"critical","description":"Guarantees deterministic memory ceilings and prevents Linux OOM-killer termination on OpenTelemetry Collectors during volumetric ingress spikes. Mandates strict ordering of the memory_limiter processor prior to tail_sampling, explicitly calculated trace ring-buffer capacities based on p99 span-tree sizes, and preemptive drop evaluation for high-frequency non-erroneous telemetry.","antiPatternHeadline":"Unbounded tail-sampling trace buffers without prior memory-limiter shedding, causing fatal Collector OOM crashes during ingress spikes.","stars_count":42,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","tail-sampling","observability","memory-safety","kubernetes"],"exportEndpoints":{"claude":"/api/rules/otel-collector-tail-sampling-ringbuffer-guardrail?format=claude","cursorMdc":"/api/rules/otel-collector-tail-sampling-ringbuffer-guardrail?format=mdc","cursorrules":"/api/rules/otel-collector-tail-sampling-ringbuffer-guardrail?format=cursor","windsurf":"/api/rules/otel-collector-tail-sampling-ringbuffer-guardrail?format=windsurf","agents":"/api/rules/otel-collector-tail-sampling-ringbuffer-guardrail?format=agents"}},{"id":"webauthn-l3-device-bound-passkey-attestation-invariant","title":"WebAuthn L3 Enterprise Device-Bound Passkey Attestation and Anti-Sync Invariant","category":"security","severity":"critical","description":"Enforces strict hardware-bound WebAuthn Level 3 credentials for enterprise access by cryptographically verifying authenticator data flags and attestation statements. Explicitly rejects multi-device synced passkeys (iCloud Keychain, Google Password Manager) by verifying Backup Eligibility (BE=0) and Backup State (BS=0) alongside enterprise AAGUID allowlists.","antiPatternHeadline":"Permitting Synced Passkeys with Unchecked Backup Flags and Unvalidated AAGUIDs in Enterprise Workflows","stars_count":114,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","fido2","passkeys","cryptography","zero-trust"],"exportEndpoints":{"claude":"/api/rules/webauthn-l3-device-bound-passkey-attestation-invariant?format=claude","cursorMdc":"/api/rules/webauthn-l3-device-bound-passkey-attestation-invariant?format=mdc","cursorrules":"/api/rules/webauthn-l3-device-bound-passkey-attestation-invariant?format=cursor","windsurf":"/api/rules/webauthn-l3-device-bound-passkey-attestation-invariant?format=windsurf","agents":"/api/rules/webauthn-l3-device-bound-passkey-attestation-invariant?format=agents"}},{"id":"ebpf-lsm-binary-drift-guardrail","title":"Kernel-Enforced eBPF LSM Container Execution Drift Neutralization","category":"devops","severity":"critical","description":"Enforces deterministic, in-kernel blocking of unauthorized executable invocations inside container workloads using Linux Security Modules (LSM) coupled with eBPF hooks. Ensures that process execution drift deviating from cryptographic digest profiles or immutable rootfs manifests is halted prior to execve commitment at ring 0, mitigating zero-day remote code execution vulnerabilities.","antiPatternHeadline":"Relying on User-Space Process Scanners or Post-Execution Audit Logs to Detect Container Compromise","stars_count":76,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["ebpf","lsm","linux-security","kubernetes","containers","runtime-security","zero-trust"],"exportEndpoints":{"claude":"/api/rules/ebpf-lsm-binary-drift-guardrail?format=claude","cursorMdc":"/api/rules/ebpf-lsm-binary-drift-guardrail?format=mdc","cursorrules":"/api/rules/ebpf-lsm-binary-drift-guardrail?format=cursor","windsurf":"/api/rules/ebpf-lsm-binary-drift-guardrail?format=windsurf","agents":"/api/rules/ebpf-lsm-binary-drift-guardrail?format=agents"}},{"id":"vite-6-module-federation-runtime-singleton-deduplication","title":"Vite 6 Module Federation Runtime Singleton Deduplication Invariant","category":"frontend","severity":"critical","description":"Enforces strict runtime singleton deduplication and asynchronous boundary bootstrapping in Vite 6 micro-frontend architectures. Prevents dual-instance framework execution, broken context providers, and split reactive runtimes when integrating independently deployed remotes and hosts.","antiPatternHeadline":"Dual-Instance Framework Execution and Split Contexts Caused by Unbound Vite MF Singletons","stars_count":64,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","vite-6","module-federation","micro-frontends","esm","singleton"],"exportEndpoints":{"claude":"/api/rules/vite-6-module-federation-runtime-singleton-deduplication?format=claude","cursorMdc":"/api/rules/vite-6-module-federation-runtime-singleton-deduplication?format=mdc","cursorrules":"/api/rules/vite-6-module-federation-runtime-singleton-deduplication?format=cursor","windsurf":"/api/rules/vite-6-module-federation-runtime-singleton-deduplication?format=windsurf","agents":"/api/rules/vite-6-module-federation-runtime-singleton-deduplication?format=agents"}},{"id":"fastapi-lifespan-state-pinning-worker-drain-standard","title":"FastAPI Lifespan State Pinning and In-Flight Request Drain Guardrail","category":"backend","severity":"critical","description":"Enforces deterministic lifecycle management for shared resources within FastAPI ASGI applications to guarantee zero-downtime rolling deployments. Prevents premature connection pool termination during SIGTERM drain cycles by pinning resource lifecycles strictly to app.state and executing non-destructive drain barriers before client disconnections.","antiPatternHeadline":"Tearing down shared connection pools inside ASGI lifespan context before in-flight requests complete","stars_count":50,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","asgi","python","zero-downtime","concurrency"],"exportEndpoints":{"claude":"/api/rules/fastapi-lifespan-state-pinning-worker-drain-standard?format=claude","cursorMdc":"/api/rules/fastapi-lifespan-state-pinning-worker-drain-standard?format=mdc","cursorrules":"/api/rules/fastapi-lifespan-state-pinning-worker-drain-standard?format=cursor","windsurf":"/api/rules/fastapi-lifespan-state-pinning-worker-drain-standard?format=windsurf","agents":"/api/rules/fastapi-lifespan-state-pinning-worker-drain-standard?format=agents"}},{"id":"react-19-rsc-tainted-reference-isolation","title":"React 19 Server Components Tainted Reference Isolation for PII & Secrets","category":"frontend","severity":"critical","description":"Enforces deterministic boundaries between React Server Components (RSC) and Client Components by mandating React 19 taint APIs (`experimental_taintUniqueValue` and `experimental_taintObjectReference`) on all sensitive entities. Prevents accidental serialization of database entity models, auth tokens, and personally identifiable information across network boundaries. Requires explicit data transfer object (DTO) projections before passing data to Client Components.","antiPatternHeadline":"Leaking Raw Database Records or Cryptographic Secrets to Client Components Across the RSC Wire Protocol","stars_count":60,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","rsc","security","taint-api","data-leakage"],"exportEndpoints":{"claude":"/api/rules/react-19-rsc-tainted-reference-isolation?format=claude","cursorMdc":"/api/rules/react-19-rsc-tainted-reference-isolation?format=mdc","cursorrules":"/api/rules/react-19-rsc-tainted-reference-isolation?format=cursor","windsurf":"/api/rules/react-19-rsc-tainted-reference-isolation?format=windsurf","agents":"/api/rules/react-19-rsc-tainted-reference-isolation?format=agents"}},{"id":"vite6-runtime-environment-api-context-quarantine","title":"Vite 6 Runtime Environment API Context Quarantine & Multi-Runtime Isolation","category":"frontend","severity":"critical","description":"Enforces complete execution isolation and zero global state pollution across concurrent SSR, Edge worker, and client runtimes using the Vite 6 Environment API. Mandates explicit DevEnvironment bindings, ModuleRunner abstraction, and AsyncLocalStorage context encapsulation over global namespace patching.","antiPatternHeadline":"Global Scope Mutation and Cross-Runtime Leaks via Legacy ssrLoadModule and Shared Singletons","stars_count":116,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","vite6","environment-api","ssr","module-runner","isolation"],"exportEndpoints":{"claude":"/api/rules/vite6-runtime-environment-api-context-quarantine?format=claude","cursorMdc":"/api/rules/vite6-runtime-environment-api-context-quarantine?format=mdc","cursorrules":"/api/rules/vite6-runtime-environment-api-context-quarantine?format=cursor","windsurf":"/api/rules/vite6-runtime-environment-api-context-quarantine?format=windsurf","agents":"/api/rules/vite6-runtime-environment-api-context-quarantine?format=agents"}},{"id":"nextjs15-ppr-hydration-barrier-guardrail","title":"Next.js 15 PPR Dynamic Boundary Isolation and Shell Invariant","category":"frontend","severity":"critical","description":"Enforces strict isolation of dynamic runtime inputs (such as cookies(), headers(), and searchParams) within React Suspense micro-boundaries under Next.js 15 Partial Prerendering (PPR). Guarantees a deterministic static outer layout shell during build time while preventing cascading dynamic de-optimization, hydration mismatches, and premature fallback triggers across server components.","antiPatternHeadline":"Dynamic Context Leakage into Static PPR Shell Inducing Entire-Route SSR Downgrade","stars_count":86,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs15","ppr","react-server-components","suspense","performance"],"exportEndpoints":{"claude":"/api/rules/nextjs15-ppr-hydration-barrier-guardrail?format=claude","cursorMdc":"/api/rules/nextjs15-ppr-hydration-barrier-guardrail?format=mdc","cursorrules":"/api/rules/nextjs15-ppr-hydration-barrier-guardrail?format=cursor","windsurf":"/api/rules/nextjs15-ppr-hydration-barrier-guardrail?format=windsurf","agents":"/api/rules/nextjs15-ppr-hydration-barrier-guardrail?format=agents"}},{"id":"postgres-17-async-direct-io-clamping","title":"Postgres 17 Asynchronous Direct I/O and Pinned Memory Clamping Standard","category":"backend","severity":"critical","description":"Enforces strict upper bounds on asynchronous Direct I/O prefetch concurrency and pinned shared buffer pages during high-volume analytical queries. Prevents kernel queue exhaustion, buffer pool thrashing, and out-of-memory worker panics in Postgres 17 Direct I/O workloads. Mandates session-level GUC clamping and bounded cursor streaming for large sequential scans.","antiPatternHeadline":"Unbounded Direct I/O prefetch concurrency causing buffer cache thrashing and worker OOM","stars_count":58,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","postgres-17","direct-io","memory-management","performance"],"exportEndpoints":{"claude":"/api/rules/postgres-17-async-direct-io-clamping?format=claude","cursorMdc":"/api/rules/postgres-17-async-direct-io-clamping?format=mdc","cursorrules":"/api/rules/postgres-17-async-direct-io-clamping?format=cursor","windsurf":"/api/rules/postgres-17-async-direct-io-clamping?format=windsurf","agents":"/api/rules/postgres-17-async-direct-io-clamping?format=agents"}},{"id":"bun-v12-ffi-lifetime-pointer-safety","title":"Bun 1.2 Native FFI C-ABI Lifetime & Pointer Safety Standard","category":"backend","severity":"critical","description":"Enforces strict memory ownership boundaries, pinned buffer allocation, and deterministic lifecycle tracking across JavaScript runtime and C-ABI native shared libraries in Bun 1.2. Eliminates dangling pointers caused by V8/JSC garbage collector compaction and halts fatal double-free or use-after-free corruption through explicit FinalizationRegistry unregister semantics and branded pointer wrappers.","antiPatternHeadline":"Passing unpinned TypedArray backing stores to asynchronous native workers or relying on nondeterministic GC finalizers for C heap reclamation","stars_count":68,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","ffi","memory-safety","c-abi","pointers"],"exportEndpoints":{"claude":"/api/rules/bun-v12-ffi-lifetime-pointer-safety?format=claude","cursorMdc":"/api/rules/bun-v12-ffi-lifetime-pointer-safety?format=mdc","cursorrules":"/api/rules/bun-v12-ffi-lifetime-pointer-safety?format=cursor","windsurf":"/api/rules/bun-v12-ffi-lifetime-pointer-safety?format=windsurf","agents":"/api/rules/bun-v12-ffi-lifetime-pointer-safety?format=agents"}},{"id":"openfga-ephemeral-contextual-tuple-fencing-standard","title":"OpenFGA Ephemeral Contextual Tuple Cryptographic Fencing & Lease Enforcement","category":"backend","severity":"critical","description":"Enforces strict cryptographic binding, short-lived epoch lease constraints, and cryptographic signature validation on dynamic contextual tuples evaluated in OpenFGA check queries. Prevents privilege escalation and confused-deputy attacks arising from unauthenticated caller-supplied relationship assertions or tuple replay. Ensures all dynamically ingested tuples are cryptographically verified, deterministic, and isolated to the immediate execution context.","antiPatternHeadline":"Blind Ingestion of Untrusted Dynamic Contextual Tuples into OpenFGA Check Calls","stars_count":112,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","openfga","authorization","security","cryptography","fga"],"exportEndpoints":{"claude":"/api/rules/openfga-ephemeral-contextual-tuple-fencing-standard?format=claude","cursorMdc":"/api/rules/openfga-ephemeral-contextual-tuple-fencing-standard?format=mdc","cursorrules":"/api/rules/openfga-ephemeral-contextual-tuple-fencing-standard?format=cursor","windsurf":"/api/rules/openfga-ephemeral-contextual-tuple-fencing-standard?format=windsurf","agents":"/api/rules/openfga-ephemeral-contextual-tuple-fencing-standard?format=agents"}},{"id":"tauri2-granular-ipc-acl-boundary","title":"Tauri 2.0 Granular IPC Capability and ACL Boundary Enforcement","category":"mobile","severity":"critical","description":"Enforces Tauri 2.0's compile-time validated Access Control List (ACL) security boundaries on both mobile and desktop targets. Restricts webview runtime capabilities by disallowing global IPC wildcards, mandating explicit capability file declarations, and isolating native plugin bridges against unauthorized webview execution context escalation.","antiPatternHeadline":"Over-permissive IPC Capability Scope and Unrestricted Webview Bridge Invocation","stars_count":89,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri","ipc","security","acl","rust","permissions"],"exportEndpoints":{"claude":"/api/rules/tauri2-granular-ipc-acl-boundary?format=claude","cursorMdc":"/api/rules/tauri2-granular-ipc-acl-boundary?format=mdc","cursorrules":"/api/rules/tauri2-granular-ipc-acl-boundary?format=cursor","windsurf":"/api/rules/tauri2-granular-ipc-acl-boundary?format=windsurf","agents":"/api/rules/tauri2-granular-ipc-acl-boundary?format=agents"}},{"id":"kmp-swift-export-exception-fencing","title":"Kotlin Multiplatform 2.1 Swift-Export ABI Exception Boundary Fencing","category":"mobile","severity":"critical","description":"Enforces deterministic ABI boundary fencing across Kotlin 2.1 Swift-Export surfaces. Prevents unhandled Kotlin coroutine panics and unwrapped Native runtime exceptions from crossing into Darwin threads and triggering fatal SIGABRT crashes in native iOS host processes.","antiPatternHeadline":"Exposing Naked Suspend Functions and Unchecked Kotlin Exceptions Across Direct Swift-Export ABI Boundaries","stars_count":108,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","swift-export","ios","concurrency","abi-stability"],"exportEndpoints":{"claude":"/api/rules/kmp-swift-export-exception-fencing?format=claude","cursorMdc":"/api/rules/kmp-swift-export-exception-fencing?format=mdc","cursorrules":"/api/rules/kmp-swift-export-exception-fencing?format=cursor","windsurf":"/api/rules/kmp-swift-export-exception-fencing?format=windsurf","agents":"/api/rules/kmp-swift-export-exception-fencing?format=agents"}},{"id":"spire-confidential-computing-attestation-invariant","title":"Hardware-Rooted Platform Attestation Validation for SPIRE SVID Issuance","category":"security","severity":"critical","description":"Enforces hardware-rooted cryptographic measurement validation (TPM 2.0 PCR quotes or AWS Nitro Enclave attestation documents) prior to issuing SPIFFE Verifiable Identity Documents (SVIDs). Prevents identity spoofing and lateral movement across multi-tenant cloud fabrics by ensuring workload identity issuance is cryptographically bound to verified platform firmware, boot sequences, and enclave enclave-held hashes.","antiPatternHeadline":"Issuing SVIDs Based on Mutable Cloud Metadata or Unverified Node Selectors Without Hardware Attestation","stars_count":47,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","spire","spiffe","confidential-computing","tpm2","nitro-enclaves","attestation","zero-trust"],"exportEndpoints":{"claude":"/api/rules/spire-confidential-computing-attestation-invariant?format=claude","cursorMdc":"/api/rules/spire-confidential-computing-attestation-invariant?format=mdc","cursorrules":"/api/rules/spire-confidential-computing-attestation-invariant?format=cursor","windsurf":"/api/rules/spire-confidential-computing-attestation-invariant?format=windsurf","agents":"/api/rules/spire-confidential-computing-attestation-invariant?format=agents"}},{"id":"otel-collector-dynamic-attribute-stripping","title":"OpenTelemetry Collector Dynamic Semantic Attribute Stripping","category":"devops","severity":"critical","description":"Enforces deterministic attribute normalization and transforms within the OpenTelemetry Collector using the transform processor and OTTL (OpenTelemetry Transformation Language). Strips unbounded, high-cardinality metadata from spans, metrics, and exemplar contexts at the ingestion tier to prevent catastrophic downstream time-series explosions across Prometheus, Mimir, and Jaeger backends without truncating trace lineage.","antiPatternHeadline":"Passing Unbounded High-Cardinality Attributes and Raw PII Direct to Downstream Time-Series Storage","stars_count":107,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","observability","cardinality","ottl","sre"],"exportEndpoints":{"claude":"/api/rules/otel-collector-dynamic-attribute-stripping?format=claude","cursorMdc":"/api/rules/otel-collector-dynamic-attribute-stripping?format=mdc","cursorrules":"/api/rules/otel-collector-dynamic-attribute-stripping?format=cursor","windsurf":"/api/rules/otel-collector-dynamic-attribute-stripping?format=windsurf","agents":"/api/rules/otel-collector-dynamic-attribute-stripping?format=agents"}},{"id":"react-19-server-actions-concurrent-abort-propagation","title":"React 19 Concurrent Server Action AbortSignal Propagation & Reentrancy Guard","category":"frontend","severity":"critical","description":"Enforces deterministic cancellation and disposal of inflight Server Action micro-tasks and downstream upstream fetch pipelines during rapid user transitions. Prevents out-of-order state overwrites and dangling backend executions by coupling React 19 transition lifecycles with explicit AbortController instances.","antiPatternHeadline":"Unbounded concurrent Server Action execution causing race-condition state corruptions via out-of-order resolution","stars_count":71,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react19","server-actions","concurrency","abort-signal","race-conditions"],"exportEndpoints":{"claude":"/api/rules/react-19-server-actions-concurrent-abort-propagation?format=claude","cursorMdc":"/api/rules/react-19-server-actions-concurrent-abort-propagation?format=mdc","cursorrules":"/api/rules/react-19-server-actions-concurrent-abort-propagation?format=cursor","windsurf":"/api/rules/react-19-server-actions-concurrent-abort-propagation?format=windsurf","agents":"/api/rules/react-19-server-actions-concurrent-abort-propagation?format=agents"}},{"id":"nextjs-15-dynamic-io-context-isolation-guardrail","title":"Next.js 15 Dynamic I/O Async Request Context Isolation Standard","category":"frontend","severity":"critical","description":"Enforces strict isolation boundaries around Next.js 15 asynchronous dynamic request APIs (cookies, headers, connection, searchParams) under Dynamic I/O. Prevents dynamic contagion across static React Server Component (RSC) trees by mandating leaf-level isolation, Suspense encapsulation, and explicit boundary containment.","antiPatternHeadline":"Unbounded Dynamic Contagion via Top-Level Awaited Request Context in Static RSC Trees","stars_count":83,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["nextjs","nextjs-15","react-server-components","dynamic-io","performance"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-dynamic-io-context-isolation-guardrail?format=claude","cursorMdc":"/api/rules/nextjs-15-dynamic-io-context-isolation-guardrail?format=mdc","cursorrules":"/api/rules/nextjs-15-dynamic-io-context-isolation-guardrail?format=cursor","windsurf":"/api/rules/nextjs-15-dynamic-io-context-isolation-guardrail?format=windsurf","agents":"/api/rules/nextjs-15-dynamic-io-context-isolation-guardrail?format=agents"}},{"id":"axum-hyper-streaming-backpressure-barrier","title":"Axum 0.8 / Hyper-v1 Bounded Stream Backpressure and Flow-Control Barrier","category":"backend","severity":"critical","description":"Enforces deterministic backpressure propagation on Axum 0.8 and Hyper-v1 streaming request bodies to regulate HTTP/2 and HTTP/3 flow-control windows. Eliminates unbounded worker heap buffering and OOM conditions during high-concurrency multipart and file ingestion by coupling TCP/QUIC window updates directly to downstream sink consumption rates.","antiPatternHeadline":"Eager Body Buffering and Unbounded MPSC Decoupling in Streaming Request Handlers","stars_count":47,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","hyper","tokio","backpressure","http2"],"exportEndpoints":{"claude":"/api/rules/axum-hyper-streaming-backpressure-barrier?format=claude","cursorMdc":"/api/rules/axum-hyper-streaming-backpressure-barrier?format=mdc","cursorrules":"/api/rules/axum-hyper-streaming-backpressure-barrier?format=cursor","windsurf":"/api/rules/axum-hyper-streaming-backpressure-barrier?format=windsurf","agents":"/api/rules/axum-hyper-streaming-backpressure-barrier?format=agents"}},{"id":"bun-sqlite-wal-shm-concurrency-guardrail","title":"Bun 1.2 SQLite Embedded WAL Shared Memory Concurrency Guardrail","category":"backend","severity":"critical","description":"Enforces strict POSIX shared-memory (`-shm`) lock synchronization, single-writer multi-reader threading topology, and automated WAL checkpoint pacing when coordinating multi-threaded Bun worker pools accessing co-located SQLite storage. Prevents SQLITE_BUSY, database corruption, deadlocks, and disk space bloat caused by uncoordinated write transactions and rogue file descriptors.","antiPatternHeadline":"Spawning Multiple Bun Workers with Uncoordinated Read-Write SQLite Connections and Default Autocheckpoint Settings","stars_count":99,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","sqlite","wal-mode","concurrency","multithreading"],"exportEndpoints":{"claude":"/api/rules/bun-sqlite-wal-shm-concurrency-guardrail?format=claude","cursorMdc":"/api/rules/bun-sqlite-wal-shm-concurrency-guardrail?format=mdc","cursorrules":"/api/rules/bun-sqlite-wal-shm-concurrency-guardrail?format=cursor","windsurf":"/api/rules/bun-sqlite-wal-shm-concurrency-guardrail?format=windsurf","agents":"/api/rules/bun-sqlite-wal-shm-concurrency-guardrail?format=agents"}},{"id":"go-chi-context-cancellation-deadline-propagation-go-chi-context-c-443","title":"Go Chi Context Cancellation Deadline Tree Propagation Invariant","category":"backend","severity":"critical","description":"Enforces strict deadline and cancellation tree propagation from root Chi HTTP request contexts into child worker pools, downstream RPCs, and database operations. Disallows naked context re-instantiation via context.Background() or context.TODO() in HTTP handler call trees, preventing orphaned cloud resource consumption and memory leaks upon client disconnection.","antiPatternHeadline":"Orphaned Goroutine and Cloud Resource Leak via Request Context Severance","stars_count":99,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","golang","chi","concurrency","context-propagation","cloud-cost"],"exportEndpoints":{"claude":"/api/rules/go-chi-context-cancellation-deadline-propagation-go-chi-context-c-443?format=claude","cursorMdc":"/api/rules/go-chi-context-cancellation-deadline-propagation-go-chi-context-c-443?format=mdc","cursorrules":"/api/rules/go-chi-context-cancellation-deadline-propagation-go-chi-context-c-443?format=cursor","windsurf":"/api/rules/go-chi-context-cancellation-deadline-propagation-go-chi-context-c-443?format=windsurf","agents":"/api/rules/go-chi-context-cancellation-deadline-propagation-go-chi-context-c-443?format=agents"}},{"id":"capacitor7-hardware-attestation-biometric-guardrail","title":"Capacitor 7 Hardware-Backed Key Attestation and Biometric Bridge Guardrail","category":"mobile","severity":"critical","description":"Enforces strict cryptographic signing of Capacitor 7 native bridge payloads using hardware-isolated private keys (iOS Secure Enclave and Android StrongBox/TEE). Binds every privileged IPC operation to an ephemeral server/native nonce and biometric authentication challenge to eliminate hybrid WebView session hijacking and compromised JavaScript context exploitation.","antiPatternHeadline":"Unsigned IPC Bridge Calls Relying on In-Memory Bearer Tokens in WebView Context","stars_count":70,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["capacitor","secure-enclave","android-strongbox","biometrics","cryptography","zero-trust-ipc","mobile-security"],"exportEndpoints":{"claude":"/api/rules/capacitor7-hardware-attestation-biometric-guardrail?format=claude","cursorMdc":"/api/rules/capacitor7-hardware-attestation-biometric-guardrail?format=mdc","cursorrules":"/api/rules/capacitor7-hardware-attestation-biometric-guardrail?format=cursor","windsurf":"/api/rules/capacitor7-hardware-attestation-biometric-guardrail?format=windsurf","agents":"/api/rules/capacitor7-hardware-attestation-biometric-guardrail?format=agents"}},{"id":"pg17-wal-block-summary-verification-standard","title":"PostgreSQL 17 Incremental Backup WAL Block Summary Verification Standard","category":"devops","severity":"critical","description":"Enforces strict validation of write-ahead log (WAL) block summarization records and cryptographic manifests prior to executing `pg_combinebackup`. Prevents catastrophic data corruption in incremental backup consolidation pipelines caused by missing WAL summaries, non-contiguous LSN ranges, or mismatched manifest checksums.","antiPatternHeadline":"Executing `pg_combinebackup` on unverified delta directories without cryptographic manifest and contiguous LSN range validation.","stars_count":85,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","postgresql","postgres17","backup-and-recovery","storage","infrastructure-as-code"],"exportEndpoints":{"claude":"/api/rules/pg17-wal-block-summary-verification-standard?format=claude","cursorMdc":"/api/rules/pg17-wal-block-summary-verification-standard?format=mdc","cursorrules":"/api/rules/pg17-wal-block-summary-verification-standard?format=cursor","windsurf":"/api/rules/pg17-wal-block-summary-verification-standard?format=windsurf","agents":"/api/rules/pg17-wal-block-summary-verification-standard?format=agents"}},{"id":"cilium-tetragon-in-kernel-namespace-escape-barrier","title":"Cilium Tetragon In-Kernel Namespace Escape and Privilege Escalation Enforcement Barrier","category":"security","severity":"critical","description":"Enforces synchronous, in-kernel containment of unauthorized namespace transitions and privilege escalations using Cilium Tetragon eBPF LSM and tracepoint hooks. Guarantees zero userspace round-trip latency by executing SIGKILL or override actions directly in the kernel ring before container breakouts complete. Prohibits asynchronous userspace detection loops that fail to prevent TOCTOU exploitation during setns, unshare, or commit_creds invocations.","antiPatternHeadline":"Asynchronous Userspace Alerting for Critical Namespace Escapes and Privilege Escalations","stars_count":47,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","ebpf","cilium-tetragon","lsm","container-security","kubernetes"],"exportEndpoints":{"claude":"/api/rules/cilium-tetragon-in-kernel-namespace-escape-barrier?format=claude","cursorMdc":"/api/rules/cilium-tetragon-in-kernel-namespace-escape-barrier?format=mdc","cursorrules":"/api/rules/cilium-tetragon-in-kernel-namespace-escape-barrier?format=cursor","windsurf":"/api/rules/cilium-tetragon-in-kernel-namespace-escape-barrier?format=windsurf","agents":"/api/rules/cilium-tetragon-in-kernel-namespace-escape-barrier?format=agents"}},{"id":"oauth2-dpop-distributed-nonce-sync-production-standard","title":"OAuth 2.0 DPoP (RFC 9449) Distributed Nonce Synchronization and Asymmetric Binding Guardrail","category":"security","severity":"critical","description":"Enforces strict asymmetric proof-of-possession verification and atomic single-use nonce synchronization across distributed gateway nodes. Prevents cross-cluster token replay, signature-stripping, and JWK thumbprint mismatch vulnerabilities under zero-trust perimeters.","antiPatternHeadline":"Local-Memory Nonce Cache with Unbound JWK Thumbprints Enabling Cross-Cluster Replay Attacks","stars_count":95,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","oauth2","dpop","rfc9449","zero-trust","jwt","redis"],"exportEndpoints":{"claude":"/api/rules/oauth2-dpop-distributed-nonce-sync-production-standard?format=claude","cursorMdc":"/api/rules/oauth2-dpop-distributed-nonce-sync-production-standard?format=mdc","cursorrules":"/api/rules/oauth2-dpop-distributed-nonce-sync-production-standard?format=cursor","windsurf":"/api/rules/oauth2-dpop-distributed-nonce-sync-production-standard?format=windsurf","agents":"/api/rules/oauth2-dpop-distributed-nonce-sync-production-standard?format=agents"}},{"id":"openfga-hierarchical-graph-max-depth-guardrail","title":"OpenFGA Graph Traversal Max-Depth and Cycle-Breaking Guardrail","category":"security","severity":"critical","description":"Enforces strict recursion depth constraints, pre-commit cycle detection, and bounded latency barriers during OpenFGA relationship tuple resolution. Prevents algorithmic denial-of-service (DoS) and thread exhaustion caused by cyclic or deeply nested relationship graphs during authorization checks.","antiPatternHeadline":"Unbounded Recursive Tuple Commit Leading to Cycle-Induced Resolution Hangs","stars_count":86,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","authorization","fine-grained-auth","graph-algorithms","dos-prevention"],"exportEndpoints":{"claude":"/api/rules/openfga-hierarchical-graph-max-depth-guardrail?format=claude","cursorMdc":"/api/rules/openfga-hierarchical-graph-max-depth-guardrail?format=mdc","cursorrules":"/api/rules/openfga-hierarchical-graph-max-depth-guardrail?format=cursor","windsurf":"/api/rules/openfga-hierarchical-graph-max-depth-guardrail?format=windsurf","agents":"/api/rules/openfga-hierarchical-graph-max-depth-guardrail?format=agents"}},{"id":"svelte-5-runes-dynamic-signal-cleanup-invariant","title":"Svelte 5 Runes Dynamic Signal Tree Memory Leak & Effect Disposal Invariant","category":"frontend","severity":"critical","description":"Mandates deterministic teardown and lifecycle anchoring for dynamic signals, derived computations, and effects created across deeply nested component trees and state modules in Svelte 5. Prevents silent memory accumulation, detached reactive subscriber trees, and zombie microtask execution caused by uncontained signal instantiations.","antiPatternHeadline":"Escaping Svelte 5 Component Effect Hierarchy via Unbound Dynamic Signals and Undisposed $effect.root Allocations","stars_count":97,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","signals","memory-leaks","reactivity"],"exportEndpoints":{"claude":"/api/rules/svelte-5-runes-dynamic-signal-cleanup-invariant?format=claude","cursorMdc":"/api/rules/svelte-5-runes-dynamic-signal-cleanup-invariant?format=mdc","cursorrules":"/api/rules/svelte-5-runes-dynamic-signal-cleanup-invariant?format=cursor","windsurf":"/api/rules/svelte-5-runes-dynamic-signal-cleanup-invariant?format=windsurf","agents":"/api/rules/svelte-5-runes-dynamic-signal-cleanup-invariant?format=agents"}},{"id":"nextjs-15-async-request-api-cache-isolation","title":"Next.js 15 Async Request Context & Cache Boundary Isolation","category":"frontend","severity":"critical","description":"Next.js 15 converts request primitives (cookies, headers, params, searchParams) to asynchronous Promises and enforces dynamic boundaries. Strict isolation must be maintained between async request context primitives and static/shared caching layers (such as unstable_cache) to prevent cross-tenant data leakage and cache poisoning.","antiPatternHeadline":"Accessing Dynamic Request Primitives Inside Shared Cache Callbacks or Unkeyed Shared Fetches","stars_count":90,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs15","security","cache-poisoning","rsc","multi-tenant"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-async-request-api-cache-isolation?format=claude","cursorMdc":"/api/rules/nextjs-15-async-request-api-cache-isolation?format=mdc","cursorrules":"/api/rules/nextjs-15-async-request-api-cache-isolation?format=cursor","windsurf":"/api/rules/nextjs-15-async-request-api-cache-isolation?format=windsurf","agents":"/api/rules/nextjs-15-async-request-api-cache-isolation?format=agents"}},{"id":"axum-tokio-cancellation-token-guardrail","title":"Axum 0.8 & Tokio Epoll Cooperative Task Cancellation Token Guardrail","category":"backend","severity":"critical","description":"Mandates deterministic cooperative cancellation propagation across Axum 0.8 HTTP request lifecycles, Tokio task trees, and active database transaction streams. Eliminates phantom resource starvation, unreleased database connection pool slots, and orphaned background tasks caused by implicit future drops and socket disconnects.","antiPatternHeadline":"Silent Future Dropping in Tokio Select! Leading to Orphaned Database Transactions and Connection Pool Starvation","stars_count":70,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tokio","async","cancellation-safety","concurrency"],"exportEndpoints":{"claude":"/api/rules/axum-tokio-cancellation-token-guardrail?format=claude","cursorMdc":"/api/rules/axum-tokio-cancellation-token-guardrail?format=mdc","cursorrules":"/api/rules/axum-tokio-cancellation-token-guardrail?format=cursor","windsurf":"/api/rules/axum-tokio-cancellation-token-guardrail?format=windsurf","agents":"/api/rules/axum-tokio-cancellation-token-guardrail?format=agents"}},{"id":"bun-worker-sharedarraybuffer-concurrency-fencing","title":"Bun 1.2 Native Worker SharedArrayBuffer Concurrency Fencing & Bounded Synchronization","category":"backend","severity":"critical","description":"Enforces strict synchronization fences and bounded timeouts on Atomics operations over SharedArrayBuffer memory segments between Bun 1.2 main processes and native Worker threads. Prevents event-loop thread starvation, unbounded blocking, and uncoordinated shared memory corruptions in high-throughput compute services.","antiPatternHeadline":"Unbounded Atomics.wait Blocking and Unsynchronized Direct SharedArrayBuffer Mutations Across Worker Threads","stars_count":54,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["bun","workers","sharedarraybuffer","atomics","concurrency","multithreading","backend"],"exportEndpoints":{"claude":"/api/rules/bun-worker-sharedarraybuffer-concurrency-fencing?format=claude","cursorMdc":"/api/rules/bun-worker-sharedarraybuffer-concurrency-fencing?format=mdc","cursorrules":"/api/rules/bun-worker-sharedarraybuffer-concurrency-fencing?format=cursor","windsurf":"/api/rules/bun-worker-sharedarraybuffer-concurrency-fencing?format=windsurf","agents":"/api/rules/bun-worker-sharedarraybuffer-concurrency-fencing?format=agents"}},{"id":"postgres-17-logical-replication-slot-failover-protocol","title":"PostgreSQL 17 Logical Replication Slot Failover and Standby Synchronization Protocol","category":"backend","severity":"critical","description":"Mandates strict declaration and management of PostgreSQL 17 failover-enabled logical replication slots (`failover = true`), coupled with primary `synchronized_standby_slots` retention and standby slot synchronization daemon orchestration. Prevents silent CDC stream loss, invalid LSN rewinds, and WAL truncation across physical standby promotion boundaries.","antiPatternHeadline":"Creating Logical Slots Without Failover Persistence or Standby WAL Retention Gates","stars_count":107,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql-17","cdc","logical-replication","streaming","high-availability"],"exportEndpoints":{"claude":"/api/rules/postgres-17-logical-replication-slot-failover-protocol?format=claude","cursorMdc":"/api/rules/postgres-17-logical-replication-slot-failover-protocol?format=mdc","cursorrules":"/api/rules/postgres-17-logical-replication-slot-failover-protocol?format=cursor","windsurf":"/api/rules/postgres-17-logical-replication-slot-failover-protocol?format=windsurf","agents":"/api/rules/postgres-17-logical-replication-slot-failover-protocol?format=agents"}},{"id":"openfga-rebac-depth-circuit-breaker","title":"OpenFGA Relationship-Based Access Control Traversal Circuit Breaker","category":"security","severity":"critical","description":"Enforces strict resolution depth invariants, cyclic graph detection, and sub-graph memoization on OpenFGA Check and Expand operations. Prevents graph traversal denial-of-service (Graph DoS) and cascading latency blow-ups caused by unbounded recursive relation trees and unvetted contextual tuples.","antiPatternHeadline":"Executing unbounded OpenFGA checks with raw contextual tuples without depth limits or latency circuit breakers.","stars_count":118,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","rebac","authorization","circuit-breaker","dos-prevention"],"exportEndpoints":{"claude":"/api/rules/openfga-rebac-depth-circuit-breaker?format=claude","cursorMdc":"/api/rules/openfga-rebac-depth-circuit-breaker?format=mdc","cursorrules":"/api/rules/openfga-rebac-depth-circuit-breaker?format=cursor","windsurf":"/api/rules/openfga-rebac-depth-circuit-breaker?format=windsurf","agents":"/api/rules/openfga-rebac-depth-circuit-breaker?format=agents"}},{"id":"fastapi-pydantic-v2-deserialization-sandbox-guardrail","title":"FastAPI Pydantic v2 Zero-Copy Deserialization and Memory Sandbox Standard","category":"security","severity":"critical","description":"Enforces strict streaming payload size limits, recursion depth boundaries, and explicit pydantic-core unmarshaling constraints for edge-facing API gateways. This prevents memory exhaustion, stack overflow micro-DoS, and catastrophic CPU pinning from malformed or deeply nested JSON payloads during Rust-to-Python boundary transitions.","antiPatternHeadline":"Unbounded Raw JSON Parsing with Default FastAPI Body Unmarshaling","stars_count":109,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","fastapi","pydantic-v2","pydantic-core","dos-prevention","api-gateway"],"exportEndpoints":{"claude":"/api/rules/fastapi-pydantic-v2-deserialization-sandbox-guardrail?format=claude","cursorMdc":"/api/rules/fastapi-pydantic-v2-deserialization-sandbox-guardrail?format=mdc","cursorrules":"/api/rules/fastapi-pydantic-v2-deserialization-sandbox-guardrail?format=cursor","windsurf":"/api/rules/fastapi-pydantic-v2-deserialization-sandbox-guardrail?format=windsurf","agents":"/api/rules/fastapi-pydantic-v2-deserialization-sandbox-guardrail?format=agents"}},{"id":"kmp-native-stateflow-thread-confinement-guardrail","title":"Kotlin/Native StateFlow to Swift Actor Dispatcher & Immutability Fence Architecture","category":"mobile","severity":"critical","description":"Enforces strict dispatcher confinement and deep value immutability when exporting Kotlin Coroutines StateFlow primitives across the Darwin Objective-C/Swift interop boundary. Prevents non-deterministic data races, memory corruption, and Swift 6 runtime actor isolation violations by enforcing Main.immediate dispatcher bridges and explicit unsubscription lifecycles.","antiPatternHeadline":"Direct Unconfined StateFlow Collection Across Kotlin/Native and Swift Actor Boundaries","stars_count":48,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","kmp","swift-concurrency","stateflow","coroutines","ios"],"exportEndpoints":{"claude":"/api/rules/kmp-native-stateflow-thread-confinement-guardrail?format=claude","cursorMdc":"/api/rules/kmp-native-stateflow-thread-confinement-guardrail?format=mdc","cursorrules":"/api/rules/kmp-native-stateflow-thread-confinement-guardrail?format=cursor","windsurf":"/api/rules/kmp-native-stateflow-thread-confinement-guardrail?format=windsurf","agents":"/api/rules/kmp-native-stateflow-thread-confinement-guardrail?format=agents"}},{"id":"opentelemetry-w3c-baggage-boundary-pii-redaction","title":"OpenTelemetry W3C Baggage Cryptographic Invariant & PII Boundary Standard","category":"devops","severity":"critical","description":"Enforces strict schema validation, allowlisted key boundaries, and cryptographic HMAC signatures on all incoming and outgoing OpenTelemetry W3C Baggage headers. Prevents downstream privilege escalation through context tampering, suppresses cross-service identity spoofing, and eliminates GDPR/CCPA log contamination by blocking unauthorized baggage injection and redacting sensitive PII before trace propagation.","antiPatternHeadline":"Unvalidated W3C Baggage Passthrough Enabling Context Tampering and Downstream PII Leakage","stars_count":51,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","security","distributed-tracing","pii-redaction","w3c-baggage"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-w3c-baggage-boundary-pii-redaction?format=claude","cursorMdc":"/api/rules/opentelemetry-w3c-baggage-boundary-pii-redaction?format=mdc","cursorrules":"/api/rules/opentelemetry-w3c-baggage-boundary-pii-redaction?format=cursor","windsurf":"/api/rules/opentelemetry-w3c-baggage-boundary-pii-redaction?format=windsurf","agents":"/api/rules/opentelemetry-w3c-baggage-boundary-pii-redaction?format=agents"}},{"id":"vite6-module-federation-hmr-state-reconciliation","title":"Vite 6 Module Federation Hot Module Replacement (HMR) State Reconciliation Guardrail","category":"frontend","severity":"critical","description":"Enforces deterministic cross-remote module graph invalidation, isolated boundary lifecycle disposal, and synchronized runtime registry cleanup during Hot Module Replacement (HMR) in Vite 6 Module Federation architectures. Eliminates cascade invalidation loops, memory leaks from dangling host listeners, and catastrophic full-page reloads when shared dependencies or exposed federation modules are updated in development mode.","antiPatternHeadline":"Cascade Boundary Invalidation and Leaked Remote State Causing Cyclic Hard Refreshes in Vite 6 MF","stars_count":97,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","vite","module-federation","hmr","micro-frontends","esm"],"exportEndpoints":{"claude":"/api/rules/vite6-module-federation-hmr-state-reconciliation?format=claude","cursorMdc":"/api/rules/vite6-module-federation-hmr-state-reconciliation?format=mdc","cursorrules":"/api/rules/vite6-module-federation-hmr-state-reconciliation?format=cursor","windsurf":"/api/rules/vite6-module-federation-hmr-state-reconciliation?format=windsurf","agents":"/api/rules/vite6-module-federation-hmr-state-reconciliation?format=agents"}},{"id":"vite6-rolldown-environment-sharding-standard","title":"Vite 6 Rolldown Environment-Scoped Module Sharding Standard","category":"frontend","severity":"critical","description":"Enforces strict compile-time runtime isolation between client, server, and worker graphs under the Vite 6 Environment API and Rolldown bundler. Prohibits cross-environment symbol bleed, insecure conditional imports relying on runtime presence checks, and shared barrel exports that leak server-only secrets or database primitives into browser manifests. Mandates compile-time condition sharding, environment module manifests, and strict virtual boundary checks.","antiPatternHeadline":"Leaking Server Credentials and Secrets via Unisolated Runtime-Guarded Barrel Imports Across Vite 6 Environments","stars_count":119,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","vite6","rolldown","security","module-isolation","environment-api"],"exportEndpoints":{"claude":"/api/rules/vite6-rolldown-environment-sharding-standard?format=claude","cursorMdc":"/api/rules/vite6-rolldown-environment-sharding-standard?format=mdc","cursorrules":"/api/rules/vite6-rolldown-environment-sharding-standard?format=cursor","windsurf":"/api/rules/vite6-rolldown-environment-sharding-standard?format=windsurf","agents":"/api/rules/vite6-rolldown-environment-sharding-standard?format=agents"}},{"id":"react-native-turbomodule-thread-confinement","title":"React Native 0.78 Bridgeless TurboModule Thread Confinement & JSI Isolation","category":"mobile","severity":"critical","description":"Enforces strict thread confinement for JSI HostObjects and native TurboModule invocations under React Native 0.78 Bridgeless mode. Prohibits background threads from directly allocating, capturing, or dereferencing JS thread-bound jsi::Runtime structures, completely mitigating main-thread priority inversions, deadlocks, and memory corruption.","antiPatternHeadline":"Retaining Raw JSI HostObjects or Capturing jsi::Runtime State Inside Background Queues","stars_count":75,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","react-native","turbomodules","jsi","bridgeless","concurrency","c++"],"exportEndpoints":{"claude":"/api/rules/react-native-turbomodule-thread-confinement?format=claude","cursorMdc":"/api/rules/react-native-turbomodule-thread-confinement?format=mdc","cursorrules":"/api/rules/react-native-turbomodule-thread-confinement?format=cursor","windsurf":"/api/rules/react-native-turbomodule-thread-confinement?format=windsurf","agents":"/api/rules/react-native-turbomodule-thread-confinement?format=agents"}},{"id":"fastapi-streaming-pydantic-backpressure-drain","title":"FastAPI Streaming: Rust-Pydantic Zero-Copy & TCP Backpressure Drain Invariant","category":"backend","severity":"critical","description":"Enforces zero-copy byte serialization via Pydantic V2 Rust core and synchronous socket drain propagation on FastAPI SSE/StreamingResponse generators. Prevents resident set size (RSS) bloat and out-of-memory cascades under asymmetric network conditions by halting async producer loops when the client TCP buffer saturates or closes.","antiPatternHeadline":"Unbounded Async Queue Decoupling with Python Object Materialization in SSE Streams","stars_count":66,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","pydantic","sse","memory-management","backpressure","asyncio"],"exportEndpoints":{"claude":"/api/rules/fastapi-streaming-pydantic-backpressure-drain?format=claude","cursorMdc":"/api/rules/fastapi-streaming-pydantic-backpressure-drain?format=mdc","cursorrules":"/api/rules/fastapi-streaming-pydantic-backpressure-drain?format=cursor","windsurf":"/api/rules/fastapi-streaming-pydantic-backpressure-drain?format=windsurf","agents":"/api/rules/fastapi-streaming-pydantic-backpressure-drain?format=agents"}},{"id":"pg17-failover-logical-slot-sync-invariant","title":"Postgres 17 Logical Replication Slot Synchronization on Physical Failover Guardrail","category":"backend","severity":"critical","description":"Enforces failover-ready logical replication slots introduced in PostgreSQL 17 to prevent duplicate emissions, dropped CDC events, and LSN divergence across physical standby failover promotions. Mandates synchronized slots via pg_create_logical_replication_slot(..., failover => true) coupled with primary-side synchronized standby slot reservations. Eliminates dual-consumer race conditions and state corruption during high-availability orchestrations.","antiPatternHeadline":"Creating Logical Slots Without Failover Synchronization Causing Data Loss or Uncontrolled Event Replay Upon Primary Promotion","stars_count":105,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","postgres-17","cdc","logical-replication","debezium","high-availability"],"exportEndpoints":{"claude":"/api/rules/pg17-failover-logical-slot-sync-invariant?format=claude","cursorMdc":"/api/rules/pg17-failover-logical-slot-sync-invariant?format=mdc","cursorrules":"/api/rules/pg17-failover-logical-slot-sync-invariant?format=cursor","windsurf":"/api/rules/pg17-failover-logical-slot-sync-invariant?format=windsurf","agents":"/api/rules/pg17-failover-logical-slot-sync-invariant?format=agents"}},{"id":"wasi-0-2-component-model-sandbox-standard","title":"WASI 0.2 Component Model Capability-Scoped Sandbox Standard","category":"backend","severity":"critical","description":"Mandates zero-shared-memory execution boundaries and explicit capability mediation for untrusted tenant plugins using the WebAssembly System Interface (WASI 0.2) Component Model. Eliminates ambient authority by restricting imports to capability-scoped WIT interfaces, requiring per-execution store isolation, and enforcing strict resource metering (fuel/epoch deadlines).","antiPatternHeadline":"Ambient Host Authority Inheritance and Unmetered Shared-Instance Execution in Multi-Tenant WebAssembly Hosts","stars_count":49,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","wasi","webassembly","component-model","sandboxing","multi-tenancy","security"],"exportEndpoints":{"claude":"/api/rules/wasi-0-2-component-model-sandbox-standard?format=claude","cursorMdc":"/api/rules/wasi-0-2-component-model-sandbox-standard?format=mdc","cursorrules":"/api/rules/wasi-0-2-component-model-sandbox-standard?format=cursor","windsurf":"/api/rules/wasi-0-2-component-model-sandbox-standard?format=windsurf","agents":"/api/rules/wasi-0-2-component-model-sandbox-standard?format=agents"}},{"id":"go-124-weak-pointer-contextual-middleware-eviction-invariant","title":"Go 1.24 Weak-Pointer Contextual Middleware Eviction Invariant","category":"backend","severity":"critical","description":"Enforces deterministic eviction of scoped request metadata and auxiliary telemetry stored in process-wide middleware registries using Go 1.24 weak pointers (weak.Make). Eliminates cross-goroutine memory retention and context-bound memory leaks in long-running services without resorting to runtime.SetFinalizer, finalizer queues, or premature garbage collector retention.","antiPatternHeadline":"Retaining Strong References to Short-Lived HTTP Contexts in Global Middleware Registries or Finalizer Queues","stars_count":115,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","golang","go124","memory-management","weak-pointers","concurrency","middleware"],"exportEndpoints":{"claude":"/api/rules/go-124-weak-pointer-contextual-middleware-eviction-invariant?format=claude","cursorMdc":"/api/rules/go-124-weak-pointer-contextual-middleware-eviction-invariant?format=mdc","cursorrules":"/api/rules/go-124-weak-pointer-contextual-middleware-eviction-invariant?format=cursor","windsurf":"/api/rules/go-124-weak-pointer-contextual-middleware-eviction-invariant?format=windsurf","agents":"/api/rules/go-124-weak-pointer-contextual-middleware-eviction-invariant?format=agents"}},{"id":"openfga-contextual-tuple-bounded-depth-invariant","title":"OpenFGA Contextual Tuple Graph Traversal Bounded-Depth & Tenant Barrier Invariant","category":"security","severity":"critical","description":"Enforces strict tenant boundary isolation and deterministic graph evaluation horizons during Relationship-Based Access Control (ReBAC) evaluations with OpenFGA. Prevents arbitrary cyclic contextual tuple injection, unbounded graph resolution denial-of-service, and cross-tenant privilege escalation (New Enemy problem).","antiPatternHeadline":"Unsanitized Contextual Tuples and Unbounded Graph Traversal in OpenFGA Check Calls","stars_count":68,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","rebac","openfga","authorization","multi-tenancy","denial-of-service"],"exportEndpoints":{"claude":"/api/rules/openfga-contextual-tuple-bounded-depth-invariant?format=claude","cursorMdc":"/api/rules/openfga-contextual-tuple-bounded-depth-invariant?format=mdc","cursorrules":"/api/rules/openfga-contextual-tuple-bounded-depth-invariant?format=cursor","windsurf":"/api/rules/openfga-contextual-tuple-bounded-depth-invariant?format=windsurf","agents":"/api/rules/openfga-contextual-tuple-bounded-depth-invariant?format=agents"}},{"id":"ebpf-bpflsm-container-exec-constraint-standard","title":"eBPF BPF-LSM Container Binary Execution and Memory Protection Guardrail","category":"security","severity":"critical","description":"Restricts executable memory mapping calls (`mprotect`, `mmap`) and process executions (`bprm_check_security`) at the kernel LSM layer to immutable, verified container rootfs mounts. Hardens runtime workloads against fileless ELF injection (memfd_create), arbitrary reverse shells, and untrusted shared-object loading by validating inode backing and namespace cgroup identifiers in kernel space.","antiPatternHeadline":"Relying on Userspace Runtime Monitors or Post-Exec Syscall Filters Allowing Memory Injection and Ephemeral Binaries","stars_count":98,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","ebpf","lsm","containers","linux-kernel","runtime-security"],"exportEndpoints":{"claude":"/api/rules/ebpf-bpflsm-container-exec-constraint-standard?format=claude","cursorMdc":"/api/rules/ebpf-bpflsm-container-exec-constraint-standard?format=mdc","cursorrules":"/api/rules/ebpf-bpflsm-container-exec-constraint-standard?format=cursor","windsurf":"/api/rules/ebpf-bpflsm-container-exec-constraint-standard?format=windsurf","agents":"/api/rules/ebpf-bpflsm-container-exec-constraint-standard?format=agents"}},{"id":"k8s-132-dra-cdi-device-claim-invariant","title":"Kubernetes 1.32 Dynamic Resource Allocation (DRA) Structured CDI Device Claim Invariant","category":"devops","severity":"critical","description":"Enforces Kubernetes 1.32 Dynamic Resource Allocation (DRA) structured parameters and Container Device Interface (CDI) contracts over legacy opaque integer device requests. Eliminates cross-socket NUMA penalties, PCIe root complex contention, and NVLink topology partitioning by mandating CEL-based DeviceClass selector claims for all accelerator-bound inference pods.","antiPatternHeadline":"Assigning AI workloads via opaque integer device limits ('nvidia.com/gpu') without topology-aware DRA resource claims.","stars_count":62,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["kubernetes","k8s-1.32","dra","cdi","gpu-orchestration","ai-inference","topology-aware-scheduling"],"exportEndpoints":{"claude":"/api/rules/k8s-132-dra-cdi-device-claim-invariant?format=claude","cursorMdc":"/api/rules/k8s-132-dra-cdi-device-claim-invariant?format=mdc","cursorrules":"/api/rules/k8s-132-dra-cdi-device-claim-invariant?format=cursor","windsurf":"/api/rules/k8s-132-dra-cdi-device-claim-invariant?format=windsurf","agents":"/api/rules/k8s-132-dra-cdi-device-claim-invariant?format=agents"}},{"id":"openfga-graph-cycle-depth-limit-invariant","title":"OpenFGA 1.6+ Tuple-To-Userset Graph Cycle and Depth Limit Invariant","category":"security","severity":"critical","description":"Deeply nested ReBAC relationship evaluations over tuple-to-userset (TTU) chains must enforce strict acyclic invariants and deterministic graph traversal boundaries. Failure to validate DAG properties at tuple ingestion and unconstrained recursive evaluations lead to CPU exhaustion, authorization timeouts, and Denial-of-Service (DoS) in critical path authorization checks. Systems must enforce proactive cycle prevention at mutation time and explicit bounded depth guardrails during evaluation.","antiPatternHeadline":"Unvalidated Cyclic TTU Relationship Ingestion Causing Authorization Engine Starvation","stars_count":79,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","rebac","authorization","graph-algorithms","cycle-detection"],"exportEndpoints":{"claude":"/api/rules/openfga-graph-cycle-depth-limit-invariant?format=claude","cursorMdc":"/api/rules/openfga-graph-cycle-depth-limit-invariant?format=mdc","cursorrules":"/api/rules/openfga-graph-cycle-depth-limit-invariant?format=cursor","windsurf":"/api/rules/openfga-graph-cycle-depth-limit-invariant?format=windsurf","agents":"/api/rules/openfga-graph-cycle-depth-limit-invariant?format=agents"}},{"id":"react-19-action-transition-idempotency","title":"React 19 useActionState Deterministic Client Idempotency Guardrail","category":"frontend","severity":"critical","description":"Enforces deterministic, pre-transition generation of client idempotency keys when pairing React 19 useActionState with optimistic rendering. Prevents duplicate mutations and split-brain state desynchronization caused by re-generating UUIDs inside re-entrant async actions or concurrent render passes during network retries.","antiPatternHeadline":"Generating Nonce or Idempotency Keys Inside Re-Entrant Actions or Volatile Render Lifecycles","stars_count":90,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react19","useActionState","useOptimistic","idempotency","concurrency"],"exportEndpoints":{"claude":"/api/rules/react-19-action-transition-idempotency?format=claude","cursorMdc":"/api/rules/react-19-action-transition-idempotency?format=mdc","cursorrules":"/api/rules/react-19-action-transition-idempotency?format=cursor","windsurf":"/api/rules/react-19-action-transition-idempotency?format=windsurf","agents":"/api/rules/react-19-action-transition-idempotency?format=agents"}},{"id":"axum-08-zerocopy-multipart-bounded-stream","title":"Axum 0.8 Zero-Copy Multipart Stream Bounded Allocation Standard","category":"backend","severity":"critical","description":"Enforces strict per-stream memory quotas and backpressure-driven chunk draining for multipart streaming uploads in Axum 0.8. Prevents catastrophic process memory exhaustion (OOM) and heap fragmentation caused by unbounded buffering under high-concurrency HTTP/2 and HTTP/3 multiplexing.","antiPatternHeadline":"Unbounded In-Memory Accumulation via `field.bytes()` or Unmetered Heap Appends in Streaming Handlers","stars_count":95,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["axum","rust","tokio","multipart","streaming","zero-copy","backpressure","http3"],"exportEndpoints":{"claude":"/api/rules/axum-08-zerocopy-multipart-bounded-stream?format=claude","cursorMdc":"/api/rules/axum-08-zerocopy-multipart-bounded-stream?format=mdc","cursorrules":"/api/rules/axum-08-zerocopy-multipart-bounded-stream?format=cursor","windsurf":"/api/rules/axum-08-zerocopy-multipart-bounded-stream?format=windsurf","agents":"/api/rules/axum-08-zerocopy-multipart-bounded-stream?format=agents"}},{"id":"tauri-v2-mobile-ipc-capability-sandboxing-tauri-2-0-cross--356","title":"Tauri 2.0 Mobile & Multi-Window IPC Capability Sandboxing Standard","category":"mobile","severity":"critical","description":"Enforces explicit, least-privilege IPC capability manifests with strict window and webview label scoping for Tauri 2.0 mobile and multi-window architectures. Eliminates wildcard capability assignments to prevent compromised secondary or external webviews from invoking host OS primitives.","antiPatternHeadline":"Global Wildcard Window Capability Grants Across Multi-Window Mobile Contexts","stars_count":61,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri-2","security","ipc","sandboxing","capabilities"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-mobile-ipc-capability-sandboxing-tauri-2-0-cross--356?format=claude","cursorMdc":"/api/rules/tauri-v2-mobile-ipc-capability-sandboxing-tauri-2-0-cross--356?format=mdc","cursorrules":"/api/rules/tauri-v2-mobile-ipc-capability-sandboxing-tauri-2-0-cross--356?format=cursor","windsurf":"/api/rules/tauri-v2-mobile-ipc-capability-sandboxing-tauri-2-0-cross--356?format=windsurf","agents":"/api/rules/tauri-v2-mobile-ipc-capability-sandboxing-tauri-2-0-cross--356?format=agents"}},{"id":"cilium-ebpf-big-tcp-ipv6-extension-header-mtu-boundary","title":"Cilium eBPF BIG TCP with IPv6 Extension Header MTU Boundary Enforcement","category":"devops","severity":"critical","description":"Enabling IPv6 BIG TCP across 100GbE+ fabrics increases GRO/GSO limits up to 194KB per super-packet, making silent packet truncation catastrophic. All Cilium eBPF tail programs and BPF-to-BPF functions handling IPv6 packets must account for cumulative IPv6 extension header chains (HBH, Routing, Fragment, DSR) before validating against the hardware interface GSO maximum and L2 MTU limits. Failure to accurately compute effective payload boundaries leads to silent hardware ring-buffer drops or invalid unfragmentable egress packet states.","antiPatternHeadline":"Hardcoded Base MTU Offsets and Incomplete IPv6 Extension Header Length Accounting in Super-Packet Pipelines","stars_count":84,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","cilium","ebpf","big-tcp","ipv6","networking","kernel","bpf"],"exportEndpoints":{"claude":"/api/rules/cilium-ebpf-big-tcp-ipv6-extension-header-mtu-boundary?format=claude","cursorMdc":"/api/rules/cilium-ebpf-big-tcp-ipv6-extension-header-mtu-boundary?format=mdc","cursorrules":"/api/rules/cilium-ebpf-big-tcp-ipv6-extension-header-mtu-boundary?format=cursor","windsurf":"/api/rules/cilium-ebpf-big-tcp-ipv6-extension-header-mtu-boundary?format=windsurf","agents":"/api/rules/cilium-ebpf-big-tcp-ipv6-extension-header-mtu-boundary?format=agents"}},{"id":"svelte-5-reactive-proxy-teardown-invariant","title":"Svelte 5 Fine-Grained Reactive Proxy Teardown and Lifetime Scoping Invariant","category":"frontend","severity":"critical","description":"Enforces deterministic subscriber disposal and boundary isolation for shared mutable $state proxies in Svelte 5. Prevents catastrophic client-side memory retention caused by module-level reactive singletons capturing component scope closures without explicit teardown during client-side navigation.","antiPatternHeadline":"Module-Level $state Proxies Leaking Retained Component Scopes Across Route Transitions","stars_count":111,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","state-proxy","memory-leaks","performance"],"exportEndpoints":{"claude":"/api/rules/svelte-5-reactive-proxy-teardown-invariant?format=claude","cursorMdc":"/api/rules/svelte-5-reactive-proxy-teardown-invariant?format=mdc","cursorrules":"/api/rules/svelte-5-reactive-proxy-teardown-invariant?format=cursor","windsurf":"/api/rules/svelte-5-reactive-proxy-teardown-invariant?format=windsurf","agents":"/api/rules/svelte-5-reactive-proxy-teardown-invariant?format=agents"}},{"id":"kmp-stateflow-darwin-runloop-deadlock-guardrail","title":"Lock-Free StateFlow-to-Darwin RunLoop Bridging and Re-Entrancy Invariant","category":"mobile","severity":"critical","description":"Mandates lock-free, asynchronous memory-fenced coordination when bridging Kotlin Multiplatform (Kotlin 2.1+) Coroutine StateFlow streams to Darwin CFRunLoop and Swift MainActor execution contexts. Prohibits synchronous queue synchronization (dispatch_sync), runBlocking on Main/UI threads, and re-entrant lock acquisition during high-frequency UI event cycles.","antiPatternHeadline":"Synchronous Darwin RunLoop Dispatching and Re-Entrant Lock Contention in StateFlow Bridges","stars_count":73,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kmp","kotlin-native","coroutines","darwin","swift-interop","concurrency"],"exportEndpoints":{"claude":"/api/rules/kmp-stateflow-darwin-runloop-deadlock-guardrail?format=claude","cursorMdc":"/api/rules/kmp-stateflow-darwin-runloop-deadlock-guardrail?format=mdc","cursorrules":"/api/rules/kmp-stateflow-darwin-runloop-deadlock-guardrail?format=cursor","windsurf":"/api/rules/kmp-stateflow-darwin-runloop-deadlock-guardrail?format=windsurf","agents":"/api/rules/kmp-stateflow-darwin-runloop-deadlock-guardrail?format=agents"}},{"id":"webauthn-mds3-aaguid-hardware-class-whitelist-invariant","title":"FIDO2 MDS3 AAGUID Hardware-Class Whitelist Enforcement Guardrail","category":"security","severity":"critical","description":"Enterprise authentication workflows must enforce direct attestation and validate the Authenticator Attestation GUID (AAGUID) against FIDO Alliance Metadata Service v3 (MDS3). The registration pipeline must cryptographically reject synced multi-device passkeys (all-zero AAGUIDs or uncertified software authenticators) and require certified hardware security keys matching an enterprise trust list with acceptable FIDO certification levels (e.g., FIDO_CERTIFIED_L2 or higher).","antiPatternHeadline":"Acceptance of Synced Multi-Device Passkeys or Unverified AAGUIDs in Enterprise-Bound Hardware Workflows","stars_count":114,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","fido2","mds3","aaguid","passkeys","cryptography"],"exportEndpoints":{"claude":"/api/rules/webauthn-mds3-aaguid-hardware-class-whitelist-invariant?format=claude","cursorMdc":"/api/rules/webauthn-mds3-aaguid-hardware-class-whitelist-invariant?format=mdc","cursorrules":"/api/rules/webauthn-mds3-aaguid-hardware-class-whitelist-invariant?format=cursor","windsurf":"/api/rules/webauthn-mds3-aaguid-hardware-class-whitelist-invariant?format=windsurf","agents":"/api/rules/webauthn-mds3-aaguid-hardware-class-whitelist-invariant?format=agents"}},{"id":"postgres-17-radix-tree-tidstore-maintenance-budget-guardrail","title":"Postgres 17 Radix Tree TidStore Maintenance Memory Budgeting Standard","category":"backend","severity":"critical","description":"PostgreSQL 17 introduces an adaptive radix tree (TidStore) for dead tuple tracking during VACUUM, drastically reducing memory usage from ~6 bytes to ~1.5–2 bytes per dead tuple. However, uncalibrated maintenance_work_mem or autovacuum_work_mem allocations during high-churn append workloads will either trigger catastrophic multi-pass index vacuuming or induce OS Out-Of-Memory (OOM) kills across concurrent workers.","antiPatternHeadline":"Static Unbudgeted Maintenance Memory Spawning Multi-Pass Index Sweeps or OOM Faults","stars_count":114,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres","vacuum","tidstore","memory-budgeting","database-reliability"],"exportEndpoints":{"claude":"/api/rules/postgres-17-radix-tree-tidstore-maintenance-budget-guardrail?format=claude","cursorMdc":"/api/rules/postgres-17-radix-tree-tidstore-maintenance-budget-guardrail?format=mdc","cursorrules":"/api/rules/postgres-17-radix-tree-tidstore-maintenance-budget-guardrail?format=cursor","windsurf":"/api/rules/postgres-17-radix-tree-tidstore-maintenance-budget-guardrail?format=windsurf","agents":"/api/rules/postgres-17-radix-tree-tidstore-maintenance-budget-guardrail?format=agents"}},{"id":"vite-6-module-federation-sri-csp-guardrail","title":"Vite 6 Module Federation Dynamic Remote SRI & CSP Nonce Guardrail","category":"frontend","severity":"critical","description":"Dynamic micro-frontend remote container resolution under the Vite 6 runtime environment must enforce automated Subresource Integrity (SRI) hashing and Content Security Policy (CSP) nonce synchronization. Omitting cryptographic hash validation on dynamically loaded remote entry bundles exposes host applications to supply-chain tampering and remote-code execution via compromised CDN edges.","antiPatternHeadline":"Arbitrary Dynamic Remote Script Injection Without SRI Verification or CSP Nonce Binding","stars_count":84,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","vite-6","module-federation","subresource-integrity","content-security-policy","app-sec"],"exportEndpoints":{"claude":"/api/rules/vite-6-module-federation-sri-csp-guardrail?format=claude","cursorMdc":"/api/rules/vite-6-module-federation-sri-csp-guardrail?format=mdc","cursorrules":"/api/rules/vite-6-module-federation-sri-csp-guardrail?format=cursor","windsurf":"/api/rules/vite-6-module-federation-sri-csp-guardrail?format=windsurf","agents":"/api/rules/vite-6-module-federation-sri-csp-guardrail?format=agents"}},{"id":"nextjs15-ppr-dynamic-hole-cache-fence","title":"Next.js 15 Partial Prerendering (PPR) Dynamic Hole Cache Fence","category":"frontend","severity":"critical","description":"Enforces strict tenant isolation and credential segregation within Next.js 15 Partial Prerendering (PPR) architectures. Prevents cross-request session poisoning and unintended build-time evaluation of per-user identity contexts by fencing dynamic user data within Suspense boundaries wrapped in dynamic request boundaries. Guarantees that static shell segments remain context-agnostic, while tenant-specific, cookie-dependent, or header-dependent payloads execute exclusively inside deferred dynamic streaming holes.","antiPatternHeadline":"Leaking Multi-Tenant Identity Contexts into the Pre-rendered Static Shell or Prematurely Collapsing PPR into Full Dynamic Rendering","stars_count":112,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs","partial-prerendering","ppr","multi-tenant","security","suspense","caching"],"exportEndpoints":{"claude":"/api/rules/nextjs15-ppr-dynamic-hole-cache-fence?format=claude","cursorMdc":"/api/rules/nextjs15-ppr-dynamic-hole-cache-fence?format=mdc","cursorrules":"/api/rules/nextjs15-ppr-dynamic-hole-cache-fence?format=cursor","windsurf":"/api/rules/nextjs15-ppr-dynamic-hole-cache-fence?format=windsurf","agents":"/api/rules/nextjs15-ppr-dynamic-hole-cache-fence?format=agents"}},{"id":"vite6-multi-runtime-hydration-integrity","title":"Vite 6 Environment API Multi-Runtime Hydration Integrity and Module Isolation Guardrail","category":"frontend","severity":"critical","description":"Enforces deterministic module evaluation, condition resolution, and state isolation across heterogeneous runtime targets (Node.js, Edge Workers, and Browser) via the Vite 6 Environment API. Prevents cross-environment module graph leakage, single-binary state contamination, and runtime-induced hydration discrepancies during simultaneous multi-runtime builds.","antiPatternHeadline":"Cross-Runtime Module Graph Contamination and Non-Deterministic Hydration Failure","stars_count":50,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["vite","vite-6","environment-api","ssr","edge-runtime","hydration","cloudflare-workers"],"exportEndpoints":{"claude":"/api/rules/vite6-multi-runtime-hydration-integrity?format=claude","cursorMdc":"/api/rules/vite6-multi-runtime-hydration-integrity?format=mdc","cursorrules":"/api/rules/vite6-multi-runtime-hydration-integrity?format=cursor","windsurf":"/api/rules/vite6-multi-runtime-hydration-integrity?format=windsurf","agents":"/api/rules/vite6-multi-runtime-hydration-integrity?format=agents"}},{"id":"tauri2-zero-copy-ipc-backpressure-protocol","title":"Tauri 2.0 Zero-Copy IPC Backpressure Protocol for Mobile WebViews","category":"mobile","severity":"critical","description":"Enforces pull-based reactive streaming and credit-gated flow control across the Rust-to-WebView binary bridge on mobile targets. Unbounded event emission across Tauri 2.0 IPC causes microtask queue backlog and uncollectable ArrayBuffer allocations in mobile V8/JavaScriptCore heaps, leading to non-catchable low-memory kills (OOM). This guardrail mandates bounded chunk windows, deterministic ACK handshakes, and native channel disposal.","antiPatternHeadline":"Unbounded Push-Based Event Streaming Saturating Mobile WebView Heap","stars_count":51,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri","ipc","backpressure","rust","memory-management","zero-copy"],"exportEndpoints":{"claude":"/api/rules/tauri2-zero-copy-ipc-backpressure-protocol?format=claude","cursorMdc":"/api/rules/tauri2-zero-copy-ipc-backpressure-protocol?format=mdc","cursorrules":"/api/rules/tauri2-zero-copy-ipc-backpressure-protocol?format=cursor","windsurf":"/api/rules/tauri2-zero-copy-ipc-backpressure-protocol?format=windsurf","agents":"/api/rules/tauri2-zero-copy-ipc-backpressure-protocol?format=agents"}},{"id":"kmp-skiko-darwin-metal-queue-sync","title":"KMP Skiko Metal Render Thread Darwin Main Queue Synchronization","category":"mobile","severity":"critical","description":"Enforces strict synchronization boundaries between Kotlin Multiplatform Skiko Metal drawing routines and Darwin's Grand Central Dispatch (GCD) main queue. Failure to isolate and properly interop with the main thread during CAMetalLayer transactions causes GPU command buffer stalling, UI thread deadlock, and hitch rates exceeding 60 FPS cadences on iOS.","antiPatternHeadline":"Direct CAMetalLayer Drawing or Synchronous Main Thread Blocking from Skiko Render Loop","stars_count":42,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kmp","compose-multiplatform","skiko","metal","ios","concurrency"],"exportEndpoints":{"claude":"/api/rules/kmp-skiko-darwin-metal-queue-sync?format=claude","cursorMdc":"/api/rules/kmp-skiko-darwin-metal-queue-sync?format=mdc","cursorrules":"/api/rules/kmp-skiko-darwin-metal-queue-sync?format=cursor","windsurf":"/api/rules/kmp-skiko-darwin-metal-queue-sync?format=windsurf","agents":"/api/rules/kmp-skiko-darwin-metal-queue-sync?format=agents"}},{"id":"fastapi-python313-freethreaded-memory-fence","title":"Python 3.13 Free-Threaded Shared Memory Fence and Concurrency Guardrails for FastAPI","category":"backend","severity":"critical","description":"Enforces strict memory isolation, explicit synchronization fences, and lock-free concurrency primitives when running FastAPI under Python 3.13 free-threaded mode (PEP 703 / nogil). Without the Global Interpreter Lock, shared mutable state across asynchronous event loops, thread pools, and subinterpreters will cause race conditions, heap corruption, and phantom writes during high-throughput I/O.","antiPatternHeadline":"Unsynchronized Mutable In-Memory State and Naked Cross-Thread Object Sharing in Free-Threaded (nogil) Runtimes","stars_count":56,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","python-3.13","free-threaded","concurrency","nogil","shared-memory"],"exportEndpoints":{"claude":"/api/rules/fastapi-python313-freethreaded-memory-fence?format=claude","cursorMdc":"/api/rules/fastapi-python313-freethreaded-memory-fence?format=mdc","cursorrules":"/api/rules/fastapi-python313-freethreaded-memory-fence?format=cursor","windsurf":"/api/rules/fastapi-python313-freethreaded-memory-fence?format=windsurf","agents":"/api/rules/fastapi-python313-freethreaded-memory-fence?format=agents"}},{"id":"bun-sqlite-wal-contention-barrier","title":"Bun 1.2 Clustered SQLite WAL Contention Barrier and Write Lease Coordination","category":"backend","severity":"critical","description":"Standardizes multi-process and multi-worker SQLite database access under Bun 1.2 cluster mode. Mandates strict WAL mode initialization, transaction immediacy (BEGIN IMMEDIATE), explicit busy timeouts, and an isolated writer-lease barrier to eliminate SQLITE_BUSY lock starvation and unbounded WAL file bloat under saturated microservice traffic.","antiPatternHeadline":"Uncoordinated Multi-Worker Concurrent SQLite Writes with Default Deferred Transactions and Missing Busy Timeouts","stars_count":43,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","sqlite","wal","concurrency","clustering"],"exportEndpoints":{"claude":"/api/rules/bun-sqlite-wal-contention-barrier?format=claude","cursorMdc":"/api/rules/bun-sqlite-wal-contention-barrier?format=mdc","cursorrules":"/api/rules/bun-sqlite-wal-contention-barrier?format=cursor","windsurf":"/api/rules/bun-sqlite-wal-contention-barrier?format=windsurf","agents":"/api/rules/bun-sqlite-wal-contention-barrier?format=agents"}},{"id":"postgresql-17-concurrent-merge-partition-deadlock-guardrail","title":"PostgreSQL 17 Concurrent MERGE Isolation and Partition Lock Contention Standard","category":"backend","severity":"critical","description":"Prevents partition-level lock contention, write serialization anomalies (SQLSTATE 40001), and cross-transaction deadlocks (SQLSTATE 40P01) during concurrent upsert workloads on PostgreSQL 17 partitioned tables. Enforces deterministic tuple ordering, targeted leaf partition routing, and bounded exponential backoff policies.","antiPatternHeadline":"Unordered Ingestion into Root Partition Tables via Concurrent MERGE Triggering Deadlocks","stars_count":40,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","partitioning","concurrency","sql-performance"],"exportEndpoints":{"claude":"/api/rules/postgresql-17-concurrent-merge-partition-deadlock-guardrail?format=claude","cursorMdc":"/api/rules/postgresql-17-concurrent-merge-partition-deadlock-guardrail?format=mdc","cursorrules":"/api/rules/postgresql-17-concurrent-merge-partition-deadlock-guardrail?format=cursor","windsurf":"/api/rules/postgresql-17-concurrent-merge-partition-deadlock-guardrail?format=windsurf","agents":"/api/rules/postgresql-17-concurrent-merge-partition-deadlock-guardrail?format=agents"}},{"id":"spiffe-spire-x509-svid-workload-attestation-guardrail","title":"SPIFFE/SPIRE Ephemeral X.509 SVID Federation and In-Memory Attestation Standard","category":"security","severity":"critical","description":"Enforces dynamic workload identity attestation via local SPIFFE Workload API over Unix Domain Sockets (UDS) bound to container cgroups. Prohibits persisting X.509 SVIDs or private keys to durable storage and mandates automated in-memory rotation before cryptographic expiration. Forbids fallback to static, long-lived cloud credentials across heterogeneous trust domains.","antiPatternHeadline":"Persisting Ephemeral SVIDs to Disk or Falling Back to Long-Lived Cloud IAM Credentials","stars_count":42,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","spiffe","spire","zero-trust","mtls","x509","cryptography"],"exportEndpoints":{"claude":"/api/rules/spiffe-spire-x509-svid-workload-attestation-guardrail?format=claude","cursorMdc":"/api/rules/spiffe-spire-x509-svid-workload-attestation-guardrail?format=mdc","cursorrules":"/api/rules/spiffe-spire-x509-svid-workload-attestation-guardrail?format=cursor","windsurf":"/api/rules/spiffe-spire-x509-svid-workload-attestation-guardrail?format=windsurf","agents":"/api/rules/spiffe-spire-x509-svid-workload-attestation-guardrail?format=agents"}},{"id":"k8s-gateway-api-referencegrant-security-guardrail","title":"Kubernetes Gateway API v1.2 Cross-Namespace ReferenceGrant Security Guardrail","category":"devops","severity":"critical","description":"Enforces strict boundary isolation for Kubernetes Gateway API v1.2 resources by prohibiting wildcard cross-namespace attachments and unvalidated backend forwarding. Mandates explicit ReferenceGrant resources in target namespaces for any cross-namespace route-to-service or gateway-to-secret bindings to prevent tenant traffic hijacking and ingress route takeover.","antiPatternHeadline":"Unrestricted Cross-Namespace Route Attachment or Missing ReferenceGrant on Multi-Tenant Ingress","stars_count":42,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["kubernetes","gateway-api","referencegrant","devops","security","multi-tenancy","networking"],"exportEndpoints":{"claude":"/api/rules/k8s-gateway-api-referencegrant-security-guardrail?format=claude","cursorMdc":"/api/rules/k8s-gateway-api-referencegrant-security-guardrail?format=mdc","cursorrules":"/api/rules/k8s-gateway-api-referencegrant-security-guardrail?format=cursor","windsurf":"/api/rules/k8s-gateway-api-referencegrant-security-guardrail?format=windsurf","agents":"/api/rules/k8s-gateway-api-referencegrant-security-guardrail?format=agents"}},{"id":"vite6-environment-api-runtime-module-isolation-guardrail","title":"Vite 6 Environment API Runtime Module Isolation Barrier","category":"frontend","severity":"critical","description":"Enforces strict compile-time and runtime module isolation across heterogeneous Vite 6 environments (client, ssr, edge). Prevents Node.js built-ins, privileged server SDKs, and sensitive server-only variables from leaking into browser or edge module subgraphs during isomorphic full-stack builds.","antiPatternHeadline":"Leaking Server Privileges and Node.js Runtimes into Browser Bundles via Legacy Monolithic SSR Configs","stars_count":93,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","vite6","ssr","environment-api","module-isolation","security"],"exportEndpoints":{"claude":"/api/rules/vite6-environment-api-runtime-module-isolation-guardrail?format=claude","cursorMdc":"/api/rules/vite6-environment-api-runtime-module-isolation-guardrail?format=mdc","cursorrules":"/api/rules/vite6-environment-api-runtime-module-isolation-guardrail?format=cursor","windsurf":"/api/rules/vite6-environment-api-runtime-module-isolation-guardrail?format=windsurf","agents":"/api/rules/vite6-environment-api-runtime-module-isolation-guardrail?format=agents"}},{"id":"react19-server-action-idempotency-key-transport-standard","title":"React 19 Server Action Idempotency-Key Deterministic Transport Standard","category":"frontend","severity":"critical","description":"Enforces deterministic client-generated idempotency tokens across React 19 Server Action transitions and form submissions to prevent duplicate database writes under automated network retries and double-submit scenarios. Requires pairing React 19 useActionState/useTransition with client-side UUID generation persisted across failed or in-flight attempts, validated and cached on the server via atomic distributed locks before mutation execution.","antiPatternHeadline":"Ephemeral Server Action Invocations Lacking Client-Side Idempotency Tokens Permitting Duplicate Mutations Under Retry","stars_count":111,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","server-actions","idempotency","distributed-systems","nextjs"],"exportEndpoints":{"claude":"/api/rules/react19-server-action-idempotency-key-transport-standard?format=claude","cursorMdc":"/api/rules/react19-server-action-idempotency-key-transport-standard?format=mdc","cursorrules":"/api/rules/react19-server-action-idempotency-key-transport-standard?format=cursor","windsurf":"/api/rules/react19-server-action-idempotency-key-transport-standard?format=windsurf","agents":"/api/rules/react19-server-action-idempotency-key-transport-standard?format=agents"}},{"id":"go-1-24-synctest-deterministic-concurrency","title":"Go 1.24 testing/synctest Deterministic Concurrency Verification","category":"backend","severity":"critical","description":"Mandates isolated synthetic time bubbles using Go 1.24 testing/synctest for concurrent and time-dependent test scenarios. Eliminates non-deterministic wall-clock sleeps and flaky integration tests by executing goroutines within deterministic virtual clocks with explicit quiescence checks.","antiPatternHeadline":"Flaky Concurrent Testing via Arbitrary Wall-Clock Sleeps and Leaked Goroutines","stars_count":67,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["go","golang","concurrency","testing","synctest","goroutines"],"exportEndpoints":{"claude":"/api/rules/go-1-24-synctest-deterministic-concurrency?format=claude","cursorMdc":"/api/rules/go-1-24-synctest-deterministic-concurrency?format=mdc","cursorrules":"/api/rules/go-1-24-synctest-deterministic-concurrency?format=cursor","windsurf":"/api/rules/go-1-24-synctest-deterministic-concurrency?format=windsurf","agents":"/api/rules/go-1-24-synctest-deterministic-concurrency?format=agents"}},{"id":"postgres-17-incremental-backup-lsn-consistency","title":"PostgreSQL 17 Block-Level Incremental Backup LSN Chain Consistency Invariant","category":"backend","severity":"critical","description":"Enforces unbroken LSN sequence validation and WAL summarization verification across PostgreSQL 17 block-level incremental backup manifests. Guarantees byte-accurate synthetic full reconstruction via pg_combinebackup without unsummarized WAL voids or corrupted differential delta merges.","antiPatternHeadline":"Executing unverified pg_combinebackup invocations over broken manifest chains or unsummarized WAL intervals","stars_count":80,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql-17","disaster-recovery","pg-combinebackup","wal-summarization","database-reliability"],"exportEndpoints":{"claude":"/api/rules/postgres-17-incremental-backup-lsn-consistency?format=claude","cursorMdc":"/api/rules/postgres-17-incremental-backup-lsn-consistency?format=mdc","cursorrules":"/api/rules/postgres-17-incremental-backup-lsn-consistency?format=cursor","windsurf":"/api/rules/postgres-17-incremental-backup-lsn-consistency?format=windsurf","agents":"/api/rules/postgres-17-incremental-backup-lsn-consistency?format=agents"}},{"id":"bun-s3-streaming-backpressure-multipart","title":"Bun 1.2 Native S3 Streaming Backpressure and Zero-Allocation Upload Protocol","category":"backend","severity":"critical","description":"Mandates streaming inbound HTTP request bodies directly into object storage via Bun 1.2 native S3 APIs without buffering payload chunks into the JavaScript runtime heap. Enforces strict upstream backpressure signaling, native chunk draining, and transactional multipart abort handling to prevent memory exhaustion under concurrent multi-gigabyte transfers.","antiPatternHeadline":"Buffering Inbound Multi-Gigabyte Payloads into JSC Heap Buffers Before S3 Dispatch","stars_count":113,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","s3","streaming","backpressure","memory-leak-prevention"],"exportEndpoints":{"claude":"/api/rules/bun-s3-streaming-backpressure-multipart?format=claude","cursorMdc":"/api/rules/bun-s3-streaming-backpressure-multipart?format=mdc","cursorrules":"/api/rules/bun-s3-streaming-backpressure-multipart?format=cursor","windsurf":"/api/rules/bun-s3-streaming-backpressure-multipart?format=windsurf","agents":"/api/rules/bun-s3-streaming-backpressure-multipart?format=agents"}},{"id":"cmp-skiko-cadisplaylink-frame-pacing-barrier","title":"Compose Multiplatform Skiko Canvas CADisplayLink VSync Frame-Pacing Barrier","category":"mobile","severity":"critical","description":"Enforces strict synchronization between Skiko rendering passes and Apple's CADisplayLink to eliminate micro-stuttering, tearing, and thermal throttling on iOS. Mandates explicit CAFrameRateRange configuration for 120Hz ProMotion displays and gates canvas redrawing on actual hardware VSync pulses rather than decoupled Kotlin coroutine timers.","antiPatternHeadline":"Decoupled Coroutine Timers and Unbounded Skiko Redraw Triggers Causing Frame Drops and Battery Drain","stars_count":52,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","compose-multiplatform","skiko","ios","cadisplaylink","promotion","performance"],"exportEndpoints":{"claude":"/api/rules/cmp-skiko-cadisplaylink-frame-pacing-barrier?format=claude","cursorMdc":"/api/rules/cmp-skiko-cadisplaylink-frame-pacing-barrier?format=mdc","cursorrules":"/api/rules/cmp-skiko-cadisplaylink-frame-pacing-barrier?format=cursor","windsurf":"/api/rules/cmp-skiko-cadisplaylink-frame-pacing-barrier?format=windsurf","agents":"/api/rules/cmp-skiko-cadisplaylink-frame-pacing-barrier?format=agents"}},{"id":"tauri-v2-webview-low-memory-eviction-state-reconstruction-standard","title":"Tauri 2.0 Webview Low-Memory Eviction State Reconstruction Standard","category":"mobile","severity":"critical","description":"Mobile operating systems (iOS Jetsam, Android LMK) unilaterally terminate idle or memory-pressured webviews without triggering browser-standard unload events. In Tauri 2.0 mobile applications, engineers must bridge native lifecycle lifecycle hooks to serialize uncommitted UI transactions and navigation state into encrypted local storage via the Tauri Store plugin, guaranteeing zero-data-loss state rehydration upon cold webview reinitialization.","antiPatternHeadline":"Relying on Window 'beforeunload' or Transient React State Leading to Mobile Eviction Data Loss","stars_count":89,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri-2","memory-management","state-persistence","rust","webview"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-webview-low-memory-eviction-state-reconstruction-standard?format=claude","cursorMdc":"/api/rules/tauri-v2-webview-low-memory-eviction-state-reconstruction-standard?format=mdc","cursorrules":"/api/rules/tauri-v2-webview-low-memory-eviction-state-reconstruction-standard?format=cursor","windsurf":"/api/rules/tauri-v2-webview-low-memory-eviction-state-reconstruction-standard?format=windsurf","agents":"/api/rules/tauri-v2-webview-low-memory-eviction-state-reconstruction-standard?format=agents"}},{"id":"oauth-2-1-dpop-ephemeral-nonce-fencing","title":"OAuth 2.1 RFC 9449 DPoP Ephemeral Nonce Fencing & Replay Defense","category":"security","severity":"critical","description":"Enforces strict Demonstrating Proof-of-Possession (DPoP) verification across zero-trust API boundaries according to RFC 9449. Mandates server-side ephemeral nonce generation, cryptographic binding of the access token hash (ath), HTTP method (htm), URI (htu), and single-use nonce validation to neutralize token exfiltration and replay attacks.","antiPatternHeadline":"Accepting static bearer tokens or omitting cryptographic nonce verification in DPoP validation pipelines","stars_count":56,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","oauth2","dpop","zero-trust","cryptography","rfc9449"],"exportEndpoints":{"claude":"/api/rules/oauth-2-1-dpop-ephemeral-nonce-fencing?format=claude","cursorMdc":"/api/rules/oauth-2-1-dpop-ephemeral-nonce-fencing?format=mdc","cursorrules":"/api/rules/oauth-2-1-dpop-ephemeral-nonce-fencing?format=cursor","windsurf":"/api/rules/oauth-2-1-dpop-ephemeral-nonce-fencing?format=windsurf","agents":"/api/rules/oauth-2-1-dpop-ephemeral-nonce-fencing?format=agents"}},{"id":"coco-vtpm-attestation-identity-binding","title":"Confidential Containers (CoCo) Hardware-Rooted vTPM Attestation Identity Binding Standard","category":"security","severity":"critical","description":"Enforces hardware-rooted remote attestation using virtual Trusted Platform Module (vTPM) quotes before releasing decryption keys or mounting storage volumes in Confidential Containers (CoCo). Prevents untrusted hypervisors, compromised host kernels, and multi-tenant host operators from snooping plaintext proprietary model weights and confidential tenant data in physical DRAM.","antiPatternHeadline":"Premature Workload Boot or Pre-Shared Key Ingestion Bypassing Cryptographic vTPM Hardware Attestation","stars_count":112,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","coco","vtpm","confidential-computing","attestation","kbs","tpm2"],"exportEndpoints":{"claude":"/api/rules/coco-vtpm-attestation-identity-binding?format=claude","cursorMdc":"/api/rules/coco-vtpm-attestation-identity-binding?format=mdc","cursorrules":"/api/rules/coco-vtpm-attestation-identity-binding?format=cursor","windsurf":"/api/rules/coco-vtpm-attestation-identity-binding?format=windsurf","agents":"/api/rules/coco-vtpm-attestation-identity-binding?format=agents"}},{"id":"opentelemetry-profiling-frame-pointer-preservation","title":"OpenTelemetry eBPF Profiling Zero-Overhead Frame-Pointer Invariant","category":"devops","severity":"critical","description":"Enforces compiler-level frame-pointer preservation across all compiled production binaries, container base images, and runtime flags to guarantee zero-overhead continuous eBPF CPU stack unwinding. Omitting frame pointers breaks kernel-space eBPF stack walks, forcing either complete profiling blind spots or catastrophic kernel DWARF-unwinding performance degradation in production environments.","antiPatternHeadline":"Compiling Production Binaries with Frame Pointer Elimination (-fomit-frame-pointer)","stars_count":71,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","opentelemetry","profiling","continuous-profiling","compiler-flags","dockerfile"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-profiling-frame-pointer-preservation?format=claude","cursorMdc":"/api/rules/opentelemetry-profiling-frame-pointer-preservation?format=mdc","cursorrules":"/api/rules/opentelemetry-profiling-frame-pointer-preservation?format=cursor","windsurf":"/api/rules/opentelemetry-profiling-frame-pointer-preservation?format=windsurf","agents":"/api/rules/opentelemetry-profiling-frame-pointer-preservation?format=agents"}},{"id":"nextjs-15-async-request-dynamic-boundary-guardrail","title":"Next.js 15 Async Request APIs & Dynamic PPR Boundary Guardrail","category":"frontend","severity":"critical","description":"Next.js 15 enforces asynchronous access for runtime dynamic inputs (cookies, headers, params, and searchParams) to decouple prerendered static shells from dynamic request execution. Synchronously accessing these APIs or awaiting them directly at the root page/layout level without Suspense isolation causes unhandled promise rejections, breaks Partial Prerendering (PPR), and triggers silent de-optimization of static routes into full-page on-demand SSR.","antiPatternHeadline":"Synchronous Dynamic API Invocation and Top-Level Shell Dynamic Unwrapping","stars_count":101,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs","nextjs-15","react-server-components","partial-prerendering","performance"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-async-request-dynamic-boundary-guardrail?format=claude","cursorMdc":"/api/rules/nextjs-15-async-request-dynamic-boundary-guardrail?format=mdc","cursorrules":"/api/rules/nextjs-15-async-request-dynamic-boundary-guardrail?format=cursor","windsurf":"/api/rules/nextjs-15-async-request-dynamic-boundary-guardrail?format=windsurf","agents":"/api/rules/nextjs-15-async-request-dynamic-boundary-guardrail?format=agents"}},{"id":"bun-cluster-websocket-zero-copy-handoff-production-standard","title":"Bun 1.2 Native Cluster WebSocket Zero-Copy Socket Handoff & Backpressure Architecture","category":"backend","severity":"critical","description":"Enforces deterministic, memory-safe WebSocket socket handoff and worker load distribution across multi-core Bun cluster architectures. Prevents intermediate heap buffer cloning, frame desynchronization, and silent frame drops during cross-worker migration under saturation by mandating zero-copy transfer lists and native backpressure drain lifecycle hooks.","antiPatternHeadline":"Heap-Cloned WebSocket IPC Handoff Without Backpressure Drain Synchronization","stars_count":61,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","websockets","clustering","zero-copy","concurrency"],"exportEndpoints":{"claude":"/api/rules/bun-cluster-websocket-zero-copy-handoff-production-standard?format=claude","cursorMdc":"/api/rules/bun-cluster-websocket-zero-copy-handoff-production-standard?format=mdc","cursorrules":"/api/rules/bun-cluster-websocket-zero-copy-handoff-production-standard?format=cursor","windsurf":"/api/rules/bun-cluster-websocket-zero-copy-handoff-production-standard?format=windsurf","agents":"/api/rules/bun-cluster-websocket-zero-copy-handoff-production-standard?format=agents"}},{"id":"fastapi-lifespan-async-teardown-guardrail","title":"FastAPI Lifespan Async Context Teardown and Graceful Task Drain Standard","category":"backend","severity":"critical","description":"Enforces strict asynchronous context manager lifecycle contracts in FastAPI services to guarantee deterministic resource disposal. Mandates that all active background tasks, thread pools, and pooled database engine connections cleanly drain before SIGTERM execution terminates the process worker.","antiPatternHeadline":"Unbounded fire-and-forget background tasks and abrupt database connection drops during worker shutdown","stars_count":92,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","asyncio","lifespan","concurrency","uvicorn","kubernetes"],"exportEndpoints":{"claude":"/api/rules/fastapi-lifespan-async-teardown-guardrail?format=claude","cursorMdc":"/api/rules/fastapi-lifespan-async-teardown-guardrail?format=mdc","cursorrules":"/api/rules/fastapi-lifespan-async-teardown-guardrail?format=cursor","windsurf":"/api/rules/fastapi-lifespan-async-teardown-guardrail?format=windsurf","agents":"/api/rules/fastapi-lifespan-async-teardown-guardrail?format=agents"}},{"id":"tauri-v2-scoped-plugin-capability-boundary","title":"Tauri 2.0 Mobile IPC Scoped Plugin Capability & Native Boundary Standard","category":"mobile","severity":"critical","description":"Mandates declarative capability manifests in src-tauri/capabilities/*.json with fine-grained scoping instead of wildcard permissions across iOS and Android builds. Enforces bidirectional Zod runtime schema validation on the WebView IPC bridge before invoking native Rust commands, combined with strict Serde bounds checking and path sandboxing in native command implementations.","antiPatternHeadline":"Executing untyped invoke calls with wildcard capability grants and unbounded native mobile filesystem access","stars_count":113,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri-2","ipc-security","rust","capabilities"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-scoped-plugin-capability-boundary?format=claude","cursorMdc":"/api/rules/tauri-v2-scoped-plugin-capability-boundary?format=mdc","cursorrules":"/api/rules/tauri-v2-scoped-plugin-capability-boundary?format=cursor","windsurf":"/api/rules/tauri-v2-scoped-plugin-capability-boundary?format=windsurf","agents":"/api/rules/tauri-v2-scoped-plugin-capability-boundary?format=agents"}},{"id":"passkey-aaguid-hardware-step-up-standard","title":"Passkey AAGUID Cryptographic Hardware Step-Up Escalation Standard","category":"security","severity":"critical","description":"Mandates cryptographic differentiation between synced multi-device passkeys and device-bound hardware authenticators (e.g., FIDO2/WebAuthn hardware tokens) to gate high-risk operations. Validates Authenticator Attestation Globally Unique Identifiers (AAGUID) against trusted FIDO Metadata Service (MDS) data and verifies authenticator flags (rejecting backup-eligible credentials) during step-up challenges.","antiPatternHeadline":"Authorizing High-Risk Operations via Synced Passkeys or Unverified Client-Supplied AAGUIDs","stars_count":108,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","fido2","passkeys","aaguid","step-up-authentication","zero-trust"],"exportEndpoints":{"claude":"/api/rules/passkey-aaguid-hardware-step-up-standard?format=claude","cursorMdc":"/api/rules/passkey-aaguid-hardware-step-up-standard?format=mdc","cursorrules":"/api/rules/passkey-aaguid-hardware-step-up-standard?format=cursor","windsurf":"/api/rules/passkey-aaguid-hardware-step-up-standard?format=windsurf","agents":"/api/rules/passkey-aaguid-hardware-step-up-standard?format=agents"}},{"id":"wasi-p2-capability-boundary-standard","title":"WASI 0.2 Component Model Capability-Based Sandbox Boundary Standard","category":"security","severity":"critical","description":"Enforces strict capability-based security boundaries for multi-tenant microservices compiled into WASI 0.2 (Preview 2) WebAssembly components. Precludes ambient authority by restricting host bindings exclusively to explicit WebAssembly Interface Type (WIT) interfaces (e.g., `wasi:http/outgoing-handler`, `wasi:filesystem/preopens`) without granting broad POSIX or unchecked host-level capabilities. Prevents untrusted guest code execution from compromising host infrastructure via unconstrained directory traversal, socket creation, or unmediated environment variable access.","antiPatternHeadline":"Ambient POSIX Emulation and Unchecked Host Capability Ingestion in Multi-Tenant WASM Runtimes","stars_count":42,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","wasm","wasi-0.2","component-model","sandboxing","wit","multi-tenancy"],"exportEndpoints":{"claude":"/api/rules/wasi-p2-capability-boundary-standard?format=claude","cursorMdc":"/api/rules/wasi-p2-capability-boundary-standard?format=mdc","cursorrules":"/api/rules/wasi-p2-capability-boundary-standard?format=cursor","windsurf":"/api/rules/wasi-p2-capability-boundary-standard?format=windsurf","agents":"/api/rules/wasi-p2-capability-boundary-standard?format=agents"}},{"id":"k8s-132-dra-claim-lifecycle-invariant","title":"Kubernetes 1.32 DRA Structured Parameter Claim Lifecycle and CDI Handshake Invariant","category":"devops","severity":"critical","description":"Enforces Kubernetes 1.32 Dynamic Resource Allocation (DRA) structured parameters (resource.k8s.io/v1beta1) and strict claim reservation lifecycle patterns. Prevents accelerator (GPU/vPU) allocation race conditions, topology-mismatched scheduling deadlocks, and CDI device handoff corruptions in high-density multi-tenant clusters.","antiPatternHeadline":"Bypassing DRA Structured Parameters with Out-of-Band Driver Mutations or Untracked Ephemeral Device Claims","stars_count":81,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","kubernetes","dra","accelerators","gpu","cdi","resource-claims"],"exportEndpoints":{"claude":"/api/rules/k8s-132-dra-claim-lifecycle-invariant?format=claude","cursorMdc":"/api/rules/k8s-132-dra-claim-lifecycle-invariant?format=mdc","cursorrules":"/api/rules/k8s-132-dra-claim-lifecycle-invariant?format=cursor","windsurf":"/api/rules/k8s-132-dra-claim-lifecycle-invariant?format=windsurf","agents":"/api/rules/k8s-132-dra-claim-lifecycle-invariant?format=agents"}},{"id":"rolldown-deterministic-module-chunking-invariant","title":"Rolldown Deterministic Module Chunking & Federated Edge Invariant","category":"frontend","severity":"critical","description":"Enforces byte-for-byte reproducible bundle hashes, topological module ordering, and shared-dependency singleton deduplication across federated Vite 6 and Rolldown edge builds. Prevents module identity drift, dual-package hazard at runtime edge nodes, and volatile chunk graph invalidations caused by non-deterministic dynamic chunk allocation.","antiPatternHeadline":"Non-Deterministic Dynamic Chunk Splitting and Platform-Dependent Path Ingestion","stars_count":57,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","rolldown","vite6","module-federation","reproducible-builds","micro-frontends","edge-runtime"],"exportEndpoints":{"claude":"/api/rules/rolldown-deterministic-module-chunking-invariant?format=claude","cursorMdc":"/api/rules/rolldown-deterministic-module-chunking-invariant?format=mdc","cursorrules":"/api/rules/rolldown-deterministic-module-chunking-invariant?format=cursor","windsurf":"/api/rules/rolldown-deterministic-module-chunking-invariant?format=windsurf","agents":"/api/rules/rolldown-deterministic-module-chunking-invariant?format=agents"}},{"id":"axum-tower-context-propagation-fence","title":"Axum Tower Context Propagation Fence & Cancellation Isolation","category":"backend","severity":"critical","description":"Enforces deterministic task-local and OpenTelemetry span fencing across Axum Tower middleware pipelines. Prevents ambient context and tenant metadata contamination across multiplexed HTTP/2 streams and async cancellation boundaries by forbidding guard retention across `.await` points and enforcing explicit RAII span attachment.","antiPatternHeadline":"Ambient Context and Tracing Span Leakage Across Async Dropped Futures and Thread Worker Pools","stars_count":72,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tower","opentelemetry","tracing","multi-tenancy"],"exportEndpoints":{"claude":"/api/rules/axum-tower-context-propagation-fence?format=claude","cursorMdc":"/api/rules/axum-tower-context-propagation-fence?format=mdc","cursorrules":"/api/rules/axum-tower-context-propagation-fence?format=cursor","windsurf":"/api/rules/axum-tower-context-propagation-fence?format=windsurf","agents":"/api/rules/axum-tower-context-propagation-fence?format=agents"}},{"id":"fastapi-anyio-threadpool-backpressure-invariant","title":"FastAPI AnyIO Threadpool Backpressure and Worker Exhaustion Guardrail","category":"backend","severity":"critical","description":"FastAPI delegates synchronous endpoint handlers and starlette background tasks to AnyIO worker threads (anyio.to_thread.run_sync), which rely on a globally bounded threadpool. Unbounded synchronous blocking I/O, heavy CPU tasks without capacity tokens, or failure to tune AnyIO thread limits leads to threadpool starvation, cascading latency spikes, and deadlocks in the event loop. Systems MUST enforce bounded concurrency limiters, tune max_threadpool_tokens, and offload CPU-intensive operations to dedicated multiprocessing pools or external message queues.","antiPatternHeadline":"Unbounded Synchronous Execution Starving AnyIO Worker Threadpool and Event Loop","stars_count":44,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","anyio","asyncio","concurrency","performance"],"exportEndpoints":{"claude":"/api/rules/fastapi-anyio-threadpool-backpressure-invariant?format=claude","cursorMdc":"/api/rules/fastapi-anyio-threadpool-backpressure-invariant?format=mdc","cursorrules":"/api/rules/fastapi-anyio-threadpool-backpressure-invariant?format=cursor","windsurf":"/api/rules/fastapi-anyio-threadpool-backpressure-invariant?format=windsurf","agents":"/api/rules/fastapi-anyio-threadpool-backpressure-invariant?format=agents"}},{"id":"bun-worker-memory-arena-scoping","title":"Deterministic Worker Memory Arena Scoping and Native Transfer Invariant in Bun 1.2","category":"backend","severity":"critical","description":"Enforces strict lifecycle boundaries and zero-copy ArrayBuffer transfer semantics across Bun 1.2 worker pools. Prevents non-deterministic V8/JavaScriptCore heap retention and native memory fragmentation by mandating explicit arena deallocation via transfer lists and manual worker lifecycle scoping.","antiPatternHeadline":"Implicit Structured Cloning of Large Buffers Across Worker Boundaries Causing Silent Heap Bloat","stars_count":77,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","workers","concurrency","memory-management","performance"],"exportEndpoints":{"claude":"/api/rules/bun-worker-memory-arena-scoping?format=claude","cursorMdc":"/api/rules/bun-worker-memory-arena-scoping?format=mdc","cursorrules":"/api/rules/bun-worker-memory-arena-scoping?format=cursor","windsurf":"/api/rules/bun-worker-memory-arena-scoping?format=windsurf","agents":"/api/rules/bun-worker-memory-arena-scoping?format=agents"}},{"id":"tauri-v2-mobile-ipc-acl-origin-confinement","title":"Tauri 2.0 Mobile IPC ACL Origin Confinement & Scoped Capability Hardening","category":"mobile","severity":"critical","description":"Tauri 2.0 introduces fine-grained Access Control Lists (ACLs) to bind native mobile platform capabilities to explicitly defined webview targets and verified origins. Permissive wildcards in capability manifests allow unauthorized third-party iframes or unexpected webview navigations to invoke privileged native OS plugins (biometrics, storage, camera). Production mobile applications must confine all native capabilities strictly to declared local frame origins and deterministic window labels.","antiPatternHeadline":"Wildcard Capability Manifests Granting Arbitrary Webview Frames Unconfined Native OS Access","stars_count":74,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri","ipc","security","acl"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-mobile-ipc-acl-origin-confinement?format=claude","cursorMdc":"/api/rules/tauri-v2-mobile-ipc-acl-origin-confinement?format=mdc","cursorrules":"/api/rules/tauri-v2-mobile-ipc-acl-origin-confinement?format=cursor","windsurf":"/api/rules/tauri-v2-mobile-ipc-acl-origin-confinement?format=windsurf","agents":"/api/rules/tauri-v2-mobile-ipc-acl-origin-confinement?format=agents"}},{"id":"webauthn-conditional-mediation-invalidation-sync","title":"Atomic Distributed Revocation and Invalidation Sync for WebAuthn Conditional Mediation","category":"security","severity":"critical","description":"Enforces atomic distributed revocation and epoch validation across synchronized cloud passkeys to prevent stale client authenticator states from completing WebAuthn conditional mediation (autofill). Eliminates authorization bypasses where locally cached passkeys generate valid cryptographically signed assertions against recently revoked or deregistered server credentials.","antiPatternHeadline":"Trusting In-Flight Conditional Assertions Without Atomic Credential Tombstoning and Epoch Validation","stars_count":40,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","passkeys","authentication","fido2","distributed-systems"],"exportEndpoints":{"claude":"/api/rules/webauthn-conditional-mediation-invalidation-sync?format=claude","cursorMdc":"/api/rules/webauthn-conditional-mediation-invalidation-sync?format=mdc","cursorrules":"/api/rules/webauthn-conditional-mediation-invalidation-sync?format=cursor","windsurf":"/api/rules/webauthn-conditional-mediation-invalidation-sync?format=windsurf","agents":"/api/rules/webauthn-conditional-mediation-invalidation-sync?format=agents"}},{"id":"openfga-graph-traversal-cycle-depth-guardrails","title":"OpenFGA Graph Traversal Cycle and Depth Guardrails","category":"security","severity":"critical","description":"Enforces strict bounded graph traversal, pre-write directed acyclic graph (DAG) cycle validation, and timeout-constrained contexts across OpenFGA authorization engines. Protects fine-grained authorization resolvers against algorithmic denial-of-service (DoS) and memory exhaustion caused by deeply nested or cyclical relationship tuples.","antiPatternHeadline":"Unbounded Recursive ReBAC Traversal and Cyclic Tuple Persistence Inducing Algorithmic DoS","stars_count":109,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","rebac","graph-dos","authorization","cycle-detection"],"exportEndpoints":{"claude":"/api/rules/openfga-graph-traversal-cycle-depth-guardrails?format=claude","cursorMdc":"/api/rules/openfga-graph-traversal-cycle-depth-guardrails?format=mdc","cursorrules":"/api/rules/openfga-graph-traversal-cycle-depth-guardrails?format=cursor","windsurf":"/api/rules/openfga-graph-traversal-cycle-depth-guardrails?format=windsurf","agents":"/api/rules/openfga-graph-traversal-cycle-depth-guardrails?format=agents"}},{"id":"otel-arrow-columnar-compression-standard","title":"OpenTelemetry Arrow Columnar Stream Compression Standard","category":"devops","severity":"critical","description":"Enforces OpenTelemetry Arrow-native columnar streaming transport over standard row-oriented OTLP/Protobuf to mitigate memory allocation spikes and garbage collection thrashing on edge collectors. Converts high-cardinality telemetry into Apache Arrow RecordBatches, maximizing compression ratios via dictionary encoding and LZ4/Zstandard block compression before egress. Guarantees deterministic memory overhead and lower network bandwidth consumption across distributed ingestion topologies.","antiPatternHeadline":"Row-Oriented OTLP Protobuf Serialization Under High-Cardinality Telemetry Bursts","stars_count":96,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","apache-arrow","observability","collector","stream-processing"],"exportEndpoints":{"claude":"/api/rules/otel-arrow-columnar-compression-standard?format=claude","cursorMdc":"/api/rules/otel-arrow-columnar-compression-standard?format=mdc","cursorrules":"/api/rules/otel-arrow-columnar-compression-standard?format=cursor","windsurf":"/api/rules/otel-arrow-columnar-compression-standard?format=windsurf","agents":"/api/rules/otel-arrow-columnar-compression-standard?format=agents"}},{"id":"ebpf-tc-pod-drainage-rerouting-invariant","title":"eBPF TC In-Kernel Pod Drainage Rerouting Invariant","category":"devops","severity":"critical","description":"Enforces deterministic in-kernel TCP packet rerouting using eBPF Traffic Control (TC) ingress/egress programs during Kubernetes pod terminations and rolling node drains. Eliminates race conditions between endpoint deregistration and conntrack teardown by rewriting L3/L4 headers and socket metadata before packets hit network namespace boundaries.","antiPatternHeadline":"Relying on Userspace Iptables/IPVS Sync Latency During Pod Eviction Causing RST Injections and Dropped In-Flight Packets","stars_count":76,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","kubernetes","networking","traffic-control","zero-downtime"],"exportEndpoints":{"claude":"/api/rules/ebpf-tc-pod-drainage-rerouting-invariant?format=claude","cursorMdc":"/api/rules/ebpf-tc-pod-drainage-rerouting-invariant?format=mdc","cursorrules":"/api/rules/ebpf-tc-pod-drainage-rerouting-invariant?format=cursor","windsurf":"/api/rules/ebpf-tc-pod-drainage-rerouting-invariant?format=windsurf","agents":"/api/rules/ebpf-tc-pod-drainage-rerouting-invariant?format=agents"}},{"id":"react-19-server-actions-idempotency-key-pipeline","title":"React 19 Server Actions Idempotency Key Pipeline & Deduplication Invariant","category":"frontend","severity":"critical","description":"Enforces an atomic idempotency key pipeline across React 19 Server Actions, useActionState, and optimistic UI updates. Guarantees that network drops, rapid-fire user submissions, and automatic transport retries never trigger duplicate writes, unauthorized double-billing, or corrupted transactional state.","antiPatternHeadline":"Blind Mutation Dispatch Without Cryptographic Idempotency Headers or Distributed Deduplication Locking","stars_count":67,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","server-actions","idempotency","distributed-systems","nextjs"],"exportEndpoints":{"claude":"/api/rules/react-19-server-actions-idempotency-key-pipeline?format=claude","cursorMdc":"/api/rules/react-19-server-actions-idempotency-key-pipeline?format=mdc","cursorrules":"/api/rules/react-19-server-actions-idempotency-key-pipeline?format=cursor","windsurf":"/api/rules/react-19-server-actions-idempotency-key-pipeline?format=windsurf","agents":"/api/rules/react-19-server-actions-idempotency-key-pipeline?format=agents"}},{"id":"tauri2-mobile-ipc-capability-scoped-permissions","title":"Tauri 2.0 Mobile IPC Capability-Scoped Permission Boundary","category":"mobile","severity":"critical","description":"Enforces strict compile-time capability mapping and runtime context isolation for Tauri 2.0 mobile targets on iOS and Android. Preempts webview-based privilege escalation by disallowing wildcard plugin permissions, mandating granular ACL definitions, and strictly typing IPC command payloads across the JavaScript-Rust FFI bridge.","antiPatternHeadline":"Wildcard Plugin Authorization and Untyped Global IPC Invocations in Mobile Webviews","stars_count":60,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri","rust","security","ipc","permissions"],"exportEndpoints":{"claude":"/api/rules/tauri2-mobile-ipc-capability-scoped-permissions?format=claude","cursorMdc":"/api/rules/tauri2-mobile-ipc-capability-scoped-permissions?format=mdc","cursorrules":"/api/rules/tauri2-mobile-ipc-capability-scoped-permissions?format=cursor","windsurf":"/api/rules/tauri2-mobile-ipc-capability-scoped-permissions?format=windsurf","agents":"/api/rules/tauri2-mobile-ipc-capability-scoped-permissions?format=agents"}},{"id":"fastapi-pydantic-v2-discriminated-unions","title":"FastAPI Pydantic V2 Explicit Discriminated Union & Serialization Invariants","category":"backend","severity":"critical","description":"Enforces explicit discriminator fields on polymorphic Pydantic v2 unions in high-throughput FastAPI endpoints. Prevents catastrophic O(N) sequential fallback evaluation, accidental data coercion, and event-loop-blocking CPU stalls during deserialization and serialization.","antiPatternHeadline":"Non-Discriminated Polymorphic Unions with Sequential Type Coercion Fallbacks","stars_count":64,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["fastapi","pydantic-v2","python","performance","serialization","discriminated-unions"],"exportEndpoints":{"claude":"/api/rules/fastapi-pydantic-v2-discriminated-unions?format=claude","cursorMdc":"/api/rules/fastapi-pydantic-v2-discriminated-unions?format=mdc","cursorrules":"/api/rules/fastapi-pydantic-v2-discriminated-unions?format=cursor","windsurf":"/api/rules/fastapi-pydantic-v2-discriminated-unions?format=windsurf","agents":"/api/rules/fastapi-pydantic-v2-discriminated-unions?format=agents"}},{"id":"webauthn-l3-hybrid-transport-attestation-validation","title":"WebAuthn Level 3 Hybrid Transport Attestation and Proximity Validation","category":"security","severity":"critical","description":"Enforces strict validation of WebAuthn Level 3 hybrid transport (caBLE) parameters and authenticators during passkey registration and cross-device assertions. Prevents cross-device passkey relay attacks and adversary-in-the-middle (AiTM) exploitation by cryptographically binding origin, RP ID, client data hash, and proximity-bound hybrid transport hints at identity verification boundaries.","antiPatternHeadline":"Trusting Client-Reported Transports Without Origin Pinning, Nonce Verification, or Hybrid Transport Validation","stars_count":47,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","passkeys","fido2","hybrid-transport","aitm-prevention","zero-trust"],"exportEndpoints":{"claude":"/api/rules/webauthn-l3-hybrid-transport-attestation-validation?format=claude","cursorMdc":"/api/rules/webauthn-l3-hybrid-transport-attestation-validation?format=mdc","cursorrules":"/api/rules/webauthn-l3-hybrid-transport-attestation-validation?format=cursor","windsurf":"/api/rules/webauthn-l3-hybrid-transport-attestation-validation?format=windsurf","agents":"/api/rules/webauthn-l3-hybrid-transport-attestation-validation?format=agents"}},{"id":"bun-sqlite-wal-checkpoint-auto-throttling","title":"Bun 1.2 Embedded SQLite WAL Auto-Throttling & Checkpoint Guardrail","category":"backend","severity":"critical","description":"Enforces proactive WAL (Write-Ahead Logging) monitoring, adaptive checkpoint scheduling, and transactional backpressure in Bun 1.2 embedded SQLite workloads. Prevents WAL file unbounded growth, ephemeral container disk exhaustion, and catastrophic write amplification caused by concurrent reader-lock checkpoint starvation.","antiPatternHeadline":"Unbounded WAL Disk Bloat and SQLITE_BUSY Lock Contention Under Async Transaction Spikes","stars_count":119,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","sqlite","wal","database-performance","resource-management"],"exportEndpoints":{"claude":"/api/rules/bun-sqlite-wal-checkpoint-auto-throttling?format=claude","cursorMdc":"/api/rules/bun-sqlite-wal-checkpoint-auto-throttling?format=mdc","cursorrules":"/api/rules/bun-sqlite-wal-checkpoint-auto-throttling?format=cursor","windsurf":"/api/rules/bun-sqlite-wal-checkpoint-auto-throttling?format=windsurf","agents":"/api/rules/bun-sqlite-wal-checkpoint-auto-throttling?format=agents"}},{"id":"go-chi-http3-103-early-hints-pipeline","title":"Deterministic RFC 8297 103 Early Hints Pipeline in Go Chi HTTP/3","category":"backend","severity":"critical","description":"Enforces deterministic dispatch of RFC 8297 103 Early Hints prior to expensive computation or data retrieval in Go Chi HTTP/3 handlers. Mandates strict validation of client protocol capabilities, isolated preload Link header construction, and explicit use of Go 1.20+ http.ResponseController to saturate zero-RTT/low-RTT client rendering paths without corrupting final HTTP stream state.","antiPatternHeadline":"Dispatching 103 Early Hints after final header commit or omitting capability checks causing HTTP/3 stream desynchronization and client preload starvation.","stars_count":51,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["go","chi","http3","quic","early-hints","rfc8297","performance"],"exportEndpoints":{"claude":"/api/rules/go-chi-http3-103-early-hints-pipeline?format=claude","cursorMdc":"/api/rules/go-chi-http3-103-early-hints-pipeline?format=mdc","cursorrules":"/api/rules/go-chi-http3-103-early-hints-pipeline?format=cursor","windsurf":"/api/rules/go-chi-http3-103-early-hints-pipeline?format=windsurf","agents":"/api/rules/go-chi-http3-103-early-hints-pipeline?format=agents"}},{"id":"postgres-17-rls-memoization-leakproof-views","title":"Postgres 17 RLS Leakproof Function Isolation & Security Invoker Views","category":"security","severity":"critical","description":"Enforces strict isolation of row-level security (RLS) predicates against timing side-channels and query-planner predicate reordering in Postgres 17. Mandates the use of 'security_invoker = true' on multi-tenant views and prohibits marking non-hardened or error-throwing functions as LEAKPROOF to prevent unauthorized row existence oracle leaks.","antiPatternHeadline":"Exposing Tenant Data via Query Planner Predicate Pushdown or Missing Security Invoker Configurations","stars_count":93,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","postgres-17","row-level-security","multi-tenancy","side-channel-mitigation"],"exportEndpoints":{"claude":"/api/rules/postgres-17-rls-memoization-leakproof-views?format=claude","cursorMdc":"/api/rules/postgres-17-rls-memoization-leakproof-views?format=mdc","cursorrules":"/api/rules/postgres-17-rls-memoization-leakproof-views?format=cursor","windsurf":"/api/rules/postgres-17-rls-memoization-leakproof-views?format=windsurf","agents":"/api/rules/postgres-17-rls-memoization-leakproof-views?format=agents"}},{"id":"kmp-datastore-proto-backward-compatibility-guardrail","title":"KMP Proto DataStore Schema Backward Compatibility & Native Concurrency Invariant","category":"mobile","severity":"critical","description":"Mandates rigid Protobuf field reservation and deterministic serialization guards for Kotlin Multiplatform Core DataStore implementations across Android ART and iOS Swift 6 concurrency domains. Prevents silent deserialization corruption, race conditions across native runtime boundaries, and runtime decode crashes caused by field renumbering or divergent schema evolution.","antiPatternHeadline":"Destructive Proto Schema Field Mutation and Non-Thread-Safe Multiplatform DataStore Deserialization","stars_count":61,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","datastore","protobuf","swift-6","concurrency"],"exportEndpoints":{"claude":"/api/rules/kmp-datastore-proto-backward-compatibility-guardrail?format=claude","cursorMdc":"/api/rules/kmp-datastore-proto-backward-compatibility-guardrail?format=mdc","cursorrules":"/api/rules/kmp-datastore-proto-backward-compatibility-guardrail?format=cursor","windsurf":"/api/rules/kmp-datastore-proto-backward-compatibility-guardrail?format=windsurf","agents":"/api/rules/kmp-datastore-proto-backward-compatibility-guardrail?format=agents"}},{"id":"ebpf-tc-egress-backpressure-signaling-standard","title":"eBPF TC Egress Token-Bucket Backpressure & Packet-Drop Signaling","category":"devops","severity":"critical","description":"Enforces sub-millisecond network egress rate-limiting and congestion backpressure at the kernel Traffic Control (TC) layer via eBPF. Eliminates proxy sidecar memory exhaustion and CPU starvation during egress microbursts by directly engaging kernel TCP congestion control with deterministic drop (TC_ACT_SHOT) or ECN marking.","antiPatternHeadline":"Delegating High-Throughput Egress Rate Limiting to Userspace Proxy Sidecars Causing OOM Cascades","stars_count":60,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","traffic-control","rate-limiting","kernel","networking"],"exportEndpoints":{"claude":"/api/rules/ebpf-tc-egress-backpressure-signaling-standard?format=claude","cursorMdc":"/api/rules/ebpf-tc-egress-backpressure-signaling-standard?format=mdc","cursorrules":"/api/rules/ebpf-tc-egress-backpressure-signaling-standard?format=cursor","windsurf":"/api/rules/ebpf-tc-egress-backpressure-signaling-standard?format=windsurf","agents":"/api/rules/ebpf-tc-egress-backpressure-signaling-standard?format=agents"}},{"id":"otel-tail-sampling-bounded-cache-standard","title":"OpenTelemetry Tail-Based Sampling Bounded In-Memory Trace Cache Guardrail","category":"devops","severity":"critical","description":"Enforces strict memory limits and drop-tail eviction strategies on OpenTelemetry collectors executing tail-based sampling under cascading service failure cascades. Prevents Out-Of-Memory (OOM) collector termination by bounding concurrent trace aggregation buffers, mandating deterministic memory limits, and configuring backpressure-safe sampling thresholds.","antiPatternHeadline":"Unbounded Collector Heap Exhaustion via Indefinite Span Aggregation in Tail-Sampling Processors","stars_count":110,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","observability","tail-sampling","memory-management","sre"],"exportEndpoints":{"claude":"/api/rules/otel-tail-sampling-bounded-cache-standard?format=claude","cursorMdc":"/api/rules/otel-tail-sampling-bounded-cache-standard?format=mdc","cursorrules":"/api/rules/otel-tail-sampling-bounded-cache-standard?format=cursor","windsurf":"/api/rules/otel-tail-sampling-bounded-cache-standard?format=windsurf","agents":"/api/rules/otel-tail-sampling-bounded-cache-standard?format=agents"}},{"id":"vite-6-environment-api-isolation-production-standard","title":"Vite 6 Environment API Module-Graph Isolation Standard","category":"frontend","severity":"critical","description":"Enforces strict module-graph separation and runtime-targeted execution via Vite 6 Environment APIs across browser, SSR, and edge environments. Prevents cross-runtime state leakage, invalid Node.js/browser primitive cross-contamination, and shared plugin cache corruption during multi-runtime builds.","antiPatternHeadline":"Monolithic Module Graph Traversal and Shared Plugin State Across Disparate Runtime Environments","stars_count":65,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","vite","vite-6","ssr","edge","module-graph","environments"],"exportEndpoints":{"claude":"/api/rules/vite-6-environment-api-isolation-production-standard?format=claude","cursorMdc":"/api/rules/vite-6-environment-api-isolation-production-standard?format=mdc","cursorrules":"/api/rules/vite-6-environment-api-isolation-production-standard?format=cursor","windsurf":"/api/rules/vite-6-environment-api-isolation-production-standard?format=windsurf","agents":"/api/rules/vite-6-environment-api-isolation-production-standard?format=agents"}},{"id":"nextjs-15-server-action-origin-host-binding","title":"Strict Cryptographic Origin and Host-Header Binding for Next.js 15 Server Actions","category":"frontend","severity":"critical","description":"Enforces deterministic origin and host-header verification inside Next.js 15 Server Action invocations and edge proxy middleware to neutralize multitenant Host-header poisoning, cross-site action execution, and CDN edge cache pollution. Next.js 15 performs basic origin matching against the Host header, but multi-tenant deployments behind reverse proxies, CDNs, or custom domains require strict cryptographic whitelist validation against an absolute tenant authority.","antiPatternHeadline":"Trusting Implicit Framework CSRF Checks on Next.js 15 Server Actions in Multi-Tenant CDN Topologies","stars_count":93,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs15","security","server-actions","multi-tenancy","csrf"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-server-action-origin-host-binding?format=claude","cursorMdc":"/api/rules/nextjs-15-server-action-origin-host-binding?format=mdc","cursorrules":"/api/rules/nextjs-15-server-action-origin-host-binding?format=cursor","windsurf":"/api/rules/nextjs-15-server-action-origin-host-binding?format=windsurf","agents":"/api/rules/nextjs-15-server-action-origin-host-binding?format=agents"}},{"id":"bun-explicit-resource-management-fd-boundary","title":"Bun 1.2 TC39 Explicit Resource Management (Symbol.asyncDispose) FD Boundary","category":"backend","severity":"critical","description":"Enforces strict utilization of TC39 Explicit Resource Management via 'using' and 'await using' declarations across Bun 1.2+ runtime boundaries. Eliminates file descriptor (FD) and OS handle leakage across high-throughput Bun TCP sockets, FileSink streams, and bun:sqlite database handles during unhandled exceptions and early return flows.","antiPatternHeadline":"Implicit garbage-collection-dependent teardown of native OS file descriptors causing EMFILE pool exhaustion under load","stars_count":54,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","typescript","sqlite","networking","resource-management"],"exportEndpoints":{"claude":"/api/rules/bun-explicit-resource-management-fd-boundary?format=claude","cursorMdc":"/api/rules/bun-explicit-resource-management-fd-boundary?format=mdc","cursorrules":"/api/rules/bun-explicit-resource-management-fd-boundary?format=cursor","windsurf":"/api/rules/bun-explicit-resource-management-fd-boundary?format=windsurf","agents":"/api/rules/bun-explicit-resource-management-fd-boundary?format=agents"}},{"id":"pgx-v5-pipeline-batch-saturation-guardrail","title":"pgx v5 Pipeline Concurrency & Batch Buffer Saturation Guardrail","category":"backend","severity":"critical","description":"Mandates deterministic chunking, strict result-drain loops, and explicit context timeouts when using jackc/pgx/v5 Batch and Pipeline APIs. Unbounded batch queuing triggers full-duplex TCP socket buffer deadlocks (SO_SNDBUF/SO_RCVBUF saturation) between Go runtimes and PostgreSQL, leading to silent connection-pool starvation.","antiPatternHeadline":"Unbounded pgx.Batch Queueing and Deferred Result Consumption Inducing Full-Duplex Socket Deadlocks","stars_count":78,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","postgresql","pgx","concurrency","performance"],"exportEndpoints":{"claude":"/api/rules/pgx-v5-pipeline-batch-saturation-guardrail?format=claude","cursorMdc":"/api/rules/pgx-v5-pipeline-batch-saturation-guardrail?format=mdc","cursorrules":"/api/rules/pgx-v5-pipeline-batch-saturation-guardrail?format=cursor","windsurf":"/api/rules/pgx-v5-pipeline-batch-saturation-guardrail?format=windsurf","agents":"/api/rules/pgx-v5-pipeline-batch-saturation-guardrail?format=agents"}},{"id":"tauri-v2-origin-bound-custom-protocol-deserialization","title":"Tauri 2.0 Custom Protocol IPC Origin-Bound Deserialization Standard","category":"mobile","severity":"critical","description":"Enforces strict origin validation and cryptographically attested message parsing on Tauri 2.0 custom protocol handlers (`register_uri_scheme_protocol` / `register_asynchronous_uri_scheme_protocol`). Prevents unauthorized cross-webview command execution and arbitrary payload deserialization triggered by embedded external web contexts, deep links, or untrusted IFrames on Android and iOS.","antiPatternHeadline":"Blind Deserialization of Custom URI Payloads Without Strict Webview Origin and Token Attestation","stars_count":82,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri-v2","ipc-security","rust","android","ios","deserialization"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-origin-bound-custom-protocol-deserialization?format=claude","cursorMdc":"/api/rules/tauri-v2-origin-bound-custom-protocol-deserialization?format=mdc","cursorrules":"/api/rules/tauri-v2-origin-bound-custom-protocol-deserialization?format=cursor","windsurf":"/api/rules/tauri-v2-origin-bound-custom-protocol-deserialization?format=windsurf","agents":"/api/rules/tauri-v2-origin-bound-custom-protocol-deserialization?format=agents"}},{"id":"kmp-native-dual-gc-cross-bridge-lifecycle","title":"Kotlin/Native to Swift ARC Dual-GC Bridge Lifecycle Detachment Invariant","category":"mobile","severity":"critical","description":"Governs the boundary between Kotlin/Native concurrent tracing GC and Swift Automatic Reference Counting (ARC) to prevent cross-runtime reference cycles and memory leaks. Requires explicit lifecycle detachment, deterministic cancellation of asynchronous subscriptions, and weak callback references across the Objective-C/Swift bridge.","antiPatternHeadline":"Unbounded Cross-Bridge Closures and Undisposed Flow Observers Between Kotlin GC and Swift ARC","stars_count":94,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","kotlin-native","swift-arc","memory-leaks","coroutines"],"exportEndpoints":{"claude":"/api/rules/kmp-native-dual-gc-cross-bridge-lifecycle?format=claude","cursorMdc":"/api/rules/kmp-native-dual-gc-cross-bridge-lifecycle?format=mdc","cursorrules":"/api/rules/kmp-native-dual-gc-cross-bridge-lifecycle?format=cursor","windsurf":"/api/rules/kmp-native-dual-gc-cross-bridge-lifecycle?format=windsurf","agents":"/api/rules/kmp-native-dual-gc-cross-bridge-lifecycle?format=agents"}},{"id":"openfga-recursion-hop-limit-boundary-guardrail","title":"OpenFGA Relationship Tuple Recursion and Hop-Limit Boundary Guardrail","category":"security","severity":"critical","description":"Enforces strict pre-write cycle detection, depth-bounding heuristics, and fail-closed resolution boundaries on fine-grained authorization graphs. Transitive relation expansions (e.g., nested groups, parent-child hierarchies) without bounded hop limits expose the authorization engine to algorithmic complexity attacks, memory exhaustion, and denial-of-service during Check and Expand API resolutions.","antiPatternHeadline":"Unbounded Graph Traversals and Cyclic Tuple Ingestion Triggering Authorization Engine DoS","stars_count":93,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","authorization","graph-dos","zanzibar"],"exportEndpoints":{"claude":"/api/rules/openfga-recursion-hop-limit-boundary-guardrail?format=claude","cursorMdc":"/api/rules/openfga-recursion-hop-limit-boundary-guardrail?format=mdc","cursorrules":"/api/rules/openfga-recursion-hop-limit-boundary-guardrail?format=cursor","windsurf":"/api/rules/openfga-recursion-hop-limit-boundary-guardrail?format=windsurf","agents":"/api/rules/openfga-recursion-hop-limit-boundary-guardrail?format=agents"}},{"id":"webauthn-aal3-hardware-attestation-invariant","title":"Passkey AAL3 Hardware Enclave Attestation & Non-Exportability Invariant","category":"security","severity":"critical","description":"Enforces strict NIST SP 800-63B Authenticator Assurance Level 3 (AAL3) compliance in WebAuthn registration ceremonies. Rejects unmanaged multi-device synced passkeys by requiring direct cryptographic attestation verification, FIDO Metadata Service (MDS3) root-of-trust anchoring, FIDO Level 2+ certification validation, and strict enforcement of single-device non-exportability flags.","antiPatternHeadline":"Accepting Unattested WebAuthn Credentials or Permitting Synced Multi-Device Passkeys in AAL3 Zero-Trust Perimeters","stars_count":105,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","fido2","passkeys","aal3","zero-trust","cryptography"],"exportEndpoints":{"claude":"/api/rules/webauthn-aal3-hardware-attestation-invariant?format=claude","cursorMdc":"/api/rules/webauthn-aal3-hardware-attestation-invariant?format=mdc","cursorrules":"/api/rules/webauthn-aal3-hardware-attestation-invariant?format=cursor","windsurf":"/api/rules/webauthn-aal3-hardware-attestation-invariant?format=windsurf","agents":"/api/rules/webauthn-aal3-hardware-attestation-invariant?format=agents"}},{"id":"otel-connector-nonblocking-backpressure-standard","title":"OpenTelemetry Collector Connector Pipeline Non-Blocking Backpressure Standard","category":"devops","severity":"critical","description":"Enforces asynchronous, memory-bounded queueing and explicit shedding configurations on OpenTelemetry Collector connectors linking telemetry pipelines. Prevents downstream exporter slowdowns (such as metric stores or trace indices) from propagating blocking backpressure upstream and starving primary ingestion receivers.","antiPatternHeadline":"Unbuffered Connector Cascades Exporter Delays Into Upstream Receiver Deadlocks","stars_count":52,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","observability","backpressure","sre"],"exportEndpoints":{"claude":"/api/rules/otel-connector-nonblocking-backpressure-standard?format=claude","cursorMdc":"/api/rules/otel-connector-nonblocking-backpressure-standard?format=mdc","cursorrules":"/api/rules/otel-connector-nonblocking-backpressure-standard?format=cursor","windsurf":"/api/rules/otel-connector-nonblocking-backpressure-standard?format=windsurf","agents":"/api/rules/otel-connector-nonblocking-backpressure-standard?format=agents"}},{"id":"react19-server-action-optimistic-interruption-invariant","title":"Deterministic Optimistic Rollback Invariant for Concurrent React 19 Server Actions","category":"frontend","severity":"critical","description":"Guarantees deterministic rollback of client-side optimistic UI state without DOM tearing, state leakage, or flash-of-stale-content (FOSC) during rapid concurrent React 19 Server Action dispatches and cancellations. Mandates strict isolation of transition boundaries using useOptimistic paired with canonical action transitions and cancellation tokens rather than unmanaged client state synchronization.","antiPatternHeadline":"Unsynchronized useState and un-sequenced useOptimistic updates causing state desynchronization and tearing during aborted Server Actions","stars_count":77,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react19","server-actions","useOptimistic","concurrency","transitions"],"exportEndpoints":{"claude":"/api/rules/react19-server-action-optimistic-interruption-invariant?format=claude","cursorMdc":"/api/rules/react19-server-action-optimistic-interruption-invariant?format=mdc","cursorrules":"/api/rules/react19-server-action-optimistic-interruption-invariant?format=cursor","windsurf":"/api/rules/react19-server-action-optimistic-interruption-invariant?format=windsurf","agents":"/api/rules/react19-server-action-optimistic-interruption-invariant?format=agents"}},{"id":"openfga-contextual-tuple-traversal-budget-standard","title":"OpenFGA Contextual Tuple Graph-Depth Traversal Budget Standard","category":"backend","severity":"critical","description":"Enforces strict limits on contextual tuple injection, recursive relationship graph traversal depth, and evaluation timeouts during OpenFGA authorization checks. Prevents algorithmic denial-of-service (Graph DoS) and memory exhaustion caused by deep transitive relations or circular dynamic context.","antiPatternHeadline":"Unbounded Contextual Tuples and Unconstrained Graph Traversal in OpenFGA ReBAC Evaluations","stars_count":116,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["openfga","authorization","rebac","security","graph-traversal","dos-prevention"],"exportEndpoints":{"claude":"/api/rules/openfga-contextual-tuple-traversal-budget-standard?format=claude","cursorMdc":"/api/rules/openfga-contextual-tuple-traversal-budget-standard?format=mdc","cursorrules":"/api/rules/openfga-contextual-tuple-traversal-budget-standard?format=cursor","windsurf":"/api/rules/openfga-contextual-tuple-traversal-budget-standard?format=windsurf","agents":"/api/rules/openfga-contextual-tuple-traversal-budget-standard?format=agents"}},{"id":"bun-sqlite-worker-thread-affinity-guardrail","title":"Bun 1.2 Worker-Thread SQLite Connection Affinity and WAL Concurrency Guardrail","category":"backend","severity":"critical","description":"Enforces strict thread-isolated SQLite connection instantiation across Bun 1.2 Worker threads and event loops. Prevents cross-isolate handle leakage, eliminates SQLITE_BUSY lock contention, and guarantees write-ahead log (WAL) checkpointing efficiency under high concurrency.","antiPatternHeadline":"Sharing bun:sqlite Database handles across Worker boundaries or running concurrent unmanaged multi-isolate writes without WAL thread affinity","stars_count":86,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","sqlite","multithreading","wal","concurrency"],"exportEndpoints":{"claude":"/api/rules/bun-sqlite-worker-thread-affinity-guardrail?format=claude","cursorMdc":"/api/rules/bun-sqlite-worker-thread-affinity-guardrail?format=mdc","cursorrules":"/api/rules/bun-sqlite-worker-thread-affinity-guardrail?format=cursor","windsurf":"/api/rules/bun-sqlite-worker-thread-affinity-guardrail?format=windsurf","agents":"/api/rules/bun-sqlite-worker-thread-affinity-guardrail?format=agents"}},{"id":"capacitor-7-native-webview-batching-backpressure","title":"Capacitor 7 Native-to-WebView Message Batching & Reactive Backpressure Guardrail","category":"mobile","severity":"critical","description":"High-frequency native notifications in Capacitor 7 overwhelm the single-threaded WebView event loop, causing runaway V8/JavaScriptCore heap allocation, dropped frames, and mobile OS memory terminations (Jetsam/LMK). This guardrail mandates bounded sliding-window batching, cooperative pull-based backpressure, and queue-overflow shedding strategies across the native-to-JS bridge interface.","antiPatternHeadline":"Unbounded fire-and-forget native telemetry flooding the Capacitor JS bridge without backpressure","stars_count":100,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["capacitor","capacitor-7","mobile","performance","backpressure","webview","memory-leak"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-native-webview-batching-backpressure?format=claude","cursorMdc":"/api/rules/capacitor-7-native-webview-batching-backpressure?format=mdc","cursorrules":"/api/rules/capacitor-7-native-webview-batching-backpressure?format=cursor","windsurf":"/api/rules/capacitor-7-native-webview-batching-backpressure?format=windsurf","agents":"/api/rules/capacitor-7-native-webview-batching-backpressure?format=agents"}},{"id":"cmp-predictive-back-gesture-state-isolation-standard","title":"Compose Multiplatform Predictive Back Gesture State Isolation Standard","category":"mobile","severity":"critical","description":"Enforces complete decoupling between predictive back gesture animation progress and persistent navigation/ViewModel state across Compose Multiplatform targets (Android, iOS). Prevents speculative transition gestures from mutating business models, firing lifecycle teardowns, or desynchronizing stack entries when users cancel mid-gesture.","antiPatternHeadline":"Premature ViewModel Mutation or Lifecycle Destruction During Speculative Gesture Tracking","stars_count":67,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","compose-multiplatform","predictive-back","kotlin","navigation","architecture"],"exportEndpoints":{"claude":"/api/rules/cmp-predictive-back-gesture-state-isolation-standard?format=claude","cursorMdc":"/api/rules/cmp-predictive-back-gesture-state-isolation-standard?format=mdc","cursorrules":"/api/rules/cmp-predictive-back-gesture-state-isolation-standard?format=cursor","windsurf":"/api/rules/cmp-predictive-back-gesture-state-isolation-standard?format=windsurf","agents":"/api/rules/cmp-predictive-back-gesture-state-isolation-standard?format=agents"}},{"id":"webauthn-prf-zk-isolation-boundary","title":"WebAuthn PRF Zero-Knowledge Key Derivation & Ephemeral Memory Isolation","category":"security","severity":"critical","description":"Enforces architectural isolation boundaries for symmetric keys derived via WebAuthn PRF (Pseudo-Random Function) extensions. Requires non-exportable WebCrypto keys, immediate manual buffer zeroization in scoped execution blocks, and strict prevention of key persistence across DOM storage, global state, and network layers.","antiPatternHeadline":"Persisting raw PRF material, using exportable CryptoKeys, or abandoning unwiped key buffers to garbage collection","stars_count":46,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","prf-extension","webcrypto","zero-knowledge","memory-isolation"],"exportEndpoints":{"claude":"/api/rules/webauthn-prf-zk-isolation-boundary?format=claude","cursorMdc":"/api/rules/webauthn-prf-zk-isolation-boundary?format=mdc","cursorrules":"/api/rules/webauthn-prf-zk-isolation-boundary?format=cursor","windsurf":"/api/rules/webauthn-prf-zk-isolation-boundary?format=windsurf","agents":"/api/rules/webauthn-prf-zk-isolation-boundary?format=agents"}},{"id":"spiffe-spire-dual-active-svid-rotation-invariant","title":"SPIFFE/SPIRE Ephemeral SVID Dual-Active Overlap Rotation Invariant","category":"security","severity":"critical","description":"Mandates dual-active overlapping validity windows when consuming ephemeral X.509 SVIDs from SPIRE Workload APIs. Enforces asynchronous TLS certificate hot-reloading with graceful in-flight handshake drain periods, eliminating TCP RST spikes and TLS handshake failures during sub-hour credential rotations.","antiPatternHeadline":"Synchronous Single-Certificate Atomic Pointer Replacement Causing In-Flight mTLS Resets","stars_count":46,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","spiffe","spire","mtls","tls-rotation","zero-trust"],"exportEndpoints":{"claude":"/api/rules/spiffe-spire-dual-active-svid-rotation-invariant?format=claude","cursorMdc":"/api/rules/spiffe-spire-dual-active-svid-rotation-invariant?format=mdc","cursorrules":"/api/rules/spiffe-spire-dual-active-svid-rotation-invariant?format=cursor","windsurf":"/api/rules/spiffe-spire-dual-active-svid-rotation-invariant?format=windsurf","agents":"/api/rules/spiffe-spire-dual-active-svid-rotation-invariant?format=agents"}},{"id":"cilium-ebpf-sockops-mtls-bypass-prevention","title":"Cilium eBPF Socket-Layer mTLS Handshake Bypass Prevention Guardrail","category":"devops","severity":"critical","description":"Enforces strict ordering and cryptographic identity validation in Cilium sidecarless service mesh architectures prior to sockops socket-layer acceleration. Prevents BPF sockmap/sockhash redirects from short-circuiting TLS handshakes or routing plaintext traffic directly across endpoints without prior mutual TLS authentication verification. Ensures that any socket bypass logic verifies the SPIFFE ID and mutual authentication handshake state before executing sock_ops redirection.","antiPatternHeadline":"Bypassing Host Cryptographic Layer via Premature BPF Sockops Redirection","stars_count":93,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","cilium","ebpf","mtls","service-mesh","spiffe","security","kubernetes"],"exportEndpoints":{"claude":"/api/rules/cilium-ebpf-sockops-mtls-bypass-prevention?format=claude","cursorMdc":"/api/rules/cilium-ebpf-sockops-mtls-bypass-prevention?format=mdc","cursorrules":"/api/rules/cilium-ebpf-sockops-mtls-bypass-prevention?format=cursor","windsurf":"/api/rules/cilium-ebpf-sockops-mtls-bypass-prevention?format=windsurf","agents":"/api/rules/cilium-ebpf-sockops-mtls-bypass-prevention?format=agents"}},{"id":"opentelemetry-profiling-ring-buffer-cap-standard","title":"OpenTelemetry Continuous Profiling Ring-Buffer Memory Cap Standard","category":"devops","severity":"critical","description":"Enforces strict off-heap, bounded ring-buffer memory allocations for OpenTelemetry eBPF continuous CPU stack sampling agents. Prohibits dynamic heap allocations, unbounded backpressure queues, and user-space memory growth during stack unwinding. Guarantees predictable p99 kernel-to-user context switch latency and prevents out-of-memory (OOM) eviction of production workloads.","antiPatternHeadline":"Unbounded User-Space Buffering and Dynamic Allocations for eBPF Profiling Telemetry","stars_count":77,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","ebpf","continuous-profiling","memory-management","kernel-stability"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-profiling-ring-buffer-cap-standard?format=claude","cursorMdc":"/api/rules/opentelemetry-profiling-ring-buffer-cap-standard?format=mdc","cursorrules":"/api/rules/opentelemetry-profiling-ring-buffer-cap-standard?format=cursor","windsurf":"/api/rules/opentelemetry-profiling-ring-buffer-cap-standard?format=windsurf","agents":"/api/rules/opentelemetry-profiling-ring-buffer-cap-standard?format=agents"}},{"id":"openfga-ephemeral-contextual-tuples-boundary-standard","title":"OpenFGA Ephemeral Contextual Tuples Boundary Standard","category":"security","severity":"critical","description":"Enforces a strict boundary between durable relationship graph state and ephemeral check-time context in OpenFGA. Runtime authorization claims—such as session validity, step-up MFA, dynamic geofencing, and break-glass elevation—must strictly be evaluated as contextual tuples or condition parameters during check evaluation, never written directly to the persistent tuple store.","antiPatternHeadline":"Persisting transient session, MFA, or dynamic environmental state to durable OpenFGA storage instead of passing check-time contextual tuples.","stars_count":43,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","rebac","zero-trust","authorization","access-control"],"exportEndpoints":{"claude":"/api/rules/openfga-ephemeral-contextual-tuples-boundary-standard?format=claude","cursorMdc":"/api/rules/openfga-ephemeral-contextual-tuples-boundary-standard?format=mdc","cursorrules":"/api/rules/openfga-ephemeral-contextual-tuples-boundary-standard?format=cursor","windsurf":"/api/rules/openfga-ephemeral-contextual-tuples-boundary-standard?format=windsurf","agents":"/api/rules/openfga-ephemeral-contextual-tuples-boundary-standard?format=agents"}},{"id":"ebpf-tetragon-namespace-escape-detection-standard","title":"eBPF Tetragon In-Kernel Namespace Escape Detection & Synchronous Kill Standard","category":"devops","severity":"critical","description":"Enforces real-time, in-kernel syscall mediation using Cilium Tetragon TracingPolicies to terminate container namespace breakout vectors before execution completes. Mandates synchronous Sigkill actions directly within the BPF hook for unauthorized pivot attempts (setns, unshare, mount injection, and cap_capable escalation), preventing user-space detection lag and race conditions.","antiPatternHeadline":"Relying on Passive Post-Execution Telemetry Without In-Kernel Enforcement for Container Breakouts","stars_count":83,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","tetragon","kubernetes","container-security","linux-kernel"],"exportEndpoints":{"claude":"/api/rules/ebpf-tetragon-namespace-escape-detection-standard?format=claude","cursorMdc":"/api/rules/ebpf-tetragon-namespace-escape-detection-standard?format=mdc","cursorrules":"/api/rules/ebpf-tetragon-namespace-escape-detection-standard?format=cursor","windsurf":"/api/rules/ebpf-tetragon-namespace-escape-detection-standard?format=windsurf","agents":"/api/rules/ebpf-tetragon-namespace-escape-detection-standard?format=agents"}},{"id":"fastapi-anyio-taskgroup-structural-concurrency","title":"FastAPI AnyIO TaskGroup Structural Concurrency and Client Disconnect Invariant","category":"backend","severity":"critical","description":"Enforces strict structural concurrency inside FastAPI route handlers performing concurrent outbound I/O using AnyIO TaskGroups. Prevents orphaned background coroutines, file descriptor leakage, and socket exhaustion when downstream HTTP clients abruptly abort or disconnect during fan-out calls.","antiPatternHeadline":"Unbounded asyncio.gather/create_task Fire-and-Forget Fan-Outs Causing Socket Exhaustion on Client Disconnect","stars_count":72,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","anyio","asyncio","concurrency","python"],"exportEndpoints":{"claude":"/api/rules/fastapi-anyio-taskgroup-structural-concurrency?format=claude","cursorMdc":"/api/rules/fastapi-anyio-taskgroup-structural-concurrency?format=mdc","cursorrules":"/api/rules/fastapi-anyio-taskgroup-structural-concurrency?format=cursor","windsurf":"/api/rules/fastapi-anyio-taskgroup-structural-concurrency?format=windsurf","agents":"/api/rules/fastapi-anyio-taskgroup-structural-concurrency?format=agents"}},{"id":"webauthn-synced-passkey-hardware-stepup","title":"WebAuthn Synced Passkey Hardware Attestation Step-Up Standard","category":"security","severity":"critical","description":"Enforces mandatory hardware-bound FIDO2 token verification invariants for high-risk operations when multi-device synced passkeys are detected. Inspects authenticatorData flags (Backup Eligibility and Backup State) and requires step-up authentication using FIDO Alliance MDS-certified, non-exportable hardware security keys.","antiPatternHeadline":"Permitting Synced Passkeys (BE=1, BS=1) to Authorize Irreversible High-Risk Operations Without Hardware Attestation Step-Up","stars_count":67,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","fido2","passkeys","attestation","step-up-auth"],"exportEndpoints":{"claude":"/api/rules/webauthn-synced-passkey-hardware-stepup?format=claude","cursorMdc":"/api/rules/webauthn-synced-passkey-hardware-stepup?format=mdc","cursorrules":"/api/rules/webauthn-synced-passkey-hardware-stepup?format=cursor","windsurf":"/api/rules/webauthn-synced-passkey-hardware-stepup?format=windsurf","agents":"/api/rules/webauthn-synced-passkey-hardware-stepup?format=agents"}},{"id":"bun-sqlite-wal-reader-isolation-standard","title":"Bun 1.2 Native SQLite WAL Reader Isolation and Concurrency Standard","category":"backend","severity":"critical","description":"Eliminates database lock starvation (SQLITE_BUSY) and transaction stalls during high-frequency concurrent operations in Bun edge microservices. Enforces separated read-only connection handles, optimized Write-Ahead Logging (WAL) pragmas, explicit busy timeouts, and isolated execution paths for native bun:sqlite instances.","antiPatternHeadline":"Shared Monolithic Read-Write Database Handles Lacking WAL PRAGMA Tuning and Busy Timeouts","stars_count":117,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["bun","sqlite","wal","backend","concurrency","edge"],"exportEndpoints":{"claude":"/api/rules/bun-sqlite-wal-reader-isolation-standard?format=claude","cursorMdc":"/api/rules/bun-sqlite-wal-reader-isolation-standard?format=mdc","cursorrules":"/api/rules/bun-sqlite-wal-reader-isolation-standard?format=cursor","windsurf":"/api/rules/bun-sqlite-wal-reader-isolation-standard?format=windsurf","agents":"/api/rules/bun-sqlite-wal-reader-isolation-standard?format=agents"}},{"id":"kmp-compose-skiko-surface-recycling-standard","title":"Compose Multiplatform Skiko Native Surface and Buffer Recycling Invariant","category":"mobile","severity":"critical","description":"Mandates the reuse and deterministic pooling of Skiko/Skia offscreen surfaces, render targets, and path objects during complex vector animations in Compose Multiplatform. Prevents Metal (iOS) and Vulkan/GLES (Android) unmanaged texture churn, GC-triggered finalizer stalls, and severe frame pacing drops during canvas transitions.","antiPatternHeadline":"Instantiating Native Skia Surfaces and Bitmaps Inside Recomposition Loops and Uncached Draw Modifiers","stars_count":89,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kmp","compose-multiplatform","skiko","skia","gpu-memory","rendering"],"exportEndpoints":{"claude":"/api/rules/kmp-compose-skiko-surface-recycling-standard?format=claude","cursorMdc":"/api/rules/kmp-compose-skiko-surface-recycling-standard?format=mdc","cursorrules":"/api/rules/kmp-compose-skiko-surface-recycling-standard?format=cursor","windsurf":"/api/rules/kmp-compose-skiko-surface-recycling-standard?format=windsurf","agents":"/api/rules/kmp-compose-skiko-surface-recycling-standard?format=agents"}},{"id":"opentelemetry-baggage-sanitization-standard-opentelemetry-ba-254","title":"OpenTelemetry Baggage Context Sanitization and Boundary Filtering Standard","category":"devops","severity":"critical","description":"Enforces deterministic ingress filtering and validation of OpenTelemetry Baggage metadata across service trust boundaries. Prevents header spoofing, tenant injection, and telemetry buffer exhaustion by constraining baggage keys to strict namespace regexes, validating payload sizes, and stripping untrusted propagation headers at boundary gateways.","antiPatternHeadline":"Blind Ingress Baggage Propagation Without Trust Boundary Filtering or Key Allowlisting","stars_count":114,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","security","distributed-tracing","context-propagation"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-baggage-sanitization-standard-opentelemetry-ba-254?format=claude","cursorMdc":"/api/rules/opentelemetry-baggage-sanitization-standard-opentelemetry-ba-254?format=mdc","cursorrules":"/api/rules/opentelemetry-baggage-sanitization-standard-opentelemetry-ba-254?format=cursor","windsurf":"/api/rules/opentelemetry-baggage-sanitization-standard-opentelemetry-ba-254?format=windsurf","agents":"/api/rules/opentelemetry-baggage-sanitization-standard-opentelemetry-ba-254?format=agents"}},{"id":"postgres-17-json-table-memory-quota-standard-postgres-17-json-180","title":"PostgreSQL 17 JSON_TABLE Memory Projection and Cardinality Quota Standard","category":"backend","severity":"critical","description":"Protects PostgreSQL 17 backend worker processes from out-of-memory (OOM) terminations and severe connection churn when dynamically shredding nested, high-cardinality JSONB payloads into relational tuples. Enforces deterministic PATH scoping, strict byte-length bounds on projected TEXT/VARCHAR columns, bounded pagination limits, and explicit work_mem execution ceilings prior to invoking JSON_TABLE. Eliminates unbounded tuple expansion, unindexed Cartesian product blowouts, and OOM-killer evictions across production database pools.","antiPatternHeadline":"Unbounded Nested JSON_TABLE Invocations Without Memory and Cardinality Guardrails","stars_count":74,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","json-table","database","sql","performance"],"exportEndpoints":{"claude":"/api/rules/postgres-17-json-table-memory-quota-standard-postgres-17-json-180?format=claude","cursorMdc":"/api/rules/postgres-17-json-table-memory-quota-standard-postgres-17-json-180?format=mdc","cursorrules":"/api/rules/postgres-17-json-table-memory-quota-standard-postgres-17-json-180?format=cursor","windsurf":"/api/rules/postgres-17-json-table-memory-quota-standard-postgres-17-json-180?format=windsurf","agents":"/api/rules/postgres-17-json-table-memory-quota-standard-postgres-17-json-180?format=agents"}},{"id":"capacitor-7-biometric-keychain-entropy-invalidation","title":"Capacitor 7 Biometric Keychain Hardware Entropy & Integrity Invalidation Guardrail","category":"mobile","severity":"critical","description":"Mandates that hardware-backed cryptographic keys accessed through Capacitor 7 native bridges strictly bind to active biometric sets (kSecAccessControlBiometryCurrentSet and Android KeyGenParameterSpec auth-bound keys). Enforces immediate Secure Enclave/KeyStore cryptographic key destruction, volatile buffer zeroization, and session termination upon biometric enrollment modifications or root/jailbreak detection.","antiPatternHeadline":"Persisting Unbound Keychain Keys or Retaining Volatile Secrets When Biometrics Mutate or Devices Are Compromised","stars_count":100,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","keychain","biometrics","secure-enclave","keystore","cryptography","zero-trust"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-biometric-keychain-entropy-invalidation?format=claude","cursorMdc":"/api/rules/capacitor-7-biometric-keychain-entropy-invalidation?format=mdc","cursorrules":"/api/rules/capacitor-7-biometric-keychain-entropy-invalidation?format=cursor","windsurf":"/api/rules/capacitor-7-biometric-keychain-entropy-invalidation?format=windsurf","agents":"/api/rules/capacitor-7-biometric-keychain-entropy-invalidation?format=agents"}},{"id":"react-19-server-actions-cryptographic-idempotency-react-19-server--258","title":"React 19 Server Actions Cryptographic Idempotency & Stream Replay Standard","category":"frontend","severity":"critical","description":"Enforces deterministic cryptographic idempotency and atomic replay guards for all mutating React 19 Server Actions over progressive HTTP/3 streams. Prevents duplicate execution, financial double-spend, and corrupted state trees caused by QUIC connection migrations, network drops, and aggressive browser auto-retries during partial stream emissions.","antiPatternHeadline":"Blind mutating Server Actions vulnerable to HTTP/3 QUIC connection retry replays and unkeyed double-execution","stars_count":69,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","server-actions","idempotency","cryptography","http3","state-integrity"],"exportEndpoints":{"claude":"/api/rules/react-19-server-actions-cryptographic-idempotency-react-19-server--258?format=claude","cursorMdc":"/api/rules/react-19-server-actions-cryptographic-idempotency-react-19-server--258?format=mdc","cursorrules":"/api/rules/react-19-server-actions-cryptographic-idempotency-react-19-server--258?format=cursor","windsurf":"/api/rules/react-19-server-actions-cryptographic-idempotency-react-19-server--258?format=windsurf","agents":"/api/rules/react-19-server-actions-cryptographic-idempotency-react-19-server--258?format=agents"}},{"id":"fastapi-anyio-threadpool-starvation-guardrail","title":"FastAPI AnyIO Worker Thread Pool Starvation & Concurrency Partitioning Guardrail","category":"backend","severity":"critical","description":"Prevents catastrophic worker thread starvation and cascading event-loop deadlocks in FastAPI applications. In FastAPI, standard synchronous route handlers (`def`) and untuned `run_in_threadpool` or `anyio.to_thread.run_sync` calls draw from AnyIO's shared global `CapacityLimiter` (defaulting to 40 threads), leading to full thread pool exhaustion under heavy sync I/O. This standard enforces non-blocking async primitives, custom isolated thread pools via dedicated `CapacityLimiter` instances, and strict tuning of global AnyIO concurrency limits during application lifespan.","antiPatternHeadline":"Saturating FastAPI's Global 40-Thread AnyIO Worker Pool via Unbounded Sync I/O","stars_count":67,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","anyio","asyncio","concurrency","threadpool","python"],"exportEndpoints":{"claude":"/api/rules/fastapi-anyio-threadpool-starvation-guardrail?format=claude","cursorMdc":"/api/rules/fastapi-anyio-threadpool-starvation-guardrail?format=mdc","cursorrules":"/api/rules/fastapi-anyio-threadpool-starvation-guardrail?format=cursor","windsurf":"/api/rules/fastapi-anyio-threadpool-starvation-guardrail?format=windsurf","agents":"/api/rules/fastapi-anyio-threadpool-starvation-guardrail?format=agents"}},{"id":"ebpf-lsm-kernel-socket-egress-invariant","title":"eBPF LSM Kernel-Enforced Socket Egress Boundary Invariant","category":"security","severity":"critical","description":"Mandates deterministic, zero-drift egress enforcement directly in the Linux Security Module (LSM) hookpoints via eBPF. Bypasses userspace proxy latency and race conditions by intercepting socket connection requests synchronously in kernel space before TCP SYN dispatch.","antiPatternHeadline":"Relying on Userspace Sidecar Proxies or Asynchronous Packet Filters for Container Egress Control","stars_count":66,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","ebpf","lsm","kernel","cgroup","network-security"],"exportEndpoints":{"claude":"/api/rules/ebpf-lsm-kernel-socket-egress-invariant?format=claude","cursorMdc":"/api/rules/ebpf-lsm-kernel-socket-egress-invariant?format=mdc","cursorrules":"/api/rules/ebpf-lsm-kernel-socket-egress-invariant?format=cursor","windsurf":"/api/rules/ebpf-lsm-kernel-socket-egress-invariant?format=windsurf","agents":"/api/rules/ebpf-lsm-kernel-socket-egress-invariant?format=agents"}},{"id":"k8s-dra-multi-instance-accelerator-standard","title":"Kubernetes DRA Deterministic Sliced-Accelerator Lifecycle & Memory Erasure Standard","category":"devops","severity":"critical","description":"Enforces strict Kubernetes Dynamic Resource Allocation (DRA) ResourceClaim parameters for partitioned GPU/TPU accelerators (e.g., NVIDIA MIG or Google TPU slices). Guarantees hardware-level memory scrubbing, deterministic spatial/temporal partitioning, and non-shared PCIe isolation boundaries to prevent cross-tenant state leakage and noisy-neighbor interference.","antiPatternHeadline":"Unsanitized Resource Sharing via Legacy Extended Resources with Leaked VRAM Buffers","stars_count":54,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","kubernetes","dra","gpu","mig","infrastructure-as-code","security"],"exportEndpoints":{"claude":"/api/rules/k8s-dra-multi-instance-accelerator-standard?format=claude","cursorMdc":"/api/rules/k8s-dra-multi-instance-accelerator-standard?format=mdc","cursorrules":"/api/rules/k8s-dra-multi-instance-accelerator-standard?format=cursor","windsurf":"/api/rules/k8s-dra-multi-instance-accelerator-standard?format=windsurf","agents":"/api/rules/k8s-dra-multi-instance-accelerator-standard?format=agents"}},{"id":"compose-skiko-vsync-frame-pacing-guardrail","title":"Compose Multiplatform Skiko Render Loop and VSync Frame-Pacing Standard","category":"mobile","severity":"critical","description":"Enforces deterministic frame pacing and native VSync synchronization within Compose Multiplatform (CMP) and Skiko rendering pipelines on variable refresh rate (VRR / 120Hz ProMotion) displays. Prevents micro-stutter, frame drops, and pipeline stalling by binding Skiko frame invalidations directly to platform-native display links rather than unconstrained coroutine clocks or timer loops.","antiPatternHeadline":"Unbounded coroutine-driven redraws and decoupled display link ticking causing 120Hz frame stutter and thermal throttling","stars_count":89,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","compose-multiplatform","skiko","frame-pacing","promotion","vsync","kotlin"],"exportEndpoints":{"claude":"/api/rules/compose-skiko-vsync-frame-pacing-guardrail?format=claude","cursorMdc":"/api/rules/compose-skiko-vsync-frame-pacing-guardrail?format=mdc","cursorrules":"/api/rules/compose-skiko-vsync-frame-pacing-guardrail?format=cursor","windsurf":"/api/rules/compose-skiko-vsync-frame-pacing-guardrail?format=windsurf","agents":"/api/rules/compose-skiko-vsync-frame-pacing-guardrail?format=agents"}},{"id":"clickhouse-adaptive-async-insert-batching-invariant","title":"ClickHouse Adaptive Asynchronous Insert Batching Invariant","category":"backend","severity":"critical","description":"Enforces server-side asynchronous batching (`async_insert=1`, `wait_for_async_insert=1`) and client-side micro-batch queues for high-throughput ingestion into ClickHouse MergeTree tables. Prevents catastrophic part-count explosion ('Too many parts in all data parts in table' exception) and zookeeper metadata exhaustion caused by synchronous micro-commits. Mandates bounded flush windows, idempotency deduplication tokens, and explicit backpressure telemetry.","antiPatternHeadline":"High-Frequency Synchronous Micro-Inserts Triggering 'Too Many Parts' MergeTree Cluster Degradation","stars_count":94,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","clickhouse","olap","telemetry","batching","database"],"exportEndpoints":{"claude":"/api/rules/clickhouse-adaptive-async-insert-batching-invariant?format=claude","cursorMdc":"/api/rules/clickhouse-adaptive-async-insert-batching-invariant?format=mdc","cursorrules":"/api/rules/clickhouse-adaptive-async-insert-batching-invariant?format=cursor","windsurf":"/api/rules/clickhouse-adaptive-async-insert-batching-invariant?format=windsurf","agents":"/api/rules/clickhouse-adaptive-async-insert-batching-invariant?format=agents"}},{"id":"webauthn-rors-origin-isolation-standard","title":"WebAuthn Related Origin Requests (RORS) Isolation and Cryptographic Origin Binding","category":"security","severity":"critical","description":"Enforces strict origin validation and Related Origin Requests (RORS) manifest verification across federated micro-frontends and multi-tenant subdomains. Prevents cross-origin credential theft, assertion relay, and phishing escalations by cryptographically asserting origin constraints against authoritative well-known manifests.","antiPatternHeadline":"Accepting Unverified Cross-Origin WebAuthn Assertions via Loose Regex or Subdomain Suffix Matching","stars_count":52,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","fido2","rors","micro-frontends","authentication"],"exportEndpoints":{"claude":"/api/rules/webauthn-rors-origin-isolation-standard?format=claude","cursorMdc":"/api/rules/webauthn-rors-origin-isolation-standard?format=mdc","cursorrules":"/api/rules/webauthn-rors-origin-isolation-standard?format=cursor","windsurf":"/api/rules/webauthn-rors-origin-isolation-standard?format=windsurf","agents":"/api/rules/webauthn-rors-origin-isolation-standard?format=agents"}},{"id":"bun-cluster-socket-handoff-zero-downtime-standard","title":"Bun 1.2 Cluster Mode Worker Zero-Downtime Socket Handoff Standard","category":"backend","severity":"critical","description":"Mandates deterministic zero-downtime socket handoff and file descriptor preservation across Bun 1.2 supervisor and worker processes. Guarantees zero dropped TCP connections during rolling reloads through SO_REUSEPORT socket sharing, IPC readiness handshakes, and graceful connection draining via Bun.serve.","antiPatternHeadline":"Uncoordinated Worker Termination and Socket Unbinding During Rolling Reloads Causing ECONNRESET","stars_count":94,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","cluster","zero-downtime","socket-handoff","hot-reload"],"exportEndpoints":{"claude":"/api/rules/bun-cluster-socket-handoff-zero-downtime-standard?format=claude","cursorMdc":"/api/rules/bun-cluster-socket-handoff-zero-downtime-standard?format=mdc","cursorrules":"/api/rules/bun-cluster-socket-handoff-zero-downtime-standard?format=cursor","windsurf":"/api/rules/bun-cluster-socket-handoff-zero-downtime-standard?format=windsurf","agents":"/api/rules/bun-cluster-socket-handoff-zero-downtime-standard?format=agents"}},{"id":"react-19-compiler-reference-purity-guardrail","title":"React 19 Compiler Reactive Reference Purity and Immutability Guardrail","category":"frontend","severity":"critical","description":"Enforces strict mathematical purity, reference stabilization, and structural immutability in React 19 environments utilizing the React Compiler (React Forget). Prevents accidental escape hatches, mutable state aliasing, and render-phase side effects that de-optimize the compiler's intermediate representation (HIR) and trigger catastrophic memoization invalidation cascades across the component tree.","antiPatternHeadline":"In-Place Mutation and Non-Pure Reference Escapes Bypassing React Compiler SSA Optimization","stars_count":51,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","react-compiler","immutability","memoization","performance"],"exportEndpoints":{"claude":"/api/rules/react-19-compiler-reference-purity-guardrail?format=claude","cursorMdc":"/api/rules/react-19-compiler-reference-purity-guardrail?format=mdc","cursorrules":"/api/rules/react-19-compiler-reference-purity-guardrail?format=cursor","windsurf":"/api/rules/react-19-compiler-reference-purity-guardrail?format=windsurf","agents":"/api/rules/react-19-compiler-reference-purity-guardrail?format=agents"}},{"id":"android-15-16kb-page-size-alignment-guardrail","title":"Android 15 16KB Page Size Native Library Memory Invariant","category":"mobile","severity":"critical","description":"Enforces strict 16KB (0x4000) ELF load segment alignment across all compiled C/C++ native shared objects (.so files) and build configurations targeted for Android 15 (API level 35) and above. Failure to align ELF segments on 16KB boundaries causes immediate mmap failures, dynamic linker aborts (SIGSEGV/SIGBUS), and application crashes on devices running 16KB page size kernels. All NDK toolchains, CMake scripts, and Gradle build configurations must explicitly configure max-page-size linker flags and audit prebuilt binary dependencies.","antiPatternHeadline":"Compiling or bundling 4KB-aligned native shared libraries (.so) causing dynamic linker crashes on Android 15 16KB kernel targets","stars_count":76,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["android","ndk","android-15","16kb-page-size","elf","memory-alignment","cmake","gradle"],"exportEndpoints":{"claude":"/api/rules/android-15-16kb-page-size-alignment-guardrail?format=claude","cursorMdc":"/api/rules/android-15-16kb-page-size-alignment-guardrail?format=mdc","cursorrules":"/api/rules/android-15-16kb-page-size-alignment-guardrail?format=cursor","windsurf":"/api/rules/android-15-16kb-page-size-alignment-guardrail?format=windsurf","agents":"/api/rules/android-15-16kb-page-size-alignment-guardrail?format=agents"}},{"id":"svelte-5-runes-ssr-state-leakage-guardrail","title":"Svelte 5 Runes Context Isolation Guardrail for Universal SSR State","category":"frontend","severity":"critical","description":"Enforces strict isolation of Svelte 5 reactive state in multi-tenant SSR runtimes by prohibiting top-level module-scoped $state() singletons in universal modules. Eliminates cross-request data pollution by mandating scoped dependency injection via getContext/setContext or per-request factory lifecycles.","antiPatternHeadline":"Module-Scoped Reactive Singletons Causing Cross-Tenant Data Leakage in Concurrent SSR Runtimes","stars_count":63,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte","svelte-5","runes","ssr","memory-leak","security"],"exportEndpoints":{"claude":"/api/rules/svelte-5-runes-ssr-state-leakage-guardrail?format=claude","cursorMdc":"/api/rules/svelte-5-runes-ssr-state-leakage-guardrail?format=mdc","cursorrules":"/api/rules/svelte-5-runes-ssr-state-leakage-guardrail?format=cursor","windsurf":"/api/rules/svelte-5-runes-ssr-state-leakage-guardrail?format=windsurf","agents":"/api/rules/svelte-5-runes-ssr-state-leakage-guardrail?format=agents"}},{"id":"openfga-contextual-tuple-bounded-traversal-standard","title":"OpenFGA Contextual Tuple Graph Traversal and Latency Bounds Guardrail","category":"security","severity":"critical","description":"Enforces deterministic computational and memory bounds on OpenFGA dynamic contextual tuples during Check and Expand evaluations. Prevents algorithmic complexity denial-of-service (ReDoS/GraphDoS) and p99 latency degradation by capping contextual tuple cardinality, depth, and payload size to guarantee sub-10ms authorization response times.","antiPatternHeadline":"Unbounded contextual tuple injection triggering combinatorial graph traversals and engine latency spikes","stars_count":85,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","rebac","authorization","performance","dos-prevention"],"exportEndpoints":{"claude":"/api/rules/openfga-contextual-tuple-bounded-traversal-standard?format=claude","cursorMdc":"/api/rules/openfga-contextual-tuple-bounded-traversal-standard?format=mdc","cursorrules":"/api/rules/openfga-contextual-tuple-bounded-traversal-standard?format=cursor","windsurf":"/api/rules/openfga-contextual-tuple-bounded-traversal-standard?format=windsurf","agents":"/api/rules/openfga-contextual-tuple-bounded-traversal-standard?format=agents"}},{"id":"axum-08-tokio-cancellation-token-propagation-standard","title":"Axum 0.8 Tokio CancellationToken Propagation & Immediate Cancellation Cascade","category":"backend","severity":"critical","description":"Enforces deterministic cancellation propagation across Axum 0.8 request pipelines, active database drivers, and upstream RPC clients. Premature HTTP client disconnects must immediately abort pending transactions, connection acquisitions, and downstream HTTP/gRPC requests via Tokio CancellationTokens and drop-aware execution boundaries to prevent phantom resource exhaustion.","antiPatternHeadline":"Orphaned Detached Task Execution and Zombie Database Transactions on Premature HTTP Client Disconnect","stars_count":68,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tokio","cancellation-token","concurrency"],"exportEndpoints":{"claude":"/api/rules/axum-08-tokio-cancellation-token-propagation-standard?format=claude","cursorMdc":"/api/rules/axum-08-tokio-cancellation-token-propagation-standard?format=mdc","cursorrules":"/api/rules/axum-08-tokio-cancellation-token-propagation-standard?format=cursor","windsurf":"/api/rules/axum-08-tokio-cancellation-token-propagation-standard?format=windsurf","agents":"/api/rules/axum-08-tokio-cancellation-token-propagation-standard?format=agents"}},{"id":"android-15-16kb-page-alignment-ndk","title":"Android 15 16KB Page Size NDK Binary Alignment Invariant","category":"mobile","severity":"critical","description":"Mandates that all native C/C++ shared libraries (.so) compiled via NDK, CMake, or bundled as prebuilts enforce strict 16KB (16384 bytes) ELF segment alignment. Failure to pass 16KB max-page-size linker flags causes immediate dlopen() aborts and unrecoverable runtime crashes on Android 15 devices running with 16KB kernel configurations.","antiPatternHeadline":"Packaging 4KB-Aligned Native Libraries on 16KB Page-Size Android Kernels","stars_count":99,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","android","ndk","16kb-pages","cmake","gradle"],"exportEndpoints":{"claude":"/api/rules/android-15-16kb-page-alignment-ndk?format=claude","cursorMdc":"/api/rules/android-15-16kb-page-alignment-ndk?format=mdc","cursorrules":"/api/rules/android-15-16kb-page-alignment-ndk?format=cursor","windsurf":"/api/rules/android-15-16kb-page-alignment-ndk?format=windsurf","agents":"/api/rules/android-15-16kb-page-alignment-ndk?format=agents"}},{"id":"postgres-17-json-table-memory-projection-guardrail","title":"PostgreSQL 17 JSON_TABLE Memory Projection and Resource Guardrail","category":"backend","severity":"critical","description":"PostgreSQL 17 introduces the SQL:2023 standard JSON_TABLE function, which shreds JSON/JSONB payloads into relational row sets in-engine. When processing unbounded nested arrays or large batch payloads in OLTP hot paths, unconstrained path expressions and missing column-width constraints cause severe memory inflation and spill into temporary disk files, exhausting work_mem and crashing backend worker processes. This guardrail establishes bounded memory projections, explicit column sizing, error-handling clauses, and chunked ingestion invariants.","antiPatternHeadline":"Unbounded JSON_TABLE Projections Without Size Limits or Streaming Chunking","stars_count":84,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","postgres-17","json-table","oltp","performance","sql"],"exportEndpoints":{"claude":"/api/rules/postgres-17-json-table-memory-projection-guardrail?format=claude","cursorMdc":"/api/rules/postgres-17-json-table-memory-projection-guardrail?format=mdc","cursorrules":"/api/rules/postgres-17-json-table-memory-projection-guardrail?format=cursor","windsurf":"/api/rules/postgres-17-json-table-memory-projection-guardrail?format=windsurf","agents":"/api/rules/postgres-17-json-table-memory-projection-guardrail?format=agents"}},{"id":"react-19-activity-suspense-restoration-guardrail","title":"React 19 Activity Offscreen Suspense Restoration Standard","category":"frontend","severity":"critical","description":"Enforces strict layout measurement isolation and effect lifecycle guards when utilizing React 19 Activity primitives for backgrounded subtrees. Prevents cascading synchronous reflows, ResizeObserver thrash loops, and destructive DOM ref destruction during hidden-to-visible transitions. Guarantees deterministic DOM state restoration, scroll persistence, and stable hydration across concurrent boundaries.","antiPatternHeadline":"Unconditioned Layout Observers and Unstable Effect Lifecycles in Backgrounded Activity Subtrees","stars_count":74,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["react19","activity","suspense","offscreen","layout-thrashing","concurrency"],"exportEndpoints":{"claude":"/api/rules/react-19-activity-suspense-restoration-guardrail?format=claude","cursorMdc":"/api/rules/react-19-activity-suspense-restoration-guardrail?format=mdc","cursorrules":"/api/rules/react-19-activity-suspense-restoration-guardrail?format=cursor","windsurf":"/api/rules/react-19-activity-suspense-restoration-guardrail?format=windsurf","agents":"/api/rules/react-19-activity-suspense-restoration-guardrail?format=agents"}},{"id":"bun-worker-sharedarraybuffer-atomics-concurrency","title":"Bun 1.2 Native Worker SharedArrayBuffer & Atomics Concurrency Standard","category":"backend","severity":"critical","description":"Enforces zero-copy SharedArrayBuffer memory sharing synchronized strictly through JavaScript Atomics across Bun 1.2 native workers. Eliminates microsecond-scale structured clone serialization overhead while preventing race conditions, memory tearing, and main-thread synchronous deadlocks.","antiPatternHeadline":"Structured Clone Serialization Overhead & Unsynchronized SharedArrayBuffer Memory Tearing","stars_count":110,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","concurrency","sharedarraybuffer","atomics","multithreading","performance"],"exportEndpoints":{"claude":"/api/rules/bun-worker-sharedarraybuffer-atomics-concurrency?format=claude","cursorMdc":"/api/rules/bun-worker-sharedarraybuffer-atomics-concurrency?format=mdc","cursorrules":"/api/rules/bun-worker-sharedarraybuffer-atomics-concurrency?format=cursor","windsurf":"/api/rules/bun-worker-sharedarraybuffer-atomics-concurrency?format=windsurf","agents":"/api/rules/bun-worker-sharedarraybuffer-atomics-concurrency?format=agents"}},{"id":"envoy-gateway-in-process-wasm-ratelimit","title":"Envoy Gateway 1.2 In-Process Wasm Rate-Limiting Guardrail","category":"devops","severity":"critical","description":"Mandates in-process Wasm filter execution via Envoy Gateway 1.2 EnvoyExtensionPolicy for pre-routing rate enforcement and high-frequency traffic shedding. Prevents worker thread starvation, network hop latency penalties, and cascading microservice exhaustion during volumetric DDoS by arbitrating requests directly within the Envoy data plane memory space.","antiPatternHeadline":"Delegating L7 Volumetric Throttling to External Network Hops or Application Runtimes","stars_count":97,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","envoy-gateway","wasm","rate-limiting","traffic-engineering","kubernetes"],"exportEndpoints":{"claude":"/api/rules/envoy-gateway-in-process-wasm-ratelimit?format=claude","cursorMdc":"/api/rules/envoy-gateway-in-process-wasm-ratelimit?format=mdc","cursorrules":"/api/rules/envoy-gateway-in-process-wasm-ratelimit?format=cursor","windsurf":"/api/rules/envoy-gateway-in-process-wasm-ratelimit?format=windsurf","agents":"/api/rules/envoy-gateway-in-process-wasm-ratelimit?format=agents"}},{"id":"slsa-v1-hermetic-provenance-production-standard","title":"SLSA v1.0 Hermetic Build Provenance Cryptographic Invariant","category":"devops","severity":"critical","description":"Enforces strict SLSA v1.0 build provenance and cryptographic attestation verification prior to container deployment. Mandates immutable SHA-256 digest referencing, Sigstore OIDC builder identity validation, and hermetic build environment verification to prevent supply chain tampering. Prohibits runtime resolution of mutable image tags or unverified container payloads.","antiPatternHeadline":"Deploying Mutable Image Tags or Unverified Container Artifacts Without Pre-Flight SLSA v1.0 Provenance Attestation","stars_count":54,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","slsa","supply-chain-security","sigstore","cosign","in-toto"],"exportEndpoints":{"claude":"/api/rules/slsa-v1-hermetic-provenance-production-standard?format=claude","cursorMdc":"/api/rules/slsa-v1-hermetic-provenance-production-standard?format=mdc","cursorrules":"/api/rules/slsa-v1-hermetic-provenance-production-standard?format=cursor","windsurf":"/api/rules/slsa-v1-hermetic-provenance-production-standard?format=windsurf","agents":"/api/rules/slsa-v1-hermetic-provenance-production-standard?format=agents"}},{"id":"webgpu-compute-pipeline-memory-synchronization-barrier","title":"WebGPU Compute Pipeline Memory Synchronization and Pass Transition Guardrail","category":"frontend","severity":"critical","description":"Enforces deterministic memory coherence across dependent compute dispatches during client-side WebGPU parallel ML inference. WebGPU does not guarantee write-after-read (WAR), read-after-write (RAW), or write-after-write (WAW) coherence between dispatches within the same compute pass. Engineers must separate dependent kernel dispatches across explicit compute pass boundaries or command encoder transitions to introduce hardware-level execution and memory barriers.","antiPatternHeadline":"Consecutive Dispatches Sharing Read-Write Storage Buffers Within a Single Compute Pass","stars_count":76,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","webgpu","machine-learning","concurrency","memory-barriers","gpgpu"],"exportEndpoints":{"claude":"/api/rules/webgpu-compute-pipeline-memory-synchronization-barrier?format=claude","cursorMdc":"/api/rules/webgpu-compute-pipeline-memory-synchronization-barrier?format=mdc","cursorrules":"/api/rules/webgpu-compute-pipeline-memory-synchronization-barrier?format=cursor","windsurf":"/api/rules/webgpu-compute-pipeline-memory-synchronization-barrier?format=windsurf","agents":"/api/rules/webgpu-compute-pipeline-memory-synchronization-barrier?format=agents"}},{"id":"react-19-server-action-dedup-rollback-production-standard","title":"React 19 Server Action State-Deduplication & Optimistic Rollback Invariant","category":"frontend","severity":"critical","description":"Enforces deterministic client-side optimistic state reconciliation and prevents double-commit mutations during concurrent React 19 Server Action executions. Mandates client-generated idempotency keys, monotonic sequencing, and strict rollback guards across volatile network transitions to ensure out-of-order responses do not corrupt client or server state.","antiPatternHeadline":"Unsequenced optimistic mutations without client-side idempotency keys and error-reconciling rollback boundaries.","stars_count":107,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","server-actions","optimistic-ui","state-reconciliation","idempotency"],"exportEndpoints":{"claude":"/api/rules/react-19-server-action-dedup-rollback-production-standard?format=claude","cursorMdc":"/api/rules/react-19-server-action-dedup-rollback-production-standard?format=mdc","cursorrules":"/api/rules/react-19-server-action-dedup-rollback-production-standard?format=cursor","windsurf":"/api/rules/react-19-server-action-dedup-rollback-production-standard?format=windsurf","agents":"/api/rules/react-19-server-action-dedup-rollback-production-standard?format=agents"}},{"id":"vite6-environment-api-worker-ssr-memory-isolation","title":"Vite 6 Environment API Memory Pool Isolation for Worker SSR Runtimes","category":"frontend","severity":"critical","description":"Enforces strict garbage collection boundaries and lifecycle isolation for Vite 6 ModuleRunner instances inside long-running Node.js worker pools and Edge SSR processes. Prevents cross-request module cache pollution, retained singleton graph leaks, and unbounded heap growth across concurrent SSR transactions.","antiPatternHeadline":"Global ModuleRunner Re-use and Unbounded Graph Caching in Long-Running SSR Worker Threads","stars_count":99,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","vite6","ssr","memory-leaks","web-workers","environment-api"],"exportEndpoints":{"claude":"/api/rules/vite6-environment-api-worker-ssr-memory-isolation?format=claude","cursorMdc":"/api/rules/vite6-environment-api-worker-ssr-memory-isolation?format=mdc","cursorrules":"/api/rules/vite6-environment-api-worker-ssr-memory-isolation?format=cursor","windsurf":"/api/rules/vite6-environment-api-worker-ssr-memory-isolation?format=windsurf","agents":"/api/rules/vite6-environment-api-worker-ssr-memory-isolation?format=agents"}},{"id":"axum-tower-workload-shedding-concurrency-guardrail","title":"Axum 0.8 Tower Workload-Shedding & Concurrency-Limit Guardrail","category":"backend","severity":"critical","description":"Mandates bounded concurrency limits and fail-fast load-shedding middleware across Axum 0.8 services to prevent Tokio worker thread starvation and connection saturation. Enforces explicit separation between critical orchestration probes and shed-sensitive business routes while mapping Tower Overloaded errors to deterministic 503 responses.","antiPatternHeadline":"Unbounded Route Concurrency and Blanket Load-Shedding Leading to Worker Starvation and Orchestration Crash Loops","stars_count":60,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tower","tokio","concurrency","load-shedding"],"exportEndpoints":{"claude":"/api/rules/axum-tower-workload-shedding-concurrency-guardrail?format=claude","cursorMdc":"/api/rules/axum-tower-workload-shedding-concurrency-guardrail?format=mdc","cursorrules":"/api/rules/axum-tower-workload-shedding-concurrency-guardrail?format=cursor","windsurf":"/api/rules/axum-tower-workload-shedding-concurrency-guardrail?format=windsurf","agents":"/api/rules/axum-tower-workload-shedding-concurrency-guardrail?format=agents"}},{"id":"postgres-17-parallel-logical-replication-conflict-barrier","title":"Postgres 17 Parallel Logical Replication Conflict-Resolution Barrier for Partition Trees","category":"backend","severity":"critical","description":"Enforces deterministic commit-order barriers, row-level vector versioning, and non-blocking conflict resolution for PostgreSQL 17 parallel logical replication workers. Eliminates worker-thread deadlocks and split-brain silent divergence across distributed active-active partition trees. Ensures transactions modify partitioned root keys deterministically with explicit failover and resolution telemetry.","antiPatternHeadline":"Unordered concurrent multi-worker apply mutating distributed partition keys without transactional barriers or commit order synchronization","stars_count":117,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","postgres-17","logical-replication","distributed-systems","partitioning","data-integrity"],"exportEndpoints":{"claude":"/api/rules/postgres-17-parallel-logical-replication-conflict-barrier?format=claude","cursorMdc":"/api/rules/postgres-17-parallel-logical-replication-conflict-barrier?format=mdc","cursorrules":"/api/rules/postgres-17-parallel-logical-replication-conflict-barrier?format=cursor","windsurf":"/api/rules/postgres-17-parallel-logical-replication-conflict-barrier?format=windsurf","agents":"/api/rules/postgres-17-parallel-logical-replication-conflict-barrier?format=agents"}},{"id":"fastapi-taskgroup-structured-concurrency-boundary","title":"FastAPI Async TaskGroup Structured Concurrency & Exception Isolation Boundary","category":"backend","severity":"critical","description":"Enforces strict structured concurrency in FastAPI asynchronous operations using Python 3.11+ asyncio.TaskGroup instead of raw asyncio.create_task or fire-and-forget background execution. Ensures that any unhandled exception immediately cancels sibling child tasks, isolates failures to the request lifecycle boundary, and prevents event loop corruption or orphaned coroutines leaking memory and resources.","antiPatternHeadline":"Unbounded fire-and-forget asyncio.create_task leaking orphaned coroutines and suppressing unhandled ExceptionGroups.","stars_count":53,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","asyncio","python","structured-concurrency","taskgroup"],"exportEndpoints":{"claude":"/api/rules/fastapi-taskgroup-structured-concurrency-boundary?format=claude","cursorMdc":"/api/rules/fastapi-taskgroup-structured-concurrency-boundary?format=mdc","cursorrules":"/api/rules/fastapi-taskgroup-structured-concurrency-boundary?format=cursor","windsurf":"/api/rules/fastapi-taskgroup-structured-concurrency-boundary?format=windsurf","agents":"/api/rules/fastapi-taskgroup-structured-concurrency-boundary?format=agents"}},{"id":"capacitor-7-biometric-enrollment-invalidation","title":"Capacitor 7 Hardware-Backed Biometric Enrollment Invalidation Standard","category":"mobile","severity":"critical","description":"Mandates that native cryptographic credentials and long-lived tokens stored in Capacitor 7 hybrid mobile applications strictly bind to hardware-backed biometric sets (kSecAccessControlBiometryCurrentSet on iOS and setInvalidatedByBiometricEnrollment(true) on Android). Forces immediate, atomic local credential destruction and backend session invalidation whenever a device's biometric enrollment configuration changes.","antiPatternHeadline":"Persisting Refresh Tokens Under Permissive Biometric Policies That Retain Access After New Biometric Enrollments","stars_count":54,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor-7","biometrics","android-keystore","ios-keychain","cryptography","session-security"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-biometric-enrollment-invalidation?format=claude","cursorMdc":"/api/rules/capacitor-7-biometric-enrollment-invalidation?format=mdc","cursorrules":"/api/rules/capacitor-7-biometric-enrollment-invalidation?format=cursor","windsurf":"/api/rules/capacitor-7-biometric-enrollment-invalidation?format=windsurf","agents":"/api/rules/capacitor-7-biometric-enrollment-invalidation?format=agents"}},{"id":"tauri-v2-mobile-zero-copy-binary-ipc-standard","title":"Tauri 2.0 Mobile Zero-Copy Binary IPC & WebAssembly Memory Ingestion","category":"mobile","severity":"critical","description":"Mandates high-throughput Rust-to-Webview IPC using raw binary channels and direct WebAssembly.Memory or TypedArray views in Tauri 2.0. Prevents severe UI-thread hitching and thermal throttling on iOS and Android caused by JSON serialization and base64 string allocations during camera, audio, or telemetry streaming.","antiPatternHeadline":"Encoding High-Frequency Binary Frames as JSON Arrays or Base64 Strings Over Standard Tauri Invoke","stars_count":116,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri","rust","wasm","ipc","performance"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-mobile-zero-copy-binary-ipc-standard?format=claude","cursorMdc":"/api/rules/tauri-v2-mobile-zero-copy-binary-ipc-standard?format=mdc","cursorrules":"/api/rules/tauri-v2-mobile-zero-copy-binary-ipc-standard?format=cursor","windsurf":"/api/rules/tauri-v2-mobile-zero-copy-binary-ipc-standard?format=windsurf","agents":"/api/rules/tauri-v2-mobile-zero-copy-binary-ipc-standard?format=agents"}},{"id":"webauthn-device-bound-enterprise-attestation-sync-segregation","title":"Enforce WebAuthn Device-Bound Enterprise Attestation & Sync Segregation","category":"security","severity":"critical","description":"Enforces strict segregation between multi-device synced passkeys and device-bound hardware credentials for Tier-0 administrative operations. Mandates verification of the WebAuthn authenticatorData backup flags (BE/BS), explicit AAGUID enterprise allowlisting, and cryptographic attestation signature validation to prevent synched credentials from satisfying high-privilege access tiers.","antiPatternHeadline":"Permitting Multi-Device Synced Passkeys to Register or Authorize Tier-0 Privileged Actions Without Attestation Flag Validation","stars_count":89,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","fido2","passkeys","attestation","tier-0","cryptography"],"exportEndpoints":{"claude":"/api/rules/webauthn-device-bound-enterprise-attestation-sync-segregation?format=claude","cursorMdc":"/api/rules/webauthn-device-bound-enterprise-attestation-sync-segregation?format=mdc","cursorrules":"/api/rules/webauthn-device-bound-enterprise-attestation-sync-segregation?format=cursor","windsurf":"/api/rules/webauthn-device-bound-enterprise-attestation-sync-segregation?format=windsurf","agents":"/api/rules/webauthn-device-bound-enterprise-attestation-sync-segregation?format=agents"}},{"id":"sigstore-v3-rekor-inclusion-verification-standard","title":"Sigstore v3 Keyless OIDC Ephemeral Certificate Rekor Inclusion Verification","category":"security","severity":"critical","description":"Production admission controllers and deployment pipelines must verify cryptographically provable transparency log (Rekor) inclusion proofs (SET/inclusion promise and Merkle audit path) for Fulcio-issued ephemeral X.509 certificates. Verification must confirm SAN OIDC claims and certificate validity windows alongside Rekor integrated time rather than relying solely on leaf certificate X.509 signature validity.","antiPatternHeadline":"Accepting Fulcio ephemeral leaf certificates without validating cryptographic Rekor inclusion proofs and SCT timestamps","stars_count":99,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","sigstore","rekor","supply-chain","cosign","oidc","fulcio"],"exportEndpoints":{"claude":"/api/rules/sigstore-v3-rekor-inclusion-verification-standard?format=claude","cursorMdc":"/api/rules/sigstore-v3-rekor-inclusion-verification-standard?format=mdc","cursorrules":"/api/rules/sigstore-v3-rekor-inclusion-verification-standard?format=cursor","windsurf":"/api/rules/sigstore-v3-rekor-inclusion-verification-standard?format=windsurf","agents":"/api/rules/sigstore-v3-rekor-inclusion-verification-standard?format=agents"}},{"id":"ebpf-tc-egress-pacing-bufferbloat-guardrail","title":"eBPF TC Egress Packet-Pacing and Network Bufferbloat Prevention","category":"devops","severity":"critical","description":"Enforces strict kernel-level egress packet pacing (EDT/FQ) and dynamic queue-depth management via eBPF Traffic Control (TC) programs on container virtual ethernet (veth) pairs. Eliminates microburst-induced bufferbloat and noisy-neighbor cross-tenant egress tail latency spikes without relying on coarse host-level HTB or user-space throttling.","antiPatternHeadline":"Unregulated Pod Egress Bursts Inducing Bufferbloat and High p99 Latency via FIFO Queues","stars_count":98,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","tc","networking","kubernetes","bufferbloat","traffic-control"],"exportEndpoints":{"claude":"/api/rules/ebpf-tc-egress-pacing-bufferbloat-guardrail?format=claude","cursorMdc":"/api/rules/ebpf-tc-egress-pacing-bufferbloat-guardrail?format=mdc","cursorrules":"/api/rules/ebpf-tc-egress-pacing-bufferbloat-guardrail?format=cursor","windsurf":"/api/rules/ebpf-tc-egress-pacing-bufferbloat-guardrail?format=windsurf","agents":"/api/rules/ebpf-tc-egress-pacing-bufferbloat-guardrail?format=agents"}},{"id":"postgres17-streaming-io-vector-memory-invariants","title":"Postgres 17 Streaming I/O Engine and Vector Memory Invariants","category":"backend","severity":"critical","description":"Enforces strict memory bounds on Postgres 17 asynchronous streaming I/O prefetch buffers during high-concurrency vector and analytical scans. Prevents backend worker starvation and out-of-memory cascading faults by clamping prefetch depth to deterministic per-backend working memory allocations. Guarantees predictable read-ahead queuing without exhausting shared buffer ring allocations under high-dimensional pgvector index scans.","antiPatternHeadline":"Unbounded AIO Prefetch Queues Starving Worker Pools During Concurrent Vector Scans","stars_count":114,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql-17","pgvector","streaming-io","memory-management","performance"],"exportEndpoints":{"claude":"/api/rules/postgres17-streaming-io-vector-memory-invariants?format=claude","cursorMdc":"/api/rules/postgres17-streaming-io-vector-memory-invariants?format=mdc","cursorrules":"/api/rules/postgres17-streaming-io-vector-memory-invariants?format=cursor","windsurf":"/api/rules/postgres17-streaming-io-vector-memory-invariants?format=windsurf","agents":"/api/rules/postgres17-streaming-io-vector-memory-invariants?format=agents"}},{"id":"react-19-compiler-memoization-boundary-standard","title":"React 19 Compiler Auto-Memoization Escape Hatch Boundary Standard","category":"frontend","severity":"critical","description":"Enforces strict boundary encapsulation when interfacing React 19 Compiler auto-memoized trees with non-idiomatic imperative references or external stores. Prevents silent compiler optimization bailouts, memoization cache thrashing, and cascading de-optimizations across deep component subtrees by isolating mutable state and imperative adapters at designated boundary points.","antiPatternHeadline":"Leaking Mutable External Subscriptions and Render-Time Ref Mutations into Auto-Memoized Component Subtrees","stars_count":71,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","react-compiler","memoization","performance"],"exportEndpoints":{"claude":"/api/rules/react-19-compiler-memoization-boundary-standard?format=claude","cursorMdc":"/api/rules/react-19-compiler-memoization-boundary-standard?format=mdc","cursorrules":"/api/rules/react-19-compiler-memoization-boundary-standard?format=cursor","windsurf":"/api/rules/react-19-compiler-memoization-boundary-standard?format=windsurf","agents":"/api/rules/react-19-compiler-memoization-boundary-standard?format=agents"}},{"id":"tauri2-mobile-ipc-crypto-boundary-standard","title":"Tauri 2.0 Multi-IPC Protocol Isolation and Origin Sandbox Standard","category":"mobile","severity":"critical","description":"Enforces strict origin isolation, explicit capability ACL scoping, and hardware-backed cryptographic boundary validation between embedded mobile webview contexts and native Rust IPC endpoints. Prevents privilege escalation and cross-origin command hijacking in Android and iOS Tauri 2.0 runtimes.","antiPatternHeadline":"Wildcard IPC Capability Scoping and Tokenless Privileged Invocations","stars_count":95,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri-2","security","ipc","rust","sandbox"],"exportEndpoints":{"claude":"/api/rules/tauri2-mobile-ipc-crypto-boundary-standard?format=claude","cursorMdc":"/api/rules/tauri2-mobile-ipc-crypto-boundary-standard?format=mdc","cursorrules":"/api/rules/tauri2-mobile-ipc-crypto-boundary-standard?format=cursor","windsurf":"/api/rules/tauri2-mobile-ipc-crypto-boundary-standard?format=windsurf","agents":"/api/rules/tauri2-mobile-ipc-crypto-boundary-standard?format=agents"}},{"id":"go-chi-zero-alloc-synthetic-arena-context-lease","title":"Go Chi Zero-Allocation Synthetic Arena Context Lease Invariant","category":"backend","severity":"critical","description":"Enforces deterministic recycling and life-cycle binding of synthetic memory arenas within Go Chi HTTP request pipelines. By anchoring arena leases directly to request contexts and strictly recycling underlying byte-slice slabs via sync.Pool, this guardrail guarantees zero-allocation request paths and eradicates garbage collection pause spikes during high-concurrency ingress surges.","antiPatternHeadline":"Escaping Ephemeral Allocations and Unbounded Context Values Triggering Stop-The-World GC Pauses","stars_count":96,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","chi","memory-management","zero-allocation","performance","tail-latency"],"exportEndpoints":{"claude":"/api/rules/go-chi-zero-alloc-synthetic-arena-context-lease?format=claude","cursorMdc":"/api/rules/go-chi-zero-alloc-synthetic-arena-context-lease?format=mdc","cursorrules":"/api/rules/go-chi-zero-alloc-synthetic-arena-context-lease?format=cursor","windsurf":"/api/rules/go-chi-zero-alloc-synthetic-arena-context-lease?format=windsurf","agents":"/api/rules/go-chi-zero-alloc-synthetic-arena-context-lease?format=agents"}},{"id":"webauthn-synced-vs-hardware-attestation-invariant","title":"FIDO2 / WebAuthn Synced Passkey Attestation and Step-Up Invariant","category":"security","severity":"critical","description":"Enforces cryptographic discrimination between multi-device synced credentials (passkeys) and hardware-bound tokens (e.g., YubiKeys) during registration and authentication. Systems must inspect authenticator data flags (BE/BS) and attestation statement formats to enforce hardware-bound credentials for step-up authentication during high-risk transactional workflows.","antiPatternHeadline":"Conflating Synced Passkeys with Dedicated Hardware Keys During High-Risk Step-Up Actions","stars_count":110,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","fido2","passkeys","cryptography","zero-trust"],"exportEndpoints":{"claude":"/api/rules/webauthn-synced-vs-hardware-attestation-invariant?format=claude","cursorMdc":"/api/rules/webauthn-synced-vs-hardware-attestation-invariant?format=mdc","cursorrules":"/api/rules/webauthn-synced-vs-hardware-attestation-invariant?format=cursor","windsurf":"/api/rules/webauthn-synced-vs-hardware-attestation-invariant?format=windsurf","agents":"/api/rules/webauthn-synced-vs-hardware-attestation-invariant?format=agents"}},{"id":"ebpf-unwind-table-kernel-memory-budget-standard","title":"Continuous Profiling eBPF Unwind Table Kernel Memory Budget Standard","category":"devops","severity":"critical","description":"Enforces deterministic kernel memory bounds and eviction protocols on eBPF BPF_MAP_TYPE_STACK_TRACE and custom compact unwind tables (e.g., .eh_frame/DWARF-less frame pointers) utilized by distributed profiling agents. Prevents node kernel memory exhaustion, non-reclaimable slab starvation, and soft-lockup panics in high-churn container environments.","antiPatternHeadline":"Unbounded eBPF map sizing and unconstrained unwind table loading causing kernel OOM and scheduling lockups","stars_count":69,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","opentelemetry","continuous-profiling","kernel","kubernetes"],"exportEndpoints":{"claude":"/api/rules/ebpf-unwind-table-kernel-memory-budget-standard?format=claude","cursorMdc":"/api/rules/ebpf-unwind-table-kernel-memory-budget-standard?format=mdc","cursorrules":"/api/rules/ebpf-unwind-table-kernel-memory-budget-standard?format=cursor","windsurf":"/api/rules/ebpf-unwind-table-kernel-memory-budget-standard?format=windsurf","agents":"/api/rules/ebpf-unwind-table-kernel-memory-budget-standard?format=agents"}},{"id":"kmp-cadisplaylink-native-gc-sync-invariant","title":"Kotlin/Native CADisplayLink Frame Budget GC Synchronization Standard","category":"mobile","severity":"critical","description":"Enforces strict synchronization between Kotlin/Native concurrent garbage collection cycles and Apple iOS CADisplayLink frame deadlines to guarantee deterministic 120Hz (8.33ms) ProMotion rendering. Forbids unthrottled GC triggers and unbudgeted Kotlin allocations within the main render loop, ensuring background marking and sweeping operate only within designated idle slices. Protects cross-platform animation systems from micro-stutter, jank, and priority inversion caused by uncoordinated runtime sweeps.","antiPatternHeadline":"Uncoordinated Kotlin/Native Garbage Collection Triggers Colliding with CoreAnimation Frame Deadlines","stars_count":78,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","ios","cadisplaylink","garbage-collection","promotion-120hz"],"exportEndpoints":{"claude":"/api/rules/kmp-cadisplaylink-native-gc-sync-invariant?format=claude","cursorMdc":"/api/rules/kmp-cadisplaylink-native-gc-sync-invariant?format=mdc","cursorrules":"/api/rules/kmp-cadisplaylink-native-gc-sync-invariant?format=cursor","windsurf":"/api/rules/kmp-cadisplaylink-native-gc-sync-invariant?format=windsurf","agents":"/api/rules/kmp-cadisplaylink-native-gc-sync-invariant?format=agents"}},{"id":"bun-postgres-direct-socket-pipelining-production-standard","title":"Bun 1.2 Native PostgreSQL Direct-Socket Pipelining Standard","category":"backend","severity":"critical","description":"Enforces non-blocking transactional query pipelining over unbuffered native TCP stream abstractions in Bun 1.2. Eliminates connection pool starvation during high-concurrency microservice fan-outs by replacing sequential pool checkouts with native binary-level socket multiplexing.","antiPatternHeadline":"Exhausting Connection Pools via Sequential Client Checkouts in High-Concurrency Fan-Outs","stars_count":117,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","postgres","pipelining","concurrency","socket-io"],"exportEndpoints":{"claude":"/api/rules/bun-postgres-direct-socket-pipelining-production-standard?format=claude","cursorMdc":"/api/rules/bun-postgres-direct-socket-pipelining-production-standard?format=mdc","cursorrules":"/api/rules/bun-postgres-direct-socket-pipelining-production-standard?format=cursor","windsurf":"/api/rules/bun-postgres-direct-socket-pipelining-production-standard?format=windsurf","agents":"/api/rules/bun-postgres-direct-socket-pipelining-production-standard?format=agents"}},{"id":"cilium-sockops-l4-packet-steering-standard","title":"Cilium Socket-Level Sockops Layer-4 Packet Steering Standard","category":"devops","severity":"critical","description":"Enforces deterministic eBPF socket-level steering (sockops) to bypass the Linux network stack, netfilter, and conntrack locks for east-west intra-node container communication. Mandates strict cgroup2 socket-map routing (`BPF_MAP_TYPE_SOCKHASH`) with complete kube-proxy replacement to prevent asymmetric routing and TCP reset loops.","antiPatternHeadline":"Traversing TCP/IP Netfilter and Conntrack for Collocated Container Workloads","stars_count":72,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","cilium","ebpf","sockops","kubernetes","networking","performance"],"exportEndpoints":{"claude":"/api/rules/cilium-sockops-l4-packet-steering-standard?format=claude","cursorMdc":"/api/rules/cilium-sockops-l4-packet-steering-standard?format=mdc","cursorrules":"/api/rules/cilium-sockops-l4-packet-steering-standard?format=cursor","windsurf":"/api/rules/cilium-sockops-l4-packet-steering-standard?format=windsurf","agents":"/api/rules/cilium-sockops-l4-packet-steering-standard?format=agents"}},{"id":"tauri-v2-multi-webview-acl-isolation-standard","title":"Tauri 2.0 Multi-WebView ACL Capability Isolation Standard","category":"security","severity":"critical","description":"Enforces strict zero-trust capability scoping and cryptographic boundary separation across heterogeneous WebViews in Tauri 2.0. Prevents cross-origin privilege escalation and malicious native command access by isolating permissions to discrete window and webview labels.","antiPatternHeadline":"Global Capability Leakage and Unvalidated Multi-WebView Native IPC Invocation","stars_count":91,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","tauri-2","acl","ipc","multi-webview","rust"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-multi-webview-acl-isolation-standard?format=claude","cursorMdc":"/api/rules/tauri-v2-multi-webview-acl-isolation-standard?format=mdc","cursorrules":"/api/rules/tauri-v2-multi-webview-acl-isolation-standard?format=cursor","windsurf":"/api/rules/tauri-v2-multi-webview-acl-isolation-standard?format=windsurf","agents":"/api/rules/tauri-v2-multi-webview-acl-isolation-standard?format=agents"}},{"id":"nextjs15-server-action-cryptographic-origin-binding","title":"Next.js 15 Server Action Cryptographic Host & Action-ID Binding Standard","category":"frontend","severity":"critical","description":"Next.js 15 Server Actions expose implicitly addressable HTTP endpoints identified by dynamic action hashes. In multi-tenant and hardened zero-trust environments, actions must not rely solely on ambient cookie transport; they must cryptographically verify that the incoming Host/Origin, authenticated tenant boundary, and target Action ID match a signed, tamper-proof context token to eliminate blind CSRF, proxy-header spoofing, and cross-tenant replay attacks.","antiPatternHeadline":"Ambient Multi-Tenant State Mutation via Unbound Server Actions Without Origin-Tenant-Action Cryptographic Attestation","stars_count":53,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs15","server-actions","csrf","multi-tenant","cryptography","security"],"exportEndpoints":{"claude":"/api/rules/nextjs15-server-action-cryptographic-origin-binding?format=claude","cursorMdc":"/api/rules/nextjs15-server-action-cryptographic-origin-binding?format=mdc","cursorrules":"/api/rules/nextjs15-server-action-cryptographic-origin-binding?format=cursor","windsurf":"/api/rules/nextjs15-server-action-cryptographic-origin-binding?format=windsurf","agents":"/api/rules/nextjs15-server-action-cryptographic-origin-binding?format=agents"}},{"id":"kmp-skiko-gpu-surface-lifecycle-invariants","title":"Kotlin Multiplatform Skiko GPU Surface Pooling and Lifecycle Invariant","category":"mobile","severity":"critical","description":"Enforces strict native GPU surface recycling and deterministic rasterization teardown for Kotlin Multiplatform Skiko runtimes across Android (Vulkan/GLES) and iOS (Metal). Eliminates severe GPU VRAM memory leaks, native driver crashes (e.g., VK_ERROR_DEVICE_LOST, Metal command buffer invalidations), and frame-pacing degradation caused by unmanaged surface reallocation across lifecycle transitions.","antiPatternHeadline":"Orphaned Native Metal/Vulkan Render Targets and Leaked Skia GrDirectContext Instances Across Lifecycle Transitions","stars_count":90,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","skiko","skia","metal","vulkan","gpu-memory"],"exportEndpoints":{"claude":"/api/rules/kmp-skiko-gpu-surface-lifecycle-invariants?format=claude","cursorMdc":"/api/rules/kmp-skiko-gpu-surface-lifecycle-invariants?format=mdc","cursorrules":"/api/rules/kmp-skiko-gpu-surface-lifecycle-invariants?format=cursor","windsurf":"/api/rules/kmp-skiko-gpu-surface-lifecycle-invariants?format=windsurf","agents":"/api/rules/kmp-skiko-gpu-surface-lifecycle-invariants?format=agents"}},{"id":"opentelemetry-inflight-pii-redaction-baggage-guardrail","title":"OpenTelemetry In-Flight PII Redaction & Baggage Propagation Standard","category":"devops","severity":"critical","description":"Enforces deterministic, in-memory PII and credential redaction directly inside the OpenTelemetry SDK SpanProcessor pipeline before batch queuing and network egress. Eliminates reliance on collector-side scrubbers to prevent cross-border compliance violations (PCI-DSS, HIPAA, GDPR) and stops unvalidated W3C Baggage propagation across downstream distributed services.","antiPatternHeadline":"Attaching Unfiltered Payloads and Propagating Tainted Context via OTLP Exporters","stars_count":112,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","tracing","pii-redaction","observability","security"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-inflight-pii-redaction-baggage-guardrail?format=claude","cursorMdc":"/api/rules/opentelemetry-inflight-pii-redaction-baggage-guardrail?format=mdc","cursorrules":"/api/rules/opentelemetry-inflight-pii-redaction-baggage-guardrail?format=cursor","windsurf":"/api/rules/opentelemetry-inflight-pii-redaction-baggage-guardrail?format=windsurf","agents":"/api/rules/opentelemetry-inflight-pii-redaction-baggage-guardrail?format=agents"}},{"id":"webauthn-conditional-mediation-passkey-signal-revocation-invariant","title":"WebAuthn Conditional Mediation & Passkey Signal API Revocation Guardrail","category":"security","severity":"critical","description":"Enforces strict synchronization between WebAuthn Conditional Mediation (autofill) UI lifecycles and the Passkey Signal API (PublicKeyCredential.signal*). Mandates that client autofill abort controllers are deterministically aborted and re-instantiated upon credential invalidation or hardware revocation events, preventing compromised credentials from persisting in active browser autofill caches.","antiPatternHeadline":"Stale Conditional Mediation Requests Exposing Revoked Passkeys in Client Autofill Prompts","stars_count":57,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","fido2","passkeys","signal-api","conditional-mediation","authentication"],"exportEndpoints":{"claude":"/api/rules/webauthn-conditional-mediation-passkey-signal-revocation-invariant?format=claude","cursorMdc":"/api/rules/webauthn-conditional-mediation-passkey-signal-revocation-invariant?format=mdc","cursorrules":"/api/rules/webauthn-conditional-mediation-passkey-signal-revocation-invariant?format=cursor","windsurf":"/api/rules/webauthn-conditional-mediation-passkey-signal-revocation-invariant?format=windsurf","agents":"/api/rules/webauthn-conditional-mediation-passkey-signal-revocation-invariant?format=agents"}},{"id":"bun-posix-spawn-cgroup-sandboxing-standard","title":"Bun 1.2 Subprocess POSIX Spawn & Cgroup Sandboxing Isolation Standard","category":"backend","severity":"critical","description":"Enforces strict process isolation for child processes executed via Bun 1.2 by prohibiting raw shell interpolation, preventing process descriptor leakage, and enforcing structured command arrays. Mandates explicit environment variable sanitization, unprivileged user execution, and cgroup v2/namespace resource boundaries to prevent command injection and host resource exhaustion.","antiPatternHeadline":"Arbitrary Shell Interpolation and Ambient Process State Inheritance via Bun.spawn/Bun.$","stars_count":63,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","security","sandboxing","posix-spawn","cgroups","subprocesses"],"exportEndpoints":{"claude":"/api/rules/bun-posix-spawn-cgroup-sandboxing-standard?format=claude","cursorMdc":"/api/rules/bun-posix-spawn-cgroup-sandboxing-standard?format=mdc","cursorrules":"/api/rules/bun-posix-spawn-cgroup-sandboxing-standard?format=cursor","windsurf":"/api/rules/bun-posix-spawn-cgroup-sandboxing-standard?format=windsurf","agents":"/api/rules/bun-posix-spawn-cgroup-sandboxing-standard?format=agents"}},{"id":"k8s-gateway-api-tls-session-ticket-rotation-guardrail","title":"Kubernetes Gateway API v1.2 Distributed TLS Session Ticket Key Rotation Guardrail","category":"devops","severity":"critical","description":"Enforces cryptographically sound, synchronized TLS Session Ticket Encryption Key (STEK) rotation across multi-cluster Kubernetes Gateway API v1.2 ingress topologies. Mitigates passive TLS session decryption and forward secrecy degradation caused by static or out-of-sync session keys across heterogeneous edge nodes. Ensures 0-RTT/1-RTT resumption performance parity without violating ephemeral forward secrecy guarantees.","antiPatternHeadline":"Static or cluster-isolated TLS session ticket encryption keys leading to cross-region resumption failures and catastrophic loss of forward secrecy.","stars_count":117,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","kubernetes","gateway-api","tls","security","zero-trust","session-resumption"],"exportEndpoints":{"claude":"/api/rules/k8s-gateway-api-tls-session-ticket-rotation-guardrail?format=claude","cursorMdc":"/api/rules/k8s-gateway-api-tls-session-ticket-rotation-guardrail?format=mdc","cursorrules":"/api/rules/k8s-gateway-api-tls-session-ticket-rotation-guardrail?format=cursor","windsurf":"/api/rules/k8s-gateway-api-tls-session-ticket-rotation-guardrail?format=windsurf","agents":"/api/rules/k8s-gateway-api-tls-session-ticket-rotation-guardrail?format=agents"}},{"id":"rust-axum-quic-migration-reauth-standard","title":"Rust Axum HTTP/3 QUIC Connection Migration Re-Authentication Invariant","category":"backend","severity":"critical","description":"Enforces strict application-level cryptographic re-authentication when QUIC connection migration modifies the client socket address during active HTTP/3 sessions. Mandates that Axum streaming pipelines immediately quarantine and gate inflight byte streams until a cryptographically bound migration token (HMAC/AEAD over the new SocketAddr and monotonic session nonce) is validated, preventing Connection-ID hijacking and off-path stream injection attacks.","antiPatternHeadline":"Unvalidated Inflight Stream Consumption Following QUIC Path Migration","stars_count":41,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","quic","http3","security","session-management"],"exportEndpoints":{"claude":"/api/rules/rust-axum-quic-migration-reauth-standard?format=claude","cursorMdc":"/api/rules/rust-axum-quic-migration-reauth-standard?format=mdc","cursorrules":"/api/rules/rust-axum-quic-migration-reauth-standard?format=cursor","windsurf":"/api/rules/rust-axum-quic-migration-reauth-standard?format=windsurf","agents":"/api/rules/rust-axum-quic-migration-reauth-standard?format=agents"}},{"id":"react-19-use-action-state-serialization","title":"React 19 useActionState Concurrent Transition Serialization and Micro-Task Reconciliation","category":"frontend","severity":"critical","description":"Enforces strict monotonic sequencing and payload reconciliation for React 19 useActionState transitions across asynchronous micro-task boundaries. Prevents zombie state divergence, torn renders, and stale closure overwrite during high-concurrency client mutations by mandating monotonic flight identifiers and atomic transition wrappers.","antiPatternHeadline":"Unsequenced Async Mutation Dispatch Creating Out-of-Order Reconciliations and Zombie State Torn Renders","stars_count":63,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","useActionState","concurrency","state-management","transitions"],"exportEndpoints":{"claude":"/api/rules/react-19-use-action-state-serialization?format=claude","cursorMdc":"/api/rules/react-19-use-action-state-serialization?format=mdc","cursorrules":"/api/rules/react-19-use-action-state-serialization?format=cursor","windsurf":"/api/rules/react-19-use-action-state-serialization?format=windsurf","agents":"/api/rules/react-19-use-action-state-serialization?format=agents"}},{"id":"openfga-cyclic-expansion-fencing-guardrail","title":"OpenFGA Distributed Graph Cyclic Expansion Fencing and Traversal Bounding","category":"security","severity":"critical","description":"Deeply nested multi-tenant Relationship-Based Access Control (ReBAC) models risk unbounded recursive graph expansions and cyclic traversals during authorization evaluations. This rule enforces strict traversal depth ceilings, deterministic cycle fencers, propagation deadlines, and edge-budgeting to prevent thread starvation, high-cardinality latency amplification, and authorization DoS vectors.","antiPatternHeadline":"Unbounded Recursive Traversal and Unfenced Graph Expansion in ReBAC Authorizers","stars_count":90,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","rebac","authorization","graph-traversal","dos-mitigation","circuit-breaker"],"exportEndpoints":{"claude":"/api/rules/openfga-cyclic-expansion-fencing-guardrail?format=claude","cursorMdc":"/api/rules/openfga-cyclic-expansion-fencing-guardrail?format=mdc","cursorrules":"/api/rules/openfga-cyclic-expansion-fencing-guardrail?format=cursor","windsurf":"/api/rules/openfga-cyclic-expansion-fencing-guardrail?format=windsurf","agents":"/api/rules/openfga-cyclic-expansion-fencing-guardrail?format=agents"}},{"id":"bun-native-websocket-backpressure-drain-invariant","title":"Bun 1.2 Native Socket Zero-Copy ArrayBuffer Drain & Backpressure Invariant","category":"backend","severity":"critical","description":"Enforces strict backpressure synchronization and bounded buffer thresholds on native Bun 1.2 WebSocket broadcast loops. Prevents catastrophic off-heap C++ buffer allocation and process-level RSS memory exhaustion caused by slow socket consumers during high-volume binary streaming.","antiPatternHeadline":"Unchecked Fire-and-Forget ws.send() Calls Triggering Unbounded Off-Heap C++ Queue Bloat","stars_count":78,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","websockets","backpressure","memory-leak","zero-copy","performance"],"exportEndpoints":{"claude":"/api/rules/bun-native-websocket-backpressure-drain-invariant?format=claude","cursorMdc":"/api/rules/bun-native-websocket-backpressure-drain-invariant?format=mdc","cursorrules":"/api/rules/bun-native-websocket-backpressure-drain-invariant?format=cursor","windsurf":"/api/rules/bun-native-websocket-backpressure-drain-invariant?format=windsurf","agents":"/api/rules/bun-native-websocket-backpressure-drain-invariant?format=agents"}},{"id":"vite6-environment-api-multi-runtime-isolation-vite-6-environme-636","title":"Vite 6 Environment API Multi-Runtime Boundary Isolation Standard","category":"frontend","severity":"critical","description":"Enforces strict compile-time module graph and symbol isolation across distinct runtime targets (client, edge/workerd, and Node SSR) using the Vite 6 Environment API. Prevents fatal runtime crashes and catastrophic security disclosures caused by native Node.js built-ins, private server credentials, or unpolyfilled symbols leaking into browser or edge worker distribution bundles.","antiPatternHeadline":"Shared SSR Module Graph Leaking Node Built-ins and Secrets into Edge and Client Bundles","stars_count":114,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","vite6","environment-api","multi-runtime","edge-computing","bundle-isolation"],"exportEndpoints":{"claude":"/api/rules/vite6-environment-api-multi-runtime-isolation-vite-6-environme-636?format=claude","cursorMdc":"/api/rules/vite6-environment-api-multi-runtime-isolation-vite-6-environme-636?format=mdc","cursorrules":"/api/rules/vite6-environment-api-multi-runtime-isolation-vite-6-environme-636?format=cursor","windsurf":"/api/rules/vite6-environment-api-multi-runtime-isolation-vite-6-environme-636?format=windsurf","agents":"/api/rules/vite6-environment-api-multi-runtime-isolation-vite-6-environme-636?format=agents"}},{"id":"postgres-17-vectorized-streaming-read-prefetch-invariant","title":"Postgres 17 Vectorized Streaming Read Prefetch Queue Depth Invariant","category":"backend","severity":"critical","description":"Enforces strict upper bounds on asynchronous streaming read queue depth and effective I/O concurrency in Postgres 17 workloads. Prevents lock convoys on buffer mapping partitions and avoids kernel page cache thrashing by calibrating prefetch horizons below OS block-device readahead boundaries.","antiPatternHeadline":"Unbounded Streaming Read Queue Depths Inducing Buffer Partition Lock Convoys and OS Readahead Cache Thrashing","stars_count":68,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["postgres","postgresql-17","streaming-io","linux-kernel","io-concurrency","backend-performance"],"exportEndpoints":{"claude":"/api/rules/postgres-17-vectorized-streaming-read-prefetch-invariant?format=claude","cursorMdc":"/api/rules/postgres-17-vectorized-streaming-read-prefetch-invariant?format=mdc","cursorrules":"/api/rules/postgres-17-vectorized-streaming-read-prefetch-invariant?format=cursor","windsurf":"/api/rules/postgres-17-vectorized-streaming-read-prefetch-invariant?format=windsurf","agents":"/api/rules/postgres-17-vectorized-streaming-read-prefetch-invariant?format=agents"}},{"id":"tauri2-mobile-ipc-binary-backpressure-standard","title":"Tauri 2.0 Mobile IPC Binary Channel Streaming Backpressure Standard","category":"mobile","severity":"critical","description":"Enforces credit-based or acknowledgement-driven windowing on native-to-webview binary streaming channels in Tauri 2.0. Prevents Android Choreographer skipped frames and iOS CADisplayLink hitches caused by unbounded IPC message queues saturating the mobile WebView main execution thread.","antiPatternHeadline":"Unbounded native-to-webview binary streaming via unthrottled Tauri 2.0 Channels starving mobile main thread frame loops","stars_count":75,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri-2","ipc","backpressure","choreographer","binary-channel","android","ios"],"exportEndpoints":{"claude":"/api/rules/tauri2-mobile-ipc-binary-backpressure-standard?format=claude","cursorMdc":"/api/rules/tauri2-mobile-ipc-binary-backpressure-standard?format=mdc","cursorrules":"/api/rules/tauri2-mobile-ipc-binary-backpressure-standard?format=cursor","windsurf":"/api/rules/tauri2-mobile-ipc-binary-backpressure-standard?format=windsurf","agents":"/api/rules/tauri2-mobile-ipc-binary-backpressure-standard?format=agents"}},{"id":"post-quantum-mlkem768-hybrid-tls-guardrail","title":"Post-Quantum ML-KEM-768 Hybrid TLS 1.3 Key Encapsulation and MTU Guardrail","category":"security","severity":"critical","description":"Mandates the deployment of post-quantum hybrid key encapsulation (X25519MLKEM768) for TLS 1.3 across all internal and ingress service mesh communication to defeat Harvest-Now-Decrypt-Later (HNDL) adversaries. Enforces deterministic Path MTU (PMTU) discovery, TCP MSS clamping, and TLS record fragmentation controls to prevent silent middlebox packet drops caused by enlarged post-quantum key exchange payloads.","antiPatternHeadline":"Classical-Only ECDH Deployment with Unconstrained Handshake MTU Causing HNDL Vulnerability and Packet Blackholing","stars_count":67,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","post-quantum","ml-kem","tls-1.3","zero-trust","service-mesh","network-resilience"],"exportEndpoints":{"claude":"/api/rules/post-quantum-mlkem768-hybrid-tls-guardrail?format=claude","cursorMdc":"/api/rules/post-quantum-mlkem768-hybrid-tls-guardrail?format=mdc","cursorrules":"/api/rules/post-quantum-mlkem768-hybrid-tls-guardrail?format=cursor","windsurf":"/api/rules/post-quantum-mlkem768-hybrid-tls-guardrail?format=windsurf","agents":"/api/rules/post-quantum-mlkem768-hybrid-tls-guardrail?format=agents"}},{"id":"kubernetes-inplace-vpa-resizing-hysteresis-standard","title":"Kubernetes In-Place VPA Resizing Hysteresis and Cgroup Freeze Guardrail","category":"devops","severity":"critical","description":"Defines mandatory hysteresis, resource clamping, and resizePolicy configurations for Kubernetes In-Place Pod Vertical Scaling (KEP-1287). Eliminates cgroup freeze thrashing, runtime lockups, and instantaneous container OOM cascades during bursty compute workloads without triggering pod evictions.","antiPatternHeadline":"Unbounded VPA Resizing Inducing Cgroup Freezes and Flapping-Induced OOM Loops","stars_count":50,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","kubernetes","vpa","cgroups-v2","autoscaling","kernel-tuning"],"exportEndpoints":{"claude":"/api/rules/kubernetes-inplace-vpa-resizing-hysteresis-standard?format=claude","cursorMdc":"/api/rules/kubernetes-inplace-vpa-resizing-hysteresis-standard?format=mdc","cursorrules":"/api/rules/kubernetes-inplace-vpa-resizing-hysteresis-standard?format=cursor","windsurf":"/api/rules/kubernetes-inplace-vpa-resizing-hysteresis-standard?format=windsurf","agents":"/api/rules/kubernetes-inplace-vpa-resizing-hysteresis-standard?format=agents"}},{"id":"go-chi-context-deadline-transport-poison-fence","title":"Chi 5.x Context Deadline Propagation & Outbound Transport Poison Fencing","category":"backend","severity":"critical","description":"Enforces strict inbound-to-outbound context deadline propagation in Go Chi 5.x handlers paired with deterministic HTTP transport connection fencing. Prevents poisoned or desynchronized TCP sockets from being recycled into the runtime epoll idle pool when client contexts abort mid-flight.","antiPatternHeadline":"Unconditional Body Draining and Default Transport Reuse on Cancelled Inbound Contexts","stars_count":77,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","chi","networking","http-client","concurrency"],"exportEndpoints":{"claude":"/api/rules/go-chi-context-deadline-transport-poison-fence?format=claude","cursorMdc":"/api/rules/go-chi-context-deadline-transport-poison-fence?format=mdc","cursorrules":"/api/rules/go-chi-context-deadline-transport-poison-fence?format=cursor","windsurf":"/api/rules/go-chi-context-deadline-transport-poison-fence?format=windsurf","agents":"/api/rules/go-chi-context-deadline-transport-poison-fence?format=agents"}},{"id":"svelte-5-snippet-signal-closure-detached-dom-quarantine","title":"Svelte 5 Snippet Signal Closure Detached DOM Quarantine Standard","category":"frontend","severity":"critical","description":"Enforces strict boundary isolation and subscriber teardown for Svelte 5 snippets capturing reactive runes. Prevents invisible single-page application heap memory leaks caused by fine-grained signal dependency graphs pinning unmounted or detached DOM tree fragments in closure memory.","antiPatternHeadline":"Persisting Snippet Functions or Signal Closures Outside Active Ownership Lifecycles Leading to Detached DOM Tree Retention","stars_count":75,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","signals","memory-leaks","detached-dom"],"exportEndpoints":{"claude":"/api/rules/svelte-5-snippet-signal-closure-detached-dom-quarantine?format=claude","cursorMdc":"/api/rules/svelte-5-snippet-signal-closure-detached-dom-quarantine?format=mdc","cursorrules":"/api/rules/svelte-5-snippet-signal-closure-detached-dom-quarantine?format=cursor","windsurf":"/api/rules/svelte-5-snippet-signal-closure-detached-dom-quarantine?format=windsurf","agents":"/api/rules/svelte-5-snippet-signal-closure-detached-dom-quarantine?format=agents"}},{"id":"svelte-5-runes-async-effect-boundary-guardrail","title":"Svelte 5 Runes Asynchronous Effect Boundary & Micro-task Isolation Standard","category":"frontend","severity":"critical","description":"Enforces strict synchronous dependency boundaries and deterministic lifecycle cancellations inside Svelte 5 $effect runes. Prevents silent dependency drop-offs across micro-task queues, state corruption from out-of-order promise resolutions, and memory leaks across dynamic island unmounts.","antiPatternHeadline":"Mutating state or consuming signals past asynchronous ticks without explicit untrack boundaries and cancellation teardowns in Svelte 5 runes.","stars_count":59,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","reactivity","async-effects","performance"],"exportEndpoints":{"claude":"/api/rules/svelte-5-runes-async-effect-boundary-guardrail?format=claude","cursorMdc":"/api/rules/svelte-5-runes-async-effect-boundary-guardrail?format=mdc","cursorrules":"/api/rules/svelte-5-runes-async-effect-boundary-guardrail?format=cursor","windsurf":"/api/rules/svelte-5-runes-async-effect-boundary-guardrail?format=windsurf","agents":"/api/rules/svelte-5-runes-async-effect-boundary-guardrail?format=agents"}},{"id":"openfga-contextual-tuple-depth-guardrail","title":"OpenFGA Contextual Tuple Graph Traversal Depth and Cycle Guardrail","category":"security","severity":"critical","description":"Enforces pre-flight cycle detection, strict cardinality caps, and traversal depth limits on contextual tuples injected during runtime OpenFGA relationship-based access control (ReBAC) evaluations. Prevents Denial of Service (DoS) and algorithmic complexity exhaustion caused by deeply nested or cyclical graph expansions in check and list-objects queries. Mandates client-side structural validation before passing dynamic authorization contexts to the OpenFGA storage engine.","antiPatternHeadline":"Unbounded Contextual Tuple Injection Causing ReBAC Graph Recursion Exhaustion","stars_count":55,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","rebac","openfga","authorization","graph-dos"],"exportEndpoints":{"claude":"/api/rules/openfga-contextual-tuple-depth-guardrail?format=claude","cursorMdc":"/api/rules/openfga-contextual-tuple-depth-guardrail?format=mdc","cursorrules":"/api/rules/openfga-contextual-tuple-depth-guardrail?format=cursor","windsurf":"/api/rules/openfga-contextual-tuple-depth-guardrail?format=windsurf","agents":"/api/rules/openfga-contextual-tuple-depth-guardrail?format=agents"}},{"id":"swift-6-strict-concurrency-kmp-cinterop-isolation","title":"Swift 6 Strict Concurrency and Kotlin Native Interop Boundary Invariant","category":"mobile","severity":"critical","description":"Enforces strict compile-time actor isolation and Sendable boundary serialization between Swift 6 concurrency domains and Kotlin Multiplatform (KMP) C/Obj-C interop runtimes. Bridged Kotlin classes are inherently non-Sendable reference types managed by Kotlin/Native's garbage collector, making cross-actor propagation without explicit boundary adaptation a catalyst for runtime reference-counter corruption and Swift 6 compiler rejection.","antiPatternHeadline":"Passing Unchecked Non-Sendable KMP Object References Across Swift Actor Boundaries","stars_count":53,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","swift6","kmp","kotlin-native","concurrency","actors","c-interop"],"exportEndpoints":{"claude":"/api/rules/swift-6-strict-concurrency-kmp-cinterop-isolation?format=claude","cursorMdc":"/api/rules/swift-6-strict-concurrency-kmp-cinterop-isolation?format=mdc","cursorrules":"/api/rules/swift-6-strict-concurrency-kmp-cinterop-isolation?format=cursor","windsurf":"/api/rules/swift-6-strict-concurrency-kmp-cinterop-isolation?format=windsurf","agents":"/api/rules/swift-6-strict-concurrency-kmp-cinterop-isolation?format=agents"}},{"id":"dpop-rfc9449-hardware-enclave-nonce-sync","title":"OAuth 2.0 DPoP (RFC 9449) Hardware Enclave Assertion & Distributed Nonce Sync Standard","category":"security","severity":"critical","description":"Mandates RFC 9449 Demonstrating Proof-of-Possession (DPoP) bound to non-exportable hardware-enclave keys across distributed edge architectures. Enforces server-side stateless cryptographic nonce generation, distributed replay prevention, strict HTTP method/URI verification, and access token hash (ath) validation. Eliminates token interception vulnerabilities, cross-region replay attacks, and asymmetric key extraction risks.","antiPatternHeadline":"Accepting Bearer tokens without cryptographic key-binding or validating DPoP proofs using single-node in-memory nonces vulnerable to edge desynchronization and replay.","stars_count":115,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","oauth2","dpop","rfc9449","cryptography","zero-trust","edge-computing"],"exportEndpoints":{"claude":"/api/rules/dpop-rfc9449-hardware-enclave-nonce-sync?format=claude","cursorMdc":"/api/rules/dpop-rfc9449-hardware-enclave-nonce-sync?format=mdc","cursorrules":"/api/rules/dpop-rfc9449-hardware-enclave-nonce-sync?format=cursor","windsurf":"/api/rules/dpop-rfc9449-hardware-enclave-nonce-sync?format=windsurf","agents":"/api/rules/dpop-rfc9449-hardware-enclave-nonce-sync?format=agents"}},{"id":"pg17-logical-replication-failover-slot-boundary","title":"PostgreSQL 17 Logical Replication Failover Slot Synchronization Boundary","category":"backend","severity":"critical","description":"Guarantees zero data loss, continuous CDC consumption, and subscriber continuity across physical high-availability failovers in PostgreSQL 17. Mandates the use of failover-enabled logical replication slots (`failover = true`) coupled with physical standby synchronization (`synchronized_standby_slots`) and pre-promotion slot parity validation. Prevents silent message loss, slot invalidation, and catastrophic subscriber re-initialization when a standby is promoted to primary.","antiPatternHeadline":"Promoting a physical replica without verifying logical replication slot sync or omitting failover attributes in PG17","stars_count":51,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql-17","logical-replication","high-availability","patroni","cdc"],"exportEndpoints":{"claude":"/api/rules/pg17-logical-replication-failover-slot-boundary?format=claude","cursorMdc":"/api/rules/pg17-logical-replication-failover-slot-boundary?format=mdc","cursorrules":"/api/rules/pg17-logical-replication-failover-slot-boundary?format=cursor","windsurf":"/api/rules/pg17-logical-replication-failover-slot-boundary?format=windsurf","agents":"/api/rules/pg17-logical-replication-failover-slot-boundary?format=agents"}},{"id":"capacitor-7-native-ipc-bridge-serialization-boundary","title":"Capacitor 7 Native IPC Bridge Structured Serialization Boundary","category":"mobile","severity":"critical","description":"Enforces strict runtime schema validation and structured byte buffer handling across the Capacitor 7 WebView-to-native IPC bridge. Eliminates cross-origin bridge exploitation, bridge injection vectors, and prototype pollution by enforcing zero-copy binary streaming and strict origin and payload validation at the native dispatcher boundary.","antiPatternHeadline":"Unvalidated JSON Serialization and Arbitrary Object Dispatch Across WebView Native Bridge","stars_count":80,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor-7","ipc-bridge","security","serialization","typescript"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-native-ipc-bridge-serialization-boundary?format=claude","cursorMdc":"/api/rules/capacitor-7-native-ipc-bridge-serialization-boundary?format=mdc","cursorrules":"/api/rules/capacitor-7-native-ipc-bridge-serialization-boundary?format=cursor","windsurf":"/api/rules/capacitor-7-native-ipc-bridge-serialization-boundary?format=windsurf","agents":"/api/rules/capacitor-7-native-ipc-bridge-serialization-boundary?format=agents"}},{"id":"k8s-gateway-api-v1-2-referencegrant-isolation","title":"Gateway API v1.2 Strict Cross-Namespace ReferenceGrant Isolation Standard","category":"devops","severity":"critical","description":"Enforces deterministic declarative authorization for cross-namespace routing and TLS certificate resolution under Kubernetes Gateway API v1.2. Prohibits implicit or wildcard cross-namespace object references, requiring explicit target-namespace ReferenceGrant manifests to eliminate lateral privilege escalation vectors in multi-tenant clusters.","antiPatternHeadline":"Wildcard or Unauthenticated Cross-Namespace Backend and Secret References via Gateway API Listeners and Routes","stars_count":104,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","kubernetes","gateway-api","security","multi-tenancy","zero-trust"],"exportEndpoints":{"claude":"/api/rules/k8s-gateway-api-v1-2-referencegrant-isolation?format=claude","cursorMdc":"/api/rules/k8s-gateway-api-v1-2-referencegrant-isolation?format=mdc","cursorrules":"/api/rules/k8s-gateway-api-v1-2-referencegrant-isolation?format=cursor","windsurf":"/api/rules/k8s-gateway-api-v1-2-referencegrant-isolation?format=windsurf","agents":"/api/rules/k8s-gateway-api-v1-2-referencegrant-isolation?format=agents"}},{"id":"fastapi-anyio-taskgroup-cancellation-invariant","title":"FastAPI AnyIO Structured TaskGroup Cooperative Cancellation Invariant","category":"backend","severity":"critical","description":"Enforces strict structured concurrency task tree scoping across all FastAPI routes and dependencies using AnyIO TaskGroups. Eliminates orphaned background coroutine leaks by ensuring task cancellation cascades cooperatively when an HTTP client disconnects or an upstream timeout triggers.","antiPatternHeadline":"Spawning Unbound Coroutines via asyncio.create_task Leading to Zombie Process Leaks on Client Disconnect","stars_count":117,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","anyio","structured-concurrency","python","asyncio"],"exportEndpoints":{"claude":"/api/rules/fastapi-anyio-taskgroup-cancellation-invariant?format=claude","cursorMdc":"/api/rules/fastapi-anyio-taskgroup-cancellation-invariant?format=mdc","cursorrules":"/api/rules/fastapi-anyio-taskgroup-cancellation-invariant?format=cursor","windsurf":"/api/rules/fastapi-anyio-taskgroup-cancellation-invariant?format=windsurf","agents":"/api/rules/fastapi-anyio-taskgroup-cancellation-invariant?format=agents"}},{"id":"wasi-02-canonical-abi-memory-sandboxing-guardrail","title":"WASI 0.2 Component Model Canonical ABI Isolation & Memory Sandboxing","category":"devops","severity":"critical","description":"Enforces strict linear memory isolation and Canonical ABI marshalling for untrusted multi-tenant WebAssembly guest components under WASI 0.2. Guarantees that guest instances cannot alias host memory, bypass Canonical ABI lift/lower validation, or exceed hard memory limits by mandating per-tenant Store isolation, strict WIT contract compilation, and deterministic resource limiting.","antiPatternHeadline":"Raw Pointer Marshalling and Shared Store Re-use in Multi-Tenant WebAssembly Execution","stars_count":64,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","wasm","wasi","sandboxing","component-model","security"],"exportEndpoints":{"claude":"/api/rules/wasi-02-canonical-abi-memory-sandboxing-guardrail?format=claude","cursorMdc":"/api/rules/wasi-02-canonical-abi-memory-sandboxing-guardrail?format=mdc","cursorrules":"/api/rules/wasi-02-canonical-abi-memory-sandboxing-guardrail?format=cursor","windsurf":"/api/rules/wasi-02-canonical-abi-memory-sandboxing-guardrail?format=windsurf","agents":"/api/rules/wasi-02-canonical-abi-memory-sandboxing-guardrail?format=agents"}},{"id":"bun-websocket-backpressure-ring-buffer-guardrail","title":"Bun 1.2 Native WebSocket Backpressure Ring-Buffer Guardrail","category":"backend","severity":"critical","description":"Enforces bounded memory allocations and native TCP backpressure handling in high-throughput Bun WebSocket streaming services. Mandates coupling Bun's native `ws.cork()`, `ws.send()`, and `ws.drain()` lifecycle hooks with pre-allocated circular ring-buffers to prevent catastrophic V8/JSC heap exhaustion caused by slow-consumer egress bloat.","antiPatternHeadline":"Unchecked Fire-and-Forget ws.send() Overrunning Native Kernel Buffers and V8 Heap","stars_count":113,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","websockets","backpressure","performance","memory-management"],"exportEndpoints":{"claude":"/api/rules/bun-websocket-backpressure-ring-buffer-guardrail?format=claude","cursorMdc":"/api/rules/bun-websocket-backpressure-ring-buffer-guardrail?format=mdc","cursorrules":"/api/rules/bun-websocket-backpressure-ring-buffer-guardrail?format=cursor","windsurf":"/api/rules/bun-websocket-backpressure-ring-buffer-guardrail?format=windsurf","agents":"/api/rules/bun-websocket-backpressure-ring-buffer-guardrail?format=agents"}},{"id":"nextjs-15-ppr-fallback-boundary-invariant","title":"Next.js 15 Partial Prerendering (PPR) Fallback Boundary Invariant","category":"frontend","severity":"critical","description":"Enforces strict isolation of dynamic Server Components inside explicit React Suspense boundaries when Partial Prerendering (PPR) is enabled. Calling runtime dynamic APIs (cookies, headers, searchParams, un-cached data queries) outside a Suspense boundary de-optimizes the entire prerendered shell into blocking dynamic SSR, introducing waterfall cascades and hydration mismatches.","antiPatternHeadline":"Leaking Dynamic Request Contexts into Prerendered Shell Layouts Without Suspense Isolation","stars_count":52,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs","react-19","ppr","suspense","streaming","performance"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-ppr-fallback-boundary-invariant?format=claude","cursorMdc":"/api/rules/nextjs-15-ppr-fallback-boundary-invariant?format=mdc","cursorrules":"/api/rules/nextjs-15-ppr-fallback-boundary-invariant?format=cursor","windsurf":"/api/rules/nextjs-15-ppr-fallback-boundary-invariant?format=windsurf","agents":"/api/rules/nextjs-15-ppr-fallback-boundary-invariant?format=agents"}},{"id":"react19-compiler-deterministic-memoization-closure-invariant","title":"React 19 Compiler Deterministic Memoization Closure Invariant Guardrail","category":"frontend","severity":"critical","description":"Guarantees React 19 compiler auto-memoization stability by prohibiting non-serializable closure mutations, post-render object leakage, and impure closure escapes. Violating these invariants forces the compiler to invalidate reactive dependency memoization slots, triggering cascading subtree de-optimizations and uncontrolled re-renders.","antiPatternHeadline":"Mutating Closed-Over Scope Objects and Shared Render Targets Causing React Compiler Memoization Bailout","stars_count":75,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react19","react-compiler","memoization","closure-invariants","typescript"],"exportEndpoints":{"claude":"/api/rules/react19-compiler-deterministic-memoization-closure-invariant?format=claude","cursorMdc":"/api/rules/react19-compiler-deterministic-memoization-closure-invariant?format=mdc","cursorrules":"/api/rules/react19-compiler-deterministic-memoization-closure-invariant?format=cursor","windsurf":"/api/rules/react19-compiler-deterministic-memoization-closure-invariant?format=windsurf","agents":"/api/rules/react19-compiler-deterministic-memoization-closure-invariant?format=agents"}},{"id":"fastapi-python313t-freethreaded-concurrency-guardrail","title":"FastAPI Python 3.13t Free-Threaded Memory Concurrency Standard","category":"backend","severity":"critical","description":"Enforces strict memory safety and thread synchronization across FastAPI applications executing on Python 3.13t free-threaded (PEP 703) runtimes without the Global Interpreter Lock (GIL). Prohibits naked mutable shared state across ASGI thread workers, eliminates torn reads and race conditions on built-in collections, and prevents process crashes caused by non-thread-safe native C-extensions.","antiPatternHeadline":"Unsynchronized shared mutable state and unsafe C-extension invocation across free-threaded worker pools","stars_count":71,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","python3.13t","free-threaded","concurrency","memory-safety","no-gil"],"exportEndpoints":{"claude":"/api/rules/fastapi-python313t-freethreaded-concurrency-guardrail?format=claude","cursorMdc":"/api/rules/fastapi-python313t-freethreaded-concurrency-guardrail?format=mdc","cursorrules":"/api/rules/fastapi-python313t-freethreaded-concurrency-guardrail?format=cursor","windsurf":"/api/rules/fastapi-python313t-freethreaded-concurrency-guardrail?format=windsurf","agents":"/api/rules/fastapi-python313t-freethreaded-concurrency-guardrail?format=agents"}},{"id":"postgres-17-direct-io-block-prefetch-alignment-standard","title":"PostgreSQL 17 Direct I/O and Block Prefetch Alignment Standard","category":"backend","severity":"critical","description":"Enforces PostgreSQL 17 Direct I/O (io_direct) configuration and NVMe block-prefetch alignment to eradicate double-caching overhead between kernel page cache and Postgres shared buffers. Requires shared_buffers reallocation up to 60-75% of total system memory, block-size sector alignment, and aggressive asynchronous prefetch tuning to ensure deterministic sub-millisecond p99 latencies on enterprise NVMe storage.","antiPatternHeadline":"Relying on Default OS Page Caching and Conventional 25% shared_buffers Allocation on High-IOPS NVMe Arrays","stars_count":83,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","database-performance","direct-io","nvme","storage-architecture"],"exportEndpoints":{"claude":"/api/rules/postgres-17-direct-io-block-prefetch-alignment-standard?format=claude","cursorMdc":"/api/rules/postgres-17-direct-io-block-prefetch-alignment-standard?format=mdc","cursorrules":"/api/rules/postgres-17-direct-io-block-prefetch-alignment-standard?format=cursor","windsurf":"/api/rules/postgres-17-direct-io-block-prefetch-alignment-standard?format=windsurf","agents":"/api/rules/postgres-17-direct-io-block-prefetch-alignment-standard?format=agents"}},{"id":"bun-worker-sharedarraybuffer-mutex-synchronization-standard","title":"Bun 1.2 Worker SharedArrayBuffer Mutex and Memory Visibility Standard","category":"backend","severity":"critical","description":"Enforces strict memory ordering and zero-spin synchronization for parallel computational pipelines communicating via SharedArrayBuffer in Bun 1.2 worker threads. Prevents thread deadlocks, cache incoherence, CPU core saturation, and data corruption caused by unsynchronized buffer reads and naive spinlocks.","antiPatternHeadline":"Unsynchronized Direct TypedArray Mutation and CPU-Saturating Spinlocks Across Worker Threads","stars_count":40,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["bun","worker-threads","sharedarraybuffer","atomics","multithreading","backend"],"exportEndpoints":{"claude":"/api/rules/bun-worker-sharedarraybuffer-mutex-synchronization-standard?format=claude","cursorMdc":"/api/rules/bun-worker-sharedarraybuffer-mutex-synchronization-standard?format=mdc","cursorrules":"/api/rules/bun-worker-sharedarraybuffer-mutex-synchronization-standard?format=cursor","windsurf":"/api/rules/bun-worker-sharedarraybuffer-mutex-synchronization-standard?format=windsurf","agents":"/api/rules/bun-worker-sharedarraybuffer-mutex-synchronization-standard?format=agents"}},{"id":"webauthn-conditional-mediation-channel-binding-guardrail","title":"WebAuthn Conditional Mediation Cross-Origin Challenge Binding Guardrail","category":"security","severity":"critical","description":"Enforces cryptographic binding between WebAuthn conditional mediation (passkey autofill) challenges, transient browser nonces, and TLS channel/session tokens to neutralize cross-origin relay and session replay attacks. Mandates strict RP ID validation, cryptographically random challenge-to-session association in isolated cache layers, and clientDataJSON origin/type parity checking during public key credential assertion verification.","antiPatternHeadline":"Unbound Ephemeral Challenges Allowing Cross-Origin Passkey Autofill Replay and Credential Stuffing","stars_count":50,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","fido2","passkeys","authentication","cryptography"],"exportEndpoints":{"claude":"/api/rules/webauthn-conditional-mediation-channel-binding-guardrail?format=claude","cursorMdc":"/api/rules/webauthn-conditional-mediation-channel-binding-guardrail?format=mdc","cursorrules":"/api/rules/webauthn-conditional-mediation-channel-binding-guardrail?format=cursor","windsurf":"/api/rules/webauthn-conditional-mediation-channel-binding-guardrail?format=windsurf","agents":"/api/rules/webauthn-conditional-mediation-channel-binding-guardrail?format=agents"}},{"id":"cilium-tetragon-ebpf-exec-enforcement","title":"Cilium Tetragon In-Kernel Process Execution and Container Breakout Enforcement","category":"devops","severity":"critical","description":"Enforces synchronous, in-kernel process termination via Cilium Tetragon eBPF TracingPolicies before unauthorized system calls return to userspace. Guarantees that container breakout attempts, unauthorized binary execution, and privilege escalations are intercepted at the kernel LSM or tracepoint boundary with Sigkill rather than detected asynchronously after execution completes.","antiPatternHeadline":"Relying on Asynchronous Userspace Audit Logs for Process Execution and Container Escapes","stars_count":75,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","cilium","tetragon","kubernetes","runtime-security","zero-trust"],"exportEndpoints":{"claude":"/api/rules/cilium-tetragon-ebpf-exec-enforcement?format=claude","cursorMdc":"/api/rules/cilium-tetragon-ebpf-exec-enforcement?format=mdc","cursorrules":"/api/rules/cilium-tetragon-ebpf-exec-enforcement?format=cursor","windsurf":"/api/rules/cilium-tetragon-ebpf-exec-enforcement?format=windsurf","agents":"/api/rules/cilium-tetragon-ebpf-exec-enforcement?format=agents"}},{"id":"opentelemetry-genai-semantic-conventions-production-standard","title":"OpenTelemetry GenAI Semantic Conventions for Heterogeneous LLM Observability","category":"devops","severity":"critical","description":"Enforces strict adherence to OpenTelemetry GenAI Semantic Conventions across all LLM inference call sites, agent frameworks, and streaming gateways. Guarantees uniform telemetry capture for token consumption, streaming Time-To-First-Token (TTFT), and agent execution traces to enable accurate cost accounting, auditability, and SLA attribution without leaking unmasked PII.","antiPatternHeadline":"Fragmented Ad-Hoc Span Names, Proprietary Token Metric Keys, and Missing Streaming TTFT Telemetry","stars_count":114,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","genai","llm-observability","tracing","cost-attribution","sla"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-genai-semantic-conventions-production-standard?format=claude","cursorMdc":"/api/rules/opentelemetry-genai-semantic-conventions-production-standard?format=mdc","cursorrules":"/api/rules/opentelemetry-genai-semantic-conventions-production-standard?format=cursor","windsurf":"/api/rules/opentelemetry-genai-semantic-conventions-production-standard?format=windsurf","agents":"/api/rules/opentelemetry-genai-semantic-conventions-production-standard?format=agents"}},{"id":"svelte-5-runes-scope-cleanup-boundary","title":"Svelte 5 $effect.root Scope Cleanup Invariant in SSR Streaming","category":"frontend","severity":"critical","description":"Enforces mandatory deterministic teardown of universal $effect.root scopes within server-side rendering (SSR) and streaming pipelines. Svelte 5 reactive scopes instantiated outside standard component hierarchies persist in the node process memory unless their teardown callback is invoked, causing cross-request data leaks and signal graph memory bloat.","antiPatternHeadline":"Instantiating unbounded $effect.root reactive scopes during SSR without lifecycle-bound teardown handlers.","stars_count":48,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","ssr","memory-leaks","signals"],"exportEndpoints":{"claude":"/api/rules/svelte-5-runes-scope-cleanup-boundary?format=claude","cursorMdc":"/api/rules/svelte-5-runes-scope-cleanup-boundary?format=mdc","cursorrules":"/api/rules/svelte-5-runes-scope-cleanup-boundary?format=cursor","windsurf":"/api/rules/svelte-5-runes-scope-cleanup-boundary?format=windsurf","agents":"/api/rules/svelte-5-runes-scope-cleanup-boundary?format=agents"}},{"id":"postgres-17-failover-slot-synchronization-boundary","title":"Postgres 17 Logical Slot Synchronization Pre-Promotion Invariant","category":"backend","severity":"critical","description":"Mandates that automated database failover scripts, cluster controllers, and promotion orchestrators enforce logical replication slot synchronization on PostgreSQL 17 physical standbys before issuing promotion commands. Pre-promotion synchronization via sync_replication_slots and pg_sync_replication_slots() eliminates downstream subscriber desynchronization, LSN gaps, and required full table resynchronization.","antiPatternHeadline":"Promoting a physical standby to primary without verifying or forcing logical replication slot synchronization, corrupting downstream logical subscribers.","stars_count":98,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql-17","high-availability","replication","cdc"],"exportEndpoints":{"claude":"/api/rules/postgres-17-failover-slot-synchronization-boundary?format=claude","cursorMdc":"/api/rules/postgres-17-failover-slot-synchronization-boundary?format=mdc","cursorrules":"/api/rules/postgres-17-failover-slot-synchronization-boundary?format=cursor","windsurf":"/api/rules/postgres-17-failover-slot-synchronization-boundary?format=windsurf","agents":"/api/rules/postgres-17-failover-slot-synchronization-boundary?format=agents"}},{"id":"webauthn-largeblob-client-side-encryption-vault","title":"Client-Side Cryptographic Vault Isolation for WebAuthn largeBlob Payloads","category":"security","severity":"critical","description":"Enforces mandatory client-side authenticated envelope encryption (AEAD) for all payloads destined for the WebAuthn largeBlob extension. Modern passkeys replicate across third-party cloud synchronization fabrics (e.g., Apple iCloud Keychain, Google Password Manager), exposing raw blob data to vendor infrastructure unless shielded by zero-knowledge client-side encryption. All reads and writes must cryptographically bind the relying party identity and credential ID to the encrypted envelope.","antiPatternHeadline":"Persisting Unencrypted or Malleable Plaintext directly into WebAuthn largeBlob Extension Buffers","stars_count":84,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","passkeys","largeblob","cryptography","zero-knowledge"],"exportEndpoints":{"claude":"/api/rules/webauthn-largeblob-client-side-encryption-vault?format=claude","cursorMdc":"/api/rules/webauthn-largeblob-client-side-encryption-vault?format=mdc","cursorrules":"/api/rules/webauthn-largeblob-client-side-encryption-vault?format=cursor","windsurf":"/api/rules/webauthn-largeblob-client-side-encryption-vault?format=windsurf","agents":"/api/rules/webauthn-largeblob-client-side-encryption-vault?format=agents"}},{"id":"otel-baggage-sanitization-guardrail","title":"OpenTelemetry W3C Baggage Ingress Sanitization and Size Limits","category":"devops","severity":"critical","description":"Enforces strict byte ceilings (maximum 8192 bytes total, 64 entries) and regex-based sensitive key/PII redaction on incoming W3C Baggage headers at edge and ingress proxies. Prevents distributed Denial of Service (DoS) from header-induced memory amplification and blocks accidental leakage of authorization tokens, passwords, and PII across downstream trace propagators.","antiPatternHeadline":"Blind Downstream Propagation of Unbounded, Unsanitized W3C Baggage Context Headers","stars_count":68,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","security","observability","api-gateway","tracing"],"exportEndpoints":{"claude":"/api/rules/otel-baggage-sanitization-guardrail?format=claude","cursorMdc":"/api/rules/otel-baggage-sanitization-guardrail?format=mdc","cursorrules":"/api/rules/otel-baggage-sanitization-guardrail?format=cursor","windsurf":"/api/rules/otel-baggage-sanitization-guardrail?format=windsurf","agents":"/api/rules/otel-baggage-sanitization-guardrail?format=agents"}},{"id":"kmp-2-1-swift-export-memory-ownership","title":"KMP 2.1 Direct Swift Export Memory Ownership and Immutability Guardrail","category":"mobile","severity":"critical","description":"Enforces strict value-type immutability and explicit lifecycle scopes across the Direct Swift Export ABI boundary in Kotlin Multiplatform 2.1. Crossing the boundary between Swift native tasks and Kotlin coroutine dispatchers with mutable state or unmanaged references creates memory ownership desynchronizations, reference cycles across ARC and Kotlin GC, and race conditions.","antiPatternHeadline":"Exposing Shared Mutable Classes and Unscoped Continuations Across the Direct Swift Export Boundary","stars_count":72,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","swift-export","memory-management","concurrency"],"exportEndpoints":{"claude":"/api/rules/kmp-2-1-swift-export-memory-ownership?format=claude","cursorMdc":"/api/rules/kmp-2-1-swift-export-memory-ownership?format=mdc","cursorrules":"/api/rules/kmp-2-1-swift-export-memory-ownership?format=cursor","windsurf":"/api/rules/kmp-2-1-swift-export-memory-ownership?format=windsurf","agents":"/api/rules/kmp-2-1-swift-export-memory-ownership?format=agents"}},{"id":"fastapi-pydantic-v2-simd-buffer-ceiling","title":"FastAPI Pydantic v2 SIMD Buffer Allocation Ceiling & Pre-Parse Guardrail","category":"backend","severity":"critical","description":"Establishes strict pre-parse memory ceilings and streaming byte limits prior to pydantic-core SIMD JSON deserialization in FastAPI applications. Prevents asymmetric denial-of-service (DoS) and out-of-memory (OOM) crashes caused by multi-megabyte payloads inflating contiguous Rust SIMD buffers during request ingestion. Ensures ASGI middleware terminates oversized streams before serialization workers buffer untrusted bytes into RAM.","antiPatternHeadline":"Unbounded Request Body Ingestion Delegated Directly to Pydantic-Core SIMD Deserialization","stars_count":70,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","pydantic-v2","security","dos-prevention","asgi","memory-management"],"exportEndpoints":{"claude":"/api/rules/fastapi-pydantic-v2-simd-buffer-ceiling?format=claude","cursorMdc":"/api/rules/fastapi-pydantic-v2-simd-buffer-ceiling?format=mdc","cursorrules":"/api/rules/fastapi-pydantic-v2-simd-buffer-ceiling?format=cursor","windsurf":"/api/rules/fastapi-pydantic-v2-simd-buffer-ceiling?format=windsurf","agents":"/api/rules/fastapi-pydantic-v2-simd-buffer-ceiling?format=agents"}},{"id":"ebpf-lsm-binary-integrity-bprm-verification","title":"Mandatory In-Kernel Binary Digest Verification via BPF-LSM bprm_creds_for_exec","category":"security","severity":"critical","description":"Enforces synchronous cryptographic integrity verification of executable binaries inside the kernel before container process execution. BPF-LSM hooks on bprm_creds_for_exec must query kernel IMA digests via bpf_ima_inode_hash or bpf_ima_file_hash and reject unmeasured or untrusted binaries with -EPERM to eliminate TOCTOU execution windows.","antiPatternHeadline":"Permissive or Asynchronous Userspace Binary Verification Prone to Execution TOCTOU and Inode Spoofing","stars_count":96,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","ebpf","bpf-lsm","ima","container-runtime","linux-kernel"],"exportEndpoints":{"claude":"/api/rules/ebpf-lsm-binary-integrity-bprm-verification?format=claude","cursorMdc":"/api/rules/ebpf-lsm-binary-integrity-bprm-verification?format=mdc","cursorrules":"/api/rules/ebpf-lsm-binary-integrity-bprm-verification?format=cursor","windsurf":"/api/rules/ebpf-lsm-binary-integrity-bprm-verification?format=windsurf","agents":"/api/rules/ebpf-lsm-binary-integrity-bprm-verification?format=agents"}},{"id":"react-19-asset-preloading-style-precedence","title":"React 19 Asset Preloading & Style Precedence Invariant","category":"frontend","severity":"critical","description":"Mandates explicit style precedence tiers via the 'precedence' prop and native 'react-dom' resource preloading APIs across all asynchronously streamed components. Guarantees deterministic CSS cascade ordering and eliminates Cumulative Layout Shifts (CLS) and Flash of Unstyled Content (FOUC) caused by out-of-order Suspense streaming.","antiPatternHeadline":"Omitting the 'precedence' attribute on linked stylesheets or using client-side DOM injection in useEffect during streaming renders","stars_count":62,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["react-19","style-precedence","asset-preloading","streaming-ssr","fouc-prevention"],"exportEndpoints":{"claude":"/api/rules/react-19-asset-preloading-style-precedence?format=claude","cursorMdc":"/api/rules/react-19-asset-preloading-style-precedence?format=mdc","cursorrules":"/api/rules/react-19-asset-preloading-style-precedence?format=cursor","windsurf":"/api/rules/react-19-asset-preloading-style-precedence?format=windsurf","agents":"/api/rules/react-19-asset-preloading-style-precedence?format=agents"}},{"id":"bun-worker-atomics-mutex-timeout-guardrail","title":"Bun 1.2 Worker Thread SharedArrayBuffer Atomics Mutex Timeout Guardrail","category":"backend","severity":"critical","description":"Enforces deterministic bounded timeout wrappers around all Atomics.wait calls within multi-threaded Bun 1.2 worker pools. Unbounded Atomics.wait invocations in worker threads cause unrecoverable thread deadlocks, resource exhaustion, and persistent event loop starvation when locking worker threads fail to release shared memory locks.","antiPatternHeadline":"Unbounded Atomics.wait Invocations Causing Permanent Worker Thread Deadlocks and Zombie Pool Exhaustion","stars_count":63,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","concurrency","multithreading","sharedarraybuffer","atomics"],"exportEndpoints":{"claude":"/api/rules/bun-worker-atomics-mutex-timeout-guardrail?format=claude","cursorMdc":"/api/rules/bun-worker-atomics-mutex-timeout-guardrail?format=mdc","cursorrules":"/api/rules/bun-worker-atomics-mutex-timeout-guardrail?format=cursor","windsurf":"/api/rules/bun-worker-atomics-mutex-timeout-guardrail?format=windsurf","agents":"/api/rules/bun-worker-atomics-mutex-timeout-guardrail?format=agents"}},{"id":"react-19-action-optimistic-rollback-concurrency","title":"React 19 Action Optimistic Rollback and Concurrency Invariant","category":"frontend","severity":"critical","description":"Mandates monotonic sequence tagging and atomic state reconciliation across concurrent useOptimistic and useActionState microtask lifecycles. High-latency network transitions and out-of-order server action rejections must never allow stale microtasks to clobber concurrent in-flight states or trigger unquarantined error cascade unmounts.","antiPatternHeadline":"Unversioned In-Flight State Collisions and Global UI Teardown via Unbounded Concurrent Action Rollbacks","stars_count":68,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","useOptimistic","useActionState","concurrency","transitions"],"exportEndpoints":{"claude":"/api/rules/react-19-action-optimistic-rollback-concurrency?format=claude","cursorMdc":"/api/rules/react-19-action-optimistic-rollback-concurrency?format=mdc","cursorrules":"/api/rules/react-19-action-optimistic-rollback-concurrency?format=cursor","windsurf":"/api/rules/react-19-action-optimistic-rollback-concurrency?format=windsurf","agents":"/api/rules/react-19-action-optimistic-rollback-concurrency?format=agents"}},{"id":"svelte-5-snippet-hydration-mismatch-quarantine-standard","title":"Svelte 5 Dynamic Snippet Hydration Mismatch Quarantine and State Isolation Standard","category":"frontend","severity":"critical","description":"Mandates isolated client-repair boundaries and deterministic placeholder fallbacks for non-deterministic or deeply nested dynamic Svelte 5 snippets during SSR hydration. Prevents DOM tree invalidation cascades, root-level re-rendering, and reactive rune ($state) destruction when server-rendered markup diverges from client initialization.","antiPatternHeadline":"Unquarantined dynamic snippets consuming non-deterministic or client-only state during SSR, triggering cascade hydration mismatches and full component tree remounts.","stars_count":59,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","ssr","hydration","runes","snippets"],"exportEndpoints":{"claude":"/api/rules/svelte-5-snippet-hydration-mismatch-quarantine-standard?format=claude","cursorMdc":"/api/rules/svelte-5-snippet-hydration-mismatch-quarantine-standard?format=mdc","cursorrules":"/api/rules/svelte-5-snippet-hydration-mismatch-quarantine-standard?format=cursor","windsurf":"/api/rules/svelte-5-snippet-hydration-mismatch-quarantine-standard?format=windsurf","agents":"/api/rules/svelte-5-snippet-hydration-mismatch-quarantine-standard?format=agents"}},{"id":"postgres-17-direct-io-streaming-ingestion-alignment","title":"PostgreSQL 17 Direct I/O Sector Alignment and Block-Bounded Batch Streaming Guardrail","category":"backend","severity":"critical","description":"Enforces strict memory and block boundary alignment (4096-byte hardware sector and 8192-byte relation block multiples) for streaming batch ingestion pipelines targeting PostgreSQL 17 deployments running with direct I/O enabled (io_direct). Prevents page cache contention, synchronous read-modify-write degradation, and unbuffered write stall cascades across NVMe storage subsystems.","antiPatternHeadline":"Arbitrary Chunk Splitting and Unaligned Memory Streaming Causing Direct I/O Read-Modify-Write Amplification","stars_count":57,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres-17","direct-io","streaming","nvme","performance","high-throughput"],"exportEndpoints":{"claude":"/api/rules/postgres-17-direct-io-streaming-ingestion-alignment?format=claude","cursorMdc":"/api/rules/postgres-17-direct-io-streaming-ingestion-alignment?format=mdc","cursorrules":"/api/rules/postgres-17-direct-io-streaming-ingestion-alignment?format=cursor","windsurf":"/api/rules/postgres-17-direct-io-streaming-ingestion-alignment?format=windsurf","agents":"/api/rules/postgres-17-direct-io-streaming-ingestion-alignment?format=agents"}},{"id":"go-swiss-table-concurrent-mutation-fence","title":"Go 1.24 Swiss Table Read-Copy-Update Mutation Fence Standard","category":"backend","severity":"critical","description":"Go 1.24 replaces internal runtime hash tables with a SIMD-accelerated Swiss Table implementation. In high-throughput parallel read/write workloads, standard coarse sync.RWMutex synchronization triggers CPU L1/L2 cache line bouncing and runtime allocator lock contention when concurrent writes induce group control word re-allocations and rehashing. This rule mandates an atomic pointer-swapped Read-Copy-Update (RCU) mutation fence with batch copy-on-write semantics to preserve lock-free reader locality and avoid allocator lockouts.","antiPatternHeadline":"Coarse RWMutex Locking Over Raw Go 1.24 Swiss Maps During High-Concurrency Mutation Cycles","stars_count":57,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","golang","go1.24","swiss-tables","concurrency","rcu","cache-locality"],"exportEndpoints":{"claude":"/api/rules/go-swiss-table-concurrent-mutation-fence?format=claude","cursorMdc":"/api/rules/go-swiss-table-concurrent-mutation-fence?format=mdc","cursorrules":"/api/rules/go-swiss-table-concurrent-mutation-fence?format=cursor","windsurf":"/api/rules/go-swiss-table-concurrent-mutation-fence?format=windsurf","agents":"/api/rules/go-swiss-table-concurrent-mutation-fence?format=agents"}},{"id":"axum-tokio-cooperative-yield-budget-standard","title":"Axum 0.8 Tokio Cooperative Task Yield Budget Standard","category":"backend","severity":"critical","description":"Enforces deterministic compute-cycle budgets inside Axum 0.8 async handlers, Server-Sent Events (SSE), and streaming chunk iterators via explicit tokio::task::yield_now calls. Prevents CPU-bound serialization and transform loops on Tokio worker threads from starving co-located network I/O tasks. Guarantees sub-millisecond p99 latency across multiplexed HTTP/2 and HTTP/3 connections.","antiPatternHeadline":"Unbounded tight CPU iteration loops in streaming handlers starving Tokio worker run queues","stars_count":58,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tokio","async","latency","concurrency"],"exportEndpoints":{"claude":"/api/rules/axum-tokio-cooperative-yield-budget-standard?format=claude","cursorMdc":"/api/rules/axum-tokio-cooperative-yield-budget-standard?format=mdc","cursorrules":"/api/rules/axum-tokio-cooperative-yield-budget-standard?format=cursor","windsurf":"/api/rules/axum-tokio-cooperative-yield-budget-standard?format=windsurf","agents":"/api/rules/axum-tokio-cooperative-yield-budget-standard?format=agents"}},{"id":"webauthn-conditional-mediation-origin-fencing","title":"WebAuthn Conditional Mediation Origin Fencing & Iframe Sandbox Invariants","category":"security","severity":"critical","description":"Enforces strict origin validation, cross-origin isolation fencing, and explicit iframe permission delegation policies during conditional WebAuthn passkey autofill. Prevents credential theft, UI redressing, and clickjacking attacks across multi-tenant micro-frontends and embedded SaaS portals by mandating ancestor checks and explicit credential-delegation permissions.","antiPatternHeadline":"Unfenced Conditional WebAuthn Invocation in Permissive or Cross-Origin Embedded Iframes","stars_count":79,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","passkeys","iframe-sandboxing","conditional-mediation","browser-security"],"exportEndpoints":{"claude":"/api/rules/webauthn-conditional-mediation-origin-fencing?format=claude","cursorMdc":"/api/rules/webauthn-conditional-mediation-origin-fencing?format=mdc","cursorrules":"/api/rules/webauthn-conditional-mediation-origin-fencing?format=cursor","windsurf":"/api/rules/webauthn-conditional-mediation-origin-fencing?format=windsurf","agents":"/api/rules/webauthn-conditional-mediation-origin-fencing?format=agents"}},{"id":"openfga-recursive-traversal-depth-ceiling","title":"OpenFGA Recursive Relation Traversal Depth Ceiling & Cycle Prevention","category":"security","severity":"critical","description":"Enforces deterministic depth ceilings, cycle detection, and strict contextual tuple validation across Zanzibar-style OpenFGA relation models and query clients. Unbounded graph expansions across transitive relations (such as nested group memberships or hierarchical folders) allow malicious or degenerate multi-tenant graphs to trigger exponential fan-out, backend memory exhaustion, and distributed denial-of-service cascades.","antiPatternHeadline":"Unbounded Recursive Transitive Relations and Contextual Tuples Triggering Zanzibar Denial-of-Service","stars_count":75,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","zanzibar","authorization","rebac","graph-traversal","dos-prevention"],"exportEndpoints":{"claude":"/api/rules/openfga-recursive-traversal-depth-ceiling?format=claude","cursorMdc":"/api/rules/openfga-recursive-traversal-depth-ceiling?format=mdc","cursorrules":"/api/rules/openfga-recursive-traversal-depth-ceiling?format=cursor","windsurf":"/api/rules/openfga-recursive-traversal-depth-ceiling?format=windsurf","agents":"/api/rules/openfga-recursive-traversal-depth-ceiling?format=agents"}},{"id":"capacitor-7-hardware-keystore-attestation-bridge","title":"Capacitor 7 Hardware-Backed Keystore Attestation and Zero-Leakage IPC Bridge","category":"mobile","severity":"critical","description":"Enforces strict isolation of cryptographic material by delegating key generation, storage, and signing exclusively to hardware-backed enclaves (Android StrongBox/TEE and iOS Secure Enclave). Prohibits transmission of raw private keys, seeds, or unencrypted secrets across the JavaScript-to-Native IPC bridge, restricting bridge payloads to opaque key aliases, public keys, and cryptographic attestation statements.","antiPatternHeadline":"Exposing Raw Cryptographic Seeds or Performing Software Key Generation across the Capacitor WebView IPC Bridge","stars_count":78,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","security","cryptography","keychain","keystore"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-hardware-keystore-attestation-bridge?format=claude","cursorMdc":"/api/rules/capacitor-7-hardware-keystore-attestation-bridge?format=mdc","cursorrules":"/api/rules/capacitor-7-hardware-keystore-attestation-bridge?format=cursor","windsurf":"/api/rules/capacitor-7-hardware-keystore-attestation-bridge?format=windsurf","agents":"/api/rules/capacitor-7-hardware-keystore-attestation-bridge?format=agents"}},{"id":"kmp-native-mimalloc-arena-segregation","title":"Kotlin Multiplatform Native Mimalloc Arena Segregation Guardrail","category":"mobile","severity":"critical","description":"Enforces strict heap allocator arena segregation between Kotlin/Native background worker threads and Darwin Apple platform runtimes (CoreData, SQLite, GCD) during high-throughput parallel database synchronization. Disallows cross-allocator pointer sharing, unmanaged heap transfers without explicit arena release, and concurrent foreign memory references that induce lock inversion or mimalloc page corruption on iOS.","antiPatternHeadline":"Cross-Boundary Raw Pointer Escaping and Shared Allocator Deadlocks Across Darwin GCD and K/Native Mimalloc Runtimes","stars_count":52,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","kotlin-native","ios","mimalloc","concurrency","memory-management"],"exportEndpoints":{"claude":"/api/rules/kmp-native-mimalloc-arena-segregation?format=claude","cursorMdc":"/api/rules/kmp-native-mimalloc-arena-segregation?format=mdc","cursorrules":"/api/rules/kmp-native-mimalloc-arena-segregation?format=cursor","windsurf":"/api/rules/kmp-native-mimalloc-arena-segregation?format=windsurf","agents":"/api/rules/kmp-native-mimalloc-arena-segregation?format=agents"}},{"id":"ebpf-ambient-mesh-socket-splicing-identity-attestation","title":"eBPF Ambient Mesh Socket Splicing Cryptographic SPIFFE Identity Attestation Invariant","category":"devops","severity":"critical","description":"Enforces that all kernel-space eBPF socket redirection and socket splicing programs (such as sockops, sk_msg, and sock_hash maps) cryptographically verify the peer SPIFFE ID context before bypassing user-space L4/L7 proxy enforcement. Unconditional kernel socket splicing based strictly on IP/port 4-tuples allows unauthorized cross-namespace pod traffic and breaks zero-trust boundaries when pod network namespaces are shared or IPs are recycled.","antiPatternHeadline":"Bypassing User-Space Mutual TLS Proxies via Naive eBPF Socket Splicing Based Solely on L3/L4 Endpoints","stars_count":71,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","ambient-mesh","spiffe","zero-trust","linux-kernel","networking"],"exportEndpoints":{"claude":"/api/rules/ebpf-ambient-mesh-socket-splicing-identity-attestation?format=claude","cursorMdc":"/api/rules/ebpf-ambient-mesh-socket-splicing-identity-attestation?format=mdc","cursorrules":"/api/rules/ebpf-ambient-mesh-socket-splicing-identity-attestation?format=cursor","windsurf":"/api/rules/ebpf-ambient-mesh-socket-splicing-identity-attestation?format=windsurf","agents":"/api/rules/ebpf-ambient-mesh-socket-splicing-identity-attestation?format=agents"}},{"id":"svelte5-async-effect-teardown-state-mirroring-invariant","title":"Svelte 5 Runes Async Effect Teardown and State Mirroring Invariant","category":"frontend","severity":"critical","description":"Enforces deterministic signal disposal and prevents micro-memory leaks during async transitions in Svelte 5. Prohibits direct async executor callbacks in $effect runes and mandates AbortController-backed synchronous teardowns with cancellation checks before state mutation.","antiPatternHeadline":"Direct Async $effect Callbacks Swallowing Teardown Functions and Causing Out-of-Order State Mutations","stars_count":82,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","async-effects","memory-leaks"],"exportEndpoints":{"claude":"/api/rules/svelte5-async-effect-teardown-state-mirroring-invariant?format=claude","cursorMdc":"/api/rules/svelte5-async-effect-teardown-state-mirroring-invariant?format=mdc","cursorrules":"/api/rules/svelte5-async-effect-teardown-state-mirroring-invariant?format=cursor","windsurf":"/api/rules/svelte5-async-effect-teardown-state-mirroring-invariant?format=windsurf","agents":"/api/rules/svelte5-async-effect-teardown-state-mirroring-invariant?format=agents"}},{"id":"vite6-environment-api-runtime-isolation-vite-6-environme-469","title":"Vite 6 Environment API Cross-Runtime Module Isolation Barrier","category":"frontend","severity":"critical","description":"Enforces strict physical isolation between client, server, and worker module graphs using the Vite 6 Environment API. Prevents runtime pollution, invalid cross-environment imports (such as Node.js built-ins leaking into edge or browser bundles), and shared mutable plugin state across compilation environments during multi-environment SSR builds.","antiPatternHeadline":"Cross-Runtime Module Graph Contamination via Legacy SSR Flags and Shared Plugin State","stars_count":103,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","vite","vite-6","ssr","environment-api","module-isolation","edge-runtime"],"exportEndpoints":{"claude":"/api/rules/vite6-environment-api-runtime-isolation-vite-6-environme-469?format=claude","cursorMdc":"/api/rules/vite6-environment-api-runtime-isolation-vite-6-environme-469?format=mdc","cursorrules":"/api/rules/vite6-environment-api-runtime-isolation-vite-6-environme-469?format=cursor","windsurf":"/api/rules/vite6-environment-api-runtime-isolation-vite-6-environme-469?format=windsurf","agents":"/api/rules/vite6-environment-api-runtime-isolation-vite-6-environme-469?format=agents"}},{"id":"rust-axum-08-tower-graceful-backpressure-standard","title":"Rust Axum 0.8 Tower Service Layer Graceful Backpressure Standard","category":"backend","severity":"critical","description":"Mandates strict concurrency boundaries, explicit load-shedding, and deterministic error-handling middleware within Axum 0.8 service pipelines. Eliminates unconstrained heap allocations and file-descriptor exhaustion by enforcing fail-fast backpressure contracts before saturated application state is reached.","antiPatternHeadline":"Unbounded Request Ingestion and Detached Task Spawning Inducing Socket Depletion and Heap Collapse Under Burst Load","stars_count":76,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tower","backpressure","concurrency","rate-limiting"],"exportEndpoints":{"claude":"/api/rules/rust-axum-08-tower-graceful-backpressure-standard?format=claude","cursorMdc":"/api/rules/rust-axum-08-tower-graceful-backpressure-standard?format=mdc","cursorrules":"/api/rules/rust-axum-08-tower-graceful-backpressure-standard?format=cursor","windsurf":"/api/rules/rust-axum-08-tower-graceful-backpressure-standard?format=windsurf","agents":"/api/rules/rust-axum-08-tower-graceful-backpressure-standard?format=agents"}},{"id":"go-124-weak-pointer-cache-pinning-standard","title":"Go 1.24 Weak Pointer Cache Eviction and Memory Pinning Standard","category":"backend","severity":"critical","description":"Enforces deterministic memory reclamation patterns in high-throughput caching tiers using Go 1.24+ 'weak' references and 'runtime.KeepAlive' pin semantics. Prevents finalizer race conditions, memory retention leaks, and use-after-collection panics caused by naive strong pointer caching or premature GC sweeps during heavy concurrent allocation cycles.","antiPatternHeadline":"Retaining Strong References in Canonicalizer Caches or Accessing Dereferenced Weak Pointers Without Immediate Strong Binding and Pinning","stars_count":47,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","concurrency","gc","performance","memory-management"],"exportEndpoints":{"claude":"/api/rules/go-124-weak-pointer-cache-pinning-standard?format=claude","cursorMdc":"/api/rules/go-124-weak-pointer-cache-pinning-standard?format=mdc","cursorrules":"/api/rules/go-124-weak-pointer-cache-pinning-standard?format=cursor","windsurf":"/api/rules/go-124-weak-pointer-cache-pinning-standard?format=windsurf","agents":"/api/rules/go-124-weak-pointer-cache-pinning-standard?format=agents"}},{"id":"tauri2-mobile-capability-ipc-permission-fence","title":"Tauri 2.0 Mobile Capability-Based IPC Permission Fence & Origin ACLs","category":"mobile","severity":"critical","description":"Enforces granular, zero-trust IPC capability manifests in Tauri 2.0 mobile environments by strictly binding privileged native device APIs to validated webview identifiers and cryptographically pinned origins. Prohibits global wildcard capabilities and ambient native bridge exposure across mobile application boundaries.","antiPatternHeadline":"Ambient Wildcard Capabilities Exposing Privileged Mobile Device APIs to Unverified Webviews","stars_count":110,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri-2","ipc-security","access-control-lists","zero-trust","ios","android"],"exportEndpoints":{"claude":"/api/rules/tauri2-mobile-capability-ipc-permission-fence?format=claude","cursorMdc":"/api/rules/tauri2-mobile-capability-ipc-permission-fence?format=mdc","cursorrules":"/api/rules/tauri2-mobile-capability-ipc-permission-fence?format=cursor","windsurf":"/api/rules/tauri2-mobile-capability-ipc-permission-fence?format=windsurf","agents":"/api/rules/tauri2-mobile-capability-ipc-permission-fence?format=agents"}},{"id":"kmp-knative-incremental-gc-cadence-stabilization-standard","title":"Kotlin Multiplatform Native Incremental GC Cadence & Allocation Pacing Standard","category":"mobile","severity":"critical","description":"Enforces deterministic object allocation and GC scheduling boundaries in Kotlin/Native shared modules executing on iOS. Prevents main-thread UI hitching and frame drops below 120Hz caused by uncoordinated incremental GC sweeping during high-throughput background ingestion streams.","antiPatternHeadline":"Unbounded allocations on background threads triggering aggressive stop-the-world GC phases during UI render deadlines.","stars_count":65,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kmp","kotlin-native","ios","garbage-collection","concurrency","performance"],"exportEndpoints":{"claude":"/api/rules/kmp-knative-incremental-gc-cadence-stabilization-standard?format=claude","cursorMdc":"/api/rules/kmp-knative-incremental-gc-cadence-stabilization-standard?format=mdc","cursorrules":"/api/rules/kmp-knative-incremental-gc-cadence-stabilization-standard?format=cursor","windsurf":"/api/rules/kmp-knative-incremental-gc-cadence-stabilization-standard?format=windsurf","agents":"/api/rules/kmp-knative-incremental-gc-cadence-stabilization-standard?format=agents"}},{"id":"webauthn-enterprise-attestation-origin-boundary","title":"WebAuthn Enterprise Attestation and Origin Boundary Enforcement","category":"security","severity":"critical","description":"Mandates strict enterprise hardware attestation, AAGUID allowlisting, and cryptographic origin verification for high-privilege WebAuthn credentials. Prevents multi-device credential synchronization (passkey leaks) across personal consumer clouds by rejecting credentials with active backup eligibility flags during registration.","antiPatternHeadline":"Accepting unverified passkeys with 'none' attestation and permissive backup flags on privileged accounts","stars_count":115,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","fido2","passkeys","enterprise-attestation","origin-validation"],"exportEndpoints":{"claude":"/api/rules/webauthn-enterprise-attestation-origin-boundary?format=claude","cursorMdc":"/api/rules/webauthn-enterprise-attestation-origin-boundary?format=mdc","cursorrules":"/api/rules/webauthn-enterprise-attestation-origin-boundary?format=cursor","windsurf":"/api/rules/webauthn-enterprise-attestation-origin-boundary?format=windsurf","agents":"/api/rules/webauthn-enterprise-attestation-origin-boundary?format=agents"}},{"id":"opentelemetry-w3c-pii-redaction-envelope","title":"OpenTelemetry W3C Trace Context Zero-Retention PII Redaction Standard","category":"security","severity":"critical","description":"Enforces deterministic, automated sanitization and cryptographically keyed tokenization of sensitive payload attributes within OpenTelemetry context envelopes and W3C trace propagation headers. Guarantees that personal identifiable information (PII), credentials, and regulated data are redacted in-memory before spans and baggage egress trust boundaries.","antiPatternHeadline":"Unredacted Egress of Regulated PII and Auth Tokens via W3C Baggage and Span Attributes","stars_count":50,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","opentelemetry","w3c-trace-context","pii-redaction","zero-retention","compliance"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-w3c-pii-redaction-envelope?format=claude","cursorMdc":"/api/rules/opentelemetry-w3c-pii-redaction-envelope?format=mdc","cursorrules":"/api/rules/opentelemetry-w3c-pii-redaction-envelope?format=cursor","windsurf":"/api/rules/opentelemetry-w3c-pii-redaction-envelope?format=windsurf","agents":"/api/rules/opentelemetry-w3c-pii-redaction-envelope?format=agents"}},{"id":"cilium-ebpf-sockops-fastpath-mtls-production-standard","title":"Cilium eBPF Socket-Layer Fast-Path mTLS Acceleration Standard","category":"devops","severity":"critical","description":"Enforces strict socket-layer fast-path architecture in Cilium-managed Kubernetes service meshes to eliminate TCP/IP traversal overhead without bypassing mTLS encryption or cryptographic identity validation. Mandates explicit sockops socket map attachment boundaries, kernel-space connection tracking synchronization, and control-plane attestation via SPIFFE/SPIRE before sockmap redirection.","antiPatternHeadline":"Bypassing Userspace TLS Handshakes via Unchecked Sockops Redirection","stars_count":67,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","cilium","ebpf","sockops","mtls","kubernetes","service-mesh","spire"],"exportEndpoints":{"claude":"/api/rules/cilium-ebpf-sockops-fastpath-mtls-production-standard?format=claude","cursorMdc":"/api/rules/cilium-ebpf-sockops-fastpath-mtls-production-standard?format=mdc","cursorrules":"/api/rules/cilium-ebpf-sockops-fastpath-mtls-production-standard?format=cursor","windsurf":"/api/rules/cilium-ebpf-sockops-fastpath-mtls-production-standard?format=windsurf","agents":"/api/rules/cilium-ebpf-sockops-fastpath-mtls-production-standard?format=agents"}},{"id":"fastapi-python313-freethreaded-concurrency-boundary","title":"FastAPI Python 3.13 Free-Threaded (No-GIL) State and Pool Invariant","category":"backend","severity":"critical","description":"Enforces strict thread-safe encapsulation of mutable module-level state and database connection pools under Python 3.13 free-threaded execution (PEP 703). Eliminates data races, torn reads/writes, and multiple-instantiation bugs caused by the absence of the Global Interpreter Lock.","antiPatternHeadline":"Unprotected Module-Level State and Unsynchronized Lazy Pool Instantiation in Free-Threaded Python","stars_count":79,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","python313","no-gil","concurrency","sqlalchemy","thread-safety"],"exportEndpoints":{"claude":"/api/rules/fastapi-python313-freethreaded-concurrency-boundary?format=claude","cursorMdc":"/api/rules/fastapi-python313-freethreaded-concurrency-boundary?format=mdc","cursorrules":"/api/rules/fastapi-python313-freethreaded-concurrency-boundary?format=cursor","windsurf":"/api/rules/fastapi-python313-freethreaded-concurrency-boundary?format=windsurf","agents":"/api/rules/fastapi-python313-freethreaded-concurrency-boundary?format=agents"}},{"id":"bun-cluster-zerocopy-arraybuffer-invariant","title":"Bun 1.2 Native Cluster Zero-Copy ArrayBuffer Transfer & Memory Detachment Guardrail","category":"backend","severity":"critical","description":"Enforces strict memory ownership transfer semantics when executing zero-copy ArrayBuffer IPC between Bun cluster primary and worker processes. Guarantees that transferred buffers are explicitly detached on the sending thread to prevent double-free, use-after-free, and segmentation faults across JavaScriptCore engine boundaries under high-throughput conditions.","antiPatternHeadline":"Retaining or Mutating ArrayBuffer References Post-IPC Transfer Leading to JSC Host Panic","stars_count":55,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","cluster","zerocopy","arraybuffer","ipc","memory-safety"],"exportEndpoints":{"claude":"/api/rules/bun-cluster-zerocopy-arraybuffer-invariant?format=claude","cursorMdc":"/api/rules/bun-cluster-zerocopy-arraybuffer-invariant?format=mdc","cursorrules":"/api/rules/bun-cluster-zerocopy-arraybuffer-invariant?format=cursor","windsurf":"/api/rules/bun-cluster-zerocopy-arraybuffer-invariant?format=windsurf","agents":"/api/rules/bun-cluster-zerocopy-arraybuffer-invariant?format=agents"}},{"id":"webauthn-prf-client-key-derivation-guardrail-webauthn-prf-ext-767","title":"Deterministic Client-Side Symmetric Key Derivation via WebAuthn PRF Extension","category":"security","severity":"critical","description":"Enforces zero-trust deterministic client-side symmetric key derivation using the WebAuthn PRF (Pseudo-Random Function) extension. Guarantees that raw authenticator-derived entropy is domain-separated via HKDF, ingested immediately into non-extractable Web Crypto handles, memory-zeroed, and never leaked to untrusted storage or network boundaries.","antiPatternHeadline":"Persisting raw PRF entropy, bypassing HKDF domain separation, or generating extractable CryptoKeys in client memory.","stars_count":67,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","prf-extension","subtlecrypto","client-side-encryption","zero-knowledge"],"exportEndpoints":{"claude":"/api/rules/webauthn-prf-client-key-derivation-guardrail-webauthn-prf-ext-767?format=claude","cursorMdc":"/api/rules/webauthn-prf-client-key-derivation-guardrail-webauthn-prf-ext-767?format=mdc","cursorrules":"/api/rules/webauthn-prf-client-key-derivation-guardrail-webauthn-prf-ext-767?format=cursor","windsurf":"/api/rules/webauthn-prf-client-key-derivation-guardrail-webauthn-prf-ext-767?format=windsurf","agents":"/api/rules/webauthn-prf-client-key-derivation-guardrail-webauthn-prf-ext-767?format=agents"}},{"id":"nextjs15-after-lifecycle-telemetry-draining-boundary","title":"Next.js 15 after() Deterministic Execution & Telemetry Draining Boundary","category":"frontend","severity":"critical","description":"Next.js 15 introduces unstable_after/after to execute asynchronous background tasks after response transmission has finished. Because serverless runtimes terminate container instances immediately once all registered promises resolve, any unhandled promise rejections, missing execution timeouts, or unbound telemetry flushes will lead to silent process eviction, log truncation, and zombie connection leaks.","antiPatternHeadline":"Unbounded fire-and-forget background operations in after() causing runtime execution starvation and truncated telemetry flushes","stars_count":61,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs15","after","telemetry","serverless","lifecycle"],"exportEndpoints":{"claude":"/api/rules/nextjs15-after-lifecycle-telemetry-draining-boundary?format=claude","cursorMdc":"/api/rules/nextjs15-after-lifecycle-telemetry-draining-boundary?format=mdc","cursorrules":"/api/rules/nextjs15-after-lifecycle-telemetry-draining-boundary?format=cursor","windsurf":"/api/rules/nextjs15-after-lifecycle-telemetry-draining-boundary?format=windsurf","agents":"/api/rules/nextjs15-after-lifecycle-telemetry-draining-boundary?format=agents"}},{"id":"postgres-17-combinebackup-lsn-chain-attestation","title":"PostgreSQL 17 pg_combinebackup LSN Chain and Manifest Integrity Attestation","category":"devops","severity":"critical","description":"Enforces strict cryptographic verification and monotonic Log Sequence Number (LSN) continuity checks across cumulative and differential backup manifests before executing PostgreSQL 17 pg_combinebackup. Prevents silent database corruption, timeline collision, and catastrophic point-in-time recovery failures.","antiPatternHeadline":"Invoking pg_combinebackup directly on directory sets without pre-flight manifest cryptographic attestation and LSN range continuity validation.","stars_count":67,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","postgres","postgres-17","backup-restore","disaster-recovery","lsn-validation"],"exportEndpoints":{"claude":"/api/rules/postgres-17-combinebackup-lsn-chain-attestation?format=claude","cursorMdc":"/api/rules/postgres-17-combinebackup-lsn-chain-attestation?format=mdc","cursorrules":"/api/rules/postgres-17-combinebackup-lsn-chain-attestation?format=cursor","windsurf":"/api/rules/postgres-17-combinebackup-lsn-chain-attestation?format=windsurf","agents":"/api/rules/postgres-17-combinebackup-lsn-chain-attestation?format=agents"}},{"id":"openfga-modular-composition-cycle-detection-guardrail","title":"OpenFGA Modular Composition Cycle Detection & Traversal Depth Guardrail","category":"security","severity":"critical","description":"Enforces static acyclic graph (DAG) verification and bounded expansion depth across modular OpenFGA authorization schemas prior to compilation or ingestion. Prevents cross-module cyclic relation references and transitive tuple_to_userset loops that trigger denial-of-service or stack exhaustion in authorization evaluation engines.","antiPatternHeadline":"Unchecked Dynamic Module Composition Permitting Infinite Traversal Recursion Cycles","stars_count":117,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","authorization","graph-algorithms","modular-models","rebac"],"exportEndpoints":{"claude":"/api/rules/openfga-modular-composition-cycle-detection-guardrail?format=claude","cursorMdc":"/api/rules/openfga-modular-composition-cycle-detection-guardrail?format=mdc","cursorrules":"/api/rules/openfga-modular-composition-cycle-detection-guardrail?format=cursor","windsurf":"/api/rules/openfga-modular-composition-cycle-detection-guardrail?format=windsurf","agents":"/api/rules/openfga-modular-composition-cycle-detection-guardrail?format=agents"}},{"id":"ebpf-sockops-netns-boundary-redirection-invariant","title":"eBPF sock_ops L4 Direct Socket Redirection and Namespace Boundary Enforcement","category":"devops","severity":"critical","description":"Mandates strict network namespace (netns) cookie verification, socket state validation, and symmetric hash lifecycle cleanup in eBPF sock_ops and sk_msg programs. Prevents cross-tenant socket hijacking, policy enforcement bypasses, and kernel memory corruption during L4 TCP/IP short-circuiting in sidecarless mesh architectures.","antiPatternHeadline":"Blind 4-Tuple Socket Redirection Without Namespace Cookie Validation and State Cleanup","stars_count":67,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","ambient-mesh","sock-ops","cilium","kernel-security","networking"],"exportEndpoints":{"claude":"/api/rules/ebpf-sockops-netns-boundary-redirection-invariant?format=claude","cursorMdc":"/api/rules/ebpf-sockops-netns-boundary-redirection-invariant?format=mdc","cursorrules":"/api/rules/ebpf-sockops-netns-boundary-redirection-invariant?format=cursor","windsurf":"/api/rules/ebpf-sockops-netns-boundary-redirection-invariant?format=windsurf","agents":"/api/rules/ebpf-sockops-netns-boundary-redirection-invariant?format=agents"}},{"id":"kmp-room-sqlite-wal-concurrency-invariant","title":"KMP Room SQLite WAL Concurrency & POSIX Lock Contention Invariant","category":"mobile","severity":"critical","description":"Prevents POSIX advisory lock collisions (SQLITE_BUSY), coroutine deadlocks, and thread starvation in Kotlin Multiplatform Room databases across iOS and Android runtimes. Mandates explicit Write-Ahead Logging (WAL), calibrated busy-timeout pragmas, and disciplined dispatcher bounds across native SQLite engines.","antiPatternHeadline":"Unbounded coroutine dispatching and missing busy_timeout pragmas causing iOS Darwin POSIX lock contention and SQLITE_BUSY fatal crashes.","stars_count":55,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kmp","room","sqlite","coroutines","wal","ios","android"],"exportEndpoints":{"claude":"/api/rules/kmp-room-sqlite-wal-concurrency-invariant?format=claude","cursorMdc":"/api/rules/kmp-room-sqlite-wal-concurrency-invariant?format=mdc","cursorrules":"/api/rules/kmp-room-sqlite-wal-concurrency-invariant?format=cursor","windsurf":"/api/rules/kmp-room-sqlite-wal-concurrency-invariant?format=windsurf","agents":"/api/rules/kmp-room-sqlite-wal-concurrency-invariant?format=agents"}},{"id":"svelte5-derived-by-untracked-read-boundary","title":"Svelte 5 $derived.by Untracked Read Boundary Isolation","category":"frontend","severity":"critical","description":"Enforces strict isolation of telemetry, logging, and side-channel diagnostic state access inside Svelte 5 `$derived.by` computation blocks using `untrack()`. Failure to wrap non-computational reads registers unwanted reactive dependencies in Svelte's reactive graph, causing re-computation loops and memory leaks.","antiPatternHeadline":"Implicit Tracking of Telemetry and Diagnostics in $derived.by Blocks","stars_count":99,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","state-management","performance","memory-leaks"],"exportEndpoints":{"claude":"/api/rules/svelte5-derived-by-untracked-read-boundary?format=claude","cursorMdc":"/api/rules/svelte5-derived-by-untracked-read-boundary?format=mdc","cursorrules":"/api/rules/svelte5-derived-by-untracked-read-boundary?format=cursor","windsurf":"/api/rules/svelte5-derived-by-untracked-read-boundary?format=windsurf","agents":"/api/rules/svelte5-derived-by-untracked-read-boundary?format=agents"}},{"id":"pg17-failover-slot-sync-logical-replication-guardrail","title":"PostgreSQL 17 Failover Slot Synchronization & Logical Replication Invariants","category":"backend","severity":"critical","description":"Mandates automated failover slot sync (`failover = true` and `sync_replication_slots = true`) across PostgreSQL 17 physical standby nodes to guarantee zero message drop and eliminate duplicate streaming during physical-to-logical cutovers. Prevents subscribers from advancing beyond physical replica lag by strictly configuring `synchronized_standby_slots` on the primary.","antiPatternHeadline":"Creating Logical Replication Slots Without Failover Capabilities Leading to Silent Data Loss or Duplicate Stream Floods on Standby Promotion","stars_count":102,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql-17","logical-replication","failover-slots","cdc","high-availability"],"exportEndpoints":{"claude":"/api/rules/pg17-failover-slot-sync-logical-replication-guardrail?format=claude","cursorMdc":"/api/rules/pg17-failover-slot-sync-logical-replication-guardrail?format=mdc","cursorrules":"/api/rules/pg17-failover-slot-sync-logical-replication-guardrail?format=cursor","windsurf":"/api/rules/pg17-failover-slot-sync-logical-replication-guardrail?format=windsurf","agents":"/api/rules/pg17-failover-slot-sync-logical-replication-guardrail?format=agents"}},{"id":"go124-weak-pointer-cyclic-memory-guardrail","title":"Go 1.24 Weak Pointer & Canonical Cache Memory Retention Standard","category":"backend","severity":"critical","description":"Enforces Go 1.24 native weak pointer runtime primitives (weak.Pointer, weak.Make) across long-lived canonicalizing caches, deduplication tables, and cyclic structures. Eliminates unbounded heap growth, memory leaks from stale cache keys, and finalizer-induced retention cascades caused by cyclic strong references.","antiPatternHeadline":"Unbounded Strong Reference Retention and Finalizer Deadlocks in Long-Lived Interning Structures","stars_count":99,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["go","golang","go1.24","weak-pointers","garbage-collection","memory-management","concurrency"],"exportEndpoints":{"claude":"/api/rules/go124-weak-pointer-cyclic-memory-guardrail?format=claude","cursorMdc":"/api/rules/go124-weak-pointer-cyclic-memory-guardrail?format=mdc","cursorrules":"/api/rules/go124-weak-pointer-cyclic-memory-guardrail?format=cursor","windsurf":"/api/rules/go124-weak-pointer-cyclic-memory-guardrail?format=windsurf","agents":"/api/rules/go124-weak-pointer-cyclic-memory-guardrail?format=agents"}},{"id":"webauthn-largeblob-encrypted-session-anchor-standard","title":"WebAuthn LargeBlob Extension Client-Side Encrypted Session Anchor Standard","category":"security","severity":"critical","description":"Governs the storage, retrieval, and cryptographic envelope lifecycle of hardware-attested, client-side encryption roots using the WebAuthn largeBlob extension. Mandates authenticated symmetric encryption (AES-256-GCM or ChaCha20-Poly1305) with ephemeral, derived keys before persisting session state or credentials to the authenticator, guaranteeing zero-knowledge offline authentication states resistant to device-level snooping and cross-origin leakage.","antiPatternHeadline":"Persisting Plaintext Session Tokens or Using Static Authenticator-Derived Keys Directly in WebAuthn largeBlob Payloads","stars_count":115,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","largeblob","cryptography","zero-knowledge","passkeys"],"exportEndpoints":{"claude":"/api/rules/webauthn-largeblob-encrypted-session-anchor-standard?format=claude","cursorMdc":"/api/rules/webauthn-largeblob-encrypted-session-anchor-standard?format=mdc","cursorrules":"/api/rules/webauthn-largeblob-encrypted-session-anchor-standard?format=cursor","windsurf":"/api/rules/webauthn-largeblob-encrypted-session-anchor-standard?format=windsurf","agents":"/api/rules/webauthn-largeblob-encrypted-session-anchor-standard?format=agents"}},{"id":"kmp-native-memory-pacing-sweeper-invariant","title":"Kotlin Multiplatform Native Memory Pacing and Concurrent Sweeper Guardrail","category":"mobile","severity":"critical","description":"Enforces strict backpressure pacing on high-throughput background pipelines in Kotlin Multiplatform targeting Darwin/iOS. Binds rapid object allocations to the Kotlin/Native concurrent garbage collector's epoch sweep phases to eliminate UI hitching and safeguard Darwin main-thread CADisplayLink frame budgets.","antiPatternHeadline":"Unbounded Background Ingestion Overwhelming Kotlin/Native Concurrent GC Epochs","stars_count":72,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kmp","kotlin-native","garbage-collection","memory-management","ios-performance"],"exportEndpoints":{"claude":"/api/rules/kmp-native-memory-pacing-sweeper-invariant?format=claude","cursorMdc":"/api/rules/kmp-native-memory-pacing-sweeper-invariant?format=mdc","cursorrules":"/api/rules/kmp-native-memory-pacing-sweeper-invariant?format=cursor","windsurf":"/api/rules/kmp-native-memory-pacing-sweeper-invariant?format=windsurf","agents":"/api/rules/kmp-native-memory-pacing-sweeper-invariant?format=agents"}},{"id":"otel-profiling-cpu-budget-pprof-ceiling","title":"OpenTelemetry eBPF Continuous Profiling Budget and Lossy Pprof Tail-Sampling Ceiling","category":"devops","severity":"critical","description":"Enforces strict resource limits on OpenTelemetry eBPF-based continuous profiling agents to cap kernel-space and user-space overhead at under 1% total CPU utilization. Mandates downstream collector pipelines to enforce lossy tail-sampling and backpressure ceilings on pprof ingestion to prevent collector OOM crashes during stack trace fan-out storms.","antiPatternHeadline":"Unbounded eBPF sample rates causing collector OOMs and >5% CPU overhead in production nodes","stars_count":117,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","ebpf","profiling","pprof","kubernetes","tail-sampling"],"exportEndpoints":{"claude":"/api/rules/otel-profiling-cpu-budget-pprof-ceiling?format=claude","cursorMdc":"/api/rules/otel-profiling-cpu-budget-pprof-ceiling?format=mdc","cursorrules":"/api/rules/otel-profiling-cpu-budget-pprof-ceiling?format=cursor","windsurf":"/api/rules/otel-profiling-cpu-budget-pprof-ceiling?format=windsurf","agents":"/api/rules/otel-profiling-cpu-budget-pprof-ceiling?format=agents"}},{"id":"react-19-server-action-optimistic-watermark","title":"React 19 Server Action Optimistic State Watermark Reconciliation Guardrail","category":"frontend","severity":"critical","description":"Mandates monotonic sequence watermarking for all concurrent React 19 Server Actions interacting with optimistic UI state. Prevents out-of-order streaming server resolutions from stomping newer optimistic writes or executing stale rollbacks that corrupt user-perceived state.","antiPatternHeadline":"Unsequenced Concurrent Server Actions Causing Stale Overwrites and Phantom Rollbacks","stars_count":101,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","server-actions","optimistic-ui","state-reconciliation","concurrency"],"exportEndpoints":{"claude":"/api/rules/react-19-server-action-optimistic-watermark?format=claude","cursorMdc":"/api/rules/react-19-server-action-optimistic-watermark?format=mdc","cursorrules":"/api/rules/react-19-server-action-optimistic-watermark?format=cursor","windsurf":"/api/rules/react-19-server-action-optimistic-watermark?format=windsurf","agents":"/api/rules/react-19-server-action-optimistic-watermark?format=agents"}},{"id":"sigstore-ephemeral-oidc-slsa3-attestation-invariant","title":"Sigstore Ephemeral OIDC Workload Identity & SLSA Level 3 Provenance Invariant","category":"security","severity":"critical","description":"Mandates keyless, short-lived OIDC-backed Fulcio certificates and Rekor transparency log entries for all containerized build artifacts emitted from isolated CI/CD workflows. Prohibits static long-lived private keys, service account secrets, and unverified build provenance in favor of non-forgeable SLSA Level 3 predicate generation. Guarantees immutable supply chain traceability from source commit SHA to container digest without secret leakage risks.","antiPatternHeadline":"Static Secret Signing and Unattested Container Emission in CI Pipelines","stars_count":114,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","sigstore","slsa-level-3","oidc","cosign","supply-chain-security"],"exportEndpoints":{"claude":"/api/rules/sigstore-ephemeral-oidc-slsa3-attestation-invariant?format=claude","cursorMdc":"/api/rules/sigstore-ephemeral-oidc-slsa3-attestation-invariant?format=mdc","cursorrules":"/api/rules/sigstore-ephemeral-oidc-slsa3-attestation-invariant?format=cursor","windsurf":"/api/rules/sigstore-ephemeral-oidc-slsa3-attestation-invariant?format=windsurf","agents":"/api/rules/sigstore-ephemeral-oidc-slsa3-attestation-invariant?format=agents"}},{"id":"bun-worker-zero-copy-arraybuffer-transfer","title":"Bun Clustered Worker Zero-Copy ArrayBuffer Transfer Standard","category":"backend","severity":"critical","description":"Enforces transfer-of-ownership semantics over structural cloning across worker boundaries in multi-threaded Bun microservices. By passing transferable objects via postMessage transfer lists, worker communication bypasses memory duplication, eradicating IPC latency and garbage collection fragmentation under high-throughput network I/O workloads.","antiPatternHeadline":"Implicit Structural Cloning of Binary Payloads Across Bun Worker Threads","stars_count":96,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","multithreading","web-workers","zero-copy","performance","memory-management"],"exportEndpoints":{"claude":"/api/rules/bun-worker-zero-copy-arraybuffer-transfer?format=claude","cursorMdc":"/api/rules/bun-worker-zero-copy-arraybuffer-transfer?format=mdc","cursorrules":"/api/rules/bun-worker-zero-copy-arraybuffer-transfer?format=cursor","windsurf":"/api/rules/bun-worker-zero-copy-arraybuffer-transfer?format=windsurf","agents":"/api/rules/bun-worker-zero-copy-arraybuffer-transfer?format=agents"}},{"id":"tauri2-gpu-surface-composition-boundary-guardrail","title":"Tauri 2.0 Webview Hardware Acceleration Isolation and Surface Composition Boundary","category":"mobile","severity":"critical","description":"Enforces strict process isolation for GPU surface compositing across multi-window Tauri 2.0 mobile and desktop shells. Mandates offscreen rendering pipelines communicate via native cross-process texture primitives or shared memory handles rather than raw UI-thread canvas synchronization, eliminating frame jank and main thread deadlock.","antiPatternHeadline":"UI-Thread Stalling via Direct Webview Shared Canvas Contexts and Unbuffered Texture Blitting","stars_count":52,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri-2.0","webgl","gpu-compositing","hardware-acceleration","ipc-surface"],"exportEndpoints":{"claude":"/api/rules/tauri2-gpu-surface-composition-boundary-guardrail?format=claude","cursorMdc":"/api/rules/tauri2-gpu-surface-composition-boundary-guardrail?format=mdc","cursorrules":"/api/rules/tauri2-gpu-surface-composition-boundary-guardrail?format=cursor","windsurf":"/api/rules/tauri2-gpu-surface-composition-boundary-guardrail?format=windsurf","agents":"/api/rules/tauri2-gpu-surface-composition-boundary-guardrail?format=agents"}},{"id":"axum-08-tower-graceful-drain-cancellation-propagation","title":"Axum 0.8 Tower Graceful Drain & CancellationToken Propagation Guardrail","category":"backend","severity":"critical","description":"Mandates explicit CancellationToken propagation, TaskTracker integration, and bounded connection draining across all Axum 0.8 Tower services and streaming handlers (SSE, long-polling, WebSockets). Guarantees zero dropped in-flight requests, prevents infinite drain deadlocks, and eliminates memory leaks during zero-downtime rolling deployments under heavy concurrent asynchronous traffic.","antiPatternHeadline":"Unbounded Streaming Handlers and Detached Tasks Blocking Axum Graceful Server Drain","stars_count":87,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tower","tokio","graceful-shutdown","sse"],"exportEndpoints":{"claude":"/api/rules/axum-08-tower-graceful-drain-cancellation-propagation?format=claude","cursorMdc":"/api/rules/axum-08-tower-graceful-drain-cancellation-propagation?format=mdc","cursorrules":"/api/rules/axum-08-tower-graceful-drain-cancellation-propagation?format=cursor","windsurf":"/api/rules/axum-08-tower-graceful-drain-cancellation-propagation?format=windsurf","agents":"/api/rules/axum-08-tower-graceful-drain-cancellation-propagation?format=agents"}},{"id":"nextjs15-ppr-dynamic-hole-isolation","title":"Next.js 15 Partial Prerendering (PPR) Dynamic Hole Hydration Boundary Isolation","category":"frontend","severity":"critical","description":"Enforces strict isolation of dynamic data access within Suspense boundaries under Next.js 15 Partial Prerendering (PPR). Prevents dynamic execution leakage that de-optimizes static edge shell prerendering when accessing headers, cookies, or high-latency downstream microservices.","antiPatternHeadline":"Dynamic execution leakage poisoning the static PPR edge shell via uncontained runtime hooks or top-level promises","stars_count":87,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs15","ppr","react19","suspense","edge-computing","performance"],"exportEndpoints":{"claude":"/api/rules/nextjs15-ppr-dynamic-hole-isolation?format=claude","cursorMdc":"/api/rules/nextjs15-ppr-dynamic-hole-isolation?format=mdc","cursorrules":"/api/rules/nextjs15-ppr-dynamic-hole-isolation?format=cursor","windsurf":"/api/rules/nextjs15-ppr-dynamic-hole-isolation?format=windsurf","agents":"/api/rules/nextjs15-ppr-dynamic-hole-isolation?format=agents"}},{"id":"cmp-skiko-metal-vulkan-lifecycle-reclamation","title":"Compose Multiplatform Skiko GPU Canvas Lifecycle & Context Reclamation","category":"mobile","severity":"critical","description":"Enforces deterministic teardown and reclamation of Skiko native GPU graphics contexts (Metal on iOS, Vulkan/OpenGL on Android) during mobile app backgrounding transitions. Prevents fatal GPU driver aborts (e.g., Metal command buffer invalidation, Vulkan out-of-date swapchains) and native memory leaks in custom Compose Multiplatform Skia/Canvas drawing pipelines.","antiPatternHeadline":"Retaining active Skia GrDirectContext, native GPU surfaces, or unmanaged RenderTargets across app suspension cycles","stars_count":66,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","compose-multiplatform","skiko","metal","vulkan","memory-management","lifecycle"],"exportEndpoints":{"claude":"/api/rules/cmp-skiko-metal-vulkan-lifecycle-reclamation?format=claude","cursorMdc":"/api/rules/cmp-skiko-metal-vulkan-lifecycle-reclamation?format=mdc","cursorrules":"/api/rules/cmp-skiko-metal-vulkan-lifecycle-reclamation?format=cursor","windsurf":"/api/rules/cmp-skiko-metal-vulkan-lifecycle-reclamation?format=windsurf","agents":"/api/rules/cmp-skiko-metal-vulkan-lifecycle-reclamation?format=agents"}},{"id":"oauth2-dpop-sender-constrained-nonce-replay-guardrail","title":"OAuth 2.1 Sender-Constrained DPoP Nonce-Bound Token Replay Protection","category":"security","severity":"critical","description":"Mandates RFC 9449 Demonstrating Proof-of-Possession (DPoP) with dynamic server-nonce verification for OAuth 2.1 tokens across web and mobile clients. Prevents token theft and replay attacks arising from client-side XSS by cryptographically binding access tokens to non-extractable client-side asymmetric key pairs. Forbids standard ambient bearer tokens in high-assurance boundary interfaces.","antiPatternHeadline":"Transmitting Unconstrained Bearer Tokens or Omitting Server-Nonce DPoP Proof Handshakes","stars_count":106,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","oauth2","dpop","rfc9449","webcrypto","anti-replay","zero-trust"],"exportEndpoints":{"claude":"/api/rules/oauth2-dpop-sender-constrained-nonce-replay-guardrail?format=claude","cursorMdc":"/api/rules/oauth2-dpop-sender-constrained-nonce-replay-guardrail?format=mdc","cursorrules":"/api/rules/oauth2-dpop-sender-constrained-nonce-replay-guardrail?format=cursor","windsurf":"/api/rules/oauth2-dpop-sender-constrained-nonce-replay-guardrail?format=windsurf","agents":"/api/rules/oauth2-dpop-sender-constrained-nonce-replay-guardrail?format=agents"}},{"id":"cilium-ebpf-sidecarless-spiffe-attestation-guardrail","title":"eBPF Cilium Sidecarless SPIFFE Workload Identity Attestation Guardrail","category":"devops","severity":"critical","description":"Enforces non-bypassable, kernel-level cryptographic identity verification across Kubernetes microservices using Cilium eBPF and SPIRE. Eliminates sidecar proxy CPU, memory, and latency overheads by delegating mutual workload attestation and mTLS handshakes directly to the node-level eBPF socket layer.","antiPatternHeadline":"Injecting Per-Pod Envoy Sidecars and Insecure Host-IP Network Policies Lacking Cryptographic Identity","stars_count":50,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","cilium","ebpf","spiffe","spire","kubernetes","zero-trust"],"exportEndpoints":{"claude":"/api/rules/cilium-ebpf-sidecarless-spiffe-attestation-guardrail?format=claude","cursorMdc":"/api/rules/cilium-ebpf-sidecarless-spiffe-attestation-guardrail?format=mdc","cursorrules":"/api/rules/cilium-ebpf-sidecarless-spiffe-attestation-guardrail?format=cursor","windsurf":"/api/rules/cilium-ebpf-sidecarless-spiffe-attestation-guardrail?format=windsurf","agents":"/api/rules/cilium-ebpf-sidecarless-spiffe-attestation-guardrail?format=agents"}},{"id":"postgres-17-logical-replication-parallel-apply-guardrail","title":"Postgres 17 Parallel Apply Conflict Matrix & Partition Streaming Invariants","category":"backend","severity":"critical","description":"Prevents transaction serialization deadlocks, cross-worker lock inversion, and silent out-of-order data corruption when streaming high-throughput partition updates across distributed Postgres 17 clusters. Enforces publish_via_partition_root invariants, deterministic parallel apply boundaries, and monotonic version reconciliation.","antiPatternHeadline":"Uncoordinated Parallel Apply on Distributed Partitioned Tables Triggering Cross-Worker Deadlocks and Split-Brain Overwrites","stars_count":108,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql-17","logical-replication","parallel-apply","partitioning","distributed-databases"],"exportEndpoints":{"claude":"/api/rules/postgres-17-logical-replication-parallel-apply-guardrail?format=claude","cursorMdc":"/api/rules/postgres-17-logical-replication-parallel-apply-guardrail?format=mdc","cursorrules":"/api/rules/postgres-17-logical-replication-parallel-apply-guardrail?format=cursor","windsurf":"/api/rules/postgres-17-logical-replication-parallel-apply-guardrail?format=windsurf","agents":"/api/rules/postgres-17-logical-replication-parallel-apply-guardrail?format=agents"}},{"id":"otel-genai-payload-pii-redaction-pipeline-guardrail","title":"OTel GenAI Semantic Conventions Payload PII Redaction Pipeline Guardrail","category":"devops","severity":"critical","description":"Enforces pre-ingestion PII scrubbing and strict GenAI semantic convention enforcement across distributed tracing pipelines. Prevents raw user inputs, completion payloads, and dynamic prompt templates from reaching multi-tenant telemetry backends without cryptographically assured token masking and OpenTelemetry Collector transform processor validation.","antiPatternHeadline":"Leaking Unsanitized GenAI Prompt and Completion Payloads Directly into Multi-Tenant Observability Backends","stars_count":98,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","genai","pii-redaction","data-privacy","tracing","collector"],"exportEndpoints":{"claude":"/api/rules/otel-genai-payload-pii-redaction-pipeline-guardrail?format=claude","cursorMdc":"/api/rules/otel-genai-payload-pii-redaction-pipeline-guardrail?format=mdc","cursorrules":"/api/rules/otel-genai-payload-pii-redaction-pipeline-guardrail?format=cursor","windsurf":"/api/rules/otel-genai-payload-pii-redaction-pipeline-guardrail?format=windsurf","agents":"/api/rules/otel-genai-payload-pii-redaction-pipeline-guardrail?format=agents"}},{"id":"react19-metadata-hoisting-sri-pinning","title":"React 19 Document Head Metadata Hoisting and Subresource Integrity Pinning","category":"frontend","severity":"critical","description":"Enforces deterministic cryptographic Subresource Integrity (SRI) validation and explicit precedence tagging for dynamically hoisted stylesheets, scripts, and preloads in React 19. Prevents hydration mismatches, supply-chain script tampering, and unpinned layout shifts when the React runtime reconciles native DOM head tags against server-rendered asset manifests.","antiPatternHeadline":"Dynamic head hoisting without cryptographic hash validation or missing React precedence markers.","stars_count":93,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","security","subresource-integrity","metadata-hoisting","hydration"],"exportEndpoints":{"claude":"/api/rules/react19-metadata-hoisting-sri-pinning?format=claude","cursorMdc":"/api/rules/react19-metadata-hoisting-sri-pinning?format=mdc","cursorrules":"/api/rules/react19-metadata-hoisting-sri-pinning?format=cursor","windsurf":"/api/rules/react19-metadata-hoisting-sri-pinning?format=windsurf","agents":"/api/rules/react19-metadata-hoisting-sri-pinning?format=agents"}},{"id":"capacitor7-jsi-bridge-pacing-memory-quarantine","title":"Capacitor 7 JSI Native Bridge Thread Pacing and Memory Quarantine","category":"mobile","severity":"critical","description":"Enforces bounded chunking, asynchronous backpressure pacing, and immediate heap quarantine during high-throughput binary transfers over the Capacitor 7 bridge. Eliminates WebKit main-thread micro-stutters and prevents mobile OS Jetsam and low-memory killer (LMK) process terminations caused by transient ArrayBuffer and Base64 allocation bursts.","antiPatternHeadline":"Unthrottled Raw Binary Marshaling and Unbounded Bridge Ingestion Saturation","stars_count":47,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","jsi","memory-management","webkit","performance"],"exportEndpoints":{"claude":"/api/rules/capacitor7-jsi-bridge-pacing-memory-quarantine?format=claude","cursorMdc":"/api/rules/capacitor7-jsi-bridge-pacing-memory-quarantine?format=mdc","cursorrules":"/api/rules/capacitor7-jsi-bridge-pacing-memory-quarantine?format=cursor","windsurf":"/api/rules/capacitor7-jsi-bridge-pacing-memory-quarantine?format=windsurf","agents":"/api/rules/capacitor7-jsi-bridge-pacing-memory-quarantine?format=agents"}},{"id":"fido2-enterprise-attestation-aaguid-mandate","title":"FIDO2 Enterprise Attestation and Hardware-Bound AAGUID Enforcement","category":"security","severity":"critical","description":"Enforces strict cryptographic guarantees against multi-device cloud-synced passkeys on high-privilege IAM scopes. Mandates direct or enterprise WebAuthn attestation verification, explicit FIDO Alliance Metadata Service (MDS3) AAGUID allowlisting, and verification that credential backup eligibility (BE) and backup state (BS) flags are strictly zero. Guarantees that only physical, non-exportable hardware authenticators (e.g., YubiKey, Google Titan) can access enterprise-tier administrative operations.","antiPatternHeadline":"Permitting Synced Multi-Device Passkeys with 'none' Attestation in High-Privilege Workflows","stars_count":61,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","fido2","passkeys","iam","attestation","zero-trust"],"exportEndpoints":{"claude":"/api/rules/fido2-enterprise-attestation-aaguid-mandate?format=claude","cursorMdc":"/api/rules/fido2-enterprise-attestation-aaguid-mandate?format=mdc","cursorrules":"/api/rules/fido2-enterprise-attestation-aaguid-mandate?format=cursor","windsurf":"/api/rules/fido2-enterprise-attestation-aaguid-mandate?format=windsurf","agents":"/api/rules/fido2-enterprise-attestation-aaguid-mandate?format=agents"}},{"id":"webauthn-prf-key-derivation-standard","title":"WebAuthn Level 3 PRF Hardware-Bound Zero-Knowledge Key Derivation","category":"security","severity":"critical","description":"Enforces strict cryptographic invariants for WebAuthn Level 3 PRF (Pseudo-Random Function) extension usage to derive symmetric encryption keys directly within authenticator hardware. Guarantees client-side zero-knowledge execution by isolating salt inputs and ephemeral outputs, mandating HKDF expansion into non-exportable CryptoKey objects, and immediately zeroizing transient memory buffers.","antiPatternHeadline":"Deriving master cryptographic secrets via software KDFs using raw credential IDs or exporting PRF evaluation outputs to plain strings in memory","stars_count":45,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","prf-extension","fido2","webcrypto","zero-knowledge"],"exportEndpoints":{"claude":"/api/rules/webauthn-prf-key-derivation-standard?format=claude","cursorMdc":"/api/rules/webauthn-prf-key-derivation-standard?format=mdc","cursorrules":"/api/rules/webauthn-prf-key-derivation-standard?format=cursor","windsurf":"/api/rules/webauthn-prf-key-derivation-standard?format=windsurf","agents":"/api/rules/webauthn-prf-key-derivation-standard?format=agents"}},{"id":"vite6-environment-api-ssr-sandboxing-vite-6-environme-144","title":"Vite 6 Environment API Heterogeneous SSR Sandboxing Invariant","category":"frontend","severity":"critical","description":"Enforces absolute module graph separation and runtime boundary isolation across client, Node SSR, and edge runtimes using Vite 6's Environment API. Eliminates leakage of server-only primitives, Node.js native built-ins, and secure credentials into client bundle targets or client HMR channels. Mandates environment-conditioned plugin execution and strict per-environment resolve conditions.","antiPatternHeadline":"Cross-Environment Module Graph Contamination and Server Primitive Leakage in Vite 6 SSR","stars_count":48,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","vite6","ssr","environment-api","sandboxing","security"],"exportEndpoints":{"claude":"/api/rules/vite6-environment-api-ssr-sandboxing-vite-6-environme-144?format=claude","cursorMdc":"/api/rules/vite6-environment-api-ssr-sandboxing-vite-6-environme-144?format=mdc","cursorrules":"/api/rules/vite6-environment-api-ssr-sandboxing-vite-6-environme-144?format=cursor","windsurf":"/api/rules/vite6-environment-api-ssr-sandboxing-vite-6-environme-144?format=windsurf","agents":"/api/rules/vite6-environment-api-ssr-sandboxing-vite-6-environme-144?format=agents"}},{"id":"axum-0-8-tower-cancellation-token-cascade-guardrail","title":"Axum 0.8 Tower CancellationToken Cascade and Cooperative Drain Invariant","category":"backend","severity":"critical","description":"Guarantees deterministic client disconnect propagation and bounded worker pool drainage across nested Tower layers during rolling zero-downtime redeployments. Enforces hierarchical CancellationToken cascading and tokio_util::task::TaskTracker lifecycle bounds to prevent orphaned zombie tasks and redeployment timeouts in Axum 0.8 services.","antiPatternHeadline":"Detached Tokio Spawns and Unbounded Mid-Flight Request Leaks During Rolling Pod Drain","stars_count":88,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tower","tokio","concurrency"],"exportEndpoints":{"claude":"/api/rules/axum-0-8-tower-cancellation-token-cascade-guardrail?format=claude","cursorMdc":"/api/rules/axum-0-8-tower-cancellation-token-cascade-guardrail?format=mdc","cursorrules":"/api/rules/axum-0-8-tower-cancellation-token-cascade-guardrail?format=cursor","windsurf":"/api/rules/axum-0-8-tower-cancellation-token-cascade-guardrail?format=windsurf","agents":"/api/rules/axum-0-8-tower-cancellation-token-cascade-guardrail?format=agents"}},{"id":"kmp-compose-skiko-metal-triple-buffering-boundary-guardrail","title":"KMP Skiko Metal Triple-Buffering & CADisplayLink Boundary Guardrail","category":"mobile","severity":"critical","description":"Mandates strict decoupling of asynchronous background state mutations from Compose Skiko Metal render pipelines on high-refresh-rate displays. Prevents CAMetalLayer drawable exhaustion, thread priority inversion, and CADisplayLink drops caused by unthrottled snapshot state updates contending with 120Hz frame synchronization.","antiPatternHeadline":"Unthrottled Snapshot Invalidation Contending with Skiko Metal Render Loop and Starving Drawables","stars_count":67,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kmp","compose-multiplatform","skiko","metal","ios-performance","concurrency"],"exportEndpoints":{"claude":"/api/rules/kmp-compose-skiko-metal-triple-buffering-boundary-guardrail?format=claude","cursorMdc":"/api/rules/kmp-compose-skiko-metal-triple-buffering-boundary-guardrail?format=mdc","cursorrules":"/api/rules/kmp-compose-skiko-metal-triple-buffering-boundary-guardrail?format=cursor","windsurf":"/api/rules/kmp-compose-skiko-metal-triple-buffering-boundary-guardrail?format=windsurf","agents":"/api/rules/kmp-compose-skiko-metal-triple-buffering-boundary-guardrail?format=agents"}},{"id":"postgres-17-memory-context-json-table-parallel-scans","title":"Postgres 17 MemoryContext Guardrails for JSON_TABLE Parallel Scans","category":"backend","severity":"critical","description":"Enforces strict session-level memory boundaries and execution limits when utilizing Postgres 17 JSON_TABLE inside parallel query plans. Prevents runaway executor MemoryContext bloat and OOM-induced cascading worker process terminations during deep nested JSON path evaluations. Mandates explicit work_mem bounds, worker count caps, and streaming batch wrappers for high-cardinality JSON transformations.","antiPatternHeadline":"Unbounded parallel worker JSON_TABLE scans exhausting OS RAM and causing backend OOM panic","stars_count":116,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres","json-table","memory-management","sql","performance"],"exportEndpoints":{"claude":"/api/rules/postgres-17-memory-context-json-table-parallel-scans?format=claude","cursorMdc":"/api/rules/postgres-17-memory-context-json-table-parallel-scans?format=mdc","cursorrules":"/api/rules/postgres-17-memory-context-json-table-parallel-scans?format=cursor","windsurf":"/api/rules/postgres-17-memory-context-json-table-parallel-scans?format=windsurf","agents":"/api/rules/postgres-17-memory-context-json-table-parallel-scans?format=agents"}},{"id":"cilium-ebpf-ringbuffer-backpressure-quarantine","title":"Cilium eBPF Ring-Buffer Backpressure and Drop-Quarantine Invariant","category":"devops","severity":"critical","description":"Enforces non-blocking ring-buffer reservations and zero-stack-overflow drop quarantine semantics across Cilium eBPF datapath hooks. Eliminates kernel-level packet loss and silent tail-drops during microburst network saturation by decoupling telemetry sampling from the fast path and routing exhausted allocations to lockless per-CPU quarantine counters.","antiPatternHeadline":"Spinning on Full eBPF Ring Buffers or Spillover Stack Allocations During Microbursts","stars_count":72,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","cilium","ebpf","networking","kernel","kubernetes"],"exportEndpoints":{"claude":"/api/rules/cilium-ebpf-ringbuffer-backpressure-quarantine?format=claude","cursorMdc":"/api/rules/cilium-ebpf-ringbuffer-backpressure-quarantine?format=mdc","cursorrules":"/api/rules/cilium-ebpf-ringbuffer-backpressure-quarantine?format=cursor","windsurf":"/api/rules/cilium-ebpf-ringbuffer-backpressure-quarantine?format=windsurf","agents":"/api/rules/cilium-ebpf-ringbuffer-backpressure-quarantine?format=agents"}},{"id":"capacitor-7-strongbox-hardware-keystore-isolation-standard","title":"Capacitor 7 StrongBox Attestation and Hardware Keystore Isolation Standard","category":"mobile","severity":"critical","description":"Enforces zero-trust cryptographic isolation in Capacitor 7 hybrid applications by disallowing plaintext token or symmetric key persistence in the JavaScript WebView runtime. Mandates that cryptographic material and high-entropy authentication tokens are strictly bound to hardware-backed secure elements (Android StrongBox Keymaster/KeyMint and Apple Secure Enclave) via native bridging with mandatory remote key attestation.","antiPatternHeadline":"Persisting Long-Lived Session Secrets and Private Keys in WebView LocalStorage, IndexedDB, or Unprotected Capacitor Preferences","stars_count":70,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor-7","strongbox","secure-enclave","keystore","attestation","zero-trust"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-strongbox-hardware-keystore-isolation-standard?format=claude","cursorMdc":"/api/rules/capacitor-7-strongbox-hardware-keystore-isolation-standard?format=mdc","cursorrules":"/api/rules/capacitor-7-strongbox-hardware-keystore-isolation-standard?format=cursor","windsurf":"/api/rules/capacitor-7-strongbox-hardware-keystore-isolation-standard?format=windsurf","agents":"/api/rules/capacitor-7-strongbox-hardware-keystore-isolation-standard?format=agents"}},{"id":"otel-tail-sampling-span-link-preservation-production-standard","title":"OpenTelemetry Distributed Trace Tail-Sampling Invariant with Span Link Preservation","category":"devops","severity":"critical","description":"Enforces trace context propagation and span linking invariants across asynchronous boundary queues while guaranteeing deterministic trace routing across autonomous tail-sampling collector clusters. Mandates the use of OpenTelemetry span links for decoupled consumer operations alongside load-balancing collector routing keyed by trace ID to prevent causal graph fragmentation and orphaned downstream error traces.","antiPatternHeadline":"Asymmetric Tail-Sampling Eviction and Fragmented DAG Parentage Across Message Queues","stars_count":112,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","tail-sampling","distributed-tracing","observability","message-queues"],"exportEndpoints":{"claude":"/api/rules/otel-tail-sampling-span-link-preservation-production-standard?format=claude","cursorMdc":"/api/rules/otel-tail-sampling-span-link-preservation-production-standard?format=mdc","cursorrules":"/api/rules/otel-tail-sampling-span-link-preservation-production-standard?format=cursor","windsurf":"/api/rules/otel-tail-sampling-span-link-preservation-production-standard?format=windsurf","agents":"/api/rules/otel-tail-sampling-span-link-preservation-production-standard?format=agents"}},{"id":"go124-weak-pointer-session-cache-standard","title":"Go 1.24 Weak Pointer Cache Eviction and Zero-Allocation Session Standard","category":"backend","severity":"critical","description":"Mandates the use of Go 1.24 weak pointers (weak.Pointer) for ephemeral in-memory session caches to eliminate GC finalizer latency and memory retention leaks. Prohibits runtime.SetFinalizer and strong-pointer map retention, ensuring deterministic reclamation of ephemeral session states without triggering stop-the-world or allocation spikes under heavy loads.","antiPatternHeadline":"Retaining Strong References in In-Memory Maps and Relying on runtime.SetFinalizer for Ephemeral Session Cleanup","stars_count":86,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","golang","go124","weak-pointer","zero-allocation","memory-management","performance"],"exportEndpoints":{"claude":"/api/rules/go124-weak-pointer-session-cache-standard?format=claude","cursorMdc":"/api/rules/go124-weak-pointer-session-cache-standard?format=mdc","cursorrules":"/api/rules/go124-weak-pointer-session-cache-standard?format=cursor","windsurf":"/api/rules/go124-weak-pointer-session-cache-standard?format=windsurf","agents":"/api/rules/go124-weak-pointer-session-cache-standard?format=agents"}},{"id":"svelte5-effect-root-microfrontend-disposal-invariant","title":"Svelte 5 Runes $effect.root Scope Disposal Invariant in Microfrontend Shells","category":"frontend","severity":"critical","description":"Microfrontend hosts and dynamic adapters initializing Svelte 5 runtimes outside standard component hierarchies MUST encapsulate all manual reactive contexts within `$effect.root` and bind the returned teardown closure directly to the shell's unmount lifecycle. Failing to invoke root disposal locks signal dependency graphs into memory, producing zombie reactive triggers, event loop bloat, and unbounded heap growth during rapid mount/unmount cycles.","antiPatternHeadline":"Dangling $effect.root Allocations and Uncollected Reactive Contexts in Dynamic Shell Adapters","stars_count":66,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","microfrontends","reactivity","memory-leaks"],"exportEndpoints":{"claude":"/api/rules/svelte5-effect-root-microfrontend-disposal-invariant?format=claude","cursorMdc":"/api/rules/svelte5-effect-root-microfrontend-disposal-invariant?format=mdc","cursorrules":"/api/rules/svelte5-effect-root-microfrontend-disposal-invariant?format=cursor","windsurf":"/api/rules/svelte5-effect-root-microfrontend-disposal-invariant?format=windsurf","agents":"/api/rules/svelte5-effect-root-microfrontend-disposal-invariant?format=agents"}},{"id":"react19-useactionstate-concurrent-transition-guardrail","title":"React 19 useActionState Concurrent Transition Reconciliation & Optimistic Serialization Standard","category":"frontend","severity":"critical","description":"Enforces strict monotonic sequencing and reconciliation boundaries for React 19 useActionState and useOptimistic primitives when handling concurrent transition updates over overlapping entity trees. Prevents out-of-order execution, stale state regressions, and flash-of-stale-content (FOSC) artifacts caused by uncoordinated async Server Actions. Mandates explicit transition boundaries and transactional rollback reconciliation vectors.","antiPatternHeadline":"Overlapping Independent useActionState Actions Cause Stale Closures and Optimistic UI Tearing","stars_count":109,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react19","useActionState","useOptimistic","concurrency","transitions"],"exportEndpoints":{"claude":"/api/rules/react19-useactionstate-concurrent-transition-guardrail?format=claude","cursorMdc":"/api/rules/react19-useactionstate-concurrent-transition-guardrail?format=mdc","cursorrules":"/api/rules/react19-useactionstate-concurrent-transition-guardrail?format=cursor","windsurf":"/api/rules/react19-useactionstate-concurrent-transition-guardrail?format=windsurf","agents":"/api/rules/react19-useactionstate-concurrent-transition-guardrail?format=agents"}},{"id":"postgres-17-direct-io-vector-streaming-read-invariant","title":"PostgreSQL 17 Direct I/O Vector Streaming Read Guardrail","category":"backend","severity":"critical","description":"Enforces kernel page-cache bypass and streaming read optimization for analytical and high-dimensional vector scans in PostgreSQL 17 environments. Prevents large HNSW and IVFFlat index scans and table sweeps from evicting hot OLTP buffer pool and OS page-cache pages by configuring direct I/O and synchronous streaming flags at the connection or transaction boundary.","antiPatternHeadline":"Executing Unbuffered High-Dimensional Vector Queries on Primary OLTP Connection Pools Without Direct I/O or Buffer Pool Segregation","stars_count":110,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql-17","pgvector","direct-io","io-concurrency","buffer-cache"],"exportEndpoints":{"claude":"/api/rules/postgres-17-direct-io-vector-streaming-read-invariant?format=claude","cursorMdc":"/api/rules/postgres-17-direct-io-vector-streaming-read-invariant?format=mdc","cursorrules":"/api/rules/postgres-17-direct-io-vector-streaming-read-invariant?format=cursor","windsurf":"/api/rules/postgres-17-direct-io-vector-streaming-read-invariant?format=windsurf","agents":"/api/rules/postgres-17-direct-io-vector-streaming-read-invariant?format=agents"}},{"id":"bun-sqlite-wal-clustered-snapshot-isolation","title":"Bun 1.2 Native SQLite WAL Clustered Snapshot Isolation Standard","category":"backend","severity":"critical","description":"Enforces deterministic MVCC read snapshot isolation and eliminates write lock escalation deadlocks across high-throughput Bun worker clusters sharing native SQLite storage. Mandates explicit PRAGMA WAL initialization, strict IMMEDIATE transaction boundaries for all mutating flows, and deterministic snapshot closure to prevent WAL file accumulation and SQLITE_BUSY starvation.","antiPatternHeadline":"Deferred Read-to-Write Lock Escalation and Unbounded Snapshots Under Clustered Bun Concurrency","stars_count":101,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","sqlite","wal","mvcc","concurrency","clustering"],"exportEndpoints":{"claude":"/api/rules/bun-sqlite-wal-clustered-snapshot-isolation?format=claude","cursorMdc":"/api/rules/bun-sqlite-wal-clustered-snapshot-isolation?format=mdc","cursorrules":"/api/rules/bun-sqlite-wal-clustered-snapshot-isolation?format=cursor","windsurf":"/api/rules/bun-sqlite-wal-clustered-snapshot-isolation?format=windsurf","agents":"/api/rules/bun-sqlite-wal-clustered-snapshot-isolation?format=agents"}},{"id":"capacitor-7-swift-6-task-cancellation-invariant","title":"Capacitor 7 Swift 6 Structured Concurrency Task Cancellation Invariant","category":"mobile","severity":"critical","description":"Guarantees that native Swift structured asynchronous task hierarchies initiated across the Capacitor 7 JS-to-Native bridge are explicitly tracked and cancelled when the originating WebView context tears down, navigates, or dispatches an explicit cancellation call. Without structured task cancellation propagation, orphaned native tasks retain UI references and background workers, leading to thread pool starvation, Swift 6 concurrency actor isolation violations, and memory leaks.","antiPatternHeadline":"Unmanaged Unstructured Tasks Leaking Across Bridge During WebView Navigation and Plugin Teardown","stars_count":43,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor-7","swift-6","structured-concurrency","ios","task-cancellation"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-swift-6-task-cancellation-invariant?format=claude","cursorMdc":"/api/rules/capacitor-7-swift-6-task-cancellation-invariant?format=mdc","cursorrules":"/api/rules/capacitor-7-swift-6-task-cancellation-invariant?format=cursor","windsurf":"/api/rules/capacitor-7-swift-6-task-cancellation-invariant?format=windsurf","agents":"/api/rules/capacitor-7-swift-6-task-cancellation-invariant?format=agents"}},{"id":"kmp-kotlin-2-1-swift-export-memory-fence-standard","title":"Kotlin 2.1 Swift Export & Swift 6 Actor Memory Fence Standard","category":"mobile","severity":"critical","description":"Establishes deterministic bidirectional memory boundaries between Kotlin 2.1 Swift Export runtimes and Swift 6 actor-isolated domains. Eliminates untracked retain cycles between Swift ARC and Kotlin/Native Garbage Collector by enforcing weak bridges, Sendable decoupling, and explicit lifecycle disposal fences.","antiPatternHeadline":"Cross-Runtime Retain Cycles Between Swift 6 Actor State and Kotlin Native GC Observers","stars_count":87,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kmp","kotlin-native","swift6","swift-export","memory-management","actors"],"exportEndpoints":{"claude":"/api/rules/kmp-kotlin-2-1-swift-export-memory-fence-standard?format=claude","cursorMdc":"/api/rules/kmp-kotlin-2-1-swift-export-memory-fence-standard?format=mdc","cursorrules":"/api/rules/kmp-kotlin-2-1-swift-export-memory-fence-standard?format=cursor","windsurf":"/api/rules/kmp-kotlin-2-1-swift-export-memory-fence-standard?format=windsurf","agents":"/api/rules/kmp-kotlin-2-1-swift-export-memory-fence-standard?format=agents"}},{"id":"amd-sev-snp-remote-attestation-verification-standard","title":"AMD SEV-SNP Confidential Container Remote Attestation & Secret Provisioning Standard","category":"security","severity":"critical","description":"Defines strict cryptographic verification invariants for AMD Secure Encrypted Virtualization-Secure Nested Paging (SEV-SNP) attestation reports prior to injecting secrets into multi-tenant cloud containers. Mandates verification of the hardware-backed VCEK certificate chain against AMD KDS root of trust, validation of measurement digests (LAUNCH_MEASUREMENT), non-renegotiable fresh nonce binding, and enforcement of minimum Trusted Computing Base (TCB) versions. Prevents man-in-the-middle attacks, hypervisor impersonation, and stale measurement replays in zero-trust confidential compute environments.","antiPatternHeadline":"Pre-mature Secret Provisioning on Unvalidated SNP Reports and Incomplete TCB Measurement Chains","stars_count":117,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","confidential-computing","amd-sev-snp","remote-attestation","zero-trust","cryptography"],"exportEndpoints":{"claude":"/api/rules/amd-sev-snp-remote-attestation-verification-standard?format=claude","cursorMdc":"/api/rules/amd-sev-snp-remote-attestation-verification-standard?format=mdc","cursorrules":"/api/rules/amd-sev-snp-remote-attestation-verification-standard?format=cursor","windsurf":"/api/rules/amd-sev-snp-remote-attestation-verification-standard?format=windsurf","agents":"/api/rules/amd-sev-snp-remote-attestation-verification-standard?format=agents"}},{"id":"sigstore-slsa-l3-ephemeral-keyless-attestation","title":"Sigstore SLSA Level 3 Keyless Ephemeral Provenance & Attestation Invariant","category":"security","severity":"critical","description":"Enforces non-forgeable, cryptographic supply chain provenance for all microservice artifacts utilizing Sigstore keyless signing backed by Fulcio ephemeral certificates and Rekor transparency log entries. Eliminates persistent private signing keys from CI/CD environments, ensuring all attestations are bound to authenticated OIDC workload identities and satisfy SLSA Level 3 requirements. Requires build-time attestation generation and strict admission-time digest-bound verification.","antiPatternHeadline":"Persisting static private signing keys in CI secrets and releasing untracked artifacts without Rekor-backed cryptographic provenance.","stars_count":60,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","sigstore","slsa-level-3","keyless-signing","cosign","supply-chain","oidc"],"exportEndpoints":{"claude":"/api/rules/sigstore-slsa-l3-ephemeral-keyless-attestation?format=claude","cursorMdc":"/api/rules/sigstore-slsa-l3-ephemeral-keyless-attestation?format=mdc","cursorrules":"/api/rules/sigstore-slsa-l3-ephemeral-keyless-attestation?format=cursor","windsurf":"/api/rules/sigstore-slsa-l3-ephemeral-keyless-attestation?format=windsurf","agents":"/api/rules/sigstore-slsa-l3-ephemeral-keyless-attestation?format=agents"}},{"id":"ebpf-af-xdp-zerocopy-ingress-standard","title":"eBPF AF_XDP Zero-Copy Ingress Steering & UMEM Lifecycle Invariants","category":"devops","severity":"critical","description":"Enforces deterministic kernel bypass for L7 microservice ingress via AF_XDP (XSK) zero-copy mode directly to user-space proxy buffers. Prevents silent fallback to SKB copy mode, ensures strict 1:1 hardware RX queue-to-worker core pinning, and guarantees descriptor fill-ring replenishment before RX ring consumption to prevent packet drops under microbursts.","antiPatternHeadline":"Silent Fallback to SKB Copy Mode and Unsynchronized UMEM Ring Starvation in Kernel Bypass Ingress","stars_count":109,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","af-xdp","xdp","kernel-bypass","envoy","performance"],"exportEndpoints":{"claude":"/api/rules/ebpf-af-xdp-zerocopy-ingress-standard?format=claude","cursorMdc":"/api/rules/ebpf-af-xdp-zerocopy-ingress-standard?format=mdc","cursorrules":"/api/rules/ebpf-af-xdp-zerocopy-ingress-standard?format=cursor","windsurf":"/api/rules/ebpf-af-xdp-zerocopy-ingress-standard?format=windsurf","agents":"/api/rules/ebpf-af-xdp-zerocopy-ingress-standard?format=agents"}},{"id":"cilium-ebpf-wireguard-encryption-invariant","title":"Cilium eBPF WireGuard Transparent Datapath Encryption and MTU Clamping","category":"devops","severity":"critical","description":"Enforces transparent node-to-node and pod-to-pod network encryption directly in the Linux datapath via Cilium eBPF and in-kernel WireGuard tunnels. Guarantees cryptographic transport isolation without sidecar proxy latency overhead while enforcing precise MTU clamping to prevent packet fragmentation.","antiPatternHeadline":"Bypassing Kernel WireGuard Encryption with Redundant User-Space Proxies or Unadjusted Network MTUs","stars_count":50,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","cilium","ebpf","wireguard","kubernetes","networking","mtu"],"exportEndpoints":{"claude":"/api/rules/cilium-ebpf-wireguard-encryption-invariant?format=claude","cursorMdc":"/api/rules/cilium-ebpf-wireguard-encryption-invariant?format=mdc","cursorrules":"/api/rules/cilium-ebpf-wireguard-encryption-invariant?format=cursor","windsurf":"/api/rules/cilium-ebpf-wireguard-encryption-invariant?format=windsurf","agents":"/api/rules/cilium-ebpf-wireguard-encryption-invariant?format=agents"}},{"id":"nextjs-15-ppr-shell-stream-isolation","title":"Next.js 15 PPR Shell-Stream Cache Boundary and Header Isolation","category":"frontend","severity":"critical","description":"Enforces deterministic boundaries between the static prerender shell and runtime streaming chunks under Next.js 15 Partial Prerendering (PPR). Prevents dynamic execution leakage into the prerender phase and prohibits ambient dynamic read contamination across React Suspense boundaries, eliminating cache stampedes and sensitive credential/header exposure in CDN-cached shells.","antiPatternHeadline":"Accessing Uncached Dynamic Contexts Outside Suspense Boundaries in PPR","stars_count":104,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs","react","partial-prerendering","caching","security"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-ppr-shell-stream-isolation?format=claude","cursorMdc":"/api/rules/nextjs-15-ppr-shell-stream-isolation?format=mdc","cursorrules":"/api/rules/nextjs-15-ppr-shell-stream-isolation?format=cursor","windsurf":"/api/rules/nextjs-15-ppr-shell-stream-isolation?format=windsurf","agents":"/api/rules/nextjs-15-ppr-shell-stream-isolation?format=agents"}},{"id":"vite-6-environment-api-worker-sandbox-isolation","title":"Strict Vite 6 Environment API Multi-Runtime Memory and Process Boundary Guardrail","category":"frontend","severity":"critical","description":"Enforces isolated execution boundaries across Vite 6 Environment API runtimes by decoupling Node.js host servers from edge-worker virtual environments. Prevents cross-realm prototype pollution and non-public environment variable leakage through strict runtime boundary segregation and explicit runner configuration.","antiPatternHeadline":"Executing edge worker runtimes within the Node.js root SSR execution context sharing global scope and process.env","stars_count":105,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","vite6","environment-api","edge-runtime","worker-sandbox","security"],"exportEndpoints":{"claude":"/api/rules/vite-6-environment-api-worker-sandbox-isolation?format=claude","cursorMdc":"/api/rules/vite-6-environment-api-worker-sandbox-isolation?format=mdc","cursorrules":"/api/rules/vite-6-environment-api-worker-sandbox-isolation?format=cursor","windsurf":"/api/rules/vite-6-environment-api-worker-sandbox-isolation?format=windsurf","agents":"/api/rules/vite-6-environment-api-worker-sandbox-isolation?format=agents"}},{"id":"openfga-rebac-cycle-detection-depth-fencing","title":"Deterministic Contextual Tuple Cycle Detection and Depth Fencing for OpenFGA ReBAC","category":"security","severity":"critical","description":"ReBAC evaluations utilizing dynamic contextual tuples are vulnerable to graph cycle exploitation and unbounded recursive traversal loops that exhaust engine resources. Systems MUST enforce client-side directed acyclic graph (DAG) cycle detection and deterministic depth fencing before dispatching authorization checks to OpenFGA. This invariant guarantees sub-millisecond p99 authorization latencies and shields identity infrastructure from algorithmic complexity denial-of-service (DoS) attacks.","antiPatternHeadline":"Unchecked Contextual Tuple Forwarding Allowing Circular Traversal Loops and Algorithmic ReBAC Denial of Service","stars_count":67,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","rebac","authorization","cycle-detection","graph-depth"],"exportEndpoints":{"claude":"/api/rules/openfga-rebac-cycle-detection-depth-fencing?format=claude","cursorMdc":"/api/rules/openfga-rebac-cycle-detection-depth-fencing?format=mdc","cursorrules":"/api/rules/openfga-rebac-cycle-detection-depth-fencing?format=cursor","windsurf":"/api/rules/openfga-rebac-cycle-detection-depth-fencing?format=windsurf","agents":"/api/rules/openfga-rebac-cycle-detection-depth-fencing?format=agents"}},{"id":"go-chi-http2-stream-drainage-lifecycle","title":"Go Chi v5 HTTP/2 Graceful Stream Drainage & Context Invariants","category":"backend","severity":"critical","description":"Enforces deterministic HTTP/2 GOAWAY stream drainage and structured hierarchical context propagation during rolling node terminations. Prevents connection resets (RST_STREAM) and dropped in-flight multiplexed client streams in Go Chi v5 services by synchronizing readiness unpublishing with staged server shutdown deadlines.","antiPatternHeadline":"Immediate http.Server.Shutdown execution and detached request contexts causing abrupt HTTP/2 connection resets.","stars_count":71,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","chi","http2","graceful-shutdown","resilience"],"exportEndpoints":{"claude":"/api/rules/go-chi-http2-stream-drainage-lifecycle?format=claude","cursorMdc":"/api/rules/go-chi-http2-stream-drainage-lifecycle?format=mdc","cursorrules":"/api/rules/go-chi-http2-stream-drainage-lifecycle?format=cursor","windsurf":"/api/rules/go-chi-http2-stream-drainage-lifecycle?format=windsurf","agents":"/api/rules/go-chi-http2-stream-drainage-lifecycle?format=agents"}},{"id":"capacitor-7-native-memory-pressure-eviction","title":"Capacitor 7 Native-to-WebView Memory Pressure & V8 Heap Eviction Standard","category":"mobile","severity":"critical","description":"Binds native low-memory signals (Android onTrimMemory / iOS didReceiveMemoryWarning) directly through Capacitor 7 App lifecycle listeners to execute deterministic JavaScript heap scavenging, canvas buffer flushes, and offscreen DOM/cache evictions. Prevents abrupt OS-level process termination by preemptively reducing memory footprint below kernel out-of-memory (OOM) kill thresholds during background and foreground pressure states.","antiPatternHeadline":"Ignoring Native Memory Warnings Leading to Silent WebView OOM Process Termination","stars_count":107,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","memory-management","v8-engine","performance","webkit"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-native-memory-pressure-eviction?format=claude","cursorMdc":"/api/rules/capacitor-7-native-memory-pressure-eviction?format=mdc","cursorrules":"/api/rules/capacitor-7-native-memory-pressure-eviction?format=cursor","windsurf":"/api/rules/capacitor-7-native-memory-pressure-eviction?format=windsurf","agents":"/api/rules/capacitor-7-native-memory-pressure-eviction?format=agents"}},{"id":"coco-atls-hardware-quote-verification-standard","title":"Mandatory Hardware-Rooted aTLS Quote Verification for Confidential Containers","category":"security","severity":"critical","description":"Enforces hardware-rooted AMD SEV-SNP and Intel TDX attestation quote validation prior to provisioning secrets to Confidential Containers (CoCo). Prohibits provisioning production credentials over standard mTLS without binding ephemeral TLS public keys to cryptographic enclave report data. Guarantees that untrusted host hypervisors cannot intercept or forge enclave identity.","antiPatternHeadline":"Trusting mTLS identities or unverified guest claims without hardware quote cryptographic binding","stars_count":110,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","confidential-computing","atls","sev-snp","tdx","key-broker-service","attestation"],"exportEndpoints":{"claude":"/api/rules/coco-atls-hardware-quote-verification-standard?format=claude","cursorMdc":"/api/rules/coco-atls-hardware-quote-verification-standard?format=mdc","cursorrules":"/api/rules/coco-atls-hardware-quote-verification-standard?format=cursor","windsurf":"/api/rules/coco-atls-hardware-quote-verification-standard?format=windsurf","agents":"/api/rules/coco-atls-hardware-quote-verification-standard?format=agents"}},{"id":"ebpf-tc-microsegmentation-pod-identity-guardrail","title":"eBPF TC Ingress/Egress Pod-Identity Cryptographic Tagging and In-Kernel Microsegmentation","category":"security","severity":"critical","description":"Mandates verified kernel-level tenant identity injection and boundary validation at the Traffic Control (TC) layer via eBPF. Forbids unauthenticated IP-to-identity mappings and missing verifier bounds checks on custom encapsulation headers, ensuring line-rate lateral movement isolation without userspace proxy latency.","antiPatternHeadline":"Trusting Plaintext L3/L4 Metadata Without Cryptographic Authentication and Missing Packet Boundary Validation in TC Filters","stars_count":51,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","ebpf","networking","traffic-control","microsegmentation","kernel","zero-trust"],"exportEndpoints":{"claude":"/api/rules/ebpf-tc-microsegmentation-pod-identity-guardrail?format=claude","cursorMdc":"/api/rules/ebpf-tc-microsegmentation-pod-identity-guardrail?format=mdc","cursorrules":"/api/rules/ebpf-tc-microsegmentation-pod-identity-guardrail?format=cursor","windsurf":"/api/rules/ebpf-tc-microsegmentation-pod-identity-guardrail?format=windsurf","agents":"/api/rules/ebpf-tc-microsegmentation-pod-identity-guardrail?format=agents"}},{"id":"k8s-gateway-api-v1-2-dualstack-canary-bgp-drain","title":"Kubernetes Gateway API v1.2 Dual-Stack Weighted Canary BGP Drain Standard","category":"devops","severity":"critical","description":"Mandates strict synchronization between Gateway API v1.2 dual-stack HTTPRoute canary weight transitions and upstream Top-of-Rack (ToR) BGP routing states. Enforces locked IPv4/IPv6 weight progression coupled with RFC 8326 BGP Graceful Shutdown community signaling to guarantee zero TCP connection resets and eliminate asymmetric IP blackholing during blue-green cutovers.","antiPatternHeadline":"Asymmetric Dual-Stack Canary Weight Shift with Abrupt BGP Teardown Leading to In-Flight TCP Resets","stars_count":69,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","kubernetes","gateway-api","bgp","dual-stack","networking","traffic-management"],"exportEndpoints":{"claude":"/api/rules/k8s-gateway-api-v1-2-dualstack-canary-bgp-drain?format=claude","cursorMdc":"/api/rules/k8s-gateway-api-v1-2-dualstack-canary-bgp-drain?format=mdc","cursorrules":"/api/rules/k8s-gateway-api-v1-2-dualstack-canary-bgp-drain?format=cursor","windsurf":"/api/rules/k8s-gateway-api-v1-2-dualstack-canary-bgp-drain?format=windsurf","agents":"/api/rules/k8s-gateway-api-v1-2-dualstack-canary-bgp-drain?format=agents"}},{"id":"otel-v1-28-genai-span-redaction-standard","title":"OpenTelemetry v1.28 GenAI Client-Side Ingress Span Redaction & Token Metrics Attribution","category":"devops","severity":"critical","description":"Enforces strict client-side PII/sensitive data redaction on GenAI spans adhering to OpenTelemetry Semantic Conventions v1.28 before telemetry egress. Mandates that prompt/completion payloads are sanitized in-process and token consumption attributes (gen_ai.usage.input_tokens, gen_ai.usage.output_tokens) are captured and attributed without data leakage.","antiPatternHeadline":"Unsanitized GenAI prompt and completion capture leaking PII to telemetry collectors without token attribution","stars_count":73,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","genai","pii-redaction","observability","semantic-conventions"],"exportEndpoints":{"claude":"/api/rules/otel-v1-28-genai-span-redaction-standard?format=claude","cursorMdc":"/api/rules/otel-v1-28-genai-span-redaction-standard?format=mdc","cursorrules":"/api/rules/otel-v1-28-genai-span-redaction-standard?format=cursor","windsurf":"/api/rules/otel-v1-28-genai-span-redaction-standard?format=windsurf","agents":"/api/rules/otel-v1-28-genai-span-redaction-standard?format=agents"}},{"id":"nextjs-15-ppr-shell-invariant","title":"Next.js 15 Partial Prerendering (PPR) Shell and Dynamic Stream Isolation","category":"frontend","severity":"critical","description":"Enforces strict architectural isolation between static prerendered HTML shells and dynamic request-time streaming slots in Next.js 15. Prevents edge cache poisoning, dynamic de-opt cascade, and client-side hydration mismatches caused by invoking dynamic APIs outside of explicit React Suspense boundaries.","antiPatternHeadline":"Leaking Dynamic Request Context into Static Shell Roots Triggering Edge Cache Invalidation and Full-Route Dynamic De-optimization","stars_count":105,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs-15","ppr","react-19","suspense","streaming","edge-cache"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-ppr-shell-invariant?format=claude","cursorMdc":"/api/rules/nextjs-15-ppr-shell-invariant?format=mdc","cursorrules":"/api/rules/nextjs-15-ppr-shell-invariant?format=cursor","windsurf":"/api/rules/nextjs-15-ppr-shell-invariant?format=windsurf","agents":"/api/rules/nextjs-15-ppr-shell-invariant?format=agents"}},{"id":"vite-rolldown-federation-boundary-isolation","title":"Vite 6 Rolldown Module Federation Chunk Boundary and Lifecycle Isolation","category":"frontend","severity":"critical","description":"Enforces strict chunk boundary isolation and deterministic initialization sequencing across dynamic module federation remotes in Vite 6 with Rolldown. Prevents cyclic dependency deadlocks, shared singleton scope contamination, and cross-micro-frontend memory retention leaks through isolated async bootstrap fencing and explicit cleanup lifecycles.","antiPatternHeadline":"Unfenced Synchronous Federation Imports Inducing Rolldown Module Graph Deadlocks and Leaked Shared Scopes","stars_count":86,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","vite6","rolldown","module-federation","micro-frontends","memory-leak"],"exportEndpoints":{"claude":"/api/rules/vite-rolldown-federation-boundary-isolation?format=claude","cursorMdc":"/api/rules/vite-rolldown-federation-boundary-isolation?format=mdc","cursorrules":"/api/rules/vite-rolldown-federation-boundary-isolation?format=cursor","windsurf":"/api/rules/vite-rolldown-federation-boundary-isolation?format=windsurf","agents":"/api/rules/vite-rolldown-federation-boundary-isolation?format=agents"}},{"id":"openfga-contextual-tuple-traversal-depth-guardrail","title":"OpenFGA Contextual Tuple Traversal Depth & Cycle Guardrail","category":"backend","severity":"critical","description":"Enforces deterministic ceilings on contextual tuple injection, graph expansion depth, and cycle detection during real-time OpenFGA Check and ListObjects calls. Unbounded contextual tuples and deeply nested transitive relations can induce computational exhaustion, thread starvation, and catastrophic authorization denial-of-service (DoS). All evaluation graphs must bound recursive dispatch depth and validate contextual tuple payload complexity prior to evaluation.","antiPatternHeadline":"Unbounded Contextual Tuple Ingestion and Recursive Transitive Graph Traversal","stars_count":86,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","openfga","authorization","rebac","dos-prevention","security"],"exportEndpoints":{"claude":"/api/rules/openfga-contextual-tuple-traversal-depth-guardrail?format=claude","cursorMdc":"/api/rules/openfga-contextual-tuple-traversal-depth-guardrail?format=mdc","cursorrules":"/api/rules/openfga-contextual-tuple-traversal-depth-guardrail?format=cursor","windsurf":"/api/rules/openfga-contextual-tuple-traversal-depth-guardrail?format=windsurf","agents":"/api/rules/openfga-contextual-tuple-traversal-depth-guardrail?format=agents"}},{"id":"bun-native-websocket-backpressure-drain-standard","title":"Bun 1.2 Native WebSocket Backpressure Drain & Queue Shedding Standard","category":"backend","severity":"critical","description":"Enforces strict backpressure handling using Bun 1.2's native WebSocket `getBufferedAmount()`, send return byte tracking, and the `drain` lifecycle hook. Mandates deterministic socket buffer thresholds and proactive shedding via connection termination or message dropping to prevent unbounded V8/JSC heap growth during large-scale enterprise broadcast bursts.","antiPatternHeadline":"Blind ws.send() Broadcasting and Missing Drain Handlers Causing Unchecked Buffer Saturation and Out-of-Memory Crashes","stars_count":78,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","websockets","backpressure","networking","performance"],"exportEndpoints":{"claude":"/api/rules/bun-native-websocket-backpressure-drain-standard?format=claude","cursorMdc":"/api/rules/bun-native-websocket-backpressure-drain-standard?format=mdc","cursorrules":"/api/rules/bun-native-websocket-backpressure-drain-standard?format=cursor","windsurf":"/api/rules/bun-native-websocket-backpressure-drain-standard?format=windsurf","agents":"/api/rules/bun-native-websocket-backpressure-drain-standard?format=agents"}},{"id":"go-chi-http3-quic-stream-reset-propagation-invariant","title":"Go Chi HTTP/3 QUIC Stream Reset Propagation & Connection Reclamation Invariant","category":"backend","severity":"critical","description":"Enforces deterministic cancellation propagation from QUIC stream resets down through Go Chi middleware trees, database transactions, and background goroutines. When an HTTP/3 client issues a QUIC RESET_STREAM frame, the underlying http.Request context must immediately abort active SQL/IO queries and release pooled connection reservations back to the driver without goroutine leaks. Failure to strictly propagate and observe r.Context().Done() creates phantom workload amplification and deadlocked connection pools under packet loss or route flapping.","antiPatternHeadline":"Orphaned SQL Queries and Goroutine Accumulation Due to Detached Contexts on HTTP/3 QUIC Stream Resets","stars_count":85,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","golang","chi","http3","quic","database","concurrency","context"],"exportEndpoints":{"claude":"/api/rules/go-chi-http3-quic-stream-reset-propagation-invariant?format=claude","cursorMdc":"/api/rules/go-chi-http3-quic-stream-reset-propagation-invariant?format=mdc","cursorrules":"/api/rules/go-chi-http3-quic-stream-reset-propagation-invariant?format=cursor","windsurf":"/api/rules/go-chi-http3-quic-stream-reset-propagation-invariant?format=windsurf","agents":"/api/rules/go-chi-http3-quic-stream-reset-propagation-invariant?format=agents"}},{"id":"envoy-gateway-proxy-wasm-linear-memory-budgeting-guardrail","title":"Envoy Gateway Proxy-Wasm Linear Memory Budgeting and Runtime Recycling Guardrail","category":"devops","severity":"critical","description":"Enforces strict WebAssembly (Wasm) linear memory limits, max page allocations, and instance lifecycle recycling across Envoy Gateway extension filters. Unbounded Wasm linear memory growth triggers OS-level OOM kills of shared Envoy worker threads, inducing cascading ingress failures across co-located tenants.","antiPatternHeadline":"Unbounded Wasm Linear Memory and Indefinite VM Lifecycles Causing Worker Thread Crashes","stars_count":108,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","envoy","envoy-gateway","proxy-wasm","webassembly","memory-management"],"exportEndpoints":{"claude":"/api/rules/envoy-gateway-proxy-wasm-linear-memory-budgeting-guardrail?format=claude","cursorMdc":"/api/rules/envoy-gateway-proxy-wasm-linear-memory-budgeting-guardrail?format=mdc","cursorrules":"/api/rules/envoy-gateway-proxy-wasm-linear-memory-budgeting-guardrail?format=cursor","windsurf":"/api/rules/envoy-gateway-proxy-wasm-linear-memory-budgeting-guardrail?format=windsurf","agents":"/api/rules/envoy-gateway-proxy-wasm-linear-memory-budgeting-guardrail?format=agents"}},{"id":"otel-async-event-trace-link-watermark-standard","title":"OpenTelemetry Monotonic Watermark Trace Link Guardrail for Event Streams","category":"devops","severity":"critical","description":"Enforces strict monotonic watermark validation and span link attribution across distributed Kafka and asynchronous broker topologies. Prevents broken causality trees, invalid span parentage, and clock-skewed out-of-order DAG fragmentation in high-throughput stream processing pipelines.","antiPatternHeadline":"Direct Parent-Child Span Nesting and Unanchored Links Across Asynchronous Partition Boundaries","stars_count":60,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","kafka","distributed-tracing","event-driven","observability"],"exportEndpoints":{"claude":"/api/rules/otel-async-event-trace-link-watermark-standard?format=claude","cursorMdc":"/api/rules/otel-async-event-trace-link-watermark-standard?format=mdc","cursorrules":"/api/rules/otel-async-event-trace-link-watermark-standard?format=cursor","windsurf":"/api/rules/otel-async-event-trace-link-watermark-standard?format=windsurf","agents":"/api/rules/otel-async-event-trace-link-watermark-standard?format=agents"}},{"id":"webauthn-largeblob-aead-envelope-verification","title":"WebAuthn LargeBlob Authenticated Encryption Verification Standard","category":"security","severity":"critical","description":"Enforces client-side Authenticated Encryption with Associated Data (AEAD) envelope verification and strict payload size bounding for WebAuthn LargeBlob extensions. Prevents credential-state tampering, ciphertext malleability, and memory-exhaustion attacks across multi-tenant or shared hardware authenticators by binding the credential ID to the AEAD Additional Authenticated Data (AAD).","antiPatternHeadline":"Trusting raw WebAuthn LargeBlob payloads without client-side AEAD envelope verification and credential-bound AAD","stars_count":52,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","cryptography","aead","largeblob","fido2"],"exportEndpoints":{"claude":"/api/rules/webauthn-largeblob-aead-envelope-verification?format=claude","cursorMdc":"/api/rules/webauthn-largeblob-aead-envelope-verification?format=mdc","cursorrules":"/api/rules/webauthn-largeblob-aead-envelope-verification?format=cursor","windsurf":"/api/rules/webauthn-largeblob-aead-envelope-verification?format=windsurf","agents":"/api/rules/webauthn-largeblob-aead-envelope-verification?format=agents"}},{"id":"kmp-k2-native-arc-reference-cycle-invariant","title":"KMP K2 Native ARC Reference Cycle & Deterministic Unbinding Invariant","category":"mobile","severity":"critical","description":"Establishes deterministic lifecycle unbinding and weak boundary mediation between Kotlin 2.1 Native runtimes and Apple Automatic Reference Counting (ARC). Under Kotlin Native's tracing garbage collector, retaining strong Swift/Obj-C closures that capture KMP state graphs spanning native threads creates disjoint island cycles that neither ARC nor the Kotlin GC can reclaim. This standard mandates explicit detachment contracts and WeakReference wrapping across the foreign function boundary.","antiPatternHeadline":"Retaining Strong Kotlin Coroutine Scope or SharedFlow Listeners inside Swift ARC ViewModels without Explicit Lifecycle Teardown","stars_count":47,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","k2","swift","ios","memory-management","arc"],"exportEndpoints":{"claude":"/api/rules/kmp-k2-native-arc-reference-cycle-invariant?format=claude","cursorMdc":"/api/rules/kmp-k2-native-arc-reference-cycle-invariant?format=mdc","cursorrules":"/api/rules/kmp-k2-native-arc-reference-cycle-invariant?format=cursor","windsurf":"/api/rules/kmp-k2-native-arc-reference-cycle-invariant?format=windsurf","agents":"/api/rules/kmp-k2-native-arc-reference-cycle-invariant?format=agents"}},{"id":"w3c-baggage-zero-trust-boundary-sanitization-standard","title":"W3C Baggage Header Zero-Trust Boundary Sanitization and Cryptographic Validation Standard","category":"security","severity":"critical","description":"Mandates strict ingress boundary redaction, allowlist enforcement, and HMAC cryptographic signing for W3C distributed baggage headers across multi-tenant security boundaries. Prevents untrusted external context injection, tenant spoofing, and privilege escalation via unverified OpenTelemetry propagation propagation context.","antiPatternHeadline":"Blind Propagation of Unverified and Unsigned W3C Baggage Across Multi-Tenant Boundaries","stars_count":68,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","opentelemetry","distributed-tracing","w3c-baggage","zero-trust","multi-tenant","api-gateway"],"exportEndpoints":{"claude":"/api/rules/w3c-baggage-zero-trust-boundary-sanitization-standard?format=claude","cursorMdc":"/api/rules/w3c-baggage-zero-trust-boundary-sanitization-standard?format=mdc","cursorrules":"/api/rules/w3c-baggage-zero-trust-boundary-sanitization-standard?format=cursor","windsurf":"/api/rules/w3c-baggage-zero-trust-boundary-sanitization-standard?format=windsurf","agents":"/api/rules/w3c-baggage-zero-trust-boundary-sanitization-standard?format=agents"}},{"id":"nextjs-15-ppr-streaming-cache-barrier","title":"Next.js 15 Partial Prerendering (PPR) Streaming Cache Isolation Barrier","category":"frontend","severity":"critical","description":"Enforces a strict architectural barrier between the pre-rendered static shell and runtime streaming Suspense boundaries in Next.js 15 PPR. Prevents dynamic request APIs and volatile cache tags from leaking into the pre-rendered shell, eliminating cache thrashing and route de-optimization.","antiPatternHeadline":"Dynamic Context Leakage Collapsing Next.js 15 PPR Static Shells into Full Dynamic SSR","stars_count":85,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs","nextjs-15","ppr","react-server-components","streaming","caching"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-ppr-streaming-cache-barrier?format=claude","cursorMdc":"/api/rules/nextjs-15-ppr-streaming-cache-barrier?format=mdc","cursorrules":"/api/rules/nextjs-15-ppr-streaming-cache-barrier?format=cursor","windsurf":"/api/rules/nextjs-15-ppr-streaming-cache-barrier?format=windsurf","agents":"/api/rules/nextjs-15-ppr-streaming-cache-barrier?format=agents"}},{"id":"vite-6-environment-api-runtime-boundary-standard-vite-6-environme-545","title":"Vite 6 Environment API Cross-Runtime Module Boundary & AST Virtualization","category":"frontend","severity":"critical","description":"Enforces strict hermetic AST virtualization and module isolation across concurrent Browser, Edge Worker (WinterCG), and Node.js SSR runtime execution targets via the Vite 6 Environment API. Eliminates architectural leaks caused by legacy binary SSR assumptions and prevents cross-contamination of runtime-specific module graphs.","antiPatternHeadline":"Leaking Node.js Built-ins or Global Module Graph State into Edge and Client Runtimes via Legacy Binary SSR Assumptions","stars_count":109,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["vite6","environment-api","wintercg","ssr","module-isolation","edge-worker","frontend"],"exportEndpoints":{"claude":"/api/rules/vite-6-environment-api-runtime-boundary-standard-vite-6-environme-545?format=claude","cursorMdc":"/api/rules/vite-6-environment-api-runtime-boundary-standard-vite-6-environme-545?format=mdc","cursorrules":"/api/rules/vite-6-environment-api-runtime-boundary-standard-vite-6-environme-545?format=cursor","windsurf":"/api/rules/vite-6-environment-api-runtime-boundary-standard-vite-6-environme-545?format=windsurf","agents":"/api/rules/vite-6-environment-api-runtime-boundary-standard-vite-6-environme-545?format=agents"}},{"id":"postgres-17-pg-createsubscriber-cutover-standard-postgres-17-pg-c-230","title":"PostgreSQL 17 pg_createsubscriber Safe Standby Cutover Standard","category":"backend","severity":"critical","description":"Mandates deterministic pre-flight checks, LSN sync verification, replica identity assertions, and atomic slot validation when converting physical standbys into logical subscribers using PostgreSQL 17 pg_createsubscriber. Prevents silent timeline drift, replication divergence, and transaction loss during migration from streaming replication to logical replication.","antiPatternHeadline":"Blind pg_createsubscriber Execution Without LSN Lag Zeroing and Replica Identity Validation","stars_count":43,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres","postgres-17","logical-replication","pg-createsubscriber","database-reliability"],"exportEndpoints":{"claude":"/api/rules/postgres-17-pg-createsubscriber-cutover-standard-postgres-17-pg-c-230?format=claude","cursorMdc":"/api/rules/postgres-17-pg-createsubscriber-cutover-standard-postgres-17-pg-c-230?format=mdc","cursorrules":"/api/rules/postgres-17-pg-createsubscriber-cutover-standard-postgres-17-pg-c-230?format=cursor","windsurf":"/api/rules/postgres-17-pg-createsubscriber-cutover-standard-postgres-17-pg-c-230?format=windsurf","agents":"/api/rules/postgres-17-pg-createsubscriber-cutover-standard-postgres-17-pg-c-230?format=agents"}},{"id":"fastapi-async-generator-dependency-teardown-invariant","title":"FastAPI Async Generator Dependency Deterministic Teardown and Connection Release Guardrail","category":"backend","severity":"critical","description":"Enforces deterministic resource deallocation and transaction termination in FastAPI async generator dependencies during unexpected client disconnects and ASGI task cancellations. Mandates comprehensive try-finally blocks or asynchronous context managers around all yield statements to eliminate connection pool starvation and orphaned transactions.","antiPatternHeadline":"Naked Dependency Yields Inducing Connection Pool Exhaustion on Abrupt Client Disconnection","stars_count":106,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","python","asyncio","sqlalchemy","connection-pooling"],"exportEndpoints":{"claude":"/api/rules/fastapi-async-generator-dependency-teardown-invariant?format=claude","cursorMdc":"/api/rules/fastapi-async-generator-dependency-teardown-invariant?format=mdc","cursorrules":"/api/rules/fastapi-async-generator-dependency-teardown-invariant?format=cursor","windsurf":"/api/rules/fastapi-async-generator-dependency-teardown-invariant?format=windsurf","agents":"/api/rules/fastapi-async-generator-dependency-teardown-invariant?format=agents"}},{"id":"openfga-rebac-graph-fanout-depth-boundary","title":"OpenFGA ReBAC Graph Traversal Fan-Out and Resolution Depth Boundary","category":"security","severity":"critical","description":"Enforces strict bounds on OpenFGA authorization graph traversal depth, contextual tuple payload size, and evaluation concurrency. Prevents Zanzibar-style algorithmic Denial of Service (DoS), thread starvation, and latency spikes caused by unbounded transitive relationship expansion and recursive contextual tuple evaluations.","antiPatternHeadline":"Unbounded Transitive Graph Traversal and Unvalidated Contextual Tuple Injection in ReBAC Checks","stars_count":91,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["openfga","rebac","zanzibar","security","authorization","latency"],"exportEndpoints":{"claude":"/api/rules/openfga-rebac-graph-fanout-depth-boundary?format=claude","cursorMdc":"/api/rules/openfga-rebac-graph-fanout-depth-boundary?format=mdc","cursorrules":"/api/rules/openfga-rebac-graph-fanout-depth-boundary?format=cursor","windsurf":"/api/rules/openfga-rebac-graph-fanout-depth-boundary?format=windsurf","agents":"/api/rules/openfga-rebac-graph-fanout-depth-boundary?format=agents"}},{"id":"wasi-canonical-abi-sandbox-guardrail","title":"WASI 0.2 Canonical ABI Component Sandboxing and Resource Protocol","category":"security","severity":"critical","description":"Enforces strict shared-nothing linear memory isolation, capability-based descriptor confinement, and deterministic resource deallocation for untrusted multi-tenant WASI 0.2 components. Guarantees host-guest boundary integrity by prohibiting raw memory aliasing across the Canonical ABI and enforcing explicit resource drop lifecycles. Prevents memory leaks, use-after-free, and capability leaks in multi-tenant WebAssembly runtime hosts.","antiPatternHeadline":"Leaking Raw Host Memory Pointers or Retaining Leaked Resource Handles Across Canonical ABI Lifecycles","stars_count":93,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","wasm","wasi","canonical-abi","sandboxing","memory-isolation"],"exportEndpoints":{"claude":"/api/rules/wasi-canonical-abi-sandbox-guardrail?format=claude","cursorMdc":"/api/rules/wasi-canonical-abi-sandbox-guardrail?format=mdc","cursorrules":"/api/rules/wasi-canonical-abi-sandbox-guardrail?format=cursor","windsurf":"/api/rules/wasi-canonical-abi-sandbox-guardrail?format=windsurf","agents":"/api/rules/wasi-canonical-abi-sandbox-guardrail?format=agents"}},{"id":"tauri-v2-multi-webview-ipc-isolation","title":"Tauri 2.0 Context-Isolated Multi-WebView IPC Contract","category":"mobile","severity":"critical","description":"Enforces strict origin-based ACL boundary separation and zero-trust event sanitization across Tauri 2.0 multi-webview mobile runtimes. Prevents untrusted secondary or remote webviews from accessing privileged native IPC channels and host bindings.","antiPatternHeadline":"Exposing Raw Native IPC Bridges to Untrusted Secondary WebViews Without Origin Checks and Strict Schema Validation","stars_count":83,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri","ipc-security","context-isolation","zero-trust"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-multi-webview-ipc-isolation?format=claude","cursorMdc":"/api/rules/tauri-v2-multi-webview-ipc-isolation?format=mdc","cursorrules":"/api/rules/tauri-v2-multi-webview-ipc-isolation?format=cursor","windsurf":"/api/rules/tauri-v2-multi-webview-ipc-isolation?format=windsurf","agents":"/api/rules/tauri-v2-multi-webview-ipc-isolation?format=agents"}},{"id":"capacitor-7-native-bridge-backpressure-guardrail","title":"Capacitor 7 Native Bridge Async Serialization Backpressure Guardrail","category":"mobile","severity":"critical","description":"Prevents UI thread hitching and out-of-memory panics by enforcing bounded queuing, rate limiting, and structured batching on asynchronous native-to-webview message passing during burst sensor and hardware events. Enforces leaky-bucket or sampling rate limits on Capacitor 7 notifyListeners to protect the JavaScript runtime from bridge queue starvation.","antiPatternHeadline":"Unbounded Sensor Event Forwarding via notifyListeners Flooding the Native-to-JavaScript Bridge","stars_count":46,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["capacitor","mobile","ios","android","performance","sensors","backpressure"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-native-bridge-backpressure-guardrail?format=claude","cursorMdc":"/api/rules/capacitor-7-native-bridge-backpressure-guardrail?format=mdc","cursorrules":"/api/rules/capacitor-7-native-bridge-backpressure-guardrail?format=cursor","windsurf":"/api/rules/capacitor-7-native-bridge-backpressure-guardrail?format=windsurf","agents":"/api/rules/capacitor-7-native-bridge-backpressure-guardrail?format=agents"}},{"id":"nextjs-15-async-request-store-isolation-barrier","title":"Next.js 15 Async Request Store Deterministic Isolation Barrier","category":"frontend","severity":"critical","description":"Enforces synchronous context boundary separation for asynchronous headers(), cookies(), params, and searchParams in Next.js 15 concurrent streaming SSR. Prohibits global or module-scoped retention of dynamic request contexts to prevent cross-request memory contamination and race conditions during async microtask interleaving. Guarantees deterministic per-request execution frames using React Server Component boundaries and React 19 async unwrap primitives.","antiPatternHeadline":"Global Module-Level Hoisting and Synchronous Consumption of Dynamic Async Request Stores","stars_count":59,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs15","react19","async-storage","concurrency","ssr-streaming"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-async-request-store-isolation-barrier?format=claude","cursorMdc":"/api/rules/nextjs-15-async-request-store-isolation-barrier?format=mdc","cursorrules":"/api/rules/nextjs-15-async-request-store-isolation-barrier?format=cursor","windsurf":"/api/rules/nextjs-15-async-request-store-isolation-barrier?format=windsurf","agents":"/api/rules/nextjs-15-async-request-store-isolation-barrier?format=agents"}},{"id":"vite6-environment-runtime-module-isolation-boundary","title":"Vite 6 Environment API Runtime Module Isolation and Evaluation Boundary","category":"frontend","severity":"critical","description":"Enforces strict runtime module graph isolation between Workerd, Node.js, and Client environments within Vite 6 multi-environment configurations. Prevents execution graph poisoning, cross-runtime prototype pollution, and illegal native binding leakage across heterogeneous SSR execution targets.","antiPatternHeadline":"Global Module Graph Leakage and Heterogeneous Runtime Pollution in Multi-Target Vite 6 SSR","stars_count":89,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","vite6","environment-api","workerd","ssr","module-isolation","cloudflare-workers"],"exportEndpoints":{"claude":"/api/rules/vite6-environment-runtime-module-isolation-boundary?format=claude","cursorMdc":"/api/rules/vite6-environment-runtime-module-isolation-boundary?format=mdc","cursorrules":"/api/rules/vite6-environment-runtime-module-isolation-boundary?format=cursor","windsurf":"/api/rules/vite6-environment-runtime-module-isolation-boundary?format=windsurf","agents":"/api/rules/vite6-environment-runtime-module-isolation-boundary?format=agents"}},{"id":"bun-v1-2-so-reuseport-cluster-socket-handoff","title":"Bun 1.2 Native Cluster SO_REUSEPORT Socket Handoff Guardrail","category":"backend","severity":"critical","description":"Enforces Linux kernel-level SO_REUSEPORT socket sharing and non-destructive connection draining in Bun 1.2+ multi-process deployments. Mandates pre-spawn worker binding and graceful TCP socket migration using server.stop(false) to achieve zero-downtime rolling restarts without connection drops or EADDRINUSE collisions.","antiPatternHeadline":"Hard Process Termination and Missing SO_REUSEPORT Causing Port Binding Collisions and TCP Connection Resets","stars_count":115,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","clustering","so-reuseport","zero-downtime","networking"],"exportEndpoints":{"claude":"/api/rules/bun-v1-2-so-reuseport-cluster-socket-handoff?format=claude","cursorMdc":"/api/rules/bun-v1-2-so-reuseport-cluster-socket-handoff?format=mdc","cursorrules":"/api/rules/bun-v1-2-so-reuseport-cluster-socket-handoff?format=cursor","windsurf":"/api/rules/bun-v1-2-so-reuseport-cluster-socket-handoff?format=windsurf","agents":"/api/rules/bun-v1-2-so-reuseport-cluster-socket-handoff?format=agents"}},{"id":"fastapi-async-lifespan-cleanup-invariant","title":"FastAPI Async Lifespan Generator Deterministic Teardown Invariant","category":"backend","severity":"critical","description":"Enforces deterministic teardown of database connection pools, HTTP clients, and background task coroutines using FastAPI lifespan context managers. Guarantees clean state draining during SIGTERM signals under multi-worker ASGI runtimes (Uvicorn/Gunicorn) to prevent unhandled connection reset cascades and aborted in-flight transactions.","antiPatternHeadline":"Unstructured Startup/Shutdown Handlers Leaking Sockets and Stranding Coroutines on Worker Recycling","stars_count":104,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","asyncio","uvicorn","lifespan","connection-pooling","graceful-shutdown"],"exportEndpoints":{"claude":"/api/rules/fastapi-async-lifespan-cleanup-invariant?format=claude","cursorMdc":"/api/rules/fastapi-async-lifespan-cleanup-invariant?format=mdc","cursorrules":"/api/rules/fastapi-async-lifespan-cleanup-invariant?format=cursor","windsurf":"/api/rules/fastapi-async-lifespan-cleanup-invariant?format=windsurf","agents":"/api/rules/fastapi-async-lifespan-cleanup-invariant?format=agents"}},{"id":"postgres-17-logical-decoding-spill-memory-ceiling","title":"Postgres 17 Logical Replication Memory Ceiling & Parallel Spill-to-Disk Control","category":"backend","severity":"critical","description":"Enforces strict memory ceilings and streaming configurations on Postgres 17 logical replication engines during large transactional workloads. Prevents wal_sender and parallel apply worker out-of-memory (OOM) crashes by mandating bounded logical_decoding_work_mem limits, streaming=parallel subscription parameters, and batch-bounded application transactions.","antiPatternHeadline":"Unbounded transaction sizes and default replication streaming triggering wal_sender heap exhaustion and worker OOM crashes","stars_count":56,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres-17","logical-replication","database-reliability","memory-management","bulk-mutations"],"exportEndpoints":{"claude":"/api/rules/postgres-17-logical-decoding-spill-memory-ceiling?format=claude","cursorMdc":"/api/rules/postgres-17-logical-decoding-spill-memory-ceiling?format=mdc","cursorrules":"/api/rules/postgres-17-logical-decoding-spill-memory-ceiling?format=cursor","windsurf":"/api/rules/postgres-17-logical-decoding-spill-memory-ceiling?format=windsurf","agents":"/api/rules/postgres-17-logical-decoding-spill-memory-ceiling?format=agents"}},{"id":"kmp-swift-concurrency-bidirectional-cancellation-propagation-standard","title":"KMP Swift Concurrency Bidirectional Cancellation Propagation Standard","category":"mobile","severity":"critical","description":"Mandates deterministic, non-blocking cooperative cancellation propagation between Swift Tasks and Kotlin Multiplatform CoroutineScopes across the foreign function interface. Prevents orphaned background compute, unbounded memory leaks, and actor thread-pool deadlocks caused by unbridged async continuations.","antiPatternHeadline":"Bridging Kotlin Suspend Functions into Swift Async/Await via Raw Continuations Without Cancellation Handlers","stars_count":72,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kmp","kotlin-multiplatform","swift-concurrency","coroutines","ios","memory-leaks"],"exportEndpoints":{"claude":"/api/rules/kmp-swift-concurrency-bidirectional-cancellation-propagation-standard?format=claude","cursorMdc":"/api/rules/kmp-swift-concurrency-bidirectional-cancellation-propagation-standard?format=mdc","cursorrules":"/api/rules/kmp-swift-concurrency-bidirectional-cancellation-propagation-standard?format=cursor","windsurf":"/api/rules/kmp-swift-concurrency-bidirectional-cancellation-propagation-standard?format=windsurf","agents":"/api/rules/kmp-swift-concurrency-bidirectional-cancellation-propagation-standard?format=agents"}},{"id":"capacitor-7-background-task-execution-budget-idempotency","title":"Capacitor 7 Background Task Execution Budget and Idempotency Guardrail","category":"mobile","severity":"critical","description":"Enforces deterministic OS battery budget compliance and transactional deduping for periodic background synchronizations bridging iOS BGAppRefreshTask/BGProcessingTask and Android WorkManager via Capacitor 7. Mandates hard execution timeouts with AbortController, idempotent synchronization leases via atomic SQLite/Key-Value stores, and immediate task completion notification to avoid OS SIGKILL termination and app standby deprioritization.","antiPatternHeadline":"Unbounded Async Execution Without Cancellation Leases and Immediate Completion Signals","stars_count":100,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","ios","android","background-tasks","idempotency","workmanager"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-background-task-execution-budget-idempotency?format=claude","cursorMdc":"/api/rules/capacitor-7-background-task-execution-budget-idempotency?format=mdc","cursorrules":"/api/rules/capacitor-7-background-task-execution-budget-idempotency?format=cursor","windsurf":"/api/rules/capacitor-7-background-task-execution-budget-idempotency?format=windsurf","agents":"/api/rules/capacitor-7-background-task-execution-budget-idempotency?format=agents"}},{"id":"openfga-contextual-tuples-dynamic-boundary","title":"OpenFGA Contextual Tuples Dynamic Evaluation Boundary","category":"security","severity":"critical","description":"Mandates that ephemeral, request-scoped, and high-churn attributes are injected exclusively via contextual tuples during the OpenFGA check call rather than written to persistent relational Zanzibar storage. Persisting transient state induces severe write amplification, cache invalidation storms, and race conditions that breach sub-millisecond authorization SLOs. Enforces an immutable architectural boundary separating persistent relationship graphs from runtime dynamic context.","antiPatternHeadline":"Persisting Ephemeral Request Context via WriteTuples Prior to Check Evaluation","stars_count":108,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","zanzibar","authorization","rebac","abac"],"exportEndpoints":{"claude":"/api/rules/openfga-contextual-tuples-dynamic-boundary?format=claude","cursorMdc":"/api/rules/openfga-contextual-tuples-dynamic-boundary?format=mdc","cursorrules":"/api/rules/openfga-contextual-tuples-dynamic-boundary?format=cursor","windsurf":"/api/rules/openfga-contextual-tuples-dynamic-boundary?format=windsurf","agents":"/api/rules/openfga-contextual-tuples-dynamic-boundary?format=agents"}},{"id":"wasi-component-model-fuel-isolation-invariant","title":"WASI 0.2 Component Model Gas-Metered Sandbox Execution Invariant","category":"security","severity":"critical","description":"Mandates strict per-invocation instruction fuel metering, memory bounds enforcement, and capability-scoped host interfaces for untrusted tenant plugins using the WASI 0.2 Component Model. Prevents denial-of-service vectors, infinite execution loops, and guest heap exhaustion in high-throughput backend services by isolating linear memory and binding execution to deterministic gas limits.","antiPatternHeadline":"Unmetered Shared Store Instantiation with Ambient Host Capabilities","stars_count":99,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","wasm","wasi","component-model","wasmtime","sandboxing","fuel-metering"],"exportEndpoints":{"claude":"/api/rules/wasi-component-model-fuel-isolation-invariant?format=claude","cursorMdc":"/api/rules/wasi-component-model-fuel-isolation-invariant?format=mdc","cursorrules":"/api/rules/wasi-component-model-fuel-isolation-invariant?format=cursor","windsurf":"/api/rules/wasi-component-model-fuel-isolation-invariant?format=windsurf","agents":"/api/rules/wasi-component-model-fuel-isolation-invariant?format=agents"}},{"id":"otel-arrow-compression-memory-bounds","title":"OpenTelemetry OTel-Arrow Stream Compression Memory Bound Invariant","category":"devops","severity":"critical","description":"Prevents telemetry pipeline buffer exhaustion under high-cardinality spikes by pinning Apache Arrow columnar record batch sizes and stream compression chunk allocation limits. Unbounded batch builders or missing memory-limiter processor envelopes in OTel-Arrow exporters induce catastrophic OOM panics when dynamic schema widening occurs during ingest bursts.","antiPatternHeadline":"Unbounded Arrow Record Batching and Ungated Stream Compression under Dynamic Schema Bursts","stars_count":67,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","arrow","streaming","memory-management","collector"],"exportEndpoints":{"claude":"/api/rules/otel-arrow-compression-memory-bounds?format=claude","cursorMdc":"/api/rules/otel-arrow-compression-memory-bounds?format=mdc","cursorrules":"/api/rules/otel-arrow-compression-memory-bounds?format=cursor","windsurf":"/api/rules/otel-arrow-compression-memory-bounds?format=windsurf","agents":"/api/rules/otel-arrow-compression-memory-bounds?format=agents"}},{"id":"react19-server-action-taint-crypto-boundary","title":"React 19 Server Action Object Taint and Cryptographic Token Boundary","category":"frontend","severity":"critical","description":"Enforces zero-trust payload boundaries across React Server Components and Server Actions by mandating React 19 experimental_taintObjectReference and experimental_taintUniqueValue on all data access layer (DAL) entities and cryptographic secrets. Prevents raw database objects, ORM records, and sensitive operational credentials from serializing into React Flight client protocol streams. Requires explicit, schema-validated Data Transfer Objects (DTOs) and HMAC-signed cryptographic tokens for any state traversing the client-server boundary.","antiPatternHeadline":"Returning raw ORM/DB entities or unsealed identifiers directly across Server Action boundaries without object tainting and explicit projection","stars_count":93,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react19","server-actions","rsc","security","data-tainting","cryptography"],"exportEndpoints":{"claude":"/api/rules/react19-server-action-taint-crypto-boundary?format=claude","cursorMdc":"/api/rules/react19-server-action-taint-crypto-boundary?format=mdc","cursorrules":"/api/rules/react19-server-action-taint-crypto-boundary?format=cursor","windsurf":"/api/rules/react19-server-action-taint-crypto-boundary?format=windsurf","agents":"/api/rules/react19-server-action-taint-crypto-boundary?format=agents"}},{"id":"nextjs-15-dynamic-io-cache-isolation","title":"Next.js 15 Dynamic I/O Speculative Execution and Cache Key Isolation Standard","category":"frontend","severity":"critical","description":"Enforces strict boundary demarcation between speculative pre-rendering and dynamic runtime execution under Next.js 15 dynamicIO. Mandates explicit cryptographic tenant/user cache key derivation and prohibits unisolated ambient request context in 'use cache' directives to eliminate cross-request cache poisoning.","antiPatternHeadline":"Cross-Tenant Cache Poisoning via Ambient Context Leaks in 'use cache' Directives Under Speculative Execution","stars_count":91,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs-15","dynamic-io","caching","cache-isolation","speculative-execution"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-dynamic-io-cache-isolation?format=claude","cursorMdc":"/api/rules/nextjs-15-dynamic-io-cache-isolation?format=mdc","cursorrules":"/api/rules/nextjs-15-dynamic-io-cache-isolation?format=cursor","windsurf":"/api/rules/nextjs-15-dynamic-io-cache-isolation?format=windsurf","agents":"/api/rules/nextjs-15-dynamic-io-cache-isolation?format=agents"}},{"id":"go124-weak-pointer-cache-finalizer-isolation","title":"Go 1.24 Weak Pointer Cache Reclamation and Finalizer Isolation Guardrail","category":"backend","severity":"critical","description":"Standardizes in-memory cache architectures on Go 1.24 weak pointer semantics (`weak.Pointer`) and decoupled cleanup handlers (`runtime.AddCleanup`). Eliminates mark-and-sweep GC latency spikes caused by large retained heaps and completely prevents object resurrection and cyclic dependency leaks historically induced by `runtime.SetFinalizer`.","antiPatternHeadline":"Retaining Large In-Memory Caches with Strong References or Legacy Finalizers Causing Memory Leaks and GC Pauses","stars_count":48,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","golang","go124","memory-management","garbage-collection","caching","performance"],"exportEndpoints":{"claude":"/api/rules/go124-weak-pointer-cache-finalizer-isolation?format=claude","cursorMdc":"/api/rules/go124-weak-pointer-cache-finalizer-isolation?format=mdc","cursorrules":"/api/rules/go124-weak-pointer-cache-finalizer-isolation?format=cursor","windsurf":"/api/rules/go124-weak-pointer-cache-finalizer-isolation?format=windsurf","agents":"/api/rules/go124-weak-pointer-cache-finalizer-isolation?format=agents"}},{"id":"axum-hyper-stream-quota-backpressure-fence","title":"Axum 0.8 & Hyper 1.0 Chunked Body Stream Quota and Backpressure Fence","category":"backend","severity":"critical","description":"Enforces strict allocator byte ceilings and non-blocking backpressure on uncontrolled HTTP/2 and HTTP/3 streaming request bodies. Eliminates remote heap exhaustion (OOM DoS) attacks by replacing unconstrained buffer aggregation with frame-level byte accounting and bounded channel handoffs.","antiPatternHeadline":"Unbounded Stream Buffering via to_bytes or Unmetered Channel Ingest Leading to Heap Exhaustion","stars_count":95,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","hyper","security","dos-prevention","memory-management"],"exportEndpoints":{"claude":"/api/rules/axum-hyper-stream-quota-backpressure-fence?format=claude","cursorMdc":"/api/rules/axum-hyper-stream-quota-backpressure-fence?format=mdc","cursorrules":"/api/rules/axum-hyper-stream-quota-backpressure-fence?format=cursor","windsurf":"/api/rules/axum-hyper-stream-quota-backpressure-fence?format=windsurf","agents":"/api/rules/axum-hyper-stream-quota-backpressure-fence?format=agents"}},{"id":"webauthn-prf-deterministic-key-derivation-guardrail-webauthn-prf-ext-512","title":"Enforce WebAuthn PRF Deterministic Key Derivation and Client-Side Zero-Knowledge Isolation","category":"security","severity":"critical","description":"Enforces hardware-backed deterministic symmetric key derivation via the WebAuthn Pseudo-Random Function (PRF) extension for client-side zero-knowledge vaults. Guarantees 32-byte input salt bounds, HKDF domain separation, ephemeral in-memory handling, and non-extractable Web Crypto keys without transmitting PRF secrets across the wire.","antiPatternHeadline":"Raw PRF Output Exposure, Direct Cipher Usage Without HKDF, or Server-Side Transmission of Authenticator Secrets","stars_count":99,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","prf-extension","zero-knowledge","cryptography","webcrypto","hkdf"],"exportEndpoints":{"claude":"/api/rules/webauthn-prf-deterministic-key-derivation-guardrail-webauthn-prf-ext-512?format=claude","cursorMdc":"/api/rules/webauthn-prf-deterministic-key-derivation-guardrail-webauthn-prf-ext-512?format=mdc","cursorrules":"/api/rules/webauthn-prf-deterministic-key-derivation-guardrail-webauthn-prf-ext-512?format=cursor","windsurf":"/api/rules/webauthn-prf-deterministic-key-derivation-guardrail-webauthn-prf-ext-512?format=windsurf","agents":"/api/rules/webauthn-prf-deterministic-key-derivation-guardrail-webauthn-prf-ext-512?format=agents"}},{"id":"ebpf-lsm-userns-credential-transition-guard","title":"eBPF LSM Invariant Enforcement for User Namespace Credential Transitions and Ambient Capability Bounds","category":"security","severity":"critical","description":"Enforces kernel-level eBPF Linux Security Module (LSM) verification on credential preparation and namespace creation hooks to prevent unprivileged user namespace escalation. Prohibits ambient capability acquisition, unverified UID/GID namespace mappings, and unauthorized credential transformations in rootless execution contexts. Blocks privilege inheritance exploits across nested user namespace boundaries before execution context commits.","antiPatternHeadline":"Permissive User Namespace Allocation Permitting Ambient Capability Inheritance and Host Credential Leaks","stars_count":55,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","ebpf","lsm","linux-kernel","user-namespaces","capabilities","containers"],"exportEndpoints":{"claude":"/api/rules/ebpf-lsm-userns-credential-transition-guard?format=claude","cursorMdc":"/api/rules/ebpf-lsm-userns-credential-transition-guard?format=mdc","cursorrules":"/api/rules/ebpf-lsm-userns-credential-transition-guard?format=cursor","windsurf":"/api/rules/ebpf-lsm-userns-credential-transition-guard?format=windsurf","agents":"/api/rules/ebpf-lsm-userns-credential-transition-guard?format=agents"}},{"id":"k8s-gateway-api-referencegrant-cross-namespace-fence","title":"Enforce ReferenceGrant Isolation for Kubernetes Gateway API Cross-Namespace Routing","category":"devops","severity":"critical","description":"Enforces strict cryptographic and namespace isolation boundaries across multi-tenant Kubernetes clusters leveraging the Gateway API (gateway.networking.k8s.io). Mandates explicit ReferenceGrant resources in target namespaces whenever Routes bind across namespace boundaries to Gateway listeners or forward traffic to cross-namespace backend Services, preventing route hijacking, unauthorized ingress exposure, and silent traffic blackholing.","antiPatternHeadline":"Unvalidated cross-namespace route attachment or backend forwarding without target-namespace ReferenceGrant authorization","stars_count":41,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","kubernetes","gateway-api","referencegrant","multi-tenancy","zero-trust"],"exportEndpoints":{"claude":"/api/rules/k8s-gateway-api-referencegrant-cross-namespace-fence?format=claude","cursorMdc":"/api/rules/k8s-gateway-api-referencegrant-cross-namespace-fence?format=mdc","cursorrules":"/api/rules/k8s-gateway-api-referencegrant-cross-namespace-fence?format=cursor","windsurf":"/api/rules/k8s-gateway-api-referencegrant-cross-namespace-fence?format=windsurf","agents":"/api/rules/k8s-gateway-api-referencegrant-cross-namespace-fence?format=agents"}},{"id":"opentelemetry-span-link-provenance-invariant","title":"OpenTelemetry Asynchronous Span Link Provenance Invariant","category":"devops","severity":"critical","description":"Enforces strict decoupling of asynchronous message consumer traces from producer execution contexts using causal Span Links rather than child-of parent contexts. Prevents unbounded distributed trace DAG explosion, cascading latency reporting skew, and trace visualization collapse in fan-out/fan-in and message batching event-driven pipelines.","antiPatternHeadline":"Subordinating Asynchronous Message Consumer Execution to Producer Parent Trace Contexts","stars_count":108,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","observability","distributed-tracing","event-driven","kafka","amqp"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-span-link-provenance-invariant?format=claude","cursorMdc":"/api/rules/opentelemetry-span-link-provenance-invariant?format=mdc","cursorrules":"/api/rules/opentelemetry-span-link-provenance-invariant?format=cursor","windsurf":"/api/rules/opentelemetry-span-link-provenance-invariant?format=windsurf","agents":"/api/rules/opentelemetry-span-link-provenance-invariant?format=agents"}},{"id":"kmp-native-stableref-arc-reclamation-guardrail","title":"Kotlin Multiplatform Native StableRef and ARC Deterministic Reclamation Guardrail","category":"mobile","severity":"critical","description":"Enforces bidirectional lifecycle deterministic disposal for Kotlin/Native StableRef handles exported to Apple Swift ARC runtimes. Prevents uncollected zombie references and heap memory leaks caused by pinned GC roots escaping Objective-C/Swift ARC deallocation lifecycles.","antiPatternHeadline":"Dangling StableRef Handles Passed as Raw Unmanaged Pointers Without Swift ARC deinit Binding","stars_count":103,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","ios","swift","memory-management","arc","stableref"],"exportEndpoints":{"claude":"/api/rules/kmp-native-stableref-arc-reclamation-guardrail?format=claude","cursorMdc":"/api/rules/kmp-native-stableref-arc-reclamation-guardrail?format=mdc","cursorrules":"/api/rules/kmp-native-stableref-arc-reclamation-guardrail?format=cursor","windsurf":"/api/rules/kmp-native-stableref-arc-reclamation-guardrail?format=windsurf","agents":"/api/rules/kmp-native-stableref-arc-reclamation-guardrail?format=agents"}},{"id":"nextjs-15-async-request-context-streaming-isolation","title":"Next.js 15 Async Request Context and Streaming Isolation Standard","category":"frontend","severity":"critical","description":"Next.js 15 converts synchronous request APIs (cookies, headers, params, searchParams) to asynchronous Promises. Awaiting dynamic request context at root layouts or page components blocks Partial Prerendering (PPR), forces the entire component tree into dynamic SSR, and creates catastrophic initial streaming waterfalls.","antiPatternHeadline":"Awaiting Dynamic Request Promises at Component Roots Triggering Cascading Waterfalls and PPR Collapse","stars_count":51,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs","react-server-components","partial-prerendering","performance","streaming"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-async-request-context-streaming-isolation?format=claude","cursorMdc":"/api/rules/nextjs-15-async-request-context-streaming-isolation?format=mdc","cursorrules":"/api/rules/nextjs-15-async-request-context-streaming-isolation?format=cursor","windsurf":"/api/rules/nextjs-15-async-request-context-streaming-isolation?format=windsurf","agents":"/api/rules/nextjs-15-async-request-context-streaming-isolation?format=agents"}},{"id":"postgres-17-logical-replication-sequence-alignment-invariant","title":"Postgres 17 Logical Replication Sequence Alignment and Failover Guardrail","category":"backend","severity":"critical","description":"Postgres 17 logical replication replicates DML changes but completely omits continuous sequence state transitions. During high-throughput cross-region failovers with parallel apply workers, promoted subscriber nodes maintain stale sequence values, inevitably triggering silent duplicate key collisions on auto-incrementing surrogate keys unless explicit synchronization barriers and deterministic sequence reservation blocks are enforced.","antiPatternHeadline":"Unsynchronized Sequence Failover Leading to Primary Key Duplicate Value Collisions","stars_count":84,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql-17","logical-replication","database-failover","high-availability","data-integrity"],"exportEndpoints":{"claude":"/api/rules/postgres-17-logical-replication-sequence-alignment-invariant?format=claude","cursorMdc":"/api/rules/postgres-17-logical-replication-sequence-alignment-invariant?format=mdc","cursorrules":"/api/rules/postgres-17-logical-replication-sequence-alignment-invariant?format=cursor","windsurf":"/api/rules/postgres-17-logical-replication-sequence-alignment-invariant?format=windsurf","agents":"/api/rules/postgres-17-logical-replication-sequence-alignment-invariant?format=agents"}},{"id":"axum-webtransport-datagram-flow-control-boundary","title":"Axum WebTransport Datagram Ingress Flow-Control & Backpressure Boundary","category":"backend","severity":"critical","description":"Enforces deterministic ingress backpressure and bounded allocation on WebTransport UDP datagram streams in Axum/Tokio services. Because HTTP/3 datagrams bypass connection-level flow control, unconstrained ingress loops saturate executor thread pools and trigger unbounded memory allocations during packet floods.","antiPatternHeadline":"Unbounded Task Spawning and Unchecked Ingress Loops on HTTP/3 Datagram Channels","stars_count":104,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","webtransport","http3","quic","backpressure","tokio"],"exportEndpoints":{"claude":"/api/rules/axum-webtransport-datagram-flow-control-boundary?format=claude","cursorMdc":"/api/rules/axum-webtransport-datagram-flow-control-boundary?format=mdc","cursorrules":"/api/rules/axum-webtransport-datagram-flow-control-boundary?format=cursor","windsurf":"/api/rules/axum-webtransport-datagram-flow-control-boundary?format=windsurf","agents":"/api/rules/axum-webtransport-datagram-flow-control-boundary?format=agents"}},{"id":"go-context-afterfunc-deregistration-leak-guardrail","title":"Go 1.24 context.AfterFunc Explicit Teardown & Closure Deregistration Guardrail","category":"backend","severity":"critical","description":"Enforces mandatory, unconditional invocation of the returned stop closure from context.AfterFunc in distributed RPC pipelines and stream handlers. Failure to deregister callbacks on short-lived operations tied to long-lived contexts causes unbounded callback list growth, memory retention of captured references, and goroutine starvation under high throughput.","antiPatternHeadline":"Omitting AfterFunc Stop Closure Invocations Leading to Retained Callbacks on Long-Lived Contexts","stars_count":114,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","concurrency","memory-leak","context","rpc"],"exportEndpoints":{"claude":"/api/rules/go-context-afterfunc-deregistration-leak-guardrail?format=claude","cursorMdc":"/api/rules/go-context-afterfunc-deregistration-leak-guardrail?format=mdc","cursorrules":"/api/rules/go-context-afterfunc-deregistration-leak-guardrail?format=cursor","windsurf":"/api/rules/go-context-afterfunc-deregistration-leak-guardrail?format=windsurf","agents":"/api/rules/go-context-afterfunc-deregistration-leak-guardrail?format=agents"}},{"id":"swift-6-kmp-native-export-actor-boundary","title":"Swift 6 Actor Isolation and Sendable Safety for KMP Export Boundaries","category":"mobile","severity":"critical","description":"Enforces complete compile-time data race safety under Swift 6 strict concurrency when consuming Kotlin Multiplatform (KMP) shared framework binaries. Prohibits direct access to non-Sendable Kotlin runtime object graphs across native Swift actor or Task boundaries without explicit actor isolation or value-type bridging.","antiPatternHeadline":"Passing Unchecked Mutable KMP Objective-C Export References Across Swift Concurrency Boundaries","stars_count":86,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","swift6","kmp","kotlin-native","concurrency","actors"],"exportEndpoints":{"claude":"/api/rules/swift-6-kmp-native-export-actor-boundary?format=claude","cursorMdc":"/api/rules/swift-6-kmp-native-export-actor-boundary?format=mdc","cursorrules":"/api/rules/swift-6-kmp-native-export-actor-boundary?format=cursor","windsurf":"/api/rules/swift-6-kmp-native-export-actor-boundary?format=windsurf","agents":"/api/rules/swift-6-kmp-native-export-actor-boundary?format=agents"}},{"id":"android-15-16kb-page-alignment-invariant-android-15-16kb--825","title":"Android 15 16KB Memory Page Alignment Native Runtime Invariant","category":"mobile","severity":"critical","description":"Android 15 introduces native support for devices configured with 16KB memory page sizes instead of legacy 4KB boundaries. Native shared libraries (.so) built with default 4KB page alignments will fail ELF loading or trigger unrecoverable SIGBUS memory faults when mapped into process memory on 16KB kernels. This invariant enforces mandatory 16KB ELF alignment across all CMake/NDK toolchains and verifies uncompressed APK zip-alignment.","antiPatternHeadline":"Compiling Native Libraries with Legacy 4KB ELF Alignment Leading to SIGBUS Crashes on Android 15","stars_count":110,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","android","ndk","16kb-pages","cmake","sigbus","c-plus-plus"],"exportEndpoints":{"claude":"/api/rules/android-15-16kb-page-alignment-invariant-android-15-16kb--825?format=claude","cursorMdc":"/api/rules/android-15-16kb-page-alignment-invariant-android-15-16kb--825?format=mdc","cursorrules":"/api/rules/android-15-16kb-page-alignment-invariant-android-15-16kb--825?format=cursor","windsurf":"/api/rules/android-15-16kb-page-alignment-invariant-android-15-16kb--825?format=windsurf","agents":"/api/rules/android-15-16kb-page-alignment-invariant-android-15-16kb--825?format=agents"}},{"id":"pqc-hybrid-mlkem768-tls13-enforcement-standard","title":"Post-Quantum Cryptography Hybrid ML-KEM-768 TLS 1.3 Handshake Enforcement","category":"security","severity":"critical","description":"Enforces mandatory Post-Quantum Cryptography (PQC) hybrid key encapsulation (ML-KEM-768 combined with classical ECDH) across all internal microservice mTLS and ingress connections. Disallows pure classical key exchange (such as standalone X25519 or NIST P-256) and TLS versions prior to 1.3 to neutralize Harvest-Now-Decrypt-Later (HNDL) attacks by quantum-capable adversaries.","antiPatternHeadline":"Accepting Classical-Only Key Exchange or Sub-TLS-1.3 Handshakes Vulnerable to HNDL Interception","stars_count":61,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","cryptography","pqc","tls1.3","ml-kem","mtls","zero-trust"],"exportEndpoints":{"claude":"/api/rules/pqc-hybrid-mlkem768-tls13-enforcement-standard?format=claude","cursorMdc":"/api/rules/pqc-hybrid-mlkem768-tls13-enforcement-standard?format=mdc","cursorrules":"/api/rules/pqc-hybrid-mlkem768-tls13-enforcement-standard?format=cursor","windsurf":"/api/rules/pqc-hybrid-mlkem768-tls13-enforcement-standard?format=windsurf","agents":"/api/rules/pqc-hybrid-mlkem768-tls13-enforcement-standard?format=agents"}},{"id":"k8s-gateway-api-referencegrant-isolation-standard-kubernetes-gatew-404","title":"Kubernetes Gateway API v1.2 Cross-Namespace ReferenceGrant Authorization Boundary","category":"devops","severity":"critical","description":"Enforces strict cross-namespace isolation boundaries under Kubernetes Gateway API v1.2 by requiring explicit ReferenceGrant resources for all cross-namespace references. Prohibits unauthorized route-to-service attachments and cross-namespace TLS secret references to eliminate ingress route hijacking, unauthorized backend routing, and certificate exfiltration.","antiPatternHeadline":"Implicit Cross-Namespace Backend and Secret References Without Cryptographic ReferenceGrant Verification","stars_count":112,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","kubernetes","gateway-api","referencegrant","security","zero-trust","multi-tenancy"],"exportEndpoints":{"claude":"/api/rules/k8s-gateway-api-referencegrant-isolation-standard-kubernetes-gatew-404?format=claude","cursorMdc":"/api/rules/k8s-gateway-api-referencegrant-isolation-standard-kubernetes-gatew-404?format=mdc","cursorrules":"/api/rules/k8s-gateway-api-referencegrant-isolation-standard-kubernetes-gatew-404?format=cursor","windsurf":"/api/rules/k8s-gateway-api-referencegrant-isolation-standard-kubernetes-gatew-404?format=windsurf","agents":"/api/rules/k8s-gateway-api-referencegrant-isolation-standard-kubernetes-gatew-404?format=agents"}},{"id":"react19-compiler-reference-identity-invariant","title":"React 19 Compiler Auto-Memoization Reference Identity Invariants for External Subscriptions","category":"frontend","severity":"critical","description":"While the React 19 compiler automates memoization for internal JSX subtrees, it does not guarantee persistent object identity or referential stability across render passes when feeding external subscription stores, event emitters, or effect dependencies. Developers must decouple external synchronization targets from compiler-scoped reactive allocations to prevent cache thrashing and tearing in state stores.","antiPatternHeadline":"Relying on React 19 compiler auto-memoization to preserve stable reference identities for external store subscribers, Map keys, and effect dependency lists","stars_count":73,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","react-compiler","referential-transparency","use-sync-external-store","performance"],"exportEndpoints":{"claude":"/api/rules/react19-compiler-reference-identity-invariant?format=claude","cursorMdc":"/api/rules/react19-compiler-reference-identity-invariant?format=mdc","cursorrules":"/api/rules/react19-compiler-reference-identity-invariant?format=cursor","windsurf":"/api/rules/react19-compiler-reference-identity-invariant?format=windsurf","agents":"/api/rules/react19-compiler-reference-identity-invariant?format=agents"}},{"id":"nextjs-15-async-request-context-boundary-next-js-15-async-935","title":"Next.js 15 Async Request Context Boundary Guardrail","category":"frontend","severity":"critical","description":"Next.js 15 transitions dynamic request APIs (`headers()`, `cookies()`, `params`, and `searchParams`) to asynchronous Promises. Accessing these properties synchronously or binding them across asynchronous execution boundaries breaks the React Server Component (RSC) AsyncLocalStorage context and risks cross-request data leaks under concurrent dynamic rendering.","antiPatternHeadline":"Synchronous Request Context Access and Async Execution Boundary Leaks","stars_count":117,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs-15","server-components","rsc","async-context","data-leak"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-async-request-context-boundary-next-js-15-async-935?format=claude","cursorMdc":"/api/rules/nextjs-15-async-request-context-boundary-next-js-15-async-935?format=mdc","cursorrules":"/api/rules/nextjs-15-async-request-context-boundary-next-js-15-async-935?format=cursor","windsurf":"/api/rules/nextjs-15-async-request-context-boundary-next-js-15-async-935?format=windsurf","agents":"/api/rules/nextjs-15-async-request-context-boundary-next-js-15-async-935?format=agents"}},{"id":"axum-08-backpressure-bounded-request-stream-invariant","title":"Axum 0.8 Backpressure-Bounded Request Stream Invariant","category":"backend","severity":"critical","description":"Prevents async runtime memory pool exhaustion during large multipart and body stream ingest by ensuring TCP backpressure propagates upstream when internal downstream workers stall or disconnect. Guarantees that asynchronous task boundaries enforce bounded buffers and structured cancellation to mitigate unbounded memory growth during interrupted or slow-consumed streams.","antiPatternHeadline":"Unbounded Channel Buffering and Detached Task Spawning in Axum Request Stream Consumption","stars_count":111,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tokio","backpressure","streams","memory-safety"],"exportEndpoints":{"claude":"/api/rules/axum-08-backpressure-bounded-request-stream-invariant?format=claude","cursorMdc":"/api/rules/axum-08-backpressure-bounded-request-stream-invariant?format=mdc","cursorrules":"/api/rules/axum-08-backpressure-bounded-request-stream-invariant?format=cursor","windsurf":"/api/rules/axum-08-backpressure-bounded-request-stream-invariant?format=windsurf","agents":"/api/rules/axum-08-backpressure-bounded-request-stream-invariant?format=agents"}},{"id":"bun-websocket-hibernation-state-synchronization-standard","title":"Bun 1.2 WebSocket Hibernation and Per-Socket State Synchronization Standard","category":"backend","severity":"critical","description":"Enforces zero-heap socket hibernation across millions of concurrent idle duplex connections using Bun 1.2's native uSockets hibernation APIs. Mandates strictly serializable, off-heap or compressed contextual data structures within `ServerWebSocket.data` to prevent JavaScript heap bloating and state divergence during rapid wake-up/sleep cycles. Eliminates closure retention and external Map-based socket registries that induce memory leaks and sub-millisecond revival stalls.","antiPatternHeadline":"Retaining In-Memory JavaScript Object References and External Socket Maps Across Hibernated Connections","stars_count":46,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","websockets","hibernation","performance","high-throughput"],"exportEndpoints":{"claude":"/api/rules/bun-websocket-hibernation-state-synchronization-standard?format=claude","cursorMdc":"/api/rules/bun-websocket-hibernation-state-synchronization-standard?format=mdc","cursorrules":"/api/rules/bun-websocket-hibernation-state-synchronization-standard?format=cursor","windsurf":"/api/rules/bun-websocket-hibernation-state-synchronization-standard?format=windsurf","agents":"/api/rules/bun-websocket-hibernation-state-synchronization-standard?format=agents"}},{"id":"postgres-17-json-table-memory-guardrail-postgres-17-json-251","title":"Postgres 17 JSON_TABLE Stream Transformation Memory Bound Guardrail","category":"backend","severity":"critical","description":"Enforces bounded memory limits and cursor-driven chunking when executing PostgreSQL 17 JSON_TABLE relational projections over large JSONB streams. Prevents backend executor out-of-memory crashes and unconstrained temporary disk spills triggered by unbounded nested path evaluations.","antiPatternHeadline":"Unbounded In-Memory Evaluation of Deeply Nested JSON_TABLE Projections Over Massive Document Sets","stars_count":82,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres","postgresql-17","json-table","jsonb","performance"],"exportEndpoints":{"claude":"/api/rules/postgres-17-json-table-memory-guardrail-postgres-17-json-251?format=claude","cursorMdc":"/api/rules/postgres-17-json-table-memory-guardrail-postgres-17-json-251?format=mdc","cursorrules":"/api/rules/postgres-17-json-table-memory-guardrail-postgres-17-json-251?format=cursor","windsurf":"/api/rules/postgres-17-json-table-memory-guardrail-postgres-17-json-251?format=windsurf","agents":"/api/rules/postgres-17-json-table-memory-guardrail-postgres-17-json-251?format=agents"}},{"id":"compose-multiplatform-skiko-vsync-pacing-guardrail","title":"Compose Multiplatform Skiko VSync Frame Pacing Invariant","category":"mobile","severity":"critical","description":"Enforces strict synchronization between Skiko rendering dispatchers and native display refresh subsystems (iOS CADisplayLink/Metal and Android Choreographer/Vulkan). Prevents visual tearing, jitter, and UI thread starvation caused by unthrottled recomposition loops or off-beat Skia draw invalidations.","antiPatternHeadline":"Unbounded Redraw Dispatching and Asynchronous Canvas Invalidation Outside Native VSync Ticks","stars_count":77,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","compose-multiplatform","skiko","metal","vulkan","rendering-pipeline"],"exportEndpoints":{"claude":"/api/rules/compose-multiplatform-skiko-vsync-pacing-guardrail?format=claude","cursorMdc":"/api/rules/compose-multiplatform-skiko-vsync-pacing-guardrail?format=mdc","cursorrules":"/api/rules/compose-multiplatform-skiko-vsync-pacing-guardrail?format=cursor","windsurf":"/api/rules/compose-multiplatform-skiko-vsync-pacing-guardrail?format=windsurf","agents":"/api/rules/compose-multiplatform-skiko-vsync-pacing-guardrail?format=agents"}},{"id":"openfga-check-linearization-consistency-standard","title":"OpenFGA 1.6 Multi-Region Cryptographic Check Linearization & Snapshot Invariance","category":"security","severity":"critical","description":"Mandates monotonic cryptographic check linearization and explicit consistency modes in OpenFGA 1.6 distributed graph evaluations. Prohibits stale snapshot traversal during cross-region tuple mutation propagation to eliminate authorization race conditions (the 'New Enemy Problem') across tenant boundaries.","antiPatternHeadline":"Stale ReBAC Snapshot Evaluation via Default Eventual Consistency During Concurrent Tuple Mutations","stars_count":56,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","rebac","linearizability","distributed-consistency","toctou"],"exportEndpoints":{"claude":"/api/rules/openfga-check-linearization-consistency-standard?format=claude","cursorMdc":"/api/rules/openfga-check-linearization-consistency-standard?format=mdc","cursorrules":"/api/rules/openfga-check-linearization-consistency-standard?format=cursor","windsurf":"/api/rules/openfga-check-linearization-consistency-standard?format=windsurf","agents":"/api/rules/openfga-check-linearization-consistency-standard?format=agents"}},{"id":"tauri-v2-scoped-ipc-buffer-guardrail","title":"Tauri 2.0 Scoped IPC Buffer Deserialization & Native Capability Guardrail","category":"security","severity":"critical","description":"Enforces strict bounds checking, memory allocation limits, and capability-scoped access controls on all IPC binary payloads entering Tauri 2.0 Rust commands from webviews. Prevents remote code execution, unauthenticated arbitrary memory access, and host privilege escalation resulting from unbounded deserialization of raw byte buffers. Guarantees full compliance with Tauri 2.0 permission sets and capability scoping invariants.","antiPatternHeadline":"Unbounded raw buffer deserialization and unvalidated native invocation from untrusted webview contexts","stars_count":46,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","tauri","ipc","rust","memory-safety","capabilities"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-scoped-ipc-buffer-guardrail?format=claude","cursorMdc":"/api/rules/tauri-v2-scoped-ipc-buffer-guardrail?format=mdc","cursorrules":"/api/rules/tauri-v2-scoped-ipc-buffer-guardrail?format=cursor","windsurf":"/api/rules/tauri-v2-scoped-ipc-buffer-guardrail?format=windsurf","agents":"/api/rules/tauri-v2-scoped-ipc-buffer-guardrail?format=agents"}},{"id":"rfc-9449-dpop-sender-constrained-token-rotation","title":"RFC 9449 OAuth DPoP Sender-Constrained Token Rotation & Verification Invariant","category":"security","severity":"critical","description":"Enforces strict RFC 9449 Demonstrating Proof-of-Possession (DPoP) verification across all microservice boundaries and edge ingress proxies. Mandates cryptographic thumbprint binding (`jkt`) in access tokens, asymmetric ephemeral key signature verification, strict HTTP method/URI claims matching, and distributed nonce-based replay prevention.","antiPatternHeadline":"Accepting Bearer Tokens with Unbound DPoP Proofs or Forwarding Ingress DPoP Proofs Downstream","stars_count":104,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","oauth2","rfc9449","dpop","cryptography","zero-trust","jwt"],"exportEndpoints":{"claude":"/api/rules/rfc-9449-dpop-sender-constrained-token-rotation?format=claude","cursorMdc":"/api/rules/rfc-9449-dpop-sender-constrained-token-rotation?format=mdc","cursorrules":"/api/rules/rfc-9449-dpop-sender-constrained-token-rotation?format=cursor","windsurf":"/api/rules/rfc-9449-dpop-sender-constrained-token-rotation?format=windsurf","agents":"/api/rules/rfc-9449-dpop-sender-constrained-token-rotation?format=agents"}},{"id":"cilium-ebpf-mutual-auth-wireguard-invariants","title":"Cilium eBPF Mutual Authentication and WireGuard Transparent Encryption Invariants","category":"devops","severity":"critical","description":"Enforces strict node-to-node transparent WireGuard encryption decoupled from control-plane mutual authentication (mTLS) handshakes using Cilium eBPF host routing. Prevents unauthenticated pod-to-pod egress fallback, eliminates sidecar proxy latency, and ensures periodic session key rotation with zero packet loss across overlay and direct routing meshes.","antiPatternHeadline":"Unencrypted Pod Egress Fallback via Broken eBPF Tail-Calls or Missing Mutual Auth Handshake Verification","stars_count":65,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","cilium","ebpf","wireguard","zero-trust","kubernetes","security"],"exportEndpoints":{"claude":"/api/rules/cilium-ebpf-mutual-auth-wireguard-invariants?format=claude","cursorMdc":"/api/rules/cilium-ebpf-mutual-auth-wireguard-invariants?format=mdc","cursorrules":"/api/rules/cilium-ebpf-mutual-auth-wireguard-invariants?format=cursor","windsurf":"/api/rules/cilium-ebpf-mutual-auth-wireguard-invariants?format=windsurf","agents":"/api/rules/cilium-ebpf-mutual-auth-wireguard-invariants?format=agents"}},{"id":"postgres-17-logical-failover-slot-sync-postgres-17-logi-121","title":"PostgreSQL 17 Logical Replication Failover Slot Synchronization","category":"backend","severity":"critical","description":"Enforces configuration, verification, and migration guardrails for PostgreSQL 17 native logical replication failover slot synchronization. Ensures all logical replication slots on primary instances are created with failover enabled (`failover = true`) and synchronized to physical standbys via `sync_replication_slots` and `synchronized_standby_slots`. This prevents subscriber rewind, stream invalidation, and data duplication or silent data loss when a physical standby is promoted.","antiPatternHeadline":"Creating unsynced logical replication slots or promoting physical standbys without synchronized LSN verification","stars_count":71,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres","postgres-17","logical-replication","high-availability","database-reliability"],"exportEndpoints":{"claude":"/api/rules/postgres-17-logical-failover-slot-sync-postgres-17-logi-121?format=claude","cursorMdc":"/api/rules/postgres-17-logical-failover-slot-sync-postgres-17-logi-121?format=mdc","cursorrules":"/api/rules/postgres-17-logical-failover-slot-sync-postgres-17-logi-121?format=cursor","windsurf":"/api/rules/postgres-17-logical-failover-slot-sync-postgres-17-logi-121?format=windsurf","agents":"/api/rules/postgres-17-logical-failover-slot-sync-postgres-17-logi-121?format=agents"}},{"id":"vite6-ssr-environment-isolation-barrier","title":"Vite 6 Environment API Heterogeneous SSR Runtime Isolation","category":"frontend","severity":"critical","description":"Enforces strict runtime and module-graph boundary isolation across heterogeneous SSR execution targets (e.g., Workerd, Node.js, Deno) cohabiting a single Vite 6 dev server. Mandates dedicated DevEnvironment instances, eliminates legacy ssrLoadModule usage, and prevents cross-environment global singleton leakage.","antiPatternHeadline":"Cross-Runtime Module Graph Contamination & Deprecated ssrLoadModule Invocations in Heterogeneous SSR Dev Servers","stars_count":92,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["vite","vite6","ssr","workerd","environment-api","module-graph","cloudflare-workers"],"exportEndpoints":{"claude":"/api/rules/vite6-ssr-environment-isolation-barrier?format=claude","cursorMdc":"/api/rules/vite6-ssr-environment-isolation-barrier?format=mdc","cursorrules":"/api/rules/vite6-ssr-environment-isolation-barrier?format=cursor","windsurf":"/api/rules/vite6-ssr-environment-isolation-barrier?format=windsurf","agents":"/api/rules/vite6-ssr-environment-isolation-barrier?format=agents"}},{"id":"capacitor7-webauthn-prf-secure-vault-guardrail","title":"Hardware-Backed WebAuthn PRF Key Derivation and Zero-Knowledge Storage Standard","category":"mobile","severity":"critical","description":"Mandates that cryptographic master keys derived via WebAuthn PRF (Pseudo-Random Function) extensions in Capacitor 7 applications remain strictly ephemeral, zero-knowledge, and memory-isolated. Prohibits persistence of raw PRF outputs, enforces cryptographically separated HKDF key derivation, and mandates explicit in-memory zeroization of raw key material to secure offline storage.","antiPatternHeadline":"Persisting Raw PRF Outputs or Leaking Unwiped Key Buffers into Capacitor Storage","stars_count":107,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","webauthn","prf","cryptography","zero-knowledge","security"],"exportEndpoints":{"claude":"/api/rules/capacitor7-webauthn-prf-secure-vault-guardrail?format=claude","cursorMdc":"/api/rules/capacitor7-webauthn-prf-secure-vault-guardrail?format=mdc","cursorrules":"/api/rules/capacitor7-webauthn-prf-secure-vault-guardrail?format=cursor","windsurf":"/api/rules/capacitor7-webauthn-prf-secure-vault-guardrail?format=windsurf","agents":"/api/rules/capacitor7-webauthn-prf-secure-vault-guardrail?format=agents"}},{"id":"bun-native-ffi-memory-boundary-invariants","title":"Bun 1.2 Native FFI Direct-Transfer Memory Boundary & Lifetime Management","category":"backend","severity":"critical","description":"Enforces strict ownership, lifetime pinning, and explicit deallocation contracts across Bun 1.2 native Foreign Function Interface (FFI) boundaries. Prevents segmentation faults, double-frees, and use-after-free corruptions during zero-copy Pointer and TypedArray/ArrayBuffer transfers between JavaScriptCore and native C/Rust runtimes.","antiPatternHeadline":"Implicit GC Reliance and Dangling Pointers in Zero-Copy Bun FFI Transfers","stars_count":75,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","ffi","memory-management","rust","c-bindings","zero-copy"],"exportEndpoints":{"claude":"/api/rules/bun-native-ffi-memory-boundary-invariants?format=claude","cursorMdc":"/api/rules/bun-native-ffi-memory-boundary-invariants?format=mdc","cursorrules":"/api/rules/bun-native-ffi-memory-boundary-invariants?format=cursor","windsurf":"/api/rules/bun-native-ffi-memory-boundary-invariants?format=windsurf","agents":"/api/rules/bun-native-ffi-memory-boundary-invariants?format=agents"}},{"id":"cilium-ebpf-spiffe-mtls-validation","title":"Cilium eBPF In-Kernel SPIFFE/SPIRE mTLS Handshake & Identity Enforcement","category":"devops","severity":"critical","description":"Enforces cryptographically attested SPIFFE workload identities at the eBPF socket layer without user-space sidecar proxies. Mandates deterministic SPIRE agent socket provisioning, kTLS kernel module compatibility, and strict CiliumNetworkPolicy mutual authentication blocks.","antiPatternHeadline":"Deploying User-Space Envoy Sidecars or Permitting Plaintext Ingress Without SPIRE eBPF Authentication Blocks","stars_count":84,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["cilium","ebpf","spiffe","spire","mtls","kubernetes","zero-trust","devops"],"exportEndpoints":{"claude":"/api/rules/cilium-ebpf-spiffe-mtls-validation?format=claude","cursorMdc":"/api/rules/cilium-ebpf-spiffe-mtls-validation?format=mdc","cursorrules":"/api/rules/cilium-ebpf-spiffe-mtls-validation?format=cursor","windsurf":"/api/rules/cilium-ebpf-spiffe-mtls-validation?format=windsurf","agents":"/api/rules/cilium-ebpf-spiffe-mtls-validation?format=agents"}},{"id":"post-quantum-hybrid-mlkem768-tls13-standard","title":"Post-Quantum ML-KEM Hybrid TLS 1.3 Edge Invariant","category":"security","severity":"critical","description":"Mandates that all external edge ingress termination points, reverse proxies, and edge gateways enforce TLS 1.3 with post-quantum hybrid key exchange (X25519+ML-KEM-768). This invariant eliminates Harvest Now, Decrypt Later (HNDL) exposure by ensuring ephemeral session keys cannot be decrypted retroactively by Cryptanalytically Relevant Quantum Computers (CRQCs). Classical-only key exchange groups (pure X25519, secp256r1, secp384r1) and protocols prior to TLS 1.3 are strictly forbidden on perimeter interfaces.","antiPatternHeadline":"Permitting Classical-Only ECDHE Key Exchange on External Ingress Gateways, Exposing In-Transit Data to Retrospective Quantum Decryption","stars_count":62,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","post-quantum","ml-kem","tls1.3","ingress","zero-trust","cryptography"],"exportEndpoints":{"claude":"/api/rules/post-quantum-hybrid-mlkem768-tls13-standard?format=claude","cursorMdc":"/api/rules/post-quantum-hybrid-mlkem768-tls13-standard?format=mdc","cursorrules":"/api/rules/post-quantum-hybrid-mlkem768-tls13-standard?format=cursor","windsurf":"/api/rules/post-quantum-hybrid-mlkem768-tls13-standard?format=windsurf","agents":"/api/rules/post-quantum-hybrid-mlkem768-tls13-standard?format=agents"}},{"id":"go-chi-http3-0rtt-anti-replay-ledger-standard","title":"Go Chi HTTP/3 0-RTT Anti-Replay Ledger Standard","category":"backend","severity":"critical","description":"Enforces distributed, monotonic token-binding checks on early-data requests to eliminate idempotent state mutation risks over QUIC (HTTP/3 0-RTT). Replay attacks in early-data connections can cause non-idempotent or supposedly idempotent endpoints to execute multiple times before handshake completion unless strictly mitigated via an ephemeral, monotonic ledger. This standard mandates explicit rejection or atomic ledger recording of 0-RTT requests before any routing logic in Go Chi services.","antiPatternHeadline":"Trusting HTTP/3 Early Data Without Atomic Distributed Monotonic Replay Binding","stars_count":55,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","chi","http3","quic","zero-rtt","security","anti-replay"],"exportEndpoints":{"claude":"/api/rules/go-chi-http3-0rtt-anti-replay-ledger-standard?format=claude","cursorMdc":"/api/rules/go-chi-http3-0rtt-anti-replay-ledger-standard?format=mdc","cursorrules":"/api/rules/go-chi-http3-0rtt-anti-replay-ledger-standard?format=cursor","windsurf":"/api/rules/go-chi-http3-0rtt-anti-replay-ledger-standard?format=windsurf","agents":"/api/rules/go-chi-http3-0rtt-anti-replay-ledger-standard?format=agents"}},{"id":"react19-action-state-hydration-interlock","title":"React 19 Action-State Hydration Interlock & Progressive Enhancement Queueing","category":"frontend","severity":"critical","description":"Enforces strict transactional integrity during Progressive Enhancement by decoupling native multi-part form submissions from unhydrated Server Action closures. Forms utilizing React 19's `useActionState` and Server Actions must interlock submission events until the client runtime has fully hydrated action references, preventing race conditions, dual-submission anomalies, and lost client state transitions.","antiPatternHeadline":"Submitting unhydrated native forms during SSR bootstrap causing unhandled multi-part boundary desynchronization and orphaned client action state.","stars_count":69,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react19","server-actions","useActionState","progressive-enhancement","hydration"],"exportEndpoints":{"claude":"/api/rules/react19-action-state-hydration-interlock?format=claude","cursorMdc":"/api/rules/react19-action-state-hydration-interlock?format=mdc","cursorrules":"/api/rules/react19-action-state-hydration-interlock?format=cursor","windsurf":"/api/rules/react19-action-state-hydration-interlock?format=windsurf","agents":"/api/rules/react19-action-state-hydration-interlock?format=agents"}},{"id":"kmp-compose-darwin-runloop-render-isolation","title":"Compose Multiplatform iOS Darwin RunLoop Rendering Isolation","category":"mobile","severity":"critical","description":"Mandate strict decoupling of high-frequency reactive event streams from Compose Multiplatform scene invalidation on iOS. Unmitigated state mutations executed on Dispatchers.Main starve the Darwin RunLoop and CADisplayLink callbacks, causing severe frame drops and touch latency.","antiPatternHeadline":"Pumping unthrottled background streams directly into Compose State on Dispatchers.Main on iOS","stars_count":94,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kmp","compose-multiplatform","ios","skiko","coroutines","runloop"],"exportEndpoints":{"claude":"/api/rules/kmp-compose-darwin-runloop-render-isolation?format=claude","cursorMdc":"/api/rules/kmp-compose-darwin-runloop-render-isolation?format=mdc","cursorrules":"/api/rules/kmp-compose-darwin-runloop-render-isolation?format=cursor","windsurf":"/api/rules/kmp-compose-darwin-runloop-render-isolation?format=windsurf","agents":"/api/rules/kmp-compose-darwin-runloop-render-isolation?format=agents"}},{"id":"webauthn-device-bound-origin-lockout-guardrail","title":"WebAuthn Origin Lockout & Top-Level Context Enforcement Standard","category":"security","severity":"critical","description":"Enforces cryptographic origin validation and strict Relying Party ID (RP-ID) verification against raw clientDataJSON on the authentication server, coupled with strict Permissions-Policy iframe exclusion. Prevents reverse-proxy Adversary-in-the-Middle (AitM) phishing frameworks from capturing or relaying passkey ceremonies across spoofed or sub-framed origins.","antiPatternHeadline":"Lenient origin parsing, regex suffix matching, or trusting client headers during WebAuthn assertion verification.","stars_count":62,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","fido2","passkeys","phishing-defense","cryptography"],"exportEndpoints":{"claude":"/api/rules/webauthn-device-bound-origin-lockout-guardrail?format=claude","cursorMdc":"/api/rules/webauthn-device-bound-origin-lockout-guardrail?format=mdc","cursorrules":"/api/rules/webauthn-device-bound-origin-lockout-guardrail?format=cursor","windsurf":"/api/rules/webauthn-device-bound-origin-lockout-guardrail?format=windsurf","agents":"/api/rules/webauthn-device-bound-origin-lockout-guardrail?format=agents"}},{"id":"react-19-activity-webgl-context-suspension","title":"React 19 Activity WebGL/WebGPU Context Suspension & Resource Teardown Invariant","category":"frontend","severity":"critical","description":"Enforces proactive suspension of WebGL/WebGPU render loops and transient GPU memory deallocation when component subtrees transition into hidden React 19 Activity boundaries. Prevents host OS VRAM exhaustion, hardware context loss (webglcontextlost), and GPU thread starvation during background navigation.","antiPatternHeadline":"Leaking Active WebGL/WebGPU Contexts and Render Loops Inside Hidden React 19 Activity Subtrees","stars_count":49,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["react19","activity","webgl","webgpu","threejs","memory-management","performance"],"exportEndpoints":{"claude":"/api/rules/react-19-activity-webgl-context-suspension?format=claude","cursorMdc":"/api/rules/react-19-activity-webgl-context-suspension?format=mdc","cursorrules":"/api/rules/react-19-activity-webgl-context-suspension?format=cursor","windsurf":"/api/rules/react-19-activity-webgl-context-suspension?format=windsurf","agents":"/api/rules/react-19-activity-webgl-context-suspension?format=agents"}},{"id":"svelte-5-snippet-context-leak-guardrail","title":"Svelte 5 Polymorphic Snippet Lifecycle and Closure Retain Cycle Prevention","category":"frontend","severity":"critical","description":"Mandates deterministic lifecycle management and closure scoping for polymorphic Svelte 5 snippets passed across reactive boundaries. Prevents detached DOM subtree retention and memory leaks caused by capturing lexical state in long-lived contexts during dynamic component unmounting.","antiPatternHeadline":"Retaining Detached Snippet Closures and Lexical State in Long-Lived Contexts","stars_count":90,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","snippets","memory-leaks","performance"],"exportEndpoints":{"claude":"/api/rules/svelte-5-snippet-context-leak-guardrail?format=claude","cursorMdc":"/api/rules/svelte-5-snippet-context-leak-guardrail?format=mdc","cursorrules":"/api/rules/svelte-5-snippet-context-leak-guardrail?format=cursor","windsurf":"/api/rules/svelte-5-snippet-context-leak-guardrail?format=windsurf","agents":"/api/rules/svelte-5-snippet-context-leak-guardrail?format=agents"}},{"id":"postgres-17-streaming-io-read-ahead-concurrency-boundary","title":"Postgres 17 Streaming I/O Read-Ahead Concurrency Boundary Enforcement","category":"backend","severity":"critical","description":"Enforces strict upper bounds on asynchronous block prefetch queue depths and parallel worker fan-out in PostgreSQL 17. Prevents NVMe/EBS storage controller queue saturation, IOPS quota exhaustion, and severe p99 tail latency spikes on concurrent OLTP transactions caused by unbounded parallel analytical scans utilizing streaming read-ahead.","antiPatternHeadline":"Unbounded parallel analytical scans flooding storage controllers via Postgres 17 streaming read-ahead queues","stars_count":90,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres","performance","database","storage","io"],"exportEndpoints":{"claude":"/api/rules/postgres-17-streaming-io-read-ahead-concurrency-boundary?format=claude","cursorMdc":"/api/rules/postgres-17-streaming-io-read-ahead-concurrency-boundary?format=mdc","cursorrules":"/api/rules/postgres-17-streaming-io-read-ahead-concurrency-boundary?format=cursor","windsurf":"/api/rules/postgres-17-streaming-io-read-ahead-concurrency-boundary?format=windsurf","agents":"/api/rules/postgres-17-streaming-io-read-ahead-concurrency-boundary?format=agents"}},{"id":"tauri-v2-mobile-ipc-backpressure-saturation-standard","title":"Tauri 2.0 Mobile IPC Buffer Backpressure and Flow Control Standard","category":"mobile","severity":"critical","description":"Enforces bounded channel backpressure, rate-limiting, and chunked binary transfers over Tauri 2.0 IPC between mobile WebViews and the Rust core. Prevents main UI thread starvation, Android ANR (Application Not Responding) triggers, and iOS watchdog kills caused by bridge queue saturation under high-frequency event bursts.","antiPatternHeadline":"Unbounded Fire-and-Forget IPC Event Flooding Across Mobile WebView Bridges","stars_count":117,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri-2","rust","ipc","performance","backpressure"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-mobile-ipc-backpressure-saturation-standard?format=claude","cursorMdc":"/api/rules/tauri-v2-mobile-ipc-backpressure-saturation-standard?format=mdc","cursorrules":"/api/rules/tauri-v2-mobile-ipc-backpressure-saturation-standard?format=cursor","windsurf":"/api/rules/tauri-v2-mobile-ipc-backpressure-saturation-standard?format=windsurf","agents":"/api/rules/tauri-v2-mobile-ipc-backpressure-saturation-standard?format=agents"}},{"id":"react-native-fabric-synchronous-layout-deadlock-guardrail","title":"React Native Fabric Synchronous Layout Deadlock Guardrail","category":"mobile","severity":"critical","description":"Enforces strict isolation between asynchronous C++ Fabric shadow tree mutations and UI-thread synchronous layout queries. Prevents priority inversion and mutual-exclusion deadlocks between the native UI thread and the JS/Shadow thread during active gesture responder lifecycles and layout recalculations.","antiPatternHeadline":"Synchronous DOM-style Layout Queries Inside High-Frequency Gesture or Mutation Handlers Under the Fabric Renderer","stars_count":73,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","react-native","fabric","reanimated","concurrency","c++"],"exportEndpoints":{"claude":"/api/rules/react-native-fabric-synchronous-layout-deadlock-guardrail?format=claude","cursorMdc":"/api/rules/react-native-fabric-synchronous-layout-deadlock-guardrail?format=mdc","cursorrules":"/api/rules/react-native-fabric-synchronous-layout-deadlock-guardrail?format=cursor","windsurf":"/api/rules/react-native-fabric-synchronous-layout-deadlock-guardrail?format=windsurf","agents":"/api/rules/react-native-fabric-synchronous-layout-deadlock-guardrail?format=agents"}},{"id":"rfc-9449-dpop-edge-nonce-replay-boundary","title":"RFC 9449 DPoP Edge Nonce Replay-Proof Synchronization Boundary","category":"security","severity":"critical","description":"Enforces sub-millisecond distributed nonce validation and cryptographic binding verification for sender-constrained OAuth 2.0 DPoP access tokens across multi-region stateless edge gateways. Mandates atomic consumption, single-use guarantees, and high-entropy sliding-window nonce generation to completely prevent replay attacks across globally replicated datastores.","antiPatternHeadline":"Stateless In-Memory or Asynchronous Nonce Caching Allowing Cross-Region DPoP Replay Windows","stars_count":73,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","oauth2","rfc9449","dpop","edge-computing","distributed-systems","crypto"],"exportEndpoints":{"claude":"/api/rules/rfc-9449-dpop-edge-nonce-replay-boundary?format=claude","cursorMdc":"/api/rules/rfc-9449-dpop-edge-nonce-replay-boundary?format=mdc","cursorrules":"/api/rules/rfc-9449-dpop-edge-nonce-replay-boundary?format=cursor","windsurf":"/api/rules/rfc-9449-dpop-edge-nonce-replay-boundary?format=windsurf","agents":"/api/rules/rfc-9449-dpop-edge-nonce-replay-boundary?format=agents"}},{"id":"spiffe-spire-svid-nonblocking-rotation-standard","title":"SPIFFE/SPIRE Ephemeral SVID Non-Blocking Rotation and Overlap Margin Standard","category":"security","severity":"critical","description":"Enforces proactive, asynchronous rotation of X.509 SVIDs prior to cryptographic expiry using deterministic grace overlap margins. Eliminates in-flight mTLS handshake failures and transport-layer downtime by decoupling the Workload API fetch loop from TLS context creation and socket-level negotiation.","antiPatternHeadline":"Synchronous or Lazy SVID Refresh Triggering Handshake Drops and TLS Expiry Invalidation","stars_count":52,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","spiffe","spire","mtls","zero-trust","cryptography"],"exportEndpoints":{"claude":"/api/rules/spiffe-spire-svid-nonblocking-rotation-standard?format=claude","cursorMdc":"/api/rules/spiffe-spire-svid-nonblocking-rotation-standard?format=mdc","cursorrules":"/api/rules/spiffe-spire-svid-nonblocking-rotation-standard?format=cursor","windsurf":"/api/rules/spiffe-spire-svid-nonblocking-rotation-standard?format=windsurf","agents":"/api/rules/spiffe-spire-svid-nonblocking-rotation-standard?format=agents"}},{"id":"k8s-dra-gpu-lifecycle-sanitization-invariant","title":"Deterministic Teardown and Memory Sanitization Invariant for DRA GPU Claims","category":"devops","severity":"critical","description":"Enforces deterministic teardown, compute context purging, and volatile memory sanitization for Dynamic Resource Allocation (DRA) GPU ResourceClaims between ephemeral container lifecycles. Prevents inter-tenant cross-contamination and persistent device allocation leaks in hardware-partitioned accelerators (such as NVIDIA MIG or MPS slices) by strictly sequencing driver deallocation phases with hardware sanitization handshakes.","antiPatternHeadline":"Unsanitized Ephemeral Pod Deallocation Leaving Stale Hardware Contexts in Reusable GPU Partitions","stars_count":104,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","kubernetes","dra","gpu","nvidia-mig","resource-claims","zero-trust"],"exportEndpoints":{"claude":"/api/rules/k8s-dra-gpu-lifecycle-sanitization-invariant?format=claude","cursorMdc":"/api/rules/k8s-dra-gpu-lifecycle-sanitization-invariant?format=mdc","cursorrules":"/api/rules/k8s-dra-gpu-lifecycle-sanitization-invariant?format=cursor","windsurf":"/api/rules/k8s-dra-gpu-lifecycle-sanitization-invariant?format=windsurf","agents":"/api/rules/k8s-dra-gpu-lifecycle-sanitization-invariant?format=agents"}},{"id":"otel-w3c-baggage-depth-containment-standard","title":"OpenTelemetry W3C Baggage Payload Budget and Key-Value Depth Containment","category":"devops","severity":"critical","description":"Enforces strict bounds on OpenTelemetry W3C Baggage injection and propagation across distributed tracing pipelines to prevent distributed telemetry bloat. Mandates a maximum payload budget of 2,048 bytes, strict key-value entry caps (maximum 16 items), and per-entry byte boundaries to eliminate catastrophic HTTP 431 Request Header Fields Too Large rejections across ingress proxies, API gateways, and downstream microservices.","antiPatternHeadline":"Unbounded Propagation of Arbitrary Telemetry Context Triggering Ingress HTTP 431 Cascades","stars_count":57,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","observability","distributed-tracing","w3c-baggage","reliability"],"exportEndpoints":{"claude":"/api/rules/otel-w3c-baggage-depth-containment-standard?format=claude","cursorMdc":"/api/rules/otel-w3c-baggage-depth-containment-standard?format=mdc","cursorrules":"/api/rules/otel-w3c-baggage-depth-containment-standard?format=cursor","windsurf":"/api/rules/otel-w3c-baggage-depth-containment-standard?format=windsurf","agents":"/api/rules/otel-w3c-baggage-depth-containment-standard?format=agents"}},{"id":"react-19-metadata-hoisting-preload-deduplication","title":"React 19 Native Document Metadata Hoisting & Resource Preload Invariants","category":"frontend","severity":"critical","description":"Enforces strict utilization of React 19 native document metadata hoisting (<title>, <meta>, <link>) and standard ReactDOM preload APIs (preload, preinit, preconnect) within render trees. Prevents runtime DOM mutation race conditions, SSR streaming head desynchronization, and hydration cascading waterfalls caused by legacy third-party head wrappers.","antiPatternHeadline":"Mutating Head via Legacy Head Managers or Imperative useEffect Injection","stars_count":84,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","performance","ssr","hydration","metadata"],"exportEndpoints":{"claude":"/api/rules/react-19-metadata-hoisting-preload-deduplication?format=claude","cursorMdc":"/api/rules/react-19-metadata-hoisting-preload-deduplication?format=mdc","cursorrules":"/api/rules/react-19-metadata-hoisting-preload-deduplication?format=cursor","windsurf":"/api/rules/react-19-metadata-hoisting-preload-deduplication?format=windsurf","agents":"/api/rules/react-19-metadata-hoisting-preload-deduplication?format=agents"}},{"id":"nextjs-15-ppr-streaming-shell-boundary-standard","title":"Next.js 15 Partial Prerendering (PPR) Streaming Shell Boundary Guardrail","category":"frontend","severity":"critical","description":"Enforces strict isolation between prerendered static layout shells and dynamic runtime components in Next.js 15 PPR. Dynamically evaluated APIs such as cookies(), headers(), searchParams, or dynamic uncached fetch requests must never bleed into root layout or page-level static contexts, guaranteeing near-zero edge TTFB via granular Suspense boundaries.","antiPatternHeadline":"Leaking Dynamic Accessors into Static Shell Layouts Deoptimizing PPR to Full SSR","stars_count":79,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs","react-server-components","ppr","performance","streaming"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-ppr-streaming-shell-boundary-standard?format=claude","cursorMdc":"/api/rules/nextjs-15-ppr-streaming-shell-boundary-standard?format=mdc","cursorrules":"/api/rules/nextjs-15-ppr-streaming-shell-boundary-standard?format=cursor","windsurf":"/api/rules/nextjs-15-ppr-streaming-shell-boundary-standard?format=windsurf","agents":"/api/rules/nextjs-15-ppr-streaming-shell-boundary-standard?format=agents"}},{"id":"svelte-5-snippet-immutability-scope-isolation","title":"Svelte 5 Snippet Parameter Immutability & Scope Isolation","category":"frontend","severity":"critical","description":"Enforces unidirectional data flow and strict parameter immutability within Svelte 5 snippets (`{#snippet ...}`). Prohibits mutating snippet-passed references or binding directly to external parent scopes from inside snippet blocks, which breaks reactive isolation boundaries and triggers cascading re-render loops or memory leaks across component boundaries.","antiPatternHeadline":"Mutating Snippet Arguments Directly or Creating Bidirectional State Couplings Across Snippet Closures","stars_count":95,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","snippets","runes","reactivity","immutability"],"exportEndpoints":{"claude":"/api/rules/svelte-5-snippet-immutability-scope-isolation?format=claude","cursorMdc":"/api/rules/svelte-5-snippet-immutability-scope-isolation?format=mdc","cursorrules":"/api/rules/svelte-5-snippet-immutability-scope-isolation?format=cursor","windsurf":"/api/rules/svelte-5-snippet-immutability-scope-isolation?format=windsurf","agents":"/api/rules/svelte-5-snippet-immutability-scope-isolation?format=agents"}},{"id":"axum-0-8-h3-multiplex-graceful-drain","title":"Axum 0.8 HTTP/3 & QUIC Multiplexed Stream Graceful Drain Standard","category":"backend","severity":"critical","description":"Enforces zero-loss termination of in-flight QUIC bidirectional streams and HTTP/3 frames during continuous orchestrator rolling updates. Mandates two-phase shutdown via GOAWAY frame broadcasting, unbinding incoming connection listeners, and explicit stream join coordination via token-gated timeouts before Quinn/s2n-quic endpoint disposal.","antiPatternHeadline":"Abrupt QUIC Endpoint Drop and Ungraceful Process Exit Dropping Active Multiplexed HTTP/3 Streams on SIGTERM","stars_count":74,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","http3","quic","tokio","kubernetes"],"exportEndpoints":{"claude":"/api/rules/axum-0-8-h3-multiplex-graceful-drain?format=claude","cursorMdc":"/api/rules/axum-0-8-h3-multiplex-graceful-drain?format=mdc","cursorrules":"/api/rules/axum-0-8-h3-multiplex-graceful-drain?format=cursor","windsurf":"/api/rules/axum-0-8-h3-multiplex-graceful-drain?format=windsurf","agents":"/api/rules/axum-0-8-h3-multiplex-graceful-drain?format=agents"}},{"id":"postgres-17-adaptive-workmem-parallel-hash-guardrail","title":"PostgreSQL 17 Adaptive work_mem and Parallel Hash Join OOM Guardrail","category":"backend","severity":"critical","description":"Enforces dynamic, worker-aware work_mem bounding and concurrency limits for PostgreSQL 17 parallel hash joins. Prevents cumulative per-node memory multiplication across parallel workers from breaching container cgroup ceilings and triggering kernel OOM-killer terminations.","antiPatternHeadline":"Unbounded work_mem Sizing with High Parallel Worker Concurrency Causing Container OOM Terminations","stars_count":87,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","performance","memory-management","database"],"exportEndpoints":{"claude":"/api/rules/postgres-17-adaptive-workmem-parallel-hash-guardrail?format=claude","cursorMdc":"/api/rules/postgres-17-adaptive-workmem-parallel-hash-guardrail?format=mdc","cursorrules":"/api/rules/postgres-17-adaptive-workmem-parallel-hash-guardrail?format=cursor","windsurf":"/api/rules/postgres-17-adaptive-workmem-parallel-hash-guardrail?format=windsurf","agents":"/api/rules/postgres-17-adaptive-workmem-parallel-hash-guardrail?format=agents"}},{"id":"go-1-24-weak-reference-cache-standard","title":"Go 1.24 Weak Reference Cache Eviction Standard","category":"backend","severity":"critical","description":"Mandates the use of Go 1.24's native weak package to eliminate memory leaks and unbounded heap growth in high-throughput in-memory entity caches. Caches storing canonical entities must store weak.Pointer instances to permit timely runtime garbage collection, pairing retrievals with mandatory nil checks and deferred key pruning.","antiPatternHeadline":"Retaining Strong Pointers in In-Memory Caches Leading to Unbounded Heap Retention and GC Pressure","stars_count":42,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","golang","memory-management","garbage-collection","caching"],"exportEndpoints":{"claude":"/api/rules/go-1-24-weak-reference-cache-standard?format=claude","cursorMdc":"/api/rules/go-1-24-weak-reference-cache-standard?format=mdc","cursorrules":"/api/rules/go-1-24-weak-reference-cache-standard?format=cursor","windsurf":"/api/rules/go-1-24-weak-reference-cache-standard?format=windsurf","agents":"/api/rules/go-1-24-weak-reference-cache-standard?format=agents"}},{"id":"tauri-v2-mobile-ipc-capability-sandboxing-tauri-2-0-scoped-348","title":"Tauri 2.0 Scoped Mobile IPC Capability Sandboxing and Permission Isolation","category":"mobile","severity":"critical","description":"Enforces strict isolation of Tauri 2.0 native mobile commands and plugin subsystems using deterministic capability schemas. Restricts dynamic webview modules from invoking wildcard commands, enforcing path-scoped filesystem access, bounded window/webview target associations, and cryptographically verified origin validation on iOS and Android.","antiPatternHeadline":"Pervasive Wildcard IPC Permissions and Unscoped Native Execution from Untrusted Webview Contexts","stars_count":44,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri-2","ipc-security","rust","capabilities","sandboxing"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-mobile-ipc-capability-sandboxing-tauri-2-0-scoped-348?format=claude","cursorMdc":"/api/rules/tauri-v2-mobile-ipc-capability-sandboxing-tauri-2-0-scoped-348?format=mdc","cursorrules":"/api/rules/tauri-v2-mobile-ipc-capability-sandboxing-tauri-2-0-scoped-348?format=cursor","windsurf":"/api/rules/tauri-v2-mobile-ipc-capability-sandboxing-tauri-2-0-scoped-348?format=windsurf","agents":"/api/rules/tauri-v2-mobile-ipc-capability-sandboxing-tauri-2-0-scoped-348?format=agents"}},{"id":"webauthn-prf-hardware-bound-zk-encryption","title":"Hardware-Bound Zero-Knowledge Encryption via WebAuthn PRF Extension","category":"security","severity":"critical","description":"Enforces strict cryptographic domain separation and ephemeral memory isolation for symmetric keys derived via the WebAuthn Pseudo-Random Function (PRF) extension. Guarantees that raw PRF outputs and derived symmetric keys remain completely client-side, non-extractable, and hardware-bound without leaking key material or authenticating hashes to remote servers or persistent web storage.","antiPatternHeadline":"Direct Raw PRF Key Ingestion, Extractable CryptoKey Storage, and Server-Side PRF Output Transmission","stars_count":111,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","fido2","prf-extension","zero-knowledge","web-crypto"],"exportEndpoints":{"claude":"/api/rules/webauthn-prf-hardware-bound-zk-encryption?format=claude","cursorMdc":"/api/rules/webauthn-prf-hardware-bound-zk-encryption?format=mdc","cursorrules":"/api/rules/webauthn-prf-hardware-bound-zk-encryption?format=cursor","windsurf":"/api/rules/webauthn-prf-hardware-bound-zk-encryption?format=windsurf","agents":"/api/rules/webauthn-prf-hardware-bound-zk-encryption?format=agents"}},{"id":"sigstore-cosign-slsa3-oidc-provenance-ledger","title":"Enforce Sigstore Cosign SLSA-3 Ephemeral OIDC Provenance Ledger","category":"devops","severity":"critical","description":"Enforces short-lived workload identity federation (OIDC) to cryptographically sign container images and generate SLSA-3 build provenance ledgers without long-lived static private keys. Requires mandatory verification of immutable digests against Fulcio certificates and Rekor transparency logs within automated deployment pipelines.","antiPatternHeadline":"Signing artifacts with long-lived static private keys stored in CI secrets without Rekor transparency or OIDC claims","stars_count":52,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","security","sigstore","cosign","slsa-3","supply-chain","oidc"],"exportEndpoints":{"claude":"/api/rules/sigstore-cosign-slsa3-oidc-provenance-ledger?format=claude","cursorMdc":"/api/rules/sigstore-cosign-slsa3-oidc-provenance-ledger?format=mdc","cursorrules":"/api/rules/sigstore-cosign-slsa3-oidc-provenance-ledger?format=cursor","windsurf":"/api/rules/sigstore-cosign-slsa3-oidc-provenance-ledger?format=windsurf","agents":"/api/rules/sigstore-cosign-slsa3-oidc-provenance-ledger?format=agents"}},{"id":"opentelemetry-profiling-cpu-budget-guardrail","title":"OpenTelemetry Continuous Profiling Thread CPU-Time Allocation Guardrail","category":"devops","severity":"critical","description":"Enforces adaptive sampling budgets and hardware thread accounting to strictly cap continuous profiling and native runtime stack unwinding overhead to under 1% total CPU allocation. Prevents telemetry-induced tail-latency spikes and CPU starvation under high concurrency by dynamically adjusting sampling frequency via a PID controller or sliding-window token bucket.","antiPatternHeadline":"Unbounded Continuous Profiling Thread Execution Without Dynamic CPU Budget Throttling","stars_count":46,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","continuous-profiling","observability","ebpf","performance-budget"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-profiling-cpu-budget-guardrail?format=claude","cursorMdc":"/api/rules/opentelemetry-profiling-cpu-budget-guardrail?format=mdc","cursorrules":"/api/rules/opentelemetry-profiling-cpu-budget-guardrail?format=cursor","windsurf":"/api/rules/opentelemetry-profiling-cpu-budget-guardrail?format=windsurf","agents":"/api/rules/opentelemetry-profiling-cpu-budget-guardrail?format=agents"}},{"id":"nextjs-15-ppr-boundary-payload-isolation","title":"Next.js 15 PPR Dynamic Stream Isolation and Static Shell Invariant","category":"frontend","severity":"critical","description":"Enforces strict isolation of dynamic runtime headers, cookies, and asynchronous flight data within React Suspense boundaries under Next.js 15 Partial Prerendering (PPR). Prevents dynamic execution leakage into the pre-rendered static shell, eliminating non-deterministic microtask stalls and full-route dynamic de-optimization during high-concurrency stale-while-revalidate cycles.","antiPatternHeadline":"Unbounded Dynamic Operations Causing Static Shell De-optimization and Flight Payload Bleed","stars_count":62,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs","react-19","ppr","rsc","concurrency","performance"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-ppr-boundary-payload-isolation?format=claude","cursorMdc":"/api/rules/nextjs-15-ppr-boundary-payload-isolation?format=mdc","cursorrules":"/api/rules/nextjs-15-ppr-boundary-payload-isolation?format=cursor","windsurf":"/api/rules/nextjs-15-ppr-boundary-payload-isolation?format=windsurf","agents":"/api/rules/nextjs-15-ppr-boundary-payload-isolation?format=agents"}},{"id":"kmp-native-coroutine-memory-arena-isolation","title":"Kotlin Multiplatform 2.1 Native Coroutine Lifecycle and Memory Arena Isolation","category":"mobile","severity":"critical","description":"Enforces strict boundary isolation between Swift Concurrency tasks and Kotlin Native coroutine execution in KMP 2.1. Prevents unmanaged memory pinning, native arena escapes across suspension points, and thread starvation on Apple GCD runtimes through explicit structured cancellation propagation.","antiPatternHeadline":"Unscoped Swift-Kotlin Continuation Bridging and Cross-Suspension Native Arena Pinning","stars_count":77,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","kotlin-native","swift-concurrency","memory-management","coroutines"],"exportEndpoints":{"claude":"/api/rules/kmp-native-coroutine-memory-arena-isolation?format=claude","cursorMdc":"/api/rules/kmp-native-coroutine-memory-arena-isolation?format=mdc","cursorrules":"/api/rules/kmp-native-coroutine-memory-arena-isolation?format=cursor","windsurf":"/api/rules/kmp-native-coroutine-memory-arena-isolation?format=windsurf","agents":"/api/rules/kmp-native-coroutine-memory-arena-isolation?format=agents"}},{"id":"cilium-ebpf-wireguard-l7-handshake-boundary","title":"Cilium eBPF WireGuard Layer-7 Identity-Aware Ingress Handshake Boundary","category":"devops","severity":"critical","description":"Mandates kernel-space cryptographic verification via eBPF sockops and transparent WireGuard encapsulation before processing L7 application ingress payloads. Enforces continuous cryptographic SPIFFE/Cilium identity re-attestation across multi-cluster service mesh boundaries to eliminate TOCTOU packet spoofing and unauthenticated cross-cluster traversal.","antiPatternHeadline":"Blind Layer-4 WireGuard Tunneling Without Kernel-Level eBPF Identity Attestation and L7 Policy Interception","stars_count":83,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","cilium","ebpf","wireguard","service-mesh","zero-trust","kubernetes"],"exportEndpoints":{"claude":"/api/rules/cilium-ebpf-wireguard-l7-handshake-boundary?format=claude","cursorMdc":"/api/rules/cilium-ebpf-wireguard-l7-handshake-boundary?format=mdc","cursorrules":"/api/rules/cilium-ebpf-wireguard-l7-handshake-boundary?format=cursor","windsurf":"/api/rules/cilium-ebpf-wireguard-l7-handshake-boundary?format=windsurf","agents":"/api/rules/cilium-ebpf-wireguard-l7-handshake-boundary?format=agents"}},{"id":"webauthn-conditional-ui-autofill-injection-mitigation","title":"WebAuthn Conditional UI Hybrid Passkey Autofill Injection Mitigation","category":"security","severity":"critical","description":"Enforces cryptographic and DOM-isolation invariants for WebAuthn Conditional Mediation (passkey autofill). Prevents malicious iframes, prototype pollution, and rogue extension DOM injections from intercepting hybrid transport credentials during asynchronous form hydration by enforcing AbortController teardowns, immutable challenge-binding, top-level ancestor validation, and strict input attribute isolation.","antiPatternHeadline":"Unisolated Conditional Passkey Requests Vulnerable to Malicious Iframe Hijacking and DOM Injection","stars_count":114,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","passkeys","fido2","dom-injection","conditional-ui"],"exportEndpoints":{"claude":"/api/rules/webauthn-conditional-ui-autofill-injection-mitigation?format=claude","cursorMdc":"/api/rules/webauthn-conditional-ui-autofill-injection-mitigation?format=mdc","cursorrules":"/api/rules/webauthn-conditional-ui-autofill-injection-mitigation?format=cursor","windsurf":"/api/rules/webauthn-conditional-ui-autofill-injection-mitigation?format=windsurf","agents":"/api/rules/webauthn-conditional-ui-autofill-injection-mitigation?format=agents"}},{"id":"go-1-24-swiss-table-map-compaction-chi-guardrail","title":"Go 1.24 Swiss Table Map Memory Compaction Invariant for Chi Microservices","category":"backend","severity":"critical","description":"Enforces deterministic lifecycle management and memory compaction for Go 1.24 Swiss Table map allocations within high-throughput go-chi router pipelines. Prevents retention of bloated slot arrays and tombstone fragmentation in persistent routing and fan-out cache contexts during bursty sub-millisecond loads. Mandates map re-instantiation, clear() semantics evaluation, and sync.Pool bucketing to eliminate p99 GC pause spikes.","antiPatternHeadline":"Retaining Long-Lived Maps Across Request Spikes Causing Uncompacted Swiss Table Slot Retention and GC Degradation","stars_count":114,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","performance","memory-management","chi","garbage-collection"],"exportEndpoints":{"claude":"/api/rules/go-1-24-swiss-table-map-compaction-chi-guardrail?format=claude","cursorMdc":"/api/rules/go-1-24-swiss-table-map-compaction-chi-guardrail?format=mdc","cursorrules":"/api/rules/go-1-24-swiss-table-map-compaction-chi-guardrail?format=cursor","windsurf":"/api/rules/go-1-24-swiss-table-map-compaction-chi-guardrail?format=windsurf","agents":"/api/rules/go-1-24-swiss-table-map-compaction-chi-guardrail?format=agents"}},{"id":"tauri2-mobile-origin-acl-deep-link-guardrail","title":"Tauri 2.0 Mobile Webview Origin ACL & Cryptographic Deep Link Guardrail","category":"mobile","severity":"critical","description":"Mandates strict Origin Access Control Lists (ACLs) and cryptographic payload verification for OS-level deep link intents in Tauri 2.0 mobile architectures. Enforces zero-trust payload sanitization and signature verification before forwarding external custom scheme triggers to the Rust backend core to eliminate arbitrary remote command execution, privilege escalation, and cross-origin webview spoofing.","antiPatternHeadline":"Blindly dispatching unauthenticated OS deep link parameters directly into Tauri native IPC invoke commands.","stars_count":62,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri-2","security","deep-link","ipc-acl","rust"],"exportEndpoints":{"claude":"/api/rules/tauri2-mobile-origin-acl-deep-link-guardrail?format=claude","cursorMdc":"/api/rules/tauri2-mobile-origin-acl-deep-link-guardrail?format=mdc","cursorrules":"/api/rules/tauri2-mobile-origin-acl-deep-link-guardrail?format=cursor","windsurf":"/api/rules/tauri2-mobile-origin-acl-deep-link-guardrail?format=windsurf","agents":"/api/rules/tauri2-mobile-origin-acl-deep-link-guardrail?format=agents"}},{"id":"otel-otlp-ring-buffer-backpressure-policy","title":"OpenTelemetry OTLP/gRPC Bounded Ring Buffer & Tail-Drop Guardrail","category":"devops","severity":"critical","description":"Enforces deterministic in-memory bounded ring buffering with error-prioritizing shedding policies for OpenTelemetry OTLP/gRPC exporters. Prevents service-level heap exhaustion (OOM) during downstream collector failures by dropping low-entropy telemetry while guaranteeing error trace retention up to strict memory limits.","antiPatternHeadline":"Unbounded Telemetry Queueing and Indiscriminate FIFO Spans Purging During Collector Outages","stars_count":86,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","backpressure","grpc","memory-management","observability"],"exportEndpoints":{"claude":"/api/rules/otel-otlp-ring-buffer-backpressure-policy?format=claude","cursorMdc":"/api/rules/otel-otlp-ring-buffer-backpressure-policy?format=mdc","cursorrules":"/api/rules/otel-otlp-ring-buffer-backpressure-policy?format=cursor","windsurf":"/api/rules/otel-otlp-ring-buffer-backpressure-policy?format=windsurf","agents":"/api/rules/otel-otlp-ring-buffer-backpressure-policy?format=agents"}},{"id":"vite-6-dynamic-mfe-dependency-quarantine-standard","title":"Vite 6 Dynamic Microfrontend Dependency Tree Isolation and Quarantine Standard","category":"frontend","severity":"critical","description":"Enforces strict runtime module isolation, scoped dependency registries, and deterministic chunk deduplication across federated Vite 6 microfrontends. Prevents shared reactive core corruption (e.g., dual React Dispatcher instances, Vue reactive context splits) and unconstrained asynchronous vendor chunk collision across host and remote module boundaries.","antiPatternHeadline":"Leaking Global Module Singletons and Unquarantined Asynchronous Vendor Chunks Across Micro-App Boundaries","stars_count":70,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","vite6","module-federation","microfrontends","reactive-core","chunk-isolation"],"exportEndpoints":{"claude":"/api/rules/vite-6-dynamic-mfe-dependency-quarantine-standard?format=claude","cursorMdc":"/api/rules/vite-6-dynamic-mfe-dependency-quarantine-standard?format=mdc","cursorrules":"/api/rules/vite-6-dynamic-mfe-dependency-quarantine-standard?format=cursor","windsurf":"/api/rules/vite-6-dynamic-mfe-dependency-quarantine-standard?format=windsurf","agents":"/api/rules/vite-6-dynamic-mfe-dependency-quarantine-standard?format=agents"}},{"id":"pqc-mlkem-hybrid-key-encapsulation-standard","title":"Mandatory ML-KEM (FIPS 203) Hybrid Ephemeral KEM Ratchet in TLS 1.3 Reverse Proxies","category":"security","severity":"critical","description":"Enforces strict hybrid classical and post-quantum ephemeral key encapsulation (X25519MLKEM768 / SecP256r1MLKEM768) across all edge reverse proxies and ingress terminators. Forbids pure classical ephemeral key agreements to defeat 'Harvest Now, Decrypt Later' (HNDL) quantum intelligence vectors, while enforcing explicit ratchet updates and validating dual shared-secret combination step invariants.","antiPatternHeadline":"Accepting Classical-Only TLS 1.3 Key Exchanges or Improper Combiner Derivations for Post-Quantum KEMs","stars_count":68,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","cryptography","pqc","ml-kem","tls13","fips-203"],"exportEndpoints":{"claude":"/api/rules/pqc-mlkem-hybrid-key-encapsulation-standard?format=claude","cursorMdc":"/api/rules/pqc-mlkem-hybrid-key-encapsulation-standard?format=mdc","cursorrules":"/api/rules/pqc-mlkem-hybrid-key-encapsulation-standard?format=cursor","windsurf":"/api/rules/pqc-mlkem-hybrid-key-encapsulation-standard?format=windsurf","agents":"/api/rules/pqc-mlkem-hybrid-key-encapsulation-standard?format=agents"}},{"id":"webauthn-prf-zk-vault-standard","title":"WebAuthn Level 3 PRF Extension Zero-Knowledge Vault Standard","category":"security","severity":"critical","description":"Mandates client-side symmetric key derivation directly from passkey hardware authenticators via the WebAuthn Level 3 PRF extension to achieve end-to-end zero-knowledge encryption. Master secret keys, raw PRF evaluation buffers, and decrypted payloads must never be transmitted across network boundaries or persisted in client-side storage. Cryptographic vaults must enforce HKDF-SHA-256 derivation over the PRF output before performing authenticated symmetric encryption (AES-256-GCM or ChaCha20-Poly1305).","antiPatternHeadline":"Transmitting Raw PRF Outputs or Derived Vault Keys to Backend Services for Server-Side Decryption","stars_count":43,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","prf-extension","zero-knowledge","cryptography","passkeys","e2ee"],"exportEndpoints":{"claude":"/api/rules/webauthn-prf-zk-vault-standard?format=claude","cursorMdc":"/api/rules/webauthn-prf-zk-vault-standard?format=mdc","cursorrules":"/api/rules/webauthn-prf-zk-vault-standard?format=cursor","windsurf":"/api/rules/webauthn-prf-zk-vault-standard?format=windsurf","agents":"/api/rules/webauthn-prf-zk-vault-standard?format=agents"}},{"id":"react19-use-action-state-optimistic-rollback-invariant","title":"React 19 useActionState & useOptimistic Transactional Rollback Invariant","category":"frontend","severity":"critical","description":"Enforces deterministic transactional synchronization between Server Actions and client-side optimistic UI updates using React 19's useActionState and useOptimistic primitives. Eliminates state tearing, orphaned optimistic renders, and unhandled rejections during concurrent mutation failures by mandating wrapped action dispatchers and explicit rollback boundaries.","antiPatternHeadline":"Decoupled Optimistic Mutations Causing Permanent State Tearing on Server Action Failure","stars_count":107,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","useActionState","useOptimistic","concurrency","server-actions"],"exportEndpoints":{"claude":"/api/rules/react19-use-action-state-optimistic-rollback-invariant?format=claude","cursorMdc":"/api/rules/react19-use-action-state-optimistic-rollback-invariant?format=mdc","cursorrules":"/api/rules/react19-use-action-state-optimistic-rollback-invariant?format=cursor","windsurf":"/api/rules/react19-use-action-state-optimistic-rollback-invariant?format=windsurf","agents":"/api/rules/react19-use-action-state-optimistic-rollback-invariant?format=agents"}},{"id":"axum-tokio-cancellation-token-hierarchy-standard","title":"Axum Tokio Hierarchical CancellationToken Propagation Standard","category":"backend","severity":"critical","description":"Enforces deterministic, tree-structured CancellationToken propagation across all asynchronous tasks spawned from Axum HTTP handlers. Ensures that client disconnections, upstream timeouts, or handler drops immediately cascade cancellation to detached futures, preventing zombie execution and resource starvation. Mandates child token derivation and select loop integration across all spawned Tokio background work.","antiPatternHeadline":"Orphaned Tokio Task Execution via Unmonitored Spawns During Client Disconnects","stars_count":101,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tokio","concurrency","cancellation-token"],"exportEndpoints":{"claude":"/api/rules/axum-tokio-cancellation-token-hierarchy-standard?format=claude","cursorMdc":"/api/rules/axum-tokio-cancellation-token-hierarchy-standard?format=mdc","cursorrules":"/api/rules/axum-tokio-cancellation-token-hierarchy-standard?format=cursor","windsurf":"/api/rules/axum-tokio-cancellation-token-hierarchy-standard?format=windsurf","agents":"/api/rules/axum-tokio-cancellation-token-hierarchy-standard?format=agents"}},{"id":"capacitor-7-secure-enclave-token-storage","title":"Capacitor 7 Secure Enclave Hardware-Bound Token Storage Standard","category":"mobile","severity":"critical","description":"Enforces that all OAuth refresh tokens and long-lived cryptographic credentials in Capacitor 7 hybrid applications are exclusively stored in biometric-gated, hardware-backed secure elements (iOS Secure Enclave via Keychain Services and Android Keystore with StrongBox/Keymaster). Prohibits fallback to unencrypted web storage, SQLite, or standard application preferences to prevent token exfiltration on compromised, rooted, or jailbroken devices. Mandates transient, memory-only caching of short-lived access tokens while forcing biometric step-up authentication on every refresh cycle.","antiPatternHeadline":"Persisting Refresh Tokens in Capacitor Preferences or Non-Hardware-Bound Web Storage","stars_count":65,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","oauth2","secure-enclave","android-keystore","biometrics"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-secure-enclave-token-storage?format=claude","cursorMdc":"/api/rules/capacitor-7-secure-enclave-token-storage?format=mdc","cursorrules":"/api/rules/capacitor-7-secure-enclave-token-storage?format=cursor","windsurf":"/api/rules/capacitor-7-secure-enclave-token-storage?format=windsurf","agents":"/api/rules/capacitor-7-secure-enclave-token-storage?format=agents"}},{"id":"kmp-coroutine-native-ffi-cancellation-boundary","title":"KMP Swift-Kotlin Coroutine FFI Boundary Structured Cancellation Guardrail","category":"mobile","severity":"critical","description":"Enforces strict structured concurrency lifecycle propagation across the Kotlin Multiplatform to Swift/Objective-C interop boundary. Ensures native Swift Tasks propagate task cancellation signals into Kotlin Coroutine `Job` handles and tear down underlying native Dispatchers to prevent thread pool starvation, unmanaged background work, and memory leaks in iOS runtimes.","antiPatternHeadline":"Unbridged Swift Task deinit resulting in orphaned Kotlin Coroutine Jobs and native iOS thread pool starvation","stars_count":76,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","swift","coroutines","concurrency","ios"],"exportEndpoints":{"claude":"/api/rules/kmp-coroutine-native-ffi-cancellation-boundary?format=claude","cursorMdc":"/api/rules/kmp-coroutine-native-ffi-cancellation-boundary?format=mdc","cursorrules":"/api/rules/kmp-coroutine-native-ffi-cancellation-boundary?format=cursor","windsurf":"/api/rules/kmp-coroutine-native-ffi-cancellation-boundary?format=windsurf","agents":"/api/rules/kmp-coroutine-native-ffi-cancellation-boundary?format=agents"}},{"id":"fastapi-pydantic-v2-strict-polymorphic-guardrail","title":"FastAPI Pydantic V2 Strict Polymorphic Deserialization Guardrail","category":"backend","severity":"critical","description":"Enforces strict validation (`strict=True`, `extra='forbid'`) alongside explicit tagged discriminators on all polymorphic unions in FastAPI Pydantic v2 schemas. This eliminates algorithmic complexity attacks (ReDoS/Backtracking CPU exhaustion) caused by sequential union branch evaluation and blocks silent type coercion exploits in nested payloads.","antiPatternHeadline":"Lax Untagged Union Deserialization Inducing Silent Type Coercion and Backtracking CPU Exhaustion","stars_count":48,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","pydantic-v2","security","deserialization","dos-prevention"],"exportEndpoints":{"claude":"/api/rules/fastapi-pydantic-v2-strict-polymorphic-guardrail?format=claude","cursorMdc":"/api/rules/fastapi-pydantic-v2-strict-polymorphic-guardrail?format=mdc","cursorrules":"/api/rules/fastapi-pydantic-v2-strict-polymorphic-guardrail?format=cursor","windsurf":"/api/rules/fastapi-pydantic-v2-strict-polymorphic-guardrail?format=windsurf","agents":"/api/rules/fastapi-pydantic-v2-strict-polymorphic-guardrail?format=agents"}},{"id":"vite6-module-runner-ssr-execution-isolation-standard","title":"Vite 6 Module Runner SSR Execution Context Isolation Standard","category":"frontend","severity":"critical","description":"Enforces strict execution context isolation for Vite 6 Module Runner instances during server-side rendering (SSR). Prevents cross-request global singleton bleeding, uncollected module cache accumulation, and race conditions by isolating module evaluation within ephemeral worker threads or isolated runner environments.","antiPatternHeadline":"Reusing a single ModuleRunner instance or shared module cache across concurrent SSR requests","stars_count":102,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","vite6","module-runner","ssr","memory-leaks","worker-threads"],"exportEndpoints":{"claude":"/api/rules/vite6-module-runner-ssr-execution-isolation-standard?format=claude","cursorMdc":"/api/rules/vite6-module-runner-ssr-execution-isolation-standard?format=mdc","cursorrules":"/api/rules/vite6-module-runner-ssr-execution-isolation-standard?format=cursor","windsurf":"/api/rules/vite6-module-runner-ssr-execution-isolation-standard?format=windsurf","agents":"/api/rules/vite6-module-runner-ssr-execution-isolation-standard?format=agents"}},{"id":"ebpf-tetragon-kernel-capability-enforcement","title":"eBPF Tetragon Kernel-Level Capability Modification and Namespace Isolation Invariant","category":"security","severity":"critical","description":"Enforces synchronous, in-kernel blocking of runtime privilege escalation and namespace breakout attempts using Cilium Tetragon TracingPolicies. Mandates the use of synchronous kernel actions (Sigkill or Override) at the kprobe boundary on critical capability and namespace transitions (commit_creds, cap_capable, switch_task_namespaces) rather than asynchronous userspace alert pipelines.","antiPatternHeadline":"Relying on Userspace Audit Events for Asynchronous Privilege Escalation Mitigation","stars_count":42,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","ebpf","tetragon","kubernetes","linux-kernel","zero-trust"],"exportEndpoints":{"claude":"/api/rules/ebpf-tetragon-kernel-capability-enforcement?format=claude","cursorMdc":"/api/rules/ebpf-tetragon-kernel-capability-enforcement?format=mdc","cursorrules":"/api/rules/ebpf-tetragon-kernel-capability-enforcement?format=cursor","windsurf":"/api/rules/ebpf-tetragon-kernel-capability-enforcement?format=windsurf","agents":"/api/rules/ebpf-tetragon-kernel-capability-enforcement?format=agents"}},{"id":"opentelemetry-baggage-pii-cardinality-guardrail","title":"OpenTelemetry W3C Baggage PII Sanitization and Cardinality Control","category":"devops","severity":"critical","description":"Enforces strict payload boundaries, cryptographic hashing of contextual identifiers, and automated PII scrubbing on OpenTelemetry W3C Baggage headers across microservice hops. Baggage is propagated downstream across trust boundaries in cleartext HTTP headers, making raw PII propagation and unbounded cardinality critical security vulnerabilities and DoS attack vectors.","antiPatternHeadline":"Propagating Unsanitized PII and Unbounded Dynamic Metadata in W3C Baggage Headers","stars_count":66,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","distributed-tracing","security","pii-protection","observability"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-baggage-pii-cardinality-guardrail?format=claude","cursorMdc":"/api/rules/opentelemetry-baggage-pii-cardinality-guardrail?format=mdc","cursorrules":"/api/rules/opentelemetry-baggage-pii-cardinality-guardrail?format=cursor","windsurf":"/api/rules/opentelemetry-baggage-pii-cardinality-guardrail?format=windsurf","agents":"/api/rules/opentelemetry-baggage-pii-cardinality-guardrail?format=agents"}},{"id":"react19-optimistic-action-mutation-boundary","title":"React 19 Deterministic Optimistic Action Mutation Boundary","category":"frontend","severity":"critical","description":"Enforces deterministic reconciliation between client optimistic state via useOptimistic and idempotent server action responses under transient network failures. Guarantees that mutations executed inside useTransition or Server Form Actions remain transactional, prevent out-of-order state tearing, and rollback safely without ghost mutations or race conditions.","antiPatternHeadline":"Unbounded Optimistic State Mutations with Disjoint Local State Reconciliations and Non-Idempotent Server Actions","stars_count":86,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","useOptimistic","server-actions","transitions","idempotency"],"exportEndpoints":{"claude":"/api/rules/react19-optimistic-action-mutation-boundary?format=claude","cursorMdc":"/api/rules/react19-optimistic-action-mutation-boundary?format=mdc","cursorrules":"/api/rules/react19-optimistic-action-mutation-boundary?format=cursor","windsurf":"/api/rules/react19-optimistic-action-mutation-boundary?format=windsurf","agents":"/api/rules/react19-optimistic-action-mutation-boundary?format=agents"}},{"id":"tauri-v2-zerocopy-ipc-stream-barrier-production-standard","title":"Tauri 2.0 Zero-Copy IPC Buffer Streaming Barrier for Mobile WebViews","category":"mobile","severity":"critical","description":"Enforces zero-copy binary streaming protocols for high-frequency Rust-to-WebView IPC in Tauri 2.0 mobile applications. Eliminates main-thread JSON serialization bottlenecks and microtask starvation in mobile WebKit (iOS) and V8 (Android) runtimes by streaming raw binary buffers directly into transferable TypedArrays and dedicated Web Workers.","antiPatternHeadline":"JSON-serialized high-frequency IPC flooding the mobile WebView main thread with V8/WebKit GC pauses and microtask queue lockup","stars_count":115,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri-v2","zero-copy","ipc","webkit","v8","arraybuffer","rust"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-zerocopy-ipc-stream-barrier-production-standard?format=claude","cursorMdc":"/api/rules/tauri-v2-zerocopy-ipc-stream-barrier-production-standard?format=mdc","cursorrules":"/api/rules/tauri-v2-zerocopy-ipc-stream-barrier-production-standard?format=cursor","windsurf":"/api/rules/tauri-v2-zerocopy-ipc-stream-barrier-production-standard?format=windsurf","agents":"/api/rules/tauri-v2-zerocopy-ipc-stream-barrier-production-standard?format=agents"}},{"id":"go124-http3-zero-rtt-anti-replay-invariant","title":"Go 1.24 HTTP/3 0-RTT Distributed Anti-Replay Guardrail","category":"backend","severity":"critical","description":"Enforces strict 0-RTT (Early Data) validation across Go HTTP/3 services to eliminate replay attacks at the edge. Guarantees that state-altering methods are rejected immediately with HTTP 425 (Too Early) and idempotent early data routes validate cryptographically signed temporal tokens against a distributed sliding window.","antiPatternHeadline":"Unchecked HTTP/3 0-RTT Early Data execution enabling distributed request replay and duplicate side-effects.","stars_count":43,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","http3","quic","zero-rtt","anti-replay","distributed-systems","security"],"exportEndpoints":{"claude":"/api/rules/go124-http3-zero-rtt-anti-replay-invariant?format=claude","cursorMdc":"/api/rules/go124-http3-zero-rtt-anti-replay-invariant?format=mdc","cursorrules":"/api/rules/go124-http3-zero-rtt-anti-replay-invariant?format=cursor","windsurf":"/api/rules/go124-http3-zero-rtt-anti-replay-invariant?format=windsurf","agents":"/api/rules/go124-http3-zero-rtt-anti-replay-invariant?format=agents"}},{"id":"webauthn-prf-deterministic-key-derivation-security","title":"Hardware-Bound WebAuthn PRF Deterministic Key Derivation Invariants","category":"security","severity":"critical","description":"Enforces client-side zero-knowledge key synthesis via the WebAuthn Level 3 PRF (Pseudo-Random Function) extension. Guarantees that derived symmetric keys never leak to backend infrastructure, authenticator assertions enforce explicit user verification, and raw PRF outputs are immediately expanded into non-extractable cryptographic keys using domain-separated HKDF.","antiPatternHeadline":"Transmitting Raw PRF Secrets to Backends, Omitting Hardware User Verification, or Persisting Extractable Master Keys","stars_count":67,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","prf-extension","zero-knowledge","cryptography","webcrypto"],"exportEndpoints":{"claude":"/api/rules/webauthn-prf-deterministic-key-derivation-security?format=claude","cursorMdc":"/api/rules/webauthn-prf-deterministic-key-derivation-security?format=mdc","cursorrules":"/api/rules/webauthn-prf-deterministic-key-derivation-security?format=cursor","windsurf":"/api/rules/webauthn-prf-deterministic-key-derivation-security?format=windsurf","agents":"/api/rules/webauthn-prf-deterministic-key-derivation-security?format=agents"}},{"id":"cilium-ebpf-socket-envoy-bypass-guardrail","title":"Cilium eBPF Socket-Level Envoy Bypass and Host-Network Guardrail","category":"devops","severity":"critical","description":"Enforces strict L7 egress and mTLS policy routing by preventing socket-level eBPF shortcuts (sockops/sockmap) from bypassing sidecar or node-level Envoy proxies. Mandates cluster-wide invariants that disallow uninspected host-network namespaces and enforce cryptographic identity binding across kernel socket operations.","antiPatternHeadline":"Bypassing Envoy L7 Policy Enforcement via Unsanitized Host-Network Sockets and eBPF Sockops Redirection","stars_count":52,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","cilium","ebpf","envoy","kubernetes","zero-trust","network-security"],"exportEndpoints":{"claude":"/api/rules/cilium-ebpf-socket-envoy-bypass-guardrail?format=claude","cursorMdc":"/api/rules/cilium-ebpf-socket-envoy-bypass-guardrail?format=mdc","cursorrules":"/api/rules/cilium-ebpf-socket-envoy-bypass-guardrail?format=cursor","windsurf":"/api/rules/cilium-ebpf-socket-envoy-bypass-guardrail?format=windsurf","agents":"/api/rules/cilium-ebpf-socket-envoy-bypass-guardrail?format=agents"}},{"id":"postgres-17-logical-replication-ddl-locks-guardrail","title":"Postgres 17 Logical Replication DDL Isolation and Catalog Bloat Prevention Standard","category":"backend","severity":"critical","description":"Enforces strict isolation of concurrent index builds and schema migrations away from logical replication decoding streams in PostgreSQL 17. Prevents WAL sender stalls, disk-exhausting WAL buildup, and catalog bloat caused by pinned catalog_xmin snapshots and unconstrained DDL lock acquisitions.","antiPatternHeadline":"Executing Concurrent Index Creation or Unbounded DDL Within Transaction Blocks on Logical Replication Primaries","stars_count":101,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres","postgresql-17","logical-replication","database-migrations","wal"],"exportEndpoints":{"claude":"/api/rules/postgres-17-logical-replication-ddl-locks-guardrail?format=claude","cursorMdc":"/api/rules/postgres-17-logical-replication-ddl-locks-guardrail?format=mdc","cursorrules":"/api/rules/postgres-17-logical-replication-ddl-locks-guardrail?format=cursor","windsurf":"/api/rules/postgres-17-logical-replication-ddl-locks-guardrail?format=windsurf","agents":"/api/rules/postgres-17-logical-replication-ddl-locks-guardrail?format=agents"}},{"id":"svelte-5-runes-cross-mfe-reactivity-bridge","title":"Svelte 5 Runes Cross-Microfrontend Reactive Graph Boundary Isolation","category":"frontend","severity":"critical","description":"Enforces isolated signal graph destruction across micro-frontend boundaries using Svelte 5's $effect.root() and explicit teardown contracts. Prevents zombie subscriptions and detached DOM tree retention when reactive proxies bridge isolated runtime realms into a long-lived host shell.","antiPatternHeadline":"Leaking Cross-Boundary Svelte 5 Runes via Raw Proxies and Missing $effect.root Teardown","stars_count":54,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","micro-frontends","memory-leaks","signals"],"exportEndpoints":{"claude":"/api/rules/svelte-5-runes-cross-mfe-reactivity-bridge?format=claude","cursorMdc":"/api/rules/svelte-5-runes-cross-mfe-reactivity-bridge?format=mdc","cursorrules":"/api/rules/svelte-5-runes-cross-mfe-reactivity-bridge?format=cursor","windsurf":"/api/rules/svelte-5-runes-cross-mfe-reactivity-bridge?format=windsurf","agents":"/api/rules/svelte-5-runes-cross-mfe-reactivity-bridge?format=agents"}},{"id":"bun-ffi-off-heap-lifecycle-invariants","title":"Bun 1.2 Off-Heap FFI Memory Lifecycle and Pointer Pinning Guardrail","category":"backend","severity":"critical","description":"Enforces deterministic lifecycle management, explicit pointer pinning, and strict ownership boundaries for off-heap memory across the JavaScriptCore-to-Rust native bridge via bun:ffi. Eliminates use-after-free, memory corruption, and double-free hazards caused by JavaScriptCore garbage collection sweeping memory backing buffers while active native threads hold raw pointers.","antiPatternHeadline":"Passing Ephemeral JSC Buffers or Naked Pointers to Asynchronous Native FFI Without Explicit Lifetime Pinning","stars_count":106,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","ffi","rust","memory-safety","javascriptcore"],"exportEndpoints":{"claude":"/api/rules/bun-ffi-off-heap-lifecycle-invariants?format=claude","cursorMdc":"/api/rules/bun-ffi-off-heap-lifecycle-invariants?format=mdc","cursorrules":"/api/rules/bun-ffi-off-heap-lifecycle-invariants?format=cursor","windsurf":"/api/rules/bun-ffi-off-heap-lifecycle-invariants?format=windsurf","agents":"/api/rules/bun-ffi-off-heap-lifecycle-invariants?format=agents"}},{"id":"kmp-atomic-sqlite-wal-rekeying-standard","title":"KMP Atomic SQLite WAL Re-Keying & Hardware-Backed Key Rotation Standard","category":"mobile","severity":"critical","description":"Enforces atomic, crash-resilient cryptographic key rotation for SQLCipher and SQLite databases operating in WAL mode across Android Keystore and iOS Secure Enclave/Keychain. Mandates full WAL truncation checkpoints, connection pool evacuation, and two-phase key state markers to prevent unrecoverable database corruption and torn-key reads.","antiPatternHeadline":"Executing in-place PRAGMA rekey on active WAL connections without checkpoint truncation or atomic key-phase synchronization.","stars_count":92,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kmp","sqlite","sqlcipher","android-keystore","secure-enclave","concurrency"],"exportEndpoints":{"claude":"/api/rules/kmp-atomic-sqlite-wal-rekeying-standard?format=claude","cursorMdc":"/api/rules/kmp-atomic-sqlite-wal-rekeying-standard?format=mdc","cursorrules":"/api/rules/kmp-atomic-sqlite-wal-rekeying-standard?format=cursor","windsurf":"/api/rules/kmp-atomic-sqlite-wal-rekeying-standard?format=windsurf","agents":"/api/rules/kmp-atomic-sqlite-wal-rekeying-standard?format=agents"}},{"id":"openfga-vector-clock-causal-invalidation-barrier","title":"OpenFGA Real-Time Vector Clock Barrier for Causal Revocation Invalidation","category":"security","severity":"critical","description":"Enforces causal consistency across geo-distributed OpenFGA ReBAC policy evaluation nodes using vector clock barriers. Guarantees that read-heavy edge nodes block or divert requests when their local replica's causal state lags behind the client's causal horizon, preventing authorization bypasses via stale revocation states.","antiPatternHeadline":"Stale ReBAC Evaluation on Stale Replicas Without Causal Horizon Fencing","stars_count":94,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","rebac","vector-clocks","cache-invalidation","distributed-systems","causal-consistency"],"exportEndpoints":{"claude":"/api/rules/openfga-vector-clock-causal-invalidation-barrier?format=claude","cursorMdc":"/api/rules/openfga-vector-clock-causal-invalidation-barrier?format=mdc","cursorrules":"/api/rules/openfga-vector-clock-causal-invalidation-barrier?format=cursor","windsurf":"/api/rules/openfga-vector-clock-causal-invalidation-barrier?format=windsurf","agents":"/api/rules/openfga-vector-clock-causal-invalidation-barrier?format=agents"}},{"id":"svelte5-deep-reactive-proxy-fencing-state-raw","title":"Svelte 5 Deep Reactive Proxy Fencing ($state.raw) for High-Frequency Telemetry","category":"frontend","severity":"critical","description":"Prevents catastrophic reactive proxy instantiation and garbage collection thrashing in Svelte 5 applications processing high-frequency data streams. Mandates the use of $state.raw for streaming telemetry, time-series arrays, and binary buffers to bypass recursive proxy wrapping. Enforces atomic reference reassignments rather than in-place deep property mutations.","antiPatternHeadline":"Unbounded Deep Proxy Wrapping of Ingested High-Frequency Stream Payloads via Standard $state()","stars_count":90,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","state-raw","performance","memory-management","telemetry"],"exportEndpoints":{"claude":"/api/rules/svelte5-deep-reactive-proxy-fencing-state-raw?format=claude","cursorMdc":"/api/rules/svelte5-deep-reactive-proxy-fencing-state-raw?format=mdc","cursorrules":"/api/rules/svelte5-deep-reactive-proxy-fencing-state-raw?format=cursor","windsurf":"/api/rules/svelte5-deep-reactive-proxy-fencing-state-raw?format=windsurf","agents":"/api/rules/svelte5-deep-reactive-proxy-fencing-state-raw?format=agents"}},{"id":"react-19-action-transition-interruption-idempotency","title":"React 19 Action Transition Interruption and Optimistic State Reconciliation Standard","category":"frontend","severity":"critical","description":"Enforces deterministic state reconciliation and idempotent mutation execution when concurrent React 19 asynchronous Action transitions are interrupted, canceled, or resolved out-of-order. Guarantees monotonic sequence tracking and atomic rollback safety across useActionState and useOptimistic boundaries.","antiPatternHeadline":"Out-of-Order Transition Settlement and Phantom State Overwrite in Async Server Actions","stars_count":86,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","server-actions","use-optimistic","use-action-state","idempotency"],"exportEndpoints":{"claude":"/api/rules/react-19-action-transition-interruption-idempotency?format=claude","cursorMdc":"/api/rules/react-19-action-transition-interruption-idempotency?format=mdc","cursorrules":"/api/rules/react-19-action-transition-interruption-idempotency?format=cursor","windsurf":"/api/rules/react-19-action-transition-interruption-idempotency?format=windsurf","agents":"/api/rules/react-19-action-transition-interruption-idempotency?format=agents"}},{"id":"bun-worker-sharedarraybuffer-zero-copy-guardrail","title":"Bun 1.2 Worker SharedArrayBuffer Zero-Copy Serialization Standard","category":"backend","severity":"critical","description":"Enforces zero-copy inter-worker communication across Bun 1.2 microservices by eliminating the structured clone algorithm on hot execution paths. Concurrency domains must operate over pre-allocated SharedArrayBuffer instances synchronized via Atomics primitives, eliminating heap fragmentation, CPU serialization overhead, and garbage collection thrashing in high-throughput workloads.","antiPatternHeadline":"Structured Clone Heap Deserialization Bottlenecks in High-Volume Worker Pipelines","stars_count":112,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","sharedarraybuffer","concurrency","zero-copy","performance","atomics"],"exportEndpoints":{"claude":"/api/rules/bun-worker-sharedarraybuffer-zero-copy-guardrail?format=claude","cursorMdc":"/api/rules/bun-worker-sharedarraybuffer-zero-copy-guardrail?format=mdc","cursorrules":"/api/rules/bun-worker-sharedarraybuffer-zero-copy-guardrail?format=cursor","windsurf":"/api/rules/bun-worker-sharedarraybuffer-zero-copy-guardrail?format=windsurf","agents":"/api/rules/bun-worker-sharedarraybuffer-zero-copy-guardrail?format=agents"}},{"id":"axum-08-hyper-streaming-backpressure-invariant","title":"Axum 0.8 Hyper-Native Streaming Body Backpressure and Abort Teardown","category":"backend","severity":"critical","description":"Enforces strict end-to-end backpressure propagation and immediate cancellation propagation across Axum 0.8 / Hyper 1.x streaming pipelines. Forbids unbounded channel buffers (`mpsc::unbounded_channel`) and unmetered in-memory collection (`to_bytes` without limits), guaranteeing deterministic O(1) memory consumption and instant upstream connection teardown when downstream HTTP clients disconnect.","antiPatternHeadline":"Unbounded Channel Buffering and Ignored Cancellation During Hyper Stream Consumption","stars_count":91,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","hyper","backpressure","streaming","memory-safety"],"exportEndpoints":{"claude":"/api/rules/axum-08-hyper-streaming-backpressure-invariant?format=claude","cursorMdc":"/api/rules/axum-08-hyper-streaming-backpressure-invariant?format=mdc","cursorrules":"/api/rules/axum-08-hyper-streaming-backpressure-invariant?format=cursor","windsurf":"/api/rules/axum-08-hyper-streaming-backpressure-invariant?format=windsurf","agents":"/api/rules/axum-08-hyper-streaming-backpressure-invariant?format=agents"}},{"id":"fastapi-anyio-cancellation-shielding-standard-fastapi-anyio-ta-964","title":"FastAPI AnyIO TaskGroup Cancellation Shielding for Critical Cleanup and Audit Pipelines","category":"backend","severity":"critical","description":"Enforces deterministic cancellation shielding and detached lifecycle execution for critical post-transaction steps, telemetry, and audit logging in FastAPI applications powered by AnyIO. Prevents silent data corruption, orphaned lock states, and unrecorded compliance trails when HTTP clients disconnect or proxy timeouts propagate cancellation cascades into coroutine trees.","antiPatternHeadline":"Unshielded post-transaction cleanup and audit coroutines aborted mid-execution during client disconnects","stars_count":105,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["fastapi","anyio","asyncio","concurrency","audit-logging","cancellation","backend"],"exportEndpoints":{"claude":"/api/rules/fastapi-anyio-cancellation-shielding-standard-fastapi-anyio-ta-964?format=claude","cursorMdc":"/api/rules/fastapi-anyio-cancellation-shielding-standard-fastapi-anyio-ta-964?format=mdc","cursorrules":"/api/rules/fastapi-anyio-cancellation-shielding-standard-fastapi-anyio-ta-964?format=cursor","windsurf":"/api/rules/fastapi-anyio-cancellation-shielding-standard-fastapi-anyio-ta-964?format=windsurf","agents":"/api/rules/fastapi-anyio-cancellation-shielding-standard-fastapi-anyio-ta-964?format=agents"}},{"id":"kmp-stateflow-bridge-deallocation-guardrail","title":"Kotlin Multiplatform StateFlow Bridge Deallocation Guardrail","category":"mobile","severity":"critical","description":"Enforces strict lifecycle-bound subscription cancellation and bidirectional weak-referencing when bridging Kotlin StateFlow and SharedFlow streams across native boundaries to Swift/Objective-C. Prevents zombie coroutine collection jobs and circular ARC-JVM reference retentions that trigger silent permanent memory leaks in native view layers.","antiPatternHeadline":"Unmanaged Cross-Boundary Flow Observation Retaining Native UI via Coroutine Collector Closures","stars_count":112,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kmp","kotlin-multiplatform","swift","coroutines","arc","memory-management"],"exportEndpoints":{"claude":"/api/rules/kmp-stateflow-bridge-deallocation-guardrail?format=claude","cursorMdc":"/api/rules/kmp-stateflow-bridge-deallocation-guardrail?format=mdc","cursorrules":"/api/rules/kmp-stateflow-bridge-deallocation-guardrail?format=cursor","windsurf":"/api/rules/kmp-stateflow-bridge-deallocation-guardrail?format=windsurf","agents":"/api/rules/kmp-stateflow-bridge-deallocation-guardrail?format=agents"}},{"id":"webauthn-prf-key-derivation-standard-webauthn-prf-pse-591","title":"Hardware-Bound WebAuthn PRF Zero-Knowledge Key Derivation Standard","category":"security","severity":"critical","description":"Enforces strict implementation invariants for client-side cryptographic key derivation using WebAuthn Level 3 Pseudo-Random Function (PRF) extensions (HMAC-secret). Guarantees that derived symmetric keys bound to hardware authenticators are never exported, stored in persistent plaintext, or transmitted over network boundaries, ensuring absolute zero-knowledge client-side encryption.","antiPatternHeadline":"Deriving Encryption Keys from Insecure Authenticators or Caching Raw PRF Evaluation Outputs in Memory or LocalStorage","stars_count":70,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","prf-extension","fido2","zero-knowledge","web-crypto","key-derivation"],"exportEndpoints":{"claude":"/api/rules/webauthn-prf-key-derivation-standard-webauthn-prf-pse-591?format=claude","cursorMdc":"/api/rules/webauthn-prf-key-derivation-standard-webauthn-prf-pse-591?format=mdc","cursorrules":"/api/rules/webauthn-prf-key-derivation-standard-webauthn-prf-pse-591?format=cursor","windsurf":"/api/rules/webauthn-prf-key-derivation-standard-webauthn-prf-pse-591?format=windsurf","agents":"/api/rules/webauthn-prf-key-derivation-standard-webauthn-prf-pse-591?format=agents"}},{"id":"openfga-cdc-outbox-cache-invalidation-pattern","title":"OpenFGA CDC Outbox Transactional Consistency and Cache Invalidation","category":"security","severity":"critical","description":"Enforces strict transactional consistency between primary entity mutations and external OpenFGA relationship tuples using the Transactional Outbox pattern with Change Data Capture (CDC). Prevents dual-write race conditions, authorization drift, split-brain permission states, and stale cache authorization bypass vulnerabilities.","antiPatternHeadline":"Dual-Writing Inline OpenFGA Tuples within HTTP Handlers Causing Phantom Permissions and Cache Desynchronization","stars_count":79,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","cdc","transactional-outbox","zanzibar","authorization","cache-invalidation"],"exportEndpoints":{"claude":"/api/rules/openfga-cdc-outbox-cache-invalidation-pattern?format=claude","cursorMdc":"/api/rules/openfga-cdc-outbox-cache-invalidation-pattern?format=mdc","cursorrules":"/api/rules/openfga-cdc-outbox-cache-invalidation-pattern?format=cursor","windsurf":"/api/rules/openfga-cdc-outbox-cache-invalidation-pattern?format=windsurf","agents":"/api/rules/openfga-cdc-outbox-cache-invalidation-pattern?format=agents"}},{"id":"tetragon-ebpf-syscall-boundary-production-standard","title":"Deterministic Kernel-Level Namespace Isolation via Tetragon eBPF Enforcement","category":"devops","severity":"critical","description":"Enforces synchronous, kernel-level workload containment by deploying Tetragon TracingPolicies with in-kernel SIGKILL interventions on unauthorized binary execution and network socket operations. Eliminates post-execution race conditions inherent to user-space monitoring daemons by blocking unauthorized system calls directly within the eBPF hook path.","antiPatternHeadline":"Relying on Asynchronous User-Space Audit Logging Instead of In-Kernel Syscall Intervention","stars_count":40,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","tetragon","cilium","kubernetes","zero-trust","runtime-security"],"exportEndpoints":{"claude":"/api/rules/tetragon-ebpf-syscall-boundary-production-standard?format=claude","cursorMdc":"/api/rules/tetragon-ebpf-syscall-boundary-production-standard?format=mdc","cursorrules":"/api/rules/tetragon-ebpf-syscall-boundary-production-standard?format=cursor","windsurf":"/api/rules/tetragon-ebpf-syscall-boundary-production-standard?format=windsurf","agents":"/api/rules/tetragon-ebpf-syscall-boundary-production-standard?format=agents"}},{"id":"otel-collector-ottl-wasm-resource-budgeting-guardrail","title":"Bounded Resource Allocation and Execution Timeouts for OTTL Wasm Telemetry Enrichment","category":"devops","severity":"critical","description":"Enforces deterministic memory bounds and execution timeouts on OpenTelemetry Collector OTTL WebAssembly (Wasm) transformations to prevent worker thread exhaustion and OOM kills. Without strict memory paging limits and instruction gas/timeout metering, dynamic guest binaries cause pipeline stalls, buffer saturation, and cascading backpressure across ingestion endpoints. All Wasm-based transformations must specify max memory allocations, runtime execution deadlines, and fallback error handling strategies.","antiPatternHeadline":"Unmetered Wasm Guest Invocation and Unbounded Heap Allocation in In-Flight Telemetry Pipelines","stars_count":96,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","wasm","ottl","site-reliability-engineering","performance"],"exportEndpoints":{"claude":"/api/rules/otel-collector-ottl-wasm-resource-budgeting-guardrail?format=claude","cursorMdc":"/api/rules/otel-collector-ottl-wasm-resource-budgeting-guardrail?format=mdc","cursorrules":"/api/rules/otel-collector-ottl-wasm-resource-budgeting-guardrail?format=cursor","windsurf":"/api/rules/otel-collector-ottl-wasm-resource-budgeting-guardrail?format=windsurf","agents":"/api/rules/otel-collector-ottl-wasm-resource-budgeting-guardrail?format=agents"}},{"id":"webauthn-l3-prf-zero-knowledge-encryption-standard","title":"WebAuthn L3 PRF Hardware-Backed Zero-Knowledge Key Derivation Guardrail","category":"security","severity":"critical","description":"Mandates strict zero-knowledge client-side encryption using the WebAuthn Level 3 Pseudo-Random Function (PRF) extension. Guarantees that raw PRF outputs and derived symmetric encryption keys are processed exclusively within client-side Web Crypto subsystems and never transmitted over the wire or persisted in inspectable storage.","antiPatternHeadline":"Transmitting raw PRF outputs, leaking derived symmetric keys to relying parties, or using extractable client-side key storage.","stars_count":40,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","prf-extension","zero-knowledge","cryptography","passkeys"],"exportEndpoints":{"claude":"/api/rules/webauthn-l3-prf-zero-knowledge-encryption-standard?format=claude","cursorMdc":"/api/rules/webauthn-l3-prf-zero-knowledge-encryption-standard?format=mdc","cursorrules":"/api/rules/webauthn-l3-prf-zero-knowledge-encryption-standard?format=cursor","windsurf":"/api/rules/webauthn-l3-prf-zero-knowledge-encryption-standard?format=windsurf","agents":"/api/rules/webauthn-l3-prf-zero-knowledge-encryption-standard?format=agents"}},{"id":"tauri-v2-capability-scoped-acl-hardening","title":"Tauri 2.0 Capability-Scoped ACL and Origin-Isolated IPC Hardening","category":"mobile","severity":"critical","description":"Enforces strict compile-time capability manifests, origin-bounded IPC isolation, and granular path/argument scopes across Tauri 2.0 mobile and desktop builds. Prevents remote webview injection, compromised deep-link payloads, and XSS vectors from escalating into arbitrary native code execution or unauthorized filesystem access.","antiPatternHeadline":"Wildcard Capability Manifests and Unscoped Remote Webview IPC Execution","stars_count":110,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri-v2","ipc-security","rust","acl","webview-isolation"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-capability-scoped-acl-hardening?format=claude","cursorMdc":"/api/rules/tauri-v2-capability-scoped-acl-hardening?format=mdc","cursorrules":"/api/rules/tauri-v2-capability-scoped-acl-hardening?format=cursor","windsurf":"/api/rules/tauri-v2-capability-scoped-acl-hardening?format=windsurf","agents":"/api/rules/tauri-v2-capability-scoped-acl-hardening?format=agents"}},{"id":"kmp-swift-export-safe-concurrency-invariants","title":"Kotlin Multiplatform Swift-Export Safe Concurrency Memory Invariants","category":"mobile","severity":"critical","description":"Enforces strict memory isolation, reference cycle avoidance, and thread-safe boundaries between Kotlin/Native runtime and Swift 6 structured concurrency. Prevents deadlocks, uncollected native references, and race conditions resulting from improper coroutine-to-async bridging and shared mutable state across FFI boundaries.","antiPatternHeadline":"Unchecked Shared Mutable State and Leaked Kotlin Coroutine Job Handles Across Swift 6 Concurrency Domains","stars_count":74,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","swift6","concurrency","memory-management","kotlin-native"],"exportEndpoints":{"claude":"/api/rules/kmp-swift-export-safe-concurrency-invariants?format=claude","cursorMdc":"/api/rules/kmp-swift-export-safe-concurrency-invariants?format=mdc","cursorrules":"/api/rules/kmp-swift-export-safe-concurrency-invariants?format=cursor","windsurf":"/api/rules/kmp-swift-export-safe-concurrency-invariants?format=windsurf","agents":"/api/rules/kmp-swift-export-safe-concurrency-invariants?format=agents"}},{"id":"fastapi-python-313-nogil-concurrency-guardrails","title":"FastAPI Async Handlers on Python 3.13 Free-Threaded Runtime Safety","category":"backend","severity":"critical","description":"Enforces strict isolation, thread-local safety, and C-extension reentrancy guards for FastAPI applications deployed on Python 3.13 free-threaded (no-GIL) binaries. Mandates the use of explicit thread synchronization primitives and context-isolated containers to prevent data races and segfaults during concurrent execution of mixed async I/O and CPU-bound subroutines. Prohibits global state mutation and unsynchronized non-reentrant native extension access across concurrent worker threads.","antiPatternHeadline":"Unsynchronized Global State Mutation and Legacy C-Extension Execution in Free-Threaded FastAPI Workers","stars_count":88,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","python313","free-threaded","no-gil","concurrency"],"exportEndpoints":{"claude":"/api/rules/fastapi-python-313-nogil-concurrency-guardrails?format=claude","cursorMdc":"/api/rules/fastapi-python-313-nogil-concurrency-guardrails?format=mdc","cursorrules":"/api/rules/fastapi-python-313-nogil-concurrency-guardrails?format=cursor","windsurf":"/api/rules/fastapi-python-313-nogil-concurrency-guardrails?format=windsurf","agents":"/api/rules/fastapi-python-313-nogil-concurrency-guardrails?format=agents"}},{"id":"pg17-json-table-workmem-plan-invalidation-guardrail","title":"PostgreSQL 17 JSON_TABLE Memory Allocation & Plan Invalidation Guardrail","category":"backend","severity":"critical","description":"Enforces strict row estimation, bounded buffer usage, and transactional statement-level memory controls when shredding deeply nested JSONB structures using PostgreSQL 17's SQL/JSON standard JSON_TABLE. Unconstrained nested path evaluations bypass standard statistics heuristics, resulting in catastrophic nested loop regressions and unbounded work_mem consumption under concurrent load.","antiPatternHeadline":"Unbounded JSON_TABLE shredding with implicit Cartesian expansions and default planner statistics causing runaway work_mem consumption and Out-Of-Memory (OOM) backend crashes.","stars_count":90,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","postgres17","jsonb","json-table","performance","query-optimization"],"exportEndpoints":{"claude":"/api/rules/pg17-json-table-workmem-plan-invalidation-guardrail?format=claude","cursorMdc":"/api/rules/pg17-json-table-workmem-plan-invalidation-guardrail?format=mdc","cursorrules":"/api/rules/pg17-json-table-workmem-plan-invalidation-guardrail?format=cursor","windsurf":"/api/rules/pg17-json-table-workmem-plan-invalidation-guardrail?format=windsurf","agents":"/api/rules/pg17-json-table-workmem-plan-invalidation-guardrail?format=agents"}},{"id":"svelte-5-universal-signal-microfrontend-federation-standard","title":"Svelte 5 Universal Signal Microfrontend State Federation Standard","category":"frontend","severity":"critical","description":"Enforces strict signal boundaries and lifecycle synchronization across federated microfrontend remotes using Svelte 5 universal reactivity ($state, $derived, $effect.root). Prevents cross-runtime signal capture, cyclical batching cascades, and detached DOM memory leaks when microfrontends mount and unmount independently.","antiPatternHeadline":"Leaking Raw Svelte 5 Runes Across MFE Host-Remote Boundaries and Capturing Un-isolated Effects","stars_count":67,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","microfrontends","reactivity","state-management","signals"],"exportEndpoints":{"claude":"/api/rules/svelte-5-universal-signal-microfrontend-federation-standard?format=claude","cursorMdc":"/api/rules/svelte-5-universal-signal-microfrontend-federation-standard?format=mdc","cursorrules":"/api/rules/svelte-5-universal-signal-microfrontend-federation-standard?format=cursor","windsurf":"/api/rules/svelte-5-universal-signal-microfrontend-federation-standard?format=windsurf","agents":"/api/rules/svelte-5-universal-signal-microfrontend-federation-standard?format=agents"}},{"id":"ebpf-xdp-l4-tracker-conntrack-bypass-standard","title":"XDP-Layer Stateful L4 Tracking and Netfilter Conntrack Bypass Guardrail","category":"devops","severity":"critical","description":"Enforces in-driver eBPF XDP stateful L4 flow inspection and hardware-assisted SYN-cookie validation prior to kernel sk_buff allocation. Decouples state tracking from Linux Netfilter conntrack tables using BPF LRU maps to process line-rate traffic and prevent table exhaustion attacks.","antiPatternHeadline":"Delegating TCP SYN Validation to Kernel Netfilter and Exhausting nf_conntrack Under Line-Rate Floods","stars_count":79,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","xdp","linux-kernel","networking","ddos-mitigation"],"exportEndpoints":{"claude":"/api/rules/ebpf-xdp-l4-tracker-conntrack-bypass-standard?format=claude","cursorMdc":"/api/rules/ebpf-xdp-l4-tracker-conntrack-bypass-standard?format=mdc","cursorrules":"/api/rules/ebpf-xdp-l4-tracker-conntrack-bypass-standard?format=cursor","windsurf":"/api/rules/ebpf-xdp-l4-tracker-conntrack-bypass-standard?format=windsurf","agents":"/api/rules/ebpf-xdp-l4-tracker-conntrack-bypass-standard?format=agents"}},{"id":"nextjs-15-server-action-multitenant-boundary-isolation","title":"Next.js 15 Server Action Host & Origin Cryptographic Tenant Boundary Isolation","category":"frontend","severity":"critical","description":"Next.js 15 Server Actions in multi-tenant reverse proxy architectures must cryptographically bind incoming Origin and Host headers to the authenticated session's tenant scope. Failure to validate cross-tenant boundaries permits forged action executions, cross-tenant CSRF replays, and hostile tenant impersonation across shared root domains.","antiPatternHeadline":"Cross-Tenant Server Action Execution via Unvalidated Host/Origin Forwarding","stars_count":68,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs","server-actions","multi-tenancy","security","csrf"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-server-action-multitenant-boundary-isolation?format=claude","cursorMdc":"/api/rules/nextjs-15-server-action-multitenant-boundary-isolation?format=mdc","cursorrules":"/api/rules/nextjs-15-server-action-multitenant-boundary-isolation?format=cursor","windsurf":"/api/rules/nextjs-15-server-action-multitenant-boundary-isolation?format=windsurf","agents":"/api/rules/nextjs-15-server-action-multitenant-boundary-isolation?format=agents"}},{"id":"drizzle-serverless-prepared-statement-lru-cache-guardrail","title":"Drizzle ORM Serverless Prepared Statement Bounded LRU and Eviction Standard","category":"backend","severity":"critical","description":"Enforces strict bounds and deterministic LRU eviction on prepared statements when using Drizzle ORM in ephemeral serverless and edge runtimes. Prevents V8 isolate out-of-memory crashes and upstream database connection pooler (e.g., PgBouncer, Neon) prepared statement thrashing.","antiPatternHeadline":"Unbounded Dynamic Statement Preparation and Leakage Across Ephemeral Edge Connections","stars_count":80,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","drizzle-orm","serverless","edge-computing","postgresql","memory-management"],"exportEndpoints":{"claude":"/api/rules/drizzle-serverless-prepared-statement-lru-cache-guardrail?format=claude","cursorMdc":"/api/rules/drizzle-serverless-prepared-statement-lru-cache-guardrail?format=mdc","cursorrules":"/api/rules/drizzle-serverless-prepared-statement-lru-cache-guardrail?format=cursor","windsurf":"/api/rules/drizzle-serverless-prepared-statement-lru-cache-guardrail?format=windsurf","agents":"/api/rules/drizzle-serverless-prepared-statement-lru-cache-guardrail?format=agents"}},{"id":"tauri2-mobile-ipc-zero-copy-backpressure-protocol","title":"Tauri 2.0 Mobile IPC Zero-Copy Binary Stream Backpressure Protocol","category":"mobile","severity":"critical","description":"Enforces deterministic chunk-level flow control and sliding-window acknowledgement contracts across the Rust-to-Webview IPC boundary in Tauri 2.0 mobile environments. Prevents fatal native host process terminations triggered by the Android Low Memory Killer (LMK) and iOS Jetsam daemon during multi-gigabyte client binary transfers.","antiPatternHeadline":"Unbounded IPC Channel Ingestion and Base64 Buffering Causing Mobile OS Process Termination","stars_count":43,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri-2","ipc","zero-copy","backpressure","rust","performance"],"exportEndpoints":{"claude":"/api/rules/tauri2-mobile-ipc-zero-copy-backpressure-protocol?format=claude","cursorMdc":"/api/rules/tauri2-mobile-ipc-zero-copy-backpressure-protocol?format=mdc","cursorrules":"/api/rules/tauri2-mobile-ipc-zero-copy-backpressure-protocol?format=cursor","windsurf":"/api/rules/tauri2-mobile-ipc-zero-copy-backpressure-protocol?format=windsurf","agents":"/api/rules/tauri2-mobile-ipc-zero-copy-backpressure-protocol?format=agents"}},{"id":"nextjs15-after-context-drain-budget-standard","title":"Next.js 15 after() Post-Response Execution and Drain Budget Standard","category":"frontend","severity":"critical","description":"Enforces deterministic wall-clock timeout caps, explicit AbortSignal propagation, and strict top-level error isolation for tasks scheduled via Next.js 15 after(). Prevents serverless runtime exhaustion, compute billing spikes, and unhandled process crashes during the post-response lifecycle.","antiPatternHeadline":"Unbounded, unshielded background promises inside after() exhausting platform drain budgets","stars_count":71,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs15","after","serverless","drain-budget","concurrency","reliability"],"exportEndpoints":{"claude":"/api/rules/nextjs15-after-context-drain-budget-standard?format=claude","cursorMdc":"/api/rules/nextjs15-after-context-drain-budget-standard?format=mdc","cursorrules":"/api/rules/nextjs15-after-context-drain-budget-standard?format=cursor","windsurf":"/api/rules/nextjs15-after-context-drain-budget-standard?format=windsurf","agents":"/api/rules/nextjs15-after-context-drain-budget-standard?format=agents"}},{"id":"vite-6-environment-api-multi-runtime-hermeticity","title":"Vite 6 Environment API Multi-Runtime State Hermeticity Invariant","category":"frontend","severity":"critical","description":"Vite 6 introduces multi-environment compilation (e.g., client, Node.js SSR, and Cloudflare Workerd/Edge) within a single pipeline. This invariant strictly enforces complete state and module hermeticity across concurrent runtimes and requests, prohibiting module-scope mutable singletons, enforcing `this.environment` context isolation in plugins, and securing request boundaries via runtime-native scoping like AsyncLocalStorage.","antiPatternHeadline":"Cross-Request State Contamination and Runtime Pollution via Shared Singletons in Vite 6 Universal Builds","stars_count":77,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","vite-6","environment-api","ssr","edge-worker","state-hermeticity"],"exportEndpoints":{"claude":"/api/rules/vite-6-environment-api-multi-runtime-hermeticity?format=claude","cursorMdc":"/api/rules/vite-6-environment-api-multi-runtime-hermeticity?format=mdc","cursorrules":"/api/rules/vite-6-environment-api-multi-runtime-hermeticity?format=cursor","windsurf":"/api/rules/vite-6-environment-api-multi-runtime-hermeticity?format=windsurf","agents":"/api/rules/vite-6-environment-api-multi-runtime-hermeticity?format=agents"}},{"id":"python313-freethreaded-fastapi-pool-thread-safety-standard","title":"Python 3.13 Free-Threaded FastAPI Async Connection Pool Thread-Safety Standard","category":"backend","severity":"critical","description":"Enforces strict thread-isolation and lock-free synchronization invariants for async connection pools in non-GIL CPython (Python 3.13t). In free-threaded runtimes, standard asyncio pools shared across concurrent ASGI worker threads cause memory corruption, atomic pointer races, and deadlocks. All connection resources must be strictly bound to thread-local event loops or synchronized via thread-safe primitives.","antiPatternHeadline":"Global Async Connection Pool Sharing Across Free-Threaded OS Worker Threads","stars_count":51,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","python313","fastapi","free-threaded","asyncpg","concurrency","nogil"],"exportEndpoints":{"claude":"/api/rules/python313-freethreaded-fastapi-pool-thread-safety-standard?format=claude","cursorMdc":"/api/rules/python313-freethreaded-fastapi-pool-thread-safety-standard?format=mdc","cursorrules":"/api/rules/python313-freethreaded-fastapi-pool-thread-safety-standard?format=cursor","windsurf":"/api/rules/python313-freethreaded-fastapi-pool-thread-safety-standard?format=windsurf","agents":"/api/rules/python313-freethreaded-fastapi-pool-thread-safety-standard?format=agents"}},{"id":"axum-cancel-safe-stream-drop-guardrail","title":"Axum 0.8 Cancel-Safe Async Pipeline and HTTP/3 Stream Drop Guardrail","category":"backend","severity":"critical","description":"Enforces cancellation-safe async state machines, atomic transaction boundaries, and Tokio CancellationToken propagation across Axum 0.8 middleware and handlers. Prevents dangling database mutations, orphaned remote RPC side effects, and resource leaks when HTTP/3 QUIC client streams terminate or reset prematurely mid-flight.","antiPatternHeadline":"Non-Cancel-Safe Multi-Stage Awaits Yielding Orphaned Mutations on HTTP/3 Stream Reset","stars_count":98,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","http3","tokio","cancel-safety","concurrency"],"exportEndpoints":{"claude":"/api/rules/axum-cancel-safe-stream-drop-guardrail?format=claude","cursorMdc":"/api/rules/axum-cancel-safe-stream-drop-guardrail?format=mdc","cursorrules":"/api/rules/axum-cancel-safe-stream-drop-guardrail?format=cursor","windsurf":"/api/rules/axum-cancel-safe-stream-drop-guardrail?format=windsurf","agents":"/api/rules/axum-cancel-safe-stream-drop-guardrail?format=agents"}},{"id":"postgres-17-incremental-backup-lsn-chain-verification","title":"PostgreSQL 17 Incremental Backup Cumulative LSN Chain and Manifest Verification","category":"backend","severity":"critical","description":"Mandates cryptographic manifest integrity checks, timeline alignment, and contiguous Log Sequence Number (LSN) chain verification before and after invoking PostgreSQL 17 pg_combinebackup. Prevents silent data corruption, invalid block overlays, and unrecoverable point-in-time recovery states in enterprise backup orchestration.","antiPatternHeadline":"Executing pg_combinebackup blindly without pre-validating manifest checksums, timeline histories, and contiguous LSN ranges across backup segments.","stars_count":44,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql-17","disaster-recovery","backup-manifest","pg-combinebackup","wal-chain"],"exportEndpoints":{"claude":"/api/rules/postgres-17-incremental-backup-lsn-chain-verification?format=claude","cursorMdc":"/api/rules/postgres-17-incremental-backup-lsn-chain-verification?format=mdc","cursorrules":"/api/rules/postgres-17-incremental-backup-lsn-chain-verification?format=cursor","windsurf":"/api/rules/postgres-17-incremental-backup-lsn-chain-verification?format=windsurf","agents":"/api/rules/postgres-17-incremental-backup-lsn-chain-verification?format=agents"}},{"id":"fido2-enterprise-attestation-passkey-rejection","title":"FIDO2 Enterprise Attestation and Cloud-Syncable Passkey Rejection Guardrail","category":"security","severity":"critical","description":"Enforces hardware-bound, non-exportable cryptographic authenticator validation via WebAuthn enterprise attestation statements to block personal consumer cloud credential synchronization on corporate assets. Mandates inspection of authenticator data flags to reject multi-device credentials (BE=1, BS=1) and validates authenticator AAGUIDs against enterprise-approved hardware allowlists anchored to FIDO MDS3 or private PKI.","antiPatternHeadline":"Accepting Multi-Device Syncable Passkeys (BE=1) or Permitting 'none' Attestation in Enterprise Workflows","stars_count":73,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","fido2","passkeys","enterprise-attestation","cryptography","zero-trust"],"exportEndpoints":{"claude":"/api/rules/fido2-enterprise-attestation-passkey-rejection?format=claude","cursorMdc":"/api/rules/fido2-enterprise-attestation-passkey-rejection?format=mdc","cursorrules":"/api/rules/fido2-enterprise-attestation-passkey-rejection?format=cursor","windsurf":"/api/rules/fido2-enterprise-attestation-passkey-rejection?format=windsurf","agents":"/api/rules/fido2-enterprise-attestation-passkey-rejection?format=agents"}},{"id":"ebpf-tc-socket-microsegmentation-guardrail","title":"eBPF TC Socket Microsegmentation and Kernel-Level Identity Injection","category":"security","severity":"critical","description":"Enforces non-bypassable kernel-level microsegmentation by attaching eBPF Traffic Control (TC) classifiers to container veth interfaces for sidecarless identity tagging and mTLS validation. Eliminates user-space bypass vectors and iptables race conditions by performing tenant SPIFFE ID verification directly within skb execution paths.","antiPatternHeadline":"Relying on user-space sidecar redirects or mutable iptables rules for microsegmentation and tenant identity attestation","stars_count":84,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","ebpf","networking","tc","microsegmentation","spiffe","zero-trust"],"exportEndpoints":{"claude":"/api/rules/ebpf-tc-socket-microsegmentation-guardrail?format=claude","cursorMdc":"/api/rules/ebpf-tc-socket-microsegmentation-guardrail?format=mdc","cursorrules":"/api/rules/ebpf-tc-socket-microsegmentation-guardrail?format=cursor","windsurf":"/api/rules/ebpf-tc-socket-microsegmentation-guardrail?format=windsurf","agents":"/api/rules/ebpf-tc-socket-microsegmentation-guardrail?format=agents"}},{"id":"cmp-ios-arc-retain-cycle-memory-guardrail","title":"Compose Multiplatform iOS Interop ARC Retain-Cycle & Teardown Guardrail","category":"mobile","severity":"critical","description":"Enforces strict weak-reference bridging and explicit lifecycle-bound teardown contracts between native UIKit/AppKit views and Kotlin/Native composables embedded via ComposeUIViewController. Without explicit weak referencing and onDispose cleanup callbacks, cross-runtime retain cycles between Apple ARC and Kotlin/Native garbage collector will cause permanent memory leaks.","antiPatternHeadline":"Cross-Runtime ARC Strong Retain Cycles via Closure Captures and Missing Teardown Callbacks","stars_count":89,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","compose-multiplatform","ios","uikit","arc","memory-management"],"exportEndpoints":{"claude":"/api/rules/cmp-ios-arc-retain-cycle-memory-guardrail?format=claude","cursorMdc":"/api/rules/cmp-ios-arc-retain-cycle-memory-guardrail?format=mdc","cursorrules":"/api/rules/cmp-ios-arc-retain-cycle-memory-guardrail?format=cursor","windsurf":"/api/rules/cmp-ios-arc-retain-cycle-memory-guardrail?format=windsurf","agents":"/api/rules/cmp-ios-arc-retain-cycle-memory-guardrail?format=agents"}},{"id":"otel-collector-inode-checkpoint-atomicity","title":"OpenTelemetry Collector Inode-Aware Checkpoint Atomicity Standard","category":"devops","severity":"critical","description":"Enforces persistent, inode-aware monotonic offset tracking within OpenTelemetry Collector filelog receivers deployed in containerized environments. Eliminates log dropouts, re-ingestion loops, and duplicate delivery spikes induced by rapid Kubernetes and CRI log rotations.","antiPatternHeadline":"Filepath-Bound Volatile Ingestion Subject to Inode Collision and Offset Rewinds During Log Rotation","stars_count":52,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","kubernetes","logging","observability","storage"],"exportEndpoints":{"claude":"/api/rules/otel-collector-inode-checkpoint-atomicity?format=claude","cursorMdc":"/api/rules/otel-collector-inode-checkpoint-atomicity?format=mdc","cursorrules":"/api/rules/otel-collector-inode-checkpoint-atomicity?format=cursor","windsurf":"/api/rules/otel-collector-inode-checkpoint-atomicity?format=windsurf","agents":"/api/rules/otel-collector-inode-checkpoint-atomicity?format=agents"}},{"id":"svelte-5-runes-boundary-isolation-standard","title":"Svelte 5 Runes Cross-Island Reactive Boundary Isolation Standard","category":"frontend","severity":"critical","description":"Enforces strict boundary encapsulation and lifecycle disposal for Svelte 5 reactive graphs operating across micro-frontend islands. Prevents cross-context memory leaks and uncontrolled cascade loops by prohibiting shared mutable $state proxies and uncontained reactive subscriptions across isolated runtime contexts.","antiPatternHeadline":"Leaking Raw Mutable $state Proxies and Detached $effect Subscriptions Across Micro-Frontend Island Boundaries","stars_count":84,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","micro-frontends","reactivity","memory-leaks"],"exportEndpoints":{"claude":"/api/rules/svelte-5-runes-boundary-isolation-standard?format=claude","cursorMdc":"/api/rules/svelte-5-runes-boundary-isolation-standard?format=mdc","cursorrules":"/api/rules/svelte-5-runes-boundary-isolation-standard?format=cursor","windsurf":"/api/rules/svelte-5-runes-boundary-isolation-standard?format=windsurf","agents":"/api/rules/svelte-5-runes-boundary-isolation-standard?format=agents"}},{"id":"nextjs-15-server-action-cryptographic-idempotency","title":"Next.js 15 Server Action Cryptographic Idempotency via Distributed Atomic Ledgers","category":"frontend","severity":"critical","description":"Enforces deterministic, cryptographically signed idempotency keys across all mutating Next.js 15 Server Actions to prevent duplicate side-effects from aggressive client-side network retries. Mandates atomic distributed lock-and-cache validation via edge-compatible ledgers (e.g., Upstash Redis) before executing sensitive business logic.","antiPatternHeadline":"Executing State-Mutating Server Actions Without Atomic Distributed Deduplication Tokens","stars_count":118,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs15","server-actions","concurrency","security","idempotency","redis"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-server-action-cryptographic-idempotency?format=claude","cursorMdc":"/api/rules/nextjs-15-server-action-cryptographic-idempotency?format=mdc","cursorrules":"/api/rules/nextjs-15-server-action-cryptographic-idempotency?format=cursor","windsurf":"/api/rules/nextjs-15-server-action-cryptographic-idempotency?format=windsurf","agents":"/api/rules/nextjs-15-server-action-cryptographic-idempotency?format=agents"}},{"id":"fastapi-python-313-nogil-concurrency-safety-standard","title":"FastAPI Python 3.13 Free-Threaded Concurrency Safety Standard","category":"backend","severity":"critical","description":"Enforces thread-safe state handling and context isolation in FastAPI applications operating on Python 3.13 free-threaded (no-GIL) runtimes. Prevents race conditions, cross-request memory bleeding, and corrupted mutable singletons caused by true concurrent native thread execution across event loops and worker pools. Mandates explicit synchronization, immutable data transfer, and proper usage of contextvars over raw module-level or thread-local storage.","antiPatternHeadline":"Unsynchronized Mutable Module Singletons and Unsafe Thread-Local State Bleed on No-GIL Runtimes","stars_count":101,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","python313","free-threaded","concurrency","no-gil","thread-safety"],"exportEndpoints":{"claude":"/api/rules/fastapi-python-313-nogil-concurrency-safety-standard?format=claude","cursorMdc":"/api/rules/fastapi-python-313-nogil-concurrency-safety-standard?format=mdc","cursorrules":"/api/rules/fastapi-python-313-nogil-concurrency-safety-standard?format=cursor","windsurf":"/api/rules/fastapi-python-313-nogil-concurrency-safety-standard?format=windsurf","agents":"/api/rules/fastapi-python-313-nogil-concurrency-safety-standard?format=agents"}},{"id":"axum-08-adaptive-concurrency-limiting-standard","title":"Axum 0.8 Adaptive Work-Conserving Concurrency Limiting Standard","category":"backend","severity":"critical","description":"Enforces dynamic, feedback-driven concurrency limiting and immediate load shedding at the Tower layer for Axum 0.8 services. Replaces brittle, static concurrency caps with gradient descent or Vegas-style RTT controllers to prevent microservice latency cliff collapse and unbounded memory buffering during downstream degradation.","antiPatternHeadline":"Static Semaphore or Fixed Token Bucket Concurrency Inducing Tail-Latency Queuing Collapse","stars_count":94,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tower","load-shedding","resilience","performance"],"exportEndpoints":{"claude":"/api/rules/axum-08-adaptive-concurrency-limiting-standard?format=claude","cursorMdc":"/api/rules/axum-08-adaptive-concurrency-limiting-standard?format=mdc","cursorrules":"/api/rules/axum-08-adaptive-concurrency-limiting-standard?format=cursor","windsurf":"/api/rules/axum-08-adaptive-concurrency-limiting-standard?format=windsurf","agents":"/api/rules/axum-08-adaptive-concurrency-limiting-standard?format=agents"}},{"id":"capacitor7-secure-enclave-biometric-assertion-bridge","title":"Hardware-Backed Biometric Assertion and Secure Enclave Isolation for Capacitor 7","category":"mobile","severity":"critical","description":"Enforces asymmetric cryptographic signing inside platform hardware secure elements (Apple Secure Enclave, Android StrongBox/TEE) via custom Capacitor 7 bridge plugins. Invariant: Private keys MUST NEVER be exportable or accessible within the hybrid WebView JavaScript realm; the WebView layer is strictly limited to passing ephemeral server challenges and receiving cryptographically signed assertions.","antiPatternHeadline":"Exporting Raw Private Keys or Performing Cryptographic Operations in WebView Memory","stars_count":107,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","security","cryptography","biometrics","secure-enclave","strongbox"],"exportEndpoints":{"claude":"/api/rules/capacitor7-secure-enclave-biometric-assertion-bridge?format=claude","cursorMdc":"/api/rules/capacitor7-secure-enclave-biometric-assertion-bridge?format=mdc","cursorrules":"/api/rules/capacitor7-secure-enclave-biometric-assertion-bridge?format=cursor","windsurf":"/api/rules/capacitor7-secure-enclave-biometric-assertion-bridge?format=windsurf","agents":"/api/rules/capacitor7-secure-enclave-biometric-assertion-bridge?format=agents"}},{"id":"cmp-skiko-render-frame-pacing-invariant","title":"Compose Multiplatform Skiko Render Frame Pacing on Heterogeneous LTPO Displays","category":"mobile","severity":"critical","description":"Enforces strict synchronization between Skiko rendering passes and platform vsync pulse mechanisms (CADisplayLink and Choreographer) across 120Hz LTPO and dynamic refresh displays. Prevents frame buffer bloat, micro-stutter, and unbound Skia GPU command allocation caused by unsynchronized recomposition and redraw loops.","antiPatternHeadline":"Unsynchronized frame ticking and unthrottled redraw scheduling causing frame pacing divergence and Skia surface buffer explosion","stars_count":45,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","compose-multiplatform","skiko","graphics","ios","android","performance"],"exportEndpoints":{"claude":"/api/rules/cmp-skiko-render-frame-pacing-invariant?format=claude","cursorMdc":"/api/rules/cmp-skiko-render-frame-pacing-invariant?format=mdc","cursorrules":"/api/rules/cmp-skiko-render-frame-pacing-invariant?format=cursor","windsurf":"/api/rules/cmp-skiko-render-frame-pacing-invariant?format=windsurf","agents":"/api/rules/cmp-skiko-render-frame-pacing-invariant?format=agents"}},{"id":"sev-snp-remote-attestation-secret-injection-guardrail","title":"AMD SEV-SNP Remote Attestation & Pre-Execution Secret Injection Guardrail","category":"security","severity":"critical","description":"Enforces strict cryptographic verification of AMD SEV-SNP hardware launch measurements and VCEK certificate chains prior to releasing sensitive secrets or decryption keys to containerized workloads. Blocks TOCTOU vulnerabilities and untrusted hypervisor snooping by ensuring ephemeral key exchange happens strictly via authenticated attestation reports tied to an unforgeable hardware root of trust.","antiPatternHeadline":"Injecting Workload Secrets Blindly Via Environment Variables Or Unverified Pre-Flight Webhooks","stars_count":92,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","confidential-computing","sev-snp","remote-attestation","zero-trust","oci-runtime"],"exportEndpoints":{"claude":"/api/rules/sev-snp-remote-attestation-secret-injection-guardrail?format=claude","cursorMdc":"/api/rules/sev-snp-remote-attestation-secret-injection-guardrail?format=mdc","cursorrules":"/api/rules/sev-snp-remote-attestation-secret-injection-guardrail?format=cursor","windsurf":"/api/rules/sev-snp-remote-attestation-secret-injection-guardrail?format=windsurf","agents":"/api/rules/sev-snp-remote-attestation-secret-injection-guardrail?format=agents"}},{"id":"webauthn-largeblob-zero-knowledge-storage-invariant","title":"WebAuthn LargeBlob Hardware-Isolated Zero-Knowledge Storage Invariant","category":"security","severity":"critical","description":"Enforces strict hardware-isolated cryptographic key and credential synchronization using the WebAuthn CTAP 2.1 largeBlob extension. Guarantees that sensitive client-side key material is sealed within authenticator-backed memory and AEAD-authenticated, strictly forbidding cloud-side custody or unencrypted persistence in standard Web Storage APIs.","antiPatternHeadline":"Degrading to Insecure Web Storage or Cloud Custody by Bypassing Hardware-Bound LargeBlob AEAD Verification","stars_count":95,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","fido2","largeblob","cryptography","zero-knowledge"],"exportEndpoints":{"claude":"/api/rules/webauthn-largeblob-zero-knowledge-storage-invariant?format=claude","cursorMdc":"/api/rules/webauthn-largeblob-zero-knowledge-storage-invariant?format=mdc","cursorrules":"/api/rules/webauthn-largeblob-zero-knowledge-storage-invariant?format=cursor","windsurf":"/api/rules/webauthn-largeblob-zero-knowledge-storage-invariant?format=windsurf","agents":"/api/rules/webauthn-largeblob-zero-knowledge-storage-invariant?format=agents"}},{"id":"otel-genai-semantic-conventions-leak-guardrail","title":"OpenTelemetry GenAI Semantic Conventions and Context Leak Guardrail","category":"devops","severity":"critical","description":"Enforces strict OpenTelemetry GenAI semantic conventions across agentic LLM workflows while preventing PII and confidential context exfiltration through telemetry span attributes. Requires token budget accounting, cryptographic payload hashing over raw prompt injection, and normalized metric dimensions across distributed inference meshes.","antiPatternHeadline":"Raw Prompt Exfiltration and Unstandardized Telemetry in GenAI Traces","stars_count":61,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","genai","tracing","security","pii-leakage","observability"],"exportEndpoints":{"claude":"/api/rules/otel-genai-semantic-conventions-leak-guardrail?format=claude","cursorMdc":"/api/rules/otel-genai-semantic-conventions-leak-guardrail?format=mdc","cursorrules":"/api/rules/otel-genai-semantic-conventions-leak-guardrail?format=cursor","windsurf":"/api/rules/otel-genai-semantic-conventions-leak-guardrail?format=windsurf","agents":"/api/rules/otel-genai-semantic-conventions-leak-guardrail?format=agents"}},{"id":"react-19-server-components-object-taint-boundary","title":"React 19 Server Components Object Taint Boundary Enforcement","category":"frontend","severity":"critical","description":"Mandates the explicit registration of sensitive runtime objects, secrets, and PII using React 19 Taint APIs (`experimental_taintObjectReference`, `experimental_taintUniqueValue`) at the Server Component data-access layer. Ensures that any serialization attempt across the React Server Component (RSC) to Client Component flight protocol boundary immediately terminates with a deterministic fatal error.","antiPatternHeadline":"Passing Raw Database Records or Secrets Across the Server-Client Serialization Boundary","stars_count":59,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","rsc","taint-api","security","data-boundary"],"exportEndpoints":{"claude":"/api/rules/react-19-server-components-object-taint-boundary?format=claude","cursorMdc":"/api/rules/react-19-server-components-object-taint-boundary?format=mdc","cursorrules":"/api/rules/react-19-server-components-object-taint-boundary?format=cursor","windsurf":"/api/rules/react-19-server-components-object-taint-boundary?format=windsurf","agents":"/api/rules/react-19-server-components-object-taint-boundary?format=agents"}},{"id":"nextjs15-ppr-dynamic-streaming-barrier","title":"Next.js 15 Partial Prerendering (PPR) Dynamic Streaming Barrier Invariant","category":"frontend","severity":"critical","description":"Enforces strict physical boundaries between static build-time shells and dynamic asynchronous RSC execution streams under Next.js 15 Partial Prerendering (PPR). Prevents dynamic execution leakages (such as un-suspended cookies(), headers(), searchParams, or dynamic uncached DB reads) from destabilizing static prerender boundaries and cascading into severe TTFB stalls.","antiPatternHeadline":"Dynamic Scope Ingress and Unbounded Dynamic De-opt in Static Shell Layouts","stars_count":101,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs15","ppr","rsc","streaming","performance"],"exportEndpoints":{"claude":"/api/rules/nextjs15-ppr-dynamic-streaming-barrier?format=claude","cursorMdc":"/api/rules/nextjs15-ppr-dynamic-streaming-barrier?format=mdc","cursorrules":"/api/rules/nextjs15-ppr-dynamic-streaming-barrier?format=cursor","windsurf":"/api/rules/nextjs15-ppr-dynamic-streaming-barrier?format=windsurf","agents":"/api/rules/nextjs15-ppr-dynamic-streaming-barrier?format=agents"}},{"id":"bun-cluster-ipc-socket-handoff","title":"Bun 1.2 Cluster IPC Non-Blocking Socket Handoff & Graceful Drain Standard","category":"backend","severity":"critical","description":"Enforces deterministic TCP connection handoffs and zero-downtime worker recycling under Bun 1.2 cluster topologies using non-blocking IPC handle transfers. Guarantees starvation-free connection distribution and prevents kernel file descriptor leaks (EMFILE) during high-throughput rolling process upgrades.","antiPatternHeadline":"Leaking Kernel FDs and Dropping Inflight Connections via Blind Worker Termination and Uncoordinated IPC Socket Transfers","stars_count":86,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","clustering","ipc","sockets","concurrency","zero-downtime"],"exportEndpoints":{"claude":"/api/rules/bun-cluster-ipc-socket-handoff?format=claude","cursorMdc":"/api/rules/bun-cluster-ipc-socket-handoff?format=mdc","cursorrules":"/api/rules/bun-cluster-ipc-socket-handoff?format=cursor","windsurf":"/api/rules/bun-cluster-ipc-socket-handoff?format=windsurf","agents":"/api/rules/bun-cluster-ipc-socket-handoff?format=agents"}},{"id":"fastapi-async-lifespan-drainage-guardrail","title":"FastAPI Async Lifespan Graceful Drainage & Connection Teardown Guardrail","category":"backend","severity":"critical","description":"Enforces deterministic termination of persistent resource pools (databases, HTTP clients, message brokers) and background coroutine task groups during ASGI lifespan shutdown. Guarantees zero dropped in-flight requests during SIGTERM orchestrations by decoupling server draining from abrupt pool termination.","antiPatternHeadline":"Premature Pool Disconnection or Zombie Background Tasks in Async Lifespan Teardown","stars_count":70,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["fastapi","asgi","asyncio","lifespan","concurrency","graceful-shutdown"],"exportEndpoints":{"claude":"/api/rules/fastapi-async-lifespan-drainage-guardrail?format=claude","cursorMdc":"/api/rules/fastapi-async-lifespan-drainage-guardrail?format=mdc","cursorrules":"/api/rules/fastapi-async-lifespan-drainage-guardrail?format=cursor","windsurf":"/api/rules/fastapi-async-lifespan-drainage-guardrail?format=windsurf","agents":"/api/rules/fastapi-async-lifespan-drainage-guardrail?format=agents"}},{"id":"android-16kb-page-size-alignment-standard-android-15-16kb--601","title":"Android 15 16KB Page Size Alignment & Native Memory-Mapping Standard","category":"mobile","severity":"critical","description":"Enforces 16KB (0x4000) ELF segment alignment and page-aware dynamic memory-mapping across all JNI/C++ native toolchains targeting Android 15 (API level 35+). Legacy 4KB-aligned ELF segments or hardcoded 4096-byte page size assumptions in mmap/mprotect routines trigger fatal kernel segmentation faults (`SIGSEGV` / `SEGV_ACCERR`) on devices utilizing 16KB physical memory pages.","antiPatternHeadline":"Hardcoded 4KB Page Assumptions and 4KB ELF Segment Packing Leading to Fatal Native SIGSEGV Crashes on Android 15","stars_count":68,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","android","ndk","jni","cpp","memory-management","android-15"],"exportEndpoints":{"claude":"/api/rules/android-16kb-page-size-alignment-standard-android-15-16kb--601?format=claude","cursorMdc":"/api/rules/android-16kb-page-size-alignment-standard-android-15-16kb--601?format=mdc","cursorrules":"/api/rules/android-16kb-page-size-alignment-standard-android-15-16kb--601?format=cursor","windsurf":"/api/rules/android-16kb-page-size-alignment-standard-android-15-16kb--601?format=windsurf","agents":"/api/rules/android-16kb-page-size-alignment-standard-android-15-16kb--601?format=agents"}},{"id":"jetpack-compose-strong-skipping-recomposition-guardrail","title":"Jetpack Compose Strong Skipping Mode and Lambda Memoization Invariants","category":"mobile","severity":"critical","description":"Enforces compiler-level stability boundaries and deterministic value equality under Jetpack Compose Strong Skipping Mode. Prevents silent recomposition thrashing and memory leaks caused by unstable parameter capture, missing structural equality contracts, and broken lambda memoization boundaries.","antiPatternHeadline":"Passing Unstable Types Lacking Value Equality or Capturing Mutating Scopes Inside Composables","stars_count":93,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","android","jetpack-compose","kotlin","recomposition","performance"],"exportEndpoints":{"claude":"/api/rules/jetpack-compose-strong-skipping-recomposition-guardrail?format=claude","cursorMdc":"/api/rules/jetpack-compose-strong-skipping-recomposition-guardrail?format=mdc","cursorrules":"/api/rules/jetpack-compose-strong-skipping-recomposition-guardrail?format=cursor","windsurf":"/api/rules/jetpack-compose-strong-skipping-recomposition-guardrail?format=windsurf","agents":"/api/rules/jetpack-compose-strong-skipping-recomposition-guardrail?format=agents"}},{"id":"opentelemetry-arrow-columnar-telemetry-ingestion-standard","title":"OpenTelemetry Arrow Columnar Ingestion and Vectorized Batching Standard","category":"devops","severity":"critical","description":"Enforces the OpenTelemetry Arrow protocol for high-throughput observability pipelines to replace row-oriented Protobuf serialization with columnar Apache Arrow RecordBatches. Eliminates cross-AZ network egress inflation and collector CPU spikes by enforcing stream-level schema dictionaries, vectorized memory limits, and adaptive batching buffers.","antiPatternHeadline":"Uncompressed Row-Oriented OTLP/Protobuf Egress with Unbounded Collector Memory Pools","stars_count":85,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","apache-arrow","observability","finops","collector"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-arrow-columnar-telemetry-ingestion-standard?format=claude","cursorMdc":"/api/rules/opentelemetry-arrow-columnar-telemetry-ingestion-standard?format=mdc","cursorrules":"/api/rules/opentelemetry-arrow-columnar-telemetry-ingestion-standard?format=cursor","windsurf":"/api/rules/opentelemetry-arrow-columnar-telemetry-ingestion-standard?format=windsurf","agents":"/api/rules/opentelemetry-arrow-columnar-telemetry-ingestion-standard?format=agents"}},{"id":"spire-workload-identity-x509-svid-rotation","title":"SPIRE Workload Identity X.509 SVID Sub-Hour Rotation and Attestation Guardrail","category":"security","severity":"critical","description":"Enforces zero-trust authentication across heterogeneous container runtimes by obtaining ephemeral X.509 SPIFFE Verifiable Identity Documents (X509-SVIDs) directly from the SPIRE Workload API. Prohibits persistent static credentials, requiring sub-hour certificate lifetimes and dynamic in-memory TLS context updates via active Workload API socket streaming.","antiPatternHeadline":"Mounting Long-Lived Static Secrets or Statically Loading Ephemeral Certificates Without Watch Loops","stars_count":77,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","spiffe","spire","zero-trust","mtls","x509","workload-identity"],"exportEndpoints":{"claude":"/api/rules/spire-workload-identity-x509-svid-rotation?format=claude","cursorMdc":"/api/rules/spire-workload-identity-x509-svid-rotation?format=mdc","cursorrules":"/api/rules/spire-workload-identity-x509-svid-rotation?format=cursor","windsurf":"/api/rules/spire-workload-identity-x509-svid-rotation?format=windsurf","agents":"/api/rules/spire-workload-identity-x509-svid-rotation?format=agents"}},{"id":"react19-server-actions-optimistic-rollback-guardrail","title":"React 19 useOptimistic Rollback and Server Action Idempotency Guardrail","category":"frontend","severity":"critical","description":"Enforces strict transition boundaries, idempotent dispatch payloads, and deterministic error handling for React 19 useOptimistic mutations paired with asynchronous Server Actions. Prevents phantom UI states, broken microtask rollback semantics, and out-of-order race conditions during server rejections.","antiPatternHeadline":"Detached Asynchronous Optimistic State Updates Without Transition Scopes or Idempotency Keys","stars_count":90,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","use-optimistic","server-actions","concurrency","idempotency"],"exportEndpoints":{"claude":"/api/rules/react19-server-actions-optimistic-rollback-guardrail?format=claude","cursorMdc":"/api/rules/react19-server-actions-optimistic-rollback-guardrail?format=mdc","cursorrules":"/api/rules/react19-server-actions-optimistic-rollback-guardrail?format=cursor","windsurf":"/api/rules/react19-server-actions-optimistic-rollback-guardrail?format=windsurf","agents":"/api/rules/react19-server-actions-optimistic-rollback-guardrail?format=agents"}},{"id":"go-124-synctest-virtual-time-boundary","title":"Go 1.24 synctest Deterministic Concurrency and Virtual Time Boundary","category":"backend","severity":"critical","description":"Enforces strict virtual time isolation via the experimental Go 1.24 testing/synctest package for concurrent tests, consensus engines, and channel workflows. Prohibits non-deterministic wall-clock sleeps, unbounded polling loops, and leaky goroutines outside the isolated bubble. Guarantees 100% deterministic scheduling and instant time acceleration across concurrent goroutine topologies.","antiPatternHeadline":"Flaky Wall-Clock Sleeps and Leaked Outer Goroutines in Concurrent State Machine Tests","stars_count":112,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","concurrency","synctest","testing","distributed-systems"],"exportEndpoints":{"claude":"/api/rules/go-124-synctest-virtual-time-boundary?format=claude","cursorMdc":"/api/rules/go-124-synctest-virtual-time-boundary?format=mdc","cursorrules":"/api/rules/go-124-synctest-virtual-time-boundary?format=cursor","windsurf":"/api/rules/go-124-synctest-virtual-time-boundary?format=windsurf","agents":"/api/rules/go-124-synctest-virtual-time-boundary?format=agents"}},{"id":"pgvector-hnsw-iterative-scan-memory-boundary","title":"pgvector 0.8+ HNSW Iterative Scan Memory and Traversal Boundary Invariant","category":"backend","severity":"critical","description":"Mandates deterministic resource boundaries for pgvector 0.8+ HNSW iterative scans during hybrid metadata filtering. Low-selectivity predicates during graph traversals must be constrained by explicit hnsw.max_scan_tuples caps, localized statement timeouts, and bounded index memory parameters to prevent unbounded backend memory expansion and catastrophic connection pool exhaustion.","antiPatternHeadline":"Unbounded HNSW Iterative Scan on Low-Selectivity Predicates Causing Graph Traversal Runaway and OOM","stars_count":73,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","pgvector","hnsw","vector-search","database-performance"],"exportEndpoints":{"claude":"/api/rules/pgvector-hnsw-iterative-scan-memory-boundary?format=claude","cursorMdc":"/api/rules/pgvector-hnsw-iterative-scan-memory-boundary?format=mdc","cursorrules":"/api/rules/pgvector-hnsw-iterative-scan-memory-boundary?format=cursor","windsurf":"/api/rules/pgvector-hnsw-iterative-scan-memory-boundary?format=windsurf","agents":"/api/rules/pgvector-hnsw-iterative-scan-memory-boundary?format=agents"}},{"id":"kmp-swift-export-actor-isolation-boundary","title":"KMP Swift Export Actor-Isolation and Cooperative Thread Pool Boundary Guardrail","category":"mobile","severity":"critical","description":"Enforces strict isolation boundaries when bridging Kotlin Coroutines with Swift Actors across Kotlin Multiplatform's Swift Export and Objective-C interop layers. Prevents Swift cooperative thread-pool exhaustion and unsafe cross-actor mutable pointer access by mandating detached execution contexts, value-type payloads, and explicit cancellation mapping across the FFI runtime.","antiPatternHeadline":"Directly invoking blocking Kotlin Suspend functions from Swift Actors causing cooperative thread pool deadlock and data races","stars_count":113,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","swift-concurrency","actor-isolation","coroutines","ffi-safety"],"exportEndpoints":{"claude":"/api/rules/kmp-swift-export-actor-isolation-boundary?format=claude","cursorMdc":"/api/rules/kmp-swift-export-actor-isolation-boundary?format=mdc","cursorrules":"/api/rules/kmp-swift-export-actor-isolation-boundary?format=cursor","windsurf":"/api/rules/kmp-swift-export-actor-isolation-boundary?format=windsurf","agents":"/api/rules/kmp-swift-export-actor-isolation-boundary?format=agents"}},{"id":"webauthn-prf-client-vault-key-derivation","title":"Mandatory Client-Side WebAuthn PRF Symmetric Key Derivation & Zero-Knowledge Transport","category":"security","severity":"critical","description":"Enforces strict client-side symmetric key derivation using the WebAuthn PRF (Pseudo-Random Function) extension for end-to-end encrypted vaults. Authenticator PRF outputs and intermediate key materials must never be transmitted to Relying Party servers, and must always be expanded via client-side HKDF with distinct domain separation parameters before encrypting application state.","antiPatternHeadline":"Transmitting WebAuthn PRF Extension Outputs to Relying Party Backends or Deriving Vault Keys Server-Side","stars_count":73,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","prf-extension","e2ee","cryptography","zero-knowledge"],"exportEndpoints":{"claude":"/api/rules/webauthn-prf-client-vault-key-derivation?format=claude","cursorMdc":"/api/rules/webauthn-prf-client-vault-key-derivation?format=mdc","cursorrules":"/api/rules/webauthn-prf-client-vault-key-derivation?format=cursor","windsurf":"/api/rules/webauthn-prf-client-vault-key-derivation?format=windsurf","agents":"/api/rules/webauthn-prf-client-vault-key-derivation?format=agents"}},{"id":"slsa-v1-1-ephemeral-oidc-sigstore-attestation","title":"SLSA v1.1 Ephemeral OIDC Sigstore Attestation & Hermetic Provenance Guardrail","category":"security","severity":"critical","description":"Mandates SLSA v1.1 Build L3 compliance via keyless cryptographic signing using ephemeral OIDC tokens through Sigstore Fulcio and Rekor. Prohibits static long-lived signing credentials, unverified build runners, and non-hermetic provenance generation across all CI/CD pipelines.","antiPatternHeadline":"Static Secret Signing & Non-Hermetic In-Runner Artifact Attestation","stars_count":105,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","slsa","sigstore","cosign","supply-chain","attestation","oidc"],"exportEndpoints":{"claude":"/api/rules/slsa-v1-1-ephemeral-oidc-sigstore-attestation?format=claude","cursorMdc":"/api/rules/slsa-v1-1-ephemeral-oidc-sigstore-attestation?format=mdc","cursorrules":"/api/rules/slsa-v1-1-ephemeral-oidc-sigstore-attestation?format=cursor","windsurf":"/api/rules/slsa-v1-1-ephemeral-oidc-sigstore-attestation?format=windsurf","agents":"/api/rules/slsa-v1-1-ephemeral-oidc-sigstore-attestation?format=agents"}},{"id":"kubernetes-gateway-api-referencegrant-boundary","title":"Kubernetes Gateway API Cross-Namespace ReferenceGrant Security Boundary Enforcement","category":"devops","severity":"critical","description":"Cross-namespace references in Kubernetes Gateway API—such as Routes forwarding to Services or Gateways referencing TLS Secrets across namespace boundaries—expose multi-tenant clusters to unauthorized traffic interception, credential exfiltration, and route hijacking. All cross-namespace linkages must be explicitly authorized using bidirectional ReferenceGrant resources scoped to specific namespaces and kinds without wildcard permissions.","antiPatternHeadline":"Implicit Cross-Namespace Route Hijacking or Wildcarded ReferenceGrant Exploitation","stars_count":52,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","kubernetes","gateway-api","security","multi-tenancy","referencegrant","network-security"],"exportEndpoints":{"claude":"/api/rules/kubernetes-gateway-api-referencegrant-boundary?format=claude","cursorMdc":"/api/rules/kubernetes-gateway-api-referencegrant-boundary?format=mdc","cursorrules":"/api/rules/kubernetes-gateway-api-referencegrant-boundary?format=cursor","windsurf":"/api/rules/kubernetes-gateway-api-referencegrant-boundary?format=windsurf","agents":"/api/rules/kubernetes-gateway-api-referencegrant-boundary?format=agents"}},{"id":"otel-tail-sampling-consistent-hash-ring-invariant","title":"OpenTelemetry Tail-Sampling Collector Cluster Consistent-Hash Ring Invariant","category":"devops","severity":"critical","description":"Enforces deterministic span routing using consistent hashing keyed strictly on trace ID across two-tier OpenTelemetry collector architectures. Prevents partial trace trees and false-positive tail-sampling drops caused by routing disparate spans of the same trace to distinct collector nodes.","antiPatternHeadline":"Stateless load-balancing (Round-Robin/Random/IP Hash) across tail-sampling collector instances fragmenting distributed traces.","stars_count":73,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","distributed-tracing","tail-sampling","load-balancing","consistent-hashing"],"exportEndpoints":{"claude":"/api/rules/otel-tail-sampling-consistent-hash-ring-invariant?format=claude","cursorMdc":"/api/rules/otel-tail-sampling-consistent-hash-ring-invariant?format=mdc","cursorrules":"/api/rules/otel-tail-sampling-consistent-hash-ring-invariant?format=cursor","windsurf":"/api/rules/otel-tail-sampling-consistent-hash-ring-invariant?format=windsurf","agents":"/api/rules/otel-tail-sampling-consistent-hash-ring-invariant?format=agents"}},{"id":"svelte-5-runes-effect-boundary-microtask-loop-quota","title":"Svelte 5 Runes Effect Boundary & Reactive Loop Quota Enforcement","category":"frontend","severity":"critical","description":"Enforces strict boundaries around $effect executions and state mutations in Svelte 5. Prevents runaway reactive cascades, cyclic microtask schedule exhaustion, and Svelte update quota crashes by mandating pure derivations via $derived and explicit boundary gating via untrack().","antiPatternHeadline":"Mutating Tracked State Inside $effect Triggering Cyclic Microtask Cascades","stars_count":45,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","state-management","performance"],"exportEndpoints":{"claude":"/api/rules/svelte-5-runes-effect-boundary-microtask-loop-quota?format=claude","cursorMdc":"/api/rules/svelte-5-runes-effect-boundary-microtask-loop-quota?format=mdc","cursorrules":"/api/rules/svelte-5-runes-effect-boundary-microtask-loop-quota?format=cursor","windsurf":"/api/rules/svelte-5-runes-effect-boundary-microtask-loop-quota?format=windsurf","agents":"/api/rules/svelte-5-runes-effect-boundary-microtask-loop-quota?format=agents"}},{"id":"nextjs-15-server-actions-idempotency-key","title":"Next.js 15 Server Actions Distributed Idempotency Key Invariant","category":"frontend","severity":"critical","description":"Next.js 15 Server Actions execute mutations over HTTP POST endpoints that lack built-in network deduplication, exposing financial and state-altering workflows to duplicate execution during mobile client retries or network handoffs. Distributed systems require every mutating Server Action to enforce an atomic acquire-evaluate-persist workflow using a client-generated idempotency key validated against an atomic distributed lock or persistent datastore before triggering external side effects. This guarantees strict exactly-once semantics across volatile mobile environments.","antiPatternHeadline":"Executing Non-Idempotent Server Actions Relying Solely on Client UI State Disabling","stars_count":95,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs15","server-actions","idempotency","distributed-systems","redis"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-server-actions-idempotency-key?format=claude","cursorMdc":"/api/rules/nextjs-15-server-actions-idempotency-key?format=mdc","cursorrules":"/api/rules/nextjs-15-server-actions-idempotency-key?format=cursor","windsurf":"/api/rules/nextjs-15-server-actions-idempotency-key?format=windsurf","agents":"/api/rules/nextjs-15-server-actions-idempotency-key?format=agents"}},{"id":"openfga-contextual-tuple-traversal-guardrail","title":"OpenFGA Contextual Tuple Traversal Depth and Cycle Bound Guardrail","category":"backend","severity":"critical","description":"Fences recursive graph evaluation in OpenFGA authorization checks by enforcing bounded contextual tuple cardinalities, strictly prohibiting circular group nesting, and preventing unbounded relation transitive walks. Uncontrolled contextual tuples injected at evaluation time trigger exponential sub-graph expansions, unconstrained database fan-out, and high-cardinality authorization-induced latency degradation.","antiPatternHeadline":"Injecting Dynamic Ephemeral Contextual Tuples Without Invariant Depth Bounds or Cycle Validation","stars_count":48,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","openfga","rebac","authorization","performance","security"],"exportEndpoints":{"claude":"/api/rules/openfga-contextual-tuple-traversal-guardrail?format=claude","cursorMdc":"/api/rules/openfga-contextual-tuple-traversal-guardrail?format=mdc","cursorrules":"/api/rules/openfga-contextual-tuple-traversal-guardrail?format=cursor","windsurf":"/api/rules/openfga-contextual-tuple-traversal-guardrail?format=windsurf","agents":"/api/rules/openfga-contextual-tuple-traversal-guardrail?format=agents"}},{"id":"pgvector-halfvec-hnsw-memory-convergence-bound","title":"pgvector Halfvec Quantization Memory-Budget & HNSW Convergence Bound","category":"backend","severity":"critical","description":"Enforces strict off-heap memory budgets and bounded graph convergence for pgvector workloads using halfvec (16-bit floating point) quantization under write saturation. Prevents database worker OOM terminations, index bloat, and recall degradation by standardizing memory limits, staging ingest pipelines, and isolating construction parameters.","antiPatternHeadline":"Unquantized In-Place HNSW Writes Under High Ingestion Inducing Out-Of-Memory and Graph Fragmentation","stars_count":73,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","pgvector","postgresql","hnsw","halfvec","memory-management","embeddings"],"exportEndpoints":{"claude":"/api/rules/pgvector-halfvec-hnsw-memory-convergence-bound?format=claude","cursorMdc":"/api/rules/pgvector-halfvec-hnsw-memory-convergence-bound?format=mdc","cursorrules":"/api/rules/pgvector-halfvec-hnsw-memory-convergence-bound?format=cursor","windsurf":"/api/rules/pgvector-halfvec-hnsw-memory-convergence-bound?format=windsurf","agents":"/api/rules/pgvector-halfvec-hnsw-memory-convergence-bound?format=agents"}},{"id":"bun-clustered-worker-ipc-buffer-lifetime","title":"Bun 1.2 Clustered Worker Zero-Copy IPC Buffer Lifetime Invariants","category":"backend","severity":"critical","description":"Enforces deterministic memory ownership and synchronization semantics for zero-copy ArrayBuffer transfers and SharedArrayBuffer IPC queues in Bun 1.2 clustered runtimes. Eliminates silent race conditions, detached buffer access errors, and use-after-free panics under high-throughput messaging workloads.","antiPatternHeadline":"Unfenced SharedArrayBuffer Mutation and Post-Transfer ArrayBuffer Access in Bun Clustered Workers","stars_count":46,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","ipc","sharedarraybuffer","concurrency","performance"],"exportEndpoints":{"claude":"/api/rules/bun-clustered-worker-ipc-buffer-lifetime?format=claude","cursorMdc":"/api/rules/bun-clustered-worker-ipc-buffer-lifetime?format=mdc","cursorrules":"/api/rules/bun-clustered-worker-ipc-buffer-lifetime?format=cursor","windsurf":"/api/rules/bun-clustered-worker-ipc-buffer-lifetime?format=windsurf","agents":"/api/rules/bun-clustered-worker-ipc-buffer-lifetime?format=agents"}},{"id":"tauri-v2-capability-ipc-permission-guardrail","title":"Tauri 2.0 Capability-Based IPC Permission Boundary Guardrail","category":"mobile","severity":"critical","description":"Enforces strict principle-of-least-privilege boundaries between untrusted webview DOM contexts and native host plugins in Tauri 2.0 applications. Prohibits wildcard plugin capabilities, mandates path-scoped filesystem permissions, and enforces defensive validation on custom host IPC commands.","antiPatternHeadline":"Over-Permissive Wildcard Capabilities and Path-Traversal Vulnerable IPC Handlers in Tauri 2.0","stars_count":114,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri","security","ipc","permissions","rust"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-capability-ipc-permission-guardrail?format=claude","cursorMdc":"/api/rules/tauri-v2-capability-ipc-permission-guardrail?format=mdc","cursorrules":"/api/rules/tauri-v2-capability-ipc-permission-guardrail?format=cursor","windsurf":"/api/rules/tauri-v2-capability-ipc-permission-guardrail?format=windsurf","agents":"/api/rules/tauri-v2-capability-ipc-permission-guardrail?format=agents"}},{"id":"kmp-native-objc-autoreleasepool-boundary-standard","title":"KMP Native Objective-C Interop ARC Autoreleasepool Boundary Standard","category":"mobile","severity":"critical","description":"High-frequency bridge traversals between Kotlin Native and Swift/Objective-C allocate intermediate bridged objects within the active thread's top-level autorelease pool. Without explicit pool boundaries during streaming payload ingestion or tight iteration loops, unbounded retention of transient Objective-C objects occurs, triggering memory pressure crashes and rapid OOM termination on iOS targets.","antiPatternHeadline":"Unbounded Transient Allocation Accumulation in Thread-Level Autorelease Pools During High-Frequency KMP Bridge Crossings","stars_count":44,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","ios","memory-management","arc","autoreleasepool"],"exportEndpoints":{"claude":"/api/rules/kmp-native-objc-autoreleasepool-boundary-standard?format=claude","cursorMdc":"/api/rules/kmp-native-objc-autoreleasepool-boundary-standard?format=mdc","cursorrules":"/api/rules/kmp-native-objc-autoreleasepool-boundary-standard?format=cursor","windsurf":"/api/rules/kmp-native-objc-autoreleasepool-boundary-standard?format=windsurf","agents":"/api/rules/kmp-native-objc-autoreleasepool-boundary-standard?format=agents"}},{"id":"oauth2-dpop-nonce-synchronization-keybinding-standard","title":"RFC 9449 DPoP Key-Binding Assertion & Nonce Synchronization Standard","category":"security","severity":"critical","description":"Enforces strict RFC 9449 Demonstrating Proof-of-Possession (DPoP) key-binding assertions and stateful nonce synchronization. Prevents token replay, exfiltration, and downgrade attacks in zero-trust architectures by cryptographically binding access and refresh tokens to client-held asymmetric keys.","antiPatternHeadline":"Falling Back to Unbound Bearer Tokens or Leaking Assertions Across Method/URI Contexts with Stale Nonces","stars_count":53,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","oauth2","rfc9449","dpop","zero-trust","cryptography","webcrypto"],"exportEndpoints":{"claude":"/api/rules/oauth2-dpop-nonce-synchronization-keybinding-standard?format=claude","cursorMdc":"/api/rules/oauth2-dpop-nonce-synchronization-keybinding-standard?format=mdc","cursorrules":"/api/rules/oauth2-dpop-nonce-synchronization-keybinding-standard?format=cursor","windsurf":"/api/rules/oauth2-dpop-nonce-synchronization-keybinding-standard?format=windsurf","agents":"/api/rules/oauth2-dpop-nonce-synchronization-keybinding-standard?format=agents"}},{"id":"ebpf-sockops-fastpath-conntrack-fencing","title":"eBPF Sockops TCP Fast-Path Stateful Firewall Bypass Fencing","category":"devops","severity":"critical","description":"Enforces strict conntrack state machine synchronization and network security policy fencing before short-circuiting TCP streams via eBPF sockops and sockmap redirection. Prevents silent bypass of stateful firewall inspection, asymmetric connection tracking timeouts, and unauthorized intra-node microsegmentation bypasses.","antiPatternHeadline":"Blind socket hash insertion on TCP handshake completion without firewall policy lookup or conntrack synchronization","stars_count":101,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","sockops","conntrack","network-security","linux-kernel","packet-filtering"],"exportEndpoints":{"claude":"/api/rules/ebpf-sockops-fastpath-conntrack-fencing?format=claude","cursorMdc":"/api/rules/ebpf-sockops-fastpath-conntrack-fencing?format=mdc","cursorrules":"/api/rules/ebpf-sockops-fastpath-conntrack-fencing?format=cursor","windsurf":"/api/rules/ebpf-sockops-fastpath-conntrack-fencing?format=windsurf","agents":"/api/rules/ebpf-sockops-fastpath-conntrack-fencing?format=agents"}},{"id":"k8s-dra-gpu-partition-preemption-guardrail","title":"Kubernetes DRA Accelerator Slice Isolation and Memory Sanitization Guardrail","category":"devops","severity":"critical","description":"Enforces deterministic teardown, VRAM memory zeroing, and hardware-level isolation during Dynamic Resource Allocation (DRA) GPU slice preemption. Guarantees that preempted fractional GPU instances (e.g., MIG, MPS, or vendor-specific virtualized contexts) cannot leak dirty residual tensor state or induce asynchronous kernel execution faults in collocated tenant workloads during slice re-allocation.","antiPatternHeadline":"Unsanitized Asynchronous Slice Eviction Permitting Cross-Tenant VRAM Data Leakage and Driver Page Fault Cascades","stars_count":100,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","kubernetes","dra","gpu","mig","cuda","zero-trust","scheduling"],"exportEndpoints":{"claude":"/api/rules/k8s-dra-gpu-partition-preemption-guardrail?format=claude","cursorMdc":"/api/rules/k8s-dra-gpu-partition-preemption-guardrail?format=mdc","cursorrules":"/api/rules/k8s-dra-gpu-partition-preemption-guardrail?format=cursor","windsurf":"/api/rules/k8s-dra-gpu-partition-preemption-guardrail?format=windsurf","agents":"/api/rules/k8s-dra-gpu-partition-preemption-guardrail?format=agents"}},{"id":"openfga-contextual-tuple-staleness-invariant","title":"OpenFGA 1.6 Contextual Tuple Staleness and Zero-Drift ReBAC Invariant","category":"security","severity":"critical","description":"Mandates contextual tuple injection and transactional replication-lag mitigation for OpenFGA 1.6 relationship-based access control (ReBAC). Guarantees zero authorization drift and prevents TOCTOU permission bypasses during high-throughput concurrent writes across distributed evaluation clusters.","antiPatternHeadline":"Evaluating Authorization Decisions Against Asynchronously Replicated State Without Contextual Tuple Injection","stars_count":108,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","rebac","authorization","distributed-systems","concurrency"],"exportEndpoints":{"claude":"/api/rules/openfga-contextual-tuple-staleness-invariant?format=claude","cursorMdc":"/api/rules/openfga-contextual-tuple-staleness-invariant?format=mdc","cursorrules":"/api/rules/openfga-contextual-tuple-staleness-invariant?format=cursor","windsurf":"/api/rules/openfga-contextual-tuple-staleness-invariant?format=windsurf","agents":"/api/rules/openfga-contextual-tuple-staleness-invariant?format=agents"}},{"id":"vite-6-module-runner-environment-isolation-guardrail","title":"Vite 6 Environment API Module Runner Deterministic Memory & Runtime Isolation Guardrail","category":"frontend","severity":"critical","description":"Enforces deterministic lifecycle disposal, module graph cache invalidation, and strict global scope hygiene across concurrent SSR micro-frontends executed via Vite 6 Environment API Module Runner. Prevents host memory leaks and cross-context pollution caused by lingering module evaluators, unclosed runners, and detached closure retention in long-running Vite server runtimes.","antiPatternHeadline":"Unbounded ModuleRunner Instantiation and Leaked Module Cache Closures in Vite 6 Multi-Tenant SSR","stars_count":61,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["vite6","environment-api","module-runner","ssr","memory-leaks","micro-frontends","garbage-collection"],"exportEndpoints":{"claude":"/api/rules/vite-6-module-runner-environment-isolation-guardrail?format=claude","cursorMdc":"/api/rules/vite-6-module-runner-environment-isolation-guardrail?format=mdc","cursorrules":"/api/rules/vite-6-module-runner-environment-isolation-guardrail?format=cursor","windsurf":"/api/rules/vite-6-module-runner-environment-isolation-guardrail?format=windsurf","agents":"/api/rules/vite-6-module-runner-environment-isolation-guardrail?format=agents"}},{"id":"postgres-17-vector-streaming-io-memory-lock-standard","title":"Postgres 17 Block-Level Streaming I/O and Isolated Memory Context for HNSW Vector Re-indexing","category":"backend","severity":"critical","description":"Enforces strict session-level buffer ring isolation, deterministic maintenance work memory capping, and asynchronous block-level streaming I/O configurations during concurrent high-dimensional HNSW index builds in PostgreSQL 17. Prevents shared buffer pool cache evictions and Linux dirty page kernel thrashing from degrading latency-sensitive co-located OLTP transactions.","antiPatternHeadline":"Global Maintenance Memory Bloat and Shared Buffer Eviction Cascades Under Unbounded Vector Indexing","stars_count":64,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql-17","pgvector","hnsw","database-performance","concurrency","io-optimization"],"exportEndpoints":{"claude":"/api/rules/postgres-17-vector-streaming-io-memory-lock-standard?format=claude","cursorMdc":"/api/rules/postgres-17-vector-streaming-io-memory-lock-standard?format=mdc","cursorrules":"/api/rules/postgres-17-vector-streaming-io-memory-lock-standard?format=cursor","windsurf":"/api/rules/postgres-17-vector-streaming-io-memory-lock-standard?format=windsurf","agents":"/api/rules/postgres-17-vector-streaming-io-memory-lock-standard?format=agents"}},{"id":"tauri2-multiwebview-ipc-zero-copy-isolation","title":"Tauri 2.0 Multi-WebView IPC Zero-Copy Deserialization Isolation","category":"mobile","severity":"critical","description":"Mandates strict boundary fencing and memory region ownership handoffs for binary payload transfers between native Rust backends and multi-webview runtimes in Tauri 2.0 mobile architectures. Enforces single-consumer buffer ownership, zero-copy channel isolation, and explicit webview origin/label verification to prevent cross-webview data leaks, buffer mutation races, and privilege escalation.","antiPatternHeadline":"Unfenced Global Binary IPC Broadcast with Mutable Shared Buffer Reuse","stars_count":114,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri-2","ipc","zero-copy","memory-safety","rust","webview-isolation"],"exportEndpoints":{"claude":"/api/rules/tauri2-multiwebview-ipc-zero-copy-isolation?format=claude","cursorMdc":"/api/rules/tauri2-multiwebview-ipc-zero-copy-isolation?format=mdc","cursorrules":"/api/rules/tauri2-multiwebview-ipc-zero-copy-isolation?format=cursor","windsurf":"/api/rules/tauri2-multiwebview-ipc-zero-copy-isolation?format=windsurf","agents":"/api/rules/tauri2-multiwebview-ipc-zero-copy-isolation?format=agents"}},{"id":"svelte-5-runes-reactive-graph-snapshot-immutability","title":"Svelte 5 Runes Reactive Graph Snapshot Immutability Invariant","category":"frontend","severity":"critical","description":"Enforces strict immutable boundaries and snapshot stabilization on complex nested signal derivations in Svelte 5 runes. Prevents reactive graph thrashing, unintended cascading re-evaluations, and memory retention leaks caused by leaking mutable proxy references or mutating internal state within derived computations.","antiPatternHeadline":"Mutating internal reactive proxies or returning un-snapshotted nested objects inside $derived runes","stars_count":83,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["svelte5","runes","reactivity","state-snapshot","performance"],"exportEndpoints":{"claude":"/api/rules/svelte-5-runes-reactive-graph-snapshot-immutability?format=claude","cursorMdc":"/api/rules/svelte-5-runes-reactive-graph-snapshot-immutability?format=mdc","cursorrules":"/api/rules/svelte-5-runes-reactive-graph-snapshot-immutability?format=cursor","windsurf":"/api/rules/svelte-5-runes-reactive-graph-snapshot-immutability?format=windsurf","agents":"/api/rules/svelte-5-runes-reactive-graph-snapshot-immutability?format=agents"}},{"id":"bun-sql-transaction-lease-timeout-guardrail","title":"Bun 1.2 Native SQL Transaction Lease Timeout & Connection Reclamation Guardrail","category":"backend","severity":"critical","description":"Mandates deterministic lease timeouts and automated rollback reclamation for Bun 1.2 native SQL transaction handles. Eliminates zombie pool connections and uncommitted lock retention caused by asynchronous micro-event loop starvation or unhandled pending promises within transaction scopes.","antiPatternHeadline":"Unbounded Asynchronous Transaction Closures Inducing Connection Pool Starvation and Uncommitted Lock Retention","stars_count":80,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","sql","concurrency","transactions","database"],"exportEndpoints":{"claude":"/api/rules/bun-sql-transaction-lease-timeout-guardrail?format=claude","cursorMdc":"/api/rules/bun-sql-transaction-lease-timeout-guardrail?format=mdc","cursorrules":"/api/rules/bun-sql-transaction-lease-timeout-guardrail?format=cursor","windsurf":"/api/rules/bun-sql-transaction-lease-timeout-guardrail?format=windsurf","agents":"/api/rules/bun-sql-transaction-lease-timeout-guardrail?format=agents"}},{"id":"webauthn-prf-deterministic-key-derivation-guardrail-webauthn-prf-ext-728","title":"WebAuthn PRF Extension Deterministic Key Derivation Zero-Leakage Standard","category":"security","severity":"critical","description":"Enforces non-extractable cryptographic isolation when deriving symmetric keys from hardware-bound WebAuthn PRF (Pseudo-Random Function) authenticator outputs. Guarantees that raw PRF outputs are immediately imported into non-extractable Web Crypto handles, memory-scrubbed via zeroization, and never persisted to client storage or transmitted over transport layers.","antiPatternHeadline":"Persisting raw PRF outputs, importing derived keys as extractable, or failing to zeroize ephemeral buffers","stars_count":67,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","prf-extension","webcrypto","zero-leakage","e2ee","cryptography"],"exportEndpoints":{"claude":"/api/rules/webauthn-prf-deterministic-key-derivation-guardrail-webauthn-prf-ext-728?format=claude","cursorMdc":"/api/rules/webauthn-prf-deterministic-key-derivation-guardrail-webauthn-prf-ext-728?format=mdc","cursorrules":"/api/rules/webauthn-prf-deterministic-key-derivation-guardrail-webauthn-prf-ext-728?format=cursor","windsurf":"/api/rules/webauthn-prf-deterministic-key-derivation-guardrail-webauthn-prf-ext-728?format=windsurf","agents":"/api/rules/webauthn-prf-deterministic-key-derivation-guardrail-webauthn-prf-ext-728?format=agents"}},{"id":"k8s-gateway-v1-2-cross-namespace-referencegrant-boundary","title":"Kubernetes Gateway API v1.2 Cross-Namespace ReferenceGrant Boundary Standard","category":"devops","severity":"critical","description":"Enforces strict tenant isolation across Kubernetes namespaces by mandating explicit ReferenceGrant validation before any cross-namespace HTTPRoute parentRef or backendRef is compiled into Envoy xDS configuration. Prevents unauthorized traffic interception, route hijacking, and backend exposure in multi-tenant clusters by ensuring unverified cross-namespace references evaluate to a terminal RefNotPermitted status.","antiPatternHeadline":"Compiling Cross-Namespace Envoy Route Clusters Without Bidirectional ReferenceGrant Verification","stars_count":73,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","kubernetes","gateway-api","envoy","multi-tenancy","reference-grant","security"],"exportEndpoints":{"claude":"/api/rules/k8s-gateway-v1-2-cross-namespace-referencegrant-boundary?format=claude","cursorMdc":"/api/rules/k8s-gateway-v1-2-cross-namespace-referencegrant-boundary?format=mdc","cursorrules":"/api/rules/k8s-gateway-v1-2-cross-namespace-referencegrant-boundary?format=cursor","windsurf":"/api/rules/k8s-gateway-v1-2-cross-namespace-referencegrant-boundary?format=windsurf","agents":"/api/rules/k8s-gateway-v1-2-cross-namespace-referencegrant-boundary?format=agents"}},{"id":"kmp-swift-export-arc-memory-cycle-deadlock-prevention","title":"KMP Swift Export ARC Memory Cycle Deadlock Prevention Invariant","category":"mobile","severity":"critical","description":"Eliminates non-deterministic native memory retention and deadlock between Kotlin/Native tracing GC and Apple ARC runtimes by enforcing bidirectional weak proxy wrappers across compilation boundaries. Prevents cross-runtime strong reference graphs that escape cycle detection in both independent memory managers. Guarantees deterministic teardown of observable listeners, platform delegates, and callback subscriptions crossing the Swift-Kotlin interop boundary.","antiPatternHeadline":"Cross-Runtime Circular Strong References Escaping Both ARC and Kotlin Native GC","stars_count":104,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kmp","kotlin-native","swift-export","arc","memory-management"],"exportEndpoints":{"claude":"/api/rules/kmp-swift-export-arc-memory-cycle-deadlock-prevention?format=claude","cursorMdc":"/api/rules/kmp-swift-export-arc-memory-cycle-deadlock-prevention?format=mdc","cursorrules":"/api/rules/kmp-swift-export-arc-memory-cycle-deadlock-prevention?format=cursor","windsurf":"/api/rules/kmp-swift-export-arc-memory-cycle-deadlock-prevention?format=windsurf","agents":"/api/rules/kmp-swift-export-arc-memory-cycle-deadlock-prevention?format=agents"}},{"id":"opentelemetry-ebpf-profiler-overhead-ceiling-standard","title":"OpenTelemetry eBPF Profiler Overhead Ceiling and Ring-Buffer Guardrail Standard","category":"devops","severity":"critical","description":"Enforces strict limits on kernel-space frame stack unwinding, eBPF ring-buffer sizing, and sampling frequencies for OpenTelemetry continuous profiling agents. Prevents profiling-induced CPU context-switch churn, cache eviction, and tail-latency regressions in low-latency production microservices.","antiPatternHeadline":"Unbounded eBPF Stack Unwinding and Excessive Ring-Buffer Allocations Inducing Host CPU Starvation and Latency Regressions","stars_count":52,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","opentelemetry","continuous-profiling","observability","kubernetes"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-ebpf-profiler-overhead-ceiling-standard?format=claude","cursorMdc":"/api/rules/opentelemetry-ebpf-profiler-overhead-ceiling-standard?format=mdc","cursorrules":"/api/rules/opentelemetry-ebpf-profiler-overhead-ceiling-standard?format=cursor","windsurf":"/api/rules/opentelemetry-ebpf-profiler-overhead-ceiling-standard?format=windsurf","agents":"/api/rules/opentelemetry-ebpf-profiler-overhead-ceiling-standard?format=agents"}},{"id":"react19-useactionstate-monotonicity-boundary","title":"React 19 useActionState Optimistic Transition Monotonicity Boundary","category":"frontend","severity":"critical","description":"Enforces version vector or monotonic Lamport sequence tagging across React 19 concurrent Actions and useOptimistic transitions. Prevents out-of-order asynchronous action resolution from overwriting newer authoritative server state or invalidating optimistic rollback queues during fast-paced concurrent dispatches.","antiPatternHeadline":"Unsequenced useActionState Dispatches Regressing Server State via Out-of-Order Promise Resolution","stars_count":45,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","useActionState","useOptimistic","concurrency","monotonicity"],"exportEndpoints":{"claude":"/api/rules/react19-useactionstate-monotonicity-boundary?format=claude","cursorMdc":"/api/rules/react19-useactionstate-monotonicity-boundary?format=mdc","cursorrules":"/api/rules/react19-useactionstate-monotonicity-boundary?format=cursor","windsurf":"/api/rules/react19-useactionstate-monotonicity-boundary?format=windsurf","agents":"/api/rules/react19-useactionstate-monotonicity-boundary?format=agents"}},{"id":"nextjs-15-server-actions-cryptographic-host-validation","title":"Next.js 15 Server Actions Cryptographic Host and Origin Validation Barrier","category":"security","severity":"critical","description":"Enforces deterministic origin verification and HMAC-signed cryptographic host token validation for Next.js 15 Server Actions across distributed edge deployments. Prevents cross-site action invocation (CSAI), DNS rebinding, and host-header injection across multi-region reverse proxies by binding incoming action requests to cryptographically signed edge ingress contexts.","antiPatternHeadline":"Trusting raw headers or unvalidated Host/Origin headers in Server Actions across distributed proxies","stars_count":48,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","nextjs15","server-actions","edge-computing","csrf","cryptography"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-server-actions-cryptographic-host-validation?format=claude","cursorMdc":"/api/rules/nextjs-15-server-actions-cryptographic-host-validation?format=mdc","cursorrules":"/api/rules/nextjs-15-server-actions-cryptographic-host-validation?format=cursor","windsurf":"/api/rules/nextjs-15-server-actions-cryptographic-host-validation?format=windsurf","agents":"/api/rules/nextjs-15-server-actions-cryptographic-host-validation?format=agents"}},{"id":"bun-worker-sharedarraybuffer-concurrency-fence","title":"Bun 1.2 Worker SharedArrayBuffer Atomic Memory Fence & Synchronization Invariant","category":"backend","severity":"critical","description":"Enforces deterministic memory fencing and futex synchronization over zero-copy SharedArrayBuffer instances shared between Bun 1.2 clustered worker threads. Direct index-based TypedArray access across multi-threaded runtimes bypasses CPU memory fences, causing compiler instruction reordering, cross-core cache incoherency, torn reads, and catastrophic silent memory corruption.","antiPatternHeadline":"Unsynchronized TypedArray indexing across Bun worker boundaries without Atomics memory fences or futex coordination.","stars_count":64,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","sharedarraybuffer","atomics","concurrency","multithreading","zero-copy"],"exportEndpoints":{"claude":"/api/rules/bun-worker-sharedarraybuffer-concurrency-fence?format=claude","cursorMdc":"/api/rules/bun-worker-sharedarraybuffer-concurrency-fence?format=mdc","cursorrules":"/api/rules/bun-worker-sharedarraybuffer-concurrency-fence?format=cursor","windsurf":"/api/rules/bun-worker-sharedarraybuffer-concurrency-fence?format=windsurf","agents":"/api/rules/bun-worker-sharedarraybuffer-concurrency-fence?format=agents"}},{"id":"tauri-v2-ipc-capability-scoping-origin-isolation","title":"Tauri 2.0 Native IPC Capability Scoping and Webview Origin Isolation","category":"security","severity":"critical","description":"Enforces strict, least-privilege capability manifests and cryptographic webview origin isolation in Tauri 2.0 architectures. Prohibits wildcard plugin permissions, binds IPC commands to validated window labels and origins, and enforces granular resource scoping on all native boundaries.","antiPatternHeadline":"Granting Wildcard Permissions or Exposing Native IPC Capabilities to Unvalidated Webview Contexts","stars_count":47,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","tauri","rust","ipc","desktop","capabilities","origin-isolation"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-ipc-capability-scoping-origin-isolation?format=claude","cursorMdc":"/api/rules/tauri-v2-ipc-capability-scoping-origin-isolation?format=mdc","cursorrules":"/api/rules/tauri-v2-ipc-capability-scoping-origin-isolation?format=cursor","windsurf":"/api/rules/tauri-v2-ipc-capability-scoping-origin-isolation?format=windsurf","agents":"/api/rules/tauri-v2-ipc-capability-scoping-origin-isolation?format=agents"}},{"id":"kmp-skiko-compose-surface-destruction-barrier","title":"KMP Skiko Compose Surface Destruction Reentrancy Barrier","category":"mobile","severity":"critical","description":"Enforces strict atomic lifecycle synchronization between native display surfaces (Android SurfaceHolder/iOS CAMetalLayer) and the Skiko Skia rendering pipeline in Compose Multiplatform. Prevents native GPU context deadlocks (EGL/Metal), SIGSEGV access violations, and render-thread tearing during rapid fragment disposal, orientation changes, and back-navigation gestures.","antiPatternHeadline":"Unsynchronized native surface destruction triggering concurrent Skia render passes and UI thread deadlocks.","stars_count":40,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kmp","skiko","compose-multiplatform","concurrency","metal","vulkan"],"exportEndpoints":{"claude":"/api/rules/kmp-skiko-compose-surface-destruction-barrier?format=claude","cursorMdc":"/api/rules/kmp-skiko-compose-surface-destruction-barrier?format=mdc","cursorrules":"/api/rules/kmp-skiko-compose-surface-destruction-barrier?format=cursor","windsurf":"/api/rules/kmp-skiko-compose-surface-destruction-barrier?format=windsurf","agents":"/api/rules/kmp-skiko-compose-surface-destruction-barrier?format=agents"}},{"id":"openfga-conditional-tuple-evaluation-boundary","title":"OpenFGA Conditional Relationship Tuple Evaluation Boundary Standard","category":"security","severity":"critical","description":"Enforces strict deadline propagation, circuit breaker boundaries, and deterministic context serialization when evaluating OpenFGA conditional relationship tuples. Unbounded evaluation of dynamic ABAC conditions allows authorization bypass via resource exhaustion, request hanging, and fail-open edge-case degradation under adversarial payload loads. All check evaluations must enforce immutable context validation, strict timeouts, and fail-closed security defaults.","antiPatternHeadline":"Unbounded or Fail-Open OpenFGA Check Execution with Dynamic Contextual Tuples","stars_count":48,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","authorization","abac","rebac","dos-prevention"],"exportEndpoints":{"claude":"/api/rules/openfga-conditional-tuple-evaluation-boundary?format=claude","cursorMdc":"/api/rules/openfga-conditional-tuple-evaluation-boundary?format=mdc","cursorrules":"/api/rules/openfga-conditional-tuple-evaluation-boundary?format=cursor","windsurf":"/api/rules/openfga-conditional-tuple-evaluation-boundary?format=windsurf","agents":"/api/rules/openfga-conditional-tuple-evaluation-boundary?format=agents"}},{"id":"axum-tokio-stream-cancellation-drain-guardrail","title":"Axum Tokio HTTP/2 & HTTP/3 Premature Stream Cancellation and Buffer Drain Guardrail","category":"backend","severity":"critical","description":"Enforces deterministic cancellation safety and clean socket buffer release for HTTP/2 and HTTP/3 request body streams in Axum and Tokio applications. Prevents socket window starvation, worker task leaks, and connection pool lockups caused by client disconnects, early handler aborts, or unbounded background stream consumers.","antiPatternHeadline":"Early Handler Return or Detached Background Streaming Without Cancellation-Safe Body Drain","stars_count":65,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","axum","tokio","http2","http3","cancellation-safety","rust"],"exportEndpoints":{"claude":"/api/rules/axum-tokio-stream-cancellation-drain-guardrail?format=claude","cursorMdc":"/api/rules/axum-tokio-stream-cancellation-drain-guardrail?format=mdc","cursorrules":"/api/rules/axum-tokio-stream-cancellation-drain-guardrail?format=cursor","windsurf":"/api/rules/axum-tokio-stream-cancellation-drain-guardrail?format=windsurf","agents":"/api/rules/axum-tokio-stream-cancellation-drain-guardrail?format=agents"}},{"id":"cilium-ebpf-wireguard-attestation-enforcement","title":"Kernel-Level Cilium eBPF WireGuard Cryptographic Attestation Enforcement","category":"devops","severity":"critical","description":"Enforces deterministic, non-bypassable pod-to-pod WireGuard encryption backed by kernel-level eBPF map attestation. Precludes plaintext transmission fallbacks by requiring cryptographically verified Cilium security identities within eBPF ipcache and peer maps prior to egress routing.","antiPatternHeadline":"Permitting Opportunistic Plaintext Egress or Missing Kernel-Level Node-to-Node WireGuard Verification","stars_count":87,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","cilium","ebpf","wireguard","kubernetes","zero-trust","network-security"],"exportEndpoints":{"claude":"/api/rules/cilium-ebpf-wireguard-attestation-enforcement?format=claude","cursorMdc":"/api/rules/cilium-ebpf-wireguard-attestation-enforcement?format=mdc","cursorrules":"/api/rules/cilium-ebpf-wireguard-attestation-enforcement?format=cursor","windsurf":"/api/rules/cilium-ebpf-wireguard-attestation-enforcement?format=windsurf","agents":"/api/rules/cilium-ebpf-wireguard-attestation-enforcement?format=agents"}},{"id":"drizzle-keyset-cursor-monotonicity-fence","title":"Drizzle ORM 0.38 Keyset Cursor Monotonicity and Read-View Fence Invariant","category":"backend","severity":"critical","description":"Enforces strictly monotonic, composite keyset cursors paired with an explicit read-view fence timestamp across all infinite pagination queries in Drizzle ORM 0.38. Prevents duplicate rows, skipped records, and phantom drift caused by concurrent writes under relational MVCC engines.","antiPatternHeadline":"Offset-based pagination or unfenced single-column keyset cursors leading to duplicate rows and phantom data drift.","stars_count":111,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","drizzle-orm","postgresql","pagination","concurrency","mvcc","database-indexing"],"exportEndpoints":{"claude":"/api/rules/drizzle-keyset-cursor-monotonicity-fence?format=claude","cursorMdc":"/api/rules/drizzle-keyset-cursor-monotonicity-fence?format=mdc","cursorrules":"/api/rules/drizzle-keyset-cursor-monotonicity-fence?format=cursor","windsurf":"/api/rules/drizzle-keyset-cursor-monotonicity-fence?format=windsurf","agents":"/api/rules/drizzle-keyset-cursor-monotonicity-fence?format=agents"}},{"id":"react-19-server-actions-closure-cryptographic-integrity-sealing","title":"React 19 Server Actions Closure Cryptographic Integrity & Anti-Replay Sealing","category":"frontend","severity":"critical","description":"Enforces zero-trust cryptographic sealing and anti-replay validation on serialized closure parameters within React 19 Server Actions. Guarantees that bound server action states cannot be tampered with, replayed across cluster regions, or forged when traversing distributed zero-trust networks.","antiPatternHeadline":"Implicitly Trusting Serialized Server Action Bound Arguments Without Cryptographic Nonce and Ephemeral Session Verification","stars_count":44,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","server-actions","zero-trust","cryptography","replay-prevention"],"exportEndpoints":{"claude":"/api/rules/react-19-server-actions-closure-cryptographic-integrity-sealing?format=claude","cursorMdc":"/api/rules/react-19-server-actions-closure-cryptographic-integrity-sealing?format=mdc","cursorrules":"/api/rules/react-19-server-actions-closure-cryptographic-integrity-sealing?format=cursor","windsurf":"/api/rules/react-19-server-actions-closure-cryptographic-integrity-sealing?format=windsurf","agents":"/api/rules/react-19-server-actions-closure-cryptographic-integrity-sealing?format=agents"}},{"id":"capacitor7-biometric-hardware-session-attestation","title":"Capacitor 7 Biometric Hardware-Backed Session Key Attestation & Invalidation Guardrail","category":"mobile","severity":"critical","description":"Enforces asymmetric session key pair generation bound to device hardware keystores (iOS Secure Enclave and Android Hardware-backed Keystore/StrongBox) with mandatory biometric user presence authentication. Keys must strictly enforce deterministic invalidation upon any biometric enrollment changes (`kSecAccessControlBiometryAny` combined with strict enrollment monitoring on iOS, and `setInvalidatedByBiometricEnrollment(true)` on Android) to prevent session hijacking via newly enrolled fingerprints or faces.","antiPatternHeadline":"Persisting Unbound Software Session Tokens or Failing to Invalidate Hardware Keys on Biometric Database Mutation","stars_count":49,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","security","biometrics","secure-enclave","keystore","cryptography"],"exportEndpoints":{"claude":"/api/rules/capacitor7-biometric-hardware-session-attestation?format=claude","cursorMdc":"/api/rules/capacitor7-biometric-hardware-session-attestation?format=mdc","cursorrules":"/api/rules/capacitor7-biometric-hardware-session-attestation?format=cursor","windsurf":"/api/rules/capacitor7-biometric-hardware-session-attestation?format=windsurf","agents":"/api/rules/capacitor7-biometric-hardware-session-attestation?format=agents"}},{"id":"envoy-ebpf-quic-migration-preservation","title":"Envoy Gateway eBPF QUIC Connection Migration & Session Preservation Standard","category":"devops","severity":"critical","description":"Mandates deterministic QUIC Connection ID (CID) generation and kernel-level eBPF socket dispatching (`SO_ATTACH_REUSEPORT_EBPF`) during Envoy Gateway rolling updates. Prevents active UDP 4-tuple route invalidations and preserves 0-RTT/TLS 1.3 session state across mutating ingress gateway replicas without severing client transport contexts.","antiPatternHeadline":"Stateless Ingress Rolling Updates Severing In-Flight QUIC 4-Tuples and Dropping 0-RTT Sessions","stars_count":97,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","envoy","ebpf","quic","http3","kubernetes","zero-rtt"],"exportEndpoints":{"claude":"/api/rules/envoy-ebpf-quic-migration-preservation?format=claude","cursorMdc":"/api/rules/envoy-ebpf-quic-migration-preservation?format=mdc","cursorrules":"/api/rules/envoy-ebpf-quic-migration-preservation?format=cursor","windsurf":"/api/rules/envoy-ebpf-quic-migration-preservation?format=windsurf","agents":"/api/rules/envoy-ebpf-quic-migration-preservation?format=agents"}},{"id":"post-quantum-mldsa-dual-signature-webhook-validation","title":"Mandatory Hybrid Post-Quantum ML-DSA-65 and Classical ECDSA Dual-Signature Invariant","category":"security","severity":"critical","description":"Enforces hybrid quantum-resilient verification on asynchronous ingestion channels by pairing classical ECDSA (P-384/secp256r1) with post-quantum ML-DSA-65 (FIPS 204). Guards webhook payloads against Harvest-Now-Decrypt/Forge-Later (HNDL/HNFL) adversaries targeting critical webhook ingestion pipelines. Payload deserialization is strictly blocked until both mathematical signatures independently verify the raw unparsed octet stream bound to tamper-proof headers.","antiPatternHeadline":"Accepting classical-only ECDSA signatures or parsing payloads prior to dual-signature verification","stars_count":114,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","post-quantum","ml-dsa","fips-204","ecdsa","webhooks","cryptography"],"exportEndpoints":{"claude":"/api/rules/post-quantum-mldsa-dual-signature-webhook-validation?format=claude","cursorMdc":"/api/rules/post-quantum-mldsa-dual-signature-webhook-validation?format=mdc","cursorrules":"/api/rules/post-quantum-mldsa-dual-signature-webhook-validation?format=cursor","windsurf":"/api/rules/post-quantum-mldsa-dual-signature-webhook-validation?format=windsurf","agents":"/api/rules/post-quantum-mldsa-dual-signature-webhook-validation?format=agents"}},{"id":"vite6-rolldown-module-federation-singleton-isolation","title":"Vite 6 Rolldown Module Federation Context Singleton Isolation","category":"frontend","severity":"critical","description":"Enforces strict runtime singleton deduplication across micro-frontend boundaries powered by Vite 6 and Rolldown-based Module Federation. Prevents catastrophic React/Vue engine duplications, corrupted UI contexts, and broken hook dispatchers caused by loose semver matching or missing shared host fallbacks.","antiPatternHeadline":"Dual-Engine Instantiation and Split React/Vue Contexts via Misconfigured Module Federation Shared Scopes","stars_count":88,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","vite6","rolldown","module-federation","micro-frontends","singleton"],"exportEndpoints":{"claude":"/api/rules/vite6-rolldown-module-federation-singleton-isolation?format=claude","cursorMdc":"/api/rules/vite6-rolldown-module-federation-singleton-isolation?format=mdc","cursorrules":"/api/rules/vite6-rolldown-module-federation-singleton-isolation?format=cursor","windsurf":"/api/rules/vite6-rolldown-module-federation-singleton-isolation?format=windsurf","agents":"/api/rules/vite6-rolldown-module-federation-singleton-isolation?format=agents"}},{"id":"go-wasi-reactor-memory-ceiling-isolation","title":"Deterministic Linear Memory Ceiling and Page-Growth Hard Boundary Guardrail for WASI Reactors","category":"backend","severity":"critical","description":"Enforces strict compile-time and runtime linear memory limits on untrusted multitenant WebAssembly reactor instances running on Go 1.24 runtimes (such as wazero). Prevents host OOM panics and tenant starvation by bounding initial and maximum WebAssembly page allocations and intercepting runtime dynamic growth requests. Guarantees deterministic failure semantics when guest modules exceed deterministic execution quotas.","antiPatternHeadline":"Unbounded WASM linear memory growth permitting untrusted tenant guest modules to trigger host-level out-of-memory crashes.","stars_count":89,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","wasm","wasi","isolation","security","multitenancy"],"exportEndpoints":{"claude":"/api/rules/go-wasi-reactor-memory-ceiling-isolation?format=claude","cursorMdc":"/api/rules/go-wasi-reactor-memory-ceiling-isolation?format=mdc","cursorrules":"/api/rules/go-wasi-reactor-memory-ceiling-isolation?format=cursor","windsurf":"/api/rules/go-wasi-reactor-memory-ceiling-isolation?format=windsurf","agents":"/api/rules/go-wasi-reactor-memory-ceiling-isolation?format=agents"}},{"id":"otel-prometheus-native-exponential-histogram-alignment","title":"Prometheus 3.0 & OpenTelemetry Native Exponential Histogram Bucketing Alignment","category":"devops","severity":"critical","description":"Mandates zero-loss exponential histogram configurations across OpenTelemetry SDKs, OpenTelemetry Collectors, and Prometheus 3.0 scrapers. Prevents tail-latency estimation errors and metric cardinality explosion by enforcing synchronized scale parameters, zero thresholds, and native histogram transmission across all pipeline stages.","antiPatternHeadline":"Down-converting high-dynamic-range exponential histograms into legacy explicit buckets or misaligning OTel scale and max-buckets across collector pipelines","stars_count":115,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","prometheus","opentelemetry","metrics","observability","native-histograms"],"exportEndpoints":{"claude":"/api/rules/otel-prometheus-native-exponential-histogram-alignment?format=claude","cursorMdc":"/api/rules/otel-prometheus-native-exponential-histogram-alignment?format=mdc","cursorrules":"/api/rules/otel-prometheus-native-exponential-histogram-alignment?format=cursor","windsurf":"/api/rules/otel-prometheus-native-exponential-histogram-alignment?format=windsurf","agents":"/api/rules/otel-prometheus-native-exponential-histogram-alignment?format=agents"}},{"id":"openfga-cdc-zanzibar-cache-invalidation-stream","title":"OpenFGA CDC-Driven Zanzibar Cache Invalidation & Consistency Guardrail","category":"security","severity":"critical","description":"Eliminates authorization race conditions by streaming transactional tuple mutations directly into distributed ReBAC cache nodes with sub-millisecond consistency. Forbids dual-write cache invalidation from application services and guarantees out-of-order mutation rejection via monotonically increasing Log Sequence Numbers (LSN) and zookie token tracking.","antiPatternHeadline":"Dual-Write Application-Tier Cache Eviction and Untracked Temporal Tuple Race Conditions","stars_count":64,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","rebac","zanzibar","cdc","cache-invalidation","distributed-systems"],"exportEndpoints":{"claude":"/api/rules/openfga-cdc-zanzibar-cache-invalidation-stream?format=claude","cursorMdc":"/api/rules/openfga-cdc-zanzibar-cache-invalidation-stream?format=mdc","cursorrules":"/api/rules/openfga-cdc-zanzibar-cache-invalidation-stream?format=cursor","windsurf":"/api/rules/openfga-cdc-zanzibar-cache-invalidation-stream?format=windsurf","agents":"/api/rules/openfga-cdc-zanzibar-cache-invalidation-stream?format=agents"}},{"id":"cmp-skiko-vsync-render-pipeline-quarantine","title":"Compose Multiplatform Hardware VSync Render Pipeline Quarantine","category":"mobile","severity":"critical","description":"Enforces strict isolation between Compose Multiplatform layout measurement phases and Skiko hardware VSync presentation threads during high-frequency native list virtualization. Prohibits synchronous recomposition, expensive measure passes, and unbounded layout allocations directly inside Skiko rendering and CADisplayLink callbacks. Guarantees 60/120 FPS frame pacing across native iOS and Desktop targets by isolating frame rendering from layout evaluation.","antiPatternHeadline":"Saturating Skiko Presentation Loops with Synchronous Subcomposition and Layout Measure Passes","stars_count":76,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["compose-multiplatform","skiko","vsync","list-virtualization","ios-cadisplaylink","kotlin-multiplatform","performance"],"exportEndpoints":{"claude":"/api/rules/cmp-skiko-vsync-render-pipeline-quarantine?format=claude","cursorMdc":"/api/rules/cmp-skiko-vsync-render-pipeline-quarantine?format=mdc","cursorrules":"/api/rules/cmp-skiko-vsync-render-pipeline-quarantine?format=cursor","windsurf":"/api/rules/cmp-skiko-vsync-render-pipeline-quarantine?format=windsurf","agents":"/api/rules/cmp-skiko-vsync-render-pipeline-quarantine?format=agents"}},{"id":"nextjs15-dynamic-io-suspense-timeout-sentinel","title":"Next.js 15 Dynamic I/O Suspense Boundary Strict Timeout Sentinel","category":"frontend","severity":"critical","description":"Enforces deterministic streaming within Next.js 15 Partial Prerendering (PPR) and Dynamic I/O architectures by mandating strict timeout sentinels on async React Server Components. Prevents unbounded microtask execution from exceeding edge runtime streaming deadlines, eliminating hanging stream connections and 504 Gateway Timeouts.","antiPatternHeadline":"Unbounded Async Server Component I/O Stalling Edge Streaming Pipelines","stars_count":55,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs","react-server-components","partial-prerendering","dynamic-io","streaming","resilience"],"exportEndpoints":{"claude":"/api/rules/nextjs15-dynamic-io-suspense-timeout-sentinel?format=claude","cursorMdc":"/api/rules/nextjs15-dynamic-io-suspense-timeout-sentinel?format=mdc","cursorrules":"/api/rules/nextjs15-dynamic-io-suspense-timeout-sentinel?format=cursor","windsurf":"/api/rules/nextjs15-dynamic-io-suspense-timeout-sentinel?format=windsurf","agents":"/api/rules/nextjs15-dynamic-io-suspense-timeout-sentinel?format=agents"}},{"id":"svelte-5-runes-effect-cycle-termination-invariant","title":"Svelte 5 Runes Reactive Effect Cycle Termination and State Graph Invariant","category":"frontend","severity":"critical","description":"Enforces deterministic termination on Svelte 5 `$effect` executions by strictly isolating signal reads from reactive mutations. Prevents recursive scheduler microtask loops and main-thread exhaustion across cross-component signal boundaries.","antiPatternHeadline":"Bi-Directional State Synchronization and Self-Triggering Signal Mutations in $effect Blocks","stars_count":48,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","reactivity","signals","performance"],"exportEndpoints":{"claude":"/api/rules/svelte-5-runes-effect-cycle-termination-invariant?format=claude","cursorMdc":"/api/rules/svelte-5-runes-effect-cycle-termination-invariant?format=mdc","cursorrules":"/api/rules/svelte-5-runes-effect-cycle-termination-invariant?format=cursor","windsurf":"/api/rules/svelte-5-runes-effect-cycle-termination-invariant?format=windsurf","agents":"/api/rules/svelte-5-runes-effect-cycle-termination-invariant?format=agents"}},{"id":"bun-worker-sharedarraybuffer-atomic-barrier","title":"Bun 1.2 Worker SharedArrayBuffer Zero-Copy Atomic Mutation Barrier","category":"backend","severity":"critical","description":"Enforces strict memory barriers and atomic state transitions when mutating SharedArrayBuffer instances across Bun 1.2 isolated Worker threads. Guarantees zero-copy pipeline integrity by prohibiting non-atomic writes to shared regions while readers are concurrently attached, avoiding torn reads, cache incoherency, and silent data corruption under high-throughput parallel execution.","antiPatternHeadline":"Unsynchronized Raw TypedArray Mutations on Cross-Thread SharedArrayBuffer Instances","stars_count":45,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","multithreading","sharedarraybuffer","atomics","zero-copy","concurrency"],"exportEndpoints":{"claude":"/api/rules/bun-worker-sharedarraybuffer-atomic-barrier?format=claude","cursorMdc":"/api/rules/bun-worker-sharedarraybuffer-atomic-barrier?format=mdc","cursorrules":"/api/rules/bun-worker-sharedarraybuffer-atomic-barrier?format=cursor","windsurf":"/api/rules/bun-worker-sharedarraybuffer-atomic-barrier?format=windsurf","agents":"/api/rules/bun-worker-sharedarraybuffer-atomic-barrier?format=agents"}},{"id":"postgres-17-failover-slot-synchronization-lsn-lag-boundary","title":"Postgres 17 Failover Slot Synchronization & LSN Lag Boundary Enforcement","category":"backend","severity":"critical","description":"Enforces failover-enabled logical slots (failover = true) and strict LSN lag boundaries across primary and physical standbys in PostgreSQL 17+. Prevents silent message drops, CDC consumer replay corruption, and phantom data loss during failovers by requiring synchronous replication slot validation (sync_replication_slots) and verified confirmed_flush_lsn assertions before traffic migration.","antiPatternHeadline":"Unsynchronized Logical Replication Slots During Physical Failover Causing Silent Consumer Divergence","stars_count":107,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql-17","cdc","logical-replication","high-availability","database"],"exportEndpoints":{"claude":"/api/rules/postgres-17-failover-slot-synchronization-lsn-lag-boundary?format=claude","cursorMdc":"/api/rules/postgres-17-failover-slot-synchronization-lsn-lag-boundary?format=mdc","cursorrules":"/api/rules/postgres-17-failover-slot-synchronization-lsn-lag-boundary?format=cursor","windsurf":"/api/rules/postgres-17-failover-slot-synchronization-lsn-lag-boundary?format=windsurf","agents":"/api/rules/postgres-17-failover-slot-synchronization-lsn-lag-boundary?format=agents"}},{"id":"go-124-weak-pointer-cache-resurrection-guardrail","title":"Go 1.24 Weak Pointer Cache Resurrection and Reclamation Guardrail","category":"backend","severity":"critical","description":"Enforces strict access patterns when dereferencing Go 1.24+ `weak.Pointer` instances within low-latency in-memory caches. Eliminates memory leaks, silent data corruption, and race conditions by preventing unsynchronized resurrection of dereferenced nil targets across GC sweep cycles and mandating atomic validation before re-anchoring cached objects.","antiPatternHeadline":"Unsynchronized Weak Pointer Dereferencing and Dead Object Resurrection Across GC Sweeps","stars_count":81,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","golang","go124","memory-management","garbage-collection","weak-pointers","caching"],"exportEndpoints":{"claude":"/api/rules/go-124-weak-pointer-cache-resurrection-guardrail?format=claude","cursorMdc":"/api/rules/go-124-weak-pointer-cache-resurrection-guardrail?format=mdc","cursorrules":"/api/rules/go-124-weak-pointer-cache-resurrection-guardrail?format=cursor","windsurf":"/api/rules/go-124-weak-pointer-cache-resurrection-guardrail?format=windsurf","agents":"/api/rules/go-124-weak-pointer-cache-resurrection-guardrail?format=agents"}},{"id":"capacitor-7-biometric-enclave-attestation-standard-capacitor-7-biom-295","title":"Capacitor 7 Hardware-Backed Key Attestation & Enclave Isolation Guardrail","category":"mobile","severity":"critical","description":"Enforces asymmetric cryptographic signing inside platform hardware enclaves (Apple Secure Enclave, Android StrongBox/TEE) for hybrid Capacitor 7 mobile runtimes. Prevents storing, caching, or transporting private keys and raw authorization bearer tokens in WebView memory (DOM/localStorage/IndexedDB) to thwart runtime memory dumping and cross-site scripting extraction attacks.","antiPatternHeadline":"Persisting Session Bearer Tokens in WebView Storage and Emulating Biometric Auth via Web Crypto Soft-Keys","stars_count":53,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","biometrics","secure-enclave","strongbox","cryptography","key-attestation"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-biometric-enclave-attestation-standard-capacitor-7-biom-295?format=claude","cursorMdc":"/api/rules/capacitor-7-biometric-enclave-attestation-standard-capacitor-7-biom-295?format=mdc","cursorrules":"/api/rules/capacitor-7-biometric-enclave-attestation-standard-capacitor-7-biom-295?format=cursor","windsurf":"/api/rules/capacitor-7-biometric-enclave-attestation-standard-capacitor-7-biom-295?format=windsurf","agents":"/api/rules/capacitor-7-biometric-enclave-attestation-standard-capacitor-7-biom-295?format=agents"}},{"id":"webauthn-device-bound-dpk-enterprise-fence","title":"Enforce WebAuthn Device-Bound Attestation and Device Public Key (DPK) Extension Verification","category":"security","severity":"critical","description":"Enterprise security boundaries require hardware-backed, non-exportable passkeys to prevent exfiltration into unmanaged consumer sync fabrics (e.g., iCloud Keychain, Google Password Manager). Registration ceremonies must strictly request and cryptographically verify the Device Public Key (devicePubKey) extension, validate enterprise attestation statements (direct or enterprise), and enforce authenticator attachment flags to fence passkey usage to vetted physical corporate hardware.","antiPatternHeadline":"Trusting client-reported passkey attachment without cryptographic verification of devicePubKey extensions and direct enterprise attestation statements","stars_count":63,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","passkeys","fido2","enterprise-attestation","cryptography"],"exportEndpoints":{"claude":"/api/rules/webauthn-device-bound-dpk-enterprise-fence?format=claude","cursorMdc":"/api/rules/webauthn-device-bound-dpk-enterprise-fence?format=mdc","cursorrules":"/api/rules/webauthn-device-bound-dpk-enterprise-fence?format=cursor","windsurf":"/api/rules/webauthn-device-bound-dpk-enterprise-fence?format=windsurf","agents":"/api/rules/webauthn-device-bound-dpk-enterprise-fence?format=agents"}},{"id":"cilium-sockops-l7-bypass-prevention-standard","title":"Cilium eBPF Sockops L7 Envoy Bypass Prevention Standard","category":"devops","severity":"critical","description":"Enforces architectural guarantees that eBPF socket-layer acceleration (sockops/sockmap) does not short-circuit node-local TCP connections past Cilium's L7 Envoy proxy. Prevents silent security bypasses of Layer 7 policy evaluation, mTLS validation, and HTTP/gRPC inspection caused by premature kernel-level socket redirection.","antiPatternHeadline":"Enabling eBPF Sockops Without L7 Envoy Redirection Isolation, Skipping Layer 7 Network Policies and mTLS","stars_count":86,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","cilium","ebpf","envoy","security","kubernetes","mtls"],"exportEndpoints":{"claude":"/api/rules/cilium-sockops-l7-bypass-prevention-standard?format=claude","cursorMdc":"/api/rules/cilium-sockops-l7-bypass-prevention-standard?format=mdc","cursorrules":"/api/rules/cilium-sockops-l7-bypass-prevention-standard?format=cursor","windsurf":"/api/rules/cilium-sockops-l7-bypass-prevention-standard?format=windsurf","agents":"/api/rules/cilium-sockops-l7-bypass-prevention-standard?format=agents"}},{"id":"otel-metric-temporal-delta-aggregation-ceiling","title":"OpenTelemetry Delta-Aggregation State Table Memory Ceiling Invariant","category":"devops","severity":"critical","description":"Enforces deterministic memory limits on OpenTelemetry SDK metric readers by mandating bounded cardinality state tables and delta temporality aggregation. High-cardinality label explosions without pre-export bucketing or explicit cardinal limits induce unbounded heap retention and trigger catastrophic out-of-memory crashes. All MeterProvider instantiations must configure explicit stream boundary views and attribute filter processors.","antiPatternHeadline":"Unbounded Cumulative Histogram Aggregation with High-Cardinality Ephemeral Attributes","stars_count":112,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","metrics","memory-management","observability"],"exportEndpoints":{"claude":"/api/rules/otel-metric-temporal-delta-aggregation-ceiling?format=claude","cursorMdc":"/api/rules/otel-metric-temporal-delta-aggregation-ceiling?format=mdc","cursorrules":"/api/rules/otel-metric-temporal-delta-aggregation-ceiling?format=cursor","windsurf":"/api/rules/otel-metric-temporal-delta-aggregation-ceiling?format=windsurf","agents":"/api/rules/otel-metric-temporal-delta-aggregation-ceiling?format=agents"}},{"id":"k8s-gateway-referencegrant-isolation-standard","title":"Kubernetes Gateway API v1.2 Cross-Namespace ReferenceGrant Isolation Invariant","category":"devops","severity":"critical","description":"Enforces strict tenant boundary isolation across Kubernetes Gateway API v1.2 deployments by mandating explicit ReferenceGrant resources for all cross-namespace route and backend bindings. Prevents multi-tenant traffic hijacking and unauthorized service exposure by requiring granular from-to authorization pairings across namespace demarcations.","antiPatternHeadline":"Implicit Cross-Namespace Route Attachment and Backend Hijacking Without Cryptographic ReferenceGrants","stars_count":68,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","kubernetes","gateway-api","security","multi-tenancy","reference-grant","traffic-routing"],"exportEndpoints":{"claude":"/api/rules/k8s-gateway-referencegrant-isolation-standard?format=claude","cursorMdc":"/api/rules/k8s-gateway-referencegrant-isolation-standard?format=mdc","cursorrules":"/api/rules/k8s-gateway-referencegrant-isolation-standard?format=cursor","windsurf":"/api/rules/k8s-gateway-referencegrant-isolation-standard?format=windsurf","agents":"/api/rules/k8s-gateway-referencegrant-isolation-standard?format=agents"}},{"id":"react-19-resource-hint-hoisting-deduplication","title":"React 19 Deterministic Resource Hoisting and Preload Deduplication Standard","category":"frontend","severity":"critical","description":"Enforces declarative asset prioritization using React 19's native react-dom hoisting APIs (preload, preinit, preconnect) while forbidding imperative DOM head mutations and useEffect-based link injection. This guarantees that asset hints are discovered during the initial render pass and deduplicated across concurrent streaming SSR chunks to eliminate network waterfall stalls and flash of unstyled content (FOUC).","antiPatternHeadline":"Imperative DOM Head Injection and Client-Deferred Asset Preloading in Streaming SSR","stars_count":107,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["react-19","resource-hints","streaming-ssr","performance","react-dom","hydration"],"exportEndpoints":{"claude":"/api/rules/react-19-resource-hint-hoisting-deduplication?format=claude","cursorMdc":"/api/rules/react-19-resource-hint-hoisting-deduplication?format=mdc","cursorrules":"/api/rules/react-19-resource-hint-hoisting-deduplication?format=cursor","windsurf":"/api/rules/react-19-resource-hint-hoisting-deduplication?format=windsurf","agents":"/api/rules/react-19-resource-hint-hoisting-deduplication?format=agents"}},{"id":"openfga-cdc-lsn-edge-cache-invalidation","title":"OpenFGA 1.8 CDC Stream Invalidation with Monotonic LSN Watermarking","category":"security","severity":"critical","description":"Enforces deterministic binding of database Change Data Capture (CDC) Log Sequence Numbers (LSNs) to edge relation tuple caches in OpenFGA 1.8 architectures. Eliminates distributed authorization drift and stale privilege retention by rejecting out-of-order CDC events and ensuring atomic, monotonic cache invalidation. Mandates strict consistency fencing between write transactions and distributed edge evaluation nodes.","antiPatternHeadline":"Blind Cache Eviction and Unversioned Invalidation via Asynchronous CDC Event Ingestion","stars_count":55,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","cdc","distributed-cache","authorization","redis","zero-trust"],"exportEndpoints":{"claude":"/api/rules/openfga-cdc-lsn-edge-cache-invalidation?format=claude","cursorMdc":"/api/rules/openfga-cdc-lsn-edge-cache-invalidation?format=mdc","cursorrules":"/api/rules/openfga-cdc-lsn-edge-cache-invalidation?format=cursor","windsurf":"/api/rules/openfga-cdc-lsn-edge-cache-invalidation?format=windsurf","agents":"/api/rules/openfga-cdc-lsn-edge-cache-invalidation?format=agents"}},{"id":"fastapi-python313-freethreaded-concurrency","title":"FastAPI Free-Threaded (PEP 703) Async Concurrency & Native C-Extension Guardrails","category":"backend","severity":"critical","description":"Mandates strict native thread-safety invariants for FastAPI applications deployed on Python 3.13+ free-threaded runtimes (nogil). Eliminates native heap corruption, SIGSEGV crashes, and data races caused by concurrent OS thread execution of non-reentrant C-extensions and shared mutable in-memory state.","antiPatternHeadline":"Relying on Asyncio Locks or Implicit GIL Serialization for Shared State and Native C-Extensions under Python 3.13t","stars_count":93,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","python-313","free-threaded","concurrency","c-extensions","pep-703"],"exportEndpoints":{"claude":"/api/rules/fastapi-python313-freethreaded-concurrency?format=claude","cursorMdc":"/api/rules/fastapi-python313-freethreaded-concurrency?format=mdc","cursorrules":"/api/rules/fastapi-python313-freethreaded-concurrency?format=cursor","windsurf":"/api/rules/fastapi-python313-freethreaded-concurrency?format=windsurf","agents":"/api/rules/fastapi-python313-freethreaded-concurrency?format=agents"}},{"id":"tauri-mobile-ipc-buffer-alignment-capability-scoping","title":"Tauri 2.0 Mobile IPC Buffer Alignment and Granular Capability Scoping","category":"mobile","severity":"critical","description":"Mandates zero-copy TypedArray IPC transfers between Tauri 2.0 Rust/native plugins and mobile WebViews, preventing Base64 string payload degradation and memory alignment faults on ARM architectures. Enforces compile-time capability scoping to strictly isolate native mobile OS bridge permissions by platform and webview label.","antiPatternHeadline":"Base64 Payload Serialization Over Mobile IPC Bridges Combined with Wildcard Capability ACLs","stars_count":88,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri-2","rust","ipc","zero-copy","capabilities","security"],"exportEndpoints":{"claude":"/api/rules/tauri-mobile-ipc-buffer-alignment-capability-scoping?format=claude","cursorMdc":"/api/rules/tauri-mobile-ipc-buffer-alignment-capability-scoping?format=mdc","cursorrules":"/api/rules/tauri-mobile-ipc-buffer-alignment-capability-scoping?format=cursor","windsurf":"/api/rules/tauri-mobile-ipc-buffer-alignment-capability-scoping?format=windsurf","agents":"/api/rules/tauri-mobile-ipc-buffer-alignment-capability-scoping?format=agents"}},{"id":"kmp-swift-export-gc-arc-reclamation-standard","title":"KMP Swift Export GC-ARC Boundary Cycle Reclamation","category":"mobile","severity":"critical","description":"Enforces strict ownership semantics and decoupling patterns across the Kotlin/Native tracing GC and Swift Automatic Reference Counting (ARC) boundary. Cross-runtime strong reference cycles prevent Kotlin GC root disposal and Swift deallocation, causing persistent native heap memory leaks. Developers must break cross-runtime cycles using explicit lifecycle teardowns, Kotlin weak wrappers, or unidirectional messaging adapters.","antiPatternHeadline":"Retaining bidirectional strong references across Swift ARC and Kotlin/Native GC boundaries","stars_count":67,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","swift","memory-management","kotlin-native","arc","garbage-collection"],"exportEndpoints":{"claude":"/api/rules/kmp-swift-export-gc-arc-reclamation-standard?format=claude","cursorMdc":"/api/rules/kmp-swift-export-gc-arc-reclamation-standard?format=mdc","cursorrules":"/api/rules/kmp-swift-export-gc-arc-reclamation-standard?format=cursor","windsurf":"/api/rules/kmp-swift-export-gc-arc-reclamation-standard?format=windsurf","agents":"/api/rules/kmp-swift-export-gc-arc-reclamation-standard?format=agents"}},{"id":"rust-axum-adaptive-load-shedding-concurrency","title":"Axum 0.8 Adaptive Queue-Latency Load Shedding & Concurrency Limiting","category":"backend","severity":"critical","description":"Enforces dynamic, latency-driven load-shedding and adaptive concurrency control at the Tower service boundary in Axum 0.8. Shields async worker runtimes from catastrophic queue tail-latency collapse and Tokio thread pool starvation under burst traffic.","antiPatternHeadline":"Static Unbounded Concurrency with In-Handler Latency Checks Causing Worker Thread Starvation","stars_count":95,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["rust","axum","tower","tokio","concurrency-limits","load-shedding","resilience"],"exportEndpoints":{"claude":"/api/rules/rust-axum-adaptive-load-shedding-concurrency?format=claude","cursorMdc":"/api/rules/rust-axum-adaptive-load-shedding-concurrency?format=mdc","cursorrules":"/api/rules/rust-axum-adaptive-load-shedding-concurrency?format=cursor","windsurf":"/api/rules/rust-axum-adaptive-load-shedding-concurrency?format=windsurf","agents":"/api/rules/rust-axum-adaptive-load-shedding-concurrency?format=agents"}},{"id":"bun-worker-sqlite-wal-mmap-sync","title":"Bun 1.2 Worker Thread Memory-Mapped SQLite WAL Synchronization & Checkpoint Guardrail","category":"backend","severity":"critical","description":"Enforces strict isolation, shared-memory synchronization (PRAGMA mmap_size, PRAGMA wal_autocheckpoint), and dedicated checkpoint orchestration across Bun 1.2 multi-threaded Worker pools. Prevents lock starvation (SQLITE_BUSY), dirty page read skew, and index corruption caused by uncoordinated concurrent checkpoints in memory-mapped SQLite engines.","antiPatternHeadline":"Uncoordinated Multi-Worker Auto-Checkpointing with Unbounded Memory-Mapped I/O","stars_count":92,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","sqlite","wal","concurrency","multithreading","mmap"],"exportEndpoints":{"claude":"/api/rules/bun-worker-sqlite-wal-mmap-sync?format=claude","cursorMdc":"/api/rules/bun-worker-sqlite-wal-mmap-sync?format=mdc","cursorrules":"/api/rules/bun-worker-sqlite-wal-mmap-sync?format=cursor","windsurf":"/api/rules/bun-worker-sqlite-wal-mmap-sync?format=windsurf","agents":"/api/rules/bun-worker-sqlite-wal-mmap-sync?format=agents"}},{"id":"webauthn-conditional-mediation-cross-origin-binding","title":"Strict Origin-Bound Cryptographic Validation for WebAuthn Conditional Mediation","category":"security","severity":"critical","description":"Enforces strict origin and top-origin cryptographic binding during WebAuthn conditional mediation (autofill passkey) exchanges. Mitigates silent credential harvesting, cross-origin assertion relay, and iframe credential substitution attacks by strictly verifying clientDataJSON against immutable session contexts. Mandates strict validation of RP ID, challenge nonce lifecycle, and conditional mediation assertion integrity on relying party servers.","antiPatternHeadline":"Permissive Origin Validation or Loose Challenge Scoping in Passkey Autofill Handshakes","stars_count":107,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","passkeys","fido2","authentication","cryptography"],"exportEndpoints":{"claude":"/api/rules/webauthn-conditional-mediation-cross-origin-binding?format=claude","cursorMdc":"/api/rules/webauthn-conditional-mediation-cross-origin-binding?format=mdc","cursorrules":"/api/rules/webauthn-conditional-mediation-cross-origin-binding?format=cursor","windsurf":"/api/rules/webauthn-conditional-mediation-cross-origin-binding?format=windsurf","agents":"/api/rules/webauthn-conditional-mediation-cross-origin-binding?format=agents"}},{"id":"cilium-wireguard-pmtu-clamp-synchronization","title":"Cilium eBPF Dynamic Path MTU Discovery and TCP MSS Clamping for WireGuard","category":"devops","severity":"critical","description":"Enforces deterministic MTU calculation, dynamic Path MTU Discovery (PMTU), and in-kernel eBPF TCP MSS clamping across all Cilium WireGuard overlays. Prevents asymmetric routing drops, fragmentation faults, and ICMP 'Fragmentation Needed' (Type 3, Code 4) blackholing caused by WireGuard encryption encapsulation overhead (60–80 bytes).","antiPatternHeadline":"Deploying Cilium WireGuard overlays with default 1500 MTU and unmanaged TCP MSS clamping","stars_count":64,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","cilium","ebpf","wireguard","kubernetes","networking","mtu"],"exportEndpoints":{"claude":"/api/rules/cilium-wireguard-pmtu-clamp-synchronization?format=claude","cursorMdc":"/api/rules/cilium-wireguard-pmtu-clamp-synchronization?format=mdc","cursorrules":"/api/rules/cilium-wireguard-pmtu-clamp-synchronization?format=cursor","windsurf":"/api/rules/cilium-wireguard-pmtu-clamp-synchronization?format=windsurf","agents":"/api/rules/cilium-wireguard-pmtu-clamp-synchronization?format=agents"}},{"id":"otel-collector-cgroupv2-memory-limiter-backpressure","title":"OpenTelemetry Collector cgroup v2 Dynamic Memory Limiter & Upstream Backpressure Invariant","category":"devops","severity":"critical","description":"Enforces dynamic memory governance for OpenTelemetry Collector instances running under Linux cgroup v2 container runtimes. Guarantees that collector memory boundaries adapt dynamically to cgroup memory.max and memory.current telemetry, immediately exerting gRPC/HTTP backpressure to upstream telemetry sources before triggering kernel OOM-killer evictions.","antiPatternHeadline":"Static memory limit allocation and missing cgroup v2 pressure hooks causing ungraceful container OOMKills","stars_count":91,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","kubernetes","cgroupv2","backpressure","resilience"],"exportEndpoints":{"claude":"/api/rules/otel-collector-cgroupv2-memory-limiter-backpressure?format=claude","cursorMdc":"/api/rules/otel-collector-cgroupv2-memory-limiter-backpressure?format=mdc","cursorrules":"/api/rules/otel-collector-cgroupv2-memory-limiter-backpressure?format=cursor","windsurf":"/api/rules/otel-collector-cgroupv2-memory-limiter-backpressure?format=windsurf","agents":"/api/rules/otel-collector-cgroupv2-memory-limiter-backpressure?format=agents"}},{"id":"nextjs-15-server-action-ephemeral-nonce-guard","title":"Next.js 15 Server Action Ephemeral Request-Binding Nonce Verification","category":"frontend","severity":"critical","description":"Mutative Next.js 15 Server Actions rendered in pre-hydrated HTML forms are susceptible to cross-site request forgery, stale token replay, and race-condition double submissions. All mutative server actions must validate a cryptographically secure, single-use ephemeral nonce bound to the user session using constant-time comparison before modifying state.","antiPatternHeadline":"Trusting Default Origin Headers Without Ephemeral Nonce Verification in Server Actions","stars_count":68,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs","server-actions","security","csrf","cryptography"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-server-action-ephemeral-nonce-guard?format=claude","cursorMdc":"/api/rules/nextjs-15-server-action-ephemeral-nonce-guard?format=mdc","cursorrules":"/api/rules/nextjs-15-server-action-ephemeral-nonce-guard?format=cursor","windsurf":"/api/rules/nextjs-15-server-action-ephemeral-nonce-guard?format=windsurf","agents":"/api/rules/nextjs-15-server-action-ephemeral-nonce-guard?format=agents"}},{"id":"svelte-5-rune-cycle-interceptor","title":"Svelte 5 Runes Fine-Grained Reactive Proxy Cycle Interceptor","category":"frontend","severity":"critical","description":"Prevents infinite signal evaluation cascades and main-thread microtask exhaustion by establishing deterministic recursion depth budgeting across nested Svelte 5 $derived signals, $state proxies, and $effect boundaries. Enforces explicit separation between pure signal derivations and state mutations to prevent cyclic microtask starvation.","antiPatternHeadline":"Cyclic $state Mutation Inside $effect or Eager $derived Invocation Causing Browser Thread Lockup","stars_count":62,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","reactivity","signals","performance"],"exportEndpoints":{"claude":"/api/rules/svelte-5-rune-cycle-interceptor?format=claude","cursorMdc":"/api/rules/svelte-5-rune-cycle-interceptor?format=mdc","cursorrules":"/api/rules/svelte-5-rune-cycle-interceptor?format=cursor","windsurf":"/api/rules/svelte-5-rune-cycle-interceptor?format=windsurf","agents":"/api/rules/svelte-5-rune-cycle-interceptor?format=agents"}},{"id":"postgres-17-aio-prefetch-concurrency-throttling-fence","title":"Postgres 17 AIO Prefetch Concurrency Throttling Fence","category":"backend","severity":"critical","description":"Enforces strict admission control and session-scoped prefetch fencing for applications querying PostgreSQL 17 with Asynchronous I/O (io_method=io_uring/worker). Prevents operating system buffer pool saturation, Linux io_uring SQE ring exhaustion, and Direct I/O queue thrashing caused by concurrent parallel sequential scans.","antiPatternHeadline":"Unbounded Parallel Queries with Default Prefetch Inducing io_uring Starvation and Storage Controller Thrashing","stars_count":58,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","postgres-17","aio","io-uring","performance","concurrency"],"exportEndpoints":{"claude":"/api/rules/postgres-17-aio-prefetch-concurrency-throttling-fence?format=claude","cursorMdc":"/api/rules/postgres-17-aio-prefetch-concurrency-throttling-fence?format=mdc","cursorrules":"/api/rules/postgres-17-aio-prefetch-concurrency-throttling-fence?format=cursor","windsurf":"/api/rules/postgres-17-aio-prefetch-concurrency-throttling-fence?format=windsurf","agents":"/api/rules/postgres-17-aio-prefetch-concurrency-throttling-fence?format=agents"}},{"id":"axum-08-tokio-sse-cancellation-drain","title":"Axum 0.8 Tokio SSE Cancellation & Backpressure Drain Guardrail","category":"backend","severity":"critical","description":"Enforces deterministic Tokio task termination and upstream backpressure propagation upon client disconnects in persistent Axum 0.8 SSE endpoints. Mandates bounded channels, proactive keep-alive heartbeats, and RAII-bound CancellationToken lifecycles to prevent zombie background workers and memory exhaustion.","antiPatternHeadline":"Spawning detached unbounded worker loops that orphan background tasks and leak memory when SSE clients disconnect.","stars_count":109,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tokio","sse","concurrency","backpressure"],"exportEndpoints":{"claude":"/api/rules/axum-08-tokio-sse-cancellation-drain?format=claude","cursorMdc":"/api/rules/axum-08-tokio-sse-cancellation-drain?format=mdc","cursorrules":"/api/rules/axum-08-tokio-sse-cancellation-drain?format=cursor","windsurf":"/api/rules/axum-08-tokio-sse-cancellation-drain?format=windsurf","agents":"/api/rules/axum-08-tokio-sse-cancellation-drain?format=agents"}},{"id":"fastapi-pydantic-v2-direct-buffer-deserialization","title":"FastAPI Pydantic v2 Direct Buffer Deserialization Invariant","category":"backend","severity":"critical","description":"Standard FastAPI request handling defaults to decoding HTTP bodies into intermediate Python unicode strings via Starlette, causing severe heap fragmentation and event loop stalls under high throughput. High-throughput ingestion pipelines must bypass Python string allocation by passing raw chunked byte buffers directly into Pydantic v2's Rust-backed SIMD parser via `model_validate_json` or `TypeAdapter.validate_json`.","antiPatternHeadline":"Materializing Intermediate Python Strings or Dictionaries Prior to JSON Model Validation","stars_count":44,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","pydantic-v2","simd-json","zero-copy","memory-optimization"],"exportEndpoints":{"claude":"/api/rules/fastapi-pydantic-v2-direct-buffer-deserialization?format=claude","cursorMdc":"/api/rules/fastapi-pydantic-v2-direct-buffer-deserialization?format=mdc","cursorrules":"/api/rules/fastapi-pydantic-v2-direct-buffer-deserialization?format=cursor","windsurf":"/api/rules/fastapi-pydantic-v2-direct-buffer-deserialization?format=windsurf","agents":"/api/rules/fastapi-pydantic-v2-direct-buffer-deserialization?format=agents"}},{"id":"capacitor-7-zero-copy-arraybuffer-transfer-invariant","title":"Capacitor 7 Native-to-WebView Zero-Copy ArrayBuffer Transfer Invariant","category":"mobile","severity":"critical","description":"Mandates direct ArrayBuffer binary transport across the Capacitor 7 native-to-web bridge, strictly prohibiting Base64 or numeric array serialization. Prevents high-frequency garbage collector thrashing, IPC latency spikes, and 33% heap inflation during binary data streaming (BLE, camera frames, SQLite exports, and audio). Enforces direct TypedArray views and ownership transfer semantics on incoming bridge buffers.","antiPatternHeadline":"Serializing Binary Payloads as Base64 Strings or Number Arrays Over the Bridge","stars_count":107,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","arraybuffer","zero-copy","performance","memory-management"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-zero-copy-arraybuffer-transfer-invariant?format=claude","cursorMdc":"/api/rules/capacitor-7-zero-copy-arraybuffer-transfer-invariant?format=mdc","cursorrules":"/api/rules/capacitor-7-zero-copy-arraybuffer-transfer-invariant?format=cursor","windsurf":"/api/rules/capacitor-7-zero-copy-arraybuffer-transfer-invariant?format=windsurf","agents":"/api/rules/capacitor-7-zero-copy-arraybuffer-transfer-invariant?format=agents"}},{"id":"kmp-2-1-swift-direct-export-memory-boundary","title":"Kotlin 2.1 Swift Direct-Export Memory Ownership & Dual-Runtime Boundary Standard","category":"mobile","severity":"critical","description":"Governs inter-runtime reference topologies across Swift direct-export boundaries in Kotlin Multiplatform 2.1. Prevents uncollected dual-runtime retain cycles between Swift ARC and Kotlin/Native Concurrent Mark-Sweep GC by prohibiting cross-boundary bidirectional strong handles and mandating explicit lifecycle tokens.","antiPatternHeadline":"Cross-Runtime Retain Cycles via Closures Capturing Swift Self Passing to Kotlin GC Roots","stars_count":59,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kmp","kotlin-native","swift-export","arc","memory-management"],"exportEndpoints":{"claude":"/api/rules/kmp-2-1-swift-direct-export-memory-boundary?format=claude","cursorMdc":"/api/rules/kmp-2-1-swift-direct-export-memory-boundary?format=mdc","cursorrules":"/api/rules/kmp-2-1-swift-direct-export-memory-boundary?format=cursor","windsurf":"/api/rules/kmp-2-1-swift-direct-export-memory-boundary?format=windsurf","agents":"/api/rules/kmp-2-1-swift-direct-export-memory-boundary?format=agents"}},{"id":"webauthn-l3-backup-state-step-up-attestation","title":"Mandatory Step-Up Attestation for WebAuthn L3 Synced Passkeys in High-Privilege Contexts","category":"security","severity":"critical","description":"Enforces strict server-side evaluation of WebAuthn authenticator data flags (flags.be and flags.bs) alongside enterprise attestation formats during high-privilege operations. Synced multi-device credentials (cloud-backed passkeys) must trigger immediate step-up verification or hardware-bound device-bound credential re-authentication to prevent unauthorized execution via synchronized credential compromise.","antiPatternHeadline":"Accepting Multi-Device Synced Passkeys for Critical Operations Without Verifying Backup State Flags","stars_count":84,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","fido2","passkeys","authentication","zero-trust"],"exportEndpoints":{"claude":"/api/rules/webauthn-l3-backup-state-step-up-attestation?format=claude","cursorMdc":"/api/rules/webauthn-l3-backup-state-step-up-attestation?format=mdc","cursorrules":"/api/rules/webauthn-l3-backup-state-step-up-attestation?format=cursor","windsurf":"/api/rules/webauthn-l3-backup-state-step-up-attestation?format=windsurf","agents":"/api/rules/webauthn-l3-backup-state-step-up-attestation?format=agents"}},{"id":"openfga-cdc-watermark-consistency-invariant","title":"OpenFGA CDC Tuple Stream Watermark Monotonic Consistency Guardrail","category":"security","severity":"critical","description":"Enforces strict read-your-writes monotonic consistency across distributed OpenFGA authorization checks fed by change data capture (CDC). Mandates that downstream permission evaluation gates block or supply contextual tuples until the OpenFGA consumer stream watermark catches up to the mutation's transactional log sequence number (LSN).","antiPatternHeadline":"Stale Authorization Decisions Caused by Ungated Checks Against Lagging OpenFGA CDC Streams","stars_count":109,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","authorization","cdc","distributed-systems","eventual-consistency"],"exportEndpoints":{"claude":"/api/rules/openfga-cdc-watermark-consistency-invariant?format=claude","cursorMdc":"/api/rules/openfga-cdc-watermark-consistency-invariant?format=mdc","cursorrules":"/api/rules/openfga-cdc-watermark-consistency-invariant?format=cursor","windsurf":"/api/rules/openfga-cdc-watermark-consistency-invariant?format=windsurf","agents":"/api/rules/openfga-cdc-watermark-consistency-invariant?format=agents"}},{"id":"otel-baggage-sanitization-redaction-standard","title":"OpenTelemetry Baggage Ingress Sanitization and Hop-by-Hop Key Redaction","category":"devops","severity":"critical","description":"Enforces strict allowlisting, size clamping, and hop-by-hop redaction on incoming W3C Baggage headers at ingress gateways and internal service boundaries. Prevents unvalidated baggage propagation from triggering HTTP 431 (Request Header Fields Too Large) outages and exfiltrating PII/internal authorization tokens to downstream or untrusted boundaries.","antiPatternHeadline":"Blind W3C Baggage Header Propagation Across Ingress and Internal Trust Boundaries","stars_count":50,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","observability","security","w3c-trace-context","api-gateway"],"exportEndpoints":{"claude":"/api/rules/otel-baggage-sanitization-redaction-standard?format=claude","cursorMdc":"/api/rules/otel-baggage-sanitization-redaction-standard?format=mdc","cursorrules":"/api/rules/otel-baggage-sanitization-redaction-standard?format=cursor","windsurf":"/api/rules/otel-baggage-sanitization-redaction-standard?format=windsurf","agents":"/api/rules/otel-baggage-sanitization-redaction-standard?format=agents"}},{"id":"svelte-5-universal-context-boundary-isolation-standard","title":"Svelte 5 Universal Context Boundary Isolation and SSR Reactive Graph Concurrency Guardrail","category":"frontend","severity":"critical","description":"Enforces rigid request-boundary isolation for Svelte 5 reactive primitives ($state, $derived) in multi-tenant SSR environments. Prevents catastrophic cross-request data leaks and signal graph memory accumulation by eliminating module-level reactive singletons in favor of scoped component tree contexts.","antiPatternHeadline":"Module-Scoped Reactive Singletons Leaking Multi-Tenant State and Retaining Signal Graphs in High-Concurrency SSR","stars_count":65,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["svelte5","runes","ssr","reactivity","multi-tenant","memory-leak"],"exportEndpoints":{"claude":"/api/rules/svelte-5-universal-context-boundary-isolation-standard?format=claude","cursorMdc":"/api/rules/svelte-5-universal-context-boundary-isolation-standard?format=mdc","cursorrules":"/api/rules/svelte-5-universal-context-boundary-isolation-standard?format=cursor","windsurf":"/api/rules/svelte-5-universal-context-boundary-isolation-standard?format=windsurf","agents":"/api/rules/svelte-5-universal-context-boundary-isolation-standard?format=agents"}},{"id":"react-19-asset-preload-suspense-deadlock","title":"React 19 Asset Preload Suspense-Deadlock Mitigation Standard","category":"frontend","severity":"critical","description":"Enforces non-blocking resource hints and deterministic stylesheet precedence hoisting in React 19 streaming SSR architectures. Prevents dynamic asset preloads inside streaming Suspense boundaries from deadlocking edge hydration workers and blocking critical path commits.","antiPatternHeadline":"Injecting blocking stylesheet precedence or synchronous preinit calls inside edge-streamed Suspense boundaries","stars_count":86,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["react-19","suspense","hydration","edge-streaming","asset-loading","performance"],"exportEndpoints":{"claude":"/api/rules/react-19-asset-preload-suspense-deadlock?format=claude","cursorMdc":"/api/rules/react-19-asset-preload-suspense-deadlock?format=mdc","cursorrules":"/api/rules/react-19-asset-preload-suspense-deadlock?format=cursor","windsurf":"/api/rules/react-19-asset-preload-suspense-deadlock?format=windsurf","agents":"/api/rules/react-19-asset-preload-suspense-deadlock?format=agents"}},{"id":"axum-zero-copy-multipart-backpressure-protocol","title":"Axum Multipart Stream Backpressure & Kernel Buffer Protection Protocol","category":"backend","severity":"critical","description":"Enforces strict demand-driven consumption of Axum multipart streaming bodies to eliminate Tokio executor task starvation and heap exhaustion. Prohibits in-memory payload aggregation across Tokio runtimes by mandating synchronous pull-based writes directly into bounded sinks to maintain TCP window zero-window advertisements.","antiPatternHeadline":"Buffering Multi-Gigabyte Stream Chunks into Unbounded Memory or Spawning Detached Channel Writers without Socket Backpressure","stars_count":100,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tokio","multipart","streaming","memory-safety"],"exportEndpoints":{"claude":"/api/rules/axum-zero-copy-multipart-backpressure-protocol?format=claude","cursorMdc":"/api/rules/axum-zero-copy-multipart-backpressure-protocol?format=mdc","cursorrules":"/api/rules/axum-zero-copy-multipart-backpressure-protocol?format=cursor","windsurf":"/api/rules/axum-zero-copy-multipart-backpressure-protocol?format=windsurf","agents":"/api/rules/axum-zero-copy-multipart-backpressure-protocol?format=agents"}},{"id":"kmp-swift-arc-cross-runtime-cycle-isolation","title":"Kotlin Multiplatform Swift-ARC Cross-Runtime Memory Cycle Isolation","category":"mobile","severity":"critical","description":"Enforces deterministic memory boundaries across the Kotlin/Native Garbage Collector and Apple Automatic Reference Counting (ARC) runtime bridge. Eliminates dual-runtime retain cycles where Swift objects retain Kotlin objects that indirectly retain Swift callbacks or delegates via Objective-C bridge wrappers, leading to catastrophic native memory leaks and frozen uncollected roots.","antiPatternHeadline":"Bypassing weak reference semantics across the Swift/KMP bridge creating cross-runtime zombie retain cycles","stars_count":77,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kmp","kotlin-native","swift","arc","memory-management","ios"],"exportEndpoints":{"claude":"/api/rules/kmp-swift-arc-cross-runtime-cycle-isolation?format=claude","cursorMdc":"/api/rules/kmp-swift-arc-cross-runtime-cycle-isolation?format=mdc","cursorrules":"/api/rules/kmp-swift-arc-cross-runtime-cycle-isolation?format=cursor","windsurf":"/api/rules/kmp-swift-arc-cross-runtime-cycle-isolation?format=windsurf","agents":"/api/rules/kmp-swift-arc-cross-runtime-cycle-isolation?format=agents"}},{"id":"capacitor-7-biometric-keystore-hardware-attestation-guardrail","title":"Capacitor 7 Biometric Hardware Keystore Invalidation & Secure Enclave Attestation","category":"mobile","severity":"critical","description":"Enforces cryptographic hardware-backed key revocation and state-bound attestation across Android KeyStore and iOS Secure Enclave within Capacitor 7 architectures. Guarantees that any device biometric enrollment modification (e.g., newly added fingerprints or facial enrollments) permanently invalidates cached biometric keys and purges authentication tokens. Prevents cross-identity session hijacking and unauthorized hardware-level key reuse across OS credential changes.","antiPatternHeadline":"Persisting Unbound Refresh Tokens or Bypassing invalidateOnEnrollment Hardware Keystore Flags","stars_count":91,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","security","biometrics","keystore","secure-enclave","hardware-security"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-biometric-keystore-hardware-attestation-guardrail?format=claude","cursorMdc":"/api/rules/capacitor-7-biometric-keystore-hardware-attestation-guardrail?format=mdc","cursorrules":"/api/rules/capacitor-7-biometric-keystore-hardware-attestation-guardrail?format=cursor","windsurf":"/api/rules/capacitor-7-biometric-keystore-hardware-attestation-guardrail?format=windsurf","agents":"/api/rules/capacitor-7-biometric-keystore-hardware-attestation-guardrail?format=agents"}},{"id":"openfga-recursive-graph-expansion-cost-containment","title":"OpenFGA Recursive Graph Expansion Cost Containment & Depth Bounding","category":"security","severity":"critical","description":"Enforces strict structural constraints, evaluation timeouts, and bounded depth traversal on OpenFGA relationship-based access control (ReBAC) evaluations. Prevents algorithmic denial-of-service (DoS) and thread exhaustion attacks caused by deeply nested transitive hierarchies or cyclical graph expansion in real-time authorization checks. Mandates fail-closed limits, contextual tuple constraints, and deterministic complexity budgeting across all authorization queries.","antiPatternHeadline":"Unbounded Recursive Transitive Traversal in OpenFGA Check Evaluations","stars_count":59,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","rebac","authorization","dos-prevention","graph-algorithms"],"exportEndpoints":{"claude":"/api/rules/openfga-recursive-graph-expansion-cost-containment?format=claude","cursorMdc":"/api/rules/openfga-recursive-graph-expansion-cost-containment?format=mdc","cursorrules":"/api/rules/openfga-recursive-graph-expansion-cost-containment?format=cursor","windsurf":"/api/rules/openfga-recursive-graph-expansion-cost-containment?format=windsurf","agents":"/api/rules/openfga-recursive-graph-expansion-cost-containment?format=agents"}},{"id":"webauthn-conditional-mediation-ambient-replay-firewall","title":"Enforce Strict Challenge Invalidation and Origin Binding for WebAuthn Conditional Mediation Flows","category":"security","severity":"critical","description":"Defends WebAuthn conditional mediation (passkey autofill) against ambient replay attacks, cross-origin credential harvesting, and concurrent AbortSignal race conditions. Mandates single-flight AbortController orchestration, ephemeral challenge-session binding, and atomic challenge invalidation on verification.","antiPatternHeadline":"Unbounded conditional mediation invocations sharing static challenges or omitting abort controller lifecycle governance","stars_count":71,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","passkeys","authentication","conditional-mediation","fido2"],"exportEndpoints":{"claude":"/api/rules/webauthn-conditional-mediation-ambient-replay-firewall?format=claude","cursorMdc":"/api/rules/webauthn-conditional-mediation-ambient-replay-firewall?format=mdc","cursorrules":"/api/rules/webauthn-conditional-mediation-ambient-replay-firewall?format=cursor","windsurf":"/api/rules/webauthn-conditional-mediation-ambient-replay-firewall?format=windsurf","agents":"/api/rules/webauthn-conditional-mediation-ambient-replay-firewall?format=agents"}},{"id":"ebpf-profiler-frame-pointer-unwinding-safety","title":"eBPF Continuous Profiler Frame Pointer Unwinding Safety Invariant","category":"devops","severity":"critical","description":"Enforces bounded frame pointer stack unwinding invariants for eBPF continuous profilers collecting traces across native and JIT runtimes. Guarantees linear verifier state exploration, prevents instruction complexity blowups (exceeding 1M verifier states), and guards against invalid user-space memory dereferences during mixed-mode execution.","antiPatternHeadline":"Unbounded stack walks and unchecked user pointer dereferencing causing eBPF verifier rejection or silent trace truncation","stars_count":85,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","continuous-profiling","kernel","observability","performance"],"exportEndpoints":{"claude":"/api/rules/ebpf-profiler-frame-pointer-unwinding-safety?format=claude","cursorMdc":"/api/rules/ebpf-profiler-frame-pointer-unwinding-safety?format=mdc","cursorrules":"/api/rules/ebpf-profiler-frame-pointer-unwinding-safety?format=cursor","windsurf":"/api/rules/ebpf-profiler-frame-pointer-unwinding-safety?format=windsurf","agents":"/api/rules/ebpf-profiler-frame-pointer-unwinding-safety?format=agents"}},{"id":"svelte-5-runes-root-effect-disposal-guardrail","title":"Svelte 5 Runes $effect.root Boundary Containment and Deterministic Disposal","category":"frontend","severity":"critical","description":"Enforces strict lifecycle containment via $effect.root across dynamically mounted micro-frontend islands, external adapters, and unmanaged reactive scopes. Prevents critical memory leaks and zombie reactive graph execution by mandating deterministic teardown of unparented Svelte 5 runtime effects.","antiPatternHeadline":"Unmanaged Dynamic Reactive Graph Allocation Without $effect.root Teardown Binding","stars_count":102,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","micro-frontends","memory-leaks"],"exportEndpoints":{"claude":"/api/rules/svelte-5-runes-root-effect-disposal-guardrail?format=claude","cursorMdc":"/api/rules/svelte-5-runes-root-effect-disposal-guardrail?format=mdc","cursorrules":"/api/rules/svelte-5-runes-root-effect-disposal-guardrail?format=cursor","windsurf":"/api/rules/svelte-5-runes-root-effect-disposal-guardrail?format=windsurf","agents":"/api/rules/svelte-5-runes-root-effect-disposal-guardrail?format=agents"}},{"id":"openfga-cdc-consistency-token-synchronization","title":"OpenFGA 1.6+ CDC Consistency Token Synchronization Standard","category":"security","severity":"critical","description":"Multi-region authorization architectures suffer from replication lag anomalies where transactional database state propagates faster than asynchronous OpenFGA tuple projections. This standard mandates propagating and binding change-data-capture (CDC) transaction tokens (e.g., PostgreSQL LSN, CockroachDB HLC, or OpenFGA continuation/transaction IDs) into OpenFGA Check and Contextual Tuple evaluations. Enforcing this invariant eliminates stale read authorization vulnerabilities (e.g., revoked access lingering during propagation windows).","antiPatternHeadline":"Decoupled Check Queries Tolerating Asynchronous CDC Replication Lag Vulnerabilities","stars_count":87,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","authorization","cdc","distributed-systems","consistency"],"exportEndpoints":{"claude":"/api/rules/openfga-cdc-consistency-token-synchronization?format=claude","cursorMdc":"/api/rules/openfga-cdc-consistency-token-synchronization?format=mdc","cursorrules":"/api/rules/openfga-cdc-consistency-token-synchronization?format=cursor","windsurf":"/api/rules/openfga-cdc-consistency-token-synchronization?format=windsurf","agents":"/api/rules/openfga-cdc-consistency-token-synchronization?format=agents"}},{"id":"fastapi-anyio-lifespan-taskgroup-boundary","title":"FastAPI 0.115+ AnyIO Lifespan TaskGroup Cancellation Boundary","category":"backend","severity":"critical","description":"Enforces structured concurrency boundaries within FastAPI 0.115+ lifespan handlers by mandating `anyio.create_task_group()` for all background coroutines. Prohibits unstructured `asyncio.create_task()` execution that bypasses lifespan cancellation scopes, preventing orphaned coroutines, unhandled exceptions, and deadlocks during SIGTERM graceful draining.","antiPatternHeadline":"Spawning Unbound Lifespan Tasks via asyncio.create_task Leading to Orphaned Coroutines During SIGTERM Draining","stars_count":118,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","anyio","structured-concurrency","asyncio","lifespan"],"exportEndpoints":{"claude":"/api/rules/fastapi-anyio-lifespan-taskgroup-boundary?format=claude","cursorMdc":"/api/rules/fastapi-anyio-lifespan-taskgroup-boundary?format=mdc","cursorrules":"/api/rules/fastapi-anyio-lifespan-taskgroup-boundary?format=cursor","windsurf":"/api/rules/fastapi-anyio-lifespan-taskgroup-boundary?format=windsurf","agents":"/api/rules/fastapi-anyio-lifespan-taskgroup-boundary?format=agents"}},{"id":"postgres-17-replication-slot-sync-failover-invariant","title":"PostgreSQL 17 Logical Replication Slot Synchronization and Standby Failover Safety","category":"backend","severity":"critical","description":"Mandates that cross-AZ physical standby failovers in PostgreSQL 17 enforce logical replication slot synchronization via synchronized_standby_slots, sync_replication_slots, and pg_sync_replication_slots(). Enforces zero-data-loss subscriber cutovers by verifying slot consistency and synced status before standby promotion and subscriber re-routing.","antiPatternHeadline":"Promoting physical standby instances without synchronized logical replication slots, causing subscriber data corruption and catalog desynchronization.","stars_count":42,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres-17","replication","high-availability","disaster-recovery"],"exportEndpoints":{"claude":"/api/rules/postgres-17-replication-slot-sync-failover-invariant?format=claude","cursorMdc":"/api/rules/postgres-17-replication-slot-sync-failover-invariant?format=mdc","cursorrules":"/api/rules/postgres-17-replication-slot-sync-failover-invariant?format=cursor","windsurf":"/api/rules/postgres-17-replication-slot-sync-failover-invariant?format=windsurf","agents":"/api/rules/postgres-17-replication-slot-sync-failover-invariant?format=agents"}},{"id":"kmp-2-1-direct-swift-export-abi-stability-standard","title":"Kotlin Multiplatform 2.1 Direct Swift Export ABI Stability and Strict Concurrency Guardrail","category":"mobile","severity":"critical","description":"Enforces deterministic layout invariants and zero-overhead memory bridge semantics under Kotlin 2.1 Direct Swift Export. Mandates strict finality, value-type boxing elimination, and boundary isolation to comply with Swift 6 strict concurrency checks without bridging via Objective-C runtime thunks.","antiPatternHeadline":"Leaking Open Classes, Unfrozen Shared State, or ObjC Boxed Dynamic Dispatches Across Swift 6 Strict Concurrency Boundaries","stars_count":119,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","swift-export","swift6","concurrency","abi-stability"],"exportEndpoints":{"claude":"/api/rules/kmp-2-1-direct-swift-export-abi-stability-standard?format=claude","cursorMdc":"/api/rules/kmp-2-1-direct-swift-export-abi-stability-standard?format=mdc","cursorrules":"/api/rules/kmp-2-1-direct-swift-export-abi-stability-standard?format=cursor","windsurf":"/api/rules/kmp-2-1-direct-swift-export-abi-stability-standard?format=windsurf","agents":"/api/rules/kmp-2-1-direct-swift-export-abi-stability-standard?format=agents"}},{"id":"opentelemetry-tail-sampling-bounded-ringbuffer-invariant","title":"OpenTelemetry Tail-Based Sampling Bounded Ringbuffer & Backpressure Invariant","category":"devops","severity":"critical","description":"Enforces deterministic memory bounds and hard backpressure thresholds within OpenTelemetry Collector pipelines utilizing tail-based sampling. Tail sampling mandates caching incomplete trace spans in memory, which without strictly ordered memory limiters, ringbuffer sizing, and deterministic trace routing results in unrecoverable OOM collector cascades during high-cardinality trace spikes.","antiPatternHeadline":"Unbounded Trace State Accumulation Leading to Collector OOM Cascades","stars_count":100,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","tail-sampling","observability","distributed-tracing","backpressure","sre"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-tail-sampling-bounded-ringbuffer-invariant?format=claude","cursorMdc":"/api/rules/opentelemetry-tail-sampling-bounded-ringbuffer-invariant?format=mdc","cursorrules":"/api/rules/opentelemetry-tail-sampling-bounded-ringbuffer-invariant?format=cursor","windsurf":"/api/rules/opentelemetry-tail-sampling-bounded-ringbuffer-invariant?format=windsurf","agents":"/api/rules/opentelemetry-tail-sampling-bounded-ringbuffer-invariant?format=agents"}},{"id":"webauthn-largeblob-envelope-encryption-standard-passkey-webauthn-130","title":"Passkey WebAuthn largeBlob Zero-Knowledge Envelope Encryption Standard","category":"security","severity":"critical","description":"Enforces client-side zero-knowledge envelope encryption on all WebAuthn largeBlob extension payloads prior to calling navigator.credentials.create or navigator.credentials.get. Prevents identity leakage, session hijacking, and cross-account transplant attacks in the event of compromised passkey cloud sync vaults (e.g., iCloud Keychain, Google Password Manager).","antiPatternHeadline":"Persisting Plaintext or Server-Known Keys into Authenticator largeBlob Extensions Without Cryptographic Envelope Binding","stars_count":60,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","passkeys","largeblob","cryptography","zero-knowledge"],"exportEndpoints":{"claude":"/api/rules/webauthn-largeblob-envelope-encryption-standard-passkey-webauthn-130?format=claude","cursorMdc":"/api/rules/webauthn-largeblob-envelope-encryption-standard-passkey-webauthn-130?format=mdc","cursorrules":"/api/rules/webauthn-largeblob-envelope-encryption-standard-passkey-webauthn-130?format=cursor","windsurf":"/api/rules/webauthn-largeblob-envelope-encryption-standard-passkey-webauthn-130?format=windsurf","agents":"/api/rules/webauthn-largeblob-envelope-encryption-standard-passkey-webauthn-130?format=agents"}},{"id":"ebpf-bpf-lsm-cgroupv2-socket-binding-invariant","title":"BPF-LSM Cgroup v2 Egress Socket Binding and Raw Socket Invariant","category":"devops","severity":"critical","description":"Enforces deterministic kernel-level LSM containment within cgroup v2 hierarchies to prohibit raw socket instantiation (SOCK_RAW, AF_PACKET) and unvalidated socket bindings. Prevents cross-tenant network namespace breakouts and packet injection in multi-tenant container hosts by verifying cgroup ancestry and namespace ownership directly in BPF-LSM hooks.","antiPatternHeadline":"Delegating Socket Isolation to User-space Runtimes Without In-Kernel BPF-LSM Socket Creation Validation","stars_count":103,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","bpf-lsm","cgroupv2","linux-kernel","zero-trust","container-security"],"exportEndpoints":{"claude":"/api/rules/ebpf-bpf-lsm-cgroupv2-socket-binding-invariant?format=claude","cursorMdc":"/api/rules/ebpf-bpf-lsm-cgroupv2-socket-binding-invariant?format=mdc","cursorrules":"/api/rules/ebpf-bpf-lsm-cgroupv2-socket-binding-invariant?format=cursor","windsurf":"/api/rules/ebpf-bpf-lsm-cgroupv2-socket-binding-invariant?format=windsurf","agents":"/api/rules/ebpf-bpf-lsm-cgroupv2-socket-binding-invariant?format=agents"}},{"id":"vite-6-rolldown-deterministic-chunking","title":"Vite 6 & Rolldown Deterministic Chunk Boundary & AST Hashing Invariant","category":"frontend","severity":"critical","description":"Enforces identical AST module partitioning, pure vendor boundary allocations, and deterministic content-addressed hash generation between client and SSR module execution graphs. Prevents dynamic import skew, cross-boundary symbol leaks, and cascading runtime hydration mismatches during rolling canary rollouts.","antiPatternHeadline":"Non-Deterministic Manual Chunk Splitting Causing SSR/Client Split-Graph Divergence","stars_count":81,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["vite6","rolldown","ssr","hydration","bundling","architecture"],"exportEndpoints":{"claude":"/api/rules/vite-6-rolldown-deterministic-chunking?format=claude","cursorMdc":"/api/rules/vite-6-rolldown-deterministic-chunking?format=mdc","cursorrules":"/api/rules/vite-6-rolldown-deterministic-chunking?format=cursor","windsurf":"/api/rules/vite-6-rolldown-deterministic-chunking?format=windsurf","agents":"/api/rules/vite-6-rolldown-deterministic-chunking?format=agents"}},{"id":"bun-asynclocalstorage-generator-propagation-contract","title":"Bun 1.2 AsyncLocalStorage Context Preservation across Streaming Async Generators","category":"backend","severity":"critical","description":"Enforces deterministic trace context and ambient state propagation across native Bun asynchronous generators and ReadableStream response pipelines. Prevents silent context loss during event-loop interleaving and microtask detachment when yielding streaming chunks in high-throughput microservices. Mandates explicit context binding via AsyncLocalStorage.bind or captured execution contexts across async iterator consumption boundaries.","antiPatternHeadline":"Unbound Async Generator Yielding Across Stream Consumers Causing Context Eviction","stars_count":114,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","asynclocalstorage","streaming","tracing","observability","microservices"],"exportEndpoints":{"claude":"/api/rules/bun-asynclocalstorage-generator-propagation-contract?format=claude","cursorMdc":"/api/rules/bun-asynclocalstorage-generator-propagation-contract?format=mdc","cursorrules":"/api/rules/bun-asynclocalstorage-generator-propagation-contract?format=cursor","windsurf":"/api/rules/bun-asynclocalstorage-generator-propagation-contract?format=windsurf","agents":"/api/rules/bun-asynclocalstorage-generator-propagation-contract?format=agents"}},{"id":"vite-6-environment-api-runtime-boundary-standard-vite-6-environme-374","title":"Vite 6 Environment API Multi-Runtime Module Graph Isolation Standard","category":"frontend","severity":"critical","description":"Enforces strict isolation of module graphs, transform pipelines, and execution runtimes across multi-target SSR architectures using Vite 6's Environment API. Eliminates cross-runtime state pollution, illegal host-runtime API leaks, and redundant module transformations across Client, Node.js, and WinterCG workerd environments.","antiPatternHeadline":"Monolithic Module Graph Bleed and Deprecated ssrLoadModule Usage Across Disjoint Runtimes","stars_count":118,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["vite","vite-6","environment-api","ssr","wintercg","module-graph","runtime-isolation"],"exportEndpoints":{"claude":"/api/rules/vite-6-environment-api-runtime-boundary-standard-vite-6-environme-374?format=claude","cursorMdc":"/api/rules/vite-6-environment-api-runtime-boundary-standard-vite-6-environme-374?format=mdc","cursorrules":"/api/rules/vite-6-environment-api-runtime-boundary-standard-vite-6-environme-374?format=cursor","windsurf":"/api/rules/vite-6-environment-api-runtime-boundary-standard-vite-6-environme-374?format=windsurf","agents":"/api/rules/vite-6-environment-api-runtime-boundary-standard-vite-6-environme-374?format=agents"}},{"id":"react-19-action-optimistic-rollback-determinism","title":"React 19 Action Optimistic Rollback Determinism & Transaction Isolation","category":"frontend","severity":"critical","description":"Enforces deterministic transactional rollbacks for React 19 optimistic updates executed within asynchronous actions and transitions. Prohibits ad-hoc imperative state mutations and unanchored optimistic state that diverge during concurrent action interruptions, network failures, or transition aborts.","antiPatternHeadline":"Ad-Hoc Imperative State Drift and Phantom Reconciliations in Concurrent React 19 Action Failures","stars_count":68,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","use-optimistic","use-action-state","concurrency","transitions"],"exportEndpoints":{"claude":"/api/rules/react-19-action-optimistic-rollback-determinism?format=claude","cursorMdc":"/api/rules/react-19-action-optimistic-rollback-determinism?format=mdc","cursorrules":"/api/rules/react-19-action-optimistic-rollback-determinism?format=cursor","windsurf":"/api/rules/react-19-action-optimistic-rollback-determinism?format=windsurf","agents":"/api/rules/react-19-action-optimistic-rollback-determinism?format=agents"}},{"id":"openfga-rebac-causal-consistency-invariant","title":"OpenFGA ReBAC Causal Consistency & Bounded-Staleness Guardrail","category":"backend","severity":"critical","description":"Eliminates authorization race conditions in high-throughput microservices by enforcing causal consistency token propagation and strict bounded-staleness cache validation. Prevents unauthorized resource exposure caused by evaluating permission checks against stale relationship tuples immediately following state mutations (read-after-write anomalies). Mandates contextual consistency tokens or forced upstream read evaluation during high-integrity authorization transactions.","antiPatternHeadline":"Blind ReBAC Checks Vulnerable to Read-After-Write Consistency Race Conditions","stars_count":53,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","openfga","rebac","authorization","distributed-systems","causal-consistency"],"exportEndpoints":{"claude":"/api/rules/openfga-rebac-causal-consistency-invariant?format=claude","cursorMdc":"/api/rules/openfga-rebac-causal-consistency-invariant?format=mdc","cursorrules":"/api/rules/openfga-rebac-causal-consistency-invariant?format=cursor","windsurf":"/api/rules/openfga-rebac-causal-consistency-invariant?format=windsurf","agents":"/api/rules/openfga-rebac-causal-consistency-invariant?format=agents"}},{"id":"fastapi-pydantic-v2-zero-copy-stream-pinning","title":"FastAPI Pydantic V2 Zero-Copy Stream Pinning & Memory Pinning Invariant","category":"backend","severity":"critical","description":"Prevents severe GIL contention and memory amplification in high-throughput FastAPI endpoints by enforcing direct Rust-core serialization buffers into ASGI response streams. Eliminates intermediary Python dictionary and object allocations by leveraging Pydantic V2 pydantic-core byte emissions directly into ASGI transport channels.","antiPatternHeadline":"Intermediary Python Heap Dict Instantiation and GIL Thrashing During Large-Scale Response Serialization","stars_count":60,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","pydantic-v2","zero-copy","asyncio","gil-contention","memory-optimization"],"exportEndpoints":{"claude":"/api/rules/fastapi-pydantic-v2-zero-copy-stream-pinning?format=claude","cursorMdc":"/api/rules/fastapi-pydantic-v2-zero-copy-stream-pinning?format=mdc","cursorrules":"/api/rules/fastapi-pydantic-v2-zero-copy-stream-pinning?format=cursor","windsurf":"/api/rules/fastapi-pydantic-v2-zero-copy-stream-pinning?format=windsurf","agents":"/api/rules/fastapi-pydantic-v2-zero-copy-stream-pinning?format=agents"}},{"id":"postgres-17-failover-logical-replication-sync","title":"Postgres 17 Failover Slot Logical Replication Synchronization Standard","category":"backend","severity":"critical","description":"Enforces strict configuration and application-level handling of PostgreSQL 17 native failover-enabled logical replication slots. Guarantees zero event loss and seamless LSN continuity across change-data-capture (CDC) pipelines and event-driven microservices during physical database failovers.","antiPatternHeadline":"Creating Non-Failover Logical Slots and Dropping/Recreating Slots on Standby Promotion","stars_count":73,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","cdc","logical-replication","postgres-17","high-availability"],"exportEndpoints":{"claude":"/api/rules/postgres-17-failover-logical-replication-sync?format=claude","cursorMdc":"/api/rules/postgres-17-failover-logical-replication-sync?format=mdc","cursorrules":"/api/rules/postgres-17-failover-logical-replication-sync?format=cursor","windsurf":"/api/rules/postgres-17-failover-logical-replication-sync?format=windsurf","agents":"/api/rules/postgres-17-failover-logical-replication-sync?format=agents"}},{"id":"kmp-swift-export-arc-boundary-isolation","title":"Kotlin Native & Swift ARC Interop Boundary Memory Isolation","category":"mobile","severity":"critical","description":"Enforces strict isolation between Swift Automatic Reference Counting (ARC) and Kotlin/Native tracing Garbage Collection (GC) across the Objective-C/Swift-Export ABI. Prohibits cross-runtime cyclic retain paths where Kotlin objects hold strong references to Swift instances implementing exported interfaces without deterministic lifecycle detachment.","antiPatternHeadline":"Cross-Runtime Cyclic Retain Graph Causing Undetectable Native Memory Leaks","stars_count":49,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kmp","kotlin-native","swift","arc","memory-management"],"exportEndpoints":{"claude":"/api/rules/kmp-swift-export-arc-boundary-isolation?format=claude","cursorMdc":"/api/rules/kmp-swift-export-arc-boundary-isolation?format=mdc","cursorrules":"/api/rules/kmp-swift-export-arc-boundary-isolation?format=cursor","windsurf":"/api/rules/kmp-swift-export-arc-boundary-isolation?format=windsurf","agents":"/api/rules/kmp-swift-export-arc-boundary-isolation?format=agents"}},{"id":"tauri-v2-ipc-capability-manifest-standard","title":"Tauri 2.0 Fine-Grained IPC Capability Manifest & Window Isolation Standard","category":"mobile","severity":"critical","description":"Enforces fine-grained permission capabilities and explicit window-to-command isolation in Tauri 2.0 configurations. Prevents arbitrary remote code execution and local privilege escalation across iOS, Android, and desktop by ensuring webviews only access explicitly scoped, cryptographically pinned IPC commands and secure origin sets.","antiPatternHeadline":"Wildcard Permissions and Global IPC Command Exposure Across Unrestricted Webviews","stars_count":105,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri","rust","security","ipc","capabilities"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-ipc-capability-manifest-standard?format=claude","cursorMdc":"/api/rules/tauri-v2-ipc-capability-manifest-standard?format=mdc","cursorrules":"/api/rules/tauri-v2-ipc-capability-manifest-standard?format=cursor","windsurf":"/api/rules/tauri-v2-ipc-capability-manifest-standard?format=windsurf","agents":"/api/rules/tauri-v2-ipc-capability-manifest-standard?format=agents"}},{"id":"sigstore-keyless-ephemeral-provenance-verification","title":"Sigstore Keyless Ephemeral Provenance Verification Invariant","category":"security","severity":"critical","description":"Enforces non-repudiable SLSA Level 3 build provenance attestation across container artifacts using ambient OIDC workload identity tokens instead of static credentials. Prohibits static cryptographic keys in CI/CD signing pipelines and enforces strict verification of Fulcio ephemeral X.509 certificates, Rekor transparency log inclusion proofs, and OIDC issuer/subject identity claims at admission and deployment boundaries.","antiPatternHeadline":"Bypassing Keyless Identity Attestation via Static Private Keys or Missing Rekor Proof Verification","stars_count":52,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","sigstore","cosign","supply-chain","slsa-level-3","rekor","fulcio","oidc"],"exportEndpoints":{"claude":"/api/rules/sigstore-keyless-ephemeral-provenance-verification?format=claude","cursorMdc":"/api/rules/sigstore-keyless-ephemeral-provenance-verification?format=mdc","cursorrules":"/api/rules/sigstore-keyless-ephemeral-provenance-verification?format=cursor","windsurf":"/api/rules/sigstore-keyless-ephemeral-provenance-verification?format=windsurf","agents":"/api/rules/sigstore-keyless-ephemeral-provenance-verification?format=agents"}},{"id":"wasi-02-component-sandbox-isolation","title":"WASI 0.2 Component Model Zero-Trust Sandboxed Host-Guest Isolation","category":"security","severity":"critical","description":"Enforces non-negotiable zero-trust execution boundaries for untrusted, customer-authored WebAssembly components via WASI 0.2 and WIT-defined capability interfaces. Eliminates ambient authority and IPC serialization overhead by strictly isolating component instances through typed resource handles, deterministic epoch-based interruption, and granular WASI capability linkers.","antiPatternHeadline":"Ambient System Capability Granting and Unmetered Host Memory Leaks in Component Runtimes","stars_count":110,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","wasi","wasm","component-model","wit","sandboxing","zero-trust"],"exportEndpoints":{"claude":"/api/rules/wasi-02-component-sandbox-isolation?format=claude","cursorMdc":"/api/rules/wasi-02-component-sandbox-isolation?format=mdc","cursorrules":"/api/rules/wasi-02-component-sandbox-isolation?format=cursor","windsurf":"/api/rules/wasi-02-component-sandbox-isolation?format=windsurf","agents":"/api/rules/wasi-02-component-sandbox-isolation?format=agents"}},{"id":"opentelemetry-cardinality-governor-exemplar-preservation","title":"OpenTelemetry Trace-Correlated Metric Cardinality Governor and Exemplar Safeguard","category":"devops","severity":"critical","description":"Enforces deterministic metric cardinality budgets across all OpenTelemetry telemetry pipelines to protect time-series databases (TSDBs) from memory exhaustion during traffic anomalies. Dynamically normalizes or drops volatile labels (such as customer IDs, UUIDs, or raw query parameters) while systematically capturing trace context via exemplars on Prometheus and OTLP exporters.","antiPatternHeadline":"Unbounded Metric Attribute Pollution Causing TSDB Out-of-Memory Crashing Under Peak Traffic","stars_count":43,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","observability","prometheus","metrics","cardinality"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-cardinality-governor-exemplar-preservation?format=claude","cursorMdc":"/api/rules/opentelemetry-cardinality-governor-exemplar-preservation?format=mdc","cursorrules":"/api/rules/opentelemetry-cardinality-governor-exemplar-preservation?format=cursor","windsurf":"/api/rules/opentelemetry-cardinality-governor-exemplar-preservation?format=windsurf","agents":"/api/rules/opentelemetry-cardinality-governor-exemplar-preservation?format=agents"}},{"id":"svelte-5-deep-rune-async-mutation-boundary","title":"Svelte 5 Deep Rune Reactive Graph Mutation Boundary Enforcement","category":"frontend","severity":"critical","description":"Enforces strict boundaries around Svelte 5 deep reactive proxies ($state) across asynchronous microtask schedules. Prohibits incremental deep object mutations interspersed with 'await' boundaries to eliminate reactive graph desynchronization, infinite effect loops, and partial UI state tearing.","antiPatternHeadline":"Asynchronous Deep Proxy Mutation across Microtask Boundaries without Snapshot Isolation","stars_count":67,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","reactivity","state-management"],"exportEndpoints":{"claude":"/api/rules/svelte-5-deep-rune-async-mutation-boundary?format=claude","cursorMdc":"/api/rules/svelte-5-deep-rune-async-mutation-boundary?format=mdc","cursorrules":"/api/rules/svelte-5-deep-rune-async-mutation-boundary?format=cursor","windsurf":"/api/rules/svelte-5-deep-rune-async-mutation-boundary?format=windsurf","agents":"/api/rules/svelte-5-deep-rune-async-mutation-boundary?format=agents"}},{"id":"nextjs-15-server-actions-crypto-taint-boundary","title":"Next.js 15 Server Actions Cryptographic Token & Tainted Record Boundary","category":"frontend","severity":"critical","description":"Enforces strict cryptographic verification of Server Action payloads and guarantees zero data leakage across the React Flight boundary using React 19 taint APIs. Prevents client-side parameter tampering on server actions and accidental serialization of server-only secrets into React Server Component (RSC) streams.","antiPatternHeadline":"Trusting unverified client-supplied identifiers in Server Actions and serializing raw database/secret objects across the Flight RPC boundary","stars_count":104,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs","server-actions","react-19","security","cryptography"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-server-actions-crypto-taint-boundary?format=claude","cursorMdc":"/api/rules/nextjs-15-server-actions-crypto-taint-boundary?format=mdc","cursorrules":"/api/rules/nextjs-15-server-actions-crypto-taint-boundary?format=cursor","windsurf":"/api/rules/nextjs-15-server-actions-crypto-taint-boundary?format=windsurf","agents":"/api/rules/nextjs-15-server-actions-crypto-taint-boundary?format=agents"}},{"id":"tauri-v2-multi-webview-ipc-acl-guardrail","title":"Tauri 2.0 Multi-WebView Scoped IPC Capability ACL Guardrail","category":"mobile","severity":"critical","description":"Enforces strict principle-of-least-privilege IPC channel boundaries across independent mobile WebViews in Tauri 2.0. Prevents auxiliary, modal, or untrusted WebViews from inheriting ambient native capabilities like filesystem, biometric authentication, and deep-link handling via indiscriminate wildcard ACL bindings.","antiPatternHeadline":"Assigning global wildcard capabilities across all WebViews, permitting unprivileged mobile WebViews to execute privileged native IPC commands","stars_count":107,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri-2","ipc-security","acl-capabilities","multi-webview","least-privilege"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-multi-webview-ipc-acl-guardrail?format=claude","cursorMdc":"/api/rules/tauri-v2-multi-webview-ipc-acl-guardrail?format=mdc","cursorrules":"/api/rules/tauri-v2-multi-webview-ipc-acl-guardrail?format=cursor","windsurf":"/api/rules/tauri-v2-multi-webview-ipc-acl-guardrail?format=windsurf","agents":"/api/rules/tauri-v2-multi-webview-ipc-acl-guardrail?format=agents"}},{"id":"pg17-parallel-apply-deterministic-conflict-resolution","title":"Postgres 17 Logical Replication Parallel Apply Deterministic Conflict Resolution Invariant","category":"backend","severity":"critical","description":"Enforces strict monotonic commit-timestamp sequencing and canonical key-ordered locking across transactional mutations replicated via PostgreSQL 17 parallel apply workers. Guarantees deterministic convergence and eliminates distributed cross-worker deadlocks in active-active topologies.","antiPatternHeadline":"Unordered Mutations and Non-Monotonic Clocks Inducing Parallel Apply Worker Deadlocks and Silent Replica Divergence","stars_count":93,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql-17","logical-replication","parallel-apply","concurrency","distributed-systems"],"exportEndpoints":{"claude":"/api/rules/pg17-parallel-apply-deterministic-conflict-resolution?format=claude","cursorMdc":"/api/rules/pg17-parallel-apply-deterministic-conflict-resolution?format=mdc","cursorrules":"/api/rules/pg17-parallel-apply-deterministic-conflict-resolution?format=cursor","windsurf":"/api/rules/pg17-parallel-apply-deterministic-conflict-resolution?format=windsurf","agents":"/api/rules/pg17-parallel-apply-deterministic-conflict-resolution?format=agents"}},{"id":"go-http3-quic-migration-stateless-reset-invariant","title":"Go HTTP/3 QUIC Connection Migration & Stateless Reset Token Determinism Standard","category":"backend","severity":"critical","description":"Enforces deterministic Stateless Reset Token generation and synchronized Connection ID routing across Go HTTP/3 QUIC servers. Guarantees multiplexed stream resilience and mitigates off-path connection hijacking and silent transport desynchronization during mobile cell-to-Wi-Fi handovers.","antiPatternHeadline":"Ephemeral per-instance reset keys and uncoordinated Connection IDs causing silent stream termination and hijack vulnerabilities during client IP migration.","stars_count":98,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","quic","http3","connection-migration","stateless-reset","rfc9000"],"exportEndpoints":{"claude":"/api/rules/go-http3-quic-migration-stateless-reset-invariant?format=claude","cursorMdc":"/api/rules/go-http3-quic-migration-stateless-reset-invariant?format=mdc","cursorrules":"/api/rules/go-http3-quic-migration-stateless-reset-invariant?format=cursor","windsurf":"/api/rules/go-http3-quic-migration-stateless-reset-invariant?format=windsurf","agents":"/api/rules/go-http3-quic-migration-stateless-reset-invariant?format=agents"}},{"id":"webauthn-prf-client-key-derivation-guardrail-webauthn-prf-ext-507","title":"WebAuthn PRF Extension Client-Side Key Derivation and Zero-Knowledge Isolation","category":"security","severity":"critical","description":"Enforces zero-knowledge client-side encryption key derivation using the WebAuthn Level 3 PRF (HMAC-Secret) extension directly inside hardware-backed authenticators. Guarantees that raw PRF outputs and derived symmetric encryption keys never traverse the network, bypass browser cryptographic memory boundaries, or touch relying party application servers.","antiPatternHeadline":"Exposing Raw Authenticator PRF Outputs or Delegating Symmetric Key Derivation to Server Runtimes","stars_count":85,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","prf-extension","zero-knowledge","cryptography","subtle-crypto","passkeys"],"exportEndpoints":{"claude":"/api/rules/webauthn-prf-client-key-derivation-guardrail-webauthn-prf-ext-507?format=claude","cursorMdc":"/api/rules/webauthn-prf-client-key-derivation-guardrail-webauthn-prf-ext-507?format=mdc","cursorrules":"/api/rules/webauthn-prf-client-key-derivation-guardrail-webauthn-prf-ext-507?format=cursor","windsurf":"/api/rules/webauthn-prf-client-key-derivation-guardrail-webauthn-prf-ext-507?format=windsurf","agents":"/api/rules/webauthn-prf-client-key-derivation-guardrail-webauthn-prf-ext-507?format=agents"}},{"id":"openfga-cdc-outbox-strict-tuple-serialization","title":"OpenFGA CDC Outbox Strict Tuple Serialization Pipeline Standard","category":"security","severity":"critical","description":"Enforces dual-write prevention and guarantees absolute authorization state consistency between application databases and OpenFGA stores via a transactional outbox CDC pipeline. Prohibits direct dual-writing to OpenFGA API endpoints within application boundary business logic to prevent authorization drift under partial failure modes.","antiPatternHeadline":"Dual-Writing Authorization Tuples Directly to OpenFGA API Alongside Primary Database Transactions","stars_count":87,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","cdc","transactional-outbox","authorization","rebac"],"exportEndpoints":{"claude":"/api/rules/openfga-cdc-outbox-strict-tuple-serialization?format=claude","cursorMdc":"/api/rules/openfga-cdc-outbox-strict-tuple-serialization?format=mdc","cursorrules":"/api/rules/openfga-cdc-outbox-strict-tuple-serialization?format=cursor","windsurf":"/api/rules/openfga-cdc-outbox-strict-tuple-serialization?format=windsurf","agents":"/api/rules/openfga-cdc-outbox-strict-tuple-serialization?format=agents"}},{"id":"opentelemetry-exemplar-reservoir-quota-guardrail","title":"OpenTelemetry Tail-Based Exemplar Metric Reservoir Quota and Memory Bounding Guardrail","category":"devops","severity":"critical","description":"Enforces strict memory-bounding and reservoir quota limits on OpenTelemetry trace-to-metric exemplar retention. Prevents catastrophic distributed collector and agent out-of-memory (OOM) crashes by constraining exemplar allocation under high-cardinality traffic bursts.","antiPatternHeadline":"Unbounded Exemplar Allocation in Metric Aggregators Triggering Collector OOMs","stars_count":66,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","metrics","tracing","observability","reliability"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-exemplar-reservoir-quota-guardrail?format=claude","cursorMdc":"/api/rules/opentelemetry-exemplar-reservoir-quota-guardrail?format=mdc","cursorrules":"/api/rules/opentelemetry-exemplar-reservoir-quota-guardrail?format=cursor","windsurf":"/api/rules/opentelemetry-exemplar-reservoir-quota-guardrail?format=windsurf","agents":"/api/rules/opentelemetry-exemplar-reservoir-quota-guardrail?format=agents"}},{"id":"k8s-gateway-v1-2-gamma-mtls-san-validation","title":"Kubernetes Gateway API v1.2 Gamma Sidecarless Cross-Namespace mTLS SAN Validation Standard","category":"devops","severity":"critical","description":"Enforces zero-trust cryptographic workload identity verification across cross-namespace east-west service routing using Kubernetes Gateway API v1.2 Gamma specifications. Mandates explicit BackendTLSPolicy definitions with strict SPIFFE Subject Alternative Name (SAN) validation and ReferenceGrant controls to prevent identity spoofing without incurring per-pod sidecar latency overhead.","antiPatternHeadline":"Unvalidated Backend TLS and Wildcard SAN Matching in Cross-Namespace Gateway Mesh Routing","stars_count":100,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","kubernetes","gateway-api","gamma-mesh","mtls","zero-trust","spiffe","sidecarless"],"exportEndpoints":{"claude":"/api/rules/k8s-gateway-v1-2-gamma-mtls-san-validation?format=claude","cursorMdc":"/api/rules/k8s-gateway-v1-2-gamma-mtls-san-validation?format=mdc","cursorrules":"/api/rules/k8s-gateway-v1-2-gamma-mtls-san-validation?format=cursor","windsurf":"/api/rules/k8s-gateway-v1-2-gamma-mtls-san-validation?format=windsurf","agents":"/api/rules/k8s-gateway-v1-2-gamma-mtls-san-validation?format=agents"}},{"id":"svelte-5-signal-tree-teardown-and-boundary-isolation","title":"Svelte 5 Signal-Tree Teardown and Boundary Isolation Standard","category":"frontend","severity":"critical","description":"Mandates deterministic lifecycle cleanup and boundary isolation for deep reactive $state and $derived dependency graphs in Svelte 5. Prevents orphan signal nodes, retained subscriber closures, and micro-memory leaks during high-frequency telemetry streaming across dynamic route transitions.","antiPatternHeadline":"Leaking Signal Trees via Unbounded Global Subscriptions and Dangling Derived Effects During Route Transitions","stars_count":72,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","signals","memory-leaks","reactivity"],"exportEndpoints":{"claude":"/api/rules/svelte-5-signal-tree-teardown-and-boundary-isolation?format=claude","cursorMdc":"/api/rules/svelte-5-signal-tree-teardown-and-boundary-isolation?format=mdc","cursorrules":"/api/rules/svelte-5-signal-tree-teardown-and-boundary-isolation?format=cursor","windsurf":"/api/rules/svelte-5-signal-tree-teardown-and-boundary-isolation?format=windsurf","agents":"/api/rules/svelte-5-signal-tree-teardown-and-boundary-isolation?format=agents"}},{"id":"nextjs-15-cache-tag-distributed-idempotency","title":"Next.js 15 Distributed Cache-Tag Revalidation and Idempotency Guardrail","category":"frontend","severity":"critical","description":"Guarantees atomic, cross-region edge cache invalidation when invoking revalidateTag within Next.js 15 Server Actions. Enforces distributed idempotency locks and fencing tokens to prevent split-brain cache states, thundering herds, and stale-while-revalidate race conditions across multi-zone CDN deployments.","antiPatternHeadline":"Unfenced Server Action revalidateTag invocations causing cross-region split-brain cache contamination","stars_count":59,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs","cache-tag","server-actions","edge-computing","idempotency"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-cache-tag-distributed-idempotency?format=claude","cursorMdc":"/api/rules/nextjs-15-cache-tag-distributed-idempotency?format=mdc","cursorrules":"/api/rules/nextjs-15-cache-tag-distributed-idempotency?format=cursor","windsurf":"/api/rules/nextjs-15-cache-tag-distributed-idempotency?format=windsurf","agents":"/api/rules/nextjs-15-cache-tag-distributed-idempotency?format=agents"}},{"id":"vite-6-environment-api-runtime-scope-isolation","title":"Vite 6 Environment API Multi-Runtime Module Scope Boundary Enforcement","category":"frontend","severity":"critical","description":"Enforces strict isolation of module resolution graphs and global scope boundaries across Vite 6 client, edge worker, and Node.js SSR environments. Prevents cross-runtime polyfill pollution, leaking Node.js built-ins into Web Worker/Edge environments, and accidental cross-contamination of client bundles with SSR dependencies.","antiPatternHeadline":"Cross-Environment Module Graph Bleed and Ambient Global Polyfill Contamination","stars_count":85,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","vite-6","environment-api","ssr","edge-runtime","module-isolation"],"exportEndpoints":{"claude":"/api/rules/vite-6-environment-api-runtime-scope-isolation?format=claude","cursorMdc":"/api/rules/vite-6-environment-api-runtime-scope-isolation?format=mdc","cursorrules":"/api/rules/vite-6-environment-api-runtime-scope-isolation?format=cursor","windsurf":"/api/rules/vite-6-environment-api-runtime-scope-isolation?format=windsurf","agents":"/api/rules/vite-6-environment-api-runtime-scope-isolation?format=agents"}},{"id":"axum-hyper-v1-flow-control-backpressure","title":"Axum 0.8 & Hyper-v1 Flow-Control Window Backpressure Invariant","category":"backend","severity":"critical","description":"Mandates strict pull-based frame-level backpressure propagation across async stream transformers in Axum 0.8 and Hyper-v1 services. Precludes unbounded memory exhaustion and kernel page thrashing caused by decoupled producer-consumer rates when serving large payloads over flow-controlled HTTP/2 and HTTP/3 client downloads.","antiPatternHeadline":"Decoupled Async Channel Buffering and Eager Task Spawning Leading to Process OOM on Flow-Controlled HTTP/2 Streams","stars_count":69,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","hyper","backpressure","http2","memory-safety"],"exportEndpoints":{"claude":"/api/rules/axum-hyper-v1-flow-control-backpressure?format=claude","cursorMdc":"/api/rules/axum-hyper-v1-flow-control-backpressure?format=mdc","cursorrules":"/api/rules/axum-hyper-v1-flow-control-backpressure?format=cursor","windsurf":"/api/rules/axum-hyper-v1-flow-control-backpressure?format=windsurf","agents":"/api/rules/axum-hyper-v1-flow-control-backpressure?format=agents"}},{"id":"postgres-17-pgvector-hnsw-quantization-budget-standard","title":"Postgres 17 pgvector HNSW Memory Budget & Quantization Standard","category":"backend","severity":"critical","description":"Enforces deterministic memory budgets and halfvec/scalar quantization limits during Postgres 17 pgvector HNSW index builds. Mitigates fatal OS Out-Of-Memory (OOM) backend terminations, lock contention, and worker query execution stalls caused by unquantized high-dimensional vector graphs.","antiPatternHeadline":"Unbounded FP32 Vector HNSW Index Creation with Unconstrained Worker Memory Budgets","stars_count":90,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres","pgvector","hnsw","database-migration","memory-budget"],"exportEndpoints":{"claude":"/api/rules/postgres-17-pgvector-hnsw-quantization-budget-standard?format=claude","cursorMdc":"/api/rules/postgres-17-pgvector-hnsw-quantization-budget-standard?format=mdc","cursorrules":"/api/rules/postgres-17-pgvector-hnsw-quantization-budget-standard?format=cursor","windsurf":"/api/rules/postgres-17-pgvector-hnsw-quantization-budget-standard?format=windsurf","agents":"/api/rules/postgres-17-pgvector-hnsw-quantization-budget-standard?format=agents"}},{"id":"bun-websocket-backpressure-drainage-boundary","title":"Bun 1.2 Native WebSocket Backpressure & Drain Invariant","category":"backend","severity":"critical","description":"Mandates backpressure-aware socket drain monitoring and buffer watermarking on native Bun.serve WebSockets during high-throughput or bursty pub/sub workloads. Uncontrolled socket writes without buffer checks or drain lifecycle handlers lead to unbounded native memory accumulation and silent event-loop starvation.","antiPatternHeadline":"Fire-and-Forget WebSocket Broadcasts Lacking Buffer Inspection and Drain Callbacks","stars_count":73,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","websockets","backpressure","networking","concurrency"],"exportEndpoints":{"claude":"/api/rules/bun-websocket-backpressure-drainage-boundary?format=claude","cursorMdc":"/api/rules/bun-websocket-backpressure-drainage-boundary?format=mdc","cursorrules":"/api/rules/bun-websocket-backpressure-drainage-boundary?format=cursor","windsurf":"/api/rules/bun-websocket-backpressure-drainage-boundary?format=windsurf","agents":"/api/rules/bun-websocket-backpressure-drainage-boundary?format=agents"}},{"id":"kmp-native-coroutine-arc-bridge-invariant","title":"KMP Native Coroutine ARC Scope Bridging and Bidirectional Cancellation Guardrail","category":"mobile","severity":"critical","description":"Enforces deterministic memory deallocation and bidirectional cancellation when bridging Kotlin Multiplatform (KMP) Flows and CoroutineScopes into Swift Concurrency. Eliminates dangling native coroutine handles, cross-runtime ARC retain cycles, and silent thread pool exhaustion on iOS.","antiPatternHeadline":"Leaking KMP CoroutineJobs in Unstructured Swift Tasks with Implicit Strong ARC Self-Captures","stars_count":89,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","swift-concurrency","ios","coroutines","arc"],"exportEndpoints":{"claude":"/api/rules/kmp-native-coroutine-arc-bridge-invariant?format=claude","cursorMdc":"/api/rules/kmp-native-coroutine-arc-bridge-invariant?format=mdc","cursorrules":"/api/rules/kmp-native-coroutine-arc-bridge-invariant?format=cursor","windsurf":"/api/rules/kmp-native-coroutine-arc-bridge-invariant?format=windsurf","agents":"/api/rules/kmp-native-coroutine-arc-bridge-invariant?format=agents"}},{"id":"webauthn-l3-prf-hardware-key-derivation-invariant","title":"WebAuthn Level 3 PRF Extension Hardware Key-Derivation Invariant","category":"security","severity":"critical","description":"Enforces zero-knowledge client-side encryption key derivation via WebAuthn Level 3 PRF (Pseudo-Random Function) authenticator outputs. Guarantees raw hardware-derived cryptographic seeds are immediately imported as non-extractable Web Crypto handles, memory buffers are explicitly zeroized, and intermediate keying material is never serialized or transmitted across boundaries.","antiPatternHeadline":"Exposing, serializing, or retaining raw WebAuthn PRF output buffers instead of immediate non-extractable CryptoKey ingestion and memory wiping","stars_count":69,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","cryptography","prf-extension","zero-knowledge","webcrypto"],"exportEndpoints":{"claude":"/api/rules/webauthn-l3-prf-hardware-key-derivation-invariant?format=claude","cursorMdc":"/api/rules/webauthn-l3-prf-hardware-key-derivation-invariant?format=mdc","cursorrules":"/api/rules/webauthn-l3-prf-hardware-key-derivation-invariant?format=cursor","windsurf":"/api/rules/webauthn-l3-prf-hardware-key-derivation-invariant?format=windsurf","agents":"/api/rules/webauthn-l3-prf-hardware-key-derivation-invariant?format=agents"}},{"id":"ebpf-xdp-dynamic-conntrack-eviction-guardrail","title":"Deterministic Microsecond-Level Conntrack Eviction & Capacity Invariants for XDP","category":"devops","severity":"critical","description":"Guarantees deterministic microsecond-level map eviction and strict memory headroom for eBPF XDP connection tracking tables. Enforces inline bounded expiration, proactive watermark-triggered evictions, and SYN-proxy fallback mechanisms to eliminate packet drops under volumetric state-exhaustion DDoS attacks.","antiPatternHeadline":"Unbounded Hash Map Saturation with Userspace-Dependent Eviction and Unchecked BPF Map Insert Failures","stars_count":74,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","xdp","ddos-mitigation","networking","kernel","conntrack"],"exportEndpoints":{"claude":"/api/rules/ebpf-xdp-dynamic-conntrack-eviction-guardrail?format=claude","cursorMdc":"/api/rules/ebpf-xdp-dynamic-conntrack-eviction-guardrail?format=mdc","cursorrules":"/api/rules/ebpf-xdp-dynamic-conntrack-eviction-guardrail?format=cursor","windsurf":"/api/rules/ebpf-xdp-dynamic-conntrack-eviction-guardrail?format=windsurf","agents":"/api/rules/ebpf-xdp-dynamic-conntrack-eviction-guardrail?format=agents"}},{"id":"react-19-server-actions-optimistic-rollback-barrier","title":"React 19 Server Action Optimistic Rollback Barrier & Flight Hydration Integrity","category":"frontend","severity":"critical","description":"Enforces an atomic transaction barrier across React 19 Server Action invocations and optimistic UI reconciliations. Guarantees that rejected actions cleanly purge transient optimistic states without desynchronizing concurrent Flight stream RSC payloads or corrupting client-side fiber state.","antiPatternHeadline":"Leaking optimistic mutations to external state stores or unmanaged closures that poison concurrent RSC Flight stream hydration upon action rejection.","stars_count":89,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["react-19","server-actions","flight-stream","use-optimistic","use-action-state","rsc-hydration"],"exportEndpoints":{"claude":"/api/rules/react-19-server-actions-optimistic-rollback-barrier?format=claude","cursorMdc":"/api/rules/react-19-server-actions-optimistic-rollback-barrier?format=mdc","cursorrules":"/api/rules/react-19-server-actions-optimistic-rollback-barrier?format=cursor","windsurf":"/api/rules/react-19-server-actions-optimistic-rollback-barrier?format=windsurf","agents":"/api/rules/react-19-server-actions-optimistic-rollback-barrier?format=agents"}},{"id":"nextjs-15-ppr-dynamic-hole-hydration-standard","title":"Next.js 15 Partial Prerendering Dynamic Hole Hydration Standard","category":"frontend","severity":"critical","description":"Enforces strict isolation of dynamic runtime boundaries within Next.js 15 Partial Prerendering (PPR) architectures to eliminate client-side hydration race conditions and micro-waterfalls. Mandates deterministic Suspense fallback boundaries and restricts runtime dynamic APIs (cookies, headers, searchParams) exclusively to deferred Server Component leaves. Prevents distributed edge node execution mismatches during asynchronous chunk streaming.","antiPatternHeadline":"Dynamic State Bleed into Static Shells and Cascading Suspense Micro-Waterfalls in PPR","stars_count":82,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs15","partial-prerendering","hydration","react-server-components","suspense","streaming"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-ppr-dynamic-hole-hydration-standard?format=claude","cursorMdc":"/api/rules/nextjs-15-ppr-dynamic-hole-hydration-standard?format=mdc","cursorrules":"/api/rules/nextjs-15-ppr-dynamic-hole-hydration-standard?format=cursor","windsurf":"/api/rules/nextjs-15-ppr-dynamic-hole-hydration-standard?format=windsurf","agents":"/api/rules/nextjs-15-ppr-dynamic-hole-hydration-standard?format=agents"}},{"id":"bun-websocket-backpressure-tcp-drain-invariant","title":"Bun 1.2 Native WebSocket Backpressure and TCP Drain Invariant","category":"backend","severity":"critical","description":"Enforces deterministic backpressure handling in Bun 1.2 native WebSocket servers by evaluating the integer byte return value of `ws.send()`. Failure to inspect send results or handle socket buffer saturation causes silent, unbounded heap accumulation during high-fanout broadcasts, leading to catastrophic OOM termination under slow client conditions.","antiPatternHeadline":"Ignoring `ws.send()` return codes and lacking `drain()` handler causing silent unbounded queue buffering","stars_count":75,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","websockets","backpressure","memory-leak","tcp-drain"],"exportEndpoints":{"claude":"/api/rules/bun-websocket-backpressure-tcp-drain-invariant?format=claude","cursorMdc":"/api/rules/bun-websocket-backpressure-tcp-drain-invariant?format=mdc","cursorrules":"/api/rules/bun-websocket-backpressure-tcp-drain-invariant?format=cursor","windsurf":"/api/rules/bun-websocket-backpressure-tcp-drain-invariant?format=windsurf","agents":"/api/rules/bun-websocket-backpressure-tcp-drain-invariant?format=agents"}},{"id":"postgres-17-io-uring-concurrency-fencing","title":"Postgres 17 io_uring Direct I/O Concurrency Fencing & WAL Starvation Prevention","category":"backend","severity":"critical","description":"Enforces hard submission queue fencing and prioritized token-bucket concurrency controls for workloads targeting PostgreSQL 17 instances utilizing io_uring and Direct I/O. Unbounded concurrent async dispatch saturates kernel submission rings and worker threads, causing severe head-of-line blocking and sync latency spikes on critical WAL flush pipelines. Systems must isolate and prioritize transactional sync operations via bounded bulkheads with proactive backpressure.","antiPatternHeadline":"Unbounded Async Batch Writes Saturating io_uring Submission Rings and Starving WAL Flush Queues","stars_count":63,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres","io_uring","direct-io","wal-flush","concurrency-fencing","performance"],"exportEndpoints":{"claude":"/api/rules/postgres-17-io-uring-concurrency-fencing?format=claude","cursorMdc":"/api/rules/postgres-17-io-uring-concurrency-fencing?format=mdc","cursorrules":"/api/rules/postgres-17-io-uring-concurrency-fencing?format=cursor","windsurf":"/api/rules/postgres-17-io-uring-concurrency-fencing?format=windsurf","agents":"/api/rules/postgres-17-io-uring-concurrency-fencing?format=agents"}},{"id":"fastapi-async-generator-dependency-teardown-guardrail","title":"FastAPI Async Generator Dependency Teardown & Resource Leak Guardrail","category":"backend","severity":"critical","description":"Mandates strict try...finally boundaries and exception-safe teardown protocols across all FastAPI yield-based dependency injection providers. Prevents persistent database pool starvation and orphaned transactions caused by abrupt client disconnects, task cancellations, and unhandled downstream exceptions.","antiPatternHeadline":"Naive sequential execution around yield statements in async dependencies leaving pooled database connections orphaned upon client drop or mid-stream task cancellation.","stars_count":82,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["fastapi","python","asyncio","sqlalchemy","connection-pool","resource-management"],"exportEndpoints":{"claude":"/api/rules/fastapi-async-generator-dependency-teardown-guardrail?format=claude","cursorMdc":"/api/rules/fastapi-async-generator-dependency-teardown-guardrail?format=mdc","cursorrules":"/api/rules/fastapi-async-generator-dependency-teardown-guardrail?format=cursor","windsurf":"/api/rules/fastapi-async-generator-dependency-teardown-guardrail?format=windsurf","agents":"/api/rules/fastapi-async-generator-dependency-teardown-guardrail?format=agents"}},{"id":"webauthn-l3-device-bound-origin-verification-standard","title":"WebAuthn L3 Origin Binding and Cryptographic User-Verification Enforcement","category":"security","severity":"critical","description":"Enforces strict canonical origin resolution, relying party ID matching, and cryptographic user-verification (UV) flag evaluation during WebAuthn assertion and registration ceremonies. Eliminates cross-origin passkey relay, phishing-proxy forwards, and session-fixation attacks by mandating tamper-proof clientDataJSON parsing and authenticatorData bit-flag checks against unforgeable server state.","antiPatternHeadline":"Accepting Loose Origins or Missing Bit-Level User Verification Flags in WebAuthn Assertions","stars_count":65,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","fido2","passkeys","cryptography","zero-trust"],"exportEndpoints":{"claude":"/api/rules/webauthn-l3-device-bound-origin-verification-standard?format=claude","cursorMdc":"/api/rules/webauthn-l3-device-bound-origin-verification-standard?format=mdc","cursorrules":"/api/rules/webauthn-l3-device-bound-origin-verification-standard?format=cursor","windsurf":"/api/rules/webauthn-l3-device-bound-origin-verification-standard?format=windsurf","agents":"/api/rules/webauthn-l3-device-bound-origin-verification-standard?format=agents"}},{"id":"spiffe-spire-svid-hot-reload-invariant","title":"SPIFFE/SPIRE Ephemeral X.509 SVID Dynamic Hot-Reload Invariant","category":"security","severity":"critical","description":"Short-lived X.509 SVIDs issued by SPIFFE/SPIRE expire rapidly (e.g., minutes to hours) to constrain credential exposure. Workload runtimes and proxy sidecars must dynamically consume SPIFFE Workload API updates and hot-reload in-memory TLS contexts without restarting processes, re-binding sockets, or terminating active long-lived TCP/mTLS sessions.","antiPatternHeadline":"Static TLS Context Initialization and Process Restarts on SVID Expiry","stars_count":97,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","spiffe","spire","zero-trust","mtls","tls-rotation","resilience"],"exportEndpoints":{"claude":"/api/rules/spiffe-spire-svid-hot-reload-invariant?format=claude","cursorMdc":"/api/rules/spiffe-spire-svid-hot-reload-invariant?format=mdc","cursorrules":"/api/rules/spiffe-spire-svid-hot-reload-invariant?format=cursor","windsurf":"/api/rules/spiffe-spire-svid-hot-reload-invariant?format=windsurf","agents":"/api/rules/spiffe-spire-svid-hot-reload-invariant?format=agents"}},{"id":"opentelemetry-otlp-ring-buffer-circuit-breaker","title":"Bounded Ring-Buffer and Circuit-Breaker Guardrails for OTLP Telemetry Pipelines","category":"devops","severity":"critical","description":"Enforces strict memory-bounded ring buffers and circuit-breaker drop mechanics on all OpenTelemetry OTLP metric and trace export pipelines. Ensures that downstream collector unavailability or network degradation sheds telemetry load immediately rather than inducing heap exhaustion or blocking the application event loop. Guarantees the primary invariant that observability infrastructure must never compromise system availability.","antiPatternHeadline":"Unbounded Telemetry Buffering Causing Heap Exhaustion and Microservice Brownouts","stars_count":87,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","circuit-breaker","backpressure","resilience","performance"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-otlp-ring-buffer-circuit-breaker?format=claude","cursorMdc":"/api/rules/opentelemetry-otlp-ring-buffer-circuit-breaker?format=mdc","cursorrules":"/api/rules/opentelemetry-otlp-ring-buffer-circuit-breaker?format=cursor","windsurf":"/api/rules/opentelemetry-otlp-ring-buffer-circuit-breaker?format=windsurf","agents":"/api/rules/opentelemetry-otlp-ring-buffer-circuit-breaker?format=agents"}},{"id":"cilium-ebpf-host-routing-mtu-path-discovery-guardrail","title":"Cilium eBPF Host-Routing MTU & Path Discovery Production Guardrail","category":"devops","severity":"critical","description":"Enforces strict interface MTU calculation, MSS clamping, and explicit ICMP Type 3 Code 4 handling across Cilium eBPF host-routing configurations. Eliminates silent blackholing, packet drops, and path fragmentation induced by Geneve/VXLAN overlay encapsulation and Direct Server Return (DSR) headers in high-throughput node topologies. Prevents asymmetric bypass of the Linux TCP/IP stack where eBPF drops Path MTU Discovery (PMTUD) signaling.","antiPatternHeadline":"Silent Overlay Packet Blackholing via Unadjusted Native MTU and Broken eBPF PMTUD","stars_count":67,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","cilium","ebpf","kubernetes","networking","mtu","pmtud"],"exportEndpoints":{"claude":"/api/rules/cilium-ebpf-host-routing-mtu-path-discovery-guardrail?format=claude","cursorMdc":"/api/rules/cilium-ebpf-host-routing-mtu-path-discovery-guardrail?format=mdc","cursorrules":"/api/rules/cilium-ebpf-host-routing-mtu-path-discovery-guardrail?format=cursor","windsurf":"/api/rules/cilium-ebpf-host-routing-mtu-path-discovery-guardrail?format=windsurf","agents":"/api/rules/cilium-ebpf-host-routing-mtu-path-discovery-guardrail?format=agents"}},{"id":"tauri2-multi-webview-sandbox-partitioning","title":"Tauri 2.0 Dynamic Webview Origin-Scoped IPC Capability Partitioning","category":"mobile","severity":"critical","description":"Enforces strict origin-scoped permission capabilities and label-based isolation across dynamic secondary webviews in Tauri 2.0 mobile and desktop applications. Prevents auxiliary frames and untrusted webview instances from inheriting root IPC command privileges, mitigating lateral privilege escalation via compromised dynamic contexts.","antiPatternHeadline":"Assigning global wildcard capabilities or inheriting root IPC privileges in secondary webview instances","stars_count":83,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri-2","security","ipc","sandboxing","permissions"],"exportEndpoints":{"claude":"/api/rules/tauri2-multi-webview-sandbox-partitioning?format=claude","cursorMdc":"/api/rules/tauri2-multi-webview-sandbox-partitioning?format=mdc","cursorrules":"/api/rules/tauri2-multi-webview-sandbox-partitioning?format=cursor","windsurf":"/api/rules/tauri2-multi-webview-sandbox-partitioning?format=windsurf","agents":"/api/rules/tauri2-multi-webview-sandbox-partitioning?format=agents"}},{"id":"react-19-use-optimistic-concurrent-rollback-invariant","title":"React 19 useOptimistic Concurrent Action Rollback Invariant","category":"frontend","severity":"critical","description":"Guarantees deterministic client-server state convergence during interleaved asynchronous Server Actions and concurrent transitions. Enforces strict derivation of optimistic state from canonical action state, preventing UI flashes, torn states, and unhandled race conditions during network failures or out-of-order action resolution.","antiPatternHeadline":"Imperative Client State Syncing and Disjointed Transitions Breaking useOptimistic Rollback Guarantees","stars_count":78,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react19","useOptimistic","server-actions","concurrency","transitions"],"exportEndpoints":{"claude":"/api/rules/react-19-use-optimistic-concurrent-rollback-invariant?format=claude","cursorMdc":"/api/rules/react-19-use-optimistic-concurrent-rollback-invariant?format=mdc","cursorrules":"/api/rules/react-19-use-optimistic-concurrent-rollback-invariant?format=cursor","windsurf":"/api/rules/react-19-use-optimistic-concurrent-rollback-invariant?format=windsurf","agents":"/api/rules/react-19-use-optimistic-concurrent-rollback-invariant?format=agents"}},{"id":"axum-tokio-task-cancellation-drain-standard","title":"Axum 0.8 Tokio Cooperative Task Cancellation & Drain Standard","category":"backend","severity":"critical","description":"Enforces structured task lifecycles and cooperative cancellation trees using Tokio and Axum 0.8 during rolling deployments. Guarantees inflight HTTP request completion, orderly background task draining, and prevention of database pool exhaustion caused by abruptly dropped futures.","antiPatternHeadline":"Unbounded detached task spawning and abrupt signal termination causing orphaned transactions and pool starvation","stars_count":104,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tokio","concurrency","graceful-shutdown"],"exportEndpoints":{"claude":"/api/rules/axum-tokio-task-cancellation-drain-standard?format=claude","cursorMdc":"/api/rules/axum-tokio-task-cancellation-drain-standard?format=mdc","cursorrules":"/api/rules/axum-tokio-task-cancellation-drain-standard?format=cursor","windsurf":"/api/rules/axum-tokio-task-cancellation-drain-standard?format=windsurf","agents":"/api/rules/axum-tokio-task-cancellation-drain-standard?format=agents"}},{"id":"bun-websocket-kernel-backpressure-throttling","title":"Bun 1.2 WebSocket Kernel Backpressure Throttling Invariant","category":"backend","severity":"critical","description":"Enforces strict handling of native socket buffer backpressure in Bun 1.2 real-time WebSocket gateways. Mandates checking ws.getBufferedAmount() and the return code of ws.send(), pausing upstream producers, and utilizing the drain(ws) lifecycle callback to prevent unmanaged C++ heap allocation and silent container OOM crashes.","antiPatternHeadline":"Unchecked Fire-and-Forget ws.send() Causing Unbounded Native Memory Bloat and OOM Kills","stars_count":46,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","websockets","backpressure","memory-leaks","zero-copy"],"exportEndpoints":{"claude":"/api/rules/bun-websocket-kernel-backpressure-throttling?format=claude","cursorMdc":"/api/rules/bun-websocket-kernel-backpressure-throttling?format=mdc","cursorrules":"/api/rules/bun-websocket-kernel-backpressure-throttling?format=cursor","windsurf":"/api/rules/bun-websocket-kernel-backpressure-throttling?format=windsurf","agents":"/api/rules/bun-websocket-kernel-backpressure-throttling?format=agents"}},{"id":"kmp-compose-skiko-metal-surface-disposal-guardrail","title":"KMP Compose Skiko Metal Surface Lifecycle & Native GPU Buffer Disposal","category":"mobile","severity":"critical","description":"Enforces deterministic teardown of CAMetalLayer render surfaces and Skiko rendering contexts during iOS navigation transitions. Prevents unmanaged native GPU memory accumulation, command buffer starvation, and rapid Jetsam terminations caused by dangling ComposeUIViewController references in shared Kotlin UI runtimes.","antiPatternHeadline":"Retaining CAMetalLayer Buffers and Skiko Render Loops Across iOS Navigation Transitions","stars_count":47,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kmp","compose-multiplatform","skiko","metal","ios","memory-leak"],"exportEndpoints":{"claude":"/api/rules/kmp-compose-skiko-metal-surface-disposal-guardrail?format=claude","cursorMdc":"/api/rules/kmp-compose-skiko-metal-surface-disposal-guardrail?format=mdc","cursorrules":"/api/rules/kmp-compose-skiko-metal-surface-disposal-guardrail?format=cursor","windsurf":"/api/rules/kmp-compose-skiko-metal-surface-disposal-guardrail?format=windsurf","agents":"/api/rules/kmp-compose-skiko-metal-surface-disposal-guardrail?format=agents"}},{"id":"capacitor-7-verified-app-links-cryptographic-attestation","title":"Capacitor 7 Verified App Links Cryptographic Attestation Invariant","category":"mobile","severity":"critical","description":"Enforces strict origin verification and cryptographic domain attestation for deep links ingested via Capacitor 7 before delegating control to the embedded WebView router. Prevents cross-app intent spoofing, parameter tampering, and state injection attacks caused by untrusted custom URL schemes or unverified Android App Links and iOS Universal Links.","antiPatternHeadline":"Blind Ingestion of Deep-Link Payloads and State Hydration via Unverified Custom Schemes","stars_count":119,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","security","deep-links","app-links","universal-links"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-verified-app-links-cryptographic-attestation?format=claude","cursorMdc":"/api/rules/capacitor-7-verified-app-links-cryptographic-attestation?format=mdc","cursorrules":"/api/rules/capacitor-7-verified-app-links-cryptographic-attestation?format=cursor","windsurf":"/api/rules/capacitor-7-verified-app-links-cryptographic-attestation?format=windsurf","agents":"/api/rules/capacitor-7-verified-app-links-cryptographic-attestation?format=agents"}},{"id":"wasi-p2-capability-sandbox-boundary","title":"Strict Capability-Based Sandboxing for WASI 0.2 Guest Component Boundaries","category":"security","severity":"critical","description":"Enforces strict capability-based least privilege and resource confinement when executing untrusted third-party plug-ins under the WebAssembly System Interface (WASI 0.2 / Preview 2) Component Model. Mandates explicit world link-time imports, ambient authority eradication, and cryptographically verified component signatures prior to instantiating host runtimes.","antiPatternHeadline":"Ambient Host Authority Leakage and Unbounded Resource Exposure in Guest WASI Runtimes","stars_count":90,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webassembly","wasi-0.2","component-model","wasmtime","sandbox"],"exportEndpoints":{"claude":"/api/rules/wasi-p2-capability-sandbox-boundary?format=claude","cursorMdc":"/api/rules/wasi-p2-capability-sandbox-boundary?format=mdc","cursorrules":"/api/rules/wasi-p2-capability-sandbox-boundary?format=cursor","windsurf":"/api/rules/wasi-p2-capability-sandbox-boundary?format=windsurf","agents":"/api/rules/wasi-p2-capability-sandbox-boundary?format=agents"}},{"id":"cosign-slsa3-ephemeral-workload-identity-attestation-standard","title":"Sigstore Cosign SLSA L3 Ephemeral Workload Identity and Attestation Standard","category":"security","severity":"critical","description":"Guarantees SLSA Level 3 supply chain integrity by mandating keyless, OIDC-federated ephemeral certificate signing via Sigstore Fulcio and immutable auditability via Rekor transparency log inclusion. Prohibits static, long-lived cryptographic keys and mutable image tags across all production build and deployment pipelines. Mandates admission-time verification of cryptographic provenance attestations and workload identity Subject Alternative Names (SAN).","antiPatternHeadline":"Signing Mutable Container Tags with Long-Lived Static Private Keys Without Rekor Transparency Logging or SLSA Provenance Verification","stars_count":52,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","sigstore","cosign","slsa-l3","supply-chain","attestation","oidc"],"exportEndpoints":{"claude":"/api/rules/cosign-slsa3-ephemeral-workload-identity-attestation-standard?format=claude","cursorMdc":"/api/rules/cosign-slsa3-ephemeral-workload-identity-attestation-standard?format=mdc","cursorrules":"/api/rules/cosign-slsa3-ephemeral-workload-identity-attestation-standard?format=cursor","windsurf":"/api/rules/cosign-slsa3-ephemeral-workload-identity-attestation-standard?format=windsurf","agents":"/api/rules/cosign-slsa3-ephemeral-workload-identity-attestation-standard?format=agents"}},{"id":"ebpf-cilium-xdp-wireguard-egress-guardrail","title":"Hardware-Accelerated eBPF Cilium XDP WireGuard Transit Encryption Standard","category":"devops","severity":"critical","description":"Enforces deterministic, hardware-accelerated pod-to-pod WireGuard transit encryption executed directly within the native NIC XDP (eXpress Data Path) hook before SKB (socket buffer) allocation in the Linux network stack. Prevents unencrypted packet leakage, kernel context-switch latency penalties, and fallbacks to user-space network queuing for sensitive inter-node workloads.","antiPatternHeadline":"Bypassing Native Driver XDP Hooks Resulting in SKB Allocation, Kernel Stack Context Switching, or Plaintext Egress Leakage","stars_count":80,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","cilium","xdp","wireguard","kernel","networking","security"],"exportEndpoints":{"claude":"/api/rules/ebpf-cilium-xdp-wireguard-egress-guardrail?format=claude","cursorMdc":"/api/rules/ebpf-cilium-xdp-wireguard-egress-guardrail?format=mdc","cursorrules":"/api/rules/ebpf-cilium-xdp-wireguard-egress-guardrail?format=cursor","windsurf":"/api/rules/ebpf-cilium-xdp-wireguard-egress-guardrail?format=windsurf","agents":"/api/rules/ebpf-cilium-xdp-wireguard-egress-guardrail?format=agents"}},{"id":"otel-spanmetrics-exemplar-reservoir-sampling-standard","title":"OpenTelemetry Spanmetrics Exemplar Reservoir and Bucket Anchoring Standard","category":"devops","severity":"critical","description":"Enforces deterministic latency histogram binning with OpenTelemetry exemplar reservoir sampling instead of promoting trace identifiers to metric labels. This guarantees high-percentile (p95/p99) latency spike trace root-cause attribution without risking downstream TSDB (Prometheus, Mimir, Cortex) time-series cardinality collapse.","antiPatternHeadline":"Promoting Trace and Span IDs to Metric Dimensions Causing TSDB OOM and Cardinality Explosion","stars_count":45,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","observability","prometheus","spanmetrics","exemplars"],"exportEndpoints":{"claude":"/api/rules/otel-spanmetrics-exemplar-reservoir-sampling-standard?format=claude","cursorMdc":"/api/rules/otel-spanmetrics-exemplar-reservoir-sampling-standard?format=mdc","cursorrules":"/api/rules/otel-spanmetrics-exemplar-reservoir-sampling-standard?format=cursor","windsurf":"/api/rules/otel-spanmetrics-exemplar-reservoir-sampling-standard?format=windsurf","agents":"/api/rules/otel-spanmetrics-exemplar-reservoir-sampling-standard?format=agents"}},{"id":"svelte-5-signal-graph-disposal-standard","title":"Svelte 5 Runes Signal Graph Disposal Standard","category":"frontend","severity":"critical","description":"Enforces strict lifecycle-bound cleanup for Svelte 5 runes effects and untracked external event subscriptions within high-frequency client transitions. Prevents detached component DOM subtrees from retaining stale reactive dependencies and inducing catastrophic memory leaks across SPA navigation cycles.","antiPatternHeadline":"Escaping Effect Roots and Uncleaned External Event Listeners Retaining Detached Svelte 5 Signal Subgraphs","stars_count":79,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","reactivity","memory-management","performance"],"exportEndpoints":{"claude":"/api/rules/svelte-5-signal-graph-disposal-standard?format=claude","cursorMdc":"/api/rules/svelte-5-signal-graph-disposal-standard?format=mdc","cursorrules":"/api/rules/svelte-5-signal-graph-disposal-standard?format=cursor","windsurf":"/api/rules/svelte-5-signal-graph-disposal-standard?format=windsurf","agents":"/api/rules/svelte-5-signal-graph-disposal-standard?format=agents"}},{"id":"vite6-environment-api-ssr-sandboxing-isolation","title":"Vite 6 Environment API: Deterministic Isomorphic SSR Sandboxing & Boundary Isolation","category":"frontend","severity":"critical","description":"Enforces deterministic runtime isolation boundaries across SSR execution targets using the Vite 6 Environment API and decoupled Module Runners. Eliminates cross-realm global contamination between client, Node.js, and edge targets by disallowing host global mutation and preventing cross-environment module graph leakage.","antiPatternHeadline":"Mutating Host Globals and Using Legacy ssrLoadModule Across Heterogeneous Runtime Environments","stars_count":48,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","vite6","ssr","environment-api","sandboxing","isomorphic-architecture"],"exportEndpoints":{"claude":"/api/rules/vite6-environment-api-ssr-sandboxing-isolation?format=claude","cursorMdc":"/api/rules/vite6-environment-api-ssr-sandboxing-isolation?format=mdc","cursorrules":"/api/rules/vite6-environment-api-ssr-sandboxing-isolation?format=cursor","windsurf":"/api/rules/vite6-environment-api-ssr-sandboxing-isolation?format=windsurf","agents":"/api/rules/vite6-environment-api-ssr-sandboxing-isolation?format=agents"}},{"id":"pg17-logical-replication-slot-sync-invariant","title":"Postgres 17 Failover Slot Synchronization and Zero-Divergence CDC Invariant","category":"backend","severity":"critical","description":"Enforces failover-safe logical replication slot synchronization introduced in PostgreSQL 17 for transactional outbox CDC consumers. Mandates `failover = true` on primary logical slots, `sync_replication_slots = true` on physical standbys, and explicit standby validation in `synchronized_standby_slots` to guarantee zero-event divergence and prevent data loss during physical standby promotion.","antiPatternHeadline":"Creating unmanaged logical replication slots without failover sync or primary standby acknowledgment checks.","stars_count":72,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","cdc","replication","outbox-pattern","distributed-systems"],"exportEndpoints":{"claude":"/api/rules/pg17-logical-replication-slot-sync-invariant?format=claude","cursorMdc":"/api/rules/pg17-logical-replication-slot-sync-invariant?format=mdc","cursorrules":"/api/rules/pg17-logical-replication-slot-sync-invariant?format=cursor","windsurf":"/api/rules/pg17-logical-replication-slot-sync-invariant?format=windsurf","agents":"/api/rules/pg17-logical-replication-slot-sync-invariant?format=agents"}},{"id":"axum-tower-graceful-drain-stream-invariants","title":"Axum Tower Phase-Aligned Stream Draining & Graceful Backpressure Invariant","category":"backend","severity":"critical","description":"Guarantees that Axum and Tower streaming endpoints (SSE, WebSockets, WebTransport) enforce phased, cooperative connection draining during pod lifecycle termination. Prevents connection resets, unbuffered drops, and indefinite rollout stalls by bounding drain phases with cancellation tokens and task tracking.","antiPatternHeadline":"Uncoordinated Axum Graceful Shutdown Causing Abrupt SSE/WebSocket Dropping or Indefinite Pod Termination Deadlocks","stars_count":104,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tower","graceful-shutdown","tokio","sse","webtransport"],"exportEndpoints":{"claude":"/api/rules/axum-tower-graceful-drain-stream-invariants?format=claude","cursorMdc":"/api/rules/axum-tower-graceful-drain-stream-invariants?format=mdc","cursorrules":"/api/rules/axum-tower-graceful-drain-stream-invariants?format=cursor","windsurf":"/api/rules/axum-tower-graceful-drain-stream-invariants?format=windsurf","agents":"/api/rules/axum-tower-graceful-drain-stream-invariants?format=agents"}},{"id":"bun-so-reuseport-cluster-handoff-standard","title":"Bun 1.2 SO_REUSEPORT Cluster Socket Handoff & Zero-Downtime Handoff Standard","category":"backend","severity":"critical","description":"Enforces deterministic Linux SO_REUSEPORT socket sharing and atomic worker handoff across Bun cluster workers under high-throughput TCP and HTTP workloads. Guarantees zero-packet drops (SYN drop avoidance) during blue-green worker recycling by synchronizing kernel listen queues, drain states, and parent-worker IPC handoffs.","antiPatternHeadline":"Naive SIGTERM Cluster Recycling Causing Silent TCP SYN/RST Drops and Kernel Listen Queue Corruption","stars_count":103,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","networking","concurrency","clustering","so-reuseport","high-performance"],"exportEndpoints":{"claude":"/api/rules/bun-so-reuseport-cluster-handoff-standard?format=claude","cursorMdc":"/api/rules/bun-so-reuseport-cluster-handoff-standard?format=mdc","cursorrules":"/api/rules/bun-so-reuseport-cluster-handoff-standard?format=cursor","windsurf":"/api/rules/bun-so-reuseport-cluster-handoff-standard?format=windsurf","agents":"/api/rules/bun-so-reuseport-cluster-handoff-standard?format=agents"}},{"id":"kmp-swift-export-weak-reference-bridging","title":"Kotlin Multiplatform Swift Export Weak-Reference Bridging & Retain Cycle Elimination","category":"mobile","severity":"critical","description":"Defines strict architectural boundaries between Apple Automatic Reference Counting (ARC) and Kotlin Garbage Collection (GC) runtimes across Swift Export. Eliminates cross-runtime bidirectional retain cycles and non-deterministic native deallocation by mandating weak-reference wrappers, explicit lifecycle unbinding, and decoupled observer interfaces.","antiPatternHeadline":"Bidirectional Hard References Between Swift Closures/Delegates and Kotlin GC Objects Inducing Native-to-GC Retain Cycles and Memory Leaks","stars_count":95,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","swift","ios","arc","memory-management","swift-export"],"exportEndpoints":{"claude":"/api/rules/kmp-swift-export-weak-reference-bridging?format=claude","cursorMdc":"/api/rules/kmp-swift-export-weak-reference-bridging?format=mdc","cursorrules":"/api/rules/kmp-swift-export-weak-reference-bridging?format=cursor","windsurf":"/api/rules/kmp-swift-export-weak-reference-bridging?format=windsurf","agents":"/api/rules/kmp-swift-export-weak-reference-bridging?format=agents"}},{"id":"tauri2-zero-copy-sharedbuffer-ipc-transfer","title":"Tauri 2.0 Zero-Copy SharedBuffer IPC Transfer Standard","category":"mobile","severity":"critical","description":"Enforces direct typed array binary streaming over Tauri 2.0 IPC channels, bypassing JSON/base64 serialization on Android and iOS webviews. Prevents main-thread UI stutters, garbage collector thrashing, and memory spikes when transporting high-frequency sensor streams and multimedia frames from Rust to JavaScript.","antiPatternHeadline":"Base64 or JSON-Array Serialization of High-Frequency Binary Streams Over Tauri IPC","stars_count":95,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri","rust","ipc","zero-copy","performance"],"exportEndpoints":{"claude":"/api/rules/tauri2-zero-copy-sharedbuffer-ipc-transfer?format=claude","cursorMdc":"/api/rules/tauri2-zero-copy-sharedbuffer-ipc-transfer?format=mdc","cursorrules":"/api/rules/tauri2-zero-copy-sharedbuffer-ipc-transfer?format=cursor","windsurf":"/api/rules/tauri2-zero-copy-sharedbuffer-ipc-transfer?format=windsurf","agents":"/api/rules/tauri2-zero-copy-sharedbuffer-ipc-transfer?format=agents"}},{"id":"webauthn-device-bound-passkey-escalation-boundary","title":"Hardware-Attested Device-Bound Passkey Enforcement for Step-Up Authorization","category":"security","severity":"critical","description":"Enforces cryptographic isolation between multi-device cloud-synced passkeys and high-risk step-up authorization flows. Mandates verification of WebAuthn Level 3 authenticator data flags (Backup Eligibility and Backup State) and hardware-backed Secure Enclave attestation before authorizing privileged operations such as wire transfers and administrative role escalations.","antiPatternHeadline":"Permitting Multi-Device Synced Passkeys to Sign High-Risk Step-Up Actions Without Hardware Boundary Attestation","stars_count":60,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","passkeys","cryptography","fido2","zero-trust"],"exportEndpoints":{"claude":"/api/rules/webauthn-device-bound-passkey-escalation-boundary?format=claude","cursorMdc":"/api/rules/webauthn-device-bound-passkey-escalation-boundary?format=mdc","cursorrules":"/api/rules/webauthn-device-bound-passkey-escalation-boundary?format=cursor","windsurf":"/api/rules/webauthn-device-bound-passkey-escalation-boundary?format=windsurf","agents":"/api/rules/webauthn-device-bound-passkey-escalation-boundary?format=agents"}},{"id":"lsm-bpf-runtime-binary-integrity-gate","title":"Linux Kernel LSM BPF Dynamic Binary and Memory Immutability Gate","category":"security","severity":"critical","description":"Enforces deterministic, in-kernel verification of binary integrity and memory-mapping invariants using eBPF Linux Security Modules (LSM) hooks (`bprm_check_security`, `file_mprotect`, `mmap_file`). Halts execution of tampered binaries, unverified shared libraries, and mutable executable memory segments (W^X violations) directly within the kernel before payload execution can occur in containerized workloads.","antiPatternHeadline":"Relying on Userspace Audit Daemons or Permitting W^X (Write XOR Execute) Memory State Transitions Inside Container Namespaces","stars_count":113,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","ebpf","lsm","kernel","container-hardening","zero-trust"],"exportEndpoints":{"claude":"/api/rules/lsm-bpf-runtime-binary-integrity-gate?format=claude","cursorMdc":"/api/rules/lsm-bpf-runtime-binary-integrity-gate?format=mdc","cursorrules":"/api/rules/lsm-bpf-runtime-binary-integrity-gate?format=cursor","windsurf":"/api/rules/lsm-bpf-runtime-binary-integrity-gate?format=windsurf","agents":"/api/rules/lsm-bpf-runtime-binary-integrity-gate?format=agents"}},{"id":"opentelemetry-prometheus-exemplar-cardinality-guardrail","title":"OpenTelemetry Prometheus Exemplar Cardinality & Memory Bounds","category":"devops","severity":"critical","description":"Enforces bounded exemplar reservoirs and deterministic trace-metric correlation on latency spikes while eliminating Prometheus TSDB label explosion and OTel Collector OOM eviction under burst traffic. Prevents injecting high-cardinality trace identifiers into dimensional metric labels and mandates strict memory-limiter pipelining.","antiPatternHeadline":"Unbounded Metric Cardinality and Unconstrained Exemplar Reservoirs Triggering Collector Eviction Crashes","stars_count":77,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","prometheus","exemplars","tracing","cardinality","sre"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-prometheus-exemplar-cardinality-guardrail?format=claude","cursorMdc":"/api/rules/opentelemetry-prometheus-exemplar-cardinality-guardrail?format=mdc","cursorrules":"/api/rules/opentelemetry-prometheus-exemplar-cardinality-guardrail?format=cursor","windsurf":"/api/rules/opentelemetry-prometheus-exemplar-cardinality-guardrail?format=windsurf","agents":"/api/rules/opentelemetry-prometheus-exemplar-cardinality-guardrail?format=agents"}},{"id":"svelte-5-runes-boundary-proxy-isolation","title":"Svelte 5 Runes State Boundary Proxy Isolation Guardrail","category":"frontend","severity":"critical","description":"Enforces deterministic state boundary serialization when passing Svelte 5 reactive proxies across Web Workers, micro-frontends, or cross-runtime message channels. Deep signal-backed state created via $state() must be explicitly un-proxied using $state.snapshot() before boundary traversal to prevent DataCloneError exceptions, memory retention leaks, and cross-runtime reactive feedback loops.","antiPatternHeadline":"Passing Raw Svelte 5 $state Proxies Across Worker Message Ports or Micro-Frontend Boundaries","stars_count":74,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","web-workers","micro-frontends","reactivity","memory-leaks"],"exportEndpoints":{"claude":"/api/rules/svelte-5-runes-boundary-proxy-isolation?format=claude","cursorMdc":"/api/rules/svelte-5-runes-boundary-proxy-isolation?format=mdc","cursorrules":"/api/rules/svelte-5-runes-boundary-proxy-isolation?format=cursor","windsurf":"/api/rules/svelte-5-runes-boundary-proxy-isolation?format=windsurf","agents":"/api/rules/svelte-5-runes-boundary-proxy-isolation?format=agents"}},{"id":"react-19-server-action-idempotency-guard","title":"React 19 Server Action Cryptographic Idempotency & Replay Guard","category":"frontend","severity":"critical","description":"Enforces cryptographically unique client-generated idempotency tokens across React 19 Server Actions and concurrent optimistic mutations. Guarantees zero duplicate distributed mutations across transient mobile/network retries and rapid multi-tap UI submissions via server-side atomic acquisition leases.","antiPatternHeadline":"Unbounded Server Action Invocations with Blind Retries and Server-Generated Request Identifiers","stars_count":40,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","server-actions","idempotency","use-optimistic","distributed-systems"],"exportEndpoints":{"claude":"/api/rules/react-19-server-action-idempotency-guard?format=claude","cursorMdc":"/api/rules/react-19-server-action-idempotency-guard?format=mdc","cursorrules":"/api/rules/react-19-server-action-idempotency-guard?format=cursor","windsurf":"/api/rules/react-19-server-action-idempotency-guard?format=windsurf","agents":"/api/rules/react-19-server-action-idempotency-guard?format=agents"}},{"id":"bun-sqlite-wal-snapshot-isolation-production-standard","title":"Bun 1.2 Native SQLite WAL Concurrent Snapshot Isolation and Worker Visibility Standard","category":"backend","severity":"critical","description":"Enforces deterministic snapshot freshness and WAL checkpoint progression across concurrent Bun.Worker threads and asynchronous event loops using bun:sqlite. Eliminates stale read anomalies, WAL file bloat, and SQLITE_BUSY lock exhaustion by establishing explicit read transaction boundaries and isolated worker handles.","antiPatternHeadline":"Dangling Read Snapshots and Cross-Worker Handle Contention in Bun SQLite WAL Mode","stars_count":54,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","sqlite","wal","concurrency","performance"],"exportEndpoints":{"claude":"/api/rules/bun-sqlite-wal-snapshot-isolation-production-standard?format=claude","cursorMdc":"/api/rules/bun-sqlite-wal-snapshot-isolation-production-standard?format=mdc","cursorrules":"/api/rules/bun-sqlite-wal-snapshot-isolation-production-standard?format=cursor","windsurf":"/api/rules/bun-sqlite-wal-snapshot-isolation-production-standard?format=windsurf","agents":"/api/rules/bun-sqlite-wal-snapshot-isolation-production-standard?format=agents"}},{"id":"fastapi-anyio-taskgroup-poison-shielding","title":"FastAPI AnyIO Structured Concurrency Session Poison Shielding","category":"backend","severity":"critical","description":"Enforces strict structured concurrency boundaries around pooled database sessions when executing concurrent child tasks via AnyIO TaskGroups or asyncio.gather in FastAPI. Prevents unhandled task cancellations and exceptions from stranding uncommitted, dirty, or transactionally poisoned connections in shared connection pools (such as SQLAlchemy AsyncEngine or asyncpg). Mandates explicit error boundaries, shielded rollbacks, and per-task isolated transactional units.","antiPatternHeadline":"Sharing a Single Database Session Across AnyIO TaskGroups Without Shielded Teardown and Isolation","stars_count":66,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","anyio","asyncpg","sqlalchemy","concurrency"],"exportEndpoints":{"claude":"/api/rules/fastapi-anyio-taskgroup-poison-shielding?format=claude","cursorMdc":"/api/rules/fastapi-anyio-taskgroup-poison-shielding?format=mdc","cursorrules":"/api/rules/fastapi-anyio-taskgroup-poison-shielding?format=cursor","windsurf":"/api/rules/fastapi-anyio-taskgroup-poison-shielding?format=windsurf","agents":"/api/rules/fastapi-anyio-taskgroup-poison-shielding?format=agents"}},{"id":"postgres-17-json-table-memory-guardrail-postgres-17-json-113","title":"Postgres 17 JSON_TABLE Memory Spill-to-Disk and Work_Mem Guardrails","category":"backend","severity":"critical","description":"ANSI SQL JSON_TABLE queries in PostgreSQL 17 evaluating complex nested paths on large payloads can exhaust backend work_mem and trigger OOM killer termination. Production query engines must bound session-level work_mem, enforce batching on incoming document batches, and constrain NESTED PATH tree depth to safely permit temp file spillover without process abortion. This invariant guarantees predictability under high-concurrency, bursty ingestion workloads.","antiPatternHeadline":"Unbounded Nested JSON_TABLE Ingestion Exhausting Backend Memory","stars_count":50,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres","json-table","memory-management","sql"],"exportEndpoints":{"claude":"/api/rules/postgres-17-json-table-memory-guardrail-postgres-17-json-113?format=claude","cursorMdc":"/api/rules/postgres-17-json-table-memory-guardrail-postgres-17-json-113?format=mdc","cursorrules":"/api/rules/postgres-17-json-table-memory-guardrail-postgres-17-json-113?format=cursor","windsurf":"/api/rules/postgres-17-json-table-memory-guardrail-postgres-17-json-113?format=windsurf","agents":"/api/rules/postgres-17-json-table-memory-guardrail-postgres-17-json-113?format=agents"}},{"id":"capacitor-7-passkey-hardware-enclave-bridge-standard","title":"Capacitor 7 Hardware-Backed WebAuthn Enclave Synchronization Guardrail","category":"mobile","severity":"critical","description":"Bridges hybrid WebView navigator.credentials invocations directly into hardware-backed Secure Enclave (iOS ASAuthorizationPlatformPublicKeyCredentialProvider) and Android KeyStore/FIDO2 Credential Manager APIs. Prohibits polyfill execution inside software-only contexts and prevents state desynchronization between native async lifecycle hooks and the hybrid bridge thread.","antiPatternHeadline":"Interception-Bypass and Bridge Execution Desynchronization in Hybrid WebAuthn Flows","stars_count":81,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","webauthn","fido2","passkeys","security","hardware-enclave"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-passkey-hardware-enclave-bridge-standard?format=claude","cursorMdc":"/api/rules/capacitor-7-passkey-hardware-enclave-bridge-standard?format=mdc","cursorrules":"/api/rules/capacitor-7-passkey-hardware-enclave-bridge-standard?format=cursor","windsurf":"/api/rules/capacitor-7-passkey-hardware-enclave-bridge-standard?format=windsurf","agents":"/api/rules/capacitor-7-passkey-hardware-enclave-bridge-standard?format=agents"}},{"id":"kmp-native-concurrent-gc-frame-budget-standard","title":"Kotlin Native Concurrent GC Frame Budget and Safepoint Standard","category":"mobile","severity":"critical","description":"Enforces strict zero-allocation pathways in real-time execution loops and explicit garbage collector scheduling controls for Kotlin Multiplatform Native. Guarantees that thread-state safepoints and concurrent cycle-collector reconciliation passes stay strictly within bounded time windows (<= 3ms), preventing audio buffer underruns and 60fps/120fps UI hitching.","antiPatternHeadline":"Uncontrolled Ephemeral Allocations in Real-Time Callbacks Triggering Unscheduled K/N GC Safepoint Stalls","stars_count":117,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","kotlin-native","garbage-collection","low-latency","memory-management"],"exportEndpoints":{"claude":"/api/rules/kmp-native-concurrent-gc-frame-budget-standard?format=claude","cursorMdc":"/api/rules/kmp-native-concurrent-gc-frame-budget-standard?format=mdc","cursorrules":"/api/rules/kmp-native-concurrent-gc-frame-budget-standard?format=cursor","windsurf":"/api/rules/kmp-native-concurrent-gc-frame-budget-standard?format=windsurf","agents":"/api/rules/kmp-native-concurrent-gc-frame-budget-standard?format=agents"}},{"id":"webauthn-conditional-mediation-origin-quarantine-standard","title":"WebAuthn Conditional Mediation Origin Quarantine and Atomic Challenge Invalidation","category":"security","severity":"critical","description":"Enforces strict origin-bound assertion verification and atomic challenge invalidation across hybrid Passkey UI handoffs and conditional mediation lifecycles. Prevents adversary-in-the-middle (AiTM) reverse-proxy relay attacks by cryptographically binding ClientDataJSON origin and RP ID while enforcing single-use challenge consumption within a strict timeout quarantine window.","antiPatternHeadline":"Reusable Challenges and Unverified ClientData Origins in Hybrid Conditional Passkey Mediations","stars_count":44,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","fido2","passkeys","aitm-prevention","conditional-mediation","authentication"],"exportEndpoints":{"claude":"/api/rules/webauthn-conditional-mediation-origin-quarantine-standard?format=claude","cursorMdc":"/api/rules/webauthn-conditional-mediation-origin-quarantine-standard?format=mdc","cursorrules":"/api/rules/webauthn-conditional-mediation-origin-quarantine-standard?format=cursor","windsurf":"/api/rules/webauthn-conditional-mediation-origin-quarantine-standard?format=windsurf","agents":"/api/rules/webauthn-conditional-mediation-origin-quarantine-standard?format=agents"}},{"id":"cilium-wireguard-bpf-host-routing-fence","title":"Cilium eBPF Host-Routing WireGuard Cryptographic Invariant Fence","category":"devops","severity":"critical","description":"Enforces strict cryptographic routing invariants between Cilium eBPF host-routing and WireGuard tunnel encapsulation layers. Prevents BPF tc-redirect and socket layer short-circuits from bypassing virtual encryption devices (cilium_wg0) and leaking unencrypted cross-tenant payload frames over raw host interfaces.","antiPatternHeadline":"Enabling BPF Direct Host Routing with WireGuard Without Cryptographic Fallback Isolation","stars_count":47,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","cilium","ebpf","wireguard","kubernetes-security","zero-trust","pulumi"],"exportEndpoints":{"claude":"/api/rules/cilium-wireguard-bpf-host-routing-fence?format=claude","cursorMdc":"/api/rules/cilium-wireguard-bpf-host-routing-fence?format=mdc","cursorrules":"/api/rules/cilium-wireguard-bpf-host-routing-fence?format=cursor","windsurf":"/api/rules/cilium-wireguard-bpf-host-routing-fence?format=windsurf","agents":"/api/rules/cilium-wireguard-bpf-host-routing-fence?format=agents"}},{"id":"otel-baggage-ingress-sanitization-standard-opentelemetry-ba-720","title":"OpenTelemetry Baggage Ingress Sanitization and Boundary Validation Standard","category":"devops","severity":"critical","description":"Enforces strict perimeter schema validation, maximum byte-length constraints, and allowlist-based stripping of W3C Baggage HTTP headers (`baggage`) at API gateways and ingress proxies. Prevents untrusted external clients from injecting unvalidated contextual key-value pairs that cause downstream memory amplification attacks, log poisoning, or accidental exfiltration of personally identifiable information (PII). Unsanitized external baggage must never cross from untrusted public networks into internal trace contexts.","antiPatternHeadline":"Pass-Through of Arbitrary W3C Baggage Headers Across Public Network Boundaries","stars_count":69,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","observability","security","api-gateway","context-propagation"],"exportEndpoints":{"claude":"/api/rules/otel-baggage-ingress-sanitization-standard-opentelemetry-ba-720?format=claude","cursorMdc":"/api/rules/otel-baggage-ingress-sanitization-standard-opentelemetry-ba-720?format=mdc","cursorrules":"/api/rules/otel-baggage-ingress-sanitization-standard-opentelemetry-ba-720?format=cursor","windsurf":"/api/rules/otel-baggage-ingress-sanitization-standard-opentelemetry-ba-720?format=windsurf","agents":"/api/rules/otel-baggage-ingress-sanitization-standard-opentelemetry-ba-720?format=agents"}},{"id":"tauri-v2-multi-window-ipc-capability-scope-isolation","title":"Tauri 2.0 Multi-Window IPC Capability Scope Isolation Standard","category":"mobile","severity":"critical","description":"Enforces strict window-level and webview-level capability scoping in Tauri 2.0 mobile and multi-window architectures to prevent cross-frame privilege escalation. Native commands and plugin operations must cryptographically bind to verified webview labels declared in granular permission manifests rather than relying on wildcard window allowances or ambient IPC execution. Eliminates unauthorized plugin invocation across untrusted webview contexts and third-party iframe overlays.","antiPatternHeadline":"Ambient IPC Execution via Wildcard Window Capabilities and Unverified Webview Labels","stars_count":49,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri","rust","security","ipc","capabilities"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-multi-window-ipc-capability-scope-isolation?format=claude","cursorMdc":"/api/rules/tauri-v2-multi-window-ipc-capability-scope-isolation?format=mdc","cursorrules":"/api/rules/tauri-v2-multi-window-ipc-capability-scope-isolation?format=cursor","windsurf":"/api/rules/tauri-v2-multi-window-ipc-capability-scope-isolation?format=windsurf","agents":"/api/rules/tauri-v2-multi-window-ipc-capability-scope-isolation?format=agents"}},{"id":"otel-collector-tail-sampling-memory-limit-standard","title":"OpenTelemetry Collector Tail-Sampling Adaptive Ring-Buffer and Memory Limiter Invariant","category":"devops","severity":"critical","description":"Enforces strict ordering and deterministic memory boundaries for OpenTelemetry Collector trace pipelines utilizing tail-based sampling. Prevents unrecoverable Out-Of-Memory (OOM) fatal kills during catastrophic upstream traffic spikes by strictly placing memory_limiter before tail_sampling and calculating bounded trace buffers against container cgroup limits.","antiPatternHeadline":"Placing tail_sampling before memory_limiter with unbounded trace buffers, triggering catastrophic OOMKilled pipeline crashes during traffic surges.","stars_count":77,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","observability","tail-sampling","kubernetes","memory-management"],"exportEndpoints":{"claude":"/api/rules/otel-collector-tail-sampling-memory-limit-standard?format=claude","cursorMdc":"/api/rules/otel-collector-tail-sampling-memory-limit-standard?format=mdc","cursorrules":"/api/rules/otel-collector-tail-sampling-memory-limit-standard?format=cursor","windsurf":"/api/rules/otel-collector-tail-sampling-memory-limit-standard?format=windsurf","agents":"/api/rules/otel-collector-tail-sampling-memory-limit-standard?format=agents"}},{"id":"wasi-0-2-capability-sandbox-boundary","title":"WASI 0.2 Component Model Capability-Based Sandbox Boundary Policy","category":"security","severity":"critical","description":"Enforces strict deny-by-default capability boundaries for multi-tenant WebAssembly 0.2 component execution. Requires explicit capability attenuation, prohibiting ambient authority inheritance such as host environment, socket access, or unrestricted filesystem preopens in host runtimes. Mandates virtualized clocks, isolated store resource limits, and explicit outbound network proxies via WASI HTTP interfaces.","antiPatternHeadline":"Ambient Host Resource Inheritance via Unrestricted WASI Preview 2 Host Context Linker","stars_count":62,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","wasi","webassembly","wasmtime","component-model","sandboxing","zero-trust"],"exportEndpoints":{"claude":"/api/rules/wasi-0-2-capability-sandbox-boundary?format=claude","cursorMdc":"/api/rules/wasi-0-2-capability-sandbox-boundary?format=mdc","cursorrules":"/api/rules/wasi-0-2-capability-sandbox-boundary?format=cursor","windsurf":"/api/rules/wasi-0-2-capability-sandbox-boundary?format=windsurf","agents":"/api/rules/wasi-0-2-capability-sandbox-boundary?format=agents"}},{"id":"go-1-24-weak-pointer-cache-eviction-invariant","title":"Go 1.24 Runtime-Tracked Weak Pointer Cache Eviction for Low-Latency Runtimes","category":"backend","severity":"critical","description":"Enforces the use of Go 1.24 weak pointers (weak.Pointer) over legacy runtime.SetFinalizer patterns in high-throughput, in-memory caching systems. Eliminates multi-generational GC pause spikes, object resurrection hazards, and finalizer queue blocking by allowing the garbage collector to reclaim unreferenced cache entries directly without execution delays.","antiPatternHeadline":"Resurrecting cached memory and causing stop-the-world GC latency via runtime.SetFinalizer queues","stars_count":95,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","golang-1.24","weak-pointers","gc-optimization","caching","low-latency"],"exportEndpoints":{"claude":"/api/rules/go-1-24-weak-pointer-cache-eviction-invariant?format=claude","cursorMdc":"/api/rules/go-1-24-weak-pointer-cache-eviction-invariant?format=mdc","cursorrules":"/api/rules/go-1-24-weak-pointer-cache-eviction-invariant?format=cursor","windsurf":"/api/rules/go-1-24-weak-pointer-cache-eviction-invariant?format=windsurf","agents":"/api/rules/go-1-24-weak-pointer-cache-eviction-invariant?format=agents"}},{"id":"capacitor-7-background-task-execution-fence-power-budget","title":"Capacitor 7 Background Task Execution Fence & Power-Budget Policy","category":"mobile","severity":"critical","description":"Enforces deterministic execution fences, abort controllers, and atomic checkpointing for SQLite batch synchronization within Capacitor 7 background tasks. Prevents immediate OS-level SIGKILL terminations and SQLite database corruption on iOS and Android when background processing limits (e.g., 30s) are exceeded.","antiPatternHeadline":"Unfenced Async SQLite Loops in Capacitor App Lifecycle Transitions Causing Process Death and Corrupted State","stars_count":70,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["capacitor","mobile","sqlite","background-tasks","resilience","concurrency"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-background-task-execution-fence-power-budget?format=claude","cursorMdc":"/api/rules/capacitor-7-background-task-execution-fence-power-budget?format=mdc","cursorrules":"/api/rules/capacitor-7-background-task-execution-fence-power-budget?format=cursor","windsurf":"/api/rules/capacitor-7-background-task-execution-fence-power-budget?format=windsurf","agents":"/api/rules/capacitor-7-background-task-execution-fence-power-budget?format=agents"}},{"id":"rfc-9449-dpop-nonce-binding-standard","title":"RFC 9449 DPoP Cryptographic Proof and Nonce Binding Standard","category":"security","severity":"critical","description":"Enforces application-layer proof-of-possession for OAuth 2.0 access tokens and mutation endpoints via RFC 9449 DPoP. Requires strict asymmetric key binding using non-extractable client keys, verification of HTTP method and URI claims, hash-bound access tokens ('ath'), and synchronized ephemeral server-issued nonces to eliminate exfiltration and replay attacks.","antiPatternHeadline":"Unbound Bearer Token Forwarding and Missing Ephemeral DPoP Nonce Validation","stars_count":52,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","dpop","rfc9449","oauth2","cryptography","zero-trust","jwt"],"exportEndpoints":{"claude":"/api/rules/rfc-9449-dpop-nonce-binding-standard?format=claude","cursorMdc":"/api/rules/rfc-9449-dpop-nonce-binding-standard?format=mdc","cursorrules":"/api/rules/rfc-9449-dpop-nonce-binding-standard?format=cursor","windsurf":"/api/rules/rfc-9449-dpop-nonce-binding-standard?format=windsurf","agents":"/api/rules/rfc-9449-dpop-nonce-binding-standard?format=agents"}},{"id":"drizzle-pgvector-connection-pinning-invariant","title":"Drizzle ORM Connection-Pinning & Session Hygiene for pgvector Index Probes","category":"backend","severity":"critical","description":"Mandates strict transactional scoping and connection lifecycle isolation when setting pgvector index hyperparameters (such as hnsw.ef_search or ivfflat.probes) in Drizzle ORM. Enforces that all asynchronous embedding generation occurs entirely outside the database transaction boundary to prevent connection pool exhaustion and transaction interleaving deadlocks under connection poolers like PgBouncer.","antiPatternHeadline":"Setting Global Session Variables or Holding Open Drizzle Transactions Across Vector Embeddings Inference","stars_count":49,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","drizzle-orm","pgvector","postgresql","connection-pooling","hnsw"],"exportEndpoints":{"claude":"/api/rules/drizzle-pgvector-connection-pinning-invariant?format=claude","cursorMdc":"/api/rules/drizzle-pgvector-connection-pinning-invariant?format=mdc","cursorrules":"/api/rules/drizzle-pgvector-connection-pinning-invariant?format=cursor","windsurf":"/api/rules/drizzle-pgvector-connection-pinning-invariant?format=windsurf","agents":"/api/rules/drizzle-pgvector-connection-pinning-invariant?format=agents"}},{"id":"nextjs15-ppr-dynamic-io-boundary-isolation-production-standard","title":"Next.js 15 Partial Prerendering dynamicIO Boundary Isolation Invariant","category":"frontend","severity":"critical","description":"Enforces strict architectural boundary isolation between static prerendered HTML shells and dynamic streaming operations under Next.js 15 Partial Prerendering (PPR) and dynamicIO. Mandates that un-cached dynamic operations (e.g., cookies(), headers(), dynamic fetch, un-cached DB calls) are strictly encapsulated inside dedicated leaf Server Components wrapped in explicit React Suspense boundaries. Prevents route-level static deoptimizations and cascading cache busts across prerendered application shells.","antiPatternHeadline":"Top-Level Dynamic Access Without Suspense Cascading Route Deoptimization","stars_count":84,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs15","partial-prerendering","dynamic-io","react-suspense","server-components"],"exportEndpoints":{"claude":"/api/rules/nextjs15-ppr-dynamic-io-boundary-isolation-production-standard?format=claude","cursorMdc":"/api/rules/nextjs15-ppr-dynamic-io-boundary-isolation-production-standard?format=mdc","cursorrules":"/api/rules/nextjs15-ppr-dynamic-io-boundary-isolation-production-standard?format=cursor","windsurf":"/api/rules/nextjs15-ppr-dynamic-io-boundary-isolation-production-standard?format=windsurf","agents":"/api/rules/nextjs15-ppr-dynamic-io-boundary-isolation-production-standard?format=agents"}},{"id":"fastapi-anyio-structured-concurrency-shielding","title":"FastAPI AnyIO Structured Concurrency and Lifespan Exception Shielding","category":"backend","severity":"critical","description":"Enforces strict structured concurrency in FastAPI application lifespans using AnyIO TaskGroups to prevent orphaned coroutines, unhandled task leakage, and silent process crashes. Guarantees clean resource draining and graceful shutdowns by wrapping resource teardown in cancel-shielded scopes during termination signals.","antiPatternHeadline":"Spawning detached asyncio.create_task coroutines during lifespan and unshielded teardown execution","stars_count":78,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","anyio","structured-concurrency","python","asyncio"],"exportEndpoints":{"claude":"/api/rules/fastapi-anyio-structured-concurrency-shielding?format=claude","cursorMdc":"/api/rules/fastapi-anyio-structured-concurrency-shielding?format=mdc","cursorrules":"/api/rules/fastapi-anyio-structured-concurrency-shielding?format=cursor","windsurf":"/api/rules/fastapi-anyio-structured-concurrency-shielding?format=windsurf","agents":"/api/rules/fastapi-anyio-structured-concurrency-shielding?format=agents"}},{"id":"bun-websocket-backpressure-drain-protocol-bun-1-2-websocke-598","title":"Bun 1.2 WebSocket Backpressure TCP Drain Protocol","category":"backend","severity":"critical","description":"Protects real-time edge gateways from unconstrained heap exhaustion and process termination by enforcing Bun 1.2 WebSocket backpressure management. Mandates checking the byte return value of ServerWebSocket.send() and deferring additional writes using the socket drain lifecycle hook when the internal TCP buffer exceeds watermark thresholds.","antiPatternHeadline":"Unchecked ServerWebSocket.send() Calls Triggering Unbounded Buffer Expansion and Out-Of-Memory Crashes","stars_count":107,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","websockets","backpressure","networking","memory-management"],"exportEndpoints":{"claude":"/api/rules/bun-websocket-backpressure-drain-protocol-bun-1-2-websocke-598?format=claude","cursorMdc":"/api/rules/bun-websocket-backpressure-drain-protocol-bun-1-2-websocke-598?format=mdc","cursorrules":"/api/rules/bun-websocket-backpressure-drain-protocol-bun-1-2-websocke-598?format=cursor","windsurf":"/api/rules/bun-websocket-backpressure-drain-protocol-bun-1-2-websocke-598?format=windsurf","agents":"/api/rules/bun-websocket-backpressure-drain-protocol-bun-1-2-websocke-598?format=agents"}},{"id":"pgvector-diskann-stream-concurrency-partitioning","title":"Postgres 17 pgvector DiskANN Stream Concurrency & WAL Isolation Standard","category":"backend","severity":"critical","description":"Enforces asynchronous, partitioned worker queue isolation for high-dimensional vector writes in Postgres 17 to eliminate Write-Ahead Log (WAL) amplification and read latency spikes. Prohibits inline mutations on DiskANN/graph-indexed hot-path tables during OLTP transactions by decoupling vector ingestion into hash-partitioned staging buffers drained by dedicated background worker pools.","antiPatternHeadline":"Synchronous In-Line Vector Graph Ingestion in User-Facing OLTP Transactions","stars_count":95,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres-17","pgvector","diskann","wal-amplification","stream-concurrency"],"exportEndpoints":{"claude":"/api/rules/pgvector-diskann-stream-concurrency-partitioning?format=claude","cursorMdc":"/api/rules/pgvector-diskann-stream-concurrency-partitioning?format=mdc","cursorrules":"/api/rules/pgvector-diskann-stream-concurrency-partitioning?format=cursor","windsurf":"/api/rules/pgvector-diskann-stream-concurrency-partitioning?format=windsurf","agents":"/api/rules/pgvector-diskann-stream-concurrency-partitioning?format=agents"}},{"id":"react-native-077-bridgeless-jsi-memory-isolation","title":"React Native 0.77 Bridgeless TurboModule JSI Memory Isolation & Thread Safety","category":"mobile","severity":"critical","description":"Enforces strict JSI pointer isolation and thread-confinement rules across C++ and JavaScript runtimes in React Native 0.77 Bridgeless mode. Guarantees that raw JSI objects and runtime references are never captured across thread boundaries or held across asynchronous tasks, preventing Hermes garbage collection deadlocks and use-after-free crashes. Mandates async dispatch via CallInvoker and zero-copy typed buffer transfers for shared memory.","antiPatternHeadline":"Retaining raw JSI values across threads or acquiring synchronous locks on the JS thread during native worker operations","stars_count":58,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","react-native","turbomodules","jsi","c++","concurrency"],"exportEndpoints":{"claude":"/api/rules/react-native-077-bridgeless-jsi-memory-isolation?format=claude","cursorMdc":"/api/rules/react-native-077-bridgeless-jsi-memory-isolation?format=mdc","cursorrules":"/api/rules/react-native-077-bridgeless-jsi-memory-isolation?format=cursor","windsurf":"/api/rules/react-native-077-bridgeless-jsi-memory-isolation?format=windsurf","agents":"/api/rules/react-native-077-bridgeless-jsi-memory-isolation?format=agents"}},{"id":"cilium-ebpf-socket-mtls-routing-production-standard","title":"Cilium eBPF Kernel-Level Socket mTLS & Zero-Sidecar Policy Enforcement","category":"devops","severity":"critical","description":"Enforces zero-overhead mutual cryptographic identity attestation using Cilium eBPF socket-level redirection and SPIFFE/SPIRE authentication. Forbids user-space sidecar proxy injection and eliminates unauthenticated cleartext fallbacks across all Kubernetes service boundaries.","antiPatternHeadline":"Injecting User-Space Envoy Sidecars Alongside Cilium or Permitting Cleartext Non-mTLS Socket Redirection","stars_count":56,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","cilium","ebpf","mtls","kubernetes","spiffe-spire","zero-trust"],"exportEndpoints":{"claude":"/api/rules/cilium-ebpf-socket-mtls-routing-production-standard?format=claude","cursorMdc":"/api/rules/cilium-ebpf-socket-mtls-routing-production-standard?format=mdc","cursorrules":"/api/rules/cilium-ebpf-socket-mtls-routing-production-standard?format=cursor","windsurf":"/api/rules/cilium-ebpf-socket-mtls-routing-production-standard?format=windsurf","agents":"/api/rules/cilium-ebpf-socket-mtls-routing-production-standard?format=agents"}},{"id":"oauth2-rar-type-attestation-guardrail","title":"Strict Schema Contract Attestation for OAuth 2.1 Rich Authorization Requests (RAR)","category":"security","severity":"critical","description":"Enforces deterministic runtime schema validation and client capability attestation for fine-grained OAuth 2.1 Rich Authorization Requests (RFC 9396). Prevents privilege escalation by disallowing open or weakly typed authorization_details objects, mandating closed schemas with strict property allowlists, and binding authorization types directly to registered client profiles before token minting.","antiPatternHeadline":"Dynamic Pass-Through or Permissive Parsing of authorization_details Payloads Leading to Privilege Escalation","stars_count":96,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","oauth2","rar","rfc9396","zero-trust","api-security"],"exportEndpoints":{"claude":"/api/rules/oauth2-rar-type-attestation-guardrail?format=claude","cursorMdc":"/api/rules/oauth2-rar-type-attestation-guardrail?format=mdc","cursorrules":"/api/rules/oauth2-rar-type-attestation-guardrail?format=cursor","windsurf":"/api/rules/oauth2-rar-type-attestation-guardrail?format=windsurf","agents":"/api/rules/oauth2-rar-type-attestation-guardrail?format=agents"}},{"id":"tetragon-ebpf-synchronous-syscall-sigkill-guardrail","title":"Tetragon eBPF Synchronous Syscall Override and Zero-Latency SIGKILL Guardrail","category":"security","severity":"critical","description":"Enforces synchronous kernel-space evaluation and deterministic SIGKILL termination on unauthorized container namespace breakout attempts prior to instruction execution. Disallows asynchronous user-space audit-only detection modes that permit malicious syscall completion before alert consumption.","antiPatternHeadline":"Asynchronous Post-Execution Auditing of Privilege Escalation and Container Breakout Syscalls","stars_count":82,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","ebpf","tetragon","kubernetes","runtime-security","zero-trust"],"exportEndpoints":{"claude":"/api/rules/tetragon-ebpf-synchronous-syscall-sigkill-guardrail?format=claude","cursorMdc":"/api/rules/tetragon-ebpf-synchronous-syscall-sigkill-guardrail?format=mdc","cursorrules":"/api/rules/tetragon-ebpf-synchronous-syscall-sigkill-guardrail?format=cursor","windsurf":"/api/rules/tetragon-ebpf-synchronous-syscall-sigkill-guardrail?format=windsurf","agents":"/api/rules/tetragon-ebpf-synchronous-syscall-sigkill-guardrail?format=agents"}},{"id":"svelte-5-runes-reactive-state-tearing-isolation","title":"Svelte 5 Runes State-Tearing Isolation and Async Mutation Standard","category":"frontend","severity":"critical","description":"Enforces strict transactional mutation boundaries and microtask isolation for Svelte 5 runes ($state, $derived, $effect) across asynchronous operations and island boundaries. Eliminates state tearing, stale tracking leaks across await points, and uncontrolled DOM flush loops in distributed reactive contexts.","antiPatternHeadline":"Asynchronous Rune Mutation Across Microtask Boundaries Causing State Tearing and Orphan Flush Cycles","stars_count":104,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","reactivity","state-tearing","concurrency"],"exportEndpoints":{"claude":"/api/rules/svelte-5-runes-reactive-state-tearing-isolation?format=claude","cursorMdc":"/api/rules/svelte-5-runes-reactive-state-tearing-isolation?format=mdc","cursorrules":"/api/rules/svelte-5-runes-reactive-state-tearing-isolation?format=cursor","windsurf":"/api/rules/svelte-5-runes-reactive-state-tearing-isolation?format=windsurf","agents":"/api/rules/svelte-5-runes-reactive-state-tearing-isolation?format=agents"}},{"id":"nextjs-15-ppr-streaming-fallback-determinism","title":"Next.js 15 PPR Deterministic Suspense Boundaries & Zero-CLS Fallback Architecture","category":"frontend","severity":"critical","description":"Enforces strict isolation between static prerender shells and dynamic streaming holes under Next.js 15 Partial Prerendering (PPR). Mandates layout-deterministic Suspense fallbacks to eliminate Cumulative Layout Shift (CLS) and guarantees zero runtime de-opt of static prerendering caused by uncontained dynamic data access.","antiPatternHeadline":"Leaking Dynamic Context into Prerender Shells with Non-Geometric or Missing Suspense Fallbacks","stars_count":103,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["nextjs","react-19","partial-prerendering","suspense","web-vitals","hydration","performance"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-ppr-streaming-fallback-determinism?format=claude","cursorMdc":"/api/rules/nextjs-15-ppr-streaming-fallback-determinism?format=mdc","cursorrules":"/api/rules/nextjs-15-ppr-streaming-fallback-determinism?format=cursor","windsurf":"/api/rules/nextjs-15-ppr-streaming-fallback-determinism?format=windsurf","agents":"/api/rules/nextjs-15-ppr-streaming-fallback-determinism?format=agents"}},{"id":"vite6-rolldown-dynamic-mfe-sri-attestation-guardrail","title":"Vite 6 Rolldown Dynamic Micro-Frontend SRI Attestation & Graph Isolation","category":"frontend","severity":"critical","description":"Enforces strict runtime Subresource Integrity (SRI) attestation and isolated module graph boundaries for dynamically federated remote micro-frontends under Vite 6 and Rolldown. Dynamic ESM imports bypass native browser script-tag integrity checks, creating critical supply chain attack vectors when loading external chunks into the host execution context. This guardrail mandates SHA-384/SHA-512 cryptographic verification of remote manifests and chunks via Web Crypto prior to module graph evaluation.","antiPatternHeadline":"Unvalidated Dynamic ESM Ingestion of Remote Micro-Frontend Chunks","stars_count":51,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","vite6","rolldown","micro-frontends","module-federation","subresource-integrity","web-crypto","security"],"exportEndpoints":{"claude":"/api/rules/vite6-rolldown-dynamic-mfe-sri-attestation-guardrail?format=claude","cursorMdc":"/api/rules/vite6-rolldown-dynamic-mfe-sri-attestation-guardrail?format=mdc","cursorrules":"/api/rules/vite6-rolldown-dynamic-mfe-sri-attestation-guardrail?format=cursor","windsurf":"/api/rules/vite6-rolldown-dynamic-mfe-sri-attestation-guardrail?format=windsurf","agents":"/api/rules/vite6-rolldown-dynamic-mfe-sri-attestation-guardrail?format=agents"}},{"id":"postgres-17-streaming-io-concurrency-limiter","title":"Postgres 17 Asynchronous Streaming I/O Concurrency Limiter Guardrail","category":"backend","severity":"critical","description":"Postgres 17 introduces streaming asynchronous read prefetching for sequential and bitmap heap scans. Unthrottled parallel execution of streaming queries can exhaust kernel page-cache buffers and saturate OS I/O pipelines, starving latency-sensitive transaction backends. Services must enforce concurrency limiters and query-scoped GUC tuning before dispatching streaming-intensive operations.","antiPatternHeadline":"Unbounded parallel scan dispatches triggering PG17 streaming I/O storms and worker starvation.","stars_count":100,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","postgres-17","async-io","performance","concurrency"],"exportEndpoints":{"claude":"/api/rules/postgres-17-streaming-io-concurrency-limiter?format=claude","cursorMdc":"/api/rules/postgres-17-streaming-io-concurrency-limiter?format=mdc","cursorrules":"/api/rules/postgres-17-streaming-io-concurrency-limiter?format=cursor","windsurf":"/api/rules/postgres-17-streaming-io-concurrency-limiter?format=windsurf","agents":"/api/rules/postgres-17-streaming-io-concurrency-limiter?format=agents"}},{"id":"axum-0-8-graceful-drain-coordination","title":"Axum 0.8 Tower Service Graceful Drain and Transactional Lifetime Protocol","category":"backend","severity":"critical","description":"Mandates explicit in-flight task tracking and cooperative cancellation hierarchies during Axum 0.8 graceful shutdown. Ensures long-lived HTTP/3 streams, WebSocket connections, and Tower layered middleware drain completely before server drop without stranding active database sessions or dropping uncommitted state.","antiPatternHeadline":"Dangling Async Tasks and Orphaned Transactions via Naive Axum Graceful Shutdown","stars_count":47,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tower","websockets","http3","concurrency"],"exportEndpoints":{"claude":"/api/rules/axum-0-8-graceful-drain-coordination?format=claude","cursorMdc":"/api/rules/axum-0-8-graceful-drain-coordination?format=mdc","cursorrules":"/api/rules/axum-0-8-graceful-drain-coordination?format=cursor","windsurf":"/api/rules/axum-0-8-graceful-drain-coordination?format=windsurf","agents":"/api/rules/axum-0-8-graceful-drain-coordination?format=agents"}},{"id":"tauri-v2-mobile-ipc-capability-acl-enforcement","title":"Tauri 2.0 Mobile Rust IPC Capability ACL Enforcement","category":"mobile","severity":"critical","description":"Restricts webview-to-native IPC bridge traffic strictly to cryptographically verified Rust command capabilities on iOS and Android platforms. Enforces explicit Capability Access Control Lists (ACLs) per mobile target, preventing unauthorized native code execution via the webview boundary.","antiPatternHeadline":"Unconstrained Webview IPC Invocations Bypassing Mobile ACL Capabilities","stars_count":87,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri-2","rust","ipc-security","acl-capabilities","ios","android"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-mobile-ipc-capability-acl-enforcement?format=claude","cursorMdc":"/api/rules/tauri-v2-mobile-ipc-capability-acl-enforcement?format=mdc","cursorrules":"/api/rules/tauri-v2-mobile-ipc-capability-acl-enforcement?format=cursor","windsurf":"/api/rules/tauri-v2-mobile-ipc-capability-acl-enforcement?format=windsurf","agents":"/api/rules/tauri-v2-mobile-ipc-capability-acl-enforcement?format=agents"}},{"id":"capacitor-7-biometric-keystore-hardware-token-standard","title":"Capacitor 7 Biometric Hardware-Backed KeyStore & Secure Enclave Token Guardrail","category":"mobile","severity":"critical","description":"Enforces hardware-backed cryptographic key generation and authentication-gated storage for offline session tokens in Capacitor 7 applications. Mandates the use of Android StrongBox Keymaster and iOS Secure Enclave with user authentication binding (`setUserAuthenticationRequired` and `kSecAccessControlBiometryAny`) to prevent extraction from memory dumps or compromised root environments.","antiPatternHeadline":"Storing sensitive session credentials in software-only KeyStore, standard SharedPreferences, iOS Keychain without Secure Enclave access controls, or unencrypted web storage like Preferences/LocalStorage.","stars_count":100,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor-7","biometrics","hardware-keystore","secure-enclave","strongbox","crypto"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-biometric-keystore-hardware-token-standard?format=claude","cursorMdc":"/api/rules/capacitor-7-biometric-keystore-hardware-token-standard?format=mdc","cursorrules":"/api/rules/capacitor-7-biometric-keystore-hardware-token-standard?format=cursor","windsurf":"/api/rules/capacitor-7-biometric-keystore-hardware-token-standard?format=windsurf","agents":"/api/rules/capacitor-7-biometric-keystore-hardware-token-standard?format=agents"}},{"id":"webauthn-l3-hybrid-transport-relay-resistance","title":"WebAuthn Level 3 Hybrid Transport Relay Resistance and ClientData Validation","category":"security","severity":"critical","description":"Enforces strict RP origin validation, clientDataJSON crossOrigin verification, and authenticator data transport binding during WebAuthn Level 3 hybrid (caBLE/cross-device) ceremonies. Prevents adversary-in-the-middle (AitM) relay proxies from harvesting passkey assertions across disassociated domains or unverified hybrid channels.","antiPatternHeadline":"Trusting unverified hybrid assertions without crossOrigin assertions or strict canonical origin and clientDataHash validation","stars_count":49,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","fido2","passkeys","cryptography","authentication"],"exportEndpoints":{"claude":"/api/rules/webauthn-l3-hybrid-transport-relay-resistance?format=claude","cursorMdc":"/api/rules/webauthn-l3-hybrid-transport-relay-resistance?format=mdc","cursorrules":"/api/rules/webauthn-l3-hybrid-transport-relay-resistance?format=cursor","windsurf":"/api/rules/webauthn-l3-hybrid-transport-relay-resistance?format=windsurf","agents":"/api/rules/webauthn-l3-hybrid-transport-relay-resistance?format=agents"}},{"id":"linux-landlock-lsm-runtime-sandbox-guardrail","title":"Mandatory Linux Landlock LSM Process Confinement and Privilege Stripping","category":"security","severity":"critical","description":"Enforces unprivileged, kernel-enforced Linux Landlock LSM sandboxing at process initialization before processing untrusted input or executing untrusted workloads. Requires strict ABI capability negotiation, explicit filesystem and network access mask definitions, PR_SET_NO_NEW_PRIVS enforcement, and immediate ruleset file descriptor closure to neutralize container breakout primitives.","antiPatternHeadline":"Executing Untrusted Container Payloads Without In-Process Landlock LSM Boundary Lockdown","stars_count":62,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","linux","landlock","lsm","container-security","sandbox","syscalls"],"exportEndpoints":{"claude":"/api/rules/linux-landlock-lsm-runtime-sandbox-guardrail?format=claude","cursorMdc":"/api/rules/linux-landlock-lsm-runtime-sandbox-guardrail?format=mdc","cursorrules":"/api/rules/linux-landlock-lsm-runtime-sandbox-guardrail?format=cursor","windsurf":"/api/rules/linux-landlock-lsm-runtime-sandbox-guardrail?format=windsurf","agents":"/api/rules/linux-landlock-lsm-runtime-sandbox-guardrail?format=agents"}},{"id":"opentelemetry-wasmedge-baggage-propagation-standard","title":"OpenTelemetry WasmEdge Distributed Baggage Propagation Standard","category":"devops","severity":"critical","description":"Enforces deterministic extraction, propagation, and mutation of W3C TraceContext and Baggage across ephemeral WebAssembly (WasmEdge) runtime boundaries. Prevents telemetry dropping and eliminates cold-start latency amplification caused by heavy in-guest SDK initialization.","antiPatternHeadline":"Instantiating Full In-Memory OTel SDKs and Dropping Baggage Across Ephemeral WASI Host-Guest Boundaries","stars_count":116,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","wasmedge","baggage","w3c-tracecontext","wasm","observability"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-wasmedge-baggage-propagation-standard?format=claude","cursorMdc":"/api/rules/opentelemetry-wasmedge-baggage-propagation-standard?format=mdc","cursorrules":"/api/rules/opentelemetry-wasmedge-baggage-propagation-standard?format=cursor","windsurf":"/api/rules/opentelemetry-wasmedge-baggage-propagation-standard?format=windsurf","agents":"/api/rules/opentelemetry-wasmedge-baggage-propagation-standard?format=agents"}},{"id":"react-19-server-action-optimistic-idempotency","title":"React 19 Server Action Optimistic Idempotency Key Pipeline","category":"frontend","severity":"critical","description":"Enforces a strict cryptographic client-generated idempotency key pipeline paired with React 19's useOptimistic hook during concurrent Server Action dispatches. Guarantees deterministic state rollback, prevents duplicate distributed executions during flaky network retries, and eliminates race conditions under React's asynchronous transitions.","antiPatternHeadline":"Unkeyed Server Action Invocations Triggering Ghost Mutations and Corrupting Optimistic Concurrent UI Trees","stars_count":115,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["react-19","server-actions","use-optimistic","idempotency","concurrency","distributed-systems"],"exportEndpoints":{"claude":"/api/rules/react-19-server-action-optimistic-idempotency?format=claude","cursorMdc":"/api/rules/react-19-server-action-optimistic-idempotency?format=mdc","cursorrules":"/api/rules/react-19-server-action-optimistic-idempotency?format=cursor","windsurf":"/api/rules/react-19-server-action-optimistic-idempotency?format=windsurf","agents":"/api/rules/react-19-server-action-optimistic-idempotency?format=agents"}},{"id":"vite-6-environment-api-multi-runtime-isolation-standard-vite-6-environme-128","title":"Vite 6 Environment API Multi-Runtime Context Isolation Standard","category":"frontend","severity":"critical","description":"Enforces strict memory, configuration, and module-graph boundary separation between heterogeneous target runtimes (e.g., Cloudflare Workers/workerd and Node.js) using the Vite 6 Environment API. Prevents runtime pollution, invalid cross-runtime polyfill leakage, and module graph cache poisoning during dual-target SSR builds. Mandates explicit environment-scoped resolve conditions, isolated runner instances, and contextual plugin execution.","antiPatternHeadline":"Cross-Runtime Module Graph Contamination via Shared Vite SSR State and Global Conditions","stars_count":112,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","vite","vite-6","ssr","cloudflare-workers","nodejs","module-graph","environment-api"],"exportEndpoints":{"claude":"/api/rules/vite-6-environment-api-multi-runtime-isolation-standard-vite-6-environme-128?format=claude","cursorMdc":"/api/rules/vite-6-environment-api-multi-runtime-isolation-standard-vite-6-environme-128?format=mdc","cursorrules":"/api/rules/vite-6-environment-api-multi-runtime-isolation-standard-vite-6-environme-128?format=cursor","windsurf":"/api/rules/vite-6-environment-api-multi-runtime-isolation-standard-vite-6-environme-128?format=windsurf","agents":"/api/rules/vite-6-environment-api-multi-runtime-isolation-standard-vite-6-environme-128?format=agents"}},{"id":"axum-tower-adaptive-concurrency-loadshedding","title":"Axum 0.8 Tower Adaptive Concurrency & Load-Shedding Invariant","category":"backend","severity":"critical","description":"Mandates deterministic token-bucket or semaphore-based load-shedding and concurrency limiting at the outer boundary of Axum 0.8 Tower service pipelines. Prevents unbounded inflight heap exhaustion, Tokio runtime worker starvation, and cascading socket stall cascades under flash crowds by shedding excess traffic before payload consumption or asynchronous task spawning.","antiPatternHeadline":"Unbounded Task Spawning and Late Payload Buffering Without Outer Tower Load-Shedding Layers","stars_count":53,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tower","tokio","load-shedding","concurrency"],"exportEndpoints":{"claude":"/api/rules/axum-tower-adaptive-concurrency-loadshedding?format=claude","cursorMdc":"/api/rules/axum-tower-adaptive-concurrency-loadshedding?format=mdc","cursorrules":"/api/rules/axum-tower-adaptive-concurrency-loadshedding?format=cursor","windsurf":"/api/rules/axum-tower-adaptive-concurrency-loadshedding?format=windsurf","agents":"/api/rules/axum-tower-adaptive-concurrency-loadshedding?format=agents"}},{"id":"fastapi-anyio-structured-taskgroup-cancellation","title":"FastAPI AnyIO Structured TaskGroup Request-Cancellation Boundary","category":"backend","severity":"critical","description":"Enforces strict structured concurrency using AnyIO TaskGroups within FastAPI request lifecycles to guarantee immediate, deterministic teardown of all spawned coroutines upon client HTTP disconnects. Prevents orphaned background tasks, runaway resource consumption, and stale uncommitted database transactions by binding all asynchronous child operations to the ASGI cancellation boundary.","antiPatternHeadline":"Unstructured asyncio.create_task Fire-and-Forget Spawning In HTTP Request Handlers","stars_count":72,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","anyio","asyncio","concurrency","cancellation"],"exportEndpoints":{"claude":"/api/rules/fastapi-anyio-structured-taskgroup-cancellation?format=claude","cursorMdc":"/api/rules/fastapi-anyio-structured-taskgroup-cancellation?format=mdc","cursorrules":"/api/rules/fastapi-anyio-structured-taskgroup-cancellation?format=cursor","windsurf":"/api/rules/fastapi-anyio-structured-taskgroup-cancellation?format=windsurf","agents":"/api/rules/fastapi-anyio-structured-taskgroup-cancellation?format=agents"}},{"id":"bun-shell-subprocess-injection-sandbox-guardrail","title":"Bun 1.2 Shell API Tagged-Template Sanitization and Subprocess Deserialization Sandbox","category":"backend","severity":"critical","description":"Enforces strict subprocess execution boundaries in Bun 1.2+ by leveraging the native shell AST tagged-template parser and prohibiting unsafe raw interpolations, string concatenations, and intermediate shell passes. Guarantees deterministic parameter escaping, explicit execution environments, and bounded input sanitization when invoking external system CLI binaries.","antiPatternHeadline":"Dynamic String Concatenation and Unsafe Raw String Injections in Bun Shell Subprocesses","stars_count":75,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","security","subprocesses","command-injection","shell-ast"],"exportEndpoints":{"claude":"/api/rules/bun-shell-subprocess-injection-sandbox-guardrail?format=claude","cursorMdc":"/api/rules/bun-shell-subprocess-injection-sandbox-guardrail?format=mdc","cursorrules":"/api/rules/bun-shell-subprocess-injection-sandbox-guardrail?format=cursor","windsurf":"/api/rules/bun-shell-subprocess-injection-sandbox-guardrail?format=windsurf","agents":"/api/rules/bun-shell-subprocess-injection-sandbox-guardrail?format=agents"}},{"id":"kmp-swift-concurrency-actor-memory-bridge-guardrail","title":"KMP StateFlow to Swift Actor ARC Bridge & Deadlock Prevention","category":"mobile","severity":"critical","description":"Enforces strict memory boundary management and reentrancy safety when bridging Kotlin Coroutine StateFlow pipelines into Swift Actors and @MainActor view models. Eliminates bidirectional reference cycles across the Kotlin/Native ARC-GC boundary and prevents threading deadlocks caused by synchronous dispatch blocking on cooperative actor pools.","antiPatternHeadline":"Escaping unmanaged Kotlin Coroutine Job closures into Swift Actor isolation contexts causing ARC retain leaks and dispatch deadlocks","stars_count":106,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kmp","kotlin-native","swift","swift-concurrency","actors","memory-management"],"exportEndpoints":{"claude":"/api/rules/kmp-swift-concurrency-actor-memory-bridge-guardrail?format=claude","cursorMdc":"/api/rules/kmp-swift-concurrency-actor-memory-bridge-guardrail?format=mdc","cursorrules":"/api/rules/kmp-swift-concurrency-actor-memory-bridge-guardrail?format=cursor","windsurf":"/api/rules/kmp-swift-concurrency-actor-memory-bridge-guardrail?format=windsurf","agents":"/api/rules/kmp-swift-concurrency-actor-memory-bridge-guardrail?format=agents"}},{"id":"capacitor-biometric-keystore-invalidation-boundary","title":"Capacitor 7 Hardware Keystore Invalidation on Biometric Enrollment Mutation","category":"mobile","severity":"critical","description":"Enforces strict hardware-backed cryptographic invalidation boundaries for persistent secrets across Capacitor 7 iOS and Android targets. Mandates iOS kSecAccessControlBiometryCurrentSet and Android KeyPermanentlyInvalidatedException traps such that any addition, deletion, or modification of biometric templates permanently destroys the decryption key material and triggers complete client session purge.","antiPatternHeadline":"Persisting Session Secrets with Weak Keychain ACLs or Silently Swallowing Hardware Key Invalidation Exceptions","stars_count":46,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","biometrics","ios-keychain","android-keystore","secure-enclave","zero-trust"],"exportEndpoints":{"claude":"/api/rules/capacitor-biometric-keystore-invalidation-boundary?format=claude","cursorMdc":"/api/rules/capacitor-biometric-keystore-invalidation-boundary?format=mdc","cursorrules":"/api/rules/capacitor-biometric-keystore-invalidation-boundary?format=cursor","windsurf":"/api/rules/capacitor-biometric-keystore-invalidation-boundary?format=windsurf","agents":"/api/rules/capacitor-biometric-keystore-invalidation-boundary?format=agents"}},{"id":"webauthn-ror-cross-subdomain-invariant","title":"FIDO2 WebAuthn Related Origin Requests (ROR) Cross-Subdomain Invariant","category":"security","severity":"critical","description":"Enforces strict origin validation and session isolation during FIDO2 WebAuthn Related Origin Requests (ROR) across federated enterprise subdomains. Prevents compromised or user-controlled subdomains from hijacking passkey assertion ceremonies or poisoning parent domain session states while safely permitting cryptographically verified passkey sharing via authoritative well-known manifests.","antiPatternHeadline":"Wildcard origin matching and broad-domain session issuance during WebAuthn assertion verification","stars_count":112,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","fido2","ror","passkeys","subdomain-takeover","session-poisoning"],"exportEndpoints":{"claude":"/api/rules/webauthn-ror-cross-subdomain-invariant?format=claude","cursorMdc":"/api/rules/webauthn-ror-cross-subdomain-invariant?format=mdc","cursorrules":"/api/rules/webauthn-ror-cross-subdomain-invariant?format=cursor","windsurf":"/api/rules/webauthn-ror-cross-subdomain-invariant?format=windsurf","agents":"/api/rules/webauthn-ror-cross-subdomain-invariant?format=agents"}},{"id":"rfc-8705-mtls-sender-constrained-tokens","title":"RFC 8705 OAuth 2.1 mTLS Certificate-Bound Token Verification","category":"security","severity":"critical","description":"Enforces strict validation of RFC 8705 sender-constrained access tokens by binding tokens to the client's X.509 certificate established during mutual TLS (mTLS). Protected resource endpoints must compute the base64url-encoded SHA-256 thumbprint of the presented client certificate and verify its exact match against the token's confirmation claim (cnf.x5t#S256) to eliminate token replay vulnerabilities.","antiPatternHeadline":"Accepting Certificate-Bound Tokens as Bearer Tokens Without Validating Transport-Layer Client Certificate Fingerprints","stars_count":50,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","oauth2","rfc8705","mtls","zero-trust","token-binding"],"exportEndpoints":{"claude":"/api/rules/rfc-8705-mtls-sender-constrained-tokens?format=claude","cursorMdc":"/api/rules/rfc-8705-mtls-sender-constrained-tokens?format=mdc","cursorrules":"/api/rules/rfc-8705-mtls-sender-constrained-tokens?format=cursor","windsurf":"/api/rules/rfc-8705-mtls-sender-constrained-tokens?format=windsurf","agents":"/api/rules/rfc-8705-mtls-sender-constrained-tokens?format=agents"}},{"id":"cilium-ebpf-wireguard-mutual-auth-guardrail","title":"Cilium eBPF Dynamic WireGuard Mutual Authentication Handshake Guardrail","category":"devops","severity":"critical","description":"Enforces zero-trust pod-to-pod transit encryption using kernel-level eBPF WireGuard datapath routing paired with SPIRE/SPIFFE-based mutual authentication handshakes. Prevents unencrypted fallback leaks and eliminates userspace proxy overhead by validating cryptographic identities directly inside the eBPF kernel pipeline before passing payloads to WireGuard tunnels.","antiPatternHeadline":"Permissive Cilium Transit Encryption with Unauthenticated Fallback or Unaccounted MTU Clamping","stars_count":86,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","cilium","ebpf","wireguard","spiffe-spire","zero-trust","kubernetes","transit-encryption"],"exportEndpoints":{"claude":"/api/rules/cilium-ebpf-wireguard-mutual-auth-guardrail?format=claude","cursorMdc":"/api/rules/cilium-ebpf-wireguard-mutual-auth-guardrail?format=mdc","cursorrules":"/api/rules/cilium-ebpf-wireguard-mutual-auth-guardrail?format=cursor","windsurf":"/api/rules/cilium-ebpf-wireguard-mutual-auth-guardrail?format=windsurf","agents":"/api/rules/cilium-ebpf-wireguard-mutual-auth-guardrail?format=agents"}},{"id":"vite6-rolldown-deterministic-chunking-standard","title":"Vite 6 and Rolldown Deterministic Module Chunk Boundary Isolation Standard","category":"frontend","severity":"critical","description":"Enforces deterministic AST-driven chunking boundaries and explicit module isolation in Vite 6 with Rolldown. Prevents cascading edge CDN cache invalidations across federated micro-frontends caused by non-deterministic dynamic chunking, circular import graphs, and leaky barrel exports.","antiPatternHeadline":"Implicit Dynamic Splitting Inducing Cascading Edge Cache Invalidation Across Micro-Frontends","stars_count":93,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","vite6","rolldown","micro-frontends","caching","performance","architecture"],"exportEndpoints":{"claude":"/api/rules/vite6-rolldown-deterministic-chunking-standard?format=claude","cursorMdc":"/api/rules/vite6-rolldown-deterministic-chunking-standard?format=mdc","cursorrules":"/api/rules/vite6-rolldown-deterministic-chunking-standard?format=cursor","windsurf":"/api/rules/vite6-rolldown-deterministic-chunking-standard?format=windsurf","agents":"/api/rules/vite6-rolldown-deterministic-chunking-standard?format=agents"}},{"id":"postgres-17-parallel-hnsw-memory-budgeting","title":"Postgres 17 Parallel HNSW Index Build Memory & Worker Saturation Guardrail","category":"backend","severity":"critical","description":"Governs parallel HNSW vector index construction in PostgreSQL 17 to prevent multi-tenant query latency spikes and Linux OOM killer invocation. Enforces strict session-scoped bounds on maintenance_work_mem and max_parallel_maintenance_workers proportional to system headroom.","antiPatternHeadline":"Unbounded Parallel Workers and Maintenance Memory in Vector Re-Indexing Starving Live RAG Workloads","stars_count":44,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres","pgvector","rag","hnsw","database-performance"],"exportEndpoints":{"claude":"/api/rules/postgres-17-parallel-hnsw-memory-budgeting?format=claude","cursorMdc":"/api/rules/postgres-17-parallel-hnsw-memory-budgeting?format=mdc","cursorrules":"/api/rules/postgres-17-parallel-hnsw-memory-budgeting?format=cursor","windsurf":"/api/rules/postgres-17-parallel-hnsw-memory-budgeting?format=windsurf","agents":"/api/rules/postgres-17-parallel-hnsw-memory-budgeting?format=agents"}},{"id":"go-chi-http3-zero-rtt-anti-replay","title":"Go Chi HTTP/3 0-RTT Early Data Anti-Replay Standard","category":"backend","severity":"critical","description":"Enforces stateful replay-token verification and strict RFC 8470 compliance for 0-RTT Early Data in HTTP/3 Go Chi services. Eliminates replay attacks against side-effect-bearing or resource-intensive endpoints during QUIC handshakes while guaranteeing single-digit millisecond connection establishment for safe requests.","antiPatternHeadline":"Unchecked 0-RTT Early Data Execution Allowing Idempotency Bypass and Amplified Request Replay","stars_count":65,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","chi","http3","quic","security","anti-replay"],"exportEndpoints":{"claude":"/api/rules/go-chi-http3-zero-rtt-anti-replay?format=claude","cursorMdc":"/api/rules/go-chi-http3-zero-rtt-anti-replay?format=mdc","cursorrules":"/api/rules/go-chi-http3-zero-rtt-anti-replay?format=cursor","windsurf":"/api/rules/go-chi-http3-zero-rtt-anti-replay?format=windsurf","agents":"/api/rules/go-chi-http3-zero-rtt-anti-replay?format=agents"}},{"id":"rn-078-fabric-layout-freezing-standard","title":"React Native 0.78 Fabric Concurrent Root Layout Freezing & VSYNC Synchronization","category":"mobile","severity":"critical","description":"Enforces strict layout freeze invariants on off-screen and backgrounded component trees under React Native 0.78 Fabric Concurrent Mode. Prevents catastrophic frame drops and main thread stalls during AppState background-to-foreground transitions by batching Yoga C++ shadow tree recalculations via React Concurrent transitions and aligning commits with the native display refresh cadence.","antiPatternHeadline":"Synchronous Off-Screen Layout Thrashing During Background-to-Foreground App Transitions","stars_count":91,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["react-native","fabric","concurrent-react","yoga-engine","performance","mobile"],"exportEndpoints":{"claude":"/api/rules/rn-078-fabric-layout-freezing-standard?format=claude","cursorMdc":"/api/rules/rn-078-fabric-layout-freezing-standard?format=mdc","cursorrules":"/api/rules/rn-078-fabric-layout-freezing-standard?format=cursor","windsurf":"/api/rules/rn-078-fabric-layout-freezing-standard?format=windsurf","agents":"/api/rules/rn-078-fabric-layout-freezing-standard?format=agents"}},{"id":"capacitor7-sqlcipher-biometric-key-derivation-standard","title":"Capacitor 7 Biometric-Gated Dynamic SQLCipher Key Derivation","category":"mobile","severity":"critical","description":"Enforces offline zero-knowledge storage architecture for Capacitor 7 mobile applications. Mandates dynamic derivation of SQLCipher AES-256 database keys via hardware-backed Secure Enclave or Android Keystore biometric prompts, strictly forbidding static key storage in preferences or unbounded runtime retention in JavaScript memory heaps.","antiPatternHeadline":"Persisting Raw SQLCipher Keys in Storage or Retaining Plaintext Master Keys in Memory Across Background State Transitions","stars_count":85,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor7","sqlcipher","biometrics","secure-enclave","keystore","zero-knowledge","security"],"exportEndpoints":{"claude":"/api/rules/capacitor7-sqlcipher-biometric-key-derivation-standard?format=claude","cursorMdc":"/api/rules/capacitor7-sqlcipher-biometric-key-derivation-standard?format=mdc","cursorrules":"/api/rules/capacitor7-sqlcipher-biometric-key-derivation-standard?format=cursor","windsurf":"/api/rules/capacitor7-sqlcipher-biometric-key-derivation-standard?format=windsurf","agents":"/api/rules/capacitor7-sqlcipher-biometric-key-derivation-standard?format=agents"}},{"id":"spiffe-spire-ephemeral-workload-attestation-standard-spiffe-spire-eph-630","title":"SPIFFE/SPIRE Ephemeral Workload Identity Attestation Standard","category":"security","severity":"critical","description":"Enforces zero static credentials by mandating cryptographically attested ephemeral X.509 SVID issuance and live rotation via local SPIRE Agent Unix Domain Sockets. Prohibits persistent cryptographic keys, static cloud IAM service account credentials, and unrotated in-memory X.509 certificates across service meshes and microservice fabrics.","antiPatternHeadline":"Baking Static Cloud IAM Credentials or Caching Unrotated X.509 Certificates Across Service Boundaries","stars_count":40,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","spiffe","spire","mtls","workload-identity","zero-trust","cryptography"],"exportEndpoints":{"claude":"/api/rules/spiffe-spire-ephemeral-workload-attestation-standard-spiffe-spire-eph-630?format=claude","cursorMdc":"/api/rules/spiffe-spire-ephemeral-workload-attestation-standard-spiffe-spire-eph-630?format=mdc","cursorrules":"/api/rules/spiffe-spire-ephemeral-workload-attestation-standard-spiffe-spire-eph-630?format=cursor","windsurf":"/api/rules/spiffe-spire-ephemeral-workload-attestation-standard-spiffe-spire-eph-630?format=windsurf","agents":"/api/rules/spiffe-spire-ephemeral-workload-attestation-standard-spiffe-spire-eph-630?format=agents"}},{"id":"bpf-lsm-runtime-container-namespace-guardrail","title":"Linux BPF-LSM Container Namespace Mutation and Capability Hardening","category":"devops","severity":"critical","description":"Enforces synchronous, kernel-level rejection of unauthorized namespace transitions and process capability elevations inside containers using modern BPF-LSM probes. Prevents container breakout vectors (e.g., arbitrary user namespace creation and cap-set exploitation) by verifying cgroup context and denying operations directly at the LSM layer before syscall execution.","antiPatternHeadline":"Relying on Asynchronous Tracepoints or User-Space Seccomp Filters for Critical Namespace Privilege Boundaries","stars_count":117,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","bpf-lsm","container-security","linux-kernel","cgroups"],"exportEndpoints":{"claude":"/api/rules/bpf-lsm-runtime-container-namespace-guardrail?format=claude","cursorMdc":"/api/rules/bpf-lsm-runtime-container-namespace-guardrail?format=mdc","cursorrules":"/api/rules/bpf-lsm-runtime-container-namespace-guardrail?format=cursor","windsurf":"/api/rules/bpf-lsm-runtime-container-namespace-guardrail?format=windsurf","agents":"/api/rules/bpf-lsm-runtime-container-namespace-guardrail?format=agents"}},{"id":"opentelemetry-exemplar-fixed-reservoir-allocation-invariant","title":"OpenTelemetry Metric Exemplar Fixed-Reservoir Allocation Invariant","category":"devops","severity":"critical","description":"Caps heap memory consumption and eliminates OpenTelemetry Collector out-of-memory (OOM) failures by mandating bounded-capacity reservoir sampling for trace exemplar storage in metric aggregators. In high-throughput pipelines, metric aggregations must never bind exemplars via unbounded collections or naive per-measurement mappings. Implementations must strictly configure fixed-window or fixed-size reservoir algorithms (such as WithFixedSizeReservoir or WithAlignedHistogramBucketReservoir) to enforce deterministic upper bounds on exemplar allocation.","antiPatternHeadline":"Unbounded Trace Exemplar Accumulation in High-Throughput Metric Aggregators Leading to Heap Exhaustion and Collector OOM","stars_count":52,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","metrics","exemplars","observability","memory-management","sre"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-exemplar-fixed-reservoir-allocation-invariant?format=claude","cursorMdc":"/api/rules/opentelemetry-exemplar-fixed-reservoir-allocation-invariant?format=mdc","cursorrules":"/api/rules/opentelemetry-exemplar-fixed-reservoir-allocation-invariant?format=cursor","windsurf":"/api/rules/opentelemetry-exemplar-fixed-reservoir-allocation-invariant?format=windsurf","agents":"/api/rules/opentelemetry-exemplar-fixed-reservoir-allocation-invariant?format=agents"}},{"id":"svelte-5-runes-untracked-signal-boundaries","title":"Svelte 5 Runes Reactive Engine: Untracked Boundaries & Derivation Determinism","category":"frontend","severity":"critical","description":"Enforces deterministic signal derivation ordering and prevents microtask queue deadlocks in Svelte 5 fine-grained reactive runtime. Mandates explicit untracked boundary isolation via untrack() for cross-component writes and strictly forbids state mutations within derived signal computations.","antiPatternHeadline":"Cyclic Signal Graph Cascades and Microtask Starvation via Implicit Dependency Capture in Runes Effects","stars_count":111,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","signals","reactivity","state-management"],"exportEndpoints":{"claude":"/api/rules/svelte-5-runes-untracked-signal-boundaries?format=claude","cursorMdc":"/api/rules/svelte-5-runes-untracked-signal-boundaries?format=mdc","cursorrules":"/api/rules/svelte-5-runes-untracked-signal-boundaries?format=cursor","windsurf":"/api/rules/svelte-5-runes-untracked-signal-boundaries?format=windsurf","agents":"/api/rules/svelte-5-runes-untracked-signal-boundaries?format=agents"}},{"id":"nextjs15-dynamic-io-ppr-boundaries","title":"Next.js 15 Dynamic IO and PPR Asynchronous Boundary Enforcement","category":"frontend","severity":"critical","description":"Next.js 15 Dynamic IO with Partial Prerendering (PPR) mandates that dynamic data sources (cookies, headers, searchParams, and uncached dynamic fetches) are quarantined behind strict React Suspense boundaries. Top-level synchronous or layout-level un-suspended dynamic accesses de-opt the static shell, leak contextual request state into shared prerender buffers, and trigger client hydration mismatch panics.","antiPatternHeadline":"Awaiting dynamic request APIs at root page/layout level without Suspense encapsulation, collapsing PPR into SSR","stars_count":72,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs15","dynamic-io","ppr","react-19","suspense","hydration"],"exportEndpoints":{"claude":"/api/rules/nextjs15-dynamic-io-ppr-boundaries?format=claude","cursorMdc":"/api/rules/nextjs15-dynamic-io-ppr-boundaries?format=mdc","cursorrules":"/api/rules/nextjs15-dynamic-io-ppr-boundaries?format=cursor","windsurf":"/api/rules/nextjs15-dynamic-io-ppr-boundaries?format=windsurf","agents":"/api/rules/nextjs15-dynamic-io-ppr-boundaries?format=agents"}},{"id":"tauri2-mobile-ipc-capability-boundary","title":"Tauri 2.0 Mobile Multi-Webview IPC Capability Boundary Isolation","category":"mobile","severity":"critical","description":"Enforces strict principle-of-least-privilege IPC boundaries across multiple webviews in Tauri 2.0 mobile applications (iOS/Android). Prohibits default universal plugin scopes, wildcard command matching, and global window capability inheritance to prevent untrusted or sandboxed auxiliary webviews from escalating privileges to native hardware APIs such as camera, biometrics, secure storage, and geolocation.","antiPatternHeadline":"Global Capability Broad-Casting and Ambient IPC Permission Leakage Across Mobile Webviews","stars_count":68,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri-2","ipc-security","capabilities","rust","android","ios"],"exportEndpoints":{"claude":"/api/rules/tauri2-mobile-ipc-capability-boundary?format=claude","cursorMdc":"/api/rules/tauri2-mobile-ipc-capability-boundary?format=mdc","cursorrules":"/api/rules/tauri2-mobile-ipc-capability-boundary?format=cursor","windsurf":"/api/rules/tauri2-mobile-ipc-capability-boundary?format=windsurf","agents":"/api/rules/tauri2-mobile-ipc-capability-boundary?format=agents"}},{"id":"capacitor-7-background-task-serialization-standard","title":"Capacitor 7 Headless Background Task Serialization and Lifecycle Standard","category":"mobile","severity":"critical","description":"Enforces strict headless runtime teardown, sequential task serialization, and explicit bridge state flushing for Capacitor 7 background operations. Eliminates silent OS watchdog process termination (SIGKILL) on iOS and ANR timeouts on Android by bounding execution time to platform quotas and releasing WebView resource locks prior to suspension.","antiPatternHeadline":"Unbounded Concurrent Background Promises with Leaked Native Bridge Listeners Causing OS Watchdog Termination","stars_count":70,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","ios","android","background-task","lifecycle"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-background-task-serialization-standard?format=claude","cursorMdc":"/api/rules/capacitor-7-background-task-serialization-standard?format=mdc","cursorrules":"/api/rules/capacitor-7-background-task-serialization-standard?format=cursor","windsurf":"/api/rules/capacitor-7-background-task-serialization-standard?format=windsurf","agents":"/api/rules/capacitor-7-background-task-serialization-standard?format=agents"}},{"id":"fastapi-anyio-structured-taskgroup-guardrail","title":"FastAPI AnyIO Structured Concurrency and TaskGroup Socket Lifecycle Invariants","category":"backend","severity":"critical","description":"Enforces strict structured concurrency in FastAPI background workers and parallel request handlers via AnyIO TaskGroups. Prevents silent fire-and-forget sub-task orphaning, enforces deterministic cancellation cascades, and guarantees active HTTP/2 and database connection sockets are gracefully terminated when exceptions occur in concurrent branches.","antiPatternHeadline":"Orphaning concurrent coroutines via unshielded fire-and-forget asyncio.create_task and unhandled ExceptionGroup socket leaks","stars_count":74,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","anyio","structured-concurrency","asyncio","sockets"],"exportEndpoints":{"claude":"/api/rules/fastapi-anyio-structured-taskgroup-guardrail?format=claude","cursorMdc":"/api/rules/fastapi-anyio-structured-taskgroup-guardrail?format=mdc","cursorrules":"/api/rules/fastapi-anyio-structured-taskgroup-guardrail?format=cursor","windsurf":"/api/rules/fastapi-anyio-structured-taskgroup-guardrail?format=windsurf","agents":"/api/rules/fastapi-anyio-structured-taskgroup-guardrail?format=agents"}},{"id":"bun-v12-s3-streaming-backpressure-protocol","title":"Bun 1.2 Native S3 Streaming Backpressure Protocol & Zero-Heap Invariant","category":"backend","severity":"critical","description":"Enforces process-safe object ingestion by piping raw HTTP incoming ReadableStreams directly into Bun 1.2's native S3 client without heap allocation. Bypassing native backpressure by materializing payloads via ArrayBuffer, Blob, or unthrottled AsyncIterables causes deterministic kernel OOM kills under concurrent multipart workloads. All S3 egress and ingress pipelines must bind native TCP socket backpressure to S3 upload sinks.","antiPatternHeadline":"Buffering In-Flight HTTP Request Payloads in V8/JSC Heap Prior to S3 Transmission","stars_count":88,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","s3","streaming","backpressure","memory-leak","performance"],"exportEndpoints":{"claude":"/api/rules/bun-v12-s3-streaming-backpressure-protocol?format=claude","cursorMdc":"/api/rules/bun-v12-s3-streaming-backpressure-protocol?format=mdc","cursorrules":"/api/rules/bun-v12-s3-streaming-backpressure-protocol?format=cursor","windsurf":"/api/rules/bun-v12-s3-streaming-backpressure-protocol?format=windsurf","agents":"/api/rules/bun-v12-s3-streaming-backpressure-protocol?format=agents"}},{"id":"pg17-json-table-optimization-standard","title":"PostgreSQL 17 SQL/JSON JSON_TABLE Optimization & Memory Streaming Guardrail","category":"backend","severity":"critical","description":"Enforces strict type-directed path expressions, explicit column projections, and memory-bounded streaming evaluation when using PostgreSQL 17 JSON_TABLE constructs. Prevents catastrophic query plan degradation, OOM crashes, and 100% CPU pinning caused by unoptimized JSONB materialization, implicit path conversions, and untyped recursive descent over high-throughput event streams.","antiPatternHeadline":"Untyped Wildcard JSON_TABLE Queries Causing Intermediate Materialization & CPU Saturation","stars_count":59,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql-17","json-table","sql-json","query-optimization","database-performance"],"exportEndpoints":{"claude":"/api/rules/pg17-json-table-optimization-standard?format=claude","cursorMdc":"/api/rules/pg17-json-table-optimization-standard?format=mdc","cursorrules":"/api/rules/pg17-json-table-optimization-standard?format=cursor","windsurf":"/api/rules/pg17-json-table-optimization-standard?format=windsurf","agents":"/api/rules/pg17-json-table-optimization-standard?format=agents"}},{"id":"webauthn-conditional-ui-session-guardrail","title":"WebAuthn Conditional UI Single-Use Challenge and Session Binding","category":"security","severity":"critical","description":"Enforces atomic, single-use cryptographically bound challenge validation for WebAuthn Conditional UI (autofill) interactions. Prevents race-condition authentication hijacking, replay attacks, and session fixation by requiring challenge consumption to be atomic and strictly bound to the initiating client session.","antiPatternHeadline":"Reusing Challenges or Verifying Conditional UI Assertions Non-Atomically","stars_count":52,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","passkeys","fido2","session-fixation","race-conditions"],"exportEndpoints":{"claude":"/api/rules/webauthn-conditional-ui-session-guardrail?format=claude","cursorMdc":"/api/rules/webauthn-conditional-ui-session-guardrail?format=mdc","cursorrules":"/api/rules/webauthn-conditional-ui-session-guardrail?format=cursor","windsurf":"/api/rules/webauthn-conditional-ui-session-guardrail?format=windsurf","agents":"/api/rules/webauthn-conditional-ui-session-guardrail?format=agents"}},{"id":"openfga-contextual-tuple-transient-lifetime-invariant","title":"OpenFGA Contextual Tuple Transient Lifetime and Cache Invalidation Invariant","category":"security","severity":"critical","description":"Enforces strict temporal bounding and atomic invalidation on OpenFGA dynamic contextual tuples used in runtime authorization checks. Guarantees zero-trust authorization freshness by prohibiting the caching, reuse, or leaking of ephemeral contextual grants across asynchronous execution boundaries or post-revocation states.","antiPatternHeadline":"Persisting, Reusing, or Statically Caching Ephemeral OpenFGA Contextual Tuples Across Disjoint Requests","stars_count":102,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","authorization","zero-trust","cache-invalidation","iam"],"exportEndpoints":{"claude":"/api/rules/openfga-contextual-tuple-transient-lifetime-invariant?format=claude","cursorMdc":"/api/rules/openfga-contextual-tuple-transient-lifetime-invariant?format=mdc","cursorrules":"/api/rules/openfga-contextual-tuple-transient-lifetime-invariant?format=cursor","windsurf":"/api/rules/openfga-contextual-tuple-transient-lifetime-invariant?format=windsurf","agents":"/api/rules/openfga-contextual-tuple-transient-lifetime-invariant?format=agents"}},{"id":"otel-arrow-stream-backpressure-standard","title":"OpenTelemetry Arrow Protocol Columnar Record Batch Backpressure Standard","category":"devops","severity":"critical","description":"Enforces strict heap-bounded memory allocation and adaptive credit-based stream throttling across OpenTelemetry Arrow protocol pipelines. Prohibits unbound RecordBatch construction and downstream push buffers lacking reactive admission control. Prevents fatal Out-Of-Memory (OOM) collector termination during hyper-dimensional metric and trace cardinality spikes.","antiPatternHeadline":"Unbounded Arrow RecordBatch Allocation with Decoupled Push Exporters Leading to Collector Node OOM","stars_count":62,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","arrow","backpressure","memory-management","go","streaming"],"exportEndpoints":{"claude":"/api/rules/otel-arrow-stream-backpressure-standard?format=claude","cursorMdc":"/api/rules/otel-arrow-stream-backpressure-standard?format=mdc","cursorrules":"/api/rules/otel-arrow-stream-backpressure-standard?format=cursor","windsurf":"/api/rules/otel-arrow-stream-backpressure-standard?format=windsurf","agents":"/api/rules/otel-arrow-stream-backpressure-standard?format=agents"}},{"id":"svelte-5-runes-async-boundary-cleanup-standard","title":"Svelte 5 Runes Async Boundary & $effect.root Cleanup Invariant","category":"frontend","severity":"critical","description":"Enforces deterministic lifecycle disposal for Svelte 5 reactive trees crossing asynchronous boundaries or instantiated outside component trees. Prevents zombie computations, uncollected signal subgraphs, and memory exhaustion in isomorphic streaming SSR and long-lived single-page applications.","antiPatternHeadline":"Instantiating Unmanaged $effect.root Subgraphs or Creating Reactive Effects Across Await Boundaries Without Explicit Teardown","stars_count":86,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","reactivity","ssr-streaming","memory-leaks"],"exportEndpoints":{"claude":"/api/rules/svelte-5-runes-async-boundary-cleanup-standard?format=claude","cursorMdc":"/api/rules/svelte-5-runes-async-boundary-cleanup-standard?format=mdc","cursorrules":"/api/rules/svelte-5-runes-async-boundary-cleanup-standard?format=cursor","windsurf":"/api/rules/svelte-5-runes-async-boundary-cleanup-standard?format=windsurf","agents":"/api/rules/svelte-5-runes-async-boundary-cleanup-standard?format=agents"}},{"id":"fastapi-anyio-taskgroup-cancellation-drain","title":"FastAPI AnyIO Structured TaskGroup Cancellation and Shielded Resource Drain","category":"backend","severity":"critical","description":"Enforces AnyIO structured concurrency within FastAPI route lifecycles to guarantee deterministic cancellation cascading on client aborts. Mandates shielded cleanup scopes during task teardown to prevent connection leaks, orphaned coroutines, and corrupted resource drains.","antiPatternHeadline":"Spawning unmanaged background coroutines and unshielded cleanup handlers during ASGI client disconnects.","stars_count":86,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","anyio","structured-concurrency","cancellation","resource-management"],"exportEndpoints":{"claude":"/api/rules/fastapi-anyio-taskgroup-cancellation-drain?format=claude","cursorMdc":"/api/rules/fastapi-anyio-taskgroup-cancellation-drain?format=mdc","cursorrules":"/api/rules/fastapi-anyio-taskgroup-cancellation-drain?format=cursor","windsurf":"/api/rules/fastapi-anyio-taskgroup-cancellation-drain?format=windsurf","agents":"/api/rules/fastapi-anyio-taskgroup-cancellation-drain?format=agents"}},{"id":"hybrid-post-quantum-tls-ingress-standard","title":"Enforce Hybrid Post-Quantum TLS 1.3 (X25519MLKEM768) Ingress Key Exchange","category":"security","severity":"critical","description":"Enforces TLS 1.3 ingress configurations to negotiate hybrid post-quantum key encapsulation mechanisms, specifically X25519MLKEM768 (or legacy drafting identifier X25519Kyber768Draft00), while maintaining TLS 1.3 protocol baselines. This standard neutralizes Harvest Now, Decrypt Later (HNDL) attacks targeting enterprise transport layers by guaranteeing that session forward secrecy is anchored by both classical elliptic curves and lattice-based cryptography.","antiPatternHeadline":"Configuring classical-only elliptic curves (e.g., pure X25519 or secp256r1) or allowing TLS 1.2 downgrades on sensitive ingress listeners.","stars_count":103,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","post-quantum","tls","cryptography","ingress","hndl-mitigation"],"exportEndpoints":{"claude":"/api/rules/hybrid-post-quantum-tls-ingress-standard?format=claude","cursorMdc":"/api/rules/hybrid-post-quantum-tls-ingress-standard?format=mdc","cursorrules":"/api/rules/hybrid-post-quantum-tls-ingress-standard?format=cursor","windsurf":"/api/rules/hybrid-post-quantum-tls-ingress-standard?format=windsurf","agents":"/api/rules/hybrid-post-quantum-tls-ingress-standard?format=agents"}},{"id":"cilium-tetragon-ebpf-syscall-kill-invariant","title":"Cilium Tetragon Kernel-Space Syscall Kill and Namespace Isolation Invariant","category":"devops","severity":"critical","description":"Enforces synchronous, sub-millisecond kernel-space mitigation against zero-day container escapes using Cilium Tetragon eBPF TracingPolicy definitions. Prevents unauthorized execution of dangerous syscalls (such as sys_enter_setns, sys_enter_pivot_root, and sys_enter_bpf) by directly terminating hostile execution contexts via kernel-level SIGKILL rather than relying on delayed userspace alerting.","antiPatternHeadline":"Audit-Only Logging and Deferred Userspace Interception for Privilege Escalation and Container Escape Syscalls","stars_count":65,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","cilium-tetragon","ebpf","zero-trust","container-escape","runtime-security","kubernetes"],"exportEndpoints":{"claude":"/api/rules/cilium-tetragon-ebpf-syscall-kill-invariant?format=claude","cursorMdc":"/api/rules/cilium-tetragon-ebpf-syscall-kill-invariant?format=mdc","cursorrules":"/api/rules/cilium-tetragon-ebpf-syscall-kill-invariant?format=cursor","windsurf":"/api/rules/cilium-tetragon-ebpf-syscall-kill-invariant?format=windsurf","agents":"/api/rules/cilium-tetragon-ebpf-syscall-kill-invariant?format=agents"}},{"id":"android-15-16kb-page-alignment-ndk-guardrail","title":"Android 15 16KB Memory Page Alignment Invariants for Native NDK Toolchains","category":"mobile","severity":"critical","description":"Android 15 introduces support for 16KB physical memory page sizes on ARM64 hardware, shifting away from the legacy 4KB page assumption. Shared libraries (.so) built with native NDK toolchains that fail to align ELF segments (PT_LOAD) to 16KB boundaries will trigger immediate dynamic linker crashes (dlopen failures) and SIGSEGV faults at runtime. Engineers must enforce strict 16KB linker alignment in CMake/ndk-build configurations, eliminate hardcoded 4KB page assumptions in native mmap/mprotect invocations, and ensure vendor prebuilts pass verification.","antiPatternHeadline":"Compiling NDK native libraries with legacy 4KB ELF segment alignment or hardcoding 4096-byte offsets in mmap calls","stars_count":102,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","android","ndk","android-15","memory-management","arm64","cmake","c-plus-plus"],"exportEndpoints":{"claude":"/api/rules/android-15-16kb-page-alignment-ndk-guardrail?format=claude","cursorMdc":"/api/rules/android-15-16kb-page-alignment-ndk-guardrail?format=mdc","cursorrules":"/api/rules/android-15-16kb-page-alignment-ndk-guardrail?format=cursor","windsurf":"/api/rules/android-15-16kb-page-alignment-ndk-guardrail?format=windsurf","agents":"/api/rules/android-15-16kb-page-alignment-ndk-guardrail?format=agents"}},{"id":"rfc9396-rich-authorization-requests-transaction-binding","title":"RFC 9396 Rich Authorization Requests & Fine-Grained Transaction Binding","category":"security","severity":"critical","description":"Eliminates coarse scope-bloat and authorization escalation by enforcing RFC 9396 'authorization_details' verification across all sensitive resource operations. Resource servers must cryptographically bind incoming request payloads to specific, structured transaction intents (amounts, currencies, destination identifiers, and action verbs) rather than relying on generic, reusable OAuth scopes.","antiPatternHeadline":"Authorizing High-Assurance Operations via Coarse Scopes Without Validating Structured Authorization Details","stars_count":82,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","oauth2","rfc9396","authorization","api-security","zero-trust"],"exportEndpoints":{"claude":"/api/rules/rfc9396-rich-authorization-requests-transaction-binding?format=claude","cursorMdc":"/api/rules/rfc9396-rich-authorization-requests-transaction-binding?format=mdc","cursorrules":"/api/rules/rfc9396-rich-authorization-requests-transaction-binding?format=cursor","windsurf":"/api/rules/rfc9396-rich-authorization-requests-transaction-binding?format=windsurf","agents":"/api/rules/rfc9396-rich-authorization-requests-transaction-binding?format=agents"}},{"id":"drizzle-orm-zero-downtime-migration-advisory-locking-standard","title":"Drizzle ORM Zero-Downtime Safe DDL Migrations & Advisory Locking Standard","category":"backend","severity":"critical","description":"Enforces non-blocking zero-downtime database migrations with Drizzle ORM through strict PostgreSQL advisory locking, bounded lock timeouts, and multi-phase expand-contract schema evolution. Eliminates race conditions across auto-scaling replicas and prevents cascading connection pool exhaustion caused by unconstrained ACCESS EXCLUSIVE locks.","antiPatternHeadline":"Running concurrent unprotected Drizzle migrations on app boot without advisory locks or bounded lock timeouts.","stars_count":72,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","drizzle-orm","postgresql","zero-downtime","migrations","concurrency"],"exportEndpoints":{"claude":"/api/rules/drizzle-orm-zero-downtime-migration-advisory-locking-standard?format=claude","cursorMdc":"/api/rules/drizzle-orm-zero-downtime-migration-advisory-locking-standard?format=mdc","cursorrules":"/api/rules/drizzle-orm-zero-downtime-migration-advisory-locking-standard?format=cursor","windsurf":"/api/rules/drizzle-orm-zero-downtime-migration-advisory-locking-standard?format=windsurf","agents":"/api/rules/drizzle-orm-zero-downtime-migration-advisory-locking-standard?format=agents"}},{"id":"react-19-useoptimistic-reconciliation-invariants","title":"React 19 useOptimistic Rollback and Server State Reconciliation Invariants","category":"frontend","severity":"critical","description":"Enforces transactional integrity and deterministic reconciliation when using React 19 useOptimistic under high-frequency mutations and unstable network conditions. Guarantees that optimistic updates occur strictly within React Transition boundaries and rely on immutable base states to prevent state tearing, ghost rollbacks, and race-condition UI thrashing. Mandates idempotent sequence tracking so rejected mutations cleanly roll back without corrupting subsequent inflight actions.","antiPatternHeadline":"Mutating Parallel Local State and Bypassing Transition Boundaries in React 19 Optimistic UI","stars_count":84,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["react-19","use-optimistic","state-reconciliation","concurrency","transitions"],"exportEndpoints":{"claude":"/api/rules/react-19-useoptimistic-reconciliation-invariants?format=claude","cursorMdc":"/api/rules/react-19-useoptimistic-reconciliation-invariants?format=mdc","cursorrules":"/api/rules/react-19-useoptimistic-reconciliation-invariants?format=cursor","windsurf":"/api/rules/react-19-useoptimistic-reconciliation-invariants?format=windsurf","agents":"/api/rules/react-19-useoptimistic-reconciliation-invariants?format=agents"}},{"id":"k8s-dra-gpu-slicing-invariant","title":"Kubernetes DRA v1beta1 Declarative Structured GPU Slicing Enforcement","category":"devops","severity":"critical","description":"Enforces Dynamic Resource Allocation (DRA v1beta1) with Structured Parameters for AI inference workloads instead of opaque integer-based extended resources. Prevents GPU memory fragmentation and cross-tenant noisy-neighbor starvation by requiring driver-orchestrated hardware slicing (MIG or hardware time-sharing) coupled directly to ResourceClaimTemplates. Guarantees deterministic device allocation, predictable latency SLAs, and precise co-scheduling at the Kubernetes scheduler layer.","antiPatternHeadline":"Legacy integer extended-resource GPU bin-packing with opaque host-level time-slicing and unmanaged VRAM exhaustion","stars_count":96,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","kubernetes","dra","gpu-slicing","cuda","vllm","resource-claims","v1beta1"],"exportEndpoints":{"claude":"/api/rules/k8s-dra-gpu-slicing-invariant?format=claude","cursorMdc":"/api/rules/k8s-dra-gpu-slicing-invariant?format=mdc","cursorrules":"/api/rules/k8s-dra-gpu-slicing-invariant?format=cursor","windsurf":"/api/rules/k8s-dra-gpu-slicing-invariant?format=windsurf","agents":"/api/rules/k8s-dra-gpu-slicing-invariant?format=agents"}},{"id":"react-native-bridgeless-turbomodule-concurrency-guardrail","title":"React Native Bridgeless TurboModule Concurrency Isolation & JSI Buffer Safety","category":"mobile","severity":"critical","description":"Enforces strict thread-affinity and memory safety guarantees for React Native Bridgeless C++ TurboModules interacting via the JavaScript Interface (JSI). Prevents direct cross-thread capture or dereferencing of raw jsi::Runtime pointers and guarantees non-torn zero-copy operations over shared ArrayBuffer memory across background worker queues and the JS engine thread.","antiPatternHeadline":"Dereferencing raw JSI pointers or mutating zero-copy memory buffers across asynchronous C++ background threads without CallInvoker synchronization.","stars_count":77,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","react-native","bridgeless","turbomodules","jsi","concurrency","c++"],"exportEndpoints":{"claude":"/api/rules/react-native-bridgeless-turbomodule-concurrency-guardrail?format=claude","cursorMdc":"/api/rules/react-native-bridgeless-turbomodule-concurrency-guardrail?format=mdc","cursorrules":"/api/rules/react-native-bridgeless-turbomodule-concurrency-guardrail?format=cursor","windsurf":"/api/rules/react-native-bridgeless-turbomodule-concurrency-guardrail?format=windsurf","agents":"/api/rules/react-native-bridgeless-turbomodule-concurrency-guardrail?format=agents"}},{"id":"react19-activity-offscreen-state-preservation-standard","title":"React 19 Activity API Offscreen Fiber State Preservation and Resource Management","category":"frontend","severity":"critical","description":"Establishes production invariants for React 19 Activity (Offscreen) boundary usage during multi-tab and multi-view navigation. Enforces deterministic DOM detachment, fiber cache retention, and strict cleanup of background render timers, web workers, and WebGL contexts to prevent memory bloat and CPU starvation.","antiPatternHeadline":"Uncontrolled Background Fiber Execution and Memory Leakage via Hidden React 19 Activity Boundaries","stars_count":40,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","activity-api","offscreen","fiber-reconciliation","memory-management"],"exportEndpoints":{"claude":"/api/rules/react19-activity-offscreen-state-preservation-standard?format=claude","cursorMdc":"/api/rules/react19-activity-offscreen-state-preservation-standard?format=mdc","cursorrules":"/api/rules/react19-activity-offscreen-state-preservation-standard?format=cursor","windsurf":"/api/rules/react19-activity-offscreen-state-preservation-standard?format=windsurf","agents":"/api/rules/react19-activity-offscreen-state-preservation-standard?format=agents"}},{"id":"postgres-17-streaming-io-bulk-write-invariant","title":"Postgres 17 Streaming I/O Engine Vectorized Bulk Ingestion Invariant","category":"backend","severity":"critical","description":"Governs the orchestration of multi-terabyte transactional writes against PostgreSQL 17's streaming I/O subsystem. Mandates aligned, asynchronous buffer pipelining and direct COPY streams to prevent shared buffer cache eviction spirals and synchronous kernel write stalls. Ensures ingestion worker memory pools remain isolated from general OLTP buffer allocations.","antiPatternHeadline":"Unbuffered Micro-Batching with Transactional Thrashing and Kernel Cache Dirtying","stars_count":45,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres-17","streaming-io","bulk-ingest","database-performance"],"exportEndpoints":{"claude":"/api/rules/postgres-17-streaming-io-bulk-write-invariant?format=claude","cursorMdc":"/api/rules/postgres-17-streaming-io-bulk-write-invariant?format=mdc","cursorrules":"/api/rules/postgres-17-streaming-io-bulk-write-invariant?format=cursor","windsurf":"/api/rules/postgres-17-streaming-io-bulk-write-invariant?format=windsurf","agents":"/api/rules/postgres-17-streaming-io-bulk-write-invariant?format=agents"}},{"id":"fastapi-anyio-taskgroup-scope-guardrail","title":"FastAPI AnyIO Structured TaskGroup Scoping and Connection Leak Prevention","category":"backend","severity":"critical","description":"Mandates that all asynchronous concurrency within FastAPI endpoints and worker routines is bounded by strict AnyIO TaskGroup scopes. Unbounded concurrency primitives like asyncio.create_task bypass FastAPI cancellation tokens during client disconnections, causing orphaned database pool checkouts and catastrophic resource starvation. Enforces fail-fast exception boundaries and deterministic teardown across all child coroutines.","antiPatternHeadline":"Unbounded Background Task Spawning with Escaped Async Resources on Client Disconnect","stars_count":107,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","anyio","concurrency","asyncio","resource-leak"],"exportEndpoints":{"claude":"/api/rules/fastapi-anyio-taskgroup-scope-guardrail?format=claude","cursorMdc":"/api/rules/fastapi-anyio-taskgroup-scope-guardrail?format=mdc","cursorrules":"/api/rules/fastapi-anyio-taskgroup-scope-guardrail?format=cursor","windsurf":"/api/rules/fastapi-anyio-taskgroup-scope-guardrail?format=windsurf","agents":"/api/rules/fastapi-anyio-taskgroup-scope-guardrail?format=agents"}},{"id":"kmp-skie-swift-task-cancellation-bridge-kotlin-multiplat-606","title":"Bidirectional Coroutine and Swift Task Cancellation via SKIE Bridge","category":"mobile","severity":"critical","description":"Enforces deterministic bidirectional cancellation propagation between Swift Tasks and Kotlin Coroutines across the Swift/Kotlin Native FFI boundary using Touchlab SKIE. Prevents thread pool starvation, native memory leaks, and corrupt asynchronous state caused by severed cancellation signals and generic exception swallowing.","antiPatternHeadline":"Catch-All Exception Swallowing and Unstructured Swift Tasks Severing Cooperative Cancellation","stars_count":77,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kmp","skie","swift","kotlin","concurrency","ios"],"exportEndpoints":{"claude":"/api/rules/kmp-skie-swift-task-cancellation-bridge-kotlin-multiplat-606?format=claude","cursorMdc":"/api/rules/kmp-skie-swift-task-cancellation-bridge-kotlin-multiplat-606?format=mdc","cursorrules":"/api/rules/kmp-skie-swift-task-cancellation-bridge-kotlin-multiplat-606?format=cursor","windsurf":"/api/rules/kmp-skie-swift-task-cancellation-bridge-kotlin-multiplat-606?format=windsurf","agents":"/api/rules/kmp-skie-swift-task-cancellation-bridge-kotlin-multiplat-606?format=agents"}},{"id":"tauri-v2-mobile-ffi-direct-buffer-ownership","title":"Tauri 2.0 Mobile Plugin FFI Direct Buffer Ownership & Lifetime Standard","category":"mobile","severity":"critical","description":"Regulates memory ownership, lifecycle pinning, and deallocation boundaries for direct zero-copy byte buffers passed across Tauri 2.0 mobile FFI boundaries. Enforces explicit ownership transfer primitives and prevents cross-runtime deallocator mismatches between the Rust core and Swift/Kotlin host environments.","antiPatternHeadline":"Cross-Runtime Double-Frees and Undefined Behavior via Implicit Foreign Buffer Deallocation","stars_count":115,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri-2","rust","swift","kotlin","ffi","memory-safety"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-mobile-ffi-direct-buffer-ownership?format=claude","cursorMdc":"/api/rules/tauri-v2-mobile-ffi-direct-buffer-ownership?format=mdc","cursorrules":"/api/rules/tauri-v2-mobile-ffi-direct-buffer-ownership?format=cursor","windsurf":"/api/rules/tauri-v2-mobile-ffi-direct-buffer-ownership?format=windsurf","agents":"/api/rules/tauri-v2-mobile-ffi-direct-buffer-ownership?format=agents"}},{"id":"webauthn-prf-zk-e2ee-key-derivation-standard-webauthn-prf-ext-890","title":"Zero-Knowledge Hardware-Bound Key Derivation via WebAuthn PRF Extension","category":"security","severity":"critical","description":"Enforces cryptographically isolated, client-side encryption key derivation directly from hardware authenticators using the WebAuthn Pseudo-Random Function (PRF) extension (HMAC-secret). Guarantees zero-knowledge end-to-end encryption by ensuring symmetric key material is derived via HKDF from PRF outputs using application-scoped salts and never leaves client volatile memory unencrypted.","antiPatternHeadline":"Deriving E2EE Keys from WebAuthn Signatures, Raw Challenge Hashes, or Storing Unwrapped Master Keys Server-Side","stars_count":112,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","passkeys","prf-extension","e2ee","cryptography","hkdf"],"exportEndpoints":{"claude":"/api/rules/webauthn-prf-zk-e2ee-key-derivation-standard-webauthn-prf-ext-890?format=claude","cursorMdc":"/api/rules/webauthn-prf-zk-e2ee-key-derivation-standard-webauthn-prf-ext-890?format=mdc","cursorrules":"/api/rules/webauthn-prf-zk-e2ee-key-derivation-standard-webauthn-prf-ext-890?format=cursor","windsurf":"/api/rules/webauthn-prf-zk-e2ee-key-derivation-standard-webauthn-prf-ext-890?format=windsurf","agents":"/api/rules/webauthn-prf-zk-e2ee-key-derivation-standard-webauthn-prf-ext-890?format=agents"}},{"id":"openfga-contextual-tuples-consistency-barrier","title":"OpenFGA Monotonic Snapshot & Contextual Tuple Consistency Guardrail","category":"security","severity":"critical","description":"Enforces strict monotonic snapshot barriers and contextual tuple reconciliation across OpenFGA authorization checks to prevent the New Enemy vulnerability and unauthorized stale read-after-write evaluations. Mandates explicit consistency constraints and temporal validation across distributed authorization checks.","antiPatternHeadline":"Stale Replica Evaluations and Unbounded Contextual Tuples in Read-After-Write Paths","stars_count":83,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","authorization","zanzibar","consistency","distributed-systems"],"exportEndpoints":{"claude":"/api/rules/openfga-contextual-tuples-consistency-barrier?format=claude","cursorMdc":"/api/rules/openfga-contextual-tuples-consistency-barrier?format=mdc","cursorrules":"/api/rules/openfga-contextual-tuples-consistency-barrier?format=cursor","windsurf":"/api/rules/openfga-contextual-tuples-consistency-barrier?format=windsurf","agents":"/api/rules/openfga-contextual-tuples-consistency-barrier?format=agents"}},{"id":"otel-ebpf-profiling-stack-unwinding-standard","title":"OpenTelemetry Continuous Profiling eBPF Stack Unwinding and Trace Correlation Standard","category":"devops","severity":"critical","description":"Enforces strict compilation, unwinding, and context-propagation standards for eBPF continuous on-CPU and off-CPU profiling. Guarantees frame-pointer preservation, synchronized monotonic clock domains, and exact microsecond-level correlation between eBPF kernel stack samples and W3C distributed trace spans.","antiPatternHeadline":"Broken Stack Unwinding and Desynchronized Wall-Clock Profiler Traces Due to Omitted Frame Pointers and Unmapped Thread-Local Context","stars_count":95,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","opentelemetry","continuous-profiling","observability","distributed-tracing","kernel"],"exportEndpoints":{"claude":"/api/rules/otel-ebpf-profiling-stack-unwinding-standard?format=claude","cursorMdc":"/api/rules/otel-ebpf-profiling-stack-unwinding-standard?format=mdc","cursorrules":"/api/rules/otel-ebpf-profiling-stack-unwinding-standard?format=cursor","windsurf":"/api/rules/otel-ebpf-profiling-stack-unwinding-standard?format=windsurf","agents":"/api/rules/otel-ebpf-profiling-stack-unwinding-standard?format=agents"}},{"id":"sigstore-ephemeral-oidc-attestation-standard","title":"Sigstore Ephemeral OIDC Fulcio-Rekor Supply Chain Attestation Verification","category":"devops","severity":"critical","description":"Enforces non-repudiable cryptographic build provenance and keyless container verification using Sigstore's Fulcio CA and Rekor transparency log. Rejects all static long-lived private signing keys and mandates strict verification of OIDC identity issuer claims, Rekor bundle inclusion, and SLSA provenance at admission time before deployment.","antiPatternHeadline":"Deploying container images signed with long-lived static private keys or verifying Cosign signatures without strict OIDC issuer and Rekor transparency constraints","stars_count":97,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","sigstore","cosign","supply-chain-security","rekor","fulcio","admission-control","kubernetes"],"exportEndpoints":{"claude":"/api/rules/sigstore-ephemeral-oidc-attestation-standard?format=claude","cursorMdc":"/api/rules/sigstore-ephemeral-oidc-attestation-standard?format=mdc","cursorrules":"/api/rules/sigstore-ephemeral-oidc-attestation-standard?format=cursor","windsurf":"/api/rules/sigstore-ephemeral-oidc-attestation-standard?format=windsurf","agents":"/api/rules/sigstore-ephemeral-oidc-attestation-standard?format=agents"}},{"id":"openfga-zanzibar-cycle-depth-barrier","title":"OpenFGA Zanzibar Hierarchical Cycle and Depth Barrier","category":"security","severity":"critical","description":"Enforces bounded traversal invariants, cycle guards, and deterministic recursion ceilings across graph-based relationship tuples in OpenFGA and Zanzibar authorization implementations. Unbounded graph queries and cyclical relationship assignments expose authorization engines to catastrophic denial-of-service, goroutine starvation, and compute amplification attacks.","antiPatternHeadline":"Unbounded recursive tuple resolution allowing cyclical dependencies and resource exhaustion during authorization checks","stars_count":83,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","zanzibar","authorization","rebac","cycle-detection","rate-limiting"],"exportEndpoints":{"claude":"/api/rules/openfga-zanzibar-cycle-depth-barrier?format=claude","cursorMdc":"/api/rules/openfga-zanzibar-cycle-depth-barrier?format=mdc","cursorrules":"/api/rules/openfga-zanzibar-cycle-depth-barrier?format=cursor","windsurf":"/api/rules/openfga-zanzibar-cycle-depth-barrier?format=windsurf","agents":"/api/rules/openfga-zanzibar-cycle-depth-barrier?format=agents"}},{"id":"fastapi-anyio4-taskgroup-cancellation-propagation-standard","title":"FastAPI AnyIO 4 TaskGroup Cancellation Propagation Standard","category":"backend","severity":"critical","description":"Enforces fail-safe structured concurrency under AnyIO 4 and ASGI servers by guaranteeing client disconnect signals cascade immediately into database execution boundaries. Prevents silent cancellation absorption and unmanaged asyncio task detachment that lead to orphan query thread starvation, connection pool exhaustion, and zombie writes.","antiPatternHeadline":"Swallowing CancelledError in Generic Exception Handlers and Spawning Detached Background Tasks Across DB Transactions","stars_count":61,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","anyio","structured-concurrency","sqlalchemy","asyncpg"],"exportEndpoints":{"claude":"/api/rules/fastapi-anyio4-taskgroup-cancellation-propagation-standard?format=claude","cursorMdc":"/api/rules/fastapi-anyio4-taskgroup-cancellation-propagation-standard?format=mdc","cursorrules":"/api/rules/fastapi-anyio4-taskgroup-cancellation-propagation-standard?format=cursor","windsurf":"/api/rules/fastapi-anyio4-taskgroup-cancellation-propagation-standard?format=windsurf","agents":"/api/rules/fastapi-anyio4-taskgroup-cancellation-propagation-standard?format=agents"}},{"id":"webauthn-prf-zero-knowledge-derivation-standard","title":"WebAuthn PRF Extension Zero-Knowledge Key Derivation Standard","category":"security","severity":"critical","description":"Enforces hardware-bound symmetric key derivation using the WebAuthn Pseudo-Random Function (PRF) extension directly within the browser context. Prohibits transiting raw PRF outputs, evaluation inputs, or derived master encryption keys across network boundaries, guaranteeing zero-knowledge client-side encryption. Mandates HKDF-SHA-256 contextual expansion and strict validation of authenticator PRF capabilities during registration and authentication assertions.","antiPatternHeadline":"Transmitting Raw Passkey PRF Secrets to Servers or Deriving Symmetric Keys Without Salt Separation","stars_count":68,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","prf-extension","zero-knowledge","e2ee","web-crypto"],"exportEndpoints":{"claude":"/api/rules/webauthn-prf-zero-knowledge-derivation-standard?format=claude","cursorMdc":"/api/rules/webauthn-prf-zero-knowledge-derivation-standard?format=mdc","cursorrules":"/api/rules/webauthn-prf-zero-knowledge-derivation-standard?format=cursor","windsurf":"/api/rules/webauthn-prf-zero-knowledge-derivation-standard?format=windsurf","agents":"/api/rules/webauthn-prf-zero-knowledge-derivation-standard?format=agents"}},{"id":"pgvector-hnsw-shared-buffer-isolation-guardrail","title":"PostgreSQL 17 pgvector HNSW Shared-Buffer Working Set Isolation","category":"backend","severity":"critical","description":"High-dimensional HNSW index graph traversals produce non-sequential page access patterns across multi-gigabyte working sets that evict hot OLTP relation pages from Postgres shared_buffers. In hybrid vector-relational workloads, HNSW query execution must be isolated through dedicated connection pools with strict session-level memory caps, materialized pre-filtering, or separated storage partitions to prevent cache thrashing and tail-latency amplification.","antiPatternHeadline":"Unconstrained In-Line HNSW Graph Traversal in Core OLTP Shared Buffers","stars_count":114,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","pgvector","hnsw","performance","database","memory-management"],"exportEndpoints":{"claude":"/api/rules/pgvector-hnsw-shared-buffer-isolation-guardrail?format=claude","cursorMdc":"/api/rules/pgvector-hnsw-shared-buffer-isolation-guardrail?format=mdc","cursorrules":"/api/rules/pgvector-hnsw-shared-buffer-isolation-guardrail?format=cursor","windsurf":"/api/rules/pgvector-hnsw-shared-buffer-isolation-guardrail?format=windsurf","agents":"/api/rules/pgvector-hnsw-shared-buffer-isolation-guardrail?format=agents"}},{"id":"android-15-credential-manager-strongbox-attestation","title":"Android 15 Credential Manager StrongBox Hardware Attestation Guardrail","category":"mobile","severity":"critical","description":"Enforces mandatory StrongBox KeyMint hardware isolation and cryptographic attestation chain verification for biometric Passkey operations via Android 15 Credential Manager. Prohibits silent software or standard TEE fallback for high-assurance credentials on compromised or rooted devices. Mandates fail-closed semantics when dedicated tamper-resistant hardware security modules are unavailable.","antiPatternHeadline":"Silent Downgrade to Software Keystore or Omitting Hardware Key Attestation during Passkey Operations","stars_count":78,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","android","android-15","credential-manager","strongbox","passkeys","keymint","hardware-attestation"],"exportEndpoints":{"claude":"/api/rules/android-15-credential-manager-strongbox-attestation?format=claude","cursorMdc":"/api/rules/android-15-credential-manager-strongbox-attestation?format=mdc","cursorrules":"/api/rules/android-15-credential-manager-strongbox-attestation?format=cursor","windsurf":"/api/rules/android-15-credential-manager-strongbox-attestation?format=windsurf","agents":"/api/rules/android-15-credential-manager-strongbox-attestation?format=agents"}},{"id":"iceberg-rest-catalog-occ-commit-barrier-production-standard","title":"Apache Iceberg REST Catalog Optimistic Concurrency Control (OCC) Commit Barrier","category":"devops","severity":"critical","description":"Enforces strict optimistic concurrency control (OCC) assertions and monotonic snapshot lineage across federated analytical compute engines interacting with Apache Iceberg REST Catalogs. Prevents split-brain metadata states, stale-pointer overwrites, and silent data loss by mandating prerequisite validation tokens and linear conflict resolution protocols during commit cycles.","antiPatternHeadline":"Blind Pointer Swaps and Assertionless Metadata Commits Causing Silent Lakehouse Split-Brain Corruption","stars_count":57,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","apache-iceberg","rest-catalog","lakehouse","concurrency","distributed-systems","data-integrity"],"exportEndpoints":{"claude":"/api/rules/iceberg-rest-catalog-occ-commit-barrier-production-standard?format=claude","cursorMdc":"/api/rules/iceberg-rest-catalog-occ-commit-barrier-production-standard?format=mdc","cursorrules":"/api/rules/iceberg-rest-catalog-occ-commit-barrier-production-standard?format=cursor","windsurf":"/api/rules/iceberg-rest-catalog-occ-commit-barrier-production-standard?format=windsurf","agents":"/api/rules/iceberg-rest-catalog-occ-commit-barrier-production-standard?format=agents"}},{"id":"tauri-v2-dynamic-capability-scope-invariant","title":"Tauri 2.0 Dynamic Capability Scope and Remote Webview Isolation Invariant","category":"frontend","severity":"critical","description":"Enforces strict origin-to-command capability mapping and deterministic window labeling in Tauri 2.0 architectures to prevent privilege escalation via IPC bridge exposure. Guarantees that dynamically spawned webviews and remote contexts cannot inherit ambient native permissions or execute unauthorized backend commands.","antiPatternHeadline":"Spawning Dynamic Webview Contexts with Ambient Capability Inheritance and Unscoped Remote IPC Execution","stars_count":67,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","tauri-2","security","ipc-acl","sandboxing","capabilities"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-dynamic-capability-scope-invariant?format=claude","cursorMdc":"/api/rules/tauri-v2-dynamic-capability-scope-invariant?format=mdc","cursorrules":"/api/rules/tauri-v2-dynamic-capability-scope-invariant?format=cursor","windsurf":"/api/rules/tauri-v2-dynamic-capability-scope-invariant?format=windsurf","agents":"/api/rules/tauri-v2-dynamic-capability-scope-invariant?format=agents"}},{"id":"otel-collector-adaptive-tail-sampling-memory-limiter-standard","title":"OpenTelemetry Collector Tail-Sampling Adaptive Buffer Limiter Standard","category":"devops","severity":"critical","description":"Enforces coordinated memory management between the memory_limiter processor and tail_sampling trace buffers in OpenTelemetry Collector deployments. Prevents catastrophic OOMKilled crashes and cluster cascading failures during high-cardinality distributed trace bursts by mandating processor ordering, bounded trace cache sizing, and calibrated memory headroom thresholds.","antiPatternHeadline":"Unbounded tail-sampling buffers configured downstream of uncalibrated or misordered memory limiters causing container OOM crashes under trace bursts","stars_count":66,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","observability","kubernetes","tail-sampling","backpressure","resilience"],"exportEndpoints":{"claude":"/api/rules/otel-collector-adaptive-tail-sampling-memory-limiter-standard?format=claude","cursorMdc":"/api/rules/otel-collector-adaptive-tail-sampling-memory-limiter-standard?format=mdc","cursorrules":"/api/rules/otel-collector-adaptive-tail-sampling-memory-limiter-standard?format=cursor","windsurf":"/api/rules/otel-collector-adaptive-tail-sampling-memory-limiter-standard?format=windsurf","agents":"/api/rules/otel-collector-adaptive-tail-sampling-memory-limiter-standard?format=agents"}},{"id":"connect-rpc-bidi-stream-backpressure-fence","title":"Connect-RPC Bidirectional Stream Flow-Control Backpressure Fence","category":"backend","severity":"critical","description":"Enforces deterministic coupling between transport-level HTTP/2 and HTTP/3 flow-control windows and server-side processing queues in Connect-RPC bidirectional streams. Disallows unbounded async dispatching during stream ingestion to prevent transport window updates from triggering catastrophic heap exhaustion.","antiPatternHeadline":"Unbounded Asynchronous Ingestion Draining Transport Frames Without Flow-Control Backpressure","stars_count":90,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","connect-rpc","http2","backpressure","streaming","memory-leak"],"exportEndpoints":{"claude":"/api/rules/connect-rpc-bidi-stream-backpressure-fence?format=claude","cursorMdc":"/api/rules/connect-rpc-bidi-stream-backpressure-fence?format=mdc","cursorrules":"/api/rules/connect-rpc-bidi-stream-backpressure-fence?format=cursor","windsurf":"/api/rules/connect-rpc-bidi-stream-backpressure-fence?format=windsurf","agents":"/api/rules/connect-rpc-bidi-stream-backpressure-fence?format=agents"}},{"id":"nextjs-ppr-streaming-abort-guardrail","title":"Next.js 15 PPR Streaming AbortSignal Propagation Standard","category":"frontend","severity":"critical","description":"Enforces mandatory AbortSignal propagation across all async data fetching, downstream HTTP clients, and database queries within Next.js 15 Partial Prerendering (PPR) dynamic Suspense boundaries. Prevents catastrophic database connection pool starvation and orphaned Node.js/Edge compute when streaming HTTP responses are terminated prematurely by client disconnects.","antiPatternHeadline":"Orphaned database queries and detached fetch operations executing post-client-disconnect in streamed PPR boundaries.","stars_count":72,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs","nextjs-15","ppr","react-server-components","streaming","abort-signal","performance"],"exportEndpoints":{"claude":"/api/rules/nextjs-ppr-streaming-abort-guardrail?format=claude","cursorMdc":"/api/rules/nextjs-ppr-streaming-abort-guardrail?format=mdc","cursorrules":"/api/rules/nextjs-ppr-streaming-abort-guardrail?format=cursor","windsurf":"/api/rules/nextjs-ppr-streaming-abort-guardrail?format=windsurf","agents":"/api/rules/nextjs-ppr-streaming-abort-guardrail?format=agents"}},{"id":"postgres-17-logical-replication-failover-slot-sync-invariant","title":"Postgres 17 Logical Replication Failover Slot Synchronization Invariant","category":"backend","severity":"critical","description":"Enforces deterministic physical-to-logical replication slot synchronization using Postgres 17 failover-enabled slots and synchronized standbys. Guarantees zero duplicate event replays or silent data loss cascades in distributed event pipelines during planned switchovers and unplanned high-availability failovers.","antiPatternHeadline":"Unsynchronized Logical Replication Slots Causing Data Loss Cascades or Multi-Day WAL Replays on Standby Failover","stars_count":42,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres","cdc","logical-replication","high-availability","event-driven","distributed-systems"],"exportEndpoints":{"claude":"/api/rules/postgres-17-logical-replication-failover-slot-sync-invariant?format=claude","cursorMdc":"/api/rules/postgres-17-logical-replication-failover-slot-sync-invariant?format=mdc","cursorrules":"/api/rules/postgres-17-logical-replication-failover-slot-sync-invariant?format=cursor","windsurf":"/api/rules/postgres-17-logical-replication-failover-slot-sync-invariant?format=windsurf","agents":"/api/rules/postgres-17-logical-replication-failover-slot-sync-invariant?format=agents"}},{"id":"tauri2-mobile-ipc-zero-copy-arraybuffer-guardrail","title":"Tauri 2.0 Mobile IPC Zero-Copy Binary Telemetry Transfer Boundary","category":"mobile","severity":"critical","description":"Enforces zero-copy ArrayBuffer semantics and dedicated binary IPC channels for high-frequency sensor and telemetry streams crossing the Rust-to-WebView mobile boundary. Eliminates Base64/JSON serialization thrashing that causes JNI local reference table exhaustion on Android, WebKit IPC pipe stalls on iOS, and mobile OS Out-Of-Memory (OOM) watchdog terminations.","antiPatternHeadline":"Serializing High-Frequency Binary Streams into JSON Arrays or Base64 Strings Across Mobile IPC","stars_count":83,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri-2","rust","ipc","arraybuffer","performance","memory-management"],"exportEndpoints":{"claude":"/api/rules/tauri2-mobile-ipc-zero-copy-arraybuffer-guardrail?format=claude","cursorMdc":"/api/rules/tauri2-mobile-ipc-zero-copy-arraybuffer-guardrail?format=mdc","cursorrules":"/api/rules/tauri2-mobile-ipc-zero-copy-arraybuffer-guardrail?format=cursor","windsurf":"/api/rules/tauri2-mobile-ipc-zero-copy-arraybuffer-guardrail?format=windsurf","agents":"/api/rules/tauri2-mobile-ipc-zero-copy-arraybuffer-guardrail?format=agents"}},{"id":"cilium-ebpf-pmtu-mss-clamping-guardrail","title":"Cilium eBPF Host-Routing Dynamic PMTU Discovery & TCP MSS Clamping Invariant","category":"devops","severity":"critical","description":"Enforces deterministic Path MTU Discovery (PMTUD) and explicit TCP MSS clamping within Cilium eBPF host-routing architectures across hybrid multi-cloud overlays. When eBPF bypasses the host Linux netfilter stack, traditional iptables TCPMSS rules become inert, causing silent packet black-holing during TCP handshakes and large payload transfers across encapsulated tunnels (Geneve/VXLAN/WireGuard). This standard mandates automated MTU derivation, tunnel overhead offsetting, and active TC/eBPF MSS clamping to prevent asymmetric drops.","antiPatternHeadline":"Bypassing Netfilter with Cilium eBPF Host-Routing Without Enabling eBPF-Native PMTU and Dynamic TCP MSS Clamping","stars_count":79,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","cilium","ebpf","kubernetes","networking","pmtud","hybrid-cloud","packet-loss"],"exportEndpoints":{"claude":"/api/rules/cilium-ebpf-pmtu-mss-clamping-guardrail?format=claude","cursorMdc":"/api/rules/cilium-ebpf-pmtu-mss-clamping-guardrail?format=mdc","cursorrules":"/api/rules/cilium-ebpf-pmtu-mss-clamping-guardrail?format=cursor","windsurf":"/api/rules/cilium-ebpf-pmtu-mss-clamping-guardrail?format=windsurf","agents":"/api/rules/cilium-ebpf-pmtu-mss-clamping-guardrail?format=agents"}},{"id":"vite6-environment-api-runtime-isolation-standard-vite-6-environme-199","title":"Vite 6 Environment API Multi-Runtime Context Isolation & Memory Sandboxing","category":"frontend","severity":"critical","description":"Enforces strict memory, execution context, and global scope isolation when executing heterogeneous SSR pipelines across browser, Node.js, and edge workers via Vite 6 Environment API. Prevents cross-runtime state leakage, globalThis pollution, and invalid shared module cache reuse during concurrent Hot Module Replacement (HMR).","antiPatternHeadline":"Cross-Environment Global Scope Contamination and Shared Module Graph Leaks in Multi-Runtime SSR","stars_count":54,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["vite6","ssr","environments-api","module-runner","edge-runtime","hmr","sandboxing"],"exportEndpoints":{"claude":"/api/rules/vite6-environment-api-runtime-isolation-standard-vite-6-environme-199?format=claude","cursorMdc":"/api/rules/vite6-environment-api-runtime-isolation-standard-vite-6-environme-199?format=mdc","cursorrules":"/api/rules/vite6-environment-api-runtime-isolation-standard-vite-6-environme-199?format=cursor","windsurf":"/api/rules/vite6-environment-api-runtime-isolation-standard-vite-6-environme-199?format=windsurf","agents":"/api/rules/vite6-environment-api-runtime-isolation-standard-vite-6-environme-199?format=agents"}},{"id":"fastapi-anyio-cancellation-isolation-standard","title":"FastAPI AnyIO Dynamic TaskGroup Cancellation Isolation Standard","category":"backend","severity":"critical","description":"Prevents premature termination of critical audit-logging, state persistence, and resource cleanup coroutines caused by client-driven HTTP disconnects. Mandates explicit AnyIO shielded cancellation scopes or decoupled application-lifetime TaskGroups for operations that must survive client dropoffs.","antiPatternHeadline":"Executing Non-Idempotent Audit Trails and State Finalization Inside Unshielded HTTP Request TaskScopes","stars_count":100,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","anyio","asyncio","cancellation","reliability"],"exportEndpoints":{"claude":"/api/rules/fastapi-anyio-cancellation-isolation-standard?format=claude","cursorMdc":"/api/rules/fastapi-anyio-cancellation-isolation-standard?format=mdc","cursorrules":"/api/rules/fastapi-anyio-cancellation-isolation-standard?format=cursor","windsurf":"/api/rules/fastapi-anyio-cancellation-isolation-standard?format=windsurf","agents":"/api/rules/fastapi-anyio-cancellation-isolation-standard?format=agents"}},{"id":"otel-genai-streaming-token-pii-redaction-standard","title":"OpenTelemetry GenAI Token Streaming Inline PII Redaction Standard","category":"security","severity":"critical","description":"Mandates deterministic, sliding-window inline masking of personally identifiable information (PII) across Server-Sent Event (SSE) token chunks before attaching content to OpenTelemetry spans, events, or telemetry exporters. Prevents boundary-split PII leakage across chunk boundaries while maintaining ultra-low-latency streaming pipelines. Enforces zero raw token retention in telemetry buffers.","antiPatternHeadline":"Attaching Unmasked Streaming Token Chunks Directly to OpenTelemetry Spans Without Multi-Chunk Boundary PII Redaction","stars_count":111,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","opentelemetry","genai","sse","pii-redaction","streaming"],"exportEndpoints":{"claude":"/api/rules/otel-genai-streaming-token-pii-redaction-standard?format=claude","cursorMdc":"/api/rules/otel-genai-streaming-token-pii-redaction-standard?format=mdc","cursorrules":"/api/rules/otel-genai-streaming-token-pii-redaction-standard?format=cursor","windsurf":"/api/rules/otel-genai-streaming-token-pii-redaction-standard?format=windsurf","agents":"/api/rules/otel-genai-streaming-token-pii-redaction-standard?format=agents"}},{"id":"kmp-atomicfu-swift-concurrency-lock-free-invariant","title":"KMP AtomicFU Lock-Free Mutation Invariant across Swift 6 Concurrency","category":"mobile","severity":"critical","description":"Enforces lock-free AtomicFU atomic state transitions and non-blocking bridge boundaries between Kotlin Multiplatform state machines and Swift 6 strict-concurrency actors. Prevents cooperative thread pool starvation, priority inversions, and deadlocks caused by synchronous spinlocks or blocking CAS retry loops on iOS Grand Central Dispatch and Swift Concurrency runtime threads.","antiPatternHeadline":"Blocking Swift Cooperative Thread Pools via Synchronous KMP AtomicFU Spin-Wait Mutation Loops","stars_count":56,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kmp","kotlin-multiplatform","swift6","concurrency","atomicfu","ios"],"exportEndpoints":{"claude":"/api/rules/kmp-atomicfu-swift-concurrency-lock-free-invariant?format=claude","cursorMdc":"/api/rules/kmp-atomicfu-swift-concurrency-lock-free-invariant?format=mdc","cursorrules":"/api/rules/kmp-atomicfu-swift-concurrency-lock-free-invariant?format=cursor","windsurf":"/api/rules/kmp-atomicfu-swift-concurrency-lock-free-invariant?format=windsurf","agents":"/api/rules/kmp-atomicfu-swift-concurrency-lock-free-invariant?format=agents"}},{"id":"postgres-17-direct-io-streaming-prefetch-guardrail","title":"Postgres 17 Direct I/O and Streaming Prefetch Memory Budget Guardrail","category":"backend","severity":"critical","description":"Enforces strict memory budgeting and I/O concurrency sizing for PostgreSQL 17 deployments utilizing Direct I/O (`io_direct`) and the modern streaming read prefetch engine on high-IOPS NVMe hardware. Prevents Linux OOM-killer invocations, unbuffered queue depth exhaustion, and tail-latency degradation caused by legacy page cache assumptions.","antiPatternHeadline":"Legacy OS Buffer Assumptions with Unbounded Asynchronous Prefetching on Direct I/O","stars_count":89,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","postgres-17","direct-io","nvme","performance","memory-management"],"exportEndpoints":{"claude":"/api/rules/postgres-17-direct-io-streaming-prefetch-guardrail?format=claude","cursorMdc":"/api/rules/postgres-17-direct-io-streaming-prefetch-guardrail?format=mdc","cursorrules":"/api/rules/postgres-17-direct-io-streaming-prefetch-guardrail?format=cursor","windsurf":"/api/rules/postgres-17-direct-io-streaming-prefetch-guardrail?format=windsurf","agents":"/api/rules/postgres-17-direct-io-streaming-prefetch-guardrail?format=agents"}},{"id":"svelte-5-runes-reactive-graph-boundary","title":"Svelte 5 Runes Reactive Graph Boundary and Root Lifecycle Isolation","category":"frontend","severity":"critical","description":"Enforces strict reactive graph boundary isolation and explicit lifecycle management using $effect.root and untrack() in non-component modules and long-running services. Prevents microtask starvation and unbounded memory retention caused by orphaned signal dependencies and circular reactive evaluations in single-page applications.","antiPatternHeadline":"Unbounded Signal Graph Leaks and Microtask Starvation via Unscoped Dynamic Runes","stars_count":102,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","memory-leaks","reactivity","performance"],"exportEndpoints":{"claude":"/api/rules/svelte-5-runes-reactive-graph-boundary?format=claude","cursorMdc":"/api/rules/svelte-5-runes-reactive-graph-boundary?format=mdc","cursorrules":"/api/rules/svelte-5-runes-reactive-graph-boundary?format=cursor","windsurf":"/api/rules/svelte-5-runes-reactive-graph-boundary?format=windsurf","agents":"/api/rules/svelte-5-runes-reactive-graph-boundary?format=agents"}},{"id":"go-1-24-weak-pointer-session-cache-invariant","title":"Go 1.24 Weak Pointer Ephemeral Session Cache Invariant","category":"backend","severity":"critical","description":"Enforces the use of Go 1.24's standard library weak pointer semantics for ephemeral session contexts and metadata caches in high-throughput services. By replacing strong-reference cache topologies with collector-eligible weak references, services prevent long-lived heap bloat, mark-sweep pointer-chasing overhead, and severe GC tail-latency spikes during traffic surges. This guarantees that ephemeral session memory is automatically reclaimed as soon as active request scopes terminate.","antiPatternHeadline":"Retaining Strong Pointers in In-Memory Session Caches Causing GC Mark Overhead and OOM Explosions","stars_count":59,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","golang","go-1.24","weak-pointers","memory-management","gc-optimization","high-throughput"],"exportEndpoints":{"claude":"/api/rules/go-1-24-weak-pointer-session-cache-invariant?format=claude","cursorMdc":"/api/rules/go-1-24-weak-pointer-session-cache-invariant?format=mdc","cursorrules":"/api/rules/go-1-24-weak-pointer-session-cache-invariant?format=cursor","windsurf":"/api/rules/go-1-24-weak-pointer-session-cache-invariant?format=windsurf","agents":"/api/rules/go-1-24-weak-pointer-session-cache-invariant?format=agents"}},{"id":"kmp-sqlite-wal-read-pool-partitioning","title":"KMP SQLite Concurrent WAL Read-Pool Partitioning & Isolated Write Serializer","category":"mobile","severity":"critical","description":"Enforces strict partitioning between isolated read-only WAL connection pools and a singleton serialized write pipeline in Kotlin Multiplatform SQLite architectures. Eliminates main-thread frame drops, iOS watchdog crashes, and transaction lock contention caused by shared connection serialization across UI flow observers and background sync writes.","antiPatternHeadline":"Monolithic Multi-Threaded Driver Sharing with Shared Mutex Deadlocks and Write-Starved Read Flows","stars_count":107,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kmp","sqlite","wal","coroutines","sqldelight","room-kmp","kotlin-native"],"exportEndpoints":{"claude":"/api/rules/kmp-sqlite-wal-read-pool-partitioning?format=claude","cursorMdc":"/api/rules/kmp-sqlite-wal-read-pool-partitioning?format=mdc","cursorrules":"/api/rules/kmp-sqlite-wal-read-pool-partitioning?format=cursor","windsurf":"/api/rules/kmp-sqlite-wal-read-pool-partitioning?format=windsurf","agents":"/api/rules/kmp-sqlite-wal-read-pool-partitioning?format=agents"}},{"id":"ebpf-xdp-syn-proxy-zero-allocation-guardrail","title":"eBPF XDP Zero-Allocation SYN Proxy Production Guardrail","category":"security","severity":"critical","description":"Enforces driver-layer packet filtering and stateless SYN-cookie handling via eBPF XDP before Linux kernel socket buffer (sk_buff) allocation occurs. Guarantees constant-time verification, in-place header rewrites, and strict verifier bounds enforcement to defeat volumetric L4 SYN floods without degrading memory or conntrack tables. Prevents CPU exhaustion and kernel panics by eliminating dynamic allocations on unauthenticated TCP handshakes.","antiPatternHeadline":"Leaking Unauthenticated TCP SYNs to Kernel Network Stack or Triggering Dynamic Allocations in Ingress Hook Paths","stars_count":44,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","ebpf","xdp","ddos","syn-proxy","linux-networking"],"exportEndpoints":{"claude":"/api/rules/ebpf-xdp-syn-proxy-zero-allocation-guardrail?format=claude","cursorMdc":"/api/rules/ebpf-xdp-syn-proxy-zero-allocation-guardrail?format=mdc","cursorrules":"/api/rules/ebpf-xdp-syn-proxy-zero-allocation-guardrail?format=cursor","windsurf":"/api/rules/ebpf-xdp-syn-proxy-zero-allocation-guardrail?format=windsurf","agents":"/api/rules/ebpf-xdp-syn-proxy-zero-allocation-guardrail?format=agents"}},{"id":"openfga-transitive-graph-resolution-depth-quota","title":"OpenFGA Transitive Graph Resolution Depth and Cycle-Budget Invariants","category":"security","severity":"critical","description":"Enforces deterministic recursion limits, bounded traversal depth, and strict execution deadlines on transitive relationship queries within OpenFGA. Prevents authorization engine Denial of Service (AuthDoS) and p99 tail-latency collapse caused by cyclic graphs or deeply nested relationship hierarchies (e.g., nested groups, recursive document folders).","antiPatternHeadline":"Unbounded Transitive Userset Expansion and Missing Traversal Quotas Inducing Graph-Engine Starvation","stars_count":98,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","authorization","graph-traversal","dos-prevention","resilience"],"exportEndpoints":{"claude":"/api/rules/openfga-transitive-graph-resolution-depth-quota?format=claude","cursorMdc":"/api/rules/openfga-transitive-graph-resolution-depth-quota?format=mdc","cursorrules":"/api/rules/openfga-transitive-graph-resolution-depth-quota?format=cursor","windsurf":"/api/rules/openfga-transitive-graph-resolution-depth-quota?format=windsurf","agents":"/api/rules/openfga-transitive-graph-resolution-depth-quota?format=agents"}},{"id":"ml-kem-hybrid-tls13-key-encapsulation-standard","title":"ML-KEM Hybrid TLS 1.3 Key Encapsulation Standard for Zero-Trust Ingress","category":"security","severity":"critical","description":"Enforces post-quantum hybrid key encapsulation mechanisms (ML-KEM-768 coupled with classical ECDH) across all internal microservice TLS 1.3 configurations. This shields internal service-to-service transit pipelines against Harvest-Now-Decrypt-Later (HNDL) attacks by quantum adversaries. Configurations must strictly disallow classical-only key exchange groups and reject TLS versions below 1.3.","antiPatternHeadline":"Permitting Classical-Only ECDH Key Exchange Groups in Service-to-Service Ingress Handshakes","stars_count":92,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","cryptography","post-quantum","ml-kem","tls-1.3","zero-trust"],"exportEndpoints":{"claude":"/api/rules/ml-kem-hybrid-tls13-key-encapsulation-standard?format=claude","cursorMdc":"/api/rules/ml-kem-hybrid-tls13-key-encapsulation-standard?format=mdc","cursorrules":"/api/rules/ml-kem-hybrid-tls13-key-encapsulation-standard?format=cursor","windsurf":"/api/rules/ml-kem-hybrid-tls13-key-encapsulation-standard?format=windsurf","agents":"/api/rules/ml-kem-hybrid-tls13-key-encapsulation-standard?format=agents"}},{"id":"otel-stream-processor-zero-loss-pii-scrubber","title":"Zero-Loss Deterministic In-Flight PII Redaction for OTel Collector Pipelines","category":"devops","severity":"critical","description":"Enforces deterministic, zero-loss in-flight PII and credential scrubbing within OpenTelemetry Collector pipelines using OTTL (OpenTelemetry Transformation Language) transform processors. Prevents high-entropy tokens, JWTs, and regulated tenant data from leaking into downstream telemetry backends while guaranteeing span and log continuity without backpressure drops.","antiPatternHeadline":"Unbounded Pass-Through Telemetry or Dropping Spans Due to Greedy Regex and Unsafe Failure Modes","stars_count":58,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","security","pii-redaction","ottl","compliance"],"exportEndpoints":{"claude":"/api/rules/otel-stream-processor-zero-loss-pii-scrubber?format=claude","cursorMdc":"/api/rules/otel-stream-processor-zero-loss-pii-scrubber?format=mdc","cursorrules":"/api/rules/otel-stream-processor-zero-loss-pii-scrubber?format=cursor","windsurf":"/api/rules/otel-stream-processor-zero-loss-pii-scrubber?format=windsurf","agents":"/api/rules/otel-stream-processor-zero-loss-pii-scrubber?format=agents"}},{"id":"ebpf-sframe-continuous-profiling-standard","title":"eBPF SFrame Continuous Profiling & Stripped Binary Stack Unwinding Standard","category":"devops","severity":"critical","description":"Establishes build pipeline and runtime invariants for low-overhead eBPF continuous stack unwinding using compact SFrame (.sframe) ELF sections. Eliminates the requirement to retain bloated DWARF debug sections or sacrifice compiler register optimizations via forced frame pointers in stripped container images while preserving sub-1% CPU continuous profiling.","antiPatternHeadline":"Shipping Stripped Binaries Without .sframe Sections or Overloading Production Container Images with DWARF Debugging Info","stars_count":71,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","continuous-profiling","sframe","observability","linux-kernel"],"exportEndpoints":{"claude":"/api/rules/ebpf-sframe-continuous-profiling-standard?format=claude","cursorMdc":"/api/rules/ebpf-sframe-continuous-profiling-standard?format=mdc","cursorrules":"/api/rules/ebpf-sframe-continuous-profiling-standard?format=cursor","windsurf":"/api/rules/ebpf-sframe-continuous-profiling-standard?format=windsurf","agents":"/api/rules/ebpf-sframe-continuous-profiling-standard?format=agents"}},{"id":"react-19-tainted-reference-server-action-replay-boundary","title":"React 19 Tainted Reference & Server Action Replay Boundary Enforcement","category":"frontend","severity":"critical","description":"Guarantees that sensitive server-side objects, environmental secrets, and raw cryptographic credentials cannot be serialized across the React Server Components (RSC) wire protocol using React 19 experimental taint primitives. Enforces strict cryptographic nonce verification, session binding, and atomic idempotency consumption across all mutating Server Actions to eradicate replay and duplicate execution vectors.","antiPatternHeadline":"Exposing Raw Cryptographic Secrets Across the RSC Protocol and Executing Un-fenced Mutating Server Actions","stars_count":104,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","nextjs","rsc","server-actions","taint-api","anti-replay","idempotency"],"exportEndpoints":{"claude":"/api/rules/react-19-tainted-reference-server-action-replay-boundary?format=claude","cursorMdc":"/api/rules/react-19-tainted-reference-server-action-replay-boundary?format=mdc","cursorrules":"/api/rules/react-19-tainted-reference-server-action-replay-boundary?format=cursor","windsurf":"/api/rules/react-19-tainted-reference-server-action-replay-boundary?format=windsurf","agents":"/api/rules/react-19-tainted-reference-server-action-replay-boundary?format=agents"}},{"id":"svelte-5-runes-ssr-isolation-standard","title":"Svelte 5 Runes Reactive Isolation & SSR State Leak Standard","category":"frontend","severity":"critical","description":"Enforces strict request-lifecycle scoping for Svelte 5 runes ($state, $derived) in universal and SSR execution environments. Prohibits module-level reactive declarations that persist in Node/Bun worker memory, eliminating cross-request state pollution, data leakage between authenticated sessions, and memory leaks in long-running processes.","antiPatternHeadline":"Global Module-Level Runes Leaking User Session State Across Concurrent SSR Requests","stars_count":64,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["svelte5","runes","ssr","security","node","bun","state-management"],"exportEndpoints":{"claude":"/api/rules/svelte-5-runes-ssr-isolation-standard?format=claude","cursorMdc":"/api/rules/svelte-5-runes-ssr-isolation-standard?format=mdc","cursorrules":"/api/rules/svelte-5-runes-ssr-isolation-standard?format=cursor","windsurf":"/api/rules/svelte-5-runes-ssr-isolation-standard?format=windsurf","agents":"/api/rules/svelte-5-runes-ssr-isolation-standard?format=agents"}},{"id":"capacitor-7-zero-copy-arraybuffer-bridge-invariant","title":"Capacitor 7 Zero-Copy ArrayBuffer Bridge Invariant","category":"mobile","severity":"critical","description":"Enforces direct memory-mapped ArrayBuffer transfers across the native-web boundary in Capacitor 7 plugins. Eliminates base64 encoding, JSON serialization bottlenecks, and WebKit main-thread UI jank during high-frequency telemetry and media stream processing.","antiPatternHeadline":"Encoding High-Frequency Binary Streams into Base64 or Serialized JSON Strings over Capacitor Bridge","stars_count":90,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["capacitor","mobile","webkit","arraybuffer","performance","memory-management"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-zero-copy-arraybuffer-bridge-invariant?format=claude","cursorMdc":"/api/rules/capacitor-7-zero-copy-arraybuffer-bridge-invariant?format=mdc","cursorrules":"/api/rules/capacitor-7-zero-copy-arraybuffer-bridge-invariant?format=cursor","windsurf":"/api/rules/capacitor-7-zero-copy-arraybuffer-bridge-invariant?format=windsurf","agents":"/api/rules/capacitor-7-zero-copy-arraybuffer-bridge-invariant?format=agents"}},{"id":"go-chi-context-deadline-goroutine-drain-standard","title":"Go Chi HTTP Context Propagation and Goroutine Drain Standard","category":"backend","severity":"critical","description":"Mandates strict propagation of `r.Context()` across all downstream operations, RPC boundaries, and internal concurrency fan-outs in Go Chi services. Eliminates silent goroutine leaks, connection starvation, and zombie downstream execution by enforcing deterministic select-based cancellation and bounded lifecycle decoupling.","antiPatternHeadline":"Spawning unanchored fire-and-forget goroutines or discarding r.Context() via context.Background() during request handling","stars_count":115,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","chi","concurrency","context-propagation","goroutine-leaks"],"exportEndpoints":{"claude":"/api/rules/go-chi-context-deadline-goroutine-drain-standard?format=claude","cursorMdc":"/api/rules/go-chi-context-deadline-goroutine-drain-standard?format=mdc","cursorrules":"/api/rules/go-chi-context-deadline-goroutine-drain-standard?format=cursor","windsurf":"/api/rules/go-chi-context-deadline-goroutine-drain-standard?format=windsurf","agents":"/api/rules/go-chi-context-deadline-goroutine-drain-standard?format=agents"}},{"id":"fastapi-async-lifespan-pool-drain-invariant","title":"FastAPI Async Lifespan & Distributed Pool Drain Invariant","category":"backend","severity":"critical","description":"Enforces strict ASGI lifespan context manager architecture across FastAPI services to guarantee deterministic teardown sequences for asynchronous databases, message brokers, and background workers. Prevents socket truncation, connection pool starvation, and corrupted in-flight writes during Kubernetes rolling deployments and SIGTERM container termination signals.","antiPatternHeadline":"Unordered Deprecated Event Handlers Truncating Active In-Flight Requests and Severing Broker TCP Sockets","stars_count":78,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["fastapi","asyncio","lifespan","sqlalchemy","aiokafka","connection-pooling"],"exportEndpoints":{"claude":"/api/rules/fastapi-async-lifespan-pool-drain-invariant?format=claude","cursorMdc":"/api/rules/fastapi-async-lifespan-pool-drain-invariant?format=mdc","cursorrules":"/api/rules/fastapi-async-lifespan-pool-drain-invariant?format=cursor","windsurf":"/api/rules/fastapi-async-lifespan-pool-drain-invariant?format=windsurf","agents":"/api/rules/fastapi-async-lifespan-pool-drain-invariant?format=agents"}},{"id":"drizzle-orm-prepared-statement-partitioning-boundary","title":"Drizzle ORM Prepared Statement Partitioning Boundary for Serverless Runtimes","category":"backend","severity":"critical","description":"Enforces static isolation and memoized lifecycle boundaries for Drizzle ORM prepared queries across serverless microVMs and worker execution tiers. Prevents per-request re-preparation and unparameterized dynamic query emissions that cause database connection pool memory exhaustion, statement name collision, and query plan cache thrashing under high concurrency.","antiPatternHeadline":"Compiling dynamic Drizzle prepared statements inside per-request execution scopes","stars_count":77,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","drizzle-orm","postgresql","performance","prepared-statements","serverless"],"exportEndpoints":{"claude":"/api/rules/drizzle-orm-prepared-statement-partitioning-boundary?format=claude","cursorMdc":"/api/rules/drizzle-orm-prepared-statement-partitioning-boundary?format=mdc","cursorrules":"/api/rules/drizzle-orm-prepared-statement-partitioning-boundary?format=cursor","windsurf":"/api/rules/drizzle-orm-prepared-statement-partitioning-boundary?format=windsurf","agents":"/api/rules/drizzle-orm-prepared-statement-partitioning-boundary?format=agents"}},{"id":"ebpf-sockops-zero-trust-microsegmentation","title":"Kernel-Enforced Sockops L7 Cryptographic Identity Verification","category":"security","severity":"critical","description":"Enforces cryptographic service identity attestation directly within kernel socket operations (BPF_PROG_TYPE_SOCK_OPS and BPF_PROG_TYPE_SK_MSG) before payload traversal to userspace. Prohibits routing packets through sockhash or sockmap based solely on mutable L3/L4 5-tuples without verifying mutual kernel-attested SPIFFE IDs or pinned cryptographic session tokens.","antiPatternHeadline":"L3/L4 Socket Map Injection Bypassing Kernel-Level Cryptographic L7 Identity Attestation","stars_count":97,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","ebpf","zero-trust","sockops","microsegmentation","kernel","spiffe"],"exportEndpoints":{"claude":"/api/rules/ebpf-sockops-zero-trust-microsegmentation?format=claude","cursorMdc":"/api/rules/ebpf-sockops-zero-trust-microsegmentation?format=mdc","cursorrules":"/api/rules/ebpf-sockops-zero-trust-microsegmentation?format=cursor","windsurf":"/api/rules/ebpf-sockops-zero-trust-microsegmentation?format=windsurf","agents":"/api/rules/ebpf-sockops-zero-trust-microsegmentation?format=agents"}},{"id":"openfga-cdc-cache-invalidation-gatekeeper","title":"OpenFGA CDC-Driven Cache Invalidation Gatekeeper Standard","category":"security","severity":"critical","description":"Enforces sub-millisecond zero-trust authorization check latency while eliminating authorization divergence between application data stores and distributed relationship graphs. Mandates transactional outbox capture for OpenFGA relationship tuples, causal consistency tokens for check queries, and monotonic CDC-driven cache evictions to prevent Time-of-Check to Time-of-Use (TOCTOU) authorization bypasses.","antiPatternHeadline":"Dual-Write Desynchronization and Unbounded Cache Window Authorization Divergence","stars_count":75,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","authorization","cdc","cache-invalidation","zero-trust"],"exportEndpoints":{"claude":"/api/rules/openfga-cdc-cache-invalidation-gatekeeper?format=claude","cursorMdc":"/api/rules/openfga-cdc-cache-invalidation-gatekeeper?format=mdc","cursorrules":"/api/rules/openfga-cdc-cache-invalidation-gatekeeper?format=cursor","windsurf":"/api/rules/openfga-cdc-cache-invalidation-gatekeeper?format=windsurf","agents":"/api/rules/openfga-cdc-cache-invalidation-gatekeeper?format=agents"}},{"id":"opentelemetry-otlp-over-quic-ingestion-standard","title":"OpenTelemetry OTLP-over-QUIC Loss-Resilient Ingestion Standard","category":"devops","severity":"critical","description":"Mandates the use of HTTP/3 and QUIC transport protocols for OpenTelemetry Protocol (OTLP) pipelines crossing WAN boundaries and availability zones. Multiplexed independent QUIC streams eliminate TCP head-of-line blocking, preventing catastrophic trace dropouts and telemetry buffer backpressure under degraded network conditions.","antiPatternHeadline":"TCP Head-of-Line Blocking Inducing Telemetry Buffer Overflows During WAN Congestion","stars_count":88,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","quic","http3","networking","observability"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-otlp-over-quic-ingestion-standard?format=claude","cursorMdc":"/api/rules/opentelemetry-otlp-over-quic-ingestion-standard?format=mdc","cursorrules":"/api/rules/opentelemetry-otlp-over-quic-ingestion-standard?format=cursor","windsurf":"/api/rules/opentelemetry-otlp-over-quic-ingestion-standard?format=windsurf","agents":"/api/rules/opentelemetry-otlp-over-quic-ingestion-standard?format=agents"}},{"id":"postgres-17-partition-parallel-aggregation-memory-boundary","title":"PostgreSQL 17 Partition-Aware Parallel Aggregation & Join Memory Governance","category":"backend","severity":"critical","description":"Enforces deterministic per-transaction memory allocation bounds for Postgres 17 parallel workers during partition-wise joins and aggregations. Eliminates kernel OOM-killer invocations by dynamically calculating work_mem, hash_mem_multiplier, and max_parallel_workers_per_gather against cgroup memory ceilings before executing analytical fanout queries.","antiPatternHeadline":"Global work_mem Multiplied Across Parallel Partition Workers Causing Process Termination","stars_count":71,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","postgres-17","performance","memory-management","query-optimization"],"exportEndpoints":{"claude":"/api/rules/postgres-17-partition-parallel-aggregation-memory-boundary?format=claude","cursorMdc":"/api/rules/postgres-17-partition-parallel-aggregation-memory-boundary?format=mdc","cursorrules":"/api/rules/postgres-17-partition-parallel-aggregation-memory-boundary?format=cursor","windsurf":"/api/rules/postgres-17-partition-parallel-aggregation-memory-boundary?format=windsurf","agents":"/api/rules/postgres-17-partition-parallel-aggregation-memory-boundary?format=agents"}},{"id":"react-19-server-actions-hmac-sealing-guardrail","title":"React 19 Server Actions Bound Closure State HMAC Sealing & Verification Invariant","category":"frontend","severity":"critical","description":"Guarantees that arguments bound to React 19 Server Actions via `.bind()` or closure capture cannot be tampered with or replayed across client-server RPC transitions. Any mutable or privileged bound parameters transmitted across the network boundary must be cryptographically signed with an HMAC token and verified against the authenticated session context before execution.","antiPatternHeadline":"Trusting Client-Supplied Bound Arguments in Server Actions Without Cryptographic Integrity Verification","stars_count":44,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","server-actions","hmac","cryptography","security","next.js"],"exportEndpoints":{"claude":"/api/rules/react-19-server-actions-hmac-sealing-guardrail?format=claude","cursorMdc":"/api/rules/react-19-server-actions-hmac-sealing-guardrail?format=mdc","cursorrules":"/api/rules/react-19-server-actions-hmac-sealing-guardrail?format=cursor","windsurf":"/api/rules/react-19-server-actions-hmac-sealing-guardrail?format=windsurf","agents":"/api/rules/react-19-server-actions-hmac-sealing-guardrail?format=agents"}},{"id":"postgres17-streaming-io-prefetch-pinning-boundary","title":"Postgres 17 Streaming I/O Direct-Access Prefetch Pinning Boundary Standard","category":"backend","severity":"critical","description":"Enforces strict query isolation, memory capping, and buffer pool eviction controls for Postgres 17 asynchronous streaming read pipelines. Prevents starvation of shared buffers during mixed OLTP/HTAP workloads by bounding direct-access prefetch worker depth and requiring segregated buffer rings with synchronized connection-level GUC parameters.","antiPatternHeadline":"Unbounded AIO Streaming Prefetching Exhausting Shared Buffer Pool Pins During Concurrent OLTP Load","stars_count":91,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","postgres-17","streaming-io","performance","htap","buffer-pool"],"exportEndpoints":{"claude":"/api/rules/postgres17-streaming-io-prefetch-pinning-boundary?format=claude","cursorMdc":"/api/rules/postgres17-streaming-io-prefetch-pinning-boundary?format=mdc","cursorrules":"/api/rules/postgres17-streaming-io-prefetch-pinning-boundary?format=cursor","windsurf":"/api/rules/postgres17-streaming-io-prefetch-pinning-boundary?format=windsurf","agents":"/api/rules/postgres17-streaming-io-prefetch-pinning-boundary?format=agents"}},{"id":"axum-08-websocket-heartbeat-desync-guardrail","title":"Axum 0.8 WebSocket Heartbeat & Task Desynchronization Invariant","category":"backend","severity":"critical","description":"Enforces deterministic bidirectional heartbeat polling and cooperative Tokio task cancellation for Axum 0.8 WebSocket connections. Eliminates silent file descriptor exhaustion, zombie connection accumulation, and unhandled task panics caused by asymmetric split-stream teardowns during edge reverse proxy failovers and rolling deploys.","antiPatternHeadline":"Asymmetric Split Tasks with Detached Ping Loops and Missing Pong Verification","stars_count":83,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tokio","websockets","concurrency"],"exportEndpoints":{"claude":"/api/rules/axum-08-websocket-heartbeat-desync-guardrail?format=claude","cursorMdc":"/api/rules/axum-08-websocket-heartbeat-desync-guardrail?format=mdc","cursorrules":"/api/rules/axum-08-websocket-heartbeat-desync-guardrail?format=cursor","windsurf":"/api/rules/axum-08-websocket-heartbeat-desync-guardrail?format=windsurf","agents":"/api/rules/axum-08-websocket-heartbeat-desync-guardrail?format=agents"}},{"id":"capacitor-7-bridge-buffer-reentrancy-guardrail","title":"Capacitor 7 Native Bridge Structured Buffer Reentrancy & Lifecycle Guardrail","category":"mobile","severity":"critical","description":"Enforces strict serialization, backpressure decoupling, and native lifecycle awareness for high-frequency web-to-native bridge calls in Capacitor 7. Prevents main-thread UI deadlocks, V8/JSC isolate aborts, and memory corruption when high-throughput binary or structured buffers intersect with Android and iOS background/foreground pause-resume transitions.","antiPatternHeadline":"Unthrottled Synchronous Bridge Buffer Dispatch During Native Lifecycle Transitions","stars_count":40,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","capacitor-7","native-bridge","concurrency","ios","android","memory-management"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-bridge-buffer-reentrancy-guardrail?format=claude","cursorMdc":"/api/rules/capacitor-7-bridge-buffer-reentrancy-guardrail?format=mdc","cursorrules":"/api/rules/capacitor-7-bridge-buffer-reentrancy-guardrail?format=cursor","windsurf":"/api/rules/capacitor-7-bridge-buffer-reentrancy-guardrail?format=windsurf","agents":"/api/rules/capacitor-7-bridge-buffer-reentrancy-guardrail?format=agents"}},{"id":"cmp-skiko-gpu-context-loss-recovery-standard","title":"Compose Multiplatform Skiko GPU Context Loss Recovery & Surface Lifecycle Standard","category":"mobile","severity":"critical","description":"Enforces deterministic teardown and recreation of Skiko render targets across mobile display lifecycle transitions. Eliminates silent render pipeline freezes, black screens, and native SIGSEGV crashes caused by stale Metal or Vulkan GrDirectContext handles when mobile operating systems reclaim hardware display buffers.","antiPatternHeadline":"Silent Skiko Render Loop Stall via Stale Hardware Context Retention and Unhandled Metal/Vulkan Surface Invalidation","stars_count":63,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","compose-multiplatform","skiko","skia","gpu-context","metal","vulkan","lifecycle"],"exportEndpoints":{"claude":"/api/rules/cmp-skiko-gpu-context-loss-recovery-standard?format=claude","cursorMdc":"/api/rules/cmp-skiko-gpu-context-loss-recovery-standard?format=mdc","cursorrules":"/api/rules/cmp-skiko-gpu-context-loss-recovery-standard?format=cursor","windsurf":"/api/rules/cmp-skiko-gpu-context-loss-recovery-standard?format=windsurf","agents":"/api/rules/cmp-skiko-gpu-context-loss-recovery-standard?format=agents"}},{"id":"openfga-transitive-graph-cycle-traversal-barrier","title":"OpenFGA Transitive Relation Graph Cycle & Traversal Budget Barrier","category":"security","severity":"critical","description":"Enforces pre-write directed acyclic graph (DAG) cycle detection and strict traversal budget caps for OpenFGA relationship tuple writes and dynamic authorization checks. Prevents denial-of-service (DoS) CPU exhaustion and engine goroutine starvation caused by recursive group nesting, circular inheritance models, or unconstrained expansion depths.","antiPatternHeadline":"Unchecked Tuple Ingestion Causing Transitive Cycles and Pathological Engine Graph Expansion","stars_count":65,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","rebac","authorization","dos-prevention","graph-algorithms"],"exportEndpoints":{"claude":"/api/rules/openfga-transitive-graph-cycle-traversal-barrier?format=claude","cursorMdc":"/api/rules/openfga-transitive-graph-cycle-traversal-barrier?format=mdc","cursorrules":"/api/rules/openfga-transitive-graph-cycle-traversal-barrier?format=cursor","windsurf":"/api/rules/openfga-transitive-graph-cycle-traversal-barrier?format=windsurf","agents":"/api/rules/openfga-transitive-graph-cycle-traversal-barrier?format=agents"}},{"id":"webauthn-largeblob-partition-isolation-invariant","title":"WebAuthn LargeBlob Partition Isolation and Cryptographic AAD Binding Standard","category":"security","severity":"critical","description":"Enforces cryptographically bounded, origin-scoped storage partitioning on WebAuthn Level 3 largeBlob extensions to prevent cross-session payload corruption and token leakage. Mandates that all hardware-backed authenticator storage operations apply AEAD authenticated encryption with Additional Authenticated Data (AAD) strictly bound to the Relying Party ID, Credential ID, and User Handle. Eliminates shared namespace clobbering, replay attacks, and unauthorized cross-identity read-write access.","antiPatternHeadline":"Writing Plaintext or Namespace-Agnostic Payloads into WebAuthn LargeBlob Storage Without Cryptographic AAD Binding","stars_count":80,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","cryptography","largeBlob","passkeys","hardware-token"],"exportEndpoints":{"claude":"/api/rules/webauthn-largeblob-partition-isolation-invariant?format=claude","cursorMdc":"/api/rules/webauthn-largeblob-partition-isolation-invariant?format=mdc","cursorrules":"/api/rules/webauthn-largeblob-partition-isolation-invariant?format=cursor","windsurf":"/api/rules/webauthn-largeblob-partition-isolation-invariant?format=windsurf","agents":"/api/rules/webauthn-largeblob-partition-isolation-invariant?format=agents"}},{"id":"k8s-in-place-resource-mutation-guardrail","title":"Kubernetes In-Place Pod Resource Mutation & Safe-Drain Guardrail","category":"devops","severity":"critical","description":"Enforces strict validation, phased downscaling, and runtime cgroup headroom checks during live Kubernetes In-Place Pod Vertical Scaling (KEP-1287). Prevents fatal container OOM kills and kernel cgroup lock contention caused by aggressive memory downscaling beneath active working set sizes or without proper resizePolicy declarations.","antiPatternHeadline":"Blind In-Place Memory Contraction Causing Instant Kernel OOM Kills and cgroup v2 Lock Contention","stars_count":41,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","kubernetes","cgroupv2","kep-1287","in-place-scaling","reliability"],"exportEndpoints":{"claude":"/api/rules/k8s-in-place-resource-mutation-guardrail?format=claude","cursorMdc":"/api/rules/k8s-in-place-resource-mutation-guardrail?format=mdc","cursorrules":"/api/rules/k8s-in-place-resource-mutation-guardrail?format=cursor","windsurf":"/api/rules/k8s-in-place-resource-mutation-guardrail?format=windsurf","agents":"/api/rules/k8s-in-place-resource-mutation-guardrail?format=agents"}},{"id":"otel-tail-sampling-sliding-window-eviction-firewall","title":"OpenTelemetry Tail-Based Sampling Sliding-Window Memory Eviction Firewall","category":"devops","severity":"critical","description":"Enforces deterministic bounded sliding windows, memory hard-limits, and prioritized trace eviction inside OpenTelemetry Collector tail-sampling pipelines. Prevents JVM/Go runtime heap exhaustion and catastrophic silent drop storms by orchestrating circuit breakers, backpressure signaling, and deterministic reservoir eviction before telemetry buffers saturate system resources.","antiPatternHeadline":"Unbounded tail-sampling buffers without proactive memory circuit-breakers causing heap exhaustion and silent trace starvation during downstream error storms","stars_count":97,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","observability","tail-sampling","circuit-breaker","memory-management"],"exportEndpoints":{"claude":"/api/rules/otel-tail-sampling-sliding-window-eviction-firewall?format=claude","cursorMdc":"/api/rules/otel-tail-sampling-sliding-window-eviction-firewall?format=mdc","cursorrules":"/api/rules/otel-tail-sampling-sliding-window-eviction-firewall?format=cursor","windsurf":"/api/rules/otel-tail-sampling-sliding-window-eviction-firewall?format=windsurf","agents":"/api/rules/otel-tail-sampling-sliding-window-eviction-firewall?format=agents"}},{"id":"react-19-concurrent-action-serialized-transition-boundary","title":"React 19 Concurrent Action State Serialized Transition Boundary","category":"frontend","severity":"critical","description":"Enforces strict transition boundaries and deterministic state serialization across React 19 Actions and optimistic rollbacks. Prevents UI tearing, stale closure overwrites, and uncoordinated rollbacks during rapid concurrent mutations by isolating mutating transitions within useActionState and useOptimistic primitives.","antiPatternHeadline":"Out-of-band async mutations corrupting optimistic queues and causing split-brain UI tearing on action rollbacks","stars_count":50,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","concurrent-react","actions","useOptimistic","useActionState","state-reconciliation"],"exportEndpoints":{"claude":"/api/rules/react-19-concurrent-action-serialized-transition-boundary?format=claude","cursorMdc":"/api/rules/react-19-concurrent-action-serialized-transition-boundary?format=mdc","cursorrules":"/api/rules/react-19-concurrent-action-serialized-transition-boundary?format=cursor","windsurf":"/api/rules/react-19-concurrent-action-serialized-transition-boundary?format=windsurf","agents":"/api/rules/react-19-concurrent-action-serialized-transition-boundary?format=agents"}},{"id":"pg17-direct-io-mmap-hnsw-indexing","title":"PostgreSQL 17 Direct I/O and Memory Isolation Guardrail for HNSW Indexing","category":"backend","severity":"critical","description":"Enforces non-blocking, zero-copy vector index generation using PostgreSQL 17 direct I/O configuration (io_combine_limit and io_direct) alongside session-scoped maintenance work memory. Prevents HNSW vector graph builds from evicting hot OLTP pages from shared_buffers, causing WAL saturation, or deadlocking concurrent write pipelines.","antiPatternHeadline":"Unbounded HNSW Indexing with Global Shared Buffer Thrashing and Synchronous WAL Spikes","stars_count":51,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres","pgvector","hnsw","direct-io","wal","database-performance"],"exportEndpoints":{"claude":"/api/rules/pg17-direct-io-mmap-hnsw-indexing?format=claude","cursorMdc":"/api/rules/pg17-direct-io-mmap-hnsw-indexing?format=mdc","cursorrules":"/api/rules/pg17-direct-io-mmap-hnsw-indexing?format=cursor","windsurf":"/api/rules/pg17-direct-io-mmap-hnsw-indexing?format=windsurf","agents":"/api/rules/pg17-direct-io-mmap-hnsw-indexing?format=agents"}},{"id":"tauri-v2-granular-ipc-capability-scope-pinning","title":"Tauri 2.0 Granular IPC Capability Mapping and Webview Scope Pinning","category":"mobile","severity":"critical","description":"Mandates explicit, least-privilege capability manifests and strict webview context targeting in Tauri 2.0 desktop and mobile shells. Forbids wildcard window targeting and permissive IPC command exposure to secondary or remote webview contexts to eliminate cross-origin privilege escalation and remote code execution vulnerabilities.","antiPatternHeadline":"Permissive Wildcard Window Capabilities Permitting Arbitrary IPC Execution Across Multi-Webview Shells","stars_count":49,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri-2","ipc-security","capabilities","webview-isolation","rust"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-granular-ipc-capability-scope-pinning?format=claude","cursorMdc":"/api/rules/tauri-v2-granular-ipc-capability-scope-pinning?format=mdc","cursorrules":"/api/rules/tauri-v2-granular-ipc-capability-scope-pinning?format=cursor","windsurf":"/api/rules/tauri-v2-granular-ipc-capability-scope-pinning?format=windsurf","agents":"/api/rules/tauri-v2-granular-ipc-capability-scope-pinning?format=agents"}},{"id":"fastapi-anyio-taskgroup-structured-concurrency-protocol","title":"FastAPI AnyIO TaskGroup Structured Concurrency & Deterministic Cancellation Standard","category":"backend","severity":"critical","description":"Enforces strict structured concurrency in FastAPI backends using AnyIO TaskGroups to prevent orphaned coroutines, resource exhaustion, and unhandled exception swallowing. Unhandled child errors must cascade deterministic cancellation to all siblings within the failure domain and cleanly unwind via shielded cancellation scopes.","antiPatternHeadline":"Unmanaged asyncio.create_task Fire-and-Forget Pipelines Causing Zombie Coroutines and Silent Exception Swallowing","stars_count":93,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","anyio","concurrency","asyncio","taskgroup"],"exportEndpoints":{"claude":"/api/rules/fastapi-anyio-taskgroup-structured-concurrency-protocol?format=claude","cursorMdc":"/api/rules/fastapi-anyio-taskgroup-structured-concurrency-protocol?format=mdc","cursorrules":"/api/rules/fastapi-anyio-taskgroup-structured-concurrency-protocol?format=cursor","windsurf":"/api/rules/fastapi-anyio-taskgroup-structured-concurrency-protocol?format=windsurf","agents":"/api/rules/fastapi-anyio-taskgroup-structured-concurrency-protocol?format=agents"}},{"id":"wasm-component-model-capability-attenuation-sandbox-guardrail","title":"WASI Preview 2 Capability Attenuation and Isolated Memory Sandbox Standard","category":"security","severity":"critical","description":"Enforces deterministic capability attenuation and strict shared-nothing memory isolation for multi-tenant WebAssembly Component Model (WASI Preview 2) micro-extensions. Forbids ambient authority, persistent cross-tenant store sharing, unconstrained preopen directories, and wildcard socket creation in host runtimes.","antiPatternHeadline":"Ambient Authority Propagation and Cross-Tenant Instance Memory Bleed in WASI Runtimes","stars_count":70,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","wasm","webassembly","wasi-preview2","sandboxing","zero-trust","multi-tenancy"],"exportEndpoints":{"claude":"/api/rules/wasm-component-model-capability-attenuation-sandbox-guardrail?format=claude","cursorMdc":"/api/rules/wasm-component-model-capability-attenuation-sandbox-guardrail?format=mdc","cursorrules":"/api/rules/wasm-component-model-capability-attenuation-sandbox-guardrail?format=cursor","windsurf":"/api/rules/wasm-component-model-capability-attenuation-sandbox-guardrail?format=windsurf","agents":"/api/rules/wasm-component-model-capability-attenuation-sandbox-guardrail?format=agents"}},{"id":"ebpf-ringbuf-backpressure-compaction-standard","title":"eBPF BPF-Ringbuf Adaptive Backpressure Shedding and Dynamic Map Compaction","category":"devops","severity":"critical","description":"Enforces strict memory budget invariants, adaptive telemetry shedding, and dynamic state-map compaction within eBPF kernel programs. Prevents ring buffer exhaustion cascades, kernel memory locking stalls, and high-frequency softirq lockups during high-throughput L7 socket and network audit bursts.","antiPatternHeadline":"Unchecked Ringbuf Allocation with Unbounded Hash Map Retention Causing Kernel Lockups and Blind Telemetry Cascades","stars_count":91,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","linux-kernel","networking","telemetry","performance"],"exportEndpoints":{"claude":"/api/rules/ebpf-ringbuf-backpressure-compaction-standard?format=claude","cursorMdc":"/api/rules/ebpf-ringbuf-backpressure-compaction-standard?format=mdc","cursorrules":"/api/rules/ebpf-ringbuf-backpressure-compaction-standard?format=cursor","windsurf":"/api/rules/ebpf-ringbuf-backpressure-compaction-standard?format=windsurf","agents":"/api/rules/ebpf-ringbuf-backpressure-compaction-standard?format=agents"}},{"id":"webauthn-device-bound-attestation-mds-pinning","title":"Mandate WebAuthn Device-Bound Key Attestation with FIDO2 Enterprise Metadata Pinning","category":"security","severity":"critical","description":"Enforces hardware-backed, non-exportable passkey registration by requiring direct attestation verification against FIDO Alliance Metadata Service (MDS3) roots of trust. Rejects synced passkeys by evaluating authenticator flags (rejecting backup eligibility) and strictly pinning enterprise-approved AAGUIDs to prevent unauthorized credential export.","antiPatternHeadline":"Accepting 'none' attestation, ignoring backup flags, or trusting client-supplied AAGUIDs without verifying x5c chains against FIDO MDS","stars_count":102,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","fido2","attestation","mds3","passkeys","cryptography"],"exportEndpoints":{"claude":"/api/rules/webauthn-device-bound-attestation-mds-pinning?format=claude","cursorMdc":"/api/rules/webauthn-device-bound-attestation-mds-pinning?format=mdc","cursorrules":"/api/rules/webauthn-device-bound-attestation-mds-pinning?format=cursor","windsurf":"/api/rules/webauthn-device-bound-attestation-mds-pinning?format=windsurf","agents":"/api/rules/webauthn-device-bound-attestation-mds-pinning?format=agents"}},{"id":"opentelemetry-baggage-cardinality-tenant-boundary-standard","title":"OpenTelemetry Baggage Strict Allowlisting, Size Capping, and Cross-Tenant Isolation","category":"devops","severity":"critical","description":"Unconstrained OpenTelemetry baggage propagation causes distributed header memory amplification, HTTP 431 request rejection cascades, and critical multi-tenant credential leaks across untrusted service boundaries. Systems must enforce compile-time or runtime allowlists of approved telemetry keys, strict byte-size limits, and boundary sanitization prior to distributed context injection.","antiPatternHeadline":"Unbounded Context Injection into W3C Baggage Causing Header Explosion and Multi-Tenant Credential Leakage","stars_count":43,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","distributed-tracing","multi-tenancy","security","observability"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-baggage-cardinality-tenant-boundary-standard?format=claude","cursorMdc":"/api/rules/opentelemetry-baggage-cardinality-tenant-boundary-standard?format=mdc","cursorrules":"/api/rules/opentelemetry-baggage-cardinality-tenant-boundary-standard?format=cursor","windsurf":"/api/rules/opentelemetry-baggage-cardinality-tenant-boundary-standard?format=windsurf","agents":"/api/rules/opentelemetry-baggage-cardinality-tenant-boundary-standard?format=agents"}},{"id":"kmp-stateflow-recomposition-debounce-barrier","title":"KMP StateFlow Telemetry Debounce & Conflation Barrier for Declarative UI","category":"mobile","severity":"critical","description":"High-frequency streaming inputs (e.g., BLE packets, GPS fixes, sensor feeds, audio telemetry) emitted directly into shared Kotlin Multiplatform StateFlow pipelines saturate the main UI thread in Jetpack Compose and SwiftUI. Shared ViewModels must enforce a conflation and temporal sampling barrier on Dispatchers.Default before exposing UI state. This guarantees that frame rendering cycles (60Hz/120Hz) are never overwhelmed by non-visual intermediary state mutations.","antiPatternHeadline":"Binding Unbounded High-Frequency Telemetry Flows Directly to UI StateFlows Without Conflation Barriers","stars_count":60,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kmp","kotlin-multiplatform","compose-multiplatform","swiftui","stateflow","performance"],"exportEndpoints":{"claude":"/api/rules/kmp-stateflow-recomposition-debounce-barrier?format=claude","cursorMdc":"/api/rules/kmp-stateflow-recomposition-debounce-barrier?format=mdc","cursorrules":"/api/rules/kmp-stateflow-recomposition-debounce-barrier?format=cursor","windsurf":"/api/rules/kmp-stateflow-recomposition-debounce-barrier?format=windsurf","agents":"/api/rules/kmp-stateflow-recomposition-debounce-barrier?format=agents"}},{"id":"nextjs15-server-actions-tainted-state-boundary-guardrail","title":"Next.js 15 Server Actions Tainted State & PII Serialization Guardrail","category":"frontend","severity":"critical","description":"Enforces deterministic boundaries between server-only secrets/unmasked PII and client-accessible states within Next.js 15 Server Components and Server Actions. Mandates the use of experimental_taintObjectReference and experimental_taintUniqueValue to eliminate inadvertent serialization leaks through action return payloads or component props.","antiPatternHeadline":"Returning Raw Data Entities or Tokens from Server Actions Causing Accidental Payload Serialization","stars_count":43,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs15","server-actions","taint-api","security","data-leaks"],"exportEndpoints":{"claude":"/api/rules/nextjs15-server-actions-tainted-state-boundary-guardrail?format=claude","cursorMdc":"/api/rules/nextjs15-server-actions-tainted-state-boundary-guardrail?format=mdc","cursorrules":"/api/rules/nextjs15-server-actions-tainted-state-boundary-guardrail?format=cursor","windsurf":"/api/rules/nextjs15-server-actions-tainted-state-boundary-guardrail?format=windsurf","agents":"/api/rules/nextjs15-server-actions-tainted-state-boundary-guardrail?format=agents"}},{"id":"fastapi-anyio-taskgroup-exception-invariant","title":"FastAPI AnyIO Structured Concurrency TaskGroup Exception Invariant","category":"backend","severity":"critical","description":"Enforces strict structured concurrency in FastAPI services using AnyIO TaskGroups to guarantee deterministic cascading cancellation and atomic cleanup across concurrent sub-tasks. Prevents orphaned background tasks, connection pool starvation, and silent event loop deadlocks caused by unhandled ExceptionGroups and non-shielded cancellation scopes.","antiPatternHeadline":"Spawning detached asyncio tasks or unshielded gather calls that swallow exceptions and leak running coroutines during partial failures.","stars_count":45,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","anyio","structured-concurrency","python","asyncio"],"exportEndpoints":{"claude":"/api/rules/fastapi-anyio-taskgroup-exception-invariant?format=claude","cursorMdc":"/api/rules/fastapi-anyio-taskgroup-exception-invariant?format=mdc","cursorrules":"/api/rules/fastapi-anyio-taskgroup-exception-invariant?format=cursor","windsurf":"/api/rules/fastapi-anyio-taskgroup-exception-invariant?format=windsurf","agents":"/api/rules/fastapi-anyio-taskgroup-exception-invariant?format=agents"}},{"id":"bun-sql-native-streaming-backpressure","title":"Bun 1.2 Native SQL Streaming Backpressure & Heap Isolation Protocol","category":"backend","severity":"critical","description":"Enforces deterministic memory bounds when streaming high-throughput PostgreSQL datasets over HTTP in Bun 1.2. Prohibits full result-set materialization in the JavaScriptCore heap, mandating direct consumption of native SQL binary cursors via bounded ReadableStream pull controllers.","antiPatternHeadline":"Unbounded Array Materialization and Free-Running Async Iteration Causing Heap Exhaustion and GC Freezes","stars_count":116,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","sql","streaming","backpressure","postgresql","memory-leak"],"exportEndpoints":{"claude":"/api/rules/bun-sql-native-streaming-backpressure?format=claude","cursorMdc":"/api/rules/bun-sql-native-streaming-backpressure?format=mdc","cursorrules":"/api/rules/bun-sql-native-streaming-backpressure?format=cursor","windsurf":"/api/rules/bun-sql-native-streaming-backpressure?format=windsurf","agents":"/api/rules/bun-sql-native-streaming-backpressure?format=agents"}},{"id":"tauri-v2-mobile-capability-ipc-sandboxing-tauri-2-0-fine-g-772","title":"Tauri 2.0 Mobile Fine-Grained Capability & IPC Sandboxing Invariant","category":"mobile","severity":"critical","description":"Tauri 2.0 replaces v1 allowlists with explicit, capability-based security contexts. In mobile environments (Android WebView and iOS WKWebView), sensitive native host API invocations and custom IPC commands must be bound exclusively to cryptographically pinned origin windows and explicit window labels rather than wildcard targets. Failure to isolate capabilities exposes privileged native bridges to auxiliary webviews, in-app browser popups, and injected third-party scripts.","antiPatternHeadline":"Wildcard Capability Mapping and Unscoped Native IPC Dispatch in Mobile WebViews","stars_count":62,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri","ipc","security","capabilities","rust","ios","android"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-mobile-capability-ipc-sandboxing-tauri-2-0-fine-g-772?format=claude","cursorMdc":"/api/rules/tauri-v2-mobile-capability-ipc-sandboxing-tauri-2-0-fine-g-772?format=mdc","cursorrules":"/api/rules/tauri-v2-mobile-capability-ipc-sandboxing-tauri-2-0-fine-g-772?format=cursor","windsurf":"/api/rules/tauri-v2-mobile-capability-ipc-sandboxing-tauri-2-0-fine-g-772?format=windsurf","agents":"/api/rules/tauri-v2-mobile-capability-ipc-sandboxing-tauri-2-0-fine-g-772?format=agents"}},{"id":"kmp-room-sqlite-concurrency-isolation-standard","title":"Kotlin Multiplatform Room SQLite Concurrency & Serial Queue Isolation Standard","category":"mobile","severity":"critical","description":"Enforces strict serialized write isolation and pool-managed read concurrency across Android ART and iOS Darwin runtimes using Room KMP. Prevents SQLite 'database is locked' errors (SQLITE_BUSY 5), native thread deadlocks, and dirty reads by binding RoomDatabase builders to dedicated single-threaded write dispatchers and bounded multi-threaded read pools.","antiPatternHeadline":"Unconfined Concurrent SQLite Mutations Across Native Thread Boundaries Inducing SQLITE_BUSY Deadlocks and POSIX Signal Aborts","stars_count":78,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","room","sqlite","concurrency","ios","android"],"exportEndpoints":{"claude":"/api/rules/kmp-room-sqlite-concurrency-isolation-standard?format=claude","cursorMdc":"/api/rules/kmp-room-sqlite-concurrency-isolation-standard?format=mdc","cursorrules":"/api/rules/kmp-room-sqlite-concurrency-isolation-standard?format=cursor","windsurf":"/api/rules/kmp-room-sqlite-concurrency-isolation-standard?format=windsurf","agents":"/api/rules/kmp-room-sqlite-concurrency-isolation-standard?format=agents"}},{"id":"oauth2-dpop-ephemeral-nonce-replay-mitigation","title":"OAuth 2.0 DPoP Ephemeral Nonce-Binding and Replay Mitigation Standard","category":"security","severity":"critical","description":"Enforces RFC 9449 Demonstrating Proof-of-Possession (DPoP) at resource and authorization servers to neutralize token theft and replay attacks. Requires asymmetric proof validation bound to client thumbprints, HTTP method and URI normalization, SHA-256 access token hashing, and strict ephemeral server-issued nonce rotation with single-use JTI cache enforcement.","antiPatternHeadline":"Accepting Unbound Bearer Tokens or DPoP Proofs Missing Ephemeral Nonces and HTM/HTU Verifications","stars_count":53,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","oauth2","dpop","rfc9449","zero-trust","cryptography"],"exportEndpoints":{"claude":"/api/rules/oauth2-dpop-ephemeral-nonce-replay-mitigation?format=claude","cursorMdc":"/api/rules/oauth2-dpop-ephemeral-nonce-replay-mitigation?format=mdc","cursorrules":"/api/rules/oauth2-dpop-ephemeral-nonce-replay-mitigation?format=cursor","windsurf":"/api/rules/oauth2-dpop-ephemeral-nonce-replay-mitigation?format=windsurf","agents":"/api/rules/oauth2-dpop-ephemeral-nonce-replay-mitigation?format=agents"}},{"id":"webauthn-device-bound-attestation-quarantine-protocol","title":"WebAuthn Device-Bound Attestation Key Quarantine and Step-Up Protocol","category":"security","severity":"critical","description":"Enforces strict cryptographic isolation and quarantine for passkeys configured for high-assurance, device-bound execution contexts when detected with synced backup flags or missing hardware-backed attestation. Requires immediate privilege downgrade and mandatory step-up re-registration before granting access to hardware-isolated enterprise boundary tiers.","antiPatternHeadline":"Trusting Multi-Device Synced Passkeys for Hardware-Bound Isolation Tiers Without Quarantine Checks","stars_count":80,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","passkeys","fido2","cryptography","zero-trust","attestation"],"exportEndpoints":{"claude":"/api/rules/webauthn-device-bound-attestation-quarantine-protocol?format=claude","cursorMdc":"/api/rules/webauthn-device-bound-attestation-quarantine-protocol?format=mdc","cursorrules":"/api/rules/webauthn-device-bound-attestation-quarantine-protocol?format=cursor","windsurf":"/api/rules/webauthn-device-bound-attestation-quarantine-protocol?format=windsurf","agents":"/api/rules/webauthn-device-bound-attestation-quarantine-protocol?format=agents"}},{"id":"k8s-gateway-api-referencegrant-cross-namespace-invariant","title":"Mandatory ReferenceGrant for Cross-Namespace Gateway API Resources and TLS Secrets","category":"devops","severity":"critical","description":"Enforces mandatory, least-privilege ReferenceGrant declarations in target namespaces whenever Gateway API resources traverse namespace boundaries. Prevents cross-namespace route hijacking, service impersonation, and unauthorized TLS certificate exfiltration across multi-tenant Kubernetes clusters.","antiPatternHeadline":"Attaching Cross-Namespace Routes or TLS Secrets Without an Explicit, Scoped ReferenceGrant","stars_count":97,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","kubernetes","gateway-api","referencegrant","multi-tenancy","network-security"],"exportEndpoints":{"claude":"/api/rules/k8s-gateway-api-referencegrant-cross-namespace-invariant?format=claude","cursorMdc":"/api/rules/k8s-gateway-api-referencegrant-cross-namespace-invariant?format=mdc","cursorrules":"/api/rules/k8s-gateway-api-referencegrant-cross-namespace-invariant?format=cursor","windsurf":"/api/rules/k8s-gateway-api-referencegrant-cross-namespace-invariant?format=windsurf","agents":"/api/rules/k8s-gateway-api-referencegrant-cross-namespace-invariant?format=agents"}},{"id":"opentelemetry-otlp-arrow-batch-streaming-standard","title":"OpenTelemetry OTLP Arrow Columnar Stream Framing & Batch Allocation Standard","category":"devops","severity":"critical","description":"Enforces columnar Apache Arrow IPC stream boundaries and batching invariants within OpenTelemetry pipelines to eliminate serialization CPU overhead and memory fragmentation. Guarantees memory safety and optimal dictionary encoding during peak ingestion by coordinating upstream batch processors with downstream OTLP Arrow stream allocations. Prevents collector out-of-memory (OOM) crashes and garbage collection thrashing under multi-gigabit telemetry loads.","antiPatternHeadline":"Naive Row-Oriented OTLP Protobuf Ingestion Under High-Throughput Burst Conditions","stars_count":60,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","apache-arrow","otlp-arrow","high-throughput","observability","performance"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-otlp-arrow-batch-streaming-standard?format=claude","cursorMdc":"/api/rules/opentelemetry-otlp-arrow-batch-streaming-standard?format=mdc","cursorrules":"/api/rules/opentelemetry-otlp-arrow-batch-streaming-standard?format=cursor","windsurf":"/api/rules/opentelemetry-otlp-arrow-batch-streaming-standard?format=windsurf","agents":"/api/rules/opentelemetry-otlp-arrow-batch-streaming-standard?format=agents"}},{"id":"react-19-concurrent-resource-disposal-guardrail","title":"React 19 Concurrent Interruption Resource Disposal Standard","category":"frontend","severity":"critical","description":"Enforces strict passive allocation paradigms in React 19 concurrent mode to eliminate leaks of unmanaged browser primitives (WebGL contexts, Web Workers, Observers, and SharedArrayBuffers). In React 19, concurrent render passes can yield, suspend, or abort before mounting; any side effects or allocations initiated during the render phase bypass commit cleanup, accumulating uncollected GPU/OS-level handles. All lifecycle allocations must be deferred strictly to passive commit phases (useEffect) or wrapped in idempotent cleanup abstractions guarded against discarded frames.","antiPatternHeadline":"Eager Resource Allocation During Concurrent Render Passes Without Deferred Commit Lifecycle Guards","stars_count":57,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["react-19","concurrent-mode","webgl","web-workers","memory-leaks","performance"],"exportEndpoints":{"claude":"/api/rules/react-19-concurrent-resource-disposal-guardrail?format=claude","cursorMdc":"/api/rules/react-19-concurrent-resource-disposal-guardrail?format=mdc","cursorrules":"/api/rules/react-19-concurrent-resource-disposal-guardrail?format=cursor","windsurf":"/api/rules/react-19-concurrent-resource-disposal-guardrail?format=windsurf","agents":"/api/rules/react-19-concurrent-resource-disposal-guardrail?format=agents"}},{"id":"axum-0-8-tower-service-clone-isolation","title":"Axum 0.8 Tower Service Clone and Stateful Buffer Isolation Standard","category":"backend","severity":"critical","description":"Enforces strict per-request state isolation when implementing custom Tower Service and Layer abstractions in Axum 0.8. Eliminates cross-request state contamination, unhandled backpressure deadlocks, and race conditions caused by shallow cloning internal buffers across Tokio's multi-threaded work-stealing runtime.","antiPatternHeadline":"Persisting Request Buffers or Mutable Context Across Tower Service Clones","stars_count":104,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tower","tokio","concurrency"],"exportEndpoints":{"claude":"/api/rules/axum-0-8-tower-service-clone-isolation?format=claude","cursorMdc":"/api/rules/axum-0-8-tower-service-clone-isolation?format=mdc","cursorrules":"/api/rules/axum-0-8-tower-service-clone-isolation?format=cursor","windsurf":"/api/rules/axum-0-8-tower-service-clone-isolation?format=windsurf","agents":"/api/rules/axum-0-8-tower-service-clone-isolation?format=agents"}},{"id":"postgres-17-streaming-direct-io-cache-bypass","title":"PostgreSQL 17 Streaming I/O and Direct I/O Cache-Bypass Invariant","category":"backend","severity":"critical","description":"Enforces strict I/O isolation for high-volume sequential analytics operations to prevent eviction of hot OLTP working sets from PostgreSQL shared_buffers and operating system page caches. Leverages PostgreSQL 17 streaming I/O architecture, vector reads, and session-level buffer-bypass configurations. Prohibits unbounded sequential scans on transaction-critical primary nodes.","antiPatternHeadline":"Unbounded sequential analytical scans polluting shared_buffers and evicting mission-critical OLTP working sets","stars_count":60,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql-17","database-performance","oltp","direct-io","streaming-io"],"exportEndpoints":{"claude":"/api/rules/postgres-17-streaming-direct-io-cache-bypass?format=claude","cursorMdc":"/api/rules/postgres-17-streaming-direct-io-cache-bypass?format=mdc","cursorrules":"/api/rules/postgres-17-streaming-direct-io-cache-bypass?format=cursor","windsurf":"/api/rules/postgres-17-streaming-direct-io-cache-bypass?format=windsurf","agents":"/api/rules/postgres-17-streaming-direct-io-cache-bypass?format=agents"}},{"id":"tauri-v2-mobile-ipc-capability-marshaling-standard","title":"Tauri 2.0 Mobile Plugin IPC Capability Scoping and Zero-Copy Binary Marshaling","category":"mobile","severity":"critical","description":"Enforces strict principle-of-least-privilege capability boundaries and zero-copy binary serialization across Tauri 2.0 mobile bridges. Prohibits wildcard IPC permissions and string-based Base64 marshaling of binary buffers over Webview, Rust core, and native Kotlin/Swift FFI boundaries to eliminate memory amplification, frame stutter, and unauthorized command execution.","antiPatternHeadline":"Unrestricted Wildcard Capabilities and Base64 Buffer Marshaling Over Mobile IPC Bridges","stars_count":41,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri","tauri-v2","rust","ipc","security","zero-copy","android","ios"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-mobile-ipc-capability-marshaling-standard?format=claude","cursorMdc":"/api/rules/tauri-v2-mobile-ipc-capability-marshaling-standard?format=mdc","cursorrules":"/api/rules/tauri-v2-mobile-ipc-capability-marshaling-standard?format=cursor","windsurf":"/api/rules/tauri-v2-mobile-ipc-capability-marshaling-standard?format=windsurf","agents":"/api/rules/tauri-v2-mobile-ipc-capability-marshaling-standard?format=agents"}},{"id":"capacitor-7-background-runner-watchdog-guardrail","title":"Capacitor 7 Background Runner Watchdog and Native Thread Bridge Guardrail","category":"mobile","severity":"critical","description":"Guarantees background telemetry, synchronization, and push processing tasks complete within OS watchdog limits (e.g., iOS 0x8badf00d kills). Prevents deadlocks by enforcing strict thread isolation between JavaScriptCore/QuickJS background workers and suspended WebKit UI threads.","antiPatternHeadline":"Unbounded Background Tasks and Cross-Thread Deadlocks with Suspended WebKit Contexts","stars_count":119,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","background-runner","ios","android","concurrency"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-background-runner-watchdog-guardrail?format=claude","cursorMdc":"/api/rules/capacitor-7-background-runner-watchdog-guardrail?format=mdc","cursorrules":"/api/rules/capacitor-7-background-runner-watchdog-guardrail?format=cursor","windsurf":"/api/rules/capacitor-7-background-runner-watchdog-guardrail?format=windsurf","agents":"/api/rules/capacitor-7-background-runner-watchdog-guardrail?format=agents"}},{"id":"openfga-contextual-tuple-depth-cycle-guardrail","title":"OpenFGA 1.6 Contextual Tuple Traversal Depth and Cycle Detection Invariant","category":"security","severity":"critical","description":"Enforces strict pre-flight acyclicity validation, traversal depth bounding, and bounded context timeouts when submitting contextual tuples to OpenFGA 1.6 check APIs. Prevents denial-of-service, goroutine starvation, and catastrophic tail-latency degradation caused by circular references or deeply nested dynamic relation graphs in ReBAC authorization pipelines.","antiPatternHeadline":"Unbounded Contextual Tuple Graph Injection Leading to ReBAC Cycle Exploitation and Algorithmic DoS","stars_count":106,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","rebac","dos-prevention","zero-trust","latency"],"exportEndpoints":{"claude":"/api/rules/openfga-contextual-tuple-depth-cycle-guardrail?format=claude","cursorMdc":"/api/rules/openfga-contextual-tuple-depth-cycle-guardrail?format=mdc","cursorrules":"/api/rules/openfga-contextual-tuple-depth-cycle-guardrail?format=cursor","windsurf":"/api/rules/openfga-contextual-tuple-depth-cycle-guardrail?format=windsurf","agents":"/api/rules/openfga-contextual-tuple-depth-cycle-guardrail?format=agents"}},{"id":"oauth-21-dpop-nonce-rotation-replay-guardrail","title":"OAuth 2.1 DPoP Sender-Constrained Nonce Rotation and Distributed Replay Guardrail","category":"security","severity":"critical","description":"Enforces sender-constrained token access via RFC 9449 Demonstrating Proof-of-Possession (DPoP) across distributed edge gateways. Mandates asymmetric key proof validation, strict HTTP method and URI binding, SHA-256 access token thumbprint validation (ath), and distributed atomic nonce rotation to neutralize access-token exfiltration and replay attacks.","antiPatternHeadline":"Accepting Bearer Tokens or Unchecked DPoP Proofs with Stale Nonces and Missing ATH Bindings","stars_count":64,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","oauth2","dpop","rfc9449","sender-constrained-tokens","distributed-systems"],"exportEndpoints":{"claude":"/api/rules/oauth-21-dpop-nonce-rotation-replay-guardrail?format=claude","cursorMdc":"/api/rules/oauth-21-dpop-nonce-rotation-replay-guardrail?format=mdc","cursorrules":"/api/rules/oauth-21-dpop-nonce-rotation-replay-guardrail?format=cursor","windsurf":"/api/rules/oauth-21-dpop-nonce-rotation-replay-guardrail?format=windsurf","agents":"/api/rules/oauth-21-dpop-nonce-rotation-replay-guardrail?format=agents"}},{"id":"otel-collector-tail-sampling-memory-circuit-breaker-invariant","title":"OpenTelemetry Collector Tail-Based Sampling Memory Limiter & Circuit Breaker Invariant","category":"devops","severity":"critical","description":"Enforces deterministic placement of the memory_limiter processor upstream of tail_sampling and exporter buffers in OpenTelemetry Collector topologies. Mandates bounded trace decision caches, proactive memory ballast thresholds, and drop policies to eliminate out-of-memory (OOM) crashes under downstream storage backpressure. Guarantees pipeline stability during cardinality spikes and network degradation.","antiPatternHeadline":"Placing Tail Sampling Before Memory Limiter with Unbounded In-Flight Caches Causing Telemetry OOM Cascades","stars_count":105,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","tail-sampling","circuit-breaker","resilience","sre"],"exportEndpoints":{"claude":"/api/rules/otel-collector-tail-sampling-memory-circuit-breaker-invariant?format=claude","cursorMdc":"/api/rules/otel-collector-tail-sampling-memory-circuit-breaker-invariant?format=mdc","cursorrules":"/api/rules/otel-collector-tail-sampling-memory-circuit-breaker-invariant?format=cursor","windsurf":"/api/rules/otel-collector-tail-sampling-memory-circuit-breaker-invariant?format=windsurf","agents":"/api/rules/otel-collector-tail-sampling-memory-circuit-breaker-invariant?format=agents"}},{"id":"k8s-gateway-v1-2-cross-namespace-referencegrant-invariant","title":"Kubernetes Gateway API v1.2 ReferenceGrant Cross-Namespace Security Invariant","category":"devops","severity":"critical","description":"Mandates explicit, fine-grained ReferenceGrant resources for all cross-namespace Gateway API v1.2 references between Routes, Gateways, and Services. Prevents cross-tenant traffic hijacking and routing misconfigurations by enforcing unidirectional administrative consent from destination namespaces.","antiPatternHeadline":"Cross-Namespace BackendRef or Route Attachment Without Explicit Destination ReferenceGrant","stars_count":88,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","kubernetes","gateway-api","security","zero-trust","multi-tenancy"],"exportEndpoints":{"claude":"/api/rules/k8s-gateway-v1-2-cross-namespace-referencegrant-invariant?format=claude","cursorMdc":"/api/rules/k8s-gateway-v1-2-cross-namespace-referencegrant-invariant?format=mdc","cursorrules":"/api/rules/k8s-gateway-v1-2-cross-namespace-referencegrant-invariant?format=cursor","windsurf":"/api/rules/k8s-gateway-v1-2-cross-namespace-referencegrant-invariant?format=windsurf","agents":"/api/rules/k8s-gateway-v1-2-cross-namespace-referencegrant-invariant?format=agents"}},{"id":"drizzle-038-serverless-prepared-statement-cache-eviction-standard","title":"Drizzle ORM 0.38 Serverless Prepared Statement Cache Eviction & Connection Guardrail","category":"backend","severity":"critical","description":"Mandates deterministic prepared statement lifecycle management and driver-level statement cache bypassing for Drizzle ORM 0.38+ within serverless and edge runtimes. Prevents connection pool exhaustion, memory bloat across execution context freeze/thaw cycles, and PgBouncer 42P05 prepared statement collisions in pooled environments.","antiPatternHeadline":"Global Unbounded Prepared Statement Caching Over Transient Serverless Handoffs","stars_count":52,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","drizzle-orm","serverless","postgresql","pgbouncer","memory-leaks","connection-pooling"],"exportEndpoints":{"claude":"/api/rules/drizzle-038-serverless-prepared-statement-cache-eviction-standard?format=claude","cursorMdc":"/api/rules/drizzle-038-serverless-prepared-statement-cache-eviction-standard?format=mdc","cursorrules":"/api/rules/drizzle-038-serverless-prepared-statement-cache-eviction-standard?format=cursor","windsurf":"/api/rules/drizzle-038-serverless-prepared-statement-cache-eviction-standard?format=windsurf","agents":"/api/rules/drizzle-038-serverless-prepared-statement-cache-eviction-standard?format=agents"}},{"id":"svelte5-runes-ssr-context-isolation","title":"Svelte 5 Runes SSR Reactive Context Isolation Standard","category":"frontend","severity":"critical","description":"Enforces strict boundary encapsulation of Svelte 5 reactive primitives ($state, $derived) within request-scoped lifecycle contexts during Node.js SSR. Prevents catastrophic cross-tenant and cross-session data leaks caused by module-scoped reactive singletons retaining state across concurrent HTTP requests in long-running server runtimes.","antiPatternHeadline":"Module-Scoped $state Primitives Leaking Cross-Request Session Context in Node.js SSR","stars_count":42,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","ssr","security","node"],"exportEndpoints":{"claude":"/api/rules/svelte5-runes-ssr-context-isolation?format=claude","cursorMdc":"/api/rules/svelte5-runes-ssr-context-isolation?format=mdc","cursorrules":"/api/rules/svelte5-runes-ssr-context-isolation?format=cursor","windsurf":"/api/rules/svelte5-runes-ssr-context-isolation?format=windsurf","agents":"/api/rules/svelte5-runes-ssr-context-isolation?format=agents"}},{"id":"postgres-17-json-table-deterministic-projection-standard","title":"PostgreSQL 17 Native JSON_TABLE Deterministic Projection Standard","category":"backend","severity":"critical","description":"Mandates the use of PostgreSQL 17 SQL/JSON standard JSON_TABLE for projecting semi-structured payloads into typed relational structures at query and boundary layers. Prohibits runtime JSONB traversal operators and legacy unnesting functions in join and filter paths to eliminate query planner misestimations and runtime deserialization overhead.","antiPatternHeadline":"Runtime JSONB Operator Traversal and Legacy Recordset Deserialization in Hot Query Paths","stars_count":95,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql-17","json-table","sql-json","query-planner","performance"],"exportEndpoints":{"claude":"/api/rules/postgres-17-json-table-deterministic-projection-standard?format=claude","cursorMdc":"/api/rules/postgres-17-json-table-deterministic-projection-standard?format=mdc","cursorrules":"/api/rules/postgres-17-json-table-deterministic-projection-standard?format=cursor","windsurf":"/api/rules/postgres-17-json-table-deterministic-projection-standard?format=windsurf","agents":"/api/rules/postgres-17-json-table-deterministic-projection-standard?format=agents"}},{"id":"go-124-zero-alloc-span-logger-standard","title":"Go 1.24 Zero-Allocation Contextual Span Logger and Pointerless Metadata Standard","category":"backend","severity":"critical","description":"Enforces strict heap-escape-free contextual telemetry propagation across hot-path microservice execution loops in Go 1.24. Forbids dynamic interface boxing via context.WithValue and heap-allocated telemetry attributes by mandating value-receiver span loggers with inline fixed-size byte buffers and compile-time stack allocation verification.","antiPatternHeadline":"Boxing dynamic telemetry metadata in context.WithValue and unbuffered slog.Attr slice allocations on hot paths","stars_count":111,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","golang","zero-allocation","telemetry","gc-optimization","slog","concurrency"],"exportEndpoints":{"claude":"/api/rules/go-124-zero-alloc-span-logger-standard?format=claude","cursorMdc":"/api/rules/go-124-zero-alloc-span-logger-standard?format=mdc","cursorrules":"/api/rules/go-124-zero-alloc-span-logger-standard?format=cursor","windsurf":"/api/rules/go-124-zero-alloc-span-logger-standard?format=windsurf","agents":"/api/rules/go-124-zero-alloc-span-logger-standard?format=agents"}},{"id":"android-15-16kb-page-size-alignment-guardrail-android-15-16kb--231","title":"Android 15 16KB Page Size Native ABI Memory Alignment Guardrail","category":"mobile","severity":"critical","description":"Android 15 introduces support for devices configured with 16KB virtual memory page sizes, breaking legacy native ELF binaries and memory-mapped operations designed exclusively for 4KB boundaries. Unaligned ELF segments and hardcoded 4KB offsets in NDK shared libraries cause fatal SIGSEGV crashes on load or runtime memory mapping. Engineers must enforce 16KB ELF segment alignment across CMake/ndk-build configurations and replace hardcoded page constants with dynamic runtime queries via sysconf(_SC_PAGESIZE) or getpagesize().","antiPatternHeadline":"Compiling NDK Binaries with Default 4KB Max Page Sizes or Hardcoding 4096-Byte Memory Offsets","stars_count":91,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","android","ndk","android15","memory-management","native","cplusplus","abi"],"exportEndpoints":{"claude":"/api/rules/android-15-16kb-page-size-alignment-guardrail-android-15-16kb--231?format=claude","cursorMdc":"/api/rules/android-15-16kb-page-size-alignment-guardrail-android-15-16kb--231?format=mdc","cursorrules":"/api/rules/android-15-16kb-page-size-alignment-guardrail-android-15-16kb--231?format=cursor","windsurf":"/api/rules/android-15-16kb-page-size-alignment-guardrail-android-15-16kb--231?format=windsurf","agents":"/api/rules/android-15-16kb-page-size-alignment-guardrail-android-15-16kb--231?format=agents"}},{"id":"swiftdata-actor-isolated-persistence-sync","title":"Strict Actor Confinement & Background Synchronization in SwiftData (iOS 18)","category":"mobile","severity":"critical","description":"Enforces strict ModelActor isolation and PersistentIdentifier passing across background sync pipelines and multi-window SwiftUI presentations in iOS 18. Eliminates cross-thread SQLite database locking, EXC_BAD_ACCESS exceptions, and multi-threaded write deadlocks by guaranteeing single-writer actor ownership and strictly preventing PersistentModel instances from crossing actor boundaries.","antiPatternHeadline":"Passing Live PersistentModel References Across Concurrent Tasks and Capturing Main-Queue Contexts in Background Operations","stars_count":102,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","ios","swift6","swiftdata","concurrency","actors","sqlite"],"exportEndpoints":{"claude":"/api/rules/swiftdata-actor-isolated-persistence-sync?format=claude","cursorMdc":"/api/rules/swiftdata-actor-isolated-persistence-sync?format=mdc","cursorrules":"/api/rules/swiftdata-actor-isolated-persistence-sync?format=cursor","windsurf":"/api/rules/swiftdata-actor-isolated-persistence-sync?format=windsurf","agents":"/api/rules/swiftdata-actor-isolated-persistence-sync?format=agents"}},{"id":"post-quantum-hybrid-tls13-mlkem-enforcement","title":"Mandatory Post-Quantum Hybrid TLS 1.3 (ML-KEM) Key Exchange Standard","category":"security","severity":"critical","description":"Enforces post-quantum hybrid key encapsulation (FIPS 203 ML-KEM-768 combined with classical ECDH curves like X25519) across all service-to-service transport configurations. Prevents Harvest-Now-Decrypt-Later (HNDL) attacks by mandating TLS 1.3 minimum versions, restricting curve preferences to hybrid groups, and rejecting classical-only key exchanges in zero-trust mesh traffic.","antiPatternHeadline":"Configuring classical-only key exchange or permissive TLS downgrades vulnerable to Harvest-Now-Decrypt-Later threats.","stars_count":113,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","cryptography","tls13","post-quantum","ml-kem","zero-trust","hndl"],"exportEndpoints":{"claude":"/api/rules/post-quantum-hybrid-tls13-mlkem-enforcement?format=claude","cursorMdc":"/api/rules/post-quantum-hybrid-tls13-mlkem-enforcement?format=mdc","cursorrules":"/api/rules/post-quantum-hybrid-tls13-mlkem-enforcement?format=cursor","windsurf":"/api/rules/post-quantum-hybrid-tls13-mlkem-enforcement?format=windsurf","agents":"/api/rules/post-quantum-hybrid-tls13-mlkem-enforcement?format=agents"}},{"id":"passkey-prf-client-side-zk-encryption-invariant","title":"WebAuthn PRF Client-Side Zero-Knowledge Key Derivation Invariants","category":"security","severity":"critical","description":"Enforces strict client-side isolation of WebAuthn Pseudo-Random Function (PRF) extension outputs and derived cryptographic keys. Mandates sanitization of credential assertions prior to server transmission, HKDF domain separation for key derivation, and storage of derived keys solely within non-extractable CryptoKey primitives.","antiPatternHeadline":"Transmitting raw PRF outputs to Relying Party servers or persisting derived keys into extractable browser storage.","stars_count":53,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","prf-extension","zero-knowledge","webcrypto","encryption"],"exportEndpoints":{"claude":"/api/rules/passkey-prf-client-side-zk-encryption-invariant?format=claude","cursorMdc":"/api/rules/passkey-prf-client-side-zk-encryption-invariant?format=mdc","cursorrules":"/api/rules/passkey-prf-client-side-zk-encryption-invariant?format=cursor","windsurf":"/api/rules/passkey-prf-client-side-zk-encryption-invariant?format=windsurf","agents":"/api/rules/passkey-prf-client-side-zk-encryption-invariant?format=agents"}},{"id":"cilium-tetragon-ebpf-namespace-escape-guardrail","title":"Cilium Tetragon eBPF Synchronous Namespace Escape & Privilege Escalation Enforcement","category":"devops","severity":"critical","description":"Enforces deterministic, in-kernel prevention of container breakout attempts using Cilium Tetragon TracingPolicies with synchronous SIGKILL interventions. Intercepts sensitive syscalls (setns, unshare, cap_capable, mount, commit_creds) inside ephemeral execution contexts before the kernel commits process capability transitions or boundary escapes. Guarantees immutable audit logging and instant process termination without relying on asynchronous userspace telemetry collectors.","antiPatternHeadline":"Relying on Passive Post-Execution Auditing or Asynchronous SIEM Forwarders to Detect Container Breakouts","stars_count":70,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","cilium","tetragon","ebpf","kubernetes","security","runtime-security"],"exportEndpoints":{"claude":"/api/rules/cilium-tetragon-ebpf-namespace-escape-guardrail?format=claude","cursorMdc":"/api/rules/cilium-tetragon-ebpf-namespace-escape-guardrail?format=mdc","cursorrules":"/api/rules/cilium-tetragon-ebpf-namespace-escape-guardrail?format=cursor","windsurf":"/api/rules/cilium-tetragon-ebpf-namespace-escape-guardrail?format=windsurf","agents":"/api/rules/cilium-tetragon-ebpf-namespace-escape-guardrail?format=agents"}},{"id":"wasi-0-2-gateway-plugin-sandbox-standard","title":"WASI 0.2 Component Model Gateway Plugin Sandboxing Standard","category":"devops","severity":"critical","description":"Enforces strict capability-based isolation and zero ambient authority for third-party middleware plugins in API gateways using WASI 0.2 and the Wasm Component Model. Prevents data exfiltration, denial-of-service, and host compromise by denying default access to file systems, environment variables, and raw sockets, while mandating explicit WIT contract boundaries, memory caps, and epoch-based execution interruption.","antiPatternHeadline":"Granting Ambient Host Capabilities and Unmetered Compute to Untrusted Gateway Wasm Plugins","stars_count":45,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","wasm","wasi-0-2","component-model","sandboxing","security","api-gateway"],"exportEndpoints":{"claude":"/api/rules/wasi-0-2-gateway-plugin-sandbox-standard?format=claude","cursorMdc":"/api/rules/wasi-0-2-gateway-plugin-sandbox-standard?format=mdc","cursorrules":"/api/rules/wasi-0-2-gateway-plugin-sandbox-standard?format=cursor","windsurf":"/api/rules/wasi-0-2-gateway-plugin-sandbox-standard?format=windsurf","agents":"/api/rules/wasi-0-2-gateway-plugin-sandbox-standard?format=agents"}},{"id":"vite-6-module-federation-remote-sandboxing-standard","title":"Vite 6 Module Federation Cross-Origin Remote Sandboxing Standard","category":"frontend","severity":"critical","description":"Enforces boundary isolation for independently deployed cross-origin remote micro-frontends integrated via Vite 6 Module Federation. Mandates runtime CSS encapsulation via Shadow DOM and execution confinement via JavaScript Proxy boundaries or SES realms to preclude prototype pollution, global object collision, and cascade destruction.","antiPatternHeadline":"Unsandboxed Cross-Origin Remote Execution and Global CSS Injection","stars_count":107,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","vite6","module-federation","micro-frontends","sandboxing","prototype-pollution","shadow-dom"],"exportEndpoints":{"claude":"/api/rules/vite-6-module-federation-remote-sandboxing-standard?format=claude","cursorMdc":"/api/rules/vite-6-module-federation-remote-sandboxing-standard?format=mdc","cursorrules":"/api/rules/vite-6-module-federation-remote-sandboxing-standard?format=cursor","windsurf":"/api/rules/vite-6-module-federation-remote-sandboxing-standard?format=windsurf","agents":"/api/rules/vite-6-module-federation-remote-sandboxing-standard?format=agents"}},{"id":"postgres-17-radix-vacuum-guardrail","title":"Postgres 17 Radix Tree Vacuum Memory Cap and Lock-Escalation Guardrail","category":"backend","severity":"critical","description":"Postgres 17 replaces flat dead-tuple arrays with an adaptive radix tree (TidStore) for autovacuum, reducing dead-TID memory overhead by up to 20x. This guardrail mandates bounded worker memory budgets and partitioned storage parameters to prevent multi-worker memory exhaustion and lock-escalation stall cascades on high-churn append-only tables.","antiPatternHeadline":"Over-allocating maintenance_work_mem and relying on default global autovacuum settings across high-write append-only event tables","stars_count":51,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres","postgres-17","database-reliability","autovacuum","performance"],"exportEndpoints":{"claude":"/api/rules/postgres-17-radix-vacuum-guardrail?format=claude","cursorMdc":"/api/rules/postgres-17-radix-vacuum-guardrail?format=mdc","cursorrules":"/api/rules/postgres-17-radix-vacuum-guardrail?format=cursor","windsurf":"/api/rules/postgres-17-radix-vacuum-guardrail?format=windsurf","agents":"/api/rules/postgres-17-radix-vacuum-guardrail?format=agents"}},{"id":"axum-0-8-tower-graceful-drain-invariant","title":"Axum 0.8 Tower Service Graceful Disconnection Drain Invariant","category":"backend","severity":"critical","description":"Enforces deterministic graceful shutdown sequencing for Axum 0.8 and underlying Hyper/Tower layers handling long-lived connections, such as Server-Sent Events (SSE) and HTTP/3 streams. Prevents socket truncation, orphaned background workers, and payload loss during Kubernetes rolling deploys through explicit cancellation propagation, active connection tracking, and dual-phase drain timeouts.","antiPatternHeadline":"Abrupt Socket Severing via Default Hyper Shutdown Without SSE/Stream Drain Signaling","stars_count":61,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tower","tokio","http3","sse","graceful-shutdown"],"exportEndpoints":{"claude":"/api/rules/axum-0-8-tower-graceful-drain-invariant?format=claude","cursorMdc":"/api/rules/axum-0-8-tower-graceful-drain-invariant?format=mdc","cursorrules":"/api/rules/axum-0-8-tower-graceful-drain-invariant?format=cursor","windsurf":"/api/rules/axum-0-8-tower-graceful-drain-invariant?format=windsurf","agents":"/api/rules/axum-0-8-tower-graceful-drain-invariant?format=agents"}},{"id":"bun-ffi-buffer-lifetime-pinning-standard","title":"Bun 1.2 FFI Buffer Lifetime and Non-GC Pinning Standard","category":"backend","severity":"critical","description":"Enforces explicit memory retention and pointer pinning across the JavaScriptCore-to-native C ABI boundary in Bun 1.2 FFI integrations. Prevents silent memory compaction and garbage collection sweeps from invalidating raw buffer pointers during asynchronous or microtask-heavy native execution.","antiPatternHeadline":"Ephemeral Inline Buffer Passing to Native FFI Boundary Causing Silent GC Use-After-Free","stars_count":59,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","ffi","memory-safety","c-abi","gc-pinning"],"exportEndpoints":{"claude":"/api/rules/bun-ffi-buffer-lifetime-pinning-standard?format=claude","cursorMdc":"/api/rules/bun-ffi-buffer-lifetime-pinning-standard?format=mdc","cursorrules":"/api/rules/bun-ffi-buffer-lifetime-pinning-standard?format=cursor","windsurf":"/api/rules/bun-ffi-buffer-lifetime-pinning-standard?format=windsurf","agents":"/api/rules/bun-ffi-buffer-lifetime-pinning-standard?format=agents"}},{"id":"capacitor-7-background-runner-memory-fence-standard","title":"Capacitor 7 Background Runner Memory-Fence and Task Lifecycle Architecture","category":"mobile","severity":"critical","description":"Establishes non-blocking memory fences and strict execution-window boundaries for @capacitor/background-runner tasks on iOS and Android runtimes. Preempts unnotified operating system SIGKILL and OOM events by constraining background heap allocation, isolating native IPC payloads, and mandating explicit cooperative multitasking checkpoints within the isolated JavaScript execution context.","antiPatternHeadline":"Unbounded Heap Accumulation and Hanging Event Loops in Capacitor Background Runner Contexts","stars_count":47,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor-7","background-runner","memory-management","web-worker","battery-optimization","ios-backgroundtasks","android-workmanager"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-background-runner-memory-fence-standard?format=claude","cursorMdc":"/api/rules/capacitor-7-background-runner-memory-fence-standard?format=mdc","cursorrules":"/api/rules/capacitor-7-background-runner-memory-fence-standard?format=cursor","windsurf":"/api/rules/capacitor-7-background-runner-memory-fence-standard?format=windsurf","agents":"/api/rules/capacitor-7-background-runner-memory-fence-standard?format=agents"}},{"id":"kmp-compose-skiko-vsync-render-decoupling-standard","title":"KMP Compose Multiplatform Skiko VSync Render-Decoupling Standard","category":"mobile","severity":"critical","description":"Enforces strict decoupling between high-frequency concurrent state dispatches and Skiko's native graphics pipeline (Metal/Vulkan). Prevents Main dispatcher saturation, frame-pacing drops below the 60Hz/120Hz VSync deadline, and device thermal throttling in Kotlin Multiplatform UI layers.","antiPatternHeadline":"Unconflated Real-Time State Ingestion Saturating Skiko Rendering Loops and Violating VSync Budgets","stars_count":63,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kmp","compose-multiplatform","skiko","metal","vulkan","coroutines","frame-pacing"],"exportEndpoints":{"claude":"/api/rules/kmp-compose-skiko-vsync-render-decoupling-standard?format=claude","cursorMdc":"/api/rules/kmp-compose-skiko-vsync-render-decoupling-standard?format=mdc","cursorrules":"/api/rules/kmp-compose-skiko-vsync-render-decoupling-standard?format=cursor","windsurf":"/api/rules/kmp-compose-skiko-vsync-render-decoupling-standard?format=windsurf","agents":"/api/rules/kmp-compose-skiko-vsync-render-decoupling-standard?format=agents"}},{"id":"webauthn-prf-zk-key-derivation-boundary","title":"WebAuthn PRF Deterministic Zero-Knowledge Key Derivation Boundary","category":"security","severity":"critical","description":"Enforces a strict cryptographic boundary for WebAuthn Pseudo-Random Function (PRF) extension key derivation. Mandates that raw PRF outputs and intermediate key material are imported strictly as non-extractable CryptoKey instances, isolated within client memory, and derived via HKDF so that zero-knowledge root symmetric credentials never traverse the wire or persist into unmanaged storage.","antiPatternHeadline":"Exposing Raw WebAuthn PRF Outputs Over the Wire or Storing Extractable Master Keys in Persistent Client Storage","stars_count":46,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","prf-extension","zero-knowledge","cryptography","webcrypto"],"exportEndpoints":{"claude":"/api/rules/webauthn-prf-zk-key-derivation-boundary?format=claude","cursorMdc":"/api/rules/webauthn-prf-zk-key-derivation-boundary?format=mdc","cursorrules":"/api/rules/webauthn-prf-zk-key-derivation-boundary?format=cursor","windsurf":"/api/rules/webauthn-prf-zk-key-derivation-boundary?format=windsurf","agents":"/api/rules/webauthn-prf-zk-key-derivation-boundary?format=agents"}},{"id":"openfga-modular-schema-acyclic-validation","title":"OpenFGA 1.6 Modular Model Schema Static Acyclic & Cycle-Detection Standard","category":"security","severity":"critical","description":"Mandates compile-time static acyclic graph verification across federated OpenFGA 1.6 modular authorization models prior to runtime registration. Circular relation expansions across distributed module files induce unbounded tuple resolution and severe Denial-of-Service (DoS) during Check and ListObjects queries. Strict automated cycle analysis guarantees provable termination bounds for recursive graph traversals.","antiPatternHeadline":"Unvalidated Cross-Module Cyclic Relation References Inducing Recursive Expansion Denial of Service","stars_count":44,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","authorization","rebac","cycle-detection","modular-models"],"exportEndpoints":{"claude":"/api/rules/openfga-modular-schema-acyclic-validation?format=claude","cursorMdc":"/api/rules/openfga-modular-schema-acyclic-validation?format=mdc","cursorrules":"/api/rules/openfga-modular-schema-acyclic-validation?format=cursor","windsurf":"/api/rules/openfga-modular-schema-acyclic-validation?format=windsurf","agents":"/api/rules/openfga-modular-schema-acyclic-validation?format=agents"}},{"id":"k8s-gateway-api-referencegrant-isolation","title":"Kubernetes Gateway API ReferenceGrant Strict Cross-Namespace Handshake Enforcement","category":"devops","severity":"critical","description":"Mandates strict bidirectional authorization for cross-namespace references in Kubernetes Gateway API using explicit ReferenceGrant custom resources. Prevents multi-tenant route hijacking, unauthorized secret attachments, and broken routing paths across Gateway listeners, Routes, Secrets, and Services.","antiPatternHeadline":"Implicit Cross-Namespace Route Hijacking and Unauthorized Secret Ingestion via Missing ReferenceGrants","stars_count":61,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","kubernetes","gateway-api","referencegrant","multi-tenancy","zero-trust"],"exportEndpoints":{"claude":"/api/rules/k8s-gateway-api-referencegrant-isolation?format=claude","cursorMdc":"/api/rules/k8s-gateway-api-referencegrant-isolation?format=mdc","cursorrules":"/api/rules/k8s-gateway-api-referencegrant-isolation?format=cursor","windsurf":"/api/rules/k8s-gateway-api-referencegrant-isolation?format=windsurf","agents":"/api/rules/k8s-gateway-api-referencegrant-isolation?format=agents"}},{"id":"react19-useoptimistic-concurrent-transition-barrier","title":"React 19 useOptimistic Concurrent Transition Rollback Barrier","category":"frontend","severity":"critical","description":"Enforces strict monotonic sequence barriers and atomic transition scoping when using React 19 useOptimistic. Prevents phantom UI flashes and stale state overwrites caused by out-of-order promise fulfillment in concurrent microtask queues by binding optimistic updates to deterministic transaction IDs and synchronous action boundaries.","antiPatternHeadline":"Unbounded concurrent useOptimistic mutations yielding race conditions and phantom rollbacks during out-of-order network resolutions","stars_count":114,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","useOptimistic","concurrency","transitions","state-reconciliation"],"exportEndpoints":{"claude":"/api/rules/react19-useoptimistic-concurrent-transition-barrier?format=claude","cursorMdc":"/api/rules/react19-useoptimistic-concurrent-transition-barrier?format=mdc","cursorrules":"/api/rules/react19-useoptimistic-concurrent-transition-barrier?format=cursor","windsurf":"/api/rules/react19-useoptimistic-concurrent-transition-barrier?format=windsurf","agents":"/api/rules/react19-useoptimistic-concurrent-transition-barrier?format=agents"}},{"id":"fastapi-pydanticv2-zerocopy-jit-serialization","title":"FastAPI Pydantic V2 Zero-Copy JIT Deserialization via Rust Core","category":"backend","severity":"critical","description":"Mandates direct HTTP byte-buffer handoff to pydantic-core's Rust validator via validate_json on high-throughput JSON pipelines. Eliminates intermediary Python string and dictionary allocations, bypassing the Global Interpreter Lock (GIL) and mitigating memory fragmentation during burst traffic.","antiPatternHeadline":"Intermediary Python Dict Materialization Under GIL Contention","stars_count":98,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","pydantic-v2","rust","gil-bypass","performance"],"exportEndpoints":{"claude":"/api/rules/fastapi-pydanticv2-zerocopy-jit-serialization?format=claude","cursorMdc":"/api/rules/fastapi-pydanticv2-zerocopy-jit-serialization?format=mdc","cursorrules":"/api/rules/fastapi-pydanticv2-zerocopy-jit-serialization?format=cursor","windsurf":"/api/rules/fastapi-pydanticv2-zerocopy-jit-serialization?format=windsurf","agents":"/api/rules/fastapi-pydanticv2-zerocopy-jit-serialization?format=agents"}},{"id":"go-1-24-swiss-table-map-sizing-guardrail","title":"Go 1.24 Swiss Table Preallocation, Growth Bounds, and Sharded In-Memory Cache Invariant","category":"backend","severity":"critical","description":"Enforces strict initial capacity hinting, control-byte allocation bounds, and entry recycling patterns for Go 1.24's Swiss Table map implementation. Prevents severe tail-latency spikes caused by dynamic SIMD control-group rehashing and excessive GC scan overhead in high-cardinality state caches.","antiPatternHeadline":"Unhinted map instantiation in high-throughput paths triggering Swiss Table SIMD group rehash cascades and GC pauses.","stars_count":65,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","golang","swiss-tables","latency","gc-tuning","performance"],"exportEndpoints":{"claude":"/api/rules/go-1-24-swiss-table-map-sizing-guardrail?format=claude","cursorMdc":"/api/rules/go-1-24-swiss-table-map-sizing-guardrail?format=mdc","cursorrules":"/api/rules/go-1-24-swiss-table-map-sizing-guardrail?format=cursor","windsurf":"/api/rules/go-1-24-swiss-table-map-sizing-guardrail?format=windsurf","agents":"/api/rules/go-1-24-swiss-table-map-sizing-guardrail?format=agents"}},{"id":"kmp-retained-state-lifecycle-restoration-standard","title":"KMP Retained State Lifecycle & Process Restoration Standard","category":"mobile","severity":"critical","description":"Enforces deterministic lifecycle-bound cancellation and serialized state restoration across Kotlin Multiplatform targets. Prevents coroutine execution leaks during iOS UIViewController deallocation and state divergence against Android ViewModel process death restoration.","antiPatternHeadline":"Unbounded CoroutineScope leaks on iOS dealloc combined with un-restored ephemeral state across Android process death.","stars_count":92,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kmp","kotlin-multiplatform","lifecycle","viewmodel","state-restoration"],"exportEndpoints":{"claude":"/api/rules/kmp-retained-state-lifecycle-restoration-standard?format=claude","cursorMdc":"/api/rules/kmp-retained-state-lifecycle-restoration-standard?format=mdc","cursorrules":"/api/rules/kmp-retained-state-lifecycle-restoration-standard?format=cursor","windsurf":"/api/rules/kmp-retained-state-lifecycle-restoration-standard?format=windsurf","agents":"/api/rules/kmp-retained-state-lifecycle-restoration-standard?format=agents"}},{"id":"capacitor-7-background-runner-watchdog-preservation","title":"Capacitor 7 Background Runner Watchdog State Preservation","category":"mobile","severity":"critical","description":"Enforces atomic state snapshots and transactional checkpointing within Capacitor 7 Background Runner isolates before mobile OS memory watchdogs (iOS Jetsam, Android Low Memory Killer) terminate execution. Prevents unrecoverable data loss and inconsistent background processing state during constrained OS background execution windows. Mandates the use of deterministic chunking and synchronous Native KV persistence during task lifecycle intervals.","antiPatternHeadline":"Monolithic In-Memory Batch Processing in Headless Background Runner Tasks","stars_count":99,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["capacitor","background-runner","ios-jetsam","android-lmk","memory-watchdog","atomic-state"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-background-runner-watchdog-preservation?format=claude","cursorMdc":"/api/rules/capacitor-7-background-runner-watchdog-preservation?format=mdc","cursorrules":"/api/rules/capacitor-7-background-runner-watchdog-preservation?format=cursor","windsurf":"/api/rules/capacitor-7-background-runner-watchdog-preservation?format=windsurf","agents":"/api/rules/capacitor-7-background-runner-watchdog-preservation?format=agents"}},{"id":"webauthn-prf-deterministic-key-derivation-standard","title":"WebAuthn PRF Deterministic Zero-Knowledge Symmetric Key Derivation Standard","category":"security","severity":"critical","description":"Enforces strict cryptographic handling when deriving hardware-backed symmetric encryption keys via the WebAuthn Pseudo-Random Function (PRF) extension (hmac-secret). Requires using high-entropy application salts, applying secondary KDFs (HKDF-SHA256) with domain separation contexts, and strictly prohibiting raw PRF output usage, plaintext key persistence, or fallback to software-derived master keys without explicit zero-knowledge degradation handling.","antiPatternHeadline":"Directly Utilizing Raw PRF Output as Symmetric Keys or Storing Hardware-Derived Keys in Unprotected Persistent Browser Storage","stars_count":84,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","prf-extension","cryptography","zero-knowledge","client-side-encryption"],"exportEndpoints":{"claude":"/api/rules/webauthn-prf-deterministic-key-derivation-standard?format=claude","cursorMdc":"/api/rules/webauthn-prf-deterministic-key-derivation-standard?format=mdc","cursorrules":"/api/rules/webauthn-prf-deterministic-key-derivation-standard?format=cursor","windsurf":"/api/rules/webauthn-prf-deterministic-key-derivation-standard?format=windsurf","agents":"/api/rules/webauthn-prf-deterministic-key-derivation-standard?format=agents"}},{"id":"openfga-subgraph-recursive-resolution-budgeting","title":"OpenFGA Sub-Graph Recursive Resolution Budgeting and Memoization Invariant","category":"security","severity":"critical","description":"Enforces deterministic depth horizons, node evaluation budgets, and memoized subproblem evaluation caches across recursive OpenFGA relation checks. Prevents algorithmic authorization denial-of-service (Auth-DoS) and thread pool exhaustion driven by cyclical or deeply nested transitive relationship graphs.","antiPatternHeadline":"Unbounded Recursive Authorization Traversals Lacking Depth Caps and Subproblem Memoization","stars_count":75,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","authorization","zanzibar","dos-prevention","graph-algorithms"],"exportEndpoints":{"claude":"/api/rules/openfga-subgraph-recursive-resolution-budgeting?format=claude","cursorMdc":"/api/rules/openfga-subgraph-recursive-resolution-budgeting?format=mdc","cursorrules":"/api/rules/openfga-subgraph-recursive-resolution-budgeting?format=cursor","windsurf":"/api/rules/openfga-subgraph-recursive-resolution-budgeting?format=windsurf","agents":"/api/rules/openfga-subgraph-recursive-resolution-budgeting?format=agents"}},{"id":"cilium-ebpf-wireguard-dynamic-pmtu-clamping","title":"Cilium eBPF WireGuard Dynamic Path MTU Clamping Standard","category":"devops","severity":"critical","description":"Enforces deterministic TCP MSS clamping and dynamic path MTU auto-detection in Cilium eBPF overlay networks with WireGuard encryption. Eliminates silent TCP session freezes and packet truncation across multi-cloud transit fabrics by accounting for kernel-level encapsulation and cryptographic overhead.","antiPatternHeadline":"Static MTU Defaults and Missing eBPF TCP MSS Clamping in WireGuard Overlay Networks","stars_count":55,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["cilium","ebpf","wireguard","kubernetes","networking","mtu","devops"],"exportEndpoints":{"claude":"/api/rules/cilium-ebpf-wireguard-dynamic-pmtu-clamping?format=claude","cursorMdc":"/api/rules/cilium-ebpf-wireguard-dynamic-pmtu-clamping?format=mdc","cursorrules":"/api/rules/cilium-ebpf-wireguard-dynamic-pmtu-clamping?format=cursor","windsurf":"/api/rules/cilium-ebpf-wireguard-dynamic-pmtu-clamping?format=windsurf","agents":"/api/rules/cilium-ebpf-wireguard-dynamic-pmtu-clamping?format=agents"}},{"id":"opentelemetry-w3c-baggage-perimeter-redaction-guardrail","title":"OpenTelemetry W3C Baggage Perimeter Redaction and Egress Boundary Filtering Guardrail","category":"devops","severity":"critical","description":"Enforces strict perimeter isolation and allowlist-based redaction of W3C Baggage headers on outbound HTTP and gRPC network boundaries. Prevents confidential multi-tenant metadata, internal routing flags, and customer PII stored in ambient OpenTelemetry context from leaking to untrusted external vendors or public APIs.","antiPatternHeadline":"Unconstrained downstream propagation of ambient W3C Baggage containing tenant identifiers and PII across external egress boundaries","stars_count":112,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","observability","security","baggage","data-loss-prevention","pii"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-w3c-baggage-perimeter-redaction-guardrail?format=claude","cursorMdc":"/api/rules/opentelemetry-w3c-baggage-perimeter-redaction-guardrail?format=mdc","cursorrules":"/api/rules/opentelemetry-w3c-baggage-perimeter-redaction-guardrail?format=cursor","windsurf":"/api/rules/opentelemetry-w3c-baggage-perimeter-redaction-guardrail?format=windsurf","agents":"/api/rules/opentelemetry-w3c-baggage-perimeter-redaction-guardrail?format=agents"}},{"id":"openfga-causal-consistency-token-check","title":"OpenFGA 1.8 Causal Consistency Token Protocol for Multi-Region Checks","category":"security","severity":"critical","description":"Enforces read-after-write causal consistency across multi-region OpenFGA/Zanzibar deployments by propagating and evaluating consistency tokens during authorization checks. Prevents authorization bypasses and privilege escalations resulting from stale read replicas evaluating authorization state before tuple writes or revocations replicate globally.","antiPatternHeadline":"Unbounded Eventual Consistency Check Permitting Revoked Access via Stale Replica Evaluation","stars_count":95,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","zanzibar","causal-consistency","authorization","distributed-systems"],"exportEndpoints":{"claude":"/api/rules/openfga-causal-consistency-token-check?format=claude","cursorMdc":"/api/rules/openfga-causal-consistency-token-check?format=mdc","cursorrules":"/api/rules/openfga-causal-consistency-token-check?format=cursor","windsurf":"/api/rules/openfga-causal-consistency-token-check?format=windsurf","agents":"/api/rules/openfga-causal-consistency-token-check?format=agents"}},{"id":"svelte-5-rune-effect-root-lifecycle-boundary","title":"Svelte 5 Rune Effect-Root Boundary Enforcement for Micro-Frontend Lifecycle Management","category":"frontend","severity":"critical","description":"Enforces strict containment of fine-grained reactive dependency graphs within explicit $effect.root scopes when initializing Svelte 5 runic state outside Svelte component tree boundaries. Guarantees deterministic destruction and total garbage collection across dynamic micro-frontend mount and unmount lifecycles.","antiPatternHeadline":"Instantiating ambient rune effects and mount calls without explicit $effect.root teardown handles during micro-frontend interop","stars_count":47,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","effect-root","micro-frontends","memory-management","teardown"],"exportEndpoints":{"claude":"/api/rules/svelte-5-rune-effect-root-lifecycle-boundary?format=claude","cursorMdc":"/api/rules/svelte-5-rune-effect-root-lifecycle-boundary?format=mdc","cursorrules":"/api/rules/svelte-5-rune-effect-root-lifecycle-boundary?format=cursor","windsurf":"/api/rules/svelte-5-rune-effect-root-lifecycle-boundary?format=windsurf","agents":"/api/rules/svelte-5-rune-effect-root-lifecycle-boundary?format=agents"}},{"id":"nextjs-15-ppr-streaming-boundary-quarantine","title":"Next.js 15 PPR Streaming Boundary Quarantine and Dynamic Shell Isolation","category":"frontend","severity":"critical","description":"Next.js 15 Partial Prerendering (PPR) generates a shared static shell at build time while streaming dynamic segments on demand. Dynamic request contexts (cookies, headers, auth tokens) accessed outside explicit React Suspense boundaries trigger static shell de-optimization or risk baking user-specific credential states into statically cached CDN shells. Strict quarantine mandates that all dynamic data access occurs exclusively inside isolated dynamic sub-trees wrapped in suspense boundaries with deterministic static fallbacks.","antiPatternHeadline":"Unquarantined Dynamic Request Access Poisoning Static Shell Prerender Cache","stars_count":64,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs15","ppr","react-streaming","security","suspense"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-ppr-streaming-boundary-quarantine?format=claude","cursorMdc":"/api/rules/nextjs-15-ppr-streaming-boundary-quarantine?format=mdc","cursorrules":"/api/rules/nextjs-15-ppr-streaming-boundary-quarantine?format=cursor","windsurf":"/api/rules/nextjs-15-ppr-streaming-boundary-quarantine?format=windsurf","agents":"/api/rules/nextjs-15-ppr-streaming-boundary-quarantine?format=agents"}},{"id":"tauri2-ipc-granular-capability-scoping","title":"Tauri 2.0 Granular IPC Command Capability Scoping & Shell Sandboxing","category":"security","severity":"critical","description":"Enforces granular, least-privilege capability manifests in Tauri 2.0 to eliminate Remote Code Execution (RCE) vectors from compromised webview contexts. Mandates strict argument validation regexes, explicit window bindings, and forbids ambient or wildcard shell permissions.","antiPatternHeadline":"Wildcard shell permissions and unbounded command execution via Tauri IPC.","stars_count":95,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","tauri","ipc","rust","capabilities","least-privilege"],"exportEndpoints":{"claude":"/api/rules/tauri2-ipc-granular-capability-scoping?format=claude","cursorMdc":"/api/rules/tauri2-ipc-granular-capability-scoping?format=mdc","cursorrules":"/api/rules/tauri2-ipc-granular-capability-scoping?format=cursor","windsurf":"/api/rules/tauri2-ipc-granular-capability-scoping?format=windsurf","agents":"/api/rules/tauri2-ipc-granular-capability-scoping?format=agents"}},{"id":"compose-multiplatform-metal-vulkan-surface-allocation-fence","title":"Compose Multiplatform Metal/Vulkan Surface Allocation Fence Synchronization","category":"mobile","severity":"critical","description":"Prevents GPU VRAM exhaustion, command buffer deadlocks, and layout hitching in Compose Multiplatform by enforcing explicit native surface synchronization fences. Decouples native surface disposal from platform garbage collection cycles across iOS (Metal/CAMetalLayer) and Android (Vulkan/ANativeWindow) through deterministic drain and disposal gates.","antiPatternHeadline":"Relying on Managed Heap Garbage Collection to Deallocate Native Metal and Vulkan Surface Backbuffers","stars_count":74,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","compose-multiplatform","vulkan","metal","graphics","vram"],"exportEndpoints":{"claude":"/api/rules/compose-multiplatform-metal-vulkan-surface-allocation-fence?format=claude","cursorMdc":"/api/rules/compose-multiplatform-metal-vulkan-surface-allocation-fence?format=mdc","cursorrules":"/api/rules/compose-multiplatform-metal-vulkan-surface-allocation-fence?format=cursor","windsurf":"/api/rules/compose-multiplatform-metal-vulkan-surface-allocation-fence?format=windsurf","agents":"/api/rules/compose-multiplatform-metal-vulkan-surface-allocation-fence?format=agents"}},{"id":"fastapi-asgi-structured-concurrency-drain-boundary","title":"FastAPI ASGI Lifespan Structured TaskGroup Drain Boundary","category":"backend","severity":"critical","description":"Enforces deterministic structured concurrency boundaries for asynchronous background work within FastAPI ASGI applications. Guarantees that any spawned background coroutines are tethered to an application-scoped or request-scoped TaskGroup that safely drains within lifespan shutdown before database and network connection pools close during Kubernetes SIGTERM events.","antiPatternHeadline":"Unbounded asyncio.create_task and BackgroundTasks Leaks Causing Database Connection Poisoning During SIGTERM","stars_count":40,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["fastapi","asgi","asyncio","structured-concurrency","kubernetes-sigterm","lifespan","python"],"exportEndpoints":{"claude":"/api/rules/fastapi-asgi-structured-concurrency-drain-boundary?format=claude","cursorMdc":"/api/rules/fastapi-asgi-structured-concurrency-drain-boundary?format=mdc","cursorrules":"/api/rules/fastapi-asgi-structured-concurrency-drain-boundary?format=cursor","windsurf":"/api/rules/fastapi-asgi-structured-concurrency-drain-boundary?format=windsurf","agents":"/api/rules/fastapi-asgi-structured-concurrency-drain-boundary?format=agents"}},{"id":"oauth2-dpop-distributed-nonce-enforcement","title":"OAuth 2.1 RFC 9449 DPoP Single-Use Nonce Cluster Enforcement","category":"security","severity":"critical","description":"Enforces atomic, cluster-wide verification of OAuth 2.1 Demonstrating Proof-of-Possession (DPoP, RFC 9449) proofs and ephemeral nonces across distributed edge proxies. Guarantees linearizable single-use proof validation and access token hash binding to eliminate replay attacks across multi-region ingress points.","antiPatternHeadline":"Process-Local Nonce Validation and Non-Atomic Read-Then-Write Replay Windows Across Edge Nodes","stars_count":112,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","oauth2","dpop","rfc9449","distributed-systems","redis","zero-trust"],"exportEndpoints":{"claude":"/api/rules/oauth2-dpop-distributed-nonce-enforcement?format=claude","cursorMdc":"/api/rules/oauth2-dpop-distributed-nonce-enforcement?format=mdc","cursorrules":"/api/rules/oauth2-dpop-distributed-nonce-enforcement?format=cursor","windsurf":"/api/rules/oauth2-dpop-distributed-nonce-enforcement?format=windsurf","agents":"/api/rules/oauth2-dpop-distributed-nonce-enforcement?format=agents"}},{"id":"opentelemetry-otlp-arrow-ingestion-scaling-standard","title":"OpenTelemetry OTLP/Arrow Columnar Ingestion Pipeline Scaling Standard","category":"devops","severity":"critical","description":"Standardizes the deployment and configuration of OpenTelemetry OTLP over Apache Arrow across gateway and agent tiers to mitigate high-cardinality serialization bottlenecks. Mandates Apache Arrow stream-oriented columnar compression and dictionary encoding to reduce network egress bandwidth and downstream deserialization CPU load by up to 70%. Enforces strict memory limiter controls and fallback semantics to prevent OOM panics in high-throughput service mesh topologies.","antiPatternHeadline":"Uncompressed Row-Oriented Standard OTLP/gRPC Ingestion for High-Cardinality High-Throughput Meshes","stars_count":53,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","apache-arrow","otlp","observability","high-cardinality","collector"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-otlp-arrow-ingestion-scaling-standard?format=claude","cursorMdc":"/api/rules/opentelemetry-otlp-arrow-ingestion-scaling-standard?format=mdc","cursorrules":"/api/rules/opentelemetry-otlp-arrow-ingestion-scaling-standard?format=cursor","windsurf":"/api/rules/opentelemetry-otlp-arrow-ingestion-scaling-standard?format=windsurf","agents":"/api/rules/opentelemetry-otlp-arrow-ingestion-scaling-standard?format=agents"}},{"id":"envoy-wasm-fail-closed-circuit-breaker-production-standard","title":"Envoy Gateway Wasm Filter Fail-Closed Policy & Panic Isolation Invariant","category":"devops","severity":"critical","description":"Enforces strict fail-closed (deny-by-default) semantics on Envoy Gateway dynamic WebAssembly (Wasm) authorization extensions. Mandates explicit filter failure mode configurations and circuit breakers to guarantee zero-trust compliance by preventing unauthenticated traffic bypass when Wasm runtime panics or VM out-of-memory traps occur.","antiPatternHeadline":"Configuring Wasm authorization filters with fail-open policies (fail_open: true or omitted fail-closed directives), permitting unauthorized ingress traffic during runtime VM panics.","stars_count":41,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","envoy-gateway","wasm","zero-trust","circuit-breaker","proxy-wasm"],"exportEndpoints":{"claude":"/api/rules/envoy-wasm-fail-closed-circuit-breaker-production-standard?format=claude","cursorMdc":"/api/rules/envoy-wasm-fail-closed-circuit-breaker-production-standard?format=mdc","cursorrules":"/api/rules/envoy-wasm-fail-closed-circuit-breaker-production-standard?format=cursor","windsurf":"/api/rules/envoy-wasm-fail-closed-circuit-breaker-production-standard?format=windsurf","agents":"/api/rules/envoy-wasm-fail-closed-circuit-breaker-production-standard?format=agents"}},{"id":"react19-rsc-client-boundary-serialization-guardrail","title":"React 19 RSC Flight Boundary Serialization and Closure Sanitization Guardrail","category":"frontend","severity":"critical","description":"Enforces strict serialization boundaries and Data Transfer Object (DTO) projection when passing data across React Server Component (Flight protocol) boundaries to Client Components. Prevents runtime serialization crashes, circular reference locks, prototype pollution, and catastrophic secret or connection pool exfiltration via memory pointers.","antiPatternHeadline":"Passing unmapped ORM entities, sensitive closure states, or non-serializable objects across the RSC-to-Client boundary","stars_count":113,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","rsc","security","serialization","nextjs"],"exportEndpoints":{"claude":"/api/rules/react19-rsc-client-boundary-serialization-guardrail?format=claude","cursorMdc":"/api/rules/react19-rsc-client-boundary-serialization-guardrail?format=mdc","cursorrules":"/api/rules/react19-rsc-client-boundary-serialization-guardrail?format=cursor","windsurf":"/api/rules/react19-rsc-client-boundary-serialization-guardrail?format=windsurf","agents":"/api/rules/react19-rsc-client-boundary-serialization-guardrail?format=agents"}},{"id":"axum-0-8-tokio-task-budget-ingress-backpressure-standard","title":"Axum 0.8 Tokio Co-Op Task Budgeting & Ingress Backpressure Standard","category":"backend","severity":"critical","description":"Enforces strict cooperative task scheduling budgets, non-blocking async runtime boundaries, and bounded ingress backpressure in Axum 0.8 microservices. Eliminates Tokio event-loop starvation and ungraceful connection drops during synchronous request floods through explicit load shedding and cooperative yielding.","antiPatternHeadline":"Unbounded TCP Ingress & Starving Tokio Worker Threads with Unbudgeted CPU Operations","stars_count":90,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tokio","concurrency","performance"],"exportEndpoints":{"claude":"/api/rules/axum-0-8-tokio-task-budget-ingress-backpressure-standard?format=claude","cursorMdc":"/api/rules/axum-0-8-tokio-task-budget-ingress-backpressure-standard?format=mdc","cursorrules":"/api/rules/axum-0-8-tokio-task-budget-ingress-backpressure-standard?format=cursor","windsurf":"/api/rules/axum-0-8-tokio-task-budget-ingress-backpressure-standard?format=windsurf","agents":"/api/rules/axum-0-8-tokio-task-budget-ingress-backpressure-standard?format=agents"}},{"id":"fastapi-anyio4-taskgroup-scope-invariant","title":"FastAPI AnyIO 4 Structured Concurrency TaskGroup Request-Scope Invariant","category":"backend","severity":"critical","description":"Enforces strict structured concurrency in FastAPI request lifecycles using AnyIO 4 TaskGroups. Guarantees that all in-flight asynchronous operations and background tasks initiated within an HTTP request context resolve deterministically within bounded scopes, preventing orphaned worker tasks, database connection exhaustion, and unhandled ExceptionGroups across cancel scopes.","antiPatternHeadline":"Spawning Unstructured Async Tasks via asyncio.create_task or BackgroundTasks Leaking DB Sessions Across Scope Boundaries","stars_count":68,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","anyio","concurrency","python","asyncpg","sqlalchemy"],"exportEndpoints":{"claude":"/api/rules/fastapi-anyio4-taskgroup-scope-invariant?format=claude","cursorMdc":"/api/rules/fastapi-anyio4-taskgroup-scope-invariant?format=mdc","cursorrules":"/api/rules/fastapi-anyio4-taskgroup-scope-invariant?format=cursor","windsurf":"/api/rules/fastapi-anyio4-taskgroup-scope-invariant?format=windsurf","agents":"/api/rules/fastapi-anyio4-taskgroup-scope-invariant?format=agents"}},{"id":"pg17-logical-replication-parallel-apply-quarantine-standard","title":"PostgreSQL 17 Logical Replication Parallel Apply Conflict Quarantine Standard","category":"backend","severity":"critical","description":"Mandates deterministic foreign key dependency sequencing, deferrable constraint enforcement, and automated LSN conflict quarantining when utilizing PostgreSQL 17 parallel apply workers. Prevents replication worker crash loops, cross-worker deadlocks, and ingestion pipeline stalls during high-throughput out-of-order transactional streaming.","antiPatternHeadline":"Configuring parallel apply logical replication over non-deferrable relational hierarchies without automated conflict quarantine","stars_count":97,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql-17","logical-replication","parallel-apply","cdc","database-reliability"],"exportEndpoints":{"claude":"/api/rules/pg17-logical-replication-parallel-apply-quarantine-standard?format=claude","cursorMdc":"/api/rules/pg17-logical-replication-parallel-apply-quarantine-standard?format=mdc","cursorrules":"/api/rules/pg17-logical-replication-parallel-apply-quarantine-standard?format=cursor","windsurf":"/api/rules/pg17-logical-replication-parallel-apply-quarantine-standard?format=windsurf","agents":"/api/rules/pg17-logical-replication-parallel-apply-quarantine-standard?format=agents"}},{"id":"bun-v12-sql-raii-finalizer-standard","title":"Bun 1.2 Native SQL Connection Pool RAII and Finalizer Standard","category":"backend","severity":"critical","description":"Enforces deterministic connection release and explicit lifecycle management on Bun 1.2 native SQL connection pools using the ECMAScript Explicit Resource Management (RAII) protocol. Guarantees that checkout sockets, reserved clients, and multi-statement transactions release pooled file descriptors immediately upon scope exit, preventing kernel socket exhaustion during unhandled rejections or sudden POSIX process termination signals.","antiPatternHeadline":"Unscoped Connection Checkouts and Dangling Leases Inducing File Descriptor Exhaustion Under Event-Loop Interruption","stars_count":77,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","sql","raii","resource-management","connection-pooling"],"exportEndpoints":{"claude":"/api/rules/bun-v12-sql-raii-finalizer-standard?format=claude","cursorMdc":"/api/rules/bun-v12-sql-raii-finalizer-standard?format=mdc","cursorrules":"/api/rules/bun-v12-sql-raii-finalizer-standard?format=cursor","windsurf":"/api/rules/bun-v12-sql-raii-finalizer-standard?format=windsurf","agents":"/api/rules/bun-v12-sql-raii-finalizer-standard?format=agents"}},{"id":"capacitor-7-background-runner-budget-standard","title":"Capacitor 7 Native Background Runner Execution Budget Standard","category":"mobile","severity":"critical","description":"Enforces strict OS battery, thermal state, and wall-clock execution quotas on Capacitor 7 Native Background Runner routines. Prevents unnotified mobile OS process termination (iOS 0x8badf00d watchdog kills and Android WorkManager battery-saver evictions) via pre-flight hardware checks, bounded AbortSignal timeouts, and idempotent state checkpointing.","antiPatternHeadline":"Unbounded Background Runner Dispatches Lacking Battery, Thermal, and Execution Watchdog Guardrails","stars_count":85,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","background-runner","ios","android","battery-optimization","thermal-guardrails"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-background-runner-budget-standard?format=claude","cursorMdc":"/api/rules/capacitor-7-background-runner-budget-standard?format=mdc","cursorrules":"/api/rules/capacitor-7-background-runner-budget-standard?format=cursor","windsurf":"/api/rules/capacitor-7-background-runner-budget-standard?format=windsurf","agents":"/api/rules/capacitor-7-background-runner-budget-standard?format=agents"}},{"id":"webauthn-prf-zk-key-derivation-guardrail-webauthn-prf-ext-843","title":"WebAuthn PRF Extension Zero-Knowledge Key Derivation Standard","category":"security","severity":"critical","description":"Enforces strict cryptographic invariants for authenticating with the WebAuthn Pseudo-Random Function (PRF) extension (HMAC-secret). Guarantees that symmetric encryption keys are derived from hardware-isolated authenticator secrets combined with client-side HKDF, preventing plaintext application master keys or credential passphrases from ever touching host memory or network transit.","antiPatternHeadline":"Deriving client encryption keys from user passphrases in memory or transmitting raw PRF outputs over the wire","stars_count":65,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","prf-extension","zero-knowledge","cryptography","webcrypto"],"exportEndpoints":{"claude":"/api/rules/webauthn-prf-zk-key-derivation-guardrail-webauthn-prf-ext-843?format=claude","cursorMdc":"/api/rules/webauthn-prf-zk-key-derivation-guardrail-webauthn-prf-ext-843?format=mdc","cursorrules":"/api/rules/webauthn-prf-zk-key-derivation-guardrail-webauthn-prf-ext-843?format=cursor","windsurf":"/api/rules/webauthn-prf-zk-key-derivation-guardrail-webauthn-prf-ext-843?format=windsurf","agents":"/api/rules/webauthn-prf-zk-key-derivation-guardrail-webauthn-prf-ext-843?format=agents"}},{"id":"otel-w3c-baggage-tenant-quarantine-standard","title":"OpenTelemetry W3C Baggage Multi-Tenant Boundary Quarantine Guardrail","category":"devops","severity":"critical","description":"Incoming W3C Baggage headers at ingress boundaries must never be propagated downstream without strict sanitization, authentication-driven claim verification, and tenant quarantine. Propagating raw, unauthenticated tenant context allows untrusted actors to forge tenant boundaries, poison telemetry datasets, and induce multi-tenant data bleed in downstream services.","antiPatternHeadline":"Direct Ingress Extraction and Unsanitized Forwarding of W3C Baggage Headers","stars_count":101,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","observability","distributed-tracing","multi-tenancy","security"],"exportEndpoints":{"claude":"/api/rules/otel-w3c-baggage-tenant-quarantine-standard?format=claude","cursorMdc":"/api/rules/otel-w3c-baggage-tenant-quarantine-standard?format=mdc","cursorrules":"/api/rules/otel-w3c-baggage-tenant-quarantine-standard?format=cursor","windsurf":"/api/rules/otel-w3c-baggage-tenant-quarantine-standard?format=windsurf","agents":"/api/rules/otel-w3c-baggage-tenant-quarantine-standard?format=agents"}},{"id":"ebpf-co-re-tracepoint-stack-bounds-safety","title":"eBPF CO-RE Tracepoint Stack Bounds Memory Safety Invariant","category":"devops","severity":"critical","description":"Enforces deterministic 512-byte stack bounds and pointer read safety for eBPF tracepoints compiled with Compile Once – Run Everywhere (CO-RE). Prevents BPF verifier rejections caused by register spill saturation, unbound memory reads, and BTF relocations across heterogeneous Linux kernel updates. Guarantees safe memory dereferences via BPF per-CPU scratchpad maps or targeted helper reads rather than deep stack allocations.","antiPatternHeadline":"Unbounded Stack Allocation and Direct Dereferencing of Kernel Tracepoint Structs Triggering Verifier Invalidation Across Kernels","stars_count":103,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","co-re","bpf-verifier","linux-kernel","observability","systems-programming"],"exportEndpoints":{"claude":"/api/rules/ebpf-co-re-tracepoint-stack-bounds-safety?format=claude","cursorMdc":"/api/rules/ebpf-co-re-tracepoint-stack-bounds-safety?format=mdc","cursorrules":"/api/rules/ebpf-co-re-tracepoint-stack-bounds-safety?format=cursor","windsurf":"/api/rules/ebpf-co-re-tracepoint-stack-bounds-safety?format=windsurf","agents":"/api/rules/ebpf-co-re-tracepoint-stack-bounds-safety?format=agents"}},{"id":"vite6-environment-api-boundary-isolation-vite-6-environme-747","title":"Vite 6 Environment API Cross-Runtime Boundary Isolation","category":"frontend","severity":"critical","description":"Enforces strict boundary isolation, module graph partitioning, and target-specific resolution conditions using the Vite 6 Environment API. Prevents silent runtime pollution such as Node.js built-ins leaking into workerd/Cloudflare Workers and synthetic server polyfills inflating browser client bundles.","antiPatternHeadline":"Ambient Node Builtin Leakage and Monolithic SSR Target Conflation in Vite Heterogeneous Builds","stars_count":63,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","vite6","environment-api","ssr","workerd","isomorphic"],"exportEndpoints":{"claude":"/api/rules/vite6-environment-api-boundary-isolation-vite-6-environme-747?format=claude","cursorMdc":"/api/rules/vite6-environment-api-boundary-isolation-vite-6-environme-747?format=mdc","cursorrules":"/api/rules/vite6-environment-api-boundary-isolation-vite-6-environme-747?format=cursor","windsurf":"/api/rules/vite6-environment-api-boundary-isolation-vite-6-environme-747?format=windsurf","agents":"/api/rules/vite6-environment-api-boundary-isolation-vite-6-environme-747?format=agents"}},{"id":"capacitor-7-swift-6-concurrency-bridge-contract","title":"Capacitor 7 Swift 6 Complete Concurrency & Sendable Boundary Contract","category":"mobile","severity":"critical","description":"Enforces strict Swift 6 actor isolation and Sendable boundary guarantees across Capacitor 7 native iOS bridges. Prevents low-level data races and memory corruption caused by cross-isolation mutations between WebKit message handlers, background worker tasks, and the main UI runloop.","antiPatternHeadline":"Unchecked Cross-Actor Mutability and Non-Sendable CAPPluginCall Passing in Capacitor iOS Plugins","stars_count":103,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","swift6","concurrency","sendable","ios","actors"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-swift-6-concurrency-bridge-contract?format=claude","cursorMdc":"/api/rules/capacitor-7-swift-6-concurrency-bridge-contract?format=mdc","cursorrules":"/api/rules/capacitor-7-swift-6-concurrency-bridge-contract?format=cursor","windsurf":"/api/rules/capacitor-7-swift-6-concurrency-bridge-contract?format=windsurf","agents":"/api/rules/capacitor-7-swift-6-concurrency-bridge-contract?format=agents"}},{"id":"oauth2-dpop-rfc9449-secure-enclave-binding","title":"OAuth 2.0 DPoP (RFC 9449) Secure Enclave Cryptographic Binding Standard","category":"security","severity":"critical","description":"Enforces sender-constrained token architecture using RFC 9449 Demonstrating Proof-of-Possession (DPoP) bound to hardware-isolated, non-exportable cryptographic keypairs. Eliminates token exfiltration and replay vectors across edge API egress by requiring per-request signed proofs containing method, normalized URI, access token thumbprint, and unique nonces. Prohibits plain Bearer token headers and exportable private key storage in client-side heaps or persistent stores.","antiPatternHeadline":"Exportable Key Storage and Unbound Bearer Token Egress Allowing Stolen Token Replay Attacks","stars_count":80,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","oauth2","dpop","rfc9449","cryptography","webcrypto","secure-enclave","zero-trust"],"exportEndpoints":{"claude":"/api/rules/oauth2-dpop-rfc9449-secure-enclave-binding?format=claude","cursorMdc":"/api/rules/oauth2-dpop-rfc9449-secure-enclave-binding?format=mdc","cursorrules":"/api/rules/oauth2-dpop-rfc9449-secure-enclave-binding?format=cursor","windsurf":"/api/rules/oauth2-dpop-rfc9449-secure-enclave-binding?format=windsurf","agents":"/api/rules/oauth2-dpop-rfc9449-secure-enclave-binding?format=agents"}},{"id":"k8s-132-dra-device-partitioning-invariant","title":"Kubernetes 1.32 DRA Structured Device Partitioning and Tenant Isolation","category":"devops","severity":"critical","description":"Enforces deterministic, conflict-free scheduling and strict hardware slice isolation for heterogeneous GPU and NPU inference workloads using Kubernetes 1.32 Dynamic Resource Allocation (DRA) with resource.k8s.io/v1beta1. Prevents co-location deadlocks and multi-tenant memory leakage by mandating structured parameter selectors, explicit partitioning attributes, and disallowing legacy Opaque Integer Resource limits alongside DRA claims.","antiPatternHeadline":"Mixing legacy resource limits with DRA claims and omitting CEL device partition constraints","stars_count":86,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","kubernetes","dra","gpu","npu","multi-tenancy","k8s-1-32"],"exportEndpoints":{"claude":"/api/rules/k8s-132-dra-device-partitioning-invariant?format=claude","cursorMdc":"/api/rules/k8s-132-dra-device-partitioning-invariant?format=mdc","cursorrules":"/api/rules/k8s-132-dra-device-partitioning-invariant?format=cursor","windsurf":"/api/rules/k8s-132-dra-device-partitioning-invariant?format=windsurf","agents":"/api/rules/k8s-132-dra-device-partitioning-invariant?format=agents"}},{"id":"react-19-compiler-purity-auto-memoization-hygiene","title":"React 19 Compiler Auto-Memoization Purity and Side-Effect Hygiene Standard","category":"frontend","severity":"critical","description":"Enforces strict functional purity and idempotent render-phase execution required by the React 19 Compiler (React Forget). Prevents compiler memoization bailouts, cache invalidation storms, and unstable reference identity shifts caused by impure reads, mutable ref access during render, and in-place object mutations.","antiPatternHeadline":"Render-Phase Mutation and Volatile Reference Reads Invalidating React 19 Compiler Memoization Blocks","stars_count":99,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","react-compiler","memoization","performance"],"exportEndpoints":{"claude":"/api/rules/react-19-compiler-purity-auto-memoization-hygiene?format=claude","cursorMdc":"/api/rules/react-19-compiler-purity-auto-memoization-hygiene?format=mdc","cursorrules":"/api/rules/react-19-compiler-purity-auto-memoization-hygiene?format=cursor","windsurf":"/api/rules/react-19-compiler-purity-auto-memoization-hygiene?format=windsurf","agents":"/api/rules/react-19-compiler-purity-auto-memoization-hygiene?format=agents"}},{"id":"go-swiss-table-map-concurrency-safety","title":"Go 1.24 Swiss Table Map Memory Access and Resizing Isolation Guardrail","category":"backend","severity":"critical","description":"Go 1.24 refactors the internal runtime map implementation to high-performance Swiss Tables, fundamentally altering slot allocation, control-byte probing, and group-level resizing mechanics. Concurrently accessing or unsafely swapping shared map state during group migration triggers catastrophic runtime panics or silent pointer corruption. All high-throughput read-heavy shared map instances MUST be fenced behind cacheline-padded atomic pointers utilizing immutable Copy-on-Write (COW) semantics.","antiPatternHeadline":"Unfenced Shared Map In-Place Resizing and False-Sharing Inducing Pointer Swaps","stars_count":109,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["go","concurrency","swiss-tables","atomic-pointer","cacheline-alignment","memory-safety"],"exportEndpoints":{"claude":"/api/rules/go-swiss-table-map-concurrency-safety?format=claude","cursorMdc":"/api/rules/go-swiss-table-map-concurrency-safety?format=mdc","cursorrules":"/api/rules/go-swiss-table-map-concurrency-safety?format=cursor","windsurf":"/api/rules/go-swiss-table-map-concurrency-safety?format=windsurf","agents":"/api/rules/go-swiss-table-map-concurrency-safety?format=agents"}},{"id":"slsa-l3-ephemeral-provenance-attestation-standard","title":"SLSA Level 3 Ephemeral Build Provenance and Keyless Cosign Attestation Guardrail","category":"security","severity":"critical","description":"Enforces complete software supply-chain integrity by mandating immutable digest resolution, keyless Cosign cryptographic verification, and SLSA Level 3 provenance validation before any container or artifact is admitted to runtime environments. It strictly eliminates static long-lived private keys in favor of ephemeral Fulcio OIDC identity tokens anchored to Rekor transparency logs and isolated build runners.","antiPatternHeadline":"Trusting Mutable Image Tags or Long-Lived Static Signing Keys Without Rekor Inclusion Proofs and SLSA Provenance Verification","stars_count":41,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","slsa-level-3","cosign","sigstore","supply-chain","admission-controller","provenance"],"exportEndpoints":{"claude":"/api/rules/slsa-l3-ephemeral-provenance-attestation-standard?format=claude","cursorMdc":"/api/rules/slsa-l3-ephemeral-provenance-attestation-standard?format=mdc","cursorrules":"/api/rules/slsa-l3-ephemeral-provenance-attestation-standard?format=cursor","windsurf":"/api/rules/slsa-l3-ephemeral-provenance-attestation-standard?format=windsurf","agents":"/api/rules/slsa-l3-ephemeral-provenance-attestation-standard?format=agents"}},{"id":"adpf-thermal-workload-governor-standard","title":"Android 15 ADPF Thermal Headroom and Workload Governor Protocol","category":"mobile","severity":"critical","description":"Enforces proactive hardware thermal throttling mitigation using Android 15 ADPF APIs (PerformanceHintManager and PowerManager thermal headroom callbacks). Guarantees that render loops dynamically scale graphics fidelity, frame pacing, and worker thread affinities before the OS triggers severe DVFS downclocking or dropped frames.","antiPatternHeadline":"Reactive Thermal Handling via OnThermalStatusChanged or Polling Without Target Duration Feedback","stars_count":41,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","android","adpf","performance","ndk","thermal","vulkan"],"exportEndpoints":{"claude":"/api/rules/adpf-thermal-workload-governor-standard?format=claude","cursorMdc":"/api/rules/adpf-thermal-workload-governor-standard?format=mdc","cursorrules":"/api/rules/adpf-thermal-workload-governor-standard?format=cursor","windsurf":"/api/rules/adpf-thermal-workload-governor-standard?format=windsurf","agents":"/api/rules/adpf-thermal-workload-governor-standard?format=agents"}},{"id":"bun-sqlite-wal-mmap-boundary-guardrail","title":"Bun 1.2 Multi-Threaded SQLite WAL Memory-Mapped Region Boundary Guardrail","category":"backend","severity":"critical","description":"Protects Bun 1.2 multi-threaded SQLite deployments from SIGBUS kernel aborts and WAL shared memory (-shm) corruption during concurrent write bursts. Enforces isolated single-writer coordination, explicit busy timeout locks, disabled auto-checkpointing during worker operations, and synchronized memory-mapped region access.","antiPatternHeadline":"Uncoordinated Parallel Writes and Automatic WAL Checkpoints Across Multi-Threaded Bun Workers Triggering SIGBUS and WAL Index Corruption","stars_count":115,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","sqlite","wal","mmap","multithreading","concurrency"],"exportEndpoints":{"claude":"/api/rules/bun-sqlite-wal-mmap-boundary-guardrail?format=claude","cursorMdc":"/api/rules/bun-sqlite-wal-mmap-boundary-guardrail?format=mdc","cursorrules":"/api/rules/bun-sqlite-wal-mmap-boundary-guardrail?format=cursor","windsurf":"/api/rules/bun-sqlite-wal-mmap-boundary-guardrail?format=windsurf","agents":"/api/rules/bun-sqlite-wal-mmap-boundary-guardrail?format=agents"}},{"id":"react-19-use-action-state-optimistic-rollback-isolation-react-19-useacti-554","title":"React 19 useActionState and useOptimistic Transactional Rollback Boundary Isolation","category":"frontend","severity":"critical","description":"Enforces strict isolation boundaries when coordinating React 19 useActionState with useOptimistic across concurrent mutations. Guarantees that asynchronous server action failures revert local speculative state without leaking invalid, uncommitted optimistic states into adjacent sibling trees, global caches, or shared Context providers.","antiPatternHeadline":"Global Context Optimistic Contamination and Cross-Tree Dirty State Leakage on Server Mutation Rejection","stars_count":107,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","useActionState","useOptimistic","concurrency","transactions"],"exportEndpoints":{"claude":"/api/rules/react-19-use-action-state-optimistic-rollback-isolation-react-19-useacti-554?format=claude","cursorMdc":"/api/rules/react-19-use-action-state-optimistic-rollback-isolation-react-19-useacti-554?format=mdc","cursorrules":"/api/rules/react-19-use-action-state-optimistic-rollback-isolation-react-19-useacti-554?format=cursor","windsurf":"/api/rules/react-19-use-action-state-optimistic-rollback-isolation-react-19-useacti-554?format=windsurf","agents":"/api/rules/react-19-use-action-state-optimistic-rollback-isolation-react-19-useacti-554?format=agents"}},{"id":"pgvector-hnsw-memory-ceiling-guardrail","title":"Postgres 17 pgvector HNSW Graph Memory-Ceiling Invariants","category":"backend","severity":"critical","description":"Enforces deterministic bounded memory allocations during HNSW index construction and query-time iterative graph traversals on PostgreSQL 17. Guarantees that concurrent streaming ingestion pipelines configure maintenance_work_mem and hnsw.ef_search within explicit session-isolated bounds to prevent uncoordinated kernel OOM killer events on database primaries.","antiPatternHeadline":"Global Unbounded HNSW Index Creation and Iterative Traversals During Streaming Ingestion","stars_count":118,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["postgres","pgvector","hnsw","database","vector-search","performance"],"exportEndpoints":{"claude":"/api/rules/pgvector-hnsw-memory-ceiling-guardrail?format=claude","cursorMdc":"/api/rules/pgvector-hnsw-memory-ceiling-guardrail?format=mdc","cursorrules":"/api/rules/pgvector-hnsw-memory-ceiling-guardrail?format=cursor","windsurf":"/api/rules/pgvector-hnsw-memory-ceiling-guardrail?format=windsurf","agents":"/api/rules/pgvector-hnsw-memory-ceiling-guardrail?format=agents"}},{"id":"cmp-18-retained-state-lifecycle-isolation","title":"Compose Multiplatform 1.8 Retained State Lifecycle Isolation Across iOS/Android Boundaries","category":"mobile","severity":"critical","description":"Enforces deterministic lifecycle bounds and memory isolation for retained ViewModels and coroutine scopes in Compose Multiplatform 1.8. Prevents native iOS UIViewController deallocation leaks and Android backstack desynchronization caused by unmanaged multiplatform state holders.","antiPatternHeadline":"Global Retained State Capturing Native Lifecycle Roots Causing iOS UIViewController Memory Leaks","stars_count":101,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","compose-multiplatform","kotlin","lifecycle","memory-leaks","ios-interop"],"exportEndpoints":{"claude":"/api/rules/cmp-18-retained-state-lifecycle-isolation?format=claude","cursorMdc":"/api/rules/cmp-18-retained-state-lifecycle-isolation?format=mdc","cursorrules":"/api/rules/cmp-18-retained-state-lifecycle-isolation?format=cursor","windsurf":"/api/rules/cmp-18-retained-state-lifecycle-isolation?format=windsurf","agents":"/api/rules/cmp-18-retained-state-lifecycle-isolation?format=agents"}},{"id":"wasi-02-wit-capability-sandboxing","title":"WASI 0.2 Component Model Strict WIT Capability Sandboxing & Host Isolation","category":"devops","severity":"critical","description":"Enforces strict capability-based isolation for multi-tenant WASI 0.2 (Preview 2) components using fine-grained WebAssembly Interface Types (WIT). Prohibits ambient authority leaks, unrestricted host filesystem/network inheritance, and un-metered linear memory execution in untrusted guest runtimes.","antiPatternHeadline":"Ambient System Inheritance and Unmetered Core Store Configuration in WASI 0.2 Hosts","stars_count":84,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","wasm","wasi","component-model","wit","security","sandboxing"],"exportEndpoints":{"claude":"/api/rules/wasi-02-wit-capability-sandboxing?format=claude","cursorMdc":"/api/rules/wasi-02-wit-capability-sandboxing?format=mdc","cursorrules":"/api/rules/wasi-02-wit-capability-sandboxing?format=cursor","windsurf":"/api/rules/wasi-02-wit-capability-sandboxing?format=windsurf","agents":"/api/rules/wasi-02-wit-capability-sandboxing?format=agents"}},{"id":"fastapi-anyio-structured-concurrency-boundary","title":"FastAPI AnyIO Structured Concurrency and Task-Group Boundary Enforcement","category":"backend","severity":"critical","description":"Enforces strict AnyIO task group boundaries across all parallel async I/O worker pipelines in FastAPI applications. Mandates deterministic task cancellation, prevents unmonitored background tasks that leak connection pool slots, and requires bidirectional exception-group unwrapping using Python 3.11+ ExceptionGroup or anyio.create_task_group.","antiPatternHeadline":"Unstructured asyncio.create_task / asyncio.gather in FastAPI causing orphaned coroutines and connection pool starvation on client disconnects or worker exceptions","stars_count":112,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","anyio","asyncio","structured-concurrency","python"],"exportEndpoints":{"claude":"/api/rules/fastapi-anyio-structured-concurrency-boundary?format=claude","cursorMdc":"/api/rules/fastapi-anyio-structured-concurrency-boundary?format=mdc","cursorrules":"/api/rules/fastapi-anyio-structured-concurrency-boundary?format=cursor","windsurf":"/api/rules/fastapi-anyio-structured-concurrency-boundary?format=windsurf","agents":"/api/rules/fastapi-anyio-structured-concurrency-boundary?format=agents"}},{"id":"cilium-tetragon-namespace-escape-enforcement","title":"Cilium Tetragon eBPF Process Namespace Boundary Enforcement","category":"security","severity":"critical","description":"Enforces synchronous kernel-level process termination using Cilium Tetragon TracingPolicies whenever unauthorized namespace transitions (setns, unshare) occur from within containerized workloads. By attaching BPF kprobe and tracepoint hooks with Sigkill action flags, policy enforcement precedes host context switching, preventing container escapes before payloads can execute.","antiPatternHeadline":"Relying on Post-Execution Audit Logs or Asynchronous Userspace Scanners to Detect Container Escape Attempts","stars_count":70,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","ebpf","tetragon","cilium","kubernetes","kernel-security"],"exportEndpoints":{"claude":"/api/rules/cilium-tetragon-namespace-escape-enforcement?format=claude","cursorMdc":"/api/rules/cilium-tetragon-namespace-escape-enforcement?format=mdc","cursorrules":"/api/rules/cilium-tetragon-namespace-escape-enforcement?format=cursor","windsurf":"/api/rules/cilium-tetragon-namespace-escape-enforcement?format=windsurf","agents":"/api/rules/cilium-tetragon-namespace-escape-enforcement?format=agents"}},{"id":"openfga-speculative-graph-traversal-budgeting-standard","title":"OpenFGA Speculative Graph Traversal Budgeting and Cycle Detection Standard","category":"security","severity":"critical","description":"Enforces deterministic execution budgets, explicit graph traversal depth ceilings, and loop detection on relationship-based access control (ReBAC) evaluations. Prevents algorithmic denial-of-service (DoS) and unbounded resource exhaustion during recursive user-to-object tuple expansions in OpenFGA authorization pipelines.","antiPatternHeadline":"Unbounded recursive tuple resolution and unmetered speculative graph expansion causing engine thread starvation","stars_count":116,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","rebac","authorization","denial-of-service","graph-traversal"],"exportEndpoints":{"claude":"/api/rules/openfga-speculative-graph-traversal-budgeting-standard?format=claude","cursorMdc":"/api/rules/openfga-speculative-graph-traversal-budgeting-standard?format=mdc","cursorrules":"/api/rules/openfga-speculative-graph-traversal-budgeting-standard?format=cursor","windsurf":"/api/rules/openfga-speculative-graph-traversal-budgeting-standard?format=windsurf","agents":"/api/rules/openfga-speculative-graph-traversal-budgeting-standard?format=agents"}},{"id":"sharedarraybuffer-atomics-worker-render-pipeline-standard","title":"SharedArrayBuffer, Atomics, and Zero-Allocation Worker Pipeline Standard","category":"frontend","severity":"critical","description":"Enforces lock-free ring buffers, explicit atomic memory fences, and zero-allocation frame loops across Web Workers feeding OffscreenCanvas rendering contexts. Guarantees memory barrier ordering and eliminates CPU-saturating spin-locks, torn reads, and garbage collection pauses across cross-thread shared memory boundaries.","antiPatternHeadline":"Spin-Locking Shared Buffers and Unsynchronized TypedArray Reads Causing Torn Frames and GC Stutters","stars_count":70,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","web-workers","sharedarraybuffer","atomics","offscreencanvas","lock-free","performance"],"exportEndpoints":{"claude":"/api/rules/sharedarraybuffer-atomics-worker-render-pipeline-standard?format=claude","cursorMdc":"/api/rules/sharedarraybuffer-atomics-worker-render-pipeline-standard?format=mdc","cursorrules":"/api/rules/sharedarraybuffer-atomics-worker-render-pipeline-standard?format=cursor","windsurf":"/api/rules/sharedarraybuffer-atomics-worker-render-pipeline-standard?format=windsurf","agents":"/api/rules/sharedarraybuffer-atomics-worker-render-pipeline-standard?format=agents"}},{"id":"kmp-swift-export-memory-pinning-guardrail","title":"KMP Swift-Export Binary ABI Memory-Pinning and Lifecycle Synchronization","category":"mobile","severity":"critical","description":"Enforces strict memory-pinning invariants and lifecycle reference consistency across the Kotlin/Native and Swift Binary ABI boundary. Guarantees that asynchronous Swift ARC invocations and Kotlin Native GC cycles do not produce dangling pointers, premature deallocations, or heap corruption during interop bridge operations.","antiPatternHeadline":"Dangling Pointer De-synchronization via Unpinned Raw Pointers or Unmanaged Swift-Export Interop Transfers","stars_count":80,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kmp","kotlin-native","swift-export","memory-management","arc-gc-bridge","abi-stability"],"exportEndpoints":{"claude":"/api/rules/kmp-swift-export-memory-pinning-guardrail?format=claude","cursorMdc":"/api/rules/kmp-swift-export-memory-pinning-guardrail?format=mdc","cursorrules":"/api/rules/kmp-swift-export-memory-pinning-guardrail?format=cursor","windsurf":"/api/rules/kmp-swift-export-memory-pinning-guardrail?format=windsurf","agents":"/api/rules/kmp-swift-export-memory-pinning-guardrail?format=agents"}},{"id":"fastapi-pydantic-v2-zero-copy-streaming","title":"FastAPI & Pydantic v2 Zero-Copy Streaming Response Pipeline","category":"backend","severity":"critical","description":"Enforces generator-driven raw byte and buffer streaming for high-throughput LLM token delivery in FastAPI and Pydantic v2. Prevents event loop starvation and high-frequency GC heap churn by forbidding intermediate Pydantic model instantiation, redundant JSON parsing, and unbuffered string concats inside hot stream iteration loops.","antiPatternHeadline":"Hydrating and Reserializing Intermediate Pydantic Models Inside SSE/NDJSON Streaming Loops","stars_count":92,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","pydantic-v2","asyncio","streaming","llm","zero-copy"],"exportEndpoints":{"claude":"/api/rules/fastapi-pydantic-v2-zero-copy-streaming?format=claude","cursorMdc":"/api/rules/fastapi-pydantic-v2-zero-copy-streaming?format=mdc","cursorrules":"/api/rules/fastapi-pydantic-v2-zero-copy-streaming?format=cursor","windsurf":"/api/rules/fastapi-pydantic-v2-zero-copy-streaming?format=windsurf","agents":"/api/rules/fastapi-pydantic-v2-zero-copy-streaming?format=agents"}},{"id":"axum-h3-quic-graceful-draining-invariant","title":"Axum 0.8 HTTP/3 QUIC Graceful Connection Draining Invariant","category":"backend","severity":"critical","description":"Enforces structured bidirectional QUIC stream retirement and RFC 9114 HTTP/3 GOAWAY mechanics during server teardown in Axum 0.8 environments. Guarantees zero-downtime canary transitions by preventing abrupt QUIC stream resets (RESET_STREAM or sudden CONNECTION_CLOSE) through phased stream count signaling and Tokio cancellation-safe connection draining.","antiPatternHeadline":"Immediate Tokio Runtime Dropping and Uncoordinated QUIC Connection Teardown on SIGTERM","stars_count":55,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","http3","quic","tokio","concurrency"],"exportEndpoints":{"claude":"/api/rules/axum-h3-quic-graceful-draining-invariant?format=claude","cursorMdc":"/api/rules/axum-h3-quic-graceful-draining-invariant?format=mdc","cursorrules":"/api/rules/axum-h3-quic-graceful-draining-invariant?format=cursor","windsurf":"/api/rules/axum-h3-quic-graceful-draining-invariant?format=windsurf","agents":"/api/rules/axum-h3-quic-graceful-draining-invariant?format=agents"}},{"id":"capacitor-7-android15-predictive-back-persistence","title":"Capacitor 7 Predictive Back Atomic State Snapshot Invariant","category":"mobile","severity":"critical","description":"Android 15 predictive back animations introduce progressive swipe lifecycles that can be cancelled mid-gesture. SPA web applications running inside Capacitor 7 WebViews must implement atomic DOM state snapshotting and deferred router state transitions to prevent premature component unmounting, layout corruption, and desynchronization between native window stacks and client-side routers.","antiPatternHeadline":"Mutating SPA routing and DOM tree state eagerly upon native back signal detection without gesture commitment confirmation","stars_count":94,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor-7","android-15","predictive-back","webview-state","spa-routing"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-android15-predictive-back-persistence?format=claude","cursorMdc":"/api/rules/capacitor-7-android15-predictive-back-persistence?format=mdc","cursorrules":"/api/rules/capacitor-7-android15-predictive-back-persistence?format=cursor","windsurf":"/api/rules/capacitor-7-android15-predictive-back-persistence?format=windsurf","agents":"/api/rules/capacitor-7-android15-predictive-back-persistence?format=agents"}},{"id":"fido-mds3-passkey-hardware-root-attestation-standard","title":"FIDO Alliance MDS3 Hardware Root of Trust Attestation Verification Standard","category":"security","severity":"critical","description":"Enforces cryptographic hardware-backed attestation verification for passkeys against dynamically synchronized FIDO Metadata Service 3 (MDS3) endpoints. Rejects software-emulated credential injection, unverified authenticator AAGUID claims, and authenticators with compromised status reports. Mandates local MDS3 JWT blob validation with FIDO Root CA chain verification, CRL checks, and strict attestation certificate path matching.","antiPatternHeadline":"Accepting Self-Asserted or Unchecked AAGUIDs Without Cryptographic MDS3 Hardware Attestation Verification","stars_count":87,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","fido2","webauthn","passkeys","mds3","attestation","cryptography"],"exportEndpoints":{"claude":"/api/rules/fido-mds3-passkey-hardware-root-attestation-standard?format=claude","cursorMdc":"/api/rules/fido-mds3-passkey-hardware-root-attestation-standard?format=mdc","cursorrules":"/api/rules/fido-mds3-passkey-hardware-root-attestation-standard?format=cursor","windsurf":"/api/rules/fido-mds3-passkey-hardware-root-attestation-standard?format=windsurf","agents":"/api/rules/fido-mds3-passkey-hardware-root-attestation-standard?format=agents"}},{"id":"k8s-gateway-api-reference-grant-cross-namespace-invariant-kubernetes-gatew-456","title":"Kubernetes Gateway API v1.2 ReferenceGrant Cross-Namespace Invariant","category":"devops","severity":"critical","description":"Enforces strict cross-namespace isolation in Kubernetes Gateway API v1.2 by requiring explicit ReferenceGrant resources for all cross-namespace Gateway-to-Route and Route-to-Service attachments. Prevents multi-tenant route hijacking and unauthorized internal cluster service discovery by treating absent ReferenceGrants as deterministic control plane binding failures. Mandates that namespace owners explicitly acknowledge and grant unidirectional downstream routing permissions before any cross-boundary traffic is accepted.","antiPatternHeadline":"Implicit Cross-Namespace Route Hijacking and Permissive Gateway References without ReferenceGrant Validation","stars_count":46,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","kubernetes","gateway-api","networking","multi-tenancy","security"],"exportEndpoints":{"claude":"/api/rules/k8s-gateway-api-reference-grant-cross-namespace-invariant-kubernetes-gatew-456?format=claude","cursorMdc":"/api/rules/k8s-gateway-api-reference-grant-cross-namespace-invariant-kubernetes-gatew-456?format=mdc","cursorrules":"/api/rules/k8s-gateway-api-reference-grant-cross-namespace-invariant-kubernetes-gatew-456?format=cursor","windsurf":"/api/rules/k8s-gateway-api-reference-grant-cross-namespace-invariant-kubernetes-gatew-456?format=windsurf","agents":"/api/rules/k8s-gateway-api-reference-grant-cross-namespace-invariant-kubernetes-gatew-456?format=agents"}},{"id":"otel-bounded-exemplar-trace-correlation","title":"OpenTelemetry Bounded Exemplar Trace-Metric Correlation Standard","category":"devops","severity":"critical","description":"Enforces strict memory-bounded sampling and rate-limiting on OpenTelemetry metric exemplars attached to high-cardinality latency measurements. Prevents telemetry collector and pipeline ingestion nodes from encountering Out-Of-Memory (OOM) crashes by restricting exemplar allocation to fixed-size reservoir samplers and filtering out non-sampled or sub-p99 traces.","antiPatternHeadline":"Attaching Unfiltered Trace Contexts to Metrics via Unbounded Exemplar Reservoirs","stars_count":52,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","observability","metrics","tracing","memory-safety"],"exportEndpoints":{"claude":"/api/rules/otel-bounded-exemplar-trace-correlation?format=claude","cursorMdc":"/api/rules/otel-bounded-exemplar-trace-correlation?format=mdc","cursorrules":"/api/rules/otel-bounded-exemplar-trace-correlation?format=cursor","windsurf":"/api/rules/otel-bounded-exemplar-trace-correlation?format=windsurf","agents":"/api/rules/otel-bounded-exemplar-trace-correlation?format=agents"}},{"id":"webgpu-wasm-linear-memory-isolation-fence","title":"WebGPU / WebAssembly Linear Memory Isolation Fence Architecture","category":"frontend","severity":"critical","description":"Enforces strict memory isolation fences between WebAssembly dynamic linear memory heaps and WebGPU queue pipelines during client-side tensor inference. Prevents browser tab crashes, GPU process termination, and detached ArrayBuffer exceptions caused by runtime Wasm heap growth (memory.grow) invalidating views during asynchronous buffer transfers.","antiPatternHeadline":"Streaming Volatile WebAssembly Heap Views Directly into WebGPU Operations Across Asynchronous Execution Boundaries","stars_count":72,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","webgpu","webassembly","machine-learning","concurrency","performance"],"exportEndpoints":{"claude":"/api/rules/webgpu-wasm-linear-memory-isolation-fence?format=claude","cursorMdc":"/api/rules/webgpu-wasm-linear-memory-isolation-fence?format=mdc","cursorrules":"/api/rules/webgpu-wasm-linear-memory-isolation-fence?format=cursor","windsurf":"/api/rules/webgpu-wasm-linear-memory-isolation-fence?format=windsurf","agents":"/api/rules/webgpu-wasm-linear-memory-isolation-fence?format=agents"}},{"id":"tauri2-deep-link-deserialization-guardrail","title":"Tauri 2.0 Native Protocol & Deep-Link Deserialization Security Standard","category":"security","severity":"critical","description":"Enforces strict native Rust validation and schema-bounded deserialization of custom protocol and OS deep-link payloads prior to IPC dispatch or Webview event emission in Tauri 2.0 applications. Prevents arbitrary command execution, protocol pollution, and privilege escalation resulting from unvalidated raw URL inputs.","antiPatternHeadline":"Blindly Forwarding Unsanitized Deep-Link URLs or Loose JSON Payloads Across Tauri IPC Boundaries","stars_count":98,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","tauri-v2","rust","deep-links","ipc","deserialization","injection-prevention"],"exportEndpoints":{"claude":"/api/rules/tauri2-deep-link-deserialization-guardrail?format=claude","cursorMdc":"/api/rules/tauri2-deep-link-deserialization-guardrail?format=mdc","cursorrules":"/api/rules/tauri2-deep-link-deserialization-guardrail?format=cursor","windsurf":"/api/rules/tauri2-deep-link-deserialization-guardrail?format=windsurf","agents":"/api/rules/tauri2-deep-link-deserialization-guardrail?format=agents"}},{"id":"react-19-server-actions-idempotency-rollback-react-19-server--219","title":"React 19 Server Action Idempotency & Optimistic Rollback Barrier","category":"frontend","severity":"critical","description":"Enforces deterministic transactional barriers across React 19 Server Actions and optimistic updates. Mandates client-generated idempotency keys, monotonic revision fencing, and strict rollback envelopes to prevent UI desynchronization and duplicate database mutations during transient network failures, double submissions, or aborted transitions.","antiPatternHeadline":"Unfenced Server Actions with Blind Optimistic Mutations and Non-Idempotent Payloads","stars_count":57,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","server-actions","optimistic-ui","idempotency","nextjs"],"exportEndpoints":{"claude":"/api/rules/react-19-server-actions-idempotency-rollback-react-19-server--219?format=claude","cursorMdc":"/api/rules/react-19-server-actions-idempotency-rollback-react-19-server--219?format=mdc","cursorrules":"/api/rules/react-19-server-actions-idempotency-rollback-react-19-server--219?format=cursor","windsurf":"/api/rules/react-19-server-actions-idempotency-rollback-react-19-server--219?format=windsurf","agents":"/api/rules/react-19-server-actions-idempotency-rollback-react-19-server--219?format=agents"}},{"id":"next15-ppr-static-dynamic-isolation-perimeter","title":"Next.js 15 PPR Static-Dynamic Isolation Perimeter & Boundary Enforcement","category":"frontend","severity":"critical","description":"Enforces strict structural boundaries between edge-cacheable static prerender shells and dynamic React Server Component streams under Next.js 15 Partial Prerendering (PPR). Prevents catastrophic static-deoptimization, user credential leakage in edge-cached prerender payloads, and Cumulative Layout Shift (CLS) caused by asymmetric fallback geometries.","antiPatternHeadline":"Leaking dynamic request-bound APIs into static route shells causing edge cache poisoning or total de-optimization","stars_count":69,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs","react","ppr","performance","security"],"exportEndpoints":{"claude":"/api/rules/next15-ppr-static-dynamic-isolation-perimeter?format=claude","cursorMdc":"/api/rules/next15-ppr-static-dynamic-isolation-perimeter?format=mdc","cursorrules":"/api/rules/next15-ppr-static-dynamic-isolation-perimeter?format=cursor","windsurf":"/api/rules/next15-ppr-static-dynamic-isolation-perimeter?format=windsurf","agents":"/api/rules/next15-ppr-static-dynamic-isolation-perimeter?format=agents"}},{"id":"fastapi-py313-nogil-threadsafe-state-isolation","title":"FastAPI Python 3.13 Free-Threaded (No-GIL) Thread-Safe State Isolation","category":"backend","severity":"critical","description":"Enforces strict thread-safe state isolation, read-only lifecycle state immutability, and explicit synchronization primitives for FastAPI services running on Python 3.13 free-threaded builds (PEP 703). Prevents silent data corruption, torn reads, and deadlocks caused by concurrent OS thread execution without the Global Interpreter Lock.","antiPatternHeadline":"Unsynchronized Global Mutations and Dynamic app.state Modification in Free-Threaded Python 3.13","stars_count":59,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","python3.13","free-threaded","no-gil","thread-safety","concurrency"],"exportEndpoints":{"claude":"/api/rules/fastapi-py313-nogil-threadsafe-state-isolation?format=claude","cursorMdc":"/api/rules/fastapi-py313-nogil-threadsafe-state-isolation?format=mdc","cursorrules":"/api/rules/fastapi-py313-nogil-threadsafe-state-isolation?format=cursor","windsurf":"/api/rules/fastapi-py313-nogil-threadsafe-state-isolation?format=windsurf","agents":"/api/rules/fastapi-py313-nogil-threadsafe-state-isolation?format=agents"}},{"id":"bun-ffi-pointer-lifecycle-ownership-invariant","title":"Bun 1.2 Native C-FFI Pointer Lifecycle, Ownership Invariant, and Finalization Registry","category":"backend","severity":"critical","description":"Enforces strict pointer ownership boundaries, deterministic deallocation, and safe buffer wrapping when bridging native C-FFI dynamic libraries with Bun 1.2's JavaScriptCore (JSC) runtime. Prevents double-free vulnerabilities, use-after-free corruption, and untracked native heap exhaustion caused by mismatched allocator ownership and asynchronous garbage collection cycles.","antiPatternHeadline":"Implicit Pointer Ownership and Untracked Native Deallocation in Bun FFI Interfaces","stars_count":114,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","ffi","memory-safety","pointers","c-interop"],"exportEndpoints":{"claude":"/api/rules/bun-ffi-pointer-lifecycle-ownership-invariant?format=claude","cursorMdc":"/api/rules/bun-ffi-pointer-lifecycle-ownership-invariant?format=mdc","cursorrules":"/api/rules/bun-ffi-pointer-lifecycle-ownership-invariant?format=cursor","windsurf":"/api/rules/bun-ffi-pointer-lifecycle-ownership-invariant?format=windsurf","agents":"/api/rules/bun-ffi-pointer-lifecycle-ownership-invariant?format=agents"}},{"id":"kmp-swift-coroutines-memory-concurrency-contract","title":"Kotlin Native and Swift Async/Await Memory & Coroutine Lifecycle Boundary Contract","category":"mobile","severity":"critical","description":"Enforces strict lifecycle-aware termination, cooperative cancellation, and ownership boundaries across the Apple ARC and Kotlin/Native Concurrent Garbage Collector (GC) interface. Prevents detached Task retain cycles, uncollected Job reference leaks, and worker thread deadlocks caused by bidirectional reference holding across asynchronous Swift-to-Kotlin bridges.","antiPatternHeadline":"Bridging Kotlin Suspend Functions Directly to Swift Tasks Without Cooperative Cancellation and Scope Deallocation Handlers","stars_count":50,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kmp","kotlin-native","swift","coroutines","arc","concurrency"],"exportEndpoints":{"claude":"/api/rules/kmp-swift-coroutines-memory-concurrency-contract?format=claude","cursorMdc":"/api/rules/kmp-swift-coroutines-memory-concurrency-contract?format=mdc","cursorrules":"/api/rules/kmp-swift-coroutines-memory-concurrency-contract?format=cursor","windsurf":"/api/rules/kmp-swift-coroutines-memory-concurrency-contract?format=windsurf","agents":"/api/rules/kmp-swift-coroutines-memory-concurrency-contract?format=agents"}},{"id":"tauri-v2-mobile-ipc-zero-copy-transfer-isolation","title":"Tauri 2.0 Mobile IPC Zero-Copy ArrayBuffer Transfer Isolation Standard","category":"mobile","severity":"critical","description":"Enforces memory-isolated, zero-copy binary communication patterns across Tauri 2.0 Android (JNI/WebKit) and iOS (WKWebView/JavaScriptCore) IPC boundaries. Prohibits JSON stringification and Base64 encapsulation of high-frequency telemetry, audio, or video buffers that trigger severe garbage collection churn and UI frame drops. Requires direct raw ArrayBuffer and Uint8Array view passing backed by explicit lifecycle ownership transfers.","antiPatternHeadline":"Base64 or JSON Payload Encoding Over High-Frequency Mobile Webview IPC Bridges","stars_count":108,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri-v2","ipc","zero-copy","arraybuffer","rust","memory-management"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-mobile-ipc-zero-copy-transfer-isolation?format=claude","cursorMdc":"/api/rules/tauri-v2-mobile-ipc-zero-copy-transfer-isolation?format=mdc","cursorrules":"/api/rules/tauri-v2-mobile-ipc-zero-copy-transfer-isolation?format=cursor","windsurf":"/api/rules/tauri-v2-mobile-ipc-zero-copy-transfer-isolation?format=windsurf","agents":"/api/rules/tauri-v2-mobile-ipc-zero-copy-transfer-isolation?format=agents"}},{"id":"post-quantum-tls13-ml-kem-hybrid-invariant","title":"Mandatory Post-Quantum TLS 1.3 ML-KEM Hybrid Key Exchange Invariant","category":"security","severity":"critical","description":"Enforces quantum-resilient hybrid key exchange mechanisms (specifically X25519MLKEM768 or SecP256r1MLKEM768) under TLS 1.3 across all perimeter ingress gateways, service mesh proxies, and internal microservice transports. Eliminates pure classical key exchange (standard ECDH/DH) to neutralize 'harvest now, decrypt later' (HNDL) adversaries intercepting enterprise data with multi-decade confidentiality requirements.","antiPatternHeadline":"Permitting Pure Classical TLS Key Exchanges Vulnerable to Harvest-Now-Decrypt-Later Cryptanalysis","stars_count":74,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","post-quantum","tls-1-3","ml-kem","pqc","zero-trust","cryptography"],"exportEndpoints":{"claude":"/api/rules/post-quantum-tls13-ml-kem-hybrid-invariant?format=claude","cursorMdc":"/api/rules/post-quantum-tls13-ml-kem-hybrid-invariant?format=mdc","cursorrules":"/api/rules/post-quantum-tls13-ml-kem-hybrid-invariant?format=cursor","windsurf":"/api/rules/post-quantum-tls13-ml-kem-hybrid-invariant?format=windsurf","agents":"/api/rules/post-quantum-tls13-ml-kem-hybrid-invariant?format=agents"}},{"id":"cilium-tetragon-ebpf-lsm-namespace-integrity","title":"Cilium Tetragon eBPF LSM Namespace Integrity and Breakout Prevention Invariant","category":"security","severity":"critical","description":"Enforces synchronous in-kernel detection and immediate process termination via eBPF LSM and kprobe hooks whenever container processes attempt unauthorized namespace boundary traversal, privilege escalation, or capability tampering. Prohibits asynchronous userspace audit-only pipelines for container breakouts to ensure zero-window execution of post-escape payloads.","antiPatternHeadline":"Asynchronous Userspace Auditing of Container Breakouts Permitting Arbitrary In-Host Execution","stars_count":107,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","tetragon","ebpf","lsm","kubernetes","container-security"],"exportEndpoints":{"claude":"/api/rules/cilium-tetragon-ebpf-lsm-namespace-integrity?format=claude","cursorMdc":"/api/rules/cilium-tetragon-ebpf-lsm-namespace-integrity?format=mdc","cursorrules":"/api/rules/cilium-tetragon-ebpf-lsm-namespace-integrity?format=cursor","windsurf":"/api/rules/cilium-tetragon-ebpf-lsm-namespace-integrity?format=windsurf","agents":"/api/rules/cilium-tetragon-ebpf-lsm-namespace-integrity?format=agents"}},{"id":"opentelemetry-cardinality-quarantine-guardrail","title":"OpenTelemetry Semantic Conventions and Cardinality Quarantine Standard","category":"devops","severity":"critical","description":"Enforces deterministic attribute bounds, strict baggage allowlisting, and automated redaction of dynamic high-cardinality values across OpenTelemetry distributed tracing pipelines. Prevents backend APM ingest denial-of-service, memory exhaustion, and runaway indexing costs by quarantining unbounded parameters at instrumentation boundaries.","antiPatternHeadline":"Unbounded Runtime Baggage and Direct Ingestion of High-Cardinality Variables into Span Attributes","stars_count":75,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","observability","distributed-tracing","cardinality-quarantine","telemetry"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-cardinality-quarantine-guardrail?format=claude","cursorMdc":"/api/rules/opentelemetry-cardinality-quarantine-guardrail?format=mdc","cursorrules":"/api/rules/opentelemetry-cardinality-quarantine-guardrail?format=cursor","windsurf":"/api/rules/opentelemetry-cardinality-quarantine-guardrail?format=windsurf","agents":"/api/rules/opentelemetry-cardinality-quarantine-guardrail?format=agents"}},{"id":"kubernetes-dra-gpu-partitioning-protocol","title":"Kubernetes Dynamic Resource Allocation (DRA) GPU Partitioning Protocol","category":"devops","severity":"critical","description":"Enforces Kubernetes Dynamic Resource Allocation (DRA) v1beta1/v1alpha3 structured parameters (resource.k8s.io) for multi-tenant GPU hardware slicing. Eliminates legacy integer-based overcommit, uncontrolled memory contention, and driver-level preemption by validating deterministic hardware claim bindings, Common Expression Language (CEL) selectors, and device class partitioning.","antiPatternHeadline":"Deploying fractional or partitioned GPU workloads via legacy extended resources or manual environment injections without DRA Structured Parameters","stars_count":68,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","kubernetes","dra","gpu-partitioning","ai-infrastructure","mig"],"exportEndpoints":{"claude":"/api/rules/kubernetes-dra-gpu-partitioning-protocol?format=claude","cursorMdc":"/api/rules/kubernetes-dra-gpu-partitioning-protocol?format=mdc","cursorrules":"/api/rules/kubernetes-dra-gpu-partitioning-protocol?format=cursor","windsurf":"/api/rules/kubernetes-dra-gpu-partitioning-protocol?format=windsurf","agents":"/api/rules/kubernetes-dra-gpu-partitioning-protocol?format=agents"}},{"id":"nextjs-15-ppr-cache-boundary-segmentation","title":"Next.js 15 Partial Prerendering (PPR) Deterministic Cache Boundary Enforcement","category":"frontend","severity":"critical","description":"Enforces strict structural boundaries between static prerendered HTML shells and dynamic React Server Component streams in Next.js 15 Partial Prerendering. Requires all dynamic functions (cookies, headers, searchParams, and uncached data fetches) to be strictly encapsulated within explicit Suspense boundaries with deterministic, dynamic-free fallbacks to prevent edge CDN cache poisoning and build-time dynamic bailout propagation.","antiPatternHeadline":"Dynamic Context Leakage into Static Shells Causing Edge CDN Cache Poisoning and Static De-optimization","stars_count":78,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs15","react19","ppr","rsc","cache-poisoning","edge-cdn"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-ppr-cache-boundary-segmentation?format=claude","cursorMdc":"/api/rules/nextjs-15-ppr-cache-boundary-segmentation?format=mdc","cursorrules":"/api/rules/nextjs-15-ppr-cache-boundary-segmentation?format=cursor","windsurf":"/api/rules/nextjs-15-ppr-cache-boundary-segmentation?format=windsurf","agents":"/api/rules/nextjs-15-ppr-cache-boundary-segmentation?format=agents"}},{"id":"svelte-5-effect-async-cancellation-boundary","title":"Svelte 5 $effect Cleanup and Asynchronous Task Cancellation Boundary","category":"frontend","severity":"critical","description":"Enforces synchronous teardown return contracts and deterministic AbortController cancellation inside Svelte 5 $effect runes. Prevents floating asynchronous microtasks from mutating unmounted component state or causing cross-render race conditions by binding all async execution lifecycles to reactive scope disposal boundaries.","antiPatternHeadline":"Async $effect Function Signatures and Unbound Microtask State Mutation","stars_count":44,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","effects","abort-controller","concurrency","memory-leaks"],"exportEndpoints":{"claude":"/api/rules/svelte-5-effect-async-cancellation-boundary?format=claude","cursorMdc":"/api/rules/svelte-5-effect-async-cancellation-boundary?format=mdc","cursorrules":"/api/rules/svelte-5-effect-async-cancellation-boundary?format=cursor","windsurf":"/api/rules/svelte-5-effect-async-cancellation-boundary?format=windsurf","agents":"/api/rules/svelte-5-effect-async-cancellation-boundary?format=agents"}},{"id":"pg17-incremental-backup-lsn-alignment","title":"PostgreSQL 17 Block-Level Incremental Backup LSN Monotonicity and Synthetic Full Alignment","category":"backend","severity":"critical","description":"PostgreSQL 17 native block-level incremental backups depend on contiguous, monotonically increasing Log Sequence Numbers (LSN) recorded across successive pg_combinebackup manifests. Orchestration layers must strictly validate that an incremental backup's start LSN exactly matches or precedes the prior backup's stop LSN and verifies pg_waldump consistency before synthesising a full backup, preventing silent corruption during point-in-time recovery (PITR).","antiPatternHeadline":"Unvalidated LSN Gap in Incremental Backup Chains and Blind pg_combinebackup Execution","stars_count":49,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql17","backup-recovery","wal","database-reliability","disaster-recovery"],"exportEndpoints":{"claude":"/api/rules/pg17-incremental-backup-lsn-alignment?format=claude","cursorMdc":"/api/rules/pg17-incremental-backup-lsn-alignment?format=mdc","cursorrules":"/api/rules/pg17-incremental-backup-lsn-alignment?format=cursor","windsurf":"/api/rules/pg17-incremental-backup-lsn-alignment?format=windsurf","agents":"/api/rules/pg17-incremental-backup-lsn-alignment?format=agents"}},{"id":"axum-graceful-streaming-socket-teardown-standard","title":"Axum 0.8 Graceful Streaming Socket Handoff and Teardown Standard","category":"backend","severity":"critical","description":"Enforces deterministic, synchronized draining for long-lived Server-Sent Events (SSE) and WebSocket connections during Axum 0.8 service shutdown. Prevents abrupt connection severing and client reconnect storms during zero-downtime rolling deployments by combining readiness probe flipping, explicit protocol-level teardown frames (WS 1001 Going Away), and bounded cancellation tokens.","antiPatternHeadline":"Uncoordinated Axum Shutdown Abruptly Dropping Active Streaming Clients via SIGKILL or TCP RST","stars_count":77,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","websockets","sse","kubernetes","zero-downtime"],"exportEndpoints":{"claude":"/api/rules/axum-graceful-streaming-socket-teardown-standard?format=claude","cursorMdc":"/api/rules/axum-graceful-streaming-socket-teardown-standard?format=mdc","cursorrules":"/api/rules/axum-graceful-streaming-socket-teardown-standard?format=cursor","windsurf":"/api/rules/axum-graceful-streaming-socket-teardown-standard?format=windsurf","agents":"/api/rules/axum-graceful-streaming-socket-teardown-standard?format=agents"}},{"id":"bun-sqlite-wal-reader-isolation-invariant","title":"Bun 1.2 Native SQLite WAL Concurrent Reader Isolation and Checkpoint Invariant","category":"backend","severity":"critical","description":"Enforces architectural isolation between single-writer and multi-reader connections in Bun 1.2 native SQLite ('bun:sqlite'). Prevents event loop thread contention, SQLite lock starvation (SQLITE_BUSY), and unbounded write-ahead log (WAL) checkpoint latency under high-throughput concurrent loads.","antiPatternHeadline":"Monolithic bun:sqlite Handle Sharing Mixed Read-Write Queries Without WAL Isolation and Busy Timeouts","stars_count":90,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","sqlite","wal-mode","concurrency","performance"],"exportEndpoints":{"claude":"/api/rules/bun-sqlite-wal-reader-isolation-invariant?format=claude","cursorMdc":"/api/rules/bun-sqlite-wal-reader-isolation-invariant?format=mdc","cursorrules":"/api/rules/bun-sqlite-wal-reader-isolation-invariant?format=cursor","windsurf":"/api/rules/bun-sqlite-wal-reader-isolation-invariant?format=windsurf","agents":"/api/rules/bun-sqlite-wal-reader-isolation-invariant?format=agents"}},{"id":"wasi-p2-capability-sandboxing-guardrail","title":"WASI 0.2 Component Model Capability Sandboxing Guardrail","category":"backend","severity":"critical","description":"Enforces strict capability-based security boundaries for third-party WebAssembly components running in multi-tenant edge runtimes under WASI 0.2 (Preview 2). Prohibits ambient authority by requiring explicit, per-instance capability tokens for virtualized filesystem, network sockets, and environment variables. Guarantees deterministic memory limits and isolated linear memory heaps to eliminate cross-tenant data leakage and remote host compromise.","antiPatternHeadline":"Ambient Host Access & Unbounded Linear Memory in Multi-Tenant Plugin Execution","stars_count":111,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","wasm","wasi","security","edge-runtime","sandboxing"],"exportEndpoints":{"claude":"/api/rules/wasi-p2-capability-sandboxing-guardrail?format=claude","cursorMdc":"/api/rules/wasi-p2-capability-sandboxing-guardrail?format=mdc","cursorrules":"/api/rules/wasi-p2-capability-sandboxing-guardrail?format=cursor","windsurf":"/api/rules/wasi-p2-capability-sandboxing-guardrail?format=windsurf","agents":"/api/rules/wasi-p2-capability-sandboxing-guardrail?format=agents"}},{"id":"tauri-v2-deeplink-origin-isolation-capability-boundary","title":"Tauri 2.0 Deep-Link Origin Isolation and Capability Boundary Guardrail","category":"mobile","severity":"critical","description":"Enforces strict origin validation and capability-scoped runtime verification for all incoming mobile deep links (custom schemes and universal app links) in Tauri 2.0. Prevents arbitrary IPC command execution and malicious payload injection by requiring explicit schema validation, state cryptographic nonces, and isolated execution scopes prior to delegating actions to native plugins or frontend state machines.","antiPatternHeadline":"Direct IPC Command Invocation via Unsanitized Custom URL Scheme Parameters","stars_count":98,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri","tauri-v2","deep-links","app-links","security","ipc"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-deeplink-origin-isolation-capability-boundary?format=claude","cursorMdc":"/api/rules/tauri-v2-deeplink-origin-isolation-capability-boundary?format=mdc","cursorrules":"/api/rules/tauri-v2-deeplink-origin-isolation-capability-boundary?format=cursor","windsurf":"/api/rules/tauri-v2-deeplink-origin-isolation-capability-boundary?format=windsurf","agents":"/api/rules/tauri-v2-deeplink-origin-isolation-capability-boundary?format=agents"}},{"id":"capacitor-7-native-bridge-ephemeral-hmac-attestation","title":"Capacitor 7 Native Bridge Ephemeral HMAC Attestation Protocol","category":"mobile","severity":"critical","description":"Enforces a zero-trust cryptographic attestation layer across all Capacitor 7 native bridge dispatches. Every hardware-level API invocation must be sealed with a single-use HMAC-SHA256 token, monotonic nonce, and millisecond-level timestamp derived from an isolated in-memory key, neutralizing DOM XSS bridge-hijacking attacks.","antiPatternHeadline":"Direct Unattested Native Plugin Invocations Vulnerable to WebView DOM XSS Exploitation","stars_count":81,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","security","xss-mitigation","hmac","zero-trust-bridge","web-crypto"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-native-bridge-ephemeral-hmac-attestation?format=claude","cursorMdc":"/api/rules/capacitor-7-native-bridge-ephemeral-hmac-attestation?format=mdc","cursorrules":"/api/rules/capacitor-7-native-bridge-ephemeral-hmac-attestation?format=cursor","windsurf":"/api/rules/capacitor-7-native-bridge-ephemeral-hmac-attestation?format=windsurf","agents":"/api/rules/capacitor-7-native-bridge-ephemeral-hmac-attestation?format=agents"}},{"id":"ebpf-lsm-process-lineage-guardrail","title":"eBPF LSM Syscall Interception and Process Lineage Enforcement","category":"security","severity":"critical","description":"Enforces synchronous, kernel-space zero-trust process lineage validation using eBPF Linux Security Modules (LSM) hooks before userspace execution. Prevents Container Drift, Time-of-Check to Time-of-Use (TOCTOU) races, and privilege escalation by binding parent-child lineage invariants directly in the task local storage and rejecting unauthorized execution vectors with deterministic kernel aborts.","antiPatternHeadline":"Asynchronous Tracepoint/Kprobe Monitoring and Reactive Userspace Kill Signals","stars_count":113,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","ebpf","lsm","linux-kernel","containers","zero-trust"],"exportEndpoints":{"claude":"/api/rules/ebpf-lsm-process-lineage-guardrail?format=claude","cursorMdc":"/api/rules/ebpf-lsm-process-lineage-guardrail?format=mdc","cursorrules":"/api/rules/ebpf-lsm-process-lineage-guardrail?format=cursor","windsurf":"/api/rules/ebpf-lsm-process-lineage-guardrail?format=windsurf","agents":"/api/rules/ebpf-lsm-process-lineage-guardrail?format=agents"}},{"id":"spiffe-spire-hardware-attestation-standard","title":"SPIFFE/SPIRE Hardware-Rooted Dynamic Workload Attestation Standard","category":"devops","severity":"critical","description":"Enforces zero-trust dynamic workload identity across hybrid Kubernetes clusters by replacing static credentials with TPM-backed, short-lived X.509 SVIDs. Mandates SPIRE Agent hardware node attestation, SPIFFE Workload API Unix domain socket consumption, and continuous in-memory certificate rotation with lifetimes under 60 minutes.","antiPatternHeadline":"Mounting static certificates, long-lived API tokens, or non-attested Kubernetes ServiceAccount secrets for service-to-service authentication.","stars_count":70,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","spiffe","spire","zero-trust","tpm2","kubernetes","mtls"],"exportEndpoints":{"claude":"/api/rules/spiffe-spire-hardware-attestation-standard?format=claude","cursorMdc":"/api/rules/spiffe-spire-hardware-attestation-standard?format=mdc","cursorrules":"/api/rules/spiffe-spire-hardware-attestation-standard?format=cursor","windsurf":"/api/rules/spiffe-spire-hardware-attestation-standard?format=windsurf","agents":"/api/rules/spiffe-spire-hardware-attestation-standard?format=agents"}},{"id":"nextjs-15-ppr-dynamic-suspense-boundary-isolation","title":"Next.js 15 PPR Dynamic Suspense Boundary and Shell Isolation Standard","category":"frontend","severity":"critical","description":"Enforces strict structural segregation between static edge-cached shell chunks and deferred dynamic runtime microtasks under Next.js 15 Partial Prerendering (PPR). Dynamic runtime APIs (cookies, headers, searchParams, and uncached data fetches) must be encapsulated within explicit Suspense boundaries to prevent full-route static de-optimization and concurrent hydration mismatches.","antiPatternHeadline":"Dynamic Context Leaking Across Static Prerender Shells via Unguarded Root Executions","stars_count":62,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs","react-server-components","partial-prerendering","hydration","suspense"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-ppr-dynamic-suspense-boundary-isolation?format=claude","cursorMdc":"/api/rules/nextjs-15-ppr-dynamic-suspense-boundary-isolation?format=mdc","cursorrules":"/api/rules/nextjs-15-ppr-dynamic-suspense-boundary-isolation?format=cursor","windsurf":"/api/rules/nextjs-15-ppr-dynamic-suspense-boundary-isolation?format=windsurf","agents":"/api/rules/nextjs-15-ppr-dynamic-suspense-boundary-isolation?format=agents"}},{"id":"wasmgc-shared-arraybuffer-microfrontend-isolation","title":"WasmGC Shared ArrayBuffer Memory Boundary Isolation in Micro-Frontends","category":"frontend","severity":"critical","description":"Federated micro-frontends utilizing WebAssembly Garbage Collection (WasmGC) and SharedArrayBuffer must enforce strict linear memory isolation and host reference boundary encapsulation. Direct passing of WasmGC heap references (externref/anyref) or shared underlying linear buffers across federated boundaries introduces cross-origin memory leaks, thread contention, and non-deterministic GC teardown cycles. Inter-module communication must instead traverse structured message ports or isolated transient serialization buffers governed by explicit lifecycle ownership.","antiPatternHeadline":"Leaking SharedArrayBuffer References and GC External References Across Federated Module Boundaries","stars_count":116,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","webassembly","wasmgc","micro-frontends","memory-management","sharedarraybuffer"],"exportEndpoints":{"claude":"/api/rules/wasmgc-shared-arraybuffer-microfrontend-isolation?format=claude","cursorMdc":"/api/rules/wasmgc-shared-arraybuffer-microfrontend-isolation?format=mdc","cursorrules":"/api/rules/wasmgc-shared-arraybuffer-microfrontend-isolation?format=cursor","windsurf":"/api/rules/wasmgc-shared-arraybuffer-microfrontend-isolation?format=windsurf","agents":"/api/rules/wasmgc-shared-arraybuffer-microfrontend-isolation?format=agents"}},{"id":"bun-native-cluster-zero-copy-ipc-standard","title":"Bun 1.2 Cluster Zero-Copy ArrayBuffer Transfer Standard","category":"backend","severity":"critical","description":"Enforces strict binary IPC memory transfer invariants across Bun 1.2 cluster worker threads to eliminate structured clone serialization overhead. Mandates the transfer list pattern with transferable ArrayBuffers alongside binary framing protocols for multi-core gateway routing. Prohibits deep JSON object cloning across IPC channels and eliminates post-transfer detached buffer access faults.","antiPatternHeadline":"Serializing JSON Objects Across Worker IPC Causing Serialization Latency Spikes and GC Pressure","stars_count":76,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","ipc","zero-copy","multithreading","performance","buffers"],"exportEndpoints":{"claude":"/api/rules/bun-native-cluster-zero-copy-ipc-standard?format=claude","cursorMdc":"/api/rules/bun-native-cluster-zero-copy-ipc-standard?format=mdc","cursorrules":"/api/rules/bun-native-cluster-zero-copy-ipc-standard?format=cursor","windsurf":"/api/rules/bun-native-cluster-zero-copy-ipc-standard?format=windsurf","agents":"/api/rules/bun-native-cluster-zero-copy-ipc-standard?format=agents"}},{"id":"sqlalchemy-async-taskgroup-greenlet-context-guardrail","title":"Async SQLAlchemy 2.0 Greenlet Context Leak & TaskGroup Isolation Guardrail","category":"backend","severity":"critical","description":"Enforces strict isolation of SQLAlchemy 2.0 AsyncSession instances across concurrent tasks inside Python 3.11+ asyncio.TaskGroup and AnyIO task groups within FastAPI. Prohibits sharing a single AsyncSession across child coroutines to prevent greenlet context corruption, cross-task connection state bleed, and 'concurrent operations are not permitted on a single Session' runtime exceptions.","antiPatternHeadline":"Sharing a Request-Scoped AsyncSession across Concurrent TaskGroup Child Coroutines","stars_count":60,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","python","fastapi","sqlalchemy","asyncio","greenlet"],"exportEndpoints":{"claude":"/api/rules/sqlalchemy-async-taskgroup-greenlet-context-guardrail?format=claude","cursorMdc":"/api/rules/sqlalchemy-async-taskgroup-greenlet-context-guardrail?format=mdc","cursorrules":"/api/rules/sqlalchemy-async-taskgroup-greenlet-context-guardrail?format=cursor","windsurf":"/api/rules/sqlalchemy-async-taskgroup-greenlet-context-guardrail?format=windsurf","agents":"/api/rules/sqlalchemy-async-taskgroup-greenlet-context-guardrail?format=agents"}},{"id":"postgres-17-hnsw-pgvector-memory-ceiling-guardrail","title":"Postgres 17 HNSW pgvector Incremental Indexing Memory Ceiling Invariant","category":"backend","severity":"critical","description":"Enforces strict resource isolation and buffer ceilings during concurrent pgvector HNSW incremental indexing in Postgres 17. Guarantees transactional query latency by capping maintenance_work_mem, throttling WAL generation, and routing vector ingest through rate-governed micro-batches with transaction-scoped timeouts.","antiPatternHeadline":"Unbounded concurrent vector insertions triggering HNSW graph traversal OOMs and WAL saturation spikes that degrade primary OLTP latency.","stars_count":77,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres17","pgvector","hnsw","memory-management","wal-throttling"],"exportEndpoints":{"claude":"/api/rules/postgres-17-hnsw-pgvector-memory-ceiling-guardrail?format=claude","cursorMdc":"/api/rules/postgres-17-hnsw-pgvector-memory-ceiling-guardrail?format=mdc","cursorrules":"/api/rules/postgres-17-hnsw-pgvector-memory-ceiling-guardrail?format=cursor","windsurf":"/api/rules/postgres-17-hnsw-pgvector-memory-ceiling-guardrail?format=windsurf","agents":"/api/rules/postgres-17-hnsw-pgvector-memory-ceiling-guardrail?format=agents"}},{"id":"rn-new-architecture-jsi-thread-sync-guardrail","title":"TurboModule JSI Lock-Free Thread Synchronization Guardrail","category":"mobile","severity":"critical","description":"Enforces strict lock-free boundaries within C++ JSI host function implementations in React Native New Architecture TurboModules. Eliminates synchronous platform thread blocking (such as dispatch_sync or std::mutex contentions against main UI queues) to prevent priority inversion deadlocks between Hermes and the native run loop.","antiPatternHeadline":"Synchronously blocking Hermes runtime host functions on UI/platform queues via JSI bindings.","stars_count":57,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","react-native","turbomodules","jsi","hermes","concurrency","c++"],"exportEndpoints":{"claude":"/api/rules/rn-new-architecture-jsi-thread-sync-guardrail?format=claude","cursorMdc":"/api/rules/rn-new-architecture-jsi-thread-sync-guardrail?format=mdc","cursorrules":"/api/rules/rn-new-architecture-jsi-thread-sync-guardrail?format=cursor","windsurf":"/api/rules/rn-new-architecture-jsi-thread-sync-guardrail?format=windsurf","agents":"/api/rules/rn-new-architecture-jsi-thread-sync-guardrail?format=agents"}},{"id":"webauthn-l3-device-public-key-guardrail","title":"WebAuthn Level 3 Device Public Key (DPK) Enclave Binding Guardrail","category":"security","severity":"critical","description":"Enforces strict parsing, cryptographic verification, and hardware-binding persistence of WebAuthn Level 3 Device Public Key (DPK) extension outputs. Eliminates multi-device passkey cloning vulnerabilities across synced cloud keychains (e.g., Apple iCloud Keychain, Google Password Manager) by requiring unexportable physical hardware-backed cryptographic proof of origin per assertion.","antiPatternHeadline":"Accepting Synced Multi-Device Passkeys Without Hardware-Bound Device Public Key (DPK) Verification","stars_count":104,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","fido2","passkeys","cryptography","zero-trust","attestation"],"exportEndpoints":{"claude":"/api/rules/webauthn-l3-device-public-key-guardrail?format=claude","cursorMdc":"/api/rules/webauthn-l3-device-public-key-guardrail?format=mdc","cursorrules":"/api/rules/webauthn-l3-device-public-key-guardrail?format=cursor","windsurf":"/api/rules/webauthn-l3-device-public-key-guardrail?format=windsurf","agents":"/api/rules/webauthn-l3-device-public-key-guardrail?format=agents"}},{"id":"sigstore-oidc-keyless-provenance-guardrail","title":"Sigstore Ephemeral OIDC Attestation and Keyless SLSA Provenance Verification","category":"security","severity":"critical","description":"Enforces SLSA Level 3+ build provenance integrity by mandating keyless, short-lived OIDC attestation verification via Sigstore Fulcio and Rekor. Validates cryptographic identity bindings, immutable certificate Subject Alternative Name (SAN) claims, and transparency log inclusion proofs without relying on long-lived signing keys.","antiPatternHeadline":"Accepting unverified OIDC tokens, bypassing Rekor log inclusion checks, or relying on ambient static private keys for build provenance.","stars_count":104,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","sigstore","slsa-level-3","provenance","oidc","supply-chain"],"exportEndpoints":{"claude":"/api/rules/sigstore-oidc-keyless-provenance-guardrail?format=claude","cursorMdc":"/api/rules/sigstore-oidc-keyless-provenance-guardrail?format=mdc","cursorrules":"/api/rules/sigstore-oidc-keyless-provenance-guardrail?format=cursor","windsurf":"/api/rules/sigstore-oidc-keyless-provenance-guardrail?format=windsurf","agents":"/api/rules/sigstore-oidc-keyless-provenance-guardrail?format=agents"}},{"id":"opentelemetry-async-context-propagation-baggage-scoping","title":"OpenTelemetry Distributed Context Preservation and Baggage Scoping Guardrail","category":"devops","severity":"critical","description":"Enforces strict distributed trace context propagation and sanitization across asynchronous task boundaries, worker threads, and message brokers. Prevents broken trace parent-child hierarchies and eliminates security vulnerabilities stemming from leaking sensitive credentials or high-cardinality state through uncontained W3C Baggage headers.","antiPatternHeadline":"Context Detachment Across Decoupled Pipelines and Unscoped Credential Leakage via W3C Baggage","stars_count":59,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","distributed-tracing","observability","context-propagation","w3c-baggage"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-async-context-propagation-baggage-scoping?format=claude","cursorMdc":"/api/rules/opentelemetry-async-context-propagation-baggage-scoping?format=mdc","cursorrules":"/api/rules/opentelemetry-async-context-propagation-baggage-scoping?format=cursor","windsurf":"/api/rules/opentelemetry-async-context-propagation-baggage-scoping?format=windsurf","agents":"/api/rules/opentelemetry-async-context-propagation-baggage-scoping?format=agents"}},{"id":"k8s-dra-numa-gpu-slicing-topology-alignment","title":"Kubernetes DRA NUMA-Aware GPU Slicing & Topology Alignment Invariant","category":"devops","severity":"critical","description":"Enforces strict PCIe and NUMA node topology alignment for containerized fractional accelerator workloads via Kubernetes Dynamic Resource Allocation (DRA). Prevents cross-socket interconnect latency penalties by guaranteeing that sliced GPU instances, container CPU affinity, and pinned memory allocations share the exact same NUMA domain.","antiPatternHeadline":"Cross-NUMA Sliced GPU Allocation Inducing Cross-Socket Interconnect Bottlenecks","stars_count":99,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","kubernetes","dra","gpu","numa","topology-manager","hpc"],"exportEndpoints":{"claude":"/api/rules/k8s-dra-numa-gpu-slicing-topology-alignment?format=claude","cursorMdc":"/api/rules/k8s-dra-numa-gpu-slicing-topology-alignment?format=mdc","cursorrules":"/api/rules/k8s-dra-numa-gpu-slicing-topology-alignment?format=cursor","windsurf":"/api/rules/k8s-dra-numa-gpu-slicing-topology-alignment?format=windsurf","agents":"/api/rules/k8s-dra-numa-gpu-slicing-topology-alignment?format=agents"}},{"id":"svelte-5-runes-signal-isolation-guardrail","title":"Svelte 5 Runes Fine-Grained Reactivity Signal Isolation Guardrail","category":"frontend","severity":"critical","description":"Enforces strict signal boundary encapsulation for Svelte 5 $state and $derived runes across microfrontend (MFE) and multi-root boundaries. Prohibits leaking reactive proxy references and cross-root signal subscriptions that cause orphan dependency nodes, broken lifecycle garbage collection, and silent memory leaks.","antiPatternHeadline":"Exposing Raw Svelte 5 Reactive Proxies Across Microfrontend Roots Causing Retained Memory Graph Leaks","stars_count":110,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["svelte5","runes","microfrontends","reactivity","memory-leaks","signals"],"exportEndpoints":{"claude":"/api/rules/svelte-5-runes-signal-isolation-guardrail?format=claude","cursorMdc":"/api/rules/svelte-5-runes-signal-isolation-guardrail?format=mdc","cursorrules":"/api/rules/svelte-5-runes-signal-isolation-guardrail?format=cursor","windsurf":"/api/rules/svelte-5-runes-signal-isolation-guardrail?format=windsurf","agents":"/api/rules/svelte-5-runes-signal-isolation-guardrail?format=agents"}},{"id":"vite-6-environment-api-runtime-sandbox","title":"Vite 6 Environment API Deterministic Multi-Runtime Isolation Guardrail","category":"frontend","severity":"critical","description":"Enforces strict boundary isolation across client, SSR, and edge worker module graphs using the Vite 6 Environment API. Guarantees deterministic module evaluation and eliminates cross-tenant state pollution caused by shared module runner instances and un-isolated module-level singletons during SSR dev and bundling.","antiPatternHeadline":"Cross-Tenant State Bleed via Shared Module Graphs and Legacy ssrLoadModule Singletons","stars_count":91,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","vite-6","environment-api","ssr","module-runner","multi-runtime","state-isolation"],"exportEndpoints":{"claude":"/api/rules/vite-6-environment-api-runtime-sandbox?format=claude","cursorMdc":"/api/rules/vite-6-environment-api-runtime-sandbox?format=mdc","cursorrules":"/api/rules/vite-6-environment-api-runtime-sandbox?format=cursor","windsurf":"/api/rules/vite-6-environment-api-runtime-sandbox?format=windsurf","agents":"/api/rules/vite-6-environment-api-runtime-sandbox?format=agents"}},{"id":"axum-tower-per-tenant-adaptive-concurrency-limit-standard","title":"Axum Tower Per-Tenant Dynamic Backpressure & Adaptive Concurrency Standard","category":"backend","severity":"critical","description":"Mandates per-tenant adaptive concurrency limits and bounded fair queuing within Axum/Tower middleware stacks using gradient or AIMD algorithms. Eliminates multi-tenant noisy-neighbor tail-latency collapse and starvation by shedding excessive tenant load with HTTP 429 before saturation propagates to shared Tokio runtimes and downstream database pools.","antiPatternHeadline":"Global Static Concurrency Limits and Unbounded Per-Tenant Queues Causing Tokio Worker Starvation","stars_count":92,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tower","concurrency","rate-limiting","multi-tenancy"],"exportEndpoints":{"claude":"/api/rules/axum-tower-per-tenant-adaptive-concurrency-limit-standard?format=claude","cursorMdc":"/api/rules/axum-tower-per-tenant-adaptive-concurrency-limit-standard?format=mdc","cursorrules":"/api/rules/axum-tower-per-tenant-adaptive-concurrency-limit-standard?format=cursor","windsurf":"/api/rules/axum-tower-per-tenant-adaptive-concurrency-limit-standard?format=windsurf","agents":"/api/rules/axum-tower-per-tenant-adaptive-concurrency-limit-standard?format=agents"}},{"id":"postgres-17-partitioned-hnsw-concurrency-control","title":"Postgres 17 Partitioned HNSW Vector Scan Concurrency and Memory Guardrails","category":"backend","severity":"critical","description":"Enforces strict query-level work memory limits, sub-partition pruning invariants, and worker concurrency caps for Postgres 17 pgvector HNSW index scans. Prevents shared buffer lock convoying, out-of-memory worker terminations, and excessive buffer pin contention during hybrid RAG vector searches.","antiPatternHeadline":"Unbounded Scatter-Gather HNSW Index Scans Across Partitions Inducing Buffer Lock Convoys","stars_count":106,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres-17","pgvector","hnsw","rag","concurrency","performance"],"exportEndpoints":{"claude":"/api/rules/postgres-17-partitioned-hnsw-concurrency-control?format=claude","cursorMdc":"/api/rules/postgres-17-partitioned-hnsw-concurrency-control?format=mdc","cursorrules":"/api/rules/postgres-17-partitioned-hnsw-concurrency-control?format=cursor","windsurf":"/api/rules/postgres-17-partitioned-hnsw-concurrency-control?format=windsurf","agents":"/api/rules/postgres-17-partitioned-hnsw-concurrency-control?format=agents"}},{"id":"drizzle-orm-relational-graph-expansion-chunking-guardrail","title":"Drizzle ORM Relational Graph Expansion Chunking & Parameter Limit Guardrail","category":"backend","severity":"critical","description":"Enforces strict chunked parameter batching and bounded concurrency when executing dynamic relational graph expansions and multi-entity 'inArray' subqueries in Drizzle ORM. Prevents exceeding database engine parameter ceilings (PostgreSQL 65,535, SQLite 999/32,766) and guards against serverless heap exhaustion caused by uncontrolled deserialization of oversized relational graphs.","antiPatternHeadline":"Unbounded Array Injection in Relational 'with' Clauses and inArray Predicates Causing Parameter Overflow or Serverless OOM","stars_count":92,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","drizzle-orm","postgresql","sqlite","performance","concurrency","database"],"exportEndpoints":{"claude":"/api/rules/drizzle-orm-relational-graph-expansion-chunking-guardrail?format=claude","cursorMdc":"/api/rules/drizzle-orm-relational-graph-expansion-chunking-guardrail?format=mdc","cursorrules":"/api/rules/drizzle-orm-relational-graph-expansion-chunking-guardrail?format=cursor","windsurf":"/api/rules/drizzle-orm-relational-graph-expansion-chunking-guardrail?format=windsurf","agents":"/api/rules/drizzle-orm-relational-graph-expansion-chunking-guardrail?format=agents"}},{"id":"kmp-compose-skiko-surface-lifecycle-sync","title":"Kotlin Multiplatform Compose Surface Lifecycle and Skiko Hardware Context Sync","category":"mobile","severity":"critical","description":"Enforces strict ordering and lifecycle synchronization between UI surface transitions and underlying Skiko GPU contexts (Vulkan on Android, Metal on iOS). Prevents deadlocks, GPU context abandonment, and SIGSEGV memory faults when an application transitions between foreground, background, and configuration changes during Compose multiplatform rendering.","antiPatternHeadline":"Accessing or reallocating Skiko render targets asynchronously during platform surface invalidation or backgrounding","stars_count":53,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","compose-multiplatform","skiko","metal","vulkan","graphics"],"exportEndpoints":{"claude":"/api/rules/kmp-compose-skiko-surface-lifecycle-sync?format=claude","cursorMdc":"/api/rules/kmp-compose-skiko-surface-lifecycle-sync?format=mdc","cursorrules":"/api/rules/kmp-compose-skiko-surface-lifecycle-sync?format=cursor","windsurf":"/api/rules/kmp-compose-skiko-surface-lifecycle-sync?format=windsurf","agents":"/api/rules/kmp-compose-skiko-surface-lifecycle-sync?format=agents"}},{"id":"swift-6-noncopyable-resource-sandbox","title":"Swift 6 Concurrency Non-Copyable Resource Sandbox Standard","category":"mobile","severity":"critical","description":"Enforces strict single-ownership semantics for low-level system and hardware handles (e.g., POSIX file descriptors, GPU command buffers, Secure Enclave keys) using Swift 6 non-copyable types (~Copyable) coupled with actor isolation. Eliminates data races, reference-counting overhead, and dangling handle leaks by verifying exclusive linear consumption at compile time.","antiPatternHeadline":"Wrapping Raw OS Hardware Handles in Reference-Counted Classes or Unchecked Copyable Structs","stars_count":119,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","swift6","concurrency","non-copyable","ownership","ios"],"exportEndpoints":{"claude":"/api/rules/swift-6-noncopyable-resource-sandbox?format=claude","cursorMdc":"/api/rules/swift-6-noncopyable-resource-sandbox?format=mdc","cursorrules":"/api/rules/swift-6-noncopyable-resource-sandbox?format=cursor","windsurf":"/api/rules/swift-6-noncopyable-resource-sandbox?format=windsurf","agents":"/api/rules/swift-6-noncopyable-resource-sandbox?format=agents"}},{"id":"webauthn-prf-zk-seed-derivation-standard","title":"WebAuthn PRF Hardware Seed Derivation & Zero-Knowledge E2EE Storage Guardrail","category":"security","severity":"critical","description":"Standardizes deterministic client-side symmetric key derivation using WebAuthn Level 3 PRF (Pseudo-Random Function) extensions. Mandates strict HKDF domain separation, ensures hardware-bound zero-knowledge isolation, and strictly forbids raw PRF output leakage to network transports or unencrypted client state.","antiPatternHeadline":"Leaking Raw Hardware PRF Outputs to Server Transports or Direct Slicing of PRF Bytes as Symmetric Keys Without HKDF Domain Separation","stars_count":111,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","prf-extension","zero-knowledge","hkdf","cryptography","e2ee"],"exportEndpoints":{"claude":"/api/rules/webauthn-prf-zk-seed-derivation-standard?format=claude","cursorMdc":"/api/rules/webauthn-prf-zk-seed-derivation-standard?format=mdc","cursorrules":"/api/rules/webauthn-prf-zk-seed-derivation-standard?format=cursor","windsurf":"/api/rules/webauthn-prf-zk-seed-derivation-standard?format=windsurf","agents":"/api/rules/webauthn-prf-zk-seed-derivation-standard?format=agents"}},{"id":"oauth-2-1-dpop-nonce-binding-standard","title":"OAuth 2.1 Demonstrating Proof-of-Possession (DPoP) Nonce Binding Standard","category":"security","severity":"critical","description":"Enforces RFC 9449 Demonstrating Proof-of-Possession (DPoP) specifications across all edge API clients and token handlers. Mandates client-side generation of ephemeral asymmetric key-bound proof JWTs with strict server-issued nonce synchronization to neutralize bearer token exfiltration, replay attacks, and man-in-the-middle impersonation.","antiPatternHeadline":"Transmitting Unbound Bearer Tokens or Static DPoP Proofs Without Dynamic Nonce Challenge Handshakes","stars_count":53,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","oauth2","dpop","cryptography","zero-trust","jwt","rfc9449"],"exportEndpoints":{"claude":"/api/rules/oauth-2-1-dpop-nonce-binding-standard?format=claude","cursorMdc":"/api/rules/oauth-2-1-dpop-nonce-binding-standard?format=mdc","cursorrules":"/api/rules/oauth-2-1-dpop-nonce-binding-standard?format=cursor","windsurf":"/api/rules/oauth-2-1-dpop-nonce-binding-standard?format=windsurf","agents":"/api/rules/oauth-2-1-dpop-nonce-binding-standard?format=agents"}},{"id":"otel-streaming-tail-sampling-memory-bound-invariant","title":"OpenTelemetry OTLP Streaming Tail-Sampling Memory Bound Invariant","category":"devops","severity":"critical","description":"Enforces deterministic ring-buffer ceilings, preemptive memory limiter processors, and backpressure-driven probabilistic trace shedding on OpenTelemetry collectors. Prevents catastrophic OOM cascading failovers across collector pools during telemetry bursts and downstream partition events.","antiPatternHeadline":"Unbounded tail-sampling trace buffers without prioritized memory limiter processors or adaptive shedding","stars_count":50,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","observability","tail-sampling","kubernetes","resilience"],"exportEndpoints":{"claude":"/api/rules/otel-streaming-tail-sampling-memory-bound-invariant?format=claude","cursorMdc":"/api/rules/otel-streaming-tail-sampling-memory-bound-invariant?format=mdc","cursorrules":"/api/rules/otel-streaming-tail-sampling-memory-bound-invariant?format=cursor","windsurf":"/api/rules/otel-streaming-tail-sampling-memory-bound-invariant?format=windsurf","agents":"/api/rules/otel-streaming-tail-sampling-memory-bound-invariant?format=agents"}},{"id":"react19-server-actions-closure-boundary-secret-fencing","title":"React 19 Server Actions Closure Boundary & Secret Fencing Standard","category":"frontend","severity":"critical","description":"Enforces strict isolation of privileged execution contexts and environment secrets from React 19 Server Actions and Server Component render trees. Prevents accidental closure capture and automatic serialization across the React Flight wire protocol boundary by mandating decoupled action files, explicit DTO projection, and the 'server-only' package.","antiPatternHeadline":"Capturing Server Secrets, Database Instances, or Sensitive Props in Lexical Closures of Server Actions","stars_count":84,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["react-19","server-actions","rsc","flight-protocol","app-router","security"],"exportEndpoints":{"claude":"/api/rules/react19-server-actions-closure-boundary-secret-fencing?format=claude","cursorMdc":"/api/rules/react19-server-actions-closure-boundary-secret-fencing?format=mdc","cursorrules":"/api/rules/react19-server-actions-closure-boundary-secret-fencing?format=cursor","windsurf":"/api/rules/react19-server-actions-closure-boundary-secret-fencing?format=windsurf","agents":"/api/rules/react19-server-actions-closure-boundary-secret-fencing?format=agents"}},{"id":"nextjs-15-ppr-fallback-isolation-standard","title":"Next.js 15 PPR Shell Isolation and Dynamic Streaming Boundary Standard","category":"frontend","severity":"critical","description":"Enforces deterministic edge delivery of static application shells by strictly isolating dynamic streaming segments within explicit React Suspense boundaries. Prevents runtime dynamic API leaks from de-optimizing Partial Prerendering (PPR) into dynamic SSR and ensures dynamic segment failures do not abort client TTFB.","antiPatternHeadline":"Leaking Dynamic Request APIs into the Static Shell or Omitting Isolated Suspense Fallbacks","stars_count":47,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs-15","partial-prerendering","react-suspense","streaming-ssr","edge-runtime"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-ppr-fallback-isolation-standard?format=claude","cursorMdc":"/api/rules/nextjs-15-ppr-fallback-isolation-standard?format=mdc","cursorrules":"/api/rules/nextjs-15-ppr-fallback-isolation-standard?format=cursor","windsurf":"/api/rules/nextjs-15-ppr-fallback-isolation-standard?format=windsurf","agents":"/api/rules/nextjs-15-ppr-fallback-isolation-standard?format=agents"}},{"id":"fastapi-anyio-structured-taskgroup-boundary","title":"FastAPI 0.115+ AnyIO TaskGroup Structured Concurrency Boundary","category":"backend","severity":"critical","description":"Enforces strict structured concurrency in FastAPI 0.115+ lifespans and background tasks using anyio.create_task_group. Eliminates dangling coroutines and unhandled ExceptionGroups across shutdown cycles by establishing rigid cancellation scopes and exception propagation boundaries.","antiPatternHeadline":"Spawning Unmanaged Background Tasks via asyncio.create_task Inside Lifespans or Endpoints","stars_count":111,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["fastapi","anyio","concurrency","taskgroup","lifespan","asyncio"],"exportEndpoints":{"claude":"/api/rules/fastapi-anyio-structured-taskgroup-boundary?format=claude","cursorMdc":"/api/rules/fastapi-anyio-structured-taskgroup-boundary?format=mdc","cursorrules":"/api/rules/fastapi-anyio-structured-taskgroup-boundary?format=cursor","windsurf":"/api/rules/fastapi-anyio-structured-taskgroup-boundary?format=windsurf","agents":"/api/rules/fastapi-anyio-structured-taskgroup-boundary?format=agents"}},{"id":"bun-websocket-kernel-drain-backpressure-invariant","title":"Bun 1.2 Native WebSocket Kernel Drain and Backpressure Invariant","category":"backend","severity":"critical","description":"Enforces strict backpressure synchronization on Bun 1.2+ native WebSockets by monitoring kernel socket buffer write return values and hooking the native drain lifecycle event. Prevents silent heap exhaustion, uninhibited queue amplification, and process OOM crashes under gigabit-scale broadcast or streaming workloads.","antiPatternHeadline":"Unchecked fire-and-forget ws.send() calls causing unbounded memory buffering during slow client drain","stars_count":87,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","websockets","backpressure","networking","memory-management"],"exportEndpoints":{"claude":"/api/rules/bun-websocket-kernel-drain-backpressure-invariant?format=claude","cursorMdc":"/api/rules/bun-websocket-kernel-drain-backpressure-invariant?format=mdc","cursorrules":"/api/rules/bun-websocket-kernel-drain-backpressure-invariant?format=cursor","windsurf":"/api/rules/bun-websocket-kernel-drain-backpressure-invariant?format=windsurf","agents":"/api/rules/bun-websocket-kernel-drain-backpressure-invariant?format=agents"}},{"id":"capacitor-7-wkwebview-session-isolation-standard","title":"Capacitor 7 WKWebView Process Pool & Cookie Jar Partitioning Standard","category":"mobile","severity":"critical","description":"Enforces strict cookie jar partitioning and process pool isolation in Capacitor 7 iOS runtimes. Prevents cross-origin authentication bleed, session fixation, and credential leakage between embedded third-party OAuth flows and core application runtimes by prohibiting shared WKWebsiteDataStore configurations and mandate-driven ephemeral authentication sessions.","antiPatternHeadline":"Executing Third-Party OAuth via Shared Process Pool WKWebView or Unpartitioned In-App Frames","stars_count":50,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","ios","wkwebview","security","oauth2","session-isolation"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-wkwebview-session-isolation-standard?format=claude","cursorMdc":"/api/rules/capacitor-7-wkwebview-session-isolation-standard?format=mdc","cursorrules":"/api/rules/capacitor-7-wkwebview-session-isolation-standard?format=cursor","windsurf":"/api/rules/capacitor-7-wkwebview-session-isolation-standard?format=windsurf","agents":"/api/rules/capacitor-7-wkwebview-session-isolation-standard?format=agents"}},{"id":"cmp-skiko-vsync-render-loop-synchronization","title":"Compose Multiplatform 1.7 Skiko Render Loop & Hardware VSync Synchronization","category":"mobile","severity":"critical","description":"Enforces strict hardware VSync alignment for Skiko software and hardware-accelerated rasterization across non-JVM native targets such as iOS and macOS. Eliminates multi-buffering desynchronization, micro-stutters, and main-thread rendering stalls by replacing continuous coroutine-based render polling with platform-native display link callbacks and coalesced invalidations.","antiPatternHeadline":"Bypassing Native Hardware VSync with Coroutine Delays or Continuous Polling Redrawers","stars_count":63,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","compose-multiplatform","skiko","metal","ios","vsync","cadisplaylink"],"exportEndpoints":{"claude":"/api/rules/cmp-skiko-vsync-render-loop-synchronization?format=claude","cursorMdc":"/api/rules/cmp-skiko-vsync-render-loop-synchronization?format=mdc","cursorrules":"/api/rules/cmp-skiko-vsync-render-loop-synchronization?format=cursor","windsurf":"/api/rules/cmp-skiko-vsync-render-loop-synchronization?format=windsurf","agents":"/api/rules/cmp-skiko-vsync-render-loop-synchronization?format=agents"}},{"id":"spiffe-spire-dynamic-x509-svid-rotation","title":"SPIFFE/SPIRE 1.10 Dynamic X.509 SVID Rotation and In-Memory mTLS Guardrail","category":"security","severity":"critical","description":"Enforces continuous in-memory rotation of short-lived X.509 SVIDs directly from the SPIFFE Workload API via Unix domain sockets. Eliminates static filesystem credential persistence, avoids process restarts upon identity rotation, and mandates strict peer SPIFFE ID authorizers for zero-trust cross-cluster mTLS.","antiPatternHeadline":"Persisting SVIDs to Disk or Caching Static TLS Configurations Leading to SVID Expiry Outages and Key Leakage","stars_count":43,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","spiffe","spire","mtls","zero-trust","cryptography"],"exportEndpoints":{"claude":"/api/rules/spiffe-spire-dynamic-x509-svid-rotation?format=claude","cursorMdc":"/api/rules/spiffe-spire-dynamic-x509-svid-rotation?format=mdc","cursorrules":"/api/rules/spiffe-spire-dynamic-x509-svid-rotation?format=cursor","windsurf":"/api/rules/spiffe-spire-dynamic-x509-svid-rotation?format=windsurf","agents":"/api/rules/spiffe-spire-dynamic-x509-svid-rotation?format=agents"}},{"id":"otel-baggage-mutation-memory-quarantine","title":"OpenTelemetry 1.35 W3C Baggage Mutation & Memory Quarantine Standard","category":"devops","severity":"critical","description":"Enforces strict bounds, allowlists, and memory quarantine on OpenTelemetry W3C Baggage propagation to eliminate distributed telemetry egress amplification and span memory exhaustion. Prevents unbounded downstream header cascade by enforcing key-length ceilings, total byte budgets, and non-mutating context propagation invariants across distributed spans.","antiPatternHeadline":"Unconstrained baggage mutation and forwarding causing W3C header bloat, trace context exhaustion, and downstream egress amplification attacks.","stars_count":73,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","tracing","distributed-systems","memory-management","security"],"exportEndpoints":{"claude":"/api/rules/otel-baggage-mutation-memory-quarantine?format=claude","cursorMdc":"/api/rules/otel-baggage-mutation-memory-quarantine?format=mdc","cursorrules":"/api/rules/otel-baggage-mutation-memory-quarantine?format=cursor","windsurf":"/api/rules/otel-baggage-mutation-memory-quarantine?format=windsurf","agents":"/api/rules/otel-baggage-mutation-memory-quarantine?format=agents"}},{"id":"ebpf-tailcall-stack-quota-hardening","title":"eBPF Tail-Call Depth and Frame Stack Quota Enforcement","category":"devops","severity":"critical","description":"Enforces strict compile-time and verifier bounds on eBPF BPF-to-BPF function calls, tail calls, and combined stack space to prevent kernel stack overflow and CPU starvation. Mandates per-frame stack usage under 512 bytes, eliminates mutual recursion across prog arrays, and enforces sub-microsecond packet processing budgets on XDP and TC hooks.","antiPatternHeadline":"Unbounded Tail-Call Chains and Oversized Stack Allocations Triggering Verifier Rejection or Kernel Stack Overflow","stars_count":109,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","kernel","networking","c","xdp","linux"],"exportEndpoints":{"claude":"/api/rules/ebpf-tailcall-stack-quota-hardening?format=claude","cursorMdc":"/api/rules/ebpf-tailcall-stack-quota-hardening?format=mdc","cursorrules":"/api/rules/ebpf-tailcall-stack-quota-hardening?format=cursor","windsurf":"/api/rules/ebpf-tailcall-stack-quota-hardening?format=windsurf","agents":"/api/rules/ebpf-tailcall-stack-quota-hardening?format=agents"}},{"id":"react-19-tainted-object-leakage-barrier","title":"React 19 Server Components Taint API Serialization Barrier","category":"frontend","severity":"critical","description":"Guarantees cryptographic secrets, private access tokens, and sensitive raw PII are structurally blocked from crossing the React Server Component (RSC) to Client Component flight serialization boundary. Mandates the explicit application of React 19's experimental_taintUniqueValue and experimental_taintObjectReference at data-access layer boundaries before passing domain entities to rendering pipelines.","antiPatternHeadline":"Passing Untainted Domain Models Containing Secrets or Unhashed PII Across Server-Client Boundaries","stars_count":81,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","nextjs","rsc","security","taint-api"],"exportEndpoints":{"claude":"/api/rules/react-19-tainted-object-leakage-barrier?format=claude","cursorMdc":"/api/rules/react-19-tainted-object-leakage-barrier?format=mdc","cursorrules":"/api/rules/react-19-tainted-object-leakage-barrier?format=cursor","windsurf":"/api/rules/react-19-tainted-object-leakage-barrier?format=windsurf","agents":"/api/rules/react-19-tainted-object-leakage-barrier?format=agents"}},{"id":"nextjs15-ppr-dynamic-io-shell-isolation","title":"Next.js 15 PPR Dynamic IO Shell Isolation Standard","category":"frontend","severity":"critical","description":"Enforces strict architectural boundaries between static prerendered HTML shells and asynchronous streaming promises under Next.js 15 Partial Prerendering (PPR) and Dynamic IO. Prevents synchronous resolution of dynamic operations—such as cookies(), headers(), searchParams, or uncached I/O—outside of explicit Suspense boundaries, eliminating cascading prerender deoptimizations and build-time dynamic bailouts.","antiPatternHeadline":"Leaking Dynamic Server Execution into Root Shell Contexts via Un-Suspended Async Operations","stars_count":74,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs","react-server-components","partial-prerendering","suspense","performance"],"exportEndpoints":{"claude":"/api/rules/nextjs15-ppr-dynamic-io-shell-isolation?format=claude","cursorMdc":"/api/rules/nextjs15-ppr-dynamic-io-shell-isolation?format=mdc","cursorrules":"/api/rules/nextjs15-ppr-dynamic-io-shell-isolation?format=cursor","windsurf":"/api/rules/nextjs15-ppr-dynamic-io-shell-isolation?format=windsurf","agents":"/api/rules/nextjs15-ppr-dynamic-io-shell-isolation?format=agents"}},{"id":"svelte-5-runes-async-graph-tearing-boundary","title":"Svelte 5 Runes Reactive Graph Boundary & Microtask Tearing Prevention","category":"frontend","severity":"critical","description":"Enforces strict synchronous transactional boundaries across Svelte 5 runes ($state, $effect, $derived) during high-throughput event processing. Eliminates race conditions and reactive graph tearing caused by interleaving microtask yields (await) within signal subscription contexts during high-frequency enterprise telemetry streaming.","antiPatternHeadline":"Interleaving Microtask Awaits within $effect Contexts and Discontinuous Multi-Signal Telemetry Mutations","stars_count":43,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","reactive-graph","telemetry","state-tearing"],"exportEndpoints":{"claude":"/api/rules/svelte-5-runes-async-graph-tearing-boundary?format=claude","cursorMdc":"/api/rules/svelte-5-runes-async-graph-tearing-boundary?format=mdc","cursorrules":"/api/rules/svelte-5-runes-async-graph-tearing-boundary?format=cursor","windsurf":"/api/rules/svelte-5-runes-async-graph-tearing-boundary?format=windsurf","agents":"/api/rules/svelte-5-runes-async-graph-tearing-boundary?format=agents"}},{"id":"bun-sqlite-wal2-checkpoint-concurrency-standard","title":"Bun 1.2 Native SQLite WAL2 Multi-Worker Checkpoint Concurrency Standard","category":"backend","severity":"critical","description":"Enforces deterministic multi-threaded SQLite access in Bun 1.2 using dual-log WAL2 mode with isolated worker connection pools. Prevents read-lock starvation and WAL file bloat during microsecond-latency event-sourcing ingest by isolating checkpoint operations to an autonomous maintenance worker.","antiPatternHeadline":"Inline Checkpointing and Standard WAL Reader Starvation in Shared SQLite Worker Threads","stars_count":105,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","sqlite","wal2","concurrency","workers","event-sourcing"],"exportEndpoints":{"claude":"/api/rules/bun-sqlite-wal2-checkpoint-concurrency-standard?format=claude","cursorMdc":"/api/rules/bun-sqlite-wal2-checkpoint-concurrency-standard?format=mdc","cursorrules":"/api/rules/bun-sqlite-wal2-checkpoint-concurrency-standard?format=cursor","windsurf":"/api/rules/bun-sqlite-wal2-checkpoint-concurrency-standard?format=windsurf","agents":"/api/rules/bun-sqlite-wal2-checkpoint-concurrency-standard?format=agents"}},{"id":"go-chi-quic-0rtt-anti-replay-barrier","title":"Go Chi HTTP/3 0-RTT Anti-Replay Idempotency Barrier","category":"backend","severity":"critical","description":"Enforces a cryptographic sliding-window verification barrier and strict idempotency checks on HTTP/3 (QUIC) Early Data requests in Go Chi services. Eliminates replay attack vectors before unvalidated 0-RTT payloads reach application handlers, preventing state-mutating double-execution.","antiPatternHeadline":"Exposing mutating or unvalidated handlers to raw HTTP/3 0-RTT Early Data without cryptographic replay detection","stars_count":42,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","chi","quic","http3","security","replay-attack","zero-rtt"],"exportEndpoints":{"claude":"/api/rules/go-chi-quic-0rtt-anti-replay-barrier?format=claude","cursorMdc":"/api/rules/go-chi-quic-0rtt-anti-replay-barrier?format=mdc","cursorrules":"/api/rules/go-chi-quic-0rtt-anti-replay-barrier?format=cursor","windsurf":"/api/rules/go-chi-quic-0rtt-anti-replay-barrier?format=windsurf","agents":"/api/rules/go-chi-quic-0rtt-anti-replay-barrier?format=agents"}},{"id":"android-15-16kb-page-alignment-guardrail","title":"Android 15 Native Shared Object 16KB Page-Size Alignment Invariant","category":"mobile","severity":"critical","description":"Android 15 introduces runtime support for 16KB physical page sizes, deprecating legacy 4KB-only kernel assumptions across ARM64 and x86_64 targets. Any native shared library (.so) packaged without strict 16KB ELF segment alignment fails linker load verification, triggering fatal SIGSEGV crashes and dynamic linker aborts upon dlopen. This guardrail mandates minimum NDK r27+ toolchains, explicit -Wl,-z,max-page-size=16384 linker flags across all build layers, and automated verification before APK/AAB packaging.","antiPatternHeadline":"Shipping 4KB-Aligned Native Binaries Triggering Silent Linker Aborts and SIGSEGV on 16KB Android 15 Runtimes","stars_count":61,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","android","android-15","ndk","c-plus-plus","cmake","memory-alignment","page-size"],"exportEndpoints":{"claude":"/api/rules/android-15-16kb-page-alignment-guardrail?format=claude","cursorMdc":"/api/rules/android-15-16kb-page-alignment-guardrail?format=mdc","cursorrules":"/api/rules/android-15-16kb-page-alignment-guardrail?format=cursor","windsurf":"/api/rules/android-15-16kb-page-alignment-guardrail?format=windsurf","agents":"/api/rules/android-15-16kb-page-alignment-guardrail?format=agents"}},{"id":"kotlin-wasm-canvaskit-context-confinement","title":"Kotlin Wasm-GC CanvasKit Context Confinement & Linear Memory Teardown","category":"mobile","severity":"critical","description":"Enforces strict lexical lifecycle confinement and deterministic teardown for Skiko/CanvasKit native backing resources within Kotlin Wasm-GC runtimes. WebAssembly Garbage Collection collects managed references but does not trace or reclaim CanvasKit C++ linear memory allocations, causing unbounded cross-heap memory leaks during high-refresh multiplatform canvas rendering.","antiPatternHeadline":"Leaking CanvasKit C++ Linear Memory via Unscoped Wasm-GC Allocation in Render Loops","stars_count":90,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-wasm","canvaskit","skiko","memory-leak","wasm-gc","compose-multiplatform"],"exportEndpoints":{"claude":"/api/rules/kotlin-wasm-canvaskit-context-confinement?format=claude","cursorMdc":"/api/rules/kotlin-wasm-canvaskit-context-confinement?format=mdc","cursorrules":"/api/rules/kotlin-wasm-canvaskit-context-confinement?format=cursor","windsurf":"/api/rules/kotlin-wasm-canvaskit-context-confinement?format=windsurf","agents":"/api/rules/kotlin-wasm-canvaskit-context-confinement?format=agents"}},{"id":"openfga-contextual-tuple-cycle-interceptor","title":"Mandatory Contextual Tuple DAG Cycle Detection and Traversal Deadlines in OpenFGA","category":"security","severity":"critical","description":"Contextual tuples passed dynamically into OpenFGA authorization checks can introduce cyclic relationships and deep recursive graphs that cause algorithmic denial-of-service (ReDoS/Graph DoS) and thread starvation. Authorization services must enforce pre-dispatch directed acyclic graph (DAG) cycle interception and strict, non-negotiable evaluation timeouts on every recursive check call.","antiPatternHeadline":"Unchecked Runtime Contextual Tuples Injected Directly into OpenFGA Check Calls Causing Recursive Graph Loops","stars_count":90,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","authorization","graph-algorithms","dos-prevention","contextual-tuples"],"exportEndpoints":{"claude":"/api/rules/openfga-contextual-tuple-cycle-interceptor?format=claude","cursorMdc":"/api/rules/openfga-contextual-tuple-cycle-interceptor?format=mdc","cursorrules":"/api/rules/openfga-contextual-tuple-cycle-interceptor?format=cursor","windsurf":"/api/rules/openfga-contextual-tuple-cycle-interceptor?format=windsurf","agents":"/api/rules/openfga-contextual-tuple-cycle-interceptor?format=agents"}},{"id":"k8s-gateway-api-referencegrant-strict-boundary-standard","title":"Strict Mutual-Handshake ReferenceGrant Cross-Namespace Ingress Boundary Standard","category":"devops","severity":"critical","description":"Enforces deterministic, mutual-handshake ReferenceGrant authorization across all Kubernetes Gateway API cross-namespace route bindings and backend references. Prevents unauthorized ingress path hijacking and cross-tenant traffic interception by mandating explicit cryptographic or granular administrative consent on both ends of cross-namespace relationships.","antiPatternHeadline":"Attaching Cross-Namespace Routes or Backend References Without Explicit Mutual ReferenceGrant Authorization","stars_count":41,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","kubernetes","gateway-api","security","multi-tenancy","referencegrant","zero-trust"],"exportEndpoints":{"claude":"/api/rules/k8s-gateway-api-referencegrant-strict-boundary-standard?format=claude","cursorMdc":"/api/rules/k8s-gateway-api-referencegrant-strict-boundary-standard?format=mdc","cursorrules":"/api/rules/k8s-gateway-api-referencegrant-strict-boundary-standard?format=cursor","windsurf":"/api/rules/k8s-gateway-api-referencegrant-strict-boundary-standard?format=windsurf","agents":"/api/rules/k8s-gateway-api-referencegrant-strict-boundary-standard?format=agents"}},{"id":"nextjs-15-ppr-fallback-isolation-fence","title":"Next.js 15 Partial Prerendering (PPR) Fallback Isolation Fence","category":"frontend","severity":"critical","description":"Enforces strict isolation fences between static prerender shells and dynamic micro-segments under Next.js 15 Partial Prerendering (PPR). Guarantees dynamic runtime execution (cookies, headers, non-deterministic database access) is sequestered behind explicit React Suspense boundaries with pure, static skeleton fallbacks, ensuring instant edge shell transmission without dynamic pipeline stalling.","antiPatternHeadline":"Leaking Dynamic Accessors to Root Scope or Polluting Fallbacks with Uncached Dynamic State","stars_count":69,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs","nextjs-15","ppr","react-server-components","suspense","performance"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-ppr-fallback-isolation-fence?format=claude","cursorMdc":"/api/rules/nextjs-15-ppr-fallback-isolation-fence?format=mdc","cursorrules":"/api/rules/nextjs-15-ppr-fallback-isolation-fence?format=cursor","windsurf":"/api/rules/nextjs-15-ppr-fallback-isolation-fence?format=windsurf","agents":"/api/rules/nextjs-15-ppr-fallback-isolation-fence?format=agents"}},{"id":"go-chi-h2-bounded-stream-multiplexing","title":"Go 1.24 Chi Coroutine-Bounded HTTP/2 Stream Multiplexing Invariant","category":"backend","severity":"critical","description":"Enforces bounded execution rings and strict stream concurrency limits on Go 1.24 Chi HTTP/2 ingress handlers. Mitigates goroutine heap inflation and socket starvation during saturated multiplexed ingress by restricting in-flight stream execution through backpressure-aware worker pools and semaphore rings.","antiPatternHeadline":"Unbounded Per-Stream Goroutine Spawning Under Saturated HTTP/2 Transport Ingress","stars_count":46,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","chi","http2","concurrency","memory-leak","backpressure"],"exportEndpoints":{"claude":"/api/rules/go-chi-h2-bounded-stream-multiplexing?format=claude","cursorMdc":"/api/rules/go-chi-h2-bounded-stream-multiplexing?format=mdc","cursorrules":"/api/rules/go-chi-h2-bounded-stream-multiplexing?format=cursor","windsurf":"/api/rules/go-chi-h2-bounded-stream-multiplexing?format=windsurf","agents":"/api/rules/go-chi-h2-bounded-stream-multiplexing?format=agents"}},{"id":"bun-sqlite-wal-concurrent-snapshot-barrier","title":"Bun 1.2 Embedded SQLite WAL Concurrent Snapshot Barrier & Checkpoint Isolation","category":"backend","severity":"critical","description":"Enforces strict snapshot barrier boundaries and deterministic WAL (Write-Ahead Logging) checkpoint synchronization across multi-threaded or isolated Bun worker processes sharing embedded SQLite storage. Prevents unbounded WAL frame expansion, SQLITE_BUSY lock contention, and read-lock checkpoint starvation by establishing explicit transaction scopes, optimal PRAGMAs, and barrier-isolated checkpoint scheduling.","antiPatternHeadline":"Uncoordinated Multi-Worker SQLite Access with Passive Checkpoint Starvation and Long-Lived Ambient Transactions","stars_count":69,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","sqlite","wal","concurrency","multithreading","database"],"exportEndpoints":{"claude":"/api/rules/bun-sqlite-wal-concurrent-snapshot-barrier?format=claude","cursorMdc":"/api/rules/bun-sqlite-wal-concurrent-snapshot-barrier?format=mdc","cursorrules":"/api/rules/bun-sqlite-wal-concurrent-snapshot-barrier?format=cursor","windsurf":"/api/rules/bun-sqlite-wal-concurrent-snapshot-barrier?format=windsurf","agents":"/api/rules/bun-sqlite-wal-concurrent-snapshot-barrier?format=agents"}},{"id":"postgres-17-direct-io-analytical-scan-guardrail","title":"Postgres 17 Direct I/O and Buffer Ring Invariant for Analytical Scans","category":"backend","severity":"critical","description":"Enforces architectural isolation and Direct I/O bypass for high-throughput sequential scans in PostgreSQL 17. Prevents cold analytical batch reads from thrashing shared_buffers and evicting high-frequency OLTP working sets and active B-tree index pages.","antiPatternHeadline":"Polluting Shared Buffer Pool via Unbounded Analytical Sequential Scans on OLTP Instances","stars_count":110,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","postgres-17","direct-io","buffer-cache","oltp"],"exportEndpoints":{"claude":"/api/rules/postgres-17-direct-io-analytical-scan-guardrail?format=claude","cursorMdc":"/api/rules/postgres-17-direct-io-analytical-scan-guardrail?format=mdc","cursorrules":"/api/rules/postgres-17-direct-io-analytical-scan-guardrail?format=cursor","windsurf":"/api/rules/postgres-17-direct-io-analytical-scan-guardrail?format=windsurf","agents":"/api/rules/postgres-17-direct-io-analytical-scan-guardrail?format=agents"}},{"id":"openfga-consistency-token-monotonic-read-fence","title":"OpenFGA Monotonic Read Fence and Consistency Token Propagation","category":"security","severity":"critical","description":"Enforces strict monotonic read consistency fences on OpenFGA authorization checks following relationship tuple mutations. Prevents transient authorization bypasses, permission leakage, and stale evaluation states across distributed database read replicas by mandating write-to-read consistency token propagation or HIGHER_CONSISTENCY read policies.","antiPatternHeadline":"Executing un-fenced authorization checks or default MINIMIZE_LATENCY reads immediately after relationship tuple mutations","stars_count":79,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","rebac","zanzibar","distributed-systems","consistency"],"exportEndpoints":{"claude":"/api/rules/openfga-consistency-token-monotonic-read-fence?format=claude","cursorMdc":"/api/rules/openfga-consistency-token-monotonic-read-fence?format=mdc","cursorrules":"/api/rules/openfga-consistency-token-monotonic-read-fence?format=cursor","windsurf":"/api/rules/openfga-consistency-token-monotonic-read-fence?format=windsurf","agents":"/api/rules/openfga-consistency-token-monotonic-read-fence?format=agents"}},{"id":"webauthn-prf-memory-fence-production-standard","title":"Mandatory Memory Fencing and Immediate Zeroization for WebAuthn PRF Secrets","category":"security","severity":"critical","description":"Enforces deterministic client-side memory scrubbing and scope isolation for raw cryptographic key material derived via WebAuthn PRF (Pseudo-Random Function) extensions. Requires in-place zeroization of typed arrays immediately post-derivation within strict try-finally blocks to prevent FIDO2 hardware-derived keys from lingering across the V8 garbage-collected heap. Mandates importing ephemeral symmetric keys as non-extractable WebCrypto handles before scrubbing the underlying buffers.","antiPatternHeadline":"Leaking Raw WebAuthn PRF Outputs into Heap Memory via Immutable Strings and Unzeroed Buffers","stars_count":83,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","fido2","prf","memory-zeroization","webcrypto"],"exportEndpoints":{"claude":"/api/rules/webauthn-prf-memory-fence-production-standard?format=claude","cursorMdc":"/api/rules/webauthn-prf-memory-fence-production-standard?format=mdc","cursorrules":"/api/rules/webauthn-prf-memory-fence-production-standard?format=cursor","windsurf":"/api/rules/webauthn-prf-memory-fence-production-standard?format=windsurf","agents":"/api/rules/webauthn-prf-memory-fence-production-standard?format=agents"}},{"id":"capacitor-7-biometric-hardware-attestation-gate","title":"Hardware-Attested Biometric Bridge Gate for Capacitor 7 Native-Web IPC","category":"mobile","severity":"critical","description":"Mandates per-call cryptographic hardware attestation tokens across Capacitor 7 native-to-web bridge invocations. Replaces vulnerable boolean bridge payloads with hardware-signed nonces generated inside Apple Secure Enclave or Android StrongBox KeyStore to completely neutralize runtime memory injection and Frida bridge hooking.","antiPatternHeadline":"Returning Unsigned Boolean State Across Capacitor Native Bridge Vulnerable to Runtime Hooking and Memory Modification","stars_count":45,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","security","biometrics","cryptography","zero-trust"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-biometric-hardware-attestation-gate?format=claude","cursorMdc":"/api/rules/capacitor-7-biometric-hardware-attestation-gate?format=mdc","cursorrules":"/api/rules/capacitor-7-biometric-hardware-attestation-gate?format=cursor","windsurf":"/api/rules/capacitor-7-biometric-hardware-attestation-gate?format=windsurf","agents":"/api/rules/capacitor-7-biometric-hardware-attestation-gate?format=agents"}},{"id":"kmp-skiko-vsync-renderloop-sync-guardrail","title":"Deterministic Skiko RenderLoop Hardware VSync Synchronization Guardrail","category":"mobile","severity":"critical","description":"Enforces hardware-aligned vsync tick dispatching across iOS CADisplayLink and Android Choreographer within Compose Multiplatform Skiko render pipelines. Mandates explicit monotonic frame-clock binding to prevent coroutine-based delay drift, phase jitter, and double-buffering tearing. Eliminates non-deterministic render cycles by locking Skia Canvas flushes strictly to hardware display refresh intervals.","antiPatternHeadline":"Synthetic Coroutine Delay Pacing Bypassing Hardware VSync Clocks","stars_count":88,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","compose-multiplatform","kmp","skiko","cadisplaylink","choreographer","rendering"],"exportEndpoints":{"claude":"/api/rules/kmp-skiko-vsync-renderloop-sync-guardrail?format=claude","cursorMdc":"/api/rules/kmp-skiko-vsync-renderloop-sync-guardrail?format=mdc","cursorrules":"/api/rules/kmp-skiko-vsync-renderloop-sync-guardrail?format=cursor","windsurf":"/api/rules/kmp-skiko-vsync-renderloop-sync-guardrail?format=windsurf","agents":"/api/rules/kmp-skiko-vsync-renderloop-sync-guardrail?format=agents"}},{"id":"otel-genai-semantic-conventions-production-standard","title":"OpenTelemetry GenAI Semantic Convention and Non-Blocking Stream Attribution Standard","category":"devops","severity":"critical","description":"Enforces OpenTelemetry GenAI semantic conventions across multi-agent orchestrations, mandating deterministic capture of model provenance, execution context, and token usage. Requires stream wrappers using non-buffering async generator taps to record usage metrics and complete parent/child spans without inducing I/O backpressure or latency spikes.","antiPatternHeadline":"Buffering LLM output streams in memory or omitting GenAI semantic attributes leads to latency bottlenecks and untraceable inference costs.","stars_count":91,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","observability","genai","llm-orchestration","distributed-tracing","token-metrics"],"exportEndpoints":{"claude":"/api/rules/otel-genai-semantic-conventions-production-standard?format=claude","cursorMdc":"/api/rules/otel-genai-semantic-conventions-production-standard?format=mdc","cursorrules":"/api/rules/otel-genai-semantic-conventions-production-standard?format=cursor","windsurf":"/api/rules/otel-genai-semantic-conventions-production-standard?format=windsurf","agents":"/api/rules/otel-genai-semantic-conventions-production-standard?format=agents"}},{"id":"postgres-17-failover-slot-sync-invariant-postgres-17-fail-725","title":"Postgres 17 Logical Replication Failover Slot Synchronization Guardrail","category":"backend","severity":"critical","description":"Enforces failover-ready logical replication architectures on PostgreSQL 17+ by mandating synchronized replication slots (`sync_replication_slots = true`), physical standby slot retention (`standby_slot_names`), and persistent `failover = true` creation flags. This architectural invariant eliminates data loss, duplicate stream processing, and expensive full-table resynchronizations when downstream logical subscribers transition across promoted physical standby replicas during primary node failover.","antiPatternHeadline":"Unsynchronized Logical Slots and Missing Standby Slot Coordinates Leading to Broken Replication Streams on Failover","stars_count":115,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres","postgres-17","logical-replication","failover-slots","cdc","database-reliability"],"exportEndpoints":{"claude":"/api/rules/postgres-17-failover-slot-sync-invariant-postgres-17-fail-725?format=claude","cursorMdc":"/api/rules/postgres-17-failover-slot-sync-invariant-postgres-17-fail-725?format=mdc","cursorrules":"/api/rules/postgres-17-failover-slot-sync-invariant-postgres-17-fail-725?format=cursor","windsurf":"/api/rules/postgres-17-failover-slot-sync-invariant-postgres-17-fail-725?format=windsurf","agents":"/api/rules/postgres-17-failover-slot-sync-invariant-postgres-17-fail-725?format=agents"}},{"id":"nextjs-15-async-request-lifecycle-after-boundary-standard","title":"Next.js 15 Async Request Lifecycle & Bounded next/after Execution Guardrail","category":"frontend","severity":"critical","description":"Enforces deterministic post-response task scheduling in Next.js 15 Route Handlers and Server Actions using the official next/after execution boundary. Prevents premature runtime suspension in serverless environments, unhandled promise rejections, memory/socket leaks, and artificial TTFB inflation caused by running auxiliary workloads in the critical rendering path.","antiPatternHeadline":"Unbounded Floating Promises and Blocking Auxiliary Workloads in Request Paths","stars_count":46,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs","nextjs-15","async-lifecycle","next-after","serverless","performance"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-async-request-lifecycle-after-boundary-standard?format=claude","cursorMdc":"/api/rules/nextjs-15-async-request-lifecycle-after-boundary-standard?format=mdc","cursorrules":"/api/rules/nextjs-15-async-request-lifecycle-after-boundary-standard?format=cursor","windsurf":"/api/rules/nextjs-15-async-request-lifecycle-after-boundary-standard?format=windsurf","agents":"/api/rules/nextjs-15-async-request-lifecycle-after-boundary-standard?format=agents"}},{"id":"kmp-swift-arc-concurrent-gc-memory-guardrail","title":"Kotlin Multiplatform 2.1 Concurrent GC & Swift ARC Boundary Guardrail","category":"mobile","severity":"critical","description":"Enforces strict memory isolation and lifecycle management across the Kotlin/Native Concurrent Mark-Sweep (CMS) GC and Apple Swift Automatic Reference Counting (ARC) boundary. Prevents cross-runtime cyclic retain graphs, dangling C-bridge pointers, and cross-thread deallocation panics during asynchronous state observation. Mandates explicit boundary nullification, weak bridge references, and MainActor-confined listener disposal.","antiPatternHeadline":"Bidirectional Strong References Across KMP-Swift Bridge Causing Silent Native Heap Exhaustion","stars_count":107,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","swift","arc","native-gc","concurrency"],"exportEndpoints":{"claude":"/api/rules/kmp-swift-arc-concurrent-gc-memory-guardrail?format=claude","cursorMdc":"/api/rules/kmp-swift-arc-concurrent-gc-memory-guardrail?format=mdc","cursorrules":"/api/rules/kmp-swift-arc-concurrent-gc-memory-guardrail?format=cursor","windsurf":"/api/rules/kmp-swift-arc-concurrent-gc-memory-guardrail?format=windsurf","agents":"/api/rules/kmp-swift-arc-concurrent-gc-memory-guardrail?format=agents"}},{"id":"hybrid-post-quantum-tls-x25519mlkem768-enforcement","title":"Strict Hybrid Post-Quantum TLS 1.3 (X25519MLKEM768) Key-Exchange Enforcement","category":"security","severity":"critical","description":"Enforces TLS 1.3 with NIST FIPS 203 hybrid quantum-resistant key encapsulation (X25519MLKEM768) across all ingress edge gateways and network termination layers. Eliminates exposure to Harvest-Now-Decrypt-Later (HNDL) attacks by banning legacy TLS versions and classical-only elliptic curves on perimeter ingress routes.","antiPatternHeadline":"Permitting Classical-Only Key Exchange or Sub-TLS 1.3 Protocols on Ingress Infrastructure","stars_count":73,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","post-quantum","tls-1.3","ml-kem","x25519mlkem768","hndl-mitigation","cryptography"],"exportEndpoints":{"claude":"/api/rules/hybrid-post-quantum-tls-x25519mlkem768-enforcement?format=claude","cursorMdc":"/api/rules/hybrid-post-quantum-tls-x25519mlkem768-enforcement?format=mdc","cursorrules":"/api/rules/hybrid-post-quantum-tls-x25519mlkem768-enforcement?format=cursor","windsurf":"/api/rules/hybrid-post-quantum-tls-x25519mlkem768-enforcement?format=windsurf","agents":"/api/rules/hybrid-post-quantum-tls-x25519mlkem768-enforcement?format=agents"}},{"id":"otel-tail-sampling-memory-pressure-guardrail","title":"OpenTelemetry Tail-Based Sampling Bounded Buffer and Memory Eviction Invariant","category":"devops","severity":"critical","description":"Enforces strict memory limits and deterministic eviction fallbacks across OpenTelemetry Collector deployments running tail-based sampling processors. Tail-based sampling requires buffering spans in-memory until trace completion; unconstrained trace buffers or misconfigured memory ballast processors under high traffic bursts trigger catastrophic out-of-memory (OOM) kills. This rule mandates pre-allocated bounds, memory limiter processor placement, trace wait-time caps, and fallback sampling routes to ensure collector tier resilience.","antiPatternHeadline":"Unbounded Trace In-Memory Buffers and Missing Memory Limiter Triggering Collector OOMs During Traffic Surges","stars_count":47,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","observability","tail-sampling","resilience","collector"],"exportEndpoints":{"claude":"/api/rules/otel-tail-sampling-memory-pressure-guardrail?format=claude","cursorMdc":"/api/rules/otel-tail-sampling-memory-pressure-guardrail?format=mdc","cursorrules":"/api/rules/otel-tail-sampling-memory-pressure-guardrail?format=cursor","windsurf":"/api/rules/otel-tail-sampling-memory-pressure-guardrail?format=windsurf","agents":"/api/rules/otel-tail-sampling-memory-pressure-guardrail?format=agents"}},{"id":"react-19-rsc-dynamic-io-boundary-serialization","title":"React 19 RSC Dynamic I/O Boundary & Microtask Serialization Invariant","category":"frontend","severity":"critical","description":"Enforces strict isolation between static prerendering phases and dynamic user context access under React 19 Dynamic I/O semantics. Prevents cross-tenant context leakage and cache poisoning by guaranteeing dynamic primitives are partitioned inside Suspense microtask boundaries.","antiPatternHeadline":"Dynamic Authentication and Header Access Leaking into Static RSC Prerender Artifacts","stars_count":42,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","rsc","nextjs","dynamic-io","security","microtasks"],"exportEndpoints":{"claude":"/api/rules/react-19-rsc-dynamic-io-boundary-serialization?format=claude","cursorMdc":"/api/rules/react-19-rsc-dynamic-io-boundary-serialization?format=mdc","cursorrules":"/api/rules/react-19-rsc-dynamic-io-boundary-serialization?format=cursor","windsurf":"/api/rules/react-19-rsc-dynamic-io-boundary-serialization?format=windsurf","agents":"/api/rules/react-19-rsc-dynamic-io-boundary-serialization?format=agents"}},{"id":"capacitor-7-hsm-webkit-bridge-isolation","title":"Capacitor 7 HSM WebKit Bridge Cryptographic Boundary Isolation","category":"mobile","severity":"critical","description":"Hardware-backed cryptographic keys generated in the iOS Secure Enclave and Android Keystore must never cross the WebKit bridge serialization boundary into the JavaScript runtime. All signing, verification, and key lifecycle operations must be executed natively within isolated Capacitor plugins using opaque key aliases, digest payloads, and zeroed native buffers.","antiPatternHeadline":"Exporting raw private key material or seeds across the Capacitor WebKit IPC bridge into JavaScript runtime memory","stars_count":89,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","security","cryptography","secure-enclave","keystore"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-hsm-webkit-bridge-isolation?format=claude","cursorMdc":"/api/rules/capacitor-7-hsm-webkit-bridge-isolation?format=mdc","cursorrules":"/api/rules/capacitor-7-hsm-webkit-bridge-isolation?format=cursor","windsurf":"/api/rules/capacitor-7-hsm-webkit-bridge-isolation?format=windsurf","agents":"/api/rules/capacitor-7-hsm-webkit-bridge-isolation?format=agents"}},{"id":"bun-sqlite-wal-concurrency-isolation-standard","title":"Bun 1.2 Native SQLite Concurrency, WAL Mode, and Checkpoint Isolation Standard","category":"backend","severity":"critical","description":"Enforces deterministic SQLite concurrency settings on Bun 1.2 runtimes by mandating Write-Ahead Logging (WAL), busy timeout thresholds, immediate transaction semantics, and background checkpoint management. This prevents write-lock starvation (SQLITE_BUSY) and unbounded WAL journal bloat during concurrent edge operations.","antiPatternHeadline":"Unconfigured Rollback Journals with Deferred Transaction Escalation and Unmonitored WAL Growth","stars_count":61,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","sqlite","wal","concurrency","edge-runtime"],"exportEndpoints":{"claude":"/api/rules/bun-sqlite-wal-concurrency-isolation-standard?format=claude","cursorMdc":"/api/rules/bun-sqlite-wal-concurrency-isolation-standard?format=mdc","cursorrules":"/api/rules/bun-sqlite-wal-concurrency-isolation-standard?format=cursor","windsurf":"/api/rules/bun-sqlite-wal-concurrency-isolation-standard?format=windsurf","agents":"/api/rules/bun-sqlite-wal-concurrency-isolation-standard?format=agents"}},{"id":"cedar-policy-deterministic-evaluation-schema-drift-guardrail","title":"Cedar Policy Engine Deterministic Partial Evaluation & Schema Drift Invariants","category":"security","severity":"critical","description":"Mandates compile-time AST verification, strict cryptographic schema hash binding, and deterministic partial evaluation for the Cedar Policy Engine across distributed services. Eliminates runtime authorization panics, schema drift vulnerabilities, and network I/O regressions in sub-millisecond evaluation paths.","antiPatternHeadline":"Dynamic Cedar String Interpolation and Unsynchronized Distributed Schema Evolution","stars_count":112,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","cedar-policy","authorization","abac","partial-evaluation","schema-drift","distributed-systems"],"exportEndpoints":{"claude":"/api/rules/cedar-policy-deterministic-evaluation-schema-drift-guardrail?format=claude","cursorMdc":"/api/rules/cedar-policy-deterministic-evaluation-schema-drift-guardrail?format=mdc","cursorrules":"/api/rules/cedar-policy-deterministic-evaluation-schema-drift-guardrail?format=cursor","windsurf":"/api/rules/cedar-policy-deterministic-evaluation-schema-drift-guardrail?format=windsurf","agents":"/api/rules/cedar-policy-deterministic-evaluation-schema-drift-guardrail?format=agents"}},{"id":"go-chi-zero-allocation-context-lifecycle-guardrail","title":"Go Chi Context Lifecycle and sync.Pool Cross-Request Memory Leak Prevention","category":"backend","severity":"critical","description":"Enforces strict context decoupling and allocation controls when routing with go-chi/chi/v5 in ultra-high-throughput Go microservices. Prevents severe data races and memory contamination stemming from chi's internal sync.Pool context reuse when goroutines outlive the HTTP request lifecycle.","antiPatternHeadline":"Retaining or Spawning Goroutines with Raw Chi Request Context Causing sync.Pool Data Race and Memory Contamination","stars_count":96,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","chi","concurrency","performance","memory-management"],"exportEndpoints":{"claude":"/api/rules/go-chi-zero-allocation-context-lifecycle-guardrail?format=claude","cursorMdc":"/api/rules/go-chi-zero-allocation-context-lifecycle-guardrail?format=mdc","cursorrules":"/api/rules/go-chi-zero-allocation-context-lifecycle-guardrail?format=cursor","windsurf":"/api/rules/go-chi-zero-allocation-context-lifecycle-guardrail?format=windsurf","agents":"/api/rules/go-chi-zero-allocation-context-lifecycle-guardrail?format=agents"}},{"id":"svelte-5-runes-hydration-boundary-guardrail","title":"Deterministic Hydration Boundaries and Effect Teardowns in Svelte 5 Runes","category":"frontend","severity":"critical","description":"Enforces synchronous effect cleanup registration and strict asynchronous signal tracking boundaries within Svelte 5 reactive graphs during SSR streaming and client hydration. Prevents memory leaks, uncollected reactive scopes, and microtask cascade loops caused by async effects returning Promises rather than deterministic teardown functions.","antiPatternHeadline":"Asynchronous Effect Initialization Bypassing Synchronous Teardown and Leaking Reactive Signal Graphs","stars_count":66,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte-5","runes","reactivity","hydration","memory-leaks"],"exportEndpoints":{"claude":"/api/rules/svelte-5-runes-hydration-boundary-guardrail?format=claude","cursorMdc":"/api/rules/svelte-5-runes-hydration-boundary-guardrail?format=mdc","cursorrules":"/api/rules/svelte-5-runes-hydration-boundary-guardrail?format=cursor","windsurf":"/api/rules/svelte-5-runes-hydration-boundary-guardrail?format=windsurf","agents":"/api/rules/svelte-5-runes-hydration-boundary-guardrail?format=agents"}},{"id":"axum-0-8-tokio-graceful-drain-fencing","title":"Axum 0.8 Tokio Graceful Drain and In-Flight Request Cancellation Fencing","category":"backend","severity":"critical","description":"Guarantees deterministic zero-downtime rolling deployments in Axum 0.8 by coordinating TCP socket shutdown deadlines with hierarchical Tokio task cancellation fences. Eliminates connection drops, half-closed socket leaks, and uncommitted database writes during SIGTERM lifecycle phases.","antiPatternHeadline":"Unbounded Process Exit via Detached Tokio Spawns and Unshielded Axum Shutdown Signals","stars_count":69,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tokio","graceful-shutdown","concurrency"],"exportEndpoints":{"claude":"/api/rules/axum-0-8-tokio-graceful-drain-fencing?format=claude","cursorMdc":"/api/rules/axum-0-8-tokio-graceful-drain-fencing?format=mdc","cursorrules":"/api/rules/axum-0-8-tokio-graceful-drain-fencing?format=cursor","windsurf":"/api/rules/axum-0-8-tokio-graceful-drain-fencing?format=windsurf","agents":"/api/rules/axum-0-8-tokio-graceful-drain-fencing?format=agents"}},{"id":"postgres-17-direct-io-streaming-read-saturation-guardrail","title":"Postgres 17 Direct I/O and Streaming Read Buffer Saturation Guardrail","category":"backend","severity":"critical","description":"Enforces strict concurrency, prefetch limits, and pool isolation on Postgres 17 streaming reads and Direct I/O operations. Prevents aggressive asynchronous read-ahead routines from saturating kernel I/O pipelines, triggering shared buffer eviction cascades, and starving latency-critical OLTP transactions. Ensures analytical or bulk scans apply session-level prefetch throttling and bypass primary OLTP connection pools.","antiPatternHeadline":"Unbounded Streaming Sequential Scans Evicting Hot OLTP Shared Buffers and Saturating Disk I/O","stars_count":81,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres-17","direct-io","streaming-reads","buffer-cache","database-performance"],"exportEndpoints":{"claude":"/api/rules/postgres-17-direct-io-streaming-read-saturation-guardrail?format=claude","cursorMdc":"/api/rules/postgres-17-direct-io-streaming-read-saturation-guardrail?format=mdc","cursorrules":"/api/rules/postgres-17-direct-io-streaming-read-saturation-guardrail?format=cursor","windsurf":"/api/rules/postgres-17-direct-io-streaming-read-saturation-guardrail?format=windsurf","agents":"/api/rules/postgres-17-direct-io-streaming-read-saturation-guardrail?format=agents"}},{"id":"openfga-temporal-expiration-cdc-consistency-standard","title":"OpenFGA Temporal Tuple Expiration and CDC Stream Consistency Standard","category":"backend","severity":"critical","description":"Guarantees zero-lag authorization decisions by synchronizing short-lived contextual access grants with transactional Change Data Capture (CDC) invalidation events. Eliminates race conditions between transactional database state changes and OpenFGA authorization checks by enforcing transactional outbox patterns, context-driven condition validation, and idempotent stream reconciliation.","antiPatternHeadline":"Asynchronous direct OpenFGA writes bypassing transactional boundaries or relying on background polling for tuple revocation","stars_count":50,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","openfga","authorization","cdc","kafka","debezium","fine-grained-access-control"],"exportEndpoints":{"claude":"/api/rules/openfga-temporal-expiration-cdc-consistency-standard?format=claude","cursorMdc":"/api/rules/openfga-temporal-expiration-cdc-consistency-standard?format=mdc","cursorrules":"/api/rules/openfga-temporal-expiration-cdc-consistency-standard?format=cursor","windsurf":"/api/rules/openfga-temporal-expiration-cdc-consistency-standard?format=windsurf","agents":"/api/rules/openfga-temporal-expiration-cdc-consistency-standard?format=agents"}},{"id":"kmp-native-arc-to-gc-cycle-confinement","title":"Kotlin Native ARC-to-GC Reference Cycle Confinement","category":"mobile","severity":"critical","description":"Eliminates catastrophic native memory leaks in Kotlin Multiplatform iOS applications caused by cross-runtime retain cycles between Swift ARC and Kotlin Native's Garbage Collector. Because Swift's reference counter cannot trace Kotlin heap allocations and Kotlin's GC treats foreign references as roots, bidirectional object graphs across the bridge must be strictly confined via deterministic weak-reference wrappers and explicit teardown lifecycles.","antiPatternHeadline":"Unconfined Bidirectional Strong Retain Cycles Across Swift ARC and Kotlin Native GC Boundaries","stars_count":41,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","ios","memory-management","arc","garbage-collection","swift"],"exportEndpoints":{"claude":"/api/rules/kmp-native-arc-to-gc-cycle-confinement?format=claude","cursorMdc":"/api/rules/kmp-native-arc-to-gc-cycle-confinement?format=mdc","cursorrules":"/api/rules/kmp-native-arc-to-gc-cycle-confinement?format=cursor","windsurf":"/api/rules/kmp-native-arc-to-gc-cycle-confinement?format=windsurf","agents":"/api/rules/kmp-native-arc-to-gc-cycle-confinement?format=agents"}},{"id":"tauri-v2-capability-ipc-sandboxing-tauri-2-0-capabi-511","title":"Tauri 2.0 Dynamic Capability-Based IPC Permission Sandboxing and Command Scoping","category":"security","severity":"critical","description":"Enforces least-privilege IPC boundaries in Tauri 2.0 by requiring window/web-view-scoped capability manifests, explicit command allowlists, and runtime path/argument scoping. Prevents Remote Code Execution (RCE) and filesystem traversal by eliminating wildcard permissions and unvalidated native invocation bindings.","antiPatternHeadline":"Wildcard IPC Allowances and Unscoped Native Commands Exposing System Primitives to Compromised WebViews","stars_count":58,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","tauri-v2","ipc-security","capabilities","sandboxing","rust"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-capability-ipc-sandboxing-tauri-2-0-capabi-511?format=claude","cursorMdc":"/api/rules/tauri-v2-capability-ipc-sandboxing-tauri-2-0-capabi-511?format=mdc","cursorrules":"/api/rules/tauri-v2-capability-ipc-sandboxing-tauri-2-0-capabi-511?format=cursor","windsurf":"/api/rules/tauri-v2-capability-ipc-sandboxing-tauri-2-0-capabi-511?format=windsurf","agents":"/api/rules/tauri-v2-capability-ipc-sandboxing-tauri-2-0-capabi-511?format=agents"}},{"id":"webauthn-conditional-ui-anti-redressing-guardrail","title":"WebAuthn Conditional Mediation Session Pinning and Origin Anti-Redressing Protocol","category":"security","severity":"critical","description":"Enforces strict origin bounds verification, framing prevention, and cryptographic challenge-to-session pinning during WebAuthn conditional UI (autofill) credential assertions. Prevents cross-origin passkey credential harvesting, UI redressing/clickjacking, and assertion relay attacks across asynchronous mediation sessions.","antiPatternHeadline":"Unpinned Passkey Autofill Assertions Permitting Frame Redressing and Detached Challenge Consumption","stars_count":44,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","passkeys","conditional-ui","fido2","session-pinning","anti-clickjacking"],"exportEndpoints":{"claude":"/api/rules/webauthn-conditional-ui-anti-redressing-guardrail?format=claude","cursorMdc":"/api/rules/webauthn-conditional-ui-anti-redressing-guardrail?format=mdc","cursorrules":"/api/rules/webauthn-conditional-ui-anti-redressing-guardrail?format=cursor","windsurf":"/api/rules/webauthn-conditional-ui-anti-redressing-guardrail?format=windsurf","agents":"/api/rules/webauthn-conditional-ui-anti-redressing-guardrail?format=agents"}},{"id":"cilium-ebpf-sidecarless-spiffe-attestation","title":"Cilium Sidecarless Mesh SPIFFE/SPIRE Cryptographic Identity Invariant","category":"devops","severity":"critical","description":"Mandates sidecarless eBPF-accelerated transport and cryptographic workload attestation using SPIFFE/SPIRE in Cilium Service Mesh. Eliminates per-pod Envoy sidecar memory and latency overhead by enforcing kernel-level socket redirection and mutual TLS with SPIFFE ID SAN validation natively via CiliumNetworkPolicies.","antiPatternHeadline":"Injecting Inefficient Sidecar Proxies or Permitting Unauthenticated Kernel Socket Traversal via IP-Only CIDR Policies","stars_count":113,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","cilium","spiffe","spire","ambient-mesh","mtls","kubernetes"],"exportEndpoints":{"claude":"/api/rules/cilium-ebpf-sidecarless-spiffe-attestation?format=claude","cursorMdc":"/api/rules/cilium-ebpf-sidecarless-spiffe-attestation?format=mdc","cursorrules":"/api/rules/cilium-ebpf-sidecarless-spiffe-attestation?format=cursor","windsurf":"/api/rules/cilium-ebpf-sidecarless-spiffe-attestation?format=windsurf","agents":"/api/rules/cilium-ebpf-sidecarless-spiffe-attestation?format=agents"}},{"id":"otel-arrow-stream-backpressure-ceiling","title":"OTLP/Arrow Ingestion Stream Backpressure and Columnar Chunk Sizing Guardrail","category":"devops","severity":"critical","description":"Enforces strict columnar record-batch sizing and stream-level reactive backpressure limits on OpenTelemetry Arrow (OTLP-Arrow) receiver and exporter topologies. Prevents catastrophic collector out-of-memory (OOM) fatal crashes and heap fragmentation when handling multi-gigabyte telemetry ingestion bursts.","antiPatternHeadline":"Unbounded Arrow record batch sizes and unthrottled gRPC stream buffering causing collector OOM panics during high-volume spikes","stars_count":66,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","otlp-arrow","backpressure","memory-limiter","grpc-streaming"],"exportEndpoints":{"claude":"/api/rules/otel-arrow-stream-backpressure-ceiling?format=claude","cursorMdc":"/api/rules/otel-arrow-stream-backpressure-ceiling?format=mdc","cursorrules":"/api/rules/otel-arrow-stream-backpressure-ceiling?format=cursor","windsurf":"/api/rules/otel-arrow-stream-backpressure-ceiling?format=windsurf","agents":"/api/rules/otel-arrow-stream-backpressure-ceiling?format=agents"}},{"id":"react19-server-action-idempotency-key-fencing","title":"React 19 Server Actions Idempotency Key Fencing & Transition Guardrail","category":"frontend","severity":"critical","description":"Enforces cryptographically verifiable idempotency tokens across React 19 Server Action transitions and form submissions to prevent duplicate state-modifying mutations during client network retries or automated form resubmissions. Guarantees that mutating Server Actions atomically fence incoming execution requests using client-seeded uniqueness keys backed by distributed locks or reservation tables before executing transactional payloads.","antiPatternHeadline":"Unprotected Mutating Server Actions Permitting Duplicate Execution on Network Retries and Double Submissions","stars_count":77,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react19","server-actions","idempotency","distributed-systems","nextjs"],"exportEndpoints":{"claude":"/api/rules/react19-server-action-idempotency-key-fencing?format=claude","cursorMdc":"/api/rules/react19-server-action-idempotency-key-fencing?format=mdc","cursorrules":"/api/rules/react19-server-action-idempotency-key-fencing?format=cursor","windsurf":"/api/rules/react19-server-action-idempotency-key-fencing?format=windsurf","agents":"/api/rules/react19-server-action-idempotency-key-fencing?format=agents"}},{"id":"axum-gradient-backpressure-shedding","title":"Axum 0.8 Dynamic Gradient Concurrency Limiting and Adaptive Shedding","category":"backend","severity":"critical","description":"Mandates dynamic, gradient-based concurrency limits via Tower middleware in Axum 0.8 services to preemptively shed low-priority requests based on observed RTT drift. Prevents Tokio multi-threaded executor queue saturation and cascading tail latency collapse under burst traffic.","antiPatternHeadline":"Static Concurrency Caps and Unbounded Tower Layers Leading to Tokio Worker Starvation","stars_count":52,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tower","tokio","concurrency","load-shedding"],"exportEndpoints":{"claude":"/api/rules/axum-gradient-backpressure-shedding?format=claude","cursorMdc":"/api/rules/axum-gradient-backpressure-shedding?format=mdc","cursorrules":"/api/rules/axum-gradient-backpressure-shedding?format=cursor","windsurf":"/api/rules/axum-gradient-backpressure-shedding?format=windsurf","agents":"/api/rules/axum-gradient-backpressure-shedding?format=agents"}},{"id":"kmp-flow-swift-task-cancellation-boundary","title":"Deterministic Teardown of KMP Coroutine Flows on Swift Task Cancellation","category":"mobile","severity":"critical","description":"Bridging Kotlin Multiplatform (KMP) Flows into Swift Concurrency AsyncSequences or Task scopes requires deterministic lifecycle propagation. Unbridged or naively wrapped KMP flows leak background Kotlin Job coroutines and platform resources on iOS when the parent Swift Task is cancelled. All boundary adapters must register cooperative cancellation handlers using withTaskCancellationHandler or SKIE/KMP-NativeCoroutines lifecycle primitives to cancel underlying Job subscriptions immediately.","antiPatternHeadline":"Unbounded Swift AsyncStream Consumption Leaking Kotlin Coroutine Jobs on Task Cancellation","stars_count":62,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kmp","kotlin-multiplatform","swift-concurrency","coroutines","flow","ios","memory-leaks"],"exportEndpoints":{"claude":"/api/rules/kmp-flow-swift-task-cancellation-boundary?format=claude","cursorMdc":"/api/rules/kmp-flow-swift-task-cancellation-boundary?format=mdc","cursorrules":"/api/rules/kmp-flow-swift-task-cancellation-boundary?format=cursor","windsurf":"/api/rules/kmp-flow-swift-task-cancellation-boundary?format=windsurf","agents":"/api/rules/kmp-flow-swift-task-cancellation-boundary?format=agents"}},{"id":"postgres-17-hnsw-parallel-memory-budget-standard","title":"Postgres 17 Bounded-Memory Parallel HNSW Index Build Guardrail","category":"backend","severity":"critical","description":"Enforces strict mathematical bounds on parallel worker allocation and session-scoped maintenance_work_mem during pgvector HNSW index builds in Postgres 17. Prevents container OOM terminates by calculating max worker memory against container cgroup limits before triggering asynchronous index builds on high-cardinality embedding tables.","antiPatternHeadline":"Global Unbounded maintenance_work_mem and max_parallel_maintenance_workers Leading to Container Cgroup OOM Kills During HNSW Construction","stars_count":93,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres-17","pgvector","hnsw","memory-bounds","database-reliability"],"exportEndpoints":{"claude":"/api/rules/postgres-17-hnsw-parallel-memory-budget-standard?format=claude","cursorMdc":"/api/rules/postgres-17-hnsw-parallel-memory-budget-standard?format=mdc","cursorrules":"/api/rules/postgres-17-hnsw-parallel-memory-budget-standard?format=cursor","windsurf":"/api/rules/postgres-17-hnsw-parallel-memory-budget-standard?format=windsurf","agents":"/api/rules/postgres-17-hnsw-parallel-memory-budget-standard?format=agents"}},{"id":"webauthn-device-bound-session-eviction-on-attestation-drift","title":"Mandatory Session Eviction on WebAuthn Authenticator Data and UV Signal Drift","category":"security","severity":"critical","description":"Hardware-backed passkey sessions must maintain continuous device-bound assurance by evaluating authenticatorData flags (User Verification bit 2, User Presence bit 0) during periodic re-assertion and step-up checks. Any observed degradation from the baseline posture established at registration—such as UV downgrade, platform-to-roaming transport divergence, or signature counter anomalies—must trigger immediate session revocation. Failure to evict sessions on signal drift allows session hijacking via credential proxying, biometric bypass, and platform downgrade attacks.","antiPatternHeadline":"Persisting High-Assurance Sessions Across Authenticator Posture Downgrades and UV Degradation","stars_count":96,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","fido2","passkeys","session-management","zero-trust"],"exportEndpoints":{"claude":"/api/rules/webauthn-device-bound-session-eviction-on-attestation-drift?format=claude","cursorMdc":"/api/rules/webauthn-device-bound-session-eviction-on-attestation-drift?format=mdc","cursorrules":"/api/rules/webauthn-device-bound-session-eviction-on-attestation-drift?format=cursor","windsurf":"/api/rules/webauthn-device-bound-session-eviction-on-attestation-drift?format=windsurf","agents":"/api/rules/webauthn-device-bound-session-eviction-on-attestation-drift?format=agents"}},{"id":"cilium-ebpf-sockops-mtls-bypass-guardrail","title":"Cilium eBPF Socket-Level TCP Bypass with Kernel-Enforced mTLS Guardrail","category":"devops","severity":"critical","description":"Enforces Cilium sockops eBPF socket map shunting for east-west container communication without compromising kernel-level cryptographic identity fences. Ensures sockops programs correctly evaluate Cilium Network Policies (CNP) and mTLS handshakes before establishing direct socket redirection (sk_msg / BPF_MAP_TYPE_SOCKHASH).","antiPatternHeadline":"Bypassing Kernel Network Stack and mTLS Handshakes via Premature sockops Redirection","stars_count":66,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","cilium","ebpf","kubernetes","mtls","sockops","microsegmentation"],"exportEndpoints":{"claude":"/api/rules/cilium-ebpf-sockops-mtls-bypass-guardrail?format=claude","cursorMdc":"/api/rules/cilium-ebpf-sockops-mtls-bypass-guardrail?format=mdc","cursorrules":"/api/rules/cilium-ebpf-sockops-mtls-bypass-guardrail?format=cursor","windsurf":"/api/rules/cilium-ebpf-sockops-mtls-bypass-guardrail?format=windsurf","agents":"/api/rules/cilium-ebpf-sockops-mtls-bypass-guardrail?format=agents"}},{"id":"vite6-environment-api-cross-runtime-isolation-vite-6-environme-854","title":"Vite 6 Environment API Cross-Runtime Artifact Isolation Guardrail","category":"frontend","severity":"critical","description":"Enforces strict module graph boundary isolation across client, Node SSR, and Edge Worker targets using the Vite 6 Environment API. Prevents tree-shake poisoning, secret leakage, and incompatible runtime symbol resolution by enforcing isolated module resolve conditions, separate dependency pipelines, and compile-time boundary validation.","antiPatternHeadline":"Cross-Runtime Graph Contamination and Tree-Shake Poisoning via Monolithic Module Bundling","stars_count":93,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","vite","vite6","ssr","edge","security","bundle-isolation"],"exportEndpoints":{"claude":"/api/rules/vite6-environment-api-cross-runtime-isolation-vite-6-environme-854?format=claude","cursorMdc":"/api/rules/vite6-environment-api-cross-runtime-isolation-vite-6-environme-854?format=mdc","cursorrules":"/api/rules/vite6-environment-api-cross-runtime-isolation-vite-6-environme-854?format=cursor","windsurf":"/api/rules/vite6-environment-api-cross-runtime-isolation-vite-6-environme-854?format=windsurf","agents":"/api/rules/vite6-environment-api-cross-runtime-isolation-vite-6-environme-854?format=agents"}},{"id":"bun-zero-alloc-ring-buffer-tls-pooling","title":"Zero-Allocation Ring-Buffer Arena Pooling for Bun TLS/WebSocket Sockets","category":"backend","severity":"critical","description":"Enforces pre-allocated, contiguous SharedArrayBuffer ring-buffer memory arenas recycled across Bun 1.2 TLS WebSocket connections. Prevents V8/JSC major GC pauses under sustained million-connection loads by eliminating per-packet heap allocations, slicing, and transient Buffer creation in high-throughput socket I/O loops.","antiPatternHeadline":"Allocating transient Buffers or sub-slices per incoming TLS/WebSocket frame, inducing catastrophic GC stop-the-world spikes under load.","stars_count":99,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","websockets","memory-management","networking","high-performance"],"exportEndpoints":{"claude":"/api/rules/bun-zero-alloc-ring-buffer-tls-pooling?format=claude","cursorMdc":"/api/rules/bun-zero-alloc-ring-buffer-tls-pooling?format=mdc","cursorrules":"/api/rules/bun-zero-alloc-ring-buffer-tls-pooling?format=cursor","windsurf":"/api/rules/bun-zero-alloc-ring-buffer-tls-pooling?format=windsurf","agents":"/api/rules/bun-zero-alloc-ring-buffer-tls-pooling?format=agents"}},{"id":"openfga-cdc-local-graph-invalidation-boundary","title":"OpenFGA CDC-Driven Local Graph Invalidation Boundary and Bounded-Staleness Enforcement","category":"security","severity":"critical","description":"Mandates strict monotonic log sequence number (LSN) fencing and bounded-staleness verification for local in-memory OpenFGA authorization graphs fed by PostgreSQL WAL logical decoding. Enforces immediate authoritative fallback to upstream OpenFGA clusters when replication lag exceeds SLA bounds or when monotonic WAL continuity is broken, preventing unauthorized access after permission revocation.","antiPatternHeadline":"Unsequenced In-Memory Auth Cache Mutated by Naive CDC Listeners Without LSN Watermarking or Upstream Fallback","stars_count":41,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","cdc","rebac","wal-decoding","bounded-staleness","cache-invalidation"],"exportEndpoints":{"claude":"/api/rules/openfga-cdc-local-graph-invalidation-boundary?format=claude","cursorMdc":"/api/rules/openfga-cdc-local-graph-invalidation-boundary?format=mdc","cursorrules":"/api/rules/openfga-cdc-local-graph-invalidation-boundary?format=cursor","windsurf":"/api/rules/openfga-cdc-local-graph-invalidation-boundary?format=windsurf","agents":"/api/rules/openfga-cdc-local-graph-invalidation-boundary?format=agents"}},{"id":"otel-collector-tail-sampling-latency-guardrails","title":"OpenTelemetry Collector Tail-Sampling Latency Guardrail Quotas","category":"devops","severity":"critical","description":"Configures OpenTelemetry Collector tail-sampling pipelines to capture 100% of SLO-breaching latencies and unhandled errors while strictly enforcing deterministic downsampling and rate-limiting on high-frequency nominal traffic. Prevents catastrophic cloud observability ingestion cost overruns without creating blind spots in high-percentile latency distributions.","antiPatternHeadline":"Naive Head-Sampling and Unbounded Tail-Sampling Causing Budget Depletion or Missed P99 Anomalies","stars_count":49,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","tail-sampling","observability","slo","finops","kubernetes"],"exportEndpoints":{"claude":"/api/rules/otel-collector-tail-sampling-latency-guardrails?format=claude","cursorMdc":"/api/rules/otel-collector-tail-sampling-latency-guardrails?format=mdc","cursorrules":"/api/rules/otel-collector-tail-sampling-latency-guardrails?format=cursor","windsurf":"/api/rules/otel-collector-tail-sampling-latency-guardrails?format=windsurf","agents":"/api/rules/otel-collector-tail-sampling-latency-guardrails?format=agents"}},{"id":"svelte-5-runes-microtask-flusher-standard","title":"Svelte 5 Runes Deterministic Reactivity and Microtask Flusher Guardrail","category":"frontend","severity":"critical","description":"Enforces bounded execution depth and deterministic signal evaluation across nested Svelte 5 rune graphs ($state, $derived, $effect). Prevents cascading microtask churn, cyclical flusher invalidation, and state tearing under heavy concurrent event dispatch through pure derivation trees, explicit untracking, and transactional state synchronization.","antiPatternHeadline":"Mutating $state inside $effect chains causing cyclic microtask flushes and frame drops","stars_count":67,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","reactivity","performance","signals"],"exportEndpoints":{"claude":"/api/rules/svelte-5-runes-microtask-flusher-standard?format=claude","cursorMdc":"/api/rules/svelte-5-runes-microtask-flusher-standard?format=mdc","cursorrules":"/api/rules/svelte-5-runes-microtask-flusher-standard?format=cursor","windsurf":"/api/rules/svelte-5-runes-microtask-flusher-standard?format=windsurf","agents":"/api/rules/svelte-5-runes-microtask-flusher-standard?format=agents"}},{"id":"openfga-rebac-distributed-cache-invalidation-standard","title":"Transactional Event-Driven Cache Invalidation for OpenFGA ReBAC Evaluations","category":"security","severity":"critical","description":"Enforces deterministic, event-driven cache invalidation and token-based consistency for OpenFGA relationship-based access control evaluations across edge and local service tiers. Prevents unauthorized privilege persistence and stale authorization grants resulting from decoupled TTL-based caching during relationship tuple revocation. Mandates integration of transactional change data capture or pub/sub bus invalidators directly tied to OpenFGA tuple mutation events.","antiPatternHeadline":"Serving Stale Authorization Decisions from Static TTL Caches Following Relationship Tuple Revocation","stars_count":108,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","rebac","distributed-cache","authorization","redis","zanzibar"],"exportEndpoints":{"claude":"/api/rules/openfga-rebac-distributed-cache-invalidation-standard?format=claude","cursorMdc":"/api/rules/openfga-rebac-distributed-cache-invalidation-standard?format=mdc","cursorrules":"/api/rules/openfga-rebac-distributed-cache-invalidation-standard?format=cursor","windsurf":"/api/rules/openfga-rebac-distributed-cache-invalidation-standard?format=windsurf","agents":"/api/rules/openfga-rebac-distributed-cache-invalidation-standard?format=agents"}},{"id":"bun-native-asyncdisposable-handle-cleanup","title":"Bun 1.2 Deterministic Handle Lifecycle via TC39 AsyncDisposable Invariant","category":"backend","severity":"critical","description":"Enforces deterministic native handle cleanup across high-throughput streaming RPCs and file I/O using Bun 1.2 TC39 Explicit Resource Management. Prevents catastrophic file descriptor exhaustion (EMFILE/ENFILE) and native C++ handle leaks caused by non-deterministic V8/JSC garbage collection cycles.","antiPatternHeadline":"Manual handle tracking or GC-reliant disposal in high-throughput streaming RPC pipelines","stars_count":59,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","typescript","explicit-resource-management","file-descriptors","streaming"],"exportEndpoints":{"claude":"/api/rules/bun-native-asyncdisposable-handle-cleanup?format=claude","cursorMdc":"/api/rules/bun-native-asyncdisposable-handle-cleanup?format=mdc","cursorrules":"/api/rules/bun-native-asyncdisposable-handle-cleanup?format=cursor","windsurf":"/api/rules/bun-native-asyncdisposable-handle-cleanup?format=windsurf","agents":"/api/rules/bun-native-asyncdisposable-handle-cleanup?format=agents"}},{"id":"postgres-17-createsubscriber-consensus-guardrail","title":"PostgreSQL 17 pg_createsubscriber Blue/Green Consensus & Zero-Downtime Slot Alignment","category":"backend","severity":"critical","description":"Mandates deterministic LSN catch-up verification, connection pooler fencing, and sequence state synchronization when promoting physical standbys to logical subscribers via PostgreSQL 17 pg_createsubscriber. Prevents split-brain mutations, logical slot divergence, and sequence ID collisions during zero-downtime blue/green database upgrades.","antiPatternHeadline":"Executing pg_createsubscriber without connection fencing, LSN catch-up verification, and sequence synchronization","stars_count":92,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres-17","pg-createsubscriber","zero-downtime","logical-replication","high-availability"],"exportEndpoints":{"claude":"/api/rules/postgres-17-createsubscriber-consensus-guardrail?format=claude","cursorMdc":"/api/rules/postgres-17-createsubscriber-consensus-guardrail?format=mdc","cursorrules":"/api/rules/postgres-17-createsubscriber-consensus-guardrail?format=cursor","windsurf":"/api/rules/postgres-17-createsubscriber-consensus-guardrail?format=windsurf","agents":"/api/rules/postgres-17-createsubscriber-consensus-guardrail?format=agents"}},{"id":"cilium-ebpf-sidecarless-mtls-l7-ingress-production-standard","title":"Cilium eBPF Sidecarless mTLS & L7 Socket Ingress Standard","category":"devops","severity":"critical","description":"Enforces kernel-level mutual authentication and L7 protocol authorization at line rate via Cilium eBPF and SPIFFE/SPIRE without user-space sidecar proxies. Guarantees that socket-level traffic redirection (sockops) adheres to strict cryptographic workload identity validation before granting ingress to application sockets.","antiPatternHeadline":"Deploying Heavyweight User-Space Sidecars or Plaintext Pod Ingress Without eBPF Cryptographic Identity Enforcement","stars_count":56,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","cilium","ebpf","mtls","kubernetes","security","spiffe-spire"],"exportEndpoints":{"claude":"/api/rules/cilium-ebpf-sidecarless-mtls-l7-ingress-production-standard?format=claude","cursorMdc":"/api/rules/cilium-ebpf-sidecarless-mtls-l7-ingress-production-standard?format=mdc","cursorrules":"/api/rules/cilium-ebpf-sidecarless-mtls-l7-ingress-production-standard?format=cursor","windsurf":"/api/rules/cilium-ebpf-sidecarless-mtls-l7-ingress-production-standard?format=windsurf","agents":"/api/rules/cilium-ebpf-sidecarless-mtls-l7-ingress-production-standard?format=agents"}},{"id":"kmp-swift6-sendable-concurrency-barrier","title":"Kotlin Multiplatform Swift 6 Sendable Concurrency Barrier Standard","category":"mobile","severity":"critical","description":"Enforces strict concurrency safety and actor isolation boundaries between Kotlin Multiplatform (KMP) shared modules and native Swift 6 code. Prevents data races, runtime memory corruption, and Swift 6 Sendable compilation failures by isolating Kotlin Coroutine dispatchers behind Sendable Swift actor boundaries and immutable value DTOs.","antiPatternHeadline":"Unchecked Non-Sendable Kotlin Reference Leaking Across Swift 6 Actor Boundaries","stars_count":110,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kmp","swift6","concurrency","sendable","kotlin-native","coroutines"],"exportEndpoints":{"claude":"/api/rules/kmp-swift6-sendable-concurrency-barrier?format=claude","cursorMdc":"/api/rules/kmp-swift6-sendable-concurrency-barrier?format=mdc","cursorrules":"/api/rules/kmp-swift6-sendable-concurrency-barrier?format=cursor","windsurf":"/api/rules/kmp-swift6-sendable-concurrency-barrier?format=windsurf","agents":"/api/rules/kmp-swift6-sendable-concurrency-barrier?format=agents"}},{"id":"capacitor-7-webview-bridge-origin-guardrail","title":"Capacitor 7 Isolated WebView Bridge Origin and Cryptographic RPC Guardrail","category":"mobile","severity":"critical","description":"Enforces strict origin validation, isolated context execution, and explicit Content Security Policy partitions on all native capability RPC invocations within Capacitor 7. Mitigates cross-context bridge hijacking and unauthorized native plugin execution by preventing wildcards in server hostnames, rejecting untrusted frame execution, and mandating cryptographic nonce validation for custom bridge protocols.","antiPatternHeadline":"Wildcard Server Allowlisting and Unvalidated Native Bridge Invocations in WebViews","stars_count":117,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","security","csp","bridge","ipc"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-webview-bridge-origin-guardrail?format=claude","cursorMdc":"/api/rules/capacitor-7-webview-bridge-origin-guardrail?format=mdc","cursorrules":"/api/rules/capacitor-7-webview-bridge-origin-guardrail?format=cursor","windsurf":"/api/rules/capacitor-7-webview-bridge-origin-guardrail?format=windsurf","agents":"/api/rules/capacitor-7-webview-bridge-origin-guardrail?format=agents"}},{"id":"caep-risc-passkey-session-revocation-standard","title":"Continuous CAEP/RISC Passkey Compromise Validation and Real-Time Session Revocation","category":"security","severity":"critical","description":"Mandates zero-trust, real-time ingestion and cryptographic verification of OpenID Shared Signals and Events (SSE) via CAEP and RISC Security Event Tokens (SET). Enforces immediate atomic session termination, refresh token blacklisting, and cross-IdP backchannel logout upon receipt of passkey credential theft or anomalous authenticator sync signals.","antiPatternHeadline":"Relying on Passive JWT Expiry or Unverified Webhooks During Passkey Compromise Events","stars_count":82,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","caep","risc","passkeys","webauthn","zero-trust","openid-sse"],"exportEndpoints":{"claude":"/api/rules/caep-risc-passkey-session-revocation-standard?format=claude","cursorMdc":"/api/rules/caep-risc-passkey-session-revocation-standard?format=mdc","cursorrules":"/api/rules/caep-risc-passkey-session-revocation-standard?format=cursor","windsurf":"/api/rules/caep-risc-passkey-session-revocation-standard?format=windsurf","agents":"/api/rules/caep-risc-passkey-session-revocation-standard?format=agents"}},{"id":"vite6-environment-api-runtime-isolation-standard-vite-6-environme-917","title":"Vite 6 Environment API Multi-Runtime Module Graph Isolation","category":"frontend","severity":"critical","description":"Enforces strict physical separation of client, Node.js SSR, and edge worker module graphs using the Vite 6 Environment API. Prevents cross-runtime prototype pollution, execution context bleeding, and critical server secret exfiltration caused by shared module caches during universal bundling.","antiPatternHeadline":"Monolithic SSR Module Graph Collapsing Client, Node, and Edge Execution Contexts","stars_count":87,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","vite6","environment-api","ssr","security","module-graph"],"exportEndpoints":{"claude":"/api/rules/vite6-environment-api-runtime-isolation-standard-vite-6-environme-917?format=claude","cursorMdc":"/api/rules/vite6-environment-api-runtime-isolation-standard-vite-6-environme-917?format=mdc","cursorrules":"/api/rules/vite6-environment-api-runtime-isolation-standard-vite-6-environme-917?format=cursor","windsurf":"/api/rules/vite6-environment-api-runtime-isolation-standard-vite-6-environme-917?format=windsurf","agents":"/api/rules/vite6-environment-api-runtime-isolation-standard-vite-6-environme-917?format=agents"}},{"id":"react-19-action-transition-rollback-invariant","title":"React 19 Concurrent Action Transition Deterministic Rollback and Optimistic Lock Invalidation","category":"frontend","severity":"critical","description":"Enforces synchronous error boundary rollbacks and optimistic lock invalidation during React 19 concurrent action transitions. Prevents split-brain UI states, zombie optimistic updates, and corrupted client caches caused by interleaved, aborted, or rejected Server Actions.","antiPatternHeadline":"Decoupled Manual Optimistic State and Uncoordinated Interleaved Server Actions Causing Stale Lock Poisoning","stars_count":100,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","concurrent-react","server-actions","use-optimistic","use-action-state"],"exportEndpoints":{"claude":"/api/rules/react-19-action-transition-rollback-invariant?format=claude","cursorMdc":"/api/rules/react-19-action-transition-rollback-invariant?format=mdc","cursorrules":"/api/rules/react-19-action-transition-rollback-invariant?format=cursor","windsurf":"/api/rules/react-19-action-transition-rollback-invariant?format=windsurf","agents":"/api/rules/react-19-action-transition-rollback-invariant?format=agents"}},{"id":"axum-tower-cancellation-socket-drain-guardrail","title":"Axum 0.8 Deterministic Async Cancellation & Graceful Stream Socket Drain","category":"backend","severity":"critical","description":"Enforces strict cancellation safety and deterministic resource cleanup within Axum 0.8 and Hyper streaming handlers. Eliminates database transaction pool starvation, stale locks, and partial state mutations caused by silent future drops during abrupt HTTP/3 QUIC connection resets.","antiPatternHeadline":"Bare Transaction Handles and Unshielded Asynchronous Finalization in Droppable Stream Contexts","stars_count":103,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tower","hyper","cancellation-safety","http3"],"exportEndpoints":{"claude":"/api/rules/axum-tower-cancellation-socket-drain-guardrail?format=claude","cursorMdc":"/api/rules/axum-tower-cancellation-socket-drain-guardrail?format=mdc","cursorrules":"/api/rules/axum-tower-cancellation-socket-drain-guardrail?format=cursor","windsurf":"/api/rules/axum-tower-cancellation-socket-drain-guardrail?format=windsurf","agents":"/api/rules/axum-tower-cancellation-socket-drain-guardrail?format=agents"}},{"id":"postgres-17-logical-decoding-memory-spooling-quota","title":"Postgres 17 Logical Decoding Spooling & Work Memory Quota Enforcement","category":"backend","severity":"critical","description":"Enforces strict memory boundary quotas (logical_decoding_work_mem) and batch chunking invariants to prevent catastrophic primary node Out-Of-Memory (OOM) cascades during logical replication. Uncommitted transactions in write-heavy workloads accumulate changes in the PostgreSQL ReorderBuffer; without bounded work memory and deterministic spill-to-disk policies, walsender processes exhaust host virtual memory. Applications and migrations must enforce bounded mutation transaction sizes and verify replication slot spill telemetry.","antiPatternHeadline":"Executing unchunked bulk DML inside long-lived transactions under unbounded logical_decoding_work_mem, exhausting walsender memory and inducing primary OOM crashes","stars_count":116,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres","logical-replication","database-reliability","cdc","memory-management"],"exportEndpoints":{"claude":"/api/rules/postgres-17-logical-decoding-memory-spooling-quota?format=claude","cursorMdc":"/api/rules/postgres-17-logical-decoding-memory-spooling-quota?format=mdc","cursorrules":"/api/rules/postgres-17-logical-decoding-memory-spooling-quota?format=cursor","windsurf":"/api/rules/postgres-17-logical-decoding-memory-spooling-quota?format=windsurf","agents":"/api/rules/postgres-17-logical-decoding-memory-spooling-quota?format=agents"}},{"id":"bun-sqlite-wal-read-starvation-guardrail","title":"Bun 1.2 Native SQLite Concurrent WAL Read-Starvation Prevention Guardrail","category":"backend","severity":"critical","description":"Enforces connection segregation between single-writer and multi-reader connections in Bun 1.2 native SQLite, preventing high-throughput or analytical reads from holding persistent read locks that stall WAL checkpointing. Guarantees deterministic WAL frame reclamation and bounded write latencies by mandating non-blocking checkpoint strategies and read transaction boundaries.","antiPatternHeadline":"Executing long-running or unbounded queries on shared SQLite connections, blocking WAL checkpoints and starving write transactions.","stars_count":114,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["bun","sqlite","wal-mode","concurrency","performance","backend"],"exportEndpoints":{"claude":"/api/rules/bun-sqlite-wal-read-starvation-guardrail?format=claude","cursorMdc":"/api/rules/bun-sqlite-wal-read-starvation-guardrail?format=mdc","cursorrules":"/api/rules/bun-sqlite-wal-read-starvation-guardrail?format=cursor","windsurf":"/api/rules/bun-sqlite-wal-read-starvation-guardrail?format=windsurf","agents":"/api/rules/bun-sqlite-wal-read-starvation-guardrail?format=agents"}},{"id":"android-15-short-service-deadline-quarantine-standard","title":"Android 15 Short-Service Execution Budget & Quarantine Standard","category":"mobile","severity":"critical","description":"Enforces deterministic state checkpointing and cooperative pre-emptive cancellation within Android 15's mandatory 3-minute (180s) shortService foreground execution ceiling. Guarantees atomic transaction flush and WorkManager fallback handoff prior to OS SIGKILL or ANR triggered on timeout.","antiPatternHeadline":"Unbounded Short-Service Worker Without onTimeout Implementation and Checkpoint Quarantine","stars_count":67,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","android","android-15","foreground-service","background-processing","coroutines"],"exportEndpoints":{"claude":"/api/rules/android-15-short-service-deadline-quarantine-standard?format=claude","cursorMdc":"/api/rules/android-15-short-service-deadline-quarantine-standard?format=mdc","cursorrules":"/api/rules/android-15-short-service-deadline-quarantine-standard?format=cursor","windsurf":"/api/rules/android-15-short-service-deadline-quarantine-standard?format=windsurf","agents":"/api/rules/android-15-short-service-deadline-quarantine-standard?format=agents"}},{"id":"kmp-native-gc-concurrency-finalizer-invariant","title":"KMP Native 2.1 Concurrent Cleaner and Finalizer Non-Blocking Invariant","category":"mobile","severity":"critical","description":"Enforces strict non-blocking execution inside Kotlin/Native Cleaner and finalization routines in Kotlin Multiplatform 2.1+. Prohibits synchronized mutex acquisition, coroutine runBlocking, and synchronous I/O within native garbage collection worker threads to eliminate runtime deadlocks and collector starvation.","antiPatternHeadline":"Executing blocking operations or mutex synchronizations inside Kotlin/Native createCleaner blocks","stars_count":94,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","kotlin-native","garbage-collection","concurrency","memory-management"],"exportEndpoints":{"claude":"/api/rules/kmp-native-gc-concurrency-finalizer-invariant?format=claude","cursorMdc":"/api/rules/kmp-native-gc-concurrency-finalizer-invariant?format=mdc","cursorrules":"/api/rules/kmp-native-gc-concurrency-finalizer-invariant?format=cursor","windsurf":"/api/rules/kmp-native-gc-concurrency-finalizer-invariant?format=windsurf","agents":"/api/rules/kmp-native-gc-concurrency-finalizer-invariant?format=agents"}},{"id":"k8s-gateway-api-v1-2-cross-namespace-mtls-referencegrant","title":"Kubernetes Gateway API v1.2 Cross-Namespace Mutual TLS and ReferenceGrant Routing Boundaries","category":"devops","severity":"critical","description":"Enforces strict cryptographically verified ReferenceGrant access boundaries for cross-namespace routing and mutual TLS handshakes under Kubernetes Gateway API v1.2 specifications. In multi-tenant clusters, Gateway resources and downstream HTTPRoute/BackendTLSPolicy objects spanning namespace perimeters must bind exclusively through explicit, bi-directional ReferenceGrant contracts to preclude route hijacking and certificate spoofing. Failure to declare granular TargetRef/From contracts breaches tenant network isolation and exposes backend mesh endpoints to cross-namespace traffic interception.","antiPatternHeadline":"Implicit Cross-Namespace Route Attachment and Unbounded BackendTLSPolicy Delegation Without Explicit ReferenceGrant Enforcement","stars_count":62,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","kubernetes","gateway-api","mtls","referencegrant","security","zero-trust"],"exportEndpoints":{"claude":"/api/rules/k8s-gateway-api-v1-2-cross-namespace-mtls-referencegrant?format=claude","cursorMdc":"/api/rules/k8s-gateway-api-v1-2-cross-namespace-mtls-referencegrant?format=mdc","cursorrules":"/api/rules/k8s-gateway-api-v1-2-cross-namespace-mtls-referencegrant?format=cursor","windsurf":"/api/rules/k8s-gateway-api-v1-2-cross-namespace-mtls-referencegrant?format=windsurf","agents":"/api/rules/k8s-gateway-api-v1-2-cross-namespace-mtls-referencegrant?format=agents"}},{"id":"opentelemetry-w3c-baggage-sanitization-guardrail-opentelemetry-w3-609","title":"OpenTelemetry W3C Baggage Ingress/Egress Sanitization & Schema Filtering","category":"devops","severity":"critical","description":"Enforces strict allowlist validation, size quotas, and redaction on OpenTelemetry W3C Baggage metadata at service ingress and egress boundaries. Prevents arbitrary downstream data exfiltration, HTTP header amplification attacks (HTTP 431 Request Header Fields Too Large), and PII leaks caused by unconstrained distributed context propagation.","antiPatternHeadline":"Blind Passthrough of Unvalidated W3C Baggage Key-Value Pairs Across Network Boundaries","stars_count":115,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","w3c-baggage","distributed-tracing","appsec","traffic-management"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-w3c-baggage-sanitization-guardrail-opentelemetry-w3-609?format=claude","cursorMdc":"/api/rules/opentelemetry-w3c-baggage-sanitization-guardrail-opentelemetry-w3-609?format=mdc","cursorrules":"/api/rules/opentelemetry-w3c-baggage-sanitization-guardrail-opentelemetry-w3-609?format=cursor","windsurf":"/api/rules/opentelemetry-w3c-baggage-sanitization-guardrail-opentelemetry-w3-609?format=windsurf","agents":"/api/rules/opentelemetry-w3c-baggage-sanitization-guardrail-opentelemetry-w3-609?format=agents"}},{"id":"rfc-9449-dpop-ephemeral-binding-standard","title":"OAuth 2.0 RFC 9449 DPoP Ephemeral Cryptographic Binding","category":"security","severity":"critical","description":"Enforces RFC 9449 Demonstrating Proof-of-Possession (DPoP) at application boundaries to bind OAuth access and refresh tokens to non-extractable client key pairs. Prevents token replay and unauthorized credential reuse by requiring signed ephemeral proof JWTs with strict HTTP method, URI normalization, token hash ('ath'), and server nonce verification on every request. Replaces traditional bearer authentication with sender-constrained token validation across all client-server communications.","antiPatternHeadline":"Transmitting Unbound Bearer Tokens or Reusing Static DPoP Proofs Without Nonce and ATH Validation","stars_count":77,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","oauth2","dpop","rfc9449","cryptography","jwt","web-crypto"],"exportEndpoints":{"claude":"/api/rules/rfc-9449-dpop-ephemeral-binding-standard?format=claude","cursorMdc":"/api/rules/rfc-9449-dpop-ephemeral-binding-standard?format=mdc","cursorrules":"/api/rules/rfc-9449-dpop-ephemeral-binding-standard?format=cursor","windsurf":"/api/rules/rfc-9449-dpop-ephemeral-binding-standard?format=windsurf","agents":"/api/rules/rfc-9449-dpop-ephemeral-binding-standard?format=agents"}},{"id":"svelte-5-runes-reactive-graph-purity","title":"Svelte 5 Runes Reactive Graph Purity Boundary","category":"frontend","severity":"critical","description":"Enforces strict synchronous dependency tracking and purity invariants across Svelte 5 reactive runes ($derived, $derived.by, $effect). Prevents untracked asynchronous race conditions, memory leaks, and cascading cyclic re-renders by mandating synchronous reads, explicit AbortController lifecycle teardowns, and mutation-free derivation boundaries.","antiPatternHeadline":"Untracked Post-Await State Access and Unbounded Async Side Effects in Runes","stars_count":50,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["svelte","svelte-5","runes","reactivity","frontend","memory-leaks"],"exportEndpoints":{"claude":"/api/rules/svelte-5-runes-reactive-graph-purity?format=claude","cursorMdc":"/api/rules/svelte-5-runes-reactive-graph-purity?format=mdc","cursorrules":"/api/rules/svelte-5-runes-reactive-graph-purity?format=cursor","windsurf":"/api/rules/svelte-5-runes-reactive-graph-purity?format=windsurf","agents":"/api/rules/svelte-5-runes-reactive-graph-purity?format=agents"}},{"id":"nextjs-15-multi-region-cache-purge-atomicity","title":"Next.js 15 Multi-Region Cache Tag Purge Atomicity Standard","category":"frontend","severity":"critical","description":"Enforces strict cache coherence and atomic invalidation protocols across globally distributed edge Points of Presence (PoPs) in Next.js 15. Prevents torn-read states during concurrent Server Action mutations by mandating monotonic epoch-tagged cache envelopes and session-bound read fencing.","antiPatternHeadline":"Uncoordinated Multi-Tag Purges in Server Actions Inducing Cross-Region Edge Split-Brain","stars_count":100,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs-15","cache-tag","server-actions","multi-region","edge-cache"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-multi-region-cache-purge-atomicity?format=claude","cursorMdc":"/api/rules/nextjs-15-multi-region-cache-purge-atomicity?format=mdc","cursorrules":"/api/rules/nextjs-15-multi-region-cache-purge-atomicity?format=cursor","windsurf":"/api/rules/nextjs-15-multi-region-cache-purge-atomicity?format=windsurf","agents":"/api/rules/nextjs-15-multi-region-cache-purge-atomicity?format=agents"}},{"id":"fastapi-pydantic-v2-rust-zero-copy-deserialization-standard","title":"FastAPI / Pydantic v2 Rust Zero-Copy Deserialization Standard","category":"backend","severity":"critical","description":"Eliminates GC pressure and heap fragmentation under heavy streaming ingestion by pinning typed memory buffers across the Python-Rust C-ABI boundary. Standardizes direct buffer validation via pydantic-core's Rust extension and memoryview borrowing to bypass intermediate Python string and dictionary allocations during high-throughput I/O.","antiPatternHeadline":"Buffer-Duplicating Intermediate Python Decodes During High-Throughput Streaming Ingestion","stars_count":98,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","pydantic-v2","rust","zero-copy","memory-management","performance"],"exportEndpoints":{"claude":"/api/rules/fastapi-pydantic-v2-rust-zero-copy-deserialization-standard?format=claude","cursorMdc":"/api/rules/fastapi-pydantic-v2-rust-zero-copy-deserialization-standard?format=mdc","cursorrules":"/api/rules/fastapi-pydantic-v2-rust-zero-copy-deserialization-standard?format=cursor","windsurf":"/api/rules/fastapi-pydantic-v2-rust-zero-copy-deserialization-standard?format=windsurf","agents":"/api/rules/fastapi-pydantic-v2-rust-zero-copy-deserialization-standard?format=agents"}},{"id":"axum-08-adaptive-load-shedding-concurrency-guardrail","title":"Axum 0.8 Adaptive Load-Shedding & Concurrency Guardrail","category":"backend","severity":"critical","description":"Protects async Tokio worker runtimes from saturation-driven tail-latency collapse using Little's Law latency-gradient backpressure middleware. Under saturation, queuing requests internally causes latency inflation and thread starvation; systems must reject excess traffic at the ingress boundary using dynamically adjusted inflight limits and immediate HTTP 503 Service Unavailable responses with Retry-After headers.","antiPatternHeadline":"Static Concurrency Caps and Unbounded Queue Buffering Inducing Tokio Worker Starvation","stars_count":117,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tokio","load-shedding","resilience"],"exportEndpoints":{"claude":"/api/rules/axum-08-adaptive-load-shedding-concurrency-guardrail?format=claude","cursorMdc":"/api/rules/axum-08-adaptive-load-shedding-concurrency-guardrail?format=mdc","cursorrules":"/api/rules/axum-08-adaptive-load-shedding-concurrency-guardrail?format=cursor","windsurf":"/api/rules/axum-08-adaptive-load-shedding-concurrency-guardrail?format=windsurf","agents":"/api/rules/axum-08-adaptive-load-shedding-concurrency-guardrail?format=agents"}},{"id":"postgres-17-adaptive-hash-join-memory-spilling-guardrail","title":"Postgres 17 Adaptive Hash-Join Memory Allocation and Spill Protection Guardrail","category":"backend","severity":"critical","description":"Enforces strict transaction-scoped memory budgeting and concurrency-aware work_mem calibration for Postgres 17 analytical hash joins. Prevents memory over-commit, OS OOM-killer interventions, recursive disk spilling, and buffer pool eviction storms caused by unconstrained multi-batch joins and parallel worker multiplication.","antiPatternHeadline":"Global or Blind Per-Query work_mem Elevation on Concurrent Analytical Joins Leading to OOM or Temp Disk Thrashing","stars_count":115,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres","sql","performance","memory-management","query-optimization"],"exportEndpoints":{"claude":"/api/rules/postgres-17-adaptive-hash-join-memory-spilling-guardrail?format=claude","cursorMdc":"/api/rules/postgres-17-adaptive-hash-join-memory-spilling-guardrail?format=mdc","cursorrules":"/api/rules/postgres-17-adaptive-hash-join-memory-spilling-guardrail?format=cursor","windsurf":"/api/rules/postgres-17-adaptive-hash-join-memory-spilling-guardrail?format=windsurf","agents":"/api/rules/postgres-17-adaptive-hash-join-memory-spilling-guardrail?format=agents"}},{"id":"kmp-native-heap-continuation-lifecycle-fence","title":"KMP Native Heap Continuation Lifecycle Fence for Swift-Kotlin Interop","category":"mobile","severity":"critical","description":"Establishes deterministic lifecycle fencing and bidirectional cancellation propagation across the Kotlin Multiplatform (Kotlin/Native) and Swift interop boundary. Prevents native heap leaks, zombie coroutine executions, and dangling Swift continuation resumption crashes by enforcing synchronous cancellation unbinding when native consumers deallocate.","antiPatternHeadline":"Unfenced Async Swift-Kotlin Bridge Invocation Causing Dangling Continuations and Native Memory Leaks","stars_count":92,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kmp","kotlin-native","swift","coroutines","memory-management","concurrency"],"exportEndpoints":{"claude":"/api/rules/kmp-native-heap-continuation-lifecycle-fence?format=claude","cursorMdc":"/api/rules/kmp-native-heap-continuation-lifecycle-fence?format=mdc","cursorrules":"/api/rules/kmp-native-heap-continuation-lifecycle-fence?format=cursor","windsurf":"/api/rules/kmp-native-heap-continuation-lifecycle-fence?format=windsurf","agents":"/api/rules/kmp-native-heap-continuation-lifecycle-fence?format=agents"}},{"id":"webauthn-conditional-mediation-origin-lock-standard","title":"WebAuthn Conditional Mediation Origin-Lock & User Verification Standard","category":"security","severity":"critical","description":"Enforces strict canonical origin binding, relying party ID validation, and mandatory hardware-backed User Verification (UV) flags during WebAuthn conditional mediation (passkey autofill) assertions. Eliminates session hijacking, automated autofill harvesting, and cross-site credential exploitation across unmediated and autofill flows.","antiPatternHeadline":"Accepting Unverified User Flags or Permissive Origins During Conditional WebAuthn Autofill","stars_count":78,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","passkeys","fido2","authentication","conditional-mediation"],"exportEndpoints":{"claude":"/api/rules/webauthn-conditional-mediation-origin-lock-standard?format=claude","cursorMdc":"/api/rules/webauthn-conditional-mediation-origin-lock-standard?format=mdc","cursorrules":"/api/rules/webauthn-conditional-mediation-origin-lock-standard?format=cursor","windsurf":"/api/rules/webauthn-conditional-mediation-origin-lock-standard?format=windsurf","agents":"/api/rules/webauthn-conditional-mediation-origin-lock-standard?format=agents"}},{"id":"cilium-ebpf-socket-identity-egress-guardrail","title":"Cilium eBPF Socket-Layer In-Kernel Identity-Aware Egress Guardrail","category":"security","severity":"critical","description":"Mandates socket-layer eBPF packet attribution via Cilium to enforce Zero Trust egress policies prior to veth egress and network namespace transit. Prevents identity spoofing and unauthorized external network egress by attaching policy enforcement directly to the socket layer (cgroups/sockops) coupled with cryptographic identity injection.","antiPatternHeadline":"Unvalidated IP-Centric Egress and Unpinned Network Policies Bypassing In-Kernel BPF Socket Enforcement","stars_count":101,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","ebpf","cilium","zero-trust","kubernetes","network-policy"],"exportEndpoints":{"claude":"/api/rules/cilium-ebpf-socket-identity-egress-guardrail?format=claude","cursorMdc":"/api/rules/cilium-ebpf-socket-identity-egress-guardrail?format=mdc","cursorrules":"/api/rules/cilium-ebpf-socket-identity-egress-guardrail?format=cursor","windsurf":"/api/rules/cilium-ebpf-socket-identity-egress-guardrail?format=windsurf","agents":"/api/rules/cilium-ebpf-socket-identity-egress-guardrail?format=agents"}},{"id":"bun-standalone-executable-mmap-memory-guardrail","title":"Bun 1.2 Standalone Executable Immutable Mmap Asset and Memory Protection","category":"devops","severity":"critical","description":"Bun 1.2 standalone executables (bun build --compile) map embedded static assets, bundled dependencies, and runtime bytecode into read-only virtual memory regions. Mutating these memory-mapped buffers in-place or attempting write operations against internal virtual paths triggers segmentation faults or tampering vulnerabilities. Systems must enforce explicit copy-on-write strategies for asset transformations and maintain strictly immutable virtual memory invariants across binary execution lifecycles.","antiPatternHeadline":"Mutating memory-mapped binary asset buffers or attempting in-place writes against virtual executable boundaries","stars_count":92,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","bun","memory-safety","security","standalone-executables","mmap"],"exportEndpoints":{"claude":"/api/rules/bun-standalone-executable-mmap-memory-guardrail?format=claude","cursorMdc":"/api/rules/bun-standalone-executable-mmap-memory-guardrail?format=mdc","cursorrules":"/api/rules/bun-standalone-executable-mmap-memory-guardrail?format=cursor","windsurf":"/api/rules/bun-standalone-executable-mmap-memory-guardrail?format=windsurf","agents":"/api/rules/bun-standalone-executable-mmap-memory-guardrail?format=agents"}},{"id":"otel-collector-tail-sampling-exemplar-retention","title":"OpenTelemetry Tail-Sampling Exemplar and Error Retention Invariant","category":"devops","severity":"critical","description":"Enforces deterministic retention of all distributed traces associated with high-percentile latency (p99+) and HTTP 5xx/gRPC errors within OpenTelemetry Collector tail-sampling pipelines. Prevents broken metric-to-trace exemplar correlation in observability backends caused by premature probabilistic drop policies.","antiPatternHeadline":"Dropping p99 and 5xx traces through downstream probabilistic tail-sampling, creating orphan metric exemplars","stars_count":94,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","tail-sampling","distributed-tracing","observability","sre"],"exportEndpoints":{"claude":"/api/rules/otel-collector-tail-sampling-exemplar-retention?format=claude","cursorMdc":"/api/rules/otel-collector-tail-sampling-exemplar-retention?format=mdc","cursorrules":"/api/rules/otel-collector-tail-sampling-exemplar-retention?format=cursor","windsurf":"/api/rules/otel-collector-tail-sampling-exemplar-retention?format=windsurf","agents":"/api/rules/otel-collector-tail-sampling-exemplar-retention?format=agents"}},{"id":"svelte-5-runes-async-boundary-teardown","title":"Svelte 5 Runes Async Boundary Isolation & Reactive Teardown Enforcement","category":"frontend","severity":"critical","description":"Strictly enforces that Svelte 5 signal derivations ($derived, $derived.by) remain purely synchronous to prevent tracking context detachment. Mandates that asynchronous microtasks and data fetches be isolated within $effect scopes with deterministic AbortController teardowns to eliminate memory leaks and stale mutations during rapid DOM unmounting.","antiPatternHeadline":"Executing Async Microtasks Within Synchronous Derivations Causing Detached Signal Tracking and Post-Teardown Memory Leaks","stars_count":87,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["svelte5","runes","reactivity","memory-leaks","async-teardown"],"exportEndpoints":{"claude":"/api/rules/svelte-5-runes-async-boundary-teardown?format=claude","cursorMdc":"/api/rules/svelte-5-runes-async-boundary-teardown?format=mdc","cursorrules":"/api/rules/svelte-5-runes-async-boundary-teardown?format=cursor","windsurf":"/api/rules/svelte-5-runes-async-boundary-teardown?format=windsurf","agents":"/api/rules/svelte-5-runes-async-boundary-teardown?format=agents"}},{"id":"nextjs-15-ppr-dynamic-io-boundary-isolation-next-js-15-parti-785","title":"Next.js 15 PPR Dynamic IO Context Isolation","category":"frontend","severity":"critical","description":"Enforces strict architectural separation between static prerender trees and streaming Suspense holes under Next.js 15 Partial Prerendering (PPR) and Dynamic IO flags. Prevents accidental route-level de-optimization by prohibiting dynamic API access (cookies, headers, un-cached data fetching) outside explicitly isolated Suspense-wrapped leaf components. Guarantees compile-time enforcement of cacheable shells and predictable incremental streaming delivery.","antiPatternHeadline":"Dynamic context leakage into static layouts and parent shells poisoning the PPR prerender boundary","stars_count":97,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs","nextjs-15","ppr","dynamic-io","react-suspense","server-components"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-ppr-dynamic-io-boundary-isolation-next-js-15-parti-785?format=claude","cursorMdc":"/api/rules/nextjs-15-ppr-dynamic-io-boundary-isolation-next-js-15-parti-785?format=mdc","cursorrules":"/api/rules/nextjs-15-ppr-dynamic-io-boundary-isolation-next-js-15-parti-785?format=cursor","windsurf":"/api/rules/nextjs-15-ppr-dynamic-io-boundary-isolation-next-js-15-parti-785?format=windsurf","agents":"/api/rules/nextjs-15-ppr-dynamic-io-boundary-isolation-next-js-15-parti-785?format=agents"}},{"id":"pg17-streaming-io-prefetch-starvation-fence","title":"PostgreSQL 17 Streaming I/O Prefetch & Buffer Starvation Dynamic Fence","category":"backend","severity":"critical","description":"Enforces dynamic calibration of PostgreSQL 17 streaming I/O prefetch depth and parallel worker allocation against active shared_buffers pressure and dirty page writeback ratios. Prevents parallel sequential scan workers from aggressively issuing speculative prefetch requests that displace transactional hot sets and trigger kernel-level page cache eviction storms. Mandates adaptive session-level GUC fencing and synchronized buffer-ring containment for concurrent analytical workloads.","antiPatternHeadline":"Unbounded Parallel Streaming Prefetch Saturating Buffer Rings and Evicting Transactional Working Sets","stars_count":59,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql-17","streaming-io","database-performance","buffer-pool","prefetch-tuning"],"exportEndpoints":{"claude":"/api/rules/pg17-streaming-io-prefetch-starvation-fence?format=claude","cursorMdc":"/api/rules/pg17-streaming-io-prefetch-starvation-fence?format=mdc","cursorrules":"/api/rules/pg17-streaming-io-prefetch-starvation-fence?format=cursor","windsurf":"/api/rules/pg17-streaming-io-prefetch-starvation-fence?format=windsurf","agents":"/api/rules/pg17-streaming-io-prefetch-starvation-fence?format=agents"}},{"id":"axum-streamed-payload-spooling-memory-ceiling","title":"Axum 0.8 Streamed Payload Spooling & Memory Ceiling Guardrail","category":"backend","severity":"critical","description":"Mandates strict non-buffering chunk-size enforcement and ephemeral disk-spool failover mechanisms for Axum 0.8 streaming endpoints. Prevents process-level Out-of-Memory (OOM) crashes and heap exhaustion vulnerabilities arising from unbounded chunked transfer encodings and uncontrolled async payload buffering.","antiPatternHeadline":"Unbounded In-Memory Body Accumulation and Unmetered Stream Buffering","stars_count":68,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tower-http","memory-safety","dos-mitigation","security"],"exportEndpoints":{"claude":"/api/rules/axum-streamed-payload-spooling-memory-ceiling?format=claude","cursorMdc":"/api/rules/axum-streamed-payload-spooling-memory-ceiling?format=mdc","cursorrules":"/api/rules/axum-streamed-payload-spooling-memory-ceiling?format=cursor","windsurf":"/api/rules/axum-streamed-payload-spooling-memory-ceiling?format=windsurf","agents":"/api/rules/axum-streamed-payload-spooling-memory-ceiling?format=agents"}},{"id":"bun-sqlite-zero-copy-arraybuffer-standard","title":"Bun 1.2 Native SQLite Zero-Copy ArrayBuffer Transfer Standard","category":"backend","severity":"critical","description":"Restricts multi-threaded Bun 1.2 worker interactions reading from bun:sqlite to zero-copy ArrayBuffer transfer lists or SharedArrayBuffer views. Eliminates structured-clone serialization latency and V8/JSC heap allocation overhead across high-throughput OLTP read paths. Enforces raw binary transfer protocols over object-graph messaging across thread boundaries.","antiPatternHeadline":"Passing Structured Object Arrays Across Bun Worker Boundaries Causing Deep Serialization Latency","stars_count":106,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","sqlite","multithreading","zero-copy","performance"],"exportEndpoints":{"claude":"/api/rules/bun-sqlite-zero-copy-arraybuffer-standard?format=claude","cursorMdc":"/api/rules/bun-sqlite-zero-copy-arraybuffer-standard?format=mdc","cursorrules":"/api/rules/bun-sqlite-zero-copy-arraybuffer-standard?format=cursor","windsurf":"/api/rules/bun-sqlite-zero-copy-arraybuffer-standard?format=windsurf","agents":"/api/rules/bun-sqlite-zero-copy-arraybuffer-standard?format=agents"}},{"id":"kmp-coroutine-swift-task-cancellation-propagation","title":"Kotlin Multiplatform Coroutine to Swift Task Bi-Directional Cancellation Propagation","category":"mobile","severity":"critical","description":"Enforces strict cooperative cancellation bridges between Kotlin Native Coroutines and Swift Concurrency Task hierarchies in Kotlin Multiplatform (KMP) iOS targets. Prevents detached task leaks, runaway thread execution, and silent memory retain cycles across the Obj-C runtime bridge by mandating explicit withTaskCancellationHandler wrapping and Swift Task-to-Job cancellation propagation hooks.","antiPatternHeadline":"Orphaned Kotlin Coroutine Jobs Executing After Swift UI/Task Cancellation","stars_count":97,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kmp","kotlin-native","swift-concurrency","ios","coroutines","cancellation"],"exportEndpoints":{"claude":"/api/rules/kmp-coroutine-swift-task-cancellation-propagation?format=claude","cursorMdc":"/api/rules/kmp-coroutine-swift-task-cancellation-propagation?format=mdc","cursorrules":"/api/rules/kmp-coroutine-swift-task-cancellation-propagation?format=cursor","windsurf":"/api/rules/kmp-coroutine-swift-task-cancellation-propagation?format=windsurf","agents":"/api/rules/kmp-coroutine-swift-task-cancellation-propagation?format=agents"}},{"id":"tauri-v2-multi-window-ipc-sandbox-guardrail","title":"Tauri 2.0 Multi-Window Dynamic IPC Channel Sandbox Isolation","category":"mobile","severity":"critical","description":"Enforces strict window-scoped capability boundaries and isolated IPC channels across heterogeneous webviews in Tauri 2.0 mobile and desktop environments. Prevents cross-frame event sniffing, privilege escalation, and unauthorized core plugin invocation by isolating permissions strictly through Tauri 2.0 capability manifests and runtime WebviewWindow label validation.","antiPatternHeadline":"Global IPC Broadcast and Wildcard Permission Escalation Across Untrusted Heterogeneous Webviews","stars_count":73,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri-v2","ipc-security","sandboxing","capabilities","rust"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-multi-window-ipc-sandbox-guardrail?format=claude","cursorMdc":"/api/rules/tauri-v2-multi-window-ipc-sandbox-guardrail?format=mdc","cursorrules":"/api/rules/tauri-v2-multi-window-ipc-sandbox-guardrail?format=cursor","windsurf":"/api/rules/tauri-v2-multi-window-ipc-sandbox-guardrail?format=windsurf","agents":"/api/rules/tauri-v2-multi-window-ipc-sandbox-guardrail?format=agents"}},{"id":"webauthn-prf-wasm-memory-quarantine","title":"WebAuthn PRF Key Quarantine and Isolated WASM Zeroization","category":"security","severity":"critical","description":"Mandates that raw outputs from the WebAuthn PRF (Pseudo-Random Function) extension and resulting derived symmetric keys are quarantined exclusively inside isolated WebAssembly linear memory heaps. Enforces immediate deterministic zeroization post-cryptographic operations to eliminate persistent key exposure across the garbage-collected JavaScript runtime heap.","antiPatternHeadline":"Exposing Raw WebAuthn PRF Secrets to Garbage-Collected JavaScript Heaps or Browser Storage","stars_count":41,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","prf-extension","webassembly","zero-trust","cryptography"],"exportEndpoints":{"claude":"/api/rules/webauthn-prf-wasm-memory-quarantine?format=claude","cursorMdc":"/api/rules/webauthn-prf-wasm-memory-quarantine?format=mdc","cursorrules":"/api/rules/webauthn-prf-wasm-memory-quarantine?format=cursor","windsurf":"/api/rules/webauthn-prf-wasm-memory-quarantine?format=windsurf","agents":"/api/rules/webauthn-prf-wasm-memory-quarantine?format=agents"}},{"id":"cilium-ebpf-wireguard-atomic-key-rotation-fence","title":"Cilium eBPF WireGuard Dual-Slot Atomic Key Rotation and Epoch Fencing","category":"devops","severity":"critical","description":"Enforces generational epoch fencing and dual-slot staging for WireGuard tunnel cryptographic keys within Cilium eBPF maps. Prohibits in-place mutation of active peer session keys, which causes transient decapsulation failures and drops inflight TCP packets. Mandates an atomic generation pointer swap followed by an RCU-aligned conntrack drain period before purging deprecated keys.","antiPatternHeadline":"In-Place WireGuard BPF Map Key Overwrite Inducing TCP Stream Resets During Rotation","stars_count":92,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["cilium","ebpf","wireguard","devops","kubernetes","crypto-agility"],"exportEndpoints":{"claude":"/api/rules/cilium-ebpf-wireguard-atomic-key-rotation-fence?format=claude","cursorMdc":"/api/rules/cilium-ebpf-wireguard-atomic-key-rotation-fence?format=mdc","cursorrules":"/api/rules/cilium-ebpf-wireguard-atomic-key-rotation-fence?format=cursor","windsurf":"/api/rules/cilium-ebpf-wireguard-atomic-key-rotation-fence?format=windsurf","agents":"/api/rules/cilium-ebpf-wireguard-atomic-key-rotation-fence?format=agents"}},{"id":"go-1-24-synctest-virtual-clock-determinism-standard","title":"Go 1.24 synctest Synthetic Bubble & Virtual Clock Determinism Standard","category":"backend","severity":"critical","description":"Enforces isolated synthetic time bubbles using Go 1.24's testing/synctest package across concurrent microservice actor and integration suites. Eliminates non-deterministic wall-clock sleeps, flaky channel polling loops, and real-time race conditions in deadline-sensitive state machines. Guarantees that goroutines within tests advance virtual time instantaneously upon durable blockage without leaking goroutines beyond the bubble boundary.","antiPatternHeadline":"Non-Deterministic Wall-Clock Sleep and Arbitrary Channel Polling in Concurrent Integration Tests","stars_count":105,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","golang","go1.24","synctest","concurrency","testing","virtual-clock"],"exportEndpoints":{"claude":"/api/rules/go-1-24-synctest-virtual-clock-determinism-standard?format=claude","cursorMdc":"/api/rules/go-1-24-synctest-virtual-clock-determinism-standard?format=mdc","cursorrules":"/api/rules/go-1-24-synctest-virtual-clock-determinism-standard?format=cursor","windsurf":"/api/rules/go-1-24-synctest-virtual-clock-determinism-standard?format=windsurf","agents":"/api/rules/go-1-24-synctest-virtual-clock-determinism-standard?format=agents"}},{"id":"nextjs-15-ppr-streaming-shell-isolation","title":"Deterministic Static-to-Dynamic Shell Isolation in Next.js 15 PPR","category":"frontend","severity":"critical","description":"Enforces strict boundary encapsulation between the edge-cached static shell and dynamic streaming segments under Next.js 15 Partial Prerendering (PPR). Mandates that dynamic context reads, unmemoized requests, and runtime I/O are strictly sequestered behind Suspense boundaries to prevent de-optimizing the pre-rendered shell into a blocking, dynamic server-rendered response.","antiPatternHeadline":"Leaking Dynamic Context Reads into the Static Shell Root, Collapsing Edge-Streamable PPR into Blocking Dynamic SSR","stars_count":58,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs","react-server-components","ppr","streaming","performance"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-ppr-streaming-shell-isolation?format=claude","cursorMdc":"/api/rules/nextjs-15-ppr-streaming-shell-isolation?format=mdc","cursorrules":"/api/rules/nextjs-15-ppr-streaming-shell-isolation?format=cursor","windsurf":"/api/rules/nextjs-15-ppr-streaming-shell-isolation?format=windsurf","agents":"/api/rules/nextjs-15-ppr-streaming-shell-isolation?format=agents"}},{"id":"react19-useoptimistic-monotonic-sequence-validation","title":"React 19 useOptimistic Monotonic Sequence Validation and Fencing","category":"frontend","severity":"critical","description":"Enforces monotonic mutation sequence fencing within React 19 useOptimistic reducers and server action handlers. Prevents state regressions, out-of-order resolution jitter, and stale optimistic rollbacks during high-frequency concurrent server action dispatches.","antiPatternHeadline":"Unfenced Optimistic Mutations Collapsing Under Out-of-Order Network Resolution","stars_count":58,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["react19","useoptimistic","concurrency","race-conditions","server-actions"],"exportEndpoints":{"claude":"/api/rules/react19-useoptimistic-monotonic-sequence-validation?format=claude","cursorMdc":"/api/rules/react19-useoptimistic-monotonic-sequence-validation?format=mdc","cursorrules":"/api/rules/react19-useoptimistic-monotonic-sequence-validation?format=cursor","windsurf":"/api/rules/react19-useoptimistic-monotonic-sequence-validation?format=windsurf","agents":"/api/rules/react19-useoptimistic-monotonic-sequence-validation?format=agents"}},{"id":"postgres17-json-table-memory-spill-quota","title":"PostgreSQL 17 JSON_TABLE Memory Spill and Nested Path Materialization Quota","category":"backend","severity":"critical","description":"Enforces deterministic memory quotas and relational materialization boundaries on PostgreSQL 17 SQL/JSON JSON_TABLE projections. Prevents query engine backend OOM kills by restricting unbounded NESTED PATH expansions on dynamic JSONB payloads and enforcing transaction-local work_mem, temp_file_limit, and typed column width boundaries.","antiPatternHeadline":"Unbounded Nested JSON_TABLE Projections Without Local Memory and Spill Controls Triggering Backend OOM","stars_count":105,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql-17","sql-json","json-table","database-reliability","memory-management"],"exportEndpoints":{"claude":"/api/rules/postgres17-json-table-memory-spill-quota?format=claude","cursorMdc":"/api/rules/postgres17-json-table-memory-spill-quota?format=mdc","cursorrules":"/api/rules/postgres17-json-table-memory-spill-quota?format=cursor","windsurf":"/api/rules/postgres17-json-table-memory-spill-quota?format=windsurf","agents":"/api/rules/postgres17-json-table-memory-spill-quota?format=agents"}},{"id":"bun-sqlite-wal-checkpoint-starvation-fence","title":"Bun 1.2 Embedded SQLite WAL Checkpoint Starvation Fence & Deterministic Read Scopes","category":"backend","severity":"critical","description":"Enforces zero-async execution within SQLite transactions, eager cursor materialization, and proactive WAL checkpoint fencing in Bun 1.2. Prevents unbounded Write-Ahead Log disk ballooning and checkpoint deadlocks caused by microtask-delayed read locks holding the SQLite WAL read mark open.","antiPatternHeadline":"Interleaving Async Microtasks Across Open Read Cursors Causing WAL Checkpoint Starvation","stars_count":41,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","sqlite","wal","concurrency","performance"],"exportEndpoints":{"claude":"/api/rules/bun-sqlite-wal-checkpoint-starvation-fence?format=claude","cursorMdc":"/api/rules/bun-sqlite-wal-checkpoint-starvation-fence?format=mdc","cursorrules":"/api/rules/bun-sqlite-wal-checkpoint-starvation-fence?format=cursor","windsurf":"/api/rules/bun-sqlite-wal-checkpoint-starvation-fence?format=windsurf","agents":"/api/rules/bun-sqlite-wal-checkpoint-starvation-fence?format=agents"}},{"id":"go-chi-http3-early-hints-speculative-pipeline-standard","title":"Deterministic RFC 8297 Early Hints Pipeline Synchronization on HTTP/3 QUIC Streams","category":"backend","severity":"critical","description":"Mandates strict synchronization, context propagation, and flow-control limits when dispatching RFC 8297 103 Early Hints across concurrent HTTP/3 QUIC streams in Go Chi services. Prevents transport stream deadlocks, data races on non-thread-safe response writers, and QUIC connection window exhaustion from unconstrained speculative pipeline tasks.","antiPatternHeadline":"Unsynchronized Speculative 103 Early Hints Dispatching Concurrently with Terminal Response Generation","stars_count":63,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","chi","http3","quic","early-hints","concurrency"],"exportEndpoints":{"claude":"/api/rules/go-chi-http3-early-hints-speculative-pipeline-standard?format=claude","cursorMdc":"/api/rules/go-chi-http3-early-hints-speculative-pipeline-standard?format=mdc","cursorrules":"/api/rules/go-chi-http3-early-hints-speculative-pipeline-standard?format=cursor","windsurf":"/api/rules/go-chi-http3-early-hints-speculative-pipeline-standard?format=windsurf","agents":"/api/rules/go-chi-http3-early-hints-speculative-pipeline-standard?format=agents"}},{"id":"tauri-v2-granular-capability-authorization-boundary","title":"Tauri 2.0 Granular Capability Manifest Authorization Boundary","category":"mobile","severity":"critical","description":"Enforces strict isolation between native host capabilities and multi-webview rendering contexts across mobile platforms in Tauri 2.0. Eliminates privilege escalation by mapping individual webview window labels to explicit, least-privilege capability manifests and forbidding catch-all wildcards or runtime command bypasses. Ensures remote or compromised untrusted webview contexts cannot invoke privileged core plugins, filesystem APIs, or native hardware bindings.","antiPatternHeadline":"Assigning global wildcard capabilities across all webviews or allowing untrusted remote content to invoke core IPC commands","stars_count":91,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri","security","ipc","capabilities","rust"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-granular-capability-authorization-boundary?format=claude","cursorMdc":"/api/rules/tauri-v2-granular-capability-authorization-boundary?format=mdc","cursorrules":"/api/rules/tauri-v2-granular-capability-authorization-boundary?format=cursor","windsurf":"/api/rules/tauri-v2-granular-capability-authorization-boundary?format=windsurf","agents":"/api/rules/tauri-v2-granular-capability-authorization-boundary?format=agents"}},{"id":"capacitor-7-hardware-key-attestation-guardrail","title":"Capacitor 7 Hardware-Backed Key Attestation and Native Bridge Cryptographic Guardrail","category":"mobile","severity":"critical","description":"Mandates that all critical Capacitor 7 native plugin dispatches authenticate through hardware-backed cryptographic key attestation (Apple Secure Enclave and Android StrongBox/TEE KeyStore). Prevents runtime payload injection, memory tampering, and Frida/Xposed bridge interception by enforcing per-dispatch signed nonces across the JavaScript-to-Native barrier.","antiPatternHeadline":"Unsigned Native Plugin Dispatches Vulnerable to WebView Bridge Interception and Tampering","stars_count":107,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor-7","secure-enclave","android-keystore","hardware-attestation","zero-trust-bridge"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-hardware-key-attestation-guardrail?format=claude","cursorMdc":"/api/rules/capacitor-7-hardware-key-attestation-guardrail?format=mdc","cursorrules":"/api/rules/capacitor-7-hardware-key-attestation-guardrail?format=cursor","windsurf":"/api/rules/capacitor-7-hardware-key-attestation-guardrail?format=windsurf","agents":"/api/rules/capacitor-7-hardware-key-attestation-guardrail?format=agents"}},{"id":"webauthn-prf-step-up-cryptographic-fence","title":"WebAuthn Level 3 PRF Extension Cryptographic Step-Up Isolation","category":"security","severity":"critical","description":"Enforces deterministic, hardware-bound cryptographic key derivation using WebAuthn Level 3 Pseudo-Random Function (PRF) extension during step-up challenges. Guarantees client-side decryption barriers that prevent cloud-synced passkey clones from decrypting sensitive data without an interactive, hardware-verified biometric assertion.","antiPatternHeadline":"Trusting Synced Passkey Signatures for Data Access Without In-Authenticator PRF Key Derivation","stars_count":54,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","prf-extension","cryptography","zero-knowledge","passkeys"],"exportEndpoints":{"claude":"/api/rules/webauthn-prf-step-up-cryptographic-fence?format=claude","cursorMdc":"/api/rules/webauthn-prf-step-up-cryptographic-fence?format=mdc","cursorrules":"/api/rules/webauthn-prf-step-up-cryptographic-fence?format=cursor","windsurf":"/api/rules/webauthn-prf-step-up-cryptographic-fence?format=windsurf","agents":"/api/rules/webauthn-prf-step-up-cryptographic-fence?format=agents"}},{"id":"ebpf-sockops-kernel-bypass-mtls-auth-guardrail","title":"eBPF sockops Kernel-Bypass Authorization Verification Standard","category":"security","severity":"critical","description":"Enforces that eBPF BPF_PROG_TYPE_SOCK_OPS and BPF_MAP_TYPE_SOCKMAP implementations never unconditionally redirect socket buffers at the transport layer without explicit userspace attestation of Layer-7 authorization and mTLS identity. Prevents premature sk_msg/sockops kernel-bypass which evades iptables, netfilter, service mesh policy checks, and SPIFFE/SPIRE identity validation before handshake finalization.","antiPatternHeadline":"Blind BPF_SOCK_OPS Socket Redirection Bypassing L7 Authorization and Mutual TLS Enforcement","stars_count":109,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","ebpf","sockops","sockmap","mtls","kernel-bypass","service-mesh","zero-trust"],"exportEndpoints":{"claude":"/api/rules/ebpf-sockops-kernel-bypass-mtls-auth-guardrail?format=claude","cursorMdc":"/api/rules/ebpf-sockops-kernel-bypass-mtls-auth-guardrail?format=mdc","cursorrules":"/api/rules/ebpf-sockops-kernel-bypass-mtls-auth-guardrail?format=cursor","windsurf":"/api/rules/ebpf-sockops-kernel-bypass-mtls-auth-guardrail?format=windsurf","agents":"/api/rules/ebpf-sockops-kernel-bypass-mtls-auth-guardrail?format=agents"}},{"id":"opentelemetry-v128-exemplar-cardinality-budget-guardrail","title":"OpenTelemetry v1.28 Exemplar Cardinality & Buffer Saturation Guardrail","category":"devops","severity":"critical","description":"Enforces deterministic bounded exemplar retention and probabilistic reservoir sampling across OpenTelemetry v1.28+ collectors and SDKs. Prevents uncontrolled memory bloat and collector crash loops caused by unbudgeted trace exemplar attachment during high-throughput tail-latency metric surges. Mandates explicit reservoir capacity caps, filtered exemplar attachment, and collector batch queue drop-on-overflow behaviors.","antiPatternHeadline":"Unbounded Trace Exemplar Accumulation Saturating Telemetry Buffers During Latency Anomalies","stars_count":94,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","observability","metrics","tracing","site-reliability"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-v128-exemplar-cardinality-budget-guardrail?format=claude","cursorMdc":"/api/rules/opentelemetry-v128-exemplar-cardinality-budget-guardrail?format=mdc","cursorrules":"/api/rules/opentelemetry-v128-exemplar-cardinality-budget-guardrail?format=cursor","windsurf":"/api/rules/opentelemetry-v128-exemplar-cardinality-budget-guardrail?format=windsurf","agents":"/api/rules/opentelemetry-v128-exemplar-cardinality-budget-guardrail?format=agents"}},{"id":"axum-0-8-cancellation-and-socket-draining","title":"Axum 0.8 Tower Service Graceful Cancellation and Socket Draining","category":"backend","severity":"critical","description":"Enforces deterministic upstream socket draining, cancellation safety, and connection lifecycle management in Axum 0.8 and Hyper 1.x. Prevents TCP socket descriptor leaks, buffer starvation, and half-open connection accumulation during high-concurrency client disconnect storms.","antiPatternHeadline":"Unbounded Body Drops and Non-Cancellation-Safe Select Loops Causing Socket Starvation","stars_count":66,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["rust","axum","tower","hyper","async","concurrency","cancellation-safety"],"exportEndpoints":{"claude":"/api/rules/axum-0-8-cancellation-and-socket-draining?format=claude","cursorMdc":"/api/rules/axum-0-8-cancellation-and-socket-draining?format=mdc","cursorrules":"/api/rules/axum-0-8-cancellation-and-socket-draining?format=cursor","windsurf":"/api/rules/axum-0-8-cancellation-and-socket-draining?format=windsurf","agents":"/api/rules/axum-0-8-cancellation-and-socket-draining?format=agents"}},{"id":"postgres-17-streaming-io-combine-limit-guardrail","title":"PostgreSQL 17 Streaming Read Concurrency and io_combine_limit Invariant","category":"backend","severity":"critical","description":"PostgreSQL 17 introduces block-level streaming read infrastructure that aggressively prefetches sequential blocks to maximize I/O throughput. In multi-terabyte analytics and parallel scan workloads, unbounded prefetching collapses kernel page cache and evicts hot shared_buffers blocks, resulting in severe latency spikes. All database pool configurations, analytics runners, and cluster definitions must bound io_combine_limit and session-level read streams to match storage block sizes and controller queue depths.","antiPatternHeadline":"Unbounded Streaming Prefetch and Default io_combine_limit Causing Shared Buffer and Page Cache Eviction","stars_count":62,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql-17","streaming-io","io-combine-limit","database-performance"],"exportEndpoints":{"claude":"/api/rules/postgres-17-streaming-io-combine-limit-guardrail?format=claude","cursorMdc":"/api/rules/postgres-17-streaming-io-combine-limit-guardrail?format=mdc","cursorrules":"/api/rules/postgres-17-streaming-io-combine-limit-guardrail?format=cursor","windsurf":"/api/rules/postgres-17-streaming-io-combine-limit-guardrail?format=windsurf","agents":"/api/rules/postgres-17-streaming-io-combine-limit-guardrail?format=agents"}},{"id":"bun-v12-chunked-zero-alloc-backpressure","title":"Bun 1.2 Chunked Transfer Zero-Allocation Backpressure Standard","category":"backend","severity":"critical","description":"Enforces synchronous socket backpressure propagation to upstream streaming producers across Bun 1.2 HTTP servers and TCP/TLS sockets. Mandates non-allocating chunk emission patterns, consumption of direct ArrayBuffer views via Native ReadableStream controllers, and absolute avoidance of unbounded async push queues during gigabyte-scale transfers.","antiPatternHeadline":"Unbounded Push-Style Streaming Causing Silent Heap Bloat and Process OOM","stars_count":62,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","streams","backpressure","memory-optimization","http2"],"exportEndpoints":{"claude":"/api/rules/bun-v12-chunked-zero-alloc-backpressure?format=claude","cursorMdc":"/api/rules/bun-v12-chunked-zero-alloc-backpressure?format=mdc","cursorrules":"/api/rules/bun-v12-chunked-zero-alloc-backpressure?format=cursor","windsurf":"/api/rules/bun-v12-chunked-zero-alloc-backpressure?format=windsurf","agents":"/api/rules/bun-v12-chunked-zero-alloc-backpressure?format=agents"}},{"id":"kmp-compose-mutex-safe-main-dispatcher-pinning","title":"KMP Compose Mutex-Safe Main Dispatcher Pinning & Swift Affinity Contract","category":"mobile","severity":"critical","description":"Enforces strict thread-affinity contracts between Compose Multiplatform runtime snapshots and iOS Swift Concurrency dispatchers. Prevents hard UI freezes, CADisplayLink starvation, and Darwin runloop deadlocks caused by unconfined coroutine hopping and unpinned Mutex acquisitions during state reconciliation.","antiPatternHeadline":"Cross-Dispatcher Mutex Contention and Unpinned Snapshot State Mutation on iOS Darwin Main Runloop","stars_count":83,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kmp","compose-multiplatform","kotlin","swift-concurrency","dispatchers","deadlock-prevention"],"exportEndpoints":{"claude":"/api/rules/kmp-compose-mutex-safe-main-dispatcher-pinning?format=claude","cursorMdc":"/api/rules/kmp-compose-mutex-safe-main-dispatcher-pinning?format=mdc","cursorrules":"/api/rules/kmp-compose-mutex-safe-main-dispatcher-pinning?format=cursor","windsurf":"/api/rules/kmp-compose-mutex-safe-main-dispatcher-pinning?format=windsurf","agents":"/api/rules/kmp-compose-mutex-safe-main-dispatcher-pinning?format=agents"}},{"id":"rn-bridgeless-turbomodule-zero-copy-jsi-memory-safety","title":"React Native 0.78 Bridgeless TurboModule Zero-Copy JSI Memory Safety","category":"mobile","severity":"critical","description":"Enforces strict memory safety invariants across hybrid C++ JSI host boundaries in React Native 0.78 Bridgeless TurboModules. Prevents fatal SIGSEGV crashes and dangling pointer dereferences caused by concurrent Hermes garbage collection passes invalidating raw ArrayBuffer pointers and unpinned HostObjects during asynchronous thread transitions.","antiPatternHeadline":"Retaining raw native buffer pointers across async boundaries without Hermes JSI lifecycle anchoring","stars_count":50,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","react-native","turbomodules","jsi","c++","hermes","zero-copy","memory-safety"],"exportEndpoints":{"claude":"/api/rules/rn-bridgeless-turbomodule-zero-copy-jsi-memory-safety?format=claude","cursorMdc":"/api/rules/rn-bridgeless-turbomodule-zero-copy-jsi-memory-safety?format=mdc","cursorrules":"/api/rules/rn-bridgeless-turbomodule-zero-copy-jsi-memory-safety?format=cursor","windsurf":"/api/rules/rn-bridgeless-turbomodule-zero-copy-jsi-memory-safety?format=windsurf","agents":"/api/rules/rn-bridgeless-turbomodule-zero-copy-jsi-memory-safety?format=agents"}},{"id":"rfc-9449-dpop-edge-distributed-nonce-sync","title":"RFC 9449 Edge Distributed DPoP Nonce Validation and Stateless Verification Standard","category":"security","severity":"critical","description":"Enforces edge-optimized, stateless cryptographic nonce generation and validation conforming to RFC 9449 for globally distributed reverse proxies. Prevents proof-of-possession replay and cross-region token theft without introducing centralized cross-region database round-trip latencies.","antiPatternHeadline":"Centralized database round-trips for nonce verification or accepting unauthenticated, state-free DPoP nonces across edge regions","stars_count":43,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","rfc-9449","dpop","edge-computing","zero-trust","replay-prevention"],"exportEndpoints":{"claude":"/api/rules/rfc-9449-dpop-edge-distributed-nonce-sync?format=claude","cursorMdc":"/api/rules/rfc-9449-dpop-edge-distributed-nonce-sync?format=mdc","cursorrules":"/api/rules/rfc-9449-dpop-edge-distributed-nonce-sync?format=cursor","windsurf":"/api/rules/rfc-9449-dpop-edge-distributed-nonce-sync?format=windsurf","agents":"/api/rules/rfc-9449-dpop-edge-distributed-nonce-sync?format=agents"}},{"id":"fido2-enterprise-attestation-hardware-passkey","title":"Hardware-Bound Passkey Enforcement via FIDO2 Enterprise Attestation & AAGUID Verification","category":"security","severity":"critical","description":"Enforces strict cryptographic verification of WebAuthn enterprise attestation statements and hardware certificate chains during passkey enrollment. Prevents unauthorized consumer multi-device synced passkeys from entering zero-trust identity perimeters by binding authentication exclusively to vetted FIDO2 Hardware Security Modules (HSMs).","antiPatternHeadline":"Accepting Unverified Synced Passkeys via Attestation None and Blind AAGUID Trust","stars_count":117,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","fido2","zero-trust","cryptography","passkeys"],"exportEndpoints":{"claude":"/api/rules/fido2-enterprise-attestation-hardware-passkey?format=claude","cursorMdc":"/api/rules/fido2-enterprise-attestation-hardware-passkey?format=mdc","cursorrules":"/api/rules/fido2-enterprise-attestation-hardware-passkey?format=cursor","windsurf":"/api/rules/fido2-enterprise-attestation-hardware-passkey?format=windsurf","agents":"/api/rules/fido2-enterprise-attestation-hardware-passkey?format=agents"}},{"id":"k8s-gateway-api-reference-grant-cross-namespace-invariant-kubernetes-gatew-387","title":"Kubernetes Gateway API ReferenceGrant Cross-Namespace Authorization Contract","category":"devops","severity":"critical","description":"Enforces deterministic, cryptographically attested cross-namespace routing boundaries in multi-tenant Kubernetes Gateway API deployments. Mandates that every cross-namespace route-to-service or gateway-to-secret reference is explicitly matched by a targeted, non-wildcard ReferenceGrant deployed in the target namespace. Prevents tenant route hijacking, unauthorized secret exfiltration, and silent ingress misconfigurations.","antiPatternHeadline":"Implicit Cross-Namespace Route Forwarding Without Target-Namespace ReferenceGrant Validation","stars_count":83,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["kubernetes","gateway-api","security","multi-tenancy","referencegrant","rbac","devops"],"exportEndpoints":{"claude":"/api/rules/k8s-gateway-api-reference-grant-cross-namespace-invariant-kubernetes-gatew-387?format=claude","cursorMdc":"/api/rules/k8s-gateway-api-reference-grant-cross-namespace-invariant-kubernetes-gatew-387?format=mdc","cursorrules":"/api/rules/k8s-gateway-api-reference-grant-cross-namespace-invariant-kubernetes-gatew-387?format=cursor","windsurf":"/api/rules/k8s-gateway-api-reference-grant-cross-namespace-invariant-kubernetes-gatew-387?format=windsurf","agents":"/api/rules/k8s-gateway-api-reference-grant-cross-namespace-invariant-kubernetes-gatew-387?format=agents"}},{"id":"otel-tail-sampling-dynamic-ring-buffer-breaker","title":"OpenTelemetry Tail-Based Sampling Dynamic Ring-Buffer Circuit Breaker","category":"devops","severity":"critical","description":"Enforces backpressure-driven probabilistic sampling decay and strict memory-bounded ring buffers within OpenTelemetry tail-based sampling pipelines. Prevents collector node OOM cascading failures during traffic surges by dynamically decaying trace retention windows and dropping non-error traces when ring-buffer memory pressure hits critical high-water marks.","antiPatternHeadline":"Unbounded In-Memory Trace Buffering Without Memory Pressure Circuit Breaking","stars_count":115,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","observability","resilience","distributed-tracing","memory-management"],"exportEndpoints":{"claude":"/api/rules/otel-tail-sampling-dynamic-ring-buffer-breaker?format=claude","cursorMdc":"/api/rules/otel-tail-sampling-dynamic-ring-buffer-breaker?format=mdc","cursorrules":"/api/rules/otel-tail-sampling-dynamic-ring-buffer-breaker?format=cursor","windsurf":"/api/rules/otel-tail-sampling-dynamic-ring-buffer-breaker?format=windsurf","agents":"/api/rules/otel-tail-sampling-dynamic-ring-buffer-breaker?format=agents"}},{"id":"vite6-environment-api-runtime-isolation-vite-6-environme-259","title":"Vite 6 Environment API Isomorphic Runtime Isolation Standard","category":"frontend","severity":"critical","description":"Enforces strict memory isolation, runner boundaries, and resolve condition partitioning across Node.js, Workerd (edge), and browser environments using the Vite 6 Environment API. Prevents cross-runtime prototype pollution, illegal host-specific globals leakage, and legacy single-graph SSR execution flaws.","antiPatternHeadline":"Conflating Server Execution Environments via Legacy Vite 5 SSR APIs and Leaking Node Globals into Workerd or Browser Runtimes","stars_count":74,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","vite-6","environment-api","ssr","workerd","cloudflare-workers","module-runner"],"exportEndpoints":{"claude":"/api/rules/vite6-environment-api-runtime-isolation-vite-6-environme-259?format=claude","cursorMdc":"/api/rules/vite6-environment-api-runtime-isolation-vite-6-environme-259?format=mdc","cursorrules":"/api/rules/vite6-environment-api-runtime-isolation-vite-6-environme-259?format=cursor","windsurf":"/api/rules/vite6-environment-api-runtime-isolation-vite-6-environme-259?format=windsurf","agents":"/api/rules/vite6-environment-api-runtime-isolation-vite-6-environme-259?format=agents"}},{"id":"pg17-failover-slot-synchronization-standard","title":"PostgreSQL 17 Failover Slot Synchronization High-Availability Standard","category":"backend","severity":"critical","description":"Enforces seamless logical CDC replication persistence across physical replica failovers using PostgreSQL 17 logical failover slots and synchronized standby slots. Ensures upstream applications create replication slots with `failover = true`, mandates primary `synchronized_standby_slots` alignment to prevent slot advance beyond standby LSN boundaries, and configures standbys with `sync_replication_slots = true` to prevent data loss or duplicate streaming upon promotion.","antiPatternHeadline":"Unsynchronized Logical Slots and Uncoordinated LSN Advance Leading to CDC Split-Brain or Slot Eviction Upon Standby Promotion","stars_count":103,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql-17","cdc","high-availability","replication-slots","debezium","database-reliability"],"exportEndpoints":{"claude":"/api/rules/pg17-failover-slot-synchronization-standard?format=claude","cursorMdc":"/api/rules/pg17-failover-slot-synchronization-standard?format=mdc","cursorrules":"/api/rules/pg17-failover-slot-synchronization-standard?format=cursor","windsurf":"/api/rules/pg17-failover-slot-synchronization-standard?format=windsurf","agents":"/api/rules/pg17-failover-slot-synchronization-standard?format=agents"}},{"id":"bun-multi-worker-zero-copy-socket-handoff-standard","title":"Bun 1.2 Zero-Copy TCP Socket Handoff and Kernel-Level Load Balancing","category":"backend","severity":"critical","description":"Enforces Bun 1.2 native zero-copy TCP socket architecture across clustered worker threads. Eliminates redundant user-space byte buffering, stream proxying, and IPC serialization by delegating socket distribution directly to the OS kernel via SO_REUSEPORT or Bun native socket transfers.","antiPatternHeadline":"User-Space Request Proxying and Stream Buffering Across Bun Worker Threads","stars_count":92,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","networking","clustering","performance","tcp"],"exportEndpoints":{"claude":"/api/rules/bun-multi-worker-zero-copy-socket-handoff-standard?format=claude","cursorMdc":"/api/rules/bun-multi-worker-zero-copy-socket-handoff-standard?format=mdc","cursorrules":"/api/rules/bun-multi-worker-zero-copy-socket-handoff-standard?format=cursor","windsurf":"/api/rules/bun-multi-worker-zero-copy-socket-handoff-standard?format=windsurf","agents":"/api/rules/bun-multi-worker-zero-copy-socket-handoff-standard?format=agents"}},{"id":"go-1-24-swissmap-request-scope-allocation-invariant","title":"Go 1.24 Swiss Tables Map Request Scope Allocation and Clear Semantics","category":"backend","severity":"critical","description":"Enforces zero-allocation reuse and optimal layout for Go 1.24 Swiss Table map architectures in ultra-high-throughput request pipelines. Prevents request-scoped heap reallocations, un-pre-sized map expansion storms, and improper pointer retainment by mandating clear() semantics and sync.Pool amortizations under million-RPS concurrency.","antiPatternHeadline":"Ephemeral Request-Scoped Map Instantiations Causing GC Churn and Memory Reallocation Under High Concurrency","stars_count":91,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","golang","go124","swiss-tables","memory-allocations","high-throughput","concurrency"],"exportEndpoints":{"claude":"/api/rules/go-1-24-swissmap-request-scope-allocation-invariant?format=claude","cursorMdc":"/api/rules/go-1-24-swissmap-request-scope-allocation-invariant?format=mdc","cursorrules":"/api/rules/go-1-24-swissmap-request-scope-allocation-invariant?format=cursor","windsurf":"/api/rules/go-1-24-swissmap-request-scope-allocation-invariant?format=windsurf","agents":"/api/rules/go-1-24-swissmap-request-scope-allocation-invariant?format=agents"}},{"id":"openfga-bounded-contextual-tuples-standard","title":"Bounded In-Memory Subtrees for OpenFGA Contextual Tuple Authorization","category":"security","severity":"critical","description":"Enforces strict structural bounds, cardinality limits, and relation allowlists on OpenFGA ephemeral contextual tuples during authorization evaluation. Injecting unconstrained or cyclic contextual tuples into in-memory resolution graphs triggers unbounded graph traversals and memory bloat, causing authorization denial-of-service (AuthDoS).","antiPatternHeadline":"Injecting Arbitrary, Unbounded Ephemeral Tuples into OpenFGA Check Traversals","stars_count":42,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","authorization","fine-grained-access-control","authdos"],"exportEndpoints":{"claude":"/api/rules/openfga-bounded-contextual-tuples-standard?format=claude","cursorMdc":"/api/rules/openfga-bounded-contextual-tuples-standard?format=mdc","cursorrules":"/api/rules/openfga-bounded-contextual-tuples-standard?format=cursor","windsurf":"/api/rules/openfga-bounded-contextual-tuples-standard?format=windsurf","agents":"/api/rules/openfga-bounded-contextual-tuples-standard?format=agents"}},{"id":"webauthn-l3-conditional-mediation-guardrail","title":"WebAuthn L3 Conditional Mediation & Cross-Device Tunnel Guardrail","category":"security","severity":"critical","description":"Enforces strict implementation standards for WebAuthn Level 3 conditional UI (autofill) and hybrid transport (caBLE/cross-device) authentication flows. Guarantees non-blocking asynchronous mediation initialization paired with robust AbortController lifecycle management and server-side origin/RP ID binding to eliminate credential friction and prevent tunnel-hijacking phishing vectors.","antiPatternHeadline":"Unmediated Modal-Locking Credential Requests and Race-Prone Abort Signals in Hybrid Passkey Flows","stars_count":61,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","passkeys","fido2","conditional-ui","authentication"],"exportEndpoints":{"claude":"/api/rules/webauthn-l3-conditional-mediation-guardrail?format=claude","cursorMdc":"/api/rules/webauthn-l3-conditional-mediation-guardrail?format=mdc","cursorrules":"/api/rules/webauthn-l3-conditional-mediation-guardrail?format=cursor","windsurf":"/api/rules/webauthn-l3-conditional-mediation-guardrail?format=windsurf","agents":"/api/rules/webauthn-l3-conditional-mediation-guardrail?format=agents"}},{"id":"cilium-ebpf-host-routing-mtls-invariant","title":"Cilium eBPF Host-Routing Node-to-Node Pod mTLS Invariant","category":"devops","severity":"critical","description":"Enforces kernel-level eBPF cryptographic encapsulation and direct host routing while eliminating userspace sidecar proxies and legacy iptables overhead. Ensures all cross-node Pod-to-Pod traffic strictly traverses authenticated WireGuard or IPsec tunnels managed via Cilium endpoints without packet reinjection or intermediate unencrypted hops.","antiPatternHeadline":"Bypassing eBPF Host-Routing or Disabling WireGuard/IPsec Encapsulation for Userspace Sidecars","stars_count":62,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","cilium","ebpf","mtls","kubernetes","networking","zero-trust"],"exportEndpoints":{"claude":"/api/rules/cilium-ebpf-host-routing-mtls-invariant?format=claude","cursorMdc":"/api/rules/cilium-ebpf-host-routing-mtls-invariant?format=mdc","cursorrules":"/api/rules/cilium-ebpf-host-routing-mtls-invariant?format=cursor","windsurf":"/api/rules/cilium-ebpf-host-routing-mtls-invariant?format=windsurf","agents":"/api/rules/cilium-ebpf-host-routing-mtls-invariant?format=agents"}},{"id":"opentelemetry-arrow-columnar-ingestion-standard-opentelemetry-ar-221","title":"OpenTelemetry Arrow Columnar Protocol High-Throughput Ingestion Standard","category":"devops","severity":"critical","description":"Enforces Apache Arrow columnar zero-copy serialization for high-volume trace and metric telemetry delivery across edge nodes prior to network egress. Eliminates standard row-oriented OTLP protobuf serialization bottlenecks and reduces CPU/memory pressure on ingestion collectors by preserving Arrow RecordBatch chunking semantics throughout the export pipeline.","antiPatternHeadline":"Row-by-Row OTLP Protobuf Serialization at High Egress Telemetry Volumes","stars_count":103,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","apache-arrow","observability","performance","high-throughput"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-arrow-columnar-ingestion-standard-opentelemetry-ar-221?format=claude","cursorMdc":"/api/rules/opentelemetry-arrow-columnar-ingestion-standard-opentelemetry-ar-221?format=mdc","cursorrules":"/api/rules/opentelemetry-arrow-columnar-ingestion-standard-opentelemetry-ar-221?format=cursor","windsurf":"/api/rules/opentelemetry-arrow-columnar-ingestion-standard-opentelemetry-ar-221?format=windsurf","agents":"/api/rules/opentelemetry-arrow-columnar-ingestion-standard-opentelemetry-ar-221?format=agents"}},{"id":"nextjs15-rsc-taint-object-reference-fencing","title":"Next.js 15 RSC Experimental Taint Object Reference Fencing","category":"frontend","severity":"critical","description":"Enforces strict cryptographic taint fences on raw domain models and secrets using React's experimental_taintObjectReference and experimental_taintUniqueValue in Next.js 15 Server Components. This categorically eliminates the risk of PII, secret keys, or sensitive backend state crossing the Server-Client serialization wire into client bundles.","antiPatternHeadline":"Passing Raw Server-Side Domain Entities or Unmasked Credentials Directly to Client Components","stars_count":50,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["nextjs15","react-server-components","taint-api","security","zero-trust","frontend"],"exportEndpoints":{"claude":"/api/rules/nextjs15-rsc-taint-object-reference-fencing?format=claude","cursorMdc":"/api/rules/nextjs15-rsc-taint-object-reference-fencing?format=mdc","cursorrules":"/api/rules/nextjs15-rsc-taint-object-reference-fencing?format=cursor","windsurf":"/api/rules/nextjs15-rsc-taint-object-reference-fencing?format=windsurf","agents":"/api/rules/nextjs15-rsc-taint-object-reference-fencing?format=agents"}},{"id":"postgres-17-failover-slot-cdc-synchronization","title":"PostgreSQL 17 Logical Replication Failover Slot Synchronization Guardrail","category":"backend","severity":"critical","description":"Enforces failover-enabled logical replication slots ('failover = true') and physical standby synchronization ('sync_replication_slots = on') introduced in PostgreSQL 17. Eliminates orphaned slots and duplicate change data capture (CDC) streams during physical standby failovers by strictly locking LSN boundaries across the cluster.","antiPatternHeadline":"Orphaned Logical Slots on Standby Promotion Triggering CDC Duplication or WAL Data Loss","stars_count":51,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql-17","cdc","logical-replication","high-availability","failover"],"exportEndpoints":{"claude":"/api/rules/postgres-17-failover-slot-cdc-synchronization?format=claude","cursorMdc":"/api/rules/postgres-17-failover-slot-cdc-synchronization?format=mdc","cursorrules":"/api/rules/postgres-17-failover-slot-cdc-synchronization?format=cursor","windsurf":"/api/rules/postgres-17-failover-slot-cdc-synchronization?format=windsurf","agents":"/api/rules/postgres-17-failover-slot-cdc-synchronization?format=agents"}},{"id":"fastapi-anyio-worker-threadpool-circuit-breaker","title":"FastAPI AnyIO Worker Thread Pool Offloading and Concurrency Shedding Circuit Breaker","category":"backend","severity":"critical","description":"Uninstrumented synchronous I/O and intensive CPU-bound serialization inside async FastAPI handlers cause severe asyncio event loop starvation and thread pool starvation. This standard mandates explicit offloading to AnyIO worker thread pools governed by an isolated CapacityLimiter and an adaptive circuit breaker that sheds load before thread worker queue saturation degrades service reliability.","antiPatternHeadline":"Executing blocking I/O or heavy Pydantic serialization directly in async def handlers or unbounded run_in_threadpool invocations.","stars_count":114,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","anyio","asyncio","concurrency","circuit-breaker"],"exportEndpoints":{"claude":"/api/rules/fastapi-anyio-worker-threadpool-circuit-breaker?format=claude","cursorMdc":"/api/rules/fastapi-anyio-worker-threadpool-circuit-breaker?format=mdc","cursorrules":"/api/rules/fastapi-anyio-worker-threadpool-circuit-breaker?format=cursor","windsurf":"/api/rules/fastapi-anyio-worker-threadpool-circuit-breaker?format=windsurf","agents":"/api/rules/fastapi-anyio-worker-threadpool-circuit-breaker?format=agents"}},{"id":"axum-0-8-tower-bounded-body-buffer-rejection-standard","title":"Axum 0.8 Tower Service Layer Bounded Body Buffer Rejection Standard","category":"backend","severity":"critical","description":"Enforces deterministic byte bounds at the Tower service middleware boundary prior to any request deserialization or extractor evaluation in Axum 0.8 applications. Unbounded or handler-deferred body buffering exposes the transport layer to heap fragmentation, slowloris byte-drip exhaustion, and memory exhaustion DoS vectors under peak concurrency. Strict adherence ensures requests exceeding payload constraints are terminated with HTTP 413 at the I/O stream level before triggering heap allocations.","antiPatternHeadline":"Handler-Level Deferred Buffering and Unbounded Byte Stream Consumption Permitting Transport Exhaustion","stars_count":47,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tower","security","memory-safety","dos-protection"],"exportEndpoints":{"claude":"/api/rules/axum-0-8-tower-bounded-body-buffer-rejection-standard?format=claude","cursorMdc":"/api/rules/axum-0-8-tower-bounded-body-buffer-rejection-standard?format=mdc","cursorrules":"/api/rules/axum-0-8-tower-bounded-body-buffer-rejection-standard?format=cursor","windsurf":"/api/rules/axum-0-8-tower-bounded-body-buffer-rejection-standard?format=windsurf","agents":"/api/rules/axum-0-8-tower-bounded-body-buffer-rejection-standard?format=agents"}},{"id":"capacitor7-keystore-nonce-enclave-barrier","title":"Capacitor 7 Hardware-Backed KeyStore Cryptographic Nonce Enclave Barrier","category":"mobile","severity":"critical","description":"Enforces strict isolation between Capacitor 7 WebViews and hardware-backed keystores (Android StrongBox/TEE and iOS Secure Enclave) via single-use, server-attested challenge nonces. Prevents bridge memory-scraping and replay attacks by guaranteeing that the native enclave signs only cryptographically fresh, atomically consumed payloads and never exposes raw key material to the JavaScript runtime.","antiPatternHeadline":"Unbounded or Nonce-Less WebView Native Cryptographic Invocations Vulnerable to Bridge Scraping and Replay","stars_count":73,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","security","cryptography","biometrics","ios","android"],"exportEndpoints":{"claude":"/api/rules/capacitor7-keystore-nonce-enclave-barrier?format=claude","cursorMdc":"/api/rules/capacitor7-keystore-nonce-enclave-barrier?format=mdc","cursorrules":"/api/rules/capacitor7-keystore-nonce-enclave-barrier?format=cursor","windsurf":"/api/rules/capacitor7-keystore-nonce-enclave-barrier?format=windsurf","agents":"/api/rules/capacitor7-keystore-nonce-enclave-barrier?format=agents"}},{"id":"webauthn-conditional-mediation-origin-attestation","title":"WebAuthn Conditional Mediation Step-Up Attestation & Cryptographic Origin Invariant","category":"security","severity":"critical","description":"Mandates strict cryptographic validation of clientDataJSON origin, challenge replay defense, authenticator data flags, and hardware-backed attestation during passkey conditional mediation and auto-upgrade step-up flows. Neutralizes Adversary-in-the-Middle (AitM) reverse proxy relay attacks by enforcing canonical Relying Party bindings and hardware security tier verification.","antiPatternHeadline":"Reflecting client-supplied origins, skipping user verification flags, or omitting hardware attestation during passkey step-up authentication.","stars_count":52,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","fido2","passkeys","attestation","aitm-defense","zero-trust"],"exportEndpoints":{"claude":"/api/rules/webauthn-conditional-mediation-origin-attestation?format=claude","cursorMdc":"/api/rules/webauthn-conditional-mediation-origin-attestation?format=mdc","cursorrules":"/api/rules/webauthn-conditional-mediation-origin-attestation?format=cursor","windsurf":"/api/rules/webauthn-conditional-mediation-origin-attestation?format=windsurf","agents":"/api/rules/webauthn-conditional-mediation-origin-attestation?format=agents"}},{"id":"openfga-edge-cache-invalidation-mesh-guardrail","title":"OpenFGA Distributed Edge Invalidation Mesh and Causal Consistency Guardrail","category":"security","severity":"critical","description":"Mandates strict causal consistency and sub-millisecond cache eviction semantics across distributed edge gateways during OpenFGA relationship tuple mutations. Enforces transactional outbox publishing with monotonic sequencing tokens to prevent authorization bypasses and privilege persistence vulnerabilities caused by race conditions. Disallows optimistic TTL-only edge caching and non-atomic dual-write broadcast mechanisms.","antiPatternHeadline":"Dual-Write Race Conditions and TTL-Only Invalidation in Distributed Authorization Caches","stars_count":60,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","rebac","edge-computing","cache-invalidation","event-mesh"],"exportEndpoints":{"claude":"/api/rules/openfga-edge-cache-invalidation-mesh-guardrail?format=claude","cursorMdc":"/api/rules/openfga-edge-cache-invalidation-mesh-guardrail?format=mdc","cursorrules":"/api/rules/openfga-edge-cache-invalidation-mesh-guardrail?format=cursor","windsurf":"/api/rules/openfga-edge-cache-invalidation-mesh-guardrail?format=windsurf","agents":"/api/rules/openfga-edge-cache-invalidation-mesh-guardrail?format=agents"}},{"id":"otel-profiling-frame-pointer-unwinding-guardrail","title":"OpenTelemetry Continuous Profiling Frame Pointer Unwinding Guardrail","category":"devops","severity":"critical","description":"Enforces preservation of frame pointers across all compiled languages and runtimes in containerized production workloads to enable zero-overhead eBPF stack unwinding. Prohibits runtime DWARF unwinding in production containers, capping continuous profiling CPU overhead below 1% while eliminating kernel-to-userspace page-fault stalls. Ensures full stack visibility across mixed native, Go, JVM, and Node.js call graphs for OpenTelemetry Profiling agents.","antiPatternHeadline":"Compiling production binaries with frame pointer omission, causing eBPF profilers to fail unwinding or fall back to resource-intensive DWARF parsers.","stars_count":46,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","continuous-profiling","ebpf","docker","cgo","performance"],"exportEndpoints":{"claude":"/api/rules/otel-profiling-frame-pointer-unwinding-guardrail?format=claude","cursorMdc":"/api/rules/otel-profiling-frame-pointer-unwinding-guardrail?format=mdc","cursorrules":"/api/rules/otel-profiling-frame-pointer-unwinding-guardrail?format=cursor","windsurf":"/api/rules/otel-profiling-frame-pointer-unwinding-guardrail?format=windsurf","agents":"/api/rules/otel-profiling-frame-pointer-unwinding-guardrail?format=agents"}},{"id":"cilium-ebpf-host-routing-ipsec-key-rollover-standard","title":"Cilium eBPF Host-Routing BPF-Native IPsec Dynamic Key Rollover Standard","category":"devops","severity":"critical","description":"Enforces zero-copy eBPF host-routing alongside BPF-native IPsec dynamic key rotation within Kubernetes pod meshes. Eliminates sk_buff allocation overhead, socket buffer duplication, and tunnel drops by synchronizing Linux XFRM SA/SP states with eBPF tail-call routing maps via seamless SPI progression.","antiPatternHeadline":"Legacy Linux XFRM Transformation Fallback with In-Flight Packet Loss During Asymmetric IPsec Key Rotation","stars_count":105,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","cilium","ebpf","ipsec","kubernetes","networking","xfrm"],"exportEndpoints":{"claude":"/api/rules/cilium-ebpf-host-routing-ipsec-key-rollover-standard?format=claude","cursorMdc":"/api/rules/cilium-ebpf-host-routing-ipsec-key-rollover-standard?format=mdc","cursorrules":"/api/rules/cilium-ebpf-host-routing-ipsec-key-rollover-standard?format=cursor","windsurf":"/api/rules/cilium-ebpf-host-routing-ipsec-key-rollover-standard?format=windsurf","agents":"/api/rules/cilium-ebpf-host-routing-ipsec-key-rollover-standard?format=agents"}},{"id":"vite-6-environment-api-server-boundary-standard","title":"Vite 6 Environment API Server Boundary Standard","category":"frontend","severity":"critical","description":"Enforce strict isolation between client, ssr, and workerd environments using Vite 6 new Environment API.","antiPatternHeadline":"AI bundles server-only Node native modules into edge worker environments.","stars_count":150,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["vite","vite-6","ssr","environment-api"],"exportEndpoints":{"claude":"/api/rules/vite-6-environment-api-server-boundary-standard?format=claude","cursorMdc":"/api/rules/vite-6-environment-api-server-boundary-standard?format=mdc","cursorrules":"/api/rules/vite-6-environment-api-server-boundary-standard?format=cursor","windsurf":"/api/rules/vite-6-environment-api-server-boundary-standard?format=windsurf","agents":"/api/rules/vite-6-environment-api-server-boundary-standard?format=agents"}},{"id":"openfga-contextual-tuple-cycle-guardrail","title":"OpenFGA 1.8 Contextual Tuple Cycle and Recursion DoS Prevention","category":"security","severity":"critical","description":"Enforces strict validation, topological cycle pre-checks, and cardinality bounds on dynamic contextual tuples passed into OpenFGA Check and ListObjects operations. Prevents graph recursion loops, depth-exhaustion denial of service (DoS), and unbounded Zanzibar subproblem expansion.","antiPatternHeadline":"Blind forwarding of unvalidated contextual tuples enabling cyclic graph recursion and authorization engine denial of service","stars_count":62,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","zanzibar","authorization","cycle-detection","dos-prevention"],"exportEndpoints":{"claude":"/api/rules/openfga-contextual-tuple-cycle-guardrail?format=claude","cursorMdc":"/api/rules/openfga-contextual-tuple-cycle-guardrail?format=mdc","cursorrules":"/api/rules/openfga-contextual-tuple-cycle-guardrail?format=cursor","windsurf":"/api/rules/openfga-contextual-tuple-cycle-guardrail?format=windsurf","agents":"/api/rules/openfga-contextual-tuple-cycle-guardrail?format=agents"}},{"id":"kmp-native-arc-memory-retention-bound","title":"Kotlin Multiplatform 2.1 Native ARC Deterministic Memory Retention Bound","category":"mobile","severity":"critical","description":"Enforces deterministic bidirectional lifecycle boundaries between Kotlin Native garbage collection and Apple ARC. Eliminates uncollectible cross-runtime cyclic references when bridging Swift closures and Kotlin Native listeners by mandating explicit unbinding and weak-capture semantics across Objective-C interop barriers.","antiPatternHeadline":"Cross-Runtime Zombie Objects Caused by Strong Bidirectional Closure Capture Between Swift ARC and Kotlin Native GC","stars_count":76,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","kmp","swift","ios","memory-management","arc"],"exportEndpoints":{"claude":"/api/rules/kmp-native-arc-memory-retention-bound?format=claude","cursorMdc":"/api/rules/kmp-native-arc-memory-retention-bound?format=mdc","cursorrules":"/api/rules/kmp-native-arc-memory-retention-bound?format=cursor","windsurf":"/api/rules/kmp-native-arc-memory-retention-bound?format=windsurf","agents":"/api/rules/kmp-native-arc-memory-retention-bound?format=agents"}},{"id":"otel-collector-tail-sampling-backpressure-invariant","title":"Deterministic Backpressure and Load Shedding in OpenTelemetry Collector Tail-Based Sampling","category":"devops","severity":"critical","description":"Enforces deterministic load shedding and explicit memory isolation within OpenTelemetry Collector tail-sampling pipelines during traffic spikes and incident cascades. Prevents OOM kills by mandating memory_limiter placement before stateful buffers and configuring finite memory-bounded trace reserves with priority-tiered drop rules.","antiPatternHeadline":"Unbounded State Buffering in Tail Sampler Preceding Memory Limiter Inducing Pipeline OOM Kills","stars_count":100,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","observability","tracing","reliability-engineering","backpressure"],"exportEndpoints":{"claude":"/api/rules/otel-collector-tail-sampling-backpressure-invariant?format=claude","cursorMdc":"/api/rules/otel-collector-tail-sampling-backpressure-invariant?format=mdc","cursorrules":"/api/rules/otel-collector-tail-sampling-backpressure-invariant?format=cursor","windsurf":"/api/rules/otel-collector-tail-sampling-backpressure-invariant?format=windsurf","agents":"/api/rules/otel-collector-tail-sampling-backpressure-invariant?format=agents"}},{"id":"svelte-5-snippet-hydration-mismatch-boundary","title":"Svelte 5 Snippet Hydration Mismatch Boundary Guardrail","category":"frontend","severity":"critical","description":"Enforces strict isolation boundaries around Svelte 5 snippets subjected to asynchronous or dynamic state drift during SSR hydration. Prevents structural tree tear-down by isolating snippet invocations inside targeted boundary components, preserving fine-grained reactive runes ($state, $derived) in sibling nodes during reconciliation.","antiPatternHeadline":"Global Subtree Unmounting Caused by Bare Dynamic Snippets During Async Hydration Drift","stars_count":103,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["svelte5","runes","hydration","snippets","ssr"],"exportEndpoints":{"claude":"/api/rules/svelte-5-snippet-hydration-mismatch-boundary?format=claude","cursorMdc":"/api/rules/svelte-5-snippet-hydration-mismatch-boundary?format=mdc","cursorrules":"/api/rules/svelte-5-snippet-hydration-mismatch-boundary?format=cursor","windsurf":"/api/rules/svelte-5-snippet-hydration-mismatch-boundary?format=windsurf","agents":"/api/rules/svelte-5-snippet-hydration-mismatch-boundary?format=agents"}},{"id":"fastapi-async-streaming-multipart-memory-spill","title":"FastAPI 0.115 Async Streaming Multipart Memory-Spill Guardrail","category":"backend","severity":"critical","description":"Enforces strict chunked streaming directly to bounded disk spillover buffers before parsing or validating multipart payloads. Prevents catastrophic event-loop blocking and Out-Of-Memory (OOM) process termination during high-concurrency uploads. Guarantees that neither Starlette's default form-data parser nor Pydantic models buffer untrusted, unbounded binary streams in the Python process heap.","antiPatternHeadline":"Buffering Arbitrary Multipart Payloads into Process Heap via Unbounded UploadFile Reads or Direct Pydantic Ingestion","stars_count":58,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","async","streaming","memory-management","security","dos-prevention"],"exportEndpoints":{"claude":"/api/rules/fastapi-async-streaming-multipart-memory-spill?format=claude","cursorMdc":"/api/rules/fastapi-async-streaming-multipart-memory-spill?format=mdc","cursorrules":"/api/rules/fastapi-async-streaming-multipart-memory-spill?format=cursor","windsurf":"/api/rules/fastapi-async-streaming-multipart-memory-spill?format=windsurf","agents":"/api/rules/fastapi-async-streaming-multipart-memory-spill?format=agents"}},{"id":"ebpf-cgroup-sock-create-egress-evasion-defense","title":"eBPF BPF_CGROUP_INET_SOCK_CREATE Egress Pod Evasion Defense","category":"security","severity":"critical","description":"Enforces deterministic socket interception at the BPF_CGROUP_INET_SOCK_CREATE attach point to prevent multi-tenant container workloads from allocating raw sockets or unauthorized protocols. Halts evasion techniques that bypass host-level CNI iptables/tc filtering and network namespace egress policies. Ensures strict fail-closed verification and security telemetry emission upon policy violation.","antiPatternHeadline":"Permitting Unrestricted SOCK_RAW Allocation and Uninspected Socket Protocols in Cgroups","stars_count":93,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","ebpf","cgroup","cni","linux-kernel","network-security"],"exportEndpoints":{"claude":"/api/rules/ebpf-cgroup-sock-create-egress-evasion-defense?format=claude","cursorMdc":"/api/rules/ebpf-cgroup-sock-create-egress-evasion-defense?format=mdc","cursorrules":"/api/rules/ebpf-cgroup-sock-create-egress-evasion-defense?format=cursor","windsurf":"/api/rules/ebpf-cgroup-sock-create-egress-evasion-defense?format=windsurf","agents":"/api/rules/ebpf-cgroup-sock-create-egress-evasion-defense?format=agents"}},{"id":"nextjs15-rsc-streaming-injection-nonce-isolation","title":"Next.js 15 RSC Streaming Lexical Boundary & Cryptographic Nonce Isolation","category":"frontend","severity":"critical","description":"Enforces strict cryptographic nonce propagation and lexical boundary escaping on asynchronously streamed React Server Component (RSC) HTML chunks. Prevents DOM clobbering and arbitrary script execution caused by premature lexical breakout or unescaped tag delimiters injected into the downstream streaming pipe.","antiPatternHeadline":"Unsanitized inline script emission and missing nonce binding in dynamic RSC streaming blocks","stars_count":118,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs15","rsc","app-router","dom-clobbering","csp-nonce","xss-prevention","streaming"],"exportEndpoints":{"claude":"/api/rules/nextjs15-rsc-streaming-injection-nonce-isolation?format=claude","cursorMdc":"/api/rules/nextjs15-rsc-streaming-injection-nonce-isolation?format=mdc","cursorrules":"/api/rules/nextjs15-rsc-streaming-injection-nonce-isolation?format=cursor","windsurf":"/api/rules/nextjs15-rsc-streaming-injection-nonce-isolation?format=windsurf","agents":"/api/rules/nextjs15-rsc-streaming-injection-nonce-isolation?format=agents"}},{"id":"tauri-v2-ipc-sharedarraybuffer-zero-copy-isolation","title":"Tauri 2.0 IPC SharedArrayBuffer Zero-Copy Isolation Standard","category":"security","severity":"critical","description":"Enforces strict Cross-Origin Isolation (COOP/COEP) and window-bound origin gating when executing high-throughput binary IPC between Tauri 2.0 native core and webview contexts. Prevents microarchitectural Spectre timing side-channel attacks and cross-origin memory leakage when exposing zero-copy binary streams or SharedArrayBuffer instances to renderers.","antiPatternHeadline":"Exposing Raw Shared Buffers or High-Resolution IPC Streaming Without Enforcing Cross-Origin Isolation Contexts","stars_count":82,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","tauri-v2","sharedarraybuffer","spectre","ipc","zero-copy","memory-safety"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-ipc-sharedarraybuffer-zero-copy-isolation?format=claude","cursorMdc":"/api/rules/tauri-v2-ipc-sharedarraybuffer-zero-copy-isolation?format=mdc","cursorrules":"/api/rules/tauri-v2-ipc-sharedarraybuffer-zero-copy-isolation?format=cursor","windsurf":"/api/rules/tauri-v2-ipc-sharedarraybuffer-zero-copy-isolation?format=windsurf","agents":"/api/rules/tauri-v2-ipc-sharedarraybuffer-zero-copy-isolation?format=agents"}},{"id":"go-chi-http2-stream-timeout-decoupling","title":"Decoupled Per-Stream Idle Deadlines for Multiplexed HTTP/2 in Go Chi","category":"backend","severity":"critical","description":"Enforces granular, per-stream idle read deadlines and stream concurrency limits within Go Chi HTTP/2 services. Prevents slowloris-style stream starvation attacks and ensures that stalled individual stream payloads do not trigger global TCP connection resets across concurrent multiplexed pipelines.","antiPatternHeadline":"Global TCP Read Deadlines and Unbounded Body Reads on Multiplexed HTTP/2 Connections","stars_count":59,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","chi","http2","security","dos-prevention","networking"],"exportEndpoints":{"claude":"/api/rules/go-chi-http2-stream-timeout-decoupling?format=claude","cursorMdc":"/api/rules/go-chi-http2-stream-timeout-decoupling?format=mdc","cursorrules":"/api/rules/go-chi-http2-stream-timeout-decoupling?format=cursor","windsurf":"/api/rules/go-chi-http2-stream-timeout-decoupling?format=windsurf","agents":"/api/rules/go-chi-http2-stream-timeout-decoupling?format=agents"}},{"id":"nextjs-15-ppr-shell-streaming-memory-cap","title":"Next.js 15 PPR Shell Streaming Memory Cap and Backpressure Invariants","category":"frontend","severity":"critical","description":"Enforces strict streaming backpressure, payload budgeting, and socket lifecycle controls for Next.js 15 Partial Prerendering (PPR). Prevents unbuffered Node.js stream buffer saturation, V8 heap exhaustion, and HTTP socket starvation during concurrent dynamic React Server Component (RSC) hydration over chunked transfer.","antiPatternHeadline":"Unbounded Dynamic Payload Fetching and Missing Stream Timeouts in Monolithic PPR Holes","stars_count":72,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs15","ppr","react-server-components","streaming","memory-management","backpressure"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-ppr-shell-streaming-memory-cap?format=claude","cursorMdc":"/api/rules/nextjs-15-ppr-shell-streaming-memory-cap?format=mdc","cursorrules":"/api/rules/nextjs-15-ppr-shell-streaming-memory-cap?format=cursor","windsurf":"/api/rules/nextjs-15-ppr-shell-streaming-memory-cap?format=windsurf","agents":"/api/rules/nextjs-15-ppr-shell-streaming-memory-cap?format=agents"}},{"id":"axum-0-8-hyper-v1-multiplex-stream-drain-barrier","title":"Axum 0.8 / Hyper v1 Deterministic Multiplexed Stream Graceful Drain Barrier","category":"backend","severity":"critical","description":"Enforces deterministic cancellation propagation and controlled HTTP/2 and HTTP/3 multiplex stream drainage during Kubernetes rolling updates. Prevents dropped in-flight requests, connection reset errors (RST_STREAM/GOAWAY races), and half-open socket leaks when pods transition into Terminating state before ingress re-routing completes.","antiPatternHeadline":"Naive axum::serve with_graceful_shutdown dropping in-flight HTTP/2 streams and racing SIGTERM ingress pruning","stars_count":103,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","hyper","kubernetes","http2","graceful-shutdown"],"exportEndpoints":{"claude":"/api/rules/axum-0-8-hyper-v1-multiplex-stream-drain-barrier?format=claude","cursorMdc":"/api/rules/axum-0-8-hyper-v1-multiplex-stream-drain-barrier?format=mdc","cursorrules":"/api/rules/axum-0-8-hyper-v1-multiplex-stream-drain-barrier?format=cursor","windsurf":"/api/rules/axum-0-8-hyper-v1-multiplex-stream-drain-barrier?format=windsurf","agents":"/api/rules/axum-0-8-hyper-v1-multiplex-stream-drain-barrier?format=agents"}},{"id":"go-chi-quic-0rtt-anti-replay-idempotency","title":"Go Chi HTTP/3 0-RTT Anti-Replay Idempotency Barrier","category":"backend","severity":"critical","description":"Enforces a strict idempotency and early data rejection barrier for HTTP/3 connections using Go and Chi. QUIC 0-RTT allows early application data frames to be sent prior to the completion of the 1-RTT cryptographic handshake, exposing state-mutating HTTP methods to network-level replay attacks. The guardrail guarantees that unsafe HTTP requests arriving in early data are intercepted and rejected with HTTP 425 (Too Early) or validated through an atomic, distributed replay cache.","antiPatternHeadline":"Executing Non-Idempotent HTTP Handlers on Unvalidated 0-RTT QUIC Early Data","stars_count":55,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","chi","http3","quic","security","tls","replay-attack"],"exportEndpoints":{"claude":"/api/rules/go-chi-quic-0rtt-anti-replay-idempotency?format=claude","cursorMdc":"/api/rules/go-chi-quic-0rtt-anti-replay-idempotency?format=mdc","cursorrules":"/api/rules/go-chi-quic-0rtt-anti-replay-idempotency?format=cursor","windsurf":"/api/rules/go-chi-quic-0rtt-anti-replay-idempotency?format=windsurf","agents":"/api/rules/go-chi-quic-0rtt-anti-replay-idempotency?format=agents"}},{"id":"pgbouncer-1-24-named-prepared-statement-decollision-invariant","title":"PgBouncer 1.24 Named Prepared Statement Session De-Collision Invariant","category":"backend","severity":"critical","description":"Enforces deterministic statement naming isolation and client-driver configurations under PgBouncer 1.24 transaction pooling. Precludes cross-tenant query plan pollution, cache collisions, and statement leakage caused by static statement identifiers across multiplexed backend server sessions. Mandates parameterized unnamed execution or cryptographically collision-free tenant-namespaced statement hashing.","antiPatternHeadline":"Cross-Session Collision and Plan Poisoning via Static Named Prepared Statements in Transaction-Pooled PgBouncer","stars_count":105,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","pgbouncer","connection-pooling","multi-tenancy","performance"],"exportEndpoints":{"claude":"/api/rules/pgbouncer-1-24-named-prepared-statement-decollision-invariant?format=claude","cursorMdc":"/api/rules/pgbouncer-1-24-named-prepared-statement-decollision-invariant?format=mdc","cursorrules":"/api/rules/pgbouncer-1-24-named-prepared-statement-decollision-invariant?format=cursor","windsurf":"/api/rules/pgbouncer-1-24-named-prepared-statement-decollision-invariant?format=windsurf","agents":"/api/rules/pgbouncer-1-24-named-prepared-statement-decollision-invariant?format=agents"}},{"id":"capacitor-secure-enclave-hardware-attested-derivation","title":"Capacitor 7 Secure Enclave Hardware-Attested Key Derivation Standard","category":"mobile","severity":"critical","description":"Enforces hardware-backed cryptographic operations directly within the hardware security module (Apple Secure Enclave / Android StrongBox Keystore) rather than trusting boolean bridge responses from biometric prompts. Dynamic memory injection tools (e.g., Frida, Objection) can trivially hook JavaScript-to-native bridges and boolean biometric evaluations; authentication must be cryptographically bound to hardware key unwrap/signing operations with server-nonce attestation.","antiPatternHeadline":"Trusting Boolean Biometric Bridge Responses and Decoupling Biometric Prompts from Hardware Cryptographic Operations","stars_count":117,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","security","cryptography","biometrics","ios","android"],"exportEndpoints":{"claude":"/api/rules/capacitor-secure-enclave-hardware-attested-derivation?format=claude","cursorMdc":"/api/rules/capacitor-secure-enclave-hardware-attested-derivation?format=mdc","cursorrules":"/api/rules/capacitor-secure-enclave-hardware-attested-derivation?format=cursor","windsurf":"/api/rules/capacitor-secure-enclave-hardware-attested-derivation?format=windsurf","agents":"/api/rules/capacitor-secure-enclave-hardware-attested-derivation?format=agents"}},{"id":"rn-78-bridgeless-fabric-mutation-barrier","title":"React Native 0.78 Bridgeless Fabric Thread-Safe Mutation Barrier","category":"mobile","severity":"critical","description":"Enforces deterministic, thread-safe state mutation barriers across JSI boundaries in React Native 0.78 Bridgeless Fabric architecture. Eliminates torn frames, layout desynchronization, and crashes induced by concurrent native gesture driver events mutating React Fiber trees outside the worklet-to-UI shadow tree pipeline. Mandates strict separation between synchronous UI runtime worklet mutations and asynchronous React state commits.","antiPatternHeadline":"Mutating React Fiber state synchronously within concurrent native gesture JSI callbacks, triggering shadow tree race conditions and torn frames.","stars_count":80,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","react-native","fabric","bridgeless","jsi","reanimated","concurrency"],"exportEndpoints":{"claude":"/api/rules/rn-78-bridgeless-fabric-mutation-barrier?format=claude","cursorMdc":"/api/rules/rn-78-bridgeless-fabric-mutation-barrier?format=mdc","cursorrules":"/api/rules/rn-78-bridgeless-fabric-mutation-barrier?format=cursor","windsurf":"/api/rules/rn-78-bridgeless-fabric-mutation-barrier?format=windsurf","agents":"/api/rules/rn-78-bridgeless-fabric-mutation-barrier?format=agents"}},{"id":"spiffe-spire-svid-zero-downtime-hot-rotation-standard","title":"SPIFFE/SPIRE Ephemeral SVID Zero-Downtime Dynamic Hot-Rotation","category":"security","severity":"critical","description":"Enforces dynamic, in-memory X.509 SVID hot-rotation for long-lived gRPC streaming connections driven by the SPIFFE Workload API. Guarantees that automated sub-hour leaf certificate and intermediate CA renewals never terminate running channels, drop active RPC streams, or trigger process restarts.","antiPatternHeadline":"Transport Teardown and Static Credential Binding During SVID Certificate Expiration","stars_count":50,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","spiffe","spire","grpc","mtls","zero-downtime"],"exportEndpoints":{"claude":"/api/rules/spiffe-spire-svid-zero-downtime-hot-rotation-standard?format=claude","cursorMdc":"/api/rules/spiffe-spire-svid-zero-downtime-hot-rotation-standard?format=mdc","cursorrules":"/api/rules/spiffe-spire-svid-zero-downtime-hot-rotation-standard?format=cursor","windsurf":"/api/rules/spiffe-spire-svid-zero-downtime-hot-rotation-standard?format=windsurf","agents":"/api/rules/spiffe-spire-svid-zero-downtime-hot-rotation-standard?format=agents"}},{"id":"otel-baggage-boundary-sanitization-invariant","title":"OpenTelemetry W3C Baggage Header Boundary Sanitization and Ceiling Enforcement","category":"devops","severity":"critical","description":"Enforces strict payload size ceilings, allowlist-only propagation, and PII redaction on W3C Baggage headers across untrusted ingress boundaries and message brokers. Blindly forwarding raw baggage tokens introduces memory exhaustion vulnerabilities, header-injection attacks, and severe regulatory data leaks across distributed systems.","antiPatternHeadline":"Unvalidated Passthrough of W3C Baggage Context into Asynchronous Message Brokers","stars_count":87,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","security","observability","distributed-tracing","kafka"],"exportEndpoints":{"claude":"/api/rules/otel-baggage-boundary-sanitization-invariant?format=claude","cursorMdc":"/api/rules/otel-baggage-boundary-sanitization-invariant?format=mdc","cursorrules":"/api/rules/otel-baggage-boundary-sanitization-invariant?format=cursor","windsurf":"/api/rules/otel-baggage-boundary-sanitization-invariant?format=windsurf","agents":"/api/rules/otel-baggage-boundary-sanitization-invariant?format=agents"}},{"id":"pg17-incremental-backup-lsn-monotonicity-standard","title":"Postgres 17 Incremental Backup LSN Monotonicity & Checkpoint Manifest Guardrail","category":"devops","severity":"critical","description":"Enforces strict monotonic Log Sequence Number (LSN) validation, timeline continuity, and cryptographic backup_manifest verification across PostgreSQL 17 incremental backup chains. Prevents storage-engine corruption and silent block divergence during pg_combinebackup delta synthetic full roll-forwards.","antiPatternHeadline":"Blind Concatenation of Incremental Backups Without LSN Monotonicity and Manifest Cryptographic Verification","stars_count":43,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","postgres17","backup-recovery","pg-combinebackup","lsn-validation","database-reliability"],"exportEndpoints":{"claude":"/api/rules/pg17-incremental-backup-lsn-monotonicity-standard?format=claude","cursorMdc":"/api/rules/pg17-incremental-backup-lsn-monotonicity-standard?format=mdc","cursorrules":"/api/rules/pg17-incremental-backup-lsn-monotonicity-standard?format=cursor","windsurf":"/api/rules/pg17-incremental-backup-lsn-monotonicity-standard?format=windsurf","agents":"/api/rules/pg17-incremental-backup-lsn-monotonicity-standard?format=agents"}},{"id":"axum-08-graceful-drain-http2-lease-standard","title":"Axum 0.8 Graceful Connection Drain & HTTP/2 In-Flight Lease Standard","category":"backend","severity":"critical","description":"Enforces a multi-phase graceful shutdown protocol for Axum 0.8 services handling HTTP/1.1 and HTTP/2 multiplexed traffic during orchestrator rolling restarts. Prevents dropped in-flight streaming connections and socket reset (RST) spikes by coordinating Kubernetes readiness lameduck delays, explicit stream lease tracking, and hyper-util connection draining bounds.","antiPatternHeadline":"Immediate SIGTERM Termination with Naive with_graceful_shutdown Triggering Ingress RST-502 Cascades","stars_count":78,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tokio","hyper","http2","graceful-shutdown","resilience"],"exportEndpoints":{"claude":"/api/rules/axum-08-graceful-drain-http2-lease-standard?format=claude","cursorMdc":"/api/rules/axum-08-graceful-drain-http2-lease-standard?format=mdc","cursorrules":"/api/rules/axum-08-graceful-drain-http2-lease-standard?format=cursor","windsurf":"/api/rules/axum-08-graceful-drain-http2-lease-standard?format=windsurf","agents":"/api/rules/axum-08-graceful-drain-http2-lease-standard?format=agents"}},{"id":"nextjs-15-use-cache-tag-swr-boundary-guardrail","title":"Next.js 15 'use cache' Cache-Tag Stale-While-Revalidate Boundary Guardrail","category":"frontend","severity":"critical","description":"Enforces strict boundary isolation between transactional Server Action writes and edge-cached 'use cache' layout derivations in Next.js 15. Prevents stale read anomalies by requiring deterministic cache tagging, immediate post-mutation tag invalidation, and strict separation of transactional return payloads from eventual edge revalidation.","antiPatternHeadline":"Coupling Server Action Mutations to Un-invalidated 'use cache' Derivations with Inconsistent Read Replicas","stars_count":116,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs","nextjs-15","use-cache","cache-tags","stale-while-revalidate","server-actions"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-use-cache-tag-swr-boundary-guardrail?format=claude","cursorMdc":"/api/rules/nextjs-15-use-cache-tag-swr-boundary-guardrail?format=mdc","cursorrules":"/api/rules/nextjs-15-use-cache-tag-swr-boundary-guardrail?format=cursor","windsurf":"/api/rules/nextjs-15-use-cache-tag-swr-boundary-guardrail?format=windsurf","agents":"/api/rules/nextjs-15-use-cache-tag-swr-boundary-guardrail?format=agents"}},{"id":"pg17-adaptive-workmem-hash-join-spill-guardrail","title":"PostgreSQL 17 Adaptive WorkMem Capping and Hash Join Spilling Guardrail","category":"backend","severity":"critical","description":"Enforces strict transaction-scoped memory budgeting for PostgreSQL 17 hash joins and hybrid vector-analytical workloads. Prevents Linux kernel Out-Of-Memory (OOM) killer terminations by replacing static global session work_mem overrides with dynamic, concurrency-aware SET LOCAL boundaries that force deterministic batch spilling to disk.","antiPatternHeadline":"Unbounded Session-Level work_mem Escalation During Concurrent Parallel Hash Joins","stars_count":114,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","pg17","memory-management","database-reliability","pgvector"],"exportEndpoints":{"claude":"/api/rules/pg17-adaptive-workmem-hash-join-spill-guardrail?format=claude","cursorMdc":"/api/rules/pg17-adaptive-workmem-hash-join-spill-guardrail?format=mdc","cursorrules":"/api/rules/pg17-adaptive-workmem-hash-join-spill-guardrail?format=cursor","windsurf":"/api/rules/pg17-adaptive-workmem-hash-join-spill-guardrail?format=windsurf","agents":"/api/rules/pg17-adaptive-workmem-hash-join-spill-guardrail?format=agents"}},{"id":"ebpf-xdp-zerotrust-token-verification-standard","title":"eBPF XDP Line-Rate Zero-Trust Token Verification Standard","category":"security","severity":"critical","description":"Enforces pre-allocation cryptographic zero-trust identity token validation in the NIC driver XDP hook before Linux kernel sk_buff allocation. Ensures strict bounded memory access, constant-time token verification, and deterministic packet drop semantics to neutralize volumetric L4/L7 DDoS vectors at wire speed.","antiPatternHeadline":"Deferring cryptographic ingress identity validation to userspace sockets or post-sk_buff network layers during volumetric floods","stars_count":77,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","ebpf","xdp","zero-trust","ddos-mitigation","kernel","c"],"exportEndpoints":{"claude":"/api/rules/ebpf-xdp-zerotrust-token-verification-standard?format=claude","cursorMdc":"/api/rules/ebpf-xdp-zerotrust-token-verification-standard?format=mdc","cursorrules":"/api/rules/ebpf-xdp-zerotrust-token-verification-standard?format=cursor","windsurf":"/api/rules/ebpf-xdp-zerotrust-token-verification-standard?format=windsurf","agents":"/api/rules/ebpf-xdp-zerotrust-token-verification-standard?format=agents"}},{"id":"fastapi-event-loop-starvation-pydantic-quarantine","title":"FastAPI Async Event Loop Quarantine for High-Throughput Pydantic v2 Parsing","category":"backend","severity":"critical","description":"Enforces deterministic event loop isolation against CPU-bound Pydantic v2 serialization and deserialization bottlenecks in high-concurrency FastAPI services. Mandates that unbounded collections, multi-megabyte payloads, and nested schemas bypass the primary asyncio event loop through threadpool offloading (`anyio.to_thread.run_sync`) or synchronous route signatures. Guarantees sub-millisecond event loop lag and eliminates tail-latency spikes caused by synchronous parsing stalls.","antiPatternHeadline":"Direct In-Loop Pydantic Deserialization of Bulk or Complex Payloads in Async Route Signatures","stars_count":111,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","asyncio","pydantic","concurrency","performance"],"exportEndpoints":{"claude":"/api/rules/fastapi-event-loop-starvation-pydantic-quarantine?format=claude","cursorMdc":"/api/rules/fastapi-event-loop-starvation-pydantic-quarantine?format=mdc","cursorrules":"/api/rules/fastapi-event-loop-starvation-pydantic-quarantine?format=cursor","windsurf":"/api/rules/fastapi-event-loop-starvation-pydantic-quarantine?format=windsurf","agents":"/api/rules/fastapi-event-loop-starvation-pydantic-quarantine?format=agents"}},{"id":"compose-multiplatform-skiko-vsync-frame-pacing","title":"Compose Multiplatform Skiko VSYNC Native Frame-Pacing & Triple-Buffer Synchronization","category":"mobile","severity":"critical","description":"Enforces synchronous triple-buffered GPU presentation across iOS (Metal/CADisplayLink) and Android (Choreographer/Vulkan/EGL) runtimes in Compose Multiplatform. Eliminates micro-stutter, frame drops, and ProMotion refresh rate mismatches by locking Skiko canvas renders to hardware VSYNC pulses with strict backpressure signaling.","antiPatternHeadline":"Decoupled Coroutine Animation Loops and Unbounded Metal/SurfaceView Canvas Drawing Causing Presentation Micro-Stutter","stars_count":111,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","compose-multiplatform","skiko","metal","vsync","cadisplaylink","choreographer","frame-pacing"],"exportEndpoints":{"claude":"/api/rules/compose-multiplatform-skiko-vsync-frame-pacing?format=claude","cursorMdc":"/api/rules/compose-multiplatform-skiko-vsync-frame-pacing?format=mdc","cursorrules":"/api/rules/compose-multiplatform-skiko-vsync-frame-pacing?format=cursor","windsurf":"/api/rules/compose-multiplatform-skiko-vsync-frame-pacing?format=windsurf","agents":"/api/rules/compose-multiplatform-skiko-vsync-frame-pacing?format=agents"}},{"id":"wasi-02-capability-sandbox-standard-wasi-0-2-compone-462","title":"WASI 0.2 Component Model Capability-Based Interface Sandbox Standard","category":"security","severity":"critical","description":"Enforces strict deny-by-default host syscall boundaries, ambient authority elimination, and explicit capability token exchange for third-party WebAssembly components under WASI 0.2. Mandates fine-grained interface grants via explicit WIT contracts, eliminating ambient filesystem, network, or clock access in host runtime configurations.","antiPatternHeadline":"Ambient Host Authority Leakage and Over-Permissioned WASI 0.2 Linker Configuration","stars_count":88,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webassembly","wasi","wasmtime","sandbox","wit"],"exportEndpoints":{"claude":"/api/rules/wasi-02-capability-sandbox-standard-wasi-0-2-compone-462?format=claude","cursorMdc":"/api/rules/wasi-02-capability-sandbox-standard-wasi-0-2-compone-462?format=mdc","cursorrules":"/api/rules/wasi-02-capability-sandbox-standard-wasi-0-2-compone-462?format=cursor","windsurf":"/api/rules/wasi-02-capability-sandbox-standard-wasi-0-2-compone-462?format=windsurf","agents":"/api/rules/wasi-02-capability-sandbox-standard-wasi-0-2-compone-462?format=agents"}},{"id":"k8s-gateway-api-referencegrant-security-guardrail-kubernetes-gatew-553","title":"Kubernetes Gateway API v1.2 ReferenceGrant & Cross-Tenant Routing Isolation","category":"devops","severity":"critical","description":"Enforces strict, least-privilege ReferenceGrant policies for cross-namespace backend and gateway references in Kubernetes Gateway API v1.2. Prevents cross-tenant service hijacking and unauthorized route attachment across shared multi-tenant gateways.","antiPatternHeadline":"Wildcard or Unscoped ReferenceGrants Exposing Internal Services to Cross-Tenant Ingress Hijacking","stars_count":108,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["kubernetes","gateway-api","reference-grant","devops","security","multi-tenancy","ingress"],"exportEndpoints":{"claude":"/api/rules/k8s-gateway-api-referencegrant-security-guardrail-kubernetes-gatew-553?format=claude","cursorMdc":"/api/rules/k8s-gateway-api-referencegrant-security-guardrail-kubernetes-gatew-553?format=mdc","cursorrules":"/api/rules/k8s-gateway-api-referencegrant-security-guardrail-kubernetes-gatew-553?format=cursor","windsurf":"/api/rules/k8s-gateway-api-referencegrant-security-guardrail-kubernetes-gatew-553?format=windsurf","agents":"/api/rules/k8s-gateway-api-referencegrant-security-guardrail-kubernetes-gatew-553?format=agents"}},{"id":"tauri2-webview-isolation-ipc-scoping-invariant","title":"Tauri 2.0 Ephemeral Webview Isolation & Scoped IPC Guardrail","category":"frontend","severity":"critical","description":"Enforces strict process, storage, and IPC boundary separation between primary execution contexts and auxiliary or ephemeral renderer windows in Tauri 2.0. Eliminates cross-webview side-channel exfiltration and memory contamination by requiring distinct window labels, explicit capability mapping, and segregated storage partitions.","antiPatternHeadline":"Spawning Auxiliary Renderers with Default Host Capabilities and Shared Memory/Storage Contexts","stars_count":112,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["tauri","frontend","security","ipc","webview-isolation","process-sandboxing"],"exportEndpoints":{"claude":"/api/rules/tauri2-webview-isolation-ipc-scoping-invariant?format=claude","cursorMdc":"/api/rules/tauri2-webview-isolation-ipc-scoping-invariant?format=mdc","cursorrules":"/api/rules/tauri2-webview-isolation-ipc-scoping-invariant?format=cursor","windsurf":"/api/rules/tauri2-webview-isolation-ipc-scoping-invariant?format=windsurf","agents":"/api/rules/tauri2-webview-isolation-ipc-scoping-invariant?format=agents"}},{"id":"bun-sqlite-wal2-snapshot-concurrency","title":"Bun 1.2 Embedded SQLite WAL2 Concurrency and Snapshot Isolation Standard","category":"backend","severity":"critical","description":"Enforces non-blocking concurrent edge reads during sustained write bursts using Bun 1.2 native SQLite with dual write-ahead log (WAL2) mode. Eliminates reader starvation and SQLITE_BUSY deadlocks by segregating read-only and write connections while maintaining transactional snapshot isolation.","antiPatternHeadline":"Shared Read-Write Database Handles Operating on Standard Single-WAL Checkpoints","stars_count":70,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","sqlite","wal2","concurrency","edge"],"exportEndpoints":{"claude":"/api/rules/bun-sqlite-wal2-snapshot-concurrency?format=claude","cursorMdc":"/api/rules/bun-sqlite-wal2-snapshot-concurrency?format=mdc","cursorrules":"/api/rules/bun-sqlite-wal2-snapshot-concurrency?format=cursor","windsurf":"/api/rules/bun-sqlite-wal2-snapshot-concurrency?format=windsurf","agents":"/api/rules/bun-sqlite-wal2-snapshot-concurrency?format=agents"}},{"id":"axum-0-8-graceful-websocket-drain-fencing","title":"Axum 0.8 Graceful WebSocket Drain-Fencing Standard","category":"backend","severity":"critical","description":"Enforces deterministic drain-fencing and cooperative task teardown for bi-directional WebSocket streams in Axum 0.8 during cluster rollouts. Prevents dropped frames, dangling Tokio tasks, and broker desynchronization by decoupling socket upgrades from unmonitored runtime tasks using tokio_util::task::TaskTracker and broadcast cancellation tokens.","antiPatternHeadline":"Spawning Unfenced Tokio Tasks for WebSocket Upgrades Without Cooperative Drain Propagation","stars_count":47,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tokio","websockets","graceful-shutdown"],"exportEndpoints":{"claude":"/api/rules/axum-0-8-graceful-websocket-drain-fencing?format=claude","cursorMdc":"/api/rules/axum-0-8-graceful-websocket-drain-fencing?format=mdc","cursorrules":"/api/rules/axum-0-8-graceful-websocket-drain-fencing?format=cursor","windsurf":"/api/rules/axum-0-8-graceful-websocket-drain-fencing?format=windsurf","agents":"/api/rules/axum-0-8-graceful-websocket-drain-fencing?format=agents"}},{"id":"react-19-concurrent-action-transition-boundary-standard","title":"React 19 Concurrent Action Transition and Optimistic Boundary Invariant Standard","category":"frontend","severity":"critical","description":"Enforces deterministic coordination between React 19 useActionState, useOptimistic, and startTransition boundaries across concurrent Server Component streaming trees. Guarantees that asynchronous mutation rollbacks, deferred payloads, and optimistic state reconciliations prevent frame tearing and visual flicker during microtask interruptions.","antiPatternHeadline":"Unbounded Async Mutations Causing Optimistic Frame Tearing and Stale Stream Drift","stars_count":111,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","useOptimistic","useActionState","transitions","streaming-ssr","concurrent-react"],"exportEndpoints":{"claude":"/api/rules/react-19-concurrent-action-transition-boundary-standard?format=claude","cursorMdc":"/api/rules/react-19-concurrent-action-transition-boundary-standard?format=mdc","cursorrules":"/api/rules/react-19-concurrent-action-transition-boundary-standard?format=cursor","windsurf":"/api/rules/react-19-concurrent-action-transition-boundary-standard?format=windsurf","agents":"/api/rules/react-19-concurrent-action-transition-boundary-standard?format=agents"}},{"id":"postgres-17-logical-decoding-memory-throttling","title":"PostgreSQL 17 Logical Decoding Memory Throttling & WAL Sender Protection","category":"backend","severity":"critical","description":"Enforces strict chunking and transactional boundaries for high-throughput batch operations alongside deterministic PostgreSQL 17 logical decoding memory allocations (`logical_decoding_work_mem`). Prevents unbounded memory reassembly in `walsender` background processes, eliminating Out-Of-Memory (OOM) process termination and replication lag amplification during high-velocity write spikes.","antiPatternHeadline":"Monolithic Batch Transactions Exhausting WAL Sender logical_decoding_work_mem and Triggering Host OOM","stars_count":55,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql-17","logical-replication","cdc","memory-management","wal-sender"],"exportEndpoints":{"claude":"/api/rules/postgres-17-logical-decoding-memory-throttling?format=claude","cursorMdc":"/api/rules/postgres-17-logical-decoding-memory-throttling?format=mdc","cursorrules":"/api/rules/postgres-17-logical-decoding-memory-throttling?format=cursor","windsurf":"/api/rules/postgres-17-logical-decoding-memory-throttling?format=windsurf","agents":"/api/rules/postgres-17-logical-decoding-memory-throttling?format=agents"}},{"id":"tauri-v2-granular-ipc-permission-scope-guardrail","title":"Tauri 2.0 Granular Mobile IPC Capability Scoping & Runtime Boundary Validation","category":"mobile","severity":"critical","description":"Enforces strict principle-of-least-privilege capability manifests and runtime deserialization guards for Tauri 2.0 IPC commands targeting mobile viewports (iOS/Android). Prevents cross-context native privilege escalation by forbidding catch-all capabilities, unconstrained wildcard scopes, and unchecked dynamic arguments over the webview-to-Rust serialization boundary.","antiPatternHeadline":"Monolithic Capability Grants and Untyped Invocations Exposing Native OS Primitives to Untrusted Mobile Viewport Contexts","stars_count":69,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri-2","rust","ipc-security","android","ios","capability-scoping"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-granular-ipc-permission-scope-guardrail?format=claude","cursorMdc":"/api/rules/tauri-v2-granular-ipc-permission-scope-guardrail?format=mdc","cursorrules":"/api/rules/tauri-v2-granular-ipc-permission-scope-guardrail?format=cursor","windsurf":"/api/rules/tauri-v2-granular-ipc-permission-scope-guardrail?format=windsurf","agents":"/api/rules/tauri-v2-granular-ipc-permission-scope-guardrail?format=agents"}},{"id":"openfga-contextual-tuple-circular-traversal-boundary","title":"OpenFGA Dynamic Contextual Tuple Circular Traversal and Recursion Boundary Invariant","category":"security","severity":"critical","description":"Enforces strict structural validation, cycle detection, and hard traversal depth limits on dynamic contextual tuples injected into OpenFGA Check and Expand calls. Unbounded contextual graph expansion can induce path combinatorial explosions, circular reference deadlocks, and worker thread exhaustion in authorization engines.","antiPatternHeadline":"Injecting unvalidated, cyclic dynamic contextual tuples without deterministic recursion boundaries into OpenFGA authorization checks","stars_count":106,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","authorization","rebac","dos-prevention","graph-traversal"],"exportEndpoints":{"claude":"/api/rules/openfga-contextual-tuple-circular-traversal-boundary?format=claude","cursorMdc":"/api/rules/openfga-contextual-tuple-circular-traversal-boundary?format=mdc","cursorrules":"/api/rules/openfga-contextual-tuple-circular-traversal-boundary?format=cursor","windsurf":"/api/rules/openfga-contextual-tuple-circular-traversal-boundary?format=windsurf","agents":"/api/rules/openfga-contextual-tuple-circular-traversal-boundary?format=agents"}},{"id":"ebpf-tc-ingress-dynamic-mss-clamping-standard","title":"eBPF TC Ingress Dynamic MSS Clamping Production Standard","category":"devops","severity":"critical","description":"Enforces deterministic TCP Maximum Segment Size (MSS) clamping at the eBPF Traffic Control (TC) ingress hook prior to tunnel encapsulation. Prevents silent Path MTU Discovery (PMTUD) blackholing across hybrid cloud overlay topologies by rewriting TCP Option 2 on SYN/SYN-ACK segments and incrementally updating Layer 4 checksums.","antiPatternHeadline":"Static MTU assumptions, missing TCP checksum incremental updates, or omitting BPF verifier pointer re-validations during option rewriting.","stars_count":51,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","tc","networking","mtu","kernel","hybrid-cloud"],"exportEndpoints":{"claude":"/api/rules/ebpf-tc-ingress-dynamic-mss-clamping-standard?format=claude","cursorMdc":"/api/rules/ebpf-tc-ingress-dynamic-mss-clamping-standard?format=mdc","cursorrules":"/api/rules/ebpf-tc-ingress-dynamic-mss-clamping-standard?format=cursor","windsurf":"/api/rules/ebpf-tc-ingress-dynamic-mss-clamping-standard?format=windsurf","agents":"/api/rules/ebpf-tc-ingress-dynamic-mss-clamping-standard?format=agents"}},{"id":"capacitor-7-background-task-state-serialization-guardrail","title":"Capacitor 7 Background Task State Serialization & Atomic Flush Guardrail","category":"mobile","severity":"critical","description":"Enforces deterministic, atomic local state persistence within OS-allotted execution budgets when Capacitor 7 mobile applications transition to the background. Eliminates silent data loss, memory-state evictions, and SQLite lock corruption caused by uncoordinated JavaScript execution during iOS watchdog terminations and Android low-memory killer (LMK) process purges.","antiPatternHeadline":"Fire-and-Forget Async State Persistence During Backgrounding Without Native OS Task Registration","stars_count":118,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","capacitor-7","background-task","state-management","sqlite","ios","android"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-background-task-state-serialization-guardrail?format=claude","cursorMdc":"/api/rules/capacitor-7-background-task-state-serialization-guardrail?format=mdc","cursorrules":"/api/rules/capacitor-7-background-task-state-serialization-guardrail?format=cursor","windsurf":"/api/rules/capacitor-7-background-task-state-serialization-guardrail?format=windsurf","agents":"/api/rules/capacitor-7-background-task-state-serialization-guardrail?format=agents"}},{"id":"fastapi-async-di-deadlock-guardrail","title":"FastAPI Async Dependency Injection Concurrency and Deadlock Guardrail","category":"backend","severity":"critical","description":"Enforces strict isolation between asynchronous event loop contexts and blocking synchronous I/O operations within FastAPI dependency injection graphs. Prevents complete asyncio event loop starvation, threadpool deadlocks, and worker worker-hang cascades by mandating fully non-blocking asynchronous drivers or explicit offloading via anyio.to_thread.run_sync.","antiPatternHeadline":"Calling blocking I/O calls directly within async def dependencies or mixing synchronous database engines into async endpoint execution graphs","stars_count":69,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","asyncio","python","concurrency","performance"],"exportEndpoints":{"claude":"/api/rules/fastapi-async-di-deadlock-guardrail?format=claude","cursorMdc":"/api/rules/fastapi-async-di-deadlock-guardrail?format=mdc","cursorrules":"/api/rules/fastapi-async-di-deadlock-guardrail?format=cursor","windsurf":"/api/rules/fastapi-async-di-deadlock-guardrail?format=windsurf","agents":"/api/rules/fastapi-async-di-deadlock-guardrail?format=agents"}},{"id":"otel-high-cardinality-exemplar-quota-boundary","title":"OpenTelemetry Trace Exemplar Rolling Reservoir & Cardinality Quota Boundary","category":"devops","severity":"critical","description":"Enforces deterministic rolling reservoir sampling and strict attribute whitelisting on OpenTelemetry metric exemplars. Prevents telemetry collector Out-Of-Memory (OOM) crashes and time-series database (TSDB) block churn caused by unbounded exemplar attachment across high-throughput endpoints. Mandates sample-rate quotas and trace-sampled filter guards prior to exemplar ingestion.","antiPatternHeadline":"Attaching Unbounded Trace Exemplars with High-Cardinality Context Across High-Throughput Metrics","stars_count":112,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","metrics","tracing","observability","exemplars"],"exportEndpoints":{"claude":"/api/rules/otel-high-cardinality-exemplar-quota-boundary?format=claude","cursorMdc":"/api/rules/otel-high-cardinality-exemplar-quota-boundary?format=mdc","cursorrules":"/api/rules/otel-high-cardinality-exemplar-quota-boundary?format=cursor","windsurf":"/api/rules/otel-high-cardinality-exemplar-quota-boundary?format=windsurf","agents":"/api/rules/otel-high-cardinality-exemplar-quota-boundary?format=agents"}},{"id":"react-19-action-transition-abort-signal-propagation-invariant","title":"React 19 Action Transition AbortSignal Propagation Invariant","category":"frontend","severity":"critical","description":"Enforces deterministic lifecycle binding between React 19 Action Transitions (`useActionState`, `startTransition`) and underlying I/O tasks via explicit AbortSignal propagation. Guarantees that pending async microtasks, fetch payloads, and optimistic state reconciliations immediately terminate upon component unmount, route transition, or action preemption, preventing memory leaks, network contention, and stale cache hydration.","antiPatternHeadline":"Unlinked Async Action Microtasks Causing Post-Unmount Network Contention and Stale State Rehydration","stars_count":91,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","transitions","abort-controller","use-action-state","concurrency"],"exportEndpoints":{"claude":"/api/rules/react-19-action-transition-abort-signal-propagation-invariant?format=claude","cursorMdc":"/api/rules/react-19-action-transition-abort-signal-propagation-invariant?format=mdc","cursorrules":"/api/rules/react-19-action-transition-abort-signal-propagation-invariant?format=cursor","windsurf":"/api/rules/react-19-action-transition-abort-signal-propagation-invariant?format=windsurf","agents":"/api/rules/react-19-action-transition-abort-signal-propagation-invariant?format=agents"}},{"id":"go124-swiss-table-map-compaction-guardrail","title":"Go 1.24 Swiss Table Map Memory Compaction & Retention Guardrail","category":"backend","severity":"critical","description":"Enforces strict heap compaction and pointer-swap lifecycles for Go 1.24+ Swiss Table-backed maps in long-lived concurrent key-value caches. Prevents unbounded high-water-mark heap retention, group directory fragmentation, and tail-latency degradation caused by iterative key deletion across burst-and-purge cycles.","antiPatternHeadline":"In-Place Iterative Deletion on Peak-Scaled Maps Retaining Peak Memory Footprint Indefinitely","stars_count":118,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["go","backend","swiss-table","memory-management","garbage-collection","concurrency","caching"],"exportEndpoints":{"claude":"/api/rules/go124-swiss-table-map-compaction-guardrail?format=claude","cursorMdc":"/api/rules/go124-swiss-table-map-compaction-guardrail?format=mdc","cursorrules":"/api/rules/go124-swiss-table-map-compaction-guardrail?format=cursor","windsurf":"/api/rules/go124-swiss-table-map-compaction-guardrail?format=windsurf","agents":"/api/rules/go124-swiss-table-map-compaction-guardrail?format=agents"}},{"id":"capacitor-7-native-bridge-thread-pool-scoping-standard","title":"Capacitor 7 Native Bridge Thread-Pool Scoping & Dispatch Invariant","category":"mobile","severity":"critical","description":"Fences native plugin JSON serialization, binary conversions, and I/O execution away from mobile UI threads into dedicated background dispatch queues. Prevents Android ANR watchdog timeouts and iOS Main Thread Watchdog crashes during high-throughput bridge messaging in Capacitor 7 plugins. Enforces concurrent background workers with explicit main-thread synchronization only during direct WebView manipulation.","antiPatternHeadline":"Executing JSON Deserialization, Disk I/O, or Heavy Compute Directly Inside CapacitorPlugin Main Thread Dispatchers","stars_count":68,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","ios","android","concurrency","performance"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-native-bridge-thread-pool-scoping-standard?format=claude","cursorMdc":"/api/rules/capacitor-7-native-bridge-thread-pool-scoping-standard?format=mdc","cursorrules":"/api/rules/capacitor-7-native-bridge-thread-pool-scoping-standard?format=cursor","windsurf":"/api/rules/capacitor-7-native-bridge-thread-pool-scoping-standard?format=windsurf","agents":"/api/rules/capacitor-7-native-bridge-thread-pool-scoping-standard?format=agents"}},{"id":"cmp-skia-texture-lifecycle-eviction","title":"Compose Multiplatform Skia Texture Deterministic Disposal and Context Eviction","category":"mobile","severity":"critical","description":"Enforces deterministic disposal and reference-counted lifecycle tracking of unmanaged native Skia textures and surfaces across platform window context loss. Prevents silent native off-heap memory leaks and driver SIGSEGV crashes caused by garbage collection delays during Android Surface destruction, iOS MetalKit unbinding, and desktop window resizing.","antiPatternHeadline":"Retaining Raw Skia Native Pointers in Compose Memory Caches Without Explicit GPU Eviction","stars_count":62,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","compose-multiplatform","skia","graphics-pipeline","memory-management","kotlin-multiplatform"],"exportEndpoints":{"claude":"/api/rules/cmp-skia-texture-lifecycle-eviction?format=claude","cursorMdc":"/api/rules/cmp-skia-texture-lifecycle-eviction?format=mdc","cursorrules":"/api/rules/cmp-skia-texture-lifecycle-eviction?format=cursor","windsurf":"/api/rules/cmp-skia-texture-lifecycle-eviction?format=windsurf","agents":"/api/rules/cmp-skia-texture-lifecycle-eviction?format=agents"}},{"id":"openfga-contextual-tuple-latency-budget-standard","title":"OpenFGA Dynamic Contextual Tuple Latency Budget and Cycle Invariant","category":"security","severity":"critical","description":"Restricts dynamic contextual tuple generation and graph resolution depth during OpenFGA authorization checks at edge API gateways. Mandates strict cardinality caps, cycle detection, and hard timeout budgets to prevent ReDoS-style graph traversal exhaustion and maintain sub-millisecond perimeter evaluation latencies.","antiPatternHeadline":"Unbounded Contextual Tuple Injection Causing Graph Traversal Cascades and Perimeter Denial-of-Service","stars_count":97,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","authorization","rebac","performance","api-gateway"],"exportEndpoints":{"claude":"/api/rules/openfga-contextual-tuple-latency-budget-standard?format=claude","cursorMdc":"/api/rules/openfga-contextual-tuple-latency-budget-standard?format=mdc","cursorrules":"/api/rules/openfga-contextual-tuple-latency-budget-standard?format=cursor","windsurf":"/api/rules/openfga-contextual-tuple-latency-budget-standard?format=windsurf","agents":"/api/rules/openfga-contextual-tuple-latency-budget-standard?format=agents"}},{"id":"cosign-oidc-ephemeral-attestation-standard","title":"Sigstore Cosign Keyless OIDC Ephemeral Attestation and Rekor Verification Standard","category":"security","severity":"critical","description":"Mandates short-lived Fulcio X.509 certificate issuance bound to ephemeral OIDC workload tokens and requires Rekor transparency log verification across all container release pipelines. Strictly eliminates long-lived static private keys while enforcing exact Subject Alternative Name (SAN) identity and OIDC issuer cryptographic assertions at deployment gates.","antiPatternHeadline":"Persisting static private signing keys in CI secrets and bypassing Rekor transparency ledger inclusion checks","stars_count":47,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","sigstore","cosign","oidc","rekor","fulcio","supply-chain","attestation"],"exportEndpoints":{"claude":"/api/rules/cosign-oidc-ephemeral-attestation-standard?format=claude","cursorMdc":"/api/rules/cosign-oidc-ephemeral-attestation-standard?format=mdc","cursorrules":"/api/rules/cosign-oidc-ephemeral-attestation-standard?format=cursor","windsurf":"/api/rules/cosign-oidc-ephemeral-attestation-standard?format=windsurf","agents":"/api/rules/cosign-oidc-ephemeral-attestation-standard?format=agents"}},{"id":"ebpf-tc-quic-ingress-steering-standard","title":"eBPF TC HTTP/3 QUIC Connection-ID Aware Ingress Steering","category":"devops","severity":"critical","description":"Enforces deterministic kernel-space ingress steering for HTTP/3 QUIC traffic using eBPF TC (Traffic Control) hooks. Inspects Destination Connection IDs (DCID) directly in the ingress datapath to map migrated UDP flows to target worker sockets without triggering userspace proxy IPC or context-switching penalties.","antiPatternHeadline":"4-Tuple Hashing on Migrated QUIC Flows Causing CPU Core Thrashing and Userspace IPC Bouncing","stars_count":114,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","quic","http3","traffic-control","networking","kernel","xdp"],"exportEndpoints":{"claude":"/api/rules/ebpf-tc-quic-ingress-steering-standard?format=claude","cursorMdc":"/api/rules/ebpf-tc-quic-ingress-steering-standard?format=mdc","cursorrules":"/api/rules/ebpf-tc-quic-ingress-steering-standard?format=cursor","windsurf":"/api/rules/ebpf-tc-quic-ingress-steering-standard?format=windsurf","agents":"/api/rules/ebpf-tc-quic-ingress-steering-standard?format=agents"}},{"id":"otel-histogram-exemplar-boundary-guardrail","title":"OpenTelemetry Multi-Dimensional Histogram Exemplar Boundary & Buffer Guardrail","category":"devops","severity":"critical","description":"Enforces strict bounds on OpenTelemetry exemplar reservoirs, sampling filters, and dimension cardinality to prevent Collector and Agent memory exhaustion under high throughput. Guarantees deterministic metric memory footprints while selectively preserving P99+ tail latency exemplar trace linkages. Mandates cell-level exemplar boundaries and explicit reservoir memory pooling across all distributed metric pipelines.","antiPatternHeadline":"Unbounded AlwaysOn Exemplar Sampling and High-Cardinality Trace Buffering Causing Collector Fleet OOMs","stars_count":98,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","metrics","exemplars","histograms","observability","sre"],"exportEndpoints":{"claude":"/api/rules/otel-histogram-exemplar-boundary-guardrail?format=claude","cursorMdc":"/api/rules/otel-histogram-exemplar-boundary-guardrail?format=mdc","cursorrules":"/api/rules/otel-histogram-exemplar-boundary-guardrail?format=cursor","windsurf":"/api/rules/otel-histogram-exemplar-boundary-guardrail?format=windsurf","agents":"/api/rules/otel-histogram-exemplar-boundary-guardrail?format=agents"}},{"id":"nextjs-15-ppr-dynamic-hole-boundary-standard","title":"Next.js 15 Partial Prerendering Dynamic Hole Boundary Standard","category":"frontend","severity":"critical","description":"Enforces strict Suspense encapsulation for dynamic runtime operations (cookies, headers, searchParams, uncached fetch calls) under Next.js 15 Partial Prerendering (PPR). Prevents dynamic execution leakage into the static prerender shell, edge cache poisoning, and catastrophic hydration mismatches.","antiPatternHeadline":"Unbounded Dynamic Context Leakage Poisoning Static Shell Prerenders","stars_count":44,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["nextjs","react-19","ppr","suspense","edge-caching","streaming"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-ppr-dynamic-hole-boundary-standard?format=claude","cursorMdc":"/api/rules/nextjs-15-ppr-dynamic-hole-boundary-standard?format=mdc","cursorrules":"/api/rules/nextjs-15-ppr-dynamic-hole-boundary-standard?format=cursor","windsurf":"/api/rules/nextjs-15-ppr-dynamic-hole-boundary-standard?format=windsurf","agents":"/api/rules/nextjs-15-ppr-dynamic-hole-boundary-standard?format=agents"}},{"id":"bun-worker-asynclocalstorage-context-isolation-bun-1-2-asyncloc-178","title":"Bun 1.2 AsyncLocalStorage Tenant Context Isolation Across Worker Boundaries","category":"backend","severity":"critical","description":"Enforces strict tenant context serialization, manual rehydration, and explicit lifecycle boundary isolation when propagating AsyncLocalStorage instances across Bun 1.2 worker thread boundaries. Prevents cross-tenant context bleeding, silent trace dropping, and unbounded heap retention in persistent worker pools.","antiPatternHeadline":"Implicit ALS Propagation Assumption and Leaked Shared Worker State","stars_count":64,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","asynclocalstorage","multithreading","tenancy","memory-management"],"exportEndpoints":{"claude":"/api/rules/bun-worker-asynclocalstorage-context-isolation-bun-1-2-asyncloc-178?format=claude","cursorMdc":"/api/rules/bun-worker-asynclocalstorage-context-isolation-bun-1-2-asyncloc-178?format=mdc","cursorrules":"/api/rules/bun-worker-asynclocalstorage-context-isolation-bun-1-2-asyncloc-178?format=cursor","windsurf":"/api/rules/bun-worker-asynclocalstorage-context-isolation-bun-1-2-asyncloc-178?format=windsurf","agents":"/api/rules/bun-worker-asynclocalstorage-context-isolation-bun-1-2-asyncloc-178?format=agents"}},{"id":"fastapi-di-request-scope-lifecycle-fencing","title":"FastAPI Dependency Injection Request-Scope Lifecycle Fencing","category":"backend","severity":"critical","description":"Enforces strict isolation between FastAPI request-scoped dependency lifecycles and asynchronous background execution. Passing request-bound yield dependencies, such as database sessions or transaction contexts, directly into BackgroundTasks or detached asyncio tasks causes race conditions, premature connection pool exhaustion, and catastrophic transaction deadlocks.","antiPatternHeadline":"Leaking Request-Scoped Yield Dependencies into Detached BackgroundTasks","stars_count":115,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","sqlalchemy","concurrency","asyncio","dependency-injection"],"exportEndpoints":{"claude":"/api/rules/fastapi-di-request-scope-lifecycle-fencing?format=claude","cursorMdc":"/api/rules/fastapi-di-request-scope-lifecycle-fencing?format=mdc","cursorrules":"/api/rules/fastapi-di-request-scope-lifecycle-fencing?format=cursor","windsurf":"/api/rules/fastapi-di-request-scope-lifecycle-fencing?format=windsurf","agents":"/api/rules/fastapi-di-request-scope-lifecycle-fencing?format=agents"}},{"id":"capacitor-7-native-bridge-ephemeral-token-protocol","title":"Capacitor 7 Native Bridge Ephemeral Token Exchange Protocol Guardrail","category":"mobile","severity":"critical","description":"Enforces a cryptographically bound ephemeral token handshake between Capacitor 7 WebView runtimes and native platform plugins. Prevents unauthorized cross-origin execution, bridge hijacking from malicious third-party frames, and IPC token replay attacks by binding single-use dynamic nonces to every native dispatch.","antiPatternHeadline":"Unauthenticated Global Bridge Invocation and Static Secret Replay in Native IPC","stars_count":72,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["capacitor","mobile-security","ipc-security","webview","token-exchange","cryptography"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-native-bridge-ephemeral-token-protocol?format=claude","cursorMdc":"/api/rules/capacitor-7-native-bridge-ephemeral-token-protocol?format=mdc","cursorrules":"/api/rules/capacitor-7-native-bridge-ephemeral-token-protocol?format=cursor","windsurf":"/api/rules/capacitor-7-native-bridge-ephemeral-token-protocol?format=windsurf","agents":"/api/rules/capacitor-7-native-bridge-ephemeral-token-protocol?format=agents"}},{"id":"kmp-sqlite-wal-concurrency-boundary","title":"Kotlin Multiplatform SQLite WAL Concurrency & Mutex Thread-Confined Invariant","category":"mobile","severity":"critical","description":"Enforces strict isolation between SQLite Write-Ahead Logging (WAL) write transactions and concurrent read pools across Kotlin Multiplatform targets. Prevents native POSIX lock starvation and SQLITE_BUSY / SQLITE_LOCKED errors on Apple platforms by constraining all database mutations to a dedicated single-threaded dispatcher backed by a non-reentrant Kotlinx Mutex, while routing reads across a bounded multi-threaded pool.","antiPatternHeadline":"Unconfined Concurrent Database Writes Across Kotlin Native POSIX Threads and Android Coroutine Dispatchers","stars_count":92,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","sqlite","wal","concurrency","ios","android"],"exportEndpoints":{"claude":"/api/rules/kmp-sqlite-wal-concurrency-boundary?format=claude","cursorMdc":"/api/rules/kmp-sqlite-wal-concurrency-boundary?format=mdc","cursorrules":"/api/rules/kmp-sqlite-wal-concurrency-boundary?format=cursor","windsurf":"/api/rules/kmp-sqlite-wal-concurrency-boundary?format=windsurf","agents":"/api/rules/kmp-sqlite-wal-concurrency-boundary?format=agents"}},{"id":"webauthn-l3-largeblob-atomic-payload-verification","title":"WebAuthn Level 3 LargeBlob Atomic Payload Verification and State Integrity","category":"security","severity":"critical","description":"Enforces cryptographic signature verification, schema validation, and two-phase atomic state management when writing and reading WebAuthn Level 3 largeBlob credential extensions. Guarantees that client-side biometric assertions cannot commit partial, corrupted, or unauthenticated payloads to authenticator storage during transaction lifecycles.","antiPatternHeadline":"Blind Overwriting and Unverified Deserialization of Authenticator LargeBlob State","stars_count":106,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","passkeys","cryptography","largeblob","level-3"],"exportEndpoints":{"claude":"/api/rules/webauthn-l3-largeblob-atomic-payload-verification?format=claude","cursorMdc":"/api/rules/webauthn-l3-largeblob-atomic-payload-verification?format=mdc","cursorrules":"/api/rules/webauthn-l3-largeblob-atomic-payload-verification?format=cursor","windsurf":"/api/rules/webauthn-l3-largeblob-atomic-payload-verification?format=windsurf","agents":"/api/rules/webauthn-l3-largeblob-atomic-payload-verification?format=agents"}},{"id":"ebpf-lsm-microvm-privilege-fencing-standard","title":"Runtime-Immutable eBPF LSM Privilege Fencing for MicroVMs","category":"security","severity":"critical","description":"Enforces deterministic, kernel-space privilege confinement for ephemeral microVM workloads by anchoring Linux Security Module (LSM) BPF hooks to cgroup contexts. Eliminates Time-of-Check to Time-of-Use (TOCTOU) capability inheritance races by making security boundaries strictly synchronous and unbypassable.","antiPatternHeadline":"Userspace Asynchronous Security Monitoring and Fail-Open LSM Hook Returns","stars_count":65,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","ebpf","lsm","microvm","kernel-hardening","capabilities"],"exportEndpoints":{"claude":"/api/rules/ebpf-lsm-microvm-privilege-fencing-standard?format=claude","cursorMdc":"/api/rules/ebpf-lsm-microvm-privilege-fencing-standard?format=mdc","cursorrules":"/api/rules/ebpf-lsm-microvm-privilege-fencing-standard?format=cursor","windsurf":"/api/rules/ebpf-lsm-microvm-privilege-fencing-standard?format=windsurf","agents":"/api/rules/ebpf-lsm-microvm-privilege-fencing-standard?format=agents"}},{"id":"opentelemetry-baggage-ingress-sanitization-guardrail","title":"OpenTelemetry Ingress Baggage Sanitization, Allowlisting, and Bounding Guardrail","category":"devops","severity":"critical","description":"Enforces strict perimeter hygiene on incoming W3C Baggage headers at API gateways and ingress points. Mandates payload size bounding, entry count truncation, and key allowlisting to prevent telemetry memory amplification attacks, trace context injection exploits, and upstream context pollution.","antiPatternHeadline":"Blind Ingress Propagation of Unbounded, Untrusted Client Baggage into Internal Distributed Contexts","stars_count":58,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","security","distributed-tracing","api-gateway"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-baggage-ingress-sanitization-guardrail?format=claude","cursorMdc":"/api/rules/opentelemetry-baggage-ingress-sanitization-guardrail?format=mdc","cursorrules":"/api/rules/opentelemetry-baggage-ingress-sanitization-guardrail?format=cursor","windsurf":"/api/rules/opentelemetry-baggage-ingress-sanitization-guardrail?format=windsurf","agents":"/api/rules/opentelemetry-baggage-ingress-sanitization-guardrail?format=agents"}},{"id":"vite6-environment-api-runtime-sandboxing-standard","title":"Vite 6 Environment API Runtime Sandboxing Standard","category":"frontend","severity":"critical","description":"Vite 6 introduces the Environment API to provide distinct, sandboxed module graphs and execution contexts for client, SSR, and custom runtime targets (e.g., edge workers). This standard mandates explicit per-environment configuration, boundary fencing via environment-aware plugin hooks, and the deprecation of legacy server-side execution APIs to eliminate cross-environment credential leaks and compilation contamination.","antiPatternHeadline":"Leaking Server Secrets and Private Backend Modules into Client Artifacts via Legacy Monolithic Configuration and Unscoped Vite Plugins","stars_count":54,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","vite","vite6","environment-api","runtime-sandboxing","ssr","module-isolation","security"],"exportEndpoints":{"claude":"/api/rules/vite6-environment-api-runtime-sandboxing-standard?format=claude","cursorMdc":"/api/rules/vite6-environment-api-runtime-sandboxing-standard?format=mdc","cursorrules":"/api/rules/vite6-environment-api-runtime-sandboxing-standard?format=cursor","windsurf":"/api/rules/vite6-environment-api-runtime-sandboxing-standard?format=windsurf","agents":"/api/rules/vite6-environment-api-runtime-sandboxing-standard?format=agents"}},{"id":"nextjs-15-ppr-dynamic-fallback-boundary-standard","title":"Next.js 15 Partial Prerendering (PPR) Dynamic Fallback Boundary Standard","category":"frontend","severity":"critical","description":"Enforces strict isolation of dynamic runtime operations within deterministic React Suspense boundaries for Next.js 15 Partial Prerendering (PPR). Guarantees instantaneous edge-cached static shell delivery while eliminating de-optimizations, cascading dynamic leaks, and hydration mismatches during dynamic chunk streaming.","antiPatternHeadline":"Unbounded Dynamic Invocations Collapsing Static Route Shells into Full Dynamic SSR","stars_count":50,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs15","ppr","suspense","performance","hydration","edge"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-ppr-dynamic-fallback-boundary-standard?format=claude","cursorMdc":"/api/rules/nextjs-15-ppr-dynamic-fallback-boundary-standard?format=mdc","cursorrules":"/api/rules/nextjs-15-ppr-dynamic-fallback-boundary-standard?format=cursor","windsurf":"/api/rules/nextjs-15-ppr-dynamic-fallback-boundary-standard?format=windsurf","agents":"/api/rules/nextjs-15-ppr-dynamic-fallback-boundary-standard?format=agents"}},{"id":"axum-0-8-tower-adaptive-concurrency-shedding-barrier","title":"Axum 0.8 Tower Adaptive Concurrency & Dwell-Time Load Shedding Guardrail","category":"backend","severity":"critical","description":"Enforces dynamic, queue-dwell-time-aware load shedding at the Tower layer in Axum 0.8 services to eliminate bufferbloat and tail-latency amplification. Prohibits static concurrency limiters and unbounded FIFO queues that process dead or expired requests during downstream saturation.","antiPatternHeadline":"Unbounded queuing and static concurrency limits causing bufferbloat, cascading collapse, and p99 tail latency explosion.","stars_count":45,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tower","concurrency","load-shedding","resilience"],"exportEndpoints":{"claude":"/api/rules/axum-0-8-tower-adaptive-concurrency-shedding-barrier?format=claude","cursorMdc":"/api/rules/axum-0-8-tower-adaptive-concurrency-shedding-barrier?format=mdc","cursorrules":"/api/rules/axum-0-8-tower-adaptive-concurrency-shedding-barrier?format=cursor","windsurf":"/api/rules/axum-0-8-tower-adaptive-concurrency-shedding-barrier?format=windsurf","agents":"/api/rules/axum-0-8-tower-adaptive-concurrency-shedding-barrier?format=agents"}},{"id":"pgvector-hnsw-quantization-memory-ceiling","title":"pgvector 0.8 HNSW Scalar Quantization & Memory Ceiling Standard","category":"backend","severity":"critical","description":"Enforces strict memory ceiling budgets and SIMD-aligned scalar quantization (halfvec/int8) for pgvector 0.8+ HNSW indexes to prevent unconstrained RAM exhaustion and kernel OOM killer termination during high-concurrency searches. Mandates deterministic index sizing validation, bounded build-time maintenance memory, and scoped runtime search constraints.","antiPatternHeadline":"Deploying unquantized 32-bit floating-point HNSW vector indexes without memory caps, causing catastrophic PostgreSQL worker process OOM evictions under concurrency","stars_count":60,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","pgvector","database","hnsw","memory-management","embeddings"],"exportEndpoints":{"claude":"/api/rules/pgvector-hnsw-quantization-memory-ceiling?format=claude","cursorMdc":"/api/rules/pgvector-hnsw-quantization-memory-ceiling?format=mdc","cursorrules":"/api/rules/pgvector-hnsw-quantization-memory-ceiling?format=cursor","windsurf":"/api/rules/pgvector-hnsw-quantization-memory-ceiling?format=windsurf","agents":"/api/rules/pgvector-hnsw-quantization-memory-ceiling?format=agents"}},{"id":"capacitor-7-deep-link-intent-sandboxing-standard","title":"Capacitor 7 Deep-Link Intent Sandboxing & IPC Bridge Isolation Standard","category":"mobile","severity":"critical","description":"Enforces strict origin validation, cryptographic payload schema verification, and isolated execution contexts for external deep-link intents prior to dispatching them across Capacitor 7's JavaScript-to-Native bridge. Prevents prototype pollution, arbitrary JavaScript execution, and internal plugin method invocation originating from untrusted native intent injections. Guarantees that parsed intent parameters are strictly decoupled from internal IPC router arguments.","antiPatternHeadline":"Directly feeding raw deep-link URLs and unvalidated query parameters into internal Capacitor plugin calls and IPC dispatchers.","stars_count":47,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor-7","deep-links","ipc-security","sandboxing","intent-sanitization"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-deep-link-intent-sandboxing-standard?format=claude","cursorMdc":"/api/rules/capacitor-7-deep-link-intent-sandboxing-standard?format=mdc","cursorrules":"/api/rules/capacitor-7-deep-link-intent-sandboxing-standard?format=cursor","windsurf":"/api/rules/capacitor-7-deep-link-intent-sandboxing-standard?format=windsurf","agents":"/api/rules/capacitor-7-deep-link-intent-sandboxing-standard?format=agents"}},{"id":"webauthn-conditional-mediation-top-level-context-guardrail","title":"WebAuthn Conditional Mediation Top-Level Browsing Context Guardrail","category":"security","severity":"critical","description":"Enforces strict top-level browsing context boundaries during WebAuthn ambient passkey autofill (conditional mediation). Ambient credential requests in unvalidated or embedded contexts expose users to credential harvesting, iframe overlays, and clickjacking attacks.","antiPatternHeadline":"Executing WebAuthn Conditional Mediation Inside Nested or Embedded Frame Contexts","stars_count":44,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","passkeys","fido2","clickjacking","iframe-isolation"],"exportEndpoints":{"claude":"/api/rules/webauthn-conditional-mediation-top-level-context-guardrail?format=claude","cursorMdc":"/api/rules/webauthn-conditional-mediation-top-level-context-guardrail?format=mdc","cursorrules":"/api/rules/webauthn-conditional-mediation-top-level-context-guardrail?format=cursor","windsurf":"/api/rules/webauthn-conditional-mediation-top-level-context-guardrail?format=windsurf","agents":"/api/rules/webauthn-conditional-mediation-top-level-context-guardrail?format=agents"}},{"id":"opentelemetry-genai-cardinality-pii-guardrail","title":"OpenTelemetry GenAI Semantic Conventions Cardinality and Boundary Redaction Guardrail","category":"devops","severity":"critical","description":"Enforces OpenTelemetry GenAI semantic conventions by strictly prohibiting unbounded dynamic metadata and prompt text inside metric dimensions while mandating client-side PII redaction and payload truncation on span attributes. Prevents OpenTelemetry Collector buffer memory exhaustion, catastrophic TSDB index explosion, and telemetry privacy breaches.","antiPatternHeadline":"Attaching Raw Prompts, PII, or Dynamic Session Identifiers to Metric Dimensions and Unsanitized Spans","stars_count":56,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","genai","cardinality","observability","security"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-genai-cardinality-pii-guardrail?format=claude","cursorMdc":"/api/rules/opentelemetry-genai-cardinality-pii-guardrail?format=mdc","cursorrules":"/api/rules/opentelemetry-genai-cardinality-pii-guardrail?format=cursor","windsurf":"/api/rules/opentelemetry-genai-cardinality-pii-guardrail?format=windsurf","agents":"/api/rules/opentelemetry-genai-cardinality-pii-guardrail?format=agents"}},{"id":"cilium-ebpf-tail-call-stack-budget-guardrail","title":"Cilium eBPF Host-Routing Tail-Call Depth & Stack Budget Guardrail","category":"devops","severity":"critical","description":"Enforces strict limits on eBPF program stack allocation (512 bytes) and tail-call execution depth (max 33 jumps) across Cilium native host-routing configurations. Prevents kernel stack overflow panics, BPF verifier rejections, and silent packet drop anomalies (DROP_MISSED_TAIL_CALL) under high-throughput service mesh and L7 proxy traversal.","antiPatternHeadline":"Deep Tail-Call Chains with Large Per-Program BPF Stack Allocation Causing Kernel Verifier Traps and Silent Drop Anomalies","stars_count":101,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","cilium","kubernetes","networking","kernel","service-mesh"],"exportEndpoints":{"claude":"/api/rules/cilium-ebpf-tail-call-stack-budget-guardrail?format=claude","cursorMdc":"/api/rules/cilium-ebpf-tail-call-stack-budget-guardrail?format=mdc","cursorrules":"/api/rules/cilium-ebpf-tail-call-stack-budget-guardrail?format=cursor","windsurf":"/api/rules/cilium-ebpf-tail-call-stack-budget-guardrail?format=windsurf","agents":"/api/rules/cilium-ebpf-tail-call-stack-budget-guardrail?format=agents"}},{"id":"dsd-hydration-boundary-streaming-isolation","title":"Declarative Shadow DOM Hydration Boundary & Isolation Standard","category":"frontend","severity":"critical","description":"Enforces deterministic, non-destructive streaming hydration for Web Components utilizing Declarative Shadow DOM (DSD) across heterogeneous micro-frontends. Eliminates runtime DOMExceptions caused by redundant shadow root attachment, prevents Flash of Unstyled Content (FOUC) during chunked SSR streaming, and prevents memory leaks from detached event boundaries in nested framework islands.","antiPatternHeadline":"Destructive Re-Attachment of Existing Declarative Shadow Roots and InnerHTML Hydration Wipeouts","stars_count":74,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","web-components","declarative-shadow-dom","streaming-ssr","micro-frontends","hydration"],"exportEndpoints":{"claude":"/api/rules/dsd-hydration-boundary-streaming-isolation?format=claude","cursorMdc":"/api/rules/dsd-hydration-boundary-streaming-isolation?format=mdc","cursorrules":"/api/rules/dsd-hydration-boundary-streaming-isolation?format=cursor","windsurf":"/api/rules/dsd-hydration-boundary-streaming-isolation?format=windsurf","agents":"/api/rules/dsd-hydration-boundary-streaming-isolation?format=agents"}},{"id":"drizzle-pgbouncer-transaction-prepared-statements-guardrail","title":"Drizzle ORM PgBouncer Transaction Pooling Prepared Statement Guardrail","category":"backend","severity":"critical","description":"Enforces strict deactivation of client- and server-side prepared statements when configuring Drizzle ORM with connection poolers operating in transaction mode (e.g., PgBouncer, Supabase Pooler, Neon Pooled, AWS RDS Proxy). Eliminates catastrophic 42P05 (prepared statement already exists) and 26000 (prepared statement does not exist) runtime failures, as well as cross-tenant plan pollution caused by backend connection rotation across transactions.","antiPatternHeadline":"Instantiating Drizzle ORM over transaction-mode poolers with default prepared statement caching enabled","stars_count":71,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","drizzle-orm","postgresql","pgbouncer","multi-tenancy","database"],"exportEndpoints":{"claude":"/api/rules/drizzle-pgbouncer-transaction-prepared-statements-guardrail?format=claude","cursorMdc":"/api/rules/drizzle-pgbouncer-transaction-prepared-statements-guardrail?format=mdc","cursorrules":"/api/rules/drizzle-pgbouncer-transaction-prepared-statements-guardrail?format=cursor","windsurf":"/api/rules/drizzle-pgbouncer-transaction-prepared-statements-guardrail?format=windsurf","agents":"/api/rules/drizzle-pgbouncer-transaction-prepared-statements-guardrail?format=agents"}},{"id":"temporal-workflow-determinism-ast-guardrail","title":"Temporal Workflow Determinism & AST-Level Replay Invariant Guardrail","category":"backend","severity":"critical","description":"Enforces strict replay determinism on all Temporal workflow definitions to eliminate non-deterministic execution errors and durable state machine corruption. Rejects native I/O, unseeded randomness, unmanaged clocks, async concurrency escapes, and unversioned AST modifications within workflow execution scopes. Mandates that all side effects, network calls, and mutable state transitions reside exclusively within Temporal Activities or version-gated patch blocks.","antiPatternHeadline":"Executing Non-Deterministic System Calls, Unversioned Control Flow, or Native Timers Inside Durable Workflows","stars_count":65,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","temporal","distributed-systems","determinism","orchestration","ast-linting"],"exportEndpoints":{"claude":"/api/rules/temporal-workflow-determinism-ast-guardrail?format=claude","cursorMdc":"/api/rules/temporal-workflow-determinism-ast-guardrail?format=mdc","cursorrules":"/api/rules/temporal-workflow-determinism-ast-guardrail?format=cursor","windsurf":"/api/rules/temporal-workflow-determinism-ast-guardrail?format=windsurf","agents":"/api/rules/temporal-workflow-determinism-ast-guardrail?format=agents"}},{"id":"kmp-swift-export-actor-isolation-boundary-kotlin-multiplat-954","title":"Strict Swift Concurrency Actor Isolation for Kotlin/Native Swift Export Boundaries","category":"mobile","severity":"critical","description":"Enforces strict Swift Concurrency actor boundaries and value-type isolation over Kotlin Multiplatform (KMP) Swift Export bridges. Prevents cross-runtime multithreaded race conditions, unstructured Task escapes, and silent runtime panics caused by mutating un-isolated Kotlin/Native object graphs across Swift threads.","antiPatternHeadline":"Exposing Raw Kotlin Reference Types to Arbitrary Swift Concurrency Tasks Without Actor Isolation","stars_count":116,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","swift-concurrency","kmp-swift-export","actor-isolation","memory-safety"],"exportEndpoints":{"claude":"/api/rules/kmp-swift-export-actor-isolation-boundary-kotlin-multiplat-954?format=claude","cursorMdc":"/api/rules/kmp-swift-export-actor-isolation-boundary-kotlin-multiplat-954?format=mdc","cursorrules":"/api/rules/kmp-swift-export-actor-isolation-boundary-kotlin-multiplat-954?format=cursor","windsurf":"/api/rules/kmp-swift-export-actor-isolation-boundary-kotlin-multiplat-954?format=windsurf","agents":"/api/rules/kmp-swift-export-actor-isolation-boundary-kotlin-multiplat-954?format=agents"}},{"id":"capacitor-7-hardware-keystore-attestation-bridge-capacitor-7-hard-749","title":"Hardware-Backed KeyStore & Enclave Attestation Bridge Standard","category":"mobile","severity":"critical","description":"Enforces a zero-trust bridge architecture between Capacitor 7 WebViews and native hardware security modules (Apple Secure Enclave and Android StrongBox/TEE KeyStore). Mandates that cryptographic keys never enter the JavaScript execution context and signatures are bound to server-generated nonces verified exclusively on remote backends.","antiPatternHeadline":"Trusting Client-Side Biometric Booleans and Storing Ephemeral Private Keys in WebView Contexts","stars_count":73,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","security","cryptography","keystore","secure-enclave","biometrics","attestation"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-hardware-keystore-attestation-bridge-capacitor-7-hard-749?format=claude","cursorMdc":"/api/rules/capacitor-7-hardware-keystore-attestation-bridge-capacitor-7-hard-749?format=mdc","cursorrules":"/api/rules/capacitor-7-hardware-keystore-attestation-bridge-capacitor-7-hard-749?format=cursor","windsurf":"/api/rules/capacitor-7-hardware-keystore-attestation-bridge-capacitor-7-hard-749?format=windsurf","agents":"/api/rules/capacitor-7-hardware-keystore-attestation-bridge-capacitor-7-hard-749?format=agents"}},{"id":"openfga-rebac-depth-limiting-standard","title":"OpenFGA Recursive Tuple Graph Depth Limiting and Cycle Prevention Standard","category":"security","severity":"critical","description":"Enforces strict invariants on OpenFGA authorization models and query evaluators to mitigate denial-of-service (DoS) and thread starvation caused by unbounded transitive evaluation and circular tuple hierarchies. Mandates pre-write cycle validation on directed acyclic graph (DAG) hierarchies, deterministic execution timeouts with circuit-breaking on OpenFGA client checks, and strict resolution depth constraints in both model configuration and test suites.","antiPatternHeadline":"Unbounded Transitive ReBAC Evaluation and Unvalidated Cyclic Tuple Ingestion","stars_count":82,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","rebac","authorization","dos-prevention","graph-algorithms"],"exportEndpoints":{"claude":"/api/rules/openfga-rebac-depth-limiting-standard?format=claude","cursorMdc":"/api/rules/openfga-rebac-depth-limiting-standard?format=mdc","cursorrules":"/api/rules/openfga-rebac-depth-limiting-standard?format=cursor","windsurf":"/api/rules/openfga-rebac-depth-limiting-standard?format=windsurf","agents":"/api/rules/openfga-rebac-depth-limiting-standard?format=agents"}},{"id":"rfc-9449-dpop-sender-constrained-enforcement","title":"RFC 9449 DPoP Sender-Constrained Token Enforcement Fence","category":"security","severity":"critical","description":"Enforces cryptographic binding between OAuth 2.0 access tokens and client-generated asymmetric key pairs using RFC 9449 Demonstrating Proof-of-Possession (DPoP). Guarantees that token exfiltration across untrusted networks or compromised storage cannot lead to credential replay attacks against downstream resource servers. Requires strict verification of public key thumbprints, HTTP method/URI bindings, access token hashes, and distributed proof replay prevention.","antiPatternHeadline":"Accepting Bearer Tokens Without Cryptographic Sender-Binding or Permitting Unverified DPoP Proofs","stars_count":67,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","oauth2","rfc9449","dpop","sender-constrained","zero-trust","replay-prevention"],"exportEndpoints":{"claude":"/api/rules/rfc-9449-dpop-sender-constrained-enforcement?format=claude","cursorMdc":"/api/rules/rfc-9449-dpop-sender-constrained-enforcement?format=mdc","cursorrules":"/api/rules/rfc-9449-dpop-sender-constrained-enforcement?format=cursor","windsurf":"/api/rules/rfc-9449-dpop-sender-constrained-enforcement?format=windsurf","agents":"/api/rules/rfc-9449-dpop-sender-constrained-enforcement?format=agents"}},{"id":"opentelemetry-baggage-redaction-cardinality-guard","title":"OpenTelemetry W3C Baggage Dynamic Redaction and Bounded Cardinality Invariant","category":"devops","severity":"critical","description":"Enforces deterministic key allowlisting, byte-length caps, and PII redaction on W3C Baggage propagation across service boundaries. Prevents inadvertent credential/PII leaks over HTTP headers and eliminates catastrophic high-cardinality metric label explosions in downstream Prometheus and OpenTelemetry collectors.","antiPatternHeadline":"Unfiltered Baggage Propagation Leaking PII and Triggering Downstream Metric Cardinality Explosions","stars_count":106,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","distributed-tracing","observability","pii-prevention","cardinality"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-baggage-redaction-cardinality-guard?format=claude","cursorMdc":"/api/rules/opentelemetry-baggage-redaction-cardinality-guard?format=mdc","cursorrules":"/api/rules/opentelemetry-baggage-redaction-cardinality-guard?format=cursor","windsurf":"/api/rules/opentelemetry-baggage-redaction-cardinality-guard?format=windsurf","agents":"/api/rules/opentelemetry-baggage-redaction-cardinality-guard?format=agents"}},{"id":"cilium-ebpf-kernel-native-mtls-handshake-invariant","title":"Cilium eBPF Kernel-Native mTLS and Cryptographic Identity Enforcement","category":"devops","severity":"critical","description":"Enforces kernel-native mTLS session authentication and cryptographic identity validation via Cilium eBPF without userspace sidecar proxies. Eliminates Envoy sidecar serialization, dual-network-stack hops, and context-switching overhead while guaranteeing non-bypassable zero-trust identity verification via SPIFFE/SPIRE and kernel-level WireGuard/IPsec payload encryption.","antiPatternHeadline":"Bypassing Kernel mTLS Handshakes via Permissive Plaintext Fallback or Deploying Latency-Degrading Userspace Proxy Sidecars","stars_count":57,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","cilium","ebpf","mtls","zero-trust","kubernetes","spiffe"],"exportEndpoints":{"claude":"/api/rules/cilium-ebpf-kernel-native-mtls-handshake-invariant?format=claude","cursorMdc":"/api/rules/cilium-ebpf-kernel-native-mtls-handshake-invariant?format=mdc","cursorrules":"/api/rules/cilium-ebpf-kernel-native-mtls-handshake-invariant?format=cursor","windsurf":"/api/rules/cilium-ebpf-kernel-native-mtls-handshake-invariant?format=windsurf","agents":"/api/rules/cilium-ebpf-kernel-native-mtls-handshake-invariant?format=agents"}},{"id":"bun-cgroup-v2-memory-pressure-gc-sync","title":"Bun 1.2 cgroup v2 Memory-Pressure GC Synchronization Guardrail","category":"backend","severity":"critical","description":"Enforces active synchronization between Linux cgroup v2 memory.events / memory.high signals and Bun's underlying JavaScriptCore garbage collector. Containers deployed in dense orchestration platforms risk sudden SIGKILL termination without active GC triggering because JavaScriptCore's default allocation heuristics are unaware of kernel cgroup boundaries.","antiPatternHeadline":"Relying on Default JSC Heap Growth Inside Memory-Constrained Linux Containers","stars_count":87,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","cgroups-v2","memory-management","garbage-collection","containers"],"exportEndpoints":{"claude":"/api/rules/bun-cgroup-v2-memory-pressure-gc-sync?format=claude","cursorMdc":"/api/rules/bun-cgroup-v2-memory-pressure-gc-sync?format=mdc","cursorrules":"/api/rules/bun-cgroup-v2-memory-pressure-gc-sync?format=cursor","windsurf":"/api/rules/bun-cgroup-v2-memory-pressure-gc-sync?format=windsurf","agents":"/api/rules/bun-cgroup-v2-memory-pressure-gc-sync?format=agents"}},{"id":"react19-useoptimistic-serialization-boundary","title":"React 19 useOptimistic Dynamic Serialization Boundary and State Isolation","category":"frontend","severity":"critical","description":"Enforces strict immutability, deterministic pure-reducer updates, and structured-cloneable payload boundaries within React 19 useOptimistic hooks. Prohibits direct object mutation, non-serializable optimistic payloads, and shared object references that trigger visual tearing, reconciliation races, and hydration mismatch during concurrent Server Action streaming.","antiPatternHeadline":"Mutating Existing State References and Passing Non-Serializable Instances to useOptimistic Update Reducers","stars_count":74,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["react19","useOptimistic","server-actions","concurrency","serialization","immutability"],"exportEndpoints":{"claude":"/api/rules/react19-useoptimistic-serialization-boundary?format=claude","cursorMdc":"/api/rules/react19-useoptimistic-serialization-boundary?format=mdc","cursorrules":"/api/rules/react19-useoptimistic-serialization-boundary?format=cursor","windsurf":"/api/rules/react19-useoptimistic-serialization-boundary?format=windsurf","agents":"/api/rules/react19-useoptimistic-serialization-boundary?format=agents"}},{"id":"postgres-17-failover-slot-preservation","title":"Postgres 17 CDC Logical Replication Failover Slot Synchronization & Invariant Guardrail","category":"backend","severity":"critical","description":"Enforces failover-safe logical replication slots introduced in PostgreSQL 17 to prevent replication stream corruption and data gaps during planned or unplanned database failovers. Mandates that CDC subscriber services initialize slots with failover enabled, synchronize slots on physical standby replicas, and verify LSN progression before reconnecting downstream consumers. Guarantees zero data loss across physical promotions by preventing subscriber consumption past un-replicated physical WAL boundaries.","antiPatternHeadline":"Creating Logical Slots Without Failover Synchronization Causing Missing CDC Events and Slot Re-Creation on Replica Promotion","stars_count":55,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres-17","cdc","logical-replication","failover","debezium","database-reliability"],"exportEndpoints":{"claude":"/api/rules/postgres-17-failover-slot-preservation?format=claude","cursorMdc":"/api/rules/postgres-17-failover-slot-preservation?format=mdc","cursorrules":"/api/rules/postgres-17-failover-slot-preservation?format=cursor","windsurf":"/api/rules/postgres-17-failover-slot-preservation?format=windsurf","agents":"/api/rules/postgres-17-failover-slot-preservation?format=agents"}},{"id":"kmp-swift-structured-concurrency-cancellation-bridge","title":"Deterministic Swift Task Tree & Kotlin Coroutine Scope Bridging","category":"mobile","severity":"critical","description":"Enforces bidirectional, deterministic cancellation propagation and bounded backpressure between Swift Concurrency Tasks and Kotlin Multiplatform 2.1 Coroutine Scopes. Prevents orphaned zombie coroutines in the Kotlin runtime when Swift Tasks are cancelled, and eliminates unbounded memory leaks when transforming Kotlin Flows into Swift AsyncSequences.","antiPatternHeadline":"Unbounded Dispatch and Fire-and-Forget Coroutine Bridging Without Cooperative Cancellation Handlers","stars_count":57,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kmp","kotlin-multiplatform","swift-concurrency","coroutines","ios","async-await"],"exportEndpoints":{"claude":"/api/rules/kmp-swift-structured-concurrency-cancellation-bridge?format=claude","cursorMdc":"/api/rules/kmp-swift-structured-concurrency-cancellation-bridge?format=mdc","cursorrules":"/api/rules/kmp-swift-structured-concurrency-cancellation-bridge?format=cursor","windsurf":"/api/rules/kmp-swift-structured-concurrency-cancellation-bridge?format=windsurf","agents":"/api/rules/kmp-swift-structured-concurrency-cancellation-bridge?format=agents"}},{"id":"opentelemetry-ebpf-xdp-w3c-trace-propagation-standard","title":"In-Kernel W3C TraceContext Propagation via eBPF XDP with Zero-Copy Header Mutation","category":"devops","severity":"critical","description":"Mandates in-kernel parsing, extraction, and injection of W3C TraceContext headers directly within the eBPF XDP driver layer. Eliminates userspace context switching, socket bouncing, and TLS de-serialization latency for ingress/egress network flows. Enforces verifier-compliant boundary safety, MTU bounds enforcement, and incremental RFC-compliant L3/L4 checksum recalculation.","antiPatternHeadline":"Bouncing Packets to Userspace Proxies or Mutating Headers Without In-Kernel Checksum Recalculation","stars_count":119,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","xdp","opentelemetry","w3c-tracecontext","kernel","observability"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-ebpf-xdp-w3c-trace-propagation-standard?format=claude","cursorMdc":"/api/rules/opentelemetry-ebpf-xdp-w3c-trace-propagation-standard?format=mdc","cursorrules":"/api/rules/opentelemetry-ebpf-xdp-w3c-trace-propagation-standard?format=cursor","windsurf":"/api/rules/opentelemetry-ebpf-xdp-w3c-trace-propagation-standard?format=windsurf","agents":"/api/rules/opentelemetry-ebpf-xdp-w3c-trace-propagation-standard?format=agents"}},{"id":"go-chi-http3-0rtt-anti-replay","title":"Go 1.24 Chi HTTP/3 0-RTT Anti-Replay Idempotency Enforcement","category":"backend","severity":"critical","description":"Mandates strict rejection or deterministic idempotency caching of QUIC 0-RTT early-data requests across distributed Go Chi edge gateways. Non-safe HTTP methods delivered via 0-RTT without cryptographically validated idempotency tokens must return HTTP 425 (Too Early) to force handshake completion. Ephemeral distributed Bloom filters must deduplicate concurrent and replayed early requests within the TLS ticket validity window.","antiPatternHeadline":"Permitting Non-Idempotent Mutations in Unverified QUIC 0-RTT Early Data Handshakes","stars_count":77,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","http3","quic","chi","security","distributed-systems","idempotency"],"exportEndpoints":{"claude":"/api/rules/go-chi-http3-0rtt-anti-replay?format=claude","cursorMdc":"/api/rules/go-chi-http3-0rtt-anti-replay?format=mdc","cursorrules":"/api/rules/go-chi-http3-0rtt-anti-replay?format=cursor","windsurf":"/api/rules/go-chi-http3-0rtt-anti-replay?format=windsurf","agents":"/api/rules/go-chi-http3-0rtt-anti-replay?format=agents"}},{"id":"svelte-5-async-derived-dependency-isolation-invariant","title":"Svelte 5 Runes Async Derived Dependency Isolation Invariant","category":"frontend","severity":"critical","description":"Svelte 5's $derived rune must strictly remain synchronous and free of untracked post-await dependency reads to prevent asynchronous dependency leakage and cascading reactive loops. Asynchronous state derivation must explicitly isolate its trigger dependencies, encapsulate pending promises through un-tracked invocations or dedicated resource state holders, and prevent unawaited Promise resolutions from executing downstream effect loops.","antiPatternHeadline":"Leaking Reactive Dependencies Across Asynchronous Execution Boundaries in Derived Runes","stars_count":98,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","reactivity","async-state"],"exportEndpoints":{"claude":"/api/rules/svelte-5-async-derived-dependency-isolation-invariant?format=claude","cursorMdc":"/api/rules/svelte-5-async-derived-dependency-isolation-invariant?format=mdc","cursorrules":"/api/rules/svelte-5-async-derived-dependency-isolation-invariant?format=cursor","windsurf":"/api/rules/svelte-5-async-derived-dependency-isolation-invariant?format=windsurf","agents":"/api/rules/svelte-5-async-derived-dependency-isolation-invariant?format=agents"}},{"id":"openfga-compile-time-graph-cycle-guardrail","title":"OpenFGA Static Relation Model Cycle and Recursion Guardrail","category":"security","severity":"critical","description":"Enforces pre-deployment compile-time verification and static Directed Acyclic Graph (DAG) validation on OpenFGA authorization models. Prevents unbounded recursive relations, mutual-containment loops, and circular tuple expansions that trigger catastrophic goroutine exhaustion and denial-of-service timeouts during runtime authorization checks.","antiPatternHeadline":"Deploying Unvalidated OpenFGA Models with Unbounded Recursive Expansion Paths","stars_count":89,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","authorization","openfga","graph-algorithms","dos-prevention","zanzibar"],"exportEndpoints":{"claude":"/api/rules/openfga-compile-time-graph-cycle-guardrail?format=claude","cursorMdc":"/api/rules/openfga-compile-time-graph-cycle-guardrail?format=mdc","cursorrules":"/api/rules/openfga-compile-time-graph-cycle-guardrail?format=cursor","windsurf":"/api/rules/openfga-compile-time-graph-cycle-guardrail?format=windsurf","agents":"/api/rules/openfga-compile-time-graph-cycle-guardrail?format=agents"}},{"id":"webauthn-synced-passkey-epoch-revocation-fencing","title":"WebAuthn Synced-Credential Epoch Revocation and Distributed Fencing Standard","category":"security","severity":"critical","description":"Mandates cryptographic epoch-counter fencing across distributed session stores and authorization layers upon compromise reporting of multi-device synced passkeys. Guarantees that any device revocation or passkey credential cycle atomically increments the security epoch, rendering all pre-existing distributed sessions, refresh tokens, and authentication assertions cryptographically obsolete across all nodes immediately.","antiPatternHeadline":"Passive Soft-Deletion of Synced Passkeys Without Epoch Fencing Allowing Compromised Stale Sessions to Persist","stars_count":115,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","passkeys","epoch-fencing","distributed-systems","session-invalidation"],"exportEndpoints":{"claude":"/api/rules/webauthn-synced-passkey-epoch-revocation-fencing?format=claude","cursorMdc":"/api/rules/webauthn-synced-passkey-epoch-revocation-fencing?format=mdc","cursorrules":"/api/rules/webauthn-synced-passkey-epoch-revocation-fencing?format=cursor","windsurf":"/api/rules/webauthn-synced-passkey-epoch-revocation-fencing?format=windsurf","agents":"/api/rules/webauthn-synced-passkey-epoch-revocation-fencing?format=agents"}},{"id":"tauri-per-turn-csp-nonce-orchestration-production-standard","title":"Tauri 2.0 Dynamic Per-Turn Webview CSP Nonce Orchestration & IPC Attestation","category":"mobile","severity":"critical","description":"Enforces dynamic, cryptographically bound Content Security Policy (CSP) nonces across Tauri 2.0 hybrid mobile and desktop runtimes for every native IPC bridge invocation. Mandates ephemeral per-turn nonce issuance and verification between the Webview context and the native Rust core to neutralize DOM-based script injection and bridge hijacking. Ensures compromised DOM contexts cannot invoke native bridge operations using replayed, static, or forged invocation tokens.","antiPatternHeadline":"Static Nonce Reuse and Unauthenticated IPC Invocations in Tauri Webview Core","stars_count":109,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri-2","csp-nonce","ipc-security","webview-hardening","zero-trust"],"exportEndpoints":{"claude":"/api/rules/tauri-per-turn-csp-nonce-orchestration-production-standard?format=claude","cursorMdc":"/api/rules/tauri-per-turn-csp-nonce-orchestration-production-standard?format=mdc","cursorrules":"/api/rules/tauri-per-turn-csp-nonce-orchestration-production-standard?format=cursor","windsurf":"/api/rules/tauri-per-turn-csp-nonce-orchestration-production-standard?format=windsurf","agents":"/api/rules/tauri-per-turn-csp-nonce-orchestration-production-standard?format=agents"}},{"id":"capacitor-7-hardware-keystore-attestation-protocol","title":"Capacitor 7 Hardware-Backed Keystore Attestation & Challenge-Response Protocol","category":"mobile","severity":"critical","description":"Enforces cryptographic hardware-backed attestation (Android KeyStore StrongBox/TEE and iOS Secure Enclave) for biometric authentication flows in Capacitor 7. Prohibits trusting local client-side boolean verification results to prevent runtime hooking attacks (e.g., via Frida, Objection, or substrate) and mandates an ephemeral, server-issued nonce challenge-response protocol.","antiPatternHeadline":"Trusting Client-Side Boolean Biometric Evaluation Flags Over Server-Verified Hardware Key Signatures","stars_count":95,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor-7","biometrics","secure-enclave","android-keystore","hardware-attestation","cryptography","frida-defense"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-hardware-keystore-attestation-protocol?format=claude","cursorMdc":"/api/rules/capacitor-7-hardware-keystore-attestation-protocol?format=mdc","cursorrules":"/api/rules/capacitor-7-hardware-keystore-attestation-protocol?format=cursor","windsurf":"/api/rules/capacitor-7-hardware-keystore-attestation-protocol?format=windsurf","agents":"/api/rules/capacitor-7-hardware-keystore-attestation-protocol?format=agents"}},{"id":"postgres-17-pgvector-hnsw-memory-bounding-guardrail","title":"PostgreSQL 17 pgvector Parallel HNSW Index Memory Bounding Invariant","category":"backend","severity":"critical","description":"Enforces deterministic memory bounds for parallel pgvector HNSW index creation on PostgreSQL 17 to prevent host OOM killer node terminations. Mandates transactional session-scoped clamps where the product of active parallel maintenance workers and maintenance_work_mem strictly respects available container headroom.","antiPatternHeadline":"Global maintenance_work_mem saturation causing multi-worker OOM termination during parallel HNSW builds.","stars_count":107,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","pgvector","hnsw","memory-management","database-reliability"],"exportEndpoints":{"claude":"/api/rules/postgres-17-pgvector-hnsw-memory-bounding-guardrail?format=claude","cursorMdc":"/api/rules/postgres-17-pgvector-hnsw-memory-bounding-guardrail?format=mdc","cursorrules":"/api/rules/postgres-17-pgvector-hnsw-memory-bounding-guardrail?format=cursor","windsurf":"/api/rules/postgres-17-pgvector-hnsw-memory-bounding-guardrail?format=windsurf","agents":"/api/rules/postgres-17-pgvector-hnsw-memory-bounding-guardrail?format=agents"}},{"id":"nextjs-15-use-cache-cryptographic-tenant-tagging","title":"Next.js 15 'use cache' Cryptographic Tenant-Fenced Tagging Standard","category":"frontend","severity":"critical","description":"Enforces deterministic, cryptographically signed tenant prefixes on all cache tags generated within Next.js 15 'use cache' scopes. Raw or guessable tenant string interpolations (e.g., 'tenant-123:orders') create cross-tenant cache contamination, tag-purging denial of service, and edge-level data leak risks across shared regional CDN infrastructure.","antiPatternHeadline":"Predictable String Interpolation in Multi-Tenant 'use cache' Tags Causing Edge Cache Contamination","stars_count":81,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs","nextjs-15","use-cache","multi-tenancy","cache-tag","edge-security"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-use-cache-cryptographic-tenant-tagging?format=claude","cursorMdc":"/api/rules/nextjs-15-use-cache-cryptographic-tenant-tagging?format=mdc","cursorrules":"/api/rules/nextjs-15-use-cache-cryptographic-tenant-tagging?format=cursor","windsurf":"/api/rules/nextjs-15-use-cache-cryptographic-tenant-tagging?format=windsurf","agents":"/api/rules/nextjs-15-use-cache-cryptographic-tenant-tagging?format=agents"}},{"id":"fastapi-anyio-exceptiongroup-structured-concurrency","title":"FastAPI AnyIO ExceptionGroup Structured Concurrency Guardrail","category":"backend","severity":"critical","description":"Enforces strict task-group boundaries and robust unwrapping of unhandled ExceptionGroups across FastAPI endpoints and AnyIO background workers. Prevents orphaned background coroutines, threadpool leakages, and silent worker loop crashes caused by unhandled multi-exception propagation across asynchronous boundaries. Mandates Python 3.11+ 'except*' or 'exceptiongroup' polyfill matching with deterministic cancellation cleanup.","antiPatternHeadline":"Bare asyncio.create_task and Naked AnyIO TaskGroups Crashing Worker Loops via Silently Swallowed or Unhandled ExceptionGroups","stars_count":84,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","anyio","structured-concurrency","python","asyncio"],"exportEndpoints":{"claude":"/api/rules/fastapi-anyio-exceptiongroup-structured-concurrency?format=claude","cursorMdc":"/api/rules/fastapi-anyio-exceptiongroup-structured-concurrency?format=mdc","cursorrules":"/api/rules/fastapi-anyio-exceptiongroup-structured-concurrency?format=cursor","windsurf":"/api/rules/fastapi-anyio-exceptiongroup-structured-concurrency?format=windsurf","agents":"/api/rules/fastapi-anyio-exceptiongroup-structured-concurrency?format=agents"}},{"id":"svelte-5-snippet-boundary-hydration-isolation-invariant","title":"Svelte 5 Snippet Boundary Hydration Isolation for Custom Elements","category":"frontend","severity":"critical","description":"Fences reactive Svelte 5 snippet slots inside custom web components with explicit hydration boundaries and isolated signal scopes. Prevents destructive hydration mismatches, parent light-DOM invalidation cascades, and slot-projection de-synchronization during SSR hydration. Ensures dynamic snippet projection adheres to strict autonomous shadow DOM boundaries.","antiPatternHeadline":"Directly projecting un-isolated Svelte 5 reactive snippets into Shadow DOM slots, inducing parent-child hydration thrashing.","stars_count":75,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","web-components","hydration","runes","snippets"],"exportEndpoints":{"claude":"/api/rules/svelte-5-snippet-boundary-hydration-isolation-invariant?format=claude","cursorMdc":"/api/rules/svelte-5-snippet-boundary-hydration-isolation-invariant?format=mdc","cursorrules":"/api/rules/svelte-5-snippet-boundary-hydration-isolation-invariant?format=cursor","windsurf":"/api/rules/svelte-5-snippet-boundary-hydration-isolation-invariant?format=windsurf","agents":"/api/rules/svelte-5-snippet-boundary-hydration-isolation-invariant?format=agents"}},{"id":"sigstore-tuf-root-rotation-rekor-inclusion-invariant","title":"Sigstore TUF Root Key Rotation & Rekor Inclusion Proof Verification Standard","category":"devops","severity":"critical","description":"Enforces deterministic offline-root TUF metadata verification, dynamic key rotation thresholds, and mandatory cryptographic Rekor Merkle tree inclusion proof validation during container image admission. Eliminates supply-chain poisoning by forbidding static public keys and unverified transparency log entries.","antiPatternHeadline":"Admitting Images via Unpinned Public Keys or Skipping Rekor Merkle Inclusion Proofs and Offline TUF Quorums","stars_count":51,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","sigstore","tuf","rekor","supply-chain-security","cosign","admission-controller"],"exportEndpoints":{"claude":"/api/rules/sigstore-tuf-root-rotation-rekor-inclusion-invariant?format=claude","cursorMdc":"/api/rules/sigstore-tuf-root-rotation-rekor-inclusion-invariant?format=mdc","cursorrules":"/api/rules/sigstore-tuf-root-rotation-rekor-inclusion-invariant?format=cursor","windsurf":"/api/rules/sigstore-tuf-root-rotation-rekor-inclusion-invariant?format=windsurf","agents":"/api/rules/sigstore-tuf-root-rotation-rekor-inclusion-invariant?format=agents"}},{"id":"room-kmp-sqlite-wal-concurrency-barrier","title":"Room KMP Multiplatform SQLite WAL Concurrency Barrier Standard","category":"mobile","severity":"critical","description":"Enforces strict single-writer multi-reader WAL (Write-Ahead Logging) concurrency barriers across Android ART and iOS Kotlin/Native runtimes in Room KMP. Prevents fatal POSIX lock contention, file corruption, and SQLite busy/locked exceptions by mandating dedicated write dispatchers and explicit WAL pragmas on BundledSQLiteDriver.","antiPatternHeadline":"Unsynchronized Multi-Threaded Writes to Unconfigured SQLite Engines Across Native Runtime Boundaries","stars_count":104,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","room-kmp","sqlite-wal","posix-locking"],"exportEndpoints":{"claude":"/api/rules/room-kmp-sqlite-wal-concurrency-barrier?format=claude","cursorMdc":"/api/rules/room-kmp-sqlite-wal-concurrency-barrier?format=mdc","cursorrules":"/api/rules/room-kmp-sqlite-wal-concurrency-barrier?format=cursor","windsurf":"/api/rules/room-kmp-sqlite-wal-concurrency-barrier?format=windsurf","agents":"/api/rules/room-kmp-sqlite-wal-concurrency-barrier?format=agents"}},{"id":"openfga-ephemeral-tuples-bounded-ttl-guardrail","title":"OpenFGA Ephemeral Tuples with Bounded TTL & Deterministic Pruning Invariant","category":"security","severity":"critical","description":"Standardizes time-decaying authorization tuples for Just-In-Time (JIT) access to prevent privilege accumulation and eliminate graph traversal degradation over time. Enforces bounded Time-To-Live (TTL) conditions on transient relationship writes and mandates contextual timestamp evaluation during authorization checks.","antiPatternHeadline":"Unbounded JIT Tuple Writes Without Condition Context or Expiration Boundaries","stars_count":111,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","authorization","jit-access","rebac","ttl"],"exportEndpoints":{"claude":"/api/rules/openfga-ephemeral-tuples-bounded-ttl-guardrail?format=claude","cursorMdc":"/api/rules/openfga-ephemeral-tuples-bounded-ttl-guardrail?format=mdc","cursorrules":"/api/rules/openfga-ephemeral-tuples-bounded-ttl-guardrail?format=cursor","windsurf":"/api/rules/openfga-ephemeral-tuples-bounded-ttl-guardrail?format=windsurf","agents":"/api/rules/openfga-ephemeral-tuples-bounded-ttl-guardrail?format=agents"}},{"id":"envoy-gateway-ebpf-nat64-stateless-ingress","title":"Envoy Gateway Stateless eBPF NAT64 Dual-Stack Ingress Standard","category":"devops","severity":"critical","description":"Enforces deterministic, stateless RFC 6052 / RFC 7915 algorithmic IPv6-to-IPv4 header synthesis via eBPF XDP programs at Envoy Gateway edge nodes. Eliminates netfilter conntrack exhaustion and dual-stack core routing complexity by mapping IPv4 targets into the Well-Known 64:ff9b::/96 prefix prior to envoy listener processing, guaranteeing O(1) memory consumption and linear scaling.","antiPatternHeadline":"Stateful Netfilter Conntrack NAT64 and Complex Internal Dual-Stack Routing Under Ingress Load","stars_count":88,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","envoy-gateway","ebpf","nat64","xdp","ipv6","kubernetes"],"exportEndpoints":{"claude":"/api/rules/envoy-gateway-ebpf-nat64-stateless-ingress?format=claude","cursorMdc":"/api/rules/envoy-gateway-ebpf-nat64-stateless-ingress?format=mdc","cursorrules":"/api/rules/envoy-gateway-ebpf-nat64-stateless-ingress?format=cursor","windsurf":"/api/rules/envoy-gateway-ebpf-nat64-stateless-ingress?format=windsurf","agents":"/api/rules/envoy-gateway-ebpf-nat64-stateless-ingress?format=agents"}},{"id":"axum-tokio-cooperative-cancellation-propagation","title":"Axum 0.8 Tokio Cooperative Cancellation Token Propagation Standard","category":"backend","severity":"critical","description":"Enforces deterministic cancellation cascades when client TCP connections terminate prematurely in Axum 0.8 services. Mandates integration of Tokio CancellationToken across asynchronous boundaries to prevent orphaned gRPC calls and lingering database operations. Guarantees immediate resource reclamation without thread exhaustion or lock contention.","antiPatternHeadline":"Fire-and-Forget Spawning and Zombie Task Execution on Client TCP Disconnect","stars_count":71,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tokio","async","grpc","sqlx"],"exportEndpoints":{"claude":"/api/rules/axum-tokio-cooperative-cancellation-propagation?format=claude","cursorMdc":"/api/rules/axum-tokio-cooperative-cancellation-propagation?format=mdc","cursorrules":"/api/rules/axum-tokio-cooperative-cancellation-propagation?format=cursor","windsurf":"/api/rules/axum-tokio-cooperative-cancellation-propagation?format=windsurf","agents":"/api/rules/axum-tokio-cooperative-cancellation-propagation?format=agents"}},{"id":"postgres-17-hnsw-worker-memory-isolation-standard","title":"Postgres 17 AVX-512 Vector Worker Memory Isolation Standard","category":"backend","severity":"critical","description":"Enforces strict isolation of pgvector HNSW indexing workloads utilizing AVX-512 SIMD kernels from standard OLTP shared buffers in PostgreSQL 17. By constraining index builds to dedicated maintenance worker memory rings and explicit session-scoped maintenance_work_mem ceilings, this standard eliminates shared_buffers page eviction cascades during continuous vector re-indexing. It guarantees that high-throughput OLTP query paths retain low P99 latencies without starving under memory-intensive graph construction.","antiPatternHeadline":"Global Unconstrained HNSW Index Construction Triggering Buffer Cache Thrashing and OOM Kills","stars_count":91,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres-17","pgvector","hnsw","avx-512","memory-isolation","oltp"],"exportEndpoints":{"claude":"/api/rules/postgres-17-hnsw-worker-memory-isolation-standard?format=claude","cursorMdc":"/api/rules/postgres-17-hnsw-worker-memory-isolation-standard?format=mdc","cursorrules":"/api/rules/postgres-17-hnsw-worker-memory-isolation-standard?format=cursor","windsurf":"/api/rules/postgres-17-hnsw-worker-memory-isolation-standard?format=windsurf","agents":"/api/rules/postgres-17-hnsw-worker-memory-isolation-standard?format=agents"}},{"id":"bun-standalone-vfs-sandbox-enforcement","title":"Bun 1.2 Standalone Binary Embedded VFS Sandbox Enforcement","category":"backend","severity":"critical","description":"Enforces strict boundary isolation between Bun 1.2's read-only embedded Virtual File System ($bunfs) and the host operating system during standalone compiled binary execution. Prevents host filesystem breakout vulnerabilities and runtime panics caused by directory traversal out of embedded virtual roots or illegal write operations on bundled assets.","antiPatternHeadline":"Unchecked Path Resolution and Mutative Operations Against Bun Embedded VFS Roots","stars_count":57,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","vfs","sandbox","security","path-traversal"],"exportEndpoints":{"claude":"/api/rules/bun-standalone-vfs-sandbox-enforcement?format=claude","cursorMdc":"/api/rules/bun-standalone-vfs-sandbox-enforcement?format=mdc","cursorrules":"/api/rules/bun-standalone-vfs-sandbox-enforcement?format=cursor","windsurf":"/api/rules/bun-standalone-vfs-sandbox-enforcement?format=windsurf","agents":"/api/rules/bun-standalone-vfs-sandbox-enforcement?format=agents"}},{"id":"kmp-swift-concurrency-arc-task-bridge-guardrail","title":"Kotlin 2.1 & Swift Concurrency ARC Cooperative Cancellation Bridge Standard","category":"mobile","severity":"critical","description":"Enforces deterministic memory lifecycle management and bi-directional cooperative task cancellation when bridging Kotlin Multiplatform 2.1 coroutines with Swift async/await. Eliminates cross-runtime ARC-to-Kotlin-GC reference cycles, dangling continuation leaks, and thread-starvation deadlocks.","antiPatternHeadline":"Leaking unmanaged Kotlin Job handles and creating zombie coroutines via unlinked Swift Task cancellations and strong closure captures.","stars_count":74,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","swift-concurrency","arc","coroutines","memory-management"],"exportEndpoints":{"claude":"/api/rules/kmp-swift-concurrency-arc-task-bridge-guardrail?format=claude","cursorMdc":"/api/rules/kmp-swift-concurrency-arc-task-bridge-guardrail?format=mdc","cursorrules":"/api/rules/kmp-swift-concurrency-arc-task-bridge-guardrail?format=cursor","windsurf":"/api/rules/kmp-swift-concurrency-arc-task-bridge-guardrail?format=windsurf","agents":"/api/rules/kmp-swift-concurrency-arc-task-bridge-guardrail?format=agents"}},{"id":"tauri2-multiwebview-ipc-mutex-standard","title":"Tauri 2.0 Multi-Webview IPC Event Ordering Mutex Standard","category":"mobile","severity":"critical","description":"Enforces deterministic command serialization, monotonic revision sequencing, and reentrant mutex locks when multiple WebViews communicate with shared Rust actors in Tauri 2.0. Prevents stale state propagation, out-of-order execution, and state desynchronization across concurrent mobile WebViews.","antiPatternHeadline":"Unordered concurrent IPC invocations from isolated WebViews mutating shared native state without revision fencing or serialization queues.","stars_count":54,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri","ipc","concurrency","state-sync","rust"],"exportEndpoints":{"claude":"/api/rules/tauri2-multiwebview-ipc-mutex-standard?format=claude","cursorMdc":"/api/rules/tauri2-multiwebview-ipc-mutex-standard?format=mdc","cursorrules":"/api/rules/tauri2-multiwebview-ipc-mutex-standard?format=cursor","windsurf":"/api/rules/tauri2-multiwebview-ipc-mutex-standard?format=windsurf","agents":"/api/rules/tauri2-multiwebview-ipc-mutex-standard?format=agents"}},{"id":"webauthn-l3-prf-hardware-key-wrapping-standard","title":"WebAuthn Level 3 PRF Extension Hardware Key-Wrapping Standard","category":"security","severity":"critical","description":"Enforces hardware-bound end-to-end client-side encryption key derivation via the WebAuthn Level 3 Pseudo-Random Function (PRF) extension. Mandates that raw PRF outputs and intermediate master keys remain strictly ephemeral within client hardware and memory, prohibiting transmission of cryptographic seeds to Relying Parties or identity providers.","antiPatternHeadline":"Transmitting raw WebAuthn PRF outputs to backend servers or relying on software-only password derivation for client-side encryption.","stars_count":64,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","passkeys","prf-extension","zero-knowledge","cryptography"],"exportEndpoints":{"claude":"/api/rules/webauthn-l3-prf-hardware-key-wrapping-standard?format=claude","cursorMdc":"/api/rules/webauthn-l3-prf-hardware-key-wrapping-standard?format=mdc","cursorrules":"/api/rules/webauthn-l3-prf-hardware-key-wrapping-standard?format=cursor","windsurf":"/api/rules/webauthn-l3-prf-hardware-key-wrapping-standard?format=windsurf","agents":"/api/rules/webauthn-l3-prf-hardware-key-wrapping-standard?format=agents"}},{"id":"openfga-ephemeral-contextual-tuple-ttl-fencing","title":"OpenFGA Ephemeral Contextual Tuple Deterministic TTL Enforcement","category":"security","severity":"critical","description":"Enforces strict cryptographic fencing and deterministic monotonic TTL validation for volatile contextual tuples injected into OpenFGA authorization checks. Prevents authorization cache poisoning and cross-request tuple bleed by cryptographically binding ephemeral contextual claims to unique request nonces and enforcing sub-millisecond evaluation deadlines. Guarantees that stale environmental assertions (such as step-up authentication, geo-velocity fences, and ephemeral break-glass roles) cannot be cached or replayed across evaluation boundaries.","antiPatternHeadline":"Injecting Ephemeral Contextual Tuples Without Cryptographic Nonce Fencing or Monotonic TTL Enforcement Allowing Cache Poisoning","stars_count":69,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","authorization","zero-trust","rbac","rebac","cache-poisoning"],"exportEndpoints":{"claude":"/api/rules/openfga-ephemeral-contextual-tuple-ttl-fencing?format=claude","cursorMdc":"/api/rules/openfga-ephemeral-contextual-tuple-ttl-fencing?format=mdc","cursorrules":"/api/rules/openfga-ephemeral-contextual-tuple-ttl-fencing?format=cursor","windsurf":"/api/rules/openfga-ephemeral-contextual-tuple-ttl-fencing?format=windsurf","agents":"/api/rules/openfga-ephemeral-contextual-tuple-ttl-fencing?format=agents"}},{"id":"otel-cryptographic-baggage-provenance-guardrail","title":"OpenTelemetry Cryptographic Baggage Provenance and Redaction Guardrail","category":"devops","severity":"critical","description":"Enforces strict cryptographic verification and allowlist redaction on incoming W3C Baggage headers at microservice network perimeters. Prevents trace context spoofing, tenant boundary violations, and accidental leakage of sensitive tokens across distributed boundaries by requiring signed contextual metadata and scrubbing unapproved attributes.","antiPatternHeadline":"Blind Ingestion and Unrestricted Propagation of Unsigned W3C Baggage Across Trust Boundaries","stars_count":111,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","security","distributed-tracing","w3c-baggage","cryptography"],"exportEndpoints":{"claude":"/api/rules/otel-cryptographic-baggage-provenance-guardrail?format=claude","cursorMdc":"/api/rules/otel-cryptographic-baggage-provenance-guardrail?format=mdc","cursorrules":"/api/rules/otel-cryptographic-baggage-provenance-guardrail?format=cursor","windsurf":"/api/rules/otel-cryptographic-baggage-provenance-guardrail?format=windsurf","agents":"/api/rules/otel-cryptographic-baggage-provenance-guardrail?format=agents"}},{"id":"nextjs-15-after-background-execution-boundary","title":"Next.js 15 after() Serverless Execution Lifetime and Microtask Drain Guardrail","category":"frontend","severity":"critical","description":"Enforces the use of Next.js 15 after() for all post-response telemetry, auditing, and cache synchronization tasks. Prevents abrupt lambda freeze termination and zombie microtask pollution caused by uncoordinated fire-and-forget promises in serverless runtimes.","antiPatternHeadline":"Unbounded Fire-and-Forget Floating Promises Silently Freezing in Serverless Execution Contexts","stars_count":56,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs","serverless","performance","architecture","reliability"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-after-background-execution-boundary?format=claude","cursorMdc":"/api/rules/nextjs-15-after-background-execution-boundary?format=mdc","cursorrules":"/api/rules/nextjs-15-after-background-execution-boundary?format=cursor","windsurf":"/api/rules/nextjs-15-after-background-execution-boundary?format=windsurf","agents":"/api/rules/nextjs-15-after-background-execution-boundary?format=agents"}},{"id":"react-19-optimistic-state-idempotency-guardrail","title":"React 19 Speculative Mutation Rollback and Action Idempotency Guardrail","category":"frontend","severity":"critical","description":"Enforces deterministic state reversion and strict idempotency for React 19 speculative mutations via `useOptimistic` and `useActionState`. Guarantees zero UI tearing, duplicate dispatches, or zombie DOM state across network latency and intermittent server rejections.","antiPatternHeadline":"Bypassing React 19 transition boundaries with un-keyed manual useState rollbacks that tear UI state on network failure","stars_count":43,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["react19","useOptimistic","useActionState","idempotency","concurrency","state-reversion"],"exportEndpoints":{"claude":"/api/rules/react-19-optimistic-state-idempotency-guardrail?format=claude","cursorMdc":"/api/rules/react-19-optimistic-state-idempotency-guardrail?format=mdc","cursorrules":"/api/rules/react-19-optimistic-state-idempotency-guardrail?format=cursor","windsurf":"/api/rules/react-19-optimistic-state-idempotency-guardrail?format=windsurf","agents":"/api/rules/react-19-optimistic-state-idempotency-guardrail?format=agents"}},{"id":"axum-08-tokio-streaming-cancellation-standard","title":"Axum 0.8 In-Flight Streaming & Tokio Task Cancellation Invariant","category":"backend","severity":"critical","description":"Enforces strict RAII cancellation tokens and bounded channel draining across Axum 0.8 streaming handlers (SSE, NDJSON, and raw byte streams). Prevents zombie Tokio tasks, memory leaks, and socket descriptor exhaustion during rolling deployments and client disconnects by coupling streams to tokio_util::task::TaskTracker and CancellationToken primitives.","antiPatternHeadline":"Spawning detached Tokio tasks feeding unmonitored channels in SSE/streaming endpoints without cancellation coordination","stars_count":59,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tokio","sse","graceful-shutdown","async"],"exportEndpoints":{"claude":"/api/rules/axum-08-tokio-streaming-cancellation-standard?format=claude","cursorMdc":"/api/rules/axum-08-tokio-streaming-cancellation-standard?format=mdc","cursorrules":"/api/rules/axum-08-tokio-streaming-cancellation-standard?format=cursor","windsurf":"/api/rules/axum-08-tokio-streaming-cancellation-standard?format=windsurf","agents":"/api/rules/axum-08-tokio-streaming-cancellation-standard?format=agents"}},{"id":"postgres-17-streaming-io-direct-buffer-quota-standard","title":"Postgres 17 Streaming I/O Direct Buffer Quota & Prefetch Bounding Standard","category":"backend","severity":"critical","description":"Enforces strict bounds on PostgreSQL 17 asynchronous streaming I/O buffer allocations and prefetching limits across pooled analytical connections. Unbounded direct block prefetching exhausts Linux page cache space and shared buffer ring allocations, evicting hot transactional pages and inducing severe tail latency spikes in OLTP paths.","antiPatternHeadline":"Unbounded AIO Prefetching and Global Shared Buffer Saturation During Analytical Scans","stars_count":60,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql-17","streaming-io","performance","buffer-cache","infrastructure"],"exportEndpoints":{"claude":"/api/rules/postgres-17-streaming-io-direct-buffer-quota-standard?format=claude","cursorMdc":"/api/rules/postgres-17-streaming-io-direct-buffer-quota-standard?format=mdc","cursorrules":"/api/rules/postgres-17-streaming-io-direct-buffer-quota-standard?format=cursor","windsurf":"/api/rules/postgres-17-streaming-io-direct-buffer-quota-standard?format=windsurf","agents":"/api/rules/postgres-17-streaming-io-direct-buffer-quota-standard?format=agents"}},{"id":"kmp-swift-task-cancellation-boundary","title":"Kotlin Multiplatform Swift Task Cancellation Boundary Guardrail","category":"mobile","severity":"critical","description":"Enforces strict bidirectional cancellation propagation across the Kotlin Multiplatform Objective-C/Swift interop boundary. Prevents zombie coroutine execution, Darwin thread pool exhaustion, and memory leaks caused by uncoordinated Swift Task and Kotlin Coroutine lifecycles.","antiPatternHeadline":"Unlinked Swift Continuations and Dangling Kotlin Bridge Jobs","stars_count":99,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kmp","kotlin-multiplatform","swift-concurrency","ios","coroutines"],"exportEndpoints":{"claude":"/api/rules/kmp-swift-task-cancellation-boundary?format=claude","cursorMdc":"/api/rules/kmp-swift-task-cancellation-boundary?format=mdc","cursorrules":"/api/rules/kmp-swift-task-cancellation-boundary?format=cursor","windsurf":"/api/rules/kmp-swift-task-cancellation-boundary?format=windsurf","agents":"/api/rules/kmp-swift-task-cancellation-boundary?format=agents"}},{"id":"capacitor-7-swift-actor-isolated-plugin-bridge-guardrail","title":"Capacitor 7 Swift Actor-Isolated Plugin Bridge Guardrail","category":"mobile","severity":"critical","description":"Enforces strict compile-time Swift actor isolation for Capacitor 7 native iOS plugins to eliminate main-thread UI hitching and cross-runtime data races. Guarantees that all asynchronous I/O, heavy computation, and mutable state mutations reside within isolated Swift actors rather than unisolated CAPPlugin instances or synchronous MainActor blocks.","antiPatternHeadline":"Main-Thread Blocking and Unsynchronized Mutable State in Capacitor iOS Plugins","stars_count":51,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","ios","swift","concurrency","actors"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-swift-actor-isolated-plugin-bridge-guardrail?format=claude","cursorMdc":"/api/rules/capacitor-7-swift-actor-isolated-plugin-bridge-guardrail?format=mdc","cursorrules":"/api/rules/capacitor-7-swift-actor-isolated-plugin-bridge-guardrail?format=cursor","windsurf":"/api/rules/capacitor-7-swift-actor-isolated-plugin-bridge-guardrail?format=windsurf","agents":"/api/rules/capacitor-7-swift-actor-isolated-plugin-bridge-guardrail?format=agents"}},{"id":"oauth2-rfc9449-dpop-ephemeral-nonce-fencing","title":"RFC 9449 DPoP Sender-Constrained Token Verification and Ephemeral Nonce Fencing","category":"security","severity":"critical","description":"Enforces RFC 9449 Demonstrating Proof-of-Possession (DPoP) verification across all edge gateways and APIs to neutralize bearer token exfiltration. Requires cryptographic sender-constraining of access tokens via the 'ath' thumbprint and enforces cryptographically signed ephemeral nonces with strict replay rejection across distributed regions.","antiPatternHeadline":"Accepting Unbound Bearer Tokens or Omitting Ephemeral Nonce and Access Token Hash (ath) Validation in DPoP Proofs","stars_count":61,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","oauth2","rfc9449","dpop","cryptography","zero-trust","edge-gateway"],"exportEndpoints":{"claude":"/api/rules/oauth2-rfc9449-dpop-ephemeral-nonce-fencing?format=claude","cursorMdc":"/api/rules/oauth2-rfc9449-dpop-ephemeral-nonce-fencing?format=mdc","cursorrules":"/api/rules/oauth2-rfc9449-dpop-ephemeral-nonce-fencing?format=cursor","windsurf":"/api/rules/oauth2-rfc9449-dpop-ephemeral-nonce-fencing?format=windsurf","agents":"/api/rules/oauth2-rfc9449-dpop-ephemeral-nonce-fencing?format=agents"}},{"id":"sigstore-keyless-ephemeral-oidc-provenance-invariant","title":"Sigstore Keyless Ephemeral OIDC Artifact Provenance Invariant","category":"security","severity":"critical","description":"Enforces non-repudiable artifact integrity and supply-chain provenance by requiring cryptographic verification against ephemeral Fulcio X.509 certificates and Rekor transparency logs. Artifact admission controllers must reject any artifact lacking an integrated Rekor SET/checkpoint and valid OIDC SAN identity matching designated trusted issuers. Long-lived signing keys and unverified offline bundles are strictly prohibited in the verification pipeline.","antiPatternHeadline":"Admitting Artifacts via Unchecked Public Keys, Bypassing Fulcio OIDC SAN or Rekor Inclusion Proofs","stars_count":98,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","sigstore","fulcio","rekor","cosign","supply-chain","provenance"],"exportEndpoints":{"claude":"/api/rules/sigstore-keyless-ephemeral-oidc-provenance-invariant?format=claude","cursorMdc":"/api/rules/sigstore-keyless-ephemeral-oidc-provenance-invariant?format=mdc","cursorrules":"/api/rules/sigstore-keyless-ephemeral-oidc-provenance-invariant?format=cursor","windsurf":"/api/rules/sigstore-keyless-ephemeral-oidc-provenance-invariant?format=windsurf","agents":"/api/rules/sigstore-keyless-ephemeral-oidc-provenance-invariant?format=agents"}},{"id":"k8s-132-inplace-pod-dynamic-resizing-invariant","title":"Kubernetes 1.32 In-Place Dynamic Pod Resizing and Cgroupv2 Controller Invariant","category":"devops","severity":"critical","description":"Enforces zero-downtime resource resizing via Kubernetes 1.32 InPlacePodVerticalScaling by mutating pod resource allocations directly against the kubelet and cgroupv2 controllers. Prevents pod recreation churn, restart loops, and OOM kills by establishing strict resize policies, validating Node resize allocations, and handling Deferred resizing states deterministically.","antiPatternHeadline":"Patching pod specs with immutable recreation triggers or omitting resizePolicy, resulting in SIGTERM evictions and container restarts during vertical scaling.","stars_count":83,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["kubernetes","k8s-1.32","cgroupv2","in-place-resize","zero-downtime","devops"],"exportEndpoints":{"claude":"/api/rules/k8s-132-inplace-pod-dynamic-resizing-invariant?format=claude","cursorMdc":"/api/rules/k8s-132-inplace-pod-dynamic-resizing-invariant?format=mdc","cursorrules":"/api/rules/k8s-132-inplace-pod-dynamic-resizing-invariant?format=cursor","windsurf":"/api/rules/k8s-132-inplace-pod-dynamic-resizing-invariant?format=windsurf","agents":"/api/rules/k8s-132-inplace-pod-dynamic-resizing-invariant?format=agents"}},{"id":"otel-arrow-memory-pool-fencing","title":"OpenTelemetry OTLP/Arrow Columnar Memory Pool Fencing & Heap Quotas","category":"devops","severity":"critical","description":"Enforces strict heap allocation quotas and bounded memory pool reservation across Apache Arrow record batches within OpenTelemetry collectors. Prevents out-of-memory (OOM) fatal cascades during high-cardinality telemetry storms by requiring custom allocator fencing, backpressure rejection, and deterministic off-heap buffer disposal.","antiPatternHeadline":"Unbounded Direct Heap Allocation of Arrow Record Batches Causing Fatal Collector OOM Under Metric Ingestion Spikes","stars_count":54,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","apache-arrow","memory-management","backpressure","high-cardinality"],"exportEndpoints":{"claude":"/api/rules/otel-arrow-memory-pool-fencing?format=claude","cursorMdc":"/api/rules/otel-arrow-memory-pool-fencing?format=mdc","cursorrules":"/api/rules/otel-arrow-memory-pool-fencing?format=cursor","windsurf":"/api/rules/otel-arrow-memory-pool-fencing?format=windsurf","agents":"/api/rules/otel-arrow-memory-pool-fencing?format=agents"}},{"id":"axum-0-8-backpressure-buffer-shedding-cancellation","title":"Axum 0.8 Backpressure Buffer Shedding & Client Disconnect Cancellation Guardrail","category":"backend","severity":"critical","description":"Enforces immediate cooperative cancellation of nested Tokio asynchronous tasks upon HTTP client disconnect in Axum 0.8 services. Mandates bounded concurrency queues with Tower LoadShed backpressure to protect executor thread pools and database connection pools from zombie compute cycles under sustained load spikes.","antiPatternHeadline":"Spawning detached Tokio tasks or utilizing unbounded buffers that leak CPU and I/O resources after client disconnect","stars_count":84,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tokio","concurrency","tower"],"exportEndpoints":{"claude":"/api/rules/axum-0-8-backpressure-buffer-shedding-cancellation?format=claude","cursorMdc":"/api/rules/axum-0-8-backpressure-buffer-shedding-cancellation?format=mdc","cursorrules":"/api/rules/axum-0-8-backpressure-buffer-shedding-cancellation?format=cursor","windsurf":"/api/rules/axum-0-8-backpressure-buffer-shedding-cancellation?format=windsurf","agents":"/api/rules/axum-0-8-backpressure-buffer-shedding-cancellation?format=agents"}},{"id":"react-19-concurrent-action-hydration-interleaving","title":"React 19 Concurrent Action-State Hydration Interleaving Guardrail","category":"frontend","severity":"critical","description":"Enforces deterministic synchronization between optimistic updates and server action states during selective hydration over streaming SSR in React 19. Prevents UI tearing, state rollback races, and hydration mismatches caused by concurrent action dispatch interleaving with progressive boundary hydration.","antiPatternHeadline":"Manual useState/useEffect optimistic emulation racing against React 19 selective hydration transitions","stars_count":108,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["react19","actions","optimistic-ui","selective-hydration","streaming-ssr","concurrency"],"exportEndpoints":{"claude":"/api/rules/react-19-concurrent-action-hydration-interleaving?format=claude","cursorMdc":"/api/rules/react-19-concurrent-action-hydration-interleaving?format=mdc","cursorrules":"/api/rules/react-19-concurrent-action-hydration-interleaving?format=cursor","windsurf":"/api/rules/react-19-concurrent-action-hydration-interleaving?format=windsurf","agents":"/api/rules/react-19-concurrent-action-hydration-interleaving?format=agents"}},{"id":"ebpf-tcp-zero-window-stall-eviction","title":"eBPF Socket-Level TCP Zero-Window Anomaly Eviction Guardrail","category":"devops","severity":"critical","description":"Enforces kernel-level eBPF instrumentation via sockops and tracepoints to detect persistent TCP Zero-Window states and receive buffer stalls. Intercepts silent socket deadlocks at layer 4 before userspace read buffers freeze and trigger slow, cascading Kubernetes liveness probe failures. Automatically generates deterministic kernel-level resets (RST) or sends synchronous eviction signals to Kubernetes node lifecycle controllers.","antiPatternHeadline":"Relying on HTTP/TCP Userspace Liveness Probes to Mitigate Pathological TCP Zero-Window Buffer Deadlocks","stars_count":79,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["ebpf","devops","tcp-ip","kubernetes","networking","kernel","resilience"],"exportEndpoints":{"claude":"/api/rules/ebpf-tcp-zero-window-stall-eviction?format=claude","cursorMdc":"/api/rules/ebpf-tcp-zero-window-stall-eviction?format=mdc","cursorrules":"/api/rules/ebpf-tcp-zero-window-stall-eviction?format=cursor","windsurf":"/api/rules/ebpf-tcp-zero-window-stall-eviction?format=windsurf","agents":"/api/rules/ebpf-tcp-zero-window-stall-eviction?format=agents"}},{"id":"otel-baggage-pii-boundary-guardrail","title":"OpenTelemetry Baggage Boundary & Cryptographic PII Redaction Standard","category":"security","severity":"critical","description":"Mandates strict schema validation, allowlist enforcement, and deterministic cryptographic pseudonymization for OpenTelemetry distributed baggage at trust and tenant boundaries. Prevents uncontrolled egress and lateral propagation of sensitive personal data (PII/PHI) through distributed trace context propagators.","antiPatternHeadline":"Transparent Pass-Through and Plaintext PII Injection into Distributed OpenTelemetry Baggage Context","stars_count":109,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","opentelemetry","distributed-tracing","pii-protection","multi-tenant","zero-trust"],"exportEndpoints":{"claude":"/api/rules/otel-baggage-pii-boundary-guardrail?format=claude","cursorMdc":"/api/rules/otel-baggage-pii-boundary-guardrail?format=mdc","cursorrules":"/api/rules/otel-baggage-pii-boundary-guardrail?format=cursor","windsurf":"/api/rules/otel-baggage-pii-boundary-guardrail?format=windsurf","agents":"/api/rules/otel-baggage-pii-boundary-guardrail?format=agents"}},{"id":"bun-sqlite-wal-shm-invalidation-invariant","title":"Bun 1.2 SQLite WAL Shared-Memory Invalidation and Cross-Isolate Linearizability","category":"backend","severity":"critical","description":"Enforces strict linearizable read-after-write consistency across multithreaded Bun worker isolates accessing in-process SQLite databases in Write-Ahead Logging (WAL) mode. Prevents stale index snapshot reads caused by cached shared-memory (.shm) state across isolated JavaScript heaps by mandating explicit transaction boundary synchronization, memory barrier pragmas, and managed checkpoint coordination.","antiPatternHeadline":"Dirty Read Anomaly Across Bun Worker Isolates Due to Unsynchronized WAL Shared-Memory Reads","stars_count":72,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","sqlite","wal","concurrency","linearizability"],"exportEndpoints":{"claude":"/api/rules/bun-sqlite-wal-shm-invalidation-invariant?format=claude","cursorMdc":"/api/rules/bun-sqlite-wal-shm-invalidation-invariant?format=mdc","cursorrules":"/api/rules/bun-sqlite-wal-shm-invalidation-invariant?format=cursor","windsurf":"/api/rules/bun-sqlite-wal-shm-invalidation-invariant?format=windsurf","agents":"/api/rules/bun-sqlite-wal-shm-invalidation-invariant?format=agents"}},{"id":"kmp-thread-boundary-mutex-handshake-standard","title":"Kotlin Multiplatform Thread-Boundary Mutex Handshake Standard","category":"mobile","severity":"critical","description":"Enforces strict thread-boundary isolation and atomic synchronization handshakes between native Darwin dispatch queues and Android ART worker threads in Kotlin Multiplatform. Prevents priority-inversion deadlocks and memory tearing caused by holding platform-specific OS locks across coroutine suspension points or mixing unconfined atomic updates with native thread schedulers.","antiPatternHeadline":"Cross-Boundary Lock Leaks, Suspension Point Lock-Holding, and Mixed Dispatcher Priority Inversion","stars_count":62,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","concurrency","coroutines","darwin","android"],"exportEndpoints":{"claude":"/api/rules/kmp-thread-boundary-mutex-handshake-standard?format=claude","cursorMdc":"/api/rules/kmp-thread-boundary-mutex-handshake-standard?format=mdc","cursorrules":"/api/rules/kmp-thread-boundary-mutex-handshake-standard?format=cursor","windsurf":"/api/rules/kmp-thread-boundary-mutex-handshake-standard?format=windsurf","agents":"/api/rules/kmp-thread-boundary-mutex-handshake-standard?format=agents"}},{"id":"openfga-ephemeral-contextual-tuple-boundary","title":"OpenFGA Ephemeral Contextual Tuple Injection Boundary Enforcement","category":"security","severity":"critical","description":"Enforces strict server-side synthesis and validation boundaries for OpenFGA contextual tuples during authorization checks. Prevents authorization bypass vulnerabilities arising from client-injected relationship assertions, untrusted contextual claims, and accidental persistence of ephemeral relationship states.","antiPatternHeadline":"Unvalidated forwarding of client-controlled contextual tuples to authorization checks","stars_count":69,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","authorization","rebac","zero-trust"],"exportEndpoints":{"claude":"/api/rules/openfga-ephemeral-contextual-tuple-boundary?format=claude","cursorMdc":"/api/rules/openfga-ephemeral-contextual-tuple-boundary?format=mdc","cursorrules":"/api/rules/openfga-ephemeral-contextual-tuple-boundary?format=cursor","windsurf":"/api/rules/openfga-ephemeral-contextual-tuple-boundary?format=windsurf","agents":"/api/rules/openfga-ephemeral-contextual-tuple-boundary?format=agents"}},{"id":"vite-6-mfe-style-cascade-dedup-guardrail","title":"Vite 6 Micro-Frontend Style Cascade Precedence and Runtime Deduplication","category":"frontend","severity":"critical","description":"Enforces strict document.head style insertion boundaries, CSSOM link tag deduplication, and deterministic cascade layering across dynamic Module Federation mounts in Vite 6. Prevents asynchronous micro-app chunk injections from trampling host design system tokens, altering specificity hierarchies, or bloating the CSSOM with duplicate vendor sheets.","antiPatternHeadline":"Uncoordinated Head Injections and Non-Deterministic Asynchronous Remote CSS Mounting","stars_count":61,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","vite","vite-6","micro-frontends","module-federation","cssom","cascade-layers"],"exportEndpoints":{"claude":"/api/rules/vite-6-mfe-style-cascade-dedup-guardrail?format=claude","cursorMdc":"/api/rules/vite-6-mfe-style-cascade-dedup-guardrail?format=mdc","cursorrules":"/api/rules/vite-6-mfe-style-cascade-dedup-guardrail?format=cursor","windsurf":"/api/rules/vite-6-mfe-style-cascade-dedup-guardrail?format=windsurf","agents":"/api/rules/vite-6-mfe-style-cascade-dedup-guardrail?format=agents"}},{"id":"webauthn-l3-prf-symmetric-key-derivation-standard","title":"WebAuthn Level 3 PRF Extension Deterministic Zero-Knowledge Key Derivation Standard","category":"security","severity":"critical","description":"Enforces strict implementation invariants for WebAuthn Level 3 PRF (Pseudo-Random Function) extension symmetric key derivation. Guarantees that client-side deterministic encryption keys remain hardware-bound, non-extractable within the Web Crypto API subsystem, and that all intermediate memory buffers are zeroized immediately upon derivation.","antiPatternHeadline":"Exposing Raw PRF Material, Permitting Extractable CryptoKeys, or Allowing Insecure Degradation on PRF-Incompatible Authenticators","stars_count":114,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","prf-extension","zero-knowledge","cryptography","web-crypto-api"],"exportEndpoints":{"claude":"/api/rules/webauthn-l3-prf-symmetric-key-derivation-standard?format=claude","cursorMdc":"/api/rules/webauthn-l3-prf-symmetric-key-derivation-standard?format=mdc","cursorrules":"/api/rules/webauthn-l3-prf-symmetric-key-derivation-standard?format=cursor","windsurf":"/api/rules/webauthn-l3-prf-symmetric-key-derivation-standard?format=windsurf","agents":"/api/rules/webauthn-l3-prf-symmetric-key-derivation-standard?format=agents"}},{"id":"nextjs-15-streaming-ssr-abortsignal-propagation","title":"Next.js 15 Streaming SSR Downstream AbortSignal Propagation Protocol","category":"frontend","severity":"critical","description":"Mandates explicit AbortSignal cascading from incoming HTTP/3 client request streams to all downstream microservices, gRPC channels, and distributed database queries during Next.js 15 chunked React Server Component (RSC) and Web Stream execution. Prevents uncollected zombie promises, thread pool exhaustion, and memory leaks when clients prematurely sever connections during active streaming SSR.","antiPatternHeadline":"Orphaned Downstream Compute via Unbound Fetch and Detached Streaming Lifecycles","stars_count":71,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs","streaming-ssr","abort-signal","rsc","http3","performance"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-streaming-ssr-abortsignal-propagation?format=claude","cursorMdc":"/api/rules/nextjs-15-streaming-ssr-abortsignal-propagation?format=mdc","cursorrules":"/api/rules/nextjs-15-streaming-ssr-abortsignal-propagation?format=cursor","windsurf":"/api/rules/nextjs-15-streaming-ssr-abortsignal-propagation?format=windsurf","agents":"/api/rules/nextjs-15-streaming-ssr-abortsignal-propagation?format=agents"}},{"id":"opentelemetry-arrow-stream-congestion-guardrail","title":"OTLP-Arrow Columnar Record Batch Backpressure and Memory Congestion Invariants","category":"devops","severity":"critical","description":"Enforces strict off-heap columnar memory allocation limits, reactive window backpressure, and schema dictionary eviction across distributed OTLP-Arrow telemetry streams. Prevents collector node OOM panics and catastrophic pipeline cascade failures caused by unbounded batch queues under downstream storage saturation.","antiPatternHeadline":"Unbounded Arrow RecordBatch Construction and Naive gRPC Stream Buffering Under Collector Congestion","stars_count":52,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","apache-arrow","otlp-arrow","backpressure","grpc-streaming","memory-allocator"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-arrow-stream-congestion-guardrail?format=claude","cursorMdc":"/api/rules/opentelemetry-arrow-stream-congestion-guardrail?format=mdc","cursorrules":"/api/rules/opentelemetry-arrow-stream-congestion-guardrail?format=cursor","windsurf":"/api/rules/opentelemetry-arrow-stream-congestion-guardrail?format=windsurf","agents":"/api/rules/opentelemetry-arrow-stream-congestion-guardrail?format=agents"}},{"id":"fastapi-free-threaded-python-313-thread-safety-invariants","title":"FastAPI Free-Threaded Python 3.13 Asyncio Thread-Safety Guardrails","category":"backend","severity":"critical","description":"In Python 3.13 free-threaded builds (PEP 703), the removal of the Global Interpreter Lock (GIL) enables simultaneous execution of Python bytecode across OS threads. Mutating module-level state, misusing asyncio loop primitives across worker threads, or relying on implicit GIL atomicity in FastAPI endpoints introduces critical data races, silent memory corruption, and undefined behavior.","antiPatternHeadline":"Unsynchronized Global Mutations and Non-Thread-Safe Async Loop Sharing Under Free-Threaded Python 3.13","stars_count":67,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","python313","free-threaded","asyncio","thread-safety"],"exportEndpoints":{"claude":"/api/rules/fastapi-free-threaded-python-313-thread-safety-invariants?format=claude","cursorMdc":"/api/rules/fastapi-free-threaded-python-313-thread-safety-invariants?format=mdc","cursorrules":"/api/rules/fastapi-free-threaded-python-313-thread-safety-invariants?format=cursor","windsurf":"/api/rules/fastapi-free-threaded-python-313-thread-safety-invariants?format=windsurf","agents":"/api/rules/fastapi-free-threaded-python-313-thread-safety-invariants?format=agents"}},{"id":"kmp-native-arc-cycle-breaking-bridge-standard","title":"KMP Native ARC Cycle-Breaking Bridge Standard","category":"mobile","severity":"critical","description":"Enforces deterministic cycle-breaking boundaries across Kotlin/Native GC and Apple Objective-C/Swift ARC runtimes. Prevents uncollectable cross-runtime retained memory islands caused by dual-root strong reference cycles between Kotlin class instances and native Apple delegates or closures.","antiPatternHeadline":"Cross-Runtime Retain Islands from Bidirectional Strong References Across K/N GC and Swift ARC","stars_count":79,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","kotlin-native","ios","arc","memory-leaks"],"exportEndpoints":{"claude":"/api/rules/kmp-native-arc-cycle-breaking-bridge-standard?format=claude","cursorMdc":"/api/rules/kmp-native-arc-cycle-breaking-bridge-standard?format=mdc","cursorrules":"/api/rules/kmp-native-arc-cycle-breaking-bridge-standard?format=cursor","windsurf":"/api/rules/kmp-native-arc-cycle-breaking-bridge-standard?format=windsurf","agents":"/api/rules/kmp-native-arc-cycle-breaking-bridge-standard?format=agents"}},{"id":"cilium-tetragon-ebpf-escape-circuit-breaker-standard","title":"Deterministic Kernel-Level Process Lineage Container Escape Circuit-Breaker via Cilium Tetragon","category":"security","severity":"critical","description":"Enforces synchronous, sub-millisecond in-kernel process termination via Cilium Tetragon eBPF TracingPolicies whenever privilege escalation or namespace breakout primitives are detected. Eliminates asynchronous userland detection delays by hooking kernel symbols (e.g., commit_creds, setns, cap_capable) and triggering in-kernel Sigkill actions before unauthorized operations can transition process state. Mandates strict validation of binary execution lineage and namespace boundary preservation across all unprivileged workloads.","antiPatternHeadline":"Relying on Asynchronous User-Space Auditing or Reactive Telemetry Daemons for Container Escape Mitigation","stars_count":95,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","ebpf","tetragon","kubernetes","zero-trust","container-security","linux-kernel"],"exportEndpoints":{"claude":"/api/rules/cilium-tetragon-ebpf-escape-circuit-breaker-standard?format=claude","cursorMdc":"/api/rules/cilium-tetragon-ebpf-escape-circuit-breaker-standard?format=mdc","cursorrules":"/api/rules/cilium-tetragon-ebpf-escape-circuit-breaker-standard?format=cursor","windsurf":"/api/rules/cilium-tetragon-ebpf-escape-circuit-breaker-standard?format=windsurf","agents":"/api/rules/cilium-tetragon-ebpf-escape-circuit-breaker-standard?format=agents"}},{"id":"go-1-24-http2-frame-buffering-backpressure-standard","title":"Go 1.24 HTTP/2 Single-Flight Frame Buffering & Backpressure Guardrail","category":"backend","severity":"critical","description":"Enforces bounded memory allocations and deterministic backpressure for HTTP/2 ingress handlers in Go 1.24. Prevents memory exhaustion attacks such as Rapid Reset (RST_STREAM floods) and WINDOW_UPDATE micro-bursts by bounding frame pools, stream concurrency, and request body consumption.","antiPatternHeadline":"Unbounded Stream Buffer Allocation and Goroutine Leaks Under Adversarial HTTP/2 Frame Churn","stars_count":95,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","http2","networking","security","backpressure","memory-safety"],"exportEndpoints":{"claude":"/api/rules/go-1-24-http2-frame-buffering-backpressure-standard?format=claude","cursorMdc":"/api/rules/go-1-24-http2-frame-buffering-backpressure-standard?format=mdc","cursorrules":"/api/rules/go-1-24-http2-frame-buffering-backpressure-standard?format=cursor","windsurf":"/api/rules/go-1-24-http2-frame-buffering-backpressure-standard?format=windsurf","agents":"/api/rules/go-1-24-http2-frame-buffering-backpressure-standard?format=agents"}},{"id":"tauri2-multi-webview-cross-origin-isolation-boundary","title":"Tauri 2.0 Multi-Webview Cross-Origin Isolation (COOP/COEP) and SharedArrayBuffer Guardrail","category":"mobile","severity":"critical","description":"Enforces strict Cross-Origin-Opener-Policy (COOP) and Cross-Origin-Embedder-Policy (COEP) headers across all multi-webview panels in Tauri 2.0 mobile and desktop targets. Guarantees that high-performance SharedArrayBuffers and WebAssembly thread pools remain secure against speculative execution side-channel attacks (Spectre/Meltdown) while preventing untrusted origin framing.","antiPatternHeadline":"Instantiating SharedArrayBuffer across unisolated or mixed-context Tauri WebViews without verified COOP/COEP boundaries","stars_count":85,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri-2","security","cross-origin-isolation","sharedarraybuffer","ipc","spectre-mitigation"],"exportEndpoints":{"claude":"/api/rules/tauri2-multi-webview-cross-origin-isolation-boundary?format=claude","cursorMdc":"/api/rules/tauri2-multi-webview-cross-origin-isolation-boundary?format=mdc","cursorrules":"/api/rules/tauri2-multi-webview-cross-origin-isolation-boundary?format=cursor","windsurf":"/api/rules/tauri2-multi-webview-cross-origin-isolation-boundary?format=windsurf","agents":"/api/rules/tauri2-multi-webview-cross-origin-isolation-boundary?format=agents"}},{"id":"react-19-server-action-cryptographic-replay-barrier","title":"React 19 Server Actions: Cryptographic Replay Barrier & Monotonic Token Invariant","category":"frontend","severity":"critical","description":"Enforces single-use cryptographic idempotency tokens bound to server action payloads in React 19 to neutralize double-submit race conditions and network replay hazards. Protects progressive enhancement forms and direct client RPC invocations by atomically consuming tokens via transactional storage before executing state-changing operations.","antiPatternHeadline":"Naked Server Actions Executing Unchecked State Mutations Subject to Double-Submit and Replay Cascades","stars_count":84,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react19","server-actions","security","idempotency","race-conditions"],"exportEndpoints":{"claude":"/api/rules/react-19-server-action-cryptographic-replay-barrier?format=claude","cursorMdc":"/api/rules/react-19-server-action-cryptographic-replay-barrier?format=mdc","cursorrules":"/api/rules/react-19-server-action-cryptographic-replay-barrier?format=cursor","windsurf":"/api/rules/react-19-server-action-cryptographic-replay-barrier?format=windsurf","agents":"/api/rules/react-19-server-action-cryptographic-replay-barrier?format=agents"}},{"id":"vite6-environment-api-shadow-dom-mfe-isolation-guardrail","title":"Vite 6 Environment API & Scoped Custom Element Micro-Frontend Sandbox Isolation","category":"frontend","severity":"critical","description":"Guarantees runtime sandbox separation and eliminates prototype pollution and custom element collisions across independently deployed micro-frontend remotes. Mandates configuring Vite 6 runtime environments paired with Scoped CustomElementRegistry instances inside isolated Shadow DOM boundaries.","antiPatternHeadline":"Global Window Pollution and Shared CustomElementRegistry Across Micro-Frontend Remotes","stars_count":73,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["vite6","micro-frontends","shadow-dom","custom-elements","sandboxing","prototype-pollution"],"exportEndpoints":{"claude":"/api/rules/vite6-environment-api-shadow-dom-mfe-isolation-guardrail?format=claude","cursorMdc":"/api/rules/vite6-environment-api-shadow-dom-mfe-isolation-guardrail?format=mdc","cursorrules":"/api/rules/vite6-environment-api-shadow-dom-mfe-isolation-guardrail?format=cursor","windsurf":"/api/rules/vite6-environment-api-shadow-dom-mfe-isolation-guardrail?format=windsurf","agents":"/api/rules/vite6-environment-api-shadow-dom-mfe-isolation-guardrail?format=agents"}},{"id":"fastapi-anyio-sse-taskgroup-cancellation-invariant","title":"FastAPI AnyIO SSE TaskGroup Structured Concurrency & Socket Disconnect Guardrail","category":"backend","severity":"critical","description":"Enforces strict structured concurrency using AnyIO task groups and cancel scopes for all FastAPI Server-Sent Events (SSE) and long-lived streaming endpoints. Mandates bidirectional client-disconnect listening and immediate cancellation of upstream database cursors, LLM inference streams, and background workers upon socket termination to prevent resource exhaustion and connection leaks.","antiPatternHeadline":"Orphaned Streaming Tasks and Unbounded Database Cursor Leaks on Silent SSE Disconnects","stars_count":80,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","anyio","sse","structured-concurrency","python","asyncio"],"exportEndpoints":{"claude":"/api/rules/fastapi-anyio-sse-taskgroup-cancellation-invariant?format=claude","cursorMdc":"/api/rules/fastapi-anyio-sse-taskgroup-cancellation-invariant?format=mdc","cursorrules":"/api/rules/fastapi-anyio-sse-taskgroup-cancellation-invariant?format=cursor","windsurf":"/api/rules/fastapi-anyio-sse-taskgroup-cancellation-invariant?format=windsurf","agents":"/api/rules/fastapi-anyio-sse-taskgroup-cancellation-invariant?format=agents"}},{"id":"postgres-17-logical-decoding-memory-guardrail","title":"Postgres 17 Logical Decoding Memory Quota and CDC Throttling Guardrail","category":"backend","severity":"critical","description":"Protects Change Data Capture (CDC) replication slots from walsender out-of-memory crashes and disk spill saturation caused by unbounded bulk transactions. Enforces micro-batched transactional writes and backpressure validation against logical_decoding_work_mem limits and pg_stat_replication_slots spill metrics.","antiPatternHeadline":"Executing unbounded multi-row DML in single transactions that breach logical_decoding_work_mem and exhaust replication worker memory","stars_count":69,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","cdc","database","replication","debezium","performance"],"exportEndpoints":{"claude":"/api/rules/postgres-17-logical-decoding-memory-guardrail?format=claude","cursorMdc":"/api/rules/postgres-17-logical-decoding-memory-guardrail?format=mdc","cursorrules":"/api/rules/postgres-17-logical-decoding-memory-guardrail?format=cursor","windsurf":"/api/rules/postgres-17-logical-decoding-memory-guardrail?format=windsurf","agents":"/api/rules/postgres-17-logical-decoding-memory-guardrail?format=agents"}},{"id":"go-chi-quic-0rtt-anti-replay-bloom-standard","title":"Go Chi HTTP/3 0-RTT Anti-Replay Distributed Bloom Filter Verification Standard","category":"backend","severity":"critical","description":"Enforces strict replay validation on QUIC HTTP/3 0-RTT (early data) requests in Go Chi services using synchronized distributed bloom filters and RFC 8470 compliance. Prevents transaction duplication and state-tampering attacks on edge nodes by requiring deterministic request fingerprint verification and automatic 425 Too Early down-negotiation.","antiPatternHeadline":"Blind Execution of HTTP/3 Early Data or Non-Distributed In-Memory Replay Checks","stars_count":68,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","chi","quic","http3","zero-rtt","bloom-filter","distributed-systems","security"],"exportEndpoints":{"claude":"/api/rules/go-chi-quic-0rtt-anti-replay-bloom-standard?format=claude","cursorMdc":"/api/rules/go-chi-quic-0rtt-anti-replay-bloom-standard?format=mdc","cursorrules":"/api/rules/go-chi-quic-0rtt-anti-replay-bloom-standard?format=cursor","windsurf":"/api/rules/go-chi-quic-0rtt-anti-replay-bloom-standard?format=windsurf","agents":"/api/rules/go-chi-quic-0rtt-anti-replay-bloom-standard?format=agents"}},{"id":"kmp-coroutines-swift6-strict-concurrency-gate","title":"KMP Coroutines to Swift 6 Strict Concurrency Isolation Gate","category":"mobile","severity":"critical","description":"Enforces a strict boundary between Kotlinx.coroutines emissions and Swift 6 structured concurrency. Forbids raw, unisolated iteration over Kotlin SharedFlow and StateFlow proxies across arbitrary Task threads to prevent Kotlin Native GC/ARC memory corruption and Swift actor data races.","antiPatternHeadline":"Directly Consuming Kotlin Coroutines in Unisolated Swift 6 Tasks Across Thread Boundaries","stars_count":58,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kmp","kotlin-multiplatform","swift6","concurrency","coroutines"],"exportEndpoints":{"claude":"/api/rules/kmp-coroutines-swift6-strict-concurrency-gate?format=claude","cursorMdc":"/api/rules/kmp-coroutines-swift6-strict-concurrency-gate?format=mdc","cursorrules":"/api/rules/kmp-coroutines-swift6-strict-concurrency-gate?format=cursor","windsurf":"/api/rules/kmp-coroutines-swift6-strict-concurrency-gate?format=windsurf","agents":"/api/rules/kmp-coroutines-swift6-strict-concurrency-gate?format=agents"}},{"id":"tauri2-mobile-zerocopy-ipc-ringbuffer-standard","title":"Tauri 2.0 Mobile Zero-Copy IPC Shared Memory Ring Buffer Standard","category":"mobile","severity":"critical","description":"High-throughput telemetry and media streaming between Rust core and mobile WebViews must bypass JSON serialization and Base64 bridge encoding to prevent fatal GC pauses and OOM termination. Engineers must utilize Tauri 2.0 binary IPC channels or custom URI streaming protocols consuming pre-allocated circular ArrayBuffers with atomic index synchronization. Enforces bounded heap allocation and sub-millisecond transmission latencies on memory-constrained iOS and Android devices.","antiPatternHeadline":"Streaming High-Frequency Telemetry or Media as JSON/Base64 over Tauri Standard Invoke Bridge","stars_count":80,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri-2","ipc","zero-copy","shared-memory","ring-buffer","rust"],"exportEndpoints":{"claude":"/api/rules/tauri2-mobile-zerocopy-ipc-ringbuffer-standard?format=claude","cursorMdc":"/api/rules/tauri2-mobile-zerocopy-ipc-ringbuffer-standard?format=mdc","cursorrules":"/api/rules/tauri2-mobile-zerocopy-ipc-ringbuffer-standard?format=cursor","windsurf":"/api/rules/tauri2-mobile-zerocopy-ipc-ringbuffer-standard?format=windsurf","agents":"/api/rules/tauri2-mobile-zerocopy-ipc-ringbuffer-standard?format=agents"}},{"id":"webauthn-prf-deterministic-key-derivation-invariant","title":"WebAuthn PRF Extension Deterministic Client-Side Key Derivation Invariant","category":"security","severity":"critical","description":"Enforces strict cryptographic isolation and domain-separated HKDF derivation when using WebAuthn Pseudo-Random Function (PRF) extensions for zero-knowledge client-side encryption. Mandates that raw PRF outputs remain client-bound and never leak into transport payloads sent to Relying Party backends.","antiPatternHeadline":"Leaking Raw Authenticator PRF Outputs to Verification Backends or Skipping Cryptographic HKDF Expansion","stars_count":101,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","prf-extension","zero-knowledge","cryptography","passkeys"],"exportEndpoints":{"claude":"/api/rules/webauthn-prf-deterministic-key-derivation-invariant?format=claude","cursorMdc":"/api/rules/webauthn-prf-deterministic-key-derivation-invariant?format=mdc","cursorrules":"/api/rules/webauthn-prf-deterministic-key-derivation-invariant?format=cursor","windsurf":"/api/rules/webauthn-prf-deterministic-key-derivation-invariant?format=windsurf","agents":"/api/rules/webauthn-prf-deterministic-key-derivation-invariant?format=agents"}},{"id":"spiffe-spire-dynamic-svid-socket-rebind-protocol","title":"SPIFFE/SPIRE Dynamic SVID Zero-Downtime Socket Rebind Protocol","category":"security","severity":"critical","description":"Enforces dynamic, in-memory X.509 SVID certificate rotation driven by the SPIRE Workload API without dropping active long-lived HTTP/2 or gRPC transport sessions. Mandates dynamic TLS context swapping and atomic socket inheritance or session re-handshaking to prevent process teardowns during sub-hour certificate lifetimes. Forbids destructive server restarts and naive socket tear-down during cryptographic renewal cycles.","antiPatternHeadline":"Hard Process Restarts and Abrupt Socket Destruction During Ephemeral SVID Rotation","stars_count":105,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","spiffe","spire","mtls","grpc","zero-trust","tls-rotation","socket-inheritance"],"exportEndpoints":{"claude":"/api/rules/spiffe-spire-dynamic-svid-socket-rebind-protocol?format=claude","cursorMdc":"/api/rules/spiffe-spire-dynamic-svid-socket-rebind-protocol?format=mdc","cursorrules":"/api/rules/spiffe-spire-dynamic-svid-socket-rebind-protocol?format=cursor","windsurf":"/api/rules/spiffe-spire-dynamic-svid-socket-rebind-protocol?format=windsurf","agents":"/api/rules/spiffe-spire-dynamic-svid-socket-rebind-protocol?format=agents"}},{"id":"react-19-server-actions-idempotency-guardrail","title":"React 19 Server Actions Cryptographic Idempotency Guardrail","category":"frontend","severity":"critical","description":"Enforces distributed cryptographic idempotency keys on mutating React 19 Server Actions across edge environments. Prevents duplicate state modifications, double-billing, and race conditions resulting from aggressive client or network retry policies by mandating atomic deduplication checks in shared storage backends before executing transactional payloads.","antiPatternHeadline":"Blind Mutation in React 19 Server Actions without Distributed Idempotency Locks","stars_count":117,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","server-actions","idempotency","distributed-systems","edge-computing"],"exportEndpoints":{"claude":"/api/rules/react-19-server-actions-idempotency-guardrail?format=claude","cursorMdc":"/api/rules/react-19-server-actions-idempotency-guardrail?format=mdc","cursorrules":"/api/rules/react-19-server-actions-idempotency-guardrail?format=cursor","windsurf":"/api/rules/react-19-server-actions-idempotency-guardrail?format=windsurf","agents":"/api/rules/react-19-server-actions-idempotency-guardrail?format=agents"}},{"id":"openfga-contextual-tuple-bounded-resolution","title":"OpenFGA 1.6 Contextual Tuple Bounded-Resolution Invariant","category":"security","severity":"critical","description":"Enforces deterministic depth ceilings, strict cardinality limits, and deduplicated subgraph traversal when injecting dynamic contextual tuples into OpenFGA 1.6 Check calls. Prevents algorithmic graph-traversal exhaustion attacks, circular dependency deadlocks, and severe tail-latency spikes across real-time RBAC/ABAC authorization boundaries.","antiPatternHeadline":"Unbounded Contextual Tuple Ingestion Inducing Pathological Graph Traversal and Latency Explosions","stars_count":66,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","authorization","rbac","abac","dos-prevention","tail-latency"],"exportEndpoints":{"claude":"/api/rules/openfga-contextual-tuple-bounded-resolution?format=claude","cursorMdc":"/api/rules/openfga-contextual-tuple-bounded-resolution?format=mdc","cursorrules":"/api/rules/openfga-contextual-tuple-bounded-resolution?format=cursor","windsurf":"/api/rules/openfga-contextual-tuple-bounded-resolution?format=windsurf","agents":"/api/rules/openfga-contextual-tuple-bounded-resolution?format=agents"}},{"id":"fastapi-pydantic-v2-simd-buffer-isolation","title":"FastAPI Pydantic V2 Zero-Copy SIMD Deserialization & Event-Loop Cooperative Isolation","category":"backend","severity":"critical","description":"Enforces zero-copy byte-buffer validation using Pydantic V2's Rust-backed SIMD deserialization engine while offloading CPU-intensive parsing to cooperative worker threads. Prevents asyncio event-loop starvation and eliminates intermediate Python heap allocations during high-throughput ingestion and streaming loads.","antiPatternHeadline":"Synchronous Event-Loop Deserialization with Intermediate String Allocations and GIL Stalls","stars_count":79,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","pydantic-v2","simd","asyncio","zero-copy","performance"],"exportEndpoints":{"claude":"/api/rules/fastapi-pydantic-v2-simd-buffer-isolation?format=claude","cursorMdc":"/api/rules/fastapi-pydantic-v2-simd-buffer-isolation?format=mdc","cursorrules":"/api/rules/fastapi-pydantic-v2-simd-buffer-isolation?format=cursor","windsurf":"/api/rules/fastapi-pydantic-v2-simd-buffer-isolation?format=windsurf","agents":"/api/rules/fastapi-pydantic-v2-simd-buffer-isolation?format=agents"}},{"id":"bun-websocket-backpressure-drainage-invariant","title":"Bun 1.2 Native WebSocket Backpressure & High-Water Mark Drainage Invariant","category":"backend","severity":"critical","description":"Enforces proactive high-water mark throttling, buffer size verification, and per-socket queue shedding on Bun 1.2 ServerWebSocket instances. Prevents process-level heap exhaustion and unmonitored bufferedAmount accumulation during high-frequency pub/sub broadcasts to slow consumers.","antiPatternHeadline":"Unchecked ws.send() Broadcasting and Omission of Native drain() Handlers Inducing Memory Bloat","stars_count":42,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","websockets","backpressure","concurrency","performance"],"exportEndpoints":{"claude":"/api/rules/bun-websocket-backpressure-drainage-invariant?format=claude","cursorMdc":"/api/rules/bun-websocket-backpressure-drainage-invariant?format=mdc","cursorrules":"/api/rules/bun-websocket-backpressure-drainage-invariant?format=cursor","windsurf":"/api/rules/bun-websocket-backpressure-drainage-invariant?format=windsurf","agents":"/api/rules/bun-websocket-backpressure-drainage-invariant?format=agents"}},{"id":"go-chi-context-deadline-propagation-and-shedding-standard","title":"Chi v5 Strict Context Deadline Propagation, Shedding, and Cooperative Goroutine Termination","category":"backend","severity":"critical","description":"Enforces strict context deadline propagation and cooperative goroutine cancellation across Go Chi v5 middleware pipelines, downstream I/O calls, and asynchronous worker queues. Mandates immediate early load-shedding via bounded concurrency limiters and early context expiration checks to prevent goroutine leaks, unbounded memory growth, and cascading connection pool saturation.","antiPatternHeadline":"Spawning detached unbuffered goroutines or continuing downstream I/O across Chi middleware after client context cancellation.","stars_count":91,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","golang","chi-v5","context-propagation","load-shedding","concurrency"],"exportEndpoints":{"claude":"/api/rules/go-chi-context-deadline-propagation-and-shedding-standard?format=claude","cursorMdc":"/api/rules/go-chi-context-deadline-propagation-and-shedding-standard?format=mdc","cursorrules":"/api/rules/go-chi-context-deadline-propagation-and-shedding-standard?format=cursor","windsurf":"/api/rules/go-chi-context-deadline-propagation-and-shedding-standard?format=windsurf","agents":"/api/rules/go-chi-context-deadline-propagation-and-shedding-standard?format=agents"}},{"id":"tauri-v2-mobile-ipc-scope-isolation","title":"Tauri 2.0 Mobile IPC Scope Isolation and Origin Attestation","category":"mobile","severity":"critical","description":"Mandates strict capability ACL scoping, webview origin attestation, and per-webview channel isolation in Tauri 2.0 mobile architectures. Enforces runtime cryptographic provenance checks on native plugin invocations to prevent unauthorized cross-origin access and IPC hijacking.","antiPatternHeadline":"Wildcard Plugin Capabilities and Ambient IPC Access for Remote or Compromised Webviews","stars_count":75,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri","tauri-v2","ipc-security","rust","capabilities-acl"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-mobile-ipc-scope-isolation?format=claude","cursorMdc":"/api/rules/tauri-v2-mobile-ipc-scope-isolation?format=mdc","cursorrules":"/api/rules/tauri-v2-mobile-ipc-scope-isolation?format=cursor","windsurf":"/api/rules/tauri-v2-mobile-ipc-scope-isolation?format=windsurf","agents":"/api/rules/tauri-v2-mobile-ipc-scope-isolation?format=agents"}},{"id":"webauthn-l3-enterprise-attestation-aaguid-validation","title":"WebAuthn Level 3 Enterprise Attestation and AAGUID Validation Invariant","category":"security","severity":"critical","description":"Enforces strict Level 3 Enterprise Attestation validation for WebAuthn credential registration. Registration ceremonies must cryptographically verify the attestation statement against the FIDO Alliance Metadata Service (MDS3) or an enterprise PKI root trust store, validating that the parsed Authenticator Attestation GUID (AAGUID) matches an authorized FIPS 140-2/3 or CC EAL4+ certified hardware profile before persisting the public key.","antiPatternHeadline":"Persisting WebAuthn credentials without cryptographic attestation verification and AAGUID trust list enforcement","stars_count":45,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","fido2","cryptography","enterprise-auth","hardware-token"],"exportEndpoints":{"claude":"/api/rules/webauthn-l3-enterprise-attestation-aaguid-validation?format=claude","cursorMdc":"/api/rules/webauthn-l3-enterprise-attestation-aaguid-validation?format=mdc","cursorrules":"/api/rules/webauthn-l3-enterprise-attestation-aaguid-validation?format=cursor","windsurf":"/api/rules/webauthn-l3-enterprise-attestation-aaguid-validation?format=windsurf","agents":"/api/rules/webauthn-l3-enterprise-attestation-aaguid-validation?format=agents"}},{"id":"cilium-ebpf-ambient-mutual-auth-standard","title":"Cilium eBPF Ambient Mode Mutual Authentication & Cryptographic Identity Guardrail","category":"devops","severity":"critical","description":"Enforces kernel-level mutual authentication and SPIFFE cryptographic identity validation directly on the eBPF datapath. Eliminates user-space sidecar proxy latency and memory footprint while guaranteeing strict zero-trust ingress and egress packet transit policies.","antiPatternHeadline":"Injecting user-space proxy sidecars or deploying permissive CiliumNetworkPolicies lacking kernel-level mutual authentication stanzas","stars_count":105,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","cilium","ebpf","ambient-mesh","spiffe","spire","kubernetes","zero-trust"],"exportEndpoints":{"claude":"/api/rules/cilium-ebpf-ambient-mutual-auth-standard?format=claude","cursorMdc":"/api/rules/cilium-ebpf-ambient-mutual-auth-standard?format=mdc","cursorrules":"/api/rules/cilium-ebpf-ambient-mutual-auth-standard?format=cursor","windsurf":"/api/rules/cilium-ebpf-ambient-mutual-auth-standard?format=windsurf","agents":"/api/rules/cilium-ebpf-ambient-mutual-auth-standard?format=agents"}},{"id":"otel-high-cardinality-hash-scrubbing-guardrail","title":"OpenTelemetry High-Cardinality Deterministic Hash Scrubbing & Pre-Aggregation Guardrail","category":"devops","severity":"critical","description":"Downstream telemetry backends suffer catastrophic memory exhaustion and index explosion when unbounded identifiers (UUIDs, transaction IDs, email addresses) enter metric label dimensions. This guardrail mandates edge-level deterministic hashing and pre-aggregation reservoir sampling in OpenTelemetry Collector configurations and SDK interceptors. High-cardinality values must be normalized into fixed-size hash buckets or stripped prior to TSDB ingestion.","antiPatternHeadline":"Injecting Raw Unbounded Identifiers Directly into Metric Dimensions Without Edge Hash-Bucketing","stars_count":96,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","observability","cardinality-management","sre","otel-collector"],"exportEndpoints":{"claude":"/api/rules/otel-high-cardinality-hash-scrubbing-guardrail?format=claude","cursorMdc":"/api/rules/otel-high-cardinality-hash-scrubbing-guardrail?format=mdc","cursorrules":"/api/rules/otel-high-cardinality-hash-scrubbing-guardrail?format=cursor","windsurf":"/api/rules/otel-high-cardinality-hash-scrubbing-guardrail?format=windsurf","agents":"/api/rules/otel-high-cardinality-hash-scrubbing-guardrail?format=agents"}},{"id":"kmp-coroutine-swift-task-cancellation-propagation-kotlin-multiplat-695","title":"Deterministic KMP Coroutine-to-Swift Task Cancellation Propagation","category":"mobile","severity":"critical","description":"Enforces bidirectional, deterministic cancellation propagation and resource deallocation across the native Swift Concurrency Task boundary and Kotlin Coroutine runtime. Prevents orphaned asynchronous executions, thread starvation, and memory leaks caused by Kotlin/Native suspend-to-Swift async bridging conventions (SKIE or standard cinterop).","antiPatternHeadline":"Orphaned Kotlin Coroutines from Unbridged Swift Task Lifecycle Deallocation","stars_count":55,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kmp","kotlin-native","swift-concurrency","coroutines","cancellation"],"exportEndpoints":{"claude":"/api/rules/kmp-coroutine-swift-task-cancellation-propagation-kotlin-multiplat-695?format=claude","cursorMdc":"/api/rules/kmp-coroutine-swift-task-cancellation-propagation-kotlin-multiplat-695?format=mdc","cursorrules":"/api/rules/kmp-coroutine-swift-task-cancellation-propagation-kotlin-multiplat-695?format=cursor","windsurf":"/api/rules/kmp-coroutine-swift-task-cancellation-propagation-kotlin-multiplat-695?format=windsurf","agents":"/api/rules/kmp-coroutine-swift-task-cancellation-propagation-kotlin-multiplat-695?format=agents"}},{"id":"go-chi-quic-zero-rtt-anti-replay-guardrail","title":"Go Chi HTTP/3 0-RTT Early Data Anti-Replay Guardrail","category":"backend","severity":"critical","description":"Protects state-mutating HTTP/3 endpoints from transport-level replay attacks enabled by TLS 1.3 / QUIC 0-RTT early data. Unvalidated early data lacks transport replay protection, allowing captured initial flight packets to execute side effects multiple times unless rejected with HTTP 425 (Too Early) or gated behind strict idempotency controls.","antiPatternHeadline":"Executing state-mutating requests arriving via QUIC 0-RTT early data without replay rejection or validation","stars_count":109,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","chi","quic","http3","tls13","replay-prevention","security"],"exportEndpoints":{"claude":"/api/rules/go-chi-quic-zero-rtt-anti-replay-guardrail?format=claude","cursorMdc":"/api/rules/go-chi-quic-zero-rtt-anti-replay-guardrail?format=mdc","cursorrules":"/api/rules/go-chi-quic-zero-rtt-anti-replay-guardrail?format=cursor","windsurf":"/api/rules/go-chi-quic-zero-rtt-anti-replay-guardrail?format=windsurf","agents":"/api/rules/go-chi-quic-zero-rtt-anti-replay-guardrail?format=agents"}},{"id":"react-19-metadata-hoisting-hydration-barrier","title":"React 19 Document Metadata Hoisting & Hydration Conflict Barrier","category":"frontend","severity":"critical","description":"Enforces deterministic document metadata hoisting and deduplication standards in React 19 applications. Eliminates client-side hydration thrashing, duplicate <head> elements, and race conditions caused by concurrent asynchronous server components and legacy imperative head managers.","antiPatternHeadline":"Emitting unkeyed concurrent meta tags across suspended async boundaries while mutating document.head imperatively.","stars_count":87,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["react-19","hydration","metadata-hoisting","server-components","ssr"],"exportEndpoints":{"claude":"/api/rules/react-19-metadata-hoisting-hydration-barrier?format=claude","cursorMdc":"/api/rules/react-19-metadata-hoisting-hydration-barrier?format=mdc","cursorrules":"/api/rules/react-19-metadata-hoisting-hydration-barrier?format=cursor","windsurf":"/api/rules/react-19-metadata-hoisting-hydration-barrier?format=windsurf","agents":"/api/rules/react-19-metadata-hoisting-hydration-barrier?format=agents"}},{"id":"prometheus-3-otel-exemplar-bounded-retention-standard","title":"Prometheus 3.0 Native OpenTelemetry Exemplar Bounded Retention Standard","category":"devops","severity":"critical","description":"Enforces deterministic memory bounds for OpenTelemetry-to-Prometheus exemplar storage within high-throughput ingestion pipelines. Prevents out-of-memory (OOM) conditions by replacing unbounded exemplar attachments with strictly sized circular ring buffers and enforcing Prometheus 3.0 max_exemplars storage limits. Guarantees predictable trace-to-metric correlation without destabilizing TSDB head block allocations.","antiPatternHeadline":"Unbounded In-Memory Trace ID Accumulation in Metric Exemplar Buffers","stars_count":88,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","prometheus","opentelemetry","metrics","exemplars","observability","tsdb"],"exportEndpoints":{"claude":"/api/rules/prometheus-3-otel-exemplar-bounded-retention-standard?format=claude","cursorMdc":"/api/rules/prometheus-3-otel-exemplar-bounded-retention-standard?format=mdc","cursorrules":"/api/rules/prometheus-3-otel-exemplar-bounded-retention-standard?format=cursor","windsurf":"/api/rules/prometheus-3-otel-exemplar-bounded-retention-standard?format=windsurf","agents":"/api/rules/prometheus-3-otel-exemplar-bounded-retention-standard?format=agents"}},{"id":"spiffe-spire-x509-svid-micro-rotation-standard","title":"SPIFFE/SPIRE Ephemeral X.509 SVID Sub-Minute Micro-Rotation Standard","category":"security","severity":"critical","description":"Enforces dynamic, continuous Workload API streaming for sub-minute X.509 SVID rotation across zero-trust mTLS channels. Eliminates static credential theft and stale connection failures by mandating dynamic TLS contexts driven by SPIRE Agent Unix Domain Sockets rather than disk-cached certificates. Guarantees zero-downtime certificate hot-reloading with deterministic SPIFFE ID peer SAN validation.","antiPatternHeadline":"Static Initialization and In-Memory Caching of Ephemeral SPIFFE X.509 SVIDs","stars_count":78,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","spiffe","spire","mtls","zero-trust","cryptography"],"exportEndpoints":{"claude":"/api/rules/spiffe-spire-x509-svid-micro-rotation-standard?format=claude","cursorMdc":"/api/rules/spiffe-spire-x509-svid-micro-rotation-standard?format=mdc","cursorrules":"/api/rules/spiffe-spire-x509-svid-micro-rotation-standard?format=cursor","windsurf":"/api/rules/spiffe-spire-x509-svid-micro-rotation-standard?format=windsurf","agents":"/api/rules/spiffe-spire-x509-svid-micro-rotation-standard?format=agents"}},{"id":"bun-sqlite-wal-concurrency-invariant-bun-1-2-clustere-765","title":"Bun 1.2 Native SQLite WAL Read-Replica Concurrency & Checkpoint Invariant","category":"backend","severity":"critical","description":"Enforces strict single-writer actor isolation and immutable read-only replicas across Bun 1.2 worker threads utilizing bun:sqlite in WAL mode. Prevents reader-induced checkpoint deadlocks, unbounded WAL file growth, and SQLITE_BUSY starvation under high-throughput concurrent edge cache workloads.","antiPatternHeadline":"Multi-Threaded Read-Write bun:sqlite Handles with Long-Lived Statements Starving WAL Checkpoints","stars_count":88,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","bun-sqlite","sqlite-wal","multithreading","concurrency","caching"],"exportEndpoints":{"claude":"/api/rules/bun-sqlite-wal-concurrency-invariant-bun-1-2-clustere-765?format=claude","cursorMdc":"/api/rules/bun-sqlite-wal-concurrency-invariant-bun-1-2-clustere-765?format=mdc","cursorrules":"/api/rules/bun-sqlite-wal-concurrency-invariant-bun-1-2-clustere-765?format=cursor","windsurf":"/api/rules/bun-sqlite-wal-concurrency-invariant-bun-1-2-clustere-765?format=windsurf","agents":"/api/rules/bun-sqlite-wal-concurrency-invariant-bun-1-2-clustere-765?format=agents"}},{"id":"w3c-fedcm-partition-isolation-security-standard","title":"FedCM Cross-Origin Partition Isolation and Side-Channel Mitigation Standard","category":"security","severity":"critical","description":"Enforces strict partition isolation and constant-time execution across W3C Federated Credential Management (FedCM) endpoints. Prevents relying party timing side-channels, cross-site identity leakage, and covert user tracking during unmediated or silent identity provider handshakes under third-party cookie deprecation.","antiPatternHeadline":"Variable-latency accounts endpoint execution and missing Sec-Fetch-Dest validation enabling cross-site login state probing","stars_count":50,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","fedcm","identity","timing-attack","partition-isolation","privacy"],"exportEndpoints":{"claude":"/api/rules/w3c-fedcm-partition-isolation-security-standard?format=claude","cursorMdc":"/api/rules/w3c-fedcm-partition-isolation-security-standard?format=mdc","cursorrules":"/api/rules/w3c-fedcm-partition-isolation-security-standard?format=cursor","windsurf":"/api/rules/w3c-fedcm-partition-isolation-security-standard?format=windsurf","agents":"/api/rules/w3c-fedcm-partition-isolation-security-standard?format=agents"}},{"id":"k8s-structured-authz-cel-budget-guardrail","title":"Kubernetes Structured Authorization CEL Invariant Execution & Budget Guardrail","category":"devops","severity":"critical","description":"Enforces strict computation cost boundaries, pre-compilation verification, and microsecond evaluation deadlines for declarative Common Expression Language (CEL) policies within Kubernetes Structured Authorization configurations. Unchecked CEL evaluation on the kube-apiserver authorization critical path exposes control plane components to denial-of-service, severe request latency degradation, and authorization deadlocks under high request per second (RPS) loads. This rule guarantees deterministic authorizer execution limits and non-backtracking evaluation profiles.","antiPatternHeadline":"Unbounded Regex and Nested Iteration in Kubernetes Authorization CEL Configurations","stars_count":85,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","kubernetes","cel","structured-authorization","kube-apiserver","security"],"exportEndpoints":{"claude":"/api/rules/k8s-structured-authz-cel-budget-guardrail?format=claude","cursorMdc":"/api/rules/k8s-structured-authz-cel-budget-guardrail?format=mdc","cursorrules":"/api/rules/k8s-structured-authz-cel-budget-guardrail?format=cursor","windsurf":"/api/rules/k8s-structured-authz-cel-budget-guardrail?format=windsurf","agents":"/api/rules/k8s-structured-authz-cel-budget-guardrail?format=agents"}},{"id":"vite6-environment-api-ssr-isolation-guardrail","title":"Vite 6 Environment API Module-Graph SSR Boundary & Runtime Isolation","category":"frontend","severity":"critical","description":"Enforces strict boundary separation between client, Node.js, and edge module graphs using the Vite 6 Environment API. Eliminates cross-runtime singleton leaks, improper HMR propagation, and shared state bleed between SSR execution contexts during local development and build pipelines.","antiPatternHeadline":"Accessing Legacy Shared ModuleGraph and ssrLoadModule Leading to Cross-Runtime State Contamination","stars_count":70,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["vite","vite6","ssr","environment-api","module-graph","hmr","fullstack"],"exportEndpoints":{"claude":"/api/rules/vite6-environment-api-ssr-isolation-guardrail?format=claude","cursorMdc":"/api/rules/vite6-environment-api-ssr-isolation-guardrail?format=mdc","cursorrules":"/api/rules/vite6-environment-api-ssr-isolation-guardrail?format=cursor","windsurf":"/api/rules/vite6-environment-api-ssr-isolation-guardrail?format=windsurf","agents":"/api/rules/vite6-environment-api-ssr-isolation-guardrail?format=agents"}},{"id":"svelte-5-raw-state-proxy-bypass-standard","title":"Svelte 5 $state.raw Proxy Bypass Standard for High-Throughput Streams","category":"frontend","severity":"critical","description":"Enforces the mandatory use of Svelte 5's $state.raw() rune for large external state trees, high-frequency streaming collections, and immutable third-party data structures. Prevents catastrophic garbage collection thrashing and main-thread freezing caused by deep recursive proxy wrapping on high-volume incoming payloads.","antiPatternHeadline":"Wrapping Large or Streaming Data Payloads in Deeply Reactive Svelte 5 $state() Proxies","stars_count":69,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","performance","memory-management","streaming"],"exportEndpoints":{"claude":"/api/rules/svelte-5-raw-state-proxy-bypass-standard?format=claude","cursorMdc":"/api/rules/svelte-5-raw-state-proxy-bypass-standard?format=mdc","cursorrules":"/api/rules/svelte-5-raw-state-proxy-bypass-standard?format=cursor","windsurf":"/api/rules/svelte-5-raw-state-proxy-bypass-standard?format=windsurf","agents":"/api/rules/svelte-5-raw-state-proxy-bypass-standard?format=agents"}},{"id":"axum-streaming-multipart-backpressure-invariant","title":"Axum 0.8 Async Streaming Multipart Backpressure & OOM Invariant","category":"backend","severity":"critical","description":"Enforces strict end-to-end backpressure during high-throughput multipart file uploads in Axum 0.8. Mandates direct bounded pipeline streaming from client socket to storage sinks without intermediate heap accumulation, preventing unbounded memory consumption and Tokio worker thread starvation.","antiPatternHeadline":"Unbounded buffering of multipart chunks into in-memory Vec/Bytes or using unthrottled channels, causing OOM heap blowouts during file ingestion.","stars_count":83,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tokio","streaming","backpressure","memory-safety"],"exportEndpoints":{"claude":"/api/rules/axum-streaming-multipart-backpressure-invariant?format=claude","cursorMdc":"/api/rules/axum-streaming-multipart-backpressure-invariant?format=mdc","cursorrules":"/api/rules/axum-streaming-multipart-backpressure-invariant?format=cursor","windsurf":"/api/rules/axum-streaming-multipart-backpressure-invariant?format=windsurf","agents":"/api/rules/axum-streaming-multipart-backpressure-invariant?format=agents"}},{"id":"fastapi-anyio-worker-pool-starvation-guardrail","title":"FastAPI AnyIO Worker Pool Starvation and Event Loop Isolation Guardrail","category":"backend","severity":"critical","description":"Enforces threadpool capacity bounds, strict caller timeouts, and isolated executor contexts when invoking synchronous blocking code within FastAPI services. Prevents default AnyIO/asyncio threadpool exhaustion from stalling concurrent event loop tasks, incoming connection handshakes, and health check probes under burst load.","antiPatternHeadline":"Exhausting the Default AnyIO Worker Pool via Unbounded Blocking Synchronous Route Handlers and Missing Circuit Timeouts","stars_count":80,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","python","anyio","asyncio","concurrency","resilience"],"exportEndpoints":{"claude":"/api/rules/fastapi-anyio-worker-pool-starvation-guardrail?format=claude","cursorMdc":"/api/rules/fastapi-anyio-worker-pool-starvation-guardrail?format=mdc","cursorrules":"/api/rules/fastapi-anyio-worker-pool-starvation-guardrail?format=cursor","windsurf":"/api/rules/fastapi-anyio-worker-pool-starvation-guardrail?format=windsurf","agents":"/api/rules/fastapi-anyio-worker-pool-starvation-guardrail?format=agents"}},{"id":"postgres-17-memory-adaptive-parallel-hash-join","title":"PostgreSQL 17 Memory-Adaptive Parallel Hash Join Guardrail","category":"backend","severity":"critical","description":"Enforces bounded memory allocations and worker throttling for parallel hash join queries on PostgreSQL 17 read replicas. Uncontrolled session-level work_mem overrides multiply across parallel gather workers, triggering Linux Out-Of-Memory (OOM) killer terminations under high concurrency.","antiPatternHeadline":"Unbounded Session-Level work_mem Inflation with Parallel Query Execution","stars_count":91,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","performance","database","concurrency","memory-management"],"exportEndpoints":{"claude":"/api/rules/postgres-17-memory-adaptive-parallel-hash-join?format=claude","cursorMdc":"/api/rules/postgres-17-memory-adaptive-parallel-hash-join?format=mdc","cursorrules":"/api/rules/postgres-17-memory-adaptive-parallel-hash-join?format=cursor","windsurf":"/api/rules/postgres-17-memory-adaptive-parallel-hash-join?format=windsurf","agents":"/api/rules/postgres-17-memory-adaptive-parallel-hash-join?format=agents"}},{"id":"capacitor-7-structured-clone-bridge-invariant","title":"Capacitor 7 Structured Clone & Zero-Copy Bridge Serialization for High-Frequency Telemetry","category":"mobile","severity":"critical","description":"Enforces zero-copy structured cloning and transferable buffer semantics across Capacitor 7 WebView-to-native message ports. Eliminates main-thread blocking and garbage collection churn caused by manual JSON stringification during high-frequency geolocation, IMU, and motion sensor streaming.","antiPatternHeadline":"Manual JSON Stringification Across MessagePorts in High-Frequency Sensor Streams","stars_count":93,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","performance","sensors","structured-clone","zero-copy"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-structured-clone-bridge-invariant?format=claude","cursorMdc":"/api/rules/capacitor-7-structured-clone-bridge-invariant?format=mdc","cursorrules":"/api/rules/capacitor-7-structured-clone-bridge-invariant?format=cursor","windsurf":"/api/rules/capacitor-7-structured-clone-bridge-invariant?format=windsurf","agents":"/api/rules/capacitor-7-structured-clone-bridge-invariant?format=agents"}},{"id":"react-native-0-78-fabric-shadow-tree-mutation-fence","title":"React Native 0.78 Bridgeless Fabric Shadow Tree Mutation Fence","category":"mobile","severity":"critical","description":"Enforces immutability invariants and atomic commit boundaries on React Native 0.78 Bridgeless Fabric shadow tree revisions. Prevents visual tearing, thread race conditions, and C++ ShadowNode mutation crashes during high-velocity gesture interactions.","antiPatternHeadline":"Direct Imperative Native Property Mutations and Concurrent Unbatched Commits During Gestures","stars_count":63,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","react-native","fabric","bridgeless","shadow-tree","gestures"],"exportEndpoints":{"claude":"/api/rules/react-native-0-78-fabric-shadow-tree-mutation-fence?format=claude","cursorMdc":"/api/rules/react-native-0-78-fabric-shadow-tree-mutation-fence?format=mdc","cursorrules":"/api/rules/react-native-0-78-fabric-shadow-tree-mutation-fence?format=cursor","windsurf":"/api/rules/react-native-0-78-fabric-shadow-tree-mutation-fence?format=windsurf","agents":"/api/rules/react-native-0-78-fabric-shadow-tree-mutation-fence?format=agents"}},{"id":"oauth21-dpop-replay-barrier-guardrail","title":"OAuth 2.1 DPoP Cryptographic Proof and Distributed Nonce Replay Barrier","category":"security","severity":"critical","description":"Enforces strict RFC 9449 OAuth 2.1 Demonstrating Proof-of-Possession (DPoP) verification across all resource servers. Validates cryptographic thumbprint binding (jkt/ath), enforces bounded clock skew (±60s), and guarantees atomicity of single-use nonces and JTI claims via distributed atomic sliding-window cache primitives to eliminate replay and token export vulnerabilities.","antiPatternHeadline":"Stateless DPoP Proof Verification Without Atomic Distributed Nonce / JTI Tracking","stars_count":95,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","oauth2.1","dpop","rfc9449","zero-trust","replay-barrier","redis"],"exportEndpoints":{"claude":"/api/rules/oauth21-dpop-replay-barrier-guardrail?format=claude","cursorMdc":"/api/rules/oauth21-dpop-replay-barrier-guardrail?format=mdc","cursorrules":"/api/rules/oauth21-dpop-replay-barrier-guardrail?format=cursor","windsurf":"/api/rules/oauth21-dpop-replay-barrier-guardrail?format=windsurf","agents":"/api/rules/oauth21-dpop-replay-barrier-guardrail?format=agents"}},{"id":"k8s-dra-device-claim-prebind-invariant","title":"Kubernetes DRA Dynamic Device Claim Atomic Pre-Binding and Health Validation Invariant","category":"devops","severity":"critical","description":"Enforces atomic pre-binding hardware validation and driver lease verification within Kubernetes Dynamic Resource Allocation (DRA) controllers and CDI plugins prior to pod container admission. Prevents silent multi-tenant resource leakage, zombie device locks, and co-tenant memory exposure on GPU and NPU clusters by mandating hardware-level sanitization and lease verification before updating NodeResourceSlice and DeviceClaim allocations.","antiPatternHeadline":"Optimistic DRA Claim Binding Without Atomic Hardware Health Verification and PCIe Reset Handshake","stars_count":56,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","kubernetes","dra","gpu","npu","cdi","hardware-isolation","multi-tenancy"],"exportEndpoints":{"claude":"/api/rules/k8s-dra-device-claim-prebind-invariant?format=claude","cursorMdc":"/api/rules/k8s-dra-device-claim-prebind-invariant?format=mdc","cursorrules":"/api/rules/k8s-dra-device-claim-prebind-invariant?format=cursor","windsurf":"/api/rules/k8s-dra-device-claim-prebind-invariant?format=windsurf","agents":"/api/rules/k8s-dra-device-claim-prebind-invariant?format=agents"}},{"id":"opentelemetry-exemplar-reservoir-memory-saturation-standard","title":"OpenTelemetry Exemplar Reservoir Memory Saturation and Fixed-Capacity Guardrails","category":"devops","severity":"critical","description":"Enforces deterministic memory bounds and strictly capped reservoir capacity on OpenTelemetry exemplar samplers attached to metric histograms. Prevents heap exhaustion, Garbage Collection thrashing, and unmetered trace context retention across high-throughput microservice runtimes under heavy traffic.","antiPatternHeadline":"Unbounded Exemplar Collection and Naive Reservoir Allocation in High-Cardinality Histograms","stars_count":54,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","metrics","exemplars","memory-management","sre"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-exemplar-reservoir-memory-saturation-standard?format=claude","cursorMdc":"/api/rules/opentelemetry-exemplar-reservoir-memory-saturation-standard?format=mdc","cursorrules":"/api/rules/opentelemetry-exemplar-reservoir-memory-saturation-standard?format=cursor","windsurf":"/api/rules/opentelemetry-exemplar-reservoir-memory-saturation-standard?format=windsurf","agents":"/api/rules/opentelemetry-exemplar-reservoir-memory-saturation-standard?format=agents"}},{"id":"webauthn-prf-key-derivation-standard-webauthn-level-3-782","title":"Deterministic Client-Side Key Derivation via WebAuthn Level 3 PRF Extension","category":"security","severity":"critical","description":"Enforces hardware-backed, deterministic client-side symmetric key derivation using the WebAuthn Level 3 pseudo-random function (PRF) extension. Mandates that root cryptographic seeds remain exclusively within authenticator hardware bounds, using HMAC-SHA-256 HKDF expansion client-side for zero-knowledge end-to-end encryption without transmitting master secrets or raw PRF outputs to the server.","antiPatternHeadline":"Deriving Encryption Keys from Server Secrets, Passwords, or Sending Raw PRF Outputs Across Network Boundaries","stars_count":101,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","prf-extension","zero-knowledge","cryptography","hkdf","e2ee"],"exportEndpoints":{"claude":"/api/rules/webauthn-prf-key-derivation-standard-webauthn-level-3-782?format=claude","cursorMdc":"/api/rules/webauthn-prf-key-derivation-standard-webauthn-level-3-782?format=mdc","cursorrules":"/api/rules/webauthn-prf-key-derivation-standard-webauthn-level-3-782?format=cursor","windsurf":"/api/rules/webauthn-prf-key-derivation-standard-webauthn-level-3-782?format=windsurf","agents":"/api/rules/webauthn-prf-key-derivation-standard-webauthn-level-3-782?format=agents"}},{"id":"axum-streaming-backpressure-abort-on-drop","title":"Axum 0.8 Streaming Body Backpressure & Tokio AbortOnDrop Guardrail","category":"backend","severity":"critical","description":"Enforces strict drop guards and backpressure on asynchronous request and response streams in Axum 0.8. Prevents orphaned background producer tasks and unbounded heap allocation when client TCP sockets terminate mid-flight by requiring RAII abort handles and bounded channel synchronization.","antiPatternHeadline":"Spawning detached stream producers without AbortOnDrop handles and bounded channel backpressure","stars_count":61,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tokio","concurrency","memory-leak"],"exportEndpoints":{"claude":"/api/rules/axum-streaming-backpressure-abort-on-drop?format=claude","cursorMdc":"/api/rules/axum-streaming-backpressure-abort-on-drop?format=mdc","cursorrules":"/api/rules/axum-streaming-backpressure-abort-on-drop?format=cursor","windsurf":"/api/rules/axum-streaming-backpressure-abort-on-drop?format=windsurf","agents":"/api/rules/axum-streaming-backpressure-abort-on-drop?format=agents"}},{"id":"react-19-activity-offscreen-cache-isolation-invariant","title":"React 19 Activity API Offscreen Component Cache Isolation Invariant","category":"frontend","severity":"critical","description":"Enforces strict cache isolation and deferred execution for backgrounded UI trees managed by React 19 Activity (<Activity mode=\"hidden\">). Prevents active layout recalculation, uncontrolled microtask execution, and un-deferred asynchronous state dispatches that induce frame drop and layout thrashing upon component restoration.","antiPatternHeadline":"Executing unthrottled DOM measurements and non-deferred microtask state updates inside hidden Activity boundaries.","stars_count":113,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","activity-api","performance","offscreen-rendering","concurrency"],"exportEndpoints":{"claude":"/api/rules/react-19-activity-offscreen-cache-isolation-invariant?format=claude","cursorMdc":"/api/rules/react-19-activity-offscreen-cache-isolation-invariant?format=mdc","cursorrules":"/api/rules/react-19-activity-offscreen-cache-isolation-invariant?format=cursor","windsurf":"/api/rules/react-19-activity-offscreen-cache-isolation-invariant?format=windsurf","agents":"/api/rules/react-19-activity-offscreen-cache-isolation-invariant?format=agents"}},{"id":"kmp-swift-export-arc-boundary-invariant","title":"Kotlin Multiplatform Swift-Export ARC Memory Boundary Invariant","category":"mobile","severity":"critical","description":"Enforces strict ownership, weak listener delegation, and explicit lifetime management across the Swift ARC and Kotlin/Native Garbage Collector boundary. Prevents invisible cross-runtime retain cycles that neither Swift ARC nor Kotlin GC can collect autonomously. Guarantees deterministic resource teardown without leaking Native/Swift bridge proxy stubs.","antiPatternHeadline":"Bidirectional Retain Cycles Across Cross-Runtime FFI Boundaries Causing Permanent Memory Leaks","stars_count":95,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kmp","swift-export","kotlin-native","arc","memory-management","ios"],"exportEndpoints":{"claude":"/api/rules/kmp-swift-export-arc-boundary-invariant?format=claude","cursorMdc":"/api/rules/kmp-swift-export-arc-boundary-invariant?format=mdc","cursorrules":"/api/rules/kmp-swift-export-arc-boundary-invariant?format=cursor","windsurf":"/api/rules/kmp-swift-export-arc-boundary-invariant?format=windsurf","agents":"/api/rules/kmp-swift-export-arc-boundary-invariant?format=agents"}},{"id":"postgres-17-direct-io-alignment-buffer-concurrency","title":"Postgres 17 Direct I/O 4KB Memory-Page Alignment & Buffer Concurrency Invariant","category":"backend","severity":"critical","description":"Enforces strict 4096-byte memory page alignment, block-boundary file offsets, and strict buffer lifecycle pinning for PostgreSQL 17 direct I/O (io_direct) and asynchronous storage pipelines. Bypassing OS page cache via Direct I/O requires zero-copy kernel alignment and completion synchronization; violation causes immediate EINVAL panics, double-buffering latency regressions, and torn page corruptions under write saturation.","antiPatternHeadline":"Submitting Unaligned Buffers or Releasing Concurrency Locks Prior to Direct I/O Completion","stars_count":69,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres17","direct-io","buffer-pool","memory-alignment","concurrency"],"exportEndpoints":{"claude":"/api/rules/postgres-17-direct-io-alignment-buffer-concurrency?format=claude","cursorMdc":"/api/rules/postgres-17-direct-io-alignment-buffer-concurrency?format=mdc","cursorrules":"/api/rules/postgres-17-direct-io-alignment-buffer-concurrency?format=cursor","windsurf":"/api/rules/postgres-17-direct-io-alignment-buffer-concurrency?format=windsurf","agents":"/api/rules/postgres-17-direct-io-alignment-buffer-concurrency?format=agents"}},{"id":"cilium-ebpf-socket-l7-zerotrust-mtls-guardrail","title":"Cilium eBPF Socket-Layer L7 Zero-Trust Mutual TLS Guardrail","category":"devops","severity":"critical","description":"Enforces kernel-level L7 protocol inspection and cryptographic workload identity verification via Cilium eBPF sockmap acceleration and delegated mTLS handshakes. Precludes userspace sidecar overhead and eliminates cleartext socket bypass vulnerabilities by requiring strict SPIFFE-backed identity assertions in all ingress and egress policies.","antiPatternHeadline":"Bypassing Kernel Cryptographic Identity Attestation or Injecting Redundant Sidecars over eBPF Sockmaps","stars_count":89,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","cilium","ebpf","mtls","zero-trust","kubernetes","security"],"exportEndpoints":{"claude":"/api/rules/cilium-ebpf-socket-l7-zerotrust-mtls-guardrail?format=claude","cursorMdc":"/api/rules/cilium-ebpf-socket-l7-zerotrust-mtls-guardrail?format=mdc","cursorrules":"/api/rules/cilium-ebpf-socket-l7-zerotrust-mtls-guardrail?format=cursor","windsurf":"/api/rules/cilium-ebpf-socket-l7-zerotrust-mtls-guardrail?format=windsurf","agents":"/api/rules/cilium-ebpf-socket-l7-zerotrust-mtls-guardrail?format=agents"}},{"id":"fastapi-lifespan-anyio-taskgroup-cancellation-invariant","title":"FastAPI Lifespan AnyIO TaskGroup Cancellation Invariant","category":"backend","severity":"critical","description":"Enforces that all persistent connection pools, background consumer coroutines, and polling loops in FastAPI applications are strictly bound to an AnyIO TaskGroup governed by the application's lifespan context. This prevents orphaned background tasks and hung worker threads when receiving SIGTERM signals during Kubernetes pod eviction and graceful shutdown sequences.","antiPatternHeadline":"Orphaning Unbounded Background Coroutines via asyncio.create_task Outside Lifespan TaskGroups","stars_count":62,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","anyio","asyncio","kubernetes","concurrency"],"exportEndpoints":{"claude":"/api/rules/fastapi-lifespan-anyio-taskgroup-cancellation-invariant?format=claude","cursorMdc":"/api/rules/fastapi-lifespan-anyio-taskgroup-cancellation-invariant?format=mdc","cursorrules":"/api/rules/fastapi-lifespan-anyio-taskgroup-cancellation-invariant?format=cursor","windsurf":"/api/rules/fastapi-lifespan-anyio-taskgroup-cancellation-invariant?format=windsurf","agents":"/api/rules/fastapi-lifespan-anyio-taskgroup-cancellation-invariant?format=agents"}},{"id":"openfga-atomic-conditional-tuple-write-guardrail","title":"OpenFGA Atomic Conditional Tuple Write Guardrail for Distributed ReBAC Consistency","category":"security","severity":"critical","description":"Enforces atomic compare-and-swap (CAS) semantics via conditional tuple writes during OpenFGA relationship updates. Unconditional reads followed by writes across distributed microservices introduce time-of-check to time-of-use (TOCTOU) race conditions, resulting in authorization bypass, privilege leakages, and state corruption. All write operations mutating role assignments or resource hierarchies must evaluate preconditions and context assertions atomically within a transactional boundary or conditional write contract.","antiPatternHeadline":"Blind Unconditional Overwrites and Read-Then-Write TOCTOU Race Conditions in OpenFGA Tuples","stars_count":79,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","rebac","concurrency","distributed-systems","authorization"],"exportEndpoints":{"claude":"/api/rules/openfga-atomic-conditional-tuple-write-guardrail?format=claude","cursorMdc":"/api/rules/openfga-atomic-conditional-tuple-write-guardrail?format=mdc","cursorrules":"/api/rules/openfga-atomic-conditional-tuple-write-guardrail?format=cursor","windsurf":"/api/rules/openfga-atomic-conditional-tuple-write-guardrail?format=windsurf","agents":"/api/rules/openfga-atomic-conditional-tuple-write-guardrail?format=agents"}},{"id":"bun-websocket-kernel-backpressure-guardrail-bun-1-2-websocke-844","title":"Bun 1.2 WebSocket Kernel-Buffer Auto-Pipelining Backpressure Guardrail","category":"backend","severity":"critical","description":"Mandates proactive backpressure mitigation using ws.bufferedAmount, the drain lifecycle handler, and explicit outbound drop/pause policies on Bun WebSockets. Prevents catastrophic event-loop heap exhaustion and process termination caused by unbounded TCP write buffer accumulation on slow consumer connections.","antiPatternHeadline":"Unbounded ws.send() Fire-and-Forget Loops Saturating OS Kernel Buffers and Triggering OOM Crashing","stars_count":113,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","websockets","backpressure","concurrency","performance"],"exportEndpoints":{"claude":"/api/rules/bun-websocket-kernel-backpressure-guardrail-bun-1-2-websocke-844?format=claude","cursorMdc":"/api/rules/bun-websocket-kernel-backpressure-guardrail-bun-1-2-websocke-844?format=mdc","cursorrules":"/api/rules/bun-websocket-kernel-backpressure-guardrail-bun-1-2-websocke-844?format=cursor","windsurf":"/api/rules/bun-websocket-kernel-backpressure-guardrail-bun-1-2-websocke-844?format=windsurf","agents":"/api/rules/bun-websocket-kernel-backpressure-guardrail-bun-1-2-websocke-844?format=agents"}},{"id":"capacitor-7-background-task-lifecycle-interlock","title":"Capacitor 7 Background Task Execution Window & Watchdog Lifecycle Interlock","category":"mobile","severity":"critical","description":"Coordinates strict hardware watchdog timers and OS budget limits for Capacitor 7 native background workers. Mandates preemptive AbortController timeouts, incremental atomic state checkpointing, and guaranteed taskId completion to prevent sudden OS termination (SIGKILL) and execution budget throttling.","antiPatternHeadline":"Unbounded background async loops without watchdog timeouts or guaranteed task completion tokens.","stars_count":106,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","background-tasks","ios","android","lifecycle"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-background-task-lifecycle-interlock?format=claude","cursorMdc":"/api/rules/capacitor-7-background-task-lifecycle-interlock?format=mdc","cursorrules":"/api/rules/capacitor-7-background-task-lifecycle-interlock?format=cursor","windsurf":"/api/rules/capacitor-7-background-task-lifecycle-interlock?format=windsurf","agents":"/api/rules/capacitor-7-background-task-lifecycle-interlock?format=agents"}},{"id":"openfga-monotonic-snapshot-consistency-invariant","title":"OpenFGA Monotonic Snapshot Read-After-Write Consistency Invariant","category":"security","severity":"critical","description":"Guarantees zero-stale authorization evaluations across distributed ReBAC topologies by enforcing monotonic Zanzibar zookie checkpoint propagation on all mutation paths. Prevents authorization bypass anomalies caused by evaluating permissions against out-of-order or stale read replicas following relational tuple writes. Mandates contextual snapshot token capture, transactional session propagation, and strict consistency token verification on all post-write Check evaluations.","antiPatternHeadline":"Executing OpenFGA Check API Calls Without Monotonic Consistency Tokens Post-Mutation","stars_count":105,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","rebac","zanzibar","authorization","read-after-write","distributed-systems"],"exportEndpoints":{"claude":"/api/rules/openfga-monotonic-snapshot-consistency-invariant?format=claude","cursorMdc":"/api/rules/openfga-monotonic-snapshot-consistency-invariant?format=mdc","cursorrules":"/api/rules/openfga-monotonic-snapshot-consistency-invariant?format=cursor","windsurf":"/api/rules/openfga-monotonic-snapshot-consistency-invariant?format=windsurf","agents":"/api/rules/openfga-monotonic-snapshot-consistency-invariant?format=agents"}},{"id":"react-19-server-action-idempotency-key-guardrail-react-19-server--219","title":"React 19 Server Action Idempotency-Key Mutation Guardrail","category":"frontend","severity":"critical","description":"Enforces strict idempotency guarantees across React 19 Server Actions by binding state mutations to cryptographically unique or client-scoped deterministic transaction keys. Prevents double-submit races, distributed side-effect amplification, and database divergence during optimistic updates, transitions, and network retries.","antiPatternHeadline":"Unbounded Server Action Mutations Without Idempotency Scopes Causing Duplicate Side-Effects","stars_count":102,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","server-actions","idempotency","distributed-systems","nextjs"],"exportEndpoints":{"claude":"/api/rules/react-19-server-action-idempotency-key-guardrail-react-19-server--219?format=claude","cursorMdc":"/api/rules/react-19-server-action-idempotency-key-guardrail-react-19-server--219?format=mdc","cursorrules":"/api/rules/react-19-server-action-idempotency-key-guardrail-react-19-server--219?format=cursor","windsurf":"/api/rules/react-19-server-action-idempotency-key-guardrail-react-19-server--219?format=windsurf","agents":"/api/rules/react-19-server-action-idempotency-key-guardrail-react-19-server--219?format=agents"}},{"id":"axum-tower-gcra-rate-limiting-degradation","title":"Axum 0.8 Tower GCRA Rate-Limiting Degradation Standard","category":"backend","severity":"critical","description":"Maintains deterministic sub-millisecond tail latency under traffic surges by decoupling distributed rate-limiting from hot request paths. The system mandates a circuit-broken fallback from Redis-backed Generic Cell Rate Algorithm (GCRA) counters to lock-free in-memory atomic token buckets whenever Redis latency exceeds deadlines or encounters connection pool saturation.","antiPatternHeadline":"Synchronously Awaiting Redis GCRA State in Tower Middleware Without Hard Latency Budgets or In-Memory Degradation","stars_count":76,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tower","rate-limiting","gcra","resilience"],"exportEndpoints":{"claude":"/api/rules/axum-tower-gcra-rate-limiting-degradation?format=claude","cursorMdc":"/api/rules/axum-tower-gcra-rate-limiting-degradation?format=mdc","cursorrules":"/api/rules/axum-tower-gcra-rate-limiting-degradation?format=cursor","windsurf":"/api/rules/axum-tower-gcra-rate-limiting-degradation?format=windsurf","agents":"/api/rules/axum-tower-gcra-rate-limiting-degradation?format=agents"}},{"id":"tetragon-ebpf-process-namespace-enforcement","title":"Cilium Tetragon eBPF In-Kernel Namespace Attestation and SIGKILL Enforcement","category":"devops","severity":"critical","description":"Enforces synchronous, in-kernel execution control using Cilium Tetragon TracingPolicies to prevent arbitrary code execution within container namespaces. Mandates the use of eBPF kprobes on sys_execve with kernel-level Sigkill actions to terminate unauthorized binaries before userspace syscall completion, eliminating post-exploitation race windows.","antiPatternHeadline":"Post-execution audit logging without in-kernel synchronous Sigkill enforcement","stars_count":55,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","tetragon","cilium","kubernetes","zero-trust","linux-security"],"exportEndpoints":{"claude":"/api/rules/tetragon-ebpf-process-namespace-enforcement?format=claude","cursorMdc":"/api/rules/tetragon-ebpf-process-namespace-enforcement?format=mdc","cursorrules":"/api/rules/tetragon-ebpf-process-namespace-enforcement?format=cursor","windsurf":"/api/rules/tetragon-ebpf-process-namespace-enforcement?format=windsurf","agents":"/api/rules/tetragon-ebpf-process-namespace-enforcement?format=agents"}},{"id":"capacitor7-hardware-biometric-session-invalidation","title":"Capacitor 7 Hardware-Bound Biometric Session Invalidation Invariant","category":"mobile","severity":"critical","description":"Eliminates token hijacking and persistent session leakage in hybrid runtimes by tying WebView session persistence directly to Secure Enclave and Android StrongBox cryptographic key lifecycles. Mandates that authentication tokens stored across the bridge are encrypted with hardware-backed keys configured to invalidate immediately upon biometric enrollment changes or OS-level credential revocation.","antiPatternHeadline":"Persisting Raw Bearer Tokens in WebView LocalStorage or Unbound Keychains Vulnerable to Extraction and Biometric Re-enrollment Hijacking","stars_count":104,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor7","security","biometrics","secure-enclave","strongbox","cryptography"],"exportEndpoints":{"claude":"/api/rules/capacitor7-hardware-biometric-session-invalidation?format=claude","cursorMdc":"/api/rules/capacitor7-hardware-biometric-session-invalidation?format=mdc","cursorrules":"/api/rules/capacitor7-hardware-biometric-session-invalidation?format=cursor","windsurf":"/api/rules/capacitor7-hardware-biometric-session-invalidation?format=windsurf","agents":"/api/rules/capacitor7-hardware-biometric-session-invalidation?format=agents"}},{"id":"bun-ffi-zerocopy-buffer-isolation-boundary","title":"Bun 1.2 FFI Zero-Copy Buffer Isolation Boundary and Lifetime Invariant","category":"backend","severity":"critical","description":"Mandates strict ownership demarcation, deterministic lifecycle tracking, and memory pinning boundaries when streaming binary frames between native C/Rust extensions and Bun 1.2 TypedArrays via bun:ffi. Prevents use-after-free, double-free, and cross-tick memory corruption caused by V8/JSC GC movements or premature deallocations of unmanaged native backing stores.","antiPatternHeadline":"Retaining Raw Zero-Copy FFI ArrayBuffers Across Asynchronous Boundaries Without Pinned Lifecycles","stars_count":54,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","ffi","memory-safety","zero-copy","systems-programming"],"exportEndpoints":{"claude":"/api/rules/bun-ffi-zerocopy-buffer-isolation-boundary?format=claude","cursorMdc":"/api/rules/bun-ffi-zerocopy-buffer-isolation-boundary?format=mdc","cursorrules":"/api/rules/bun-ffi-zerocopy-buffer-isolation-boundary?format=cursor","windsurf":"/api/rules/bun-ffi-zerocopy-buffer-isolation-boundary?format=windsurf","agents":"/api/rules/bun-ffi-zerocopy-buffer-isolation-boundary?format=agents"}},{"id":"otel-w3c-baggage-dynamic-redaction-standard","title":"OpenTelemetry W3C Baggage Dynamic Redaction & Context Ingress Standard","category":"devops","severity":"critical","description":"Enforces strict PII filtering, cryptographically secure hash masking, and allowlist validation on W3C Baggage headers at distributed ingress boundaries prior to trace context propagation. Prevents accidental data exfiltration and compliance violations across distributed service meshes caused by unvetted downstream context propagation.","antiPatternHeadline":"Blind Context Propagation of Raw Ingress Baggage Headers into Downstream Distributed Calls","stars_count":48,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","distributed-tracing","pii-redaction","w3c-baggage","security"],"exportEndpoints":{"claude":"/api/rules/otel-w3c-baggage-dynamic-redaction-standard?format=claude","cursorMdc":"/api/rules/otel-w3c-baggage-dynamic-redaction-standard?format=mdc","cursorrules":"/api/rules/otel-w3c-baggage-dynamic-redaction-standard?format=cursor","windsurf":"/api/rules/otel-w3c-baggage-dynamic-redaction-standard?format=windsurf","agents":"/api/rules/otel-w3c-baggage-dynamic-redaction-standard?format=agents"}},{"id":"svelte5-rune-sharedarraybuffer-worker-offload","title":"Svelte 5 Rune State Offloading via SharedArrayBuffer & Atomics Invariants","category":"frontend","severity":"critical","description":"Enforces non-blocking high-frequency compute graphs by isolating CPU-intensive operations into dedicated Web Workers synchronized across a SharedArrayBuffer. Mandates Svelte 5 fine-grained $state reactivity bound strictly via microtask-coalesced TypedArray views, preventing UI micro-stutters, race conditions, and uncoordinated atomic writes.","antiPatternHeadline":"Mutating Svelte 5 Runes Directly in Worker Callbacks or Calling Structured Clone PostMessage on High-Frequency Compute Frames","stars_count":52,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","web-workers","sharedarraybuffer","atomics","performance"],"exportEndpoints":{"claude":"/api/rules/svelte5-rune-sharedarraybuffer-worker-offload?format=claude","cursorMdc":"/api/rules/svelte5-rune-sharedarraybuffer-worker-offload?format=mdc","cursorrules":"/api/rules/svelte5-rune-sharedarraybuffer-worker-offload?format=cursor","windsurf":"/api/rules/svelte5-rune-sharedarraybuffer-worker-offload?format=windsurf","agents":"/api/rules/svelte5-rune-sharedarraybuffer-worker-offload?format=agents"}},{"id":"webauthn-conditional-mediation-nonce-boundary","title":"WebAuthn Conditional Mediation Cross-Origin Nonce Attestation Boundary","category":"security","severity":"critical","description":"Enforces strict cryptographic coupling of server-issued challenge nonces to client transport bindings and canonical relying party origins during WebAuthn conditional mediation (autofill). Prevents passkey replay, cross-origin assertion injection, and passkey phishing across embedded frames or shared origin boundaries.","antiPatternHeadline":"Decoupled Challenge Verification and Permissive Origin Matching in Autofill Passkey Assertions","stars_count":93,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","fido2","passkeys","authentication","cryptography"],"exportEndpoints":{"claude":"/api/rules/webauthn-conditional-mediation-nonce-boundary?format=claude","cursorMdc":"/api/rules/webauthn-conditional-mediation-nonce-boundary?format=mdc","cursorrules":"/api/rules/webauthn-conditional-mediation-nonce-boundary?format=cursor","windsurf":"/api/rules/webauthn-conditional-mediation-nonce-boundary?format=windsurf","agents":"/api/rules/webauthn-conditional-mediation-nonce-boundary?format=agents"}},{"id":"axum-0-8-adaptive-concurrency-shedding-invariant","title":"Axum 0.8 Adaptive Concurrency Shedding via Dynamic Latency Telemetry","category":"backend","severity":"critical","description":"Enforces dynamic, TCP/RTT-telemetry-driven concurrency limits within Axum 0.8 microservices to replace rigid static concurrency caps. Prevents catastrophic cascading failures and thread starvation caused by distributed tail-latency spikes and queuing delays governed by Little's Law. Ensures backpressure manifests as instantaneous HTTP 503 load-shed responses with zero-allocation drops rather than unbounded heap growth or socket pileups.","antiPatternHeadline":"Static Concurrency Caps and Unbounded Tower Buffering Inducing Latency Cascades","stars_count":86,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tower","concurrency","load-shedding","systems-resilience"],"exportEndpoints":{"claude":"/api/rules/axum-0-8-adaptive-concurrency-shedding-invariant?format=claude","cursorMdc":"/api/rules/axum-0-8-adaptive-concurrency-shedding-invariant?format=mdc","cursorrules":"/api/rules/axum-0-8-adaptive-concurrency-shedding-invariant?format=cursor","windsurf":"/api/rules/axum-0-8-adaptive-concurrency-shedding-invariant?format=windsurf","agents":"/api/rules/axum-0-8-adaptive-concurrency-shedding-invariant?format=agents"}},{"id":"nextjs-15-dynamic-io-secret-tainting-standard","title":"Next.js 15 Dynamic IO Server Secret Tainting and Build Shell Isolation Standard","category":"frontend","severity":"critical","description":"Enforces strict compile-time and runtime boundary fencing to guarantee tenant-scoped cryptographic secrets, private keys, and authorization credentials are never accidentally embedded into pre-rendered static shells during Next.js 15 Dynamic IO builds. Leverages React Server Component object tainting ('experimental_taintUniqueValue' and 'experimental_taintObjectReference') alongside the dynamicIO flag to block secret leakage across serialization boundaries. Mandates deterministic dynamic scope tagging whenever tenant-scoped data or secrets are accessed.","antiPatternHeadline":"Leaking Raw Tenant Keys into Pre-rendered Prerender Shells via Untainted RSC Props under Dynamic IO","stars_count":45,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs15","dynamic-io","secret-tainting","rsc","security"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-dynamic-io-secret-tainting-standard?format=claude","cursorMdc":"/api/rules/nextjs-15-dynamic-io-secret-tainting-standard?format=mdc","cursorrules":"/api/rules/nextjs-15-dynamic-io-secret-tainting-standard?format=cursor","windsurf":"/api/rules/nextjs-15-dynamic-io-secret-tainting-standard?format=windsurf","agents":"/api/rules/nextjs-15-dynamic-io-secret-tainting-standard?format=agents"}},{"id":"webauthn-l3-prf-hardware-key-derivation-standard","title":"WebAuthn Level 3 PRF Hardware-Enforced Root Key Derivation","category":"security","severity":"critical","description":"Enforces hardware-backed deterministic root key derivation via the WebAuthn Level 3 PRF (Pseudo-Random Function) extension for zero-knowledge client-side storage encryption. Mandates strict client-side negotiation verification, user-verification enforcement, ephemeral in-memory lifecycle bounds, and mandatory HKDF domain separation prior to operational key generation.","antiPatternHeadline":"Deriving Storage Encryption Keys via Software KDFs or Caching Raw PRF Secrets in Insecure Storage","stars_count":93,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","prf-extension","hardware-security","cryptography","zero-knowledge","hkdf"],"exportEndpoints":{"claude":"/api/rules/webauthn-l3-prf-hardware-key-derivation-standard?format=claude","cursorMdc":"/api/rules/webauthn-l3-prf-hardware-key-derivation-standard?format=mdc","cursorrules":"/api/rules/webauthn-l3-prf-hardware-key-derivation-standard?format=cursor","windsurf":"/api/rules/webauthn-l3-prf-hardware-key-derivation-standard?format=windsurf","agents":"/api/rules/webauthn-l3-prf-hardware-key-derivation-standard?format=agents"}},{"id":"capacitor-7-isolated-bridge-guardrail-production-standard","title":"Capacitor 7 Native Bridge Isolation and Prototype Pollution Guardrail","category":"mobile","severity":"critical","description":"Enforces strict runtime isolation, deep immutability, and prototype sanitation on Capacitor 7 native bridge interfaces inside hybrid WebViews. Restricts untrusted third-party scripts from hijacking bridge dispatchers or polluting Object prototypes to escalate privileges into native device capabilities.","antiPatternHeadline":"Exposing Mutable Native Bridge Handlers and Unsanitized Plugin Registries to Untrusted WebView Execution Contexts","stars_count":50,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","webview","security","prototype-pollution"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-isolated-bridge-guardrail-production-standard?format=claude","cursorMdc":"/api/rules/capacitor-7-isolated-bridge-guardrail-production-standard?format=mdc","cursorrules":"/api/rules/capacitor-7-isolated-bridge-guardrail-production-standard?format=cursor","windsurf":"/api/rules/capacitor-7-isolated-bridge-guardrail-production-standard?format=windsurf","agents":"/api/rules/capacitor-7-isolated-bridge-guardrail-production-standard?format=agents"}},{"id":"k8s-gateway-api-backend-tls-policy-pod-verification","title":"Kubernetes Gateway API BackendTLSPolicy Cryptographic Pod Verification Invariant","category":"devops","severity":"critical","description":"Enforces strict end-to-end cryptographic verification between Kubernetes Gateway API implementations and downstream Pod workloads using BackendTLSPolicy. Mandates explicit subject alternative name (SAN) hostname validation, ConfigMap-anchored Certificate Authority trust chains, and prevents unencrypted transit hops across container network interfaces (CNI) in zero-trust architectures.","antiPatternHeadline":"Cleartext Service-to-Pod Transit or Insecure Skip-Verify TLS Configurations in Gateway API Topologies","stars_count":119,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","kubernetes","gateway-api","tls","zero-trust","security"],"exportEndpoints":{"claude":"/api/rules/k8s-gateway-api-backend-tls-policy-pod-verification?format=claude","cursorMdc":"/api/rules/k8s-gateway-api-backend-tls-policy-pod-verification?format=mdc","cursorrules":"/api/rules/k8s-gateway-api-backend-tls-policy-pod-verification?format=cursor","windsurf":"/api/rules/k8s-gateway-api-backend-tls-policy-pod-verification?format=windsurf","agents":"/api/rules/k8s-gateway-api-backend-tls-policy-pod-verification?format=agents"}},{"id":"bun-sqlite-wal-sigterm-barrier-guardrail","title":"Bun 1.2 Embedded SQLite WAL Checkpoint SIGTERM Barrier","category":"backend","severity":"critical","description":"Enforces deterministic PRAGMA wal_checkpoint(TRUNCATE) execution and explicit shared-memory (.shm) unmapping prior to process termination in containerized Bun runtimes. Failure to complete checkpoint barriers during SIGTERM/SIGINT teardowns leaves SQLite database files in an unrecovered recovery-journal state, causing lock collisions or index corruption upon rapid container restarts. This guardrail mandates an idempotent teardown lifecycle with strict synchronous execution timeouts.","antiPatternHeadline":"Uncoordinated process termination leaving uncheckpointed SQLite WAL rings and unclosed file descriptors","stars_count":92,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","sqlite","wal-mode","process-lifecycle","containerization"],"exportEndpoints":{"claude":"/api/rules/bun-sqlite-wal-sigterm-barrier-guardrail?format=claude","cursorMdc":"/api/rules/bun-sqlite-wal-sigterm-barrier-guardrail?format=mdc","cursorrules":"/api/rules/bun-sqlite-wal-sigterm-barrier-guardrail?format=cursor","windsurf":"/api/rules/bun-sqlite-wal-sigterm-barrier-guardrail?format=windsurf","agents":"/api/rules/bun-sqlite-wal-sigterm-barrier-guardrail?format=agents"}},{"id":"otel-ebpf-profiling-overhead-throttling-standard","title":"OpenTelemetry eBPF Continuous Profiling Dynamic Overhead Throttling Standard","category":"devops","severity":"critical","description":"Enforces dynamic, feedback-loop sample-rate decay and kernel unwinding bypasses when OpenTelemetry continuous profiling agent host CPU overhead breaches 1.5%. Mitigates hypervisor steal and Completely Fair Scheduler (CFS) quota throttling on production Kubernetes nodes under heavy thread contention.","antiPatternHeadline":"Static high-frequency eBPF stack unwinding triggering CFS quota starvation and hypervisor-level CPU throttling","stars_count":44,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","opentelemetry","continuous-profiling","kernel-observability","cgroup-throttling"],"exportEndpoints":{"claude":"/api/rules/otel-ebpf-profiling-overhead-throttling-standard?format=claude","cursorMdc":"/api/rules/otel-ebpf-profiling-overhead-throttling-standard?format=mdc","cursorrules":"/api/rules/otel-ebpf-profiling-overhead-throttling-standard?format=cursor","windsurf":"/api/rules/otel-ebpf-profiling-overhead-throttling-standard?format=windsurf","agents":"/api/rules/otel-ebpf-profiling-overhead-throttling-standard?format=agents"}},{"id":"mlkem-hybrid-pqc-tls13-key-exchange-invariant","title":"Mandatory ML-KEM-768 Hybrid Post-Quantum Key Exchange for TLS 1.3 Ingress Terminations","category":"security","severity":"critical","description":"Enforces hybrid post-quantum key encapsulation mechanism (X25519MLKEM768 / Kyber768 hybrid) on all TLS 1.3 edge ingress and internal service mesh termination endpoints. Prevents harvest-now-decrypt-later (HNDL) attacks by quantum-adversaries while maintaining classical elliptic curve fallback robustness across edge listeners and downstream clients. Restricts cryptographic cipher suites exclusively to TLS 1.3 primitives and mandates post-quantum curve negotiation ordering.","antiPatternHeadline":"Classical-Only Curve Selection or Insecure TLS Protocol Fallback Permitting Harvest-Now-Decrypt-Later Interception","stars_count":50,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","post-quantum-cryptography","pqc","tls-1.3","ml-kem","infrastructure-security"],"exportEndpoints":{"claude":"/api/rules/mlkem-hybrid-pqc-tls13-key-exchange-invariant?format=claude","cursorMdc":"/api/rules/mlkem-hybrid-pqc-tls13-key-exchange-invariant?format=mdc","cursorrules":"/api/rules/mlkem-hybrid-pqc-tls13-key-exchange-invariant?format=cursor","windsurf":"/api/rules/mlkem-hybrid-pqc-tls13-key-exchange-invariant?format=windsurf","agents":"/api/rules/mlkem-hybrid-pqc-tls13-key-exchange-invariant?format=agents"}},{"id":"nextjs15-ppr-dynamic-boundary-isolation","title":"Next.js 15 PPR Dynamic Boundary Isolation and Session Leak Prevention","category":"frontend","severity":"critical","description":"Enforces strict isolation of dynamic runtime functions (cookies, headers, searchParams) inside explicit React Suspense boundaries under Next.js 15 Partial Prerendering (PPR). Prevents dynamic user-session data and personalization tokens from prematurely de-opting static prerender shells or bleeding into edge-cached static distribution layers during streaming hydration.","antiPatternHeadline":"Unwrapped Dynamic Hook Invocation Leaking Personalized State into Prerendered Static Shells","stars_count":102,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs15","ppr","react-server-components","suspense","edge-cache","security"],"exportEndpoints":{"claude":"/api/rules/nextjs15-ppr-dynamic-boundary-isolation?format=claude","cursorMdc":"/api/rules/nextjs15-ppr-dynamic-boundary-isolation?format=mdc","cursorrules":"/api/rules/nextjs15-ppr-dynamic-boundary-isolation?format=cursor","windsurf":"/api/rules/nextjs15-ppr-dynamic-boundary-isolation?format=windsurf","agents":"/api/rules/nextjs15-ppr-dynamic-boundary-isolation?format=agents"}},{"id":"vite6-cross-realm-prototype-isolation","title":"Vite 6 Environment API Cross-Realm Prototype Isolation & Scope Boundary Standard","category":"frontend","severity":"critical","description":"Enforces strict prototype isolation and cross-realm defensive boundaries when executing multiple SSR microfrontend islands using the Vite 6 Environment API. Prevents runtime cross-contamination, memory leaks across HMR cycles, and prototype pollution caused by shared global intrinsics.","antiPatternHeadline":"Mutating Shared Global Intrinsics or Exchanging Raw Uncloned Objects Across Vite 6 Environment Boundaries","stars_count":71,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","vite6","ssr","microfrontends","environment-api","prototype-pollution","v8-realms"],"exportEndpoints":{"claude":"/api/rules/vite6-cross-realm-prototype-isolation?format=claude","cursorMdc":"/api/rules/vite6-cross-realm-prototype-isolation?format=mdc","cursorrules":"/api/rules/vite6-cross-realm-prototype-isolation?format=cursor","windsurf":"/api/rules/vite6-cross-realm-prototype-isolation?format=windsurf","agents":"/api/rules/vite6-cross-realm-prototype-isolation?format=agents"}},{"id":"pg17-synchronized-replication-slots-zero-rpo","title":"Postgres 17 Failover-Enabled Logical Replication Slots for Distributed Outbox Zero-RPO","category":"backend","severity":"critical","description":"Mandates explicit failover synchronization on logical replication slots introduced in PostgreSQL 17 for transactional outbox and CDC event engines. Ensures promoted physical standbys inherit accurate consumer LSN positions, preventing downstream event duplicate storms and replication gap data loss during automated multi-region failovers.","antiPatternHeadline":"Legacy Slot Provisioning Without Failover Sync Causing Catastrophic Event Replay Storms Upon Standby Promotion","stars_count":48,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres-17","logical-replication","transactional-outbox","zero-rpo","high-availability"],"exportEndpoints":{"claude":"/api/rules/pg17-synchronized-replication-slots-zero-rpo?format=claude","cursorMdc":"/api/rules/pg17-synchronized-replication-slots-zero-rpo?format=mdc","cursorrules":"/api/rules/pg17-synchronized-replication-slots-zero-rpo?format=cursor","windsurf":"/api/rules/pg17-synchronized-replication-slots-zero-rpo?format=windsurf","agents":"/api/rules/pg17-synchronized-replication-slots-zero-rpo?format=agents"}},{"id":"go-chi-push-iterator-stream-resilience","title":"Deterministic Resource and Goroutine Teardown in Go 1.23+ Push Iterators over Chi Streams","category":"backend","severity":"critical","description":"Enforces deterministic cancellation and resource release when streaming data over HTTP/2 using Go 1.23+ range-over-func iterators (iter.Seq / iter.Seq2) in Chi handlers. Requires tight coupling of the request context (r.Context()) and iterator yield return values to prevent goroutine leaks, orphaned database cursors, and socket deadlocks upon sudden client disconnection.","antiPatternHeadline":"Ignoring iterator yield boolean status and context cancellation during HTTP streaming, causing persistent database connection leakage and orphaned background worker goroutines.","stars_count":90,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","chi","iterators","streaming","goroutine-leak","database"],"exportEndpoints":{"claude":"/api/rules/go-chi-push-iterator-stream-resilience?format=claude","cursorMdc":"/api/rules/go-chi-push-iterator-stream-resilience?format=mdc","cursorrules":"/api/rules/go-chi-push-iterator-stream-resilience?format=cursor","windsurf":"/api/rules/go-chi-push-iterator-stream-resilience?format=windsurf","agents":"/api/rules/go-chi-push-iterator-stream-resilience?format=agents"}},{"id":"kmp-2-1-strict-coroutine-confinement-standard","title":"KMP 2.1 Coroutine Confinement and Cross-Platform Memory Boundary Enforcement","category":"mobile","severity":"critical","description":"Enforces strict thread-isolated mutable state boundaries across Darwin Grand Central Dispatch (GCD) queues and Android thread pools in Kotlin Multiplatform 2.1+. Prevents multi-threaded native memory leaks, unconfined Obj-C/Kotlin retain cycles, and cross-thread access race conditions by mandating serial dispatcher confinement and immutable boundary projection.","antiPatternHeadline":"Mutating Shared State Across Unconfined Dispatchers and Leaking Native Object References Through Coroutine Captures","stars_count":62,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","coroutines","darwin-gc","concurrency","memory-leak"],"exportEndpoints":{"claude":"/api/rules/kmp-2-1-strict-coroutine-confinement-standard?format=claude","cursorMdc":"/api/rules/kmp-2-1-strict-coroutine-confinement-standard?format=mdc","cursorrules":"/api/rules/kmp-2-1-strict-coroutine-confinement-standard?format=cursor","windsurf":"/api/rules/kmp-2-1-strict-coroutine-confinement-standard?format=windsurf","agents":"/api/rules/kmp-2-1-strict-coroutine-confinement-standard?format=agents"}},{"id":"capacitor-7-strict-native-bridge-sandboxing","title":"Capacitor 7 Strict Native Bridge Sandboxing and Origin-Capability Isolation","category":"mobile","severity":"critical","description":"Enforces strict origin-capability tagging and execution boundaries on the Capacitor 7 JavaScript-to-Native bridge. Prevents Cross-Site Scripting (XSS) payloads and untrusted third-party DOM scripts from invoking high-privilege native device interfaces (Filesystem, Biometrics, SecureStorage, Geolocation) through global bridge escalation.","antiPatternHeadline":"Global Window Bridge Exposure Permitting XSS-Driven Native Privilege Escalation","stars_count":106,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","security","bridge","xss-mitigation"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-strict-native-bridge-sandboxing?format=claude","cursorMdc":"/api/rules/capacitor-7-strict-native-bridge-sandboxing?format=mdc","cursorrules":"/api/rules/capacitor-7-strict-native-bridge-sandboxing?format=cursor","windsurf":"/api/rules/capacitor-7-strict-native-bridge-sandboxing?format=windsurf","agents":"/api/rules/capacitor-7-strict-native-bridge-sandboxing?format=agents"}},{"id":"openfga-rebac-consistency-token-edge-cache-guardrail","title":"Enforce Monotonic Consistency Tokens for OpenFGA Edge Caching to Prevent New Enemy Vulnerabilities","category":"security","severity":"critical","description":"Enforces strict propagation and monotonic validation of OpenFGA consistency tokens across distributed edge caches, API gateways, and authorization evaluation engines. Guarantees that write-to-read authorization causal ordering prevents the 'New Enemy Problem' where revoked permissions remain exploitable due to asynchronous replication lag or stale edge evaluation caches.","antiPatternHeadline":"Evaluating OpenFGA Check Requests Against Edge Caches Without Enforcing Monotonic Consistency Token Watermarks","stars_count":92,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","rebac","openfga","authorization","distributed-systems","edge-computing","consistency-tokens"],"exportEndpoints":{"claude":"/api/rules/openfga-rebac-consistency-token-edge-cache-guardrail?format=claude","cursorMdc":"/api/rules/openfga-rebac-consistency-token-edge-cache-guardrail?format=mdc","cursorrules":"/api/rules/openfga-rebac-consistency-token-edge-cache-guardrail?format=cursor","windsurf":"/api/rules/openfga-rebac-consistency-token-edge-cache-guardrail?format=windsurf","agents":"/api/rules/openfga-rebac-consistency-token-edge-cache-guardrail?format=agents"}},{"id":"fido2-webauthn-l3-device-bound-stepup-attestation","title":"FIDO2/WebAuthn L3 Device-Bound Passkey Step-Up Attestation Standard","category":"security","severity":"critical","description":"Enforces strict validation of WebAuthn Level 3 authenticator flags (BE/BS) and hardware-backed attestation during step-up re-authentication. Blocks multi-device synced passkey replay and cross-device session extraction by ensuring privileged transactions strictly require hardware-bound secure enclave authenticators.","antiPatternHeadline":"Accepting Multi-Device Synced Passkeys (BE=1) Without Attestation for High-Assurance Privileged Actions","stars_count":94,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","fido2","webauthn","passkeys","zero-trust","secure-enclave","cryptography"],"exportEndpoints":{"claude":"/api/rules/fido2-webauthn-l3-device-bound-stepup-attestation?format=claude","cursorMdc":"/api/rules/fido2-webauthn-l3-device-bound-stepup-attestation?format=mdc","cursorrules":"/api/rules/fido2-webauthn-l3-device-bound-stepup-attestation?format=cursor","windsurf":"/api/rules/fido2-webauthn-l3-device-bound-stepup-attestation?format=windsurf","agents":"/api/rules/fido2-webauthn-l3-device-bound-stepup-attestation?format=agents"}},{"id":"opentelemetry-ebpf-socket-baggage-propagation","title":"Kernel-Level W3C Trace Context and Baggage Propagation via eBPF Socket Operations","category":"devops","severity":"critical","description":"Enforces deterministic extraction and injection of W3C Trace Context and Baggage at the Linux socket layer using eBPF sock_ops and sk_msg programs. Eliminates runtime bytecode instrumentation while guaranteeing parent-child lineage across uninstrumented processes and external native runtimes. Prevents TCP frame corruption and sequence desynchronization when parsing or splicing L7 headers in kernel space.","antiPatternHeadline":"Invasive Bytecode Modification or Uncoordinated Socket Splicing That Breaks HTTP/2/gRPC Framing","stars_count":101,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","opentelemetry","distributed-tracing","kernel","w3c-trace-context"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-ebpf-socket-baggage-propagation?format=claude","cursorMdc":"/api/rules/opentelemetry-ebpf-socket-baggage-propagation?format=mdc","cursorrules":"/api/rules/opentelemetry-ebpf-socket-baggage-propagation?format=cursor","windsurf":"/api/rules/opentelemetry-ebpf-socket-baggage-propagation?format=windsurf","agents":"/api/rules/opentelemetry-ebpf-socket-baggage-propagation?format=agents"}},{"id":"tokio-cooperative-budgeting-epoll-starvation-guardrail","title":"Tokio Cooperative Task Budgeting & epoll Starvation Guardrail","category":"devops","severity":"critical","description":"Enforces cooperative task budgeting and mandatory yield points within compute-intensive async futures to prevent worker thread monopolization. Preserves deterministic epoll event loop cadences in high-throughput network edge proxies, eliminating tail-latency amplification (p99/p99.9) on multiplexed I/O connections.","antiPatternHeadline":"Monopolizing Tokio Worker Threads with Unbounded In-Band Compute Bypassing epoll Poll Cadence","stars_count":103,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","tokio","rust","epoll","async","latency-engineering","networking"],"exportEndpoints":{"claude":"/api/rules/tokio-cooperative-budgeting-epoll-starvation-guardrail?format=claude","cursorMdc":"/api/rules/tokio-cooperative-budgeting-epoll-starvation-guardrail?format=mdc","cursorrules":"/api/rules/tokio-cooperative-budgeting-epoll-starvation-guardrail?format=cursor","windsurf":"/api/rules/tokio-cooperative-budgeting-epoll-starvation-guardrail?format=windsurf","agents":"/api/rules/tokio-cooperative-budgeting-epoll-starvation-guardrail?format=agents"}},{"id":"react-19-server-actions-idempotency-rollback-react-19-server--809","title":"React 19 Server Actions Idempotency & Optimistic Rollback Protocol","category":"frontend","severity":"critical","description":"Enforces deterministic state synchronization between client and server across high-latency or unstable mobile-web boundaries. Mandates client-generated idempotency tokens paired with React 19 useActionState and useOptimistic primitives to prevent duplicate mutations and eliminate zombie optimistic states upon network failures.","antiPatternHeadline":"Non-Idempotent Mutations with Leaky Unchecked Optimistic UI","stars_count":119,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","server-actions","idempotency","optimistic-ui","use-action-state"],"exportEndpoints":{"claude":"/api/rules/react-19-server-actions-idempotency-rollback-react-19-server--809?format=claude","cursorMdc":"/api/rules/react-19-server-actions-idempotency-rollback-react-19-server--809?format=mdc","cursorrules":"/api/rules/react-19-server-actions-idempotency-rollback-react-19-server--809?format=cursor","windsurf":"/api/rules/react-19-server-actions-idempotency-rollback-react-19-server--809?format=windsurf","agents":"/api/rules/react-19-server-actions-idempotency-rollback-react-19-server--809?format=agents"}},{"id":"tauri-v2-granular-ipc-capability-acl-sandboxing","title":"Tauri 2.0 IPC Granular Capability ACL Sandboxing and Boundary Hardening","category":"frontend","severity":"critical","description":"Enforces strict principle-of-least-privilege IPC boundaries in Tauri 2.0 applications by eliminating wildcard native plugin permissions and unbounded invoke calls. All frontend interactions with native host APIs must route through strongly-typed command wrappers constrained by granular, path-scoped capability manifests bound exclusively to authorized webview labels.","antiPatternHeadline":"Direct Webview Invocations of Wildcard Plugin Commands Exposing Arbitrary Native Host Execution via XSS","stars_count":61,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","tauri","security","ipc","sandboxing","acl"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-granular-ipc-capability-acl-sandboxing?format=claude","cursorMdc":"/api/rules/tauri-v2-granular-ipc-capability-acl-sandboxing?format=mdc","cursorrules":"/api/rules/tauri-v2-granular-ipc-capability-acl-sandboxing?format=cursor","windsurf":"/api/rules/tauri-v2-granular-ipc-capability-acl-sandboxing?format=windsurf","agents":"/api/rules/tauri-v2-granular-ipc-capability-acl-sandboxing?format=agents"}},{"id":"openfga-zanzibar-cycle-safe-tuple-graph-evaluation-standard","title":"Cycle-Safe Graph Evaluation and Traversal Guardrails for OpenFGA and Zanzibar ReBAC","category":"backend","severity":"critical","description":"Enforces deterministic cycle detection, bounded traversal depth, and evaluation memoization across dynamic multi-tenant relationship-based access control (ReBAC) graphs. Prevents denial-of-service and stack overflow vulnerabilities caused by circular delegation chains, mutually recursive group memberships, or unbounded transitive closures in tuple evaluation engines.","antiPatternHeadline":"Unbounded Recursive Traversal and Cycle-Prone Graph Resolution in ReBAC Engine","stars_count":46,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","openfga","zanzibar","rebac","authorization","graph-traversal","dos-prevention"],"exportEndpoints":{"claude":"/api/rules/openfga-zanzibar-cycle-safe-tuple-graph-evaluation-standard?format=claude","cursorMdc":"/api/rules/openfga-zanzibar-cycle-safe-tuple-graph-evaluation-standard?format=mdc","cursorrules":"/api/rules/openfga-zanzibar-cycle-safe-tuple-graph-evaluation-standard?format=cursor","windsurf":"/api/rules/openfga-zanzibar-cycle-safe-tuple-graph-evaluation-standard?format=windsurf","agents":"/api/rules/openfga-zanzibar-cycle-safe-tuple-graph-evaluation-standard?format=agents"}},{"id":"swift6-distributed-actor-transport-boundary-isolation","title":"Swift 6 Distributed Actor Remote Transport & Deserialization Failure Boundary","category":"mobile","severity":"critical","description":"Enforces strict fault-isolation boundaries and transactional state rollbacks across Swift 6 distributed actor systems operating over edge-to-client networks. Prevents split-brain state mutations and orphan lifecycle states caused by unhandled transport disconnects and invocation deserialization failures. Mandates that all distributed calls wrap remote transport invocations in idempotent, circuit-broken compensations with explicit lifecycle verification.","antiPatternHeadline":"Mutating Local Distributed Actor State Prior to Remote Invalidation or Without Inbound Deserialization Isolation","stars_count":104,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","swift6","distributed-actors","concurrency","resilience","edge-computing"],"exportEndpoints":{"claude":"/api/rules/swift6-distributed-actor-transport-boundary-isolation?format=claude","cursorMdc":"/api/rules/swift6-distributed-actor-transport-boundary-isolation?format=mdc","cursorrules":"/api/rules/swift6-distributed-actor-transport-boundary-isolation?format=cursor","windsurf":"/api/rules/swift6-distributed-actor-transport-boundary-isolation?format=windsurf","agents":"/api/rules/swift6-distributed-actor-transport-boundary-isolation?format=agents"}},{"id":"webauthn-dynamic-attestation-origin-binding-guardrail","title":"WebAuthn Dynamic Attestation and Strict Origin-Binding Validation","category":"security","severity":"critical","description":"Cryptographically enforces strict Relying Party ID (rpId) hashing, exact expected origin verification, and raw clientDataHash computation during WebAuthn registration and authentication ceremonies. Prevents credential-relay, subdomain manipulation, and Man-in-the-Middle (MITM) passkey replay attacks by mandating exact byte-level hashing of raw clientDataJSON and constant-time verification of session-bound cryptographic challenges.","antiPatternHeadline":"Trusting Client-Supplied Origins and Deserializing clientDataJSON Prior to Hash Verification","stars_count":95,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","fido2","passkeys","cryptography","authentication"],"exportEndpoints":{"claude":"/api/rules/webauthn-dynamic-attestation-origin-binding-guardrail?format=claude","cursorMdc":"/api/rules/webauthn-dynamic-attestation-origin-binding-guardrail?format=mdc","cursorrules":"/api/rules/webauthn-dynamic-attestation-origin-binding-guardrail?format=cursor","windsurf":"/api/rules/webauthn-dynamic-attestation-origin-binding-guardrail?format=windsurf","agents":"/api/rules/webauthn-dynamic-attestation-origin-binding-guardrail?format=agents"}},{"id":"spiffe-spire-dynamic-x509-svid-rotation-spiffe-spire-dyn-581","title":"SPIFFE/SPIRE Ephemeral X.509 SVID Dynamic Auto-Rotation Invariant","category":"security","severity":"critical","description":"Enforces dynamic consumption of short-lived X.509 SVIDs directly from the SPIFFE Workload API socket, forbidding static certificate caching or one-time TLS context initialization. Guarantees zero-downtime cryptographic identity auto-rotation and prevents microservice communication failures caused by expired ephemeral credentials.","antiPatternHeadline":"One-Time Static SVID Loading and Persistent TLS Context Caching","stars_count":83,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","spiffe","spire","mtls","zero-trust","cryptography"],"exportEndpoints":{"claude":"/api/rules/spiffe-spire-dynamic-x509-svid-rotation-spiffe-spire-dyn-581?format=claude","cursorMdc":"/api/rules/spiffe-spire-dynamic-x509-svid-rotation-spiffe-spire-dyn-581?format=mdc","cursorrules":"/api/rules/spiffe-spire-dynamic-x509-svid-rotation-spiffe-spire-dyn-581?format=cursor","windsurf":"/api/rules/spiffe-spire-dynamic-x509-svid-rotation-spiffe-spire-dyn-581?format=windsurf","agents":"/api/rules/spiffe-spire-dynamic-x509-svid-rotation-spiffe-spire-dyn-581?format=agents"}},{"id":"opentelemetry-tail-sampling-error-preservation-standard","title":"OpenTelemetry Tail-Based Sampling and Trace Error Preservation Guardrail","category":"devops","severity":"critical","description":"Enforces 100% trace capture for all error trees and high-latency anomalies via OpenTelemetry Collector tail-sampling policies while downsampling nominal traffic to protect ingest quotas. Prevents distributed trace fragmentation caused by aggressive upstream head-based sampling and premature collector decision windows.","antiPatternHeadline":"Premature Head-Based Probabilistic Dropping of Distributed Traces and Incomplete Leaf-Span Error Capture","stars_count":63,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","distributed-tracing","observability","tail-sampling","collector"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-tail-sampling-error-preservation-standard?format=claude","cursorMdc":"/api/rules/opentelemetry-tail-sampling-error-preservation-standard?format=mdc","cursorrules":"/api/rules/opentelemetry-tail-sampling-error-preservation-standard?format=cursor","windsurf":"/api/rules/opentelemetry-tail-sampling-error-preservation-standard?format=windsurf","agents":"/api/rules/opentelemetry-tail-sampling-error-preservation-standard?format=agents"}},{"id":"cosign-keyless-admission-guardrail","title":"Sigstore Cosign Ephemeral Keyless Attestation Admission Guardrail","category":"devops","severity":"critical","description":"Enforces admission controller verification of keyless Sigstore signatures and SLSA build provenance attestations for container images entering the cluster. Mandates validation of Fulcio ephemeral X.509 certificate identities (OIDC issuer and SAN claims) and Rekor transparency log proofs, preventing execution of unsigned, untrusted, or tampered container workloads.","antiPatternHeadline":"Deploying Untrusted Container Images Without Cryptographic Identity and Transparency Verification","stars_count":77,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","sigstore","cosign","admission-controller","kyverno","supply-chain-security","slsa"],"exportEndpoints":{"claude":"/api/rules/cosign-keyless-admission-guardrail?format=claude","cursorMdc":"/api/rules/cosign-keyless-admission-guardrail?format=mdc","cursorrules":"/api/rules/cosign-keyless-admission-guardrail?format=cursor","windsurf":"/api/rules/cosign-keyless-admission-guardrail?format=windsurf","agents":"/api/rules/cosign-keyless-admission-guardrail?format=agents"}},{"id":"react-19-server-action-idempotency-deduplication","title":"React 19 Server Action Idempotency-Key Deduplication Guardrail","category":"frontend","severity":"critical","description":"Enforces deterministic client-side generation and server-side atomic validation of idempotency keys across all mutating React 19 Server Actions. Guarantees that concurrent submissions, network retry storms, and transient timeout replay loops cannot cause duplicate side effects or non-reentrant state corruptions. Mandates atomic distributed lock/reservation primitives prior to executing durable business mutations.","antiPatternHeadline":"Blind Execution of Non-Idempotent React 19 Server Actions on Optimistic Retries","stars_count":119,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","server-actions","idempotency","concurrency","nextjs"],"exportEndpoints":{"claude":"/api/rules/react-19-server-action-idempotency-deduplication?format=claude","cursorMdc":"/api/rules/react-19-server-action-idempotency-deduplication?format=mdc","cursorrules":"/api/rules/react-19-server-action-idempotency-deduplication?format=cursor","windsurf":"/api/rules/react-19-server-action-idempotency-deduplication?format=windsurf","agents":"/api/rules/react-19-server-action-idempotency-deduplication?format=agents"}},{"id":"svelte5-async-effect-race-condition-fence","title":"Svelte 5 Untracked Async Effect Race-Condition Fence","category":"frontend","severity":"critical","description":"Enforces strict cancellation tokens and AbortController fences within Svelte 5 $effect workflows. Prevents out-of-order promise resolutions from clobbering fine-grained reactive state when rapid UI inputs re-trigger asynchronous tasks.","antiPatternHeadline":"Unfenced Async State Resolution in Svelte 5 $effect Causing Stale UI Clobbering","stars_count":118,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["svelte5","runes","concurrency","frontend","race-conditions","async-effects"],"exportEndpoints":{"claude":"/api/rules/svelte5-async-effect-race-condition-fence?format=claude","cursorMdc":"/api/rules/svelte5-async-effect-race-condition-fence?format=mdc","cursorrules":"/api/rules/svelte5-async-effect-race-condition-fence?format=cursor","windsurf":"/api/rules/svelte5-async-effect-race-condition-fence?format=windsurf","agents":"/api/rules/svelte5-async-effect-race-condition-fence?format=agents"}},{"id":"openfga-contextual-tuple-batch-isolation-boundary","title":"OpenFGA 1.8 Contextual Tuple Batch Isolation and Graph Depth Guardrail","category":"security","severity":"critical","description":"Enforces strict request-scoped isolation and deterministic boundary checks when injecting contextual tuples into OpenFGA v1.8 runtime evaluation calls. Prevents cross-tenant authorization state leakage across concurrent batch evaluations and halts Denial-of-Service vectors stemming from unbounded graph traversals or recursive ephemeral relation cycles.","antiPatternHeadline":"Leaking Ephemeral Contextual Tuples Across Concurrent Requests and Unbounded Zanzibar Graph Expansion","stars_count":118,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","zanzibar","authorization","rebac","multi-tenancy"],"exportEndpoints":{"claude":"/api/rules/openfga-contextual-tuple-batch-isolation-boundary?format=claude","cursorMdc":"/api/rules/openfga-contextual-tuple-batch-isolation-boundary?format=mdc","cursorrules":"/api/rules/openfga-contextual-tuple-batch-isolation-boundary?format=cursor","windsurf":"/api/rules/openfga-contextual-tuple-batch-isolation-boundary?format=windsurf","agents":"/api/rules/openfga-contextual-tuple-batch-isolation-boundary?format=agents"}},{"id":"axum-0-8-cancel-safe-stream-guardrail","title":"Axum 0.8 Cancel-Safe Body Stream Flow Control Standard","category":"backend","severity":"critical","description":"Enforces strict cancellation safety and backpressure guarantees when consuming Axum 0.8 request body streams on Tokio runtimes. Prevents unconsumed payload buffer accumulation, lingering socket descriptors, and corrupted or poisoned shared synchronization states when client connections abruptly terminate mid-stream. Mandates explicit RAII cleanup and isolation of asynchronous lock guards from stream ingestion poll loops.","antiPatternHeadline":"Holding async synchronization guards across unbuffered body chunk awaits and neglecting drop-safety during premature client termination.","stars_count":41,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tokio","concurrency","cancel-safety"],"exportEndpoints":{"claude":"/api/rules/axum-0-8-cancel-safe-stream-guardrail?format=claude","cursorMdc":"/api/rules/axum-0-8-cancel-safe-stream-guardrail?format=mdc","cursorrules":"/api/rules/axum-0-8-cancel-safe-stream-guardrail?format=cursor","windsurf":"/api/rules/axum-0-8-cancel-safe-stream-guardrail?format=windsurf","agents":"/api/rules/axum-0-8-cancel-safe-stream-guardrail?format=agents"}},{"id":"bun-websocket-backpressure-buffer-recycling","title":"Bun 1.2 Native WebSocket Backpressure and ArrayBuffer Recycling Invariant","category":"backend","severity":"critical","description":"Enforces strict native queue-depth validation via ws.getBufferedAmount() and pre-allocated ArrayBuffer pool recycling across Bun 1.2 native WebSocket servers. Unbounded ws.send() calls bypass native libuv/C++ queues, inducing hidden C++ heap memory leaks and GC thrashing. Mandates backpressure-aware draining cycles and deterministic ring/slab buffer reuse for zero-copy high-throughput framing.","antiPatternHeadline":"Unchecked ws.send() Fire-and-Forget with On-The-Fly Buffer Allocations Inducing Native Memory Exhaustion","stars_count":49,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","websockets","backpressure","memory-management","zero-copy","performance"],"exportEndpoints":{"claude":"/api/rules/bun-websocket-backpressure-buffer-recycling?format=claude","cursorMdc":"/api/rules/bun-websocket-backpressure-buffer-recycling?format=mdc","cursorrules":"/api/rules/bun-websocket-backpressure-buffer-recycling?format=cursor","windsurf":"/api/rules/bun-websocket-backpressure-buffer-recycling?format=windsurf","agents":"/api/rules/bun-websocket-backpressure-buffer-recycling?format=agents"}},{"id":"kmp-swift-export-memory-lifecycle-guardrail-kotlin-multiplat-178","title":"KMP Swift-Export Cross-Runtime ARC/GC Memory Lifecycle Guardrail","category":"mobile","severity":"critical","description":"Enforces strict lifecycle decoupling and deterministic cancellation bridges between Apple ARC and Kotlin Native GC. Prevents permanent cross-runtime memory leaks caused by circular references between Swift modern concurrency tasks and Kotlin coroutine Flow collectors.","antiPatternHeadline":"Unbounded Swift Concurrency AsyncStream Retaining Kotlin Coroutines Creating Invisible Cross-Runtime Zombie Islands","stars_count":101,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kmp","kotlin-native","swift-export","swift-concurrency","memory-management","arc"],"exportEndpoints":{"claude":"/api/rules/kmp-swift-export-memory-lifecycle-guardrail-kotlin-multiplat-178?format=claude","cursorMdc":"/api/rules/kmp-swift-export-memory-lifecycle-guardrail-kotlin-multiplat-178?format=mdc","cursorrules":"/api/rules/kmp-swift-export-memory-lifecycle-guardrail-kotlin-multiplat-178?format=cursor","windsurf":"/api/rules/kmp-swift-export-memory-lifecycle-guardrail-kotlin-multiplat-178?format=windsurf","agents":"/api/rules/kmp-swift-export-memory-lifecycle-guardrail-kotlin-multiplat-178?format=agents"}},{"id":"tauri-v2-webview-capability-scoping-fence","title":"Tauri 2.0 Multi-Window Webview IPC Capability Scoping Fence","category":"mobile","severity":"critical","description":"Enforces strict window-level capability isolation and explicit IPC permission schemas across Tauri 2.0 mobile and desktop targets. Disallows wildcard permissions and global plugin exposure, ensuring secondary, untrusted, or external webview windows cannot access sensitive native plugins or escalate OS privileges.","antiPatternHeadline":"Global Plugin IPC Exposure Across Untrusted Secondary Webview Windows","stars_count":109,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri-v2","ipc-security","capabilities","rust","webview-isolation"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-webview-capability-scoping-fence?format=claude","cursorMdc":"/api/rules/tauri-v2-webview-capability-scoping-fence?format=mdc","cursorrules":"/api/rules/tauri-v2-webview-capability-scoping-fence?format=cursor","windsurf":"/api/rules/tauri-v2-webview-capability-scoping-fence?format=windsurf","agents":"/api/rules/tauri-v2-webview-capability-scoping-fence?format=agents"}},{"id":"webauthn-largeblob-enclave-storage-invariant","title":"WebAuthn FIDO2 LargeBlob Secure Enclave Storage & Sync Invariant","category":"security","severity":"critical","description":"Enforces client-side envelope encryption, cryptographic origin/credential-binding in Additional Authenticated Data (AAD), and monotonic sequence vectoring for WebAuthn largeBlob operations. Prevents cross-device synchronization race conditions, split-brain forks, and cleartext credential extraction across passkey cloud sync fabrics.","antiPatternHeadline":"Unencrypted LargeBlob Writes with Blind State Overwriting in Synced Authenticators","stars_count":115,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","fido2","largeblob","passkeys","hardware-security","cryptography"],"exportEndpoints":{"claude":"/api/rules/webauthn-largeblob-enclave-storage-invariant?format=claude","cursorMdc":"/api/rules/webauthn-largeblob-enclave-storage-invariant?format=mdc","cursorrules":"/api/rules/webauthn-largeblob-enclave-storage-invariant?format=cursor","windsurf":"/api/rules/webauthn-largeblob-enclave-storage-invariant?format=windsurf","agents":"/api/rules/webauthn-largeblob-enclave-storage-invariant?format=agents"}},{"id":"opentelemetry-w3c-baggage-cardinality-quarantine-standard","title":"OpenTelemetry W3C Baggage Ingress Quarantine & High-Cardinality Guardrail","category":"devops","severity":"critical","description":"Enforces strict extraction, validation, and sanitization of W3C Baggage headers at edge API ingress points before promoting attributes to telemetry spans or metrics. Unchecked propagation of arbitrary baggage values directly into span attributes triggers exponential metric cardinality explosions, degrading OpenTelemetry Collector nodes and causing downstream TSDB/Cortex OOM failures.","antiPatternHeadline":"Blind extraction and promotion of raw W3C baggage keys to span attributes and metric dimensions without allowlisting or cardinality caps","stars_count":70,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","observability","distributed-tracing","cardinality-explosion","api-gateway"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-w3c-baggage-cardinality-quarantine-standard?format=claude","cursorMdc":"/api/rules/opentelemetry-w3c-baggage-cardinality-quarantine-standard?format=mdc","cursorrules":"/api/rules/opentelemetry-w3c-baggage-cardinality-quarantine-standard?format=cursor","windsurf":"/api/rules/opentelemetry-w3c-baggage-cardinality-quarantine-standard?format=windsurf","agents":"/api/rules/opentelemetry-w3c-baggage-cardinality-quarantine-standard?format=agents"}},{"id":"vite6-environment-api-runtime-isolation-guardrail","title":"Vite 6 Environment API Runtime Module Isolation Guardrail","category":"frontend","severity":"critical","description":"Enforces strict boundary isolation and prevents cross-runtime prototype pollution and state leakage across browser, web worker/worklet, and server-side runtime graphs using the Vite 6 Environment API. Guarantees that compilation transforms, dependency caches, and ModuleRunner instances operate within deterministic, hermetically isolated runtime execution contexts.","antiPatternHeadline":"Cross-Runtime State Bleed and Shared Module Graph Pollution via Legacy Vite SSR Loaders","stars_count":95,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["vite","vite6","environment-api","module-runner","runtime-isolation","ssr","worklets"],"exportEndpoints":{"claude":"/api/rules/vite6-environment-api-runtime-isolation-guardrail?format=claude","cursorMdc":"/api/rules/vite6-environment-api-runtime-isolation-guardrail?format=mdc","cursorrules":"/api/rules/vite6-environment-api-runtime-isolation-guardrail?format=cursor","windsurf":"/api/rules/vite6-environment-api-runtime-isolation-guardrail?format=windsurf","agents":"/api/rules/vite6-environment-api-runtime-isolation-guardrail?format=agents"}},{"id":"axum-0-8-tower-http3-stream-cancellation-quarantine","title":"Axum 0.8 Tower HTTP/3 Stream Abrupt-Cancellation Quarantine","category":"backend","severity":"critical","description":"Enforces immediate cooperative task abort and pooled resource reclamation when HTTP/3 QUIC streams receive abrupt resets or cancellations. Eliminates detached background worker drift, leaked database connection pool leases, and CPU exhaustion caused by unmonitored Tokio task spawning in Axum 0.8 handlers.","antiPatternHeadline":"Detached Fire-and-Forget Tokio Tasks and Unbounded Streams Surviving QUIC Stream Resets","stars_count":95,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tower","http3","quic","tokio","concurrency"],"exportEndpoints":{"claude":"/api/rules/axum-0-8-tower-http3-stream-cancellation-quarantine?format=claude","cursorMdc":"/api/rules/axum-0-8-tower-http3-stream-cancellation-quarantine?format=mdc","cursorrules":"/api/rules/axum-0-8-tower-http3-stream-cancellation-quarantine?format=cursor","windsurf":"/api/rules/axum-0-8-tower-http3-stream-cancellation-quarantine?format=windsurf","agents":"/api/rules/axum-0-8-tower-http3-stream-cancellation-quarantine?format=agents"}},{"id":"pg17-parallel-hash-join-spill-quota-guardrail","title":"PostgreSQL 17 Parallel Hash Join Memory Spill-Quota & Temp-File Limit Guardrail","category":"backend","severity":"critical","description":"Enforces strict per-query work_mem and temp_file_limit quotas during multi-batch parallel hash joins in PostgreSQL 17. Unconstrained parallel worker allocation multiplying against unbudgeted work_mem causes catastrophic multi-batch disk spills to pgsql_tmp, saturating NVMe IOPS and starving primary OLTP read/write paths.","antiPatternHeadline":"Unbounded Parallel Multi-Batch Hash Joins Spilling Uncapped Gigabytes to Disk","stars_count":56,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql-17","query-optimization","database-performance","parallel-query"],"exportEndpoints":{"claude":"/api/rules/pg17-parallel-hash-join-spill-quota-guardrail?format=claude","cursorMdc":"/api/rules/pg17-parallel-hash-join-spill-quota-guardrail?format=mdc","cursorrules":"/api/rules/pg17-parallel-hash-join-spill-quota-guardrail?format=cursor","windsurf":"/api/rules/pg17-parallel-hash-join-spill-quota-guardrail?format=windsurf","agents":"/api/rules/pg17-parallel-hash-join-spill-quota-guardrail?format=agents"}},{"id":"fastapi-uvicorn-stream-backpressure-guardrail","title":"FastAPI Uvicorn Multiplexed Stream Backpressure Guardrail","category":"backend","severity":"critical","description":"Enforces strict producer-consumer backpressure mechanisms and bounded concurrency queues for HTTP/2 multiplexed streams and Server-Sent Events (SSE) in FastAPI/Uvicorn deployments. Prevents unconstrained heap ballooning, event-loop starvation, and OOM terminations caused by fast upstream generators paired with slow network consumers.","antiPatternHeadline":"Unbounded Async Generator Consumption and Zero-Backpressure Task Spawning on Multiplexed SSE/Streaming Endpoints","stars_count":113,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","uvicorn","asyncio","backpressure","http2","sse"],"exportEndpoints":{"claude":"/api/rules/fastapi-uvicorn-stream-backpressure-guardrail?format=claude","cursorMdc":"/api/rules/fastapi-uvicorn-stream-backpressure-guardrail?format=mdc","cursorrules":"/api/rules/fastapi-uvicorn-stream-backpressure-guardrail?format=cursor","windsurf":"/api/rules/fastapi-uvicorn-stream-backpressure-guardrail?format=windsurf","agents":"/api/rules/fastapi-uvicorn-stream-backpressure-guardrail?format=agents"}},{"id":"kmp-coroutine-cancellation-swift-boundary","title":"KMP Coroutine Cancellation and Memory Retention Swift-Interop Guardrail","category":"mobile","severity":"critical","description":"Enforces strict bidirectional cancellation propagation and memory lifecycle bridging between Kotlin Multiplatform Coroutine Jobs and Swift Concurrency Task trees. Prevents Objective-C ARC to Kotlin/Native GC retain cycles and unhandled Kotlin CancellationException panics escaping into Swift callers.","antiPatternHeadline":"Leaking Kotlin Coroutine Jobs across the Swift-ObjC bridge and converting CancellationExceptions into fatal runtime errors","stars_count":119,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","swift-concurrency","coroutines","memory-management","interop"],"exportEndpoints":{"claude":"/api/rules/kmp-coroutine-cancellation-swift-boundary?format=claude","cursorMdc":"/api/rules/kmp-coroutine-cancellation-swift-boundary?format=mdc","cursorrules":"/api/rules/kmp-coroutine-cancellation-swift-boundary?format=cursor","windsurf":"/api/rules/kmp-coroutine-cancellation-swift-boundary?format=windsurf","agents":"/api/rules/kmp-coroutine-cancellation-swift-boundary?format=agents"}},{"id":"android-15-private-space-ipc-sandboxing-standard","title":"Android 15 Private Space Cross-Profile IPC & Storage Sandboxing Standard","category":"mobile","severity":"critical","description":"Enforces strict isolation barriers between the primary user profile and isolated Android 15 Private Space containers (android.os.usertype.profile.PRIVATE). Mandates explicit caller validation via Binder.getCallingUserHandle(), denies implicit cross-profile URI grants, and prevents shared cache or external storage bleed across security boundaries.","antiPatternHeadline":"Implicit Cross-Profile Intent Broadcasting and Unchecked ContentProvider URI Leaks Across Private Space Boundaries","stars_count":91,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","android-15","private-space","ipc-security","content-provider","sandboxing"],"exportEndpoints":{"claude":"/api/rules/android-15-private-space-ipc-sandboxing-standard?format=claude","cursorMdc":"/api/rules/android-15-private-space-ipc-sandboxing-standard?format=mdc","cursorrules":"/api/rules/android-15-private-space-ipc-sandboxing-standard?format=cursor","windsurf":"/api/rules/android-15-private-space-ipc-sandboxing-standard?format=windsurf","agents":"/api/rules/android-15-private-space-ipc-sandboxing-standard?format=agents"}},{"id":"ebpf-tc-egress-credential-sentinel","title":"eBPF TC Egress Plaintext Credential Exfiltration Sentinel","category":"security","severity":"critical","description":"Enforces pre-network egress packet boundary inspection using eBPF Traffic Control (TC) classifiers to intercept and drop unencrypted outbound API keys, private tokens, and credentials. Prevents data exfiltration by parsing TCP payload windows at the host interface layer before packets exit the network namespace.","antiPatternHeadline":"Permitting Uninspected Plaintext Socket Buffers to Traverse Egress TC Queues Without Boundary Verification","stars_count":46,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","ebpf","traffic-control","networking","c","token-exfiltration"],"exportEndpoints":{"claude":"/api/rules/ebpf-tc-egress-credential-sentinel?format=claude","cursorMdc":"/api/rules/ebpf-tc-egress-credential-sentinel?format=mdc","cursorrules":"/api/rules/ebpf-tc-egress-credential-sentinel?format=cursor","windsurf":"/api/rules/ebpf-tc-egress-credential-sentinel?format=windsurf","agents":"/api/rules/ebpf-tc-egress-credential-sentinel?format=agents"}},{"id":"otel-arrow-batch-compaction-memory-watermark","title":"Deterministic Arrow Batch Compaction and High-Watermark Memory Shedding","category":"devops","severity":"critical","description":"Enforces strict memory-limiter-driven watermarks and deterministic columnar batch compaction bounds for OpenTelemetry OTLP-Arrow pipelines. Prevents catastrophic OOM panic loops caused by unbounded record construction, non-contiguous Apache Arrow buffer allocation, and unthrottled upstream streaming during downstream backpressure.","antiPatternHeadline":"Unbounded Columnar Buffer Allocations with Decoupled Pipeline Memory Limits Inducing OOM Panics","stars_count":66,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","otlp-arrow","memory-management","backpressure","apache-arrow"],"exportEndpoints":{"claude":"/api/rules/otel-arrow-batch-compaction-memory-watermark?format=claude","cursorMdc":"/api/rules/otel-arrow-batch-compaction-memory-watermark?format=mdc","cursorrules":"/api/rules/otel-arrow-batch-compaction-memory-watermark?format=cursor","windsurf":"/api/rules/otel-arrow-batch-compaction-memory-watermark?format=windsurf","agents":"/api/rules/otel-arrow-batch-compaction-memory-watermark?format=agents"}},{"id":"nextjs-15-after-lifecycle-boundary","title":"Next.js 15 after() Post-Response Lifecycle & Serverless Execution Boundary","category":"frontend","severity":"critical","description":"Guarantees secondary compute routines, audit trails, and analytics outlive the primary HTTP response lifecycle without freezing in serverless runtimes or penalizing Time to First Byte (TTFB). Mandates next/server's after() API over floating fire-and-forget promises and synchronous pre-response execution.","antiPatternHeadline":"Floating Unawaited Promises or Blocking Side-Effects in Serverless Request Handlers","stars_count":79,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs","nextjs-15","after","serverless","ttfb","performance"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-after-lifecycle-boundary?format=claude","cursorMdc":"/api/rules/nextjs-15-after-lifecycle-boundary?format=mdc","cursorrules":"/api/rules/nextjs-15-after-lifecycle-boundary?format=cursor","windsurf":"/api/rules/nextjs-15-after-lifecycle-boundary?format=windsurf","agents":"/api/rules/nextjs-15-after-lifecycle-boundary?format=agents"}},{"id":"fastapi-python313-free-threaded-state-synchronization-standard","title":"FastAPI Python 3.13 Free-Threaded Shared State Synchronization Standard","category":"backend","severity":"critical","description":"Enforces strict thread-safety invariants and explicit synchronization primitives for FastAPI applications operating on free-threaded Python 3.13 (PEP 703) runtimes without the Global Interpreter Lock. Mandates lock-encapsulated data structures and prohibits reliance on legacy CPython bytecode atomicity across concurrent native worker threads.","antiPatternHeadline":"Relying on implicit GIL bytecode atomicity for shared mutable state in Python 3.13t runtimes.","stars_count":46,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","python313","free-threaded","pep703","concurrency","thread-safety"],"exportEndpoints":{"claude":"/api/rules/fastapi-python313-free-threaded-state-synchronization-standard?format=claude","cursorMdc":"/api/rules/fastapi-python313-free-threaded-state-synchronization-standard?format=mdc","cursorrules":"/api/rules/fastapi-python313-free-threaded-state-synchronization-standard?format=cursor","windsurf":"/api/rules/fastapi-python313-free-threaded-state-synchronization-standard?format=windsurf","agents":"/api/rules/fastapi-python313-free-threaded-state-synchronization-standard?format=agents"}},{"id":"axum-08-cancellation-safe-tower-streaming-boundary","title":"Axum 0.8 Cancellation-Safe Tower Middleware Streaming Boundary","category":"backend","severity":"critical","description":"Enforces strict cancellation safety across Axum 0.8 response streaming pipelines and Tower middleware layers. Prevents dangling database connection leases, lock leaks, and half-consumed stream buffer deadlocks when HTTP/2 RST_STREAM frames or HTTP/3 stream aborts occur mid-flight.","antiPatternHeadline":"Unbounded Body Buffering and RAII Drop Bypass in Asynchronous Stream Pipelines","stars_count":100,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tower","cancellation-safety","tokio","streaming"],"exportEndpoints":{"claude":"/api/rules/axum-08-cancellation-safe-tower-streaming-boundary?format=claude","cursorMdc":"/api/rules/axum-08-cancellation-safe-tower-streaming-boundary?format=mdc","cursorrules":"/api/rules/axum-08-cancellation-safe-tower-streaming-boundary?format=cursor","windsurf":"/api/rules/axum-08-cancellation-safe-tower-streaming-boundary?format=windsurf","agents":"/api/rules/axum-08-cancellation-safe-tower-streaming-boundary?format=agents"}},{"id":"postgres-17-failover-slot-synchronization-ha-invariant","title":"PostgreSQL 17 Failover Slot Synchronization & HA Replication Invariant","category":"backend","severity":"critical","description":"Enforces PostgreSQL 17 native logical replication failover slot synchronization across high-availability topologies. Ensures standby nodes synchronize logical slot offsets prior to promotion, eliminating confirmed_flush_lsn regression, catastrophic CDC duplicate replays, and downstream pipeline corruption.","antiPatternHeadline":"Creating unmanaged logical slots or failing to gate primary WAL progression via standby_slot_names, triggering CDC stream corruption upon failover.","stars_count":47,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","postgres-17","cdc","high-availability","replication"],"exportEndpoints":{"claude":"/api/rules/postgres-17-failover-slot-synchronization-ha-invariant?format=claude","cursorMdc":"/api/rules/postgres-17-failover-slot-synchronization-ha-invariant?format=mdc","cursorrules":"/api/rules/postgres-17-failover-slot-synchronization-ha-invariant?format=cursor","windsurf":"/api/rules/postgres-17-failover-slot-synchronization-ha-invariant?format=windsurf","agents":"/api/rules/postgres-17-failover-slot-synchronization-ha-invariant?format=agents"}},{"id":"spiffe-spire-ephemeral-gpu-attestation","title":"SPIFFE/SPIRE Dynamic Workload Attestation for Ephemeral GPU Inference","category":"security","severity":"critical","description":"Enforces zero-trust cryptographic workload identity for ephemeral AI inference pods accessing private model registries. Pods must acquire dynamic, short-lived x509-SVIDs via the local SPIFFE Workload API Unix Domain Socket backed by hardware and node attestation, eliminating all persistent cloud credentials and static registry access tokens.","antiPatternHeadline":"Mounting Long-Lived Cloud Credentials or Static API Keys in Ephemeral GPU Inference Workloads","stars_count":95,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","spiffe","spire","zero-trust","gpu-inference","svid","mtls"],"exportEndpoints":{"claude":"/api/rules/spiffe-spire-ephemeral-gpu-attestation?format=claude","cursorMdc":"/api/rules/spiffe-spire-ephemeral-gpu-attestation?format=mdc","cursorrules":"/api/rules/spiffe-spire-ephemeral-gpu-attestation?format=cursor","windsurf":"/api/rules/spiffe-spire-ephemeral-gpu-attestation?format=windsurf","agents":"/api/rules/spiffe-spire-ephemeral-gpu-attestation?format=agents"}},{"id":"gateway-api-v1-2-referencegrant-isolation-fence","title":"Kubernetes Gateway API v1.2 ReferenceGrant Cross-Namespace Isolation Fence","category":"devops","severity":"critical","description":"Enforces deterministic, bidirectional trust boundaries across multi-tenant Kubernetes clusters utilizing Gateway API v1.2. Cross-namespace references—including backendRefs, Gateway-to-Secret TLS references, and Route-to-Gateway attachments—MUST be validated by an explicit, least-privilege ReferenceGrant resource residing in the target resource's namespace before any routing or binding reconciles.","antiPatternHeadline":"Implicit Cross-Namespace Route Attachment and Unchecked Service Bridging Without Cryptographic ReferenceGrant Handshakes","stars_count":102,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","kubernetes","gateway-api","reference-grant","zero-trust","multi-tenancy"],"exportEndpoints":{"claude":"/api/rules/gateway-api-v1-2-referencegrant-isolation-fence?format=claude","cursorMdc":"/api/rules/gateway-api-v1-2-referencegrant-isolation-fence?format=mdc","cursorrules":"/api/rules/gateway-api-v1-2-referencegrant-isolation-fence?format=cursor","windsurf":"/api/rules/gateway-api-v1-2-referencegrant-isolation-fence?format=windsurf","agents":"/api/rules/gateway-api-v1-2-referencegrant-isolation-fence?format=agents"}},{"id":"go-1-24-rangefunc-stream-memory-bounded-invariant","title":"Go 1.24 Range-over-Func Stream Pipeline Memory-Bounded Invariant","category":"backend","severity":"critical","description":"Enforces strict push and pull iterator contract adherence in Go 1.24+ range-over-func pipelines. Mandates immediate termination upon false yield returns and deterministic execution of iter.Pull cleanup stop functions to prevent goroutine leaks, uncollected channel buffers, and unbounded heap retention in high-throughput streams.","antiPatternHeadline":"Ignoring Yield Return False or Leaking iter.Pull Stop Closures Causing Goroutine Hangs and Heap Leaks","stars_count":60,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","concurrency","iterators","memory-management","rangefunc"],"exportEndpoints":{"claude":"/api/rules/go-1-24-rangefunc-stream-memory-bounded-invariant?format=claude","cursorMdc":"/api/rules/go-1-24-rangefunc-stream-memory-bounded-invariant?format=mdc","cursorrules":"/api/rules/go-1-24-rangefunc-stream-memory-bounded-invariant?format=cursor","windsurf":"/api/rules/go-1-24-rangefunc-stream-memory-bounded-invariant?format=windsurf","agents":"/api/rules/go-1-24-rangefunc-stream-memory-bounded-invariant?format=agents"}},{"id":"openfga-contextual-tuple-ephemeral-access-leasing","title":"OpenFGA Ephemeral Access Leasing with Cryptographically Verified Contextual Tuples","category":"security","severity":"critical","description":"Enforces that transient, just-in-time authorization evaluations must inject strictly bounded contextual tuples verified via cryptographically signed lease tokens. Contextual tuples must be validated against sub-minute timestamps and bounded nonces directly prior to authorization evaluations, avoiding persistent storage of temporal privileges within the OpenFGA tuple store.","antiPatternHeadline":"Persisting Short-Lived Access Tuples in OpenFGA or Trusting Client-Supplied Contextual Tuples Without Cryptographic Lease Verification","stars_count":97,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","authorization","fine-grained-authz","cryptography","zero-trust"],"exportEndpoints":{"claude":"/api/rules/openfga-contextual-tuple-ephemeral-access-leasing?format=claude","cursorMdc":"/api/rules/openfga-contextual-tuple-ephemeral-access-leasing?format=mdc","cursorrules":"/api/rules/openfga-contextual-tuple-ephemeral-access-leasing?format=cursor","windsurf":"/api/rules/openfga-contextual-tuple-ephemeral-access-leasing?format=windsurf","agents":"/api/rules/openfga-contextual-tuple-ephemeral-access-leasing?format=agents"}},{"id":"svelte-5-runes-ssr-state-isolation-barrier","title":"Svelte 5 Runes SSR Cross-Request Reactive Isolation Standard","category":"frontend","severity":"critical","description":"Enforces strict architectural boundaries on Svelte 5 $state runes within universal and server-side contexts. Top-level reactive singletons in shared modules persist across the entire Node.js/Bun process lifetime, causing catastrophic cross-request data leaks and multi-tenant session poisoning in SSR applications.","antiPatternHeadline":"Module-Level Singleton Reactive Runes Mutating Across Concurrent Server Requests","stars_count":90,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["svelte5","runes","ssr","security","state-isolation","multi-tenant"],"exportEndpoints":{"claude":"/api/rules/svelte-5-runes-ssr-state-isolation-barrier?format=claude","cursorMdc":"/api/rules/svelte-5-runes-ssr-state-isolation-barrier?format=mdc","cursorrules":"/api/rules/svelte-5-runes-ssr-state-isolation-barrier?format=cursor","windsurf":"/api/rules/svelte-5-runes-ssr-state-isolation-barrier?format=windsurf","agents":"/api/rules/svelte-5-runes-ssr-state-isolation-barrier?format=agents"}},{"id":"duckdb-wasm-worker-memory-isolation","title":"DuckDB-Wasm Dedicated Worker & Memory Pool Isolation Guardrail","category":"frontend","severity":"critical","description":"Restricts all in-browser analytical compute with DuckDB-Wasm to isolated Web Worker execution contexts bounded by strict WebAssembly memory pools and watchdog monitors. Prohibits main-thread database instantiation and unconstrained buffer growth that induce rendering pipeline starvation and fatal browser tab terminations.","antiPatternHeadline":"Direct Main-Thread DuckDB Instantiation and Uncapped WebAssembly Memory Allocation","stars_count":42,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","duckdb-wasm","web-workers","performance","memory-management","webassembly"],"exportEndpoints":{"claude":"/api/rules/duckdb-wasm-worker-memory-isolation?format=claude","cursorMdc":"/api/rules/duckdb-wasm-worker-memory-isolation?format=mdc","cursorrules":"/api/rules/duckdb-wasm-worker-memory-isolation?format=cursor","windsurf":"/api/rules/duckdb-wasm-worker-memory-isolation?format=windsurf","agents":"/api/rules/duckdb-wasm-worker-memory-isolation?format=agents"}},{"id":"axum-tokio-cooperative-budget-cancellation-invariant","title":"Axum 0.8 Tokio Cooperative Task Budget Cancellation Invariant","category":"backend","severity":"critical","description":"Enforces strict coupling between Axum 0.8 streaming response lifecycles, Tokio cooperative task budget yielding, and explicit cancellation tokens. Guarantees bounded CPU starvation and immediate teardown of upstream processing pipelines during client disconnects or HTTP/3 stream resets.","antiPatternHeadline":"Spawning unmonitored streaming tasks or unyielding chunk loops that leak compute resources upon peer disconnect.","stars_count":55,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tokio","concurrency","http3"],"exportEndpoints":{"claude":"/api/rules/axum-tokio-cooperative-budget-cancellation-invariant?format=claude","cursorMdc":"/api/rules/axum-tokio-cooperative-budget-cancellation-invariant?format=mdc","cursorrules":"/api/rules/axum-tokio-cooperative-budget-cancellation-invariant?format=cursor","windsurf":"/api/rules/axum-tokio-cooperative-budget-cancellation-invariant?format=windsurf","agents":"/api/rules/axum-tokio-cooperative-budget-cancellation-invariant?format=agents"}},{"id":"valkey-8-io-thread-numa-affinity-standard","title":"Valkey 8.0 Multi-Threaded I/O Shard Affinity and NUMA Pinning Standard","category":"backend","severity":"critical","description":"Mandates strict CPU core pinning and NUMA node alignment for Valkey 8.0 multi-threaded I/O architectures to prevent cross-socket latency, L3 cache invalidation, and kernel lock contention. Prohibits floating threads across unbalanced sockets by configuring deterministic server-cpulist, bio-cpulist, and io-threads-cpulist parameters along with numactl process memory binding.","antiPatternHeadline":"Unpinned Multi-Threaded I/O Engines Spanning Asymmetric NUMA Nodes Inducing Inter-Socket Cache Thrashing","stars_count":57,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","valkey","numa","cpu-pinning","concurrency","caching","linux-kernel"],"exportEndpoints":{"claude":"/api/rules/valkey-8-io-thread-numa-affinity-standard?format=claude","cursorMdc":"/api/rules/valkey-8-io-thread-numa-affinity-standard?format=mdc","cursorrules":"/api/rules/valkey-8-io-thread-numa-affinity-standard?format=cursor","windsurf":"/api/rules/valkey-8-io-thread-numa-affinity-standard?format=windsurf","agents":"/api/rules/valkey-8-io-thread-numa-affinity-standard?format=agents"}},{"id":"tauri2-multi-webview-ipc-capability-scoping-guardrail","title":"Tauri 2.0 Multi-Webview IPC Capability Scoping & ACL Isolation","category":"mobile","severity":"critical","description":"Enforces strict origin-bound Access Control Lists (ACLs) and capability isolation across multi-webview and dynamic window architectures in Tauri 2.0 mobile and desktop targets. Eliminates native privilege escalation vectors by binding discrete IPC permissions exclusively to deterministic webview labels and cryptographically validated remote or local origins.","antiPatternHeadline":"Wildcard Capability Mapping and Unpartitioned Window IPC Binding","stars_count":85,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri-2","ipc-security","webview-isolation","acl-capabilities","rust"],"exportEndpoints":{"claude":"/api/rules/tauri2-multi-webview-ipc-capability-scoping-guardrail?format=claude","cursorMdc":"/api/rules/tauri2-multi-webview-ipc-capability-scoping-guardrail?format=mdc","cursorrules":"/api/rules/tauri2-multi-webview-ipc-capability-scoping-guardrail?format=cursor","windsurf":"/api/rules/tauri2-multi-webview-ipc-capability-scoping-guardrail?format=windsurf","agents":"/api/rules/tauri2-multi-webview-ipc-capability-scoping-guardrail?format=agents"}},{"id":"capacitor-secure-enclave-biometric-invalidation","title":"Capacitor 7 Secure Enclave Dynamic Biometric Invalidation and Database Purge","category":"mobile","severity":"critical","description":"Enforces immediate volatile cryptographic key zeroization, Secure Enclave/KeyStore secret invalidation, and SQLite (SQLCipher) handle purging whenever OS-level biometric enrollment changes or lock-screen authentication degrades. Guards against session hijacking caused by unauthorized fingerprint/face enrollment on compromised or shared devices.","antiPatternHeadline":"Persisting Decrypted Encryption Keys in Memory and Ignoring Biometric Enrollment Changes","stars_count":77,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","biometrics","secure-enclave","sqlcipher","security"],"exportEndpoints":{"claude":"/api/rules/capacitor-secure-enclave-biometric-invalidation?format=claude","cursorMdc":"/api/rules/capacitor-secure-enclave-biometric-invalidation?format=mdc","cursorrules":"/api/rules/capacitor-secure-enclave-biometric-invalidation?format=cursor","windsurf":"/api/rules/capacitor-secure-enclave-biometric-invalidation?format=windsurf","agents":"/api/rules/capacitor-secure-enclave-biometric-invalidation?format=agents"}},{"id":"cosign-ephemeral-slsa-provenance-attestation","title":"Sigstore Cosign Ephemeral Workload Identity SLSA Provenance Attestation","category":"security","severity":"critical","description":"Mandates keyless, hardware-rooted workload identity signing via Sigstore (Fulcio CA and Rekor transparency log) for all build provenance attestations generated inside ephemeral CI/CD runners. Strictly forbids static long-lived signing keys and mutable tag references, ensuring every published artifact carries tamper-evident SLSA provenance cryptographically bound to an immutable content digest.","antiPatternHeadline":"Static Secret Keys and Mutable Tag Attestation in CI/CD Runners","stars_count":60,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","sigstore","cosign","slsa","supply-chain","provenance","oidc"],"exportEndpoints":{"claude":"/api/rules/cosign-ephemeral-slsa-provenance-attestation?format=claude","cursorMdc":"/api/rules/cosign-ephemeral-slsa-provenance-attestation?format=mdc","cursorrules":"/api/rules/cosign-ephemeral-slsa-provenance-attestation?format=cursor","windsurf":"/api/rules/cosign-ephemeral-slsa-provenance-attestation?format=windsurf","agents":"/api/rules/cosign-ephemeral-slsa-provenance-attestation?format=agents"}},{"id":"k8s-1-32-inplace-resize-grace-barrier-production-standard","title":"Kubernetes 1.32 In-Place Pod Resize Dynamic Memory Grace Barrier Standard","category":"devops","severity":"critical","description":"Enforces deterministic synchronization between container engine cgroup resource adjustments and internal application runtime heap controllers during Kubernetes 1.32 In-Place Pod Vertical Scaling. Prevents instantaneous SIGKILL (exit code 137) OOM evictions during downward memory resizing by orchestrating explicit runtime garbage collection and heap limit compaction before the lower cgroup ceiling becomes active. Mandates explicit Pod resizePolicy declarations alongside dynamic runtime memory monitoring hooks.","antiPatternHeadline":"Unsynchronized In-Place Downward Resize Inducing Immediate Kernel OOMKill","stars_count":115,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","kubernetes","cgroups-v2","resource-management","oom-prevention"],"exportEndpoints":{"claude":"/api/rules/k8s-1-32-inplace-resize-grace-barrier-production-standard?format=claude","cursorMdc":"/api/rules/k8s-1-32-inplace-resize-grace-barrier-production-standard?format=mdc","cursorrules":"/api/rules/k8s-1-32-inplace-resize-grace-barrier-production-standard?format=cursor","windsurf":"/api/rules/k8s-1-32-inplace-resize-grace-barrier-production-standard?format=windsurf","agents":"/api/rules/k8s-1-32-inplace-resize-grace-barrier-production-standard?format=agents"}},{"id":"otel-ebpf-profiling-tail-sampling-invariant","title":"OpenTelemetry eBPF Continuous Profiling Adaptive Tail-Sampling Guardrail","category":"devops","severity":"critical","description":"Governs kernel-level continuous profiling ingestion rates using adaptive tail-sampling to capture thread latency anomalies without exhausting telemetry storage backends or collector memory. Mandates local ring-buffer retention with p99-evaluated forwarding, strict bounded heap limits, and backpressure shedding across eBPF collectors.","antiPatternHeadline":"Naive head-sampling or unbounded forwarding of high-frequency eBPF stack traces leading to OOM crashes and storage blowouts.","stars_count":64,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","ebpf","continuous-profiling","tail-sampling","observability"],"exportEndpoints":{"claude":"/api/rules/otel-ebpf-profiling-tail-sampling-invariant?format=claude","cursorMdc":"/api/rules/otel-ebpf-profiling-tail-sampling-invariant?format=mdc","cursorrules":"/api/rules/otel-ebpf-profiling-tail-sampling-invariant?format=cursor","windsurf":"/api/rules/otel-ebpf-profiling-tail-sampling-invariant?format=windsurf","agents":"/api/rules/otel-ebpf-profiling-tail-sampling-invariant?format=agents"}},{"id":"postgres-17-async-streaming-io-pin-budget-guardrail","title":"Postgres 17 Streaming I/O Buffer Pin Budget & AIO Saturation Guardrail","category":"backend","severity":"critical","description":"PostgreSQL 17 utilizes an asynchronous streaming read API that pre-pins shared buffers and schedules lookahead kernel AIO requests. Analytical streaming queries that interleave row consumption with network I/O or fail to bound fetch windows retain buffer pins indefinitely, exhausting AIO queue depths and starving concurrent OLTP transactions.","antiPatternHeadline":"Interleaving Client Async Operations Inside Unbounded Streaming Cursors Retaining Buffer Pins","stars_count":82,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres-17","async-io","buffer-pool","performance"],"exportEndpoints":{"claude":"/api/rules/postgres-17-async-streaming-io-pin-budget-guardrail?format=claude","cursorMdc":"/api/rules/postgres-17-async-streaming-io-pin-budget-guardrail?format=mdc","cursorrules":"/api/rules/postgres-17-async-streaming-io-pin-budget-guardrail?format=cursor","windsurf":"/api/rules/postgres-17-async-streaming-io-pin-budget-guardrail?format=windsurf","agents":"/api/rules/postgres-17-async-streaming-io-pin-budget-guardrail?format=agents"}},{"id":"nextjs15-ppr-cryptographic-shell-hole-isolation","title":"Next.js 15 PPR Cryptographic Shell-Hole and Streaming Boundary Isolation","category":"frontend","severity":"critical","description":"Enforces strict cryptographic boundary isolation for Next.js 15 Partial Prerendering (PPR) dynamic streaming slots embedded in static shells. Dynamic holes resolved inside static ISR shells must validate HMAC-signed resume tokens and scope dynamic runtime access behind isolated Suspense boundaries to prevent edge cache poisoning and SSR injection.","antiPatternHeadline":"Unsigned Dynamic Suspense Holes Leaking Tainted Context into Static Shells or Allowing Slot Boundary Forgery","stars_count":85,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs15","ppr","react19","cache-poisoning","cryptography"],"exportEndpoints":{"claude":"/api/rules/nextjs15-ppr-cryptographic-shell-hole-isolation?format=claude","cursorMdc":"/api/rules/nextjs15-ppr-cryptographic-shell-hole-isolation?format=mdc","cursorrules":"/api/rules/nextjs15-ppr-cryptographic-shell-hole-isolation?format=cursor","windsurf":"/api/rules/nextjs15-ppr-cryptographic-shell-hole-isolation?format=windsurf","agents":"/api/rules/nextjs15-ppr-cryptographic-shell-hole-isolation?format=agents"}},{"id":"otel-collector-w3c-baggage-isolation-gate","title":"OpenTelemetry Collector W3C Baggage Cross-Tenant Isolation Gate","category":"devops","severity":"critical","description":"Distributed context propagation across trust boundaries must enforce schema-validated egress sanitization of W3C Baggage headers. Multi-tenant execution metadata, internal account IDs, and routing context injected into Baggage must be filtered through OpenTelemetry Collector transform processors or custom OTTL pipelines to prevent sensitive data exfiltration to third-party integrations and unverified downstream boundaries.","antiPatternHeadline":"Blind Downstream Forwarding of Unsanitized W3C Baggage Headers Across Multi-Tenant Trust Boundaries","stars_count":98,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","security","multi-tenancy","baggage","tracing"],"exportEndpoints":{"claude":"/api/rules/otel-collector-w3c-baggage-isolation-gate?format=claude","cursorMdc":"/api/rules/otel-collector-w3c-baggage-isolation-gate?format=mdc","cursorrules":"/api/rules/otel-collector-w3c-baggage-isolation-gate?format=cursor","windsurf":"/api/rules/otel-collector-w3c-baggage-isolation-gate?format=windsurf","agents":"/api/rules/otel-collector-w3c-baggage-isolation-gate?format=agents"}},{"id":"webauthn-prf-zk-derivation-salt-rotation-standard","title":"Deterministic Salt Ratcheting and HKDF Expansion for WebAuthn PRF Zero-Knowledge Cryptographic Envelopes","category":"security","severity":"critical","description":"Hardware-backed symmetric keys derived via the WebAuthn PRF (hmac-secret) extension must never utilize static salts, raw PRF outputs as direct symmetric keys, or non-versioned derivation contexts. Client-side zero-knowledge envelopes must enforce HKDF-SHA-256 domain separation, monotonic salt ratcheting across write epochs, and immediate zeroization of transient key material in memory to guarantee offline cryptographic confidentiality.","antiPatternHeadline":"Static Salt Re-use and Direct Cipher Key Casting of Raw WebAuthn PRF Outputs","stars_count":56,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","prf-extension","zero-knowledge","cryptography","hkdf","forward-secrecy"],"exportEndpoints":{"claude":"/api/rules/webauthn-prf-zk-derivation-salt-rotation-standard?format=claude","cursorMdc":"/api/rules/webauthn-prf-zk-derivation-salt-rotation-standard?format=mdc","cursorrules":"/api/rules/webauthn-prf-zk-derivation-salt-rotation-standard?format=cursor","windsurf":"/api/rules/webauthn-prf-zk-derivation-salt-rotation-standard?format=windsurf","agents":"/api/rules/webauthn-prf-zk-derivation-salt-rotation-standard?format=agents"}},{"id":"kmp-stateflow-immutability-guardrail","title":"Kotlin Multiplatform StateFlow Immutability and AST Verification Guardrail","category":"mobile","severity":"critical","description":"Enforces strict compile-time immutability contracts for Kotlin Multiplatform (KMP) StateFlow architectures across JVM, iOS Native, and Web runtimes. Prevents cross-platform UI thread starvation, memory model leaks, and Jetpack/Compose Multiplatform recomposition storms by mandating persistent collections, atomic update semantics, and private state encapsulation.","antiPatternHeadline":"Exposing Mutable Collections or MutableStateFlow Leaks Causing Multiplatform Recomposition Storms","stars_count":80,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","stateflow","compose-multiplatform","coroutines"],"exportEndpoints":{"claude":"/api/rules/kmp-stateflow-immutability-guardrail?format=claude","cursorMdc":"/api/rules/kmp-stateflow-immutability-guardrail?format=mdc","cursorrules":"/api/rules/kmp-stateflow-immutability-guardrail?format=cursor","windsurf":"/api/rules/kmp-stateflow-immutability-guardrail?format=windsurf","agents":"/api/rules/kmp-stateflow-immutability-guardrail?format=agents"}},{"id":"tokio-async-cancellation-transaction-raii-guard","title":"Tokio Async-Cancellation Scope-Safe Transaction RAII Guard","category":"backend","severity":"critical","description":"Enforces synchronous Drop RAII guards with background rollback dispatching for database transactions across Tokio yield points. Prevents connection pool starvation, orphaned row-level locks, and phantom writes caused by dropped futures in cancellation scenarios like timeouts and select branches. Guarantees deterministic abort execution even when async executors drop executing futures without running async cleanup blocks.","antiPatternHeadline":"Dropping uncommitted async database transactions across Tokio cancellation boundaries without an RAII-dispatched background rollback","stars_count":52,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","tokio","concurrency","database","raii","async-cancellation"],"exportEndpoints":{"claude":"/api/rules/tokio-async-cancellation-transaction-raii-guard?format=claude","cursorMdc":"/api/rules/tokio-async-cancellation-transaction-raii-guard?format=mdc","cursorrules":"/api/rules/tokio-async-cancellation-transaction-raii-guard?format=cursor","windsurf":"/api/rules/tokio-async-cancellation-transaction-raii-guard?format=windsurf","agents":"/api/rules/tokio-async-cancellation-transaction-raii-guard?format=agents"}},{"id":"ebpf-lsm-memory-introspection-guardrail","title":"Synchronous eBPF LSM Enforcement Against Unauthorized Process Memory Scraping","category":"security","severity":"critical","description":"Enforces synchronous kernel-space interception of process memory inspection attempts (such as reads to /proc/$PID/mem and ptrace calls). Mitigates runtime credential scraping cold at the kernel boundary using eBPF Linux Security Module (LSM) hooks instead of bypass-prone asynchronous tracing probes.","antiPatternHeadline":"Relying on Asynchronous Kprobes or Passive Userspace Telemetry to Prevent Process Memory Scraping","stars_count":54,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","ebpf","lsm","linux-kernel","zero-trust","memory-protection"],"exportEndpoints":{"claude":"/api/rules/ebpf-lsm-memory-introspection-guardrail?format=claude","cursorMdc":"/api/rules/ebpf-lsm-memory-introspection-guardrail?format=mdc","cursorrules":"/api/rules/ebpf-lsm-memory-introspection-guardrail?format=cursor","windsurf":"/api/rules/ebpf-lsm-memory-introspection-guardrail?format=windsurf","agents":"/api/rules/ebpf-lsm-memory-introspection-guardrail?format=agents"}},{"id":"vite-6-workerd-ssr-context-boundary","title":"Vite 6 Environment API Workerd-SSR Context Boundary Enforcement","category":"frontend","severity":"critical","description":"Vite 6's Environment API enables isolated multi-runtime pipelines (e.g., client, edge/workerd, and node). Engineers must enforce strict compile-time module resolution barriers, condition fencing, and bundle virtualization to prevent Node.js native primitives, un-sandboxed global access, and private server secrets from leaking into Cloudflare Workerd edge worker bundles.","antiPatternHeadline":"Leaking Node.js Builtins and Un-sandboxed Host Globals into Vite 6 Workerd SSR Environments","stars_count":82,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","vite-6","environment-api","workerd","ssr","cloudflare-workers","module-isolation"],"exportEndpoints":{"claude":"/api/rules/vite-6-workerd-ssr-context-boundary?format=claude","cursorMdc":"/api/rules/vite-6-workerd-ssr-context-boundary?format=mdc","cursorrules":"/api/rules/vite-6-workerd-ssr-context-boundary?format=cursor","windsurf":"/api/rules/vite-6-workerd-ssr-context-boundary?format=windsurf","agents":"/api/rules/vite-6-workerd-ssr-context-boundary?format=agents"}},{"id":"temporal-go-deterministic-workflow-replay-guardrail","title":"Temporal Go SDK Deterministic Workflow Replay & History Assertion Standard","category":"backend","severity":"critical","description":"Workflow definitions in Temporal must maintain strict determinism across versions to prevent non-deterministic replay panics on running executions. All workflow alterations must utilize workflow.GetVersion for branching and be verified in CI using worker.WorkflowReplayer against production history JSON dumps prior to deployment.","antiPatternHeadline":"Modifying workflow call sequences without version branching or deploying unverified workflow changes against historical execution logs","stars_count":63,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","temporal","golang","distributed-systems","determinism","ci-cd"],"exportEndpoints":{"claude":"/api/rules/temporal-go-deterministic-workflow-replay-guardrail?format=claude","cursorMdc":"/api/rules/temporal-go-deterministic-workflow-replay-guardrail?format=mdc","cursorrules":"/api/rules/temporal-go-deterministic-workflow-replay-guardrail?format=cursor","windsurf":"/api/rules/temporal-go-deterministic-workflow-replay-guardrail?format=windsurf","agents":"/api/rules/temporal-go-deterministic-workflow-replay-guardrail?format=agents"}},{"id":"envoy-gateway-partition-resilient-rate-limit-invariant","title":"Envoy Gateway 1.2 Multi-Cluster Partition-Resilient Rate Limit Guardrail","category":"devops","severity":"critical","description":"Cross-region edge ingress must enforce a local token-bucket rate limit layer alongside global rate limiting policies within Envoy Gateway 1.2. In the event of cross-region network partitions or central rate-limit cluster degradation, local rate limiting guarantees deterministic traffic shedding to protect downstream backends from thundering herds.","antiPatternHeadline":"Global-Only Rate Limiting Failing Open During Cross-Region Partitions","stars_count":90,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","envoy-gateway","kubernetes","rate-limiting","reliability","traffic-management"],"exportEndpoints":{"claude":"/api/rules/envoy-gateway-partition-resilient-rate-limit-invariant?format=claude","cursorMdc":"/api/rules/envoy-gateway-partition-resilient-rate-limit-invariant?format=mdc","cursorrules":"/api/rules/envoy-gateway-partition-resilient-rate-limit-invariant?format=cursor","windsurf":"/api/rules/envoy-gateway-partition-resilient-rate-limit-invariant?format=windsurf","agents":"/api/rules/envoy-gateway-partition-resilient-rate-limit-invariant?format=agents"}},{"id":"openfga-conditional-evaluation-traversal-guard","title":"OpenFGA 1.6 Traversal Depth Bound and Conditional CEL Latency Guardrail","category":"security","severity":"critical","description":"Prevents unbounded distributed graph traversal, cascading latency degradation, and resource exhaustion in OpenFGA 1.6 Zanzibar authorization engines. Mandates strict client-side timeout propagation, bounded contextual tuple evaluation, depth-limited model relations, and O(1) Common Expression Language (CEL) conditionals under deep multi-tenant hierarchies.","antiPatternHeadline":"Unconstrained Recursive Relation Traversal and Unbounded Dynamic CEL Context Causing Authorization Engine DoS","stars_count":53,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","authorization","zanzibar","latency-budget","denial-of-service","cel"],"exportEndpoints":{"claude":"/api/rules/openfga-conditional-evaluation-traversal-guard?format=claude","cursorMdc":"/api/rules/openfga-conditional-evaluation-traversal-guard?format=mdc","cursorrules":"/api/rules/openfga-conditional-evaluation-traversal-guard?format=cursor","windsurf":"/api/rules/openfga-conditional-evaluation-traversal-guard?format=windsurf","agents":"/api/rules/openfga-conditional-evaluation-traversal-guard?format=agents"}},{"id":"kmp-shared-flow-swift6-sendable-guardrail","title":"Kotlin 2.1 SharedFlow & Swift 6 AsyncSequence Sendable Isolation Guardrail","category":"mobile","severity":"critical","description":"Enforces thread-safe, data-race-free interoperability between Kotlin Multiplatform 2.1 SharedFlow/StateFlow emissions and Swift 6 Complete Concurrency AsyncSequences. Eliminates cross-runtime thread pool exhaustion and cooperative thread starvation deadlocks caused by unmanaged coroutine collectors. Mandates strict Sendable isolation and deterministic cancellation bridging across the Darwin runtime boundary.","antiPatternHeadline":"Unchecked Cross-Boundary Flow Bridging Causing Swift 6 Isolation Escapes and Cooperative Thread Starvation Deadlocks","stars_count":78,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","swift6","concurrency","sendable","async-sequence","coroutines"],"exportEndpoints":{"claude":"/api/rules/kmp-shared-flow-swift6-sendable-guardrail?format=claude","cursorMdc":"/api/rules/kmp-shared-flow-swift6-sendable-guardrail?format=mdc","cursorrules":"/api/rules/kmp-shared-flow-swift6-sendable-guardrail?format=cursor","windsurf":"/api/rules/kmp-shared-flow-swift6-sendable-guardrail?format=windsurf","agents":"/api/rules/kmp-shared-flow-swift6-sendable-guardrail?format=agents"}},{"id":"react19-async-transition-optimistic-rollback-standard","title":"React 19 Async Transition Error Boundary & Optimistic Rollback Standard","category":"frontend","severity":"critical","description":"Mandates transactional reconciliation of optimistic UI mutations using React 19 useOptimistic and useActionState primitives within async Transitions. Guarantees deterministic rollback of speculative state updates when asynchronous actions reject, preventing UI-server desynchronization and unhandled transition faults.","antiPatternHeadline":"Manual Asynchronous Rollback via Secondary setState Calls and Swallowed Transition Failures","stars_count":44,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react19","use-optimistic","use-action-state","async-transitions","error-boundary"],"exportEndpoints":{"claude":"/api/rules/react19-async-transition-optimistic-rollback-standard?format=claude","cursorMdc":"/api/rules/react19-async-transition-optimistic-rollback-standard?format=mdc","cursorrules":"/api/rules/react19-async-transition-optimistic-rollback-standard?format=cursor","windsurf":"/api/rules/react19-async-transition-optimistic-rollback-standard?format=windsurf","agents":"/api/rules/react19-async-transition-optimistic-rollback-standard?format=agents"}},{"id":"otel-collector-tail-sampling-memory-guardrail-opentelemetry-co-717","title":"OpenTelemetry Collector Tail-Sampling Buffer Memory Ceiling Guardrail","category":"devops","severity":"critical","description":"Enforces strict memory ballast, memory_limiter processor ordering, and bounded trace buffer sizing within OpenTelemetry Collector deployments. Prevents container OOMKills during cardinality bursts while ensuring high-latency spans and 5xx error traces are deterministically retained through isolated priority queues.","antiPatternHeadline":"Unbounded tail-sampling buffers without upstream memory_limiter enforcement causing catastrophic collector OOM crash loops during traffic spikes.","stars_count":63,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","observability","tail-sampling","kubernetes","memory-management"],"exportEndpoints":{"claude":"/api/rules/otel-collector-tail-sampling-memory-guardrail-opentelemetry-co-717?format=claude","cursorMdc":"/api/rules/otel-collector-tail-sampling-memory-guardrail-opentelemetry-co-717?format=mdc","cursorrules":"/api/rules/otel-collector-tail-sampling-memory-guardrail-opentelemetry-co-717?format=cursor","windsurf":"/api/rules/otel-collector-tail-sampling-memory-guardrail-opentelemetry-co-717?format=windsurf","agents":"/api/rules/otel-collector-tail-sampling-memory-guardrail-opentelemetry-co-717?format=agents"}},{"id":"go-1-24-http-structured-concurrency-allocation-guardrail","title":"Go 1.24 HTTP Structured Concurrency & Request-Scope Allocation Guardrail","category":"backend","severity":"critical","description":"Enforces strict structured concurrency lifecycle management and zero-escape request-scoped memory allocation across high-throughput Go 1.24 HTTP services. Eliminates unbounded goroutine leaks by tying async work to request context trees, and mitigates GC thrashing by prohibiting boxed context keys and unpooled buffer escapes in middleware pipelines.","antiPatternHeadline":"Spawning detached goroutines inside HTTP handlers and allocating untyped context values that escape to the heap.","stars_count":102,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","concurrency","performance","memory-management","http"],"exportEndpoints":{"claude":"/api/rules/go-1-24-http-structured-concurrency-allocation-guardrail?format=claude","cursorMdc":"/api/rules/go-1-24-http-structured-concurrency-allocation-guardrail?format=mdc","cursorrules":"/api/rules/go-1-24-http-structured-concurrency-allocation-guardrail?format=cursor","windsurf":"/api/rules/go-1-24-http-structured-concurrency-allocation-guardrail?format=windsurf","agents":"/api/rules/go-1-24-http-structured-concurrency-allocation-guardrail?format=agents"}},{"id":"sd-jwt-claim-disclosure-invariant","title":"SD-JWT (RFC 9528) Selective Disclosure Cryptographic Integrity & Minimization Standard","category":"security","severity":"critical","description":"Enforces strict compliance with RFC 9528 for Selective Disclosure JSON Web Tokens (SD-JWT). Guarantees that selective disclosures are cryptographically hashed using collision-resistant digest algorithms matching the _sd_alg header, prevents leaking raw salt or plaintext identity claims in presentation payloads, and strictly rejects undecoded or malformed disclosure frames during token verification.","antiPatternHeadline":"Leaking Raw Disclosures or Salt Entropy in Verifier Payloads and Skipping Disclosure Digest Recalculation","stars_count":107,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","sd-jwt","rfc9528","decentralized-identity","zero-trust","cryptography"],"exportEndpoints":{"claude":"/api/rules/sd-jwt-claim-disclosure-invariant?format=claude","cursorMdc":"/api/rules/sd-jwt-claim-disclosure-invariant?format=mdc","cursorrules":"/api/rules/sd-jwt-claim-disclosure-invariant?format=cursor","windsurf":"/api/rules/sd-jwt-claim-disclosure-invariant?format=windsurf","agents":"/api/rules/sd-jwt-claim-disclosure-invariant?format=agents"}},{"id":"k8s-gateway-api-v1-2-cross-namespace-delegation-boundary","title":"Strict Gateway API v1.2 Cross-Namespace HTTPRoute Delegation & ReferenceGrant Boundaries","category":"devops","severity":"critical","description":"Enforces strict RBAC and architectural separation between cluster operators managing Gateway resources and tenant teams managing HTTPRoutes. Mandates ReferenceGrant enforcement, explicit allowedNamespaces route selector boundaries on Gateway listeners, and HTTPRoute-to-HTTPRoute delegation invariants to prevent tenant route hijacking and ingress privilege escalation.","antiPatternHeadline":"Permissive Gateway AllowedNamespaces Wildcards and Uncontrolled Cross-Namespace Backend References","stars_count":101,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","kubernetes","gateway-api","security","multi-tenancy","infrastructure-as-code"],"exportEndpoints":{"claude":"/api/rules/k8s-gateway-api-v1-2-cross-namespace-delegation-boundary?format=claude","cursorMdc":"/api/rules/k8s-gateway-api-v1-2-cross-namespace-delegation-boundary?format=mdc","cursorrules":"/api/rules/k8s-gateway-api-v1-2-cross-namespace-delegation-boundary?format=cursor","windsurf":"/api/rules/k8s-gateway-api-v1-2-cross-namespace-delegation-boundary?format=windsurf","agents":"/api/rules/k8s-gateway-api-v1-2-cross-namespace-delegation-boundary?format=agents"}},{"id":"tokio-tower-buffer-backpressure-deadlock-guardrail","title":"Tokio & Tower Buffer Backpressure and Circular-Wait Deadlock Prevention","category":"backend","severity":"critical","description":"Enforces strict ordering, worker isolation, and reservation-dispatch pairing for Tower Buffer middleware in Tokio-based Rust RPC clients and servers. Prevents re-entrant channel deadlocks, circular-wait lockups, and unmetered memory exhaustion in layered interceptor topologies.","antiPatternHeadline":"Interleaved Awaits Between poll_ready and call in Tower Buffers Causing Worker Starvation and Circular-Wait Deadlocks","stars_count":76,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","tokio","tower","concurrency","grpc","middleware"],"exportEndpoints":{"claude":"/api/rules/tokio-tower-buffer-backpressure-deadlock-guardrail?format=claude","cursorMdc":"/api/rules/tokio-tower-buffer-backpressure-deadlock-guardrail?format=mdc","cursorrules":"/api/rules/tokio-tower-buffer-backpressure-deadlock-guardrail?format=cursor","windsurf":"/api/rules/tokio-tower-buffer-backpressure-deadlock-guardrail?format=windsurf","agents":"/api/rules/tokio-tower-buffer-backpressure-deadlock-guardrail?format=agents"}},{"id":"whatwg-streams-backpressure-pipeline-standard","title":"WHATWG Streams API Backpressure-Driven Byte Stream Decoding Pipeline Standard","category":"frontend","severity":"critical","description":"Enforces strict backpressure propagation, unbuffered zero-copy chunk handoff, and BYOB (Bring Your Own Buffer) reader semantics across browser streaming pipelines. Mandates that multi-gigabyte binary streams are consumed using chunk-aligned transform loops and dedicated Web Workers to eliminate main-thread stalls and unbounded heap growth.","antiPatternHeadline":"Unbounded ArrayBuffer Aggregation and Unconstrained Async Loop Ingestion Without Backpressure","stars_count":96,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","whatwg-streams","backpressure","web-workers","binary-decoding","performance"],"exportEndpoints":{"claude":"/api/rules/whatwg-streams-backpressure-pipeline-standard?format=claude","cursorMdc":"/api/rules/whatwg-streams-backpressure-pipeline-standard?format=mdc","cursorrules":"/api/rules/whatwg-streams-backpressure-pipeline-standard?format=cursor","windsurf":"/api/rules/whatwg-streams-backpressure-pipeline-standard?format=windsurf","agents":"/api/rules/whatwg-streams-backpressure-pipeline-standard?format=agents"}},{"id":"svelte5-runes-cycle-fence-boundary","title":"Svelte 5 Runes Invalidation Fence & Microtask Boundary Convergence","category":"frontend","severity":"critical","description":"Enforces strict unidirectional data flow and deterministic microtask boundary fencing within Svelte 5 fine-grained reactive graphs ($state, $derived, $effect). Prohibits bidirectional state mutations inside reactive effects to eliminate cascading dependency tearing and infinite graph invalidation loops under high-frequency stream ingress.","antiPatternHeadline":"Mutating Dependent $state Inside $effect Causing Microtask Invalidation Cycles and Signal Graph Tearing","stars_count":91,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","reactivity","signals","performance"],"exportEndpoints":{"claude":"/api/rules/svelte5-runes-cycle-fence-boundary?format=claude","cursorMdc":"/api/rules/svelte5-runes-cycle-fence-boundary?format=mdc","cursorrules":"/api/rules/svelte5-runes-cycle-fence-boundary?format=cursor","windsurf":"/api/rules/svelte5-runes-cycle-fence-boundary?format=windsurf","agents":"/api/rules/svelte5-runes-cycle-fence-boundary?format=agents"}},{"id":"tauri-v2-ipc-scoped-capability-webview-isolation-standard","title":"Tauri 2.0 Scoped IPC Capabilities & Multi-Webview Isolation Standard","category":"frontend","severity":"critical","description":"Enforces granular IPC capability scoping and strict multi-webview runtime isolation within Tauri 2.0 desktop applications. Guarantees that secondary, untrusted, or multi-tenant webviews cannot invoke native privileged commands or execute cross-origin privilege escalations via shared IPC channels.","antiPatternHeadline":"Wildcard Window Targeting and Unrestricted IPC Exposure Across Multi-Webview Boundaries","stars_count":116,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","tauri-v2","ipc-security","webview-isolation","capabilities"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-ipc-scoped-capability-webview-isolation-standard?format=claude","cursorMdc":"/api/rules/tauri-v2-ipc-scoped-capability-webview-isolation-standard?format=mdc","cursorrules":"/api/rules/tauri-v2-ipc-scoped-capability-webview-isolation-standard?format=cursor","windsurf":"/api/rules/tauri-v2-ipc-scoped-capability-webview-isolation-standard?format=windsurf","agents":"/api/rules/tauri-v2-ipc-scoped-capability-webview-isolation-standard?format=agents"}},{"id":"kmp-skiko-cadisplaylink-promotion-sync","title":"KMP Skiko Metal Surface CADisplayLink ProMotion Frame Synchronization Guardrail","category":"mobile","severity":"critical","description":"Enforces strict temporal lockstep between Skiko's CAMetalLayer drawing pipeline and iOS CADisplayLink targets up to 120Hz ProMotion. Prevents frame dropping, micro-stutter, and torn presentation intervals during cross-platform Compose Multiplatform view transitions and interactive navigation gestures.","antiPatternHeadline":"Decoupled Unsynchronized Metal Rendering Loop on iOS RunLoops Causing Jitter and 60Hz Caps","stars_count":86,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","compose-multiplatform","skiko","metal","ios","promotion"],"exportEndpoints":{"claude":"/api/rules/kmp-skiko-cadisplaylink-promotion-sync?format=claude","cursorMdc":"/api/rules/kmp-skiko-cadisplaylink-promotion-sync?format=mdc","cursorrules":"/api/rules/kmp-skiko-cadisplaylink-promotion-sync?format=cursor","windsurf":"/api/rules/kmp-skiko-cadisplaylink-promotion-sync?format=windsurf","agents":"/api/rules/kmp-skiko-cadisplaylink-promotion-sync?format=agents"}},{"id":"capacitor7-geofence-power-throttle-invariant","title":"Capacitor 7 Background Geofencing Hardware-Power Step-Down Invariant","category":"mobile","severity":"critical","description":"Enforces battery-budget preservation in Capacitor 7 hybrid mobile applications by gating high-precision native geofence monitoring behind low-power step-down location providers. Continuous high-accuracy GNSS triggers OS watchdog terminations (iOS Energy Log kills, Android vitals excessive wake lock evictions) unless step-down coalescing is systematically implemented.","antiPatternHeadline":"Continuous High-Accuracy GNSS Polling and Ungated Native Geofence Registration Causing OS Battery Eviction","stars_count":88,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","geofencing","battery-optimization","corelocation","fused-location"],"exportEndpoints":{"claude":"/api/rules/capacitor7-geofence-power-throttle-invariant?format=claude","cursorMdc":"/api/rules/capacitor7-geofence-power-throttle-invariant?format=mdc","cursorrules":"/api/rules/capacitor7-geofence-power-throttle-invariant?format=cursor","windsurf":"/api/rules/capacitor7-geofence-power-throttle-invariant?format=windsurf","agents":"/api/rules/capacitor7-geofence-power-throttle-invariant?format=agents"}},{"id":"go-iter-seq-resource-leak-fence","title":"Go 1.24 iter.Seq and iter.Pull Concurrency Resource Leak Mitigation Fence","category":"backend","severity":"critical","description":"Enforces mandatory, unconditional invocation of the stop closure returned by iter.Pull/iter.Pull2 via defer and guarantees unblocked defer execution within custom iter.Seq/iter.Seq2 push producers upon yield rejection. Prevents paired goroutine leaks, orphaned database cursors, and deadlocked gRPC streams across early break, return, or panic paths in high-throughput pipelines.","antiPatternHeadline":"Orphaning iter.Pull Goroutines and Leaking Network Handles via Omitted stop() Calls on Early Exit","stars_count":96,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","concurrency","iterators","resource-management","leak-prevention"],"exportEndpoints":{"claude":"/api/rules/go-iter-seq-resource-leak-fence?format=claude","cursorMdc":"/api/rules/go-iter-seq-resource-leak-fence?format=mdc","cursorrules":"/api/rules/go-iter-seq-resource-leak-fence?format=cursor","windsurf":"/api/rules/go-iter-seq-resource-leak-fence?format=windsurf","agents":"/api/rules/go-iter-seq-resource-leak-fence?format=agents"}},{"id":"bun-websocket-backpressure-drain-high-watermark","title":"Bun 1.2 WebSocket Backpressure Drain High-Watermark Standard","category":"backend","severity":"critical","description":"Enforces strict native buffer limits and backpressure-aware packet dispatching on Bun 1.2 native WebSockets. By inspecting ws.getBufferedAmount() and handling the native drain() lifecycle callback, services prevent silent heap and C++ native memory exhaustion under asymmetrical consumer lag.","antiPatternHeadline":"Unbounded WebSocket Send Loop Ignoring Native Kernel and C++ Buffer Limits","stars_count":84,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","websockets","backpressure","memory-leak","realtime"],"exportEndpoints":{"claude":"/api/rules/bun-websocket-backpressure-drain-high-watermark?format=claude","cursorMdc":"/api/rules/bun-websocket-backpressure-drain-high-watermark?format=mdc","cursorrules":"/api/rules/bun-websocket-backpressure-drain-high-watermark?format=cursor","windsurf":"/api/rules/bun-websocket-backpressure-drain-high-watermark?format=windsurf","agents":"/api/rules/bun-websocket-backpressure-drain-high-watermark?format=agents"}},{"id":"postgres-17-json-table-streaming-memory-budgeting","title":"Postgres 17 JSON_TABLE Streaming Memory Ceiling and Plan Guardrail","category":"backend","severity":"critical","description":"Postgres 17 introduces the SQL:2016 JSON_TABLE standard, enabling direct relational projection of nested JSONB documents. Unbounded JSON path traversals and missing materialization barriers force backend worker processes to buffer parsed JSONB documents in work_mem or process memory, leading to out-of-memory (OOM) backend termination during high-throughput ETL jobs. This guardrail mandates bounded path expressions, explicit chunked streaming pagination, and strict per-query work_mem isolation.","antiPatternHeadline":"Unbounded JSON_TABLE Path Evaluation Buffering Arbitrary Multi-Megabyte Payloads into Single Worker Memory","stars_count":107,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres","jsonb","json-table","etl","memory-budgeting","database"],"exportEndpoints":{"claude":"/api/rules/postgres-17-json-table-streaming-memory-budgeting?format=claude","cursorMdc":"/api/rules/postgres-17-json-table-streaming-memory-budgeting?format=mdc","cursorrules":"/api/rules/postgres-17-json-table-streaming-memory-budgeting?format=cursor","windsurf":"/api/rules/postgres-17-json-table-streaming-memory-budgeting?format=windsurf","agents":"/api/rules/postgres-17-json-table-streaming-memory-budgeting?format=agents"}},{"id":"ebpf-xdp-dsr-conntrack-sync-guardrail","title":"eBPF XDP Layer-4 Direct Server Return (DSR) State Synchronization Guardrail","category":"devops","severity":"critical","description":"Enforces deterministic, synchronized conntrack state management across distributed XDP ingress routers deploying Layer-4 DSR load balancing. Prevents silent packet drops and TCP reset storms caused by asymmetric routing and stale Maglev/consistent-hash lookups during rapid autoscaling events.","antiPatternHeadline":"Local-only in-memory eBPF conntrack table updates without cluster-wide cross-node sync or consistent encapsulation fallbacks.","stars_count":42,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","xdp","networking","dsr","kubernetes","conntrack"],"exportEndpoints":{"claude":"/api/rules/ebpf-xdp-dsr-conntrack-sync-guardrail?format=claude","cursorMdc":"/api/rules/ebpf-xdp-dsr-conntrack-sync-guardrail?format=mdc","cursorrules":"/api/rules/ebpf-xdp-dsr-conntrack-sync-guardrail?format=cursor","windsurf":"/api/rules/ebpf-xdp-dsr-conntrack-sync-guardrail?format=windsurf","agents":"/api/rules/ebpf-xdp-dsr-conntrack-sync-guardrail?format=agents"}},{"id":"nextjs-15-tiered-cache-tags-distributed-purge-consistency","title":"Next.js 15 Tiered Cache Tags & Distributed Purge Consistency Invariant","category":"frontend","severity":"critical","description":"Enforces a hierarchical, deterministic tagging schema for Next.js 15 Data Cache and unstable_cache invocations across distributed edge regions. Prevents thundering herds, race conditions, and stale read states during high-concurrency revalidation events by coupling tag granularities with distributed locks and stale-while-revalidate invariants.","antiPatternHeadline":"Global Path Invalidation and Flat Tags Triggering Multi-Region Edge Stampedes","stars_count":60,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs15","cache-tags","edge-computing","thundering-herd","distributed-systems"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-tiered-cache-tags-distributed-purge-consistency?format=claude","cursorMdc":"/api/rules/nextjs-15-tiered-cache-tags-distributed-purge-consistency?format=mdc","cursorrules":"/api/rules/nextjs-15-tiered-cache-tags-distributed-purge-consistency?format=cursor","windsurf":"/api/rules/nextjs-15-tiered-cache-tags-distributed-purge-consistency?format=windsurf","agents":"/api/rules/nextjs-15-tiered-cache-tags-distributed-purge-consistency?format=agents"}},{"id":"go-124-weak-pointer-ephemeral-cache-guardrail","title":"Go 1.24 Weak Pointer Ephemeral Cache and GC Finalizer Guardrail","category":"backend","severity":"critical","description":"Enforces deterministic, non-blocking memory reclamation in Go 1.24+ using the standard 'weak' package for ephemeral caches. Prohibits legacy runtime.SetFinalizer patterns that induce object resurrection, GC sweep latency spikes, and concurrent lock inversion deadlocks.","antiPatternHeadline":"Resurrecting Evicted Cache Entries via runtime.SetFinalizer Under Inverted Mutex Locks","stars_count":42,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","concurrency","gc","memory-management","cache"],"exportEndpoints":{"claude":"/api/rules/go-124-weak-pointer-ephemeral-cache-guardrail?format=claude","cursorMdc":"/api/rules/go-124-weak-pointer-ephemeral-cache-guardrail?format=mdc","cursorrules":"/api/rules/go-124-weak-pointer-ephemeral-cache-guardrail?format=cursor","windsurf":"/api/rules/go-124-weak-pointer-ephemeral-cache-guardrail?format=windsurf","agents":"/api/rules/go-124-weak-pointer-ephemeral-cache-guardrail?format=agents"}},{"id":"bun-ffi-async-callback-gc-pinning-guardrail","title":"Bun 1.2 FFI Thread-Safe Async Callback & JSC Memory Pinning Guardrail","category":"backend","severity":"critical","description":"Enforces strict thread-safe callback configuration and deterministic JavaScriptCore (JSC) GC memory pinning when interfacing native C/Rust thread pools with Bun 1.2 FFI. Prevents fatal segmentation faults (SIGSEGV) caused by calling JSC off the main thread and use-after-free pointer corruption due to premature garbage collection.","antiPatternHeadline":"Ephemeral, non-threadsafe JSCallback instances passed to asynchronous native workers without GC anchoring.","stars_count":56,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","bun-ffi","native-interop","memory-safety","concurrency"],"exportEndpoints":{"claude":"/api/rules/bun-ffi-async-callback-gc-pinning-guardrail?format=claude","cursorMdc":"/api/rules/bun-ffi-async-callback-gc-pinning-guardrail?format=mdc","cursorrules":"/api/rules/bun-ffi-async-callback-gc-pinning-guardrail?format=cursor","windsurf":"/api/rules/bun-ffi-async-callback-gc-pinning-guardrail?format=windsurf","agents":"/api/rules/bun-ffi-async-callback-gc-pinning-guardrail?format=agents"}},{"id":"tauri-v2-mobile-ipc-capability-sandboxing-tauri-2-0-mobile-692","title":"Tauri 2.0 Mobile IPC Capability Sandboxing and Granular Permission Policy","category":"mobile","severity":"critical","description":"Enforces strict compile-time and runtime permission isolation across Tauri 2.0 mobile IPC boundaries. Prevents privilege escalation and arbitrary native code execution from compromised WebViews by mandating explicit capability file scoping, zero-trust remote URL policies, and fine-grained command parameter validation in Rust core.","antiPatternHeadline":"Wildcard Plugin Permissions and Unscoped IPC Invocations in Mobile WebViews","stars_count":70,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri-v2","ipc-security","capabilities","rust-tauri"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-mobile-ipc-capability-sandboxing-tauri-2-0-mobile-692?format=claude","cursorMdc":"/api/rules/tauri-v2-mobile-ipc-capability-sandboxing-tauri-2-0-mobile-692?format=mdc","cursorrules":"/api/rules/tauri-v2-mobile-ipc-capability-sandboxing-tauri-2-0-mobile-692?format=cursor","windsurf":"/api/rules/tauri-v2-mobile-ipc-capability-sandboxing-tauri-2-0-mobile-692?format=windsurf","agents":"/api/rules/tauri-v2-mobile-ipc-capability-sandboxing-tauri-2-0-mobile-692?format=agents"}},{"id":"webauthn-conditional-mediation-cross-origin-partitioning-guardrail","title":"WebAuthn Conditional Mediation Cross-Origin Partitioning & Session Isolation Invariant","category":"security","severity":"critical","description":"Enforces strict top-level origin isolation, explicit Permissions-Policy sandboxing, and cryptographic origin-binding during WebAuthn conditional mediation (passkey autofill) within micro-frontend federation layouts. Prevents cross-origin credential leakage, autofill hijacking, and federated session poisoning caused by unpartitioned credential mediation across untrusted remotes.","antiPatternHeadline":"Executing WebAuthn Conditional Autofill Inside Embedded Remotes or Relaying Assertions Across Cross-Origin Boundaries","stars_count":54,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","passkeys","conditional-mediation","micro-frontends","permissions-policy"],"exportEndpoints":{"claude":"/api/rules/webauthn-conditional-mediation-cross-origin-partitioning-guardrail?format=claude","cursorMdc":"/api/rules/webauthn-conditional-mediation-cross-origin-partitioning-guardrail?format=mdc","cursorrules":"/api/rules/webauthn-conditional-mediation-cross-origin-partitioning-guardrail?format=cursor","windsurf":"/api/rules/webauthn-conditional-mediation-cross-origin-partitioning-guardrail?format=windsurf","agents":"/api/rules/webauthn-conditional-mediation-cross-origin-partitioning-guardrail?format=agents"}},{"id":"openfga-transitive-freshness-pruning-barrier","title":"OpenFGA Transitive Relation Freshness and Cache Pruning Barrier","category":"security","severity":"critical","description":"Guarantees zero-trust authorization consistency across high-velocity relationship tuple mutations and pre-computed evaluation caches. Mandates transactional cache pruning barriers and strict consistency token propagation to prevent authorization revocation lag and stale access leakage in transitive relation graphs.","antiPatternHeadline":"Decoupled Fire-and-Forget Tuple Deletions Permitting Revocation Bypass via Stale Transitive Caches","stars_count":74,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","authorization","zanzibar","cache-invalidation","zero-trust"],"exportEndpoints":{"claude":"/api/rules/openfga-transitive-freshness-pruning-barrier?format=claude","cursorMdc":"/api/rules/openfga-transitive-freshness-pruning-barrier?format=mdc","cursorrules":"/api/rules/openfga-transitive-freshness-pruning-barrier?format=cursor","windsurf":"/api/rules/openfga-transitive-freshness-pruning-barrier?format=windsurf","agents":"/api/rules/openfga-transitive-freshness-pruning-barrier?format=agents"}},{"id":"otel-ebpf-profiler-ringbuf-overflow-guardrail","title":"OpenTelemetry eBPF Continuous Profiler Ring Buffer Sizing and Drop Mitigation Guardrail","category":"devops","severity":"critical","description":"Enforces strict kernel ring buffer page sizing, adaptive sampling frequencies, and epoll wakeup watermarks for OpenTelemetry eBPF continuous profiling agents. Prevents silent kernel-space sample drop spikes (-ENOSPC) during micro-bursts and guarantees bounded agent CPU overhead during high-density native stack unwinding. Ensures system stability by preventing unbounded lock memory allocations and kernel tracing telemetry blind spots.","antiPatternHeadline":"Statically Undersized BPF Ring Buffers with Unthrottled High-Frequency Native Stack Unwinding","stars_count":94,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","opentelemetry","continuous-profiling","kernel","observability","performance"],"exportEndpoints":{"claude":"/api/rules/otel-ebpf-profiler-ringbuf-overflow-guardrail?format=claude","cursorMdc":"/api/rules/otel-ebpf-profiler-ringbuf-overflow-guardrail?format=mdc","cursorrules":"/api/rules/otel-ebpf-profiler-ringbuf-overflow-guardrail?format=cursor","windsurf":"/api/rules/otel-ebpf-profiler-ringbuf-overflow-guardrail?format=windsurf","agents":"/api/rules/otel-ebpf-profiler-ringbuf-overflow-guardrail?format=agents"}},{"id":"cilium-clustermesh-wireguard-zero-downtime-rotation-standard","title":"Cilium Cluster Mesh eBPF WireGuard Zero-Downtime Key Rotation Standard","category":"devops","severity":"critical","description":"Enforces cryptographically continuous, zero-packet-loss key rotation workflows across multi-cluster Cilium eBPF WireGuard meshes. Guarantees that ephemeral VPN key re-generation synchronizes through dual-phase handshakes, validates cross-cluster eBPF routing tables, and asserts active Noise IK protocol completion before retiring legacy credentials.","antiPatternHeadline":"Unsynchronized Atomic Key Replacement Causing Cross-Cluster Routing Blackholes and Crypto Drop Panics","stars_count":99,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","cilium","ebpf","wireguard","kubernetes","clustermesh","encryption"],"exportEndpoints":{"claude":"/api/rules/cilium-clustermesh-wireguard-zero-downtime-rotation-standard?format=claude","cursorMdc":"/api/rules/cilium-clustermesh-wireguard-zero-downtime-rotation-standard?format=mdc","cursorrules":"/api/rules/cilium-clustermesh-wireguard-zero-downtime-rotation-standard?format=cursor","windsurf":"/api/rules/cilium-clustermesh-wireguard-zero-downtime-rotation-standard?format=windsurf","agents":"/api/rules/cilium-clustermesh-wireguard-zero-downtime-rotation-standard?format=agents"}},{"id":"nextjs-15-ppr-dynamic-hole-boundary","title":"Next.js 15 PPR Dynamic Hole Boundary & Static Shell Cache-Isolation","category":"frontend","severity":"critical","description":"Enforces strict boundary segregation between static shell pre-rendering and dynamic micro-task streaming in Next.js 15 Partial Prerendering (PPR). Mandates that all dynamic functions (cookies, headers, searchParams, and uncached data fetches) are strictly isolated within Suspense boundaries to prevent full-page static shell de-optimization and catastrophic dynamic session leakage into shared CDN caches.","antiPatternHeadline":"Accessing Dynamic Runtime Context at Page Root Shell Level Causing PPR De-optimization or Session Poisoning in Edge CDN Caches","stars_count":56,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["nextjs","nextjs-15","ppr","partial-prerendering","suspense","edge-cache","react-server-components"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-ppr-dynamic-hole-boundary?format=claude","cursorMdc":"/api/rules/nextjs-15-ppr-dynamic-hole-boundary?format=mdc","cursorrules":"/api/rules/nextjs-15-ppr-dynamic-hole-boundary?format=cursor","windsurf":"/api/rules/nextjs-15-ppr-dynamic-hole-boundary?format=windsurf","agents":"/api/rules/nextjs-15-ppr-dynamic-hole-boundary?format=agents"}},{"id":"go-chi-http3-zero-rtt-anti-replay-guardrail-go-1-24-chi-http-359","title":"Go 1.24 Chi HTTP/3 0-RTT Anti-Replay Guardrail for Mutating Endpoints","category":"backend","severity":"critical","description":"Enforces strict rejection of non-idempotent HTTP methods received via HTTP/3 0-RTT early data handshakes using HTTP 425 (Too Early) per RFC 8470. Prevents network attackers from executing packet replay attacks against state-mutating handlers before the QUIC/TLS handshake completes.","antiPatternHeadline":"Executing State-Mutating Chi Handlers via Replayable HTTP/3 0-RTT Early Data","stars_count":94,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","chi","http3","quic","zero-rtt","security","anti-replay"],"exportEndpoints":{"claude":"/api/rules/go-chi-http3-zero-rtt-anti-replay-guardrail-go-1-24-chi-http-359?format=claude","cursorMdc":"/api/rules/go-chi-http3-zero-rtt-anti-replay-guardrail-go-1-24-chi-http-359?format=mdc","cursorrules":"/api/rules/go-chi-http3-zero-rtt-anti-replay-guardrail-go-1-24-chi-http-359?format=cursor","windsurf":"/api/rules/go-chi-http3-zero-rtt-anti-replay-guardrail-go-1-24-chi-http-359?format=windsurf","agents":"/api/rules/go-chi-http3-zero-rtt-anti-replay-guardrail-go-1-24-chi-http-359?format=agents"}},{"id":"bun-sqlite-wal2-checkpoint-starvation-boundary","title":"Bun 1.2 SQLite WAL2 Checkpoint Starvation Boundary & Disk Growth Guardrail","category":"backend","severity":"critical","description":"Prevents unbounded WAL growth and container ENOSPC failures in high-throughput Bun 1.2 microservices using SQLite WAL/WAL2 mode. Enforces strict boundary isolation between synchronous read/write transactions and asynchronous event-loop operations, eliminating reader snapshot holding that blocks WAL log recycling.","antiPatternHeadline":"Suspending SQLite Transactions Across Asynchronous Event Loop Ticks","stars_count":115,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","sqlite","wal2","database-reliability","storage-starvation"],"exportEndpoints":{"claude":"/api/rules/bun-sqlite-wal2-checkpoint-starvation-boundary?format=claude","cursorMdc":"/api/rules/bun-sqlite-wal2-checkpoint-starvation-boundary?format=mdc","cursorrules":"/api/rules/bun-sqlite-wal2-checkpoint-starvation-boundary?format=cursor","windsurf":"/api/rules/bun-sqlite-wal2-checkpoint-starvation-boundary?format=windsurf","agents":"/api/rules/bun-sqlite-wal2-checkpoint-starvation-boundary?format=agents"}},{"id":"postgres-17-streaming-hash-join-memory-limit-enforcement","title":"Postgres 17 Streaming Hash Join Memory & Spill Limit Enforcement","category":"backend","severity":"critical","description":"Enforces strict per-query memory limits and temporary disk spill bounds for Postgres 17 streaming and parallel hash joins. Prevents container cgroup OOM kills and disk exhaustion during multi-batch inner relation builds by dynamically scoping work_mem, hash_mem_multiplier, and temp_file_limit within transactional boundaries.","antiPatternHeadline":"Executing Large Parallel Hash Joins Under Global Pool Defaults Leading to Container cgroup OOM Kills","stars_count":75,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["postgres","postgresql-17","backend","query-optimization","memory-management","performance"],"exportEndpoints":{"claude":"/api/rules/postgres-17-streaming-hash-join-memory-limit-enforcement?format=claude","cursorMdc":"/api/rules/postgres-17-streaming-hash-join-memory-limit-enforcement?format=mdc","cursorrules":"/api/rules/postgres-17-streaming-hash-join-memory-limit-enforcement?format=cursor","windsurf":"/api/rules/postgres-17-streaming-hash-join-memory-limit-enforcement?format=windsurf","agents":"/api/rules/postgres-17-streaming-hash-join-memory-limit-enforcement?format=agents"}},{"id":"kmp-ktor3-flow-ios-runloop-fence","title":"KMP Ktor 3.0 Coroutine Flow iOS RunLoop Synchronization Fence","category":"mobile","severity":"critical","description":"Enforces backpressure fences and RunLoop decoupling when bridging Ktor 3.0 reactive byte/event flows across Kotlin/Native to Apple Darwin platforms. Prevents CFRunLoop starvation, CADisplayLink hitching, and Grand Central Dispatch (GCD) thread pool exhaustion caused by direct main-thread Flow collection under high I/O ingress.","antiPatternHeadline":"Direct Main-Thread Collection of Unbuffered Ktor 3.0 Streaming Flows on Apple Darwin","stars_count":75,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","ktor-3","coroutines","ios","darwin","swift"],"exportEndpoints":{"claude":"/api/rules/kmp-ktor3-flow-ios-runloop-fence?format=claude","cursorMdc":"/api/rules/kmp-ktor3-flow-ios-runloop-fence?format=mdc","cursorrules":"/api/rules/kmp-ktor3-flow-ios-runloop-fence?format=cursor","windsurf":"/api/rules/kmp-ktor3-flow-ios-runloop-fence?format=windsurf","agents":"/api/rules/kmp-ktor3-flow-ios-runloop-fence?format=agents"}},{"id":"oauth21-dpop-nonce-sync-replay-boundary-guardrail","title":"OAuth 2.1 Asymmetric DPoP Proof Validation and Distributed Nonce Synchronization","category":"security","severity":"critical","description":"Mandates strict Demonstrating Proof-of-Possession (DPoP, RFC 9449) validation across distributed API gateways, binding access tokens to client asymmetric keys via SHA-256 hashes (`ath`). Enforces cluster-wide synchronized server-issued nonces and atomic single-use JTI replay caches to neutralize cross-gateway token replay attacks upon token exfiltration.","antiPatternHeadline":"Stateless or Localized DPoP Verification Allowing Cross-Gateway Token Replays and Unbound Bearer Token Substitution","stars_count":59,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","oauth2","dpop","rfc9449","zero-trust","api-gateway"],"exportEndpoints":{"claude":"/api/rules/oauth21-dpop-nonce-sync-replay-boundary-guardrail?format=claude","cursorMdc":"/api/rules/oauth21-dpop-nonce-sync-replay-boundary-guardrail?format=mdc","cursorrules":"/api/rules/oauth21-dpop-nonce-sync-replay-boundary-guardrail?format=cursor","windsurf":"/api/rules/oauth21-dpop-nonce-sync-replay-boundary-guardrail?format=windsurf","agents":"/api/rules/oauth21-dpop-nonce-sync-replay-boundary-guardrail?format=agents"}},{"id":"k8s-dra-gpu-partitioning-fence-standard","title":"Deterministic GPU Partitioning with Kubernetes 1.32 Dynamic Resource Allocation (DRA)","category":"devops","severity":"critical","description":"Enforces Kubernetes 1.32 Structured Resource Claims via resource.k8s.io/v1beta1 for multi-tenant accelerator workloads, completely replacing legacy static device-plugin limit injections. Guarantees deterministic hardware slicing (MIG/vGPU/MPS) with strict memory and compute isolation fences at the kube-scheduler level. Eliminates cross-tenant memory starvation and non-deterministic scheduler preemption failures during co-located inference.","antiPatternHeadline":"Binding Multi-Tenant Workloads to Static nvidia.com/gpu Limits with Unenforced Host-Level MIG/MPS Slicing","stars_count":116,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","kubernetes","dra","gpu-partitioning","inference-infrastructure","resource-management"],"exportEndpoints":{"claude":"/api/rules/k8s-dra-gpu-partitioning-fence-standard?format=claude","cursorMdc":"/api/rules/k8s-dra-gpu-partitioning-fence-standard?format=mdc","cursorrules":"/api/rules/k8s-dra-gpu-partitioning-fence-standard?format=cursor","windsurf":"/api/rules/k8s-dra-gpu-partitioning-fence-standard?format=windsurf","agents":"/api/rules/k8s-dra-gpu-partitioning-fence-standard?format=agents"}},{"id":"opentelemetry-baggage-pii-sanitization-egress-guardrail","title":"OpenTelemetry W3C Baggage PII Sanitization & Egress Redaction Policy","category":"devops","severity":"critical","description":"Enforces runtime egress filtering and compile-time type boundaries on OpenTelemetry W3C Baggage context propagation. Prevents inadvertent leakage of Personally Identifiable Information (PII) and secret credentials to external distributed trace hops via HTTP baggage headers. Mandates explicit allowlisting and automated redaction interceptors on all outbound distributed context injection vectors.","antiPatternHeadline":"Propagating Unfiltered W3C Baggage Headers Containing Tenant PII to External Third-Party APIs","stars_count":110,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","security","pii-sanitization","distributed-tracing","w3c-baggage"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-baggage-pii-sanitization-egress-guardrail?format=claude","cursorMdc":"/api/rules/opentelemetry-baggage-pii-sanitization-egress-guardrail?format=mdc","cursorrules":"/api/rules/opentelemetry-baggage-pii-sanitization-egress-guardrail?format=cursor","windsurf":"/api/rules/opentelemetry-baggage-pii-sanitization-egress-guardrail?format=windsurf","agents":"/api/rules/opentelemetry-baggage-pii-sanitization-egress-guardrail?format=agents"}},{"id":"nextjs-15-ppr-dynamic-hole-streaming-barrier","title":"Next.js 15 Partial Prerendering (PPR) Dynamic Hole Streaming Barrier & Zero-CLS Fallbacks","category":"frontend","severity":"critical","description":"Enforces strict isolation of dynamic React Server Components inside Suspense boundaries with dimensionally matched fallbacks when using Next.js 15 Partial Prerendering (PPR). Guarantees dynamic execution contexts (cookies, headers, un-cached data queries) never leak into the edge-cached static shell, preventing runtime de-opts and layout shifts (CLS).","antiPatternHeadline":"Leaking Dynamic Request APIs into Shell Scope and Unbounded Dynamic Fallback Layout Shifts","stars_count":53,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs","react-server-components","ppr","streaming","web-vitals"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-ppr-dynamic-hole-streaming-barrier?format=claude","cursorMdc":"/api/rules/nextjs-15-ppr-dynamic-hole-streaming-barrier?format=mdc","cursorrules":"/api/rules/nextjs-15-ppr-dynamic-hole-streaming-barrier?format=cursor","windsurf":"/api/rules/nextjs-15-ppr-dynamic-hole-streaming-barrier?format=windsurf","agents":"/api/rules/nextjs-15-ppr-dynamic-hole-streaming-barrier?format=agents"}},{"id":"svelte-5-untrack-async-boundary-lexical-isolation","title":"Svelte 5 Untrack Asynchronous Boundary Lexical Scope Isolation","category":"frontend","severity":"critical","description":"Enforces strict synchronous boundaries when using Svelte 5's untrack primitive to prevent reactive tracking context leakage. Svelte 5's reactivity runtime unsets the active reaction synchronously and reinstates it via a finally block; passing async functions to untrack or reading runes after await statements causes stealth dependencies, race conditions, and infinite reactive cascades.","antiPatternHeadline":"Passing Async Callbacks to untrack or Reading Rune State Across Await Boundaries","stars_count":66,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","reactivity","untrack","async-safety"],"exportEndpoints":{"claude":"/api/rules/svelte-5-untrack-async-boundary-lexical-isolation?format=claude","cursorMdc":"/api/rules/svelte-5-untrack-async-boundary-lexical-isolation?format=mdc","cursorrules":"/api/rules/svelte-5-untrack-async-boundary-lexical-isolation?format=cursor","windsurf":"/api/rules/svelte-5-untrack-async-boundary-lexical-isolation?format=windsurf","agents":"/api/rules/svelte-5-untrack-async-boundary-lexical-isolation?format=agents"}},{"id":"postgres-17-pg-combinebackup-lsn-fence-production-standard","title":"Postgres 17 pg_combinebackup Monotonic LSN & Timeline Integrity Fence","category":"backend","severity":"critical","description":"Enforces strict monotonic LSN validation and timeline continuity across backup chains prior to invoking Postgres 17 pg_combinebackup. Prevents silent corruption, broken recovery chains, and data loss caused by non-contiguous incremental backups, missing WAL intervals, or mismatched system identifiers during synthetic full backup generation.","antiPatternHeadline":"Executing pg_combinebackup on unvalidated directory lists without parsing backup_manifest LSN intervals and running post-combine pg_verifybackup validation.","stars_count":97,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","postgres-17","disaster-recovery","pg-combinebackup","backup-manifest","data-integrity"],"exportEndpoints":{"claude":"/api/rules/postgres-17-pg-combinebackup-lsn-fence-production-standard?format=claude","cursorMdc":"/api/rules/postgres-17-pg-combinebackup-lsn-fence-production-standard?format=mdc","cursorrules":"/api/rules/postgres-17-pg-combinebackup-lsn-fence-production-standard?format=cursor","windsurf":"/api/rules/postgres-17-pg-combinebackup-lsn-fence-production-standard?format=windsurf","agents":"/api/rules/postgres-17-pg-combinebackup-lsn-fence-production-standard?format=agents"}},{"id":"fastapi-pydantic-v2-polymorphic-core-schema-precompilation-guardrail","title":"FastAPI Pydantic v2 Polymorphic Core-Schema Precompilation Guardrail","category":"backend","severity":"critical","description":"Enforces module-level compile-time instantiation and core-schema pinning for Pydantic v2 polymorphic discriminated unions and TypeAdapters. Eliminates per-request pydantic-core SchemaValidator reconstruction and dynamic reflection overhead that causes CPU saturation and GIL bottlenecks under high-concurrency ingestion workloads.","antiPatternHeadline":"Dynamic per-request TypeAdapter synthesis and unpinned polymorphic union schema regeneration","stars_count":44,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["fastapi","pydantic-v2","pydantic-core","performance","polymorphism","backend","python"],"exportEndpoints":{"claude":"/api/rules/fastapi-pydantic-v2-polymorphic-core-schema-precompilation-guardrail?format=claude","cursorMdc":"/api/rules/fastapi-pydantic-v2-polymorphic-core-schema-precompilation-guardrail?format=mdc","cursorrules":"/api/rules/fastapi-pydantic-v2-polymorphic-core-schema-precompilation-guardrail?format=cursor","windsurf":"/api/rules/fastapi-pydantic-v2-polymorphic-core-schema-precompilation-guardrail?format=windsurf","agents":"/api/rules/fastapi-pydantic-v2-polymorphic-core-schema-precompilation-guardrail?format=agents"}},{"id":"tauri2-zero-copy-ipc-arraybuffer-boundary","title":"Tauri 2.0 Zero-Copy Native IPC ArrayBuffer Memory-Mapping Boundary","category":"mobile","severity":"critical","description":"Enforces serialization-free, memory-mapped binary transfers between mobile WebViews and native Rust engines in Tauri 2.0. Eliminates main-thread JSON serialization and base64 overhead that cause dropped frames and UI stalls during high-throughput sensor, camera, and audio streaming. Mandates the use of raw byte buffers via Tauri 2.0 Channel/Response abstractions rather than structured JSON bridging.","antiPatternHeadline":"Base64 or Number-Array Serialized IPC Streaming Over Webview Bridge","stars_count":117,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri-2","rust","zero-copy","ipc","arraybuffer","performance"],"exportEndpoints":{"claude":"/api/rules/tauri2-zero-copy-ipc-arraybuffer-boundary?format=claude","cursorMdc":"/api/rules/tauri2-zero-copy-ipc-arraybuffer-boundary?format=mdc","cursorrules":"/api/rules/tauri2-zero-copy-ipc-arraybuffer-boundary?format=cursor","windsurf":"/api/rules/tauri2-zero-copy-ipc-arraybuffer-boundary?format=windsurf","agents":"/api/rules/tauri2-zero-copy-ipc-arraybuffer-boundary?format=agents"}},{"id":"capacitor-7-biometric-keychain-session-sync","title":"Capacitor 7 Biometric Keychain Partitioning & Ephemeral Session Boundary Standard","category":"mobile","severity":"critical","description":"Mandates isolating authentication credentials to native hardware enclaves (iOS Keychain / Android KeyStore) across Capacitor 7 native-web bridges. Enforces an ephemeral, in-memory-only session model within the WebView runtime, guaranteeing credentials survive OS webview sandbox purges without ever persisting secrets in insecure web storage.","antiPatternHeadline":"Persisting Sensitive Session Credentials into Unencrypted Web Storage or Misconfiguring Biometric Enclave Partitioning in Hybrid WebViews","stars_count":49,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","biometrics","keychain","security","ios","android"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-biometric-keychain-session-sync?format=claude","cursorMdc":"/api/rules/capacitor-7-biometric-keychain-session-sync?format=mdc","cursorrules":"/api/rules/capacitor-7-biometric-keychain-session-sync?format=cursor","windsurf":"/api/rules/capacitor-7-biometric-keychain-session-sync?format=windsurf","agents":"/api/rules/capacitor-7-biometric-keychain-session-sync?format=agents"}},{"id":"webauthn-prf-zk-key-derivation-guardrail-webauthn-level-3-221","title":"WebAuthn Level 3 PRF Extension Client-Side Zero-Knowledge Key Derivation Invariants","category":"security","severity":"critical","description":"Enforces cryptographic invariants for WebAuthn Level 3 PRF (Pseudo-Random Function) extension usage. Mandates that PRF output materials never leave client memory, require immediate HKDF expansion into non-extractable Web Crypto keys, and strictly isolate client-side envelope encryption keys from relying party server payloads.","antiPatternHeadline":"Leaking Hardware-Derived PRF Key Material to Relying Party Servers or Direct Insecure Key Usage","stars_count":97,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","prf-extension","zero-knowledge","cryptography","passkeys","envelope-encryption"],"exportEndpoints":{"claude":"/api/rules/webauthn-prf-zk-key-derivation-guardrail-webauthn-level-3-221?format=claude","cursorMdc":"/api/rules/webauthn-prf-zk-key-derivation-guardrail-webauthn-level-3-221?format=mdc","cursorrules":"/api/rules/webauthn-prf-zk-key-derivation-guardrail-webauthn-level-3-221?format=cursor","windsurf":"/api/rules/webauthn-prf-zk-key-derivation-guardrail-webauthn-level-3-221?format=windsurf","agents":"/api/rules/webauthn-prf-zk-key-derivation-guardrail-webauthn-level-3-221?format=agents"}},{"id":"fedcm-browser-idp-sandbox-token-relay","title":"W3C FedCM Browser-Enforced IdP Sandbox and Token Relay Invariant","category":"security","severity":"critical","description":"Enforces strict browser-mediated identity assertion handoffs using the W3C Federated Credential Management (FedCM) API. Eliminates silent iframe postMessage hacks and covert link-decoration tracking vectors, guaranteeing that Relying Party and Identity Provider token exchanges execute exclusively via browser-sandboxed origin boundaries with verified 'Sec-Fetch-Dest: webidentity' constraints.","antiPatternHeadline":"Bypassing FedCM with Silent Hidden iFrames, Dynamic Link Decoration, or Unverified Token PostMessage Channels","stars_count":103,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","fedcm","identity","authentication","privacy-sandbox","oauth2"],"exportEndpoints":{"claude":"/api/rules/fedcm-browser-idp-sandbox-token-relay?format=claude","cursorMdc":"/api/rules/fedcm-browser-idp-sandbox-token-relay?format=mdc","cursorrules":"/api/rules/fedcm-browser-idp-sandbox-token-relay?format=cursor","windsurf":"/api/rules/fedcm-browser-idp-sandbox-token-relay?format=windsurf","agents":"/api/rules/fedcm-browser-idp-sandbox-token-relay?format=agents"}},{"id":"ebpf-tc-ingress-w3c-tracecontext-injection","title":"Kernel-Level W3C TraceContext Ingress Injection via eBPF TC","category":"devops","severity":"critical","description":"Enforces deterministic W3C TraceContext propagation at the eBPF Traffic Control (TC) ingress hook prior to socket layer demuxing and userspace runtime consumption. Guarantees end-to-end distributed tracing across heterogeneous service mesh runtimes by eliminating userspace decoding blind spots, preserving BPF verifier packet-boundary invariants, and preventing payload corruption.","antiPatternHeadline":"Userspace-Only Context Extraction Causing Observability Gaps and Corrupt Ingress Header Slices","stars_count":111,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","tc","w3c-tracecontext","networking","observability","bpf-verifier"],"exportEndpoints":{"claude":"/api/rules/ebpf-tc-ingress-w3c-tracecontext-injection?format=claude","cursorMdc":"/api/rules/ebpf-tc-ingress-w3c-tracecontext-injection?format=mdc","cursorrules":"/api/rules/ebpf-tc-ingress-w3c-tracecontext-injection?format=cursor","windsurf":"/api/rules/ebpf-tc-ingress-w3c-tracecontext-injection?format=windsurf","agents":"/api/rules/ebpf-tc-ingress-w3c-tracecontext-injection?format=agents"}},{"id":"opentelemetry-exponential-histogram-dynamic-scale-down","title":"OpenTelemetry Exponential Histogram Dynamic Scale-Down & Memory Invariant","category":"devops","severity":"critical","description":"Enforces dynamic scale-down invariants for OpenTelemetry exponential histograms under extreme latency distributions, guaranteeing a bounded memory footprint via strict max_buckets caps while preserving sub-millisecond tail percentile accuracy. Mandates automatic scale decay and bucket collapsing rather than arbitrary sample dropping or unbounded linear bucket allocation.","antiPatternHeadline":"Unbounded Bucket Expansion via Static High-Scale Exponential Histograms Causing OOM Kills","stars_count":80,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","metrics","observability","exponential-histogram","memory-management"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-exponential-histogram-dynamic-scale-down?format=claude","cursorMdc":"/api/rules/opentelemetry-exponential-histogram-dynamic-scale-down?format=mdc","cursorrules":"/api/rules/opentelemetry-exponential-histogram-dynamic-scale-down?format=cursor","windsurf":"/api/rules/opentelemetry-exponential-histogram-dynamic-scale-down?format=windsurf","agents":"/api/rules/opentelemetry-exponential-histogram-dynamic-scale-down?format=agents"}},{"id":"svelte-5-runes-cross-worker-proxy-invariant","title":"Svelte 5 Runes Cross-Worker State Synchronization & Proxy Isolation Standard","category":"frontend","severity":"critical","description":"Enforces deterministic state boundaries between Svelte 5 Runes reactivity and Web Worker thread pools. Guarantees that deeply reactive proxies created by $state() are snapshot-sanitized prior to postMessage serialization, preventing runtime DataCloneError exceptions, thread-boundary proxy leakage, and reactive graph tearing.","antiPatternHeadline":"Direct Serialization of Svelte 5 Reactive Proxies and Unsynchronized Worker Mutability Leading to DataCloneError and State Tearing","stars_count":94,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","web-workers","reactivity","concurrency"],"exportEndpoints":{"claude":"/api/rules/svelte-5-runes-cross-worker-proxy-invariant?format=claude","cursorMdc":"/api/rules/svelte-5-runes-cross-worker-proxy-invariant?format=mdc","cursorrules":"/api/rules/svelte-5-runes-cross-worker-proxy-invariant?format=cursor","windsurf":"/api/rules/svelte-5-runes-cross-worker-proxy-invariant?format=windsurf","agents":"/api/rules/svelte-5-runes-cross-worker-proxy-invariant?format=agents"}},{"id":"fastapi-anyio-taskgroup-cancellation-isolation","title":"FastAPI AnyIO TaskGroup Structured Concurrency & Cancellation Isolation","category":"backend","severity":"critical","description":"Enforces deterministic teardown and structured concurrency isolation for AnyIO task groups within FastAPI route handlers when client disconnects occur. Mandates explicit cancellation shielding for non-idempotent operations and prevents AnyIO cancellation exceptions from corrupting shared worker thread pools or leaking raw errors into ASGI middleware.","antiPatternHeadline":"Spawning detached asyncio tasks or unshielded AnyIO TaskGroups that leak unhandled cancellation exceptions and leave thread-pool workers orphaned on client disconnect","stars_count":112,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","anyio","structured-concurrency","cancellation","asyncio","python"],"exportEndpoints":{"claude":"/api/rules/fastapi-anyio-taskgroup-cancellation-isolation?format=claude","cursorMdc":"/api/rules/fastapi-anyio-taskgroup-cancellation-isolation?format=mdc","cursorrules":"/api/rules/fastapi-anyio-taskgroup-cancellation-isolation?format=cursor","windsurf":"/api/rules/fastapi-anyio-taskgroup-cancellation-isolation?format=windsurf","agents":"/api/rules/fastapi-anyio-taskgroup-cancellation-isolation?format=agents"}},{"id":"postgres-17-parallel-apply-conflict-guardrail","title":"PostgreSQL 17 Parallel Logical Replication Apply Boundary & Conflict Ordering Guardrail","category":"backend","severity":"critical","description":"Enforces deterministic conflict handling, strict monotonic commit order, and origin boundary isolation for PostgreSQL 17 parallel logical replication apply workers. Prevents silent data divergence, circular replication loops, and transaction serialization failures across multi-active topologies.","antiPatternHeadline":"Unbounded Parallel Apply with Non-Deterministic Conflict Ignorance and Missing Origin Filters","stars_count":61,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres-17","logical-replication","distributed-systems","high-availability"],"exportEndpoints":{"claude":"/api/rules/postgres-17-parallel-apply-conflict-guardrail?format=claude","cursorMdc":"/api/rules/postgres-17-parallel-apply-conflict-guardrail?format=mdc","cursorrules":"/api/rules/postgres-17-parallel-apply-conflict-guardrail?format=cursor","windsurf":"/api/rules/postgres-17-parallel-apply-conflict-guardrail?format=windsurf","agents":"/api/rules/postgres-17-parallel-apply-conflict-guardrail?format=agents"}},{"id":"go-chi-http3-zero-rtt-anti-replay-standard","title":"Go Chi HTTP/3 0-RTT Anti-Replay and Early Data Transport Guardrail","category":"backend","severity":"critical","description":"Enforces strict transport-layer validation and rejection of TLS 1.3 / QUIC 0-RTT Early Data on non-idempotent HTTP routes within Go Chi services. Prevents replay-window exploitation by rejecting unconfirmed early-data requests with RFC 8470 HTTP 425 (Too Early) or deferring stateful execution until the full TLS handshake is finalized.","antiPatternHeadline":"Executing State-Mutating Handlers Over Unvalidated QUIC 0-RTT Early Data","stars_count":119,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","chi","http3","quic","security","tls","zero-rtt"],"exportEndpoints":{"claude":"/api/rules/go-chi-http3-zero-rtt-anti-replay-standard?format=claude","cursorMdc":"/api/rules/go-chi-http3-zero-rtt-anti-replay-standard?format=mdc","cursorrules":"/api/rules/go-chi-http3-zero-rtt-anti-replay-standard?format=cursor","windsurf":"/api/rules/go-chi-http3-zero-rtt-anti-replay-standard?format=windsurf","agents":"/api/rules/go-chi-http3-zero-rtt-anti-replay-standard?format=agents"}},{"id":"webauthn-prf-client-side-key-derivation-standard","title":"WebAuthn PRF Extension Zero-Knowledge Key Derivation & HKDF Isolation Standard","category":"security","severity":"critical","description":"Mandates strict zero-knowledge client-side cryptographic bounds when using the WebAuthn PRF (Pseudo-Random Function) extension. Requires non-extractable HKDF-SHA-256 expansion, distinct credential-specific salts, context-bound domain separation, and zero exposure of derived symmetric keys or raw PRF hardware outputs to relying party servers or persistent storage.","antiPatternHeadline":"Exposing Raw Authenticator PRF Outputs or Directly Using PRF Results as Symmetric Cipher Keys","stars_count":91,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","prf-extension","zero-knowledge","cryptography","hkdf","aes-gcm"],"exportEndpoints":{"claude":"/api/rules/webauthn-prf-client-side-key-derivation-standard?format=claude","cursorMdc":"/api/rules/webauthn-prf-client-side-key-derivation-standard?format=mdc","cursorrules":"/api/rules/webauthn-prf-client-side-key-derivation-standard?format=cursor","windsurf":"/api/rules/webauthn-prf-client-side-key-derivation-standard?format=windsurf","agents":"/api/rules/webauthn-prf-client-side-key-derivation-standard?format=agents"}},{"id":"openfga-distributed-tuple-cache-consistency-standard","title":"OpenFGA Distributed ReBAC Tuple Evaluation & Cache Stampede Elimination Standard","category":"security","severity":"critical","description":"Enforces deterministic ReBAC graph evaluation coalescing, model-version-bound cache keys, and causal consistency token propagation for OpenFGA authorization checks. Prevents authorization bypasses arising from stale permission revocations (New Enemy Problem) and mitigates upstream OpenFGA graph amplification and cache stampedes under high concurrency.","antiPatternHeadline":"Naive Tuple Key-Value Caching with Uncoordinated In-Flight Graph Traversals and Stale Consistency Tokens","stars_count":47,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","rebac","authorization","cache-stampede","distributed-systems"],"exportEndpoints":{"claude":"/api/rules/openfga-distributed-tuple-cache-consistency-standard?format=claude","cursorMdc":"/api/rules/openfga-distributed-tuple-cache-consistency-standard?format=mdc","cursorrules":"/api/rules/openfga-distributed-tuple-cache-consistency-standard?format=cursor","windsurf":"/api/rules/openfga-distributed-tuple-cache-consistency-standard?format=windsurf","agents":"/api/rules/openfga-distributed-tuple-cache-consistency-standard?format=agents"}},{"id":"capacitor-7-indexeddb-sqlite-wal-bridge-standard","title":"Capacitor 7 Isolated WebView IndexedDB-to-Native SQLite WAL Bridge","category":"mobile","severity":"critical","description":"Protects against silent OS-level storage eviction and cross-context race conditions in Capacitor 7 hybrid applications. Mandates that native SQLite in Write-Ahead Logging (WAL) mode acts as the single source of truth, while WebView IndexedDB serves strictly as an ephemeral, rehydratable read cache synchronized via monotonic transaction logs.","antiPatternHeadline":"Direct Authoritative Storage in Isolated WebViews Leading to Silent Eviction and Split-Brain Mutation Races","stars_count":97,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor-7","sqlite","indexeddb","wal-sync","offline-first","data-integrity"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-indexeddb-sqlite-wal-bridge-standard?format=claude","cursorMdc":"/api/rules/capacitor-7-indexeddb-sqlite-wal-bridge-standard?format=mdc","cursorrules":"/api/rules/capacitor-7-indexeddb-sqlite-wal-bridge-standard?format=cursor","windsurf":"/api/rules/capacitor-7-indexeddb-sqlite-wal-bridge-standard?format=windsurf","agents":"/api/rules/capacitor-7-indexeddb-sqlite-wal-bridge-standard?format=agents"}},{"id":"kmp-stateflow-threadsafe-mutation-guardrail","title":"Kotlin Multiplatform StateFlow Atomic Confinement and Thread-Safe Mutation Guardrail","category":"mobile","severity":"critical","description":"Guarantees thread-safe shared mutable state between JVM and Kotlin/Native runtimes by forbidding direct property assignment and unconfined coroutine execution on MutableStateFlow. Enforces atomic state transitions via .update{} and pins mutations to deterministic coroutine contexts to eliminate race conditions and memory model desynchronization across platforms.","antiPatternHeadline":"Direct MutableStateFlow.value reassignments from arbitrary or unconfined coroutine scopes across JVM and Darwin runtimes","stars_count":67,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","coroutines","stateflow","concurrency","ios-android"],"exportEndpoints":{"claude":"/api/rules/kmp-stateflow-threadsafe-mutation-guardrail?format=claude","cursorMdc":"/api/rules/kmp-stateflow-threadsafe-mutation-guardrail?format=mdc","cursorrules":"/api/rules/kmp-stateflow-threadsafe-mutation-guardrail?format=cursor","windsurf":"/api/rules/kmp-stateflow-threadsafe-mutation-guardrail?format=windsurf","agents":"/api/rules/kmp-stateflow-threadsafe-mutation-guardrail?format=agents"}},{"id":"k8s-132-inplace-pod-resource-scaling-boundary","title":"Kubernetes 1.32 In-Place Pod Vertical Resource Scaling Boundary","category":"devops","severity":"critical","description":"Governs the dynamic patching of container CPU and memory allocations under Kubernetes 1.32 InPlacePodVerticalScaling. Mandates strict resource resize policies, validation of node allocatable headroom, and sequenced memory step-downs to eliminate pod eviction, container restarts, and kernel out-of-memory (OOM) kills.","antiPatternHeadline":"Patching pod container resources without restartPolicy controls and node capacity pre-checks, triggering node overcommit and silent pod restarts","stars_count":62,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","kubernetes","k8s-1.32","resource-management","in-place-scaling"],"exportEndpoints":{"claude":"/api/rules/k8s-132-inplace-pod-resource-scaling-boundary?format=claude","cursorMdc":"/api/rules/k8s-132-inplace-pod-resource-scaling-boundary?format=mdc","cursorrules":"/api/rules/k8s-132-inplace-pod-resource-scaling-boundary?format=cursor","windsurf":"/api/rules/k8s-132-inplace-pod-resource-scaling-boundary?format=windsurf","agents":"/api/rules/k8s-132-inplace-pod-resource-scaling-boundary?format=agents"}},{"id":"otel-exemplar-tail-sampling-standard","title":"OpenTelemetry Bounded Exemplar Retention and Tail-Sampled Metric Invariant","category":"devops","severity":"critical","description":"Restricts OpenTelemetry histogram exemplar retention to bounded, fixed-size memory reservoirs while enforcing zero high-cardinality metric labels. Deterministically binds high-cardinality trace contexts and tail-sampling policies exclusively to latency quantile outliers to eliminate memory bloat and metrics storage explosion.","antiPatternHeadline":"Unbounded Metric Label Cardinality with Head-Sampled Tracing and Leaky Exemplar Reservoirs","stars_count":42,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","metrics","tracing","observability","tail-sampling"],"exportEndpoints":{"claude":"/api/rules/otel-exemplar-tail-sampling-standard?format=claude","cursorMdc":"/api/rules/otel-exemplar-tail-sampling-standard?format=mdc","cursorrules":"/api/rules/otel-exemplar-tail-sampling-standard?format=cursor","windsurf":"/api/rules/otel-exemplar-tail-sampling-standard?format=windsurf","agents":"/api/rules/otel-exemplar-tail-sampling-standard?format=agents"}},{"id":"vite-6-environment-api-ssr-target-isolation-guardrail","title":"Vite 6 Environment API SSR Runtime Target Isolation Guardrail","category":"frontend","severity":"critical","description":"Enforces strict module graph separation, dedicated DevEnvironment instances, and isolated global/hot scopes across client, edge, and node runtimes in Vite 6 SSR architectures. Prevents cross-environment state leakage, dual-module graph contamination, and cumulative memory leaks caused by sharing server-side state or module execution runners across distinct request boundaries.","antiPatternHeadline":"Global Module Contamination and Shared Environment State in Vite SSR","stars_count":58,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","vite6","ssr","environment-api","hmr","memory-leaks"],"exportEndpoints":{"claude":"/api/rules/vite-6-environment-api-ssr-target-isolation-guardrail?format=claude","cursorMdc":"/api/rules/vite-6-environment-api-ssr-target-isolation-guardrail?format=mdc","cursorrules":"/api/rules/vite-6-environment-api-ssr-target-isolation-guardrail?format=cursor","windsurf":"/api/rules/vite-6-environment-api-ssr-target-isolation-guardrail?format=windsurf","agents":"/api/rules/vite-6-environment-api-ssr-target-isolation-guardrail?format=agents"}},{"id":"tanstack-router-strict-search-validation","title":"TanStack Router Strict Search Param Validation and Schema Sanitization","category":"frontend","severity":"critical","description":"Enforces deterministic, runtime-validated search parameter parsing on all TanStack Router routes prior to component mounting. Guarantees that query state is structurally sanitized via resilient Zod or Valibot schemas with fallback defaults, preventing SSR hydration mismatches, NaN/prototype pollution, and unhandled boundary crashes caused by malformed or adversarial URLs.","antiPatternHeadline":"Accessing Unvalidated Query Strings via Loose Typing, Raw Window APIs, or Non-Sanitized Route Search Definitions","stars_count":115,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","tanstack-router","zod","type-safety","security","hydration"],"exportEndpoints":{"claude":"/api/rules/tanstack-router-strict-search-validation?format=claude","cursorMdc":"/api/rules/tanstack-router-strict-search-validation?format=mdc","cursorrules":"/api/rules/tanstack-router-strict-search-validation?format=cursor","windsurf":"/api/rules/tanstack-router-strict-search-validation?format=windsurf","agents":"/api/rules/tanstack-router-strict-search-validation?format=agents"}},{"id":"postgres-17-json-table-memory-projection-standard","title":"Postgres 17 JSON_TABLE Memory Projection and WorkMem Ceiling Standard","category":"backend","severity":"critical","description":"Establishes deterministic memory ceilings, plan cost controls, and strict column projection schemas on Postgres 17 SQL/JSON JSON_TABLE transformations. Unbounded array expansions and dynamic text extractions without localized work_mem boundaries or nested path limits trigger non-spillable executor buffer bloat, leading to connection termination and backend Out-Of-Memory (OOM) events. This standard enforces stream-friendly projections, localized session memory clamps, and explicit column sizing.","antiPatternHeadline":"Unbounded JSON_TABLE Cartesian Expansions and Default WorkMem Starvation","stars_count":104,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres-17","json-table","work-mem","memory-leak","sql-json","performance"],"exportEndpoints":{"claude":"/api/rules/postgres-17-json-table-memory-projection-standard?format=claude","cursorMdc":"/api/rules/postgres-17-json-table-memory-projection-standard?format=mdc","cursorrules":"/api/rules/postgres-17-json-table-memory-projection-standard?format=cursor","windsurf":"/api/rules/postgres-17-json-table-memory-projection-standard?format=windsurf","agents":"/api/rules/postgres-17-json-table-memory-projection-standard?format=agents"}},{"id":"fastapi-streamingresponse-async-generator-cancellation-guardrail","title":"FastAPI StreamingResponse Upstream Async Generator Disconnect Cancellation Guardrail","category":"backend","severity":"critical","description":"FastAPI `StreamingResponse` iterators do not automatically interrupt long-running upstream database or network generators when clients abort connections unless explicit ASGI disconnect monitoring is bound to the async generator loop. Unbound stream generators continue iterating in background tasks, exhausting connection pools, leaking cursor memory, and leaving zombie database transactions open. This standard mandates explicit request disconnect polling via `request.is_disconnected()`, `asyncio.CancelledError` trapping, and deterministic resource release within upstream async generator iterators.","antiPatternHeadline":"Unmonitored StreamingResponse generator causing zombie database queries and pool exhaustion on client disconnect","stars_count":56,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["fastapi","asgi","streaming-response","asyncio","resource-leak","python","backend"],"exportEndpoints":{"claude":"/api/rules/fastapi-streamingresponse-async-generator-cancellation-guardrail?format=claude","cursorMdc":"/api/rules/fastapi-streamingresponse-async-generator-cancellation-guardrail?format=mdc","cursorrules":"/api/rules/fastapi-streamingresponse-async-generator-cancellation-guardrail?format=cursor","windsurf":"/api/rules/fastapi-streamingresponse-async-generator-cancellation-guardrail?format=windsurf","agents":"/api/rules/fastapi-streamingresponse-async-generator-cancellation-guardrail?format=agents"}},{"id":"go-chi-context-deadline-tree-cancellation-standard","title":"Go Chi HTTP/2 & HTTP/3 Context Propagation and Subtree Cancellation Guardrail","category":"backend","severity":"critical","description":"Mandates strict downstream propagation of Chi request contexts and active cancellation listeners across all spawned goroutine subtrees. Inbound HTTP/2 RST_STREAM frames and HTTP/3 transport terminations must preemptively abort downstream database transactions and RPC calls to prevent connection pool exhaustion and resource leaks under network degradation.","antiPatternHeadline":"Orphan Goroutines and Context Severance During HTTP/2 Client Transport Disconnects","stars_count":86,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["go","chi","context-cancellation","http2","http3","goroutine-leaks","sql-pool-exhaustion"],"exportEndpoints":{"claude":"/api/rules/go-chi-context-deadline-tree-cancellation-standard?format=claude","cursorMdc":"/api/rules/go-chi-context-deadline-tree-cancellation-standard?format=mdc","cursorrules":"/api/rules/go-chi-context-deadline-tree-cancellation-standard?format=cursor","windsurf":"/api/rules/go-chi-context-deadline-tree-cancellation-standard?format=windsurf","agents":"/api/rules/go-chi-context-deadline-tree-cancellation-standard?format=agents"}},{"id":"capacitor7-hardware-biometric-keystore-isolation-standard","title":"Capacitor 7 Hardware-Backed Biometric Keystore Isolation Standard","category":"mobile","severity":"critical","description":"Enforces mandatory hardware-backed asymmetric key pair generation inside the Secure Enclave (iOS) and Android Keystore backed by StrongBox or TEE across Capacitor 7 bridges. Prohibits persisting decrypted master tokens or private keys inside standard web storage or unauthenticated native Preferences, requiring challenge-response cryptographic attestation and biometric gating for every signature operation.","antiPatternHeadline":"Persisting Raw Bearer Tokens in Web Storage or Unauthenticated SharedPreferences Without Hardware Keystore Isolation","stars_count":97,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor7","secure-enclave","strongbox","biometrics","key-attestation","zero-trust"],"exportEndpoints":{"claude":"/api/rules/capacitor7-hardware-biometric-keystore-isolation-standard?format=claude","cursorMdc":"/api/rules/capacitor7-hardware-biometric-keystore-isolation-standard?format=mdc","cursorrules":"/api/rules/capacitor7-hardware-biometric-keystore-isolation-standard?format=cursor","windsurf":"/api/rules/capacitor7-hardware-biometric-keystore-isolation-standard?format=windsurf","agents":"/api/rules/capacitor7-hardware-biometric-keystore-isolation-standard?format=agents"}},{"id":"tauri-v2-multiwindow-webview-process-isolation-standard","title":"Tauri 2.0 Multi-Window Process & Scoped IPC Isolation Standard","category":"mobile","severity":"critical","description":"Enforces strict OS-level render context separation, segregated data directories, and deterministic capability mapping across multi-window Webviews in Tauri 2.0. Prevents cross-webview privilege escalation, shared cookie/DOM storage contamination, and unauthorized ambient IPC message sniffing.","antiPatternHeadline":"Global IPC Event Broadcasting and Ambient Multi-Window Capability Sharing","stars_count":80,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri","security","ipc","process-isolation","multi-window"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-multiwindow-webview-process-isolation-standard?format=claude","cursorMdc":"/api/rules/tauri-v2-multiwindow-webview-process-isolation-standard?format=mdc","cursorrules":"/api/rules/tauri-v2-multiwindow-webview-process-isolation-standard?format=cursor","windsurf":"/api/rules/tauri-v2-multiwindow-webview-process-isolation-standard?format=windsurf","agents":"/api/rules/tauri-v2-multiwindow-webview-process-isolation-standard?format=agents"}},{"id":"webauthn-l3-device-bound-attestation-sync-guardrail","title":"WebAuthn L3 Device-Bound Attestation and Sync Guardrail","category":"security","severity":"critical","description":"Requires cryptographic direct or enterprise attestation verification and authenticatorData flag inspection during WebAuthn registration to separate synchronized multi-device passkeys from non-exportable hardware-bound authenticators. Enforces strict attestation certificate chain validation via the FIDO Metadata Service (MDS3) and blocks credentials with backup eligibility flags from privileged administrative workflows.","antiPatternHeadline":"Accepting Passkeys for Privileged Roles Without Cryptographic Attestation and Backup Flag Inspection","stars_count":76,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","fido2","passkeys","cryptography","attestation","pki"],"exportEndpoints":{"claude":"/api/rules/webauthn-l3-device-bound-attestation-sync-guardrail?format=claude","cursorMdc":"/api/rules/webauthn-l3-device-bound-attestation-sync-guardrail?format=mdc","cursorrules":"/api/rules/webauthn-l3-device-bound-attestation-sync-guardrail?format=cursor","windsurf":"/api/rules/webauthn-l3-device-bound-attestation-sync-guardrail?format=windsurf","agents":"/api/rules/webauthn-l3-device-bound-attestation-sync-guardrail?format=agents"}},{"id":"openfga-cdc-cache-consistency-invariant","title":"OpenFGA CDC-Driven Distributed Consistency and Invalidation Invariant","category":"security","severity":"critical","description":"Enforces strict causal consistency between relational OLTP state mutations and OpenFGA authorization relationship tuples via transactional outbox Change Data Capture (CDC). Prevents critical authorization bypass windows and privilege escalation vulnerabilities resulting from asynchronous dual-writes, out-of-order tuple propagation, and race conditions against distributed authorization check caches.","antiPatternHeadline":"Dual-Writing to OpenFGA and Asynchronous Cache Eviction Without Transactional Outbox CDC Ordering","stars_count":62,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","cdc","cache-invalidation","fine-grained-authorization","distributed-systems"],"exportEndpoints":{"claude":"/api/rules/openfga-cdc-cache-consistency-invariant?format=claude","cursorMdc":"/api/rules/openfga-cdc-cache-consistency-invariant?format=mdc","cursorrules":"/api/rules/openfga-cdc-cache-consistency-invariant?format=cursor","windsurf":"/api/rules/openfga-cdc-cache-consistency-invariant?format=windsurf","agents":"/api/rules/openfga-cdc-cache-consistency-invariant?format=agents"}},{"id":"ebpf-xdp-numa-socket-steering-standard","title":"eBPF XDP NUMA-Aware Socket Steering & Ingress Buffer Allocation Standard","category":"devops","severity":"critical","description":"Enforces strict NUMA node alignment between NIC PCIe controllers, AF_XDP UMEM packet memory, and driver worker threads on 100GbE enterprise interfaces. Mandates MPOL_BIND memory policies for XSK zero-copy ring buffers and explicit IRQ/CPU core pinning to eliminate inter-socket interconnect (UPI/QPI) saturation and microburst packet drops under high-throughput line rates.","antiPatternHeadline":"Blind Ingress UMEM Allocation and Cross-Node IRQ Affinity Causing Severe Interconnect Saturation","stars_count":98,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","xdp","af-xdp","numa","kernel","networking","100gbe"],"exportEndpoints":{"claude":"/api/rules/ebpf-xdp-numa-socket-steering-standard?format=claude","cursorMdc":"/api/rules/ebpf-xdp-numa-socket-steering-standard?format=mdc","cursorrules":"/api/rules/ebpf-xdp-numa-socket-steering-standard?format=cursor","windsurf":"/api/rules/ebpf-xdp-numa-socket-steering-standard?format=windsurf","agents":"/api/rules/ebpf-xdp-numa-socket-steering-standard?format=agents"}},{"id":"react-19-server-action-optimistic-rollback-integrity","title":"React 19 Server Action Optimistic Mutation & Deterministic Rollback Guardrails","category":"frontend","severity":"critical","description":"Enforces deterministic state synchronization during concurrent React 19 Server Action mutations by anchoring optimistic state directly to transition-scoped boundaries via useOptimistic and useActionState. Prevents UI desynchronization, stale-closure overwrites, and clobbered concurrent mutations caused by imperative useState snapshots in catch blocks.","antiPatternHeadline":"Manual useState Snapshot Reversion in Server Action Catch Blocks Causing Race-Condition Rollbacks","stars_count":61,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","server-actions","useOptimistic","concurrency"],"exportEndpoints":{"claude":"/api/rules/react-19-server-action-optimistic-rollback-integrity?format=claude","cursorMdc":"/api/rules/react-19-server-action-optimistic-rollback-integrity?format=mdc","cursorrules":"/api/rules/react-19-server-action-optimistic-rollback-integrity?format=cursor","windsurf":"/api/rules/react-19-server-action-optimistic-rollback-integrity?format=windsurf","agents":"/api/rules/react-19-server-action-optimistic-rollback-integrity?format=agents"}},{"id":"kmp-skie-swift-concurrency-cancellation","title":"KMP 2.1 SKIE Bidirectional Cancellation and Error Mapping Guardrail","category":"mobile","severity":"critical","description":"Enforces strict two-way cooperative cancellation and type-safe error propagation between Kotlin Coroutines and Swift Concurrency via Touchlab SKIE in Kotlin Multiplatform 2.1+. Prevents leaked background jobs, thread deadlocks, swallowed CancellationExceptions, and unhandled Swift Task cancellations across the foreign function interface (FFI) boundary.","antiPatternHeadline":"Swallowing CancellationException in Kotlin and Unbounded Detached Swift Task Invocations Leaking Coroutines Across the Obj-C Runtime Boundary","stars_count":43,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","skie","swift-concurrency","coroutines","ios"],"exportEndpoints":{"claude":"/api/rules/kmp-skie-swift-concurrency-cancellation?format=claude","cursorMdc":"/api/rules/kmp-skie-swift-concurrency-cancellation?format=mdc","cursorrules":"/api/rules/kmp-skie-swift-concurrency-cancellation?format=cursor","windsurf":"/api/rules/kmp-skie-swift-concurrency-cancellation?format=windsurf","agents":"/api/rules/kmp-skie-swift-concurrency-cancellation?format=agents"}},{"id":"opentelemetry-ebpf-profiling-span-correlation-standard","title":"OpenTelemetry eBPF Continuous Profiling Span Correlation Standard","category":"devops","severity":"critical","description":"Enforces low-overhead kernel and user-space continuous CPU profiling samples to deterministically stitch to W3C distributed trace contexts. Mandates frame pointer preservation, non-blocking thread-local trace context publication for eBPF maps, and standardized OpenTelemetry pprof span attributes.","antiPatternHeadline":"Stochastic Wall-Clock Profiling Correlation with Stripped Frame Pointers and Uncorrelated eBPF Samples","stars_count":97,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","ebpf","continuous-profiling","tracing","linux-perf","w3c-trace-context"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-ebpf-profiling-span-correlation-standard?format=claude","cursorMdc":"/api/rules/opentelemetry-ebpf-profiling-span-correlation-standard?format=mdc","cursorrules":"/api/rules/opentelemetry-ebpf-profiling-span-correlation-standard?format=cursor","windsurf":"/api/rules/opentelemetry-ebpf-profiling-span-correlation-standard?format=windsurf","agents":"/api/rules/opentelemetry-ebpf-profiling-span-correlation-standard?format=agents"}},{"id":"postgres-17-logical-replication-failover-slot-sync-postgres-17-logi-845","title":"Postgres 17 Logical Replication Failover & Slot Synchronization Protocol","category":"backend","severity":"critical","description":"Enforces failover-enabled logical replication slots and synchronized standby slot topologies introduced in PostgreSQL 17. Guarantees that physical standbys lead or match logical subscriber LSNs, preventing data loss and unrecoverable downstream duplicates during HA switchovers.","antiPatternHeadline":"Unsynchronized Logical Slots Advancing Past Physical Standbys During HA Switchovers","stars_count":88,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","logical-replication","failover","high-availability","pg17"],"exportEndpoints":{"claude":"/api/rules/postgres-17-logical-replication-failover-slot-sync-postgres-17-logi-845?format=claude","cursorMdc":"/api/rules/postgres-17-logical-replication-failover-slot-sync-postgres-17-logi-845?format=mdc","cursorrules":"/api/rules/postgres-17-logical-replication-failover-slot-sync-postgres-17-logi-845?format=cursor","windsurf":"/api/rules/postgres-17-logical-replication-failover-slot-sync-postgres-17-logi-845?format=windsurf","agents":"/api/rules/postgres-17-logical-replication-failover-slot-sync-postgres-17-logi-845?format=agents"}},{"id":"bun-zero-copy-buffer-transfer-isolation","title":"Bun 1.2 Zero-Copy ArrayBuffer Transfer Isolation Invariants","category":"backend","severity":"critical","description":"Enforces strict detachment verification and lifecycle ownership transfers when passing ArrayBuffers across Bun 1.2 multi-threaded worker pools via postMessage. Prevents use-after-free, concurrent mutation race conditions, and race-induced memory corruption by asserting explicit buffer neutering on senders and validation of transfer ownership on receivers.","antiPatternHeadline":"Accessing Detached ArrayBuffers or Sharing Non-Transferable References Across Worker Boundaries","stars_count":101,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","concurrency","memory-safety","zero-copy","workers"],"exportEndpoints":{"claude":"/api/rules/bun-zero-copy-buffer-transfer-isolation?format=claude","cursorMdc":"/api/rules/bun-zero-copy-buffer-transfer-isolation?format=mdc","cursorrules":"/api/rules/bun-zero-copy-buffer-transfer-isolation?format=cursor","windsurf":"/api/rules/bun-zero-copy-buffer-transfer-isolation?format=windsurf","agents":"/api/rules/bun-zero-copy-buffer-transfer-isolation?format=agents"}},{"id":"capacitor-7-native-bridge-serialization-quarantine","title":"Capacitor 7 Native Bridge Serialization Quarantine and Thread Isolation","category":"mobile","severity":"critical","description":"High-frequency bi-directional bridge traffic between the WebView and native runtime in Capacitor 7 can monopolize the UI thread and trigger Out-Of-Memory (OOM) faults via unmetered JSON serialization. This rule enforces an off-main-thread serialization quarantine via dedicated Web Workers on the web layer and explicit background dispatch queues/coroutines with bounded chunk buffers on native platforms.","antiPatternHeadline":"Synchronous Main-Thread JSON Bridge Flooding with Unbounded Large Payloads","stars_count":101,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["capacitor","mobile","bridge","performance","memory-management","threading"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-native-bridge-serialization-quarantine?format=claude","cursorMdc":"/api/rules/capacitor-7-native-bridge-serialization-quarantine?format=mdc","cursorrules":"/api/rules/capacitor-7-native-bridge-serialization-quarantine?format=cursor","windsurf":"/api/rules/capacitor-7-native-bridge-serialization-quarantine?format=windsurf","agents":"/api/rules/capacitor-7-native-bridge-serialization-quarantine?format=agents"}},{"id":"sigstore-slsa-v1-provenance-gate","title":"Cryptographic Sigstore SLSA v1.0 Provenance and Immutability Gate","category":"security","severity":"critical","description":"Enforces mandatory SLSA v1.0 in-toto provenance verification using Sigstore Fulcio certificate identities and Rekor transparency log proofs before admitting container workloads into production environments. Rejects images deployed by mutable tag, lacking cryptographically verified subject digests, or missing non-forgeable CI/CD OIDC claims.","antiPatternHeadline":"Deploying Mutable Container Tags with Unverified Build Provenance and Unvalidated OIDC Signer Identities","stars_count":42,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","sigstore","slsa-v1","supply-chain","kubernetes","admission-control"],"exportEndpoints":{"claude":"/api/rules/sigstore-slsa-v1-provenance-gate?format=claude","cursorMdc":"/api/rules/sigstore-slsa-v1-provenance-gate?format=mdc","cursorrules":"/api/rules/sigstore-slsa-v1-provenance-gate?format=cursor","windsurf":"/api/rules/sigstore-slsa-v1-provenance-gate?format=windsurf","agents":"/api/rules/sigstore-slsa-v1-provenance-gate?format=agents"}},{"id":"go-1-24-weak-pointer-finalizer-leak-guardrail","title":"Go 1.24 Weak Reference Finalizer Memory Leak Prevention","category":"backend","severity":"critical","description":"Go 1.24 introduces canonical weak pointers via `weak.Pointer` and finalizers via `runtime.AddCleanup`. When implementing high-throughput in-memory caches, engineers must prevent closure-captured strong references and finalizer resurrective cycles that silently convert weak references back into immortal strong roots, causing unbounded heap bloat and GC degradation.","antiPatternHeadline":"Closure-Captured Strong Pointers in Cleanup Handlers and Re-entrapment in Weak Pointer Invalidation","stars_count":93,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","memory-management","garbage-collection","concurrency"],"exportEndpoints":{"claude":"/api/rules/go-1-24-weak-pointer-finalizer-leak-guardrail?format=claude","cursorMdc":"/api/rules/go-1-24-weak-pointer-finalizer-leak-guardrail?format=mdc","cursorrules":"/api/rules/go-1-24-weak-pointer-finalizer-leak-guardrail?format=cursor","windsurf":"/api/rules/go-1-24-weak-pointer-finalizer-leak-guardrail?format=windsurf","agents":"/api/rules/go-1-24-weak-pointer-finalizer-leak-guardrail?format=agents"}},{"id":"fido-cxp-passkey-sync-verification","title":"FIDO CXP Cross-Ecosystem Passkey Migration and Cryptographic Provenance Invariants","category":"security","severity":"critical","description":"Enforces strict cryptographic integrity, Relying Party ID (RP ID) canonicalization, and key-pair consistency checks during FIDO Credential Exchange Protocol (CXP) and Credential Exchange Format (CXF) migrations. Prevents cross-origin credential harvesting, unpinned provenance tampering, and corrupted key ingestion during cross-ecosystem passkey imports.","antiPatternHeadline":"Ingesting Unverified FIDO CXP Payloads Without Keypair Consistency Checks or RP ID Scoping","stars_count":48,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","fido2","webauthn","passkeys","cxp","cryptography","zero-trust"],"exportEndpoints":{"claude":"/api/rules/fido-cxp-passkey-sync-verification?format=claude","cursorMdc":"/api/rules/fido-cxp-passkey-sync-verification?format=mdc","cursorrules":"/api/rules/fido-cxp-passkey-sync-verification?format=cursor","windsurf":"/api/rules/fido-cxp-passkey-sync-verification?format=windsurf","agents":"/api/rules/fido-cxp-passkey-sync-verification?format=agents"}},{"id":"svelte-5-snippet-template-scoping-guardrail","title":"Svelte 5 Snippet Context Scoping and Memory Leak Prevention","category":"frontend","severity":"critical","description":"Enforces strict lexical and reactive scoping rules for Svelte 5 snippets passed across recursive component boundaries. Prevents implicit closure over parent component runes ($state, $derived) and context lookups (getContext) that trigger unintended reactive context bleeding and cyclic memory retention across unmounted tree segments.","antiPatternHeadline":"Implicit Parent Lexical Closure and Context Bleed Inside Recursive Snippet Invocations","stars_count":90,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","snippets","runes","memory-leaks","reactivity"],"exportEndpoints":{"claude":"/api/rules/svelte-5-snippet-template-scoping-guardrail?format=claude","cursorMdc":"/api/rules/svelte-5-snippet-template-scoping-guardrail?format=mdc","cursorrules":"/api/rules/svelte-5-snippet-template-scoping-guardrail?format=cursor","windsurf":"/api/rules/svelte-5-snippet-template-scoping-guardrail?format=windsurf","agents":"/api/rules/svelte-5-snippet-template-scoping-guardrail?format=agents"}},{"id":"svelte-5-reactive-ownership-graph-invariant","title":"Svelte 5 Reactive Ownership Graph & Unidirectional Signal Invariant","category":"frontend","severity":"critical","description":"Enforces strict unidirectional dependency trees and explicit ownership bounds within Svelte 5 Runes architecture. Eliminates synchronous circular re-render loops ('effect_update_depth_exceeded') and cross-component signal race conditions by forbidding state-synchronization side-effects and unshielded bi-directional mutations.","antiPatternHeadline":"Cyclic Signal Mutation and Synchronous State Synchronization in Effects","stars_count":59,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","signals","reactivity","architecture"],"exportEndpoints":{"claude":"/api/rules/svelte-5-reactive-ownership-graph-invariant?format=claude","cursorMdc":"/api/rules/svelte-5-reactive-ownership-graph-invariant?format=mdc","cursorrules":"/api/rules/svelte-5-reactive-ownership-graph-invariant?format=cursor","windsurf":"/api/rules/svelte-5-reactive-ownership-graph-invariant?format=windsurf","agents":"/api/rules/svelte-5-reactive-ownership-graph-invariant?format=agents"}},{"id":"vite-6-environment-api-runtime-isolation-vite-6-environme-540","title":"Vite 6 Environment API Heterogeneous Runtime Isolation & Graph Sandboxing","category":"devops","severity":"critical","description":"Enforces strict module graph separation, dedicated condition resolution, and isolated runtime symbol contexts when compiling heterogeneous targets (Node.js, Workerd, Deno) via Vite 6's Environment API. Prevents runtime symbol cross-contamination, illegal intrinsic leakage, and shared cache corruption across disparate deployment runtimes in unified pipelines.","antiPatternHeadline":"Cross-Runtime Module Graph Pollution and Shared Resolver State in Multi-Environment Vite Pipelines","stars_count":92,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","vite6","environment-api","workerd","nodejs","deno","module-graph","sandboxing"],"exportEndpoints":{"claude":"/api/rules/vite-6-environment-api-runtime-isolation-vite-6-environme-540?format=claude","cursorMdc":"/api/rules/vite-6-environment-api-runtime-isolation-vite-6-environme-540?format=mdc","cursorrules":"/api/rules/vite-6-environment-api-runtime-isolation-vite-6-environme-540?format=cursor","windsurf":"/api/rules/vite-6-environment-api-runtime-isolation-vite-6-environme-540?format=windsurf","agents":"/api/rules/vite-6-environment-api-runtime-isolation-vite-6-environme-540?format=agents"}},{"id":"tauri-2-ipc-permission-capability-scope-standard","title":"Tauri 2.0 IPC Zero-Trust Permission Capability & Scoping Standard","category":"security","severity":"critical","description":"Enforces fine-grained capability definitions and path/parameter scoping across the Tauri 2.0 WebView-to-Rust IPC boundary. Prohibits global wildcard permissions, unconstrained shell execution, and unsanitized command handlers that risk arbitrary native host code execution.","antiPatternHeadline":"Blanket Capability Declarations and Wildcard Command Scopes in Tauri 2.0 IPC Manifests","stars_count":76,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","tauri-2","ipc","rust","capabilities","least-privilege"],"exportEndpoints":{"claude":"/api/rules/tauri-2-ipc-permission-capability-scope-standard?format=claude","cursorMdc":"/api/rules/tauri-2-ipc-permission-capability-scope-standard?format=mdc","cursorrules":"/api/rules/tauri-2-ipc-permission-capability-scope-standard?format=cursor","windsurf":"/api/rules/tauri-2-ipc-permission-capability-scope-standard?format=windsurf","agents":"/api/rules/tauri-2-ipc-permission-capability-scope-standard?format=agents"}},{"id":"go-chi-http3-quic-graceful-draining-standard","title":"Go Chi Graceful HTTP/3 QUIC GOAWAY Connection Draining Standard","category":"backend","severity":"critical","description":"Enforces deterministic two-phase QUIC connection and stream draining when running HTTP/3 servers over Go Chi during container lifecycle transitions. Orchestrates initial and final GOAWAY frame emission with synchronized HTTP/1.1, HTTP/2, and HTTP/3 listeners against Kubernetes preStop hooks and SIGTERM grace periods to prevent dropped in-flight UDP RPCs.","antiPatternHeadline":"Abrupt QUIC Context Cancellation Causing CONNECTION_REFUSED and Silent Dropped Streams During Pod Rollouts","stars_count":63,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","chi","quic","http3","kubernetes","zero-downtime"],"exportEndpoints":{"claude":"/api/rules/go-chi-http3-quic-graceful-draining-standard?format=claude","cursorMdc":"/api/rules/go-chi-http3-quic-graceful-draining-standard?format=mdc","cursorrules":"/api/rules/go-chi-http3-quic-graceful-draining-standard?format=cursor","windsurf":"/api/rules/go-chi-http3-quic-graceful-draining-standard?format=windsurf","agents":"/api/rules/go-chi-http3-quic-graceful-draining-standard?format=agents"}},{"id":"fastapi-async-generator-disconnect-cancellation","title":"FastAPI Async Generator Client Disconnect Cancellation Interlock","category":"backend","severity":"critical","description":"Enforces deterministic cancellation and resource deallocation for FastAPI async generators and SSE streams upon client socket termination. Without an explicit ASGI disconnect polling loop or cancellation interlock, orphaned async generators continue streaming tokens from upstream LLM inference providers, triggering thread-pool exhaustion, runaway token bills, and memory leaks. Architects must wire Request.is_disconnected() polling or Task cancellation directly into async generator pipelines.","antiPatternHeadline":"Unchecked Async Generators Consuming Upstream LLM Streams Post-Client Disconnect","stars_count":47,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","asgi","streaming","llm","asyncio","python"],"exportEndpoints":{"claude":"/api/rules/fastapi-async-generator-disconnect-cancellation?format=claude","cursorMdc":"/api/rules/fastapi-async-generator-disconnect-cancellation?format=mdc","cursorrules":"/api/rules/fastapi-async-generator-disconnect-cancellation?format=cursor","windsurf":"/api/rules/fastapi-async-generator-disconnect-cancellation?format=windsurf","agents":"/api/rules/fastapi-async-generator-disconnect-cancellation?format=agents"}},{"id":"ebpf-tc-zero-trust-packet-attestation","title":"eBPF TC Egress Zero-Trust mTLS & Direct Packet Attestation Standard","category":"devops","severity":"critical","description":"Enforces cryptographic identity verification at the Linux Traffic Control (TC) clsact layer using eBPF classifiers before socket buffers (skb) traverse network devices. Prevents service mesh egress sidecar bypasses and malicious raw socket transmission by validating authenticated workload identity tokens directly within packet headers.","antiPatternHeadline":"Relying Exclusively on iptables Sidecar Redirection Without Kernel-Level TC Cryptographic Attestation","stars_count":118,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","zero-trust","mtls","traffic-control","kernel-security","service-mesh"],"exportEndpoints":{"claude":"/api/rules/ebpf-tc-zero-trust-packet-attestation?format=claude","cursorMdc":"/api/rules/ebpf-tc-zero-trust-packet-attestation?format=mdc","cursorrules":"/api/rules/ebpf-tc-zero-trust-packet-attestation?format=cursor","windsurf":"/api/rules/ebpf-tc-zero-trust-packet-attestation?format=windsurf","agents":"/api/rules/ebpf-tc-zero-trust-packet-attestation?format=agents"}},{"id":"openfga-transactional-outbox-reconciliation","title":"OpenFGA Transactional Outbox Dual-Write Reconciliation Boundary","category":"security","severity":"critical","description":"Dual-writing directly to a domain database and the OpenFGA authorization tuple store introduces non-atomic failure modes, network partitions, and temporal race conditions that lead to privilege escalation or unauthorized data leaks. All OpenFGA relationship tuple mutations MUST be persisted transactionally into an outbox table within the primary business transaction and propagated asynchronously via an idempotent Change Data Capture (CDC) reconciliation consumer.","antiPatternHeadline":"Non-Atomic Dual-Writing to Application DB and OpenFGA API During State Mutations","stars_count":59,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","rebac","transactional-outbox","cdc","dual-write","authorization"],"exportEndpoints":{"claude":"/api/rules/openfga-transactional-outbox-reconciliation?format=claude","cursorMdc":"/api/rules/openfga-transactional-outbox-reconciliation?format=mdc","cursorrules":"/api/rules/openfga-transactional-outbox-reconciliation?format=cursor","windsurf":"/api/rules/openfga-transactional-outbox-reconciliation?format=windsurf","agents":"/api/rules/openfga-transactional-outbox-reconciliation?format=agents"}},{"id":"kmp-wasmgc-ffi-heap-boundary-guardrail","title":"KMP WasmGC FFI Cross-Heap Lifecycle and Finalization Invariant","category":"mobile","severity":"critical","description":"Enforces strict object lifespans and deterministic disposal contracts across Kotlin Multiplatform WasmGC managed heaps and JavaScript V8/JavaScriptCore host memory. Unchecked bi-directional referencing across the WasmGC/JS boundary leads to opaque circular cross-heap references that evade both engine garbage collectors. All cross-boundary exports and imports must leverage FinalizationRegistry, WeakRef, and explicit AutoCloseable/Disposable handles.","antiPatternHeadline":"Retaining raw JS references in Kotlin Wasm or leaking Wasm exported references across JS FFI without explicit dereferencing or finalization registries.","stars_count":41,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","wasm","wasmgc","kmp","kotlin","javascript","memory-leak"],"exportEndpoints":{"claude":"/api/rules/kmp-wasmgc-ffi-heap-boundary-guardrail?format=claude","cursorMdc":"/api/rules/kmp-wasmgc-ffi-heap-boundary-guardrail?format=mdc","cursorrules":"/api/rules/kmp-wasmgc-ffi-heap-boundary-guardrail?format=cursor","windsurf":"/api/rules/kmp-wasmgc-ffi-heap-boundary-guardrail?format=windsurf","agents":"/api/rules/kmp-wasmgc-ffi-heap-boundary-guardrail?format=agents"}},{"id":"svelte-5-universal-runes-boundary-effect-destruction","title":"Svelte 5 Universal Runes Boundary & Effect Destruction Invariants","category":"frontend","severity":"critical","description":"Enforces strict lifecycle ownership, root scoping ($effect.root), and deterministic cleanup protocols for universal runes (.svelte.ts) spanning SSR hydration boundaries and component unmount lifecycles. Prevents reactive graph leaks, cross-request state contamination, and orphaned effect subscriptions in nested state domains.","antiPatternHeadline":"Unbounded Universal Effects and Leaked Nested Reactive Scopes Across Hydration Boundaries","stars_count":112,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["svelte","svelte-5","runes","state-management","ssr","memory-leaks"],"exportEndpoints":{"claude":"/api/rules/svelte-5-universal-runes-boundary-effect-destruction?format=claude","cursorMdc":"/api/rules/svelte-5-universal-runes-boundary-effect-destruction?format=mdc","cursorrules":"/api/rules/svelte-5-universal-runes-boundary-effect-destruction?format=cursor","windsurf":"/api/rules/svelte-5-universal-runes-boundary-effect-destruction?format=windsurf","agents":"/api/rules/svelte-5-universal-runes-boundary-effect-destruction?format=agents"}},{"id":"tauri2-ipc-capability-isolation-guardrail","title":"Tauri 2.0 Mobile Capability Isolation and IPC Scoping","category":"mobile","severity":"critical","description":"Enforces strict compile-time capability isolation and per-window Access Control Lists (ACLs) in Tauri 2.0 mobile applications. Disallows wildcard permissions, restricts plugin access to explicitly bound webview labels, and prevents compromised web contexts from escalating privileges to native platform APIs.","antiPatternHeadline":"Exposing Wildcard IPC Capabilities and Unscoped Native Commands to Mobile Webviews","stars_count":93,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri-2","security","ipc","acl","rust"],"exportEndpoints":{"claude":"/api/rules/tauri2-ipc-capability-isolation-guardrail?format=claude","cursorMdc":"/api/rules/tauri2-ipc-capability-isolation-guardrail?format=mdc","cursorrules":"/api/rules/tauri2-ipc-capability-isolation-guardrail?format=cursor","windsurf":"/api/rules/tauri2-ipc-capability-isolation-guardrail?format=windsurf","agents":"/api/rules/tauri2-ipc-capability-isolation-guardrail?format=agents"}},{"id":"cilium-ebpf-encryption-host-routing-invariants","title":"Cilium eBPF Socket Encryption & Host-Routing Wire Invariants","category":"devops","severity":"critical","description":"Enforces strict kernel-level eBPF host-routing and transparent encryption (WireGuard/IPsec) configuration invariants across Kubernetes clusters without sidecar overhead. Mandates that Cilium eBPF map limits, MTU encap calculations, Node-to-Node encryption boundaries, and Envoy L7 egress redirects preserve cryptographic pod-identity verification at the socket layer.","antiPatternHeadline":"Bypassing Kernel eBPF Data-Path via Misconfigured Host-Routing Fallback and Unencrypted Overlay Leaks","stars_count":102,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","cilium","ebpf","wireguard","kubernetes","networking","zero-trust"],"exportEndpoints":{"claude":"/api/rules/cilium-ebpf-encryption-host-routing-invariants?format=claude","cursorMdc":"/api/rules/cilium-ebpf-encryption-host-routing-invariants?format=mdc","cursorrules":"/api/rules/cilium-ebpf-encryption-host-routing-invariants?format=cursor","windsurf":"/api/rules/cilium-ebpf-encryption-host-routing-invariants?format=windsurf","agents":"/api/rules/cilium-ebpf-encryption-host-routing-invariants?format=agents"}},{"id":"caep-sse-subsecond-revocation-pipeline","title":"Continuous Access Evaluation Protocol (CAEP) & OpenID SSE Sub-Second Revocation Standard","category":"security","severity":"critical","description":"Enforces cryptographic ingestion, validation, and sub-second distributed propagation of OpenID Shared Signals and Events (SSE) and Continuous Access Evaluation Protocol (CAEP) Security Event Tokens (SET). Decoupled microservices must intercept requests against an L1/L2 revocation tier indexed by subject (sub), session (sid), and token (jti) to invalidate compromised sessions immediately without awaiting JWT expiration.","antiPatternHeadline":"Blind Stateless JWT Acceptance and Unchecked Trust Window Post-Identity Compromise","stars_count":76,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","caep","openid-sse","zero-trust","distributed-revocation","jwt","redis"],"exportEndpoints":{"claude":"/api/rules/caep-sse-subsecond-revocation-pipeline?format=claude","cursorMdc":"/api/rules/caep-sse-subsecond-revocation-pipeline?format=mdc","cursorrules":"/api/rules/caep-sse-subsecond-revocation-pipeline?format=cursor","windsurf":"/api/rules/caep-sse-subsecond-revocation-pipeline?format=windsurf","agents":"/api/rules/caep-sse-subsecond-revocation-pipeline?format=agents"}},{"id":"kmp-swift-arc-gc-retain-cycle-fencing","title":"Kotlin Native ARC-to-GC Cross-Bridge Retain Cycle Fencing and Lifecycle Management","category":"mobile","severity":"critical","description":"Enforces strict boundary contracts between Apple Automatic Reference Counting (ARC) and Kotlin/Native Concurrent Garbage Collector runtimes. Precludes hidden cross-heap retain cycles created when Swift closures or delegate instances cross the Objective-C bridging header into long-lived Kotlin coroutine scopes or class graphs.","antiPatternHeadline":"Cross-Runtime Retain Cycles via Strong Swift Closures or Delegate Retention in Kotlin/Native Objects","stars_count":95,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","swift","arc","kotlin-native","memory-management","ios"],"exportEndpoints":{"claude":"/api/rules/kmp-swift-arc-gc-retain-cycle-fencing?format=claude","cursorMdc":"/api/rules/kmp-swift-arc-gc-retain-cycle-fencing?format=mdc","cursorrules":"/api/rules/kmp-swift-arc-gc-retain-cycle-fencing?format=cursor","windsurf":"/api/rules/kmp-swift-arc-gc-retain-cycle-fencing?format=windsurf","agents":"/api/rules/kmp-swift-arc-gc-retain-cycle-fencing?format=agents"}},{"id":"fastapi-anyio-taskgroup-exception-shielding","title":"FastAPI AnyIO Structured TaskGroup Exception Shielding and Context Preservation Invariants","category":"backend","severity":"critical","description":"Enforces robust structured concurrency patterns within FastAPI asynchronous request lifecycles using AnyIO TaskGroups. Prevents unhandled child-task exceptions and cancellation cascades from aborting critical audit, telemetry, and transactional cleanup routines or propagating raw ExceptionGroups into ASGI worker loops.","antiPatternHeadline":"Spawning naked concurrent child tasks within unshielded AnyIO TaskGroups, causing unhandled ExceptionGroups to tear down sibling operations and drop audit context.","stars_count":47,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","anyio","asyncio","concurrency","python"],"exportEndpoints":{"claude":"/api/rules/fastapi-anyio-taskgroup-exception-shielding?format=claude","cursorMdc":"/api/rules/fastapi-anyio-taskgroup-exception-shielding?format=mdc","cursorrules":"/api/rules/fastapi-anyio-taskgroup-exception-shielding?format=cursor","windsurf":"/api/rules/fastapi-anyio-taskgroup-exception-shielding?format=windsurf","agents":"/api/rules/fastapi-anyio-taskgroup-exception-shielding?format=agents"}},{"id":"webgpu-pipeline-caching-worker-fence-isolation","title":"WebGPU Compute Pipeline Compilation Caching & Cross-Worker Buffer Fence Isolation","category":"frontend","severity":"critical","description":"Enforces asynchronous shader pre-compilation with persistent IndexedDB pipeline descriptor caching to eliminate UI main-thread jank and shader stutter. Mandates strict GPU queue completion fencing and unmap-before-transfer invariants across dedicated Web Workers to prevent GPUDevice lost panics and concurrent memory mutation.","antiPatternHeadline":"Main-Thread Synchronous Pipeline Creation and Unfenced Worker Buffer Remapping","stars_count":96,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","webgpu","compute-shader","web-workers","concurrency","performance"],"exportEndpoints":{"claude":"/api/rules/webgpu-pipeline-caching-worker-fence-isolation?format=claude","cursorMdc":"/api/rules/webgpu-pipeline-caching-worker-fence-isolation?format=mdc","cursorrules":"/api/rules/webgpu-pipeline-caching-worker-fence-isolation?format=cursor","windsurf":"/api/rules/webgpu-pipeline-caching-worker-fence-isolation?format=windsurf","agents":"/api/rules/webgpu-pipeline-caching-worker-fence-isolation?format=agents"}},{"id":"opentelemetry-v1-28-attribute-hardening-tail-sampling","title":"OpenTelemetry v1.28 SemConv Hardening and Tail-Sampling Guardrails","category":"devops","severity":"critical","description":"Enforces strict compliance with OpenTelemetry Semantic Conventions v1.28 resource schemas and mandates deterministic tail-sampling processor pipelines within OpenTelemetry Collectors. Eliminates uncontrolled trace storage cost explosions from unbound cardinality attributes while preventing distributed trace fragmentation across asynchronous boundaries.","antiPatternHeadline":"Emitting Unsanitized High-Cardinality Attributes and Fragmenting Traces with Head-Based Dropping","stars_count":76,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","observability","tracing","tail-sampling","semantic-conventions"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-v1-28-attribute-hardening-tail-sampling?format=claude","cursorMdc":"/api/rules/opentelemetry-v1-28-attribute-hardening-tail-sampling?format=mdc","cursorrules":"/api/rules/opentelemetry-v1-28-attribute-hardening-tail-sampling?format=cursor","windsurf":"/api/rules/opentelemetry-v1-28-attribute-hardening-tail-sampling?format=windsurf","agents":"/api/rules/opentelemetry-v1-28-attribute-hardening-tail-sampling?format=agents"}},{"id":"go-chi-http3-context-lifeline-draining","title":"Go Chi HTTP/3 Context Lifeline & Request-Scoped Goroutine Pool Draining","category":"backend","severity":"critical","description":"Enforces deterministic cancellation propagation and synchronous goroutine pool draining for Go Chi services serving HTTP/3 (QUIC). Prevents orphaned worker routines, memory bloat, and file descriptor exhaustion triggered by rapid QUIC client stream resets.","antiPatternHeadline":"Detached Goroutine Fan-Out Leaks Workers Under High-Frequency QUIC Stream Resets","stars_count":47,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","chi","http3","quic","goroutines","context","concurrency"],"exportEndpoints":{"claude":"/api/rules/go-chi-http3-context-lifeline-draining?format=claude","cursorMdc":"/api/rules/go-chi-http3-context-lifeline-draining?format=mdc","cursorrules":"/api/rules/go-chi-http3-context-lifeline-draining?format=cursor","windsurf":"/api/rules/go-chi-http3-context-lifeline-draining?format=windsurf","agents":"/api/rules/go-chi-http3-context-lifeline-draining?format=agents"}},{"id":"react-19-use-action-state-concurrent-rollback","title":"React 19 useActionState Concurrent Optimistic Rollback Standard","category":"frontend","severity":"critical","description":"Mandates deterministic rollback trees and atomic state reconciliation across concurrent React 19 form transitions. Eliminates race conditions, out-of-order write hazards, and UI tearing by binding optimistic state strictly through React 19 transition primitives rather than unversioned imperative local state.","antiPatternHeadline":"Decoupled imperative local state mutations alongside interleaved asynchronous useActionState transitions resulting in stale-closure overwrites and non-deterministic rollback tearing.","stars_count":112,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","useactionstate","useoptimistic","concurrency","state-reconciliation"],"exportEndpoints":{"claude":"/api/rules/react-19-use-action-state-concurrent-rollback?format=claude","cursorMdc":"/api/rules/react-19-use-action-state-concurrent-rollback?format=mdc","cursorrules":"/api/rules/react-19-use-action-state-concurrent-rollback?format=cursor","windsurf":"/api/rules/react-19-use-action-state-concurrent-rollback?format=windsurf","agents":"/api/rules/react-19-use-action-state-concurrent-rollback?format=agents"}},{"id":"openfga-contextual-tuple-gateway-invariant","title":"OpenFGA 1.8 Contextual Tuple Gateway Boundary & Schema Invariants","category":"security","severity":"critical","description":"Enforces strict API gateway boundary validation, cryptographic signing, and relation allowlisting on transient contextual tuples passed to OpenFGA Check calls. Unsanitized contextual tuples allow untrusted clients to inject arbitrary graph relationships (e.g., claiming 'admin' relation or overriding resource tenancy) into low-latency evaluation queries, causing direct privilege escalation. All contextual tuples must be synthesized exclusively by trusted internal boundary services or verified against strict schema and scope constraints.","antiPatternHeadline":"Blind Passthrough of Untrusted Client Contextual Tuples Directly into OpenFGA Check Queries","stars_count":55,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","authorization","rebac","zero-trust"],"exportEndpoints":{"claude":"/api/rules/openfga-contextual-tuple-gateway-invariant?format=claude","cursorMdc":"/api/rules/openfga-contextual-tuple-gateway-invariant?format=mdc","cursorrules":"/api/rules/openfga-contextual-tuple-gateway-invariant?format=cursor","windsurf":"/api/rules/openfga-contextual-tuple-gateway-invariant?format=windsurf","agents":"/api/rules/openfga-contextual-tuple-gateway-invariant?format=agents"}},{"id":"fastapi-pydantic-v2-zerocopy-rust-streaming","title":"FastAPI Pydantic v2 Zero-Copy Rust Buffer Streaming Standard","category":"backend","severity":"critical","description":"Enforces zero-copy stream processing and direct byte buffer passthrough in FastAPI applications utilizing Pydantic v2. Prevents catastrophic Python runtime heap allocations and GIL contention during high-throughput serialization by bypassing Python dict/string instantiation and piping raw serialized bytes directly from pydantic-core's Rust layer to ASGI response streams.","antiPatternHeadline":"Heap Re-allocation via Intermediate Python Dict/String Materialization in High-Throughput Serialization","stars_count":109,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","pydantic-v2","rust","performance","zero-copy","async"],"exportEndpoints":{"claude":"/api/rules/fastapi-pydantic-v2-zerocopy-rust-streaming?format=claude","cursorMdc":"/api/rules/fastapi-pydantic-v2-zerocopy-rust-streaming?format=mdc","cursorrules":"/api/rules/fastapi-pydantic-v2-zerocopy-rust-streaming?format=cursor","windsurf":"/api/rules/fastapi-pydantic-v2-zerocopy-rust-streaming?format=windsurf","agents":"/api/rules/fastapi-pydantic-v2-zerocopy-rust-streaming?format=agents"}},{"id":"pg17-logical-replication-failover-slot-sync-postgresql-17-fa-807","title":"PostgreSQL 17 Failover-Safe Logical Replication Slot Synchronization Guardrail","category":"backend","severity":"critical","description":"Enforces PostgreSQL 17 native logical slot failover mechanics (failover => true, primary synchronized_standby_slots, and standby sync_replication_slots = on) across database provisioning, connection initializers, and migration harnesses. Prevents downstream CDC stream invalidation, full table re-snapshots, and silent message omission during physical primary failovers.","antiPatternHeadline":"Ephemeral Logical Slot Provisioning Lacking Failover Preservation Across Physical Standby Promotions","stars_count":40,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","pg17","logical-replication","cdc","high-availability","distributed-systems"],"exportEndpoints":{"claude":"/api/rules/pg17-logical-replication-failover-slot-sync-postgresql-17-fa-807?format=claude","cursorMdc":"/api/rules/pg17-logical-replication-failover-slot-sync-postgresql-17-fa-807?format=mdc","cursorrules":"/api/rules/pg17-logical-replication-failover-slot-sync-postgresql-17-fa-807?format=cursor","windsurf":"/api/rules/pg17-logical-replication-failover-slot-sync-postgresql-17-fa-807?format=windsurf","agents":"/api/rules/pg17-logical-replication-failover-slot-sync-postgresql-17-fa-807?format=agents"}},{"id":"capacitor-7-background-sync-lifecycle-invariant","title":"Capacitor 7 Background Sync Native-Bridge Lifecycle Invariant","category":"mobile","severity":"critical","description":"Standardizes native bridge lifecycle handling in Capacitor 7 to eliminate OS-enforced background process termination (SIGKILL) on iOS and Android. Mandates defensive bridge timeouts, deterministic background task registration (`App.addListener('appStateChange')` and native BGTaskScheduler / WorkManager coordination), and idempotent queue synchronization with transactional state persistence.","antiPatternHeadline":"Unbounded JavaScript promises spanning OS background transitions causing silent process termination and non-idempotent duplicate writes","stars_count":108,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","background-sync","ios","android","offline-first"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-background-sync-lifecycle-invariant?format=claude","cursorMdc":"/api/rules/capacitor-7-background-sync-lifecycle-invariant?format=mdc","cursorrules":"/api/rules/capacitor-7-background-sync-lifecycle-invariant?format=cursor","windsurf":"/api/rules/capacitor-7-background-sync-lifecycle-invariant?format=windsurf","agents":"/api/rules/capacitor-7-background-sync-lifecycle-invariant?format=agents"}},{"id":"axum-08-quic-flow-control-backpressure-standard","title":"Axum 0.8 HTTP/3 QUIC Datagram & Stream Flow-Control Backpressure Standard","category":"backend","severity":"critical","description":"Shields server memory pools by enforcing strict QUIC stream-level credit boundaries and bounded transmission pipelines in Axum 0.8 and h3/quinn stacks. Prevents unbounded heap allocation and buffer bloat caused by slow-consuming multiplexed edge clients. Guarantees that producers yield execution when transport window credits are exhausted.","antiPatternHeadline":"Unbounded task buffering and unconstrained streaming without polling QUIC stream capacity and transport credit limits","stars_count":94,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","http3","quic","backpressure","memory-safety"],"exportEndpoints":{"claude":"/api/rules/axum-08-quic-flow-control-backpressure-standard?format=claude","cursorMdc":"/api/rules/axum-08-quic-flow-control-backpressure-standard?format=mdc","cursorrules":"/api/rules/axum-08-quic-flow-control-backpressure-standard?format=cursor","windsurf":"/api/rules/axum-08-quic-flow-control-backpressure-standard?format=windsurf","agents":"/api/rules/axum-08-quic-flow-control-backpressure-standard?format=agents"}},{"id":"otel-w3c-baggage-cross-tenant-isolation-production-standard","title":"OpenTelemetry W3C Baggage Cross-Tenant Isolation & Propagation Guardrail","category":"devops","severity":"critical","description":"Enforces strict schema allowlists and byte-length boundaries on OpenTelemetry W3C Baggage headers across distributed boundaries. Prevents multi-tenant PII/secret data leakage and downstream APM high-cardinality index degradation by stripping untrusted distributed context keys at ingress and egress gateways.","antiPatternHeadline":"Unrestricted W3C Baggage Passthrough Causing Cross-Tenant Data Leakage and Cardinality Explosion","stars_count":108,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","distributed-tracing","w3c-baggage","multi-tenancy","security"],"exportEndpoints":{"claude":"/api/rules/otel-w3c-baggage-cross-tenant-isolation-production-standard?format=claude","cursorMdc":"/api/rules/otel-w3c-baggage-cross-tenant-isolation-production-standard?format=mdc","cursorrules":"/api/rules/otel-w3c-baggage-cross-tenant-isolation-production-standard?format=cursor","windsurf":"/api/rules/otel-w3c-baggage-cross-tenant-isolation-production-standard?format=windsurf","agents":"/api/rules/otel-w3c-baggage-cross-tenant-isolation-production-standard?format=agents"}},{"id":"ebpf-tc-ringbuf-bounded-allocation-standard","title":"eBPF TC Ingress Ring-Buffer Bounded Allocation Standard","category":"devops","severity":"critical","description":"Enforces verifier-guaranteed static memory caps and deterministic reservation lifecycles on eBPF Traffic Control (TC) ingress ring-buffers. Prevents kernel memory exhaustion (RLIMIT_MEMLOCK saturation) and page allocation stalls during 100GbE+ ingress packet floods by guaranteeing compile-time bounded sample reservation and strict paired discard/submit paths.","antiPatternHeadline":"Unbounded or Dynamic skb Slicing in bpf_ringbuf_reserve Without Strict Verifier Bounds or Discard Guarantees","stars_count":106,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","tc","networking","linux-kernel","ring-buffer","memory-safety"],"exportEndpoints":{"claude":"/api/rules/ebpf-tc-ringbuf-bounded-allocation-standard?format=claude","cursorMdc":"/api/rules/ebpf-tc-ringbuf-bounded-allocation-standard?format=mdc","cursorrules":"/api/rules/ebpf-tc-ringbuf-bounded-allocation-standard?format=cursor","windsurf":"/api/rules/ebpf-tc-ringbuf-bounded-allocation-standard?format=windsurf","agents":"/api/rules/ebpf-tc-ringbuf-bounded-allocation-standard?format=agents"}},{"id":"tauri-2-multiwindow-ipc-state-mutex-standard","title":"Tauri 2.0 Multi-Window IPC State Synchronization Mutex Standard","category":"frontend","severity":"critical","description":"Enforces deterministic, serialized state transitions across isolated Tauri 2.0 webview windows by delegating mutable state mutations exclusively to a Rust-managed transactional state mutex via typed IPC commands. Prohibits direct inter-window communication, optimistic unverified local state overrides, and peer-to-peer event bus broadcasts that induce split-brain conditions.","antiPatternHeadline":"Optimistic Frontend State Mutation with Unsynchronized Cross-Window Custom Events","stars_count":50,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","tauri","tauri-2","ipc","state-management","concurrency","multi-window"],"exportEndpoints":{"claude":"/api/rules/tauri-2-multiwindow-ipc-state-mutex-standard?format=claude","cursorMdc":"/api/rules/tauri-2-multiwindow-ipc-state-mutex-standard?format=mdc","cursorrules":"/api/rules/tauri-2-multiwindow-ipc-state-mutex-standard?format=cursor","windsurf":"/api/rules/tauri-2-multiwindow-ipc-state-mutex-standard?format=windsurf","agents":"/api/rules/tauri-2-multiwindow-ipc-state-mutex-standard?format=agents"}},{"id":"webauthn-related-origin-cryptographic-binding","title":"WebAuthn Related Origin Cryptographic Manifest & Cross-Subdomain Relay Guardrail","category":"security","severity":"critical","description":"Precludes subdomain passkey credential relay and token interception across distributed micro-frontends by strictly enforcing W3C WebAuthn Related Origin Requests specifications. Requires deterministic server-side cryptographic validation of clientDataJSON origin against an authoritative, statically verified related-origin manifest, rejecting ambient origin reflection or wildcard rpId relaxation.","antiPatternHeadline":"Dynamic RP Origin Reflection or Ambient Subdomain rpId Relaxation Without Strict Related-Origin Manifest Validation","stars_count":109,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","fido2","passkeys","micro-frontends","related-origins","cryptography"],"exportEndpoints":{"claude":"/api/rules/webauthn-related-origin-cryptographic-binding?format=claude","cursorMdc":"/api/rules/webauthn-related-origin-cryptographic-binding?format=mdc","cursorrules":"/api/rules/webauthn-related-origin-cryptographic-binding?format=cursor","windsurf":"/api/rules/webauthn-related-origin-cryptographic-binding?format=windsurf","agents":"/api/rules/webauthn-related-origin-cryptographic-binding?format=agents"}},{"id":"react19-use-optimistic-interleaved-rollback-barrier","title":"React 19 useOptimistic Monotonic Sequence and Interleaved Rollback Barrier","category":"frontend","severity":"critical","description":"Enforces strict monotonic transaction sequence barriers and idempotent revision tracking for React 19 useOptimistic when orchestrating concurrent Server Actions. Guarantees deterministic state convergence and prevents UI tearing or ghost rollbacks caused by out-of-order network responses and interleaved server action failures.","antiPatternHeadline":"Unversioned useOptimistic Reducers Permitting Out-of-Order Rollback and UI Tearing","stars_count":110,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","useOptimistic","server-actions","concurrency","transactions"],"exportEndpoints":{"claude":"/api/rules/react19-use-optimistic-interleaved-rollback-barrier?format=claude","cursorMdc":"/api/rules/react19-use-optimistic-interleaved-rollback-barrier?format=mdc","cursorrules":"/api/rules/react19-use-optimistic-interleaved-rollback-barrier?format=cursor","windsurf":"/api/rules/react19-use-optimistic-interleaved-rollback-barrier?format=windsurf","agents":"/api/rules/react19-use-optimistic-interleaved-rollback-barrier?format=agents"}},{"id":"svelte-5-runes-untrack-boundary-isolation","title":"Svelte 5 Runes Reactive Isolation and Untrack Boundary Enforcement","category":"frontend","severity":"critical","description":"Enforces purity in Svelte 5 $derived computations and mandates the explicit use of untrack() inside $effect blocks to sever accidental dependency tracking. Eliminates circular reactive cascades and runaway rendering loops caused by asynchronous state writes and uncontrolled signal reads.","antiPatternHeadline":"Unbounded Signal Cascades and Impure Derivations Triggering ERR_SVELTE_TOO_MANY_UPDATES","stars_count":45,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","reactivity","untrack"],"exportEndpoints":{"claude":"/api/rules/svelte-5-runes-untrack-boundary-isolation?format=claude","cursorMdc":"/api/rules/svelte-5-runes-untrack-boundary-isolation?format=mdc","cursorrules":"/api/rules/svelte-5-runes-untrack-boundary-isolation?format=cursor","windsurf":"/api/rules/svelte-5-runes-untrack-boundary-isolation?format=windsurf","agents":"/api/rules/svelte-5-runes-untrack-boundary-isolation?format=agents"}},{"id":"postgres-17-json-table-streaming-projection","title":"Postgres 17 JSON_TABLE Streaming Relational Projections","category":"backend","severity":"critical","description":"Mandates PostgreSQL 17 SQL/JSON standard JSON_TABLE for unpacking large or deeply nested JSONB structures directly into relational tuples. Eliminates intermediate recordset materialization, out-of-memory crashes, and query stalls caused by legacy jsonb_array_elements() and jsonb_to_recordset() lateral cascades.","antiPatternHeadline":"Unbounded Work-Memory Spillage and CPU Throttling via Chained jsonb_array_elements()","stars_count":75,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","postgres-17","json-table","jsonb","performance","sql"],"exportEndpoints":{"claude":"/api/rules/postgres-17-json-table-streaming-projection?format=claude","cursorMdc":"/api/rules/postgres-17-json-table-streaming-projection?format=mdc","cursorrules":"/api/rules/postgres-17-json-table-streaming-projection?format=cursor","windsurf":"/api/rules/postgres-17-json-table-streaming-projection?format=windsurf","agents":"/api/rules/postgres-17-json-table-streaming-projection?format=agents"}},{"id":"tauri2-ipc-capability-scoping-manifest","title":"Tauri 2.0 Mobile IPC Capability Manifest and Webview Isolation Standard","category":"mobile","severity":"critical","description":"Enforces strict principle-of-least-privilege IPC command invocation boundaries within Tauri 2.0 mobile architectures. Requires deterministic capability JSON files binding discrete permissions exclusively to designated webview labels, preventing arbitrary invoke access and lateral privilege escalation from compromised webviews to native mobile subsystems.","antiPatternHeadline":"Global Default-Allow Capabilities and Unscoped Webview IPC Command Invocations","stars_count":97,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri-2","ipc-security","capabilities","rust"],"exportEndpoints":{"claude":"/api/rules/tauri2-ipc-capability-scoping-manifest?format=claude","cursorMdc":"/api/rules/tauri2-ipc-capability-scoping-manifest?format=mdc","cursorrules":"/api/rules/tauri2-ipc-capability-scoping-manifest?format=cursor","windsurf":"/api/rules/tauri2-ipc-capability-scoping-manifest?format=windsurf","agents":"/api/rules/tauri2-ipc-capability-scoping-manifest?format=agents"}},{"id":"kmp-swift-arc-gc-weak-reference-bridge","title":"KMP Swift-ARC and Kotlin/Native GC Weak Reference Bridge Standard","category":"mobile","severity":"critical","description":"Prevents catastrophic cross-runtime retain cycles and memory leaks across the Swift ARC and Kotlin/Native tracing GC boundary. Enforces non-capturing closures, weak bridging wrappers, and deterministic lifecycle disposal for bidirectional delegates and flow subscriptions.","antiPatternHeadline":"Bidirectional Strong Retain Cycles Bridging Swift ARC Object Graphs to Kotlin Native GC","stars_count":114,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kmp","kotlin-native","swift","arc","memory-management","ios"],"exportEndpoints":{"claude":"/api/rules/kmp-swift-arc-gc-weak-reference-bridge?format=claude","cursorMdc":"/api/rules/kmp-swift-arc-gc-weak-reference-bridge?format=mdc","cursorrules":"/api/rules/kmp-swift-arc-gc-weak-reference-bridge?format=cursor","windsurf":"/api/rules/kmp-swift-arc-gc-weak-reference-bridge?format=windsurf","agents":"/api/rules/kmp-swift-arc-gc-weak-reference-bridge?format=agents"}},{"id":"capacitor-7-biometric-enclave-invalidation-guardrail","title":"Capacitor 7 Biometric Enclave Key Invalidation on Enrollment Mutation","category":"security","severity":"critical","description":"Enforces hardware-backed cryptographic key invalidation within the Secure Enclave and Android Keystore whenever biometric enrollments change. Prevents unauthorized decryption by secondary biometrics added to an already-enrolled device by requiring explicit enclave-bound key generation with enrollment mutation guards.","antiPatternHeadline":"Persisting Sensitive Tokens with Generic Biometric Prompts Without Hardware Key Invalidation","stars_count":43,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","capacitor","biometrics","secure-enclave","keystore"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-biometric-enclave-invalidation-guardrail?format=claude","cursorMdc":"/api/rules/capacitor-7-biometric-enclave-invalidation-guardrail?format=mdc","cursorrules":"/api/rules/capacitor-7-biometric-enclave-invalidation-guardrail?format=cursor","windsurf":"/api/rules/capacitor-7-biometric-enclave-invalidation-guardrail?format=windsurf","agents":"/api/rules/capacitor-7-biometric-enclave-invalidation-guardrail?format=agents"}},{"id":"rfc-9421-http-message-signatures-gateway-verification","title":"RFC 9421 HTTP Message Signatures End-to-End Cryptographic Invariants","category":"security","severity":"critical","description":"Enforces deterministic, non-repudiable RFC 9421 HTTP Message Signature verification at edge gateways and multi-cluster mesh boundaries. Prevents man-in-the-middle header tampering, request replay attacks, and content alteration across untrusted ingress networks by binding derived components, canonical headers, and raw digest hashes to cryptographic public key infrastructures. Guarantees end-to-end payload immutability prior to microservice dispatch.","antiPatternHeadline":"Trusting Ingress Proxies Without Full RFC 9421 Canonical Component and Content-Digest Verification","stars_count":95,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","rfc-9421","cryptography","api-gateway","zero-trust","ed25519","mesh"],"exportEndpoints":{"claude":"/api/rules/rfc-9421-http-message-signatures-gateway-verification?format=claude","cursorMdc":"/api/rules/rfc-9421-http-message-signatures-gateway-verification?format=mdc","cursorrules":"/api/rules/rfc-9421-http-message-signatures-gateway-verification?format=cursor","windsurf":"/api/rules/rfc-9421-http-message-signatures-gateway-verification?format=windsurf","agents":"/api/rules/rfc-9421-http-message-signatures-gateway-verification?format=agents"}},{"id":"opentelemetry-otlp-push-flow-control-watermark-invariant","title":"OpenTelemetry OTLP Push Flow-Control Watermark Invariant","category":"devops","severity":"critical","description":"Enforces strict high- and low-watermark flow-control policies on OpenTelemetry OTLP metric and span batch processors to prevent process OOM crashes during downstream ingestion degradation. Requires non-blocking enqueue strategies that shed telemetry based on buffer capacity thresholds before exporter thread pools or event loops block.","antiPatternHeadline":"Unbounded Telemetry Buffering Causing Process Termination via Ingestion Backpressure","stars_count":70,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","observability","backpressure","flow-control","otlp"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-otlp-push-flow-control-watermark-invariant?format=claude","cursorMdc":"/api/rules/opentelemetry-otlp-push-flow-control-watermark-invariant?format=mdc","cursorrules":"/api/rules/opentelemetry-otlp-push-flow-control-watermark-invariant?format=cursor","windsurf":"/api/rules/opentelemetry-otlp-push-flow-control-watermark-invariant?format=windsurf","agents":"/api/rules/opentelemetry-otlp-push-flow-control-watermark-invariant?format=agents"}},{"id":"bun-subprocess-shell-sandbox-guardrail","title":"Bun 1.2 Sandboxed Subprocess Shell and Fork-Bomb Protection Guardrail","category":"devops","severity":"critical","description":"Enforces strict parameter escaping, execution timeouts, and bounded concurrency for Bun 1.2 subprocess scripting. Prohibits unescaped raw shell interpolations and unmetered parallel process spawns to eliminate command injection vulnerabilities, file descriptor exhaustion, and fork-bomb denial-of-service failures.","antiPatternHeadline":"Unescaped Raw Template Interpolation Coupled with Unbounded Concurrency in Bun Shell Scripts","stars_count":94,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","bun","security","subprocesses","concurrency","rce-prevention"],"exportEndpoints":{"claude":"/api/rules/bun-subprocess-shell-sandbox-guardrail?format=claude","cursorMdc":"/api/rules/bun-subprocess-shell-sandbox-guardrail?format=mdc","cursorrules":"/api/rules/bun-subprocess-shell-sandbox-guardrail?format=cursor","windsurf":"/api/rules/bun-subprocess-shell-sandbox-guardrail?format=windsurf","agents":"/api/rules/bun-subprocess-shell-sandbox-guardrail?format=agents"}},{"id":"react19-activity-offscreen-reconciliation-guardrail","title":"React 19 <Activity> Offscreen State Reconciliation and Subscription Guardrail","category":"frontend","severity":"critical","description":"Enforces strict memory reclamation and explicit subscription teardowns for subtrees managed by React 19's <Activity> (Offscreen) API. Offscreen subtrees preserve internal state while detaching DOM nodes; failing to decouple long-lived event emitters, timers, WebSocket listeners, and canvas render loops leads to massive memory leaks, phantom state updates, and CPU saturation.","antiPatternHeadline":"Persisting Active Subscriptions and Continuous Render Loops in Deactivated <Activity> Subtrees","stars_count":112,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","activity","offscreen","memory-leaks","subscriptions"],"exportEndpoints":{"claude":"/api/rules/react19-activity-offscreen-reconciliation-guardrail?format=claude","cursorMdc":"/api/rules/react19-activity-offscreen-reconciliation-guardrail?format=mdc","cursorrules":"/api/rules/react19-activity-offscreen-reconciliation-guardrail?format=cursor","windsurf":"/api/rules/react19-activity-offscreen-reconciliation-guardrail?format=windsurf","agents":"/api/rules/react19-activity-offscreen-reconciliation-guardrail?format=agents"}},{"id":"nextjs-15-async-request-context-streaming-guardrail","title":"Next.js 15 Async Dynamic APIs and Streaming Isolation Standard","category":"frontend","severity":"critical","description":"Enforces strict isolation of request-scoped context in Next.js 15 App Router by mandating asynchronous consumption of dynamic APIs (cookies, headers, params) and prohibiting module-level mutable caching. Prevents cross-request state bleeding and session poisoning across concurrent streaming server renders.","antiPatternHeadline":"Synchronous Dynamic API Reads and Module-Scoped Request Context Pollution","stars_count":56,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs","react-server-components","streaming","security","async-local-storage"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-async-request-context-streaming-guardrail?format=claude","cursorMdc":"/api/rules/nextjs-15-async-request-context-streaming-guardrail?format=mdc","cursorrules":"/api/rules/nextjs-15-async-request-context-streaming-guardrail?format=cursor","windsurf":"/api/rules/nextjs-15-async-request-context-streaming-guardrail?format=windsurf","agents":"/api/rules/nextjs-15-async-request-context-streaming-guardrail?format=agents"}},{"id":"kmp-swift-coroutine-scope-cancellation-standard","title":"Kotlin Multiplatform Swift Coroutine Scope and Task Cancellation Bridging","category":"mobile","severity":"critical","description":"Enforces deterministic structured concurrency bridging between Swift Task lifecycles and Kotlin CoroutineScopes. Prevents orphaned background execution, thread starvation, and memory leaks caused by unpropagated Swift async Task cancellation into Kotlin/Native Job hierarchies.","antiPatternHeadline":"Orphaned Kotlin Jobs Executing Indefinitely After Swift Task Cancellation or SwiftUI View Dismissal","stars_count":57,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","swift","coroutines","concurrency","ios","memory-leaks"],"exportEndpoints":{"claude":"/api/rules/kmp-swift-coroutine-scope-cancellation-standard?format=claude","cursorMdc":"/api/rules/kmp-swift-coroutine-scope-cancellation-standard?format=mdc","cursorrules":"/api/rules/kmp-swift-coroutine-scope-cancellation-standard?format=cursor","windsurf":"/api/rules/kmp-swift-coroutine-scope-cancellation-standard?format=windsurf","agents":"/api/rules/kmp-swift-coroutine-scope-cancellation-standard?format=agents"}},{"id":"tauri-2-capability-ipc-permission-isolation-standard","title":"Tauri 2.0 Capability-Based IPC Permission Isolation and Payload Validation","category":"mobile","severity":"critical","description":"Enforces Tauri 2.0 granular capability definitions, strict Access Control Lists (ACLs), and runtime schema validation on all native IPC bridges. Eliminates arbitrary code execution and unauthorized native API exposure when operating on mobile and embedded WebViews. Prevents privilege escalation by scoping permissions exclusively to designated windows and verifying command payloads against typed boundaries.","antiPatternHeadline":"Assigning global wildcard permissions in capabilities and invoking unvalidated native commands across arbitrary WebViews","stars_count":71,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri","security","ipc","rust","capabilities"],"exportEndpoints":{"claude":"/api/rules/tauri-2-capability-ipc-permission-isolation-standard?format=claude","cursorMdc":"/api/rules/tauri-2-capability-ipc-permission-isolation-standard?format=mdc","cursorrules":"/api/rules/tauri-2-capability-ipc-permission-isolation-standard?format=cursor","windsurf":"/api/rules/tauri-2-capability-ipc-permission-isolation-standard?format=windsurf","agents":"/api/rules/tauri-2-capability-ipc-permission-isolation-standard?format=agents"}},{"id":"pgvector-hnsw-shared-buffer-pinning-invariant","title":"Postgres 17 pgvector HNSW Dedicated Buffer Pool and Memory Prewarming Invariant","category":"backend","severity":"critical","description":"Enforces deterministic resident-memory retention for high-dimensional pgvector HNSW indices to prevent catastrophic NVMe paging spikes during concurrent approximate nearest neighbor (ANN) scans. Mandates strict shared_buffers sizing, explicit pg_prewarm integration during deployment pipelines, and session-level work_mem/maintenance_work_mem calibration.","antiPatternHeadline":"Unpinned Cold-Index Paging Spikes and Unbounded Random Read Degradation","stars_count":74,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","pgvector","hnsw","performance","database-indexing"],"exportEndpoints":{"claude":"/api/rules/pgvector-hnsw-shared-buffer-pinning-invariant?format=claude","cursorMdc":"/api/rules/pgvector-hnsw-shared-buffer-pinning-invariant?format=mdc","cursorrules":"/api/rules/pgvector-hnsw-shared-buffer-pinning-invariant?format=cursor","windsurf":"/api/rules/pgvector-hnsw-shared-buffer-pinning-invariant?format=windsurf","agents":"/api/rules/pgvector-hnsw-shared-buffer-pinning-invariant?format=agents"}},{"id":"bun-ffi-clustered-buffer-ownership-handshake","title":"Bun 1.2 Clustered FFI Native Buffer Ownership Handshake","category":"backend","severity":"critical","description":"Enforces deterministic memory ownership transfer and ArrayBuffer detachment when dispatching native memory across Bun worker clusters executing bun:ffi foreign function bindings. Prohibits implicit cross-thread pointer reuse and non-transferred buffer clones that cause double-free errors, use-after-free faults, and JVM/C-heap desynchronization.","antiPatternHeadline":"Shared-Memory Race and Double-Free via Untransferred Native Buffers Across Bun Workers","stars_count":64,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","ffi","memory-management","workers","concurrency"],"exportEndpoints":{"claude":"/api/rules/bun-ffi-clustered-buffer-ownership-handshake?format=claude","cursorMdc":"/api/rules/bun-ffi-clustered-buffer-ownership-handshake?format=mdc","cursorrules":"/api/rules/bun-ffi-clustered-buffer-ownership-handshake?format=cursor","windsurf":"/api/rules/bun-ffi-clustered-buffer-ownership-handshake?format=windsurf","agents":"/api/rules/bun-ffi-clustered-buffer-ownership-handshake?format=agents"}},{"id":"spiffe-spire-hardware-attested-svid-rotation-guardrail","title":"SPIFFE/SPIRE Hardware-Attested Workload Identity Rotation Guardrail","category":"security","severity":"critical","description":"Enforces sub-hour TPM-attested X.509 SVID (SPIFFE Verifiable Identity Document) issuance and strictly in-memory cryptographic rotation via the SPIRE Workload API. Prohibits static cloud IAM service account keys, long-lived certificates, and disk-persisted private keys in zero-trust mesh architectures.","antiPatternHeadline":"Persisting Long-Lived Credentials to Disk or Bypassing Workload API In-Memory SVID Stream","stars_count":119,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","spiffe","spire","zero-trust","tpm","mtls","x509"],"exportEndpoints":{"claude":"/api/rules/spiffe-spire-hardware-attested-svid-rotation-guardrail?format=claude","cursorMdc":"/api/rules/spiffe-spire-hardware-attested-svid-rotation-guardrail?format=mdc","cursorrules":"/api/rules/spiffe-spire-hardware-attested-svid-rotation-guardrail?format=cursor","windsurf":"/api/rules/spiffe-spire-hardware-attested-svid-rotation-guardrail?format=windsurf","agents":"/api/rules/spiffe-spire-hardware-attested-svid-rotation-guardrail?format=agents"}},{"id":"ebpf-lsm-container-namespace-escape-guardrail","title":"eBPF BPF_LSM In-Kernel Container Namespace Escape and Credential Escalation Guardrail","category":"security","severity":"critical","description":"Enforces synchronous, in-kernel blocking of unauthorized namespace transitions (`unshare`, `setns`) and privileged capability acquisition directly inside BPF Linux Security Module (LSM) hooks. Bypasses user-space round-trip latency and eliminates time-of-check-to-time-of-use (TOCTOU) races by evaluating caller task cgroup hierarchies, mount namespaces, and target security descriptors atomically within kernel context.","antiPatternHeadline":"Delegating container containment enforcement to user-space tracepoint/kprobe monitors or asynchronous event loops","stars_count":46,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","ebpf","lsm","kernel","containers","namespaces","hardening"],"exportEndpoints":{"claude":"/api/rules/ebpf-lsm-container-namespace-escape-guardrail?format=claude","cursorMdc":"/api/rules/ebpf-lsm-container-namespace-escape-guardrail?format=mdc","cursorrules":"/api/rules/ebpf-lsm-container-namespace-escape-guardrail?format=cursor","windsurf":"/api/rules/ebpf-lsm-container-namespace-escape-guardrail?format=windsurf","agents":"/api/rules/ebpf-lsm-container-namespace-escape-guardrail?format=agents"}},{"id":"otel-collector-adaptive-tail-sampling-cardinality","title":"OpenTelemetry Collector Tail-Sampling Reservoir & Cardinality Guardrail","category":"devops","severity":"critical","description":"Enforces strict memory-bounded tail-sampling policies, memory limiter thresholds, and adaptive reservoir limits within OpenTelemetry Collector deployments. Prevents out-of-memory crashes caused by high-cardinality trace dimensions and volumetric bursts during systemic cascading failures.","antiPatternHeadline":"Unbounded Head/Tail Sampling and Uncapped Attribute Cardinality Triggering Collector OOM Panics","stars_count":106,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","observability","distributed-tracing","sre"],"exportEndpoints":{"claude":"/api/rules/otel-collector-adaptive-tail-sampling-cardinality?format=claude","cursorMdc":"/api/rules/otel-collector-adaptive-tail-sampling-cardinality?format=mdc","cursorrules":"/api/rules/otel-collector-adaptive-tail-sampling-cardinality?format=cursor","windsurf":"/api/rules/otel-collector-adaptive-tail-sampling-cardinality?format=windsurf","agents":"/api/rules/otel-collector-adaptive-tail-sampling-cardinality?format=agents"}},{"id":"envoy-gateway-http3-quic-connection-migration-guardrail","title":"Envoy Gateway HTTP/3 QUIC Dynamic Connection Migration & Session Continuity Standard","category":"devops","severity":"critical","description":"Mandates deterministic QUIC Connection ID (CID) routing, eBPF socket dispatching, and cryptographic session continuity across Envoy Gateway deployments for HTTP/3 clients undergoing IP/port migrations. Enforces strict decoupling of UDP transport state from 4-tuple addressing during cellular-to-Wi-Fi network shifts to prevent connection resets and state desynchronization.","antiPatternHeadline":"4-Tuple IP-Pinned UDP Listeners and Stateless Connection ID Decoupling Causing Silent QUIC Teardowns","stars_count":91,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","envoy","http3","quic","kubernetes","ebpf","session-continuity"],"exportEndpoints":{"claude":"/api/rules/envoy-gateway-http3-quic-connection-migration-guardrail?format=claude","cursorMdc":"/api/rules/envoy-gateway-http3-quic-connection-migration-guardrail?format=mdc","cursorrules":"/api/rules/envoy-gateway-http3-quic-connection-migration-guardrail?format=cursor","windsurf":"/api/rules/envoy-gateway-http3-quic-connection-migration-guardrail?format=windsurf","agents":"/api/rules/envoy-gateway-http3-quic-connection-migration-guardrail?format=agents"}},{"id":"tauri-v2-multiwindow-ipc-capability-scoping","title":"Tauri 2.0 Multi-Window IPC Capability Isolation & Sandboxing Standard","category":"frontend","severity":"critical","description":"Enforces strict capability scoping and explicit label sandboxing for dynamically spawned secondary webviews in Tauri 2.0. Prevents privilege escalation and remote code execution by ensuring dynamic windows, preview contexts, and untrusted frames cannot inherit wildcard native Rust IPC commands or system dialog access.","antiPatternHeadline":"Assigning Wildcard Window Capabilities or Spawning Unrestricted WebviewWindows for Untrusted Content","stars_count":109,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","tauri","security","ipc","capability-scoping","multi-window"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-multiwindow-ipc-capability-scoping?format=claude","cursorMdc":"/api/rules/tauri-v2-multiwindow-ipc-capability-scoping?format=mdc","cursorrules":"/api/rules/tauri-v2-multiwindow-ipc-capability-scoping?format=cursor","windsurf":"/api/rules/tauri-v2-multiwindow-ipc-capability-scoping?format=windsurf","agents":"/api/rules/tauri-v2-multiwindow-ipc-capability-scoping?format=agents"}},{"id":"bun-sharedarraybuffer-zero-copy-cluster-routing","title":"Bun 1.2 Lock-Free SharedArrayBuffer Ring Buffer for Clustered Ingestion","category":"backend","severity":"critical","description":"Mandates lock-free ring buffers backed by SharedArrayBuffer and typed Atomics for high-throughput inter-worker messaging in Bun 1.2 clusters. Eliminates event-loop stalls and garbage collection thrashing caused by structured clone serialization during sustained WebSocket ingestion (>10k msg/sec).","antiPatternHeadline":"Structured Clone Worker postMessage Flooding in High-Throughput Ingestion Pipelines","stars_count":66,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","sharedarraybuffer","atomics","zero-copy","websockets","concurrency"],"exportEndpoints":{"claude":"/api/rules/bun-sharedarraybuffer-zero-copy-cluster-routing?format=claude","cursorMdc":"/api/rules/bun-sharedarraybuffer-zero-copy-cluster-routing?format=mdc","cursorrules":"/api/rules/bun-sharedarraybuffer-zero-copy-cluster-routing?format=cursor","windsurf":"/api/rules/bun-sharedarraybuffer-zero-copy-cluster-routing?format=windsurf","agents":"/api/rules/bun-sharedarraybuffer-zero-copy-cluster-routing?format=agents"}},{"id":"kmp-native-gc-cinterop-concurrency-boundary","title":"KMP 2.1 Native GC Safe C-Pointer Concurrency and StableRef Lifecycle","category":"mobile","severity":"critical","description":"Enforces strict memory ownership boundaries when bridging raw C-interop pointers and Kotlin objects across coroutine thread boundaries in Kotlin Multiplatform 2.1+ Native targets. Prohibits untracked COpaquePointer sharing and unpinned Native GC heap object access across worker dispatchers to prevent use-after-free panics and segmentation faults on iOS runtimes.","antiPatternHeadline":"Passing naked C pointers or dereferencing untracked Kotlin Native heap references across background dispatchers and the main thread loop","stars_count":76,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","native-gc","c-interop","ios","concurrency","memory-safety"],"exportEndpoints":{"claude":"/api/rules/kmp-native-gc-cinterop-concurrency-boundary?format=claude","cursorMdc":"/api/rules/kmp-native-gc-cinterop-concurrency-boundary?format=mdc","cursorrules":"/api/rules/kmp-native-gc-cinterop-concurrency-boundary?format=cursor","windsurf":"/api/rules/kmp-native-gc-cinterop-concurrency-boundary?format=windsurf","agents":"/api/rules/kmp-native-gc-cinterop-concurrency-boundary?format=agents"}},{"id":"capacitor-7-biometric-enrollment-drift-invalidation","title":"Capacitor 7 Biometric Enrollment Drift & Enclave Token Invalidation","category":"mobile","severity":"critical","description":"Enforces hardware-backed cryptographic binding of Secure Enclave and Android Keystore authentication tokens to the active biometric enrollment state in Capacitor 7 applications. Guarantees that any addition or deletion of biometric records at the OS level immediately invalidates decryption keys, terminating compromised local sessions and triggering remote token revocation.","antiPatternHeadline":"Relying on Stateless Software Biometric Prompts Without Hardware Key Mutation Invalidation","stars_count":58,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","biometrics","secure-enclave","android-keystore","cryptography","security"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-biometric-enrollment-drift-invalidation?format=claude","cursorMdc":"/api/rules/capacitor-7-biometric-enrollment-drift-invalidation?format=mdc","cursorrules":"/api/rules/capacitor-7-biometric-enrollment-drift-invalidation?format=cursor","windsurf":"/api/rules/capacitor-7-biometric-enrollment-drift-invalidation?format=windsurf","agents":"/api/rules/capacitor-7-biometric-enrollment-drift-invalidation?format=agents"}},{"id":"ebpf-lsm-socket-bind-verification-standard","title":"Deterministic Kernel-Level Socket Bind & Egress Invariant Enforcement via eBPF LSM","category":"security","severity":"critical","description":"Enforces deterministic zero-trust network egress and UNIX domain socket binding restrictions directly at the Linux kernel boundary using eBPF LSM hooks (`socket_bind`, `socket_connect`). Eliminates user-space interception bypasses, LD_PRELOAD stripping, and namespace hopping in containerized multi-tenant node architectures by coupling kernel probes with immutable cgroup identifiers.","antiPatternHeadline":"Relying on User-Space Sidecar Proxies or LD_PRELOAD Wrappers for Socket Access Control","stars_count":42,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","ebpf","lsm","linux-kernel","zero-trust","multi-tenancy","network-security"],"exportEndpoints":{"claude":"/api/rules/ebpf-lsm-socket-bind-verification-standard?format=claude","cursorMdc":"/api/rules/ebpf-lsm-socket-bind-verification-standard?format=mdc","cursorrules":"/api/rules/ebpf-lsm-socket-bind-verification-standard?format=cursor","windsurf":"/api/rules/ebpf-lsm-socket-bind-verification-standard?format=windsurf","agents":"/api/rules/ebpf-lsm-socket-bind-verification-standard?format=agents"}},{"id":"webauthn-hybrid-ble-proximity-attestation-mandate","title":"FIDO2 WebAuthn Hybrid Transport BLE Proximity Verification Standard","category":"security","severity":"critical","description":"Enforces strict validation of FIDO2 WebAuthn cross-device hybrid transport sessions to ensure local BLE proximity proofs are cryptographically confirmed. Without validating that the hybrid handshake occurred over authenticated Bluetooth Low Energy channels, adversary-in-the-middle reverse proxies can relay QR-code handshakes to remote victims. The relying party server must verify authenticator transport metadata, client data JSON transport parameters, and proximity flags to mitigate remote session relay.","antiPatternHeadline":"Accepting Hybrid Passkey Assertions Without Validating Cross-Device BLE Proximity Bounds","stars_count":103,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","fido2","passkeys","hybrid-transport","ble-proximity","cryptography"],"exportEndpoints":{"claude":"/api/rules/webauthn-hybrid-ble-proximity-attestation-mandate?format=claude","cursorMdc":"/api/rules/webauthn-hybrid-ble-proximity-attestation-mandate?format=mdc","cursorrules":"/api/rules/webauthn-hybrid-ble-proximity-attestation-mandate?format=cursor","windsurf":"/api/rules/webauthn-hybrid-ble-proximity-attestation-mandate?format=windsurf","agents":"/api/rules/webauthn-hybrid-ble-proximity-attestation-mandate?format=agents"}},{"id":"otel-w3c-baggage-tenant-ingress-sanitization","title":"OpenTelemetry W3C Baggage Ingress Sanitization and Tenant Context Isolation","category":"devops","severity":"critical","description":"Enforces deterministic stripping, allowlisting, and cryptographic re-anchoring of W3C Baggage headers at API gateway and ingress boundaries. Prevents multi-tenant context spoofing, downstream trace attribute pollution, and tenant escalation caused by naive propagation of unauthenticated client-supplied baggage.","antiPatternHeadline":"Naive Propagation of Client-Supplied W3C Baggage Headers Without Ingress Tenant Boundary Re-Anchoring","stars_count":114,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","security","multi-tenancy","distributed-tracing","w3c-baggage","api-gateway"],"exportEndpoints":{"claude":"/api/rules/otel-w3c-baggage-tenant-ingress-sanitization?format=claude","cursorMdc":"/api/rules/otel-w3c-baggage-tenant-ingress-sanitization?format=mdc","cursorrules":"/api/rules/otel-w3c-baggage-tenant-ingress-sanitization?format=cursor","windsurf":"/api/rules/otel-w3c-baggage-tenant-ingress-sanitization?format=windsurf","agents":"/api/rules/otel-w3c-baggage-tenant-ingress-sanitization?format=agents"}},{"id":"react-19-server-actions-replay-idempotency-standard","title":"React 19 Server Actions Cryptographic Replay & Idempotency Standard","category":"frontend","severity":"critical","description":"Enforces cryptographically signed monotonic nonces and distributed atomic claim locks on React 19 Server Actions to eliminate double-execution, race conditions, and distributed replay attacks across edge runtimes. Mandates strict validation of ephemeral HMAC-signed action tokens before executing any state-mutating operation.","antiPatternHeadline":"Unvalidated and Naked Server Actions Vulnerable to Distributed Replay Attacks and Double Mutations","stars_count":82,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","server-actions","security","idempotency","cryptography","distributed-systems"],"exportEndpoints":{"claude":"/api/rules/react-19-server-actions-replay-idempotency-standard?format=claude","cursorMdc":"/api/rules/react-19-server-actions-replay-idempotency-standard?format=mdc","cursorrules":"/api/rules/react-19-server-actions-replay-idempotency-standard?format=cursor","windsurf":"/api/rules/react-19-server-actions-replay-idempotency-standard?format=windsurf","agents":"/api/rules/react-19-server-actions-replay-idempotency-standard?format=agents"}},{"id":"nextjs-15-ppr-streaming-suspense-boundary-standard","title":"Deterministic Static-to-Dynamic PPR Streaming Suspense Boundaries in Next.js 15","category":"frontend","severity":"critical","description":"Enforces strict layout-locked React Suspense boundaries around all dynamic runtime holes when using Next.js 15 Partial Prerendering (PPR). Guarantees static shell pre-generation without de-opting to dynamic SSR, prevents Cumulative Layout Shift (CLS) via dimensionally matched fallback skeletons, and prevents unhandled DynamicServerError stream aborts.","antiPatternHeadline":"Unbounded dynamic API calls and dimensionally mismatched fallbacks triggering full-route PPR de-optimization and post-hydration layout shifts","stars_count":72,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs15","ppr","react-suspense","streaming","rsc","web-vitals"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-ppr-streaming-suspense-boundary-standard?format=claude","cursorMdc":"/api/rules/nextjs-15-ppr-streaming-suspense-boundary-standard?format=mdc","cursorrules":"/api/rules/nextjs-15-ppr-streaming-suspense-boundary-standard?format=cursor","windsurf":"/api/rules/nextjs-15-ppr-streaming-suspense-boundary-standard?format=windsurf","agents":"/api/rules/nextjs-15-ppr-streaming-suspense-boundary-standard?format=agents"}},{"id":"axum-0-8-streaming-backpressure-bounds","title":"Axum 0.8 Asynchronous Streaming Backpressure & Memory Bounds Standard","category":"backend","severity":"critical","description":"Enforces strict byte-budget guards, bounded buffer pipelines, and deterministic backpressure across all Axum 0.8 streaming endpoints and multipart handlers. Prevents catastrophic OOM panics and heap fragmentation caused by unbounded buffering, disabled DefaultBodyLimit guards, and unthrottled chunk collection.","antiPatternHeadline":"Buffering unbounded streams into in-memory vectors or detaching consumers without backpressure, risking process-level OOM DoS.","stars_count":40,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","streaming","backpressure","tokio","memory-safety"],"exportEndpoints":{"claude":"/api/rules/axum-0-8-streaming-backpressure-bounds?format=claude","cursorMdc":"/api/rules/axum-0-8-streaming-backpressure-bounds?format=mdc","cursorrules":"/api/rules/axum-0-8-streaming-backpressure-bounds?format=cursor","windsurf":"/api/rules/axum-0-8-streaming-backpressure-bounds?format=windsurf","agents":"/api/rules/axum-0-8-streaming-backpressure-bounds?format=agents"}},{"id":"postgres-17-pgvector-hnsw-quantization-isolation","title":"Postgres 17 pgvector HNSW Half-Precision Quantization & Buffer Isolation Guardrail","category":"backend","severity":"critical","description":"Mandates the usage of pgvector 0.7.0+ half-precision (halfvec) scalar quantization and strict buffer isolation for HNSW vector indexes in PostgreSQL 17. Unquantized float4 vector graphs (1536+ dims) rapidly exceed shared_buffers, causing massive disk I/O thrashing and eviction of relational working sets during OLTP workloads. Enforces halfvec cast-indexing, bounded graph connectivity parameters, and iterative scan tuning to guarantee sub-10ms vector retrieval without noisy-neighbor degradation.","antiPatternHeadline":"Full-Precision vector(dim) HNSW Indexing Evicting Relational Buffer Pools","stars_count":41,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres","pgvector","hnsw","quantization","performance"],"exportEndpoints":{"claude":"/api/rules/postgres-17-pgvector-hnsw-quantization-isolation?format=claude","cursorMdc":"/api/rules/postgres-17-pgvector-hnsw-quantization-isolation?format=mdc","cursorrules":"/api/rules/postgres-17-pgvector-hnsw-quantization-isolation?format=cursor","windsurf":"/api/rules/postgres-17-pgvector-hnsw-quantization-isolation?format=windsurf","agents":"/api/rules/postgres-17-pgvector-hnsw-quantization-isolation?format=agents"}},{"id":"capacitor-7-deep-link-authority-pinning-sanitization","title":"Capacitor 7 Deep Link Intent Sanitization and Authority Pinning","category":"mobile","severity":"critical","description":"Enforces deterministic URI parsing, scheme/host authority pinning, and path allowlisting on OS-level deep link intents within Capacitor 7 applications. Mitigates open redirects, cross-app intent hijacking, and parameter injection by requiring deep link payloads to pass strict schema validation before dispatching to internal routing contexts.","antiPatternHeadline":"Blind In-App Routing of Raw Deep Link URLs and Unvalidated Intent Payloads","stars_count":88,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["capacitor","mobile","security","deep-links","intent-handling","app-links"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-deep-link-authority-pinning-sanitization?format=claude","cursorMdc":"/api/rules/capacitor-7-deep-link-authority-pinning-sanitization?format=mdc","cursorrules":"/api/rules/capacitor-7-deep-link-authority-pinning-sanitization?format=cursor","windsurf":"/api/rules/capacitor-7-deep-link-authority-pinning-sanitization?format=windsurf","agents":"/api/rules/capacitor-7-deep-link-authority-pinning-sanitization?format=agents"}},{"id":"android-15-private-space-keystore-invalidation-standard","title":"Android 15 Private Space Biometric Keystore Invalidation Standard","category":"mobile","severity":"critical","description":"Enforces immediate zeroization of memory-resident cryptographic keys and instantaneous termination of background jobs when an Android 15 Private Space enters the locked state. Mandates listening to ACTION_PROFILE_UNAVAILABLE and user-lifecycle broadcasts to invalidate Keystore handles and prevent key retention in suspended profile runtimes.","antiPatternHeadline":"Retaining In-Memory Cryptographic Handles and Background Job Schedulers Across Private Space Profile Lock Cycles","stars_count":48,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","android","android-15","keystore","biometrics","private-space","security"],"exportEndpoints":{"claude":"/api/rules/android-15-private-space-keystore-invalidation-standard?format=claude","cursorMdc":"/api/rules/android-15-private-space-keystore-invalidation-standard?format=mdc","cursorrules":"/api/rules/android-15-private-space-keystore-invalidation-standard?format=cursor","windsurf":"/api/rules/android-15-private-space-keystore-invalidation-standard?format=windsurf","agents":"/api/rules/android-15-private-space-keystore-invalidation-standard?format=agents"}},{"id":"openfga-contextual-tuple-traversal-guard","title":"OpenFGA 1.6 Contextual Tuple Traversal Depth and Cycle Boundary Enforcement","category":"security","severity":"critical","description":"Enforces pre-evaluation validation and execution boundaries on OpenFGA contextual tuples to prevent recursive traversal denial-of-service (DoS) and infinite cycle resolution attacks. Mandates strict cardinality limits, client-side directed acyclic graph (DAG) verification, and sub-50ms deterministic deadline abort signals for real-time authorization checks.","antiPatternHeadline":"Unbounded or Cyclic Contextual Tuples Triggering Engine Goroutine Exhaustion and Traversal Timeouts","stars_count":112,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","rebac","authorization","dos-prevention","graph-traversal"],"exportEndpoints":{"claude":"/api/rules/openfga-contextual-tuple-traversal-guard?format=claude","cursorMdc":"/api/rules/openfga-contextual-tuple-traversal-guard?format=mdc","cursorrules":"/api/rules/openfga-contextual-tuple-traversal-guard?format=cursor","windsurf":"/api/rules/openfga-contextual-tuple-traversal-guard?format=windsurf","agents":"/api/rules/openfga-contextual-tuple-traversal-guard?format=agents"}},{"id":"webauthn-enterprise-attestation-sync-boundary-standard","title":"WebAuthn Enterprise Attestation and Non-Exportable Passkey Boundary Standard","category":"security","severity":"critical","description":"Enforces cryptographic attestation validation and authenticator flag verification to restrict high-assurance perimeters to non-exportable, hardware-backed credentials. Prevents multi-device cloud-synced passkeys from masquerading as dedicated enterprise hardware authenticators by validating AAGUID allowlists, attestation certificate chains against FIDO MDS, and backing state flags.","antiPatternHeadline":"Accepting unverified attestation ('none') or multi-device syncable credentials (BE/BS flags active) within high-assurance authentication perimeters.","stars_count":107,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","fido2","passkeys","cryptography","enterprise-attestation","zero-trust"],"exportEndpoints":{"claude":"/api/rules/webauthn-enterprise-attestation-sync-boundary-standard?format=claude","cursorMdc":"/api/rules/webauthn-enterprise-attestation-sync-boundary-standard?format=mdc","cursorrules":"/api/rules/webauthn-enterprise-attestation-sync-boundary-standard?format=cursor","windsurf":"/api/rules/webauthn-enterprise-attestation-sync-boundary-standard?format=windsurf","agents":"/api/rules/webauthn-enterprise-attestation-sync-boundary-standard?format=agents"}},{"id":"k8s-gateway-v1-2-referencegrant-cross-namespace-invariants","title":"Kubernetes Gateway API v1.2 Cross-Namespace ReferenceGrant Invariants","category":"devops","severity":"critical","description":"Enforces zero-trust cross-namespace routing contracts between Gateway API v1.2 HTTPRoutes and target backend Services or parent Gateways. Mandates explicit, least-privilege ReferenceGrant resources in target namespaces to prevent unauthorized cross-tenant route-hijacking and traffic intercept attacks. Prohibits wildcard namespace trust, dangling references, and implicit cross-namespace backend bindings.","antiPatternHeadline":"Unvalidated Cross-Namespace HTTPRoute Backends Lacking Explicit, Least-Privilege ReferenceGrants","stars_count":50,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","kubernetes","gateway-api","zero-trust","security","networking"],"exportEndpoints":{"claude":"/api/rules/k8s-gateway-v1-2-referencegrant-cross-namespace-invariants?format=claude","cursorMdc":"/api/rules/k8s-gateway-v1-2-referencegrant-cross-namespace-invariants?format=mdc","cursorrules":"/api/rules/k8s-gateway-v1-2-referencegrant-cross-namespace-invariants?format=cursor","windsurf":"/api/rules/k8s-gateway-v1-2-referencegrant-cross-namespace-invariants?format=windsurf","agents":"/api/rules/k8s-gateway-v1-2-referencegrant-cross-namespace-invariants?format=agents"}},{"id":"otel-ebpf-profiling-overhead-guardrail","title":"OpenTelemetry eBPF Continuous Profiling Overhead & Symbol Cache Limiter","category":"devops","severity":"critical","description":"Enforces strict runtime bounds on OpenTelemetry eBPF CPU continuous profilers by dynamically regulating stack-walking sample rates and capping userspace symbolization memory footprints. This ensures that kernel-level profiling instrumentation never consumes more than 1% aggregate CPU cycles or causes out-of-memory kernel panics under elevated system stress.","antiPatternHeadline":"Static high-frequency eBPF sampling with unbounded native symbol maps causing node throttling and OOM panics","stars_count":61,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","ebpf","continuous-profiling","observability","linux-kernel","performance"],"exportEndpoints":{"claude":"/api/rules/otel-ebpf-profiling-overhead-guardrail?format=claude","cursorMdc":"/api/rules/otel-ebpf-profiling-overhead-guardrail?format=mdc","cursorrules":"/api/rules/otel-ebpf-profiling-overhead-guardrail?format=cursor","windsurf":"/api/rules/otel-ebpf-profiling-overhead-guardrail?format=windsurf","agents":"/api/rules/otel-ebpf-profiling-overhead-guardrail?format=agents"}},{"id":"react-19-server-actions-optimistic-rollback-invariant-react-19-server--881","title":"React 19 Server Actions: Deterministic Optimistic Rollback & Hydration Boundary Invariant","category":"frontend","severity":"critical","description":"Enforces strict atomicity and deterministic rollback patterns for speculative UI states when invoking React 19 Server Actions. Guarantees that concurrent mutation failures, hydration boundaries, and unhandled server rejections preserve accessible focus trees, prevent layout thrashing, and avoid split-brain state desynchronization.","antiPatternHeadline":"Ad-Hoc Speculative State Mutation via useState with Unsynchronized Server Action Rejections","stars_count":107,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","server-actions","use-optimistic","use-action-state","hydration","accessibility"],"exportEndpoints":{"claude":"/api/rules/react-19-server-actions-optimistic-rollback-invariant-react-19-server--881?format=claude","cursorMdc":"/api/rules/react-19-server-actions-optimistic-rollback-invariant-react-19-server--881?format=mdc","cursorrules":"/api/rules/react-19-server-actions-optimistic-rollback-invariant-react-19-server--881?format=cursor","windsurf":"/api/rules/react-19-server-actions-optimistic-rollback-invariant-react-19-server--881?format=windsurf","agents":"/api/rules/react-19-server-actions-optimistic-rollback-invariant-react-19-server--881?format=agents"}},{"id":"svelte5-runes-circularity-effect-root-scoping","title":"Svelte 5 Runes Reactive Graph Circularity & Effect Root Scoping Guardrail","category":"frontend","severity":"critical","description":"Enforces strict lifecycle bounding for Svelte 5 $effect.root scopes and eliminates cascading microtask reactivity cycles. Mandates deterministic cleanup disposal for non-component signal trees and isolates state mutation loops using untrack() and pure derivations to prevent browser thread saturation.","antiPatternHeadline":"Unbounded $effect.root allocations and cyclic $state mutations inside effects causing ERR_SVELTE_TOO_MANY_UPDATES","stars_count":78,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","reactivity","memory-leaks","signals"],"exportEndpoints":{"claude":"/api/rules/svelte5-runes-circularity-effect-root-scoping?format=claude","cursorMdc":"/api/rules/svelte5-runes-circularity-effect-root-scoping?format=mdc","cursorrules":"/api/rules/svelte5-runes-circularity-effect-root-scoping?format=cursor","windsurf":"/api/rules/svelte5-runes-circularity-effect-root-scoping?format=windsurf","agents":"/api/rules/svelte5-runes-circularity-effect-root-scoping?format=agents"}},{"id":"openfga-recursive-resolution-circuit-breaker-standard","title":"OpenFGA Recursive Tuple Graph Resolution Depth and Latency Circuit-Breaker Standard","category":"backend","severity":"critical","description":"Enforces strict traversal depth limits, adaptive circuit breakers, and bounded deadlines on OpenFGA relationship-based access control (ReBAC) evaluations. Prevents catastrophic distributed deadlocks, thread pool exhaustion, and cascading database saturation triggered by cyclic or deeply nested relationship graphs during high-throughput authorization checks.","antiPatternHeadline":"Unbounded ReBAC Graph Traversal Without Client Deadlines or Circuit Breakers","stars_count":98,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","openfga","rebac","circuit-breaker","resilience","authorization"],"exportEndpoints":{"claude":"/api/rules/openfga-recursive-resolution-circuit-breaker-standard?format=claude","cursorMdc":"/api/rules/openfga-recursive-resolution-circuit-breaker-standard?format=mdc","cursorrules":"/api/rules/openfga-recursive-resolution-circuit-breaker-standard?format=cursor","windsurf":"/api/rules/openfga-recursive-resolution-circuit-breaker-standard?format=windsurf","agents":"/api/rules/openfga-recursive-resolution-circuit-breaker-standard?format=agents"}},{"id":"postgres-17-wal-summarizer-sync-standard","title":"Postgres 17 WAL Summarizer Block-Level Incremental Backup Synchronization Standard","category":"backend","severity":"critical","description":"Enforces deterministic synchronization between the PostgreSQL 17 WAL summarizer daemon and block-level incremental backup orchestrators. Unmonitored summarizer lag or concurrent pg_combinebackup/pg_dump operations without verifying pg_available_wal_summaries() leads to RPO degradation, backup pipeline failures, and critical WAL disk starvation.","antiPatternHeadline":"Blind Incremental Backups Without WAL Summarization Verification and Lag Circuit Breakers","stars_count":87,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql-17","backup-orchestration","disaster-recovery","wal-summarizer","reliability"],"exportEndpoints":{"claude":"/api/rules/postgres-17-wal-summarizer-sync-standard?format=claude","cursorMdc":"/api/rules/postgres-17-wal-summarizer-sync-standard?format=mdc","cursorrules":"/api/rules/postgres-17-wal-summarizer-sync-standard?format=cursor","windsurf":"/api/rules/postgres-17-wal-summarizer-sync-standard?format=windsurf","agents":"/api/rules/postgres-17-wal-summarizer-sync-standard?format=agents"}},{"id":"go-iterseq-chi-pipeline-backpressure","title":"Go 1.24 iter.Seq Push Iterator Backpressure Propagation in Chi Middleware","category":"backend","severity":"critical","description":"Enforces strict coupling between Go 1.24 iter.Seq yield suspension and network socket drain events within Chi HTTP middleware chains. Eliminates unbounded heap allocation during streaming responses by propagating client TCP window stalls directly into iterator cancellation and upstream pipeline pauses.","antiPatternHeadline":"Decoupled Goroutine Buffering and Ignored Yield Falsehoods in Streaming HTTP Responders","stars_count":85,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","iter-seq","chi","concurrency","memory-management","backpressure"],"exportEndpoints":{"claude":"/api/rules/go-iterseq-chi-pipeline-backpressure?format=claude","cursorMdc":"/api/rules/go-iterseq-chi-pipeline-backpressure?format=mdc","cursorrules":"/api/rules/go-iterseq-chi-pipeline-backpressure?format=cursor","windsurf":"/api/rules/go-iterseq-chi-pipeline-backpressure?format=windsurf","agents":"/api/rules/go-iterseq-chi-pipeline-backpressure?format=agents"}},{"id":"kmp-swift-export-interop-retain-cycle-guardrail","title":"KMP 2.1 Swift-Export Cross-Runtime ARC/GC Retain Cycle Guardrail","category":"mobile","severity":"critical","description":"Enforces deterministic lifecycle-bound reference disposal and weak bridge wrappers between Swift ARC and Kotlin/Native 2.1 GC runtimes. Prevents uncollected native heap islands caused by cyclic references across the Swift-Kotlin interop boundary where neither runtime can traverse cross-boundary reference graphs.","antiPatternHeadline":"Invisible Cross-Runtime Retain Cycles Between Swift ARC and Kotlin Tracing GC","stars_count":55,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","swift-export","memory-management","arc","kotlin-native","ios"],"exportEndpoints":{"claude":"/api/rules/kmp-swift-export-interop-retain-cycle-guardrail?format=claude","cursorMdc":"/api/rules/kmp-swift-export-interop-retain-cycle-guardrail?format=mdc","cursorrules":"/api/rules/kmp-swift-export-interop-retain-cycle-guardrail?format=cursor","windsurf":"/api/rules/kmp-swift-export-interop-retain-cycle-guardrail?format=windsurf","agents":"/api/rules/kmp-swift-export-interop-retain-cycle-guardrail?format=agents"}},{"id":"spiffe-spire-x509-svid-in-memory-atomic-rotation","title":"SPIFFE/SPIRE Workload API X.509 SVID Zero-Downtime Memory-Only Rotation Invariant","category":"security","severity":"critical","description":"Enforces lock-free, zero-downtime, memory-only rotation of X.509 SVIDs received via the SPIFFE Workload API stream. Precludes disk-snoop attacks by prohibiting disk persistence of ephemeral keys and prevents file-descriptor exhaustion and TLS handshake stalls by hot-swapping certificates via atomic reference pointers.","antiPatternHeadline":"Persisting Ephemeral SVIDs to Disk or Restarting Listeners on Key Rotation","stars_count":107,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","spiffe","spire","mtls","zero-trust","cryptography"],"exportEndpoints":{"claude":"/api/rules/spiffe-spire-x509-svid-in-memory-atomic-rotation?format=claude","cursorMdc":"/api/rules/spiffe-spire-x509-svid-in-memory-atomic-rotation?format=mdc","cursorrules":"/api/rules/spiffe-spire-x509-svid-in-memory-atomic-rotation?format=cursor","windsurf":"/api/rules/spiffe-spire-x509-svid-in-memory-atomic-rotation?format=windsurf","agents":"/api/rules/spiffe-spire-x509-svid-in-memory-atomic-rotation?format=agents"}},{"id":"sigstore-cosign-slsa-provenance-admission-standard","title":"Mandatory Sigstore Cosign SLSA Provenance and Rekor Bundle Admission Enforcement","category":"security","severity":"critical","description":"Enforces non-bypassable admission-time cryptographic verification of in-toto SLSA build provenance attestations and Rekor transparency log bundles for all container images. Images failing cryptographic signature verification, lacking Rekor log inclusion proofs, or referencing mutable tags instead of immutable sha256 digests are denied transition to running state.","antiPatternHeadline":"Deploying unverified or tag-addressed images without SLSA provenance and Rekor transparency log bundle verification","stars_count":89,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","sigstore","cosign","slsa","in-toto","rekor","kubernetes","admission-controller"],"exportEndpoints":{"claude":"/api/rules/sigstore-cosign-slsa-provenance-admission-standard?format=claude","cursorMdc":"/api/rules/sigstore-cosign-slsa-provenance-admission-standard?format=mdc","cursorrules":"/api/rules/sigstore-cosign-slsa-provenance-admission-standard?format=cursor","windsurf":"/api/rules/sigstore-cosign-slsa-provenance-admission-standard?format=windsurf","agents":"/api/rules/sigstore-cosign-slsa-provenance-admission-standard?format=agents"}},{"id":"k8s-gateway-backend-tls-san-verification","title":"Gateway API v1.2 BackendTLSPolicy Strict SAN Verification Standard","category":"devops","severity":"critical","description":"Enforces strict transport security and explicit cryptographic identity verification between Kubernetes Gateway controllers and upstream backends. Mandates the binding of BackendTLSPolicy v1alpha3 resources with explicit Subject Alternative Name (SAN) hostnames and pinned CA certificate references to eliminate east-west man-in-the-middle attacks and internal impersonation vectors.","antiPatternHeadline":"Unvalidated Backend TLS Allowing East-West Service Impersonation and Insecure Upstream Transport","stars_count":78,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","kubernetes","gateway-api","tls","zero-trust","mtls","security"],"exportEndpoints":{"claude":"/api/rules/k8s-gateway-backend-tls-san-verification?format=claude","cursorMdc":"/api/rules/k8s-gateway-backend-tls-san-verification?format=mdc","cursorrules":"/api/rules/k8s-gateway-backend-tls-san-verification?format=cursor","windsurf":"/api/rules/k8s-gateway-backend-tls-san-verification?format=windsurf","agents":"/api/rules/k8s-gateway-backend-tls-san-verification?format=agents"}},{"id":"svelte5-runes-async-cancellation-guardrail","title":"Svelte 5 Runes Async Mutation Cancellation & Fine-Grained State Protection","category":"frontend","severity":"critical","description":"Prevents race conditions, out-of-order mutations, and stale asynchronous writes from corrupting Svelte 5 signal dependency graphs. Mandates deterministic cleanup, AbortController propagation, and generation checks for all asynchronous processes tied to runes reactivity.","antiPatternHeadline":"Unbounded Asynchronous Closures Mutating Fine-Grained State Runes Out-of-Order","stars_count":48,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","reactivity","signals","concurrency","async-cancellation"],"exportEndpoints":{"claude":"/api/rules/svelte5-runes-async-cancellation-guardrail?format=claude","cursorMdc":"/api/rules/svelte5-runes-async-cancellation-guardrail?format=mdc","cursorrules":"/api/rules/svelte5-runes-async-cancellation-guardrail?format=cursor","windsurf":"/api/rules/svelte5-runes-async-cancellation-guardrail?format=windsurf","agents":"/api/rules/svelte5-runes-async-cancellation-guardrail?format=agents"}},{"id":"nextjs-15-ppr-streaming-hydration-guardrail","title":"Next.js 15 PPR & Streaming Hydration Isolation Guardrail","category":"frontend","severity":"critical","description":"Next.js 15 Partial Prerendering (PPR) delivers an instant static HTML shell while streaming dynamic components over the same HTTP connection. Invoking dynamic request-time APIs (such as headers(), cookies(), searchParams, or un-cached data sources) outside of an explicit React Suspense boundary de-optimizes the entire page segment to dynamic SSR at request time. Dynamic subtrees must be isolated within Suspense boundaries whose fallback skeletons structurally mirror dynamic components to prevent streaming hydration mismatches.","antiPatternHeadline":"Uncontained Dynamic Request APIs Forcing Full Dynamic SSR and Streamed Hydration Collapse","stars_count":57,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs15","react-server-components","partial-prerendering","suspense","streaming"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-ppr-streaming-hydration-guardrail?format=claude","cursorMdc":"/api/rules/nextjs-15-ppr-streaming-hydration-guardrail?format=mdc","cursorrules":"/api/rules/nextjs-15-ppr-streaming-hydration-guardrail?format=cursor","windsurf":"/api/rules/nextjs-15-ppr-streaming-hydration-guardrail?format=windsurf","agents":"/api/rules/nextjs-15-ppr-streaming-hydration-guardrail?format=agents"}},{"id":"axum-08-tokio-cooperative-cancellation-standard","title":"Axum 0.8 Tokio Cooperative Task Budgeting & Deterministic Cancellation","category":"backend","severity":"critical","description":"Enforces deterministic cancellation and resource cleanup across Axum 0.8 and Tower middleware chains during abrupt client disconnects under heavy load. Mandates cooperative task budgeting, cancellation-safe transactional state machines, and hierarchical token propagation to prevent resource leaks, zombie background tasks, and connection pool exhaustion.","antiPatternHeadline":"Unattached Background Spawning and Cancellation-Unsafe Async State Transitions Leading to Connection Leaks and Zombie Work","stars_count":70,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tokio","tower","cancellation-safety","concurrency"],"exportEndpoints":{"claude":"/api/rules/axum-08-tokio-cooperative-cancellation-standard?format=claude","cursorMdc":"/api/rules/axum-08-tokio-cooperative-cancellation-standard?format=mdc","cursorrules":"/api/rules/axum-08-tokio-cooperative-cancellation-standard?format=cursor","windsurf":"/api/rules/axum-08-tokio-cooperative-cancellation-standard?format=windsurf","agents":"/api/rules/axum-08-tokio-cooperative-cancellation-standard?format=agents"}},{"id":"go-synctest-chi-context-propagation-boundary","title":"Go 1.24 Synctest and Chi Middleware Context Tree Propagation Boundary","category":"backend","severity":"critical","description":"Enforces strict context-tree lifetime propagation across nested Chi HTTP middleware chains and async background routines. Precludes orphaned goroutines and silent request cancellation leaks by requiring structured context derivation and verifying deterministic termination via Go 1.24 testing/synctest virtual bubbles.","antiPatternHeadline":"Spawning Unbound Asynchronous Goroutines with Request Context or Raw context.Background Inside Chi Middleware","stars_count":76,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["go","chi","concurrency","synctest","context","backend"],"exportEndpoints":{"claude":"/api/rules/go-synctest-chi-context-propagation-boundary?format=claude","cursorMdc":"/api/rules/go-synctest-chi-context-propagation-boundary?format=mdc","cursorrules":"/api/rules/go-synctest-chi-context-propagation-boundary?format=cursor","windsurf":"/api/rules/go-synctest-chi-context-propagation-boundary?format=windsurf","agents":"/api/rules/go-synctest-chi-context-propagation-boundary?format=agents"}},{"id":"tauri2-mobile-ipc-capability-access-control","title":"Tauri 2.0 Mobile IPC Capability-Based Access Control and Webview Isolation","category":"mobile","severity":"critical","description":"Enforces compile-time granular permission boundaries on native host platform API invocations executing from multi-webview runtime contexts in Tauri 2.0. Prohibits global wildcard permissions and mandates explicit capability manifest segregation by window/webview identifier for native host APIs across iOS and Android runtimes. Ensures all host commands adhere strictly to the principle of least privilege, preventing privilege escalation between sandboxed and trusted webview contexts.","antiPatternHeadline":"Granting Global Capabilities or Exposing Privileged Host APIs Across Multi-Webview Mobile Runtimes Without Boundary Scoping","stars_count":69,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri-v2","ipc-security","capabilities","rust","webview-isolation"],"exportEndpoints":{"claude":"/api/rules/tauri2-mobile-ipc-capability-access-control?format=claude","cursorMdc":"/api/rules/tauri2-mobile-ipc-capability-access-control?format=mdc","cursorrules":"/api/rules/tauri2-mobile-ipc-capability-access-control?format=cursor","windsurf":"/api/rules/tauri2-mobile-ipc-capability-access-control?format=windsurf","agents":"/api/rules/tauri2-mobile-ipc-capability-access-control?format=agents"}},{"id":"kmp-hardware-surface-synchronization","title":"Deterministic 120Hz Surface Sync and Teardown Synchronization in KMP Compose","category":"mobile","severity":"critical","description":"Enforces synchronous lifecycle fencing and atomic frame pacing between Compose Multiplatform render loops and native display surfaces (Android SurfaceView/Choreographer and iOS CAMetalLayer/CADisplayLink). Prevents BufferQueue abandonment, SIGSEGV crashes on invalidated ANativeWindow handles, and CAMetalLayer presentation on detached layers during 120Hz ProMotion transitions.","antiPatternHeadline":"Asynchronous surface release racing against active frame-pacing threads during composition teardown","stars_count":59,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","compose","metal","vulkan","surfaceview"],"exportEndpoints":{"claude":"/api/rules/kmp-hardware-surface-synchronization?format=claude","cursorMdc":"/api/rules/kmp-hardware-surface-synchronization?format=mdc","cursorrules":"/api/rules/kmp-hardware-surface-synchronization?format=cursor","windsurf":"/api/rules/kmp-hardware-surface-synchronization?format=windsurf","agents":"/api/rules/kmp-hardware-surface-synchronization?format=agents"}},{"id":"openfga-real-time-tuple-consistency-barrier","title":"OpenFGA Real-Time Tuple Consistency Barrier for Multi-Region ReBAC","category":"security","severity":"critical","description":"Enforces real-time consistency barriers and causal token propagation across distributed edge nodes in OpenFGA ReBAC architectures. Eliminates replication-lag authorization bypass windows and Zanzibar 'New Enemy' vulnerabilities by mandating explicit consistency levels and transactional fencing tokens during mutation-critical evaluation paths.","antiPatternHeadline":"Permitting Eventual Consistency ReBAC Checks Post-Mutation Allowing Revoked Access Window Exploits","stars_count":90,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","rebac","authorization","distributed-systems","consistency"],"exportEndpoints":{"claude":"/api/rules/openfga-real-time-tuple-consistency-barrier?format=claude","cursorMdc":"/api/rules/openfga-real-time-tuple-consistency-barrier?format=mdc","cursorrules":"/api/rules/openfga-real-time-tuple-consistency-barrier?format=cursor","windsurf":"/api/rules/openfga-real-time-tuple-consistency-barrier?format=windsurf","agents":"/api/rules/openfga-real-time-tuple-consistency-barrier?format=agents"}},{"id":"opentelemetry-otlp-arrow-transport-standard","title":"OpenTelemetry OTLP Apache Arrow Columnar Transport Standard","category":"devops","severity":"critical","description":"Enforces OpenTelemetry Protocol (OTLP) over Apache Arrow columnar format for all inter-collector telemetry fabrics and egress routing. Eliminates row-based Protocol Buffer serialization bottlenecks, achieving over 60% reduction in CPU processing overhead and network bandwidth consumption for high-cardinality distributed traces, logs, and metrics pipelines.","antiPatternHeadline":"Defaulting to Standard Row-Oriented OTLP/Protobuf for High-Volume Inter-Collector Egress","stars_count":107,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","apache-arrow","otlp","observability","distributed-tracing","performance"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-otlp-arrow-transport-standard?format=claude","cursorMdc":"/api/rules/opentelemetry-otlp-arrow-transport-standard?format=mdc","cursorrules":"/api/rules/opentelemetry-otlp-arrow-transport-standard?format=cursor","windsurf":"/api/rules/opentelemetry-otlp-arrow-transport-standard?format=windsurf","agents":"/api/rules/opentelemetry-otlp-arrow-transport-standard?format=agents"}},{"id":"wasi-02-component-sandbox-isolation-standard","title":"WASI 0.2 Component Model Capability-Scoped Isolation Guardrail","category":"devops","severity":"critical","description":"Enforces strict capability-based isolation for WebAssembly Component Model (WASI 0.2) runtimes by eliminating ambient authority, mandating explicit WebAssembly Interface Type (WIT) capability contracts, and verifying binary provenance. Prohibits direct host filesystem, network, or environment inheritance for plugin components, replacing OS container overhead with cryptographically bounded in-process execution.","antiPatternHeadline":"Ambient Authority Ingestion and Unconstrained Capability Delegation in WebAssembly Plugin Runtimes","stars_count":79,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","wasm","wasi-02","component-model","sandboxing","zero-trust"],"exportEndpoints":{"claude":"/api/rules/wasi-02-component-sandbox-isolation-standard?format=claude","cursorMdc":"/api/rules/wasi-02-component-sandbox-isolation-standard?format=mdc","cursorrules":"/api/rules/wasi-02-component-sandbox-isolation-standard?format=cursor","windsurf":"/api/rules/wasi-02-component-sandbox-isolation-standard?format=windsurf","agents":"/api/rules/wasi-02-component-sandbox-isolation-standard?format=agents"}},{"id":"svelte-5-rune-state-proxy-isolation-standard","title":"Svelte 5 High-Frequency Telemetry Isolation via $state.raw","category":"frontend","severity":"critical","description":"Mandates the use of $state.raw for high-frequency streaming data, binary buffers, and large collections in Svelte 5. By bypassing recursive reactive proxy tree synthesis, applications eliminate massive memory allocation overhead, micro-tick thrashing, and garbage collection stutter during sustained telemetry ingestion. Deep reactivity must be explicitly decoupled from raw ingest buffers and reserved exclusively for leaf presentation primitives.","antiPatternHeadline":"Wrapping high-frequency telemetry payloads in standard $state runes causing recursive proxy thrashing and frame drops","stars_count":53,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","performance","memory-management","reactivity"],"exportEndpoints":{"claude":"/api/rules/svelte-5-rune-state-proxy-isolation-standard?format=claude","cursorMdc":"/api/rules/svelte-5-rune-state-proxy-isolation-standard?format=mdc","cursorrules":"/api/rules/svelte-5-rune-state-proxy-isolation-standard?format=cursor","windsurf":"/api/rules/svelte-5-rune-state-proxy-isolation-standard?format=windsurf","agents":"/api/rules/svelte-5-rune-state-proxy-isolation-standard?format=agents"}},{"id":"axum-08-cancellation-token-stream-termination","title":"Axum 0.8 Tokio CancellationToken Stream Termination & Task Leak Prevention","category":"backend","severity":"critical","description":"Mandates proactive runtime cancellation token propagation across Axum 0.8 handlers and Tower middleware layers to guarantee immediate task termination upon HTTP/3 stream cancellation. Eliminates unbounded CPU and memory leaks caused by orphaned Tokio tasks executing past client disconnections or QUIC stream resets.","antiPatternHeadline":"Spawning Unbounded Tokio Worker Tasks Detached From HTTP/3 Stream Drop Lifecycles","stars_count":52,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tokio","http3","concurrency"],"exportEndpoints":{"claude":"/api/rules/axum-08-cancellation-token-stream-termination?format=claude","cursorMdc":"/api/rules/axum-08-cancellation-token-stream-termination?format=mdc","cursorrules":"/api/rules/axum-08-cancellation-token-stream-termination?format=cursor","windsurf":"/api/rules/axum-08-cancellation-token-stream-termination?format=windsurf","agents":"/api/rules/axum-08-cancellation-token-stream-termination?format=agents"}},{"id":"go-weak-pointer-cache-eviction-invariant","title":"Go 1.24 Weak-Pointer Cache Eviction Invariant in HTTP Handlers","category":"backend","severity":"critical","description":"Enforces safe utilization of Go 1.24 runtime weak pointers (weak.Pointer) and runtime cleanups (runtime.AddCleanup) inside high-throughput HTTP handler caching tiers. Guarantees immediate reclamation of heavy payload memory during GC pressure while eliminating unbounded map key growth and dereference nil panics under multi-gigabit traffic.","antiPatternHeadline":"Retaining strong payload pointers in global handler caches or dereferencing Go 1.24 weak pointers without nil-fallback reconstruction.","stars_count":98,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","weak-pointer","memory-management","http-performance"],"exportEndpoints":{"claude":"/api/rules/go-weak-pointer-cache-eviction-invariant?format=claude","cursorMdc":"/api/rules/go-weak-pointer-cache-eviction-invariant?format=mdc","cursorrules":"/api/rules/go-weak-pointer-cache-eviction-invariant?format=cursor","windsurf":"/api/rules/go-weak-pointer-cache-eviction-invariant?format=windsurf","agents":"/api/rules/go-weak-pointer-cache-eviction-invariant?format=agents"}},{"id":"openfga-cdc-wal-cache-invalidation-standard","title":"OpenFGA CDC-Driven WAL Relation Invalidation and Cache Coherency Guardrail","category":"security","severity":"critical","description":"Mandates that authorization decision caches and OpenFGA tuple projections derive invalidation events deterministically from PostgreSQL Write-Ahead Log (WAL) change data capture (CDC) streams. Prohibits synchronous application-tier dual-writes and unversioned TTL-only authorization caching that risk stale permit decisions after privilege revocation. Enforces transactional Log Sequence Number (LSN) watermarking to maintain strict monotonic read consistency across distributed authorization checks.","antiPatternHeadline":"Dual-Write Application-Level Eviction and TTL Authorization Caching Allowing Revocation Bypass","stars_count":78,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","cdc","postgres-wal","cache-coherency","authorization"],"exportEndpoints":{"claude":"/api/rules/openfga-cdc-wal-cache-invalidation-standard?format=claude","cursorMdc":"/api/rules/openfga-cdc-wal-cache-invalidation-standard?format=mdc","cursorrules":"/api/rules/openfga-cdc-wal-cache-invalidation-standard?format=cursor","windsurf":"/api/rules/openfga-cdc-wal-cache-invalidation-standard?format=windsurf","agents":"/api/rules/openfga-cdc-wal-cache-invalidation-standard?format=agents"}},{"id":"compose-strong-skipping-stability-fencing","title":"Jetpack Compose 1.8 Strong Skipping Mode Stability Fencing","category":"mobile","severity":"critical","description":"Enforces strict compiler stability invariants and stability fencing across multi-module boundaries under Jetpack Compose 1.8 Strong Skipping Mode. While Strong Skipping enables composables with unstable parameters to be skipped via instance equality (`===`), multi-module domain models, collections, and lambdas crossing API boundaries without explicit stability contracts cause subtle recomposition cascades, structural equality bypasses, and deferred UI jank. This standard mandates explicit `@Immutable`/`@Stable` annotations or immutable wrapper fencing, stable collection wrappers, and proper lambda memoization across architectural boundaries.","antiPatternHeadline":"Implicit Unstable Parameter Leaks and Instance Equality Failures in Strong Skipping Compositions","stars_count":47,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","android","jetpack-compose","strong-skipping","stability","recomposition","kotlin"],"exportEndpoints":{"claude":"/api/rules/compose-strong-skipping-stability-fencing?format=claude","cursorMdc":"/api/rules/compose-strong-skipping-stability-fencing?format=mdc","cursorrules":"/api/rules/compose-strong-skipping-stability-fencing?format=cursor","windsurf":"/api/rules/compose-strong-skipping-stability-fencing?format=windsurf","agents":"/api/rules/compose-strong-skipping-stability-fencing?format=agents"}},{"id":"opentelemetry-arrow-ingest-backpressure-guardrail","title":"OpenTelemetry Arrow Stream Memory-Bounded Ingest Guardrail","category":"devops","severity":"critical","description":"Enforces hard memory-bounded ring buffer allocations and upstream gRPC flow-control backpressure on high-throughput OTLP Arrow columnar streams. Prevents Linux Out-Of-Memory (OOM) killer evictions and collector process termination during sudden cross-cluster telemetry surges by rejecting or throttling unbuffered record batches prior to deserialization.","antiPatternHeadline":"Unbounded Dynamic Batch Ingestion Leading to Native Heap Exhaustion and Collector SIGKILL","stars_count":110,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","apache-arrow","backpressure","grpc","sre","kubernetes"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-arrow-ingest-backpressure-guardrail?format=claude","cursorMdc":"/api/rules/opentelemetry-arrow-ingest-backpressure-guardrail?format=mdc","cursorrules":"/api/rules/opentelemetry-arrow-ingest-backpressure-guardrail?format=cursor","windsurf":"/api/rules/opentelemetry-arrow-ingest-backpressure-guardrail?format=windsurf","agents":"/api/rules/opentelemetry-arrow-ingest-backpressure-guardrail?format=agents"}},{"id":"envoy-gateway-llm-inference-concurrency-queue-boundary","title":"Envoy Gateway 1.2 LLM Inference Concurrency Boundary and Dynamic Queue Policy","category":"devops","severity":"critical","description":"Governs the mandatory enforcement of strict circuit breaking, pending request queue boundaries, and token-bucket rate limits at Envoy Gateway 1.2 for LLM inference workloads. Prevents GPU VRAM exhaustion and uncoordinated tail-latency spikes by enforcing KV-cache aware queue depth limits and connection pooling before traffic reaches inference runtimes (e.g., vLLM, TensorRT-LLM).","antiPatternHeadline":"Unbounded HTTP Concurrency to GPU Inference Backends Causing VRAM Thrashing and OOM Panics","stars_count":41,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","envoy-gateway","kubernetes","llm-inference","rate-limiting","vllm"],"exportEndpoints":{"claude":"/api/rules/envoy-gateway-llm-inference-concurrency-queue-boundary?format=claude","cursorMdc":"/api/rules/envoy-gateway-llm-inference-concurrency-queue-boundary?format=mdc","cursorrules":"/api/rules/envoy-gateway-llm-inference-concurrency-queue-boundary?format=cursor","windsurf":"/api/rules/envoy-gateway-llm-inference-concurrency-queue-boundary?format=windsurf","agents":"/api/rules/envoy-gateway-llm-inference-concurrency-queue-boundary?format=agents"}},{"id":"svelte-5-runes-async-state-guardrail","title":"Svelte 5 Runes Asynchronous State Transition and Signal Dependency Guardrail","category":"frontend","severity":"critical","description":"Enforces rigid synchronous tracking boundaries on Svelte 5 reactive runes ($state, $derived, $effect) to eliminate microtask dependency drops. Prevents unhandled teardown cascades, stale state overwrites, and memory leaks during concurrent asynchronous UI transitions.","antiPatternHeadline":"Naked Async $effect Callbacks Reading Signals Post-Await with Untracked Dependencies and Out-of-Order Teardowns","stars_count":50,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte","svelte-5","runes","signals","concurrency"],"exportEndpoints":{"claude":"/api/rules/svelte-5-runes-async-state-guardrail?format=claude","cursorMdc":"/api/rules/svelte-5-runes-async-state-guardrail?format=mdc","cursorrules":"/api/rules/svelte-5-runes-async-state-guardrail?format=cursor","windsurf":"/api/rules/svelte-5-runes-async-state-guardrail?format=windsurf","agents":"/api/rules/svelte-5-runes-async-state-guardrail?format=agents"}},{"id":"axum-08-makeservice-connection-limit-tcp-reaping","title":"Axum 0.8 Connection Limiting and TCP Handshake Reaping Guardrail","category":"backend","severity":"critical","description":"Enforces strict concurrency ceilings and handshake timeout fences on incoming TCP streams in Axum 0.8 deployments. Prevents file-descriptor starvation and heap exhaustion caused by slowloris attacks, hung TLS negotiations, and half-open HTTP/2 multiplexing state vectors. Guarantees that socket ingestion adheres to bounded resource pools and explicit socket teardown invariants.","antiPatternHeadline":"Unbounded Listener Ingestion and Unfenced TLS/TCP Handshakes Inducing File Descriptor Exhaustion","stars_count":104,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tokio","tower","networking","dos-mitigation"],"exportEndpoints":{"claude":"/api/rules/axum-08-makeservice-connection-limit-tcp-reaping?format=claude","cursorMdc":"/api/rules/axum-08-makeservice-connection-limit-tcp-reaping?format=mdc","cursorrules":"/api/rules/axum-08-makeservice-connection-limit-tcp-reaping?format=cursor","windsurf":"/api/rules/axum-08-makeservice-connection-limit-tcp-reaping?format=windsurf","agents":"/api/rules/axum-08-makeservice-connection-limit-tcp-reaping?format=agents"}},{"id":"tauri-v2-mobile-capability-ipc-security-manifest","title":"Tauri 2.0 Declarative Mobile Capability Manifest & IPC Permission Boundary Enforcement","category":"mobile","severity":"critical","description":"Enforces strict, least-privilege capability manifests in Tauri 2.0 mobile applications (iOS and Android). Prevents cross-webview privilege escalation and unauthorized native OS plugin invocation by binding explicit command sets and native scope constraints to isolated window and webview contexts.","antiPatternHeadline":"Wildcard Default Capabilities and Global Native Plugin Access via Unrestricted IPC Boundaries","stars_count":118,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri-v2","security","ipc","capabilities","rust"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-mobile-capability-ipc-security-manifest?format=claude","cursorMdc":"/api/rules/tauri-v2-mobile-capability-ipc-security-manifest?format=mdc","cursorrules":"/api/rules/tauri-v2-mobile-capability-ipc-security-manifest?format=cursor","windsurf":"/api/rules/tauri-v2-mobile-capability-ipc-security-manifest?format=windsurf","agents":"/api/rules/tauri-v2-mobile-capability-ipc-security-manifest?format=agents"}},{"id":"capacitor-7-biometric-secure-enclave-keychain-invariant","title":"Hardware-Backed Biometric Enclave Key Binding & Re-Authentication Invariant","category":"mobile","severity":"critical","description":"High-entropy cryptographic keys, access tokens, and signing secrets in Capacitor 7 applications must be strictly bound to hardware-backed security modules (Apple Secure Enclave via SecAccessControl and Android KeyStore via StrongBox Keymaster) with mandatory per-use or short-window biometric presence. Web-layer persistence stores (localStorage, IndexedDB) or software-backed Keychain/Keystore fallback without explicit user re-authentication invariants permit zero-day sandbox exfiltration and are strictly prohibited.","antiPatternHeadline":"Persisting Sensitive Cryptographic Material in Insecure Webviews or Software Keychains Without Biometric Hardware Binding","stars_count":99,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["capacitor","ios","android","keychain","secure-enclave","biometrics","security"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-biometric-secure-enclave-keychain-invariant?format=claude","cursorMdc":"/api/rules/capacitor-7-biometric-secure-enclave-keychain-invariant?format=mdc","cursorrules":"/api/rules/capacitor-7-biometric-secure-enclave-keychain-invariant?format=cursor","windsurf":"/api/rules/capacitor-7-biometric-secure-enclave-keychain-invariant?format=windsurf","agents":"/api/rules/capacitor-7-biometric-secure-enclave-keychain-invariant?format=agents"}},{"id":"rfc-9449-dpop-edge-nonce-token-binding-guardrail","title":"RFC 9449 DPoP Edge Nonce Validation and Token-Binding Guardrail","category":"security","severity":"critical","description":"Enforces asymmetric RFC 9449 Demonstrating Proof-of-Possession (DPoP) verification and cryptographically bound token validation at edge gateways. Neutralizes access token theft and replay attacks by validating public key thumbprints (jkt), canonicalized HTTP request attributes (htm/htu), access token hashes (ath), and distributed clock-skew-tolerant edge nonces.","antiPatternHeadline":"Accepting Plain Bearer Tokens or Unbound DPoP Proofs Without Nonce and Thumbprint Verification","stars_count":89,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","oauth2","dpop","rfc9449","edge-gateway","zero-trust","cryptography"],"exportEndpoints":{"claude":"/api/rules/rfc-9449-dpop-edge-nonce-token-binding-guardrail?format=claude","cursorMdc":"/api/rules/rfc-9449-dpop-edge-nonce-token-binding-guardrail?format=mdc","cursorrules":"/api/rules/rfc-9449-dpop-edge-nonce-token-binding-guardrail?format=cursor","windsurf":"/api/rules/rfc-9449-dpop-edge-nonce-token-binding-guardrail?format=windsurf","agents":"/api/rules/rfc-9449-dpop-edge-nonce-token-binding-guardrail?format=agents"}},{"id":"sigstore-slsa3-admission-enforcement","title":"Sigstore SLSA Level 3 Provenance and Cryptographic Attestation Admission Enforcement","category":"security","severity":"critical","description":"Production container workloads must strictly enforce cryptographic supply-chain verification before scheduling via admission webhooks or policy engines like Kyverno or OPA Gatekeeper. All container images must be pinned to immutable digest references (SHA-256) accompanied by valid Cosign/Sigstore digital signatures, Rekor transparency log proofs, and SLSA Level 3 build provenance generated within isolated, hermetic runners.","antiPatternHeadline":"Scheduling Mutable or Unverified Container Images Without Non-Repudiable Cryptographic Provenance","stars_count":111,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","kubernetes","supply-chain","sigstore","cosign","slsa-level-3","admission-controller"],"exportEndpoints":{"claude":"/api/rules/sigstore-slsa3-admission-enforcement?format=claude","cursorMdc":"/api/rules/sigstore-slsa3-admission-enforcement?format=mdc","cursorrules":"/api/rules/sigstore-slsa3-admission-enforcement?format=cursor","windsurf":"/api/rules/sigstore-slsa3-admission-enforcement?format=windsurf","agents":"/api/rules/sigstore-slsa3-admission-enforcement?format=agents"}},{"id":"k8s-132-dra-structured-gpu-standard","title":"Kubernetes 1.32 DRA Structured GPU Allocation Standard","category":"devops","severity":"critical","description":"Enforces Kubernetes 1.32 Dynamic Resource Allocation (DRA) Structured Parameters for deterministic multi-tenant GPU provisioning. Prevents legacy device plugin resource fragmentation and out-of-band driver re-initialization by replacing opaque string-keyed limits with resource.k8s.io/v1beta1 ResourceClaim specs and in-tree CEL selector constraints.","antiPatternHeadline":"Opaque Device-Plugin Allocations and Runtime MPS Driver Re-Initialization Hacks","stars_count":85,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","kubernetes","gpu","dra","nvidia","structured-parameters"],"exportEndpoints":{"claude":"/api/rules/k8s-132-dra-structured-gpu-standard?format=claude","cursorMdc":"/api/rules/k8s-132-dra-structured-gpu-standard?format=mdc","cursorrules":"/api/rules/k8s-132-dra-structured-gpu-standard?format=cursor","windsurf":"/api/rules/k8s-132-dra-structured-gpu-standard?format=windsurf","agents":"/api/rules/k8s-132-dra-structured-gpu-standard?format=agents"}},{"id":"clickhouse-sharedmergetree-lease-fencing","title":"ClickHouse SharedMergeTree Lease Fencing & Split-Brain Prevention","category":"devops","severity":"critical","description":"Enforces strict monotonic fencing tokens and Keeper ephemeral lease validation across stateless ClickHouse compute replicas operating on SharedMergeTree engines. Prevents partitioned or zombie worker nodes from writing uncoordinated mutations or orphan parts directly to shared object storage (S3/GCS).","antiPatternHeadline":"Unfenced Object Storage Mutations via Expired Keeper Leases","stars_count":73,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","clickhouse","sharedmergetree","distributed-systems","s3","fencing-tokens"],"exportEndpoints":{"claude":"/api/rules/clickhouse-sharedmergetree-lease-fencing?format=claude","cursorMdc":"/api/rules/clickhouse-sharedmergetree-lease-fencing?format=mdc","cursorrules":"/api/rules/clickhouse-sharedmergetree-lease-fencing?format=cursor","windsurf":"/api/rules/clickhouse-sharedmergetree-lease-fencing?format=windsurf","agents":"/api/rules/clickhouse-sharedmergetree-lease-fencing?format=agents"}},{"id":"tanstack-router-v1-search-param-schema-invariant","title":"TanStack Router v1 Runtime Search Parameter Validation and Isolation Invariant","category":"frontend","severity":"critical","description":"Enforces strict runtime schema validation and serialization isolation for all route search parameters via validateSearch at the route boundary. Eliminates client-side prototype pollution, malformed state propagation, and unchecked type-casting across nested route transitions.","antiPatternHeadline":"Bypassing runtime validation via TypeScript type assertions or unconstrained record parsing in route search configurations","stars_count":73,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","tanstack-router","typescript","zod","security","routing"],"exportEndpoints":{"claude":"/api/rules/tanstack-router-v1-search-param-schema-invariant?format=claude","cursorMdc":"/api/rules/tanstack-router-v1-search-param-schema-invariant?format=mdc","cursorrules":"/api/rules/tanstack-router-v1-search-param-schema-invariant?format=cursor","windsurf":"/api/rules/tanstack-router-v1-search-param-schema-invariant?format=windsurf","agents":"/api/rules/tanstack-router-v1-search-param-schema-invariant?format=agents"}},{"id":"openfga-contextual-tuple-depth-guardrail-openfga-1-6-cont-531","title":"OpenFGA 1.6 Contextual Tuple Bounded Depth & Cardinality Guardrail","category":"backend","severity":"critical","description":"Enforces strict recursion depth limits, contextual tuple bounds, and request timeouts for OpenFGA 1.6 Check and ListObjects operations. Unchecked contextual tuples and unbounded graph traversals in Relationship-Based Access Control (ReBAC) induce query amplification, goroutine exhaustion, and denial-of-service in high-throughput engines.","antiPatternHeadline":"Unbounded Contextual Tuple Ingestion and Missing Evaluation Depth Bounds in ReBAC Checks","stars_count":81,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","openfga","rebac","authorization","performance","dos-prevention"],"exportEndpoints":{"claude":"/api/rules/openfga-contextual-tuple-depth-guardrail-openfga-1-6-cont-531?format=claude","cursorMdc":"/api/rules/openfga-contextual-tuple-depth-guardrail-openfga-1-6-cont-531?format=mdc","cursorrules":"/api/rules/openfga-contextual-tuple-depth-guardrail-openfga-1-6-cont-531?format=cursor","windsurf":"/api/rules/openfga-contextual-tuple-depth-guardrail-openfga-1-6-cont-531?format=windsurf","agents":"/api/rules/openfga-contextual-tuple-depth-guardrail-openfga-1-6-cont-531?format=agents"}},{"id":"postgres-17-logical-replication-failover-slot-sync-guardrail","title":"Postgres 17 Logical Replication Failover Slot Synchronization & CDC Invariants","category":"backend","severity":"critical","description":"Enforces failover-enabled logical replication slots and synchronized standby slots introduced in PostgreSQL 17 for CDC consumers and cache synchronizers. Prevents silent data divergence, dropped CDC events, and catastrophic WAL bloat during failover transitions by ensuring physical standbys retain and mirror logical replication state in lockstep before primary advance.","antiPatternHeadline":"Unsynchronized Logical Replication Slots Causing Data Loss or Consumer Desynchronization Upon HA Failover","stars_count":102,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["postgres","postgresql-17","cdc","logical-replication","failover","database-ha"],"exportEndpoints":{"claude":"/api/rules/postgres-17-logical-replication-failover-slot-sync-guardrail?format=claude","cursorMdc":"/api/rules/postgres-17-logical-replication-failover-slot-sync-guardrail?format=mdc","cursorrules":"/api/rules/postgres-17-logical-replication-failover-slot-sync-guardrail?format=cursor","windsurf":"/api/rules/postgres-17-logical-replication-failover-slot-sync-guardrail?format=windsurf","agents":"/api/rules/postgres-17-logical-replication-failover-slot-sync-guardrail?format=agents"}},{"id":"bun-websocket-backpressure-watermark-standard","title":"Bun 1.2 WebSocket Backpressure Watermark Standard","category":"backend","severity":"critical","description":"Enforces strict egress buffer monitoring and ingestion pausing on Bun WebSocket connections using ws.getBufferedAmount() and return values from ws.send(). Prevents unmitigated heap exhaustion and process OOM kills in high-throughput event loops by establishing high and low watermarks that govern client read suspension and frame emission.","antiPatternHeadline":"Unbounded WebSocket Writes Without Backpressure Yielding Process OOM","stars_count":52,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","websockets","backpressure","memory-management","event-driven"],"exportEndpoints":{"claude":"/api/rules/bun-websocket-backpressure-watermark-standard?format=claude","cursorMdc":"/api/rules/bun-websocket-backpressure-watermark-standard?format=mdc","cursorrules":"/api/rules/bun-websocket-backpressure-watermark-standard?format=cursor","windsurf":"/api/rules/bun-websocket-backpressure-watermark-standard?format=windsurf","agents":"/api/rules/bun-websocket-backpressure-watermark-standard?format=agents"}},{"id":"tauri-v2-mobile-ipc-zero-copy-binary-streaming","title":"Tauri 2.0 IPC Zero-Copy Binary Buffer Streaming Standard","category":"mobile","severity":"critical","description":"Enforces raw binary buffer streaming and direct memory transfer across the Rust-WebView FFI boundary in Tauri 2.0 mobile targets. Eliminates memory amplification, GC thrashing, and CPU bottlenecks caused by JSON or Base64 serialization when streaming high-frequency sensor telemetry, camera frames, and audio PCM buffers.","antiPatternHeadline":"Base64 string encoding or JSON array wrapping of dense binary buffers over IPC invokes triple memory amplification and blocks the mobile main thread.","stars_count":112,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri-2.0","rust","ipc","zero-copy","binary-streaming","memory-optimization"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-mobile-ipc-zero-copy-binary-streaming?format=claude","cursorMdc":"/api/rules/tauri-v2-mobile-ipc-zero-copy-binary-streaming?format=mdc","cursorrules":"/api/rules/tauri-v2-mobile-ipc-zero-copy-binary-streaming?format=cursor","windsurf":"/api/rules/tauri-v2-mobile-ipc-zero-copy-binary-streaming?format=windsurf","agents":"/api/rules/tauri-v2-mobile-ipc-zero-copy-binary-streaming?format=agents"}},{"id":"capacitor-7-biometric-hardware-key-attestation-invariant","title":"Capacitor 7 Biometric Hardware Key Attestation & Token Invariant","category":"mobile","severity":"critical","description":"Enforces that client-side authentication tokens and cryptographic challenges in Capacitor 7 hybrid applications are anchored to hardware-backed keystores (Apple Secure Enclave, Android StrongBox/TEE) via non-exportable biometric-bound keys. This prevents Cross-Site Scripting (DOM injection) vulnerabilities within the WebView from exfiltrating access tokens or forging authenticated transactions.","antiPatternHeadline":"Persisting raw bearer tokens in WebView-accessible storage (localStorage, IndexedDB, or standard unauthenticated native preferences) susceptible to DOM exfiltration.","stars_count":48,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","security","biometrics","cryptography","webauthn"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-biometric-hardware-key-attestation-invariant?format=claude","cursorMdc":"/api/rules/capacitor-7-biometric-hardware-key-attestation-invariant?format=mdc","cursorrules":"/api/rules/capacitor-7-biometric-hardware-key-attestation-invariant?format=cursor","windsurf":"/api/rules/capacitor-7-biometric-hardware-key-attestation-invariant?format=windsurf","agents":"/api/rules/capacitor-7-biometric-hardware-key-attestation-invariant?format=agents"}},{"id":"oauth2-rar-fine-grained-policy-standard","title":"OAuth 2.0 RFC 9396 Rich Authorization Requests (RAR) Policy Enforcement","category":"security","severity":"critical","description":"RFC 9396 Rich Authorization Requests (RAR) mandate that capability tokens convey transaction-specific, fine-grained authorization details rather than broad, ambient OAuth scopes. Resource servers and token-issuing gateways must strictly validate, structurally type, and cryptographically bind authorization details to prevent token re-use, lateral movement, and privilege escalation in zero-trust architectures.","antiPatternHeadline":"Falling Back to Ambient Coarse Scopes or Unvalidated authorization_details Payloads","stars_count":69,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","oauth2","rfc9396","rar","zero-trust","token-validation"],"exportEndpoints":{"claude":"/api/rules/oauth2-rar-fine-grained-policy-standard?format=claude","cursorMdc":"/api/rules/oauth2-rar-fine-grained-policy-standard?format=mdc","cursorrules":"/api/rules/oauth2-rar-fine-grained-policy-standard?format=cursor","windsurf":"/api/rules/oauth2-rar-fine-grained-policy-standard?format=windsurf","agents":"/api/rules/oauth2-rar-fine-grained-policy-standard?format=agents"}},{"id":"sigstore-cosign-slsa3-keyless-admission-guardrail","title":"Mandatory Sigstore Cosign Keyless Provenance & Rekor Transparency Admission","category":"security","severity":"critical","description":"Enforces cryptographic verification of container images at admission time using Sigstore Cosign with ephemeral OIDC keyless signing, Rekor transparency log validation, and Fulcio root CA attestation. Guarantees that Kubernetes clusters immediately reject any workload lacking valid SLSA Level 3 build provenance generated by approved CI/CD identities.","antiPatternHeadline":"Trusting Unverified Image Digests or Using Long-Lived Static Private Keys Bypassing Transparency Logs","stars_count":73,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","kubernetes","sigstore","cosign","slsa-level-3","supply-chain","admission-controller","policy-as-code"],"exportEndpoints":{"claude":"/api/rules/sigstore-cosign-slsa3-keyless-admission-guardrail?format=claude","cursorMdc":"/api/rules/sigstore-cosign-slsa3-keyless-admission-guardrail?format=mdc","cursorrules":"/api/rules/sigstore-cosign-slsa3-keyless-admission-guardrail?format=cursor","windsurf":"/api/rules/sigstore-cosign-slsa3-keyless-admission-guardrail?format=windsurf","agents":"/api/rules/sigstore-cosign-slsa3-keyless-admission-guardrail?format=agents"}},{"id":"karpenter-disruption-budget-pod-graceful-eviction-standard","title":"Karpenter 1.2+ Disruption Budget and Deterministic Eviction Guardrail","category":"devops","severity":"critical","description":"Enforces strict NodePool disruption schedules, deterministic node consolidation limits, and synchronized PodDisruptionBudget/terminationGracePeriodSeconds configurations for Karpenter v1.2+. Guarantees zero cascading microservice outages by eliminating unconstrained automated node rollouts and rapid instance drains during peak production traffic.","antiPatternHeadline":"Unbounded NodePool Consolidation and Missing Pod Drain Synchronization Inducing Microservice Cascading Failures","stars_count":104,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","karpenter","kubernetes","autoscaling","reliability","infrastructure-as-code"],"exportEndpoints":{"claude":"/api/rules/karpenter-disruption-budget-pod-graceful-eviction-standard?format=claude","cursorMdc":"/api/rules/karpenter-disruption-budget-pod-graceful-eviction-standard?format=mdc","cursorrules":"/api/rules/karpenter-disruption-budget-pod-graceful-eviction-standard?format=cursor","windsurf":"/api/rules/karpenter-disruption-budget-pod-graceful-eviction-standard?format=windsurf","agents":"/api/rules/karpenter-disruption-budget-pod-graceful-eviction-standard?format=agents"}},{"id":"react-19-useactionstate-optimistic-rollback-barrier","title":"React 19 useActionState Optimistic Rollback Barrier & Race-Condition Defense","category":"frontend","severity":"critical","description":"Enforces strict transactional synchronization between React 19 useActionState and useOptimistic primitives. Eliminates zombie speculative UI states, stale hydration mismatches, and out-of-order reconciliation when server actions execute across high-latency networks or experience transit failures.","antiPatternHeadline":"Ad-Hoc Imperative Rollback Logic and Decoupled Optimistic State via Standard useState Hooks","stars_count":45,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["react-19","useActionState","useOptimistic","server-actions","concurrency","frontend"],"exportEndpoints":{"claude":"/api/rules/react-19-useactionstate-optimistic-rollback-barrier?format=claude","cursorMdc":"/api/rules/react-19-useactionstate-optimistic-rollback-barrier?format=mdc","cursorrules":"/api/rules/react-19-useactionstate-optimistic-rollback-barrier?format=cursor","windsurf":"/api/rules/react-19-useactionstate-optimistic-rollback-barrier?format=windsurf","agents":"/api/rules/react-19-useactionstate-optimistic-rollback-barrier?format=agents"}},{"id":"vite6-environment-api-runtime-sandbox-isolation","title":"Vite 6 Environment API Multi-Runtime Sandbox & Memory Guardrails","category":"frontend","severity":"critical","description":"Enforces deterministic process boundaries, memory limits, and module execution sandboxing across heterogeneous Vite 6 environments (Workerd, Node.js, Deno). Prevents host runtime pollution, IPC starvation, and cross-environment global prototype leaks during dev-server and SSR build phases.","antiPatternHeadline":"Global Scope Bleed and Unbounded Memory Allocation in Vite 6 Mixed SSR Runners","stars_count":79,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","vite-6","environment-api","ssr","workerd","sandboxing","memory-leak"],"exportEndpoints":{"claude":"/api/rules/vite6-environment-api-runtime-sandbox-isolation?format=claude","cursorMdc":"/api/rules/vite6-environment-api-runtime-sandbox-isolation?format=mdc","cursorrules":"/api/rules/vite6-environment-api-runtime-sandbox-isolation?format=cursor","windsurf":"/api/rules/vite6-environment-api-runtime-sandbox-isolation?format=windsurf","agents":"/api/rules/vite6-environment-api-runtime-sandbox-isolation?format=agents"}},{"id":"bun-websocket-backpressure-watermark-invariant","title":"Bun 1.2 WebSocket Backpressure & High-Water Mark Invariant","category":"backend","severity":"critical","description":"Enforces deterministic flow control on Bun WebSocket connections by gating transmission against socket-buffered byte thresholds and orchestrating re-activation via the drain lifecycle hook. Without backpressure watermarks, slow consumers cause kernel TCP and native Bun memory buffers to accumulate unboundedly, precipitating event-loop starvation and catastrophic out-of-memory (OOM) termination.","antiPatternHeadline":"Fire-and-forget socket writes without getBufferedAmount gating or drain callback synchronization.","stars_count":76,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","websockets","backpressure","flow-control","networking"],"exportEndpoints":{"claude":"/api/rules/bun-websocket-backpressure-watermark-invariant?format=claude","cursorMdc":"/api/rules/bun-websocket-backpressure-watermark-invariant?format=mdc","cursorrules":"/api/rules/bun-websocket-backpressure-watermark-invariant?format=cursor","windsurf":"/api/rules/bun-websocket-backpressure-watermark-invariant?format=windsurf","agents":"/api/rules/bun-websocket-backpressure-watermark-invariant?format=agents"}},{"id":"fastapi-pydantic-v2-zerocopy-arena-serialization","title":"FastAPI Pydantic v2 Zero-Copy Arena-Allocated Serialization Guardrail","category":"backend","severity":"critical","description":"Enforces zero-copy, off-heap serialization patterns for high-throughput FastAPI endpoints returning massive payloads. Eliminates Python Global Interpreter Lock (GIL) stalls and garbage collection pressure by dispatching serialization directly to Rust-managed arena memory segments for raw byte-level ASGI streaming.","antiPatternHeadline":"Intermediate Python Dict Materialization and Unbounded Heap Reallocation Under GIL","stars_count":111,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","pydantic-v2","rust","zero-copy","memory-management","concurrency"],"exportEndpoints":{"claude":"/api/rules/fastapi-pydantic-v2-zerocopy-arena-serialization?format=claude","cursorMdc":"/api/rules/fastapi-pydantic-v2-zerocopy-arena-serialization?format=mdc","cursorrules":"/api/rules/fastapi-pydantic-v2-zerocopy-arena-serialization?format=cursor","windsurf":"/api/rules/fastapi-pydantic-v2-zerocopy-arena-serialization?format=windsurf","agents":"/api/rules/fastapi-pydantic-v2-zerocopy-arena-serialization?format=agents"}},{"id":"tauri-v2-multi-webview-ipc-isolation-fence","title":"Tauri 2.0 Multi-WebView IPC Isolation & Capability Scoping","category":"mobile","severity":"critical","description":"Enforces strict window-scoped capability segregation and IPC context isolation across multi-webview Tauri 2.0 mobile architectures. Mandates explicit webview label binding in capability configurations and cryptographic caller validation within Rust command handlers to prevent secondary webviews from invoking privileged native operations.","antiPatternHeadline":"Ambient Native Exposure via Wildcard IPC Capability Allocation Across WebViews","stars_count":67,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri-v2","ipc-security","webview-isolation","rust"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-multi-webview-ipc-isolation-fence?format=claude","cursorMdc":"/api/rules/tauri-v2-multi-webview-ipc-isolation-fence?format=mdc","cursorrules":"/api/rules/tauri-v2-multi-webview-ipc-isolation-fence?format=cursor","windsurf":"/api/rules/tauri-v2-multi-webview-ipc-isolation-fence?format=windsurf","agents":"/api/rules/tauri-v2-multi-webview-ipc-isolation-fence?format=agents"}},{"id":"capacitor-universal-link-attestation-guardrail","title":"Capacitor 7 Universal Link Cryptographic Attestation and Bridge Sanitization Standard","category":"mobile","severity":"critical","description":"Mandates strict cryptographic and domain origin attestation for Universal Links (iOS) and Android App Links prior to dispatching deep link payloads across the Capacitor 7 bridge. Prohibits implicit trust of incoming URI parameters in `appUrlOpen` listeners without host verification matching OS-level digital asset links. Prevents deep link hijacking, custom scheme interception, and unauthenticated execution of privileged native plugins.","antiPatternHeadline":"Trusting Raw appUrlOpen Events and Custom Schemes for Native Bridge Dispatch","stars_count":76,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","security","deep-links","app-links","universal-links"],"exportEndpoints":{"claude":"/api/rules/capacitor-universal-link-attestation-guardrail?format=claude","cursorMdc":"/api/rules/capacitor-universal-link-attestation-guardrail?format=mdc","cursorrules":"/api/rules/capacitor-universal-link-attestation-guardrail?format=cursor","windsurf":"/api/rules/capacitor-universal-link-attestation-guardrail?format=windsurf","agents":"/api/rules/capacitor-universal-link-attestation-guardrail?format=agents"}},{"id":"ebpf-xdp-smartnic-syn-cookie-offload-standard","title":"eBPF XDP SmartNIC Stateless SYN-Cookie Offload Standard","category":"security","severity":"critical","description":"Enforces completely stateless L4 SYN flood mitigation executed directly in SmartNIC hardware (XDP offload mode) or native driver space prior to kernel SKB allocation. Prohibits stateful map lookups or allocations during TCP SYN ingestion, mandating deterministic cookie generation and verification via cryptographic helpers with zero host memory overhead.","antiPatternHeadline":"Allocating BPF map state on inbound TCP SYN packets before cookie verification","stars_count":92,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","ebpf","xdp","smartnic","ddos-mitigation","kernel","networking"],"exportEndpoints":{"claude":"/api/rules/ebpf-xdp-smartnic-syn-cookie-offload-standard?format=claude","cursorMdc":"/api/rules/ebpf-xdp-smartnic-syn-cookie-offload-standard?format=mdc","cursorrules":"/api/rules/ebpf-xdp-smartnic-syn-cookie-offload-standard?format=cursor","windsurf":"/api/rules/ebpf-xdp-smartnic-syn-cookie-offload-standard?format=windsurf","agents":"/api/rules/ebpf-xdp-smartnic-syn-cookie-offload-standard?format=agents"}},{"id":"otel-exponential-histograms-dynamic-compaction-invariant","title":"OpenTelemetry Exponential Histogram Dynamic Compaction and Bucket Scale Invariant","category":"devops","severity":"critical","description":"Enforces strict upper bounds on memory allocation for OpenTelemetry metrics streams by mandating exponential histograms with dynamic scale reduction and explicit maxBucket limits. Guarantees that SDK clients and OpenTelemetry Collectors automatically downscale bucket resolution (scale compaction) during high-dynamic-range metric spikes, preventing Out-Of-Memory (OOM) termination and collector buffer saturation.","antiPatternHeadline":"Unbounded Explicit Buckets or Unconstrained Exponential Histogram Scales Causing Memory Exhaustion","stars_count":73,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","metrics","observability","memory-management","sre"],"exportEndpoints":{"claude":"/api/rules/otel-exponential-histograms-dynamic-compaction-invariant?format=claude","cursorMdc":"/api/rules/otel-exponential-histograms-dynamic-compaction-invariant?format=mdc","cursorrules":"/api/rules/otel-exponential-histograms-dynamic-compaction-invariant?format=cursor","windsurf":"/api/rules/otel-exponential-histograms-dynamic-compaction-invariant?format=windsurf","agents":"/api/rules/otel-exponential-histograms-dynamic-compaction-invariant?format=agents"}},{"id":"vite6-rolldown-module-federation-boundary-isolation","title":"Vite 6 Rolldown Module Federation AST Boundary and Scope Isolation","category":"frontend","severity":"critical","description":"Enforces strict Rust-based AST graph separation in Vite 6 (Rolldown) to eliminate runtime global-scope pollution, duplicate vendor chunk execution, and multi-version framework instantiation across dynamic federated remotes. Guarantees that shared singleton runtimes (such as React or Vue context dispatchers) are pinned to immutable host scopes while dynamic exposed remotes use isolated chunk evaluation contexts.","antiPatternHeadline":"Implicit Scope Leakage and Dual-Framework Instantiation via Unpinned Module Federation Sharing","stars_count":56,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","vite6","rolldown","module-federation","micro-frontends","ast-isolation"],"exportEndpoints":{"claude":"/api/rules/vite6-rolldown-module-federation-boundary-isolation?format=claude","cursorMdc":"/api/rules/vite6-rolldown-module-federation-boundary-isolation?format=mdc","cursorrules":"/api/rules/vite6-rolldown-module-federation-boundary-isolation?format=cursor","windsurf":"/api/rules/vite6-rolldown-module-federation-boundary-isolation?format=windsurf","agents":"/api/rules/vite6-rolldown-module-federation-boundary-isolation?format=agents"}},{"id":"fastapi-anyio-taskgroup-teardown-invariant","title":"FastAPI AnyIO TaskGroup Structured Concurrency Teardown Invariant","category":"backend","severity":"critical","description":"Enforces strict structured concurrency teardown semantics using anyio.create_task_group() within async FastAPI streaming endpoints and background job runners. Guarantees deterministic cancellation propagation, unhandled exception containment, and immediate file/socket resource cleanup upon client disconnects or upstream failures.","antiPatternHeadline":"Fire-and-Forget asyncio.create_task Inside Streaming Generators Causing Orphaned Sockets and Zombie Coroutines","stars_count":72,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","anyio","asyncio","streaming","concurrency"],"exportEndpoints":{"claude":"/api/rules/fastapi-anyio-taskgroup-teardown-invariant?format=claude","cursorMdc":"/api/rules/fastapi-anyio-taskgroup-teardown-invariant?format=mdc","cursorrules":"/api/rules/fastapi-anyio-taskgroup-teardown-invariant?format=cursor","windsurf":"/api/rules/fastapi-anyio-taskgroup-teardown-invariant?format=windsurf","agents":"/api/rules/fastapi-anyio-taskgroup-teardown-invariant?format=agents"}},{"id":"capacitor-7-wkwebview-process-termination-recovery","title":"Capacitor 7 WKWebView Process Termination State Recovery Protocol","category":"mobile","severity":"critical","description":"Mitigates catastrophic hybrid application state loss on iOS caused by Jetsam termination of the out-of-process WKWebView WebContent process under background memory pressure. Enforces atomic state snapshot serialization through the native Capacitor bridge onto POSIX-atomic native disk caches before OS suspension, coupled with deterministic cold-rehydrate handshakes on webview process respawn.","antiPatternHeadline":"Relying on DOM Lifecycle Hooks and Async Web Storage for Background State Preservation in WKWebView","stars_count":42,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","ios","wkwebview","state-recovery","jetsam","persistence"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-wkwebview-process-termination-recovery?format=claude","cursorMdc":"/api/rules/capacitor-7-wkwebview-process-termination-recovery?format=mdc","cursorrules":"/api/rules/capacitor-7-wkwebview-process-termination-recovery?format=cursor","windsurf":"/api/rules/capacitor-7-wkwebview-process-termination-recovery?format=windsurf","agents":"/api/rules/capacitor-7-wkwebview-process-termination-recovery?format=agents"}},{"id":"nextjs-15-server-action-nonce-binding","title":"Next.js 15 Server Action Ephemeral Cryptographic Nonce-Binding Standard","category":"security","severity":"critical","description":"Next.js 15 Server Actions must enforce cryptographic nonce-binding to neutralize distributed replay attacks and session-riding state transitions. Every mutation-bearing Server Action must validate an ephemeral, HMAC-signed execution nonce strictly coupled to the authenticated user's session identifier, timestamp bounds, and mutation signature. State-changing operations must reject unverified payloads, guarantee single-use consumption, and strictly enforce atomic invalidation.","antiPatternHeadline":"Executing Naked State Mutations in Next.js Server Actions Without Ephemeral Cryptographic Nonce Verification","stars_count":70,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","nextjs15","server-actions","cryptography","csrf","replay-prevention"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-server-action-nonce-binding?format=claude","cursorMdc":"/api/rules/nextjs-15-server-action-nonce-binding?format=mdc","cursorrules":"/api/rules/nextjs-15-server-action-nonce-binding?format=cursor","windsurf":"/api/rules/nextjs-15-server-action-nonce-binding?format=windsurf","agents":"/api/rules/nextjs-15-server-action-nonce-binding?format=agents"}},{"id":"tauri-v2-mmap-ipc-buffer-fence","title":"Tauri 2.0 Core Zero-Copy Memory-Mapped IPC Buffer Fence Guardrail","category":"mobile","severity":"critical","description":"Enforces strict zero-copy memory-mapped IPC buffer patterns across Tauri 2.0 webviews and native Rust runtime backends on mobile targets. Eliminates JSON and binary serialization overhead by pinning shared circular ring buffers with double-buffering fences and atomic sequence barriers. Prevents UI thread stalls, memory duplication, and bus saturation during high-throughput sensor, camera, or frame-buffer streaming.","antiPatternHeadline":"JSON/Base64 IPC Payload Serialization and Unfenced Dynamic TypedArray Transfers","stars_count":79,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri-2.0","zero-copy","shared-memory","ipc","rust","android","ios"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-mmap-ipc-buffer-fence?format=claude","cursorMdc":"/api/rules/tauri-v2-mmap-ipc-buffer-fence?format=mdc","cursorrules":"/api/rules/tauri-v2-mmap-ipc-buffer-fence?format=cursor","windsurf":"/api/rules/tauri-v2-mmap-ipc-buffer-fence?format=windsurf","agents":"/api/rules/tauri-v2-mmap-ipc-buffer-fence?format=agents"}},{"id":"axum-08-tls-session-ticket-invalidation-http3-drain","title":"Axum 0.8 Graceful Shutdown and TLS Session Ticket Invalidation Protocol","category":"backend","severity":"critical","description":"Enforces deterministic two-phase connection draining and atomic TLS session ticket deprecation in Axum 0.8 services handling HTTP/3. Prevents rolling update request truncation by disabling 0-RTT/resumption tickets prior to stream draining and issuing synchronous QUIC GOAWAY frames with active stream timeouts.","antiPatternHeadline":"Naive SIGTERM listener termination allowing cached TLS ticket 0-RTT reconnects and inflight HTTP/3 stream truncation.","stars_count":68,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","http3","quic","tls","rustls"],"exportEndpoints":{"claude":"/api/rules/axum-08-tls-session-ticket-invalidation-http3-drain?format=claude","cursorMdc":"/api/rules/axum-08-tls-session-ticket-invalidation-http3-drain?format=mdc","cursorrules":"/api/rules/axum-08-tls-session-ticket-invalidation-http3-drain?format=cursor","windsurf":"/api/rules/axum-08-tls-session-ticket-invalidation-http3-drain?format=windsurf","agents":"/api/rules/axum-08-tls-session-ticket-invalidation-http3-drain?format=agents"}},{"id":"otel-non-blocking-batch-span-drop-backpressure-guardrail","title":"OpenTelemetry Non-Blocking Batch Span Drop Backpressure Guardrail","category":"devops","severity":"critical","description":"Enforces bounded memory limits and non-blocking drop-on-saturation policies for OpenTelemetry span processors to eliminate application thread contention and garbage collection pause storms. Mandates explicit maxQueueSize, aggressive export timeouts, and non-blocking batch exports during collector degradation or network partitions. Disallows synchronous span processing, unconstrained in-memory queues, and blocking flush calls within the hot path.","antiPatternHeadline":"Unbounded Telemetry Buffering and Synchronous Export Stalling Microservice Event Loops Under Network Degradation","stars_count":82,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","observability","backpressure","performance","resilience"],"exportEndpoints":{"claude":"/api/rules/otel-non-blocking-batch-span-drop-backpressure-guardrail?format=claude","cursorMdc":"/api/rules/otel-non-blocking-batch-span-drop-backpressure-guardrail?format=mdc","cursorrules":"/api/rules/otel-non-blocking-batch-span-drop-backpressure-guardrail?format=cursor","windsurf":"/api/rules/otel-non-blocking-batch-span-drop-backpressure-guardrail?format=windsurf","agents":"/api/rules/otel-non-blocking-batch-span-drop-backpressure-guardrail?format=agents"}},{"id":"openfga-lamport-clock-tuple-mutation-ordering-standard","title":"Strict Monotonic Lamport Clock Ordering for OpenFGA Tuple Mutations and Cache Invalidation","category":"security","severity":"critical","description":"Enforces strict monotonic Lamport timestamp validation and atomic compare-and-swap state transitions across distributed Zanzibar authorization caches and tuple change streams. Eliminates time-of-check to time-of-use (TOCTOU) authorization windows and stale permissions resulting from out-of-order tuple ingestion across horizontally scaled evaluators. Guarantees that late-arriving revoke mutations are never overwritten or masked by superseded grant events.","antiPatternHeadline":"Unordered Asynchronous Tuple Streaming Causing Phantom Authorization Windows in Distributed Caches","stars_count":50,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","zanzibar","distributed-systems","cache-consistency","lamport-timestamps","concurrency"],"exportEndpoints":{"claude":"/api/rules/openfga-lamport-clock-tuple-mutation-ordering-standard?format=claude","cursorMdc":"/api/rules/openfga-lamport-clock-tuple-mutation-ordering-standard?format=mdc","cursorrules":"/api/rules/openfga-lamport-clock-tuple-mutation-ordering-standard?format=cursor","windsurf":"/api/rules/openfga-lamport-clock-tuple-mutation-ordering-standard?format=windsurf","agents":"/api/rules/openfga-lamport-clock-tuple-mutation-ordering-standard?format=agents"}},{"id":"cilium-ebpf-pmtu-blackhole-prevention","title":"Cilium eBPF Host Routing Path-MTU Blackhole Discovery Invariant","category":"devops","severity":"critical","description":"Enforces deterministic ICMP Fragmentation-Needed and ICMPv6 Packet-Too-Big generation across eBPF host routing paths. Prevents silent TCP drops by eliminating XDP-to-skb transition MTU mismatch blackholes through mandatory TCP MSS clamping and automated Path-MTU discovery configuration.","antiPatternHeadline":"Silent Overlay Packet Loss via eBPF Host-Routing BPF_DROP Without ICMP Generation","stars_count":115,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","cilium","ebpf","networking","kubernetes","pmtu","bgp","vxlan"],"exportEndpoints":{"claude":"/api/rules/cilium-ebpf-pmtu-blackhole-prevention?format=claude","cursorMdc":"/api/rules/cilium-ebpf-pmtu-blackhole-prevention?format=mdc","cursorrules":"/api/rules/cilium-ebpf-pmtu-blackhole-prevention?format=cursor","windsurf":"/api/rules/cilium-ebpf-pmtu-blackhole-prevention?format=windsurf","agents":"/api/rules/cilium-ebpf-pmtu-blackhole-prevention?format=agents"}},{"id":"tauri-v2-capability-scoped-zero-copy-ipc","title":"Tauri 2.0 IPC Capability-Scoped Zero-Copy ArrayBuffer Isolation","category":"frontend","severity":"critical","description":"Enforces fine-grained Tauri 2.0 ACL capability scoping and raw binary TypedArray/ArrayBuffer transfers across the Webview-to-Core boundary. Prohibits base64 or JSON-serialized byte arrays to eliminate GC pressure, heap fragmentation, and unauthorized IPC capability escalation.","antiPatternHeadline":"Passing Large Binary Blobs via Base64/JSON Serialization Over Unscoped Tauri IPC Commands","stars_count":118,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","tauri","security","ipc","performance","rust"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-capability-scoped-zero-copy-ipc?format=claude","cursorMdc":"/api/rules/tauri-v2-capability-scoped-zero-copy-ipc?format=mdc","cursorrules":"/api/rules/tauri-v2-capability-scoped-zero-copy-ipc?format=cursor","windsurf":"/api/rules/tauri-v2-capability-scoped-zero-copy-ipc?format=windsurf","agents":"/api/rules/tauri-v2-capability-scoped-zero-copy-ipc?format=agents"}},{"id":"tanstack-start-streaming-hydration-chunk-cancellation-barrier","title":"TanStack Start Streaming Hydration Chunk Cancellation Barrier","category":"frontend","severity":"critical","description":"Mandates strict AbortSignal binding between HTTP transport streams, TanStack Start server functions, and client-side deferred hydration loaders. Prevents orphaned server-side computations, dangling database queries, and uncollected client hydration chunks when a user navigates away or disconnects mid-stream.","antiPatternHeadline":"Orphaned Deferred Loaders and Unbounded Server Execution After Stream Disconnection","stars_count":104,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","tanstack-start","streaming","hydration","abort-controller","memory-leaks","concurrency"],"exportEndpoints":{"claude":"/api/rules/tanstack-start-streaming-hydration-chunk-cancellation-barrier?format=claude","cursorMdc":"/api/rules/tanstack-start-streaming-hydration-chunk-cancellation-barrier?format=mdc","cursorrules":"/api/rules/tanstack-start-streaming-hydration-chunk-cancellation-barrier?format=cursor","windsurf":"/api/rules/tanstack-start-streaming-hydration-chunk-cancellation-barrier?format=windsurf","agents":"/api/rules/tanstack-start-streaming-hydration-chunk-cancellation-barrier?format=agents"}},{"id":"axum-tower-bidirectional-stream-drain-boundary","title":"Axum 0.8 & Tower In-Flight Bidirectional Stream Drain Boundary","category":"backend","severity":"critical","description":"Enforces deterministic graceful shutdown and connection drain fences for upgraded bidirectional connections (WebSockets, SSE, and gRPC) in Axum 0.8 and Tower services. Prevents abrupt Kubernetes SIGKILL resets by mandating protocol-level drain signaling, TaskTracker tracking, and bounded drain timeouts prior to pod eviction.","antiPatternHeadline":"Leaking In-Flight Upgraded Connections Past SIGTERM Leading to Abrupt SIGKILL Termination","stars_count":80,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tower","kubernetes","websockets","graceful-shutdown"],"exportEndpoints":{"claude":"/api/rules/axum-tower-bidirectional-stream-drain-boundary?format=claude","cursorMdc":"/api/rules/axum-tower-bidirectional-stream-drain-boundary?format=mdc","cursorrules":"/api/rules/axum-tower-bidirectional-stream-drain-boundary?format=cursor","windsurf":"/api/rules/axum-tower-bidirectional-stream-drain-boundary?format=windsurf","agents":"/api/rules/axum-tower-bidirectional-stream-drain-boundary?format=agents"}},{"id":"fastapi-sse-stream-backpressure-resource-guardrail","title":"FastAPI SSE Backpressure and Premature Disconnect Resource Deallocation Guardrail","category":"backend","severity":"critical","description":"Enforces deterministic teardown of upstream database sessions, pub/sub consumer groups, and network sockets during Server-Sent Events (SSE) streaming in FastAPI. Guarantees that client disconnects, socket cancellations, and downstream backpressure collapses propagate immediate generator termination and resource pool release.","antiPatternHeadline":"Orphaned Coroutines and Leaked Database/Queue Connections on Abrupt SSE Client Disconnect","stars_count":80,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","sse","asyncio","concurrency","resource-management"],"exportEndpoints":{"claude":"/api/rules/fastapi-sse-stream-backpressure-resource-guardrail?format=claude","cursorMdc":"/api/rules/fastapi-sse-stream-backpressure-resource-guardrail?format=mdc","cursorrules":"/api/rules/fastapi-sse-stream-backpressure-resource-guardrail?format=cursor","windsurf":"/api/rules/fastapi-sse-stream-backpressure-resource-guardrail?format=windsurf","agents":"/api/rules/fastapi-sse-stream-backpressure-resource-guardrail?format=agents"}},{"id":"postgres-17-json-table-work-mem-allocation-standard","title":"Postgres 17 JSON_TABLE Memory Bounds and WorkMem Guardrail","category":"backend","severity":"critical","description":"Enforces strict transaction-local memory ceilings (`work_mem`), streaming projection semantics, and chunked cursor evaluation when extracting relational rows from massive JSON payloads using Postgres 17's SQL/JSON `JSON_TABLE`. Prevents query backend termination and cluster-wide Linux Out-Of-Memory (OOM) killer cascades caused by unconstrained in-memory JSON path tree evaluation during concurrent high-throughput unnesting.","antiPatternHeadline":"Unbounded JSON_TABLE evaluation over large payloads without transaction-local memory fencing and streaming limits","stars_count":80,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres-17","sql-json","json-table","work-mem","memory-leak","database"],"exportEndpoints":{"claude":"/api/rules/postgres-17-json-table-work-mem-allocation-standard?format=claude","cursorMdc":"/api/rules/postgres-17-json-table-work-mem-allocation-standard?format=mdc","cursorrules":"/api/rules/postgres-17-json-table-work-mem-allocation-standard?format=cursor","windsurf":"/api/rules/postgres-17-json-table-work-mem-allocation-standard?format=windsurf","agents":"/api/rules/postgres-17-json-table-work-mem-allocation-standard?format=agents"}},{"id":"kmp-metal-render-loop-frame-fence-guardrail","title":"KMP Compose Metal Render-Loop Frame Synchronization Fence","category":"mobile","severity":"critical","description":"Decouples Kotlin StateFlow emissions from Apple ProMotion CADisplayLink and Metal render loops in Compose Multiplatform iOS targets. Prevents main-thread UI hitching and frame drops by establishing a lock-free atomic snapshot fence between high-frequency Coroutine state updates and CAMetalDrawable presentation cycles.","antiPatternHeadline":"Synchronous Main-Thread StateFlow Collection Blocking CAMetalLayer Render Passes During ProMotion 120Hz VSync","stars_count":90,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kmp","compose-multiplatform","metal","ios","concurrency","frame-pacing"],"exportEndpoints":{"claude":"/api/rules/kmp-metal-render-loop-frame-fence-guardrail?format=claude","cursorMdc":"/api/rules/kmp-metal-render-loop-frame-fence-guardrail?format=mdc","cursorrules":"/api/rules/kmp-metal-render-loop-frame-fence-guardrail?format=cursor","windsurf":"/api/rules/kmp-metal-render-loop-frame-fence-guardrail?format=windsurf","agents":"/api/rules/kmp-metal-render-loop-frame-fence-guardrail?format=agents"}},{"id":"openfga-contextual-tuple-cycle-depth-mitigation","title":"OpenFGA Contextual Tuple Graph Recursion Depth & Cycle Mitigation Guardrail","category":"security","severity":"critical","description":"Enforces pre-evaluation cycle detection, bounded contextual tuple graph depth, and deterministic execution timeouts for OpenFGA authorization checks. Prevents fine-grained authorization clusters from thread starvation and distributed denial-of-service caused by circular references or deeply nested dynamic relation expansions.","antiPatternHeadline":"Unvalidated Contextual Tuples Triggering Circular Graph Traversal and Authorization Cluster Starvation","stars_count":102,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","rebac","authorization","dos-mitigation","graph-recursion"],"exportEndpoints":{"claude":"/api/rules/openfga-contextual-tuple-cycle-depth-mitigation?format=claude","cursorMdc":"/api/rules/openfga-contextual-tuple-cycle-depth-mitigation?format=mdc","cursorrules":"/api/rules/openfga-contextual-tuple-cycle-depth-mitigation?format=cursor","windsurf":"/api/rules/openfga-contextual-tuple-cycle-depth-mitigation?format=windsurf","agents":"/api/rules/openfga-contextual-tuple-cycle-depth-mitigation?format=agents"}},{"id":"webauthn-prf-deterministic-salt-derivation","title":"WebAuthn PRF Deterministic Client-Side Salt Derivation and Key Wrapping Standard","category":"security","severity":"critical","description":"Enforces cryptographic invariants when leveraging WebAuthn PRF (Pseudo-Random Function) extension for zero-knowledge client-side encryption key derivation directly from authenticators. Prevents relying party leakage, unkeyed salt reuse, insecure PRF output consumption, and lack of domain separation in HKDF expansions.","antiPatternHeadline":"Exposing Raw PRF Outputs to Servers, Using Static Global Salts Without Domain Separation, or Bypassing HKDF Expansion","stars_count":75,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","prf-extension","cryptography","zero-knowledge","hkdf"],"exportEndpoints":{"claude":"/api/rules/webauthn-prf-deterministic-salt-derivation?format=claude","cursorMdc":"/api/rules/webauthn-prf-deterministic-salt-derivation?format=mdc","cursorrules":"/api/rules/webauthn-prf-deterministic-salt-derivation?format=cursor","windsurf":"/api/rules/webauthn-prf-deterministic-salt-derivation?format=windsurf","agents":"/api/rules/webauthn-prf-deterministic-salt-derivation?format=agents"}},{"id":"tetragon-execve-lineage-namespace-isolation-standard","title":"Tetragon In-Kernel Execve Lineage & Namespace Escape Prevention","category":"security","severity":"critical","description":"Enforces deterministic, in-kernel synchronous termination (SIGKILL) of unauthorized process lineages and container namespace breakouts via Cilium Tetragon TracingPolicies. Prevents post-compromise lateral movement and container escape payloads by intercepting syscalls at kernel entry prior to binary execution rather than relying on reactive user-space audit logging.","antiPatternHeadline":"Relying on Asynchronous Audit Logging or sys_exit Probes that Allow Malicious Binaries to Execute Before User-Space Intervention","stars_count":112,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","ebpf","tetragon","kubernetes","runtime-security","zero-trust"],"exportEndpoints":{"claude":"/api/rules/tetragon-execve-lineage-namespace-isolation-standard?format=claude","cursorMdc":"/api/rules/tetragon-execve-lineage-namespace-isolation-standard?format=mdc","cursorrules":"/api/rules/tetragon-execve-lineage-namespace-isolation-standard?format=cursor","windsurf":"/api/rules/tetragon-execve-lineage-namespace-isolation-standard?format=windsurf","agents":"/api/rules/tetragon-execve-lineage-namespace-isolation-standard?format=agents"}},{"id":"oci-zstd-chunked-microvm-hydration-provenance","title":"OCI v1.1 Zstd:chunked MicroVM Hydration and Block-Level Provenance Verification","category":"devops","severity":"critical","description":"Enforces sub-second microVM cold-starts by requiring lazy streaming of OCI v1.1 zstd:chunked layers while cryptographically validating individual chunk digests and Cosign/in-toto provenance before paging into guest memory. Prevents unauthenticated remote chunk injection, TOCTOU layer corruption, and hypervisor-level denial of service.","antiPatternHeadline":"Unauthenticated On-Demand Chunk Streaming and Monolithic Layer Pre-Hydration","stars_count":55,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","oci-spec","microvm","firecracker","zstd-chunked","supply-chain-security","sigstore"],"exportEndpoints":{"claude":"/api/rules/oci-zstd-chunked-microvm-hydration-provenance?format=claude","cursorMdc":"/api/rules/oci-zstd-chunked-microvm-hydration-provenance?format=mdc","cursorrules":"/api/rules/oci-zstd-chunked-microvm-hydration-provenance?format=cursor","windsurf":"/api/rules/oci-zstd-chunked-microvm-hydration-provenance?format=windsurf","agents":"/api/rules/oci-zstd-chunked-microvm-hydration-provenance?format=agents"}},{"id":"axum-tower-service-lease-cancellation-guardrail","title":"Axum 0.8 Tower Service Lease Borrowing & Graceful Cancellation Guardrail","category":"backend","severity":"critical","description":"Enforces strict boundaries between Tower Service readiness checks (poll_ready), cloned service leases, and Tokio task cancellations in Axum 0.8 backends. Prevents silent lease dropping, deadlocks, and corrupted database transactions during SIGTERM pod drains by decoupling cooperative cancellation from in-flight transactional futures using CancellationToken and tokio::task::spawn.","antiPatternHeadline":"Dropping un-polled Tower service reservations or interleaving tokio::select! across non-cancellation-safe transactional Service::call pipelines.","stars_count":76,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tower","tokio","concurrency","distributed-systems"],"exportEndpoints":{"claude":"/api/rules/axum-tower-service-lease-cancellation-guardrail?format=claude","cursorMdc":"/api/rules/axum-tower-service-lease-cancellation-guardrail?format=mdc","cursorrules":"/api/rules/axum-tower-service-lease-cancellation-guardrail?format=cursor","windsurf":"/api/rules/axum-tower-service-lease-cancellation-guardrail?format=windsurf","agents":"/api/rules/axum-tower-service-lease-cancellation-guardrail?format=agents"}},{"id":"react-19-metadata-preload-cascade-suppression-standard","title":"React 19 Document Metadata Preload Cascade Suppression Standard","category":"frontend","severity":"critical","description":"Enforces strict priority scheduling and deterministic consolidation for React 19 native document metadata hoisting (<title>, <meta>, <link rel='stylesheet'>, and ReactDOM preload APIs). Prevents unstructured concurrent metadata injection that triggers browser resource discovery race conditions, FOUC, and Cumulative Layout Shift (CLS) storms.","antiPatternHeadline":"Unbounded Component-Level Dynamic Preloading and Late-Discovered Hoisted Stylesheets","stars_count":57,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","performance","core-web-vitals","cls-prevention","preload-cascade"],"exportEndpoints":{"claude":"/api/rules/react-19-metadata-preload-cascade-suppression-standard?format=claude","cursorMdc":"/api/rules/react-19-metadata-preload-cascade-suppression-standard?format=mdc","cursorrules":"/api/rules/react-19-metadata-preload-cascade-suppression-standard?format=cursor","windsurf":"/api/rules/react-19-metadata-preload-cascade-suppression-standard?format=windsurf","agents":"/api/rules/react-19-metadata-preload-cascade-suppression-standard?format=agents"}},{"id":"bun-so-reuseport-worker-affinity-standard","title":"Bun 1.2 Isolated Multi-Worker SO_REUSEPORT Socket Invariant","category":"backend","severity":"critical","description":"Enforces isolated, multi-threaded server architecture in Bun 1.2+ utilizing native kernel SO_REUSEPORT socket load balancing across independent Worker threads. Eliminates event-loop starvation and cross-thread lock contention during TLS termination by guaranteeing zero shared state, per-worker socket instantiation, and CPU-pinned affinity.","antiPatternHeadline":"Centralized Master-Accept Socket Proxying with Cross-Worker IPC Handoff","stars_count":97,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","so_reuseport","multithreading","tls","high-throughput","concurrency"],"exportEndpoints":{"claude":"/api/rules/bun-so-reuseport-worker-affinity-standard?format=claude","cursorMdc":"/api/rules/bun-so-reuseport-worker-affinity-standard?format=mdc","cursorrules":"/api/rules/bun-so-reuseport-worker-affinity-standard?format=cursor","windsurf":"/api/rules/bun-so-reuseport-worker-affinity-standard?format=windsurf","agents":"/api/rules/bun-so-reuseport-worker-affinity-standard?format=agents"}},{"id":"webauthn-hardware-bound-step-up-standard","title":"Hardware-Bound WebAuthn Step-Up Invariant for Privileged Operations","category":"security","severity":"critical","description":"Enforces dual-attested, non-exportable hardware-bound assertion claims during step-up authentication for high-privilege operations. Mitigates cloud keychain credential-cloning vectors by strictly verifying AuthenticatorData flags (UV=1, UP=1, BE=0, BS=0) or enterprise-attested device public keys (Device PubKey extension).","antiPatternHeadline":"Accepting Synced Multi-Device Credentials for Privileged In-Session Transactions Without Hardware-Bound Attestation","stars_count":94,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","fido2","passkeys","authentication","zero-trust"],"exportEndpoints":{"claude":"/api/rules/webauthn-hardware-bound-step-up-standard?format=claude","cursorMdc":"/api/rules/webauthn-hardware-bound-step-up-standard?format=mdc","cursorrules":"/api/rules/webauthn-hardware-bound-step-up-standard?format=cursor","windsurf":"/api/rules/webauthn-hardware-bound-step-up-standard?format=windsurf","agents":"/api/rules/webauthn-hardware-bound-step-up-standard?format=agents"}},{"id":"otlp-arrow-streaming-microbatching-production-standard","title":"OpenTelemetry OTLP/Arrow Streaming Ingestion Micro-Batching Standard","category":"devops","severity":"critical","description":"Enforces deterministic memory allocation, dictionary lifecycle recycling, and backpressure-governed micro-batching for high-cardinality OTLP/Arrow streaming pipelines. Prevents catastrophic JVM/V8/Go heap fragmentation, unconstrained dictionary vector growth, and silent telemetry dropouts caused by asynchronous buffer starvation under burst loads.","antiPatternHeadline":"Unbounded In-Memory Columnar Batching with Static Arrow Dictionary Vectors and Unchecked Backpressure","stars_count":56,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","apache-arrow","otlp","observability","backpressure","streaming"],"exportEndpoints":{"claude":"/api/rules/otlp-arrow-streaming-microbatching-production-standard?format=claude","cursorMdc":"/api/rules/otlp-arrow-streaming-microbatching-production-standard?format=mdc","cursorrules":"/api/rules/otlp-arrow-streaming-microbatching-production-standard?format=cursor","windsurf":"/api/rules/otlp-arrow-streaming-microbatching-production-standard?format=windsurf","agents":"/api/rules/otlp-arrow-streaming-microbatching-production-standard?format=agents"}},{"id":"kmp-compose-offscreen-surface-invalidation-guardrail","title":"KMP Compose Multiplatform Offscreen Surface Invalidation & Lifecycle Guardrail","category":"mobile","severity":"critical","description":"Enforces lifecycle-bound texture pooling, dirty-state synchronization, and explicit teardown for offscreen rendering surfaces in Compose Multiplatform across iOS (Metal) and Android (Vulkan). Eliminates unthrottled VSync invalidation loops and GPU VRAM exhaustion caused by orphaned hardware buffers, unreleased Skia surfaces, and asynchronous swapchain deadlocks.","antiPatternHeadline":"Unbounded VSync Invalidation Loops and Leaked Metal/Vulkan Native Surfaces in Compose Multiplatform Custom Drawing Pipelines","stars_count":45,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kmp","compose-multiplatform","vulkan","metal","graphics","memory-management"],"exportEndpoints":{"claude":"/api/rules/kmp-compose-offscreen-surface-invalidation-guardrail?format=claude","cursorMdc":"/api/rules/kmp-compose-offscreen-surface-invalidation-guardrail?format=mdc","cursorrules":"/api/rules/kmp-compose-offscreen-surface-invalidation-guardrail?format=cursor","windsurf":"/api/rules/kmp-compose-offscreen-surface-invalidation-guardrail?format=windsurf","agents":"/api/rules/kmp-compose-offscreen-surface-invalidation-guardrail?format=agents"}},{"id":"pgvector-hnsw-streaming-wal-throttle-guardrail","title":"Postgres 17 pgvector HNSW Streaming Index Build and WAL Throttle Guardrail","category":"backend","severity":"critical","description":"Enforces adaptive backpressure and replication-aware throttling during high-throughput vector ingestion into pgvector HNSW indexes on PostgreSQL 17. Prevents WAL volume spikes, full-page write cascades, and replication lag blowouts by mandating staged batching and active replication slot telemetry checks.","antiPatternHeadline":"Unbounded Direct Vector Streaming into HNSW Indexes Causing WAL Buffer Exhaustion and Replica Desynchronization","stars_count":46,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","postgres-17","pgvector","hnsw","wal","replication","database-reliability"],"exportEndpoints":{"claude":"/api/rules/pgvector-hnsw-streaming-wal-throttle-guardrail?format=claude","cursorMdc":"/api/rules/pgvector-hnsw-streaming-wal-throttle-guardrail?format=mdc","cursorrules":"/api/rules/pgvector-hnsw-streaming-wal-throttle-guardrail?format=cursor","windsurf":"/api/rules/pgvector-hnsw-streaming-wal-throttle-guardrail?format=windsurf","agents":"/api/rules/pgvector-hnsw-streaming-wal-throttle-guardrail?format=agents"}},{"id":"openfga-ephemeral-tuple-invalidation-consensus","title":"OpenFGA Ephemeral Tuple Invalidation Consensus Standard","category":"security","severity":"critical","description":"Enforces strict monotonic fencing tokens and distributed barrier consensus across multi-tenant edge authorization nodes evaluating OpenFGA relationships. Prevents stale authorization grants and window-of-vulnerability replay attacks during rapid team membership revocations. Guarantees linearized, zero-staleness access checks without introducing full-cluster synchronization bottlenecks.","antiPatternHeadline":"Local-Cache-First Authorization Without Monotonic Fencing Token Consensus","stars_count":96,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","rebac","distributed-systems","edge-computing","concurrency"],"exportEndpoints":{"claude":"/api/rules/openfga-ephemeral-tuple-invalidation-consensus?format=claude","cursorMdc":"/api/rules/openfga-ephemeral-tuple-invalidation-consensus?format=mdc","cursorrules":"/api/rules/openfga-ephemeral-tuple-invalidation-consensus?format=cursor","windsurf":"/api/rules/openfga-ephemeral-tuple-invalidation-consensus?format=windsurf","agents":"/api/rules/openfga-ephemeral-tuple-invalidation-consensus?format=agents"}},{"id":"tauri2-multiwindow-shmem-frame-sync-standard","title":"Tauri 2.0 Multi-Window Shared Memory Frame Synchronization Standard","category":"frontend","severity":"critical","description":"Mandates atomic fence synchronization and triple-buffered shared memory structures for cross-window canvas streaming across decoupled Tauri 2.0 WebViews. Eliminates buffer tearing, out-of-order frame presentation, and garbage collection thrashing inherent in serializing frame buffers over the native IPC event bus.","antiPatternHeadline":"Unsynchronized Raw Buffer Broadcasts via Tauri Event Bus Causing Frame Tearing and Serialization Bottlenecks","stars_count":103,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","tauri-2","shared-memory","webgl","canvas","ipc","performance"],"exportEndpoints":{"claude":"/api/rules/tauri2-multiwindow-shmem-frame-sync-standard?format=claude","cursorMdc":"/api/rules/tauri2-multiwindow-shmem-frame-sync-standard?format=mdc","cursorrules":"/api/rules/tauri2-multiwindow-shmem-frame-sync-standard?format=cursor","windsurf":"/api/rules/tauri2-multiwindow-shmem-frame-sync-standard?format=windsurf","agents":"/api/rules/tauri2-multiwindow-shmem-frame-sync-standard?format=agents"}},{"id":"webtransport-h3-bbrv3-datagram-clamp-standard","title":"HTTP/3 WebTransport Datagram BBRv3 Congestion Window Clamping Standard","category":"devops","severity":"critical","description":"Enforces strict upper bounds on QUIC congestion windows (cwnd) and datagram egress queues under BBRv3 congestion control during WebTransport bidirectional media and RPC sessions. Prevents edge-proxy bufferbloat, queuing delay escalation, and tail-drop packet loss over volatile cellular and congested edge networks by actively capping inflight datagram bytes to bounded bandwidth-delay products (BDP).","antiPatternHeadline":"Unconstrained Datagram Buffering and Floating BBRv3 cwnd Causing Edge Bufferbloat and Latency Spikes","stars_count":50,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","http3","webtransport","bbrv3","quic","congestion-control","networking"],"exportEndpoints":{"claude":"/api/rules/webtransport-h3-bbrv3-datagram-clamp-standard?format=claude","cursorMdc":"/api/rules/webtransport-h3-bbrv3-datagram-clamp-standard?format=mdc","cursorrules":"/api/rules/webtransport-h3-bbrv3-datagram-clamp-standard?format=cursor","windsurf":"/api/rules/webtransport-h3-bbrv3-datagram-clamp-standard?format=windsurf","agents":"/api/rules/webtransport-h3-bbrv3-datagram-clamp-standard?format=agents"}},{"id":"axum-08-hyper-v1-http3-graceful-drain-standard","title":"Axum 0.8 / Hyper v1 HTTP/3 Zero-Downtime Multiplex Drain Standard","category":"backend","severity":"critical","description":"Enforces deterministic two-phase GOAWAY frame emission and QUIC connection draining during cluster reloads in Axum 0.8 and Hyper v1. Prevents client-visible RST_STREAM errors, abrupt QUIC CONNECTION_CLOSE packet drops, and truncated bi-directional streams during SIGTERM rolling deployments.","antiPatternHeadline":"Abrupt QUIC Endpoint Termination and Dropped HTTP/3 Multiplexed Streams on SIGTERM","stars_count":109,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","hyper","http3","quic","graceful-shutdown"],"exportEndpoints":{"claude":"/api/rules/axum-08-hyper-v1-http3-graceful-drain-standard?format=claude","cursorMdc":"/api/rules/axum-08-hyper-v1-http3-graceful-drain-standard?format=mdc","cursorrules":"/api/rules/axum-08-hyper-v1-http3-graceful-drain-standard?format=cursor","windsurf":"/api/rules/axum-08-hyper-v1-http3-graceful-drain-standard?format=windsurf","agents":"/api/rules/axum-08-hyper-v1-http3-graceful-drain-standard?format=agents"}},{"id":"vite-rolldown-federation-chunk-eviction-fence","title":"Vite 6 Rolldown Module Federation Chunk Eviction & Memory Boundary Fence","category":"frontend","severity":"critical","description":"Enforces deterministic lifecycle reclamation, global symbol purge, and style tag teardown when dynamic federated remotes are unmounted in Vite 6 and Rolldown architectures. Prevents cross-remote prototype pollution, shared scope symbol collisions, and retain cycles within the host runtime.","antiPatternHeadline":"Dangling Remote Containers, Leaked Scope Registries, and Uncollected Federated DOM Artifacts","stars_count":100,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["vite6","rolldown","module-federation","micro-frontends","memory-leak","chunk-eviction"],"exportEndpoints":{"claude":"/api/rules/vite-rolldown-federation-chunk-eviction-fence?format=claude","cursorMdc":"/api/rules/vite-rolldown-federation-chunk-eviction-fence?format=mdc","cursorrules":"/api/rules/vite-rolldown-federation-chunk-eviction-fence?format=cursor","windsurf":"/api/rules/vite-rolldown-federation-chunk-eviction-fence?format=windsurf","agents":"/api/rules/vite-rolldown-federation-chunk-eviction-fence?format=agents"}},{"id":"bun-ffi-pinned-buffer-memory-fence","title":"Bun 1.2 Native FFI Pinned Buffer Memory Ownership Fence","category":"backend","severity":"critical","description":"Enforces deterministic memory ownership and explicit buffer pinning across Bun 1.2 JavaScriptCore (JSC) and native C/Rust FFI boundaries. Prevents catastrophic use-after-free vulnerabilities, memory corruption, and runtime SIGSEGV crashes caused by JSC garbage collection and heap compaction sweeps reclaiming shared memory while native threads operate on raw pointers.","antiPatternHeadline":"Passing Ephemeral TypedArrays Directly to Native FFI Without Explicit Lifetime Anchoring or Manual Allocator Fencing","stars_count":51,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","ffi","memory-safety","rust","low-level"],"exportEndpoints":{"claude":"/api/rules/bun-ffi-pinned-buffer-memory-fence?format=claude","cursorMdc":"/api/rules/bun-ffi-pinned-buffer-memory-fence?format=mdc","cursorrules":"/api/rules/bun-ffi-pinned-buffer-memory-fence?format=cursor","windsurf":"/api/rules/bun-ffi-pinned-buffer-memory-fence?format=windsurf","agents":"/api/rules/bun-ffi-pinned-buffer-memory-fence?format=agents"}},{"id":"fastapi-pydantic-core-zero-copy-streaming","title":"FastAPI Pydantic-Core Zero-Copy Streaming Validation Invariant","category":"backend","severity":"critical","description":"Enforces strict chunked streaming of massive multipart/file payloads through memory-mapped buffers and native rust-backed validation boundaries. Eliminates catastrophic Out-Of-Memory (OOM) heap allocations by preventing Python runtime string/bytes materialization and forcing backpressured chunk ingestion directly into pydantic-core or downstream sinks.","antiPatternHeadline":"Buffer Bloat via In-Memory Request Body Buffering and Intermediate Python String Conversions","stars_count":81,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","pydantic","zero-copy","streaming","memory-safety","python"],"exportEndpoints":{"claude":"/api/rules/fastapi-pydantic-core-zero-copy-streaming?format=claude","cursorMdc":"/api/rules/fastapi-pydantic-core-zero-copy-streaming?format=mdc","cursorrules":"/api/rules/fastapi-pydantic-core-zero-copy-streaming?format=cursor","windsurf":"/api/rules/fastapi-pydantic-core-zero-copy-streaming?format=windsurf","agents":"/api/rules/fastapi-pydantic-core-zero-copy-streaming?format=agents"}},{"id":"postgres-17-json-table-simd-memory-fence","title":"Postgres 17 JSON_TABLE SIMD Vectorized Execution Memory Fence","category":"backend","severity":"critical","description":"Enforces strict per-transaction working memory fences and keyset-bounded chunking when executing Postgres 17 JSON_TABLE queries over nested JSONB payloads. High-throughput vectorized SIMD parsing rapidly inflates per-backend heap allocations across nested execution paths, triggering kernel cgroup OOM container evictions if execution memory boundaries are omitted.","antiPatternHeadline":"Unbounded SIMD JSON_TABLE Extraction Triggering Container OOM-Kills","stars_count":111,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","postgres-17","json-table","simd","memory-management","performance"],"exportEndpoints":{"claude":"/api/rules/postgres-17-json-table-simd-memory-fence?format=claude","cursorMdc":"/api/rules/postgres-17-json-table-simd-memory-fence?format=mdc","cursorrules":"/api/rules/postgres-17-json-table-simd-memory-fence?format=cursor","windsurf":"/api/rules/postgres-17-json-table-simd-memory-fence?format=windsurf","agents":"/api/rules/postgres-17-json-table-simd-memory-fence?format=agents"}},{"id":"capacitor-7-wasm-memory-sandboxing-standard","title":"Capacitor 7 Isolated WASM Engine Memory Sandboxing Standard","category":"mobile","severity":"critical","description":"Enforces strict process and memory sandboxing for on-device edge AI WebAssembly runtimes inside Capacitor 7 hybrid applications. Prevents cross-origin context contamination and speculative execution memory extraction by isolating model weights, KV caches, and inference buffers inside ephemeral Web Workers with zero-copy buffer detachment and explicit Cross-Origin-Opener-Policy/Cross-Origin-Embedder-Policy controls.","antiPatternHeadline":"Instantiating Edge AI WASM Memory on the Global Window Thread Without Origin Isolation and Worker Boundaries","stars_count":80,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor-7","webassembly","edge-ai","memory-safety","security"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-wasm-memory-sandboxing-standard?format=claude","cursorMdc":"/api/rules/capacitor-7-wasm-memory-sandboxing-standard?format=mdc","cursorrules":"/api/rules/capacitor-7-wasm-memory-sandboxing-standard?format=cursor","windsurf":"/api/rules/capacitor-7-wasm-memory-sandboxing-standard?format=windsurf","agents":"/api/rules/capacitor-7-wasm-memory-sandboxing-standard?format=agents"}},{"id":"tauri-v2-shm-ring-buffer-invariant","title":"Tauri 2.0 Inter-Webview SharedArrayBuffer Ring Buffer Protocol","category":"mobile","severity":"critical","description":"Enforces a zero-copy lock-free ring buffer backed by SharedArrayBuffer and Atomics across Tauri 2.0 multi-webview instances. Bypasses IPC JSON-serialization latency to guarantee deterministic 120 FPS binary telemetry rendering on resource-constrained mobile and desktop platforms. Eliminates event-loop starvation and GC pressure by prohibiting JSON marshalling for high-frequency binary streams.","antiPatternHeadline":"Marshalling 120 FPS Binary Telemetry via Stringified IPC Events Across Webviews","stars_count":105,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri","shared-memory","atomics","zero-copy","ring-buffer"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-shm-ring-buffer-invariant?format=claude","cursorMdc":"/api/rules/tauri-v2-shm-ring-buffer-invariant?format=mdc","cursorrules":"/api/rules/tauri-v2-shm-ring-buffer-invariant?format=cursor","windsurf":"/api/rules/tauri-v2-shm-ring-buffer-invariant?format=windsurf","agents":"/api/rules/tauri-v2-shm-ring-buffer-invariant?format=agents"}},{"id":"webauthn-ctap22-ephemeral-ecdh-binding-guardrail","title":"WebAuthn CTAP 2.2 Cross-Device Ephemeral ECDH Proximity Binding Guardrail","category":"security","severity":"critical","description":"Enforces strict validation and cryptographic tying of WebAuthn hybrid cross-device transport (caBLE/FIDO CTAP 2.2) authentication assertions to ephemeral ECDH-derived session channels. Precludes QR-phishing, adversarial session interception, and cross-device session bleeding by mandating constant-time verification of the clientDataJSON hash, ephemeral authenticator public key derivation, and Bluetooth Low Energy (BLE) proximity routing commitments before issuing server-side user sessions.","antiPatternHeadline":"Accepting Cross-Device Hybrid WebAuthn Assertions Without Enforcing Ephemeral ECDH Channel Tying and BLE Proximity Commitments","stars_count":45,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","ctap22","cryptography","fido2","passkeys","ecdh"],"exportEndpoints":{"claude":"/api/rules/webauthn-ctap22-ephemeral-ecdh-binding-guardrail?format=claude","cursorMdc":"/api/rules/webauthn-ctap22-ephemeral-ecdh-binding-guardrail?format=mdc","cursorrules":"/api/rules/webauthn-ctap22-ephemeral-ecdh-binding-guardrail?format=cursor","windsurf":"/api/rules/webauthn-ctap22-ephemeral-ecdh-binding-guardrail?format=windsurf","agents":"/api/rules/webauthn-ctap22-ephemeral-ecdh-binding-guardrail?format=agents"}},{"id":"ebpf-uretprobe-goroutine-stack-unwinding-guardrail","title":"eBPF uretprobe Goroutine Stack Unwinding Trampoline Guardrail","category":"devops","severity":"critical","description":"Attaching standard kernel uretprobes to Go binaries corrupts runtime execution because the kernel trampoline overrides return addresses on non-standard, dynamically resized Go runtime stacks. In high-concurrency environments, this triggers fatal runtime panics such as 'runtime: g 1: frame SP out of range' or silent memory corruption during goroutine stack unwinding and growth. Telemetry agents must reject raw uretprobes on Go symbols and instead deploy dual-entry uprobes or uprobes paired with manual DWARF-based return-offset interception.","antiPatternHeadline":"Attaching raw eBPF uretprobes to Go binaries causing corrupted goroutine stack pointers and fatal runtime panics","stars_count":92,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","golang","uretprobe","observability","linux-kernel"],"exportEndpoints":{"claude":"/api/rules/ebpf-uretprobe-goroutine-stack-unwinding-guardrail?format=claude","cursorMdc":"/api/rules/ebpf-uretprobe-goroutine-stack-unwinding-guardrail?format=mdc","cursorrules":"/api/rules/ebpf-uretprobe-goroutine-stack-unwinding-guardrail?format=cursor","windsurf":"/api/rules/ebpf-uretprobe-goroutine-stack-unwinding-guardrail?format=windsurf","agents":"/api/rules/ebpf-uretprobe-goroutine-stack-unwinding-guardrail?format=agents"}},{"id":"fastapi-pydantic-v2-strict-zero-copy-serialization","title":"Strict-Mode Parsing and Zero-Copy Serialization in FastAPI with Pydantic V2","category":"backend","severity":"critical","description":"Enforces strict type validation and zero-copy streaming serialization across FastAPI services using Pydantic V2 core architecture. Prevents silent data mutation, precision degradation, and type spoofing caused by lax coercion while bypassing Python Global Interpreter Lock (GIL) bottlenecks on multi-gigabyte or high-throughput JSON payloads via native Rust serializers and orjson streaming responses.","antiPatternHeadline":"Lax Type Coercion Exploits and GIL-Bound O(N) In-Memory Re-Serialization Bottlenecks","stars_count":101,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","pydantic-v2","performance","serialization","strict-mode"],"exportEndpoints":{"claude":"/api/rules/fastapi-pydantic-v2-strict-zero-copy-serialization?format=claude","cursorMdc":"/api/rules/fastapi-pydantic-v2-strict-zero-copy-serialization?format=mdc","cursorrules":"/api/rules/fastapi-pydantic-v2-strict-zero-copy-serialization?format=cursor","windsurf":"/api/rules/fastapi-pydantic-v2-strict-zero-copy-serialization?format=windsurf","agents":"/api/rules/fastapi-pydantic-v2-strict-zero-copy-serialization?format=agents"}},{"id":"tokio-async-drop-cancellation-safety-protocol","title":"Tokio Async Drop Cancellation Safety Protocol for Distributed Transactions","category":"backend","severity":"critical","description":"Enforces strict cancellation safety invariants across async boundaries in Tokio-driven distributed transaction handlers. Prevents orphaned two-phase commit states, leaked database connection locks, and partial write corruption when futures are dropped mid-execution by timeouts or task abortion.","antiPatternHeadline":"Dropping Incomplete Transaction Futures Across Yield Points Without Cleanup Guards or Rollback Daemons","stars_count":74,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","tokio","async","cancellation-safety","distributed-systems"],"exportEndpoints":{"claude":"/api/rules/tokio-async-drop-cancellation-safety-protocol?format=claude","cursorMdc":"/api/rules/tokio-async-drop-cancellation-safety-protocol?format=mdc","cursorrules":"/api/rules/tokio-async-drop-cancellation-safety-protocol?format=cursor","windsurf":"/api/rules/tokio-async-drop-cancellation-safety-protocol?format=windsurf","agents":"/api/rules/tokio-async-drop-cancellation-safety-protocol?format=agents"}},{"id":"go-chi-cgroup-adaptive-concurrency-throttling","title":"Cgroup-Aware Adaptive Concurrency Limiting and CFS Throttling Prevention for Go Chi","category":"backend","severity":"critical","description":"Protects containerized Go HTTP microservices from Linux CFS (Completely Fair Scheduler) quota throttling, runqueue starvation, and catastrophic tail-latency amplification. Enforces dynamic in-flight request shedding via latency-gradient or PID-governed feedback loops measuring moving RTT ratios and cgroup v2 cpu.stat throttling metrics.","antiPatternHeadline":"Unbounded Goroutine Spawning or Static Semaphores Triggering Severe CFS Quota Starvation and Tail Latency Blowups","stars_count":51,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["go","chi","cgroups","concurrency","cfs-throttling","rate-limiting","resilience"],"exportEndpoints":{"claude":"/api/rules/go-chi-cgroup-adaptive-concurrency-throttling?format=claude","cursorMdc":"/api/rules/go-chi-cgroup-adaptive-concurrency-throttling?format=mdc","cursorrules":"/api/rules/go-chi-cgroup-adaptive-concurrency-throttling?format=cursor","windsurf":"/api/rules/go-chi-cgroup-adaptive-concurrency-throttling?format=windsurf","agents":"/api/rules/go-chi-cgroup-adaptive-concurrency-throttling?format=agents"}},{"id":"postgres-17-json-table-streaming-projection-quota","title":"Postgres 17 JSON_TABLE Bounded Work Queue and Streaming Ingestion Quota","category":"backend","severity":"critical","description":"Enforces deterministic batch quotas, strictly bounded work_mem sessions, and optimized streaming projections using PostgreSQL 17 JSON_TABLE semantics. Prevents backend OOM death spirals during high-throughput semi-structured JSONB relational shredding by replacing unconstrained jsonb_to_recordset and in-memory array expansions with bounded column-projected streams.","antiPatternHeadline":"Unbounded jsonb_to_recordset cross-joins and memory allocation spikes during bulk JSON ingestion","stars_count":95,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres","sql","json-table","performance","memory-management"],"exportEndpoints":{"claude":"/api/rules/postgres-17-json-table-streaming-projection-quota?format=claude","cursorMdc":"/api/rules/postgres-17-json-table-streaming-projection-quota?format=mdc","cursorrules":"/api/rules/postgres-17-json-table-streaming-projection-quota?format=cursor","windsurf":"/api/rules/postgres-17-json-table-streaming-projection-quota?format=windsurf","agents":"/api/rules/postgres-17-json-table-streaming-projection-quota?format=agents"}},{"id":"capacitor-7-biometric-keystore-bridge-guardrail","title":"Capacitor 7 Hardware-Backed Secure Enclave Keystore Bridge & Memory Isolation","category":"mobile","severity":"critical","description":"Enforces strict biometric-gated hardware key isolation (iOS Keychain Secure Enclave and Android Hardware Keystore/StrongBox) for session tokens in Capacitor 7 hybrid architectures. Prohibits persistent token serialization within unencrypted webview runtimes (localStorage, IndexedDB, document.cookie) to prevent full credential compromise via Webview XSS or runtime heap scraping.","antiPatternHeadline":"Persisting Raw Bearer Tokens in Unencrypted Web Storage or Bridging Secrets into Long-Lived JavaScript Heap Memory","stars_count":101,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["capacitor","ios","android","keychain","secure-enclave","biometrics","jwt"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-biometric-keystore-bridge-guardrail?format=claude","cursorMdc":"/api/rules/capacitor-7-biometric-keystore-bridge-guardrail?format=mdc","cursorrules":"/api/rules/capacitor-7-biometric-keystore-bridge-guardrail?format=cursor","windsurf":"/api/rules/capacitor-7-biometric-keystore-bridge-guardrail?format=windsurf","agents":"/api/rules/capacitor-7-biometric-keystore-bridge-guardrail?format=agents"}},{"id":"fips-204-ml-dsa-pqc-service-jwt-standard","title":"NIST FIPS 204 ML-DSA Post-Quantum Service-to-Service JWT Standard","category":"security","severity":"critical","description":"Mandates post-quantum digital signature standards (NIST FIPS 204 ML-DSA) for all internal service-to-service JSON Web Tokens across distributed mesh fabrics. Eliminates vulnerability to harvest-now-decrypt-later adversaries by enforcing lattice-based signatures (ML-DSA-65/ML-DSA-87) over classical RSA or ECC primitives. Enforces strict token header verification, signature length assertions, and prevents algorithmic downgrade attacks.","antiPatternHeadline":"Signing or Validating Distributed Machine-to-Machine JWTs with Quantum-Vulnerable Classical Primitives (RS256, ES256)","stars_count":77,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","post-quantum","fips-204","ml-dsa","jwt","service-mesh","zero-trust"],"exportEndpoints":{"claude":"/api/rules/fips-204-ml-dsa-pqc-service-jwt-standard?format=claude","cursorMdc":"/api/rules/fips-204-ml-dsa-pqc-service-jwt-standard?format=mdc","cursorrules":"/api/rules/fips-204-ml-dsa-pqc-service-jwt-standard?format=cursor","windsurf":"/api/rules/fips-204-ml-dsa-pqc-service-jwt-standard?format=windsurf","agents":"/api/rules/fips-204-ml-dsa-pqc-service-jwt-standard?format=agents"}},{"id":"k8s-validating-admission-policy-cel-fencing","title":"Kubernetes ValidatingAdmissionPolicy CEL Invariant Fencing","category":"devops","severity":"critical","description":"Enforces deterministic, in-process Common Expression Language (CEL) validation policies within the kube-apiserver, deprecating out-of-process admission webhooks for zero-latency structural fencing. Mandates strict null-safe navigation, cost-budget enforcement, and Pod Security Standards immutability across multi-tenant workloads.","antiPatternHeadline":"Fragile Out-of-Process Admission Webhooks and Unbounded, Null-Unsafe CEL Expressions","stars_count":88,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["kubernetes","cel","validating-admission-policy","security","devops","platform-engineering"],"exportEndpoints":{"claude":"/api/rules/k8s-validating-admission-policy-cel-fencing?format=claude","cursorMdc":"/api/rules/k8s-validating-admission-policy-cel-fencing?format=mdc","cursorrules":"/api/rules/k8s-validating-admission-policy-cel-fencing?format=cursor","windsurf":"/api/rules/k8s-validating-admission-policy-cel-fencing?format=windsurf","agents":"/api/rules/k8s-validating-admission-policy-cel-fencing?format=agents"}},{"id":"ebpf-xdp-syn-flood-ringbuf-mitigation","title":"Driver-Level XDP SYN Flood Mitigation and Lockless Ring Buffer Telemetry","category":"devops","severity":"critical","description":"Mandates dropping malicious volumetric L4 SYN floods at the native NIC driver layer via eBPF XDP before kernel sk_buff and socket allocation occur. Enforces memory-safe packet parsing with strict verifier bounds checks and zero-copy metric streaming via BPF_MAP_TYPE_RINGBUF to eliminate context switches and userspace polling overhead.","antiPatternHeadline":"Processing High-PPS SYN Floods in Socket Layer and Using Blocking or Deprecated BPF Telemetry","stars_count":86,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","xdp","networking","ddos-mitigation","ring-buffer","kernel"],"exportEndpoints":{"claude":"/api/rules/ebpf-xdp-syn-flood-ringbuf-mitigation?format=claude","cursorMdc":"/api/rules/ebpf-xdp-syn-flood-ringbuf-mitigation?format=mdc","cursorrules":"/api/rules/ebpf-xdp-syn-flood-ringbuf-mitigation?format=cursor","windsurf":"/api/rules/ebpf-xdp-syn-flood-ringbuf-mitigation?format=windsurf","agents":"/api/rules/ebpf-xdp-syn-flood-ringbuf-mitigation?format=agents"}},{"id":"react-19-server-actions-optimistic-reentrancy-isolation","title":"React 19 Optimistic State Isolation and Transactional Reentrancy Guardrail","category":"frontend","severity":"critical","description":"Enforces deterministic transaction isolation and causal consistency for concurrent React 19 Server Actions paired with useOptimistic. Prevents UI state tearing, ghost rollbacks, and race-condition overwrites caused by interleaved, out-of-order network resolutions through monotonic sequence stamping and journaled base-state reconciliation.","antiPatternHeadline":"Naive optimistic state patching prone to out-of-order overwrites and phantom rollbacks during concurrent Server Action invocations","stars_count":60,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","server-actions","use-optimistic","concurrency","state-isolation"],"exportEndpoints":{"claude":"/api/rules/react-19-server-actions-optimistic-reentrancy-isolation?format=claude","cursorMdc":"/api/rules/react-19-server-actions-optimistic-reentrancy-isolation?format=mdc","cursorrules":"/api/rules/react-19-server-actions-optimistic-reentrancy-isolation?format=cursor","windsurf":"/api/rules/react-19-server-actions-optimistic-reentrancy-isolation?format=windsurf","agents":"/api/rules/react-19-server-actions-optimistic-reentrancy-isolation?format=agents"}},{"id":"fastapi-py313-free-threaded-memory-boundary-standard","title":"FastAPI Python 3.13 Free-Threaded Memory Boundary & State Encapsulation Standard","category":"backend","severity":"critical","description":"Mandates strict thread-safe memory boundaries and state encapsulation across FastAPI request lifecycles under Python 3.13 free-threaded (PEP 703) runtimes. Enforces total isolation of request contexts, thread-safe synchronization for shared state, and elimination of implicit GIL-dependent mutable patterns in dependency injection.","antiPatternHeadline":"Unsynchronized Module-Level State and Shared Mutable Dependencies Under Python 3.13 Free-Threading","stars_count":46,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","python313","free-threaded","concurrency","thread-safety","pep703"],"exportEndpoints":{"claude":"/api/rules/fastapi-py313-free-threaded-memory-boundary-standard?format=claude","cursorMdc":"/api/rules/fastapi-py313-free-threaded-memory-boundary-standard?format=mdc","cursorrules":"/api/rules/fastapi-py313-free-threaded-memory-boundary-standard?format=cursor","windsurf":"/api/rules/fastapi-py313-free-threaded-memory-boundary-standard?format=windsurf","agents":"/api/rules/fastapi-py313-free-threaded-memory-boundary-standard?format=agents"}},{"id":"bun-1-2-ffi-zerocopy-pointer-alignment-guardrail","title":"Bun 1.2 FFI Zero-Copy Pointer Alignment and Lifetime Pinning Guardrail","category":"backend","severity":"critical","description":"Enforces strict memory boundary, byte alignment, and GC lifetime anchoring when marshalling zero-copy typed arrays to native C-ABI and SIMD routines via Bun 1.2 FFI. Prevents silent memory corruption, microarchitectural page-boundary faults, and SIGSEGV/SIGBUS crashes caused by unaligned vector loads or premature JavaScriptCore garbage collection.","antiPatternHeadline":"Passing unaligned TypedArray views or unanchored buffers directly to native SIMD/C functions via bun:ffi.","stars_count":42,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","ffi","simd","memory-safety","zero-copy"],"exportEndpoints":{"claude":"/api/rules/bun-1-2-ffi-zerocopy-pointer-alignment-guardrail?format=claude","cursorMdc":"/api/rules/bun-1-2-ffi-zerocopy-pointer-alignment-guardrail?format=mdc","cursorrules":"/api/rules/bun-1-2-ffi-zerocopy-pointer-alignment-guardrail?format=cursor","windsurf":"/api/rules/bun-1-2-ffi-zerocopy-pointer-alignment-guardrail?format=windsurf","agents":"/api/rules/bun-1-2-ffi-zerocopy-pointer-alignment-guardrail?format=agents"}},{"id":"capacitor-custom-scheme-asset-encryption-standard","title":"Capacitor 7 Custom Scheme Hardware-Backed Asset Decryption Interceptor Standard","category":"mobile","severity":"critical","description":"Enforces that all proprietary hybrid assets served inside Capacitor 7 native webviews are encrypted at rest using AES-GCM-256 and decrypted strictly in memory on-the-fly via custom scheme URL interceptors. Mandates that cryptographic keys reside inside hardware-backed storage (Android KeyStore StrongBox or iOS Secure Enclave / Keychain) and forbids writing decrypted payloads back to persistent disk or web storage caches.","antiPatternHeadline":"Plaintext Asset Distribution and Local Storage Decryption Caching in Capacitor WebViews","stars_count":109,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["capacitor","ios","android","security","encryption","webview"],"exportEndpoints":{"claude":"/api/rules/capacitor-custom-scheme-asset-encryption-standard?format=claude","cursorMdc":"/api/rules/capacitor-custom-scheme-asset-encryption-standard?format=mdc","cursorrules":"/api/rules/capacitor-custom-scheme-asset-encryption-standard?format=cursor","windsurf":"/api/rules/capacitor-custom-scheme-asset-encryption-standard?format=windsurf","agents":"/api/rules/capacitor-custom-scheme-asset-encryption-standard?format=agents"}},{"id":"openfga-contextual-tuple-ephemeral-boundary","title":"OpenFGA Ephemeral Contextual Tuple Verification and Ingestion Guardrail","category":"security","severity":"critical","description":"Enforces strict authorization boundaries in OpenFGA by mandating that dynamic, transient attributes (such as IP bounds, active session scopes, step-up MFA claims, and break-glass tokens) are passed strictly as validated, short-lived contextual tuples rather than persisted in the relationship store. Prevents privilege elevation and stale grants by requiring cryptographic verification and TTL validation before contextual tuple construction.","antiPatternHeadline":"Persisting Transient Authorization States into the Global FGA Tuplestore or Trusting Unverified Contextual Tuples","stars_count":115,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","zero-trust","authorization","fine-grained-authz","jwt"],"exportEndpoints":{"claude":"/api/rules/openfga-contextual-tuple-ephemeral-boundary?format=claude","cursorMdc":"/api/rules/openfga-contextual-tuple-ephemeral-boundary?format=mdc","cursorrules":"/api/rules/openfga-contextual-tuple-ephemeral-boundary?format=cursor","windsurf":"/api/rules/openfga-contextual-tuple-ephemeral-boundary?format=windsurf","agents":"/api/rules/openfga-contextual-tuple-ephemeral-boundary?format=agents"}},{"id":"post-quantum-tls13-hybrid-kem-guardrail","title":"Post-Quantum TLS 1.3 ML-KEM-768/X25519 Hybrid Key Exchange Enforcement","category":"security","severity":"critical","description":"Enforces mandatory dual-algorithm hybrid key encapsulation mechanisms (combining NIST FIPS 203 ML-KEM-768 with classical X25519) across all TLS 1.3 edge ingress and reverse proxy configurations. This neutralizes retrospective quantum decryption ('Store Now, Decrypt Later') threats while retaining classical cryptographic guarantees against current adversaries.","antiPatternHeadline":"Deploying Pure Classical Key Exchange (X25519-only, P-256) or Allowing Downgrade from Quantum-Resistant Hybrid Key Shares","stars_count":78,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","post-quantum-cryptography","tls-1-3","ml-kem","x25519","cryptographic-agility","zero-trust"],"exportEndpoints":{"claude":"/api/rules/post-quantum-tls13-hybrid-kem-guardrail?format=claude","cursorMdc":"/api/rules/post-quantum-tls13-hybrid-kem-guardrail?format=mdc","cursorrules":"/api/rules/post-quantum-tls13-hybrid-kem-guardrail?format=cursor","windsurf":"/api/rules/post-quantum-tls13-hybrid-kem-guardrail?format=windsurf","agents":"/api/rules/post-quantum-tls13-hybrid-kem-guardrail?format=agents"}},{"id":"ebpf-ringbuf-nonblocking-reclamation-standard","title":"eBPF Ring Buffer Multi-Consumer Non-Blocking Memory Reclamation Standard","category":"devops","severity":"critical","description":"Enforces non-blocking memory reclamation and watermark-driven telemetry pacing across multi-consumer eBPF ring buffer architectures. Prevents kernel slab exhaustion during high-volume syscall storms by orchestrating lockless consumer draining, zero-copy commit timeouts, and automatic degradation tiers. Ensures security telemetry streaming remains lossless without risking host kernel panic or unbounded buffer backpressure.","antiPatternHeadline":"Unbounded BPF Ring Buffer Reservations and Blocking Polling Cascading into Kernel Slab Starvation","stars_count":41,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","telemetry","linux-kernel","memory-management","observability"],"exportEndpoints":{"claude":"/api/rules/ebpf-ringbuf-nonblocking-reclamation-standard?format=claude","cursorMdc":"/api/rules/ebpf-ringbuf-nonblocking-reclamation-standard?format=mdc","cursorrules":"/api/rules/ebpf-ringbuf-nonblocking-reclamation-standard?format=cursor","windsurf":"/api/rules/ebpf-ringbuf-nonblocking-reclamation-standard?format=windsurf","agents":"/api/rules/ebpf-ringbuf-nonblocking-reclamation-standard?format=agents"}},{"id":"opentelemetry-w3c-baggage-cardinality-pii-scrubber-standard","title":"OpenTelemetry W3C Baggage Ingestion Cardinality & PII Scrubber Standard","category":"devops","severity":"critical","description":"Prevents distributed tracing memory bloat, cardinality explosion, and regulatory data leakage by strictly validating and sanitizing W3C Baggage headers at ingress boundaries. All untrusted external baggage must be filtered through an explicit allowlist and size boundary before propagation into internal execution contexts.","antiPatternHeadline":"Blind Ingestion and Unbounded Propagation of Untrusted W3C Baggage Headers","stars_count":86,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","observability","distributed-tracing","w3c-baggage","pii-sanitization","security"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-w3c-baggage-cardinality-pii-scrubber-standard?format=claude","cursorMdc":"/api/rules/opentelemetry-w3c-baggage-cardinality-pii-scrubber-standard?format=mdc","cursorrules":"/api/rules/opentelemetry-w3c-baggage-cardinality-pii-scrubber-standard?format=cursor","windsurf":"/api/rules/opentelemetry-w3c-baggage-cardinality-pii-scrubber-standard?format=windsurf","agents":"/api/rules/opentelemetry-w3c-baggage-cardinality-pii-scrubber-standard?format=agents"}},{"id":"next15-ppr-hydration-watermark-invariant","title":"Next.js 15 PPR Static Shell Hydration Watermark Invariant","category":"frontend","severity":"critical","description":"Enforces strict isolation between static prerendered shells and dynamic streaming Suspense boundaries in Next.js 15 Partial Prerendering (PPR). Guarantees deterministic microtask execution order and prevents client-side hydration mismatch cascading caused by unisolated asynchronous context access under high-latency edge streaming.","antiPatternHeadline":"Dynamic State Leakage Across Static PPR Boundaries Causing Cascading Hydration De-optimization","stars_count":108,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs","react19","ppr","streaming","hydration","concurrency"],"exportEndpoints":{"claude":"/api/rules/next15-ppr-hydration-watermark-invariant?format=claude","cursorMdc":"/api/rules/next15-ppr-hydration-watermark-invariant?format=mdc","cursorrules":"/api/rules/next15-ppr-hydration-watermark-invariant?format=cursor","windsurf":"/api/rules/next15-ppr-hydration-watermark-invariant?format=windsurf","agents":"/api/rules/next15-ppr-hydration-watermark-invariant?format=agents"}},{"id":"react-19-asset-preloading-priority-watermark-standard","title":"React 19 Streaming SSR Asset Preloading and 103 Early Hints Watermark Standard","category":"frontend","severity":"critical","description":"Enforces deterministic asset preloading tiers during React 19 concurrent streaming SSR (renderToPipeableStream/renderToReadableStream) to eliminate stylesheet and font waterfalls. Mandates the use of react-dom preloading APIs (preload, preinit) synchronized with server-level HTTP 103 Early Hints before Suspense boundaries yield control.","antiPatternHeadline":"Deferred In-Tree Preloading Inside Nested Suspense Boundaries Inducing Render-Blocking Asset Waterfalls","stars_count":57,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","ssr","streaming","103-early-hints","web-vitals","react-dom"],"exportEndpoints":{"claude":"/api/rules/react-19-asset-preloading-priority-watermark-standard?format=claude","cursorMdc":"/api/rules/react-19-asset-preloading-priority-watermark-standard?format=mdc","cursorrules":"/api/rules/react-19-asset-preloading-priority-watermark-standard?format=cursor","windsurf":"/api/rules/react-19-asset-preloading-priority-watermark-standard?format=windsurf","agents":"/api/rules/react-19-asset-preloading-priority-watermark-standard?format=agents"}},{"id":"fastapi-anyio-cancellation-shielding-drain-guardrail","title":"FastAPI AnyIO Cancellation Shielding and Connection Drain Invariant","category":"backend","severity":"critical","description":"Enforces strict cancellation boundaries and deterministic connection draining in FastAPI services running on AnyIO/asyncio. Prevents orphaned mutations, partial transactional states, and thread pool starvation caused by unhandled client disconnections and mid-flight ASGI task cancellations.","antiPatternHeadline":"Unshielded Multi-Step Asynchronous Mutations and Unprotected Thread Worker Dispatches Under Client Disconnect","stars_count":46,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","anyio","asyncio","concurrency","python","reliability"],"exportEndpoints":{"claude":"/api/rules/fastapi-anyio-cancellation-shielding-drain-guardrail?format=claude","cursorMdc":"/api/rules/fastapi-anyio-cancellation-shielding-drain-guardrail?format=mdc","cursorrules":"/api/rules/fastapi-anyio-cancellation-shielding-drain-guardrail?format=cursor","windsurf":"/api/rules/fastapi-anyio-cancellation-shielding-drain-guardrail?format=windsurf","agents":"/api/rules/fastapi-anyio-cancellation-shielding-drain-guardrail?format=agents"}},{"id":"go-chi-http3-zero-escape-context-barrier","title":"Go Chi v5 HTTP/3 Stream Lifecycle Zero-Escape Context Barrier","category":"backend","severity":"critical","description":"Enforces strict lifecycle boundaries between multiplexed QUIC/HTTP/3 stream contexts and asynchronous operations in Go Chi v5 services. Eliminates memory corruption, heap escapes, and premature cancellations caused by passing request contexts or pooled sync.Pool buffers across stream boundary horizons.","antiPatternHeadline":"Escaping Ephemeral QUIC Stream Contexts and Pooled Buffers into Unbounded Background Goroutines","stars_count":85,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","golang","chi-v5","http3","quic","sync-pool","concurrency","zero-allocation"],"exportEndpoints":{"claude":"/api/rules/go-chi-http3-zero-escape-context-barrier?format=claude","cursorMdc":"/api/rules/go-chi-http3-zero-escape-context-barrier?format=mdc","cursorrules":"/api/rules/go-chi-http3-zero-escape-context-barrier?format=cursor","windsurf":"/api/rules/go-chi-http3-zero-escape-context-barrier?format=windsurf","agents":"/api/rules/go-chi-http3-zero-escape-context-barrier?format=agents"}},{"id":"tauri2-multiwindow-plugin-capability-isolation","title":"Tauri 2.0 Multi-Window Plugin Capability Scope Isolation","category":"mobile","severity":"critical","description":"Enforces strict per-window capability manifest partitioning in Tauri 2.0 multi-window architectures to prevent cross-webview privilege escalation. Webview instances must bind exclusively to least-privilege capability sets keyed directly to explicit window labels and origins. Global plugin permissions or wildcard window bindings that expose OS-level hardware, file systems, or biometric APIs across window boundaries are strictly prohibited.","antiPatternHeadline":"Global Plugin Permission Bleed via Wildcard Window Capability Mappings","stars_count":67,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri","rust","security","ipc","capabilities"],"exportEndpoints":{"claude":"/api/rules/tauri2-multiwindow-plugin-capability-isolation?format=claude","cursorMdc":"/api/rules/tauri2-multiwindow-plugin-capability-isolation?format=mdc","cursorrules":"/api/rules/tauri2-multiwindow-plugin-capability-isolation?format=cursor","windsurf":"/api/rules/tauri2-multiwindow-plugin-capability-isolation?format=windsurf","agents":"/api/rules/tauri2-multiwindow-plugin-capability-isolation?format=agents"}},{"id":"openfga-contextual-tuple-cyclic-expansion-guardrail","title":"OpenFGA Contextual Tuple Cyclic Expansion Depth and Memory Guardrail","category":"security","severity":"critical","description":"Mandates strict bounds on contextual tuple array size, acyclic relationship validation, and client-side execution timeouts for OpenFGA 1.6 authorization calls. Unbounded or cyclic transient tuples injected into real-time check evaluations trigger exponential sub-graph traversals, causing severe latency degradation, worker thread starvation, and Denial-of-Service (DoS) vulnerabilities.","antiPatternHeadline":"Injecting Unsanitized Dynamic Contextual Tuples Directly into Authorization Checks Without Depth Caps or Graph Bounds","stars_count":84,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","authorization","fga","rebac","dos-prevention","graph-algorithms"],"exportEndpoints":{"claude":"/api/rules/openfga-contextual-tuple-cyclic-expansion-guardrail?format=claude","cursorMdc":"/api/rules/openfga-contextual-tuple-cyclic-expansion-guardrail?format=mdc","cursorrules":"/api/rules/openfga-contextual-tuple-cyclic-expansion-guardrail?format=cursor","windsurf":"/api/rules/openfga-contextual-tuple-cyclic-expansion-guardrail?format=windsurf","agents":"/api/rules/openfga-contextual-tuple-cyclic-expansion-guardrail?format=agents"}},{"id":"k8s-1-32-in-place-pod-vertical-scaling-standard","title":"Kubernetes 1.32 In-Place Pod Vertical Scaling Mutability Standard","category":"devops","severity":"critical","description":"Enforces non-disruptive in-place container resource updates introduced in Kubernetes 1.27 and graduated in 1.32, preventing unexpected pod restarts during horizontal or vertical adjustments. Restricts live resource mutation exclusively to CPU and memory while ensuring resizePolicy preserves process state under cgroup v2. Validates that controllers mutate only spec.containers[*].resources without triggering Pod recreation or container restart cycles.","antiPatternHeadline":"Blind resource patching triggering Pod recreation and SIGKILL eviction under dynamic load","stars_count":86,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","kubernetes","cgroups-v2","autoscaling","in-place-resize"],"exportEndpoints":{"claude":"/api/rules/k8s-1-32-in-place-pod-vertical-scaling-standard?format=claude","cursorMdc":"/api/rules/k8s-1-32-in-place-pod-vertical-scaling-standard?format=mdc","cursorrules":"/api/rules/k8s-1-32-in-place-pod-vertical-scaling-standard?format=cursor","windsurf":"/api/rules/k8s-1-32-in-place-pod-vertical-scaling-standard?format=windsurf","agents":"/api/rules/k8s-1-32-in-place-pod-vertical-scaling-standard?format=agents"}},{"id":"opentelemetry-arrow-columnar-telemetry-pipeline-standard","title":"OpenTelemetry Arrow Protocol Zero-Copy Columnar Telemetry Pipeline Standard","category":"devops","severity":"critical","description":"Mandates the deployment of Apache Arrow-native encoders and decoders across OpenTelemetry Collector mesh pipelines to replace standard row-oriented OTLP Protobuf serialization over inter-cluster transit. Enforces zero-copy columnar serialization, shared dictionary encoding, and stream-oriented batching, reducing telemetry network egress bills and CPU collector serialization overhead by over 70%.","antiPatternHeadline":"Transporting Cross-Cluster OTLP via Row-Based Protobuf over WAN Without Columnar Arrow Compression","stars_count":86,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","apache-arrow","observability","grpc","finops","kubernetes"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-arrow-columnar-telemetry-pipeline-standard?format=claude","cursorMdc":"/api/rules/opentelemetry-arrow-columnar-telemetry-pipeline-standard?format=mdc","cursorrules":"/api/rules/opentelemetry-arrow-columnar-telemetry-pipeline-standard?format=cursor","windsurf":"/api/rules/opentelemetry-arrow-columnar-telemetry-pipeline-standard?format=windsurf","agents":"/api/rules/opentelemetry-arrow-columnar-telemetry-pipeline-standard?format=agents"}},{"id":"react-19-activity-offscreen-boundary-standard","title":"React 19 Activity API Offscreen Boundary and Memory Retention Invariant","category":"frontend","severity":"critical","description":"Governs the use of React 19's unstable_Activity (Offscreen API) across deep route transitions and tabbed panels. Enforces explicit lifecycle suspension, event listener teardown, and cancellation of pending asynchronous tasks during hidden states to prevent detached DOM memory leaks while retaining client-side component state.","antiPatternHeadline":"Uncontrolled Offscreen Activity Causing Detached DOM Leaks and Unthrottled Hidden Renders","stars_count":88,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["react-19","activity-api","offscreen-rendering","memory-management","performance"],"exportEndpoints":{"claude":"/api/rules/react-19-activity-offscreen-boundary-standard?format=claude","cursorMdc":"/api/rules/react-19-activity-offscreen-boundary-standard?format=mdc","cursorrules":"/api/rules/react-19-activity-offscreen-boundary-standard?format=cursor","windsurf":"/api/rules/react-19-activity-offscreen-boundary-standard?format=windsurf","agents":"/api/rules/react-19-activity-offscreen-boundary-standard?format=agents"}},{"id":"wasmgc-sharedarraybuffer-cross-origin-isolation-invariant","title":"WasmGC SharedArrayBuffer Cross-Origin Isolation and COOP/COEP Enforcement","category":"frontend","severity":"critical","description":"Enforces strict Cross-Origin-Opener-Policy (COOP) and Cross-Origin-Embedder-Policy (COEP) invariants across all root documents, service workers, and micro-frontend entrypoints to guarantee window.crossOriginIsolated is true. This prevents catastrophic runtime crashes when allocating shared WebAssembly.Memory instances for hardware-accelerated multithreaded WasmGC workloads. It also ensures all cross-origin subresources and workers declare appropriate Cross-Origin Resource Policy (CORP) headers.","antiPatternHeadline":"Instantiating Multithreaded WasmGC or SharedArrayBuffer Without Complete Cross-Origin Isolation and CORP Verification","stars_count":95,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","webassembly","wasmgc","sharedarraybuffer","coop-coep","micro-frontends","concurrency"],"exportEndpoints":{"claude":"/api/rules/wasmgc-sharedarraybuffer-cross-origin-isolation-invariant?format=claude","cursorMdc":"/api/rules/wasmgc-sharedarraybuffer-cross-origin-isolation-invariant?format=mdc","cursorrules":"/api/rules/wasmgc-sharedarraybuffer-cross-origin-isolation-invariant?format=cursor","windsurf":"/api/rules/wasmgc-sharedarraybuffer-cross-origin-isolation-invariant?format=windsurf","agents":"/api/rules/wasmgc-sharedarraybuffer-cross-origin-isolation-invariant?format=agents"}},{"id":"axum-structured-task-cancellation-barrier","title":"Axum 0.8 Structured Task-Cancellation Barrier via CancellationToken Hierarchies","category":"backend","severity":"critical","description":"In Axum 0.8, HTTP/3 QUIC stream resets and client connection drops abruptly terminate handler futures at yield points. Without an explicit structured task-cancellation barrier using tokio_util CancellationToken hierarchies and RAII rollback guards, spawned background tasks leak compute and orphaned database transactions persist indefinitely.","antiPatternHeadline":"Spawning Unlinked tokio::spawn Tasks and Unguarded Long-Running IO in Dropped Handlers","stars_count":52,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tokio","http3","concurrency"],"exportEndpoints":{"claude":"/api/rules/axum-structured-task-cancellation-barrier?format=claude","cursorMdc":"/api/rules/axum-structured-task-cancellation-barrier?format=mdc","cursorrules":"/api/rules/axum-structured-task-cancellation-barrier?format=cursor","windsurf":"/api/rules/axum-structured-task-cancellation-barrier?format=windsurf","agents":"/api/rules/axum-structured-task-cancellation-barrier?format=agents"}},{"id":"bun-websocket-backpressure-drain-invariant-bun-1-2-websocke-621","title":"Bun 1.2 WebSocket Backpressure High-Water Mark and Drain Invariant","category":"backend","severity":"critical","description":"Enforces non-blocking backpressure checks and per-socket buffer boundaries on Bun WebSocket connections using Bun.serve. Mandates tracking ws.send() return byte counts, monitoring ws.readyState, registering drain() callbacks, and enforcing high-water mark buffer ceilings to prevent slow-client buffer inflation and fatal Node/Bun process OOM termination.","antiPatternHeadline":"Unchecked Fire-and-Forget ws.send() Loops Inducing Unbounded C++ Heap Growth and Slow-Client OOM","stars_count":111,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","websockets","backpressure","memory-leak","networking"],"exportEndpoints":{"claude":"/api/rules/bun-websocket-backpressure-drain-invariant-bun-1-2-websocke-621?format=claude","cursorMdc":"/api/rules/bun-websocket-backpressure-drain-invariant-bun-1-2-websocke-621?format=mdc","cursorrules":"/api/rules/bun-websocket-backpressure-drain-invariant-bun-1-2-websocke-621?format=cursor","windsurf":"/api/rules/bun-websocket-backpressure-drain-invariant-bun-1-2-websocke-621?format=windsurf","agents":"/api/rules/bun-websocket-backpressure-drain-invariant-bun-1-2-websocke-621?format=agents"}},{"id":"skiko-gpu-surface-lifecycle-invalidation","title":"Compose Multiplatform Skiko GPU Surface Lifecycle & Swapchain Invalidation","category":"mobile","severity":"critical","description":"Enforces synchronous GPU swapchain invalidation, render loop detachment, and Skia GrContext resource flushing when native platforms transition to background or inactive states. Prevents fatal OS termination (such as iOS gpus_ReturnNotPermittedKillClient or Android Vulkan/EGL surface-destroyed aborts) caused by rogue draw calls on invalidated native rendering surfaces.","antiPatternHeadline":"Deferred or Async SkiaLayer Teardown Permitting Background GPU Frame Submissions","stars_count":72,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","compose-multiplatform","skiko","metal","vulkan","lifecycle","ios","android"],"exportEndpoints":{"claude":"/api/rules/skiko-gpu-surface-lifecycle-invalidation?format=claude","cursorMdc":"/api/rules/skiko-gpu-surface-lifecycle-invalidation?format=mdc","cursorrules":"/api/rules/skiko-gpu-surface-lifecycle-invalidation?format=cursor","windsurf":"/api/rules/skiko-gpu-surface-lifecycle-invalidation?format=windsurf","agents":"/api/rules/skiko-gpu-surface-lifecycle-invalidation?format=agents"}},{"id":"capacitor-deep-link-cold-boot-fence","title":"Capacitor 7 Deep-Link Decoupled Cold-Boot Fencing Standard","category":"mobile","severity":"critical","description":"Enforces an atomic staging queue and synchronization fence between native platform URI activation events and web runtime bootstrap in Capacitor 7 applications. Guarantees that cold-boot links retrieved via getLaunchUrl() and runtime appUrlOpen events are sequentially buffered and dispatched only after routing and authentication state machines declare readiness.","antiPatternHeadline":"Registering appUrlOpen Inside Lazy-Loaded Component Mounts Dropping Cold-Boot Activations","stars_count":82,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","deep-links","cold-boot","ios","android"],"exportEndpoints":{"claude":"/api/rules/capacitor-deep-link-cold-boot-fence?format=claude","cursorMdc":"/api/rules/capacitor-deep-link-cold-boot-fence?format=mdc","cursorrules":"/api/rules/capacitor-deep-link-cold-boot-fence?format=cursor","windsurf":"/api/rules/capacitor-deep-link-cold-boot-fence?format=windsurf","agents":"/api/rules/capacitor-deep-link-cold-boot-fence?format=agents"}},{"id":"envoy-extauthz-rebac-circuit-breaker-standard","title":"Envoy ext_authz Distributed ReBAC Dynamic Circuit-Breaking Standard","category":"security","severity":"critical","description":"Enforces strict deadline fencing, local bounded fallback caching, and dynamic circuit breaking for Envoy external authorization (ext_authz) services interfacing with distributed ReBAC (Zanzibar-style) graph backends. Prevents unbounded graph expansion latency from cascading to the ingress edge by mandating fail-closed deterministic timeouts and concurrency isolation. Guarantees ingress edge resilience during high-cardinality relationship traversals without sacrificing security posture.","antiPatternHeadline":"Unbounded ReBAC Graph Traversal Without Edge Deadline Fencing and Fail-Closed Circuit Breaking","stars_count":72,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","envoy","ext-authz","rebac","circuit-breaker","zanzibar","resilience"],"exportEndpoints":{"claude":"/api/rules/envoy-extauthz-rebac-circuit-breaker-standard?format=claude","cursorMdc":"/api/rules/envoy-extauthz-rebac-circuit-breaker-standard?format=mdc","cursorrules":"/api/rules/envoy-extauthz-rebac-circuit-breaker-standard?format=cursor","windsurf":"/api/rules/envoy-extauthz-rebac-circuit-breaker-standard?format=windsurf","agents":"/api/rules/envoy-extauthz-rebac-circuit-breaker-standard?format=agents"}},{"id":"istio-ambient-ztunnel-ebpf-redirection-guardrail","title":"Istio Ambient Mesh ztunnel eBPF Transparent Redirection Invariants","category":"devops","severity":"critical","description":"Enforces deterministic node-level socket capture and HBONE encapsulation invariants across ambient mesh workloads without in-pod sidecars or host-cgroup mutation. Guarantees that ztunnel retains cryptographic identity attestation (SPIFFE ID matching) and non-invasive eBPF/iptables redirection without breaking CNI compatibility or exposing cleartext socket bypasses.","antiPatternHeadline":"Bypassing ztunnel HBONE redirection via unpinned eBPF sockops or colliding iptables MARK rules","stars_count":83,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","istio","ambient-mesh","ztunnel","ebpf","hbone","mtls","cilium"],"exportEndpoints":{"claude":"/api/rules/istio-ambient-ztunnel-ebpf-redirection-guardrail?format=claude","cursorMdc":"/api/rules/istio-ambient-ztunnel-ebpf-redirection-guardrail?format=mdc","cursorrules":"/api/rules/istio-ambient-ztunnel-ebpf-redirection-guardrail?format=cursor","windsurf":"/api/rules/istio-ambient-ztunnel-ebpf-redirection-guardrail?format=windsurf","agents":"/api/rules/istio-ambient-ztunnel-ebpf-redirection-guardrail?format=agents"}},{"id":"react-19-use-optimistic-server-action-rollback-guardrail","title":"React 19 useOptimistic Server Action Rollback & Layout Drift Invariants","category":"frontend","severity":"critical","description":"Enforces deterministic UI state reconciliation and eliminates layout drift during concurrent React 19 Server Actions under high network latency or execution failure. Mandates explicit state pass-through via useActionState alongside useOptimistic, stable optimistic keys, and atomic rollback boundaries to prevent desynchronization between transient transitions and persistent server state. Forbids non-transitioned optimistic dispatching, unkeyed list appends, and local uncoordinated state shadowing.","antiPatternHeadline":"Unbounded Optimistic Mutating and Non-Transition Mutation Dispatch Causing Permanent Ghost State and Layout Drift","stars_count":104,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","useOptimistic","server-actions","concurrency","state-reconciliation"],"exportEndpoints":{"claude":"/api/rules/react-19-use-optimistic-server-action-rollback-guardrail?format=claude","cursorMdc":"/api/rules/react-19-use-optimistic-server-action-rollback-guardrail?format=mdc","cursorrules":"/api/rules/react-19-use-optimistic-server-action-rollback-guardrail?format=cursor","windsurf":"/api/rules/react-19-use-optimistic-server-action-rollback-guardrail?format=windsurf","agents":"/api/rules/react-19-use-optimistic-server-action-rollback-guardrail?format=agents"}},{"id":"postgres-17-json-table-streaming-projection-postgresql-17-sq-327","title":"PostgreSQL 17 SQL/JSON JSON_TABLE In-Engine Streaming Projections","category":"backend","severity":"critical","description":"PostgreSQL 17 JSON_TABLE transforms semi-structured JSONB documents directly into typed relational projections within the query executor. Application services must leverage in-engine JSON_TABLE evaluation rather than deserializing large JSON blobs in runtime application memory, preventing catastrophic V8/Go garbage collection pauses and OOM crashes. Streaming projections ensure strict type safety, columnar filtering, and zero-allocation relational joins.","antiPatternHeadline":"Hydrating Large JSONB Documents into Application Memory for Runtime Parsing and Extraction","stars_count":107,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","json-table","performance","sql-json","database"],"exportEndpoints":{"claude":"/api/rules/postgres-17-json-table-streaming-projection-postgresql-17-sq-327?format=claude","cursorMdc":"/api/rules/postgres-17-json-table-streaming-projection-postgresql-17-sq-327?format=mdc","cursorrules":"/api/rules/postgres-17-json-table-streaming-projection-postgresql-17-sq-327?format=cursor","windsurf":"/api/rules/postgres-17-json-table-streaming-projection-postgresql-17-sq-327?format=windsurf","agents":"/api/rules/postgres-17-json-table-streaming-projection-postgresql-17-sq-327?format=agents"}},{"id":"openfga-contextual-tuple-batching-standard","title":"OpenFGA Contextual Tuple Batching and Tail Latency Mitigation Standard","category":"backend","severity":"critical","description":"Enforces batched evaluation and deduplication of contextual tuples during OpenFGA ReBAC operations across distributed boundaries. Prevents N+1 network roundtrips, redundant graph traversal allocations, and sub-millisecond p99 tail latency amplification in high-throughput microservice pipelines.","antiPatternHeadline":"Sequential single-check evaluations with redundant contextual tuple serialization causing N+1 latency cascades.","stars_count":90,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","authorization","openfga","rebac","performance","tail-latency"],"exportEndpoints":{"claude":"/api/rules/openfga-contextual-tuple-batching-standard?format=claude","cursorMdc":"/api/rules/openfga-contextual-tuple-batching-standard?format=mdc","cursorrules":"/api/rules/openfga-contextual-tuple-batching-standard?format=cursor","windsurf":"/api/rules/openfga-contextual-tuple-batching-standard?format=windsurf","agents":"/api/rules/openfga-contextual-tuple-batching-standard?format=agents"}},{"id":"fastapi-pydantic-v2-streaming-deserialization","title":"FastAPI & Pydantic V2 Chunked Zero-Copy Stream Deserialization Standard","category":"backend","severity":"critical","description":"Enforces non-blocking, zero-copy, chunked deserialization for high-throughput and multi-gigabyte structured payloads in FastAPI using Pydantic V2. Protects the asyncio event loop from starvation and prevents worker out-of-memory (OOM) crashes by streaming byte buffers directly into iterative parsers and offloading validation to bounded worker threads.","antiPatternHeadline":"Eager Request Body Buffering and Synchronous In-Loop Deserialization of Large Payloads","stars_count":105,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","pydantic-v2","asyncio","streaming","memory-optimization"],"exportEndpoints":{"claude":"/api/rules/fastapi-pydantic-v2-streaming-deserialization?format=claude","cursorMdc":"/api/rules/fastapi-pydantic-v2-streaming-deserialization?format=mdc","cursorrules":"/api/rules/fastapi-pydantic-v2-streaming-deserialization?format=cursor","windsurf":"/api/rules/fastapi-pydantic-v2-streaming-deserialization?format=windsurf","agents":"/api/rules/fastapi-pydantic-v2-streaming-deserialization?format=agents"}},{"id":"tauri-2-ipc-capability-sandboxing-guardrail","title":"Tauri 2.0 Compile-Time IPC Capability Sandboxing and Granular Permission Scoping","category":"mobile","severity":"critical","description":"Enforces strict, compile-time capability manifests and permission scoping in Tauri 2.0 mobile and desktop targets. Disallows wildcard IPC permissions and unrestrained native access to protect host devices from Remote Code Execution (RCE) and native privilege escalation stemming from webview XSS vulnerabilities.","antiPatternHeadline":"Blanket Wildcard Permissions and Unscoped Capability Manifests in Tauri 2.0 IPC Layer","stars_count":94,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri-2","ipc-security","sandboxing","capabilities","rust"],"exportEndpoints":{"claude":"/api/rules/tauri-2-ipc-capability-sandboxing-guardrail?format=claude","cursorMdc":"/api/rules/tauri-2-ipc-capability-sandboxing-guardrail?format=mdc","cursorrules":"/api/rules/tauri-2-ipc-capability-sandboxing-guardrail?format=cursor","windsurf":"/api/rules/tauri-2-ipc-capability-sandboxing-guardrail?format=windsurf","agents":"/api/rules/tauri-2-ipc-capability-sandboxing-guardrail?format=agents"}},{"id":"capacitor7-hardware-biometric-key-invalidation-standard","title":"Capacitor 7 Hardware-Backed Key Attestation & Biometric Invalidation Standard","category":"mobile","severity":"critical","description":"Enforces hardware-backed cryptographic keys bound directly to the native OS biometric database state within Capacitor 7 architectures. Guarantees immediate cryptographic invalidation, local secret erasure, and remote key re-attestation when OS biometric database mutations (e.g., new fingerprint or face enrollment) are detected.","antiPatternHeadline":"Treating Biometric Authentication as an Unbound Local Boolean Gate Vulnerable to Biometric Database Mutation","stars_count":80,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","security","cryptography","biometrics","ios","android"],"exportEndpoints":{"claude":"/api/rules/capacitor7-hardware-biometric-key-invalidation-standard?format=claude","cursorMdc":"/api/rules/capacitor7-hardware-biometric-key-invalidation-standard?format=mdc","cursorrules":"/api/rules/capacitor7-hardware-biometric-key-invalidation-standard?format=cursor","windsurf":"/api/rules/capacitor7-hardware-biometric-key-invalidation-standard?format=windsurf","agents":"/api/rules/capacitor7-hardware-biometric-key-invalidation-standard?format=agents"}},{"id":"cilium-tetragon-ebpf-kernel-namespace-boundary-enforcement","title":"Cilium Tetragon eBPF Synchronous Kernel Namespace Boundary Enforcement","category":"security","severity":"critical","description":"Enforces in-kernel synchronous execution blocking using Cilium Tetragon TracingPolicies with Sigkill actions for unauthorized namespace boundary crossings, privilege escalations, and container breakouts. Traditional user-space observability agents incur asynchronous event transmission latency, allowing malicious code to persist or execute payloads before remediation occurs. Systems must enforce strict eBPF kprobe/tracepoint hooks to terminate violating processes within the kernel syscall boundary instantly.","antiPatternHeadline":"Relying on Asynchronous User-Space Telemetry Alerts for Container Breakouts Instead of Synchronous Kernel Sigkill Enforcement","stars_count":45,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","cilium","tetragon","ebpf","kubernetes","container-security","runtime-enforcement"],"exportEndpoints":{"claude":"/api/rules/cilium-tetragon-ebpf-kernel-namespace-boundary-enforcement?format=claude","cursorMdc":"/api/rules/cilium-tetragon-ebpf-kernel-namespace-boundary-enforcement?format=mdc","cursorrules":"/api/rules/cilium-tetragon-ebpf-kernel-namespace-boundary-enforcement?format=cursor","windsurf":"/api/rules/cilium-tetragon-ebpf-kernel-namespace-boundary-enforcement?format=windsurf","agents":"/api/rules/cilium-tetragon-ebpf-kernel-namespace-boundary-enforcement?format=agents"}},{"id":"webauthn-prf-zk-client-key-derivation-guardrail","title":"WebAuthn PRF Zero-Knowledge Key Derivation & HKDF Domain Separation Standard","category":"security","severity":"critical","description":"Mandates cryptographic domain separation, zero-knowledge isolation, and memory hygiene when deriving client-side symmetric keys via the WebAuthn PRF (Pseudo-Random Function) extension. Prevents raw PRF output exposure to remote servers, direct use of raw PRF bytes as cipher keys, and silent authentication failures on authenticators lacking PRF support.","antiPatternHeadline":"Direct Cipher Usage of Raw PRF Secret, Exposing PRF Output to Server Payloads, or Missing HKDF Domain Separation","stars_count":52,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","prf-extension","zero-knowledge","hkdf","passkeys","cryptography"],"exportEndpoints":{"claude":"/api/rules/webauthn-prf-zk-client-key-derivation-guardrail?format=claude","cursorMdc":"/api/rules/webauthn-prf-zk-client-key-derivation-guardrail?format=mdc","cursorrules":"/api/rules/webauthn-prf-zk-client-key-derivation-guardrail?format=cursor","windsurf":"/api/rules/webauthn-prf-zk-client-key-derivation-guardrail?format=windsurf","agents":"/api/rules/webauthn-prf-zk-client-key-derivation-guardrail?format=agents"}},{"id":"opentelemetry-tail-sampling-w3c-baggage-policy","title":"OpenTelemetry Tail-Based Sampling and W3C Baggage Ingress Guardrail","category":"devops","severity":"critical","description":"Enforces edge extraction, sanitization, and span-attribute promotion of W3C Baggage customer metadata alongside collector-level tail-based sampling configurations. Ensures deterministic trace retention for P99 latency spikes, downstream unhandled exceptions, and high-value customer tiers while constraining telemetry storage expenditure.","antiPatternHeadline":"Head-Based Dropping of VIP Anomaly Traces and Missing W3C Baggage Attribute Promotion","stars_count":67,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","observability","distributed-tracing","tail-sampling","w3c-baggage"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-tail-sampling-w3c-baggage-policy?format=claude","cursorMdc":"/api/rules/opentelemetry-tail-sampling-w3c-baggage-policy?format=mdc","cursorrules":"/api/rules/opentelemetry-tail-sampling-w3c-baggage-policy?format=cursor","windsurf":"/api/rules/opentelemetry-tail-sampling-w3c-baggage-policy?format=windsurf","agents":"/api/rules/opentelemetry-tail-sampling-w3c-baggage-policy?format=agents"}},{"id":"kyverno-ephemeral-spiffe-spire-admission-standard","title":"Kyverno Ephemeral SPIFFE/SPIRE Workload Attestation Admission Standard","category":"devops","severity":"critical","description":"Enforces zero-trust ephemeral workload identities across Kubernetes clusters by binding SPIFFE/SPIRE workload attestation requirements directly into admission control. Rejects static cloud credentials, database tokens, and long-lived ServiceAccount secrets in favor of short-lived X.509 and JWT SVIDs issued via SPIFFE Workload API CSI driver sockets. Guarantees immutable attestation selectors and cryptographic identity provenance across all container deployments.","antiPatternHeadline":"Bypassing SPIFFE CSI Driver Sockets in Favor of Long-Lived Static Secrets and Ambient ServiceAccount Tokens","stars_count":56,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","kyverno","spiffe","spire","kubernetes","zero-trust","security"],"exportEndpoints":{"claude":"/api/rules/kyverno-ephemeral-spiffe-spire-admission-standard?format=claude","cursorMdc":"/api/rules/kyverno-ephemeral-spiffe-spire-admission-standard?format=mdc","cursorrules":"/api/rules/kyverno-ephemeral-spiffe-spire-admission-standard?format=cursor","windsurf":"/api/rules/kyverno-ephemeral-spiffe-spire-admission-standard?format=windsurf","agents":"/api/rules/kyverno-ephemeral-spiffe-spire-admission-standard?format=agents"}},{"id":"nextjs-15-ppr-dynamic-hole-streaming-barrier-next-js-15-ppr-d-719","title":"Next.js 15 PPR Dynamic Hole Streaming Barrier Standard","category":"frontend","severity":"critical","description":"Enforces strict boundary isolation for dynamic request data, asynchronous dynamic APIs, and streaming chunks under Next.js 15 Partial Prerendering (PPR). Guarantees that request-bound state cannot contaminate static edge shells or emit unhandled streaming rejections during deferred hydration.","antiPatternHeadline":"Accessing Uncached Request APIs Outside Suspense Boundaries or Emitting Unbounded Dynamic Stream Rejections into Static Shells","stars_count":96,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs","react","ppr","suspense","streaming","edge-cache"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-ppr-dynamic-hole-streaming-barrier-next-js-15-ppr-d-719?format=claude","cursorMdc":"/api/rules/nextjs-15-ppr-dynamic-hole-streaming-barrier-next-js-15-ppr-d-719?format=mdc","cursorrules":"/api/rules/nextjs-15-ppr-dynamic-hole-streaming-barrier-next-js-15-ppr-d-719?format=cursor","windsurf":"/api/rules/nextjs-15-ppr-dynamic-hole-streaming-barrier-next-js-15-ppr-d-719?format=windsurf","agents":"/api/rules/nextjs-15-ppr-dynamic-hole-streaming-barrier-next-js-15-ppr-d-719?format=agents"}},{"id":"react19-server-components-taint-object-perimeter","title":"React 19 Server Components Taint Object Memory Perimeter Enforcement","category":"security","severity":"critical","description":"Enforces memory perimeter guardrails using React 19 taint APIs (taintObjectReference and taintUniqueValue) to prevent sensitive credential containers, database records, and cryptographically sensitive keys from leaking across the React Server Component Flight serialization boundary. Any attempt to serialize a tainted object or value to a Client Component triggers an immediate runtime exception.","antiPatternHeadline":"Passing Untainted Credential-Bearing Data Models Across RSC Serialization Boundaries into Client Components","stars_count":64,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","react-19","server-components","rsc","taint-object-reference","flight-protocol"],"exportEndpoints":{"claude":"/api/rules/react19-server-components-taint-object-perimeter?format=claude","cursorMdc":"/api/rules/react19-server-components-taint-object-perimeter?format=mdc","cursorrules":"/api/rules/react19-server-components-taint-object-perimeter?format=cursor","windsurf":"/api/rules/react19-server-components-taint-object-perimeter?format=windsurf","agents":"/api/rules/react19-server-components-taint-object-perimeter?format=agents"}},{"id":"bun-websocket-backpressure-drain-pipeline","title":"Bun 1.2 Native WebSocket Backpressure and Cooperative Drain Architecture","category":"backend","severity":"critical","description":"Enforces strict non-blocking backpressure handling on native Bun WebSockets using ws.send() return codes and the drain() callback. Prevents unbounded native heap exhaustion caused by slow consumer stalls during high-frequency telemetry and event distribution.","antiPatternHeadline":"Blind ws.send() Invocations in High-Throughput Loops Leading to Native Buffer Bloat and OOM Crashes","stars_count":46,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","websockets","backpressure","memory-management","performance"],"exportEndpoints":{"claude":"/api/rules/bun-websocket-backpressure-drain-pipeline?format=claude","cursorMdc":"/api/rules/bun-websocket-backpressure-drain-pipeline?format=mdc","cursorrules":"/api/rules/bun-websocket-backpressure-drain-pipeline?format=cursor","windsurf":"/api/rules/bun-websocket-backpressure-drain-pipeline?format=windsurf","agents":"/api/rules/bun-websocket-backpressure-drain-pipeline?format=agents"}},{"id":"capacitor-7-swift-6-sendable-concurrency-bridge","title":"Swift 6 Strict Concurrency and Sendable Marshalling in Capacitor 7 Plugins","category":"mobile","severity":"critical","description":"Eliminates native Swift 6 data races and actor-boundary runtime panics during asynchronous plugin payload marshalling between WebKit and Capacitor 7. Enforces strict Sendable isolation, explicit @MainActor demarcation, and thread-safe JSObject serialization without unchecked concurrency escapes.","antiPatternHeadline":"Unchecked mutable bridging of CAPPluginCall and raw [String: Any] dictionaries across Swift 6 concurrency boundaries without Sendable conformance.","stars_count":76,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","swift6","concurrency","ios","webkit"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-swift-6-sendable-concurrency-bridge?format=claude","cursorMdc":"/api/rules/capacitor-7-swift-6-sendable-concurrency-bridge?format=mdc","cursorrules":"/api/rules/capacitor-7-swift-6-sendable-concurrency-bridge?format=cursor","windsurf":"/api/rules/capacitor-7-swift-6-sendable-concurrency-bridge?format=windsurf","agents":"/api/rules/capacitor-7-swift-6-sendable-concurrency-bridge?format=agents"}},{"id":"react-native-bridgeless-fabric-jsi-memory-lifetime-guardrail","title":"React Native Bridgeless Fabric JSI Host Object Lifetime & Teardown Guardrail","category":"mobile","severity":"critical","description":"Prevents C++ host-object use-after-free and dangling pointer memory corruption during rapid unmount-remount cycles within React Native Bridgeless Fabric architecture. Enforces synchronous teardown semantics, cancellation tokens, and explicit nullification of raw JSI object references before the JavaScript runtime context detaches from the shadow tree. Eliminates asynchronous callback re-entry crashes caused by unpinned C++ Turbomodule instances.","antiPatternHeadline":"Asynchronous invocation of raw JSI C++ HostObjects across unmount-remount cycles without cancellation or reference-pinning checks","stars_count":65,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","react-native","fabric","bridgeless","jsi","c++","memory-safety"],"exportEndpoints":{"claude":"/api/rules/react-native-bridgeless-fabric-jsi-memory-lifetime-guardrail?format=claude","cursorMdc":"/api/rules/react-native-bridgeless-fabric-jsi-memory-lifetime-guardrail?format=mdc","cursorrules":"/api/rules/react-native-bridgeless-fabric-jsi-memory-lifetime-guardrail?format=cursor","windsurf":"/api/rules/react-native-bridgeless-fabric-jsi-memory-lifetime-guardrail?format=windsurf","agents":"/api/rules/react-native-bridgeless-fabric-jsi-memory-lifetime-guardrail?format=agents"}},{"id":"oauth-dpop-nonce-rotation-binding","title":"OAuth 2.1 DPoP Token Binding and Server Nonce Rotation Invariant","category":"security","severity":"critical","description":"Enforces strict RFC 9449 Demonstrating Proof-of-Possession (DPoP) binding across API gateways by requiring asymmetric client-key validation, SHA-256 access token hash verification (`ath`), and distributed single-use nonce rotation. Mitigates token exfiltration and replay attacks by rejecting standard Bearer authorizations on protected endpoints and invalidating stale or unbound DPoP proof headers.","antiPatternHeadline":"Treating DPoP Proofs as Stateless Bearer Tokens Without Server Nonce Verification, Distributed Replay Detection, or Access Token Hash Binding","stars_count":118,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","oauth2","dpop","rfc9449","token-binding","api-gateway"],"exportEndpoints":{"claude":"/api/rules/oauth-dpop-nonce-rotation-binding?format=claude","cursorMdc":"/api/rules/oauth-dpop-nonce-rotation-binding?format=mdc","cursorrules":"/api/rules/oauth-dpop-nonce-rotation-binding?format=cursor","windsurf":"/api/rules/oauth-dpop-nonce-rotation-binding?format=windsurf","agents":"/api/rules/oauth-dpop-nonce-rotation-binding?format=agents"}},{"id":"cilium-ebpf-host-routing-wireguard-transit-invariant","title":"Cilium eBPF Host-Routing with Node-to-Node WireGuard Transit Invariant","category":"devops","severity":"critical","description":"Mandates Cilium eBPF host-routing mode paired with native node-to-node WireGuard encryption to achieve zero-overhead socket-layer inter-pod transit. Eliminates legacy Linux conntrack and iptables traversal by executing traffic routing directly within kernel socket and tc eBPF hooks while maintaining cryptographic transit isolation.","antiPatternHeadline":"Routing Pod Traffic via Legacy Iptables Conntrack and Geneve/VXLAN Overlays with Unencrypted Transit","stars_count":52,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["cilium","ebpf","wireguard","kubernetes","networking","cni","security"],"exportEndpoints":{"claude":"/api/rules/cilium-ebpf-host-routing-wireguard-transit-invariant?format=claude","cursorMdc":"/api/rules/cilium-ebpf-host-routing-wireguard-transit-invariant?format=mdc","cursorrules":"/api/rules/cilium-ebpf-host-routing-wireguard-transit-invariant?format=cursor","windsurf":"/api/rules/cilium-ebpf-host-routing-wireguard-transit-invariant?format=windsurf","agents":"/api/rules/cilium-ebpf-host-routing-wireguard-transit-invariant?format=agents"}},{"id":"nats-jetstream-deterministic-deduplication-window-partitioning","title":"Deterministic Deduplication Window Partitioning in NATS JetStream 2.11","category":"backend","severity":"critical","description":"Enforces strict broker-level sequence-pinned deduplication windows across distributed edge topologies in NATS JetStream 2.11+. Eliminates edge clock-drift anomalies and split-brain replays by partitioning deduplication keys by deterministic sequence boundaries, domain partitions, and bounded epoch buckets rather than volatile wall-clock intervals.","antiPatternHeadline":"Relying on Wall-Clock Timestamps and Ephemeral UUIDs for JetStream Deduplication Across Edge Topologies","stars_count":41,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","nats","jetstream","distributed-systems","edge-computing","idempotency"],"exportEndpoints":{"claude":"/api/rules/nats-jetstream-deterministic-deduplication-window-partitioning?format=claude","cursorMdc":"/api/rules/nats-jetstream-deterministic-deduplication-window-partitioning?format=mdc","cursorrules":"/api/rules/nats-jetstream-deterministic-deduplication-window-partitioning?format=cursor","windsurf":"/api/rules/nats-jetstream-deterministic-deduplication-window-partitioning?format=windsurf","agents":"/api/rules/nats-jetstream-deterministic-deduplication-window-partitioning?format=agents"}},{"id":"opentelemetry-ingress-baggage-sanitization-cardinality-gate","title":"OpenTelemetry Ingress Baggage Sanitization and Cardinality Gate Enforcement","category":"devops","severity":"critical","description":"Enforces strict validation, allowlisting, and cardinality bounds on W3C Baggage headers at ingress service boundaries. Prevents cross-tenant context injection, telemetry store index explosion, and memory exhaustion by stripping untrusted keys before propagating OpenTelemetry Context downstream.","antiPatternHeadline":"Blind Ingress Baggage Propagation Leading to Multi-Tenant Spoofing and Telemetry DoS","stars_count":80,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["opentelemetry","observability","security","distributed-tracing","devops","cardinality"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-ingress-baggage-sanitization-cardinality-gate?format=claude","cursorMdc":"/api/rules/opentelemetry-ingress-baggage-sanitization-cardinality-gate?format=mdc","cursorrules":"/api/rules/opentelemetry-ingress-baggage-sanitization-cardinality-gate?format=cursor","windsurf":"/api/rules/opentelemetry-ingress-baggage-sanitization-cardinality-gate?format=windsurf","agents":"/api/rules/opentelemetry-ingress-baggage-sanitization-cardinality-gate?format=agents"}},{"id":"vite-6-environment-api-isolation-boundary","title":"Vite 6 Environment API Multi-Runtime Isolation Boundary","category":"frontend","severity":"critical","description":"Enforces strict isolation of module graphs, resolution conditions, and transform pipelines across Edge, Node, and Workerd runtimes using the Vite 6 Environment API. Prevents cross-runtime symbol pollution, conflicting export conditions, and shared transform state in unified multi-target SSR compilations.","antiPatternHeadline":"Collapsing multi-target SSR compilation into a monolithic SSR pipeline with shared resolution conditions and cross-polluted transforms","stars_count":117,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","vite6","ssr","environment-api","workerd","edge-computing","module-resolution"],"exportEndpoints":{"claude":"/api/rules/vite-6-environment-api-isolation-boundary?format=claude","cursorMdc":"/api/rules/vite-6-environment-api-isolation-boundary?format=mdc","cursorrules":"/api/rules/vite-6-environment-api-isolation-boundary?format=cursor","windsurf":"/api/rules/vite-6-environment-api-isolation-boundary?format=windsurf","agents":"/api/rules/vite-6-environment-api-isolation-boundary?format=agents"}},{"id":"nextjs-15-coop-coep-isolation-shell","title":"Next.js 15 Cross-Origin Isolation (COOP/COEP) Shell Standard","category":"frontend","severity":"critical","description":"Enforces strict process-level browser isolation (Cross-Origin-Opener-Policy and Cross-Origin-Embedder-Policy) required for high-performance primitives such as SharedArrayBuffer and WebAssembly multi-threading in Next.js 15 App Router. Mandates that all federated layouts, edge middleware, and external asset loaders explicitly declare CORP/COEP headers to prevent render-tree lockouts and catastrophic iframe/asset degradation. Precludes cross-origin communication leakages and unauthorized cross-process memory inspection across federated boundary routes.","antiPatternHeadline":"Global COOP/COEP Header Ingestion Without CORP Boundary Management and Credential Handling","stars_count":82,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs15","security","webassembly","sharedarraybuffer","coop-coep"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-coop-coep-isolation-shell?format=claude","cursorMdc":"/api/rules/nextjs-15-coop-coep-isolation-shell?format=mdc","cursorrules":"/api/rules/nextjs-15-coop-coep-isolation-shell?format=cursor","windsurf":"/api/rules/nextjs-15-coop-coep-isolation-shell?format=windsurf","agents":"/api/rules/nextjs-15-coop-coep-isolation-shell?format=agents"}},{"id":"openfga-contextual-tuple-timeout-cycle-breaking-guardrail","title":"OpenFGA Contextual Tuple Evaluation Timeout & Cycle-Breaking Guardrail","category":"security","severity":"critical","description":"Enforces strict deadline propagation, cycle detection, and input cardinality bounds when executing OpenFGA authorization checks with contextual tuples. Prevents unbounded graph traversals, distributed resource exhaustion, and Denial-of-Service attacks triggered by circular group memberships or deep nested relational paths during dynamic authorization queries.","antiPatternHeadline":"Unbounded Contextual Tuples with Missing Deadlines Leading to Graph Traversals and Resource Exhaustion","stars_count":113,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","authorization","rebac","dos-prevention","circuit-breaker"],"exportEndpoints":{"claude":"/api/rules/openfga-contextual-tuple-timeout-cycle-breaking-guardrail?format=claude","cursorMdc":"/api/rules/openfga-contextual-tuple-timeout-cycle-breaking-guardrail?format=mdc","cursorrules":"/api/rules/openfga-contextual-tuple-timeout-cycle-breaking-guardrail?format=cursor","windsurf":"/api/rules/openfga-contextual-tuple-timeout-cycle-breaking-guardrail?format=windsurf","agents":"/api/rules/openfga-contextual-tuple-timeout-cycle-breaking-guardrail?format=agents"}},{"id":"fido2-largeblob-eviction-signature-continuity","title":"FIDO2 WebAuthn LargeBlob Storage Eviction & Signature Continuity Standard","category":"security","severity":"critical","description":"Enforces cryptographic envelope integrity, size-budget verification, and deterministic failover when persisting encrypted state to WebAuthn largeBlob hardware storage. Prevents silent write truncation, state desynchronization, and replay attacks across CTAP2 authenticator lifecycle events.","antiPatternHeadline":"Blindly overwriting or reading unversioned, unverified largeBlobs without payload size budgeting, write-status verification, or encrypted vault fallback.","stars_count":100,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","fido2","largeblob","cryptography","prf"],"exportEndpoints":{"claude":"/api/rules/fido2-largeblob-eviction-signature-continuity?format=claude","cursorMdc":"/api/rules/fido2-largeblob-eviction-signature-continuity?format=mdc","cursorrules":"/api/rules/fido2-largeblob-eviction-signature-continuity?format=cursor","windsurf":"/api/rules/fido2-largeblob-eviction-signature-continuity?format=windsurf","agents":"/api/rules/fido2-largeblob-eviction-signature-continuity?format=agents"}},{"id":"capacitor-7-native-biometric-thread-confinement-guardrail","title":"Capacitor 7 Native Biometric Bridge Thread Confinement and Lifecycle Token Invalidation","category":"mobile","severity":"critical","description":"Enforces strict thread-confinement for Capacitor 7 biometric authentication routines, ensuring native execution runs exclusively on serial background dispatch queues rather than the UI/main thread. Concurrently mandates atomic invalidation of volatile biometric session tokens upon app state transition to background or suspension, neutralizing session hijacking and lockup race conditions.","antiPatternHeadline":"Executing Biometric Prompts on the Main UI Thread Coupled with Persistent In-Memory Session Tokens Across App Suspension","stars_count":60,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor-7","biometrics","thread-safety","security","lifecycle"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-native-biometric-thread-confinement-guardrail?format=claude","cursorMdc":"/api/rules/capacitor-7-native-biometric-thread-confinement-guardrail?format=mdc","cursorrules":"/api/rules/capacitor-7-native-biometric-thread-confinement-guardrail?format=cursor","windsurf":"/api/rules/capacitor-7-native-biometric-thread-confinement-guardrail?format=windsurf","agents":"/api/rules/capacitor-7-native-biometric-thread-confinement-guardrail?format=agents"}},{"id":"postgres-17-incremental-backup-lsn-verification-standard","title":"Postgres 17 Block-Level Incremental Backup LSN Verification and Continuity Guardrail","category":"backend","severity":"critical","description":"Enforces strict LSN (Log Sequence Number) continuity validation, backup manifest cryptographic verification, and timeline integrity when orchestrating Postgres 17 native block-level incremental backups. Prevents broken backup chains, silent data loss, and failed disaster recovery workflows by mathematically guaranteeing prior-manifest parentage before and after invoking pg_basebackup with incremental mode.","antiPatternHeadline":"Executing Unverified Incremental Backups Against Invalid or Desynchronized Parent Manifests","stars_count":99,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","backup-recovery","pg-basebackup","database-reliability","lsn-verification"],"exportEndpoints":{"claude":"/api/rules/postgres-17-incremental-backup-lsn-verification-standard?format=claude","cursorMdc":"/api/rules/postgres-17-incremental-backup-lsn-verification-standard?format=mdc","cursorrules":"/api/rules/postgres-17-incremental-backup-lsn-verification-standard?format=cursor","windsurf":"/api/rules/postgres-17-incremental-backup-lsn-verification-standard?format=windsurf","agents":"/api/rules/postgres-17-incremental-backup-lsn-verification-standard?format=agents"}},{"id":"wasi-02-linear-memory-hard-cap-invariant","title":"WASI 0.2 Component Model Linear Memory Hard-Cap and Resource Limiter Invariant","category":"backend","severity":"critical","description":"Enforces strict per-instance linear memory allocation ceilings and deterministic trap semantics for multi-tenant WASI 0.2 components. Prevents untrusted guest code from exhausting host memory by mandating explicit Store-level ResourceLimiter configurations and bounded canonical ABI reallocations.","antiPatternHeadline":"Unbounded Wasm Instance Growth via Default Store Allocation and Missing ResourceLimiter Traps","stars_count":108,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","wasm","wasi-0-2","wasmtime","memory-isolation","multi-tenancy"],"exportEndpoints":{"claude":"/api/rules/wasi-02-linear-memory-hard-cap-invariant?format=claude","cursorMdc":"/api/rules/wasi-02-linear-memory-hard-cap-invariant?format=mdc","cursorrules":"/api/rules/wasi-02-linear-memory-hard-cap-invariant?format=cursor","windsurf":"/api/rules/wasi-02-linear-memory-hard-cap-invariant?format=windsurf","agents":"/api/rules/wasi-02-linear-memory-hard-cap-invariant?format=agents"}},{"id":"go-http3-0rtt-anti-replay-chi","title":"Go 1.24 HTTP/3 0-RTT Anti-Replay Cache Invariant in Chi Routers","category":"backend","severity":"critical","description":"Enforces strict gating of QUIC 0-RTT early data in Go 1.24 HTTP/3 Chi services to prevent state-mutating replay attacks. Replays of 0-RTT early data bypass TLS forward secrecy and can cause duplicate state mutations unless non-idempotent methods are rejected with HTTP 425 Too Early before handler context propagation.","antiPatternHeadline":"Permitting Unvalidated 0-RTT QUIC Early Data to Execute State-Mutating Chi Handlers","stars_count":52,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","http3","quic","chi","security","zero-rtt"],"exportEndpoints":{"claude":"/api/rules/go-http3-0rtt-anti-replay-chi?format=claude","cursorMdc":"/api/rules/go-http3-0rtt-anti-replay-chi?format=mdc","cursorrules":"/api/rules/go-http3-0rtt-anti-replay-chi?format=cursor","windsurf":"/api/rules/go-http3-0rtt-anti-replay-chi?format=windsurf","agents":"/api/rules/go-http3-0rtt-anti-replay-chi?format=agents"}},{"id":"pg17-logical-failover-slot-sync-read-routing","title":"PostgreSQL 17 Logical Failover Slot Sync & Causal Read Routing Standard","category":"backend","severity":"critical","description":"Mandates failover-enabled logical replication slots (`failover = true`), primary physical synchronization gating via `standby_slot_names`, and causal LSN-tracked read routing in PostgreSQL 17. Eliminates WAL retention truncation, CDC stream starvation, and stale replica reads during physical primary failovers.","antiPatternHeadline":"Unsynchronized Logical Slots and Uncoordinated Read Dispatch Causing Consumer Drop and Replication Desynchronization","stars_count":71,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql-17","logical-replication","failover-slots","read-routing","cdc"],"exportEndpoints":{"claude":"/api/rules/pg17-logical-failover-slot-sync-read-routing?format=claude","cursorMdc":"/api/rules/pg17-logical-failover-slot-sync-read-routing?format=mdc","cursorrules":"/api/rules/pg17-logical-failover-slot-sync-read-routing?format=cursor","windsurf":"/api/rules/pg17-logical-failover-slot-sync-read-routing?format=windsurf","agents":"/api/rules/pg17-logical-failover-slot-sync-read-routing?format=agents"}},{"id":"react-19-server-actions-nonce-idempotency-pipeline","title":"React 19 Flight Stream Nonce-Binding and Idempotency Architecture","category":"frontend","severity":"critical","description":"Enforces cryptographic nonce binding and atomic idempotency locks for all mutating React 19 Server Actions across the RSC Flight stream wire protocol. Prevents catastrophic double-commits, phantom mutations, and non-repudiation failures during transient transport resets or browser-level retry cascades.","antiPatternHeadline":"Naked Server Action Submissions Vulnerable to Flight Stream Retries and Duplicate Mutation Commits","stars_count":49,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","server-actions","flight-protocol","idempotency","security"],"exportEndpoints":{"claude":"/api/rules/react-19-server-actions-nonce-idempotency-pipeline?format=claude","cursorMdc":"/api/rules/react-19-server-actions-nonce-idempotency-pipeline?format=mdc","cursorrules":"/api/rules/react-19-server-actions-nonce-idempotency-pipeline?format=cursor","windsurf":"/api/rules/react-19-server-actions-nonce-idempotency-pipeline?format=windsurf","agents":"/api/rules/react-19-server-actions-nonce-idempotency-pipeline?format=agents"}},{"id":"go-iter-seq-deterministic-resource-teardown","title":"Go 1.24 iter.Seq Deterministic Resource Teardown and Goroutine Leak Prevention","category":"backend","severity":"critical","description":"Enforces deterministic resource cleanup and goroutine leak prevention within Go 1.24 range-over-func push (`iter.Seq`, `iter.Seq2`) and pull (`iter.Pull`, `iter.Pull2`) iterators. Guarantees that when consumer loops break early, iterator yields halt immediately, `defer` blocks execute without truncation, and pull iterator `stop()` callbacks are registered to tear down producer goroutines.","antiPatternHeadline":"Ignoring yield() False Returns and Omitting iter.Pull stop() Teardown, Causing Leaked Goroutines and Orphaned Handles","stars_count":95,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","iterators","concurrency","goroutine-leak","resource-management","go124"],"exportEndpoints":{"claude":"/api/rules/go-iter-seq-deterministic-resource-teardown?format=claude","cursorMdc":"/api/rules/go-iter-seq-deterministic-resource-teardown?format=mdc","cursorrules":"/api/rules/go-iter-seq-deterministic-resource-teardown?format=cursor","windsurf":"/api/rules/go-iter-seq-deterministic-resource-teardown?format=windsurf","agents":"/api/rules/go-iter-seq-deterministic-resource-teardown?format=agents"}},{"id":"kmp-swift6-strict-concurrency-boundary","title":"Kotlin 2.1 & Swift 6 Strict Concurrency Memory Isolation Boundary","category":"mobile","severity":"critical","description":"Enforces strict memory isolation and transfer boundaries between Kotlin Multiplatform 2.1 native runtimes and Swift 6 complete concurrency actors. Prevents fatal SIGSEGV memory faults, undefined ARC deallocations, and data races caused by bridging non-Sendable Objective-C/Kotlin references across Swift cooperative thread pools.","antiPatternHeadline":"Passing Mutable Kotlin Objects or Unbounded Native Coroutine Scopes Directly Across Swift 6 Actor Boundaries","stars_count":76,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","swift-6","concurrency","sendable","memory-safety"],"exportEndpoints":{"claude":"/api/rules/kmp-swift6-strict-concurrency-boundary?format=claude","cursorMdc":"/api/rules/kmp-swift6-strict-concurrency-boundary?format=mdc","cursorrules":"/api/rules/kmp-swift6-strict-concurrency-boundary?format=cursor","windsurf":"/api/rules/kmp-swift6-strict-concurrency-boundary?format=windsurf","agents":"/api/rules/kmp-swift6-strict-concurrency-boundary?format=agents"}},{"id":"otel-arrow-ingestion-columnar-memory-bounds","title":"OpenTelemetry Arrow Protocol Ingestion with Strict Columnar Memory Bounds","category":"devops","severity":"critical","description":"High-throughput OpenTelemetry ingestion pipelines utilizing the OTel-Arrow protocol must enforce strict off-heap columnar memory boundaries and backpressure controls. Bypassing Arrow Flight stream limits or omitting early-stage memory limiters causes uncontrolled schema dilation, columnar buffer fragmentation, and catastrophic stop-the-world garbage collection pauses.","antiPatternHeadline":"Unbounded Arrow Flight RPC Streams Without Off-Heap Memory Limiter and Columnar Batch Slicing","stars_count":59,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","apache-arrow","grpc","memory-management"],"exportEndpoints":{"claude":"/api/rules/otel-arrow-ingestion-columnar-memory-bounds?format=claude","cursorMdc":"/api/rules/otel-arrow-ingestion-columnar-memory-bounds?format=mdc","cursorrules":"/api/rules/otel-arrow-ingestion-columnar-memory-bounds?format=cursor","windsurf":"/api/rules/otel-arrow-ingestion-columnar-memory-bounds?format=windsurf","agents":"/api/rules/otel-arrow-ingestion-columnar-memory-bounds?format=agents"}},{"id":"pqc-mlkem768-hybrid-tls-guardrail","title":"ML-KEM-768 Hybrid Key Exchange Invariant for Post-Quantum TLS 1.3","category":"security","severity":"critical","description":"Enforces dual-layer hybrid key exchange (X25519 + ML-KEM-768) over TLS 1.3 across high-assurance network boundaries to defeat Harvest-Now-Decrypt-Later (HNDL) adversary strategies. Mandates strict TLS 1.3 protocol versions, enforces quantum-resistant key-share ordering, and strictly prevents downgrade to pure classical asymmetric key encapsulation mechanisms.","antiPatternHeadline":"Configuring classical-only elliptic curves or permitting silent downgrade below ML-KEM-768 hybrid groups in TLS 1.3 handshakes","stars_count":97,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","cryptography","post-quantum","tls-1-3","ml-kem-768","zero-trust"],"exportEndpoints":{"claude":"/api/rules/pqc-mlkem768-hybrid-tls-guardrail?format=claude","cursorMdc":"/api/rules/pqc-mlkem768-hybrid-tls-guardrail?format=mdc","cursorrules":"/api/rules/pqc-mlkem768-hybrid-tls-guardrail?format=cursor","windsurf":"/api/rules/pqc-mlkem768-hybrid-tls-guardrail?format=windsurf","agents":"/api/rules/pqc-mlkem768-hybrid-tls-guardrail?format=agents"}},{"id":"fastapi-anyio-taskgroup-cancellation-standard","title":"FastAPI AnyIO Structured TaskGroup & ExceptionGroup Propagation Standard","category":"backend","severity":"critical","description":"Enforces structured concurrency across asynchronous FastAPI endpoints and background routines using AnyIO TaskGroups and Python 3.11+ ExceptionGroups. Guarantees cooperative cancellation across concurrent subtasks when any subtask faults, eliminating orphaned processes, dangling database sessions, and silent background resource leaks.","antiPatternHeadline":"Unsupervised asyncio.create_task Spawning and Bare Exception Catching Causing Orphaned Worker Proliferation","stars_count":59,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","anyio","asyncio","structured-concurrency","python"],"exportEndpoints":{"claude":"/api/rules/fastapi-anyio-taskgroup-cancellation-standard?format=claude","cursorMdc":"/api/rules/fastapi-anyio-taskgroup-cancellation-standard?format=mdc","cursorrules":"/api/rules/fastapi-anyio-taskgroup-cancellation-standard?format=cursor","windsurf":"/api/rules/fastapi-anyio-taskgroup-cancellation-standard?format=windsurf","agents":"/api/rules/fastapi-anyio-taskgroup-cancellation-standard?format=agents"}},{"id":"tanstack-router-search-param-canonicalization","title":"TanStack Router Type-Safe URL Search Parameter Canonicalization & Validation Invariant","category":"frontend","severity":"critical","description":"Enforces strict runtime structural validation and sanitization on all TanStack Router search parameters via validated schemas in the validateSearch hook. Prevents unvalidated search params from triggering open redirects, bypassing access controls, injecting script vectors into DOM sinks, or corrupting client-side state.","antiPatternHeadline":"Type Casting Unvalidated Search Params Leading to Client-Side State Injection and XSS Vulnerabilities","stars_count":107,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","tanstack-router","search-params","zod","xss-prevention","type-safety","app-security"],"exportEndpoints":{"claude":"/api/rules/tanstack-router-search-param-canonicalization?format=claude","cursorMdc":"/api/rules/tanstack-router-search-param-canonicalization?format=mdc","cursorrules":"/api/rules/tanstack-router-search-param-canonicalization?format=cursor","windsurf":"/api/rules/tanstack-router-search-param-canonicalization?format=windsurf","agents":"/api/rules/tanstack-router-search-param-canonicalization?format=agents"}},{"id":"android-15-predictive-back-compose-navigation-invariant","title":"Decoupling Predictive Back Speculative Rendering from Jetpack Compose Navigation Commits","category":"mobile","severity":"critical","description":"Enforces deterministic separation between Android 15 Predictive Back speculative gesture progress animations and architectural backstack state transitions in Jetpack Compose. Prevents UI state desynchronization, ghost view states, and frame drops caused by mutating navigation state during uncommitted or cancelled back gestures.","antiPatternHeadline":"Mutating Backstack or Screen ViewModel State on Predictive Back Gesture Progress Events","stars_count":41,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","android","jetpack-compose","predictive-back","navigation-compose","android-15"],"exportEndpoints":{"claude":"/api/rules/android-15-predictive-back-compose-navigation-invariant?format=claude","cursorMdc":"/api/rules/android-15-predictive-back-compose-navigation-invariant?format=mdc","cursorrules":"/api/rules/android-15-predictive-back-compose-navigation-invariant?format=cursor","windsurf":"/api/rules/android-15-predictive-back-compose-navigation-invariant?format=windsurf","agents":"/api/rules/android-15-predictive-back-compose-navigation-invariant?format=agents"}},{"id":"svelte-5-runes-cyclic-mutation-fence","title":"Svelte 5 Runes Reactive Graph Cyclic Mutation Fence","category":"frontend","severity":"critical","description":"Enforces strict computation purity within Svelte 5 `$derived` and `$derived.by` runes to safeguard the push-pull reactive graph. Unbatched signal mutations, deep object state writes, and implicit side effects within derived calculations cause dependency graph thrashing, non-deterministic re-evaluations, and catastrophic circular update loops in complex single-page architectures. Computations must remain referentially transparent projections of state, offloading mutations exclusively to explicit user event handlers or untracked `$effect` fences.","antiPatternHeadline":"Mutating Root or Proxied $state Signals Directly Inside $derived Computations","stars_count":41,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["svelte5","runes","reactivity","fine-grained-reactivity","state-management"],"exportEndpoints":{"claude":"/api/rules/svelte-5-runes-cyclic-mutation-fence?format=claude","cursorMdc":"/api/rules/svelte-5-runes-cyclic-mutation-fence?format=mdc","cursorrules":"/api/rules/svelte-5-runes-cyclic-mutation-fence?format=cursor","windsurf":"/api/rules/svelte-5-runes-cyclic-mutation-fence?format=windsurf","agents":"/api/rules/svelte-5-runes-cyclic-mutation-fence?format=agents"}},{"id":"fastapi-pydanticv2-zerocopy-buffer-deserialization-standard","title":"FastAPI Pydantic V2 Zero-Copy Buffer Deserialization Standard","category":"backend","severity":"critical","description":"Mandates parsing high-throughput HTTP payloads directly from raw contiguous byte buffers using Pydantic V2's Rust-backed deserializer (`model_validate_json`) rather than intermediate Python dictionaries or Starlette's `Request.json()`. Prevents severe event-loop stalls, intermediate heap object explosion, and garbage collection pauses in gigabit-scale ingress services.","antiPatternHeadline":"Intermediate Python Dict Construction & Double-Validation via request.json() or Dict-Based Body Ingestion","stars_count":109,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","pydantic-v2","performance","zero-copy","rust-interop"],"exportEndpoints":{"claude":"/api/rules/fastapi-pydanticv2-zerocopy-buffer-deserialization-standard?format=claude","cursorMdc":"/api/rules/fastapi-pydanticv2-zerocopy-buffer-deserialization-standard?format=mdc","cursorrules":"/api/rules/fastapi-pydanticv2-zerocopy-buffer-deserialization-standard?format=cursor","windsurf":"/api/rules/fastapi-pydanticv2-zerocopy-buffer-deserialization-standard?format=windsurf","agents":"/api/rules/fastapi-pydanticv2-zerocopy-buffer-deserialization-standard?format=agents"}},{"id":"go-chi-context-bound-pool-drain-invariant","title":"Go 1.24 Chi Context-Bound Goroutine Pool Drain Invariant","category":"backend","severity":"critical","description":"Enforces deterministic cancellation propagation from Chi HTTP request contexts into all bounded goroutine pools and fan-out worker pipelines. Prevents orphaned database transactions, lingering connection leases, and hung upstream sockets by mandating context-aware dispatching, select-guarded channel writes, and strict errgroup drain mechanics on client disconnect.","antiPatternHeadline":"Spawning uncoordinated goroutines or enqueuing work with detached contexts inside Chi HTTP request lifecycles","stars_count":45,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","chi","concurrency","goroutines","errgroup","context"],"exportEndpoints":{"claude":"/api/rules/go-chi-context-bound-pool-drain-invariant?format=claude","cursorMdc":"/api/rules/go-chi-context-bound-pool-drain-invariant?format=mdc","cursorrules":"/api/rules/go-chi-context-bound-pool-drain-invariant?format=cursor","windsurf":"/api/rules/go-chi-context-bound-pool-drain-invariant?format=windsurf","agents":"/api/rules/go-chi-context-bound-pool-drain-invariant?format=agents"}},{"id":"kmp-structured-concurrency-lifetime-boundary","title":"Kotlin Multiplatform 2.1 Structured Concurrency & Native Lifetime Cancellation Boundary","category":"mobile","severity":"critical","description":"Mandates strict lifecycle-bound CoroutineScope termination and bidirectional cancellation propagation across Android ViewModels and Swift/Objective-C interop runtimes. Prohibits detached jobs, unbound GlobalScope invocations, and manual un-bridged async calls to eliminate native heap leaks, uncollected Kotlin/Native reference graphs, and zombie network dispatches.","antiPatternHeadline":"Unbound Coroutine Bridging Yielding Zombie Tasks and Swift/Native Memory Leaks","stars_count":72,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","coroutines","swift","structured-concurrency","memory-leaks"],"exportEndpoints":{"claude":"/api/rules/kmp-structured-concurrency-lifetime-boundary?format=claude","cursorMdc":"/api/rules/kmp-structured-concurrency-lifetime-boundary?format=mdc","cursorrules":"/api/rules/kmp-structured-concurrency-lifetime-boundary?format=cursor","windsurf":"/api/rules/kmp-structured-concurrency-lifetime-boundary?format=windsurf","agents":"/api/rules/kmp-structured-concurrency-lifetime-boundary?format=agents"}},{"id":"tauri2-ipc-binary-channel-chunking-standard","title":"Tauri 2.0 IPC Scoped Binary Channel Chunking Standard","category":"mobile","severity":"critical","description":"Enforces isolated, chunked binary streaming via Tauri 2.0 Channel primitives for large filesystem and high-frequency sensor payloads on mobile targets. Eliminates main-thread UI thread locks, JNI/WebKit bridge serialization saturation, and Out-Of-Memory (OOM) aborts caused by monolithic base64 or JSON marshalling. Mandates strict backpressure, bounded frame allocations, and explicit channel lifecycle cleanup.","antiPatternHeadline":"Monolithic Base64 Serialization or Unchunked Direct IPC Invocations for Large Payloads","stars_count":81,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri-2","ipc","performance","binary-streams","rust"],"exportEndpoints":{"claude":"/api/rules/tauri2-ipc-binary-channel-chunking-standard?format=claude","cursorMdc":"/api/rules/tauri2-ipc-binary-channel-chunking-standard?format=mdc","cursorrules":"/api/rules/tauri2-ipc-binary-channel-chunking-standard?format=cursor","windsurf":"/api/rules/tauri2-ipc-binary-channel-chunking-standard?format=windsurf","agents":"/api/rules/tauri2-ipc-binary-channel-chunking-standard?format=agents"}},{"id":"webauthn-l3-passkey-origin-binding-guardrail","title":"WebAuthn Level 3 Device-Bound Passkey Origin Binding & Iframe Isolation","category":"security","severity":"critical","description":"Enforces strict W3C WebAuthn Level 3 cryptographic verification of Relying Party ID (rpId) and clientDataJSON origin bindings across all passkey registration and authentication ceremonies. Neutralizes cross-origin iframe exfiltration, adversarial session fixation, and federated phishing vectors by mandating top-level document fences and canonical origin matching on the server. Prevents reliance on client-controlled Host headers and insecure iframe delegates without strict Permissions-Policy directives.","antiPatternHeadline":"Trusting Client-Supplied Origin Headers and Permitting WebAuthn in Cross-Origin Iframes","stars_count":55,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","passkeys","fido2","origin-binding","rp-id","zero-trust"],"exportEndpoints":{"claude":"/api/rules/webauthn-l3-passkey-origin-binding-guardrail?format=claude","cursorMdc":"/api/rules/webauthn-l3-passkey-origin-binding-guardrail?format=mdc","cursorrules":"/api/rules/webauthn-l3-passkey-origin-binding-guardrail?format=cursor","windsurf":"/api/rules/webauthn-l3-passkey-origin-binding-guardrail?format=windsurf","agents":"/api/rules/webauthn-l3-passkey-origin-binding-guardrail?format=agents"}},{"id":"ebpf-xdp-syn-flood-early-drop-invariants","title":"eBPF XDP Dynamic Layer 4 SYN Flood Early-Drop Filter Invariants","category":"devops","severity":"critical","description":"Mandates kernel-space Layer 4 ingress filtering at the eBPF XDP driver hook before sk_buff allocation. Enforces strict linear packet boundary verification, lockless per-CPU tracking maps, and kernel helper SYN cookie validation to eliminate host socket table and netfilter connection-tracking exhaustion under volumetric attacks.","antiPatternHeadline":"Delegating SYN flood defense to iptables/nftables or user-space proxies after kernel sk_buff allocation has already occurred.","stars_count":60,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","xdp","networking","ddos-mitigation","kernel","linux"],"exportEndpoints":{"claude":"/api/rules/ebpf-xdp-syn-flood-early-drop-invariants?format=claude","cursorMdc":"/api/rules/ebpf-xdp-syn-flood-early-drop-invariants?format=mdc","cursorrules":"/api/rules/ebpf-xdp-syn-flood-early-drop-invariants?format=cursor","windsurf":"/api/rules/ebpf-xdp-syn-flood-early-drop-invariants?format=windsurf","agents":"/api/rules/ebpf-xdp-syn-flood-early-drop-invariants?format=agents"}},{"id":"otel-exponential-histogram-dynamic-scale-governor","title":"OpenTelemetry Exponential Histogram Dynamic Scale Governor Standard","category":"devops","severity":"critical","description":"Enforces strict bounds and dynamic downscaling on OpenTelemetry Exponential Histograms at both the SDK and OpenTelemetry Collector boundaries. Prevents catastrophic cardinality explosions and memory exhaustion in TSDB backends during severe tail-latency anomalies by constraining max bucket allocation and scale factors.","antiPatternHeadline":"Unbounded Exponential Histogram Scales Inducing OOM Panics and TSDB Write Rejection","stars_count":107,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","metrics","cardinality","observability","reliability"],"exportEndpoints":{"claude":"/api/rules/otel-exponential-histogram-dynamic-scale-governor?format=claude","cursorMdc":"/api/rules/otel-exponential-histogram-dynamic-scale-governor?format=mdc","cursorrules":"/api/rules/otel-exponential-histogram-dynamic-scale-governor?format=cursor","windsurf":"/api/rules/otel-exponential-histogram-dynamic-scale-governor?format=windsurf","agents":"/api/rules/otel-exponential-histogram-dynamic-scale-governor?format=agents"}},{"id":"react-19-server-action-cryptographic-nonce-invariant","title":"React 19 Server Action Cryptographic Idempotency Nonce and Anti-CSRF Invariant","category":"security","severity":"critical","description":"Mandates cryptographically signed, single-use, short-lived session nonces on all React 19 Server Actions executing state-mutating operations. Neutralizes blind cross-site request forgery (CSRF) via native progressive enhancement form submissions and prevents malicious transaction replay or double-execution attacks through atomic nonce consumption.","antiPatternHeadline":"Naked 'use server' Mutation Boundaries Exposed to Blind Cross-Site Request Forgery and Replay Attacks","stars_count":61,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","react-19","server-actions","csrf","idempotency","cryptography"],"exportEndpoints":{"claude":"/api/rules/react-19-server-action-cryptographic-nonce-invariant?format=claude","cursorMdc":"/api/rules/react-19-server-action-cryptographic-nonce-invariant?format=mdc","cursorrules":"/api/rules/react-19-server-action-cryptographic-nonce-invariant?format=cursor","windsurf":"/api/rules/react-19-server-action-cryptographic-nonce-invariant?format=windsurf","agents":"/api/rules/react-19-server-action-cryptographic-nonce-invariant?format=agents"}},{"id":"openfga-bounded-rebac-subgraph-expansion","title":"OpenFGA Bounded ReBAC Sub-Graph Expansion Guardrail","category":"security","severity":"critical","description":"Enforces bounded traversal depth, cycle detection, and strict concurrency limits on OpenFGA Relationship-Based Access Control (ReBAC) evaluations. Prevents catastrophic denial of service, memory exhaustion, and tail-latency spikes caused by unbounded transitive resolution over deep organizational hierarchies.","antiPatternHeadline":"Unbounded recursive group or folder inheritance causing cascading OpenFGA resolution timeouts and engine thread starvation","stars_count":63,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","rebac","authorization","performance","resilience"],"exportEndpoints":{"claude":"/api/rules/openfga-bounded-rebac-subgraph-expansion?format=claude","cursorMdc":"/api/rules/openfga-bounded-rebac-subgraph-expansion?format=mdc","cursorrules":"/api/rules/openfga-bounded-rebac-subgraph-expansion?format=cursor","windsurf":"/api/rules/openfga-bounded-rebac-subgraph-expansion?format=windsurf","agents":"/api/rules/openfga-bounded-rebac-subgraph-expansion?format=agents"}},{"id":"fastapi-anyio-taskgroup-exception-propagation-standard","title":"FastAPI AnyIO Structured TaskGroup Exception Propagation and Cancellation Standard","category":"backend","severity":"critical","description":"Enforces deterministic handling and explicit unrolling of multi-child ExceptionGroups across request-scoped AnyIO TaskGroups in FastAPI services. Prevents silently swallowed coroutine cancellations, hidden subtask panics, and zombie background worker states through strict isolation and shield invariants.","antiPatternHeadline":"Swallowing BaseExceptions or Blindly Catching Top-Level Exception Around AnyIO TaskGroups","stars_count":62,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","anyio","asyncio","concurrency","exception-handling","python"],"exportEndpoints":{"claude":"/api/rules/fastapi-anyio-taskgroup-exception-propagation-standard?format=claude","cursorMdc":"/api/rules/fastapi-anyio-taskgroup-exception-propagation-standard?format=mdc","cursorrules":"/api/rules/fastapi-anyio-taskgroup-exception-propagation-standard?format=cursor","windsurf":"/api/rules/fastapi-anyio-taskgroup-exception-propagation-standard?format=windsurf","agents":"/api/rules/fastapi-anyio-taskgroup-exception-propagation-standard?format=agents"}},{"id":"kmp-main-actor-thread-affinity-guardrail","title":"KMP Compose Main-Actor Thread Affinity & Dispatcher Boundary Enforcement","category":"mobile","severity":"critical","description":"Enforces strict compile-time and runtime isolation boundaries between native platform dispatchers and shared Compose Multiplatform UI trees. Prevents cross-thread UI mutations, iOS Darwin main queue deadlocks, and background freeze panics caused by leaking non-Main dispatchers into ViewModel state holders.","antiPatternHeadline":"Dispatching Mutable UI State Updates on Non-Main Dispatchers Across iOS and Desktop Targets","stars_count":107,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","compose-multiplatform","coroutines","thread-safety","ios"],"exportEndpoints":{"claude":"/api/rules/kmp-main-actor-thread-affinity-guardrail?format=claude","cursorMdc":"/api/rules/kmp-main-actor-thread-affinity-guardrail?format=mdc","cursorrules":"/api/rules/kmp-main-actor-thread-affinity-guardrail?format=cursor","windsurf":"/api/rules/kmp-main-actor-thread-affinity-guardrail?format=windsurf","agents":"/api/rules/kmp-main-actor-thread-affinity-guardrail?format=agents"}},{"id":"webauthn-level3-prf-symmetric-key-derivation-standard","title":"WebAuthn Level 3 PRF Symmetric Key Derivation & Zero-Knowledge Vault Standard","category":"security","severity":"critical","description":"Enforces strict cryptographic invariants when deriving zero-knowledge symmetric vault keys using the WebAuthn Level 3 PRF (Pseudo-Random Function) extension. Requires HKDF domain separation, enforces non-extractable CryptoKey handles, and forbids transmission of PRF material to Relying Parties.","antiPatternHeadline":"Exfiltrating PRF output to Relying Party backends or directly using raw PRF buffers as cipher keys without HKDF expansion.","stars_count":68,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","prf-extension","web-crypto","hkdf","zero-knowledge","aes-gcm"],"exportEndpoints":{"claude":"/api/rules/webauthn-level3-prf-symmetric-key-derivation-standard?format=claude","cursorMdc":"/api/rules/webauthn-level3-prf-symmetric-key-derivation-standard?format=mdc","cursorrules":"/api/rules/webauthn-level3-prf-symmetric-key-derivation-standard?format=cursor","windsurf":"/api/rules/webauthn-level3-prf-symmetric-key-derivation-standard?format=windsurf","agents":"/api/rules/webauthn-level3-prf-symmetric-key-derivation-standard?format=agents"}},{"id":"opentelemetry-span-link-async-event-streams","title":"OpenTelemetry Span Link Lineage for Asynchronous Event Streams","category":"devops","severity":"critical","description":"Mandates non-hierarchical OpenTelemetry Span Links instead of direct parent-child span parenting in partitioned asynchronous event consumers (e.g., Kafka, RabbitMQ). Directly parenting consumer loops to incoming message trace contexts causes unbounded distributed trace graph bloat, skewed latency calculations, and incorrect causal dependency representations.","antiPatternHeadline":"Hierarchical Parent-Child Span Context Chaining in Batched Event Stream Consumers","stars_count":59,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","distributed-tracing","kafka","rabbitmq","observability"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-span-link-async-event-streams?format=claude","cursorMdc":"/api/rules/opentelemetry-span-link-async-event-streams?format=mdc","cursorrules":"/api/rules/opentelemetry-span-link-async-event-streams?format=cursor","windsurf":"/api/rules/opentelemetry-span-link-async-event-streams?format=windsurf","agents":"/api/rules/opentelemetry-span-link-async-event-streams?format=agents"}},{"id":"cilium-ebpf-tc-tail-call-stack-budget","title":"Cilium eBPF TC Tail-Call Stack Frame Depth Budget Standard","category":"devops","severity":"critical","description":"Enforces strict limits on eBPF Traffic Control (TC) stack allocations (<256 bytes per frame) and deterministic tail-call invocation chains (<32 hops). Prevents kernel BPF verifier rejections and tail-call JIT stack frame exhaustion that cause silent packet drops during Cilium service mesh routing.","antiPatternHeadline":"Exceeding 512-Byte Verifier Stack Ceilings and Unbounded Tail-Call Chaining in TC Datapaths","stars_count":101,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","cilium","kernel","networking","tc","service-mesh"],"exportEndpoints":{"claude":"/api/rules/cilium-ebpf-tc-tail-call-stack-budget?format=claude","cursorMdc":"/api/rules/cilium-ebpf-tc-tail-call-stack-budget?format=mdc","cursorrules":"/api/rules/cilium-ebpf-tc-tail-call-stack-budget?format=cursor","windsurf":"/api/rules/cilium-ebpf-tc-tail-call-stack-budget?format=windsurf","agents":"/api/rules/cilium-ebpf-tc-tail-call-stack-budget?format=agents"}},{"id":"svelte-5-runes-reactive-isolation-boundary-standard","title":"Svelte 5 Runes Reactive Isolation Boundary Standard Across Micro-Frontends","category":"frontend","severity":"critical","description":"Enforces strict isolation boundaries when exposing or consuming Svelte 5 reactive rune graphs across host-remote micro-frontend architectures. Prevents cross-instance signal retention leaks and unbounded cascading re-renders by mandating immutable snapshots ($state.snapshot) and untracked proxy adapters at federation seams.","antiPatternHeadline":"Cross-Boundary Signal Leakage and Cascading Render Storms via Direct $state Proxy Exposure","stars_count":116,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","micro-frontends","module-federation","memory-leaks"],"exportEndpoints":{"claude":"/api/rules/svelte-5-runes-reactive-isolation-boundary-standard?format=claude","cursorMdc":"/api/rules/svelte-5-runes-reactive-isolation-boundary-standard?format=mdc","cursorrules":"/api/rules/svelte-5-runes-reactive-isolation-boundary-standard?format=cursor","windsurf":"/api/rules/svelte-5-runes-reactive-isolation-boundary-standard?format=windsurf","agents":"/api/rules/svelte-5-runes-reactive-isolation-boundary-standard?format=agents"}},{"id":"react-19-server-action-abortsignal-backpressure","title":"React 19 Server Action Backpressure & AbortSignal Propagation Guardrail","category":"frontend","severity":"critical","description":"Enforces strict AbortSignal binding and cancellation tokens across React 19 concurrent transitions and Server Actions. Prevents phantom background writes, stale state overwrites, and desynchronized optimistic UI by halting upstream RPCs and database transactions when client transitions are superseded or aborted.","antiPatternHeadline":"Uncancellable Fire-and-Forget Server Actions Overwriting Fresh State After Client Navigation","stars_count":45,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","server-actions","abort-controller","optimistic-ui","concurrency"],"exportEndpoints":{"claude":"/api/rules/react-19-server-action-abortsignal-backpressure?format=claude","cursorMdc":"/api/rules/react-19-server-action-abortsignal-backpressure?format=mdc","cursorrules":"/api/rules/react-19-server-action-abortsignal-backpressure?format=cursor","windsurf":"/api/rules/react-19-server-action-abortsignal-backpressure?format=windsurf","agents":"/api/rules/react-19-server-action-abortsignal-backpressure?format=agents"}},{"id":"axum-epoll-graceful-connection-draining","title":"Axum 0.8 Epoll-Aware Zero-Loss Connection Draining Standard","category":"backend","severity":"critical","description":"Guarantees zero-loss termination of active Server-Sent Events (SSE) and HTTP/2 multiplexed streams during rolling pod replacements. Enforces coordinated dual-phase graceful shutdown via Tokio cancellation tokens and hyper connection tracking to prevent TCP RST generation and truncated stream frames.","antiPatternHeadline":"Naive Axum serve termination hanging on infinite SSE streams until Kubernetes SIGKILL emits TCP RSTs","stars_count":50,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tokio","http2","sse","kubernetes","networking"],"exportEndpoints":{"claude":"/api/rules/axum-epoll-graceful-connection-draining?format=claude","cursorMdc":"/api/rules/axum-epoll-graceful-connection-draining?format=mdc","cursorrules":"/api/rules/axum-epoll-graceful-connection-draining?format=cursor","windsurf":"/api/rules/axum-epoll-graceful-connection-draining?format=windsurf","agents":"/api/rules/axum-epoll-graceful-connection-draining?format=agents"}},{"id":"postgres-17-json-table-parallel-worker-memory-fencing","title":"Postgres 17 JSON_TABLE Parallel Worker Memory Fencing","category":"backend","severity":"critical","description":"Enforces transaction-scoped dynamic work_mem calculation and parallel worker fences for SQL/JSON transformations using PostgreSQL 17 JSON_TABLE. Unbounded parallel query plans executing memory-intensive JSON unpacking lead to multiplicative work_mem allocation across worker nodes, triggering Linux OOM-killer termination of Postgres backends.","antiPatternHeadline":"Global Uncapped work_mem with Unconstrained max_parallel_workers Under JSON_TABLE Scans","stars_count":44,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres-17","json-table","memory-management","sql-json","concurrency"],"exportEndpoints":{"claude":"/api/rules/postgres-17-json-table-parallel-worker-memory-fencing?format=claude","cursorMdc":"/api/rules/postgres-17-json-table-parallel-worker-memory-fencing?format=mdc","cursorrules":"/api/rules/postgres-17-json-table-parallel-worker-memory-fencing?format=cursor","windsurf":"/api/rules/postgres-17-json-table-parallel-worker-memory-fencing?format=windsurf","agents":"/api/rules/postgres-17-json-table-parallel-worker-memory-fencing?format=agents"}},{"id":"compose-multiplatform-ios-cadisplaylink-vsync-invariant","title":"Compose Multiplatform iOS CADisplayLink VSync & ProMotion Refresh Invariant","category":"mobile","severity":"critical","description":"Enforces deterministic synchronization between the Skiko rendering pipeline and iOS native CADisplayLink. Prevents thermal throttling, visual tearing, and micro-stutter by binding draw passes to hardware VSync signals and dynamically configuring CAFrameRateRange for ProMotion displays.","antiPatternHeadline":"Free-running coroutine render loop bypassing CADisplayLink and causing battery drainage and frame drops","stars_count":85,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","compose-multiplatform","ios","skiko","promotion","cadisplaylink","metal"],"exportEndpoints":{"claude":"/api/rules/compose-multiplatform-ios-cadisplaylink-vsync-invariant?format=claude","cursorMdc":"/api/rules/compose-multiplatform-ios-cadisplaylink-vsync-invariant?format=mdc","cursorrules":"/api/rules/compose-multiplatform-ios-cadisplaylink-vsync-invariant?format=cursor","windsurf":"/api/rules/compose-multiplatform-ios-cadisplaylink-vsync-invariant?format=windsurf","agents":"/api/rules/compose-multiplatform-ios-cadisplaylink-vsync-invariant?format=agents"}},{"id":"tauri-mobile-ipc-ephemeral-token-guardrail","title":"Tauri 2.0 Mobile IPC Ephemeral Capability Token Guardrail","category":"mobile","severity":"critical","description":"Enforces single-use, cryptographically verified capability tokens for all Tauri 2.0 mobile IPC invocations across iOS and Android bridge boundaries. This prevents cross-site scripting (XSS) or hijacked webview contexts from abusing ambient bridge permissions to execute sensitive native device APIs, file system modifications, or hardware sensors without a validated, one-time execution grant. The native Rust layer verifies token entropy, lifespan, and caller bounds before immediately revoking the token from memory.","antiPatternHeadline":"Ambient-Authority Mobile IPC Invocations Vulnerable to Webview Hijacking","stars_count":52,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri","ipc-security","rust","zero-trust","defense-in-depth"],"exportEndpoints":{"claude":"/api/rules/tauri-mobile-ipc-ephemeral-token-guardrail?format=claude","cursorMdc":"/api/rules/tauri-mobile-ipc-ephemeral-token-guardrail?format=mdc","cursorrules":"/api/rules/tauri-mobile-ipc-ephemeral-token-guardrail?format=cursor","windsurf":"/api/rules/tauri-mobile-ipc-ephemeral-token-guardrail?format=windsurf","agents":"/api/rules/tauri-mobile-ipc-ephemeral-token-guardrail?format=agents"}},{"id":"tetragon-ebpf-namespace-isolation-standard","title":"Tetragon In-Kernel Synchronous Syscall Namespace Isolation Enforcement","category":"security","severity":"critical","description":"Mandates synchronous in-kernel process termination (Sigkill) via Cilium Tetragon TracingPolicy for unauthorized container namespace transitions involving setns and pivot_root syscalls. Guarantees container breakout attempts are blocked directly inside the Linux eBPF execution layer before privilege boundaries are crossed, replacing latency-prone user-space audit daemons.","antiPatternHeadline":"Passive Audit Logging of Container Namespace Escapes and Post-Mortem Alerts","stars_count":89,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","ebpf","tetragon","kubernetes","container-escape","syscalls"],"exportEndpoints":{"claude":"/api/rules/tetragon-ebpf-namespace-isolation-standard?format=claude","cursorMdc":"/api/rules/tetragon-ebpf-namespace-isolation-standard?format=mdc","cursorrules":"/api/rules/tetragon-ebpf-namespace-isolation-standard?format=cursor","windsurf":"/api/rules/tetragon-ebpf-namespace-isolation-standard?format=windsurf","agents":"/api/rules/tetragon-ebpf-namespace-isolation-standard?format=agents"}},{"id":"spiffe-spire-cgroup-attestation-standard","title":"Mandatory SPIFFE/SPIRE Ephemeral X.509 SVID Attestation via Kernel cgroups","category":"security","severity":"critical","description":"Completely eliminates static cloud IAM credentials and static TLS certificates across microservices by mandating ephemeral X.509 SVID issuance via the SPIFFE Workload API. Enforces kernel-level workload attestation bound strictly to Linux cgroup identifiers and requires active stream watching for seamless, zero-downtime mTLS certificate rotation.","antiPatternHeadline":"Injecting Static Cloud IAM Tokens or Hardcoding X.509 Certificates Instead of Dynamic SPIFFE cgroup Attestation","stars_count":62,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","spiffe","spire","mtls","zero-trust","cgroups","iam"],"exportEndpoints":{"claude":"/api/rules/spiffe-spire-cgroup-attestation-standard?format=claude","cursorMdc":"/api/rules/spiffe-spire-cgroup-attestation-standard?format=mdc","cursorrules":"/api/rules/spiffe-spire-cgroup-attestation-standard?format=cursor","windsurf":"/api/rules/spiffe-spire-cgroup-attestation-standard?format=windsurf","agents":"/api/rules/spiffe-spire-cgroup-attestation-standard?format=agents"}},{"id":"otel-w3c-baggage-ingress-sanitization","title":"OpenTelemetry W3C Baggage Ingress Sanitization and Boundary Defense","category":"devops","severity":"critical","description":"Ingress reverse proxies and edge gateways must strictly validate, filter, and sanitize incoming W3C baggage headers prior to propagating trace context downstream. Unsanitized baggage propagation allows external attackers to inject arbitrary metadata, causing log forgery, sensitive context poisoning, and high-cardinality metric denial of service across distributed telemetry backends.","antiPatternHeadline":"Blind Downstream Propagation of Untrusted External W3C Baggage Headers","stars_count":64,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","security","observability","distributed-tracing","w3c-baggage"],"exportEndpoints":{"claude":"/api/rules/otel-w3c-baggage-ingress-sanitization?format=claude","cursorMdc":"/api/rules/otel-w3c-baggage-ingress-sanitization?format=mdc","cursorrules":"/api/rules/otel-w3c-baggage-ingress-sanitization?format=cursor","windsurf":"/api/rules/otel-w3c-baggage-ingress-sanitization?format=windsurf","agents":"/api/rules/otel-w3c-baggage-ingress-sanitization?format=agents"}},{"id":"envoy-gateway-extauthz-submillisecond-token-bucket","title":"Envoy Gateway 1.2 ExtAuthz Sub-Millisecond Token-Bucket Standard","category":"devops","severity":"critical","description":"Mandates that edge rate limiting and authorization via Envoy Gateway 1.2 ExtAuthz execute within a strict sub-millisecond bounded latency budget using atomic, single-roundtrip token-bucket algorithms. Prevents cluster-wide cascading failures and edge worker thread pool exhaustion by strictly bounding ExtAuthz gRPC timeouts and executing rate evaluation at the edge data plane before upstream dispatch.","antiPatternHeadline":"Multi-Hop Database Calls and Unbounded Timeouts in ExtAuthz Causing Edge Proxy Thread Pool Starvation","stars_count":47,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","envoy-gateway","ext-authz","rate-limiting","token-bucket","grpc"],"exportEndpoints":{"claude":"/api/rules/envoy-gateway-extauthz-submillisecond-token-bucket?format=claude","cursorMdc":"/api/rules/envoy-gateway-extauthz-submillisecond-token-bucket?format=mdc","cursorrules":"/api/rules/envoy-gateway-extauthz-submillisecond-token-bucket?format=cursor","windsurf":"/api/rules/envoy-gateway-extauthz-submillisecond-token-bucket?format=windsurf","agents":"/api/rules/envoy-gateway-extauthz-submillisecond-token-bucket?format=agents"}},{"id":"svelte5-runes-reactive-graph-cycle-guardrail","title":"Svelte 5 Runes Reactive Graph Cycle & Depth Bounding Guardrail","category":"frontend","severity":"critical","description":"Enforces static determinism and runtime cycle/depth bounding across Svelte 5 runes ($state, $derived, $effect) to eliminate cascading reactive microtask storms. Mandates untracked async dependency isolation, mutation-free derivations, and cancellation semantics across asynchronous boundaries.","antiPatternHeadline":"Unbounded Feedback Cascades and Untracked Async Re-entries in Svelte 5 Signal Graphs","stars_count":108,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","signals","reactivity","performance"],"exportEndpoints":{"claude":"/api/rules/svelte5-runes-reactive-graph-cycle-guardrail?format=claude","cursorMdc":"/api/rules/svelte5-runes-reactive-graph-cycle-guardrail?format=mdc","cursorrules":"/api/rules/svelte5-runes-reactive-graph-cycle-guardrail?format=cursor","windsurf":"/api/rules/svelte5-runes-reactive-graph-cycle-guardrail?format=windsurf","agents":"/api/rules/svelte5-runes-reactive-graph-cycle-guardrail?format=agents"}},{"id":"react-19-concurrent-action-hydration-lock","title":"React 19 Concurrent Action Hydration Interleaving Lock","category":"frontend","severity":"critical","description":"Enforces deterministic serialization between progressive streaming SSR hydration chunks and user-dispatched concurrent action transitions. Guarantees that interactive actions dispatched on partially hydrated streaming components are safely queued through React 19 native action boundaries, eliminating DOM desynchronization, fiber tearing, and hydration mismatch panics.","antiPatternHeadline":"Mutating state via uncoordinated async handlers or imperative DOM updates during streaming SSR hydration","stars_count":82,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","streaming-ssr","hydration","concurrent-actions","server-components"],"exportEndpoints":{"claude":"/api/rules/react-19-concurrent-action-hydration-lock?format=claude","cursorMdc":"/api/rules/react-19-concurrent-action-hydration-lock?format=mdc","cursorrules":"/api/rules/react-19-concurrent-action-hydration-lock?format=cursor","windsurf":"/api/rules/react-19-concurrent-action-hydration-lock?format=windsurf","agents":"/api/rules/react-19-concurrent-action-hydration-lock?format=agents"}},{"id":"openfga-rebac-depth-fencing-guardrail","title":"OpenFGA Recursive Tuple Graph Evaluation Depth Fencing & Cycle Detection","category":"security","severity":"critical","description":"Prevents catastrophic denial-of-service, unconstrained graph traversals, and thread-pool exhaustion during relationship-based access control (ReBAC) evaluations. Enforces mandatory cycle detection via visited-node memoization, strict bounded depth-fencing budgets, and fail-closed timeout signals across all recursive OpenFGA tuple resolutions.","antiPatternHeadline":"Unbounded Transitive Graph Traversal and Missing Cycle Detection in ReBAC Resolvers","stars_count":41,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","rebac","authorization","dos-prevention","graph-traversal"],"exportEndpoints":{"claude":"/api/rules/openfga-rebac-depth-fencing-guardrail?format=claude","cursorMdc":"/api/rules/openfga-rebac-depth-fencing-guardrail?format=mdc","cursorrules":"/api/rules/openfga-rebac-depth-fencing-guardrail?format=cursor","windsurf":"/api/rules/openfga-rebac-depth-fencing-guardrail?format=windsurf","agents":"/api/rules/openfga-rebac-depth-fencing-guardrail?format=agents"}},{"id":"postgres-17-direct-io-prefetch-budget-standard","title":"PostgreSQL 17 Vectorized Direct I/O & Prefetch Budget Architecture Standard","category":"backend","severity":"critical","description":"Enforces deterministic I/O budget allocations and OS page-cache bypass thresholds in PostgreSQL 17 streaming read pipelines. Prevents kernel inode lock contention, double-buffering degradation, and OLTP buffer pool eviction under concurrent high-throughput sequential scans and vector workloads.","antiPatternHeadline":"Unbounded Streaming Scans Polluting Page Cache and Exhausting Prefetch Ring Buffers","stars_count":117,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql-17","direct-io","streaming-io","database-performance","concurrency"],"exportEndpoints":{"claude":"/api/rules/postgres-17-direct-io-prefetch-budget-standard?format=claude","cursorMdc":"/api/rules/postgres-17-direct-io-prefetch-budget-standard?format=mdc","cursorrules":"/api/rules/postgres-17-direct-io-prefetch-budget-standard?format=cursor","windsurf":"/api/rules/postgres-17-direct-io-prefetch-budget-standard?format=windsurf","agents":"/api/rules/postgres-17-direct-io-prefetch-budget-standard?format=agents"}},{"id":"bun-native-worker-memory-quota-enforcement","title":"Bun 1.2 Isolated Native Worker Linear Memory Quota Enforcement","category":"backend","severity":"critical","description":"Enforces strict physical and virtual linear memory quotas alongside deterministic cooperative cancellation tokens within Bun 1.2 native multithreaded worker pools. Prevents rogue tenant payloads from triggering unbounded heap growth, process-level OOM aborts, or cross-tenant degradation by isolating execution environments within monitored, cancelable Worker boundaries.","antiPatternHeadline":"Unbounded Multithreaded Worker Execution Without Proactive RSS Tracking or SharedArrayBuffer Cancellation Tokens","stars_count":52,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","workers","concurrency","memory-management","multi-tenancy"],"exportEndpoints":{"claude":"/api/rules/bun-native-worker-memory-quota-enforcement?format=claude","cursorMdc":"/api/rules/bun-native-worker-memory-quota-enforcement?format=mdc","cursorrules":"/api/rules/bun-native-worker-memory-quota-enforcement?format=cursor","windsurf":"/api/rules/bun-native-worker-memory-quota-enforcement?format=windsurf","agents":"/api/rules/bun-native-worker-memory-quota-enforcement?format=agents"}},{"id":"go-124-weak-pointer-ephemeral-cache-invariant","title":"Go 1.24 Weak-Pointer Ephemeral Cache and GC Invariant","category":"backend","severity":"critical","description":"Enforces strict memory safety and lifetime boundaries when using Go 1.24 weak pointers (weak.Pointer) for high-throughput route metadata and ephemeral session caches. Weak references must guard against nil dereferencing, prevent premature promotion during lookup, and use runtime-aligned cleanup to eradicate GC mark-phase STW latency spikes.","antiPatternHeadline":"Retaining strong references across cache lookups and using manual finalizers instead of Go 1.24 weak.Pointer and runtime.AddCleanup.","stars_count":40,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","golang","memory-management","caching","gc-tuning","concurrency"],"exportEndpoints":{"claude":"/api/rules/go-124-weak-pointer-ephemeral-cache-invariant?format=claude","cursorMdc":"/api/rules/go-124-weak-pointer-ephemeral-cache-invariant?format=mdc","cursorrules":"/api/rules/go-124-weak-pointer-ephemeral-cache-invariant?format=cursor","windsurf":"/api/rules/go-124-weak-pointer-ephemeral-cache-invariant?format=windsurf","agents":"/api/rules/go-124-weak-pointer-ephemeral-cache-invariant?format=agents"}},{"id":"kmp-skiko-frame-budget-recomposition-guardrail","title":"Compose Multiplatform Metal/Vulkan 8.33ms Frame Budget & Recomposition Guardrail","category":"mobile","severity":"critical","description":"Enforces deterministic microtask thresholds and zero-allocation rendering paths across Kotlin Multiplatform Compose UI trees targeting Skiko (Metal on iOS, Vulkan on Android). Guarantees consistent 120Hz frame pacing (8.33ms budget) by eliminating recomposition loops, layout-pass allocations, and un-deferred state reads on mobile render pipelines.","antiPatternHeadline":"Reading Unstable State in Composition Passes and Allocating Canvas Objects Inside Skiko Render Loops","stars_count":76,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","compose-multiplatform","skiko","performance","metal","vulkan"],"exportEndpoints":{"claude":"/api/rules/kmp-skiko-frame-budget-recomposition-guardrail?format=claude","cursorMdc":"/api/rules/kmp-skiko-frame-budget-recomposition-guardrail?format=mdc","cursorrules":"/api/rules/kmp-skiko-frame-budget-recomposition-guardrail?format=cursor","windsurf":"/api/rules/kmp-skiko-frame-budget-recomposition-guardrail?format=windsurf","agents":"/api/rules/kmp-skiko-frame-budget-recomposition-guardrail?format=agents"}},{"id":"tauri2-mobile-shm-ringbuffer-protocol","title":"Tauri 2.0 Mobile Zero-Copy Binary Ring Buffer Protocol Invariant","category":"mobile","severity":"critical","description":"Enforces zero-copy or direct binary channel streaming for high-frequency binary data between the Tauri 2.0 native Rust core and platform WebViews (iOS WKWebView / Android WebView). Prohibits JSON or Base64 serialization over the standard IPC bridge for binary streams to prevent mobile garbage collector thrashing, main thread stalls, and excessive battery consumption.","antiPatternHeadline":"Serializing High-Frequency Binary Streaming Payloads via Standard JSON/Base64 invoke() IPC","stars_count":44,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri","rust","ring-buffer","zero-copy","ipc","performance"],"exportEndpoints":{"claude":"/api/rules/tauri2-mobile-shm-ringbuffer-protocol?format=claude","cursorMdc":"/api/rules/tauri2-mobile-shm-ringbuffer-protocol?format=mdc","cursorrules":"/api/rules/tauri2-mobile-shm-ringbuffer-protocol?format=cursor","windsurf":"/api/rules/tauri2-mobile-shm-ringbuffer-protocol?format=windsurf","agents":"/api/rules/tauri2-mobile-shm-ringbuffer-protocol?format=agents"}},{"id":"cilium-ebpf-dsr-dynamic-drain-invariant","title":"Cilium 1.17 eBPF Direct-Server-Return Dynamic Drain Invariant","category":"devops","severity":"critical","description":"Guarantees deterministic socket state preservation and active TCP connection draining during rolling Kubernetes node evictions under Cilium Direct Server Return (DSR) mode. Mandates strict kernel connection tracking synchronization and graceful termination life-cycles to eliminate RST spikes without relying on userspace reverse-proxy sidecars.","antiPatternHeadline":"Immediate Pod Termination Severing Active eBPF DSR Conntrack Tuples and Causing Silent Client RST Storms","stars_count":44,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","cilium","ebpf","kubernetes","dsr","networking"],"exportEndpoints":{"claude":"/api/rules/cilium-ebpf-dsr-dynamic-drain-invariant?format=claude","cursorMdc":"/api/rules/cilium-ebpf-dsr-dynamic-drain-invariant?format=mdc","cursorrules":"/api/rules/cilium-ebpf-dsr-dynamic-drain-invariant?format=cursor","windsurf":"/api/rules/cilium-ebpf-dsr-dynamic-drain-invariant?format=windsurf","agents":"/api/rules/cilium-ebpf-dsr-dynamic-drain-invariant?format=agents"}},{"id":"otel-collector-exemplar-reservoir-bounding","title":"OpenTelemetry Collector High-Cardinality Exemplar Reservoir Bounding and Heap Guardrails","category":"devops","severity":"critical","description":"Enforces strict bounded-size reservoir sampling, attribute sanitization, and explicit memory limits on metric exemplars within OpenTelemetry Collector pipelines. Prevents catastrophic Go runtime heap exhaustion and OOM kills triggered by distributed trace storms that inject high-cardinality baggage or trace IDs into metric streams. Mandates that memory_limiter processors execute prior to metric aggregation and that exemplar filters employ fixed-size bounded buffers.","antiPatternHeadline":"Unbounded Always-On Exemplar Collection and Missing Memory Limiter Leading to Collector OOM Crash Loops","stars_count":53,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","metrics","exemplars","collector","memory-management","resilience"],"exportEndpoints":{"claude":"/api/rules/otel-collector-exemplar-reservoir-bounding?format=claude","cursorMdc":"/api/rules/otel-collector-exemplar-reservoir-bounding?format=mdc","cursorrules":"/api/rules/otel-collector-exemplar-reservoir-bounding?format=cursor","windsurf":"/api/rules/otel-collector-exemplar-reservoir-bounding?format=windsurf","agents":"/api/rules/otel-collector-exemplar-reservoir-bounding?format=agents"}},{"id":"svelte-5-runes-cross-island-signal-boundary-enforcement","title":"Svelte 5 Runes Cross-Island Signal Boundary & Teardown Enforcement","category":"frontend","severity":"critical","description":"Enforces deterministic lifecycle and memory boundary isolation when sharing Svelte 5 runes ($state, $derived, $effect.root) across heterogeneous micro-frontend islands. Guarantees that fine-grained reactive subscriptions and detached signal dependency graphs are explicitly disposed during island unmounting to prevent cross-framework memory leaks.","antiPatternHeadline":"Unbounded Cross-Island Signal Subscriptions via Undisposed $effect.root Trees","stars_count":49,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","micro-frontends","signals","memory-management"],"exportEndpoints":{"claude":"/api/rules/svelte-5-runes-cross-island-signal-boundary-enforcement?format=claude","cursorMdc":"/api/rules/svelte-5-runes-cross-island-signal-boundary-enforcement?format=mdc","cursorrules":"/api/rules/svelte-5-runes-cross-island-signal-boundary-enforcement?format=cursor","windsurf":"/api/rules/svelte-5-runes-cross-island-signal-boundary-enforcement?format=windsurf","agents":"/api/rules/svelte-5-runes-cross-island-signal-boundary-enforcement?format=agents"}},{"id":"react-19-server-action-distributed-idempotency-fencing","title":"React 19 Server Action Distributed Idempotency Key Fencing","category":"frontend","severity":"critical","description":"Prevents duplicate mutations, race conditions, and unauthorized replays during network retries or progressive enhancement form submissions by cryptographically binding an idempotency token across the React Server Component (RSC) wire boundary. Mandates distributed atomic fencing and cache-aside replay handling before executing non-reversible side-effects.","antiPatternHeadline":"Unfenced Server Actions Executing Duplicate Side-Effects on Network Retries or Rapid Clicks","stars_count":114,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","server-actions","idempotency","distributed-systems","security"],"exportEndpoints":{"claude":"/api/rules/react-19-server-action-distributed-idempotency-fencing?format=claude","cursorMdc":"/api/rules/react-19-server-action-distributed-idempotency-fencing?format=mdc","cursorrules":"/api/rules/react-19-server-action-distributed-idempotency-fencing?format=cursor","windsurf":"/api/rules/react-19-server-action-distributed-idempotency-fencing?format=windsurf","agents":"/api/rules/react-19-server-action-distributed-idempotency-fencing?format=agents"}},{"id":"vite-6-environment-api-cross-runtime-isolation-vite-6-environme-285","title":"Vite 6 Environment API Cross-Runtime Sandbox Isolation Standard","category":"devops","severity":"critical","description":"Enforces strict isolation across execution contexts (client, ssr, edge, and workerd) using the Vite 6 Environment API. Prevents module graph leakage, cross-environment global object bleeding, and build-time contamination across heterogenous SSR runtimes by mandating per-environment module runners and explicit condition exports.","antiPatternHeadline":"Global Module Graph Leakage and Leaked Node.js Intrinsic Globals in Edge/Browser Bundles","stars_count":67,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","vite6","ssr","environment-api","module-runner","cross-runtime"],"exportEndpoints":{"claude":"/api/rules/vite-6-environment-api-cross-runtime-isolation-vite-6-environme-285?format=claude","cursorMdc":"/api/rules/vite-6-environment-api-cross-runtime-isolation-vite-6-environme-285?format=mdc","cursorrules":"/api/rules/vite-6-environment-api-cross-runtime-isolation-vite-6-environme-285?format=cursor","windsurf":"/api/rules/vite-6-environment-api-cross-runtime-isolation-vite-6-environme-285?format=windsurf","agents":"/api/rules/vite-6-environment-api-cross-runtime-isolation-vite-6-environme-285?format=agents"}},{"id":"postgres-17-streaming-io-vectorized-prefetch-memory-fence","title":"Postgres 17 Streaming I/O Vectorized Prefetch Memory Fencing Standard","category":"backend","severity":"critical","description":"Governs Postgres 17 streaming I/O lookahead prefetching and kernel page cache allocations during vectorized asynchronous sequential and bitmap heap scans. Enforces strict session-level memory fences and concurrency ceilings to prevent OS page cache bloat and container cgroup OOM killer termination.","antiPatternHeadline":"Unfenced Vectorized Asynchronous Prefetching Triggering cgroup OOM Evictions","stars_count":76,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres","postgres-17","database","memory-safety","performance"],"exportEndpoints":{"claude":"/api/rules/postgres-17-streaming-io-vectorized-prefetch-memory-fence?format=claude","cursorMdc":"/api/rules/postgres-17-streaming-io-vectorized-prefetch-memory-fence?format=mdc","cursorrules":"/api/rules/postgres-17-streaming-io-vectorized-prefetch-memory-fence?format=cursor","windsurf":"/api/rules/postgres-17-streaming-io-vectorized-prefetch-memory-fence?format=windsurf","agents":"/api/rules/postgres-17-streaming-io-vectorized-prefetch-memory-fence?format=agents"}},{"id":"bun-ffi-native-buffer-pinning-gc-isolation","title":"Bun 1.2 FFI Buffer Pinning and JSC GC Isolation Standard","category":"backend","severity":"critical","description":"Enforces deterministic lifetime pinning and GC isolation for typed buffers passed across Bun 1.2 FFI boundaries. Prevents JavaScriptCore garbage collection cycles from deallocating or corrupting memory backing active native pointers during synchronous and asynchronous foreign execution.","antiPatternHeadline":"Passing ephemeral TypedArrays inline to FFI functions, allowing JavaScriptCore GC to sweep backing memory under active native pointers.","stars_count":67,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","ffi","memory-management","c-interop","rust"],"exportEndpoints":{"claude":"/api/rules/bun-ffi-native-buffer-pinning-gc-isolation?format=claude","cursorMdc":"/api/rules/bun-ffi-native-buffer-pinning-gc-isolation?format=mdc","cursorrules":"/api/rules/bun-ffi-native-buffer-pinning-gc-isolation?format=cursor","windsurf":"/api/rules/bun-ffi-native-buffer-pinning-gc-isolation?format=windsurf","agents":"/api/rules/bun-ffi-native-buffer-pinning-gc-isolation?format=agents"}},{"id":"tauri-v2-multiwindow-ipc-capability-sandboxing","title":"Tauri 2.0 Webview Window Isolation & IPC Capability Sandboxing","category":"mobile","severity":"critical","description":"Enforces granular per-window IPC capability manifests in Tauri 2.0 mobile and multi-webview architectures. Restricts OS-level plugin access, native invoke commands, and IPC events to explicitly bound window labels, preventing untrusted or auxiliary webviews from escalating privileges to host operating system APIs.","antiPatternHeadline":"Wildcard window capability assignments and unpartitioned IPC commands enabling cross-window privilege escalation.","stars_count":67,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri-2","security","ipc","sandboxing","rust"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-multiwindow-ipc-capability-sandboxing?format=claude","cursorMdc":"/api/rules/tauri-v2-multiwindow-ipc-capability-sandboxing?format=mdc","cursorrules":"/api/rules/tauri-v2-multiwindow-ipc-capability-sandboxing?format=cursor","windsurf":"/api/rules/tauri-v2-multiwindow-ipc-capability-sandboxing?format=windsurf","agents":"/api/rules/tauri-v2-multiwindow-ipc-capability-sandboxing?format=agents"}},{"id":"kmp-skie-flow-backpressure-guardrail","title":"KMP SKIE Flow-to-AsyncSequence Backpressure & Bounded Buffer Guardrail","category":"mobile","severity":"critical","description":"Enforces strict bounded buffering and explicit overflow policies on Kotlin Multiplatform Flows exposed to Swift via SKIE. Without explicit backpressure boundaries, mismatched production-consumption rates across the Kotlin/Native and Swift async boundary cause unmonitored queue accumulation, rapid heap exhaustion, and iOS Jetsam terminations during high-frequency streaming.","antiPatternHeadline":"Unbounded Flow Bridging to Swift AsyncSequence Triggering Uncontrolled Memory Growth and Jetsam Kills","stars_count":93,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kmp","kotlin-multiplatform","skie","swift","coroutines","asyncsequence","memory-management"],"exportEndpoints":{"claude":"/api/rules/kmp-skie-flow-backpressure-guardrail?format=claude","cursorMdc":"/api/rules/kmp-skie-flow-backpressure-guardrail?format=mdc","cursorrules":"/api/rules/kmp-skie-flow-backpressure-guardrail?format=cursor","windsurf":"/api/rules/kmp-skie-flow-backpressure-guardrail?format=windsurf","agents":"/api/rules/kmp-skie-flow-backpressure-guardrail?format=agents"}},{"id":"rfc-9449-dpop-ephemeral-key-guardrail","title":"RFC 9449 DPoP Ephemeral Cryptographic Proof-of-Possession Enforcement","category":"security","severity":"critical","description":"Enforces RFC 9449 Demonstrating Proof-of-Possession (DPoP) at the Application Layer to cryptographically bind OAuth 2.1 access and refresh tokens to client-held asymmetric key pairs. Private keys MUST be non-extractable and ephemeral, generated within isolated hardware or WebCrypto subsystems to prevent exfiltration. All outbound requests and resource verifications MUST strictly validate HTTP method ('htm'), HTTP URI ('htu'), access token hash ('ath'), unique token ID ('jti'), and server-issued nonces to eliminate replay attacks.","antiPatternHeadline":"Bearer Token Degradation and Insecure DPoP Proof Construction with Extractable Keys","stars_count":59,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","oauth2","dpop","rfc9449","cryptography","webcrypto"],"exportEndpoints":{"claude":"/api/rules/rfc-9449-dpop-ephemeral-key-guardrail?format=claude","cursorMdc":"/api/rules/rfc-9449-dpop-ephemeral-key-guardrail?format=mdc","cursorrules":"/api/rules/rfc-9449-dpop-ephemeral-key-guardrail?format=cursor","windsurf":"/api/rules/rfc-9449-dpop-ephemeral-key-guardrail?format=windsurf","agents":"/api/rules/rfc-9449-dpop-ephemeral-key-guardrail?format=agents"}},{"id":"otel-tail-sampling-adaptive-eviction-standard","title":"OpenTelemetry Tail-Based Sampling Adaptive Eviction Standard","category":"devops","severity":"critical","description":"Enforces strict memory-bounded trace buffers and priority-aware adaptive eviction in OpenTelemetry collector pipelines. Ensures anomalous spans, HTTP 5xx errors, and high-latency traces are deterministically preserved during traffic spikes while non-critical root and intermediate spans are pruned to avoid collector OOM kills. Mandates consistent hash-based trace routing to guarantee complete trace assembly before sampling decisions are made.","antiPatternHeadline":"Unbounded Collector Memory Buffers and Random Drop Shedding Under Ingress Surges","stars_count":113,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","observability","distributed-tracing","collector","sampling"],"exportEndpoints":{"claude":"/api/rules/otel-tail-sampling-adaptive-eviction-standard?format=claude","cursorMdc":"/api/rules/otel-tail-sampling-adaptive-eviction-standard?format=mdc","cursorrules":"/api/rules/otel-tail-sampling-adaptive-eviction-standard?format=cursor","windsurf":"/api/rules/otel-tail-sampling-adaptive-eviction-standard?format=windsurf","agents":"/api/rules/otel-tail-sampling-adaptive-eviction-standard?format=agents"}},{"id":"ebpf-tc-egress-microsegmentation-fencing","title":"eBPF TC Egress Microsegmentation Fencing for Ephemeral Sandboxes","category":"security","severity":"critical","description":"Autonomous code execution sandboxes must be strictly fenced at the kernel Traffic Control (TC) egress layer using eBPF programs attached to their virtual network interfaces prior to process initiation. Egress traffic must default to TC_ACT_SHOT with dynamic CIDR and L4 port allowlists enforced via atomic BPF LPM trie lookups to prevent network boundary escape and out-of-band lateral data exfiltration.","antiPatternHeadline":"Asynchronous Userspace Filtering or Missing Kernel-Level TC Egress Barrier Before Process Launch","stars_count":103,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","ebpf","traffic-control","microsegmentation","sandbox-security","data-exfiltration"],"exportEndpoints":{"claude":"/api/rules/ebpf-tc-egress-microsegmentation-fencing?format=claude","cursorMdc":"/api/rules/ebpf-tc-egress-microsegmentation-fencing?format=mdc","cursorrules":"/api/rules/ebpf-tc-egress-microsegmentation-fencing?format=cursor","windsurf":"/api/rules/ebpf-tc-egress-microsegmentation-fencing?format=windsurf","agents":"/api/rules/ebpf-tc-egress-microsegmentation-fencing?format=agents"}},{"id":"postgres-17-logical-replication-failover-slots-guardrail","title":"PostgreSQL 17 Deterministic Failover Slot Synchronization Guardrail","category":"backend","severity":"critical","description":"Enforces deterministic configuration and validation of PostgreSQL 17 logical replication failover slots across physical standbys. Prevents silent downstream subscriber divergence, double-processing, and WAL disk exhaustion caused by uncoordinated primary promotions or unsynchronized LSN markers.","antiPatternHeadline":"Unsynchronized Ephemeral Logical Slots Leading to Replay Divergence or WAL Disk Exhaustion Post-Failover","stars_count":45,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","logical-replication","cdc","high-availability","database"],"exportEndpoints":{"claude":"/api/rules/postgres-17-logical-replication-failover-slots-guardrail?format=claude","cursorMdc":"/api/rules/postgres-17-logical-replication-failover-slots-guardrail?format=mdc","cursorrules":"/api/rules/postgres-17-logical-replication-failover-slots-guardrail?format=cursor","windsurf":"/api/rules/postgres-17-logical-replication-failover-slots-guardrail?format=windsurf","agents":"/api/rules/postgres-17-logical-replication-failover-slots-guardrail?format=agents"}},{"id":"tauri-v2-capability-ipc-sandboxing-tauri-2-0-capabi-189","title":"Tauri 2.0 Granular Capability Manifests and IPC Sandboxing","category":"security","severity":"critical","description":"Enforces compile-time capability mapping and strict runtime isolation between Tauri 2.0 webview contexts and native Rust commands. Mandates window-specific capability manifests with explicit command allowlisting, scoped file-system and network boundaries, and zero-trust isolation for untrusted or remote webview windows.","antiPatternHeadline":"Monolithic Capabilities, Wildcard Window Binding, and Arbitrary Native IPC Exposure to Untrusted Webviews","stars_count":94,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","tauri","tauri-v2","ipc-sandboxing","rust","capabilities"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-capability-ipc-sandboxing-tauri-2-0-capabi-189?format=claude","cursorMdc":"/api/rules/tauri-v2-capability-ipc-sandboxing-tauri-2-0-capabi-189?format=mdc","cursorrules":"/api/rules/tauri-v2-capability-ipc-sandboxing-tauri-2-0-capabi-189?format=cursor","windsurf":"/api/rules/tauri-v2-capability-ipc-sandboxing-tauri-2-0-capabi-189?format=windsurf","agents":"/api/rules/tauri-v2-capability-ipc-sandboxing-tauri-2-0-capabi-189?format=agents"}},{"id":"vite-6-environment-api-runtime-isolation-vite-6-environme-913","title":"Vite 6 Environment API Multi-Runtime Module Execution Isolation","category":"frontend","severity":"critical","description":"Enforces strict runtime module and state isolation across client, SSR Node, and edge worker compilation environments using the Vite 6 Environment API. Prevents cross-environment global state pollution, prototype tampering, and memory leaks by ensuring each runner uses isolated module runners, environment-scoped dev plugins, and runtime-agnostic module evaluation.","antiPatternHeadline":"Global Module Evaluation Sharing and Unscoped State Leakage Across Heterogeneous Vite Environments","stars_count":63,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","vite-6","environment-api","ssr","edge-runtime","module-runner"],"exportEndpoints":{"claude":"/api/rules/vite-6-environment-api-runtime-isolation-vite-6-environme-913?format=claude","cursorMdc":"/api/rules/vite-6-environment-api-runtime-isolation-vite-6-environme-913?format=mdc","cursorrules":"/api/rules/vite-6-environment-api-runtime-isolation-vite-6-environme-913?format=cursor","windsurf":"/api/rules/vite-6-environment-api-runtime-isolation-vite-6-environme-913?format=windsurf","agents":"/api/rules/vite-6-environment-api-runtime-isolation-vite-6-environme-913?format=agents"}},{"id":"capacitor7-sharedarraybuffer-zero-copy-streaming","title":"Capacitor 7 Native-to-Webview Zero-Copy TypedArray Bridge Invariant","category":"mobile","severity":"critical","description":"Mandates bounded zero-copy buffer transfers or SharedArrayBuffer ring-buffers via Web Workers for high-frequency native telemetry in Capacitor 7. Eliminates JSON bridge serialization overhead, GC thrashing, and UI main-thread frame drops during sensor, IMU, audio, and biometric data ingest.","antiPatternHeadline":"Serializing Continuous High-Frequency Sensor Telemetry as JSON Across the Capacitor Bridge","stars_count":57,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","sharedarraybuffer","typedarray","performance","web-workers"],"exportEndpoints":{"claude":"/api/rules/capacitor7-sharedarraybuffer-zero-copy-streaming?format=claude","cursorMdc":"/api/rules/capacitor7-sharedarraybuffer-zero-copy-streaming?format=mdc","cursorrules":"/api/rules/capacitor7-sharedarraybuffer-zero-copy-streaming?format=cursor","windsurf":"/api/rules/capacitor7-sharedarraybuffer-zero-copy-streaming?format=windsurf","agents":"/api/rules/capacitor7-sharedarraybuffer-zero-copy-streaming?format=agents"}},{"id":"go-1-24-swiss-table-partition-sharding-standard","title":"Go 1.24 Swiss Table Cache-Line Padded Partition Sharding Standard","category":"backend","severity":"critical","description":"Establishes strict striping and cache-line padding invariants over concurrent Go 1.24 Swiss table maps. Prevents false sharing, cross-core cache invalidation storms, and unbounded heap allocations in ultra-high-throughput concurrent workloads by enforcing power-of-two mask-based sharding and CPU cache-line alignment.","antiPatternHeadline":"Global RWMutex Contention and False Sharing on Swiss Map Partitions","stars_count":42,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","concurrency","performance","memory-alignment","swiss-table"],"exportEndpoints":{"claude":"/api/rules/go-1-24-swiss-table-partition-sharding-standard?format=claude","cursorMdc":"/api/rules/go-1-24-swiss-table-partition-sharding-standard?format=mdc","cursorrules":"/api/rules/go-1-24-swiss-table-partition-sharding-standard?format=cursor","windsurf":"/api/rules/go-1-24-swiss-table-partition-sharding-standard?format=windsurf","agents":"/api/rules/go-1-24-swiss-table-partition-sharding-standard?format=agents"}},{"id":"ebpf-lsm-netns-egress-enforcement-guardrail","title":"Kernel-Level eBPF LSM Container Network Namespace Egress Enforcement","category":"security","severity":"critical","description":"Enforces deterministic, in-kernel egress control at the Linux Security Module (LSM) socket layer prior to TCP handshake initiation. Prevents inter-pod data exfiltration and lateral movement by intercepting socket operations synchronously before packets hit the network stack or allocate sk_buff structures.","antiPatternHeadline":"Relying on Userspace Sidecars or Post-Routing Netfilter Rules for Zero-Trust Container Egress","stars_count":85,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","ebpf","lsm","containers","networking","cgroups"],"exportEndpoints":{"claude":"/api/rules/ebpf-lsm-netns-egress-enforcement-guardrail?format=claude","cursorMdc":"/api/rules/ebpf-lsm-netns-egress-enforcement-guardrail?format=mdc","cursorrules":"/api/rules/ebpf-lsm-netns-egress-enforcement-guardrail?format=cursor","windsurf":"/api/rules/ebpf-lsm-netns-egress-enforcement-guardrail?format=windsurf","agents":"/api/rules/ebpf-lsm-netns-egress-enforcement-guardrail?format=agents"}},{"id":"react19-resource-hint-multiplexing-watermark","title":"React 19 Resource Hint Multiplexing & Layout Watermark Guardrail","category":"frontend","severity":"critical","description":"Enforces deterministic, top-level resource hint orchestration using React 19 native DOM preinit and preload APIs at layout watermarks. Prevents duplicate network requests, priority inversion, and client-side streaming waterfalls caused by fragmented, ad-hoc asset loading across nested Server-Client Component boundaries.","antiPatternHeadline":"Ad-Hoc Client-Side Resource Injection and Leaf-Level Hint Thrashing","stars_count":60,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","resource-hints","rsc","performance","streaming-ssr"],"exportEndpoints":{"claude":"/api/rules/react19-resource-hint-multiplexing-watermark?format=claude","cursorMdc":"/api/rules/react19-resource-hint-multiplexing-watermark?format=mdc","cursorrules":"/api/rules/react19-resource-hint-multiplexing-watermark?format=cursor","windsurf":"/api/rules/react19-resource-hint-multiplexing-watermark?format=windsurf","agents":"/api/rules/react19-resource-hint-multiplexing-watermark?format=agents"}},{"id":"otel-collector-pdata-arena-lifecycle-standard","title":"OpenTelemetry Collector PData In-Memory Arena Buffer Lifecycle Standard","category":"devops","severity":"critical","description":"Mandates deterministic zero-copy mutations, byte-slice arena pooling, and bounded object lifetimes across custom OpenTelemetry Collector receivers and processors. Prevents catastrophic Stop-The-World (STW) Go garbage collection pauses and memory fragmentation under multi-gigabit OTLP ingestion workloads.","antiPatternHeadline":"Escaping Heap Allocations via PData Deep-Cloning and Unpooled String Conversions in Hot Pipeline Paths","stars_count":43,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","golang","pdata","garbage-collection","high-throughput","memory-arena"],"exportEndpoints":{"claude":"/api/rules/otel-collector-pdata-arena-lifecycle-standard?format=claude","cursorMdc":"/api/rules/otel-collector-pdata-arena-lifecycle-standard?format=mdc","cursorrules":"/api/rules/otel-collector-pdata-arena-lifecycle-standard?format=cursor","windsurf":"/api/rules/otel-collector-pdata-arena-lifecycle-standard?format=windsurf","agents":"/api/rules/otel-collector-pdata-arena-lifecycle-standard?format=agents"}},{"id":"webauthn-largeblob-epoch-validation-protocol","title":"WebAuthn largeBlob Client-Side Cryptographic Epoch Validation Protocol","category":"security","severity":"critical","description":"Enforces hardware-bound, monotonically increasing cryptographic epoch counters within WebAuthn largeBlob payloads to protect offline-first zero-trust client credentials. Without atomic epoch progression and authenticated data binding via Authenticator Assertion Data (authData) or HMAC-SHA256 integrity tags, attackers can execute state rollback attacks by replaying stale largeBlob captures across offline clients. All largeBlob write/read transactions must mandate strict client-side verification of epoch sequence numbers and authenticated encryption before trusting payload states.","antiPatternHeadline":"Trusting raw WebAuthn largeBlob payloads without verifying monotonically increasing client epoch counters and cryptographic AEAD bindings","stars_count":47,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","largeblob","cryptography","zero-trust","rollback-defense"],"exportEndpoints":{"claude":"/api/rules/webauthn-largeblob-epoch-validation-protocol?format=claude","cursorMdc":"/api/rules/webauthn-largeblob-epoch-validation-protocol?format=mdc","cursorrules":"/api/rules/webauthn-largeblob-epoch-validation-protocol?format=cursor","windsurf":"/api/rules/webauthn-largeblob-epoch-validation-protocol?format=windsurf","agents":"/api/rules/webauthn-largeblob-epoch-validation-protocol?format=agents"}},{"id":"svelte5-universal-runes-ssr-leak-guardrail","title":"Svelte 5 Universal Runes SSR Memory Retention & Cross-Request Contamination Guardrail","category":"frontend","severity":"critical","description":"Enforces strict isolation of universal reactive runes ($state, $derived) within request and component lifecycles in Svelte 5 SSR environments. Module-level reactive rune instantiations persist across concurrent HTTP requests in Node.js/Bun/Deno runtimes, causing critical multi-tenant data leaks and unbounded memory retention. All shared reactive state MUST be scoped to Svelte contexts, request events, or per-instance class closures.","antiPatternHeadline":"Global Module-Level Rune Declarations Leaking Multi-Tenant State and Retaining Memory in SSR Runtimes","stars_count":105,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte","svelte5","runes","ssr","memory-leaks","multi-tenant","security"],"exportEndpoints":{"claude":"/api/rules/svelte5-universal-runes-ssr-leak-guardrail?format=claude","cursorMdc":"/api/rules/svelte5-universal-runes-ssr-leak-guardrail?format=mdc","cursorrules":"/api/rules/svelte5-universal-runes-ssr-leak-guardrail?format=cursor","windsurf":"/api/rules/svelte5-universal-runes-ssr-leak-guardrail?format=windsurf","agents":"/api/rules/svelte5-universal-runes-ssr-leak-guardrail?format=agents"}},{"id":"openfga-rebac-graph-traversal-guardrail","title":"OpenFGA ReBAC Graph Traversal Cycle and Depth Guardrail","category":"security","severity":"critical","description":"Enforces strict bounded-depth DAG execution, cycle detection, and resolution limits across enterprise ReBAC relationship models. Prevents catastrophic CPU exhaustion, thread starvation, and exponential latency spikes caused by cyclic graph traversals and unbounded recursive authorization expansion.","antiPatternHeadline":"Unbounded Recursive Traversal and Unchecked Circular Relations in OpenFGA Tuple Graphs","stars_count":85,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","rebac","authorization","dos-prevention","graph-traversal"],"exportEndpoints":{"claude":"/api/rules/openfga-rebac-graph-traversal-guardrail?format=claude","cursorMdc":"/api/rules/openfga-rebac-graph-traversal-guardrail?format=mdc","cursorrules":"/api/rules/openfga-rebac-graph-traversal-guardrail?format=cursor","windsurf":"/api/rules/openfga-rebac-graph-traversal-guardrail?format=windsurf","agents":"/api/rules/openfga-rebac-graph-traversal-guardrail?format=agents"}},{"id":"tauri-mobile-scoped-plugin-capability-enforcement","title":"Tauri 2.0 Mobile Scoped Plugin Capability & IPC Manifest Isolation","category":"mobile","severity":"critical","description":"Enforces zero-trust boundary isolation between mobile webview contexts and native platform bridge APIs in Tauri 2.0. Mandates granular, least-privilege capability manifests with strict window scoping and cryptographic validation, eliminating wildcard permissions and unverified IPC invocation surfaces across iOS and Android runtimes.","antiPatternHeadline":"Over-privileged wildcard permissions and unscoped mobile IPC invocation channels exposing native runtime primitives.","stars_count":102,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri-v2","ipc-security","capabilities","zero-trust","rust"],"exportEndpoints":{"claude":"/api/rules/tauri-mobile-scoped-plugin-capability-enforcement?format=claude","cursorMdc":"/api/rules/tauri-mobile-scoped-plugin-capability-enforcement?format=mdc","cursorrules":"/api/rules/tauri-mobile-scoped-plugin-capability-enforcement?format=cursor","windsurf":"/api/rules/tauri-mobile-scoped-plugin-capability-enforcement?format=windsurf","agents":"/api/rules/tauri-mobile-scoped-plugin-capability-enforcement?format=agents"}},{"id":"postgres-17-failover-logical-slot-sync-guardrail","title":"Postgres 17 Logical Replication Slot Synchronization & Zero-Data-Loss Failover","category":"backend","severity":"critical","description":"PostgreSQL 17 introduces native logical replication slot failover via physical standby synchronization ('failover => true' and 'sync_replication_slots'). Services and CDC orchestrators must strictly enforce slot synchronization state validation before standby cutover and mandate finite WAL retention limits to avoid either catastrophic disk exhaustion or silent data loss during failovers.","antiPatternHeadline":"Uncoordinated Logical Slot Cutover and Unbounded WAL Accumulation Causing Split-Brain CDC and Node Crash","stars_count":79,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql-17","cdc","logical-replication","high-availability","distributed-systems"],"exportEndpoints":{"claude":"/api/rules/postgres-17-failover-logical-slot-sync-guardrail?format=claude","cursorMdc":"/api/rules/postgres-17-failover-logical-slot-sync-guardrail?format=mdc","cursorrules":"/api/rules/postgres-17-failover-logical-slot-sync-guardrail?format=cursor","windsurf":"/api/rules/postgres-17-failover-logical-slot-sync-guardrail?format=windsurf","agents":"/api/rules/postgres-17-failover-logical-slot-sync-guardrail?format=agents"}},{"id":"karpenter-v1-pdb-coordinated-drain-standard","title":"Karpenter v1 Consolidated Pod Disruption Budget Coordinated Drain Standard","category":"devops","severity":"critical","description":"Enforces deterministic coordination between Karpenter v1 node consolidation policies, application PodDisruptionBudgets (PDBs), and container lifecycle graceful termination hooks. Guarantees zero transient 502/504 connection drops during Spot node interruptions and consolidation drains by synchronizing terminationGracePeriodSeconds with ingress draining and preStop sleeps.","antiPatternHeadline":"Uncoordinated Karpenter Node Drain Causing Abrupt Pod Termination and Upstream 502/504 Gateway Errors","stars_count":68,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","karpenter","kubernetes","spot-instances","pdb","graceful-shutdown"],"exportEndpoints":{"claude":"/api/rules/karpenter-v1-pdb-coordinated-drain-standard?format=claude","cursorMdc":"/api/rules/karpenter-v1-pdb-coordinated-drain-standard?format=mdc","cursorrules":"/api/rules/karpenter-v1-pdb-coordinated-drain-standard?format=cursor","windsurf":"/api/rules/karpenter-v1-pdb-coordinated-drain-standard?format=windsurf","agents":"/api/rules/karpenter-v1-pdb-coordinated-drain-standard?format=agents"}},{"id":"capacitor7-biometric-keystore-nonce-binding","title":"Capacitor 7 Hardware Keystore Biometric Nonce-Binding Standard","category":"mobile","severity":"critical","description":"Enforces cryptographic binding between native hardware keystore biometrics (Secure Enclave / Android StrongBox) and single-use ephemeral challenge nonces in Capacitor 7 hybrid architectures. Eliminates cross-context bridge token replay and XSS-induced authorization theft by mandating that biometric authentication produces an ephemeral ECDSA signature over a server-validated challenge rather than releasing static stored secrets or boolean authentication flags across the WebView bridge.","antiPatternHeadline":"Exposing Raw Biometric Verification Booleans or Static Secrets Across the Capacitor Bridge","stars_count":66,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","security","biometrics","keystore","cryptography"],"exportEndpoints":{"claude":"/api/rules/capacitor7-biometric-keystore-nonce-binding?format=claude","cursorMdc":"/api/rules/capacitor7-biometric-keystore-nonce-binding?format=mdc","cursorrules":"/api/rules/capacitor7-biometric-keystore-nonce-binding?format=cursor","windsurf":"/api/rules/capacitor7-biometric-keystore-nonce-binding?format=windsurf","agents":"/api/rules/capacitor7-biometric-keystore-nonce-binding?format=agents"}},{"id":"go-chi-http3-early-hints-pipeline-sync","title":"Go Chi HTTP/3 Early Hints Deterministic Stream Synchronization","category":"backend","severity":"critical","description":"Enforces deterministic emission of RFC 8297 103 Early Hints prior to initiating zero-allocation streaming body flushes over multiplexed HTTP/3 QUIC streams in Go Chi services. Prevents race conditions, protocol frame interleaving, and broken stream state caused by concurrent header mutation and unbuffered body transmission.","antiPatternHeadline":"Concurrent or Post-Flush 103 Early Hints Header Emission on Multiplexed QUIC Streams","stars_count":60,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","chi","http3","quic","early-hints","concurrency","zero-allocation"],"exportEndpoints":{"claude":"/api/rules/go-chi-http3-early-hints-pipeline-sync?format=claude","cursorMdc":"/api/rules/go-chi-http3-early-hints-pipeline-sync?format=mdc","cursorrules":"/api/rules/go-chi-http3-early-hints-pipeline-sync?format=cursor","windsurf":"/api/rules/go-chi-http3-early-hints-pipeline-sync?format=windsurf","agents":"/api/rules/go-chi-http3-early-hints-pipeline-sync?format=agents"}},{"id":"vite-6-sharedarraybuffer-coop-coep-memory-ownership","title":"Vite 6 SharedArrayBuffer Cross-Origin Isolation and Memory Ownership Standard","category":"frontend","severity":"critical","description":"Enforces strict Cross-Origin Isolation via COOP and COEP credentialless headers across Vite 6 development and production preview environments. Mandates explicit memory management patterns including zero-copy Transferable streams, Atomics-based synchronization for SharedArrayBuffer, and deterministic ownership transfer between the main thread and Web Workers to eliminate race conditions and memory leaks.","antiPatternHeadline":"Unsynchronized SharedArrayBuffer Mutations and Structured Clone Overhead Without Isolation Headers","stars_count":47,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","vite","sharedarraybuffer","web-workers","atomics","zero-copy","coop-coep"],"exportEndpoints":{"claude":"/api/rules/vite-6-sharedarraybuffer-coop-coep-memory-ownership?format=claude","cursorMdc":"/api/rules/vite-6-sharedarraybuffer-coop-coep-memory-ownership?format=mdc","cursorrules":"/api/rules/vite-6-sharedarraybuffer-coop-coep-memory-ownership?format=cursor","windsurf":"/api/rules/vite-6-sharedarraybuffer-coop-coep-memory-ownership?format=windsurf","agents":"/api/rules/vite-6-sharedarraybuffer-coop-coep-memory-ownership?format=agents"}},{"id":"bun-sqlite-wal-concurrent-writer-sharding-standard","title":"Bun 1.2 Native SQLite WAL Concurrent Writer Sharding Standard","category":"backend","severity":"critical","description":"Enforces strict write-worker thread affinity, PRAGMA tuning, and deterministic checkpoint coordination for high-throughput Bun 1.2 native SQLite microservices. Prevents SQLITE_BUSY locking stalls and unconstrained write-ahead log explosion by partitioning writes across dedicated shard workers while allowing unblocked read-only replicas in concurrent WAL mode.","antiPatternHeadline":"Unpartitioned Concurrent Mutex Contention and Uncontrolled WAL Growth Under Distributed Node/Worker Writers","stars_count":99,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","sqlite","wal","concurrency","sharding","performance"],"exportEndpoints":{"claude":"/api/rules/bun-sqlite-wal-concurrent-writer-sharding-standard?format=claude","cursorMdc":"/api/rules/bun-sqlite-wal-concurrent-writer-sharding-standard?format=mdc","cursorrules":"/api/rules/bun-sqlite-wal-concurrent-writer-sharding-standard?format=cursor","windsurf":"/api/rules/bun-sqlite-wal-concurrent-writer-sharding-standard?format=windsurf","agents":"/api/rules/bun-sqlite-wal-concurrent-writer-sharding-standard?format=agents"}},{"id":"in-toto-ite6-hermetic-build-provenance-guardrail","title":"in-toto ITE-6 Hermetic Build Provenance and Reproducibility Admission Guardrail","category":"security","severity":"critical","description":"Enforces cryptographic verification of in-toto ITE-6 hermetic build provenance attestations before any container workload can be admitted to Kubernetes clusters. Prevents software supply chain tampering by verifying isolated builder identities, immutable material digests, and deterministic hermetic environment hashes against approved cluster policies.","antiPatternHeadline":"Admitting Images Based Solely on Signatures Without Hermetic Environment and Material Attestation Verification","stars_count":113,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","in-toto","supply-chain","kubernetes","admission-control","sigstore","provenance"],"exportEndpoints":{"claude":"/api/rules/in-toto-ite6-hermetic-build-provenance-guardrail?format=claude","cursorMdc":"/api/rules/in-toto-ite6-hermetic-build-provenance-guardrail?format=mdc","cursorrules":"/api/rules/in-toto-ite6-hermetic-build-provenance-guardrail?format=cursor","windsurf":"/api/rules/in-toto-ite6-hermetic-build-provenance-guardrail?format=windsurf","agents":"/api/rules/in-toto-ite6-hermetic-build-provenance-guardrail?format=agents"}},{"id":"react19-rsc-taint-boundary-protection","title":"React 19 Server Components Tainted Reference Boundary Enforcement","category":"frontend","severity":"critical","description":"Enforces strict application of React 19 taint primitives (experimental_taintObjectReference and experimental_taintUniqueValue) across server-side data access layers. Guarantees that private tenant credentials, cryptographic secrets, and unscrubbed domain models are structurally blocked from crossing the React Server Component serialization boundary during streaming SSR.","antiPatternHeadline":"Leaking Raw Tenant Credentials and Private Keys Across the RSC-Client Serialization Boundary","stars_count":71,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react19","rsc","taint-api","security","server-components","nextjs"],"exportEndpoints":{"claude":"/api/rules/react19-rsc-taint-boundary-protection?format=claude","cursorMdc":"/api/rules/react19-rsc-taint-boundary-protection?format=mdc","cursorrules":"/api/rules/react19-rsc-taint-boundary-protection?format=cursor","windsurf":"/api/rules/react19-rsc-taint-boundary-protection?format=windsurf","agents":"/api/rules/react19-rsc-taint-boundary-protection?format=agents"}},{"id":"bun-zero-copy-tcp-pipeline-production-standard","title":"Bun 1.2 Zero-Copy Kernel-Space TCP Streaming Standard","category":"backend","severity":"critical","description":"Mandates direct kernel-space streaming transfers for high-volume binary payloads using Bun.listen and Bun.connect. Enforces strict zero-copy descriptor offloading (via sendfile/copy_file_range) to bypass JavaScriptCore heap allocation and eliminate garbage collection thrashing under 100k+ concurrent connections.","antiPatternHeadline":"Userland Heap Buffering and Intermediate ArrayBuffer Allocations in High-Throughput TCP Sockets","stars_count":76,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","networking","tcp","zero-copy","performance"],"exportEndpoints":{"claude":"/api/rules/bun-zero-copy-tcp-pipeline-production-standard?format=claude","cursorMdc":"/api/rules/bun-zero-copy-tcp-pipeline-production-standard?format=mdc","cursorrules":"/api/rules/bun-zero-copy-tcp-pipeline-production-standard?format=cursor","windsurf":"/api/rules/bun-zero-copy-tcp-pipeline-production-standard?format=windsurf","agents":"/api/rules/bun-zero-copy-tcp-pipeline-production-standard?format=agents"}},{"id":"openfga-contextual-tuple-consistency-boundary","title":"OpenFGA Contextual Tuple Consistency Boundary and Token Verification","category":"backend","severity":"critical","description":"Enforces strict distributed consistency and cryptographic boundary verification for contextual tuples in OpenFGA authorization checks. Prevents unauthorized privilege escalation and confused deputy exploits caused by processing stale, unverified, or client-tampered transient contextual tuples.","antiPatternHeadline":"Injecting Client-Supplied Contextual Tuples Directly into OpenFGA Check Requests Without Consistency Token Verification","stars_count":106,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","openfga","authorization","distributed-systems","security","zanzibar","cache-consistency"],"exportEndpoints":{"claude":"/api/rules/openfga-contextual-tuple-consistency-boundary?format=claude","cursorMdc":"/api/rules/openfga-contextual-tuple-consistency-boundary?format=mdc","cursorrules":"/api/rules/openfga-contextual-tuple-consistency-boundary?format=cursor","windsurf":"/api/rules/openfga-contextual-tuple-consistency-boundary?format=windsurf","agents":"/api/rules/openfga-contextual-tuple-consistency-boundary?format=agents"}},{"id":"tauri-mobile-biometric-keychain-invariant","title":"Tauri 2.0 Biometric-Enforced Keychain IPC Token Verification","category":"mobile","severity":"critical","description":"Enforces cryptographic verification of hardware-backed biometric authentication (Secure Enclave / Android KeyStore) before releasing raw access tokens across the Tauri 2.0 mobile IPC bridge into WebView memory. Prevents token exfiltration and bypass attacks by requiring nonce-based challenge-response signatures verified in Rust core prior to credential release.","antiPatternHeadline":"Trusting Client-Side Biometric Prompts Without Hardware Nonce Signatures Over Tauri IPC","stars_count":116,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri-2","biometrics","secure-enclave","keychain","ipc-security"],"exportEndpoints":{"claude":"/api/rules/tauri-mobile-biometric-keychain-invariant?format=claude","cursorMdc":"/api/rules/tauri-mobile-biometric-keychain-invariant?format=mdc","cursorrules":"/api/rules/tauri-mobile-biometric-keychain-invariant?format=cursor","windsurf":"/api/rules/tauri-mobile-biometric-keychain-invariant?format=windsurf","agents":"/api/rules/tauri-mobile-biometric-keychain-invariant?format=agents"}},{"id":"capacitor7-background-runner-watchdog-barrier","title":"Capacitor 7 Background Runner Watchdog Execution Barrier & State Checkpointing","category":"mobile","severity":"critical","description":"Mandates cooperative cancellation barriers, atomic state checkpointing, and deterministic time budgets for Capacitor 7 Background Runner tasks. Prevents fatal OS watchdog termination (iOS 0x8badf00d kills and Android WorkManager eviction) and non-deterministic state corruption across native-to-web isolate boundaries.","antiPatternHeadline":"Unbounded Async Worker Loops Causing Native Watchdog Thread Eviction and Corrupted Storage State","stars_count":65,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["capacitor","background-runner","mobile","ios-watchdog","android-workmanager","concurrency"],"exportEndpoints":{"claude":"/api/rules/capacitor7-background-runner-watchdog-barrier?format=claude","cursorMdc":"/api/rules/capacitor7-background-runner-watchdog-barrier?format=mdc","cursorrules":"/api/rules/capacitor7-background-runner-watchdog-barrier?format=cursor","windsurf":"/api/rules/capacitor7-background-runner-watchdog-barrier?format=windsurf","agents":"/api/rules/capacitor7-background-runner-watchdog-barrier?format=agents"}},{"id":"spiffe-spire-svid-rotation-overlap-invariant","title":"SPIFFE/SPIRE Ephemeral SVID Dynamic Rotation and Overlap Handshake Guardrail","category":"security","severity":"critical","description":"Enforces non-disruptive, atomic X.509 SVID and trust bundle rotation for ephemeral identities in distributed service meshes. Mandates overlap validation windows and thread-safe dynamic TLS context swapping to guarantee zero-downtime mTLS handshakes during aggressive sub-hour rotation cycles.","antiPatternHeadline":"Static TLS Context Initialization and Destructive Listener Restarts During SVID Rotations","stars_count":42,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","spiffe","spire","mtls","zero-trust","crypto","tls"],"exportEndpoints":{"claude":"/api/rules/spiffe-spire-svid-rotation-overlap-invariant?format=claude","cursorMdc":"/api/rules/spiffe-spire-svid-rotation-overlap-invariant?format=mdc","cursorrules":"/api/rules/spiffe-spire-svid-rotation-overlap-invariant?format=cursor","windsurf":"/api/rules/spiffe-spire-svid-rotation-overlap-invariant?format=windsurf","agents":"/api/rules/spiffe-spire-svid-rotation-overlap-invariant?format=agents"}},{"id":"opentelemetry-batch-span-processor-memory-fence","title":"OpenTelemetry BatchSpanProcessor Memory Bounding and Non-Blocking Buffer Fence","category":"devops","severity":"critical","description":"Enforces strict memory allocation fences on OpenTelemetry trace exporters via bounded ring buffers and aggressive drop-on-saturation policies. Prevents catastrophic process-level Out-Of-Memory (OOM) crashes during collector outages and telemetry bursts.","antiPatternHeadline":"Unbounded Telemetry Queues and Indefinite Export Timeouts Triggering Fatal Heap Exhaustion","stars_count":96,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","observability","memory-management","resilience","nodejs"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-batch-span-processor-memory-fence?format=claude","cursorMdc":"/api/rules/opentelemetry-batch-span-processor-memory-fence?format=mdc","cursorrules":"/api/rules/opentelemetry-batch-span-processor-memory-fence?format=cursor","windsurf":"/api/rules/opentelemetry-batch-span-processor-memory-fence?format=windsurf","agents":"/api/rules/opentelemetry-batch-span-processor-memory-fence?format=agents"}},{"id":"nextjs-15-ppr-dynamic-io-boundary-guardrail","title":"Next.js 15 PPR Dynamic IO Boundary and Prerender Shell Guardrail","category":"frontend","severity":"critical","description":"Enforces deterministic separation between static prerender shells and dynamic runtime execution paths under Next.js 15 Partial Prerendering (PPR) and Dynamic IO. Prevents dynamic data APIs (headers, cookies, searchParams, and uncached fetch operations) from executing outside React Suspense boundaries, which de-optimizes partial static generation into full on-demand SSR.","antiPatternHeadline":"Accessing Runtime Request Headers and Uncached IO Outside Suspense Boundaries","stars_count":84,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs","react-server-components","partial-prerendering","dynamic-io","performance"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-ppr-dynamic-io-boundary-guardrail?format=claude","cursorMdc":"/api/rules/nextjs-15-ppr-dynamic-io-boundary-guardrail?format=mdc","cursorrules":"/api/rules/nextjs-15-ppr-dynamic-io-boundary-guardrail?format=cursor","windsurf":"/api/rules/nextjs-15-ppr-dynamic-io-boundary-guardrail?format=windsurf","agents":"/api/rules/nextjs-15-ppr-dynamic-io-boundary-guardrail?format=agents"}},{"id":"react-19-optimistic-mutation-reentrancy-rollback-standard","title":"React 19 Optimistic Mutation Re-entrancy & Rollback Guardrail","category":"frontend","severity":"critical","description":"Enforces deterministic state reconciliation during concurrent, re-entrant Server Action executions using React 19 useOptimistic and useActionState primitives. Prevents view-model divergence, stale baseline clobbering, and uncoordinated rollbacks caused by out-of-order network resolutions in asynchronous optimistic mutations.","antiPatternHeadline":"Non-Deterministic Optimistic Rollback and Out-of-Order Clobbering in Concurrent Transitions","stars_count":70,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","useOptimistic","server-actions","concurrency","state-sync"],"exportEndpoints":{"claude":"/api/rules/react-19-optimistic-mutation-reentrancy-rollback-standard?format=claude","cursorMdc":"/api/rules/react-19-optimistic-mutation-reentrancy-rollback-standard?format=mdc","cursorrules":"/api/rules/react-19-optimistic-mutation-reentrancy-rollback-standard?format=cursor","windsurf":"/api/rules/react-19-optimistic-mutation-reentrancy-rollback-standard?format=windsurf","agents":"/api/rules/react-19-optimistic-mutation-reentrancy-rollback-standard?format=agents"}},{"id":"axum-hyper-h3-early-data-anti-replay-guardrail","title":"Axum 0.8 Hyper HTTP/3 Early Data 0-RTT Anti-Replay Guardrail","category":"backend","severity":"critical","description":"Enforces strict isolation and validation of QUIC 0-RTT early data within Axum 0.8 and Hyper HTTP/3 stacks. Non-idempotent HTTP methods and state-mutating handlers must reject early data with HTTP 425 (Too Early) or validate cryptographically bound TLS exporter tokens against replay windows to prevent replay-induced state corruption.","antiPatternHeadline":"Executing state-mutating requests over unverified QUIC 0-RTT Early Data, enabling on-path packet replay attacks.","stars_count":65,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","hyper","http3","quic","security","zero-rtt"],"exportEndpoints":{"claude":"/api/rules/axum-hyper-h3-early-data-anti-replay-guardrail?format=claude","cursorMdc":"/api/rules/axum-hyper-h3-early-data-anti-replay-guardrail?format=mdc","cursorrules":"/api/rules/axum-hyper-h3-early-data-anti-replay-guardrail?format=cursor","windsurf":"/api/rules/axum-hyper-h3-early-data-anti-replay-guardrail?format=windsurf","agents":"/api/rules/axum-hyper-h3-early-data-anti-replay-guardrail?format=agents"}},{"id":"go124-weak-pointer-cache-finalization-invariant","title":"Go 1.24 Weak Pointer & Cleanup Invariant for Ephemeral Actor Caches","category":"backend","severity":"critical","description":"Enforces non-resurrecting ephemeral caching patterns using Go 1.24 weak pointers and runtime.AddCleanup. Eliminates strong cyclic reference retention and heap fragmentation across high-throughput actor goroutines by decoupling cleanup closures from cached heap allocations.","antiPatternHeadline":"Strong Reference Cycling and Object Resurrection in Concurrent Actor Caches","stars_count":83,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","concurrency","garbage-collection","memory-management","actors"],"exportEndpoints":{"claude":"/api/rules/go124-weak-pointer-cache-finalization-invariant?format=claude","cursorMdc":"/api/rules/go124-weak-pointer-cache-finalization-invariant?format=mdc","cursorrules":"/api/rules/go124-weak-pointer-cache-finalization-invariant?format=cursor","windsurf":"/api/rules/go124-weak-pointer-cache-finalization-invariant?format=windsurf","agents":"/api/rules/go124-weak-pointer-cache-finalization-invariant?format=agents"}},{"id":"postgres-17-json-table-memory-guardrail-postgres-17-json-862","title":"Postgres 17 JSON_TABLE Projection Memory Budget and Allocation Bounding","category":"backend","severity":"critical","description":"Unbounded relational projections using Postgres 17 SQL/JSON JSON_TABLE across arbitrary JSONB payloads risk rapid backend worker memory exhaustion and Linux OOM killer termination. This standard enforces deterministic projection buffer bounding through JSON path array slicing, strict output column width limits, transaction-scoped work_mem ceilings, and keyset-paginated source batches.","antiPatternHeadline":"Unbounded Nested JSON_TABLE Projections Triggering Postgres Worker OOM Termination","stars_count":69,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres","postgresql-17","json-table","sql-json","memory-management","performance"],"exportEndpoints":{"claude":"/api/rules/postgres-17-json-table-memory-guardrail-postgres-17-json-862?format=claude","cursorMdc":"/api/rules/postgres-17-json-table-memory-guardrail-postgres-17-json-862?format=mdc","cursorrules":"/api/rules/postgres-17-json-table-memory-guardrail-postgres-17-json-862?format=cursor","windsurf":"/api/rules/postgres-17-json-table-memory-guardrail-postgres-17-json-862?format=windsurf","agents":"/api/rules/postgres-17-json-table-memory-guardrail-postgres-17-json-862?format=agents"}},{"id":"capacitor-7-biometric-keystore-invalidation-sync","title":"Capacitor 7 Biometric Keystore Invalidation & Cryptographic Token Eviction","category":"mobile","severity":"critical","description":"Enforces immediate application-tier cryptographic token invalidation upon detection of OS-level biometric enrollment state changes (KeyPermanentlyInvalidatedException on Android, errSecAuthFailed/errSecUserCanceled on iOS). Prevents unauthorized access when new biometric identities are enrolled on the host device by ensuring native secure keystore hardware-backed flags invalidate persisted session credentials.","antiPatternHeadline":"Persisting Session Tokens and Fallback Keystores Across OS-Level Biometric State Mutations","stars_count":47,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","biometrics","security","keystore","authentication"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-biometric-keystore-invalidation-sync?format=claude","cursorMdc":"/api/rules/capacitor-7-biometric-keystore-invalidation-sync?format=mdc","cursorrules":"/api/rules/capacitor-7-biometric-keystore-invalidation-sync?format=cursor","windsurf":"/api/rules/capacitor-7-biometric-keystore-invalidation-sync?format=windsurf","agents":"/api/rules/capacitor-7-biometric-keystore-invalidation-sync?format=agents"}},{"id":"kmp-skiko-gpu-thread-affinity-guardrail","title":"KMP Skiko GPU Thread-Affinity and Render Context Concurrency Guardrail","category":"mobile","severity":"critical","description":"Enforces strict thread affinity and synchronizes hardware command buffer submissions across Skiko rendering loops on iOS Metal and Android Vulkan backends. Prevents silent graphics driver crashes, invalid command queue submissions, and memory corruptions caused by out-of-order surface drawing across unpinned Coroutine dispatchers.","antiPatternHeadline":"Dispatching Direct Skia Canvas Mutations and Native Surface Renders Across Unpinned Background Coroutines","stars_count":71,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kmp","skiko","compose-multiplatform","metal","vulkan","concurrency"],"exportEndpoints":{"claude":"/api/rules/kmp-skiko-gpu-thread-affinity-guardrail?format=claude","cursorMdc":"/api/rules/kmp-skiko-gpu-thread-affinity-guardrail?format=mdc","cursorrules":"/api/rules/kmp-skiko-gpu-thread-affinity-guardrail?format=cursor","windsurf":"/api/rules/kmp-skiko-gpu-thread-affinity-guardrail?format=windsurf","agents":"/api/rules/kmp-skiko-gpu-thread-affinity-guardrail?format=agents"}},{"id":"sigstore-cosign-ephemeral-oidc-attestation-standard","title":"Sigstore Cosign Keyless Ephemeral OIDC Workload Attestation Standard","category":"security","severity":"critical","description":"Enforces keyless container image signing and in-toto provenance attestation using short-lived OpenID Connect (OIDC) identity tokens issued by CI/CD workload providers. Completely eliminates static signing keys by requiring Fulcio root CA certificate verification and Rekor transparency log proof validation at all image promotion gates.","antiPatternHeadline":"Static Secret-Based Artifact Signing with Missing Transparency Log and Identity Constraints","stars_count":52,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","supply-chain","sigstore","cosign","oidc","slsa","container-security"],"exportEndpoints":{"claude":"/api/rules/sigstore-cosign-ephemeral-oidc-attestation-standard?format=claude","cursorMdc":"/api/rules/sigstore-cosign-ephemeral-oidc-attestation-standard?format=mdc","cursorrules":"/api/rules/sigstore-cosign-ephemeral-oidc-attestation-standard?format=cursor","windsurf":"/api/rules/sigstore-cosign-ephemeral-oidc-attestation-standard?format=windsurf","agents":"/api/rules/sigstore-cosign-ephemeral-oidc-attestation-standard?format=agents"}},{"id":"amd-sev-snp-attestation-boundary-guardrail","title":"Strict AMD SEV-SNP Hardware Attestation & Root-of-Trust Validation Before Key Release","category":"security","severity":"critical","description":"Enforces strict validation of AMD SEV-SNP attestation reports against AMD Key Distribution Service (KDS) hardware certificate chains (ARK/ASK/VCEK) before releasing cryptographic keys to guest virtual machines. Guarantees measurement register verification (launch digest), report data binding against client session nonces, debug policy disallowance, and TCB version compliance to eliminate hypervisor-mediated man-in-the-middle and replay attacks.","antiPatternHeadline":"Trusting hypervisor-supplied VCEK certs, bypassing AMD ARK/ASK root verification, or omitting REPORT_DATA cryptographic binding","stars_count":115,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","confidential-computing","amd-sev-snp","attestation","zero-trust","cryptography"],"exportEndpoints":{"claude":"/api/rules/amd-sev-snp-attestation-boundary-guardrail?format=claude","cursorMdc":"/api/rules/amd-sev-snp-attestation-boundary-guardrail?format=mdc","cursorrules":"/api/rules/amd-sev-snp-attestation-boundary-guardrail?format=cursor","windsurf":"/api/rules/amd-sev-snp-attestation-boundary-guardrail?format=windsurf","agents":"/api/rules/amd-sev-snp-attestation-boundary-guardrail?format=agents"}},{"id":"prom3-otlp-ingestion-sharding-backpressure","title":"Prometheus 3.0 Native OTLP Sharded Backpressure and TSDB Ingestion Boundary","category":"devops","severity":"critical","description":"Establishes a resilient boundary for Prometheus 3.0 native OTLP ingestion under high-cardinality multi-cluster surges. Mandates consistent metric series-affinity sharding, explicit upstream backpressure propagation (gRPC ResourceExhausted/HTTP 429), and strict TSDB out-of-order ingestion alignment to eliminate Head-of-Line WAL blocking and out-of-order sample eviction.","antiPatternHeadline":"Unpartitioned direct OTLP stream dumping into Prometheus 3.0 endpoints, triggering Head chunk lock contention, out-of-order drops, and WAL write stalls.","stars_count":73,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","prometheus","opentelemetry","backpressure","tsdb","kubernetes"],"exportEndpoints":{"claude":"/api/rules/prom3-otlp-ingestion-sharding-backpressure?format=claude","cursorMdc":"/api/rules/prom3-otlp-ingestion-sharding-backpressure?format=mdc","cursorrules":"/api/rules/prom3-otlp-ingestion-sharding-backpressure?format=cursor","windsurf":"/api/rules/prom3-otlp-ingestion-sharding-backpressure?format=windsurf","agents":"/api/rules/prom3-otlp-ingestion-sharding-backpressure?format=agents"}},{"id":"react19-rsc-taint-api-policy","title":"React 19 Server Components Taint API Serialization Barrier Enforcement","category":"frontend","severity":"critical","description":"Enforces strict server-side boundary validation using React 19's experimental Taint APIs (taintObjectReference and taintUniqueValue). Ensures that raw database entities containing sensitive customer data, cryptographic keys, and backend API tokens are irrevocably marked as untransferable before crossing the React Server Component (RSC) to Client Component serialization boundary. Mandates explicit data transfer object (DTO) projection to prevent accidental exposure via Flight payload serialization.","antiPatternHeadline":"Passing Unsanitized Server Entities or Environment Secrets Directly to Client Component Props","stars_count":84,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","rsc","security","taint-api","next.js"],"exportEndpoints":{"claude":"/api/rules/react19-rsc-taint-api-policy?format=claude","cursorMdc":"/api/rules/react19-rsc-taint-api-policy?format=mdc","cursorrules":"/api/rules/react19-rsc-taint-api-policy?format=cursor","windsurf":"/api/rules/react19-rsc-taint-api-policy?format=windsurf","agents":"/api/rules/react19-rsc-taint-api-policy?format=agents"}},{"id":"pg17-async-streaming-io-dynamic-buffer-standard","title":"Postgres 17 Asynchronous Streaming I/O Dynamic Workload Buffer Standard","category":"backend","severity":"critical","description":"Enforces strict runtime session-level tuning for PostgreSQL 17 streaming read and asynchronous vectorized I/O primitives during high-concurrency analytical and batch sequential scans. Prevents kernel buffer cache thrashing and tail-latency degradation by dynamically balancing io_combine_limit, maintenance_io_concurrency, and ring-buffer allocations per workload classification.","antiPatternHeadline":"Unbounded Synchronous Sequential Scans and Static Global Read Buffers Causing Kernel I/O Queue Evictions","stars_count":94,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","postgres-17","async-io","database-performance","vectorized-io"],"exportEndpoints":{"claude":"/api/rules/pg17-async-streaming-io-dynamic-buffer-standard?format=claude","cursorMdc":"/api/rules/pg17-async-streaming-io-dynamic-buffer-standard?format=mdc","cursorrules":"/api/rules/pg17-async-streaming-io-dynamic-buffer-standard?format=cursor","windsurf":"/api/rules/pg17-async-streaming-io-dynamic-buffer-standard?format=windsurf","agents":"/api/rules/pg17-async-streaming-io-dynamic-buffer-standard?format=agents"}},{"id":"go-synctest-bubble-quarantine","title":"Go 1.24 testing/synctest Bubble Concurrency Quarantine","category":"backend","severity":"critical","description":"Mandates deterministic, zero-wall-time concurrency testing using Go 1.24's testing/synctest bubble quarantine for distributed locks, stateful orchestrators, and goroutine pools. Eliminates flaky time.Sleep heuristics and CPU-wasting poll loops by anchoring goroutines inside synthetic time bubbles where goroutine advancement is strictly coordinated.","antiPatternHeadline":"Arbitrary Real-Time Sleep Heuristics and Leaked Goroutines in Concurrent State Testing","stars_count":118,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","concurrency","synctest","testing","goroutines"],"exportEndpoints":{"claude":"/api/rules/go-synctest-bubble-quarantine?format=claude","cursorMdc":"/api/rules/go-synctest-bubble-quarantine?format=mdc","cursorrules":"/api/rules/go-synctest-bubble-quarantine?format=cursor","windsurf":"/api/rules/go-synctest-bubble-quarantine?format=windsurf","agents":"/api/rules/go-synctest-bubble-quarantine?format=agents"}},{"id":"fastapi-async-cancellation-shield-taskgroup-guardrail","title":"FastAPI Async Cancellation Shield and Structured TaskGroup Guardrail","category":"backend","severity":"critical","description":"Enforces strict asynchronous cancellation boundaries and structured concurrency across FastAPI handlers when client streams or HTTP/3 sessions disconnect mid-flight. Prevents orphaned background tasks, unclosed SQLAlchemy/asyncpg transactions, and inconsistent external state mutation by mandating asyncio.shield on critical sections and asyncio.TaskGroup for child task lifecycles.","antiPatternHeadline":"Unshielded Database Mutations and Naked asyncio.create_task Inside Client-Cancellable Route Handlers","stars_count":103,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","asyncio","structured-concurrency","database-transactions","http3"],"exportEndpoints":{"claude":"/api/rules/fastapi-async-cancellation-shield-taskgroup-guardrail?format=claude","cursorMdc":"/api/rules/fastapi-async-cancellation-shield-taskgroup-guardrail?format=mdc","cursorrules":"/api/rules/fastapi-async-cancellation-shield-taskgroup-guardrail?format=cursor","windsurf":"/api/rules/fastapi-async-cancellation-shield-taskgroup-guardrail?format=windsurf","agents":"/api/rules/fastapi-async-cancellation-shield-taskgroup-guardrail?format=agents"}},{"id":"tauri-v2-custom-protocol-streaming-range-invariant","title":"Tauri 2.0 Webview Custom Protocol HTTP Range Chunking Invariant","category":"mobile","severity":"critical","description":"Standardizes chunked HTTP Range-request streaming for local asset retrieval across Tauri 2.0 Android and iOS webviews. Bypasses IPC serialization bottlenecks and prevents catastrophic OOM memory spikes by serving native file data through asynchronous seek-and-slice operations instead of monolithic base64 or complete byte array payloads.","antiPatternHeadline":"Buffering Entire Media Assets in Memory via Tauri IPC or Non-Ranged Custom Protocols","stars_count":62,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri-2","rust","custom-protocol","streaming","memory-management","range-requests"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-custom-protocol-streaming-range-invariant?format=claude","cursorMdc":"/api/rules/tauri-v2-custom-protocol-streaming-range-invariant?format=mdc","cursorrules":"/api/rules/tauri-v2-custom-protocol-streaming-range-invariant?format=cursor","windsurf":"/api/rules/tauri-v2-custom-protocol-streaming-range-invariant?format=windsurf","agents":"/api/rules/tauri-v2-custom-protocol-streaming-range-invariant?format=agents"}},{"id":"kmp-darwin-main-flow-conflation-standard","title":"KMP Darwin Main RunLoop SharedFlow Conflation Guardrail","category":"mobile","severity":"critical","description":"Enforces a strict buffer-drop-oldest conflation boundary on Kotlin Multiplatform SharedFlow and StateFlow bridges exposed to Darwin (iOS) runloops. Prevents dispatch queue saturation, runaway micro-tasks, and CADisplayLink frame hitches caused by bridging unbuffered high-frequency Kotlin coroutine emissions directly into Swift/SwiftUI main-thread observers.","antiPatternHeadline":"Bridging Unconflated High-Frequency Kotlin SharedFlow to Darwin Main Dispatcher Causing Main RunLoop Starvation and Frame Hitches","stars_count":69,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","swift","concurrency","ios","coroutines","performance"],"exportEndpoints":{"claude":"/api/rules/kmp-darwin-main-flow-conflation-standard?format=claude","cursorMdc":"/api/rules/kmp-darwin-main-flow-conflation-standard?format=mdc","cursorrules":"/api/rules/kmp-darwin-main-flow-conflation-standard?format=cursor","windsurf":"/api/rules/kmp-darwin-main-flow-conflation-standard?format=windsurf","agents":"/api/rules/kmp-darwin-main-flow-conflation-standard?format=agents"}},{"id":"webauthn-l3-conditional-mediation-nonce-verification-standard","title":"WebAuthn Level 3 Conditional Mediation Auto-Fill Ephemeral Nonce & Challenge Binding Standard","category":"security","severity":"critical","description":"Enforces strict origin-bound, cryptographically random, ephemeral challenge-nonce verification for WebAuthn Level 3 conditional UI ceremonies. Prevents passkey replay, token-binding circumvention, and passkey injection during silent auto-fill credential generation by ensuring single-use consumption and session isolation. Guarantees that conditional mediation public key credential requests cannot be intercepted or replayed across tab contexts or origin boundaries.","antiPatternHeadline":"Persisting static challenges in sessions or unauthenticated cookies during conditional UI pre-flight passkey requests","stars_count":110,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","passkeys","authentication","cryptography","conditional-mediation"],"exportEndpoints":{"claude":"/api/rules/webauthn-l3-conditional-mediation-nonce-verification-standard?format=claude","cursorMdc":"/api/rules/webauthn-l3-conditional-mediation-nonce-verification-standard?format=mdc","cursorrules":"/api/rules/webauthn-l3-conditional-mediation-nonce-verification-standard?format=cursor","windsurf":"/api/rules/webauthn-l3-conditional-mediation-nonce-verification-standard?format=windsurf","agents":"/api/rules/webauthn-l3-conditional-mediation-nonce-verification-standard?format=agents"}},{"id":"k8s-gateway-api-backendtlspolicy-dynamic-verification","title":"Kubernetes Gateway API v1.2 Dynamic BackendTLSPolicy Verification Standard","category":"devops","severity":"critical","description":"Enforces zero-trust egress from Gateway data planes to upstream backend services using Gateway API v1.2 BackendTLSPolicy. Mandates explicit Subject Alternative Name (SAN) hostname verification against dynamically synchronized ConfigMap trust bundles, preventing unverified plaintext traffic, insecure skip-verify bypasses, and proxy reloads during CA certificate rotations.","antiPatternHeadline":"Unvalidated Backend TLS, Insecure Skip Verification, and Proxy Reloads on CA Rotation","stars_count":66,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","kubernetes","gateway-api","zero-trust","mtls","envoy"],"exportEndpoints":{"claude":"/api/rules/k8s-gateway-api-backendtlspolicy-dynamic-verification?format=claude","cursorMdc":"/api/rules/k8s-gateway-api-backendtlspolicy-dynamic-verification?format=mdc","cursorrules":"/api/rules/k8s-gateway-api-backendtlspolicy-dynamic-verification?format=cursor","windsurf":"/api/rules/k8s-gateway-api-backendtlspolicy-dynamic-verification?format=windsurf","agents":"/api/rules/k8s-gateway-api-backendtlspolicy-dynamic-verification?format=agents"}},{"id":"sigstore-ambient-oidc-workload-attestation-guardrail","title":"Sigstore Ambient OIDC Ephemeral Workload Attestation Guardrail","category":"security","severity":"critical","description":"Enforces keyless in-toto supply chain provenance attestations via ambient CI/CD OIDC workload identity federation. Eliminates all static, long-lived signing keys and passphrases in favor of short-lived Fulcio X.509 leaf certificates logged to Rekor transparency logs.","antiPatternHeadline":"Injecting long-lived private signing keys or credentials into CI/CD runners instead of exchanging ambient OIDC tokens for ephemeral Fulcio certificates.","stars_count":40,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","sigstore","cosign","supply-chain","oidc","in-toto","slsa"],"exportEndpoints":{"claude":"/api/rules/sigstore-ambient-oidc-workload-attestation-guardrail?format=claude","cursorMdc":"/api/rules/sigstore-ambient-oidc-workload-attestation-guardrail?format=mdc","cursorrules":"/api/rules/sigstore-ambient-oidc-workload-attestation-guardrail?format=cursor","windsurf":"/api/rules/sigstore-ambient-oidc-workload-attestation-guardrail?format=windsurf","agents":"/api/rules/sigstore-ambient-oidc-workload-attestation-guardrail?format=agents"}},{"id":"vite6-environment-sandbox-worker-isolation","title":"Vite 6 Environment API Worker-Thread Sandbox Isolation and Lifecycle Management","category":"frontend","severity":"critical","description":"Enforces strict process and worker-thread isolation across heterogeneous runtime targets (Client, Node SSR, Edge/Workerd) utilizing the Vite 6 Environment API. Prevents module graph cross-contamination, polyfill pollution of global scopes, and heap accumulation by mandating explicit environment runners, isolated resolution conditions, and deterministic lifecycle teardowns.","antiPatternHeadline":"Monolithic Dev Server Runtime Sharing Module Graphs and Ambient State Across SSR and Edge Targets","stars_count":119,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["vite6","environment-api","ssr","worker-threads","memory-isolation","edge-runtime"],"exportEndpoints":{"claude":"/api/rules/vite6-environment-sandbox-worker-isolation?format=claude","cursorMdc":"/api/rules/vite6-environment-sandbox-worker-isolation?format=mdc","cursorrules":"/api/rules/vite6-environment-sandbox-worker-isolation?format=cursor","windsurf":"/api/rules/vite6-environment-sandbox-worker-isolation?format=windsurf","agents":"/api/rules/vite6-environment-sandbox-worker-isolation?format=agents"}},{"id":"react19-useactionstate-concurrent-mutex","title":"React 19 useActionState Deterministic Concurrency and Monotonic Sequence Guardrail","category":"frontend","severity":"critical","description":"Enforces deterministic serialization and monotonic sequence verification for asynchronous mutations managed by React 19 useActionState. Prevents race conditions, out-of-order reconciliations, and stale payload overrides during high-frequency user interactions while preserving non-blocking optimistic UI updates.","antiPatternHeadline":"Unsequenced useActionState Mutations Causing Stale Clashes and Out-of-Order Overwrites","stars_count":56,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","useActionState","useOptimistic","concurrency","race-conditions","state-reconciliation"],"exportEndpoints":{"claude":"/api/rules/react19-useactionstate-concurrent-mutex?format=claude","cursorMdc":"/api/rules/react19-useactionstate-concurrent-mutex?format=mdc","cursorrules":"/api/rules/react19-useactionstate-concurrent-mutex?format=cursor","windsurf":"/api/rules/react19-useactionstate-concurrent-mutex?format=windsurf","agents":"/api/rules/react19-useactionstate-concurrent-mutex?format=agents"}},{"id":"python-313-freethreaded-fastapi-state-guardrail","title":"Python 3.13 Free-Threaded FastAPI Shared State & Concurrency Invariant","category":"backend","severity":"critical","description":"Enforces strict thread-safe access patterns, fine-grained locking, or externalized state management for Python 3.13 free-threaded (PEP 703) runtimes. Without the Global Interpreter Lock (GIL), in-memory mutations on built-in collections across concurrent worker threads cause non-deterministic race conditions, torn reads, and memory corruption in ASGI applications. All shared application state must use synchronized primitives, atomics, or immutable data structures.","antiPatternHeadline":"Unsynchronized In-Memory State Mutation Across Concurrent ASGI Worker Threads in Free-Threaded Python","stars_count":110,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","python313","fastapi","pep703","free-threading","concurrency","thread-safety"],"exportEndpoints":{"claude":"/api/rules/python-313-freethreaded-fastapi-state-guardrail?format=claude","cursorMdc":"/api/rules/python-313-freethreaded-fastapi-state-guardrail?format=mdc","cursorrules":"/api/rules/python-313-freethreaded-fastapi-state-guardrail?format=cursor","windsurf":"/api/rules/python-313-freethreaded-fastapi-state-guardrail?format=windsurf","agents":"/api/rules/python-313-freethreaded-fastapi-state-guardrail?format=agents"}},{"id":"kmp-swift-arc-retain-cycle-fence","title":"Kotlin Multiplatform Swift Interop ARC Retain-Cycle Fence","category":"mobile","severity":"critical","description":"Enforces strict weak-proxy and listener boundary decoupling across the Kotlin/Native runtime and Apple Swift ARC bridge in long-lived background synchronization services. Eliminates bi-directional cyclic references where Swift delegates held strongly by Kotlin GC roots prevent deallocation across runtime memory models. Mandates explicit teardown protocols and weak-referencing wrapper adapters across the bridge.","antiPatternHeadline":"Bi-directional strong reference cycles crossing the K/N Garbage Collector and Swift ARC memory barrier.","stars_count":45,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","swift","arc","memory-leak","concurrency"],"exportEndpoints":{"claude":"/api/rules/kmp-swift-arc-retain-cycle-fence?format=claude","cursorMdc":"/api/rules/kmp-swift-arc-retain-cycle-fence?format=mdc","cursorrules":"/api/rules/kmp-swift-arc-retain-cycle-fence?format=cursor","windsurf":"/api/rules/kmp-swift-arc-retain-cycle-fence?format=windsurf","agents":"/api/rules/kmp-swift-arc-retain-cycle-fence?format=agents"}},{"id":"capacitor-7-native-to-webview-ipc-deserialization-schema-guardrail","title":"Capacitor 7 Native-to-WebView IPC Deserialization & Payload Validation Guardrail","category":"mobile","severity":"critical","description":"Enforces strict runtime type validation, prototype pollution defense, and payload byte-size bounds on all Capacitor 7 bridge notifications and method return values crossing from native runtimes (Swift/Kotlin) into the WebView JavaScript execution context. Prevents prototype pollution, arbitrary property injection, and memory exhaustion from compromised native bridge boundaries.","antiPatternHeadline":"Unchecked Native-to-JS Bridge Casts and Raw Event Stream Deserialization","stars_count":91,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","security","ipc","deserialization","zod","runtime-validation"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-native-to-webview-ipc-deserialization-schema-guardrail?format=claude","cursorMdc":"/api/rules/capacitor-7-native-to-webview-ipc-deserialization-schema-guardrail?format=mdc","cursorrules":"/api/rules/capacitor-7-native-to-webview-ipc-deserialization-schema-guardrail?format=cursor","windsurf":"/api/rules/capacitor-7-native-to-webview-ipc-deserialization-schema-guardrail?format=windsurf","agents":"/api/rules/capacitor-7-native-to-webview-ipc-deserialization-schema-guardrail?format=agents"}},{"id":"openfga-recursive-relation-depth-ceiling","title":"OpenFGA Recursive Relation Evaluation Depth Ceiling and Cycle Guard","category":"security","severity":"critical","description":"Enforces deterministic bounding on OpenFGA graph traversal depth and mandates cycle prevention in recursive authorization hierarchies. Failure to bound recursive evaluation allows adversarial or misconfigured nested groups to trigger catastrophic goroutine or memory exhaustion in multi-tenant authorization engines. Production environments must strictly configure engine-level resolution depth limits and intercept relationship creation to reject cyclic or excessive graph chains.","antiPatternHeadline":"Unbounded recursive tuple resolution and unvalidated cyclic relationships leading to authorization engine denial-of-service","stars_count":63,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","authorization","dos-mitigation","graph-traversal","rebac"],"exportEndpoints":{"claude":"/api/rules/openfga-recursive-relation-depth-ceiling?format=claude","cursorMdc":"/api/rules/openfga-recursive-relation-depth-ceiling?format=mdc","cursorrules":"/api/rules/openfga-recursive-relation-depth-ceiling?format=cursor","windsurf":"/api/rules/openfga-recursive-relation-depth-ceiling?format=windsurf","agents":"/api/rules/openfga-recursive-relation-depth-ceiling?format=agents"}},{"id":"passkey-attestation-hardware-binding-standard","title":"Passkey Hardware-Bound Registration Attestation Verification Standard","category":"security","severity":"critical","description":"Enforces strict validation of WebAuthn attestation statements against certified hardware roots of trust during passkey registration. Guarantees that credentials originating in high-assurance environments are bound to verified physical authenticators (e.g., FIDO2 Level 2+ / CC EAL6+) by cryptographically verifying x5c certificate chains, AAGUID metadata, and authenticator flags, rejecting software-emulated or synced consumer passkeys.","antiPatternHeadline":"Accepting 'none' attestation or unverified AAGUIDs in high-assurance workflows, allowing software-emulated or exportable credentials.","stars_count":119,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","passkeys","fido2","attestation","cryptography"],"exportEndpoints":{"claude":"/api/rules/passkey-attestation-hardware-binding-standard?format=claude","cursorMdc":"/api/rules/passkey-attestation-hardware-binding-standard?format=mdc","cursorrules":"/api/rules/passkey-attestation-hardware-binding-standard?format=cursor","windsurf":"/api/rules/passkey-attestation-hardware-binding-standard?format=windsurf","agents":"/api/rules/passkey-attestation-hardware-binding-standard?format=agents"}},{"id":"k8s-gateway-api-reference-grant-fence","title":"Enforce ReferenceGrant Cross-Namespace Fences in Kubernetes Gateway API v1.2","category":"devops","severity":"critical","description":"Enforces strict cross-namespace isolation under Kubernetes Gateway API v1.2 standards by mandating explicit ReferenceGrant resources for cross-namespace Gateway parentRefs and Service backendRefs. Prevents unauthorized multi-tenant traffic hijacking where rogue namespaces attach HTTPRoutes to shared ingress gateways or bind routes to foreign backend services without explicit cryptographic and declarative authorization. Ensures the Gateway controller drops ungranted bindings and surface policy status warnings in CI/CD linters.","antiPatternHeadline":"Implicit Cross-Namespace Gateway ParentRefs and Service Forwarding Without Declarative ReferenceGrants","stars_count":115,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","kubernetes","gateway-api","security","multi-tenancy","network-security"],"exportEndpoints":{"claude":"/api/rules/k8s-gateway-api-reference-grant-fence?format=claude","cursorMdc":"/api/rules/k8s-gateway-api-reference-grant-fence?format=mdc","cursorrules":"/api/rules/k8s-gateway-api-reference-grant-fence?format=cursor","windsurf":"/api/rules/k8s-gateway-api-reference-grant-fence?format=windsurf","agents":"/api/rules/k8s-gateway-api-reference-grant-fence?format=agents"}},{"id":"nextjs-15-ppr-dynamic-hole-isolation-next-js-15-parti-855","title":"Next.js 15 Partial Prerendering Dynamic Hole Isolation and Layout Stability","category":"frontend","severity":"critical","description":"Enforces deterministic boundaries between static prerendered HTML shells and dynamic asynchronous streaming segments under Next.js 15 Partial Prerendering (PPR). Guarantees dynamic data fetching functions execute strictly within explicitly bounded React Suspense boundaries equipped with dimension-locked fallbacks to eliminate cascading layout shifts (CLS) and TTFB regression over multiplexed HTTP/3 connections.","antiPatternHeadline":"Dynamic Scope Creep Causing Static Shell De-opt and Cascading Layout Shifts","stars_count":88,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs","react-server-components","partial-prerendering","suspense","performance"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-ppr-dynamic-hole-isolation-next-js-15-parti-855?format=claude","cursorMdc":"/api/rules/nextjs-15-ppr-dynamic-hole-isolation-next-js-15-parti-855?format=mdc","cursorrules":"/api/rules/nextjs-15-ppr-dynamic-hole-isolation-next-js-15-parti-855?format=cursor","windsurf":"/api/rules/nextjs-15-ppr-dynamic-hole-isolation-next-js-15-parti-855?format=windsurf","agents":"/api/rules/nextjs-15-ppr-dynamic-hole-isolation-next-js-15-parti-855?format=agents"}},{"id":"vite6-environment-api-multi-runtime-ssr-guardrail-vite-6-environme-593","title":"Vite 6 Environment API Multi-Runtime SSR Guardrail","category":"frontend","severity":"critical","description":"Enforces strict isolation between Client, Node.js, and WinterCG edge runtimes using Vite 6 Environment APIs. Prevents cross-runtime global pollution, invalid module externalization, and cross-boundary state leakage during unified multi-environment SSR bundling.","antiPatternHeadline":"Monolithic SSR configurations leaking Node.js built-ins or browser globals across heterogeneous runtime environments","stars_count":63,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","vite6","ssr","wintercg","edge","environment-api"],"exportEndpoints":{"claude":"/api/rules/vite6-environment-api-multi-runtime-ssr-guardrail-vite-6-environme-593?format=claude","cursorMdc":"/api/rules/vite6-environment-api-multi-runtime-ssr-guardrail-vite-6-environme-593?format=mdc","cursorrules":"/api/rules/vite6-environment-api-multi-runtime-ssr-guardrail-vite-6-environme-593?format=cursor","windsurf":"/api/rules/vite6-environment-api-multi-runtime-ssr-guardrail-vite-6-environme-593?format=windsurf","agents":"/api/rules/vite6-environment-api-multi-runtime-ssr-guardrail-vite-6-environme-593?format=agents"}},{"id":"go-chi-http3-early-hints-preconnect-invariant","title":"Go Chi HTTP/3 Early Hints (RFC 8297) 103 Preconnect Invariant","category":"backend","severity":"critical","description":"Enforces immediate emission of RFC 8297 103 Early Hints for preconnect and preload resource directives over HTTP/3 QUIC streams prior to executing long-running business logic in Go Chi handlers. Prevents head-of-line payload blocking on edge networks by explicitly flushing the 103 informational status header through the underlying ResponseWriter before expensive database or microservice queries are initiated.","antiPatternHeadline":"Executing blocking upstream I/O queries before flushing 103 Early Hints informational headers over the QUIC stream.","stars_count":109,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","chi","http3","quic","rfc8297","early-hints","networking"],"exportEndpoints":{"claude":"/api/rules/go-chi-http3-early-hints-preconnect-invariant?format=claude","cursorMdc":"/api/rules/go-chi-http3-early-hints-preconnect-invariant?format=mdc","cursorrules":"/api/rules/go-chi-http3-early-hints-preconnect-invariant?format=cursor","windsurf":"/api/rules/go-chi-http3-early-hints-preconnect-invariant?format=windsurf","agents":"/api/rules/go-chi-http3-early-hints-preconnect-invariant?format=agents"}},{"id":"kmp-skiko-native-deallocation-guardrail","title":"Deterministic Skiko Native Resource Disposal in Compose Multiplatform","category":"mobile","severity":"critical","description":"Enforces immediate and deterministic deallocation of native Skia/Skiko resources (such as Image, Surface, PictureRecorder, and NativePointer wrappers) across Compose Multiplatform iOS and Desktop targets. Mitigates native off-heap memory exhaustion and iOS Jetsam kills caused by Kotlin/Native GC latency when handling high-frequency view recycling. Guarantees that canvas raster buffers and transient graphics contexts are closed explicitly via lifecycle hooks rather than deferred finalizers.","antiPatternHeadline":"Unbounded Native Buffer Accumulation via GC-Deferred Finalization in Skiko Rendering","stars_count":119,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","compose-multiplatform","skiko","memory-leak","ios-jetsam"],"exportEndpoints":{"claude":"/api/rules/kmp-skiko-native-deallocation-guardrail?format=claude","cursorMdc":"/api/rules/kmp-skiko-native-deallocation-guardrail?format=mdc","cursorrules":"/api/rules/kmp-skiko-native-deallocation-guardrail?format=cursor","windsurf":"/api/rules/kmp-skiko-native-deallocation-guardrail?format=windsurf","agents":"/api/rules/kmp-skiko-native-deallocation-guardrail?format=agents"}},{"id":"android-15-16kb-page-alignment-guardrail-android-15-16kb--586","title":"Android 15 16KB Memory Page Size Alignment Guardrail","category":"mobile","severity":"critical","description":"Android 15 introduces support for 16KB physical memory page sizes alongside legacy 4KB pages. Native C/C++ libraries compiled with 4KB ELF segment alignment fail during dynamic loading (dlopen) and runtime memory mapping (mmap), causing fatal SIGSEGV crashes on 16KB kernel configurations. This guardrail enforces 16KB linker alignment across all CMake/NDK build scripts and validates third-party prebuilt shared libraries.","antiPatternHeadline":"Compiling NDK Binaries or Bundling Vendor .so Files with Legacy 4KB ELF Segment Alignment","stars_count":44,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","android","ndk","android-15","memory-alignment","cmake","jni"],"exportEndpoints":{"claude":"/api/rules/android-15-16kb-page-alignment-guardrail-android-15-16kb--586?format=claude","cursorMdc":"/api/rules/android-15-16kb-page-alignment-guardrail-android-15-16kb--586?format=mdc","cursorrules":"/api/rules/android-15-16kb-page-alignment-guardrail-android-15-16kb--586?format=cursor","windsurf":"/api/rules/android-15-16kb-page-alignment-guardrail-android-15-16kb--586?format=windsurf","agents":"/api/rules/android-15-16kb-page-alignment-guardrail-android-15-16kb--586?format=agents"}},{"id":"dbsc-cryptographic-session-binding-guardrail","title":"W3C Device-Bound Session Credentials (DBSC) Cryptographic Invariant","category":"security","severity":"critical","description":"Enforces cryptographic hardware-binding of HTTP application sessions using W3C Device-Bound Session Credentials (DBSC) specifications. Prevents token exfiltration and session replay attacks by asserting asymmetric TPM or Secure Enclave proof signatures on session initialization, refresh, and high-privilege transactional paths.","antiPatternHeadline":"Unbound Bearer Cookie Replay and Missing Hardware-Attested DBSC Signature Proofs","stars_count":69,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","dbsc","cryptography","session-management","tpm","w3c","zero-trust"],"exportEndpoints":{"claude":"/api/rules/dbsc-cryptographic-session-binding-guardrail?format=claude","cursorMdc":"/api/rules/dbsc-cryptographic-session-binding-guardrail?format=mdc","cursorrules":"/api/rules/dbsc-cryptographic-session-binding-guardrail?format=cursor","windsurf":"/api/rules/dbsc-cryptographic-session-binding-guardrail?format=windsurf","agents":"/api/rules/dbsc-cryptographic-session-binding-guardrail?format=agents"}},{"id":"sigstore-cosign-slsa3-ephemeral-provenance-guardrail","title":"Sigstore Cosign SLSA Level 3 Ephemeral Provenance and Keyless Verification","category":"security","severity":"critical","description":"Enforces non-forgeable, hardware-attested cryptographic build provenance and keyless workload identity attestation prior to production deployment. Prevents deployment of artifacts signed with static long-lived private keys, self-hosted unverified runners, or absent Fulcio/Rekor certificate transparency entries.","antiPatternHeadline":"Trusting Static Long-Lived GPG/RSA Keys or Self-Asserted Build Metadata Without OIDC-Bound Ephemeral Attestation","stars_count":57,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","sigstore","cosign","slsa-level-3","provenance","supply-chain","keyless"],"exportEndpoints":{"claude":"/api/rules/sigstore-cosign-slsa3-ephemeral-provenance-guardrail?format=claude","cursorMdc":"/api/rules/sigstore-cosign-slsa3-ephemeral-provenance-guardrail?format=mdc","cursorrules":"/api/rules/sigstore-cosign-slsa3-ephemeral-provenance-guardrail?format=cursor","windsurf":"/api/rules/sigstore-cosign-slsa3-ephemeral-provenance-guardrail?format=windsurf","agents":"/api/rules/sigstore-cosign-slsa3-ephemeral-provenance-guardrail?format=agents"}},{"id":"ebpf-bpf-lsm-zero-day-syscall-restriction-guardrail","title":"BPF-LSM Kernel Invariant: Enforcing Zero-Trust Container Isolation and Syscall Mediation","category":"devops","severity":"critical","description":"Enforces synchronous in-kernel access control using Linux Security Module (BPF-LSM) hooks to block unauthorized container host namespace traversal, credential tampering, and privilege escalation before syscall execution. Prohibits reliance on reactive user-space auditing or prone-to-race kprobes, eliminating Time-of-Check-to-Time-of-Use (TOCTOU) zero-day escape vectors.","antiPatternHeadline":"Post-Execution User-Space Event Auditing and Asynchronous Namespace Escape Detection","stars_count":66,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","bpf-lsm","linux-kernel","container-security","zero-day","kernel-security"],"exportEndpoints":{"claude":"/api/rules/ebpf-bpf-lsm-zero-day-syscall-restriction-guardrail?format=claude","cursorMdc":"/api/rules/ebpf-bpf-lsm-zero-day-syscall-restriction-guardrail?format=mdc","cursorrules":"/api/rules/ebpf-bpf-lsm-zero-day-syscall-restriction-guardrail?format=cursor","windsurf":"/api/rules/ebpf-bpf-lsm-zero-day-syscall-restriction-guardrail?format=windsurf","agents":"/api/rules/ebpf-bpf-lsm-zero-day-syscall-restriction-guardrail?format=agents"}},{"id":"prometheus-v3-otlp-cardinality-dedup-standard","title":"Prometheus 3.0 Native OTLP Ingestion and High-Cardinality Deduplication Guardrail","category":"devops","severity":"critical","description":"Enforces strict streaming time-windowed deduplication, label allowlisting, and exemplar normalization at the OpenTelemetry (OTLP) ingestion boundary for Prometheus 3.0. Prevents memory thrashing, TSDB head block WAL corruption, and ingestion dropouts caused by ephemeral attributes (e.g., trace IDs, customer GUIDs) masquerading as metric labels.","antiPatternHeadline":"Unbounded OTLP Resource Attribute Leakage Triggering Prometheus 3.0 TSDB Head OOM","stars_count":112,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","prometheus","opentelemetry","metrics","otlp","tsdb","cardinality"],"exportEndpoints":{"claude":"/api/rules/prometheus-v3-otlp-cardinality-dedup-standard?format=claude","cursorMdc":"/api/rules/prometheus-v3-otlp-cardinality-dedup-standard?format=mdc","cursorrules":"/api/rules/prometheus-v3-otlp-cardinality-dedup-standard?format=cursor","windsurf":"/api/rules/prometheus-v3-otlp-cardinality-dedup-standard?format=windsurf","agents":"/api/rules/prometheus-v3-otlp-cardinality-dedup-standard?format=agents"}},{"id":"svelte-5-runes-reactive-context-isolation","title":"Svelte 5 Runes Fine-Grained Reactive Context Isolation Invariant","category":"frontend","severity":"critical","description":"Enforces strict lifecycle-bound encapsulation for Svelte 5 runes ($state, $effect, $derived) within micro-frontend architectures and component hierarchies. Prevents memory leaks caused by module-level signal subscriptions and cross-boundary graph pollution where external event cascades trigger untracked reactive evaluation in unmounted sub-trees.","antiPatternHeadline":"Module-Scoped Signal Retention and Unbounded Cross-Boundary Reactive Graph Pollution","stars_count":53,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","signals","micro-frontends","memory-management"],"exportEndpoints":{"claude":"/api/rules/svelte-5-runes-reactive-context-isolation?format=claude","cursorMdc":"/api/rules/svelte-5-runes-reactive-context-isolation?format=mdc","cursorrules":"/api/rules/svelte-5-runes-reactive-context-isolation?format=cursor","windsurf":"/api/rules/svelte-5-runes-reactive-context-isolation?format=windsurf","agents":"/api/rules/svelte-5-runes-reactive-context-isolation?format=agents"}},{"id":"axum-tokio-cooperative-cancellation-standard","title":"Axum 0.8 Tokio Cooperative Task-Budget Cancellation Standard","category":"backend","severity":"critical","description":"Mandates strict binding between Axum 0.8 client connection drops and Tokio cooperative cancellation tokens across streaming SSE, WebSocket, and long-polling conduits. Eliminates zombie background worker tasks and downstream connection-pool starvation by enforcing RAII-based cancellation propagation and cooperative budget yields on all asynchronous execution paths.","antiPatternHeadline":"Spawning Detached Tokio Tasks in Handlers Without Client Disconnect Binding","stars_count":89,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tokio","concurrency","sse","connection-pool"],"exportEndpoints":{"claude":"/api/rules/axum-tokio-cooperative-cancellation-standard?format=claude","cursorMdc":"/api/rules/axum-tokio-cooperative-cancellation-standard?format=mdc","cursorrules":"/api/rules/axum-tokio-cooperative-cancellation-standard?format=cursor","windsurf":"/api/rules/axum-tokio-cooperative-cancellation-standard?format=windsurf","agents":"/api/rules/axum-tokio-cooperative-cancellation-standard?format=agents"}},{"id":"go124-http3-zero-rtt-anti-replay-idempotency","title":"Go 1.24 HTTP/3 0-RTT Anti-Replay Idempotency Boundary Enforcement","category":"backend","severity":"critical","description":"RFC 8470 and RFC 9114 mandate that TLS 1.3 and QUIC 0-RTT (Early Data) frames are susceptible to passive network replay attacks. In Go 1.24 HTTP/3 edge gateways and services, handlers must enforce an absolute boundary invariant that forbids state-mutating HTTP methods within early data frames, immediately rejecting unconfirmed operations with HTTP 425 (Too Early) or gating them behind non-replayable distributed token leases.","antiPatternHeadline":"Processing Mutating HTTP Requests Inside Unconfirmed 0-RTT Early Data Frames","stars_count":119,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","http3","quic","zero-rtt","replay-attack","security"],"exportEndpoints":{"claude":"/api/rules/go124-http3-zero-rtt-anti-replay-idempotency?format=claude","cursorMdc":"/api/rules/go124-http3-zero-rtt-anti-replay-idempotency?format=mdc","cursorrules":"/api/rules/go124-http3-zero-rtt-anti-replay-idempotency?format=cursor","windsurf":"/api/rules/go124-http3-zero-rtt-anti-replay-idempotency?format=windsurf","agents":"/api/rules/go124-http3-zero-rtt-anti-replay-idempotency?format=agents"}},{"id":"tauri-v2-capability-ipc-scoping-standard","title":"Tauri 2.0 Capability-Based IPC Fine-Grained Scoping Standard","category":"mobile","severity":"critical","description":"Enforces strict least-privilege isolation in Tauri 2.0 mobile architectures by binding every window and webview context to dedicated, schema-validated capability files. Prohibits global wildcards and unconstrained plugin scopes, ensuring native mobile hardware APIs, secure storage, and filesystem operations are cryptographically and contextually bounded.","antiPatternHeadline":"Permissive Global Default Capabilities and Unscoped Command Invocation in Tauri 2.0 Mobile Runtimes","stars_count":70,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri-2","rust","ipc-security","capabilities","sandboxing"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-capability-ipc-scoping-standard?format=claude","cursorMdc":"/api/rules/tauri-v2-capability-ipc-scoping-standard?format=mdc","cursorrules":"/api/rules/tauri-v2-capability-ipc-scoping-standard?format=cursor","windsurf":"/api/rules/tauri-v2-capability-ipc-scoping-standard?format=windsurf","agents":"/api/rules/tauri-v2-capability-ipc-scoping-standard?format=agents"}},{"id":"capacitor-7-hardware-secure-enclave-ephemeral-storage-invariant","title":"Capacitor 7 Hardware-Backed Secure Enclave Ephemeral Storage Invariant","category":"mobile","severity":"critical","description":"Enforces strict hardware-backed cryptographic key isolation (iOS Secure Enclave via Keychain Access Controls and Android 15 StrongBox Keymaster) for Capacitor 7 hybrid applications. Mandates zero-retention memory scrubbing of raw session secrets in the JavaScript runtime and explicit ephemeral native lifecycle disposal to thwart runtime inspection on rooted Android 15 or jailbroken iOS 18 environments.","antiPatternHeadline":"Persisting Unencrypted or Software-Backed Session Tokens in WebView LocalStorage, Native Preferences, or Unscrubbed JS Heap","stars_count":84,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor7","security","cryptography","secure-enclave","android15","ios18","memory-scrubbing"],"exportEndpoints":{"claude":"/api/rules/capacitor-7-hardware-secure-enclave-ephemeral-storage-invariant?format=claude","cursorMdc":"/api/rules/capacitor-7-hardware-secure-enclave-ephemeral-storage-invariant?format=mdc","cursorrules":"/api/rules/capacitor-7-hardware-secure-enclave-ephemeral-storage-invariant?format=cursor","windsurf":"/api/rules/capacitor-7-hardware-secure-enclave-ephemeral-storage-invariant?format=windsurf","agents":"/api/rules/capacitor-7-hardware-secure-enclave-ephemeral-storage-invariant?format=agents"}},{"id":"webauthn-l3-enterprise-attestation-sync-exclusion","title":"WebAuthn Level 3 Enterprise Attestation and Multi-Device Passkey Sync-Exclusion","category":"security","severity":"critical","description":"Enforces strict zero-trust hardware attestation for high-assurance enterprise WebAuthn flows. Requires cryptographically verified AAGUID allowlisting against trusted FIDO Metadata Service (MDS) roots and explicitly rejects multi-device synchronized passkeys by inspecting authenticator data backup flags (BE/BS).","antiPatternHeadline":"Accepting Cloud-Synchronized Passkeys and Unverified AAGUIDs in Zero-Trust Authentication Tiers","stars_count":104,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","fido2","passkeys","zero-trust","cryptography","enterprise-attestation"],"exportEndpoints":{"claude":"/api/rules/webauthn-l3-enterprise-attestation-sync-exclusion?format=claude","cursorMdc":"/api/rules/webauthn-l3-enterprise-attestation-sync-exclusion?format=mdc","cursorrules":"/api/rules/webauthn-l3-enterprise-attestation-sync-exclusion?format=cursor","windsurf":"/api/rules/webauthn-l3-enterprise-attestation-sync-exclusion?format=windsurf","agents":"/api/rules/webauthn-l3-enterprise-attestation-sync-exclusion?format=agents"}},{"id":"cilium-ebpf-socket-mtls-identity-assertion-standard","title":"Cilium eBPF Socket-Level Mutual TLS Identity Assertion Guardrail","category":"security","severity":"critical","description":"Enforces cryptographically authenticated pod-to-pod identity directly within the Linux socket layer using Cilium eBPF authentication handshakes, eliminating user-space sidecar proxy memory overhead and connection latency. Requires all service-to-service ingress and egress rules to declare mandatory mutual TLS verification via Cilium Network Policies backed by SPIFFE/SPIRE workload identities. Prohibits unauthenticated eBPF bypasses, weak IP-based security assertions, and degraded cleartext fallback modes.","antiPatternHeadline":"Relying on Mutable Pod IP Filters or Injected Sidecar Proxies without eBPF Cryptographic Identity Enforcement","stars_count":113,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","cilium","ebpf","mtls","kubernetes","spiffe-spire","zero-trust"],"exportEndpoints":{"claude":"/api/rules/cilium-ebpf-socket-mtls-identity-assertion-standard?format=claude","cursorMdc":"/api/rules/cilium-ebpf-socket-mtls-identity-assertion-standard?format=mdc","cursorrules":"/api/rules/cilium-ebpf-socket-mtls-identity-assertion-standard?format=cursor","windsurf":"/api/rules/cilium-ebpf-socket-mtls-identity-assertion-standard?format=windsurf","agents":"/api/rules/cilium-ebpf-socket-mtls-identity-assertion-standard?format=agents"}},{"id":"oci-v1-1-referrers-intoto-provenance-admission-guardrail","title":"OCI 1.1 Referrers Index In-Toto Provenance Admission Gate Guardrail","category":"devops","severity":"critical","description":"Enforces deterministic traversal and cryptographic verification of the OCI 1.1 referrers index to mandate in-toto SLSA provenance at Kubernetes admission. Workloads referencing mutable tags, missing cryptographically signed attestations, or failing trusted root builder identity checks must be strictly rejected prior to scheduling.","antiPatternHeadline":"Admitting Pods Based on Mutable Image Tags with Unverified or Missing OCI 1.1 In-Toto Provenance Attestations","stars_count":92,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","kubernetes","oci-spec","in-toto","slsa","admission-controller","sigstore","supply-chain"],"exportEndpoints":{"claude":"/api/rules/oci-v1-1-referrers-intoto-provenance-admission-guardrail?format=claude","cursorMdc":"/api/rules/oci-v1-1-referrers-intoto-provenance-admission-guardrail?format=mdc","cursorrules":"/api/rules/oci-v1-1-referrers-intoto-provenance-admission-guardrail?format=cursor","windsurf":"/api/rules/oci-v1-1-referrers-intoto-provenance-admission-guardrail?format=windsurf","agents":"/api/rules/oci-v1-1-referrers-intoto-provenance-admission-guardrail?format=agents"}},{"id":"vllm-pagedattention-multitenant-kv-cache-boundary-invariant","title":"vLLM PagedAttention Multi-Tenant KV-Cache Cryptographic Partitioning & Memory Sanitization","category":"backend","severity":"critical","description":"Enforces tenant-scoped cryptographic domain isolation in vLLM PagedAttention allocation tables and mandates asynchronous zero-scrubbing of recycled GPU block pools. Prevents cross-tenant prompt extraction via prefix caching collision attacks and residual High Bandwidth Memory (HBM) activation recovery.","antiPatternHeadline":"Cross-Tenant Block Pool Recycling with Unsalted Prefix Caching and Dirty Memory Allocation","stars_count":87,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","vllm","paged-attention","kv-cache","multi-tenancy","gpu-security","cuda"],"exportEndpoints":{"claude":"/api/rules/vllm-pagedattention-multitenant-kv-cache-boundary-invariant?format=claude","cursorMdc":"/api/rules/vllm-pagedattention-multitenant-kv-cache-boundary-invariant?format=mdc","cursorrules":"/api/rules/vllm-pagedattention-multitenant-kv-cache-boundary-invariant?format=cursor","windsurf":"/api/rules/vllm-pagedattention-multitenant-kv-cache-boundary-invariant?format=windsurf","agents":"/api/rules/vllm-pagedattention-multitenant-kv-cache-boundary-invariant?format=agents"}},{"id":"web-streams-backpressure-cooperative-drain-invariant","title":"Web Streams Backpressure Cooperative Drain Invariant","category":"frontend","severity":"critical","description":"Enforces strict backpressure propagation and zero-overflow cooperative drain across client-side Web Streams processing high-throughput telemetry, binary blobs, and large artifacts. Prohibits decoupled asynchronous chunk queuing and unthrottled producer reads to prevent V8/Chromium renderer heap exhaustion and browser tab termination.","antiPatternHeadline":"Unbounded Async Enqueueing and Decoupled Stream Pumps Overwhelming Browser Tab Heap","stars_count":55,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","web-streams","memory-leak","performance","streams-api","backpressure"],"exportEndpoints":{"claude":"/api/rules/web-streams-backpressure-cooperative-drain-invariant?format=claude","cursorMdc":"/api/rules/web-streams-backpressure-cooperative-drain-invariant?format=mdc","cursorrules":"/api/rules/web-streams-backpressure-cooperative-drain-invariant?format=cursor","windsurf":"/api/rules/web-streams-backpressure-cooperative-drain-invariant?format=windsurf","agents":"/api/rules/web-streams-backpressure-cooperative-drain-invariant?format=agents"}},{"id":"svelte-5-runes-cycle-barrier","title":"Svelte 5 Runes Microtask Re-entrancy & Reactive Dependency Cycle Barrier","category":"frontend","severity":"critical","description":"Enforces strict unidirectional data flow and non-cyclical dependency invariants across Svelte 5 custom runes and effect handlers. Prevents catastrophic microtask queue starvation and synchronous infinite re-entrancy caused by bi-directional state mutations across nested reactive contexts.","antiPatternHeadline":"Bi-directional Ping-Pong Synchronization via Cascading $effect State Mutations","stars_count":92,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","reactivity","performance","architecture"],"exportEndpoints":{"claude":"/api/rules/svelte-5-runes-cycle-barrier?format=claude","cursorMdc":"/api/rules/svelte-5-runes-cycle-barrier?format=mdc","cursorrules":"/api/rules/svelte-5-runes-cycle-barrier?format=cursor","windsurf":"/api/rules/svelte-5-runes-cycle-barrier?format=windsurf","agents":"/api/rules/svelte-5-runes-cycle-barrier?format=agents"}},{"id":"axum-tokio-broadcast-graceful-teardown-barrier","title":"Axum 0.8 Tokio Broadcast Channel Graceful Teardown Barrier","category":"backend","severity":"critical","description":"Enforces a two-phase connection draining and broadcast channel shutdown barrier for long-lived streaming connections (SSE and WebSockets) in Axum 0.8. Prevents message loss, abrupt socket resets (RST), and half-open deadlocks during zero-downtime rolling container deployments by synchronizing HTTP server termination with consumer stream exhaustion via cancellation tokens and task trackers.","antiPatternHeadline":"Abrupt Runtime Termination of Axum SSE/WebSocket Streams on SIGTERM Causing Message Drops and Client Socket Resets","stars_count":80,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tokio","sse","websockets","graceful-shutdown"],"exportEndpoints":{"claude":"/api/rules/axum-tokio-broadcast-graceful-teardown-barrier?format=claude","cursorMdc":"/api/rules/axum-tokio-broadcast-graceful-teardown-barrier?format=mdc","cursorrules":"/api/rules/axum-tokio-broadcast-graceful-teardown-barrier?format=cursor","windsurf":"/api/rules/axum-tokio-broadcast-graceful-teardown-barrier?format=windsurf","agents":"/api/rules/axum-tokio-broadcast-graceful-teardown-barrier?format=agents"}},{"id":"pgvector-hnsw-iterative-scan-memory-budget","title":"pgvector 0.8+ HNSW Iterative Index Scan Memory Budget Guardrail","category":"backend","severity":"critical","description":"Enforces strict session-level memory caps and scan bounds during pgvector 0.8+ iterative HNSW index scans on PostgreSQL 17. Highly selective relational WHERE clauses combined with nearest-neighbor vector operators cause unbounded graph traversal and candidate set allocation in backend worker memory, triggering OOM panics unless guarded by hnsw.iterative_scan and work_mem safeguards.","antiPatternHeadline":"Unbounded Iterative HNSW Graph Traversals Triggering Postgres Worker OOM Panics","stars_count":104,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres","pgvector","database","hnsw","performance","memory-management"],"exportEndpoints":{"claude":"/api/rules/pgvector-hnsw-iterative-scan-memory-budget?format=claude","cursorMdc":"/api/rules/pgvector-hnsw-iterative-scan-memory-budget?format=mdc","cursorrules":"/api/rules/pgvector-hnsw-iterative-scan-memory-budget?format=cursor","windsurf":"/api/rules/pgvector-hnsw-iterative-scan-memory-budget?format=windsurf","agents":"/api/rules/pgvector-hnsw-iterative-scan-memory-budget?format=agents"}},{"id":"kmp-swift-export-foreign-memory-quarantine","title":"Kotlin Multiplatform 2.1 Swift Export Foreign Memory Allocation Quarantine","category":"mobile","severity":"critical","description":"Enforces strict memory quarantine and deterministic buffer lifetime management across the Kotlin/Native 2.1 Swift Export boundary. Prevents silent heap corruption, double-frees, and use-after-free crashes by prohibiting raw unmanaged pointer escapes and mandating scoped pinned-buffer transfers with explicit ownership handoffs.","antiPatternHeadline":"Escaping Raw CPointer or UnsafePointer Across Swift Export Boundaries Without Explicit Lifetime Pinning","stars_count":70,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kmp","kotlin-native","swift-export","memory-management","concurrency"],"exportEndpoints":{"claude":"/api/rules/kmp-swift-export-foreign-memory-quarantine?format=claude","cursorMdc":"/api/rules/kmp-swift-export-foreign-memory-quarantine?format=mdc","cursorrules":"/api/rules/kmp-swift-export-foreign-memory-quarantine?format=cursor","windsurf":"/api/rules/kmp-swift-export-foreign-memory-quarantine?format=windsurf","agents":"/api/rules/kmp-swift-export-foreign-memory-quarantine?format=agents"}},{"id":"tauri-2-zero-copy-binary-ipc-guardrail","title":"Tauri 2.0 Zero-Copy Binary IPC Protocol for High-Throughput Mobile Sensor Streams","category":"mobile","severity":"critical","description":"Enforces zero-copy byte buffer transfers via Tauri 2.0 IPC Response primitives instead of Serde JSON or Base64 serialization for high-frequency telemetry and sensor feeds. Eliminates serialization overhead, V8 garbage collection thrashing, and memory bloat on resource-constrained iOS and Android WebViews.","antiPatternHeadline":"Serializing High-Frequency Binary Sensor Telemetry into JSON Arrays or Base64 Strings Across IPC","stars_count":75,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri-2","rust","zero-copy","ipc","arraybuffer","performance"],"exportEndpoints":{"claude":"/api/rules/tauri-2-zero-copy-binary-ipc-guardrail?format=claude","cursorMdc":"/api/rules/tauri-2-zero-copy-binary-ipc-guardrail?format=mdc","cursorrules":"/api/rules/tauri-2-zero-copy-binary-ipc-guardrail?format=cursor","windsurf":"/api/rules/tauri-2-zero-copy-binary-ipc-guardrail?format=windsurf","agents":"/api/rules/tauri-2-zero-copy-binary-ipc-guardrail?format=agents"}},{"id":"hybrid-pq-tls13-clienthello-fragmentation-guardrail","title":"Hybrid Post-Quantum TLS 1.3 (ML-KEM-768) ClientHello Fragmentation Guardrail","category":"security","severity":"critical","description":"Enforces strict ClientHello payload budgeting and key-share negotiation policies when deploying hybrid post-quantum algorithms like X25519MLKEM768. Prevents catastrophic middlebox packet drops and latency penalties caused by multi-segment IP/TCP fragmentation when the TLS 1.3 ClientHello exceeds standard MTU boundaries (~1460 byte MSS). Mandates single key-share advertisement, extension payload minimization, and automated fallback monitoring without downgrading cryptographic guarantees.","antiPatternHeadline":"Multi-Group KeyShare Bloat Exceeding Standard MTU Causing Middlebox Blackholing","stars_count":56,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","tls13","post-quantum","ml-kem","networking","cryptography"],"exportEndpoints":{"claude":"/api/rules/hybrid-pq-tls13-clienthello-fragmentation-guardrail?format=claude","cursorMdc":"/api/rules/hybrid-pq-tls13-clienthello-fragmentation-guardrail?format=mdc","cursorrules":"/api/rules/hybrid-pq-tls13-clienthello-fragmentation-guardrail?format=cursor","windsurf":"/api/rules/hybrid-pq-tls13-clienthello-fragmentation-guardrail?format=windsurf","agents":"/api/rules/hybrid-pq-tls13-clienthello-fragmentation-guardrail?format=agents"}},{"id":"webauthn-largeblob-sync-cryptographic-integrity-envelope","title":"Passkey LargeBlob Synchronized Cryptographic State and Monotonic Integrity Invariant","category":"security","severity":"critical","description":"Enforces client-side cryptographic integrity checks and monotonic sequence versioning on WebAuthn largeBlob storage payloads. Prevents out-of-order writes, stale-state rollbacks, and cross-origin state injection caused by multi-device cloud synchronization ecosystems (e.g., iCloud Keychain, Google Password Manager).","antiPatternHeadline":"Blind writes or raw unversioned AEAD encryption of passkey largeBlob payloads without monotonic sequence binding and RP-credential AAD validation","stars_count":59,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","passkeys","largeblob","cryptography","aead","distributed-sync"],"exportEndpoints":{"claude":"/api/rules/webauthn-largeblob-sync-cryptographic-integrity-envelope?format=claude","cursorMdc":"/api/rules/webauthn-largeblob-sync-cryptographic-integrity-envelope?format=mdc","cursorrules":"/api/rules/webauthn-largeblob-sync-cryptographic-integrity-envelope?format=cursor","windsurf":"/api/rules/webauthn-largeblob-sync-cryptographic-integrity-envelope?format=windsurf","agents":"/api/rules/webauthn-largeblob-sync-cryptographic-integrity-envelope?format=agents"}},{"id":"kubernetes-dra-structured-parameters-guardrail","title":"Deterministic Structured Parameters for Kubernetes Dynamic Resource Allocation (DRA)","category":"devops","severity":"critical","description":"Enforces declarative, structured parameter claims for Dynamic Resource Allocation (resource.k8s.io/v1beta1) in heterogeneous accelerator clusters. Eliminates driver-side allocation race conditions, non-deterministic fractional GPU slicing, and scheduling deadlocks across multi-tenant inference workloads.","antiPatternHeadline":"Unstructured Opaque DRA Requests Causing Scheduler Race Conditions and Fragmented Memory Slices","stars_count":107,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["kubernetes","dra","gpu","scheduling","resource-claims","devops"],"exportEndpoints":{"claude":"/api/rules/kubernetes-dra-structured-parameters-guardrail?format=claude","cursorMdc":"/api/rules/kubernetes-dra-structured-parameters-guardrail?format=mdc","cursorrules":"/api/rules/kubernetes-dra-structured-parameters-guardrail?format=cursor","windsurf":"/api/rules/kubernetes-dra-structured-parameters-guardrail?format=windsurf","agents":"/api/rules/kubernetes-dra-structured-parameters-guardrail?format=agents"}},{"id":"envoy-http3-quic-early-data-anti-replay-standard","title":"Envoy HTTP/3 QUIC 0-RTT Early Data Anti-Replay Guardrail","category":"devops","severity":"critical","description":"Enforces strict anti-replay mitigations for Envoy HTTP/3 QUIC 0-RTT early data before requests propagate to upstream services. Mandates RFC 8470 compliance, route-level early data policies restricting early frames to idempotent methods, and automated HTTP 425 (Too Early) rejections for unvalidated or mutable actions.","antiPatternHeadline":"Blindly Forwarding 0-RTT QUIC Early Data on Mutating Endpoints Without Anti-Replay Buffering or RFC 8470 Validation","stars_count":40,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","envoy","http3","quic","zero-rtt","anti-replay","tls13"],"exportEndpoints":{"claude":"/api/rules/envoy-http3-quic-early-data-anti-replay-standard?format=claude","cursorMdc":"/api/rules/envoy-http3-quic-early-data-anti-replay-standard?format=mdc","cursorrules":"/api/rules/envoy-http3-quic-early-data-anti-replay-standard?format=cursor","windsurf":"/api/rules/envoy-http3-quic-early-data-anti-replay-standard?format=windsurf","agents":"/api/rules/envoy-http3-quic-early-data-anti-replay-standard?format=agents"}},{"id":"react19-server-actions-optimistic-rollback-reseed-invariant","title":"React 19 Server Actions Optimistic Mutation Rollback & Reseed Invariant","category":"frontend","severity":"critical","description":"Enforces deterministic reconciliation between client optimistic state via useOptimistic, server action response payloads via useActionState, and persistent form inputs. Prevents UI tearing, lost user focus/draft input, and ghost state when edge server actions fail or experience high-latency network partitions.","antiPatternHeadline":"Ad-Hoc Imperative useState Optimism with Unchecked Form Resets on Action Failure","stars_count":100,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","server-actions","use-optimistic","use-action-state"],"exportEndpoints":{"claude":"/api/rules/react19-server-actions-optimistic-rollback-reseed-invariant?format=claude","cursorMdc":"/api/rules/react19-server-actions-optimistic-rollback-reseed-invariant?format=mdc","cursorrules":"/api/rules/react19-server-actions-optimistic-rollback-reseed-invariant?format=cursor","windsurf":"/api/rules/react19-server-actions-optimistic-rollback-reseed-invariant?format=windsurf","agents":"/api/rules/react19-server-actions-optimistic-rollback-reseed-invariant?format=agents"}},{"id":"axum-http3-quic-stream-draining-standard","title":"Axum 0.8 HTTP/3 QUIC In-Flight Stream Draining Standard","category":"backend","severity":"critical","description":"Enforces deterministic two-phase GOAWAY signaling, active stream counting, and coordinated UDP connection draining for Axum 0.8 HTTP/3 (QUIC) microservices. Prevents truncated multiplexed streams, silent request drops, and client-side stream resets during container rolling restarts.","antiPatternHeadline":"Dropping QUIC Endpoints on SIGTERM Without Two-Phase GOAWAY Stream Draining","stars_count":64,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","http3","quic","networking","kubernetes"],"exportEndpoints":{"claude":"/api/rules/axum-http3-quic-stream-draining-standard?format=claude","cursorMdc":"/api/rules/axum-http3-quic-stream-draining-standard?format=mdc","cursorrules":"/api/rules/axum-http3-quic-stream-draining-standard?format=cursor","windsurf":"/api/rules/axum-http3-quic-stream-draining-standard?format=windsurf","agents":"/api/rules/axum-http3-quic-stream-draining-standard?format=agents"}},{"id":"postgres-17-failover-slot-sync-guardrail-postgres-17-fail-948","title":"Postgres 17 Failover Slot Synchronization & Synchronized Logical Replication Guardrail","category":"backend","severity":"critical","description":"Enforces Postgres 17 native logical replication failover slot synchronization across primary and physical standby nodes. Guarantees that CDC consumers and logical decoding subscribers maintain zero-data-loss and strictly ordered streaming without duplicate or dropped WAL segments after automated HA cluster failover.","antiPatternHeadline":"Creating unmanaged logical slots without failover synchronization and standby physical replication slot coordination","stars_count":73,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgres-17","cdc","logical-replication","high-availability","database"],"exportEndpoints":{"claude":"/api/rules/postgres-17-failover-slot-sync-guardrail-postgres-17-fail-948?format=claude","cursorMdc":"/api/rules/postgres-17-failover-slot-sync-guardrail-postgres-17-fail-948?format=mdc","cursorrules":"/api/rules/postgres-17-failover-slot-sync-guardrail-postgres-17-fail-948?format=cursor","windsurf":"/api/rules/postgres-17-failover-slot-sync-guardrail-postgres-17-fail-948?format=windsurf","agents":"/api/rules/postgres-17-failover-slot-sync-guardrail-postgres-17-fail-948?format=agents"}},{"id":"go-chi-sse-client-disconnect-teardown-guardrail","title":"Go Chi SSE Client Disconnect & Stream Teardown Sentinel Guardrail","category":"backend","severity":"critical","description":"Binds HTTP Server-Sent Event (SSE) streaming runtimes strictly to underlying TCP socket closures using Chi context propagation. Ensures prompt reclamation of connection pools and prevents runaway background goroutine leaks during client dropouts or network partitions.","antiPatternHeadline":"Orphaned SSE Goroutines and TCP Pool Starvation via Unmonitored Context Closure","stars_count":113,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","chi","sse","concurrency","goroutines","memory-leak"],"exportEndpoints":{"claude":"/api/rules/go-chi-sse-client-disconnect-teardown-guardrail?format=claude","cursorMdc":"/api/rules/go-chi-sse-client-disconnect-teardown-guardrail?format=mdc","cursorrules":"/api/rules/go-chi-sse-client-disconnect-teardown-guardrail?format=cursor","windsurf":"/api/rules/go-chi-sse-client-disconnect-teardown-guardrail?format=windsurf","agents":"/api/rules/go-chi-sse-client-disconnect-teardown-guardrail?format=agents"}},{"id":"compose-skiko-metal-vulkan-presentation-latency-invariant","title":"Compose Multiplatform SKIKO Metal/Vulkan Presentation Latency & Swap-Chain Invariant","category":"mobile","severity":"critical","description":"Enforces strict swap-chain synchronization, shared graphics context lifecycles, and VSync pacing across Metal and Vulkan backends in Compose Multiplatform. Prevents GPU context thrashing, command queue starvation, and drawable exhaustion in multi-window desktop and high-refresh-rate mobile configurations. Guarantees deterministic presentation scheduling by decoupling composition dispatch from platform rendering swap-buffers.","antiPatternHeadline":"Spawning Disjoint GrDirectContexts and Blocking UI Dispatchers on Swap-Chain Backpressure","stars_count":104,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","compose-multiplatform","skiko","metal","vulkan","rendering","gpu"],"exportEndpoints":{"claude":"/api/rules/compose-skiko-metal-vulkan-presentation-latency-invariant?format=claude","cursorMdc":"/api/rules/compose-skiko-metal-vulkan-presentation-latency-invariant?format=mdc","cursorrules":"/api/rules/compose-skiko-metal-vulkan-presentation-latency-invariant?format=cursor","windsurf":"/api/rules/compose-skiko-metal-vulkan-presentation-latency-invariant?format=windsurf","agents":"/api/rules/compose-skiko-metal-vulkan-presentation-latency-invariant?format=agents"}},{"id":"cedar-formal-verification-deterministic-slicing","title":"Cedar Policy Engine Formal Verification & Deterministic Policy Slicing Invariant","category":"security","severity":"critical","description":"Enforces formal verification via SMT-backed validation and deterministic policy slicing on Cedar authorization policies before compilation or deployment to API gateways. Prevents privilege escalation paths and conflicting forbid/permit evaluation leaks across distributed microservice boundaries by mathematically proving policy soundness and non-interference.","antiPatternHeadline":"Ad-hoc Gateway Ingestion of Unverified Cedar Policies with Ambiguous Scope and Non-Deterministic Slicing","stars_count":80,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","cedar-policy","formal-verification","zero-trust","authorization","smt"],"exportEndpoints":{"claude":"/api/rules/cedar-formal-verification-deterministic-slicing?format=claude","cursorMdc":"/api/rules/cedar-formal-verification-deterministic-slicing?format=mdc","cursorrules":"/api/rules/cedar-formal-verification-deterministic-slicing?format=cursor","windsurf":"/api/rules/cedar-formal-verification-deterministic-slicing?format=windsurf","agents":"/api/rules/cedar-formal-verification-deterministic-slicing?format=agents"}},{"id":"ebpf-uretprobe-overhead-quarantine-guardrail","title":"eBPF uretprobe Latency Tail Quarantine and Overhead Guardrail","category":"devops","severity":"critical","description":"Enforces strict instruction ceilings, dynamic sampling governors, and circuit-breaking quotas on eBPF uretprobes in continuous production profiling. Prevents severe user-space thread stalls caused by trampoline-induced context switching and lock contention in high-frequency invocation paths. Guarantees that tracing overhead never exceeds 1% aggregate CPU or causes p99 latency regressions.","antiPatternHeadline":"Attaching Unbounded uretprobes to Hot-Path User Functions Without In-Bpf Cycle Quotas or Circuit Breakers","stars_count":82,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","observability","profiling","linux-kernel","performance"],"exportEndpoints":{"claude":"/api/rules/ebpf-uretprobe-overhead-quarantine-guardrail?format=claude","cursorMdc":"/api/rules/ebpf-uretprobe-overhead-quarantine-guardrail?format=mdc","cursorrules":"/api/rules/ebpf-uretprobe-overhead-quarantine-guardrail?format=cursor","windsurf":"/api/rules/ebpf-uretprobe-overhead-quarantine-guardrail?format=windsurf","agents":"/api/rules/ebpf-uretprobe-overhead-quarantine-guardrail?format=agents"}},{"id":"nats-jetstream-deduplication-window-invariant-nats-jetstream-i-448","title":"NATS JetStream Sliding Deduplication Window & Message Hash Invariant","category":"devops","severity":"critical","description":"Enforces deterministic deduplication keys (Nats-Msg-Id) and guarantees stream sliding deduplication windows cover maximum edge retry backoff intervals. Prevents duplicate state mutation across network-partitioned edge topologies by asserting canonical sequence hashing and broker-side deduplication verification.","antiPatternHeadline":"Ephemerally Generated Message IDs and Truncated Deduplication Windows Inducing Double-Processing","stars_count":72,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","nats","jetstream","idempotency","distributed-systems","edge-computing"],"exportEndpoints":{"claude":"/api/rules/nats-jetstream-deduplication-window-invariant-nats-jetstream-i-448?format=claude","cursorMdc":"/api/rules/nats-jetstream-deduplication-window-invariant-nats-jetstream-i-448?format=mdc","cursorrules":"/api/rules/nats-jetstream-deduplication-window-invariant-nats-jetstream-i-448?format=cursor","windsurf":"/api/rules/nats-jetstream-deduplication-window-invariant-nats-jetstream-i-448?format=windsurf","agents":"/api/rules/nats-jetstream-deduplication-window-invariant-nats-jetstream-i-448?format=agents"}},{"id":"react-19-server-action-idempotency-key-standard","title":"React 19 Server Action Client-Side UUIDv7 Idempotency Standard","category":"frontend","severity":"critical","description":"Enforces client-synthesized UUIDv7 idempotency keys on all state-mutating React 19 Server Actions paired with optimistic updates. Guarantees exactly-once mutation semantics across spotty mobile network reconnections, duplicate form submissions, and automated retry loops. Prevents duplicated side effects such as repeat charges, duplicate ledger entries, and orphaned database rows.","antiPatternHeadline":"Submitting Blind Server Actions and Optimistic State Without Client-Generated Idempotency Keys","stars_count":114,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","server-actions","idempotency","uuidv7","optimistic-ui","next.js"],"exportEndpoints":{"claude":"/api/rules/react-19-server-action-idempotency-key-standard?format=claude","cursorMdc":"/api/rules/react-19-server-action-idempotency-key-standard?format=mdc","cursorrules":"/api/rules/react-19-server-action-idempotency-key-standard?format=cursor","windsurf":"/api/rules/react-19-server-action-idempotency-key-standard?format=windsurf","agents":"/api/rules/react-19-server-action-idempotency-key-standard?format=agents"}},{"id":"pg17-failover-synchronized-logical-replication-guardrail","title":"PostgreSQL 17 Failover-Synchronized Logical Replication Slot Guardrail","category":"backend","severity":"critical","description":"Enforces failover-ready logical replication slots introduced in PostgreSQL 17 to prevent Change Data Capture (CDC) event stream divergence during physical replica promotions. Mandates failover configuration on primary logical slots and synchronizes standby slots using synchronized_standby_slots and sync_replication_slots. Guarantees zero data loss and prevents duplicate or skipped CDC events upon unplanned failovers.","antiPatternHeadline":"Creating uncoordinated logical replication slots lacking synchronized failover metadata across physical standbys","stars_count":95,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql-17","cdc","replication-slots","high-availability","failover","debezium"],"exportEndpoints":{"claude":"/api/rules/pg17-failover-synchronized-logical-replication-guardrail?format=claude","cursorMdc":"/api/rules/pg17-failover-synchronized-logical-replication-guardrail?format=mdc","cursorrules":"/api/rules/pg17-failover-synchronized-logical-replication-guardrail?format=cursor","windsurf":"/api/rules/pg17-failover-synchronized-logical-replication-guardrail?format=windsurf","agents":"/api/rules/pg17-failover-synchronized-logical-replication-guardrail?format=agents"}},{"id":"bun-worker-resource-ceiling-sandboxing-standard","title":"Bun 1.2 Multi-Tenant Worker Resource Ceiling and Sandbox Isolation","category":"backend","severity":"critical","description":"Enforces deterministic memory quotas and strict execution boundaries on Bun workers to prevent multi-tenant noisy-neighbor starvation and host process out-of-memory crashes. Mandates explicit resourceLimits configuration, aggressive watchdog timeouts, and mediated host-worker IPC protocols instead of direct host system access.","antiPatternHeadline":"Unconstrained Worker Allocation and Unsandboxed Execution Causing Host Process OOM and Event Loop Starvation","stars_count":45,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","web-workers","sandboxing","resource-limits","multi-tenancy"],"exportEndpoints":{"claude":"/api/rules/bun-worker-resource-ceiling-sandboxing-standard?format=claude","cursorMdc":"/api/rules/bun-worker-resource-ceiling-sandboxing-standard?format=mdc","cursorrules":"/api/rules/bun-worker-resource-ceiling-sandboxing-standard?format=cursor","windsurf":"/api/rules/bun-worker-resource-ceiling-sandboxing-standard?format=windsurf","agents":"/api/rules/bun-worker-resource-ceiling-sandboxing-standard?format=agents"}},{"id":"tauri-v2-granular-ipc-capability-guardrail","title":"Tauri 2.0 Granular IPC Capability & Scoped Permission Guardrail","category":"mobile","severity":"critical","description":"Enforces strict principle-of-least-privilege capability manifests and scoped IPC bindings in Tauri 2.0 mobile and desktop targets. Disallows wildcard permissions, global shell execution, unrestricted filesystem scopes, and unvalidated frontend invokes to prevent unauthorized host subsystem compromise via XSS or supply chain vulnerabilities.","antiPatternHeadline":"Over-Privileged Wildcard Capabilities and Unscoped IPC Invocations Exposing Host Operating System Subsystems","stars_count":64,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri","tauri-2","security","ipc","capabilities","rust"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-granular-ipc-capability-guardrail?format=claude","cursorMdc":"/api/rules/tauri-v2-granular-ipc-capability-guardrail?format=mdc","cursorrules":"/api/rules/tauri-v2-granular-ipc-capability-guardrail?format=cursor","windsurf":"/api/rules/tauri-v2-granular-ipc-capability-guardrail?format=windsurf","agents":"/api/rules/tauri-v2-granular-ipc-capability-guardrail?format=agents"}},{"id":"compose-multiplatform-skiko-thread-affinity-guardrail-compose-multipla-930","title":"Compose Multiplatform 1.8 Skiko Render Pipeline Thread-Affinity Guardrail","category":"mobile","severity":"critical","description":"Enforces strict UI-thread dispatcher binding and deterministic surface synchronization during platform-native view embedding in Compose Multiplatform 1.8. Prevents GPU context deadlocks, EGL/Metal resource corruption, and asynchronous surface teardown race conditions between the Skiko render pipeline and native platform rendering hierarchies.","antiPatternHeadline":"Dispatching Platform Native Views or Skiko Surface Operations on Non-Main Coroutine Contexts","stars_count":116,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","compose-multiplatform","skiko","kotlin-multiplatform","metal","egl","concurrency"],"exportEndpoints":{"claude":"/api/rules/compose-multiplatform-skiko-thread-affinity-guardrail-compose-multipla-930?format=claude","cursorMdc":"/api/rules/compose-multiplatform-skiko-thread-affinity-guardrail-compose-multipla-930?format=mdc","cursorrules":"/api/rules/compose-multiplatform-skiko-thread-affinity-guardrail-compose-multipla-930?format=cursor","windsurf":"/api/rules/compose-multiplatform-skiko-thread-affinity-guardrail-compose-multipla-930?format=windsurf","agents":"/api/rules/compose-multiplatform-skiko-thread-affinity-guardrail-compose-multipla-930?format=agents"}},{"id":"wasi-preview2-canonical-abi-isolation","title":"WASI 0.2 Component Model Shared-Nothing Sandbox Guardrail","category":"security","severity":"critical","description":"Enforces strict canonical ABI boundaries and shared-nothing memory isolation across WebAssembly Component Model (WASI 0.2) interfaces. Prevents arbitrary host-guest pointer passing, raw linear memory sharing, and unconstrained capability grants when executing untrusted dynamic plugins. Guarantees that communication across component boundaries uses exclusively WIT (Wasm Interface Type) declarations with canonical serialization and explicit host resource handle lifecycles.","antiPatternHeadline":"Exposing Raw Linear Memory Pointers or Direct Host Capabilities to Guest Components","stars_count":48,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webassembly","wasi","wasmtime","component-model","wit"],"exportEndpoints":{"claude":"/api/rules/wasi-preview2-canonical-abi-isolation?format=claude","cursorMdc":"/api/rules/wasi-preview2-canonical-abi-isolation?format=mdc","cursorrules":"/api/rules/wasi-preview2-canonical-abi-isolation?format=cursor","windsurf":"/api/rules/wasi-preview2-canonical-abi-isolation?format=windsurf","agents":"/api/rules/wasi-preview2-canonical-abi-isolation?format=agents"}},{"id":"slsa-l4-hermetic-build-provenance-attestation-guardrail","title":"SLSA Build Level 3/4 Hermetic Provenance and Ephemeral Attestation Guardrail","category":"security","severity":"critical","description":"Enforces cryptographically verifiable, ephemeral, and air-gapped CI/CD build environments to eliminate supply chain tampering. Requires network-isolated build phases with pre-fetched pinned dependencies, cryptographic SHA256 immutability for all builders, and automated generation of signed in-toto SLSA provenance predicates outside the build execution context.","antiPatternHeadline":"Non-Hermetic Ambient Builds With Dynamic Network Ingress and Untrusted Provenance Generation","stars_count":67,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","slsa","supply-chain","sigstore","in-toto","hermetic-builds","attestation"],"exportEndpoints":{"claude":"/api/rules/slsa-l4-hermetic-build-provenance-attestation-guardrail?format=claude","cursorMdc":"/api/rules/slsa-l4-hermetic-build-provenance-attestation-guardrail?format=mdc","cursorrules":"/api/rules/slsa-l4-hermetic-build-provenance-attestation-guardrail?format=cursor","windsurf":"/api/rules/slsa-l4-hermetic-build-provenance-attestation-guardrail?format=windsurf","agents":"/api/rules/slsa-l4-hermetic-build-provenance-attestation-guardrail?format=agents"}},{"id":"ebpf-sockops-w3c-traceparent-injection-standard","title":"eBPF Socket-Layer Kernel W3C Traceparent Header Injection Standard","category":"devops","severity":"critical","description":"Mandates strict stream protocol validation, TLS/ULP state inspection, and pointer revalidation during kernel-level TCP stream inspection using BPF_PROG_TYPE_SK_MSG. Prohibits direct ASCII header insertion into raw encrypted TCP streams or binary multiplexed protocols (HTTP/2, HTTP/3) without verified kernel TLS offload.","antiPatternHeadline":"Blind ASCII W3C Header Injection into Raw Encrypted or Multiplexed TCP Sockets via sk_msg","stars_count":51,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["ebpf","w3c-tracecontext","kernel","devops","sockops","distributed-tracing","telemetry"],"exportEndpoints":{"claude":"/api/rules/ebpf-sockops-w3c-traceparent-injection-standard?format=claude","cursorMdc":"/api/rules/ebpf-sockops-w3c-traceparent-injection-standard?format=mdc","cursorrules":"/api/rules/ebpf-sockops-w3c-traceparent-injection-standard?format=cursor","windsurf":"/api/rules/ebpf-sockops-w3c-traceparent-injection-standard?format=windsurf","agents":"/api/rules/ebpf-sockops-w3c-traceparent-injection-standard?format=agents"}},{"id":"k8s-gateway-api-v1-2-referencegrant-route-delegation","title":"Explicit Cross-Namespace ReferenceGrant and Route Delegation Boundaries in Gateway API v1.2","category":"devops","severity":"critical","description":"Enforces explicit, zero-trust cross-namespace routing and route delegation boundaries across multi-tenant clusters via Kubernetes Gateway API v1.2 ReferenceGrant resources. Prevents cross-tenant service hijacking, unauthorized host-collision takeovers, and silent traffic misdirection by mandating precise Group, Kind, and Namespace authorization tuples on all cross-namespace parent-child route attachments and backend service references.","antiPatternHeadline":"Unbounded Cross-Namespace Routing and Missing ReferenceGrants Permitting Tenant Service Hijacking","stars_count":75,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","kubernetes","gateway-api","referencegrant","multi-tenancy","zero-trust","route-delegation"],"exportEndpoints":{"claude":"/api/rules/k8s-gateway-api-v1-2-referencegrant-route-delegation?format=claude","cursorMdc":"/api/rules/k8s-gateway-api-v1-2-referencegrant-route-delegation?format=mdc","cursorrules":"/api/rules/k8s-gateway-api-v1-2-referencegrant-route-delegation?format=cursor","windsurf":"/api/rules/k8s-gateway-api-v1-2-referencegrant-route-delegation?format=windsurf","agents":"/api/rules/k8s-gateway-api-v1-2-referencegrant-route-delegation?format=agents"}},{"id":"svelte-5-runes-async-hydration-boundary","title":"Svelte 5 Runes Async Hydration Boundary Guardrail","category":"frontend","severity":"critical","description":"Enforces strict isolation of asynchronous microtask execution from Svelte 5 synchronous signal tracking to prevent reactive graph tearing. In Svelte 5, the active reactive tracking context ($effect, $derived) is synchronously bound and detaches across await points and microtask queues. This rule prevents orphaned signals, missed invalidations, and DOM hydration mismatches between SSR streaming chunks and client signal graphs.","antiPatternHeadline":"Microtask Suspension Within Runes Tracking Context Causing Hydration Graph Tearing","stars_count":114,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","svelte5","runes","ssr","hydration","signals"],"exportEndpoints":{"claude":"/api/rules/svelte-5-runes-async-hydration-boundary?format=claude","cursorMdc":"/api/rules/svelte-5-runes-async-hydration-boundary?format=mdc","cursorrules":"/api/rules/svelte-5-runes-async-hydration-boundary?format=cursor","windsurf":"/api/rules/svelte-5-runes-async-hydration-boundary?format=windsurf","agents":"/api/rules/svelte-5-runes-async-hydration-boundary?format=agents"}},{"id":"react-native-77-bridgeless-fabric-pipeline-invariant","title":"React Native 0.77 Bridgeless Fabric Synchronous JSI Layout Pipeline Invariants","category":"mobile","severity":"critical","description":"Enforces synchronous JSI memory alignment and prevents blocking TurboModule calls during concurrent Fabric layout passes in React Native 0.77 Bridgeless architecture. Eliminates main-thread priority inversions, JS-thread deadlocks, and dropped layout frames on 120Hz ProMotion/high-refresh displays.","antiPatternHeadline":"Executing Synchronous TurboModule JSI Invocations Inside Fabric Layout Passes and Component Render Lifecycles","stars_count":93,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","react-native","fabric","turbomodules","jsi","bridgeless","concurrency"],"exportEndpoints":{"claude":"/api/rules/react-native-77-bridgeless-fabric-pipeline-invariant?format=claude","cursorMdc":"/api/rules/react-native-77-bridgeless-fabric-pipeline-invariant?format=mdc","cursorrules":"/api/rules/react-native-77-bridgeless-fabric-pipeline-invariant?format=cursor","windsurf":"/api/rules/react-native-77-bridgeless-fabric-pipeline-invariant?format=windsurf","agents":"/api/rules/react-native-77-bridgeless-fabric-pipeline-invariant?format=agents"}},{"id":"postgres-17-async-direct-io-block-cache-invariant","title":"Postgres 17 Asynchronous Direct I/O Memory Alignment & Zero-Copy Invariant","category":"backend","severity":"critical","description":"Enforces strict sector-aligned memory buffer allocations and block-granular I/O boundaries when interfacing with PostgreSQL 17 asynchronous direct I/O (AIO/io_direct) subsystems and custom block drivers. Prevents double-buffering OS page cache thrashing, EINVAL traps on io_uring/libaio syscalls, and degraded fallback execution during write-intensive transactional and ingestion workloads.","antiPatternHeadline":"Unaligned Heap Allocations and Variable-Size Buffer Writes Bypassing Direct I/O Invariants","stars_count":104,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","postgresql","direct-io","memory-alignment","performance","io-uring"],"exportEndpoints":{"claude":"/api/rules/postgres-17-async-direct-io-block-cache-invariant?format=claude","cursorMdc":"/api/rules/postgres-17-async-direct-io-block-cache-invariant?format=mdc","cursorrules":"/api/rules/postgres-17-async-direct-io-block-cache-invariant?format=cursor","windsurf":"/api/rules/postgres-17-async-direct-io-block-cache-invariant?format=windsurf","agents":"/api/rules/postgres-17-async-direct-io-block-cache-invariant?format=agents"}},{"id":"fastapi-nogil-concurrency-guardrail","title":"FastAPI Free-Threaded (Python 3.13 nogil) Shared-Memory Concurrency Standard","category":"backend","severity":"critical","description":"Mandates explicit thread-safe synchronization primitives for shared in-process state in Python 3.13 free-threaded (PEP 703 / nogil) FastAPI runtimes. In environments without the Global Interpreter Lock, compound operations on native collections produce race conditions, lost updates, and memory-inconsistency bugs across parallel execution threads.","antiPatternHeadline":"Unsynchronized in-memory state manipulation assuming legacy GIL serialization in Python 3.13t","stars_count":93,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","python313","nogil","multithreading","concurrency","performance"],"exportEndpoints":{"claude":"/api/rules/fastapi-nogil-concurrency-guardrail?format=claude","cursorMdc":"/api/rules/fastapi-nogil-concurrency-guardrail?format=mdc","cursorrules":"/api/rules/fastapi-nogil-concurrency-guardrail?format=cursor","windsurf":"/api/rules/fastapi-nogil-concurrency-guardrail?format=windsurf","agents":"/api/rules/fastapi-nogil-concurrency-guardrail?format=agents"}},{"id":"openfga-subgraph-recursion-traversal-budget-standard","title":"OpenFGA Zanzibar Subgraph Recursion Depth and Contextual Tuple Budget Standard","category":"backend","severity":"critical","description":"Enforces strict bounds on transitive relation closure depth and contextual tuple cardinality within OpenFGA authorization evaluations. Guarantees predictable sub-millisecond query latencies and prevents catastrophic graph expansion attacks in dense multi-tenant authorization topographies.","antiPatternHeadline":"Unbounded Transitive Graph Traversal and Arbitrary Contextual Tuple Expansion Causing Zanzibar Engine Collapse","stars_count":78,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","openfga","zanzibar","authorization","performance","security"],"exportEndpoints":{"claude":"/api/rules/openfga-subgraph-recursion-traversal-budget-standard?format=claude","cursorMdc":"/api/rules/openfga-subgraph-recursion-traversal-budget-standard?format=mdc","cursorrules":"/api/rules/openfga-subgraph-recursion-traversal-budget-standard?format=cursor","windsurf":"/api/rules/openfga-subgraph-recursion-traversal-budget-standard?format=windsurf","agents":"/api/rules/openfga-subgraph-recursion-traversal-budget-standard?format=agents"}},{"id":"go-124-weak-pointer-cache-lifecycle-standard","title":"Go 1.24 Weak Pointer Cache Retention & Cleanup Lifecycle Standard","category":"backend","severity":"critical","description":"Enforces non-owning memory references in high-throughput Go caching layers using Go 1.24 weak.Pointer and runtime.AddCleanup. Eliminates sweep-phase GC bloat, memory resurrection leaks, and finalizer-induced goroutine stalls.","antiPatternHeadline":"Retaining Strong References in Caches and Relying on Deprecated runtime.SetFinalizer","stars_count":50,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","gc","memory-safety","performance","concurrency"],"exportEndpoints":{"claude":"/api/rules/go-124-weak-pointer-cache-lifecycle-standard?format=claude","cursorMdc":"/api/rules/go-124-weak-pointer-cache-lifecycle-standard?format=mdc","cursorrules":"/api/rules/go-124-weak-pointer-cache-lifecycle-standard?format=cursor","windsurf":"/api/rules/go-124-weak-pointer-cache-lifecycle-standard?format=windsurf","agents":"/api/rules/go-124-weak-pointer-cache-lifecycle-standard?format=agents"}},{"id":"webauthn-fido2-prf-vault-derivation-standard","title":"WebAuthn FIDO2 PRF Extension Zero-Knowledge Vault Derivation Guardrail","category":"security","severity":"critical","description":"Mandates zero-knowledge symmetric key derivation using WebAuthn Level 3 FIDO2 Pseudo-Random Function (PRF) extensions without persisting key material to host storage. Derived keying material must undergo HKDF expansion with domain separation, instantiate non-extractable CryptoKey handles, and enforce immediate memory zeroization of intermediate buffers.","antiPatternHeadline":"Persisting raw PRF outputs or derived master keys to client-side storage without HKDF domain separation or memory hygiene","stars_count":118,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","fido2","prf-extension","cryptography","zero-knowledge","webcrypto"],"exportEndpoints":{"claude":"/api/rules/webauthn-fido2-prf-vault-derivation-standard?format=claude","cursorMdc":"/api/rules/webauthn-fido2-prf-vault-derivation-standard?format=mdc","cursorrules":"/api/rules/webauthn-fido2-prf-vault-derivation-standard?format=cursor","windsurf":"/api/rules/webauthn-fido2-prf-vault-derivation-standard?format=windsurf","agents":"/api/rules/webauthn-fido2-prf-vault-derivation-standard?format=agents"}},{"id":"bun-linux-landlock-containerless-sandbox","title":"Kernel-Enforced Linux Landlock LSM Sandboxing for Bun 1.2 Runtimes","category":"devops","severity":"critical","description":"Mandates kernel-enforced Linux Landlock LSM confinement via Bun 1.2 FFI immediately post-bootstrap before executing untrusted workloads. Prevents lateral filesystem traversal and unauthorized network operations at the kernel level without VM or container overhead.","antiPatternHeadline":"Relying on Userland Sandboxing or Process Isolation Without Kernel Landlock Enforcement","stars_count":111,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","security","linux-landlock","bun","sandboxing","lsm","ffi"],"exportEndpoints":{"claude":"/api/rules/bun-linux-landlock-containerless-sandbox?format=claude","cursorMdc":"/api/rules/bun-linux-landlock-containerless-sandbox?format=mdc","cursorrules":"/api/rules/bun-linux-landlock-containerless-sandbox?format=cursor","windsurf":"/api/rules/bun-linux-landlock-containerless-sandbox?format=windsurf","agents":"/api/rules/bun-linux-landlock-containerless-sandbox?format=agents"}},{"id":"ebpf-xdp-hardware-offloaded-l4-amplification-mitigation-invariant","title":"Hardware-Offloaded eBPF XDP Invariant for L4 Reflection and Amplification Defense","category":"devops","severity":"critical","description":"Enforces strict offload-compatible eBPF XDP invariants to intercept and drop UDP-based amplification vectors (e.g., DNS, NTP, Memcached, CLDAP) directly within the NIC RX descriptor ring buffer. Prohibits helper functions, packet mutations, and map architectures that breach hardware offload boundaries or cause fallback to native/generic driver processing. Ensures deterministic wire-rate drop throughput without triggering host network stack overhead or kernel socket allocations.","antiPatternHeadline":"Executing Non-Offloadable eBPF Operations or Deferring Volumetric L4 Drop Logic to sk_buff Stack Ingress","stars_count":41,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","ebpf","xdp","ddos-mitigation","networking","kernel","c"],"exportEndpoints":{"claude":"/api/rules/ebpf-xdp-hardware-offloaded-l4-amplification-mitigation-invariant?format=claude","cursorMdc":"/api/rules/ebpf-xdp-hardware-offloaded-l4-amplification-mitigation-invariant?format=mdc","cursorrules":"/api/rules/ebpf-xdp-hardware-offloaded-l4-amplification-mitigation-invariant?format=cursor","windsurf":"/api/rules/ebpf-xdp-hardware-offloaded-l4-amplification-mitigation-invariant?format=windsurf","agents":"/api/rules/ebpf-xdp-hardware-offloaded-l4-amplification-mitigation-invariant?format=agents"}},{"id":"react-19-server-actions-concurrent-optimistic-mutex-standard","title":"React 19 Server Actions Monotonic Optimistic Mutex Standard","category":"frontend","severity":"critical","description":"Enforces strict monotonic mutation sequencing and client-side transaction serialization across concurrent React 19 Server Action invocations and multi-tab dynamic UI updates. Prevents out-of-order resolution, lost updates, and optimistic state clobbering by mandating versioned optimistic transitions coupled with client-side Web Locks and monotonic revision vectors.","antiPatternHeadline":"Unordered Server Action dispatching with naive useOptimistic state overrides causing out-of-order state corruption and multi-tab divergence.","stars_count":45,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","server-actions","useOptimistic","concurrency","web-locks","state-synchronization"],"exportEndpoints":{"claude":"/api/rules/react-19-server-actions-concurrent-optimistic-mutex-standard?format=claude","cursorMdc":"/api/rules/react-19-server-actions-concurrent-optimistic-mutex-standard?format=mdc","cursorrules":"/api/rules/react-19-server-actions-concurrent-optimistic-mutex-standard?format=cursor","windsurf":"/api/rules/react-19-server-actions-concurrent-optimistic-mutex-standard?format=windsurf","agents":"/api/rules/react-19-server-actions-concurrent-optimistic-mutex-standard?format=agents"}},{"id":"nextjs-15-ppr-dynamic-hole-timeout-fallback-invariant","title":"Next.js 15 PPR Dynamic Hole Streaming Timeout and Circuit-Breaker Invariant","category":"frontend","severity":"critical","description":"Enforces deterministic streaming latency in Next.js 15 Partial Prerendering (PPR) by mandating strict execution timeouts and circuit-breaker fallbacks on all dynamic Suspense holes. Prevents upstream microservice degradation from stalling HTTP/2 streaming responses, exhausting edge connection limits, or causing 504 Gateway Timeouts.","antiPatternHeadline":"Unbounded Dynamic Suspense Streaming Holding Open Server Streams and Inducing Edge Connection Exhaustion","stars_count":40,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["nextjs","nextjs-15","ppr","streaming","suspense","resilience","performance"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-ppr-dynamic-hole-timeout-fallback-invariant?format=claude","cursorMdc":"/api/rules/nextjs-15-ppr-dynamic-hole-timeout-fallback-invariant?format=mdc","cursorrules":"/api/rules/nextjs-15-ppr-dynamic-hole-timeout-fallback-invariant?format=cursor","windsurf":"/api/rules/nextjs-15-ppr-dynamic-hole-timeout-fallback-invariant?format=windsurf","agents":"/api/rules/nextjs-15-ppr-dynamic-hole-timeout-fallback-invariant?format=agents"}},{"id":"axum-tokio-cooperative-scheduling-budget-guardrail","title":"Axum 0.8 Tokio Cooperative Task Scheduling Budget Guardrail","category":"backend","severity":"critical","description":"Enforces preemption yield points and blocking offloads within Axum 0.8 middleware and extractors executing CPU-intensive serialization or validation workloads. Prevents long-running synchronous compute loops from starving Tokio runtime worker threads, eliminating tail-latency degradation and executor stalls under high concurrency.","antiPatternHeadline":"Unbounded Synchronous Serialization Loops Starving Tokio Worker Threads","stars_count":84,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tokio","async-concurrency","performance"],"exportEndpoints":{"claude":"/api/rules/axum-tokio-cooperative-scheduling-budget-guardrail?format=claude","cursorMdc":"/api/rules/axum-tokio-cooperative-scheduling-budget-guardrail?format=mdc","cursorrules":"/api/rules/axum-tokio-cooperative-scheduling-budget-guardrail?format=cursor","windsurf":"/api/rules/axum-tokio-cooperative-scheduling-budget-guardrail?format=windsurf","agents":"/api/rules/axum-tokio-cooperative-scheduling-budget-guardrail?format=agents"}},{"id":"kmp-darwin-coroutine-arc-ownership-invariant","title":"KMP Native Darwin Coroutine Memory Ownership & Runloop Decoupling Standard","category":"mobile","severity":"critical","description":"Enforces strict unidirectional memory ownership and explicit scope teardown between Kotlin/Native coroutine runtimes and Apple platform ARC runloops. Prevents bidirectional reference cycles between Swift ARC-managed instances and Kotlin/Native GC roots that trigger worker thread exhaustion and process-level deadlocks. Guarantees non-blocking dispatch boundary isolation across Apple DispatchQueues and Kotlin Dispatchers.","antiPatternHeadline":"Retaining Long-Lived Kotlin Coroutine Scopes in Swift ARC Objects Without Cooperative Cancellation Hooks","stars_count":64,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","kotlin-multiplatform","swift","darwin","coroutines","arc","memory-management"],"exportEndpoints":{"claude":"/api/rules/kmp-darwin-coroutine-arc-ownership-invariant?format=claude","cursorMdc":"/api/rules/kmp-darwin-coroutine-arc-ownership-invariant?format=mdc","cursorrules":"/api/rules/kmp-darwin-coroutine-arc-ownership-invariant?format=cursor","windsurf":"/api/rules/kmp-darwin-coroutine-arc-ownership-invariant?format=windsurf","agents":"/api/rules/kmp-darwin-coroutine-arc-ownership-invariant?format=agents"}},{"id":"tauri2-compositor-gpu-fault-isolation-standard","title":"Tauri 2.0 Webview Compositor GPU Fault Isolation Standard","category":"mobile","severity":"critical","description":"Enforces automatic fallback to software rasterization and headless layer degradation upon detecting platform compositor panics or repeated WebGL context losses in Tauri 2.0. Prevents unrecoverable native WebKit/WebView2/Android WebView render process crash loops across desktop and mobile targets.","antiPatternHeadline":"Unchecked WebGL Context Loss & Compositor Crashes Causing Native App Crash Loops","stars_count":106,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri-2.0","gpu-acceleration","fault-tolerance","webview"],"exportEndpoints":{"claude":"/api/rules/tauri2-compositor-gpu-fault-isolation-standard?format=claude","cursorMdc":"/api/rules/tauri2-compositor-gpu-fault-isolation-standard?format=mdc","cursorrules":"/api/rules/tauri2-compositor-gpu-fault-isolation-standard?format=cursor","windsurf":"/api/rules/tauri2-compositor-gpu-fault-isolation-standard?format=windsurf","agents":"/api/rules/tauri2-compositor-gpu-fault-isolation-standard?format=agents"}},{"id":"fido2-enterprise-attestation-mds-verification-standard","title":"FIDO2 Hardware Enterprise Attestation & FIDO MDS3 Cryptographic Verification Standard","category":"security","severity":"critical","description":"Mandates strict cryptographic validation of WebAuthn registration attestation statements, certificate chains, and AAGUIDs against the FIDO Alliance Metadata Service (MDS3) root of trust. Prevents software-emulated authenticators, compromised keys, and non-compliant tokens from enrolling in zero-trust enterprise perimeters.","antiPatternHeadline":"Accepting unverified 'none' attestation or skipping cryptographic MDS root chaining during WebAuthn credential enrollment.","stars_count":93,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","fido2","webauthn","cryptography","zero-trust","authentication"],"exportEndpoints":{"claude":"/api/rules/fido2-enterprise-attestation-mds-verification-standard?format=claude","cursorMdc":"/api/rules/fido2-enterprise-attestation-mds-verification-standard?format=mdc","cursorrules":"/api/rules/fido2-enterprise-attestation-mds-verification-standard?format=cursor","windsurf":"/api/rules/fido2-enterprise-attestation-mds-verification-standard?format=windsurf","agents":"/api/rules/fido2-enterprise-attestation-mds-verification-standard?format=agents"}},{"id":"openfga-contextual-tuples-depth-boundary","title":"OpenFGA Hierarchical Contextual Tuples Depth Boundary and Complexity Guard","category":"security","severity":"critical","description":"Enforces strict recursion depth limits, cycle detection, and tuple payload cardinality constraints when passing client-supplied contextual tuples to OpenFGA Check and ListObjects APIs. Prevents Algorithmic Complexity Denial of Service (Graph-DoS) caused by adversarial deeply nested or cyclic relationship graph resolutions during dynamic authorization evaluation.","antiPatternHeadline":"Injecting Unbounded or Cyclic Dynamic Contextual Tuples into OpenFGA Check Calls","stars_count":90,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","authorization","rebac","dos-mitigation","graph-traversal"],"exportEndpoints":{"claude":"/api/rules/openfga-contextual-tuples-depth-boundary?format=claude","cursorMdc":"/api/rules/openfga-contextual-tuples-depth-boundary?format=mdc","cursorrules":"/api/rules/openfga-contextual-tuples-depth-boundary?format=cursor","windsurf":"/api/rules/openfga-contextual-tuples-depth-boundary?format=windsurf","agents":"/api/rules/openfga-contextual-tuples-depth-boundary?format=agents"}},{"id":"cilium-ebpf-wireguard-rekey-nonce-invariant","title":"Cilium eBPF WireGuard In-Flight Rekeying and Nonce Safety Invariant","category":"devops","severity":"critical","description":"Enforces a fail-closed eBPF datapath invariant to eliminate transient plaintext packet leakage during asynchronous WireGuard key renegotiation across multi-cloud Kubernetes nodes. Guarantees that packet transmission halts or queues inside the eBPF tail-call pipeline if an active cryptographic session nonce resets or key rotation handshake has not achieved convergence.","antiPatternHeadline":"Opportunistic Encryption Fallback and Premature Session Destruction During Dynamic WireGuard Rekeying","stars_count":86,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","cilium","ebpf","wireguard","kubernetes","zero-trust","cryptography"],"exportEndpoints":{"claude":"/api/rules/cilium-ebpf-wireguard-rekey-nonce-invariant?format=claude","cursorMdc":"/api/rules/cilium-ebpf-wireguard-rekey-nonce-invariant?format=mdc","cursorrules":"/api/rules/cilium-ebpf-wireguard-rekey-nonce-invariant?format=cursor","windsurf":"/api/rules/cilium-ebpf-wireguard-rekey-nonce-invariant?format=windsurf","agents":"/api/rules/cilium-ebpf-wireguard-rekey-nonce-invariant?format=agents"}},{"id":"opentelemetry-async-mesh-tail-sampling-standard","title":"OpenTelemetry Async Mesh Context-Preserving Tail-Sampling Standard","category":"devops","severity":"critical","description":"Enforces deterministic distributed trace context propagation and trace-ID routing across decoupled broker message fan-outs. Prevents fragmented parent-child trace graphs and telemetry blindspots caused by uncoordinated tail-sampling collectors dropping asynchronous consumer spans.","antiPatternHeadline":"Dropping or Re-rooting Asynchronous Spans and Collector Trace Fragmentation across Event Broker Fan-Outs","stars_count":90,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","tail-sampling","distributed-tracing","event-driven-architecture","observability"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-async-mesh-tail-sampling-standard?format=claude","cursorMdc":"/api/rules/opentelemetry-async-mesh-tail-sampling-standard?format=mdc","cursorrules":"/api/rules/opentelemetry-async-mesh-tail-sampling-standard?format=cursor","windsurf":"/api/rules/opentelemetry-async-mesh-tail-sampling-standard?format=windsurf","agents":"/api/rules/opentelemetry-async-mesh-tail-sampling-standard?format=agents"}},{"id":"react-19-rsc-taint-boundary-enforcement","title":"React 19 RSC Taint API & Cryptographic Boundary Enforcement","category":"frontend","severity":"critical","description":"Enforces strict cryptographic serialization boundaries in React 19 Server Components using experimental_taintUniqueValue and taintObjectReference. Guarantees that internal database records, private API tokens, and cryptographic keys are blocked at the RSC serialization layer from leaking to client bundles.","antiPatternHeadline":"Unchecked Secret and Session Deserialization Across RSC-to-Client Component Props","stars_count":83,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["react19","rsc","taint-api","security","nextjs","cryptography"],"exportEndpoints":{"claude":"/api/rules/react-19-rsc-taint-boundary-enforcement?format=claude","cursorMdc":"/api/rules/react-19-rsc-taint-boundary-enforcement?format=mdc","cursorrules":"/api/rules/react-19-rsc-taint-boundary-enforcement?format=cursor","windsurf":"/api/rules/react-19-rsc-taint-boundary-enforcement?format=windsurf","agents":"/api/rules/react-19-rsc-taint-boundary-enforcement?format=agents"}},{"id":"fastapi-python313-freethreaded-concurrency-fastapi-on-pytho-178","title":"FastAPI Python 3.13 Free-Threaded (nogil) Concurrency & C-Extension Isolation","category":"backend","severity":"critical","description":"Enforces strict thread-safe state synchronization and process isolation for non-reentrant C-extension bindings when running FastAPI under Python 3.13 free-threaded execution (nogil). Eliminates silent data corruption, torn reads, and SIGSEGV crashes caused by concurrent OS thread execution.","antiPatternHeadline":"Unsynchronized Shared State Access and Unisolated Non-Reentrant C-Extensions Under Free-Threaded Python","stars_count":55,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","fastapi","python-3.13","nogil","free-threaded","concurrency","memory-safety"],"exportEndpoints":{"claude":"/api/rules/fastapi-python313-freethreaded-concurrency-fastapi-on-pytho-178?format=claude","cursorMdc":"/api/rules/fastapi-python313-freethreaded-concurrency-fastapi-on-pytho-178?format=mdc","cursorrules":"/api/rules/fastapi-python313-freethreaded-concurrency-fastapi-on-pytho-178?format=cursor","windsurf":"/api/rules/fastapi-python313-freethreaded-concurrency-fastapi-on-pytho-178?format=windsurf","agents":"/api/rules/fastapi-python313-freethreaded-concurrency-fastapi-on-pytho-178?format=agents"}},{"id":"capacitor7-wkwebview-cookie-storage-isolation","title":"Capacitor 7 WKWebView Cookie Partitioning & Native Storage Isolation Standard","category":"mobile","severity":"critical","description":"Enforces deterministic authentication persistence and eliminates silent session termination across native-to-web boundaries in Capacitor 7 under iOS 18+ WKWebsiteDataStore partitioning. Guarantees that authentication state does not rely on ambient cookie mirroring across custom schemes and isolated web processes.","antiPatternHeadline":"Relying on ambient document.cookie or implicit WKHTTPCookieStore synchronization across ASWebAuthenticationSession and custom schemes.","stars_count":73,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","capacitor","ios","wkwebview","authentication","cookies","security"],"exportEndpoints":{"claude":"/api/rules/capacitor7-wkwebview-cookie-storage-isolation?format=claude","cursorMdc":"/api/rules/capacitor7-wkwebview-cookie-storage-isolation?format=mdc","cursorrules":"/api/rules/capacitor7-wkwebview-cookie-storage-isolation?format=cursor","windsurf":"/api/rules/capacitor7-wkwebview-cookie-storage-isolation?format=windsurf","agents":"/api/rules/capacitor7-wkwebview-cookie-storage-isolation?format=agents"}},{"id":"webauthn-l3-hardware-attestation-integrity-binding","title":"Mandate WebAuthn L3 Hardware Attestation Cryptographic Binding with Native App Integrity","category":"security","severity":"critical","description":"Cryptographically couples WebAuthn passkey registration with platform integrity assertions (Apple App Attest and Android Play Integrity) to eliminate cloned-key client spoofing. Ensures keys are physically sealed within hardware security modules (Apple Secure Enclave, Android StrongBox/TEE) on untampered native clients by enforcing nonce-bound dual verification.","antiPatternHeadline":"Decoupled WebAuthn Registration Permitting Software Emulators and Cloned Key Injections","stars_count":62,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","passkeys","app-attest","play-integrity","fido2","cryptography"],"exportEndpoints":{"claude":"/api/rules/webauthn-l3-hardware-attestation-integrity-binding?format=claude","cursorMdc":"/api/rules/webauthn-l3-hardware-attestation-integrity-binding?format=mdc","cursorrules":"/api/rules/webauthn-l3-hardware-attestation-integrity-binding?format=cursor","windsurf":"/api/rules/webauthn-l3-hardware-attestation-integrity-binding?format=windsurf","agents":"/api/rules/webauthn-l3-hardware-attestation-integrity-binding?format=agents"}},{"id":"opentelemetry-async-event-lineage-propagation","title":"W3C Trace Context Injection & Async Span Lineage Continuity Across Message Brokers","category":"devops","severity":"critical","description":"Standardizes explicit W3C TraceContext injection into binary and text message envelopes across partitioned event streaming platforms (Kafka, NATS, RabbitMQ). Mandates context extraction and span link establishment on consumers to eliminate distributed trace fragmentation without conflating synchronous child-parent RPC hierarchies with asynchronous batch processing.","antiPatternHeadline":"Orphaned Consumer Traces via Unpropagated Headers and Erroneous Parent Span Coupling in Batch Processing","stars_count":70,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","kafka","nats","distributed-tracing","w3c-trace-context"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-async-event-lineage-propagation?format=claude","cursorMdc":"/api/rules/opentelemetry-async-event-lineage-propagation?format=mdc","cursorrules":"/api/rules/opentelemetry-async-event-lineage-propagation?format=cursor","windsurf":"/api/rules/opentelemetry-async-event-lineage-propagation?format=windsurf","agents":"/api/rules/opentelemetry-async-event-lineage-propagation?format=agents"}},{"id":"axum-tokio-cancellation-cleanup-guardrail","title":"Axum 0.8 Tokio Cooperative Request Cancellation and Drop Safety Standard","category":"backend","severity":"critical","description":"Enforces strict cancellation safety, explicit drop semantics, and deterministic transaction rollbacks under Axum 0.8 and Tokio runtimes. When HTTP/2 clients terminate connections prematurely or reset streams (RST_STREAM), pending futures are dropped mid-execution, which can leave database connection pools depleted or lock states orphaned if asynchronous resources are not wrapped in drop guards or shielded spawn blocks.","antiPatternHeadline":"Orphaned Transactions and Poisoned DB Pool Locks Due to Premature Stream Drops","stars_count":58,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","rust","axum","tokio","concurrency","cancellation-safety"],"exportEndpoints":{"claude":"/api/rules/axum-tokio-cancellation-cleanup-guardrail?format=claude","cursorMdc":"/api/rules/axum-tokio-cancellation-cleanup-guardrail?format=mdc","cursorrules":"/api/rules/axum-tokio-cancellation-cleanup-guardrail?format=cursor","windsurf":"/api/rules/axum-tokio-cancellation-cleanup-guardrail?format=windsurf","agents":"/api/rules/axum-tokio-cancellation-cleanup-guardrail?format=agents"}},{"id":"go-http3-quic-early-data-anti-replay-invariant","title":"Go 1.24 HTTP/3 QUIC 0-RTT Anti-Replay Window & Early Data Invariant","category":"security","severity":"critical","description":"Enforces cryptographic strike registers and strict RFC 8470 idempotency fences on QUIC 0-RTT (Early Data) handshakes in Go 1.24 HTTP/3 servers. Non-idempotent HTTP verbs (POST, PUT, PATCH, DELETE) arriving via 0-RTT MUST be rejected immediately with HTTP 425 Too Early to prevent replay-induced state corruption. Safe idempotent requests MUST be evaluated against a bounded anti-replay sliding window strike register.","antiPatternHeadline":"Permitting Unvalidated QUIC 0-RTT Early Data on State-Mutating Chi Handlers Exposing Endpoints to Packet Replay Attacks","stars_count":84,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","quic","http3","go1.24","replay-attack","chi-router","zero-rtt"],"exportEndpoints":{"claude":"/api/rules/go-http3-quic-early-data-anti-replay-invariant?format=claude","cursorMdc":"/api/rules/go-http3-quic-early-data-anti-replay-invariant?format=mdc","cursorrules":"/api/rules/go-http3-quic-early-data-anti-replay-invariant?format=cursor","windsurf":"/api/rules/go-http3-quic-early-data-anti-replay-invariant?format=windsurf","agents":"/api/rules/go-http3-quic-early-data-anti-replay-invariant?format=agents"}},{"id":"openfga-wasm-edge-memory-ceiling-guardrail","title":"OpenFGA WASM Edge Evaluation Memory-Ceiling Guardrail","category":"security","severity":"critical","description":"Enforces strict upper bounds on WebAssembly linear memory allocations and deterministic graph traversal recursion depths when evaluating OpenFGA authorization checks at edge runtimes. Prevents catastrophic OOM isolate termination, ReDoS-style tuple amplification attacks, and edge compute starvation during relational permission resolution.","antiPatternHeadline":"Unbounded WASM Memory Growth and Unguarded Tuple Graph Traversal at Edge","stars_count":48,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","openfga","wasm","edge-computing","memory-management","authorization"],"exportEndpoints":{"claude":"/api/rules/openfga-wasm-edge-memory-ceiling-guardrail?format=claude","cursorMdc":"/api/rules/openfga-wasm-edge-memory-ceiling-guardrail?format=mdc","cursorrules":"/api/rules/openfga-wasm-edge-memory-ceiling-guardrail?format=cursor","windsurf":"/api/rules/openfga-wasm-edge-memory-ceiling-guardrail?format=windsurf","agents":"/api/rules/openfga-wasm-edge-memory-ceiling-guardrail?format=agents"}},{"id":"react-19-server-action-idempotency-boundary","title":"React 19 Server Action Idempotency and Nonce-Gated Reentrancy Control","category":"frontend","severity":"critical","description":"Enforces client-generated idempotency keys and sequence-gated state reconciliation for React 19 Server Actions. Eliminates duplicate server mutations, out-of-order race conditions, and corrupted optimistic UI state during burst submissions or unstable network conditions.","antiPatternHeadline":"Un-keyed Direct Server Action Invocations and Naked useOptimistic State Transitions Under Burst Traffic","stars_count":53,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","react-19","server-actions","concurrency","idempotency","useOptimistic","useActionState"],"exportEndpoints":{"claude":"/api/rules/react-19-server-action-idempotency-boundary?format=claude","cursorMdc":"/api/rules/react-19-server-action-idempotency-boundary?format=mdc","cursorrules":"/api/rules/react-19-server-action-idempotency-boundary?format=cursor","windsurf":"/api/rules/react-19-server-action-idempotency-boundary?format=windsurf","agents":"/api/rules/react-19-server-action-idempotency-boundary?format=agents"}},{"id":"tauri2-mobile-zerocopy-ipc-guardrail","title":"Tauri 2.0 Mobile Zero-Copy Binary IPC Buffer Safety Guardrail","category":"mobile","severity":"critical","description":"Enforces memory-safe, zero-copy binary streaming protocols between Tauri 2.0 native Rust host engines and mobile webviews (iOS WKWebView and Android WebView). Prevents mobile operating system terminations (iOS Jetsam, Android LowMemoryKiller), GC thrashing from Base64 string serialization, and cross-thread buffer mutations during high-bandwidth media and sensor ingestion.","antiPatternHeadline":"Serializing high-bandwidth binary streams via Base64/JSON strings or mutating in-flight Rust memory buffers without atomic ownership handoff.","stars_count":80,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri-2","rust","ipc","zero-copy","memory-safety","android-webview","wkwebview"],"exportEndpoints":{"claude":"/api/rules/tauri2-mobile-zerocopy-ipc-guardrail?format=claude","cursorMdc":"/api/rules/tauri2-mobile-zerocopy-ipc-guardrail?format=mdc","cursorrules":"/api/rules/tauri2-mobile-zerocopy-ipc-guardrail?format=cursor","windsurf":"/api/rules/tauri2-mobile-zerocopy-ipc-guardrail?format=windsurf","agents":"/api/rules/tauri2-mobile-zerocopy-ipc-guardrail?format=agents"}},{"id":"bun-ffi-pointer-lifetime-worker-boundary","title":"Bun 1.2 Native C-FFI Pointer Lifetime & Thread-Safe Worker Boundary","category":"backend","severity":"critical","description":"Enforces strict memory ownership, non-aliased pointer lifecycles, and isolated native resource pinning when executing foreign functions across Bun Worker threads. Prevents use-after-free conditions, double-frees, and v8/JSC GC-induced memory corruption during offloaded cryptographic or hardware-bound operations.","antiPatternHeadline":"Transferring raw native pointers or retaining unpinned JS TypedArrays across asynchronous worker boundaries during native C-FFI execution","stars_count":73,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","bun","ffi","memory-safety","concurrency","multithreading"],"exportEndpoints":{"claude":"/api/rules/bun-ffi-pointer-lifetime-worker-boundary?format=claude","cursorMdc":"/api/rules/bun-ffi-pointer-lifetime-worker-boundary?format=mdc","cursorrules":"/api/rules/bun-ffi-pointer-lifetime-worker-boundary?format=cursor","windsurf":"/api/rules/bun-ffi-pointer-lifetime-worker-boundary?format=windsurf","agents":"/api/rules/bun-ffi-pointer-lifetime-worker-boundary?format=agents"}},{"id":"webauthn-l3-prf-deterministic-key-derivation-guardrail","title":"WebAuthn Level 3 PRF Extension Deterministic Key Derivation Invariant","category":"security","severity":"critical","description":"Mandates client-side hardware-bound deterministic key derivation via the WebAuthn Level 3 PRF (Pseudo-Random Function) extension. Enforces strict zero-knowledge cryptographic boundaries ensuring raw PRF outputs and derived symmetric encryption keys never traverse network boundaries or persist into non-volatile client storage.","antiPatternHeadline":"Exfiltrating PRF outputs to server endpoints or persisting raw derived symmetric keys in client storage.","stars_count":69,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","webauthn","prf-extension","zero-knowledge","cryptography","webcrypto"],"exportEndpoints":{"claude":"/api/rules/webauthn-l3-prf-deterministic-key-derivation-guardrail?format=claude","cursorMdc":"/api/rules/webauthn-l3-prf-deterministic-key-derivation-guardrail?format=mdc","cursorrules":"/api/rules/webauthn-l3-prf-deterministic-key-derivation-guardrail?format=cursor","windsurf":"/api/rules/webauthn-l3-prf-deterministic-key-derivation-guardrail?format=windsurf","agents":"/api/rules/webauthn-l3-prf-deterministic-key-derivation-guardrail?format=agents"}},{"id":"otel-baggage-overflow-redaction-filter-standard","title":"OpenTelemetry Baggage Overflow Redaction & Cross-Tenant Injection Guardrail","category":"devops","severity":"critical","description":"Enforces strict boundary filtering, size constraints, and key allowlisting on OpenTelemetry Baggage and TraceContext propagation across distributed service mesh hops. Prevents tenant context spoofing, memory exhaustion via unbounded header propagation, and downstream metric storage cardinality explosion.","antiPatternHeadline":"Unsanitized W3C Baggage Ingestion and Metric Tag Forwarding","stars_count":96,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","opentelemetry","security","distributed-tracing","service-mesh","cardinality-control"],"exportEndpoints":{"claude":"/api/rules/otel-baggage-overflow-redaction-filter-standard?format=claude","cursorMdc":"/api/rules/otel-baggage-overflow-redaction-filter-standard?format=mdc","cursorrules":"/api/rules/otel-baggage-overflow-redaction-filter-standard?format=cursor","windsurf":"/api/rules/otel-baggage-overflow-redaction-filter-standard?format=windsurf","agents":"/api/rules/otel-baggage-overflow-redaction-filter-standard?format=agents"}},{"id":"go-chi-h2-stream-cancellation-slab-invariant","title":"Go Chi HTTP/2 Stream Context Cancellation & Slab Reallocation Invariant","category":"backend","severity":"critical","description":"Enforces strict context-cancellation propagation and deterministic slab buffer cleanup for long-lived HTTP/2 streams handled by Chi. Prevents unbounded goroutine accumulation, context cancellation masking, and sync.Pool buffer fragmentation or cross-stream corruption when multiplexed clients prematurely disconnect.","antiPatternHeadline":"Ignoring r.Context().Done() or returning dirty sync.Pool byte slabs across prematurely aborted HTTP/2 stream flushes","stars_count":113,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","go","chi","http2","memory-management","goroutines","sync-pool"],"exportEndpoints":{"claude":"/api/rules/go-chi-h2-stream-cancellation-slab-invariant?format=claude","cursorMdc":"/api/rules/go-chi-h2-stream-cancellation-slab-invariant?format=mdc","cursorrules":"/api/rules/go-chi-h2-stream-cancellation-slab-invariant?format=cursor","windsurf":"/api/rules/go-chi-h2-stream-cancellation-slab-invariant?format=windsurf","agents":"/api/rules/go-chi-h2-stream-cancellation-slab-invariant?format=agents"}},{"id":"react-native-bridgeless-fabric-shadow-tree-sync","title":"React Native 0.76 Bridgeless Fabric C++ Shadow-Tree Synchronization Standard","category":"mobile","severity":"critical","description":"Enforces strict mutation semantics and non-blocking JSI host object boundaries during concurrent asynchronous component mounting in React Native 0.76 Bridgeless architecture. Prohibits synchronous cross-thread UI mutations and unsafe direct ShadowNode access from JS runtimes that trigger C++ mutex deadlocks and layout race conditions in Fabric's commit lifecycle. Mandates state updates through the React scheduler and C++ StateUpdate pipelines to guarantee thread-safe layout trees.","antiPatternHeadline":"Synchronous JSI layout mutations and unsafe ShadowNode lock inversion during concurrent component mounting","stars_count":76,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","react-native","fabric","bridgeless","cpp","shadow-tree","jsi"],"exportEndpoints":{"claude":"/api/rules/react-native-bridgeless-fabric-shadow-tree-sync?format=claude","cursorMdc":"/api/rules/react-native-bridgeless-fabric-shadow-tree-sync?format=mdc","cursorrules":"/api/rules/react-native-bridgeless-fabric-shadow-tree-sync?format=cursor","windsurf":"/api/rules/react-native-bridgeless-fabric-shadow-tree-sync?format=windsurf","agents":"/api/rules/react-native-bridgeless-fabric-shadow-tree-sync?format=agents"}},{"id":"slsa-level-3-ephemeral-oidc-sigstore-admission-guardrail","title":"Enforce SLSA Level 3 Ephemeral OIDC Sigstore Attestations via Admission Controllers","category":"devops","severity":"critical","description":"Production Kubernetes clusters must reject any workload image lacking tamper-proof SLSA Level 3 build provenance signed via ephemeral OIDC identities (Fulcio/Sigstore) and recorded in the Rekor transparency log. Workload admission controllers (Kyverno or Policy Controller) must cryptographically verify that container digests originate exclusively from designated isolated CI/CD runners matching strict repository subject identity claims.","antiPatternHeadline":"Deploying Mutable Container Images Signed with Static Keys or Lacking Cryptographic SLSA Provenance","stars_count":51,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["devops","slsa","sigstore","cosign","kubernetes","kyverno","supply-chain-security"],"exportEndpoints":{"claude":"/api/rules/slsa-level-3-ephemeral-oidc-sigstore-admission-guardrail?format=claude","cursorMdc":"/api/rules/slsa-level-3-ephemeral-oidc-sigstore-admission-guardrail?format=mdc","cursorrules":"/api/rules/slsa-level-3-ephemeral-oidc-sigstore-admission-guardrail?format=cursor","windsurf":"/api/rules/slsa-level-3-ephemeral-oidc-sigstore-admission-guardrail?format=windsurf","agents":"/api/rules/slsa-level-3-ephemeral-oidc-sigstore-admission-guardrail?format=agents"}},{"id":"oauth2-dpop-rfc9449-replay-isolation-standard","title":"OAuth 2.0 DPoP (RFC 9449) Proof Token Replay & Clock-Skew Isolation Guardrail","category":"security","severity":"critical","description":"Mandates end-to-end cryptographic verification of RFC 9449 Demonstrating Proof-of-Possession (DPoP) proof tokens across all edge and resource-tier API endpoints. Renders exfiltrated bearer tokens inert by strictly enforcing asymmetric key thumbprint ('cnf.jkt') binding, atomic single-use 'jti' replay tracking, strict clock-skew isolation windows, and canonical 'htm'/'htu' matching.","antiPatternHeadline":"Accepting DPoP proofs without atomic jti replay checks, omitting cnf.jkt token binding, or permitting uncanonicalized URI validation.","stars_count":77,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","oauth2","dpop","rfc9449","replay-prevention","cryptography","zero-trust"],"exportEndpoints":{"claude":"/api/rules/oauth2-dpop-rfc9449-replay-isolation-standard?format=claude","cursorMdc":"/api/rules/oauth2-dpop-rfc9449-replay-isolation-standard?format=mdc","cursorrules":"/api/rules/oauth2-dpop-rfc9449-replay-isolation-standard?format=cursor","windsurf":"/api/rules/oauth2-dpop-rfc9449-replay-isolation-standard?format=windsurf","agents":"/api/rules/oauth2-dpop-rfc9449-replay-isolation-standard?format=agents"}},{"id":"nextjs-15-async-request-context-als-leak-guardrail","title":"Next.js 15 Async Request Context & AsyncLocalStorage Isolation Standard","category":"frontend","severity":"critical","description":"Enforces strict isolation of Node.js AsyncLocalStorage (ALS) and Next.js 15 dynamic asynchronous request boundaries during concurrent React Server Component (RSC) streaming renders. Prevents cross-request telemetry contamination, cryptographic context bleed, and tenant credential mixing caused by un-scoped ALS contexts, module-level singletons, and microtask interleaving.","antiPatternHeadline":"Global Module-Level State and Unbounded AsyncLocalStorage Execution Leaking Across Interleaved Streaming RSC Render Passes","stars_count":119,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["frontend","nextjs-15","react-server-components","asynclocalstorage","security","telemetry","multi-tenant"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-async-request-context-als-leak-guardrail?format=claude","cursorMdc":"/api/rules/nextjs-15-async-request-context-als-leak-guardrail?format=mdc","cursorrules":"/api/rules/nextjs-15-async-request-context-als-leak-guardrail?format=cursor","windsurf":"/api/rules/nextjs-15-async-request-context-als-leak-guardrail?format=windsurf","agents":"/api/rules/nextjs-15-async-request-context-als-leak-guardrail?format=agents"}},{"id":"python-313-nogil-fastapi-thread-safety","title":"Python 3.13 Free-Threaded FastAPI Native C-Extension Thread-Safety Invariant","category":"backend","severity":"critical","description":"Enforces strict synchronization and isolation guarantees when executing FastAPI services under Python 3.13 free-threaded (PEP 703 no-GIL) runtimes. Prevents silent memory corruption, race conditions, and segmentation faults originating from concurrent worker-pool access to non-reentrant C-extensions, Cython handles, and shared mutable Python state.","antiPatternHeadline":"Unsynchronized Concurrent Access to Shared Mutable State and Non-Reentrant Native Extensions Under No-GIL Runtimes","stars_count":119,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["backend","python313","free-threaded","nogil","fastapi","concurrency","thread-safety"],"exportEndpoints":{"claude":"/api/rules/python-313-nogil-fastapi-thread-safety?format=claude","cursorMdc":"/api/rules/python-313-nogil-fastapi-thread-safety?format=mdc","cursorrules":"/api/rules/python-313-nogil-fastapi-thread-safety?format=cursor","windsurf":"/api/rules/python-313-nogil-fastapi-thread-safety?format=windsurf","agents":"/api/rules/python-313-nogil-fastapi-thread-safety?format=agents"}},{"id":"tauri-v2-webview-capability-matrix-isolation","title":"Tauri 2.0 Webview Capability Matrix and Scoped IPC Token Isolation Standard","category":"mobile","severity":"critical","description":"Enforces deterministic, window-isolated IPC capability matrices in Tauri 2.0 mobile and desktop architectures. Prohibits ambient native API exposure by mandating window-specific capability definitions and cryptographically verified, short-lived session scope tokens on all privileged native commands.","antiPatternHeadline":"Wildcard Window Bindings and Ambient Native Command Invocation Without Scope Tokens","stars_count":112,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mobile","tauri","security","ipc","rust","capabilities"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-webview-capability-matrix-isolation?format=claude","cursorMdc":"/api/rules/tauri-v2-webview-capability-matrix-isolation?format=mdc","cursorrules":"/api/rules/tauri-v2-webview-capability-matrix-isolation?format=cursor","windsurf":"/api/rules/tauri-v2-webview-capability-matrix-isolation?format=windsurf","agents":"/api/rules/tauri-v2-webview-capability-matrix-isolation?format=agents"}},{"id":"nextjs-15-app-router","title":"Next.js 15 App Router & Server Actions Standard","category":"frontend","severity":"critical","description":"Strict architecture guardrails for Next.js 15: strictly App Router (no pages/ bleed), async request APIs (cookies, headers, params), and secure Server Actions.","antiPatternHeadline":"AI outputs legacy pages/ router, synchronous cookies(), or unvalidated server actions vulnerable to CSRF.","stars_count":2480,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["nextjs","react","typescript","server-actions","app-router"],"exportEndpoints":{"claude":"/api/rules/nextjs-15-app-router?format=claude","cursorMdc":"/api/rules/nextjs-15-app-router?format=mdc","cursorrules":"/api/rules/nextjs-15-app-router?format=cursor","windsurf":"/api/rules/nextjs-15-app-router?format=windsurf","agents":"/api/rules/nextjs-15-app-router?format=agents"}},{"id":"react-19-compiler","title":"React 19 Compiler & Modern Hooks Architecture","category":"frontend","severity":"high","description":"Conventions for React 19: utilize React Compiler automatic memoization, replace boilerplate useMemo/useCallback, adopt useActionState, useOptimistic, and Server Actions.","antiPatternHeadline":"AI wraps every primitive function in useCallback/useMemo out of habit and hallucinates legacy useEffect data fetching.","stars_count":1940,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["react","react-19","compiler","hooks","optimistic-ui"],"exportEndpoints":{"claude":"/api/rules/react-19-compiler?format=claude","cursorMdc":"/api/rules/react-19-compiler?format=mdc","cursorrules":"/api/rules/react-19-compiler?format=cursor","windsurf":"/api/rules/react-19-compiler?format=windsurf","agents":"/api/rules/react-19-compiler?format=agents"}},{"id":"tailwind-v4","title":"Tailwind CSS v4 Modern Theme & Pure CSS Standard","category":"frontend","severity":"high","description":"Guardrails for Tailwind CSS v4: use @import 'tailwindcss', @theme directive in CSS, native cascade layers, and pure CSS variables instead of tailwind.config.js.","antiPatternHeadline":"AI attempts to generate a legacy tailwind.config.js, uses deprecated @apply syntax, or confuses v3 arbitrary values.","stars_count":1650,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["tailwind","css","styling","tailwind-v4"],"exportEndpoints":{"claude":"/api/rules/tailwind-v4?format=claude","cursorMdc":"/api/rules/tailwind-v4?format=mdc","cursorrules":"/api/rules/tailwind-v4?format=cursor","windsurf":"/api/rules/tailwind-v4?format=windsurf","agents":"/api/rules/tailwind-v4?format=agents"}},{"id":"vue-3-composition-api","title":"Vue 3.5+ Composition API & Script Setup Standard","category":"frontend","severity":"high","description":"Strict Vue 3.5+ architecture: pure <script setup lang='ts'>, reactive props destructuring, shallowRef for performance, and zero Options API legacy code.","antiPatternHeadline":"AI mixes this.$refs, Options API data()/methods(), or fails to use Vue 3.5 reactive props destructure.","stars_count":1420,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["vue","vue3","typescript","composition-api"],"exportEndpoints":{"claude":"/api/rules/vue-3-composition-api?format=claude","cursorMdc":"/api/rules/vue-3-composition-api?format=mdc","cursorrules":"/api/rules/vue-3-composition-api?format=cursor","windsurf":"/api/rules/vue-3-composition-api?format=windsurf","agents":"/api/rules/vue-3-composition-api?format=agents"}},{"id":"typescript-strict-core","title":"TypeScript Strict Mode & Zero Any Standard","category":"frontend","severity":"critical","description":"Enterprise TypeScript discipline: strict null checks, no 'any' types, discriminated unions for state modeling, and the satisfies operator.","antiPatternHeadline":"AI uses 'as any', loose object index signatures, or overlooks discriminated union narrowing.","stars_count":2890,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["typescript","type-safety","discriminated-unions"],"exportEndpoints":{"claude":"/api/rules/typescript-strict-core?format=claude","cursorMdc":"/api/rules/typescript-strict-core?format=mdc","cursorrules":"/api/rules/typescript-strict-core?format=cursor","windsurf":"/api/rules/typescript-strict-core?format=windsurf","agents":"/api/rules/typescript-strict-core?format=agents"}},{"id":"zustand-v5-state","title":"Zustand v5 Atomic State & Clean Selectors Standard","category":"frontend","severity":"high","description":"Production Zustand v5 patterns: use atomic selector hooks to prevent unnecessary re-renders, avoid giant monolithic stores, and strictly enforce immutable state mutations.","antiPatternHeadline":"AI calls useStore() without selectors causing the entire component tree to re-render on every state change.","stars_count":1310,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["zustand","react","state-management"],"exportEndpoints":{"claude":"/api/rules/zustand-v5-state?format=claude","cursorMdc":"/api/rules/zustand-v5-state?format=mdc","cursorrules":"/api/rules/zustand-v5-state?format=cursor","windsurf":"/api/rules/zustand-v5-state?format=windsurf","agents":"/api/rules/zustand-v5-state?format=agents"}},{"id":"tanstack-query-v5","title":"TanStack Query v5 Server State & Cache Factory","category":"frontend","severity":"high","description":"Best practices for TanStack Query v5: queryKey factories for bulletproof cache invalidation, mutation optimistic updates, and elimination of useEffect data fetching.","antiPatternHeadline":"AI uses inline strings for query keys, causing impossible cache invalidations or N+1 fetch waterfalls.","stars_count":1780,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["tanstack-query","react-query","cache","data-fetching"],"exportEndpoints":{"claude":"/api/rules/tanstack-query-v5?format=claude","cursorMdc":"/api/rules/tanstack-query-v5?format=mdc","cursorrules":"/api/rules/tanstack-query-v5?format=cursor","windsurf":"/api/rules/tanstack-query-v5?format=windsurf","agents":"/api/rules/tanstack-query-v5?format=agents"}},{"id":"shadcn-ui-radix","title":"shadcn/ui & Radix UI Component Composition Discipline","category":"frontend","severity":"medium","description":"Guardrails for shadcn/ui and Radix UI: composition with cva (class-variance-authority), accessibility attributes, and preventing CSS class specificity conflicts.","antiPatternHeadline":"AI writes hardcoded style overrides on shadcn components, breaking dark mode and accessibility.","stars_count":1890,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["shadcn","radix-ui","accessibility","cva"],"exportEndpoints":{"claude":"/api/rules/shadcn-ui-radix?format=claude","cursorMdc":"/api/rules/shadcn-ui-radix?format=mdc","cursorrules":"/api/rules/shadcn-ui-radix?format=cursor","windsurf":"/api/rules/shadcn-ui-radix?format=windsurf","agents":"/api/rules/shadcn-ui-radix?format=agents"}},{"id":"astro-5-content","title":"Astro 5 Islands & Content Layer Standard","category":"frontend","severity":"medium","description":"Conventions for Astro 5: zero-JS HTML by default, island client directives (client:load, client:visible), and the modern Astro Content Layer API.","antiPatternHeadline":"AI loads heavy client-side JavaScript across the entire page, defeating Astro's zero-JS performance premise.","stars_count":1120,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["astro","astro-5","islands-architecture","content-layer"],"exportEndpoints":{"claude":"/api/rules/astro-5-content?format=claude","cursorMdc":"/api/rules/astro-5-content?format=mdc","cursorrules":"/api/rules/astro-5-content?format=cursor","windsurf":"/api/rules/astro-5-content?format=windsurf","agents":"/api/rules/astro-5-content?format=agents"}},{"id":"svelte-5-runes","title":"Svelte 5 Runes & Modern Reactivity Standard","category":"frontend","severity":"high","description":"Guardrails for Svelte 5: adopt runes ($state, $derived, $effect, $props) and strictly avoid deprecated Svelte 3/4 'let' reactive assignments ($:).","antiPatternHeadline":"AI generates legacy Svelte 4 '$:' syntax or 'export let prop' which are deprecated in Svelte 5.","stars_count":1390,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["svelte","svelte-5","runes","reactivity"],"exportEndpoints":{"claude":"/api/rules/svelte-5-runes?format=claude","cursorMdc":"/api/rules/svelte-5-runes?format=mdc","cursorrules":"/api/rules/svelte-5-runes?format=cursor","windsurf":"/api/rules/svelte-5-runes?format=windsurf","agents":"/api/rules/svelte-5-runes?format=agents"}},{"id":"zod-v3-validation","title":"Zod Schema Validation & Strict Sanitization","category":"frontend","severity":"critical","description":"Bulletproof data validation using Zod: enforce safeParse, handle type coercion safely, sanitize strings, and prevent prototype pollution.","antiPatternHeadline":"AI uses .parse() directly causing unhandled runtime crashes, or relies on unsafe type assertions instead of safeParse.","stars_count":2210,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["zod","validation","typescript","schemas"],"exportEndpoints":{"claude":"/api/rules/zod-v3-validation?format=claude","cursorMdc":"/api/rules/zod-v3-validation?format=mdc","cursorrules":"/api/rules/zod-v3-validation?format=cursor","windsurf":"/api/rules/zod-v3-validation?format=windsurf","agents":"/api/rules/zod-v3-validation?format=agents"}},{"id":"vitest-testing-frontend","title":"Vitest & Testing Library User-Centric Test Standard","category":"frontend","severity":"high","description":"Conventions for Vitest & React/Vue Testing Library: test user behavior rather than implementation details, use screen.getByRole, and mock network calls cleanly with MSW.","antiPatternHeadline":"AI tests internal state values and props, writes fragile test selectors, or tests implementation details.","stars_count":1470,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["vitest","testing","react-testing-library","qa"],"exportEndpoints":{"claude":"/api/rules/vitest-testing-frontend?format=claude","cursorMdc":"/api/rules/vitest-testing-frontend?format=mdc","cursorrules":"/api/rules/vitest-testing-frontend?format=cursor","windsurf":"/api/rules/vitest-testing-frontend?format=windsurf","agents":"/api/rules/vitest-testing-frontend?format=agents"}},{"id":"remix-react-router-v7","title":"React Router v7 / Remix Data Architecture Standard","category":"frontend","severity":"medium","description":"Guardrails for React Router v7 & Remix: standard loaders and actions, progressive enhancement, error boundaries, and clientLoader caching.","antiPatternHeadline":"AI uses useEffect for fetching in React Router or fails to implement route error boundaries.","stars_count":1280,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["react-router","remix","routing","data-loading"],"exportEndpoints":{"claude":"/api/rules/remix-react-router-v7?format=claude","cursorMdc":"/api/rules/remix-react-router-v7?format=mdc","cursorrules":"/api/rules/remix-react-router-v7?format=cursor","windsurf":"/api/rules/remix-react-router-v7?format=windsurf","agents":"/api/rules/remix-react-router-v7?format=agents"}},{"id":"css-modern-container","title":"Modern CSS Grid, Subgrid & Container Queries Standard","category":"frontend","severity":"medium","description":"Responsive layout architecture: CSS container queries (@container), subgrid alignment, clamp() fluid typography, and zero hardcoded fixed-pixel breakpoints.","antiPatternHeadline":"AI uses fixed pixel widths that break mobile viewports, or writes dozens of rigid media queries.","stars_count":1050,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["css","responsive","container-queries","subgrid"],"exportEndpoints":{"claude":"/api/rules/css-modern-container?format=claude","cursorMdc":"/api/rules/css-modern-container?format=mdc","cursorrules":"/api/rules/css-modern-container?format=cursor","windsurf":"/api/rules/css-modern-container?format=windsurf","agents":"/api/rules/css-modern-container?format=agents"}},{"id":"micro-frontend-module-federation","title":"Module Federation 2.0 & Micro-Frontend Discipline","category":"frontend","severity":"high","description":"Guardrails for Micro-Frontends: Module Federation 2.0 shared dependency singletons, isolated CSS scoping, and resilient runtime error boundaries.","antiPatternHeadline":"AI duplicates React runtime instances causing dual-hook crashes, or leaks global CSS across micro-apps.","stars_count":980,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["micro-frontends","module-federation","webpack","vite"],"exportEndpoints":{"claude":"/api/rules/micro-frontend-module-federation?format=claude","cursorMdc":"/api/rules/micro-frontend-module-federation?format=mdc","cursorrules":"/api/rules/micro-frontend-module-federation?format=cursor","windsurf":"/api/rules/micro-frontend-module-federation?format=windsurf","agents":"/api/rules/micro-frontend-module-federation?format=agents"}},{"id":"biome-linter-formatter","title":"Biome Modern Toolchain & Rust-Powered Linter Discipline","category":"frontend","severity":"high","description":"Production guidelines for Biome (Rust-native linter/formatter). Replaces legacy ESLint + Prettier toolchain sprawl with sub-millisecond single-binary checks, strict import organization, and zero-config speed.","antiPatternHeadline":"AI scaffolds obsolete .eslintrc.json and .prettierrc configs with conflicting plugins instead of modern biome.json.","stars_count":1420,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["biome","linter","formatter","rust-toolchain","code-quality"],"exportEndpoints":{"claude":"/api/rules/biome-linter-formatter?format=claude","cursorMdc":"/api/rules/biome-linter-formatter?format=mdc","cursorrules":"/api/rules/biome-linter-formatter?format=cursor","windsurf":"/api/rules/biome-linter-formatter?format=windsurf","agents":"/api/rules/biome-linter-formatter?format=agents"}},{"id":"playwright-e2e-testing","title":"Playwright Resilient E2E & Web-First Assertions Standard","category":"frontend","severity":"critical","description":"Battle-tested End-to-End testing architecture with Playwright. Forbids arbitrary sleeps, manual timeouts, and brittle XPath selectors; mandates web-first auto-retrying assertions and accessible locators.","antiPatternHeadline":"AI writes flaky tests with page.waitForTimeout(5000) and brittle XPath selectors that fail under network latency.","stars_count":2190,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["playwright","e2e-testing","web-first-assertions","locators","testing"],"exportEndpoints":{"claude":"/api/rules/playwright-e2e-testing?format=claude","cursorMdc":"/api/rules/playwright-e2e-testing?format=mdc","cursorrules":"/api/rules/playwright-e2e-testing?format=cursor","windsurf":"/api/rules/playwright-e2e-testing?format=windsurf","agents":"/api/rules/playwright-e2e-testing?format=agents"}},{"id":"react-hook-form-zod","title":"React Hook Form & Zod Strict Uncontrolled Validation","category":"frontend","severity":"high","description":"High-performance form state management with React Hook Form and Zod schema validation. Eliminates per-keystroke re-render waterfalls via uncontrolled inputs, enforces type-safe resolvers, and manages loading states.","antiPatternHeadline":"AI binds every form input to useState causing massive re-renders on every keystroke and loose manual validation.","stars_count":1870,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["react-hook-form","zod","forms","performance","react"],"exportEndpoints":{"claude":"/api/rules/react-hook-form-zod?format=claude","cursorMdc":"/api/rules/react-hook-form-zod?format=mdc","cursorrules":"/api/rules/react-hook-form-zod?format=cursor","windsurf":"/api/rules/react-hook-form-zod?format=windsurf","agents":"/api/rules/react-hook-form-zod?format=agents"}},{"id":"storybook-v8-csf3","title":"Storybook 8 Component Story Format (CSF3) Standard","category":"frontend","severity":"medium","description":"Modern component-driven development with Storybook 8 and CSF3. Replaces deprecated CSF2 template factories (Template.bind({})) with declarative Meta/StoryObj typing, play functions for interaction tests, and autodocs.","antiPatternHeadline":"AI outputs deprecated CSF2 Template.bind({}) or legacy storiesOf syntax that fails TypeScript checking in Storybook 8.","stars_count":1290,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["storybook","csf3","component-driven","ui-testing","documentation"],"exportEndpoints":{"claude":"/api/rules/storybook-v8-csf3?format=claude","cursorMdc":"/api/rules/storybook-v8-csf3?format=mdc","cursorrules":"/api/rules/storybook-v8-csf3?format=cursor","windsurf":"/api/rules/storybook-v8-csf3?format=windsurf","agents":"/api/rules/storybook-v8-csf3?format=agents"}},{"id":"dnd-kit-accessible-drag-drop","title":"dnd kit Modern & Accessible Drag-and-Drop Architecture","category":"frontend","severity":"high","description":"Lightweight, modular, and accessible drag-and-drop powered by @dnd-kit/core and @dnd-kit/sortable. Forbids deprecated react-beautiful-dnd, supports keyboard navigation, touch screens, and React 19 concurrent mode.","antiPatternHeadline":"AI imports deprecated react-beautiful-dnd which crashes in React 18/19 StrictMode and lacks keyboard accessibility.","stars_count":1640,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["dnd-kit","drag-and-drop","accessibility","react-19","ux"],"exportEndpoints":{"claude":"/api/rules/dnd-kit-accessible-drag-drop?format=claude","cursorMdc":"/api/rules/dnd-kit-accessible-drag-drop?format=mdc","cursorrules":"/api/rules/dnd-kit-accessible-drag-drop?format=cursor","windsurf":"/api/rules/dnd-kit-accessible-drag-drop?format=windsurf","agents":"/api/rules/dnd-kit-accessible-drag-drop?format=agents"}},{"id":"turborepo-monorepo-best-practices","title":"Turborepo 2+ Monorepo Pipeline & Strict Boundary Architecture","category":"frontend","severity":"critical","description":"Production guidelines for Turborepo 2+ monorepos. Mandates strict package.json exports, hermetic task inputs/outputs caching declarations, boundary linting, and forbids implicit sibling workspace imports.","antiPatternHeadline":"AI scaffolds circular workspace imports, omits turbo.json hash boundaries, and causes cache misses across build pipelines.","stars_count":2310,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["turborepo","monorepo","workspace","caching","build-system"],"exportEndpoints":{"claude":"/api/rules/turborepo-monorepo-best-practices?format=claude","cursorMdc":"/api/rules/turborepo-monorepo-best-practices?format=mdc","cursorrules":"/api/rules/turborepo-monorepo-best-practices?format=cursor","windsurf":"/api/rules/turborepo-monorepo-best-practices?format=windsurf","agents":"/api/rules/turborepo-monorepo-best-practices?format=agents"}},{"id":"tanstack-table-v8-virtualization","title":"TanStack Table v8 & Virtualized Row Architecture","category":"frontend","severity":"high","description":"Enterprise data grid architecture using headless TanStack Table v8 and @tanstack/react-virtual. Eliminates browser main-thread freezes on 10,000+ row datasets through DOM element recycling, memoized column accessors, and debounced filtering.","antiPatternHeadline":"AI maps 5,000 un-virtualized <tr> elements directly to the DOM with inline sort functions, freezing the browser UI.","stars_count":1980,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["tanstack-table","virtualization","react","performance","datagrid"],"exportEndpoints":{"claude":"/api/rules/tanstack-table-v8-virtualization?format=claude","cursorMdc":"/api/rules/tanstack-table-v8-virtualization?format=mdc","cursorrules":"/api/rules/tanstack-table-v8-virtualization?format=cursor","windsurf":"/api/rules/tanstack-table-v8-virtualization?format=windsurf","agents":"/api/rules/tanstack-table-v8-virtualization?format=agents"}},{"id":"threejs-webgl-lifecycle-cleanup","title":"Three.js & WebGL Memory Lifecycle and GPU Resource Disposal","category":"frontend","severity":"critical","description":"Production guidelines for 3D graphics in modern web applications. Mandates rigorous GPU buffer disposal (geometries, textures, render targets), animation frame cleanup, and context loss recovery to eliminate fatal memory leaks.","antiPatternHeadline":"AI instantiates Three.js scenes inside React useEffect without calling dispose() on geometries and textures, crashing user browser tabs.","stars_count":1730,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["threejs","webgl","3d","memory-leak","gpu-cleanup"],"exportEndpoints":{"claude":"/api/rules/threejs-webgl-lifecycle-cleanup?format=claude","cursorMdc":"/api/rules/threejs-webgl-lifecycle-cleanup?format=mdc","cursorrules":"/api/rules/threejs-webgl-lifecycle-cleanup?format=cursor","windsurf":"/api/rules/threejs-webgl-lifecycle-cleanup?format=windsurf","agents":"/api/rules/threejs-webgl-lifecycle-cleanup?format=agents"}},{"id":"webrtc-realtime-media-stream","title":"WebRTC Realtime MediaStream & ICE Candidate Resilient Architecture","category":"frontend","severity":"critical","description":"Production WebRTC audio/video communications standard. Mandates polite peer negotiation, candidate queuing before remote description, iceconnectionstatechange monitoring, and deterministic MediaStreamTrack teardown.","antiPatternHeadline":"AI attempts to addIceCandidate() before setRemoteDescription() executes, causing silent peer connection drops.","stars_count":1840,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["webrtc","video","audio","realtime","peer-to-peer"],"exportEndpoints":{"claude":"/api/rules/webrtc-realtime-media-stream?format=claude","cursorMdc":"/api/rules/webrtc-realtime-media-stream?format=mdc","cursorrules":"/api/rules/webrtc-realtime-media-stream?format=cursor","windsurf":"/api/rules/webrtc-realtime-media-stream?format=windsurf","agents":"/api/rules/webrtc-realtime-media-stream?format=agents"}},{"id":"tailwind-v4-container-fluid","title":"Tailwind CSS v4 Container Queries & Fluid Typography System","category":"frontend","severity":"medium","description":"Modern modular styling with Tailwind CSS v4 container queries (@container) and CSS clamp() fluid scales. Forbids fixed viewport breakpoints on nested components, eliminates brittle @apply statements, and enforces pure CSS theme variables.","antiPatternHeadline":"AI binds nested card components to viewport breakpoints (md: flex), breaking responsive layouts inside sidebars.","stars_count":1620,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["tailwind-v4","container-queries","fluid-typography","css","responsive"],"exportEndpoints":{"claude":"/api/rules/tailwind-v4-container-fluid?format=claude","cursorMdc":"/api/rules/tailwind-v4-container-fluid?format=mdc","cursorrules":"/api/rules/tailwind-v4-container-fluid?format=cursor","windsurf":"/api/rules/tailwind-v4-container-fluid?format=windsurf","agents":"/api/rules/tailwind-v4-container-fluid?format=agents"}},{"id":"pwa-workbox-offline-cache-invalidation","title":"Progressive Web App (PWA) Workbox 7 & Cache Invalidation Architecture","category":"frontend","severity":"critical","description":"Production architecture for Service Workers and Workbox 7. Mandates NetworkFirst for HTML navigation routes, CacheFirst with explicit content hashing for immutable static assets, and immediate registration skipWaiting lifecycle orchestration to prevent users from being permanently trapped on stale application bundles.","antiPatternHeadline":"AI generates a naive Service Worker caching all requests with CacheFirst, causing browsers to permanently serve obsolete HTML bundles even after redeployment.","stars_count":1280,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["pwa","service-worker","workbox","offline-first","caching","nextjs"],"exportEndpoints":{"claude":"/api/rules/pwa-workbox-offline-cache-invalidation?format=claude","cursorMdc":"/api/rules/pwa-workbox-offline-cache-invalidation?format=mdc","cursorrules":"/api/rules/pwa-workbox-offline-cache-invalidation?format=cursor","windsurf":"/api/rules/pwa-workbox-offline-cache-invalidation?format=windsurf","agents":"/api/rules/pwa-workbox-offline-cache-invalidation?format=agents"}},{"id":"wasm-rust-web-worker-offscreen","title":"WebAssembly (WASM) Rust & Web Worker Heavy Compute Architecture","category":"frontend","severity":"critical","description":"Production architecture for WebAssembly compute pipelines. Enforces offloading Rust/WASM binaries into dedicated Web Workers with zero-copy Transferable ArrayBuffers and OffscreenCanvas, eliminating main thread frame drops and browser UI freezing.","antiPatternHeadline":"AI loads and executes synchronous WebAssembly compute algorithms directly on the browser main UI thread, causing UI freezes and severe INP degradation.","stars_count":1140,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["webassembly","rust","wasm-bindgen","web-worker","performance","offscreen-canvas"],"exportEndpoints":{"claude":"/api/rules/wasm-rust-web-worker-offscreen?format=claude","cursorMdc":"/api/rules/wasm-rust-web-worker-offscreen?format=mdc","cursorrules":"/api/rules/wasm-rust-web-worker-offscreen?format=cursor","windsurf":"/api/rules/wasm-rust-web-worker-offscreen?format=windsurf","agents":"/api/rules/wasm-rust-web-worker-offscreen?format=agents"}},{"id":"core-web-vitals-inp-lcp-optimization","title":"Core Web Vitals (INP, LCP, CLS) & Main Thread Yielding Standard","category":"frontend","severity":"critical","description":"Production performance engineering standard for modern web applications. Mandates Interaction to Next Paint (INP) < 200ms using scheduler.yield() chunking, explicit layout dimensions preventing Cumulative Layout Shift (CLS), and priority resource loading (fetchpriority='high').","antiPatternHeadline":"AI executes large data transformation loops synchronously in event handlers, blocking the main thread and resulting in catastrophic INP failures (>500ms).","stars_count":1420,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["performance","core-web-vitals","inp","lcp","cls","browser","react"],"exportEndpoints":{"claude":"/api/rules/core-web-vitals-inp-lcp-optimization?format=claude","cursorMdc":"/api/rules/core-web-vitals-inp-lcp-optimization?format=mdc","cursorrules":"/api/rules/core-web-vitals-inp-lcp-optimization?format=cursor","windsurf":"/api/rules/core-web-vitals-inp-lcp-optimization?format=windsurf","agents":"/api/rules/core-web-vitals-inp-lcp-optimization?format=agents"}},{"id":"next-intl-app-router-localization","title":"Next.js 15 App Router & next-intl Dynamic Localization Architecture","category":"frontend","severity":"high","description":"Enterprise internationalization standard for Next.js 15 App Router. Mandates server-side translation resolution via next-intl, type-safe translation keys, clean routing middleware with alternate hreflang tags, and zero client bundle bloat from translation dictionaries.","antiPatternHeadline":"AI passes massive monolithic JSON translation dictionaries to client-side Context providers, bloating client bundle size and destroying Next.js 15 SSR caching.","stars_count":990,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["nextjs","next-intl","i18n","localization","seo","react"],"exportEndpoints":{"claude":"/api/rules/next-intl-app-router-localization?format=claude","cursorMdc":"/api/rules/next-intl-app-router-localization?format=mdc","cursorrules":"/api/rules/next-intl-app-router-localization?format=cursor","windsurf":"/api/rules/next-intl-app-router-localization?format=windsurf","agents":"/api/rules/next-intl-app-router-localization?format=agents"}},{"id":"react-use-transition-concurrency","title":"React 19 Concurrent Rendering & useTransition Non-Urgent Update Slicing","category":"frontend","severity":"critical","description":"Production standard for non-blocking concurrent UI updates in React 18/19. Mandates wrapping high-latency state updates (search filtering, tab switching, large list sorting) in useTransition / startTransition to maintain 60 FPS input responsiveness, eliminating main thread stutter and INP penalties. (Semgrep rule: react-unbatched-state-transitions)","antiPatternHeadline":"AI executes high-latency state filtering synchronously on user typing, blocking the main thread and triggering catastrophic Interaction to Next Paint (INP) failures.","stars_count":1820,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["react","react-19","concurrency","useTransition","performance","inp"],"exportEndpoints":{"claude":"/api/rules/react-use-transition-concurrency?format=claude","cursorMdc":"/api/rules/react-use-transition-concurrency?format=mdc","cursorrules":"/api/rules/react-use-transition-concurrency?format=cursor","windsurf":"/api/rules/react-use-transition-concurrency?format=windsurf","agents":"/api/rules/react-use-transition-concurrency?format=agents"}},{"id":"nextjs-server-actions-csrf-authorization","title":"Next.js 15 Server Actions Session Authorization & CSRF Mitigation Standard","category":"frontend","severity":"critical","description":"Enterprise security standard for Next.js 15 Server Actions. Mandates strict session authentication checks inside action bodies, Zod payload schema validation, CSRF origin verification, and prevents exposed POST mutations without authorization. (OWASP A01:2021 Broken Access Control / CWE-352).","antiPatternHeadline":"AI treats Next.js Server Actions like private internal functions, omitting session authentication and permitting unauthenticated public POST mutations.","stars_count":2150,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["nextjs","server-actions","security","csrf","authorization","zod"],"exportEndpoints":{"claude":"/api/rules/nextjs-server-actions-csrf-authorization?format=claude","cursorMdc":"/api/rules/nextjs-server-actions-csrf-authorization?format=mdc","cursorrules":"/api/rules/nextjs-server-actions-csrf-authorization?format=cursor","windsurf":"/api/rules/nextjs-server-actions-csrf-authorization?format=windsurf","agents":"/api/rules/nextjs-server-actions-csrf-authorization?format=agents"}},{"id":"css-subgrid-nested-alignment","title":"Modern CSS Grid Subgrid & Form Layout Track Inheritance Standard","category":"frontend","severity":"medium","description":"Production standard for multi-column form and card alignments using CSS Grid Level 2 Subgrid. Eliminates manual fixed pixel offsets and JavaScript resize observers by allowing nested card items to align directly to the parent grid track definition.","antiPatternHeadline":"AI writes brittle JavaScript resize observers or hardcoded pixel heights to align cards across variable-length headers and buttons in grid layouts.","stars_count":1180,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["css","subgrid","grid","responsive","frontend","layout"],"exportEndpoints":{"claude":"/api/rules/css-subgrid-nested-alignment?format=claude","cursorMdc":"/api/rules/css-subgrid-nested-alignment?format=mdc","cursorrules":"/api/rules/css-subgrid-nested-alignment?format=cursor","windsurf":"/api/rules/css-subgrid-nested-alignment?format=windsurf","agents":"/api/rules/css-subgrid-nested-alignment?format=agents"}},{"id":"typescript-satisfies-operator-narrowing","title":"TypeScript satisfies Operator vs Type Assertion Casting Standard","category":"frontend","severity":"high","description":"Production TypeScript typing standard. Mandates using the 'satisfies' operator for configuration objects, themes, and route definitions to validate schema conformity while preserving exact literal types, strictly forbidding 'as Type' type assertions that mask missing properties.","antiPatternHeadline":"AI uses 'as ConfigType' or ': Record<string, any>' annotations, blowing away specific literal keys and breaking autocompletion and type narrowing.","stars_count":1640,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["typescript","satisfies","type-safety","narrowing","dx"],"exportEndpoints":{"claude":"/api/rules/typescript-satisfies-operator-narrowing?format=claude","cursorMdc":"/api/rules/typescript-satisfies-operator-narrowing?format=mdc","cursorrules":"/api/rules/typescript-satisfies-operator-narrowing?format=cursor","windsurf":"/api/rules/typescript-satisfies-operator-narrowing?format=windsurf","agents":"/api/rules/typescript-satisfies-operator-narrowing?format=agents"}},{"id":"graphql-persisted-queries-apollo","title":"GraphQL Automatic Persisted Queries (APQ) & DoS Defense Architecture","category":"frontend","severity":"high","description":"Production architecture for GraphQL clients (Apollo Client / Urql). Mandates Automatic Persisted Queries (APQ) with SHA-256 hashes, query whitelisting in production, and disables arbitrary client-crafted GraphQL strings to prevent query complexity Denial of Service attacks. (OWASP API Top 10).","antiPatternHeadline":"AI sends massive raw multi-kilobyte GraphQL query strings in every HTTP request body, enabling DoS attacks and wasting upstream mobile bandwidth.","stars_count":1310,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["graphql","apollo","security","apq","dos-defense","performance"],"exportEndpoints":{"claude":"/api/rules/graphql-persisted-queries-apollo?format=claude","cursorMdc":"/api/rules/graphql-persisted-queries-apollo?format=mdc","cursorrules":"/api/rules/graphql-persisted-queries-apollo?format=cursor","windsurf":"/api/rules/graphql-persisted-queries-apollo?format=windsurf","agents":"/api/rules/graphql-persisted-queries-apollo?format=agents"}},{"id":"nextjs-dynamic-io-partial-prerendering","title":"Next.js 15 dynamicIO & Partial Prerendering (PPR) Streaming Standard","category":"frontend","severity":"critical","description":"Production standard for Next.js 15 Partial Prerendering and experimental.dynamicIO. Enforces explicit React Suspense boundaries around dynamic cookies/searchParams calls, allowing static page shells to prerender instantly from CDN edges while streaming dynamic user slots.","antiPatternHeadline":"AI accesses dynamic request headers or cookies at the layout or root page level, de-optimizing the entire page to slow SSR dynamic rendering.","stars_count":1940,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["nextjs","nextjs-15","ppr","dynamic-io","suspense","streaming","seo"],"exportEndpoints":{"claude":"/api/rules/nextjs-dynamic-io-partial-prerendering?format=claude","cursorMdc":"/api/rules/nextjs-dynamic-io-partial-prerendering?format=mdc","cursorrules":"/api/rules/nextjs-dynamic-io-partial-prerendering?format=cursor","windsurf":"/api/rules/nextjs-dynamic-io-partial-prerendering?format=windsurf","agents":"/api/rules/nextjs-dynamic-io-partial-prerendering?format=agents"}},{"id":"react-aria-accessibility-focus-trap","title":"Accessible Modals & Focus Trap Management Standard (WCAG 2.2 AA)","category":"frontend","severity":"high","description":"Production accessibility engineering standard for interactive web components. Mandates strict focus trapping within open dialogs, automatic restoration of focus to triggering elements upon dismissal, Escape key closing, and screen-reader ARIA live region notifications. (WCAG 2.2 Level AA).","antiPatternHeadline":"AI creates custom dialog modals using plain <div> tags without focus trapping or ARIA attributes, leaving keyboard and screen-reader users permanently trapped.","stars_count":1420,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["accessibility","a11y","wcag","radix-ui","dialog","focus-management"],"exportEndpoints":{"claude":"/api/rules/react-aria-accessibility-focus-trap?format=claude","cursorMdc":"/api/rules/react-aria-accessibility-focus-trap?format=mdc","cursorrules":"/api/rules/react-aria-accessibility-focus-trap?format=cursor","windsurf":"/api/rules/react-aria-accessibility-focus-trap?format=windsurf","agents":"/api/rules/react-aria-accessibility-focus-trap?format=agents"}},{"id":"zustand-immer-middleware-immutability","title":"Zustand & Immer Middleware Deep Structural State Mutation Discipline","category":"frontend","severity":"medium","description":"State management standard for Zustand v5 combined with Immer middleware. Enforces type-safe draft mutations for deeply nested states, prevents accidental manual object spread mistakes, and eliminates memory leak references in complex global client states.","antiPatternHeadline":"AI writes buggy 5-level deep object spread syntax (...state.a.b.c) inside Zustand actions, accidentally mutating nested objects or dropping sibling keys.","stars_count":1260,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["zustand","immer","state-management","immutability","react"],"exportEndpoints":{"claude":"/api/rules/zustand-immer-middleware-immutability?format=claude","cursorMdc":"/api/rules/zustand-immer-middleware-immutability?format=mdc","cursorrules":"/api/rules/zustand-immer-middleware-immutability?format=cursor","windsurf":"/api/rules/zustand-immer-middleware-immutability?format=windsurf","agents":"/api/rules/zustand-immer-middleware-immutability?format=agents"}},{"id":"fastapi-pydantic-v2","title":"FastAPI & Pydantic v2 Async Concurrency Standard","category":"backend","severity":"critical","description":"Guardrails for FastAPI with Pydantic v2: prevent synchronous blocking calls inside async def endpoints, use lifespan context managers, and migrate to model_dump().","antiPatternHeadline":"AI calls blocking synchronous requests.get() or time.sleep() inside async def, freezing the entire event loop.","stars_count":2610,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["fastapi","python","pydantic-v2","asyncio","concurrency"],"exportEndpoints":{"claude":"/api/rules/fastapi-pydantic-v2?format=claude","cursorMdc":"/api/rules/fastapi-pydantic-v2?format=mdc","cursorrules":"/api/rules/fastapi-pydantic-v2?format=cursor","windsurf":"/api/rules/fastapi-pydantic-v2?format=windsurf","agents":"/api/rules/fastapi-pydantic-v2?format=agents"}},{"id":"golang-gin-clean-arch","title":"Go Gin Clean Architecture & Explicit Error Handling","category":"backend","severity":"critical","description":"Production Go standards: strict error checking (never ignore `if err != nil`), context propagation for cancellation/timeouts, and dependency injection.","antiPatternHeadline":"AI uses blank identifier `_` to suppress errors, panics in HTTP handlers, or ignores request context.","stars_count":2150,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["go","golang","gin","clean-architecture","error-handling"],"exportEndpoints":{"claude":"/api/rules/golang-gin-clean-arch?format=claude","cursorMdc":"/api/rules/golang-gin-clean-arch?format=mdc","cursorrules":"/api/rules/golang-gin-clean-arch?format=cursor","windsurf":"/api/rules/golang-gin-clean-arch?format=windsurf","agents":"/api/rules/golang-gin-clean-arch?format=agents"}},{"id":"rust-axum-tokio","title":"Rust Axum & Tokio Production Concurrency Standard","category":"backend","severity":"critical","description":"Guardrails for Rust web services: manage Send + Sync bounds, avoid blocking Tokio worker threads, use bounded mpsc channels, and handle database connection pooling.","antiPatternHeadline":"AI calls std::thread::sleep or std::fs in async Axum handlers, stalling the Tokio async runtime.","stars_count":2040,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["rust","axum","tokio","concurrency","performance"],"exportEndpoints":{"claude":"/api/rules/rust-axum-tokio?format=claude","cursorMdc":"/api/rules/rust-axum-tokio?format=mdc","cursorrules":"/api/rules/rust-axum-tokio?format=cursor","windsurf":"/api/rules/rust-axum-tokio?format=windsurf","agents":"/api/rules/rust-axum-tokio?format=agents"}},{"id":"nodejs-prisma-optimization","title":"Node.js & Prisma ORM Anti-N+1 Query Optimization","category":"backend","severity":"critical","description":"Guardrails for Prisma ORM: prevent N+1 query loops using include/select relations, use prisma.$transaction for batching, and maintain singleton PrismaClient instance.","antiPatternHeadline":"AI queries the database inside a for-loop (N+1 query trap) or creates a new PrismaClient() on every request.","stars_count":2320,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["nodejs","prisma","database","performance","sql"],"exportEndpoints":{"claude":"/api/rules/nodejs-prisma-optimization?format=claude","cursorMdc":"/api/rules/nodejs-prisma-optimization?format=mdc","cursorrules":"/api/rules/nodejs-prisma-optimization?format=cursor","windsurf":"/api/rules/nodejs-prisma-optimization?format=windsurf","agents":"/api/rules/nodejs-prisma-optimization?format=agents"}},{"id":"nestjs-modular-architecture","title":"NestJS Enterprise Modular Architecture & Validation","category":"backend","severity":"high","description":"Enterprise NestJS conventions: enforce strict modular boundaries, global ValidationPipe with whitelist: true, custom exception filters, and proper DI token usage.","antiPatternHeadline":"AI mutates request objects directly, skips class-validator DTOs, or puts business logic in controllers.","stars_count":1730,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["nestjs","typescript","architecture","dependency-injection"],"exportEndpoints":{"claude":"/api/rules/nestjs-modular-architecture?format=claude","cursorMdc":"/api/rules/nestjs-modular-architecture?format=mdc","cursorrules":"/api/rules/nestjs-modular-architecture?format=cursor","windsurf":"/api/rules/nestjs-modular-architecture?format=windsurf","agents":"/api/rules/nestjs-modular-architecture?format=agents"}},{"id":"python-sqlalchemy-v2","title":"SQLAlchemy 2.0 Async Session & Modern Select Syntax","category":"backend","severity":"critical","description":"Guardrails for SQLAlchemy 2.0: strictly use select(Model) syntax, async_sessionmaker, await session.execute(), and prevent lazy-loading crashes in async sessions.","antiPatternHeadline":"AI uses legacy query() syntax (Model.query.filter) which is deprecated in SQLAlchemy 2.0, or triggers async MissingGreenlet errors.","stars_count":1850,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["python","sqlalchemy","asyncio","orm"],"exportEndpoints":{"claude":"/api/rules/python-sqlalchemy-v2?format=claude","cursorMdc":"/api/rules/python-sqlalchemy-v2?format=mdc","cursorrules":"/api/rules/python-sqlalchemy-v2?format=cursor","windsurf":"/api/rules/python-sqlalchemy-v2?format=windsurf","agents":"/api/rules/python-sqlalchemy-v2?format=agents"}},{"id":"django-ninja-crud","title":"Django Ninja & Async ORM Architecture Standard","category":"backend","severity":"medium","description":"Conventions for Django Ninja: typed Pydantic Schema inputs/outputs, select_related/prefetch_related to prevent N+1 queries, and safe async views.","antiPatternHeadline":"AI exposes raw Django model instances to JSON serialization or forgets select_related in querysets.","stars_count":1190,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["django","django-ninja","python","api"],"exportEndpoints":{"claude":"/api/rules/django-ninja-crud?format=claude","cursorMdc":"/api/rules/django-ninja-crud?format=mdc","cursorrules":"/api/rules/django-ninja-crud?format=cursor","windsurf":"/api/rules/django-ninja-crud?format=windsurf","agents":"/api/rules/django-ninja-crud?format=agents"}},{"id":"go-gorm-concurrency","title":"Go GORM Concurrency & Transaction Safety Standard","category":"backend","severity":"critical","description":"Guardrails for Go GORM: prevent race conditions on shared DB handles, use db.WithContext(ctx), and encapsulate multi-step mutations in db.Transaction.","antiPatternHeadline":"AI reuses a mutated *gorm.DB instance across goroutines, causing race conditions and cross-polluted queries.","stars_count":1460,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["go","golang","gorm","database","transactions"],"exportEndpoints":{"claude":"/api/rules/go-gorm-concurrency?format=claude","cursorMdc":"/api/rules/go-gorm-concurrency?format=mdc","cursorrules":"/api/rules/go-gorm-concurrency?format=cursor","windsurf":"/api/rules/go-gorm-concurrency?format=windsurf","agents":"/api/rules/go-gorm-concurrency?format=agents"}},{"id":"java-spring-boot-3","title":"Spring Boot 3 & Virtual Threads (Project Loom) Standard","category":"backend","severity":"high","description":"Conventions for Spring Boot 3+: enable virtual threads for high concurrency, use Java Record DTOs, and replace RestTemplate with modern RestClient or WebClient.","antiPatternHeadline":"AI uses deprecated RestTemplate, mutable JavaBean DTOs with boilerplate getters/setters, or blocks virtual thread carriers.","stars_count":1910,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["java","spring-boot","spring-boot-3","virtual-threads"],"exportEndpoints":{"claude":"/api/rules/java-spring-boot-3?format=claude","cursorMdc":"/api/rules/java-spring-boot-3?format=mdc","cursorrules":"/api/rules/java-spring-boot-3?format=cursor","windsurf":"/api/rules/java-spring-boot-3?format=windsurf","agents":"/api/rules/java-spring-boot-3?format=agents"}},{"id":"csharp-dotnet-8-minimal-api","title":".NET 8 Minimal APIs & Entity Framework Core Performance","category":"backend","severity":"high","description":"Guardrails for modern .NET 8+: Minimal API routing with typed results (TypedResults), AsNoTracking for read queries, and record types for request contracts.","antiPatternHeadline":"AI generates heavy legacy MVC controllers for simple microservices or forgets AsNoTracking causing EF memory bloat.","stars_count":1680,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["dotnet","csharp","minimal-api","ef-core"],"exportEndpoints":{"claude":"/api/rules/csharp-dotnet-8-minimal-api?format=claude","cursorMdc":"/api/rules/csharp-dotnet-8-minimal-api?format=mdc","cursorrules":"/api/rules/csharp-dotnet-8-minimal-api?format=cursor","windsurf":"/api/rules/csharp-dotnet-8-minimal-api?format=windsurf","agents":"/api/rules/csharp-dotnet-8-minimal-api?format=agents"}},{"id":"elixir-phoenix-liveview","title":"Elixir Phoenix LiveView 1.0 Streams & OTP Standard","category":"backend","severity":"medium","description":"Guardrails for Phoenix LiveView 1.0: use stream() for large lists to minimize server memory, handle async operations with assign_async, and respect GenServer timeouts.","antiPatternHeadline":"AI loads thousands of records directly into socket assigns, exhausting server RAM under concurrent users.","stars_count":1080,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["elixir","phoenix","liveview","otp"],"exportEndpoints":{"claude":"/api/rules/elixir-phoenix-liveview?format=claude","cursorMdc":"/api/rules/elixir-phoenix-liveview?format=mdc","cursorrules":"/api/rules/elixir-phoenix-liveview?format=cursor","windsurf":"/api/rules/elixir-phoenix-liveview?format=windsurf","agents":"/api/rules/elixir-phoenix-liveview?format=agents"}},{"id":"redis-distributed-patterns","title":"Redis Distributed Lock & Cache Invalidation Standard","category":"backend","severity":"critical","description":"Production Redis conventions: safe distributed locking with Redlock or Lua release scripts, TTL on all keys to prevent memory leaks, and pipeline/transaction batching.","antiPatternHeadline":"AI sets keys without TTL, uses non-atomic GET then SET for locks, or causes cache stampedes.","stars_count":2190,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["redis","caching","distributed-lock","concurrency"],"exportEndpoints":{"claude":"/api/rules/redis-distributed-patterns?format=claude","cursorMdc":"/api/rules/redis-distributed-patterns?format=mdc","cursorrules":"/api/rules/redis-distributed-patterns?format=cursor","windsurf":"/api/rules/redis-distributed-patterns?format=windsurf","agents":"/api/rules/redis-distributed-patterns?format=agents"}},{"id":"kafka-event-streaming","title":"Apache Kafka Event Streaming & Idempotency Standard","category":"backend","severity":"critical","description":"Guardrails for Apache Kafka producers and consumers: idempotent producers (enable.idempotence=true), manual commit offset discipline, and dead-letter queues (DLQ).","antiPatternHeadline":"AI enables auto-commit offsets, causing message loss during consumer crashes, or ignores deduplication.","stars_count":1810,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["kafka","event-driven","messaging","microservices"],"exportEndpoints":{"claude":"/api/rules/kafka-event-streaming?format=claude","cursorMdc":"/api/rules/kafka-event-streaming?format=mdc","cursorrules":"/api/rules/kafka-event-streaming?format=cursor","windsurf":"/api/rules/kafka-event-streaming?format=windsurf","agents":"/api/rules/kafka-event-streaming?format=agents"}},{"id":"graphql-apollo-dataloader","title":"GraphQL Apollo Server & DataLoader Batching Standard","category":"backend","severity":"critical","description":"Guardrails for GraphQL APIs: mandatory DataLoader for nested field resolvers, query depth and complexity limits, and schema-first type safety.","antiPatternHeadline":"AI writes nested GraphQL resolvers that fetch from DB inside each resolver, creating massive N+1 query explosions.","stars_count":1540,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["graphql","apollo","dataloader","api"],"exportEndpoints":{"claude":"/api/rules/graphql-apollo-dataloader?format=claude","cursorMdc":"/api/rules/graphql-apollo-dataloader?format=mdc","cursorrules":"/api/rules/graphql-apollo-dataloader?format=cursor","windsurf":"/api/rules/graphql-apollo-dataloader?format=windsurf","agents":"/api/rules/graphql-apollo-dataloader?format=agents"}},{"id":"trpc-v11-typesafe","title":"tRPC v11 End-to-End Type Safety & Procedure Standard","category":"backend","severity":"high","description":"Conventions for tRPC v11: modular sub-routers, superjson transformer for dates/maps, middleware authorization guards, and input/output schema validation.","antiPatternHeadline":"AI uses untyped procedures, bypasses middleware for authentication, or forgets superjson.","stars_count":1720,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["trpc","typescript","fullstack","rpc"],"exportEndpoints":{"claude":"/api/rules/trpc-v11-typesafe?format=claude","cursorMdc":"/api/rules/trpc-v11-typesafe?format=mdc","cursorrules":"/api/rules/trpc-v11-typesafe?format=cursor","windsurf":"/api/rules/trpc-v11-typesafe?format=windsurf","agents":"/api/rules/trpc-v11-typesafe?format=agents"}},{"id":"mcp-server-sdk-typescript","title":"Model Context Protocol (MCP) TypeScript SDK Standard","category":"backend","severity":"critical","description":"Production invariants for developing MCP tool servers using @modelcontextprotocol/sdk: strict Zod input schemas, asynchronous tool call isolation, error payload formatting, and stdout JSON-RPC stream preservation.","antiPatternHeadline":"AI creates MCP servers with console.log corrupting stdout JSON-RPC, untyped tool arguments without Zod schemas, or unhandled errors crashing daemon transports.","stars_count":2450,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mcp","ai-agent","typescript","zod","json-rpc"],"exportEndpoints":{"claude":"/api/rules/mcp-server-sdk-typescript?format=claude","cursorMdc":"/api/rules/mcp-server-sdk-typescript?format=mdc","cursorrules":"/api/rules/mcp-server-sdk-typescript?format=cursor","windsurf":"/api/rules/mcp-server-sdk-typescript?format=windsurf","agents":"/api/rules/mcp-server-sdk-typescript?format=agents"}},{"id":"mcp-server-sdk-python","title":"Python FastMCP Protocol & Tool Server Standard","category":"backend","severity":"critical","description":"Conventions for Python FastMCP servers: async tool definitions with @mcp.tool(), Pydantic v2 argument models, typed Context injection for client progress/logging, and clean shutdown handling.","antiPatternHeadline":"AI uses print statements that corrupt stdout JSON-RPC, writes sync blocking handlers without threadpool delegation, or forgets Pydantic v2 field descriptions needed by LLM planners.","stars_count":2180,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mcp","fastmcp","python","pydantic","ai-agent"],"exportEndpoints":{"claude":"/api/rules/mcp-server-sdk-python?format=claude","cursorMdc":"/api/rules/mcp-server-sdk-python?format=mdc","cursorrules":"/api/rules/mcp-server-sdk-python?format=cursor","windsurf":"/api/rules/mcp-server-sdk-python?format=windsurf","agents":"/api/rules/mcp-server-sdk-python?format=agents"}},{"id":"langgraph-agentic-workflow","title":"LangGraph 2026 StateGraph & Multi-Agent Architecture","category":"backend","severity":"critical","description":"Standard for production LangGraph architectures: immutable state reducers using Annotated, durable checkpointing (PostgresSaver / MemorySaver), streaming event iteration via astream_events, and recursion limit boundaries.","antiPatternHeadline":"AI mutates graph state in place, misses state reducers causing list overwrite instead of append, omits durable checkpoint savers, or loops indefinitely without recursion limits.","stars_count":2310,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["langgraph","ai-agent","langchain","state-machine","python"],"exportEndpoints":{"claude":"/api/rules/langgraph-agentic-workflow?format=claude","cursorMdc":"/api/rules/langgraph-agentic-workflow?format=mdc","cursorrules":"/api/rules/langgraph-agentic-workflow?format=cursor","windsurf":"/api/rules/langgraph-agentic-workflow?format=windsurf","agents":"/api/rules/langgraph-agentic-workflow?format=agents"}},{"id":"postgresql-pgvector-hnsw","title":"PostgreSQL pgvector & HNSW Vector Indexing Standard","category":"backend","severity":"high","description":"Production standards for vector similarity search with pgvector: HNSW index creation with tuned m and ef_construction, cosine distance operator (<=>), halfvec quantization for memory efficiency, and partition pruning.","antiPatternHeadline":"AI uses ivfflat with default lists on unpopulated tables causing 100% sequential scans, queries vector distances with raw euclidean math instead of indexed operators, or misses maintenance_work_mem.","stars_count":1980,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["pgvector","postgresql","hnsw","embeddings","rag","database"],"exportEndpoints":{"claude":"/api/rules/postgresql-pgvector-hnsw?format=claude","cursorMdc":"/api/rules/postgresql-pgvector-hnsw?format=mdc","cursorrules":"/api/rules/postgresql-pgvector-hnsw?format=cursor","windsurf":"/api/rules/postgresql-pgvector-hnsw?format=windsurf","agents":"/api/rules/postgresql-pgvector-hnsw?format=agents"}},{"id":"clickhouse-olap-query-optimization","title":"ClickHouse OLAP Analytics & Partitioned MergeTree Standard","category":"backend","severity":"critical","description":"Production-grade ClickHouse architecture for billion-row high-throughput analytics. Forbids row-by-row mutating updates (ALTER TABLE UPDATE), mandates immutable partitioned ReplacingMergeTree engines, and pre-aggregated Materialized Views.","antiPatternHeadline":"AI writes row-by-row OLTP-style updates and unindexed full-table joins that freeze ClickHouse background merge threads.","stars_count":2450,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["clickhouse","olap","mergetree","big-data","sql-optimization"],"exportEndpoints":{"claude":"/api/rules/clickhouse-olap-query-optimization?format=claude","cursorMdc":"/api/rules/clickhouse-olap-query-optimization?format=mdc","cursorrules":"/api/rules/clickhouse-olap-query-optimization?format=cursor","windsurf":"/api/rules/clickhouse-olap-query-optimization?format=windsurf","agents":"/api/rules/clickhouse-olap-query-optimization?format=agents"}},{"id":"rabbitmq-amqp-resilience","title":"RabbitMQ AMQP Resilience, Dead Letter Exchange & Manual ACK Standard","category":"backend","severity":"critical","description":"Robust asynchronous message processing with RabbitMQ. Enforces manual consumer ACKs with explicit try/catch, dead-letter exchanges (DLX) for poisoned payloads, and prefetch limits (basicQos) to prevent memory exhaustion.","antiPatternHeadline":"AI sets noAck: true losing critical messages on consumer process crash, and omits DLX dead-letter queues.","stars_count":1890,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["rabbitmq","amqp","message-queue","dead-letter-queue","distributed-systems"],"exportEndpoints":{"claude":"/api/rules/rabbitmq-amqp-resilience?format=claude","cursorMdc":"/api/rules/rabbitmq-amqp-resilience?format=mdc","cursorrules":"/api/rules/rabbitmq-amqp-resilience?format=cursor","windsurf":"/api/rules/rabbitmq-amqp-resilience?format=windsurf","agents":"/api/rules/rabbitmq-amqp-resilience?format=agents"}},{"id":"elasticsearch-opensearch-dsl","title":"OpenSearch & Elasticsearch 8+ Hybrid Search & Filter Context Standard","category":"backend","severity":"high","description":"High-performance search and retrieval with OpenSearch and Elasticsearch 8. Enforces separation between non-scoring filter context (cached in BitSets) and scoring query context, hybrid BM25 + kNN vector search, and fielddata prevention.","antiPatternHeadline":"AI puts exact term filters in query/must context calculating useless BM25 scores and bypassing the BitSet cache.","stars_count":2040,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["elasticsearch","opensearch","fulltext-search","vector-search","performance"],"exportEndpoints":{"claude":"/api/rules/elasticsearch-opensearch-dsl?format=claude","cursorMdc":"/api/rules/elasticsearch-opensearch-dsl?format=mdc","cursorrules":"/api/rules/elasticsearch-opensearch-dsl?format=cursor","windsurf":"/api/rules/elasticsearch-opensearch-dsl?format=windsurf","agents":"/api/rules/elasticsearch-opensearch-dsl?format=agents"}},{"id":"stripe-webhook-idempotency","title":"Stripe Payment Webhook & Cryptographic Signature Verification Standard","category":"backend","severity":"critical","description":"Bank-grade payment webhook ingestion architecture. Mandates raw-body cryptographic signature verification via stripe.webhooks.constructEvent, atomic database idempotency keys to prevent double-crediting, and immediate 200 responses with async task dispatching.","antiPatternHeadline":"AI parses JSON body before signature verification causing hash mismatch errors, and processes payments without idempotency locks.","stars_count":2780,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["stripe","webhooks","payments","cryptography","idempotency"],"exportEndpoints":{"claude":"/api/rules/stripe-webhook-idempotency?format=claude","cursorMdc":"/api/rules/stripe-webhook-idempotency?format=mdc","cursorrules":"/api/rules/stripe-webhook-idempotency?format=cursor","windsurf":"/api/rules/stripe-webhook-idempotency?format=windsurf","agents":"/api/rules/stripe-webhook-idempotency?format=agents"}},{"id":"temporal-durable-execution","title":"Temporal Durable Workflow Execution & Determinism Standard","category":"backend","severity":"critical","description":"Mission-critical fault-tolerant workflow orchestration with Temporal. Mandates strict separation between deterministic workflow logic (no I/O, no random, no system clock) and non-deterministic activities with exponential retry policies.","antiPatternHeadline":"AI writes direct HTTP calls, UUID generation, or Date.now() inside Temporal workflow functions, crashing the replay engine.","stars_count":2150,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["temporal","durable-execution","orchestration","microservices","fault-tolerance"],"exportEndpoints":{"claude":"/api/rules/temporal-durable-execution?format=claude","cursorMdc":"/api/rules/temporal-durable-execution?format=mdc","cursorrules":"/api/rules/temporal-durable-execution?format=cursor","windsurf":"/api/rules/temporal-durable-execution?format=windsurf","agents":"/api/rules/temporal-durable-execution?format=agents"}},{"id":"duckdb-embedded-analytics","title":"DuckDB Embedded Analytics & Zero-Copy Parquet Query Standard","category":"backend","severity":"high","description":"Ultra-fast embedded columnar analytics on Parquet and Arrow datasets. Eliminates heavy Pandas memory bloat by running zero-copy vectorized SQL queries directly on local or S3 Parquet files with streaming execution.","antiPatternHeadline":"AI loads gigabytes of raw CSV/Parquet into Pandas memory via pd.read_csv() triggering OOM crashes.","stars_count":2310,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["duckdb","parquet","embedded-analytics","arrow","python-data"],"exportEndpoints":{"claude":"/api/rules/duckdb-embedded-analytics?format=claude","cursorMdc":"/api/rules/duckdb-embedded-analytics?format=mdc","cursorrules":"/api/rules/duckdb-embedded-analytics?format=cursor","windsurf":"/api/rules/duckdb-embedded-analytics?format=windsurf","agents":"/api/rules/duckdb-embedded-analytics?format=agents"}},{"id":"openai-structured-outputs-zod","title":"OpenAI Structured Outputs & Zod Strict JSON Schema Enforcement","category":"backend","severity":"critical","description":"Production standard for deterministic LLM tool calling and structured outputs. Mandates native response_format: zodResponseFormat with strict: true, eliminates flaky regex markdown code-block parsing, and guarantees 100% schema compliance.","antiPatternHeadline":"AI writes brittle regex to strip ```json code fences from LLM text responses, crashing on omitted fields.","stars_count":2540,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["openai","structured-outputs","zod","json-schema","llm"],"exportEndpoints":{"claude":"/api/rules/openai-structured-outputs-zod?format=claude","cursorMdc":"/api/rules/openai-structured-outputs-zod?format=mdc","cursorrules":"/api/rules/openai-structured-outputs-zod?format=cursor","windsurf":"/api/rules/openai-structured-outputs-zod?format=windsurf","agents":"/api/rules/openai-structured-outputs-zod?format=agents"}},{"id":"langchain-modern-lcel-runnable","title":"LangChain Expression Language (LCEL) & Runnable Pipeline Standard","category":"backend","severity":"critical","description":"Production standard for LangChain applications using LangChain Expression Language (LCEL). Deprecates legacy AgentExecutor, LLMChain, and initialize_agent in favor of composable Runnable sequences with native streaming, async batching, and LangSmith tracing.","antiPatternHeadline":"AI imports deprecated AgentExecutor or LLMChain from langchain, triggering deprecation crashes in production.","stars_count":2180,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["langchain","lcel","runnable","python","ai-agents"],"exportEndpoints":{"claude":"/api/rules/langchain-modern-lcel-runnable?format=claude","cursorMdc":"/api/rules/langchain-modern-lcel-runnable?format=mdc","cursorrules":"/api/rules/langchain-modern-lcel-runnable?format=cursor","windsurf":"/api/rules/langchain-modern-lcel-runnable?format=windsurf","agents":"/api/rules/langchain-modern-lcel-runnable?format=agents"}},{"id":"vllm-inference-high-throughput","title":"vLLM Production Inference Serving & PagedAttention Optimization","category":"backend","severity":"critical","description":"Production deployment standard for open-weights LLMs (Llama 3, Mistral, Qwen 2.5) using vLLM. Enforces PagedAttention VRAM management, continuous request batching, prefix caching, and tensor-parallel scaling to maximize token throughput.","antiPatternHeadline":"AI writes synchronous HuggingFace pipeline() loops in FastAPI servers, blocking concurrent GPU requests.","stars_count":2780,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["vllm","llm-serving","paged-attention","gpu","inference"],"exportEndpoints":{"claude":"/api/rules/vllm-inference-high-throughput?format=claude","cursorMdc":"/api/rules/vllm-inference-high-throughput?format=mdc","cursorrules":"/api/rules/vllm-inference-high-throughput?format=cursor","windsurf":"/api/rules/vllm-inference-high-throughput?format=windsurf","agents":"/api/rules/vllm-inference-high-throughput?format=agents"}},{"id":"grpc-protobuf-v3-microservices","title":"gRPC Protobuf v3 Interceptors & Deadline Propagation Standard","category":"backend","severity":"critical","description":"Enterprise microservice communications standard using gRPC and Protocol Buffers v3. Mandates strict deadline and context propagation, bidirectional client/server interceptors, google.rpc.Status rich error details, and keepalive ping tuning.","antiPatternHeadline":"AI creates bare gRPC clients without timeouts, causing cascading thread pool exhaustion during service brownouts.","stars_count":2040,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["grpc","protobuf","microservices","rpc","concurrency"],"exportEndpoints":{"claude":"/api/rules/grpc-protobuf-v3-microservices?format=claude","cursorMdc":"/api/rules/grpc-protobuf-v3-microservices?format=mdc","cursorrules":"/api/rules/grpc-protobuf-v3-microservices?format=cursor","windsurf":"/api/rules/grpc-protobuf-v3-microservices?format=windsurf","agents":"/api/rules/grpc-protobuf-v3-microservices?format=agents"}},{"id":"neo4j-cypher-graph-optimization","title":"Neo4j Cypher Graph Database & Relationship Indexing Standard","category":"backend","severity":"high","description":"Production database standard for graph applications using Neo4j and Cypher. Enforces parameterized query execution, relationship directionality, uniqueness constraints, index hints, and batch periodic commits to eliminate graph query stalls.","antiPatternHeadline":"AI constructs raw string Cypher queries with unbounded Cartesian products (MATCH (a), (b)), crashing Neo4j CPU cores.","stars_count":1690,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["neo4j","cypher","graph-database","indexing","knowledge-graph"],"exportEndpoints":{"claude":"/api/rules/neo4j-cypher-graph-optimization?format=claude","cursorMdc":"/api/rules/neo4j-cypher-graph-optimization?format=mdc","cursorrules":"/api/rules/neo4j-cypher-graph-optimization?format=cursor","windsurf":"/api/rules/neo4j-cypher-graph-optimization?format=windsurf","agents":"/api/rules/neo4j-cypher-graph-optimization?format=agents"}},{"id":"meilisearch-fulltext-engine","title":"Meilisearch Fast Full-Text Search & Filterable Attributes Standard","category":"backend","severity":"high","description":"Production search engine standard for Meilisearch. Mandates explicit index configuration (searchableAttributes, filterableAttributes, rankingRules), asynchronous task UID completion polling with waitForTask(), and tenant-scoped search keys.","antiPatternHeadline":"AI filters Meilisearch queries without declaring filterableAttributes, triggering un-indexed search query failures.","stars_count":1890,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["meilisearch","search","full-text","indexing","typo-tolerance"],"exportEndpoints":{"claude":"/api/rules/meilisearch-fulltext-engine?format=claude","cursorMdc":"/api/rules/meilisearch-fulltext-engine?format=mdc","cursorrules":"/api/rules/meilisearch-fulltext-engine?format=cursor","windsurf":"/api/rules/meilisearch-fulltext-engine?format=windsurf","agents":"/api/rules/meilisearch-fulltext-engine?format=agents"}},{"id":"websocket-redis-pubsub-cluster","title":"WebSocket Cluster Scalability & Redis Pub/Sub Backpressure Architecture","category":"backend","severity":"critical","description":"Production real-time architecture for horizontally scaled WebSocket clusters. Mandates Redis Pub/Sub or Streams for cross-node message routing, heartbeat ping-pong socket pruning, exponential reconnection backoff with jitter, and buffer backpressure limits.","antiPatternHeadline":"AI stores active WebSockets in local process memory Maps, dropping messages across multi-instance server deployments.","stars_count":2130,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["websocket","redis","pubsub","realtime","concurrency"],"exportEndpoints":{"claude":"/api/rules/websocket-redis-pubsub-cluster?format=claude","cursorMdc":"/api/rules/websocket-redis-pubsub-cluster?format=mdc","cursorrules":"/api/rules/websocket-redis-pubsub-cluster?format=cursor","windsurf":"/api/rules/websocket-redis-pubsub-cluster?format=windsurf","agents":"/api/rules/websocket-redis-pubsub-cluster?format=agents"}},{"id":"mcp-server-security-sandboxing","title":"Model Context Protocol (MCP) Server Security Sandboxing & Path Traversal Defense","category":"backend","severity":"critical","description":"Production security standard for Model Context Protocol (MCP) tool servers. Enforces strict filesystem root confinement with path canonicalization (realpath), absolute prohibition of raw child_process.exec() parameter substitution, parameter schema boundaries, and timeout kill-switches.","antiPatternHeadline":"AI writes MCP tool handlers that pass un-sanitized tool arguments directly to child_process.exec() or fs.readFile(), permitting host path traversal and remote code execution.","stars_count":1820,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["mcp","model-context-protocol","security","sandboxing","tools","typescript","python"],"exportEndpoints":{"claude":"/api/rules/mcp-server-security-sandboxing?format=claude","cursorMdc":"/api/rules/mcp-server-security-sandboxing?format=mdc","cursorrules":"/api/rules/mcp-server-security-sandboxing?format=cursor","windsurf":"/api/rules/mcp-server-security-sandboxing?format=windsurf","agents":"/api/rules/mcp-server-security-sandboxing?format=agents"}},{"id":"rag-semantic-chunking-reranking","title":"Enterprise RAG Pipeline: Semantic Chunking & Cross-Encoder Reranking","category":"backend","severity":"critical","description":"Production architecture for Retrieval-Augmented Generation (RAG). Replaces arbitrary character splitting with semantic Markdown header hierarchy chunking, hybrid vector + BM25 keyword search with Reciprocal Rank Fusion (RRF), and Cross-Encoder reranking (Cohere / BGE) to eliminate LLM hallucinations.","antiPatternHeadline":"AI uses fixed chunk_size=500 character splitting cutting code blocks and sentences in half, passes raw top-k vector similarity scores, and prompts LLMs with fragmented noise.","stars_count":2150,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["rag","vector-search","reranking","chunking","llm","python","embeddings"],"exportEndpoints":{"claude":"/api/rules/rag-semantic-chunking-reranking?format=claude","cursorMdc":"/api/rules/rag-semantic-chunking-reranking?format=mdc","cursorrules":"/api/rules/rag-semantic-chunking-reranking?format=cursor","windsurf":"/api/rules/rag-semantic-chunking-reranking?format=windsurf","agents":"/api/rules/rag-semantic-chunking-reranking?format=agents"}},{"id":"llm-eval-deepeval-ragas-benchmarking","title":"LLM Evaluation & Automated CI/CD Regression Guardrails (DeepEval & Ragas)","category":"backend","severity":"critical","description":"Production quality assurance standard for LLM applications. Mandates automated evaluation test suites using DeepEval and Ragas in CI/CD pipelines, scoring Answer Relevancy, Faithfulness, Hallucination, and Contextual Precision with deterministic assertion thresholds before code deployment.","antiPatternHeadline":"AI edits prompts and RAG parameters blindly without automated regression test suites, shipping silent hallucinations and quality regressions into production.","stars_count":1690,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["evals","deepeval","ragas","llm-testing","ci-cd","python","quality-assurance"],"exportEndpoints":{"claude":"/api/rules/llm-eval-deepeval-ragas-benchmarking?format=claude","cursorMdc":"/api/rules/llm-eval-deepeval-ragas-benchmarking?format=mdc","cursorrules":"/api/rules/llm-eval-deepeval-ragas-benchmarking?format=cursor","windsurf":"/api/rules/llm-eval-deepeval-ragas-benchmarking?format=windsurf","agents":"/api/rules/llm-eval-deepeval-ragas-benchmarking?format=agents"}},{"id":"scylladb-cassandra-partition-key-design","title":"ScyllaDB & Apache Cassandra Wide-Column Partition Key Architecture","category":"backend","severity":"critical","description":"High-throughput distributed database architecture for ScyllaDB and Apache Cassandra. Mandates strict partition key cardinality bounds (<100MB per partition), prohibits production ALLOW FILTERING queries, and enforces time-bucketed clustering keys to eliminate tombstone storm crashes.","antiPatternHeadline":"AI writes Cassandra queries using ALLOW FILTERING on unindexed columns or creates unbounded single-partition time-series, causing catastrophic node OOM crashes.","stars_count":1330,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["scylladb","cassandra","nosql","distributed-database","time-series","high-throughput"],"exportEndpoints":{"claude":"/api/rules/scylladb-cassandra-partition-key-design?format=claude","cursorMdc":"/api/rules/scylladb-cassandra-partition-key-design?format=mdc","cursorrules":"/api/rules/scylladb-cassandra-partition-key-design?format=cursor","windsurf":"/api/rules/scylladb-cassandra-partition-key-design?format=windsurf","agents":"/api/rules/scylladb-cassandra-partition-key-design?format=agents"}},{"id":"nats-jetstream-message-streaming","title":"NATS JetStream 2.10+ High-Performance Event Streaming & Deduplication","category":"backend","severity":"critical","description":"Production architecture for NATS JetStream 2.10+ event-driven systems. Mandates explicit message deduplication headers (Nats-Msg-Id), durable pull consumers with backpressure batching, and strict ACK timeout handling to guarantee zero message loss at microsecond latencies.","antiPatternHeadline":"AI publishes unacknowledged fire-and-forget messages to basic NATS subjects without JetStream persistence or deduplication headers, dropping messages on network reconnections.","stars_count":1470,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["nats","jetstream","event-streaming","message-broker","concurrency","go","typescript"],"exportEndpoints":{"claude":"/api/rules/nats-jetstream-message-streaming?format=claude","cursorMdc":"/api/rules/nats-jetstream-message-streaming?format=mdc","cursorrules":"/api/rules/nats-jetstream-message-streaming?format=cursor","windsurf":"/api/rules/nats-jetstream-message-streaming?format=windsurf","agents":"/api/rules/nats-jetstream-message-streaming?format=agents"}},{"id":"polars-dataframe-zero-copy-rust","title":"Polars High-Performance DataFrame & Lazy Execution Architecture","category":"backend","severity":"high","description":"Production standard for high-performance data engineering and analytics in Python. Mandates Polars LazyFrame query optimization (predicate/projection pushdown), zero-copy Apache Arrow memory layouts, and streaming execution over legacy Pandas to eliminate GIL single-thread bottlenecks.","antiPatternHeadline":"AI writes Pandas pd.read_csv() and .apply() row loops, exhausting RAM and locking the single-threaded Python GIL on multi-gigabyte datasets.","stars_count":1780,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["polars","python","arrow","data-engineering","performance","rust"],"exportEndpoints":{"claude":"/api/rules/polars-dataframe-zero-copy-rust?format=claude","cursorMdc":"/api/rules/polars-dataframe-zero-copy-rust?format=mdc","cursorrules":"/api/rules/polars-dataframe-zero-copy-rust?format=cursor","windsurf":"/api/rules/polars-dataframe-zero-copy-rust?format=windsurf","agents":"/api/rules/polars-dataframe-zero-copy-rust?format=agents"}},{"id":"postgresql-advisory-locks-concurrency","title":"PostgreSQL Application-Level Advisory Locks & Distributed Race Protection","category":"backend","severity":"critical","description":"Production concurrency standard for PostgreSQL database operations. Mandates using transaction-scoped advisory locks (pg_advisory_xact_lock) or session-scoped locks for serializing critical operations (billing, credit grants, sequential invoice numbering), eliminating table-level locking bottlenecks and race conditions.","antiPatternHeadline":"AI executes read-then-write logic without advisory locks or uses SELECT FOR UPDATE on high-traffic tables, causing database deadlocks and double-spending races.","stars_count":1890,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["postgresql","database","concurrency","advisory-locks","distributed-systems","sql"],"exportEndpoints":{"claude":"/api/rules/postgresql-advisory-locks-concurrency?format=claude","cursorMdc":"/api/rules/postgresql-advisory-locks-concurrency?format=mdc","cursorrules":"/api/rules/postgresql-advisory-locks-concurrency?format=cursor","windsurf":"/api/rules/postgresql-advisory-locks-concurrency?format=windsurf","agents":"/api/rules/postgresql-advisory-locks-concurrency?format=agents"}},{"id":"fastapi-lifespan-context-manager","title":"FastAPI & Starlette Modern lifespan Async Context Manager Standard","category":"backend","severity":"high","description":"Production lifecycle standard for FastAPI and Starlette microservices. Mandates the asynccontextmanager lifespan handler for database pool connection, cache client initialization, and graceful resource teardown, strictly replacing deprecated @app.on_event('startup') and @app.on_event('shutdown') decorators.","antiPatternHeadline":"AI uses deprecated @app.on_event('startup') event listeners that do not share state cleanly and are slated for removal in modern Starlette/FastAPI.","stars_count":1580,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["fastapi","python","lifespan","asyncio","architecture","microservices"],"exportEndpoints":{"claude":"/api/rules/fastapi-lifespan-context-manager?format=claude","cursorMdc":"/api/rules/fastapi-lifespan-context-manager?format=mdc","cursorrules":"/api/rules/fastapi-lifespan-context-manager?format=cursor","windsurf":"/api/rules/fastapi-lifespan-context-manager?format=windsurf","agents":"/api/rules/fastapi-lifespan-context-manager?format=agents"}},{"id":"redis-stream-consumer-group-pel","title":"Redis Streams Consumer Groups, PEL & Poison Pill Recovery Standard","category":"backend","severity":"critical","description":"Production message queue standard for Redis Streams. Mandates consumer group creation with explicit MKSTREAM, manual message acknowledgment (XACK), Pending Entries List (PEL) monitoring with XPENDING, and poison pill auto-recovery using XAUTOCLAIM.","antiPatternHeadline":"AI reads Redis Streams using XREAD without consumer groups or forgets XACK, causing unacknowledged messages to accumulate indefinitely in memory.","stars_count":1670,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["redis","redis-streams","message-queue","concurrency","distributed-systems"],"exportEndpoints":{"claude":"/api/rules/redis-stream-consumer-group-pel?format=claude","cursorMdc":"/api/rules/redis-stream-consumer-group-pel?format=mdc","cursorrules":"/api/rules/redis-stream-consumer-group-pel?format=cursor","windsurf":"/api/rules/redis-stream-consumer-group-pel?format=windsurf","agents":"/api/rules/redis-stream-consumer-group-pel?format=agents"}},{"id":"golang-sync-errgroup-context","title":"Go errgroup Context-Aware Parallel Fan-Out & First-Error Abort Standard","category":"backend","severity":"critical","description":"High-concurrency Go standard for fan-out task execution. Mandates using golang.org/x/sync/errgroup with context propagation to coordinate parallel goroutines, cancel sibling tasks immediately on first error, and eliminate goroutine leaks caused by unbuffered channels.","antiPatternHeadline":"AI spawns raw goroutines using sync.WaitGroup without error propagation, leaving sibling goroutines running and leaking memory when one worker fails.","stars_count":1730,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["go","golang","concurrency","errgroup","goroutines","context"],"exportEndpoints":{"claude":"/api/rules/golang-sync-errgroup-context?format=claude","cursorMdc":"/api/rules/golang-sync-errgroup-context?format=mdc","cursorrules":"/api/rules/golang-sync-errgroup-context?format=cursor","windsurf":"/api/rules/golang-sync-errgroup-context?format=windsurf","agents":"/api/rules/golang-sync-errgroup-context?format=agents"}},{"id":"clickhouse-replacing-mergetree-dedup","title":"ClickHouse ReplacingMergeTree & FINAL Query Argument Optimization","category":"backend","severity":"high","description":"Production data architecture standard for ClickHouse. Mandates using ReplacingMergeTree with an explicit version column (updated_at) for deduplication, avoids naive unconstrained SELECT ... FINAL queries across large partitions, and leverages argMax() aggregation for high-speed sub-millisecond deduplication.","antiPatternHeadline":"AI writes SELECT * FROM table FINAL on multi-billion row ClickHouse tables, causing massive single-thread merges and crushing analytical query throughput.","stars_count":1450,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["clickhouse","olap","sql","big-data","replacing-mergetree","performance"],"exportEndpoints":{"claude":"/api/rules/clickhouse-replacing-mergetree-dedup?format=claude","cursorMdc":"/api/rules/clickhouse-replacing-mergetree-dedup?format=mdc","cursorrules":"/api/rules/clickhouse-replacing-mergetree-dedup?format=cursor","windsurf":"/api/rules/clickhouse-replacing-mergetree-dedup?format=windsurf","agents":"/api/rules/clickhouse-replacing-mergetree-dedup?format=agents"}},{"id":"kafka-consumer-commit-sync-anti-pattern","title":"Apache Kafka Manual Offset Commit Discipline & Rebalance Listener Standard","category":"backend","severity":"critical","description":"Production event streaming standard for Apache Kafka consumers. Mandates asynchronous offset commits (commitAsync) during high-throughput polling loops, coupled with synchronous commits (commitSync) on partition revocation listeners and shutdown hooks to prevent duplicate message replay and broker commit backpressure.","antiPatternHeadline":"AI calls commitSync() synchronously after every single processed message, crushing consumer throughput from 50,000 msg/sec down to 100 msg/sec.","stars_count":1810,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["kafka","event-streaming","concurrency","distributed-systems","java","go","python"],"exportEndpoints":{"claude":"/api/rules/kafka-consumer-commit-sync-anti-pattern?format=claude","cursorMdc":"/api/rules/kafka-consumer-commit-sync-anti-pattern?format=mdc","cursorrules":"/api/rules/kafka-consumer-commit-sync-anti-pattern?format=cursor","windsurf":"/api/rules/kafka-consumer-commit-sync-anti-pattern?format=windsurf","agents":"/api/rules/kafka-consumer-commit-sync-anti-pattern?format=agents"}},{"id":"python-httpx-async-connection-pooling","title":"Python HTTPX Async Client Lifecycles & TCP Pool Exhaustion Defense","category":"backend","severity":"critical","description":"Production networking standard for Python async microservices using HTTPX. Mandates reusing a single shared httpx.AsyncClient singleton across request lifecycles, configuring explicit connection pool limits (limits=httpx.Limits(max_keepalive_connections=20)), and strictly prohibits instantiating new clients inside function bodies.","antiPatternHeadline":"AI creates a new `async with httpx.AsyncClient() as client` inside every API request, causing TCP socket exhaustion (TIME_WAIT state) under load.","stars_count":1690,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["python","httpx","networking","asyncio","connection-pooling","fastapi"],"exportEndpoints":{"claude":"/api/rules/python-httpx-async-connection-pooling?format=claude","cursorMdc":"/api/rules/python-httpx-async-connection-pooling?format=mdc","cursorrules":"/api/rules/python-httpx-async-connection-pooling?format=cursor","windsurf":"/api/rules/python-httpx-async-connection-pooling?format=windsurf","agents":"/api/rules/python-httpx-async-connection-pooling?format=agents"}},{"id":"langchain-agent-recursion-limit","title":"LangChain & LangGraph State Machine recursion_limit Cost Runaway Guardrails","category":"backend","severity":"critical","description":"Production safety guardrail for autonomous AI agent architectures. Mandates setting explicit recursion_limit bounds (max 25-50 iterations) in LangGraph / LangChain execution configurations, prevents infinite self-correction loops when tools fail repeatedly, and enforces hard timeout cancellations.","antiPatternHeadline":"AI runs LangGraph or LangChain agent workflows without recursion_limit or timeouts, causing agents in decision deadlocks to loop endlessly and rack up thousands in API costs.","stars_count":2040,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["langchain","langgraph","ai-agents","recursion-limit","cost-governance","python"],"exportEndpoints":{"claude":"/api/rules/langchain-agent-recursion-limit?format=claude","cursorMdc":"/api/rules/langchain-agent-recursion-limit?format=mdc","cursorrules":"/api/rules/langchain-agent-recursion-limit?format=cursor","windsurf":"/api/rules/langchain-agent-recursion-limit?format=windsurf","agents":"/api/rules/langchain-agent-recursion-limit?format=agents"}},{"id":"elasticsearch-scroll-deprecation-search-after","title":"Elasticsearch 8+ & OpenSearch search_after Deep Pagination Standard","category":"backend","severity":"high","description":"Production search architecture for Elasticsearch 8+ and OpenSearch. Mandates search_after cursor-based pagination with point-in-time (PIT), strictly replacing deprecated and memory-intensive scroll contexts that exhaust JVM heap memory.","antiPatternHeadline":"AI writes Elasticsearch queries using deprecated scroll API or high from offsets (from: 10000), causing JVM garbage collection pauses and OOM crashes.","stars_count":1470,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["elasticsearch","opensearch","search","pagination","search-after","big-data"],"exportEndpoints":{"claude":"/api/rules/elasticsearch-scroll-deprecation-search-after?format=claude","cursorMdc":"/api/rules/elasticsearch-scroll-deprecation-search-after?format=mdc","cursorrules":"/api/rules/elasticsearch-scroll-deprecation-search-after?format=cursor","windsurf":"/api/rules/elasticsearch-scroll-deprecation-search-after?format=windsurf","agents":"/api/rules/elasticsearch-scroll-deprecation-search-after?format=agents"}},{"id":"rust-tokio-blocking-task-spawn","title":"Rust Tokio spawn_blocking vs Synchronous Syscall Starvation Standard","category":"backend","severity":"critical","description":"Production concurrency standard for Rust Axum and Tokio applications. Mandates offloading synchronous CPU-intensive algorithms (hashing, compression, image decoding) and blocking filesystem I/O into tokio::task::spawn_blocking, strictly prohibiting blocking syscalls on async worker threads.","antiPatternHeadline":"AI executes std::fs::read or std::thread::sleep directly inside an async fn in Rust Tokio, starving the multi-threaded cooperative runtime.","stars_count":1870,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["rust","tokio","concurrency","async","performance","axum"],"exportEndpoints":{"claude":"/api/rules/rust-tokio-blocking-task-spawn?format=claude","cursorMdc":"/api/rules/rust-tokio-blocking-task-spawn?format=mdc","cursorrules":"/api/rules/rust-tokio-blocking-task-spawn?format=cursor","windsurf":"/api/rules/rust-tokio-blocking-task-spawn?format=windsurf","agents":"/api/rules/rust-tokio-blocking-task-spawn?format=agents"}},{"id":"grpc-client-load-balancing-dns","title":"gRPC Client-Side Round-Robin Load Balancing & Channel Architecture","category":"backend","severity":"critical","description":"Production architecture for gRPC microservices. Mandates client-side round-robin load balancing (dns:/// service resolution), persistent channel reuse, and HTTP/2 stream multiplexing, eliminating the fatal trap of creating a new gRPC channel per RPC call.","antiPatternHeadline":"AI creates new ManagedChannel or grpc.Dial connections on every RPC call, destroying connection multiplexing and overwhelming backends with TLS handshakes.","stars_count":1560,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["grpc","protobuf","microservices","load-balancing","go","java","typescript"],"exportEndpoints":{"claude":"/api/rules/grpc-client-load-balancing-dns?format=claude","cursorMdc":"/api/rules/grpc-client-load-balancing-dns?format=mdc","cursorrules":"/api/rules/grpc-client-load-balancing-dns?format=cursor","windsurf":"/api/rules/grpc-client-load-balancing-dns?format=windsurf","agents":"/api/rules/grpc-client-load-balancing-dns?format=agents"}},{"id":"sqlite-wal-checkpoint-concurrency","title":"SQLite WAL Mode, Busy Timeout & Passive Checkpoint Concurrency Standard","category":"backend","severity":"critical","description":"Production database standard for embedded SQLite (Node.js, Go, Python). Mandates enabling Write-Ahead Logging (PRAGMA journal_mode = WAL), configuring busy_timeout = 5000ms, PRAGMA synchronous = NORMAL, and managing passive checkpointing to prevent 'database is locked' errors under concurrent multi-reader/single-writer workloads.","antiPatternHeadline":"AI uses SQLite default rollback journal mode with zero busy_timeout, causing immediate SQLITE_BUSY (database is locked) crashes during concurrent web requests.","stars_count":1620,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["sqlite","database","wal","concurrency","embedded","performance"],"exportEndpoints":{"claude":"/api/rules/sqlite-wal-checkpoint-concurrency?format=claude","cursorMdc":"/api/rules/sqlite-wal-checkpoint-concurrency?format=mdc","cursorrules":"/api/rules/sqlite-wal-checkpoint-concurrency?format=cursor","windsurf":"/api/rules/sqlite-wal-checkpoint-concurrency?format=windsurf","agents":"/api/rules/sqlite-wal-checkpoint-concurrency?format=agents"}},{"id":"react-native-expo","title":"React Native Expo SDK 52+ & Expo Router Standard","category":"mobile","severity":"critical","description":"Conventions for React Native with Expo SDK 52+: file-based Expo Router v4, New Architecture (Bridgeless + Fabric), FlashList for 60fps lists, and typed environment variables.","antiPatternHeadline":"AI uses outdated React Native Navigation boilerplate or deprecated expo-permissions / bare native modules.","stars_count":2120,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["react-native","expo","mobile","ios","android"],"exportEndpoints":{"claude":"/api/rules/react-native-expo?format=claude","cursorMdc":"/api/rules/react-native-expo?format=mdc","cursorrules":"/api/rules/react-native-expo?format=cursor","windsurf":"/api/rules/react-native-expo?format=windsurf","agents":"/api/rules/react-native-expo?format=agents"}},{"id":"flutter-bloc","title":"Flutter BLoC & Clean State Architecture Standard","category":"mobile","severity":"high","description":"Guardrails for Flutter: strict BLoC (Business Logic Component) pattern, immutable state objects via Freezed, separation of UI and business logic, and memory leak prevention.","antiPatternHeadline":"AI sprays setState() across deep widget trees, leading to uncontrolled rebuilds and state loss.","stars_count":1790,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["flutter","dart","bloc","mobile","cross-platform"],"exportEndpoints":{"claude":"/api/rules/flutter-bloc?format=claude","cursorMdc":"/api/rules/flutter-bloc?format=mdc","cursorrules":"/api/rules/flutter-bloc?format=cursor","windsurf":"/api/rules/flutter-bloc?format=windsurf","agents":"/api/rules/flutter-bloc?format=agents"}},{"id":"swiftui-modern-concurrency","title":"SwiftUI & Swift 6 Structured Concurrency Standard","category":"mobile","severity":"critical","description":"Guardrails for native iOS with Swift 6: enforce Sendable conformance, replace ObservableObject with modern @Observable macro, and ensure @MainActor isolation for UI.","antiPatternHeadline":"AI uses deprecated @ObservedObject / ObservableObject, causes data race compiler errors in Swift 6, or forgets @MainActor.","stars_count":1840,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["swift","swiftui","ios","swift6","concurrency"],"exportEndpoints":{"claude":"/api/rules/swiftui-modern-concurrency?format=claude","cursorMdc":"/api/rules/swiftui-modern-concurrency?format=mdc","cursorrules":"/api/rules/swiftui-modern-concurrency?format=cursor","windsurf":"/api/rules/swiftui-modern-concurrency?format=windsurf","agents":"/api/rules/swiftui-modern-concurrency?format=agents"}},{"id":"android-jetpack-compose","title":"Android Jetpack Compose & Kotlin Flow Standard","category":"mobile","severity":"high","description":"Conventions for native Android: State hoisting, rememberSaveable for configuration changes, collectAsStateWithLifecycle(), and CoroutineScope lifecycle scoping.","antiPatternHeadline":"AI uses plain collectAsState() causing background battery drain, or modifies ViewModel mutable state from Composables.","stars_count":1610,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["android","jetpack-compose","kotlin","coroutines","flow"],"exportEndpoints":{"claude":"/api/rules/android-jetpack-compose?format=claude","cursorMdc":"/api/rules/android-jetpack-compose?format=mdc","cursorrules":"/api/rules/android-jetpack-compose?format=cursor","windsurf":"/api/rules/android-jetpack-compose?format=windsurf","agents":"/api/rules/android-jetpack-compose?format=agents"}},{"id":"kmp-compose-multiplatform","title":"Kotlin Multiplatform (KMP) Architecture Standard","category":"mobile","severity":"high","description":"Guardrails for Kotlin Multiplatform: isolate platform specifics behind expect/actual, share 100% of domain and data layers, and manage Ktor HTTP client engines per platform.","antiPatternHeadline":"AI leaks Android/iOS platform APIs into commonMain, causing multiplatform compilation failure.","stars_count":1490,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["kmp","kotlin-multiplatform","compose-multiplatform","cross-platform"],"exportEndpoints":{"claude":"/api/rules/kmp-compose-multiplatform?format=claude","cursorMdc":"/api/rules/kmp-compose-multiplatform?format=mdc","cursorrules":"/api/rules/kmp-compose-multiplatform?format=cursor","windsurf":"/api/rules/kmp-compose-multiplatform?format=windsurf","agents":"/api/rules/kmp-compose-multiplatform?format=agents"}},{"id":"tauri-v2-desktop","title":"Tauri v2 Desktop & Mobile Security Standard","category":"mobile","severity":"critical","description":"Guardrails for Tauri v2 cross-platform desktop & mobile apps: command capability security ACLs, safe IPC serialization, and isolation of OS native permissions.","antiPatternHeadline":"AI enables wildcard permissions ('*') in Tauri capabilities or passes unsanitized filesystem paths over IPC.","stars_count":1670,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["tauri","rust","desktop","mobile","security"],"exportEndpoints":{"claude":"/api/rules/tauri-v2-desktop?format=claude","cursorMdc":"/api/rules/tauri-v2-desktop?format=mdc","cursorrules":"/api/rules/tauri-v2-desktop?format=cursor","windsurf":"/api/rules/tauri-v2-desktop?format=windsurf","agents":"/api/rules/tauri-v2-desktop?format=agents"}},{"id":"capacitor-ionic-hybrid","title":"Capacitor 6 Native Bridge & Offline Sync Standard","category":"mobile","severity":"medium","description":"Conventions for Capacitor 6 hybrid apps: manage native plugin lifecycles, handle safe hardware back buttons, and implement offline SQLite/IndexedDB synchronization.","antiPatternHeadline":"AI forgets platform check (Capacitor.isNativePlatform), causing web builds to crash when calling mobile native plugins.","stars_count":1150,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["capacitor","ionic","hybrid-mobile","typescript"],"exportEndpoints":{"claude":"/api/rules/capacitor-ionic-hybrid?format=claude","cursorMdc":"/api/rules/capacitor-ionic-hybrid?format=mdc","cursorrules":"/api/rules/capacitor-ionic-hybrid?format=cursor","windsurf":"/api/rules/capacitor-ionic-hybrid?format=windsurf","agents":"/api/rules/capacitor-ionic-hybrid?format=agents"}},{"id":"flutter-riverpod-v2","title":"Flutter Riverpod 2.5+ Code Generation & AsyncValue Standard","category":"mobile","severity":"high","description":"Modern state management and dependency injection in Flutter using Riverpod 2.5+ code generation. Forbids legacy StateNotifierProvider; mandates @riverpod annotations, autoDispose lifecycle, and compile-safe AsyncValue.when() UI branching.","antiPatternHeadline":"AI outputs legacy Riverpod 1.0 StateNotifierProvider boilerplate with manual state mutations and missing loading/error UI states.","stars_count":1720,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["flutter","riverpod","state-management","dart","mobile-architecture"],"exportEndpoints":{"claude":"/api/rules/flutter-riverpod-v2?format=claude","cursorMdc":"/api/rules/flutter-riverpod-v2?format=mdc","cursorrules":"/api/rules/flutter-riverpod-v2?format=cursor","windsurf":"/api/rules/flutter-riverpod-v2?format=windsurf","agents":"/api/rules/flutter-riverpod-v2?format=agents"}},{"id":"apple-app-store-guidelines","title":"Apple App Store Review Guidelines & Privacy Manifest Standard","category":"mobile","severity":"critical","description":"iOS production compliance guardrails for App Store approval. Mandates PrivacyInfo.xcprivacy manifests declaring API categories (User Defaults, File Timestamps), Sign in with Apple requirement when third-party OAuth is used, and App Tracking Transparency (ATT).","antiPatternHeadline":"AI omits required privacy manifests or adds Google Sign-in without mandatory Sign in with Apple, causing instant app rejection.","stars_count":2210,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["ios","app-store","privacy-manifest","apple-login","compliance"],"exportEndpoints":{"claude":"/api/rules/apple-app-store-guidelines?format=claude","cursorMdc":"/api/rules/apple-app-store-guidelines?format=mdc","cursorrules":"/api/rules/apple-app-store-guidelines?format=cursor","windsurf":"/api/rules/apple-app-store-guidelines?format=windsurf","agents":"/api/rules/apple-app-store-guidelines?format=agents"}},{"id":"android-security-keystore","title":"Android Keystore & EncryptedSharedPreferences Hardening","category":"mobile","severity":"critical","description":"Hardware-backed security architecture for Android. Mandates AES-256-GCM encryption for stored user tokens and private keys using Android Keystore and Jetpack Security EncryptedSharedPreferences; forbids world-readable files.","antiPatternHeadline":"AI stores API tokens and sensitive user data in unencrypted plaintext SharedPreferences or world-readable files.","stars_count":1980,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["android","keystore","encryption","jetpack-security","mobile-security"],"exportEndpoints":{"claude":"/api/rules/android-security-keystore?format=claude","cursorMdc":"/api/rules/android-security-keystore?format=mdc","cursorrules":"/api/rules/android-security-keystore?format=cursor","windsurf":"/api/rules/android-security-keystore?format=windsurf","agents":"/api/rules/android-security-keystore?format=agents"}},{"id":"react-native-reanimated-v3-worklets","title":"React Native Reanimated 3 Worklets & 120 FPS Gesture Architecture","category":"mobile","severity":"high","description":"Production mobile UI animation standard using React Native Reanimated 3 and Gesture Handler 2. Mandates JS-to-UI thread worklet execution, useSharedValue atomic primitives, withSpring physics, and forbids bridge-blocking legacy Animated APIs.","antiPatternHeadline":"AI writes legacy React Native Animated.timing with useNativeDriver: false, causing severe frame drops during JS thread load.","stars_count":2150,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["react-native","reanimated","gestures","mobile","ios-android"],"exportEndpoints":{"claude":"/api/rules/react-native-reanimated-v3-worklets?format=claude","cursorMdc":"/api/rules/react-native-reanimated-v3-worklets?format=mdc","cursorrules":"/api/rules/react-native-reanimated-v3-worklets?format=cursor","windsurf":"/api/rules/react-native-reanimated-v3-worklets?format=windsurf","agents":"/api/rules/react-native-reanimated-v3-worklets?format=agents"}},{"id":"swiftdata-modern-persistence","title":"SwiftData iOS 17+ Modern Model Persistence & Concurrency Standard","category":"mobile","severity":"high","description":"Production persistence architecture for iOS 17/18 and macOS using SwiftData. Replaces verbose CoreData boilerplate with declarative @Model macros, type-safe #Predicate queries, @Query SwiftUI property wrappers, and ModelActor background isolation.","antiPatternHeadline":"AI scaffolds legacy CoreData .xcdatamodeld and passes NSManagedObject instances across Swift concurrency boundaries.","stars_count":1940,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["swiftdata","swift","ios","swiftui","persistence"],"exportEndpoints":{"claude":"/api/rules/swiftdata-modern-persistence?format=claude","cursorMdc":"/api/rules/swiftdata-modern-persistence?format=mdc","cursorrules":"/api/rules/swiftdata-modern-persistence?format=cursor","windsurf":"/api/rules/swiftdata-modern-persistence?format=windsurf","agents":"/api/rules/swiftdata-modern-persistence?format=agents"}},{"id":"expo-sqlite-drizzle-offline-first","title":"Expo SQLite & Drizzle ORM Offline-First Local Database Architecture","category":"mobile","severity":"critical","description":"Production standard for offline-first React Native / Expo applications. Mandates expo-sqlite modern async API with Drizzle ORM, UUIDv7 / ULID primary keys for conflict-free two-way synchronization, WAL mode pragmas, and transactional schema migrations.","antiPatternHeadline":"AI uses deprecated synchronous SQLite APIs or auto-incrementing integer IDs that collide when syncing offline transactions back to the backend database.","stars_count":1410,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["expo","sqlite","drizzle-orm","react-native","offline-first","mobile"],"exportEndpoints":{"claude":"/api/rules/expo-sqlite-drizzle-offline-first?format=claude","cursorMdc":"/api/rules/expo-sqlite-drizzle-offline-first?format=mdc","cursorrules":"/api/rules/expo-sqlite-drizzle-offline-first?format=cursor","windsurf":"/api/rules/expo-sqlite-drizzle-offline-first?format=windsurf","agents":"/api/rules/expo-sqlite-drizzle-offline-first?format=agents"}},{"id":"flutter-rust-bridge-v2-native-compute","title":"Flutter Rust Bridge (FRB v2) Zero-Copy Native Compute Integration","category":"mobile","severity":"high","description":"Production architecture for Flutter applications requiring native C/Rust high performance. Mandates flutter_rust_bridge (FRB v2) code generation, zero-copy byte buffers with Dart isolates, asynchronous Stream responses for long-running algorithms, and elimination of main UI isolate freezes.","antiPatternHeadline":"AI executes heavy cryptography, image manipulation, or binary parsing directly in Dart on the main UI isolate, causing noticeable 20-30 FPS UI frame drops.","stars_count":1290,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["flutter","rust","ffi","native-compute","mobile-performance","dart"],"exportEndpoints":{"claude":"/api/rules/flutter-rust-bridge-v2-native-compute?format=claude","cursorMdc":"/api/rules/flutter-rust-bridge-v2-native-compute?format=mdc","cursorrules":"/api/rules/flutter-rust-bridge-v2-native-compute?format=cursor","windsurf":"/api/rules/flutter-rust-bridge-v2-native-compute?format=windsurf","agents":"/api/rules/flutter-rust-bridge-v2-native-compute?format=agents"}},{"id":"react-native-new-architecture-turbomodules","title":"React Native New Architecture (TurboModules & Fabric) Migration Standard","category":"mobile","severity":"critical","description":"Production standard for React Native 0.76+ New Architecture. Mandates C++ TurboModule interfaces using Codegen Specs, pure Fabric Native Component rendering, and eliminates legacy asynchronous JSON bridge calls that cause UI bridge thread locking.","antiPatternHeadline":"AI writes legacy NativeModules bridging using NativeModules.MyModule, triggering runtime crashes and deprecation errors on React Native New Architecture builds.","stars_count":1650,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["react-native","turbomodules","fabric","mobile","new-architecture","typescript"],"exportEndpoints":{"claude":"/api/rules/react-native-new-architecture-turbomodules?format=claude","cursorMdc":"/api/rules/react-native-new-architecture-turbomodules?format=mdc","cursorrules":"/api/rules/react-native-new-architecture-turbomodules?format=cursor","windsurf":"/api/rules/react-native-new-architecture-turbomodules?format=windsurf","agents":"/api/rules/react-native-new-architecture-turbomodules?format=agents"}},{"id":"flutter-custom-painter-repaint-boundary","title":"Flutter CustomPainter RepaintBoundary & Canvas Cache Standard","category":"mobile","severity":"high","description":"Performance standard for Flutter rendering and canvas animations. Mandates wrapping CustomPaint widgets in RepaintBoundary to isolate canvas repaints from the outer widget tree, implementing shouldRepaint() equality checks, and eliminating 60fps frame drops in custom charts and particle animations.","antiPatternHeadline":"AI omits RepaintBoundary and unconditionally returns `true` in CustomPainter.shouldRepaint, causing Flutter to repaint the entire screen on every cursor blink or tick.","stars_count":1410,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["flutter","dart","custom-painter","repaint-boundary","performance","mobile"],"exportEndpoints":{"claude":"/api/rules/flutter-custom-painter-repaint-boundary?format=claude","cursorMdc":"/api/rules/flutter-custom-painter-repaint-boundary?format=mdc","cursorrules":"/api/rules/flutter-custom-painter-repaint-boundary?format=cursor","windsurf":"/api/rules/flutter-custom-painter-repaint-boundary?format=windsurf","agents":"/api/rules/flutter-custom-painter-repaint-boundary?format=agents"}},{"id":"expo-background-fetch-task-manager","title":"Expo Background Fetch & TaskManager Execution Windows Standard","category":"mobile","severity":"high","description":"Production standard for background synchronization in React Native / Expo. Mandates registering global TaskManager definitions in root index.js, configuring minimumInterval (15+ mins), respecting OS battery optimization constraints, and returning BackgroundFetch.BackgroundFetchResult.NewData to avoid OS task throttling.","antiPatternHeadline":"AI defines TaskManager background tasks inside React component lifecycles or uses 1-minute intervals, causing iOS and Android to permanently suspend the app.","stars_count":1380,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["expo","react-native","background-fetch","task-manager","mobile","ios","android"],"exportEndpoints":{"claude":"/api/rules/expo-background-fetch-task-manager?format=claude","cursorMdc":"/api/rules/expo-background-fetch-task-manager?format=mdc","cursorrules":"/api/rules/expo-background-fetch-task-manager?format=cursor","windsurf":"/api/rules/expo-background-fetch-task-manager?format=windsurf","agents":"/api/rules/expo-background-fetch-task-manager?format=agents"}},{"id":"swiftui-observation-framework-ios17","title":"SwiftUI iOS 17+ @Observable Macro Migration & State Isolation Standard","category":"mobile","severity":"high","description":"Production state architecture standard for modern SwiftUI (iOS 17+ / Swift 6). Mandates migrating from legacy ObservableObject and @Published to the native @Observable macro, using @State for model ownership, @Bindable for two-way bindings, and eliminating redundant view body invalidations.","antiPatternHeadline":"AI writes legacy class ViewModel: ObservableObject with @Published and @StateObject in iOS 17+ codebases, causing whole-view re-renders on every property change.","stars_count":1540,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["swiftui","swift","ios","observable","macros","mobile","apple"],"exportEndpoints":{"claude":"/api/rules/swiftui-observation-framework-ios17?format=claude","cursorMdc":"/api/rules/swiftui-observation-framework-ios17?format=mdc","cursorrules":"/api/rules/swiftui-observation-framework-ios17?format=cursor","windsurf":"/api/rules/swiftui-observation-framework-ios17?format=windsurf","agents":"/api/rules/swiftui-observation-framework-ios17?format=agents"}},{"id":"solidity-smart-contract-audit","title":"Solidity 0.8+ Smart Contract Security & Gas Optimization","category":"security","severity":"critical","description":"Enterprise Web3 smart contract security: Checks-Effects-Interactions pattern, ReentrancyGuard from OpenZeppelin v5, custom errors instead of strings, and overflow safety.","antiPatternHeadline":"AI sends ETH transfers before updating balances (reentrancy vector) or uses deprecated tx.origin for authentication.","stars_count":2430,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["solidity","web3","smart-contracts","ethereum","audit"],"exportEndpoints":{"claude":"/api/rules/solidity-smart-contract-audit?format=claude","cursorMdc":"/api/rules/solidity-smart-contract-audit?format=mdc","cursorrules":"/api/rules/solidity-smart-contract-audit?format=cursor","windsurf":"/api/rules/solidity-smart-contract-audit?format=windsurf","agents":"/api/rules/solidity-smart-contract-audit?format=agents"}},{"id":"owasp-api-security-top10","title":"OWASP API Security Top 10 Guardrails & BOLA Defense","category":"security","severity":"critical","description":"Protection against Broken Object Level Authorization (BOLA/IDOR), Broken Object Property Level Authorization, and sensitive data leakage in REST/GraphQL APIs.","antiPatternHeadline":"AI relies on client-provided IDs directly without verifying tenant ownership (BOLA vulnerability).","stars_count":2750,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","owasp","api-security","authorization","idor"],"exportEndpoints":{"claude":"/api/rules/owasp-api-security-top10?format=claude","cursorMdc":"/api/rules/owasp-api-security-top10?format=mdc","cursorrules":"/api/rules/owasp-api-security-top10?format=cursor","windsurf":"/api/rules/owasp-api-security-top10?format=windsurf","agents":"/api/rules/owasp-api-security-top10?format=agents"}},{"id":"input-sanitization-sql-injection","title":"SQL Injection Defense & Parameterized Query Standard","category":"security","severity":"critical","description":"Eliminate SQL injection: strictly use parameterized queries or prepared statements, avoid string interpolation in SQL strings, and validate identifiers against strict whitelists.","antiPatternHeadline":"AI uses template literals (f-strings / `${userInput}`) to construct dynamic SQL queries.","stars_count":2680,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","sql-injection","database","sanitization"],"exportEndpoints":{"claude":"/api/rules/input-sanitization-sql-injection?format=claude","cursorMdc":"/api/rules/input-sanitization-sql-injection?format=mdc","cursorrules":"/api/rules/input-sanitization-sql-injection?format=cursor","windsurf":"/api/rules/input-sanitization-sql-injection?format=windsurf","agents":"/api/rules/input-sanitization-sql-injection?format=agents"}},{"id":"secret-management-zero-hardcode","title":"Zero Secret Hardcoding & Environment Hygiene Standard","category":"security","severity":"critical","description":"Guardrails against leaked API keys, tokens, and database passwords: zero plaintext secrets in code, Git pre-commit secret scanning, and automated runtime env validation.","antiPatternHeadline":"AI writes hardcoded placeholder API keys ('sk-proj-...') or fake tokens directly in test/source files.","stars_count":2390,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","secrets","env","git-safety","devops"],"exportEndpoints":{"claude":"/api/rules/secret-management-zero-hardcode?format=claude","cursorMdc":"/api/rules/secret-management-zero-hardcode?format=mdc","cursorrules":"/api/rules/secret-management-zero-hardcode?format=cursor","windsurf":"/api/rules/secret-management-zero-hardcode?format=windsurf","agents":"/api/rules/secret-management-zero-hardcode?format=agents"}},{"id":"oauth2-pkce-implementation","title":"OAuth 2.1 & OIDC Authorization Code with PKCE Standard","category":"security","severity":"critical","description":"Guardrails for modern authentication: OAuth 2.1 Authorization Code Flow with PKCE (Proof Key for Code Exchange), httpOnly SameSite=Lax cookies, and refresh token rotation.","antiPatternHeadline":"AI uses deprecated OAuth Implicit Flow or stores JWT access tokens in browser localStorage.","stars_count":2160,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["oauth","security","authentication","pkce","jwt"],"exportEndpoints":{"claude":"/api/rules/oauth2-pkce-implementation?format=claude","cursorMdc":"/api/rules/oauth2-pkce-implementation?format=mdc","cursorrules":"/api/rules/oauth2-pkce-implementation?format=cursor","windsurf":"/api/rules/oauth2-pkce-implementation?format=windsurf","agents":"/api/rules/oauth2-pkce-implementation?format=agents"}},{"id":"cors-csrf-defense","title":"Modern CORS & CSRF Defense Architecture Standard","category":"security","severity":"critical","description":"Guardrails for Cross-Origin Resource Sharing (CORS) and Cross-Site Request Forgery (CSRF): strict allowed origins (no wildcard with credentials), SameSite cookies, and Double Submit Cookie patterns.","antiPatternHeadline":"AI configures Access-Control-Allow-Origin: '*' alongside credentials: true, or disables CORS entirely.","stars_count":1980,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["cors","csrf","security","web-security","cookies"],"exportEndpoints":{"claude":"/api/rules/cors-csrf-defense?format=claude","cursorMdc":"/api/rules/cors-csrf-defense?format=mdc","cursorrules":"/api/rules/cors-csrf-defense?format=cursor","windsurf":"/api/rules/cors-csrf-defense?format=windsurf","agents":"/api/rules/cors-csrf-defense?format=agents"}},{"id":"cryptographic-key-handling","title":"Cryptographic Standards & Password Hashing Standard","category":"security","severity":"critical","description":"Guardrails for modern cryptography: Argon2id for password hashing (no MD5, SHA-1, or plain bcrypt), AES-256-GCM for symmetric encryption, and constant-time string comparisons.","antiPatternHeadline":"AI uses MD5/SHA256 for password hashing, ECB mode for AES encryption, or standard '===' for secret comparison.","stars_count":2130,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["cryptography","encryption","argon2","passwords","security"],"exportEndpoints":{"claude":"/api/rules/cryptographic-key-handling?format=claude","cursorMdc":"/api/rules/cryptographic-key-handling?format=mdc","cursorrules":"/api/rules/cryptographic-key-handling?format=cursor","windsurf":"/api/rules/cryptographic-key-handling?format=windsurf","agents":"/api/rules/cryptographic-key-handling?format=agents"}},{"id":"ai-prompt-injection-defense","title":"LLM Prompt Injection & Output Guardrails Standard","category":"security","severity":"critical","description":"Guardrails for AI Agent applications: delimiter sandboxing for untrusted inputs, schema validation for LLM outputs, canary tokens to detect system prompt exfiltration, and tool call permission bounds.","antiPatternHeadline":"AI directly concatenates raw user prompts into system instructions without boundary delimiters or validation.","stars_count":2840,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["ai-security","prompt-injection","llm-guardrails","agents"],"exportEndpoints":{"claude":"/api/rules/ai-prompt-injection-defense?format=claude","cursorMdc":"/api/rules/ai-prompt-injection-defense?format=mdc","cursorrules":"/api/rules/ai-prompt-injection-defense?format=cursor","windsurf":"/api/rules/ai-prompt-injection-defense?format=windsurf","agents":"/api/rules/ai-prompt-injection-defense?format=agents"}},{"id":"jwt-stateless-auth-hardening","title":"JWT Stateless Authentication Hardening & Token Rotation Standard","category":"security","severity":"critical","description":"Cryptographically sound JWT token architecture. Mandates asymmetric RS256/EdDSA signature verification, short-lived access tokens (15m) in HttpOnly SameSite=Strict cookies, refresh token rotation with reuse detection, and revocation blacklists.","antiPatternHeadline":"AI stores tokens in localStorage (vulnerable to XSS), uses weak symmetric HS256 secrets, and allows infinite token lifespans.","stars_count":2950,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["jwt","authentication","security","token-rotation","owasp"],"exportEndpoints":{"claude":"/api/rules/jwt-stateless-auth-hardening?format=claude","cursorMdc":"/api/rules/jwt-stateless-auth-hardening?format=mdc","cursorrules":"/api/rules/jwt-stateless-auth-hardening?format=cursor","windsurf":"/api/rules/jwt-stateless-auth-hardening?format=windsurf","agents":"/api/rules/jwt-stateless-auth-hardening?format=agents"}},{"id":"rate-limiting-token-bucket","title":"Distributed Rate Limiting (Redis Token Bucket / Sliding Window) Standard","category":"security","severity":"critical","description":"Enterprise DDoS and abuse mitigation via atomic Redis sliding-window log/token bucket algorithms. Enforces IP- and user-tier rate limits, standard IETF RateLimit-* headers, and atomic Lua script execution.","antiPatternHeadline":"AI implements rate limiting with local in-memory JavaScript objects that leak memory and fail in clustered multi-pod deployments.","stars_count":2490,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["rate-limiting","redis","token-bucket","ddos-prevention","api-security"],"exportEndpoints":{"claude":"/api/rules/rate-limiting-token-bucket?format=claude","cursorMdc":"/api/rules/rate-limiting-token-bucket?format=mdc","cursorrules":"/api/rules/rate-limiting-token-bucket?format=cursor","windsurf":"/api/rules/rate-limiting-token-bucket?format=windsurf","agents":"/api/rules/rate-limiting-token-bucket?format=agents"}},{"id":"gdpr-hipaa-pii-masking","title":"PII Data Sanitization & Log Masking Compliance Standard","category":"security","severity":"critical","description":"GDPR, HIPAA, and SOC2 compliant data sanitization discipline. Forbids logging plaintext Personally Identifiable Information (PII) including passwords, credit card numbers, national IDs, and JWT tokens; mandates deep recursive redaction.","antiPatternHeadline":"AI logs raw request bodies, database entities, or error dumps containing cleartext passwords and user PII.","stars_count":2380,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["gdpr","hipaa","pii-sanitization","log-masking","compliance"],"exportEndpoints":{"claude":"/api/rules/gdpr-hipaa-pii-masking?format=claude","cursorMdc":"/api/rules/gdpr-hipaa-pii-masking?format=mdc","cursorrules":"/api/rules/gdpr-hipaa-pii-masking?format=cursor","windsurf":"/api/rules/gdpr-hipaa-pii-masking?format=windsurf","agents":"/api/rules/gdpr-hipaa-pii-masking?format=agents"}},{"id":"supply-chain-sbom-security","title":"Software Supply Chain Security & Dependency Pinning Standard","category":"security","severity":"high","description":"Modern supply chain hardening against malicious package injection and typosquatting. Mandates strict dependency pinning (no wildcard ranges), reproducible lockfiles, CI automated vulnerability scanning, and CycloneDX SBOM generation.","antiPatternHeadline":"AI leaves open wildcard ranges in package.json/pyproject.toml and ignores supply chain verification in CI.","stars_count":1910,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["supply-chain","sbom","cyclonedx","dependencies","security-audit"],"exportEndpoints":{"claude":"/api/rules/supply-chain-sbom-security?format=claude","cursorMdc":"/api/rules/supply-chain-sbom-security?format=mdc","cursorrules":"/api/rules/supply-chain-sbom-security?format=cursor","windsurf":"/api/rules/supply-chain-sbom-security?format=windsurf","agents":"/api/rules/supply-chain-sbom-security?format=agents"}},{"id":"passkeys-webauthn-fido2-standard","title":"Passkeys & WebAuthn FIDO2 Passwordless Authentication Standard","category":"security","severity":"critical","description":"Enterprise authentication standard for Passkeys and WebAuthn FIDO2. Mandates cryptographic challenge generation, signature replay counter validation, attestation verification, and secure user-handle management using @simplewebauthn.","antiPatternHeadline":"AI stores unverified WebAuthn public keys in plaintext and omits cryptographic challenge verification.","stars_count":2340,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["passkeys","webauthn","fido2","authentication","cryptography"],"exportEndpoints":{"claude":"/api/rules/passkeys-webauthn-fido2-standard?format=claude","cursorMdc":"/api/rules/passkeys-webauthn-fido2-standard?format=mdc","cursorrules":"/api/rules/passkeys-webauthn-fido2-standard?format=cursor","windsurf":"/api/rules/passkeys-webauthn-fido2-standard?format=windsurf","agents":"/api/rules/passkeys-webauthn-fido2-standard?format=agents"}},{"id":"coop-coep-cross-origin-isolation","title":"Cross-Origin Isolation (COOP & COEP) & SharedArrayBuffer Defense","category":"security","severity":"high","description":"Browser security standard for high-performance web applications using WebAssembly multi-threading and SharedArrayBuffer. Mandates precise Cross-Origin-Opener-Policy (COOP) and Cross-Origin-Embedder-Policy (COEP) headers while safeguarding third-party embeds.","antiPatternHeadline":"AI attempts to instantiate SharedArrayBuffer without cross-origin isolation headers, causing silent security exceptions.","stars_count":1720,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["coop","coep","sharedarraybuffer","webassembly","browser-security"],"exportEndpoints":{"claude":"/api/rules/coop-coep-cross-origin-isolation?format=claude","cursorMdc":"/api/rules/coop-coep-cross-origin-isolation?format=mdc","cursorrules":"/api/rules/coop-coep-cross-origin-isolation?format=cursor","windsurf":"/api/rules/coop-coep-cross-origin-isolation?format=windsurf","agents":"/api/rules/coop-coep-cross-origin-isolation?format=agents"}},{"id":"zero-trust-istio-mtls","title":"Istio Service Mesh Zero-Trust mTLS & Strict AuthorizationPolicy","category":"security","severity":"critical","description":"Zero-trust microservice security standard using Istio service mesh. Enforces PeerAuthentication STRICT mode, SPIFFE cryptographic identity validation, explicit egress traffic gateways, and granular L7 AuthorizationPolicies.","antiPatternHeadline":"AI leaves Istio in PERMISSIVE mTLS mode and allows unauthenticated east-west traffic between internal pods.","stars_count":2180,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["istio","zero-trust","mtls","kubernetes","service-mesh"],"exportEndpoints":{"claude":"/api/rules/zero-trust-istio-mtls?format=claude","cursorMdc":"/api/rules/zero-trust-istio-mtls?format=mdc","cursorrules":"/api/rules/zero-trust-istio-mtls?format=cursor","windsurf":"/api/rules/zero-trust-istio-mtls?format=windsurf","agents":"/api/rules/zero-trust-istio-mtls?format=agents"}},{"id":"owasp-llm-top-10-guardrails","title":"OWASP Top 10 for LLMs & Indirect Prompt Injection Defense","category":"security","severity":"critical","description":"Enterprise security standard mitigating OWASP Top 10 for Large Language Model Applications (LLM01 Prompt Injection, LLM02 Sensitive Information Disclosure, LLM08 Excessive Agency). Mandates dual-boundary structural tagging, input guardrail scanning, and human-in-the-loop gates for high-impact actions.","antiPatternHeadline":"AI concatenates untrusted user content and web scraping outputs directly into agent prompts without structural isolation.","stars_count":2690,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["owasp","llm-security","prompt-injection","ai-guardrails","security"],"exportEndpoints":{"claude":"/api/rules/owasp-llm-top-10-guardrails?format=claude","cursorMdc":"/api/rules/owasp-llm-top-10-guardrails?format=mdc","cursorrules":"/api/rules/owasp-llm-top-10-guardrails?format=cursor","windsurf":"/api/rules/owasp-llm-top-10-guardrails?format=windsurf","agents":"/api/rules/owasp-llm-top-10-guardrails?format=agents"}},{"id":"casbin-abac-rbac-authorization-engine","title":"Casbin & OPA Attribute-Based Access Control (ABAC) & RBAC Engine","category":"security","severity":"critical","description":"Enterprise authorization standard for fine-grained multi-tenant access control. Replaces scattered procedural if (user.role === 'admin') statements with declarative PERM policy models (Casbin / Open Policy Agent), preventing Broken Object Level Authorization (BOLA/IDOR) vulnerabilities.","antiPatternHeadline":"AI writes ad-hoc imperative authorization checks inside controllers, omitting tenant isolation checks on nested sub-resource routes.","stars_count":1490,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["casbin","opa","rbac","abac","authorization","security","tenant-isolation"],"exportEndpoints":{"claude":"/api/rules/casbin-abac-rbac-authorization-engine?format=claude","cursorMdc":"/api/rules/casbin-abac-rbac-authorization-engine?format=mdc","cursorrules":"/api/rules/casbin-abac-rbac-authorization-engine?format=cursor","windsurf":"/api/rules/casbin-abac-rbac-authorization-engine?format=windsurf","agents":"/api/rules/casbin-abac-rbac-authorization-engine?format=agents"}},{"id":"ietf-idempotency-key-rfc-standard","title":"IETF Idempotency-Key HTTP Standard (RFC 9457 / Draft) & Financial Safety","category":"security","severity":"critical","description":"Production standard for idempotent mutation APIs (payments, transfers, orders). Enforces the IETF Idempotency-Key HTTP header specification, distributed atomic reservation locks in Redis (SETNX + TTL), in-flight collision 409 Conflict rejection, and exact cached response replay.","antiPatternHeadline":"AI processes payment and order mutations without idempotency keys, causing duplicate charges when network timeouts trigger client retries.","stars_count":1920,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["idempotency","fintech","api-design","rfc-standards","redis","concurrency"],"exportEndpoints":{"claude":"/api/rules/ietf-idempotency-key-rfc-standard?format=claude","cursorMdc":"/api/rules/ietf-idempotency-key-rfc-standard?format=mdc","cursorrules":"/api/rules/ietf-idempotency-key-rfc-standard?format=cursor","windsurf":"/api/rules/ietf-idempotency-key-rfc-standard?format=windsurf","agents":"/api/rules/ietf-idempotency-key-rfc-standard?format=agents"}},{"id":"cloudflare-turnstile-bot-defense","title":"Cloudflare Turnstile & Automated Bot Defense Server-Side Verification","category":"security","severity":"critical","description":"Production privacy-first bot mitigation standard using Cloudflare Turnstile. Mandates strict server-side cryptographic token validation with the siteverify endpoint, idempotency replay prevention, remote IP checking, and zero client-side bypass vulnerabilities.","antiPatternHeadline":"AI verifies Cloudflare Turnstile purely on the client frontend without server-side siteverify validation, allowing malicious bots to bypass defense by invoking the API directly.","stars_count":1370,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["turnstile","cloudflare","bot-defense","anti-scraping","security","nextjs"],"exportEndpoints":{"claude":"/api/rules/cloudflare-turnstile-bot-defense?format=claude","cursorMdc":"/api/rules/cloudflare-turnstile-bot-defense?format=mdc","cursorrules":"/api/rules/cloudflare-turnstile-bot-defense?format=cursor","windsurf":"/api/rules/cloudflare-turnstile-bot-defense?format=windsurf","agents":"/api/rules/cloudflare-turnstile-bot-defense?format=agents"}},{"id":"confidential-computing-enclave-attestation","title":"Confidential Computing, TPM 2.0 & AWS Nitro Enclaves Attestation","category":"security","severity":"critical","description":"Production standard for confidential computing and hardware-rooted trust. Mandates cryptographic remote attestation using AWS Nitro Enclaves NSM (Nitro Security Module) or TPM 2.0 PCR registers, ephemeral KMS decryption, and zero host-level memory access to master signing keys.","antiPatternHeadline":"AI places private signing keys or sensitive decryption secrets in standard container environment variables where root or host memory dumps can extract them.","stars_count":1510,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["confidential-computing","nitro-enclaves","tpm","cryptography","zero-trust","aws","security"],"exportEndpoints":{"claude":"/api/rules/confidential-computing-enclave-attestation?format=claude","cursorMdc":"/api/rules/confidential-computing-enclave-attestation?format=mdc","cursorrules":"/api/rules/confidential-computing-enclave-attestation?format=cursor","windsurf":"/api/rules/confidential-computing-enclave-attestation?format=windsurf","agents":"/api/rules/confidential-computing-enclave-attestation?format=agents"}},{"id":"timing-attack-constant-time-crypto","title":"Constant-Time Cryptographic Comparison & Side-Channel Timing Attack Defense","category":"security","severity":"critical","description":"Production cryptography standard (CWE-208: Observable Timing Discrepancy). Mandates using constant-time comparison algorithms (crypto.timingSafeEqual in Node.js, hmac.compare_digest in Python, subtle.ConstantTimeCompare in Go) when comparing API keys, webhook signatures, and password tokens, eliminating timing side-channel attacks.","antiPatternHeadline":"AI compares authentication tokens or HMAC signatures using string equality (a === b or a == b), leaking secret length and characters via microsecond timing differences.","stars_count":2180,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["cryptography","security","timing-attack","constant-time","hmac","tokens"],"exportEndpoints":{"claude":"/api/rules/timing-attack-constant-time-crypto?format=claude","cursorMdc":"/api/rules/timing-attack-constant-time-crypto?format=mdc","cursorrules":"/api/rules/timing-attack-constant-time-crypto?format=cursor","windsurf":"/api/rules/timing-attack-constant-time-crypto?format=windsurf","agents":"/api/rules/timing-attack-constant-time-crypto?format=agents"}},{"id":"ssrf-private-ip-dns-rebinding","title":"Server-Side Request Forgery (SSRF) & DNS Rebinding Mitigation Standard","category":"security","severity":"critical","description":"Production network security standard (CWE-918 / OWASP A10:2021). Mandates strict validation of user-supplied URLs before outbound HTTP requests, resolves DNS to target IP, rejects private/internal RFC 1918 ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.1, 169.254.169.254), and prevents DNS Rebinding attacks by pinning resolved IPs.","antiPatternHeadline":"AI fetches user-provided URLs with fetch(req.body.url) without IP resolution or private range filtering, allowing attackers to access internal cloud metadata and databases.","stars_count":2240,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["ssrf","security","dns-rebinding","cwe-918","owasp","network"],"exportEndpoints":{"claude":"/api/rules/ssrf-private-ip-dns-rebinding?format=claude","cursorMdc":"/api/rules/ssrf-private-ip-dns-rebinding?format=mdc","cursorrules":"/api/rules/ssrf-private-ip-dns-rebinding?format=cursor","windsurf":"/api/rules/ssrf-private-ip-dns-rebinding?format=windsurf","agents":"/api/rules/ssrf-private-ip-dns-rebinding?format=agents"}},{"id":"prototype-pollution-recursive-merge","title":"JavaScript Object Prototype Pollution Defense in Deep Merge Functions","category":"security","severity":"critical","description":"Production JavaScript/TypeScript security standard (CWE-1321). Mandates blocking __proto__, constructor, and prototype property keys in recursive deep merge and object clone functions, eliminating prototype pollution attacks that lead to Remote Code Execution (RCE) or authentication bypass.","antiPatternHeadline":"AI writes naive recursive object merge functions that traverse __proto__ keys, polluting the global Object.prototype across the entire Node.js runtime.","stars_count":1720,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["security","prototype-pollution","cwe-1321","typescript","javascript","owasp"],"exportEndpoints":{"claude":"/api/rules/prototype-pollution-recursive-merge?format=claude","cursorMdc":"/api/rules/prototype-pollution-recursive-merge?format=mdc","cursorrules":"/api/rules/prototype-pollution-recursive-merge?format=cursor","windsurf":"/api/rules/prototype-pollution-recursive-merge?format=windsurf","agents":"/api/rules/prototype-pollution-recursive-merge?format=agents"}},{"id":"xml-external-entity-xxe-prevention","title":"XML External Entity (XXE) Injection Prevention & Safe Parser Configuration","category":"security","severity":"critical","description":"Production security standard (CWE-611 / OWASP Top 10). Mandates completely disabling Document Type Definitions (DTD) and external entity resolution in XML parsers (fast-xml-parser, libxmljs, defusedxml), preventing local file disclosure (/etc/passwd) and server-side request forgery through XML payloads.","antiPatternHeadline":"AI parses incoming XML documents using default configurations with external entities enabled, allowing attackers to exfiltrate server files via XXE injections.","stars_count":1640,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["xxe","security","xml","cwe-611","owasp","python","typescript"],"exportEndpoints":{"claude":"/api/rules/xml-external-entity-xxe-prevention?format=claude","cursorMdc":"/api/rules/xml-external-entity-xxe-prevention?format=mdc","cursorrules":"/api/rules/xml-external-entity-xxe-prevention?format=cursor","windsurf":"/api/rules/xml-external-entity-xxe-prevention?format=windsurf","agents":"/api/rules/xml-external-entity-xxe-prevention?format=agents"}},{"id":"jwt-algorithm-none-attack-defense","title":"JWT alg: 'none' & Key Confusion Attack Defense Standard","category":"security","severity":"critical","description":"Cryptographic authentication standard for JSON Web Tokens (CVE-2015-9235). Mandates explicit algorithm whitelisting (algorithms: ['RS256']), strictly prohibits 'none' or 'HS256' when using public keys, and validates token expiration (exp), audience (aud), and issuer (iss) claims.","antiPatternHeadline":"AI verifies JWTs without specifying explicit algorithms, allowing attackers to forge arbitrary tokens by setting `alg: 'none'` or executing HMAC key confusion attacks.","stars_count":1980,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["jwt","authentication","security","cryptography","cve-2015-9235","oauth"],"exportEndpoints":{"claude":"/api/rules/jwt-algorithm-none-attack-defense?format=claude","cursorMdc":"/api/rules/jwt-algorithm-none-attack-defense?format=mdc","cursorrules":"/api/rules/jwt-algorithm-none-attack-defense?format=cursor","windsurf":"/api/rules/jwt-algorithm-none-attack-defense?format=windsurf","agents":"/api/rules/jwt-algorithm-none-attack-defense?format=agents"}},{"id":"sql-order-by-injection-whitelist","title":"Dynamic SQL ORDER BY & Column Identifier Injection Defense Standard","category":"security","severity":"critical","description":"Database security standard (CWE-89 / OWASP Top 10). Mandates strict whitelist mapping for dynamic ORDER BY columns and sort directions (ASC/DESC), eliminating SQL injection vulnerabilities in sorting clauses that cannot be parameterized via standard prepared statements.","antiPatternHeadline":"AI inlines user query parameters directly into SQL ORDER BY clauses (${req.query.sortBy}), enabling blind boolean-based SQL injection.","stars_count":1840,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["sql","sql-injection","cwe-89","security","database","orm"],"exportEndpoints":{"claude":"/api/rules/sql-order-by-injection-whitelist?format=claude","cursorMdc":"/api/rules/sql-order-by-injection-whitelist?format=mdc","cursorrules":"/api/rules/sql-order-by-injection-whitelist?format=cursor","windsurf":"/api/rules/sql-order-by-injection-whitelist?format=windsurf","agents":"/api/rules/sql-order-by-injection-whitelist?format=agents"}},{"id":"cors-wildcard-credentials-vulnerability","title":"CORS Dynamic Origin Whitelist & Credentials Misconfiguration Defense","category":"security","severity":"critical","description":"Web security standard for Cross-Origin Resource Sharing (CWE-942). Mandates validating Origin headers against an explicit domain whitelist, strictly forbids returning Access-Control-Allow-Origin: * when Access-Control-Allow-Credentials: true is set, and prevents origin reflection attacks that leak authenticated session cookies.","antiPatternHeadline":"AI writes origin: true or reflects the incoming Origin header back into Access-Control-Allow-Origin, completely defeating cross-origin browser isolation.","stars_count":1890,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["cors","security","cwe-942","cookies","headers","api"],"exportEndpoints":{"claude":"/api/rules/cors-wildcard-credentials-vulnerability?format=claude","cursorMdc":"/api/rules/cors-wildcard-credentials-vulnerability?format=mdc","cursorrules":"/api/rules/cors-wildcard-credentials-vulnerability?format=cursor","windsurf":"/api/rules/cors-wildcard-credentials-vulnerability?format=windsurf","agents":"/api/rules/cors-wildcard-credentials-vulnerability?format=agents"}},{"id":"owasp-llm-data-leakage-pii","title":"LLM PII Anonymization & Sensitive Training Data Leakage Guardrails","category":"security","severity":"critical","description":"Security standard for Enterprise LLM architectures (OWASP Top 10 for LLMs: LLM06 Sensitive Information Disclosure). Mandates pre-prompt PII masking (Social Security Numbers, credit cards, API keys) via Microsoft Presidio or regular expressions, and post-generation output guardrails to prevent private data leakage.","antiPatternHeadline":"AI feeds raw customer database logs and un-redacted PII directly into external third-party LLM APIs, violating GDPR/HIPAA regulations.","stars_count":2100,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["owasp-llm","pii","security","privacy","gdpr","hipaa","ai-guardrails"],"exportEndpoints":{"claude":"/api/rules/owasp-llm-data-leakage-pii?format=claude","cursorMdc":"/api/rules/owasp-llm-data-leakage-pii?format=mdc","cursorrules":"/api/rules/owasp-llm-data-leakage-pii?format=cursor","windsurf":"/api/rules/owasp-llm-data-leakage-pii?format=windsurf","agents":"/api/rules/owasp-llm-data-leakage-pii?format=agents"}},{"id":"docker-security-hardening","title":"Docker Multi-Stage & Non-Root Hardening Standard","category":"devops","severity":"critical","description":"Production Dockerfile hardening: multi-stage builds, non-root user execution, minimal base images (distroless/alpine), and HEALTHCHECK directives.","antiPatternHeadline":"AI runs containers as root (USER 0), bundles devDependencies into final production images, or omits HEALTHCHECK.","stars_count":2510,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["docker","containers","security","devops","kubernetes"],"exportEndpoints":{"claude":"/api/rules/docker-security-hardening?format=claude","cursorMdc":"/api/rules/docker-security-hardening?format=mdc","cursorrules":"/api/rules/docker-security-hardening?format=cursor","windsurf":"/api/rules/docker-security-hardening?format=windsurf","agents":"/api/rules/docker-security-hardening?format=agents"}},{"id":"kubernetes-manifests-production","title":"Kubernetes Production Manifest & Resource Governance","category":"devops","severity":"critical","description":"Guardrails for Kubernetes manifests: mandatory resource requests/limits (CPU/memory), liveness/readiness probes, PodDisruptionBudget, and securityContext constraints.","antiPatternHeadline":"AI leaves cpu/memory requests and limits undefined, allowing a single leaking pod to crash the entire node.","stars_count":2280,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["kubernetes","k8s","devops","cloud","reliability"],"exportEndpoints":{"claude":"/api/rules/kubernetes-manifests-production?format=claude","cursorMdc":"/api/rules/kubernetes-manifests-production?format=mdc","cursorrules":"/api/rules/kubernetes-manifests-production?format=cursor","windsurf":"/api/rules/kubernetes-manifests-production?format=windsurf","agents":"/api/rules/kubernetes-manifests-production?format=agents"}},{"id":"terraform-infrastructure-as-code","title":"Terraform Modern HCL & State Locking Standard","category":"devops","severity":"critical","description":"Guardrails for Terraform & OpenTofu: remote state with DynamoDB/S3 locking, pinned provider versions, modular architecture, and prevention of hardcoded secrets.","antiPatternHeadline":"AI uses local terraform.tfstate or hardcodes sensitive passwords directly in plain .tf files.","stars_count":1930,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["terraform","opentofu","iac","cloud","aws"],"exportEndpoints":{"claude":"/api/rules/terraform-infrastructure-as-code?format=claude","cursorMdc":"/api/rules/terraform-infrastructure-as-code?format=mdc","cursorrules":"/api/rules/terraform-infrastructure-as-code?format=cursor","windsurf":"/api/rules/terraform-infrastructure-as-code?format=windsurf","agents":"/api/rules/terraform-infrastructure-as-code?format=agents"}},{"id":"github-actions-security","title":"GitHub Actions CI/CD Security & OIDC Standard","category":"devops","severity":"critical","description":"Guardrails for GitHub Actions: pin third-party actions to full commit SHAs, set permissions: read-all by default, use OIDC for cloud authentication instead of long-lived AWS keys.","antiPatternHeadline":"AI uses mutable action tags (@v1, @main) vulnerable to supply-chain tampering, or grants write-all token permissions.","stars_count":2340,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["github-actions","ci-cd","security","supply-chain","oidc"],"exportEndpoints":{"claude":"/api/rules/github-actions-security?format=claude","cursorMdc":"/api/rules/github-actions-security?format=mdc","cursorrules":"/api/rules/github-actions-security?format=cursor","windsurf":"/api/rules/github-actions-security?format=windsurf","agents":"/api/rules/github-actions-security?format=agents"}},{"id":"cloudflare-workers-edge","title":"Cloudflare Workers & Hono Edge Runtime Standard","category":"devops","severity":"high","description":"Conventions for Cloudflare Workers and Hono: sub-millisecond cold starts, streaming responses with ReadableStream, safe D1/KV binding usage, and global edge cache headers.","antiPatternHeadline":"AI attempts to use Node.js native fs or child_process modules inside Cloudflare Workers edge runtime.","stars_count":2050,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["cloudflare","workers","hono","edge-computing","serverless"],"exportEndpoints":{"claude":"/api/rules/cloudflare-workers-edge?format=claude","cursorMdc":"/api/rules/cloudflare-workers-edge?format=mdc","cursorrules":"/api/rules/cloudflare-workers-edge?format=cursor","windsurf":"/api/rules/cloudflare-workers-edge?format=windsurf","agents":"/api/rules/cloudflare-workers-edge?format=agents"}},{"id":"nginx-reverse-proxy-hardening","title":"Nginx Reverse Proxy Hardening & TLS 1.3 Standard","category":"devops","severity":"high","description":"Guardrails for Nginx configuration: TLS 1.3 cipher suites, HTTP Strict Transport Security (HSTS), rate limiting zones, and prevention of hop-by-hop header leakage.","antiPatternHeadline":"AI forgets proxy_set_header Host $host or leaves server_tokens on, exposing the exact Nginx version.","stars_count":1870,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["nginx","proxy","tls","security","sysadmin"],"exportEndpoints":{"claude":"/api/rules/nginx-reverse-proxy-hardening?format=claude","cursorMdc":"/api/rules/nginx-reverse-proxy-hardening?format=mdc","cursorrules":"/api/rules/nginx-reverse-proxy-hardening?format=cursor","windsurf":"/api/rules/nginx-reverse-proxy-hardening?format=windsurf","agents":"/api/rules/nginx-reverse-proxy-hardening?format=agents"}},{"id":"prometheus-grafana-metrics","title":"Prometheus & OpenTelemetry RED Observability Standard","category":"devops","severity":"critical","description":"Guardrails for observability: implement RED metrics (Rate, Errors, Duration), prevent high-cardinality metric label explosions (never put user IDs or UUIDs in labels), and propagate W3C trace context.","antiPatternHeadline":"AI attaches dynamic user IDs or query parameters as Prometheus metric labels, causing out-of-memory crashes on Prometheus servers.","stars_count":2110,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["prometheus","grafana","opentelemetry","metrics","observability"],"exportEndpoints":{"claude":"/api/rules/prometheus-grafana-metrics?format=claude","cursorMdc":"/api/rules/prometheus-grafana-metrics?format=mdc","cursorrules":"/api/rules/prometheus-grafana-metrics?format=cursor","windsurf":"/api/rules/prometheus-grafana-metrics?format=windsurf","agents":"/api/rules/prometheus-grafana-metrics?format=agents"}},{"id":"opentelemetry-distributed-tracing","title":"OpenTelemetry (OTel) Distributed Tracing & W3C Context Propagation Standard","category":"devops","severity":"critical","description":"Enterprise observability standard for distributed microservices. Mandates W3C traceparent context propagation across HTTP/gRPC boundaries, structured semantic attributes, and error recording with OpenTelemetry SDK.","antiPatternHeadline":"AI creates isolated disconnected spans without propagating parent trace context across network requests.","stars_count":2260,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["opentelemetry","tracing","observability","microservices","distributed-systems"],"exportEndpoints":{"claude":"/api/rules/opentelemetry-distributed-tracing?format=claude","cursorMdc":"/api/rules/opentelemetry-distributed-tracing?format=mdc","cursorrules":"/api/rules/opentelemetry-distributed-tracing?format=cursor","windsurf":"/api/rules/opentelemetry-distributed-tracing?format=windsurf","agents":"/api/rules/opentelemetry-distributed-tracing?format=agents"}},{"id":"helm-charts-best-practices","title":"Helm Charts Production Hardening & Schema Validation Standard","category":"devops","severity":"high","description":"Production-grade Kubernetes packaging with Helm 3. Enforces values.schema.json validation, non-root security contexts, pod anti-affinity, readiness/liveness probes, and PodDisruptionBudgets.","antiPatternHeadline":"AI outputs unvalidated Helm templates with hardcoded credentials, missing resource limits, and no health probes.","stars_count":1780,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["helm","kubernetes","cloud-native","devops","manifests"],"exportEndpoints":{"claude":"/api/rules/helm-charts-best-practices?format=claude","cursorMdc":"/api/rules/helm-charts-best-practices?format=mdc","cursorrules":"/api/rules/helm-charts-best-practices?format=cursor","windsurf":"/api/rules/helm-charts-best-practices?format=windsurf","agents":"/api/rules/helm-charts-best-practices?format=agents"}},{"id":"argocd-gitops-declarative","title":"ArgoCD GitOps Declarative Application & Self-Healing Standard","category":"devops","severity":"critical","description":"Declarative GitOps continuous delivery with ArgoCD. Forbids manual imperative kubectl commands; mandates versioned Application CRDs, automated sync policies with selfHeal and prune enabled, and sync wave ordering.","antiPatternHeadline":"AI recommends manual kubectl edit/patch commands creating uncontrolled cluster drift away from Git.","stars_count":2120,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["argocd","gitops","kubernetes","declarative-cd","automation"],"exportEndpoints":{"claude":"/api/rules/argocd-gitops-declarative?format=claude","cursorMdc":"/api/rules/argocd-gitops-declarative?format=mdc","cursorrules":"/api/rules/argocd-gitops-declarative?format=cursor","windsurf":"/api/rules/argocd-gitops-declarative?format=windsurf","agents":"/api/rules/argocd-gitops-declarative?format=agents"}},{"id":"caddy-edge-webserver","title":"Caddy 2 Modern Edge Webserver & Automatic TLS Standard","category":"devops","severity":"medium","description":"Modern edge reverse proxy and TLS termination with Caddy 2. Leverages automatic ACME certificates, zero-downtime reloads, memory-safe Go architecture, and concise Caddyfile directives with HTTP/3 support.","antiPatternHeadline":"AI writes bloated Apache configs or fragile manual certbot cron scripts that fail during certificate renewal.","stars_count":1530,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["caddy","reverse-proxy","https","tls-automation","edge-server"],"exportEndpoints":{"claude":"/api/rules/caddy-edge-webserver?format=claude","cursorMdc":"/api/rules/caddy-edge-webserver?format=mdc","cursorrules":"/api/rules/caddy-edge-webserver?format=cursor","windsurf":"/api/rules/caddy-edge-webserver?format=windsurf","agents":"/api/rules/caddy-edge-webserver?format=agents"}},{"id":"aws-cdk-v2-constructs","title":"AWS CDK v2 Modern L2 Constructs & Least-Privilege IAM Discipline","category":"devops","severity":"critical","description":"Enterprise cloud infrastructure standard using AWS CDK v2. Mandates higher-level L2/L3 constructs over raw Cfn escape hatches, fine-grained resource-level IAM grants, and strict multi-stack state isolation.","antiPatternHeadline":"AI drops to low-level Cfn* primitives with wildcards in IAM policies (Action: '*', Resource: '*').","stars_count":2190,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["aws-cdk","typescript","cloud-infrastructure","iam","aws"],"exportEndpoints":{"claude":"/api/rules/aws-cdk-v2-constructs?format=claude","cursorMdc":"/api/rules/aws-cdk-v2-constructs?format=mdc","cursorrules":"/api/rules/aws-cdk-v2-constructs?format=cursor","windsurf":"/api/rules/aws-cdk-v2-constructs?format=windsurf","agents":"/api/rules/aws-cdk-v2-constructs?format=agents"}},{"id":"keda-event-driven-autoscaling","title":"KEDA Kubernetes Event-Driven Autoscaler & Queue Metric Governance","category":"devops","severity":"critical","description":"Production autoscaling standard for Kubernetes worker workloads using KEDA. Replaces generic CPU/memory HPA with event-driven triggers (Kafka lag, SQS queue depth, Redis list length) and enforces scale-to-zero governance.","antiPatternHeadline":"AI configures standard CPU HPA for async queue workers, failing to scale out during massive message backlogs.","stars_count":1850,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["keda","kubernetes","autoscaling","kafka","sqs"],"exportEndpoints":{"claude":"/api/rules/keda-event-driven-autoscaling?format=claude","cursorMdc":"/api/rules/keda-event-driven-autoscaling?format=mdc","cursorrules":"/api/rules/keda-event-driven-autoscaling?format=cursor","windsurf":"/api/rules/keda-event-driven-autoscaling?format=windsurf","agents":"/api/rules/keda-event-driven-autoscaling?format=agents"}},{"id":"tailscale-wireguard-mesh-networking","title":"Tailscale & WireGuard Zero-Trust Mesh Networking Architecture","category":"devops","severity":"critical","description":"Production zero-trust networking standard using Tailscale and WireGuard. Replaces public IP exposure and legacy VPN concentrators with peer-to-peer encrypted mesh tunnels, tag-based ACL governance, and MagicDNS routing.","antiPatternHeadline":"AI binds internal PostgreSQL and Redis ports to 0.0.0.0/0 on cloud VMs, exposing data to the public internet.","stars_count":2240,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["tailscale","wireguard","zero-trust","networking","security"],"exportEndpoints":{"claude":"/api/rules/tailscale-wireguard-mesh-networking?format=claude","cursorMdc":"/api/rules/tailscale-wireguard-mesh-networking?format=mdc","cursorrules":"/api/rules/tailscale-wireguard-mesh-networking?format=cursor","windsurf":"/api/rules/tailscale-wireguard-mesh-networking?format=windsurf","agents":"/api/rules/tailscale-wireguard-mesh-networking?format=agents"}},{"id":"ansible-idempotent-playbooks","title":"Ansible Idempotent Automation & Vault Credential Hardening","category":"devops","severity":"high","description":"Production configuration management standard for Ansible. Mandates strict task idempotency, native declarative modules over raw shell commands, Ansible Vault credential encryption, and yamllint schema hygiene.","antiPatternHeadline":"AI writes imperative ansible.builtin.shell scripts without creates or changed_when, causing dirty state mutations on every run.","stars_count":1680,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["ansible","automation","devops","idempotency","sysadmin"],"exportEndpoints":{"claude":"/api/rules/ansible-idempotent-playbooks?format=claude","cursorMdc":"/api/rules/ansible-idempotent-playbooks?format=mdc","cursorrules":"/api/rules/ansible-idempotent-playbooks?format=cursor","windsurf":"/api/rules/ansible-idempotent-playbooks?format=windsurf","agents":"/api/rules/ansible-idempotent-playbooks?format=agents"}},{"id":"opentofu-terraform-drift-state-locking","title":"OpenTofu & Terraform State Locking, S3/DynamoDB Backend & Drift Defense","category":"devops","severity":"critical","description":"Production Infrastructure as Code (IaC) governance standard for OpenTofu and Terraform. Mandates remote encrypted S3 state backends with DynamoDB state locking, strict module semantic version pinning, pre-apply plan verification, and zero manual console drift.","antiPatternHeadline":"AI writes Terraform templates with local state files or unversioned modules without state locking, leading to concurrent state corruption in CI/CD runs.","stars_count":1390,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["opentofu","terraform","iac","state-management","aws","s3","dynamodb"],"exportEndpoints":{"claude":"/api/rules/opentofu-terraform-drift-state-locking?format=claude","cursorMdc":"/api/rules/opentofu-terraform-drift-state-locking?format=mdc","cursorrules":"/api/rules/opentofu-terraform-drift-state-locking?format=cursor","windsurf":"/api/rules/opentofu-terraform-drift-state-locking?format=windsurf","agents":"/api/rules/opentofu-terraform-drift-state-locking?format=agents"}},{"id":"cilium-ebpf-network-security-policy","title":"Cilium eBPF L7 Network Security & Transparent Egress Governance","category":"devops","severity":"critical","description":"Cloud-native Kubernetes network governance standard for Cilium eBPF. Enforces granular CiliumNetworkPolicy for L7 HTTP/DNS egress filtering, replaces bloated iptables sidecars with kernel-level eBPF acceleration, and mandates default-deny pod network isolation.","antiPatternHeadline":"AI provisions Kubernetes pods with open egress (0.0.0.0/0), allowing compromised pods to query external malicious command-and-control servers or exfiltrate cloud metadata.","stars_count":1580,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["cilium","ebpf","kubernetes","network-policy","security","zero-trust"],"exportEndpoints":{"claude":"/api/rules/cilium-ebpf-network-security-policy?format=claude","cursorMdc":"/api/rules/cilium-ebpf-network-security-policy?format=mdc","cursorrules":"/api/rules/cilium-ebpf-network-security-policy?format=cursor","windsurf":"/api/rules/cilium-ebpf-network-security-policy?format=windsurf","agents":"/api/rules/cilium-ebpf-network-security-policy?format=agents"}},{"id":"vector-fluentbit-high-throughput-logging","title":"Vector & FluentBit High-Throughput Log Aggregation & Backpressure","category":"devops","severity":"high","description":"Production observability architecture for log pipelines using Datadog Vector and Fluent Bit. Mandates on-disk backpressure buffer queues, edge log redaction with Vector Remap Language (VRL), JSON structured parsing, and circuit breaking to prevent log-sink brownouts.","antiPatternHeadline":"AI configures in-memory log shippers without disk buffers, causing massive OOM node crashes when downstream Elasticsearch or ClickHouse sinks experience transient latency.","stars_count":1220,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["vector","fluentbit","logging","observability","backpressure","datadog","kubernetes"],"exportEndpoints":{"claude":"/api/rules/vector-fluentbit-high-throughput-logging?format=claude","cursorMdc":"/api/rules/vector-fluentbit-high-throughput-logging?format=mdc","cursorrules":"/api/rules/vector-fluentbit-high-throughput-logging?format=cursor","windsurf":"/api/rules/vector-fluentbit-high-throughput-logging?format=windsurf","agents":"/api/rules/vector-fluentbit-high-throughput-logging?format=agents"}},{"id":"sops-age-gitops-secret-encryption","title":"SOPS & Age Declarative Secret Encryption for GitOps Pipelines","category":"devops","severity":"critical","description":"Production secret management standard for GitOps and Kubernetes repositories. Mandates Mozilla SOPS with modern Age key cryptography to encrypt sensitive YAML values while preserving unencrypted keys for transparent git diffs, strictly prohibiting raw base64 Secret commits.","antiPatternHeadline":"AI commits base64-encoded Kubernetes Secret manifests to git repositories, assuming base64 is encryption and leaking production credentials.","stars_count":1640,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["sops","age","gitops","secret-management","kubernetes","cryptography","security"],"exportEndpoints":{"claude":"/api/rules/sops-age-gitops-secret-encryption?format=claude","cursorMdc":"/api/rules/sops-age-gitops-secret-encryption?format=mdc","cursorrules":"/api/rules/sops-age-gitops-secret-encryption?format=cursor","windsurf":"/api/rules/sops-age-gitops-secret-encryption?format=windsurf","agents":"/api/rules/sops-age-gitops-secret-encryption?format=agents"}},{"id":"k8s-pod-disruption-budget-pdb","title":"Kubernetes PodDisruptionBudget (PDB) & Zero-Downtime Node Draining Standard","category":"devops","severity":"critical","description":"Production Kubernetes reliability standard. Mandates configuring PodDisruptionBudget (PDB) with minAvailable or maxUnavailable for all replicated deployments, preventing involuntary cluster maintenance (node drains, cluster upgrades, spot terminations) from taking down services completely.","antiPatternHeadline":"AI creates Kubernetes Deployments without PodDisruptionBudgets, allowing kubectl drain or node autoscaling to terminate all replicas simultaneously.","stars_count":1690,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["kubernetes","k8s","pdb","high-availability","devops","cloud-native"],"exportEndpoints":{"claude":"/api/rules/k8s-pod-disruption-budget-pdb?format=claude","cursorMdc":"/api/rules/k8s-pod-disruption-budget-pdb?format=mdc","cursorrules":"/api/rules/k8s-pod-disruption-budget-pdb?format=cursor","windsurf":"/api/rules/k8s-pod-disruption-budget-pdb?format=windsurf","agents":"/api/rules/k8s-pod-disruption-budget-pdb?format=agents"}},{"id":"docker-compose-v2-healthcheck-depends","title":"Docker Compose v2 service_healthy Dependency Orchestration Standard","category":"devops","severity":"high","description":"Production standard for multi-container orchestration in Docker Compose v2. Mandates using depends_on with condition: service_healthy instead of naive string list dependencies, preventing application containers from crashing upon startup while waiting for PostgreSQL or Redis readiness.","antiPatternHeadline":"AI writes depends_on: ['db'] without healthchecks, causing backend containers to crash immediately because the database container has started but cannot yet accept connections.","stars_count":1420,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["docker","docker-compose","devops","healthcheck","orchestration"],"exportEndpoints":{"claude":"/api/rules/docker-compose-v2-healthcheck-depends?format=claude","cursorMdc":"/api/rules/docker-compose-v2-healthcheck-depends?format=mdc","cursorrules":"/api/rules/docker-compose-v2-healthcheck-depends?format=cursor","windsurf":"/api/rules/docker-compose-v2-healthcheck-depends?format=windsurf","agents":"/api/rules/docker-compose-v2-healthcheck-depends?format=agents"}},{"id":"nginx-http2-http3-brotli-tls","title":"Nginx HTTP/2, HTTP/3 QUIC & Brotli Dynamic Compression Hardening","category":"devops","severity":"high","description":"Production web server performance and security standard for Nginx. Mandates modern HTTP/2 / HTTP/3 (QUIC) configuration with Brotli compression, strict TLS 1.3 ciphers, and prevents Gzip CRIME/BREACH vulnerability leakage over encrypted HTTPS streams.","antiPatternHeadline":"AI configures obsolete HTTP/1.1 Nginx configs or enables gzip compression on encrypted endpoints without BREACH defense.","stars_count":1510,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["nginx","http2","http3","brotli","tls","security","devops"],"exportEndpoints":{"claude":"/api/rules/nginx-http2-http3-brotli-tls?format=claude","cursorMdc":"/api/rules/nginx-http2-http3-brotli-tls?format=mdc","cursorrules":"/api/rules/nginx-http2-http3-brotli-tls?format=cursor","windsurf":"/api/rules/nginx-http2-http3-brotli-tls?format=windsurf","agents":"/api/rules/nginx-http2-http3-brotli-tls?format=agents"}},{"id":"github-actions-composite-action-cache","title":"GitHub Actions Composite Actions & Immutable SHA Action Pinning Standard","category":"devops","severity":"critical","description":"CI/CD security and modularity standard for GitHub Actions. Mandates pinning third-party actions to immutable full 40-character commit SHAs with comment tags (e.g. actions/checkout@v4 -> actions/checkout@11bd71... # v4.2.2), preventing supply-chain tag mutation attacks, and utilizing composite actions for DRY pipeline reuse.","antiPatternHeadline":"AI references unpinned major tags (@v1, @main) for third-party GitHub Actions, leaving pipelines vulnerable to supply chain tag hijacking.","stars_count":1780,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["github-actions","ci-cd","security","supply-chain","devops"],"exportEndpoints":{"claude":"/api/rules/github-actions-composite-action-cache?format=claude","cursorMdc":"/api/rules/github-actions-composite-action-cache?format=mdc","cursorrules":"/api/rules/github-actions-composite-action-cache?format=cursor","windsurf":"/api/rules/github-actions-composite-action-cache?format=windsurf","agents":"/api/rules/github-actions-composite-action-cache?format=agents"}},{"id":"terraform-dynamic-blocks-splat","title":"Terraform HCL for_each vs count Resource Replacement Discipline","category":"devops","severity":"high","description":"Production Infrastructure as Code standard for Terraform and OpenTofu. Mandates using for_each with stable map keys instead of count for managing collections of cloud resources, preventing accidental cascading destructions when array elements are removed.","antiPatternHeadline":"AI uses count = length(var.subnets) to provision cloud resources, causing Terraform to destroy and recreate all subsequent resources whenever an index changes.","stars_count":1590,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["terraform","opentofu","iac","devops","cloud","aws"],"exportEndpoints":{"claude":"/api/rules/terraform-dynamic-blocks-splat?format=claude","cursorMdc":"/api/rules/terraform-dynamic-blocks-splat?format=mdc","cursorrules":"/api/rules/terraform-dynamic-blocks-splat?format=cursor","windsurf":"/api/rules/terraform-dynamic-blocks-splat?format=windsurf","agents":"/api/rules/terraform-dynamic-blocks-splat?format=agents"}},{"id":"prometheus-recording-rules-alerting","title":"Prometheus Multi-Window Multi-Burn-Rate Error Budget Alerting Standard","category":"devops","severity":"high","description":"Site Reliability Engineering (SRE) standard for Prometheus and OpenTelemetry. Mandates implementing Google SRE Multi-Window Multi-Burn-Rate alerting rules on Service Level Objectives (SLOs), eliminating alert fatigue caused by single-spike threshold alerts and capturing both fast and slow burn budget exhaustions.","antiPatternHeadline":"AI creates naive CPU > 80% or error_rate > 1% alerts, causing dozens of false-alarm pages every day and masking gradual catastrophic service degradations.","stars_count":1640,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["prometheus","sre","alerting","slo","sli","observability","devops"],"exportEndpoints":{"claude":"/api/rules/prometheus-recording-rules-alerting?format=claude","cursorMdc":"/api/rules/prometheus-recording-rules-alerting?format=mdc","cursorrules":"/api/rules/prometheus-recording-rules-alerting?format=cursor","windsurf":"/api/rules/prometheus-recording-rules-alerting?format=windsurf","agents":"/api/rules/prometheus-recording-rules-alerting?format=agents"}},{"id":"caddy-automatic-https-on-demand","title":"Caddy 2 On-Demand TLS Rate Limiting & ask Endpoint Verification Standard","category":"devops","severity":"critical","description":"Production web server standard for multi-tenant SaaS platforms using Caddy 2. Mandates configuring on-demand TLS with an explicit HTTP ask endpoint, rate-limiting certificate requests, and strictly prohibiting open on-demand TLS without domain validation to prevent Let's Encrypt rate-limit DoS attacks.","antiPatternHeadline":"AI enables Caddy on_demand TLS without an `ask` verification endpoint, allowing malicious actors to point thousands of junk domains at the server and exhaust Let's Encrypt issuance quotas.","stars_count":1390,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["caddy","tls","saas","https","devops","security"],"exportEndpoints":{"claude":"/api/rules/caddy-automatic-https-on-demand?format=claude","cursorMdc":"/api/rules/caddy-automatic-https-on-demand?format=mdc","cursorrules":"/api/rules/caddy-automatic-https-on-demand?format=cursor","windsurf":"/api/rules/caddy-automatic-https-on-demand?format=windsurf","agents":"/api/rules/caddy-automatic-https-on-demand?format=agents"}},{"id":"kubernetes-ephemeral-storage-requests","title":"Kubernetes Container Ephemeral Storage Limits & Root Disk Eviction Safeguards","category":"devops","severity":"high","description":"Production Kubernetes infrastructure standard. Mandates declaring ephemeral-storage requests and limits on all container specifications, preventing runaway container log writes, un-rotated temp files, or image pulls from exhausting node root filesystems and triggering node-wide pod evictions.","antiPatternHeadline":"AI omits ephemeral-storage in container resources, allowing a single rogue container writing temporary files to exhaust the host node's root disk and crash the entire node.","stars_count":1490,"compatibility":{"cursor":true,"claudeCode":true,"windsurf":true,"codex":true,"cline":true},"tags":["kubernetes","k8s","storage","resources","devops","cloud-native"],"exportEndpoints":{"claude":"/api/rules/kubernetes-ephemeral-storage-requests?format=claude","cursorMdc":"/api/rules/kubernetes-ephemeral-storage-requests?format=mdc","cursorrules":"/api/rules/kubernetes-ephemeral-storage-requests?format=cursor","windsurf":"/api/rules/kubernetes-ephemeral-storage-requests?format=windsurf","agents":"/api/rules/kubernetes-ephemeral-storage-requests?format=agents"}}]}