Enforce coverage thresholds (TST-040). In vitest.config.ts, set:

// vitest.config.ts
import { defineConfig } from 'vitest/config';

export default defineConfig({
  test: {
    coverage: {
      provider: 'v8',
      reporter: ['text', 'html', 'lcov'],
      thresholds: {
        branches: 80,
        functions: 80,
        lines: 80,
        statements: 80,
      },
    },
  },
});

Then pnpm test --coverage must pass in CI. Run it once locally and write the missing tests before turning on the enforcement.

E2E test for every critical journey (TST-050). Install Playwright and write an E2E test for each critical user journey: signup, sign-in, the top-one-or-two feature flows. Playwright's resilient selectors (getByRole, getByLabel, data-testid) are non-negotiable — CSS class selectors make tests brittle.

Flake detection or retry budget (TST-060). In CI, enable Playwright's built-in retry (retries: 2 on CI, 0 locally). In your report, quarantine any tests that retry-pass more than once in a 50-run window.

Strict-mode types (CQV-030). If you're using TypeScript, set:

// tsconfig.json
{
  "compilerOptions": {
    "strict": true,
    "noUncheckedIndexedAccess": true,
    "noImplicitOverride": true,
    "exactOptionalPropertyTypes": true
  }
}

Then run tsc --noEmit and fix every resulting error before turning on the gate.

Pre-commit enforcement (CQV-040). Install husky + lint-staged:

// package.json
{
  "scripts": {
    "prepare": "husky"
  },
  "lint-staged": {
    "*.{ts,tsx,js,mjs,cjs}": ["eslint --fix", "prettier --write"],
    "*.{json,md,css,yml,yaml}": ["prettier --write"]
  }
}

Then pnpm add -D husky lint-staged && pnpm exec husky init and echo 'pnpm exec lint-staged' > .husky/pre-commit.

No escape hatches (CQV-050). Grep for @ts-ignore, @ts-expect-error, as any, eslint-disable-next-line without justifying comments. Every remaining instance must carry a one-line reason and a tracking issue.

ADR folder (DOC-050). Create docs/adr/ with at minimum a template and one recorded decision. The MADR template is a reasonable default. Record architectural decisions as they happen, not after. ADRs give agents a record of why the codebase is the way it is — which prevents re-litigating settled questions.

Runbook (DOC-060). Create docs/runbook.md covering on-call procedures, common failure modes, dashboards, and rollback steps. This is an AI-assisted criterion — the assessor looks at whether the content actually covers operational concerns, not just that a file exists.

Changelog (DOC-080). Adopt Keep-a-Changelog format. Update it on every release. Minimum structure:

# Changelog

## [Unreleased]

### Added

### Changed

### Fixed

## [0.3.0] — 2026-04-22

### Added

- New `--format markdown` output for the report command.

Branch protection (SEC-010). On GitHub, require status checks to pass, require PR reviews, disable force-push on main. The assessor queries the repository's branch-protection API (if accessible) or looks for .github/settings.yml / CODEOWNERS / the repo-settings documentation file to confirm.

Secret scanning (SEC-020). Enable GitHub's native secret scanning, and add gitleaks as a CI step.

- name: gitleaks
  uses: gitleaks/gitleaks-action@v2
  env:
    GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

CODEOWNERS (SEC-030). Create CODEOWNERS at the repo root. Routing rules should point real reviewers at the areas they own:

# CODEOWNERS
*                       @av8r-ryan
packages/engine/**      @av8r-ryan @engine-maintainer
packages/docs/**        @av8r-ryan @docs-maintainer

Dependency scanning (SEC-040). Enable Dependabot (commit .github/dependabot.yml) and add pnpm audit to CI.

Devcontainer or equivalent (BLD-030). Ship a .devcontainer/ that boots a reproducible environment, or document an equivalent Nix / Docker Compose setup. Agents that can rebuild the dev environment on demand outperform agents that depend on a bespoke local setup.

Bootstrap script (BLD-040). Provide a single command that takes a fresh clone to a working dev environment. pnpm install && pnpm db:migrate counts if it actually works — test it.

CI feedback time (DLM-020). Measure and publish the median PR-to-CI completion time. Target ≤10 minutes for meaningful feedback. If your CI takes longer, invest in parallelism or caching before anything else.

Rollback mechanism (DLM-030). Document how to revert a production deployment in one step. If you use Vercel / Fly / Cloudflare Pages, this is a built-in feature — just document the procedure in your runbook.

Issue templates (TIR-010). Add .github/ISSUE_TEMPLATE/ with bug, feature, and (for specs or standards) change-request templates. Each template should require a minimum structure — reproducer for bugs, motivation and scope for features.

PR template (TIR-020). Add .github/PULL_REQUEST_TEMPLATE.md with a short checklist: summary, test plan, breaking-change flag, linked issue.