A quick-reference index of every CARL v1.0 criterion. IDs are linked to the full
catalog entry at
/spec/v1.0/criteria-catalog/, where each
criterion has its complete description, rationale, and expected evidence.
Use your browser's in-page find (⌘F / Ctrl-F) to search by ID, keyword, or
pillar.
Documentation & Knowledge (DOC-)
| ID | Name | Level | Scope | Check |
|---|---|---|---|---|
| DOC-010 | README present and substantive | L0 | repository | deterministic |
| DOC-020 | Project purpose stated in README | L1 | repository | ai-assisted |
| DOC-030 | AGENTS.md or CLAUDE.md present | L1 | repository | deterministic |
| DOC-040 | Environment variables documented | L1 | application | deterministic |
| DOC-050 | ADR folder present | L2 | repository | deterministic |
| DOC-060 | Runbook / operations documentation | L2 | application | ai-assisted |
| DOC-070 | API reference auto-generated or hand-maintained | L3 | application | deterministic |
| DOC-080 | Changelog in Keep-a-Changelog format | L2 | repository | deterministic |
Code Quality & Validation (CQV-)
| ID | Name | Level | Scope | Check |
|---|---|---|---|---|
| CQV-010 | Linter configured and runnable | L0 | application | deterministic |
| CQV-020 | Formatter configured with single source of truth | L1 | repository | deterministic |
| CQV-030 | Typed language in strict mode | L1 | application | deterministic |
| CQV-040 | Pre-commit hooks enforce formatter and linter | L1 | repository | deterministic |
| CQV-050 | No forbidden escape hatches | L2 | application | deterministic |
| CQV-060 | No raw console.log / print | L2 | application | deterministic |
| CQV-070 | Import ordering enforced | L2 | application | deterministic |
| CQV-080 | Code complexity gates | L3 | application | deterministic |
| CQV-090 | CI enforces a full quality gate | L4 | application | deterministic |
Testing (TST-)
| ID | Name | Level | Scope | Check |
|---|---|---|---|---|
| TST-010 | Test framework present | L0 | application | deterministic |
| TST-020 | Coverage measurement configured | L1 | application | deterministic |
| TST-030 | Coverage thresholds ≥ 80% enforced | L2 | application | deterministic |
| TST-040 | E2E tests for critical journeys | L2 | application | deterministic |
| TST-050 | Resilient selectors in UI tests | L2 | application | ai-assisted |
| TST-060 | Test isolation | L3 | application | ai-assisted |
| TST-070 | Flake detection and quarantine | L3 | application | deterministic |
| TST-080 | Property-based or fuzz testing | L4 | application | manual |
Build & Environment (BLD-)
| ID | Name | Level | Scope | Check |
|---|---|---|---|---|
| BLD-010 | Reproducible build | L0 | application | deterministic |
| BLD-020 | Node / runtime version pinned | L1 | repository | deterministic |
| BLD-030 | Lockfile committed | L0 | repository | deterministic |
| BLD-040 | .env.example documents every env var | L1 | application | deterministic |
| BLD-050 | Local-setup script or devcontainer | L2 | application | deterministic |
| BLD-060 | Hermetic CI | L3 | application | manual |
| BLD-070 | Docker image produced and published | L3 | application | deterministic |
| BLD-080 | Infrastructure provisioned as code | L5 | application | deterministic |
Observability (OBS-)
| ID | Name | Level | Scope | Check |
|---|---|---|---|---|
| OBS-010 | Structured logging | L1 | application | deterministic |
| OBS-020 | Error aggregation | L2 | application | deterministic |
| OBS-030 | Distributed tracing | L2 | application | deterministic |
| OBS-040 | Health endpoint | L1 | application | deterministic |
| OBS-050 | Metrics exported | L3 | application | deterministic |
| OBS-060 | SLOs and alerting | L4 | application | manual |
| OBS-070 | Product analytics / business KPIs instrumented | L6 | application | deterministic |
Security & Access Control (SEC-)
| ID | Name | Level | Scope | Check |
|---|---|---|---|---|
| SEC-010 | No committed secrets | L0 | repository | deterministic |
| SEC-020 | .env* gitignored | L0 | repository | deterministic |
| SEC-030 | Dependency audit gate | L1 | repository | deterministic |
| SEC-040 | CODEOWNERS present | L1 | repository | deterministic |
| SEC-050 | Branch protection on main | L2 | repository | manual |
| SEC-060 | DCO or equivalent gating | L2 | repository | deterministic |
| SEC-070 | Dependabot / Renovate configured | L2 | repository | deterministic |
| SEC-080 | Security headers set | L3 | application | deterministic |
| SEC-090 | SBOM generated on release | L4 | application | deterministic |
Task Intake & Routing (TIR-)
| ID | Name | Level | Scope | Check |
|---|---|---|---|---|
| TIR-010 | Issue templates present | L1 | repository | deterministic |
| TIR-020 | Pull request template | L1 | repository | deterministic |
| TIR-030 | Labels defined and documented | L2 | repository | deterministic |
| TIR-040 | Triage convention documented | L3 | organization | manual |
| TIR-050 | Structured task intake — issue / PR templates | L4 | repository | deterministic |
Delivery & Measurement (DLM-)
| ID | Name | Level | Scope | Check |
|---|---|---|---|---|
| DLM-010 | CI runs every gate on every PR | L1 | repository | deterministic |
| DLM-020 | Deployment pipeline documented | L2 | application | deterministic |
| DLM-030 | Deploy previews on PRs | L2 | application | deterministic |
| DLM-040 | CI feedback time instrumented | L3 | repository | manual |
| DLM-050 | DORA metrics captured | L3 | organization | manual |
| DLM-060 | Product analytics stubbed | L2 | application | deterministic |
| DLM-070 | Self-improving gates | L4 | organization | manual |
| DLM-080 | Billing or payments integrated | L5 | application | deterministic |
| DLM-090 | Operations runbooks present | L6 | repository | deterministic |
Related
- Full catalog — complete definitions, rationale, and expected evidence for every criterion.
- The 8 pillars — what each pillar aggregates.
- Report schema — how criteria results are structured in a conformance report.