{
  "version": "1.0.0",
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "ccgm/audit/severity-rubric.json",
  "title": "CCGM Audit Severity Rubric",
  "description": "Rule-level, deterministic severity/confidence table. Agents source severity from here; they do NOT invent it. Keyed by check_id (pattern: <pack>/<check>, matching finding.schema.json). Pack epics add entries under their own namespace; use the [RUBRIC-serial] gate to avoid concurrent edits.",
  "_format": {
    "severity": "critical|high|medium|low|info",
    "confidence": "high|medium|low \u2014 signal precision (how often this check fires correctly)",
    "fix_confidence": "high|medium|low \u2014 safety confidence for auto-fix when applicable"
  },
  "checks": {
    "secrets/leaked-credential": {
      "severity": "critical",
      "confidence": "high",
      "fix_confidence": "low"
    },
    "security/hardcoded-secret": {
      "severity": "critical",
      "confidence": "medium",
      "fix_confidence": "low"
    },
    "security/sensitive-console-log": {
      "severity": "high",
      "confidence": "medium",
      "fix_confidence": "high"
    },
    "security/sql-injection": {
      "severity": "critical",
      "confidence": "medium",
      "fix_confidence": "low"
    },
    "security/xss-vulnerability": {
      "severity": "high",
      "confidence": "medium",
      "fix_confidence": "low"
    },
    "security/missing-security-headers": {
      "severity": "high",
      "confidence": "high",
      "fix_confidence": "medium"
    },
    "security/edge-function-auth-bypass": {
      "severity": "critical",
      "confidence": "medium",
      "fix_confidence": "low"
    },
    "dependencies/npm-audit-vulnerability": {
      "severity": "high",
      "confidence": "high",
      "fix_confidence": "high"
    },
    "dependencies/outdated-minor": {
      "severity": "low",
      "confidence": "high",
      "fix_confidence": "high"
    },
    "dependencies/outdated-major": {
      "severity": "medium",
      "confidence": "high",
      "fix_confidence": "low"
    },
    "dependencies/unused-dependency": {
      "severity": "low",
      "confidence": "medium",
      "fix_confidence": "high"
    },
    "dependencies/duplicate-dependency": {
      "severity": "medium",
      "confidence": "high",
      "fix_confidence": "low"
    },
    "dependencies/postinstall-script": {
      "severity": "high",
      "confidence": "medium",
      "fix_confidence": "low"
    },
    "dependencies/typosquat": {
      "severity": "high",
      "confidence": "low",
      "fix_confidence": "low"
    },
    "dependencies/lockfile-integrity": {
      "severity": "high",
      "confidence": "medium",
      "fix_confidence": "low"
    },
    "dependencies/unpinned-version-range": {
      "severity": "medium",
      "confidence": "high",
      "fix_confidence": "low"
    },
    "code-quality/eslint-violation": {
      "severity": "medium",
      "confidence": "high",
      "fix_confidence": "high"
    },
    "code-quality/prettier-violation": {
      "severity": "low",
      "confidence": "high",
      "fix_confidence": "high"
    },
    "code-quality/unused-import": {
      "severity": "low",
      "confidence": "high",
      "fix_confidence": "high"
    },
    "code-quality/long-method": {
      "severity": "medium",
      "confidence": "high",
      "fix_confidence": "low"
    },
    "code-quality/large-file": {
      "severity": "medium",
      "confidence": "high",
      "fix_confidence": "low"
    },
    "code-quality/empty-catch-block": {
      "severity": "medium",
      "confidence": "high",
      "fix_confidence": "low"
    },
    "architecture/circular-dependency": {
      "severity": "high",
      "confidence": "high",
      "fix_confidence": "low"
    },
    "architecture/god-object": {
      "severity": "high",
      "confidence": "medium",
      "fix_confidence": "low"
    },
    "architecture/improper-layering": {
      "severity": "medium",
      "confidence": "medium",
      "fix_confidence": "low"
    },
    "architecture/wrong-layer-import": {
      "severity": "medium",
      "confidence": "medium",
      "fix_confidence": "medium"
    },
    "typescript/excessive-any": {
      "severity": "medium",
      "confidence": "high",
      "fix_confidence": "medium"
    },
    "typescript/missing-return-type": {
      "severity": "low",
      "confidence": "high",
      "fix_confidence": "medium"
    },
    "typescript/react-hooks-violation": {
      "severity": "high",
      "confidence": "high",
      "fix_confidence": "low"
    },
    "typescript/fast-refresh-violation": {
      "severity": "medium",
      "confidence": "high",
      "fix_confidence": "low"
    },
    "typescript/missing-key-prop": {
      "severity": "medium",
      "confidence": "high",
      "fix_confidence": "low"
    },
    "testing/missing-test-file": {
      "severity": "medium",
      "confidence": "high",
      "fix_confidence": "low"
    },
    "testing/no-assertions": {
      "severity": "high",
      "confidence": "high",
      "fix_confidence": "low"
    },
    "testing/missing-edge-cases": {
      "severity": "low",
      "confidence": "low",
      "fix_confidence": "low"
    },
    "testing/sleep-based-flake": {
      "severity": "medium",
      "confidence": "medium",
      "fix_confidence": "low"
    },
    "testing/only-or-skip-committed": {
      "severity": "high",
      "confidence": "high",
      "fix_confidence": "high"
    },
    "testing/mock-not-behavior": {
      "severity": "medium",
      "confidence": "low",
      "fix_confidence": "low"
    },
    "testing/test-only-prod-method": {
      "severity": "medium",
      "confidence": "medium",
      "fix_confidence": "low"
    },
    "documentation/missing-jsdoc": {
      "severity": "low",
      "confidence": "high",
      "fix_confidence": "low"
    },
    "documentation/stale-comment": {
      "severity": "low",
      "confidence": "low",
      "fix_confidence": "low"
    },
    "documentation/incomplete-readme": {
      "severity": "medium",
      "confidence": "medium",
      "fix_confidence": "low"
    },
    "performance/n-plus-one-query": {
      "severity": "high",
      "confidence": "medium",
      "fix_confidence": "low"
    },
    "performance/missing-react-memo": {
      "severity": "low",
      "confidence": "medium",
      "fix_confidence": "medium"
    },
    "performance/large-bundle-import": {
      "severity": "medium",
      "confidence": "medium",
      "fix_confidence": "low"
    },
    "tos-compliance/copyleft-in-proprietary": {
      "severity": "critical",
      "confidence": "high",
      "fix_confidence": "low"
    },
    "tos-compliance/non-commercial-in-commercial": {
      "severity": "critical",
      "confidence": "high",
      "fix_confidence": "low"
    },
    "tos-compliance/missing-attribution": {
      "severity": "high",
      "confidence": "medium",
      "fix_confidence": "low"
    },
    "tos-compliance/unlicensed-dependency": {
      "severity": "medium",
      "confidence": "high",
      "fix_confidence": "low"
    },
    "tos-compliance/scraping-prohibited-site": {
      "severity": "high",
      "confidence": "medium",
      "fix_confidence": "low"
    },
    "tos-compliance/credential-misuse": {
      "severity": "high",
      "confidence": "medium",
      "fix_confidence": "low"
    },
    "tos-compliance/remote-code-extension": {
      "severity": "critical",
      "confidence": "high",
      "fix_confidence": "low"
    },
    "tos-compliance/overbroad-extension-permissions": {
      "severity": "high",
      "confidence": "medium",
      "fix_confidence": "low"
    },
    "tos-compliance/ai-output-training-competitor": {
      "severity": "high",
      "confidence": "medium",
      "fix_confidence": "low"
    },
    "tos-compliance/undisclosed-telemetry": {
      "severity": "medium",
      "confidence": "medium",
      "fix_confidence": "low"
    },
    "tos-compliance/rate-limit-circumvention": {
      "severity": "high",
      "confidence": "medium",
      "fix_confidence": "low"
    },
    "tos-compliance/paywall-bypass": {
      "severity": "high",
      "confidence": "medium",
      "fix_confidence": "low"
    },
    "tos-compliance/trademark-misuse": {
      "severity": "medium",
      "confidence": "medium",
      "fix_confidence": "low"
    },
    "tos-compliance/store-policy-violation": {
      "severity": "high",
      "confidence": "medium",
      "fix_confidence": "low"
    },
    "tos-compliance/missing-privacy-policy": {
      "severity": "medium",
      "confidence": "high",
      "fix_confidence": "low"
    },
    "tos-compliance/ai-prohibited-use": {
      "severity": "high",
      "confidence": "medium",
      "fix_confidence": "low"
    },
    "tos-compliance/ai-output-misrepresentation": {
      "severity": "medium",
      "confidence": "medium",
      "fix_confidence": "low"
    },
    "tos-compliance/ai-data-retention-violation": {
      "severity": "high",
      "confidence": "medium",
      "fix_confidence": "low"
    },
    "tos-compliance/platform-tos-violation": {
      "severity": "medium",
      "confidence": "low",
      "fix_confidence": "low"
    },
    "tos-compliance/iap-bypass": {
      "severity": "critical",
      "confidence": "medium",
      "fix_confidence": "low"
    },
    "deps/vulnerable-dependency": {
      "severity": "high",
      "confidence": "high",
      "fix_confidence": "high"
    },
    "dead-code/unused-dependency": {
      "severity": "low",
      "confidence": "medium",
      "fix_confidence": "high"
    },
    "dead-code/unused-file": {
      "severity": "low",
      "confidence": "medium",
      "fix_confidence": "low"
    },
    "dead-code/unused-export": {
      "severity": "low",
      "confidence": "medium",
      "fix_confidence": "low"
    },
    "dead-code/unlisted-dependency": {
      "severity": "medium",
      "confidence": "medium",
      "fix_confidence": "low"
    },
    "a11y/img-missing-alt": {
      "severity": "medium",
      "confidence": "medium",
      "fix_confidence": "low"
    },
    "a11y/click-without-keyboard": {
      "severity": "medium",
      "confidence": "medium",
      "fix_confidence": "low"
    },
    "a11y/anchor-missing-rel": {
      "severity": "medium",
      "confidence": "high",
      "fix_confidence": "high"
    },
    "a11y/missing-prefers-reduced-motion": {
      "severity": "low",
      "confidence": "medium",
      "fix_confidence": "low"
    },
    "a11y/tailwind-cursor-pointer": {
      "severity": "low",
      "confidence": "medium",
      "fix_confidence": "high"
    },
    "reliability/floating-promise": {
      "severity": "high",
      "confidence": "medium",
      "fix_confidence": "low"
    },
    "reliability/misused-promise": {
      "severity": "high",
      "confidence": "medium",
      "fix_confidence": "low"
    },
    "reliability/unhandled-promise": {
      "severity": "high",
      "confidence": "medium",
      "fix_confidence": "low"
    },
    "reliability/await-in-loop": {
      "severity": "medium",
      "confidence": "medium",
      "fix_confidence": "low"
    },
    "reliability/fetch-without-timeout": {
      "severity": "medium",
      "confidence": "medium",
      "fix_confidence": "low"
    },
    "reliability/retry-without-backoff": {
      "severity": "low",
      "confidence": "medium",
      "fix_confidence": "low"
    },
    "reliability/promise-all-vs-allsettled": {
      "severity": "low",
      "confidence": "medium",
      "fix_confidence": "low"
    },
    "lint/eqeqeq": {
      "severity": "medium",
      "confidence": "high",
      "fix_confidence": "high"
    },
    "lint/use-isnan": {
      "severity": "high",
      "confidence": "high",
      "fix_confidence": "high"
    },
    "lint/valid-typeof": {
      "severity": "high",
      "confidence": "high",
      "fix_confidence": "high"
    },
    "lint/no-unreachable": {
      "severity": "high",
      "confidence": "high",
      "fix_confidence": "high"
    },
    "lint/no-constant-condition": {
      "severity": "medium",
      "confidence": "high",
      "fix_confidence": "medium"
    },
    "lint/no-fallthrough": {
      "severity": "medium",
      "confidence": "high",
      "fix_confidence": "high"
    },
    "lint/default-case": {
      "severity": "medium",
      "confidence": "high",
      "fix_confidence": "medium"
    },
    "correctness/off-by-one": {
      "severity": "high",
      "confidence": "low",
      "fix_confidence": "low"
    },
    "correctness/float-equality": {
      "severity": "medium",
      "confidence": "low",
      "fix_confidence": "medium"
    },
    "correctness/wrong-branch-logic": {
      "severity": "high",
      "confidence": "low",
      "fix_confidence": "low"
    },
    "secrets/tracked-env-file": {
      "severity": "high",
      "confidence": "high",
      "fix_confidence": "low"
    },
    "secrets/tracked-key-material": {
      "severity": "critical",
      "confidence": "high",
      "fix_confidence": "low"
    },
    "secrets/history-only-credential": {
      "severity": "high",
      "confidence": "high",
      "fix_confidence": "low"
    },
    "dm/unquoted-reserved-keyword": {
      "severity": "high",
      "confidence": "medium",
      "fix_confidence": "high"
    },
    "dm/index-without-concurrently": {
      "severity": "high",
      "confidence": "high",
      "fix_confidence": "high"
    },
    "dm/missing-rls": {
      "severity": "high",
      "confidence": "medium",
      "fix_confidence": "low"
    },
    "dm/on-conflict-without-unique": {
      "severity": "medium",
      "confidence": "medium",
      "fix_confidence": "low"
    },
    "dm/security-definer-function": {
      "severity": "medium",
      "confidence": "high",
      "fix_confidence": "low"
    },
    "dm/squawk-violation": {
      "severity": "medium",
      "confidence": "medium",
      "fix_confidence": "low"
    },
    "dm/sqlfluff-violation": {
      "severity": "low",
      "confidence": "medium",
      "fix_confidence": "low"
    },
    "cicd/unpinned-action": {
      "severity": "high",
      "confidence": "high",
      "fix_confidence": "high"
    },
    "cicd/dangerous-trigger": {
      "severity": "critical",
      "confidence": "high",
      "fix_confidence": "low"
    },
    "cicd/excessive-permissions": {
      "severity": "medium",
      "confidence": "high",
      "fix_confidence": "high"
    },
    "cicd/script-injection": {
      "severity": "high",
      "confidence": "high",
      "fix_confidence": "low"
    },
    "cicd/actionlint-error": {
      "severity": "medium",
      "confidence": "high",
      "fix_confidence": "low"
    },
    "cicd/workflow-security-issue": {
      "severity": "medium",
      "confidence": "medium",
      "fix_confidence": "low"
    },
    "api/missing-input-validation": {
      "severity": "high",
      "confidence": "medium",
      "fix_confidence": "low"
    },
    "api/mass-assignment": {
      "severity": "high",
      "confidence": "medium",
      "fix_confidence": "low"
    },
    "api/unbounded-list": {
      "severity": "medium",
      "confidence": "medium",
      "fix_confidence": "low"
    },
    "api/missing-versioning": {
      "severity": "low",
      "confidence": "medium",
      "fix_confidence": "low"
    },
    "privacy/pii-without-consent": {
      "severity": "high",
      "confidence": "medium",
      "fix_confidence": "low"
    },
    "privacy/pii-no-retention": {
      "severity": "medium",
      "confidence": "medium",
      "fix_confidence": "low"
    },
    "privacy/pii-in-url": {
      "severity": "high",
      "confidence": "medium",
      "fix_confidence": "low"
    },
    "observability/pii-in-logs": {
      "severity": "high",
      "confidence": "medium",
      "fix_confidence": "low"
    },
    "observability/missing-structured-logging": {
      "severity": "low",
      "confidence": "medium",
      "fix_confidence": "low"
    },
    "observability/missing-error-reporting": {
      "severity": "medium",
      "confidence": "medium",
      "fix_confidence": "low"
    },
    "ccgm/shipped-todo-marker": {
      "severity": "info",
      "confidence": "high",
      "fix_confidence": "low"
    },
    "ccgm/env-example-drift": {
      "severity": "medium",
      "confidence": "medium",
      "fix_confidence": "low"
    },
    "ccgm/cloudflare-pages-no-git": {
      "severity": "high",
      "confidence": "high",
      "fix_confidence": "low"
    },
    "ccgm/project-standards-conformance": {
      "severity": "medium",
      "confidence": "low",
      "fix_confidence": "low"
    },
    "ccgm/mcp-tool-annotations": {
      "severity": "low",
      "confidence": "medium",
      "fix_confidence": "low"
    },
    "iac/dockerfile-root-user": {
      "severity": "high",
      "confidence": "high",
      "fix_confidence": "medium"
    },
    "iac/dockerfile-latest-tag": {
      "severity": "medium",
      "confidence": "high",
      "fix_confidence": "high"
    },
    "iac/public-ingress": {
      "severity": "high",
      "confidence": "medium",
      "fix_confidence": "low"
    },
    "iac/missing-encryption": {
      "severity": "medium",
      "confidence": "medium",
      "fix_confidence": "medium"
    },
    "iac/hardcoded-secret-in-iac": {
      "severity": "high",
      "confidence": "medium",
      "fix_confidence": "low"
    },
    "iac/dockerfile-issue": {
      "severity": "medium",
      "confidence": "high",
      "fix_confidence": "medium"
    },
    "iac/checkov-violation": {
      "severity": "medium",
      "confidence": "medium",
      "fix_confidence": "low"
    }
  }
}