Law 8 rules
Binding legislation. Not ours to waive, and not the client's either.
EUR-Lex, Publications Office of the European Union · Consolidated 04/05/2016 · checked 2026-08-25 · also written rgpd
RGPD is the French name for the same regulation, not a French national law. It was a second token in this list until 2026-08-25, carrying five rules while this one carried two. The regulation number is the token because it is the one name that cannot be written two ways. The consolidated text rather than the original OJ notice, because a reader following a citation wants the article as it stands. EUR-Lex sits behind a JavaScript challenge: a scripted request gets 202 and an interstitial, a browser gets the document, so a dead-link check on this one has to be a browser check.
7 rules, every one citing a clause inside it:
legal.consent-record, legal.documents-published, legal.newsletter-separate, legal.consent-retention, legal.no-pii-in-urls, legal.consent-record-context, security.submission-store-private
EUR-Lex, Publications Office of the European Union · OJ L 151, 7.6.2019, p. 70 · checked 2026-08-26
Added by the 2026-08-26 citation audit, because the rule about publishing an accessibility statement was resting on EN 301 549, and EN 301 549 does not contain one - its only mention of a statement is a non-normative note about ICT product documentation. Art. 13(2) and Annex V are what actually bind, and they bind SERVICE PROVIDERS, which is most of our clients; the public-sector route is Directive (EU) 2016/2102 instead and is a different shape. Note what the EAA asks for and what it does not: information on how the service meets the requirements, in the general terms and conditions or an equivalent document. It does not name a published page or a contact address. Same EUR-Lex behaviour as the GDPR - a scripted request gets 202 and an interstitial, a browser gets the document.
1 rule, every one citing a clause inside it:
a11y.statement
Regulator 3 rules
Guidance from the authority that enforces the law. Not statute, but it is what an inspection is run against.
CNIL (Commission nationale de l'informatique et des libertes) · Consolidee 16 janvier 2026 (deliberation 2020-092, modifiee par 2025-131) · checked 2026-08-25
In French, because that is the version that binds. All three rules citing it are about consent and trackers, which is exactly this document's scope.
2 rules, every one citing a clause inside it:
legal.cookie-banner, legal.no-tags-before-consent
CNIL (Commission nationale de l'informatique et des libertes) · checked 2026-08-26
A SECOND CNIL entry on purpose. The other one is the cookies recommendation and its scope is trackers under article 82; a rule about what data may exist on staging has nothing to do with it, and filing it there would have widened a token whose note says exactly what it covers. This fiche is the one that carries it, in one sentence, plus a "ne pas faire" against real personal data in development and test. It is what the rule had been citing GDPR Art. 32 for - and Art. 32 never mentions test environments, staging or synthetic data. The rule's own prose had said so since it was written.
1 rule, every one citing a clause inside it:
env.no-production-data-off-production
Standard 34 rules
A published specification from a standards body. Referenced by law in some cases, and the technical benchmark either way.
W3C · 2.1 · checked 2026-08-25
The pass bar for this standard, because EN 301 549 V3.2.1 incorporates it and that is what the European Accessibility Act references. The page is stamped 06 May 2025, which is a republication with errata folded in rather than a new version.
22 rules, every one citing a clause inside it:
a11y.keyboard-operable, a11y.focus-visible, a11y.skip-link, a11y.form-labels, a11y.form-errors, a11y.alt-text, a11y.contrast, a11y.reduced-motion, a11y.dialog-behaviour, a11y.link-text, a11y.media-alternatives, a11y.zoom-and-reflow, a11y.icon-semantics, html.doctype-and-lang, html.single-h1, html.landmarks, html.buttons-vs-links, seo.headings-describe-content, design.not-colour-alone, design.contrast-in-mockup, design.text-over-media, forms.input-type-and-autocomplete
WHATWG · checked 2026-08-25
Unversioned by design: it updates on commit, so a version string here would be wrong daily.
4 rules, every one citing a clause inside it:
html.valid-markup, html.lists-and-tables, html.no-duplicate-ids, forms.value-formats
OWASP Foundation · 5.0.0 · checked 2026-08-26
Moved off 4.0.3 on 2026-08-26, the pass Phase 4 scheduled. Phase 4 decided STAY and gave three reasons; opening 5.0.0 answered all three and turned up a fourth nobody had checked. THE PIN WAS NOT A PIN. The old token said immutable v4.0.3 tag, and v4.0.3 is a BRANCH. The tag is v4.0.3_release, frozen at d31389d in 2021; the branch head is 719cd32 from 2024, and one of the 22 English chapters, V3 Session management, already differs between the two. None of the three chapters we quoted was that one, so no citation here was ever wrong - the stated reason it could not go wrong was. This token names a real tag, checked against the tag list rather than assumed from the URL shape. The mutability objection was aimed at the wrong document. 5.0.0 says its 4.x MAPPING files are not tied to release versioning, and nothing here cites a mapping file; requirement text under a release tag does not move. Levels do not survive the trip and are not meant to: Level 1 went from 46% of requirements to 20%, so a level is read inside its own version and nowhere else. WHAT THE MOVE BOUGHT. 12.5.2 forbade execution as HTML/JavaScript and left our deny-PHP half resting on implication; 5.3.1 says server-side program code outright and is still Level 1. The MIME half moved the same way, V12.2.1 at L2 to 5.2.2 at L1. 7.4.1 asked only for a generic message; 16.5.1 names stack traces, which is one of the literal strings the rule greps for. WHAT IT COST. 4.0.3 V2.2.1 carried the only hard rate-limit number in the whole standard, 100 failed attempts per hour, and 5.0.0 has no number anywhere. It splits the control in two instead: 6.1.1 requires documentation defining how rate limiting is used, and 6.3.1 requires it be implemented according to that documentation. That is a real loss of outside authority for a threshold and is not to be papered over. It is also, read straight, a better fit than what it replaced - 5.0.0 calls this Documented Security Decisions in its own migration chapter, and a standard that sets 20 POSTs per minute is precisely the document 6.1.1 asks to exist. Of the 286 requirements in 4.0.3, 11 survive unchanged. Any 4.x citation found elsewhere needs a re-read, not a renumber.
3 rules, every one citing a clause inside it:
security.upload-types-and-execution, security.no-error-disclosure, security.public-post-rate-limit
W3C · 2.2 · checked 2026-08-25
Ahead of the legal floor, not part of it. Anything cited from 2.2 is a house bar until the harmonised standard moves.
1 rule, every one citing a clause inside it:
a11y.target-size
ETSI, CEN and CENELEC · V3.2.1 (2021-03) · checked 2026-08-25
The harmonised European standard, and a 2.3 MB PDF rather than a web page. It incorporates WCAG 2.1 AA for web content, which is why the two are not competing bars. V3.2.1 is still the harmonised version: it was cited in the Official Journal by Implementing Decision (EU) 2021/1339. Checked on the ETSI server 2026-08-25 - the newest directory is 04.01.00_30 holding a final draft for vote, and there is no published V4, so anything claiming V4.1.1 applies is ahead of the record. etsi.org 403s a default user agent; use a browser one.
1 rule, every one citing a clause inside it:
a11y.axe-clean
W3C · Level 3 · checked 2026-08-25
Still a Working Draft, not a Recommendation, despite shipping in every browser. Do not describe it as a Recommendation anywhere it is cited.
1 rule, every one citing a clause inside it:
security.csp-enforced-baseline
ogp.me, originally created at Facebook · Open Web Foundation Agreement 0.9 · checked 2026-08-26
A de facto specification, NOT a standards-body Recommendation, and it is filed as a standard rather than as vendor documentation because no platform owns it - the page says it was "originally created at Facebook and is inspired by Dublin Core, link-rel canonical, Microformats, and RDFa". Added by the 2026-08-26 audit: the sharing rule had been resting on Google Search Central, which does not document Open Graph at all. Its supported-tags page lists no og: property, and og:image appears only as one optional Discover thumbnail source. Note also that ogp.me states NO image size - the 1200x630 our rule names is platform guidance, so that half of the rule is uncited by this document.
1 rule, every one citing a clause inside it:
seo.open-graph
Schema.org, W3C Schema.org Community Group · 30.0 · checked 2026-08-25
Release 30.0 dated 2026-03-19 at the time of checking. Reserved rather than deleted since 2026-08-26: its one rule moved to Google Search Central, because Schema.org publishes a VOCABULARY and Google publishes the conformance policy - the only relevant line here is guidance to mark up what is visible, which is not the accuracy requirement the rule sets. Held because the next structured-data rule may genuinely cite a type definition, and that is what this entry is for.
No rule cites this yet. Held on purpose, not forgotten.
Vendor documentation 45 rules
The documented behaviour of a platform we build on. True because they built it, and it changes when they change it.
Google · checked 2026-08-25
The documentation root, and the loosest citation in this registry: 19 rules point at it and none of them names a page. Naming the page is what the citation audit is for.
19 rules, every one citing a clause inside it:
colibrity.paged-canonical, colibrity.filter-indexability, seo.canonical, seo.no-noindex-leak, seo.robots-txt, seo.sitemap, seo.title-description, seo.structured-data, seo.internal-links-resolve, seo.hreflang, seo.redirects-on-launch, crawl.language-urls, crawl.breadcrumb-trail, crawl.content-in-server-html, crawl.search-console, migration.url-inventory, onpage.schema-fidelity, onpage.favicon, states.error-pages
Google (web.dev) · checked 2026-08-25
Still on web.dev, contrary to the assumption that everything moved to developer.chrome.com. The old short URL web.dev/vitals redirects here. Thresholds carry a date they were current, which no rule citing this records yet.
9 rules, every one citing a clause inside it:
perf.lcp, perf.cls, perf.inp-tbt, perf.no-render-blocking, perf.image-formats, perf.lazy-and-priority, perf.caching-and-compression, perf.third-party, perf.ttfb
WordPress · checked 2026-08-25
Moved out of the retired Codex into the Advanced Administration Handbook.
6 rules, every one citing a clause inside it:
ops.backup-coverage, ops.db-write-backup, ops.recovery-drill, security.admin-accounts-at-handover, security.versions-current, security.wp-attack-surface
Salesforce (Heroku), written by Adam Wiggins · checked 2026-08-25
Marked last updated 2017 on its own pages. Cited for the config-in-environment position, which has not changed, rather than for anything current.
4 rules, every one citing a clause inside it:
env.deploy-provenance, env.env-config-not-in-db, env.staging-parity, env.staging-sends-nothing-live
Google (web.dev) · checked 2026-08-26
The second web.dev token, split from the Vitals one on a real line rather than an arbitrary one: Web Vitals is a named programme with defined thresholds that move on a published cadence, and the rest of the site is general guidance that does not. Added by the 2026-08-26 audit, which found two rules parked on the Vitals token for things Vitals does not cover - HTTPS is not a Web Vital and "mixed content" appears in none of the Vitals articles, and the cost of animating a layout-triggering property is a rendering question rather than a metric. Cite the article path, never this root.
2 rules, every one citing a clause inside it:
perf.animation-cost, seo.https-and-mixed-content
WordPress · checked 2026-08-25
A site root, so it is a weak citation until the rules naming it name a handbook page.
2 rules, every one citing a clause inside it:
ops.cron-runs, ops.fatal-alerts
Google (Chrome for Developers) · Lighthouse 10 weightings · checked 2026-08-26
Where the 90-100 figure actually lives, and it is not on web.dev: the audit found web.dev/articles/performance-scoring 404s and web.dev/lighthouse-performance redirects off-site to here. The metric weightings matter as much as the number - FCP 10, SI 10, LCP 25, TBT 30, CLS 25 - because they decide which half of a score is worth working on, and they are versioned per Lighthouse major.
1 rule, every one citing a clause inside it:
perf.score-floor
WordPress · checked 2026-08-25
A living handbook shipped alongside core, with no edition string of its own.
1 rule, every one citing a clause inside it:
security.rest-route-authorisation
Google (Gmail Help) · checked 2026-08-25
Google's half of the requirements that came into force in 2024. Yahoo publishes an equivalent; the token names both because the rule has to satisfy both.
1 rule, every one citing a clause inside it:
comms.email-authentication
Client document 47 rules
A requirement the client wrote down. Authority over this project, none outside it, and usually not public.
Website Design and Development Checklist
Colibrity (Mariya, CEO) · not public
186 checkboxes across 15 numbered sections, plus a per-page list and six meta-principles. Not public, and held in a private knowledge base rather than in this repository. 40 rules rest on it, more than any other source. Every one of its 186 boxes is accounted for on /checklist-map/, item by item, including the ten we declined and the nine no rule carries.
40 rules, every one citing a clause inside it:
a11y.screen-reader-pass, perf.enqueue-hygiene, perf.optimiser-output-fresh, practices.mobile-viewport-chrome, crawl.signals-agree, crawl.indexability-decided, crawl.slug-change-redirect, migration.redirect-map, onpage.core-fields, onpage.site-identity, comms.crm-field-map, comms.conversion-events, comms.delivery-alerting, comms.email-rendering, comms.sender-identity, delivery.real-content, delivery.browser-matrix, delivery.client-handover, delivery.monitoring-and-backups, design.mockup-coverage, design.motion-spec, design.naming-convention, design.state-set, design.ui-kit, forms.file-uploads, forms.server-side-validation, forms.anti-spam, forms.confirmation, forms.error-timing, forms.input-font-size, forms.submit-lifecycle, legal.terms-consent-checkbox, states.no-js-fallback, states.preloader-budget, states.current-page, states.error-page-design, states.interactive-set, states.loading-feedback, states.scroll-reveal-recovery, states.sticky-chrome
Technical SEO control grid
A third-party SEO agency, commissioned by Colibrity · 159 control points, crawl of 182 URLs on 2026-07-30 · not public
An outside agency's audit of one delivered site, handed to Colibrity as the remediating party. Neither the site nor the auditor is named here: a reader of this standard cannot open it, has no reason to care whose site it was, and naming a client's defect list on a public page is not ours to do. What a reader is owed is the kind of authority, and it is a client document. Every one of its 159 points is accounted for on /checklist-map/. It carries no authority column of its own, so a point in it is evidence of a defect on one site rather than a citation of a standard - and two whole classes of it were checked against the live site and found wrong, which is why 22 of the 159 are declined.
5 rules, every one citing a clause inside it:
colibrity.pagination-crawlable, perf.page-weight, crawl.sibling-hosts, crawl.internal-reachability, crawl.url-format
Front-end brief
Colibrity (Michael Vasyuk, CTO) · not public
Not public, and held in a private knowledge base rather than in this repository. He asked for six areas, two lists and two named internal practices; everything beyond that is our inference. Two rules cited it for something it does not contain and were re-sourced in the 2026-08-26 citation audit, which is what that audit was for.
2 rules, every one citing a clause inside it:
colibrity.filter-url-state, colibrity.pagination-in-url
House rule 38 rules
Our own practice, written down in our own repositories. Legitimate, and labelled so it is never mistaken for one of the above.
Delivered reference builds, audited together
Our own delivered work · Audited 2026-08-25; a third build, partially, 2026-09-09 · not public
WordPress themes we built and shipped, named in standard.builds.yml in this repository along with a path:line verdict for every rule in the standard. They are not named here because a reader of this standard has no way to open them and no reason to care which client they belong to; what they are owed is the KIND of authority, and it is house. The entry was ronn-square-reference until 2026-08-25, held reserved for exactly this audit. It is one token and not several on purpose, because the builds are the same lineage - the second is a port of the first, and the third stands on a starter extracted from both - so a practice found in all of them is one decision that survived being carried forward, not independent confirmations. Real evidence, weaker than a count implies. The third build was not audited row by row: it is cited only on the rules it introduced, and the ledger refuses a citation of it without a line number.
28 rules, every one citing a clause inside it:
colibrity.filter-history-noise, colibrity.dev-surfaces-hidden, colibrity.adding-a-block, colibrity.tokens-from-the-design-file, html.no-inline-handlers, perf.split-points-asserted, practices.no-hardcoded-content, practices.empty-states, practices.self-cleaning-modules, practices.responsive-breakpoints, practices.real-device-check, practices.handover-notes, practices.soft-navigation-parity, practices.tests-before-deploy, crawl.published-urls-resolve, crawl.language-parity, admin.client-mode, admin.capability-boundaries, admin.fields-in-code, admin.one-control-per-setting, admin.editor-language, admin.duplicate-content, admin.translation-declared, comms.submission-delivery, delivery.editor-test, forms.cache-safe-submit, ops.deploy-target-pinned, security.comments-closed
CONVENTIONS.md
wp-starter, our own repository · wp-starter v1.22.1 (4358f86, 2026-08-14) · not public
At .claude/CONVENTIONS.md in the wp-starter repository, which is not vendored here. It said "not version-pinned, so a rule citing it cites whatever that file says today" until the 2026-08-26 audit pinned it: the file is byte-unchanged since v1.22.1, which is the only thing that makes a line range citable at all. Four of the thirteen rules survived contact with the file; the rest cited it for things it does not say.
5 rules, every one citing a clause inside it:
colibrity.block-file-triple, html.bem-naming, practices.no-secrets, practices.output-escaping, practices.console-clean
PERFORMANCE.md
wp-starter, our own repository · wp-starter v1.22.1 (4358f86, 2026-08-14) · not public
At .claude/PERFORMANCE.md in the wp-starter repository, pinned to v1.22.1 by the 2026-08-26 audit for the same reason as CONVENTIONS.md. It is a measurement log rather than a specification, which is why several rules that cited it were citing an adjacent finding rather than a requirement.
4 rules, every one citing a clause inside it:
perf.bundle-budgets, perf.fonts, perf.video-weight, practices.one-change-per-deploy
Colibrity standard, published at /decisions/ · checked 2026-08-26
The honest home for a rule that is our own judgement and nothing else. The 2026-08-26 audit found rules resting on the nearest plausible document because the registry had no such place - the account-inventory rule cited the Twelve-Factor App, which is about application architecture and says nothing about registrars. That rule is gone; this entry is what stops the next one being filed the same way. A citation here names a plan file and a line range in THIS repository, which bin/cites-check.mjs opens, so the claim is "we decided this, here, on this date, for this reason" and a reader can go and read the reason. It is the weakest tier on the page and says so. It is not a way round the audit: a rule belongs here only when no document and no delivered build carries it, and it is the last resort rather than the easy one. Published at /decisions/ since 2026-08-26: it was the only source in this registry a reader could not open, which is exactly backwards, since a rule resting on WCAG survives being taken on trust and a rule resting on our own judgement does not.
1 rule, every one citing a clause inside it:
colibrity.js-hooks-are-data-attributes