Skip to content
CREED
Menu

The handbook#

This page maps the CREED handbook: what it is, how to read its key words and PROCTOR check lines, and where each of the thirteen chapters lives.

What the handbook is#

The rules for the Wayne State app stack, chapter by chapter. Each chapter states what the ADRs have decided or what WSU's developer standards (2024) already require, and names its undecided points under a "Not decided here" heading. The rules, chapter by chapter, live in the handbook site, built separately from handbook/.

How to read a rule#

  • The key words MUST, MUST NOT, SHOULD, SHOULD NOT and MAY in each chapter are to be interpreted as described in RFC 2119.
  • A line that reads "PROCTOR check: <id>" names the PROCTOR check that reports a breach of that rule.

The chapters#

  • Versions: the stack's version policy, the state table from active to EOL plus 90 days, with the dates in policy/policy.json and every tool deriving a version's state from the date.
  • Dependencies: no unbounded constraints, a committed lock file, an audit with no advisories at or above the policy's severity threshold, and the private-packages registry rules.
  • Code: PHP style with one Pint preset per repo, reading the code, static analysis at PHPStan level 8, banned patterns, and Vue and JavaScript linting.
  • Auth: one protocol-neutral library that returns a verified identity and leaves the session to the app, with its drivers and non-EOL PHP only.
  • Databases: the MySQL lines the policy lists, the conventions that keep an app working on the shared 5.6 server, and the 90-day grace period.
  • Runtime and headers: the runtime (Baseline) warns and refuses only for unsafe config, HELMET's headers on every response, proxy trust from a platform preset or the app's own list, and debug off in production.
  • Deploy gate: the gate runs PROCTOR against the commit being released, before it is released, and refuses EOL PHP.
  • CI: CI is enforcement point (c), a red pipeline before merge, built from Preflight's pinned components and judged with deterministic commands, never with a model.
  • Accessibility: WCAG 2.2 Level AA as the target for every public page, WayneUI components as the checked starting point, an automated Pa11y check in CI, and the open Title II question.
  • Every OS: every developer tool works on Windows, macOS and Linux, with .ps1 and .sh pairs, LF line endings and portable paths.
  • Secrets: credentials never in version control and never in the served folder, with errors and debug output that hide them.
  • Production: pre-production and production environments, running safely with the least access needed, and who can reach an app.
  • Overrides: overrides are named, dated and visible, with an expiry date and a reason, and an expired override is a failure.