Quality rubric — dimensions

The ten dimensions every build on the nanohype stack is graded against. This file names the dimensions, gives a one-line summary, and names the canonical lens for each (the named thinker / framework whose framing the dimension is graded through). The depth — specific REJECT criteria, anti-pattern catalogs, pattern-to-solution maps, reviewer assignments, weights, and merge-gate enforcement — lives in the reference client's bundled `quality-check` skill (`fab/skills/quality-check.md`) and can be overlaid by any consumer with their own deepened version.

Name	`quality-rubric-dimensions`
Version	`1`
Source	`standards/quality-rubric-dimensions.json`

The standard

dimensions

id
architecture
name
Architecture & Domain Modeling
summary
Bounded contexts, layering, separation of concerns, and how the domain model maps to code structure. Lens: Evans (DDD), Vernon (Aggregates), Fowler (P of EAA), Martin (Clean Architecture).
id
patterns
name
Design Patterns & Reuse
summary
Whether existing patterns and utilities are reused, abstractions are at the right level, and new patterns are justified by problem fit. Lens: Hickey (Simple Made Easy), GoF (Design Patterns), Hohpe & Woolf (Enterprise Integration Patterns).
id
systems
name
Systems Thinking
summary
Failure modes, blast radius, backpressure, retries, idempotency, and second-order behavior under load or partial failure. Lens: Kleppmann (DDIA), Nygard (Release It!), Gregg (Systems Performance).
id
testing
name
Testing Strategy (Testing Trophy)
summary
Static analysis base, integration-heavy middle, minimal e2e. Coverage thresholds, hermetic integration for orchestrators, contract tests against every external API. Lens: Dodds (Testing Trophy), Beck (TDD), Feathers (Working Effectively with Legacy Code).
id
frontend
name
Frontend Architecture & Design Systems
summary
Component boundaries, accessibility, design-token usage, state management, rendering performance. N/A for headless services. Lens: Frost (Atomic Design), Eliott (Composing Software), Soueidan & Pickering on accessibility, WCAG 2.1.
id
security
name
Security
summary
Threat model, IAM least-privilege, secrets handling, dependency supply chain, real-upstream identity resolution (never fabricated). Lens: Shostack (Threat Modeling — STRIDE), OWASP Top 10, Schneier et al. (Cryptography Engineering).
id
code_quality
name
Code Quality & Craft
summary
Naming, function size, complexity, error handling at boundaries, explicit timeouts on every external call, absence of stubs presented as done. Lens: Ousterhout (Philosophy of Software Design), Martin (Clean Code), Goetz (Concurrency in Practice).
id
documentation
name
Documentation & Developer Experience
summary
README, runbook, .env.example, per-project CLAUDE.md, API docs regenerated by the docs phase, PR descriptions that explain why not what. Lens: Procida (Diátaxis four-quadrant model), Hunt & Thomas (The Pragmatic Programmer).
id
consistency
name
Consistency & Polish
summary
Conventions inherited from the parent repo, code shape across modules, file layout, absence of aspirational comments that claim behavior the code does not deliver. Lens: Kelling & Wilson (Broken Windows applied to codebases), Hunt & Thomas (camp-site rule), Knuth (Literate Programming).
id
ai_systems
name
AI & Agent Systems
summary
Eval suites as the test tier for non-deterministic components, prompt discipline and versioning, model routing + fallback, token/cost metering and caching, structured-output validation, prompt-injection defense, and agent tool-use (least-privilege authz, typed I/O, identity propagation, kill-switch on budget breach). N/A for builds with no LLM or agent surface. Lens: Huyen (AI Engineering), Willison (prompt injection), OWASP (Top 10 for LLM Applications), Anthropic (Building Effective Agents).