refactor: 4개 검사 엔진을 YAML 기반 표준 규칙으로 리팩토링

- YAML 규칙 파일 4개 신규 생성 (html_css, accessibility, seo, performance_security)
  W3C, WCAG 2.0/2.1/2.2, OWASP, Google Search Essentials 공식 표준 기반
- rules/__init__.py: YAML 로더 + 캐싱 + 리로드 모듈
- html_css.py: 30개 폐기 요소, 100+개 폐기 속성을 YAML에서 동적 로드
- accessibility.py: WCAG 버전 선택 지원 (wcag_version 파라미터)
- seo.py: title/description 길이, OG 필수 태그 등 임계값 YAML 로드
- performance_security.py: COOP/COEP/CORP 검사 추가, 정보 노출 헤더 검사 추가,
  TTFB/페이지 크기 임계값 YAML 로드
- PyYAML 의존성 추가

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

backend/app/engines/accessibility.py

@@ -1,7 +1,8 @@
 """
-Accessibility (WCAG 2.1 AA) Checker Engine (F-003).
+Accessibility (WCAG) Checker Engine (F-003).
 Uses Playwright + axe-core for comprehensive accessibility testing.
 Falls back to BeautifulSoup-based checks if Playwright is unavailable.
+Supports WCAG version selection (2.0/2.1/2.2) via rules/accessibility.yaml.
 """
 
 import json
@@ -14,6 +15,7 @@ from bs4 import BeautifulSoup
 
 from app.engines.base import BaseChecker
 from app.models.schemas import CategoryResult, Issue
+from app.rules import get_rules
 
 logger = logging.getLogger(__name__)
 
@@ -24,21 +26,42 @@ AXE_CORE_JS_PATH = Path(__file__).parent / "axe_core" / "axe.min.js"
 AXE_RULE_MESSAGES = {
     "image-alt": ("A-01", "이미지에 대체 텍스트(alt)가 없습니다", "1.1.1"),
     "color-contrast": ("A-02", "텍스트와 배경의 색상 대비가 부족합니다", "1.4.3"),
+    "color-contrast-enhanced": ("A-02", "텍스트와 배경의 색상 대비가 향상된 기준을 충족하지 않습니다", "1.4.6"),
     "keyboard": ("A-03", "키보드로 접근할 수 없는 요소가 있습니다", "2.1.1"),
     "focus-visible": ("A-04", "키보드 포커스가 시각적으로 표시되지 않습니다", "2.4.7"),
     "label": ("A-05", "폼 요소에 레이블이 연결되지 않았습니다", "1.3.1"),
     "input-label": ("A-05", "입력 요소에 레이블이 없습니다", "1.3.1"),
+    "input-button-name": ("A-05", "입력 버튼에 접근 가능한 이름이 없습니다", "4.1.2"),
+    "select-name": ("A-05", "select 요소에 접근 가능한 이름이 없습니다", "4.1.2"),
     "aria-valid-attr": ("A-06", "유효하지 않은 ARIA 속성이 사용되었습니다", "4.1.2"),
     "aria-roles": ("A-06", "유효하지 않은 ARIA 역할이 사용되었습니다", "4.1.2"),
     "aria-required-attr": ("A-06", "필수 ARIA 속성이 누락되었습니다", "4.1.2"),
     "aria-valid-attr-value": ("A-06", "ARIA 속성 값이 올바르지 않습니다", "4.1.2"),
+    "aria-allowed-attr": ("A-06", "허용되지 않는 ARIA 속성이 사용되었습니다", "4.1.2"),
+    "aria-allowed-role": ("A-06", "허용되지 않는 ARIA 역할이 사용되었습니다", "4.1.2"),
+    "aria-hidden-body": ("A-06", "body 요소에 aria-hidden이 설정되어 있습니다", "4.1.2"),
+    "aria-hidden-focus": ("A-06", "aria-hidden 요소 내에 포커스 가능한 요소가 있습니다", "4.1.2"),
     "link-name": ("A-07", "링크 텍스트가 목적을 설명하지 않습니다", "2.4.4"),
     "html-has-lang": ("A-08", "HTML 요소에 lang 속성이 없습니다", "3.1.1"),
     "html-lang-valid": ("A-08", "HTML lang 속성 값이 올바르지 않습니다", "3.1.1"),
+    "valid-lang": ("A-08", "lang 속성 값이 올바르지 않습니다", "3.1.2"),
     "bypass": ("A-09", "건너뛰기 링크(skip navigation)가 없습니다", "2.4.1"),
+    "region": ("A-09", "랜드마크 영역 밖에 콘텐츠가 있습니다", "2.4.1"),
     "no-autoplay-audio": ("A-10", "자동 재생 미디어에 정지/음소거 컨트롤이 없습니다", "1.4.2"),
     "audio-caption": ("A-10", "오디오/비디오에 자막이 없습니다", "1.2.2"),
     "video-caption": ("A-10", "비디오에 자막이 없습니다", "1.2.2"),
+    "document-title": ("A-11", "페이지에 제목(title)이 없습니다", "2.4.2"),
+    "empty-heading": ("A-12", "빈 heading 요소가 있습니다", "2.4.6"),
+    "frame-title": ("A-13", "iframe에 접근 가능한 제목이 없습니다", "4.1.2"),
+    "button-name": ("A-14", "버튼에 접근 가능한 이름이 없습니다", "4.1.2"),
+    "meta-refresh": ("A-15", "meta refresh로 시간 제한이 설정되어 있습니다", "2.2.1"),
+    "meta-viewport-large": ("A-16", "사용자의 확대/축소가 제한되어 있습니다", "1.4.4"),
+    "autocomplete-valid": ("A-17", "autocomplete 속성이 올바르지 않습니다", "1.3.5"),
+    "target-size": ("A-18", "터치 대상 크기가 최소 기준을 충족하지 않습니다", "2.5.8"),
+    "scrollable-region-focusable": ("A-19", "스크롤 가능한 영역에 키보드 접근이 불가합니다", "2.1.1"),
+    "tabindex": ("A-20", "tabindex 값이 0보다 크게 설정되어 있습니다", "2.4.3"),
+    "blink": ("A-21", "깜빡이는 콘텐츠가 있습니다", "2.2.2"),
+    "marquee": ("A-21", "자동 스크롤 콘텐츠(marquee)가 있습니다", "2.2.2"),
 }
 
 # axe-core impact to severity mapping
@@ -49,9 +72,56 @@ IMPACT_TO_SEVERITY = {
     "minor": "info",
 }
 
+# WCAG version to axe-core tags mapping (loaded from YAML at runtime)
+WCAG_VERSION_PRESETS = {
+    "2.0_A": ["wcag2a"],
+    "2.0_AA": ["wcag2a", "wcag2aa"],
+    "2.1_AA": ["wcag2a", "wcag2aa", "wcag21a", "wcag21aa"],
+    "2.2_AA": ["wcag2a", "wcag2aa", "wcag21a", "wcag21aa", "wcag22aa"],
+    "2.2_full": ["wcag2a", "wcag2aa", "wcag2aaa", "wcag21a", "wcag21aa", "wcag22aa"],
+}
+
+
+def _get_axe_tags_for_version(wcag_version: str = "2.1_AA") -> list[str]:
+    """Get axe-core tags for a given WCAG version preset."""
+    rules = get_rules("accessibility")
+    presets = rules.get("compliance_presets", {})
+
+    # Map user-friendly names to YAML preset keys
+    version_map = {
+        "2.0_A": "wcag_20_a",
+        "2.0_AA": "wcag_20_aa",
+        "2.1_AA": "wcag_21_aa",
+        "2.2_AA": "wcag_22_aa",
+        "2.2_full": "wcag_22_full",
+    }
+
+    yaml_key = version_map.get(wcag_version)
+    if yaml_key and yaml_key in presets:
+        return presets[yaml_key].get("tags", WCAG_VERSION_PRESETS.get(wcag_version, ["wcag2a", "wcag2aa"]))
+
+    return WCAG_VERSION_PRESETS.get(wcag_version, ["wcag2a", "wcag2aa", "wcag21a", "wcag21aa"])
+
+
+def _get_wcag_level_label(wcag_version: str) -> str:
+    """Get human-readable WCAG level label."""
+    labels = {
+        "2.0_A": "WCAG 2.0 Level A",
+        "2.0_AA": "WCAG 2.0 Level AA",
+        "2.1_AA": "WCAG 2.1 Level AA",
+        "2.2_AA": "WCAG 2.2 Level AA",
+        "2.2_full": "WCAG 2.2 All Levels",
+    }
+    return labels.get(wcag_version, "WCAG 2.1 Level AA")
+
 
 class AccessibilityChecker(BaseChecker):
-    """Accessibility (WCAG 2.1 AA) checker engine."""
+    """Accessibility (WCAG) checker engine with version selection."""
+
+    def __init__(self, progress_callback=None, wcag_version: str = "2.1_AA"):
+        super().__init__(progress_callback)
+        self.wcag_version = wcag_version
+        self.axe_tags = _get_axe_tags_for_version(wcag_version)
 
     @property
     def category_name(self) -> str:
@@ -86,12 +156,10 @@ class AccessibilityChecker(BaseChecker):
                 await page.goto(url, wait_until="networkidle", timeout=30000)
 
                 await self.update_progress(40, "axe-core 주입 중...")
-                # Load axe-core JS
                 if AXE_CORE_JS_PATH.exists() and AXE_CORE_JS_PATH.stat().st_size > 1000:
                     axe_js = AXE_CORE_JS_PATH.read_text(encoding="utf-8")
                     await page.evaluate(axe_js)
                 else:
-                    # Fallback: load from CDN
                     await page.evaluate("""
                         async () => {
                             const script = document.createElement('script');
@@ -104,22 +172,27 @@ class AccessibilityChecker(BaseChecker):
                         }
                     """)
 
-                await self.update_progress(60, "접근성 검사 실행 중...")
+                await self.update_progress(60, f"접근성 검사 실행 중 ({_get_wcag_level_label(self.wcag_version)})...")
-                axe_results = await page.evaluate("""
+
-                    () => {
+                # Build axe-core tag list including best-practice
-                        return new Promise((resolve, reject) => {
+                axe_tag_list = self.axe_tags + ["best-practice"]
-                            if (typeof axe === 'undefined') {
+                tags_js = json.dumps(axe_tag_list)
+
+                axe_results = await page.evaluate(f"""
+                    () => {{
+                        return new Promise((resolve, reject) => {{
+                            if (typeof axe === 'undefined') {{
                                 reject(new Error('axe-core not loaded'));
                                 return;
-                            }
+                            }}
-                            axe.run(document, {
+                            axe.run(document, {{
-                                runOnly: {
+                                runOnly: {{
                                     type: 'tag',
-                                    values: ['wcag2a', 'wcag2aa', 'best-practice']
+                                    values: {tags_js}
-                                }
+                                }}
-                            }).then(resolve).catch(reject);
+                            }}).then(resolve).catch(reject);
-                        });
+                        }});
-                    }
+                    }}
                 """)
 
                 await self.update_progress(80, "결과 분석 중...")
@@ -134,7 +207,7 @@ class AccessibilityChecker(BaseChecker):
             category="accessibility",
             score=score,
             issues=issues,
-            wcag_level="AA",
+            wcag_level=_get_wcag_level_label(self.wcag_version),
         )
 
     async def _check_with_beautifulsoup(self, url: str, html_content: str) -> CategoryResult:
@@ -170,7 +243,7 @@ class AccessibilityChecker(BaseChecker):
             category="accessibility",
             score=score,
             issues=issues,
-            wcag_level="AA",
+            wcag_level=_get_wcag_level_label(self.wcag_version),
         )
 
     def _parse_axe_results(self, axe_results: dict) -> list[Issue]:
@@ -182,15 +255,15 @@ class AccessibilityChecker(BaseChecker):
             impact = violation.get("impact", "minor")
             severity = IMPACT_TO_SEVERITY.get(impact, "info")
 
-            # Map to our issue codes
             if rule_id in AXE_RULE_MESSAGES:
                 code, korean_msg, wcag = AXE_RULE_MESSAGES[rule_id]
             else:
-                code = "A-06"
+                code = "A-99"
                 korean_msg = violation.get("description", "접근성 위반 사항이 발견되었습니다")
-                wcag = "4.1.2"
+                # Try to extract WCAG criterion from tags
+                tags = violation.get("tags", [])
+                wcag = self._extract_wcag_from_tags(tags)
 
-            # Get affected elements
             nodes = violation.get("nodes", [])
             element = None
             if nodes:
@@ -211,7 +284,6 @@ class AccessibilityChecker(BaseChecker):
                         if ratio:
                             detail = f" (대비율: {ratio}:1, 최소 4.5:1 필요)"
 
-            # Create the issue with node count info
             node_count = len(nodes)
             count_info = f" ({node_count}개 요소)" if node_count > 1 else ""
 
@@ -226,11 +298,19 @@ class AccessibilityChecker(BaseChecker):
 
         return issues
 
+    @staticmethod
+    def _extract_wcag_from_tags(tags: list[str]) -> str:
+        """Extract WCAG criterion number from axe-core tags (e.g., 'wcag111' -> '1.1.1')."""
+        for tag in tags:
+            if tag.startswith("wcag") and not tag.startswith("wcag2"):
+                # e.g., "wcag111" -> "1.1.1"
+                digits = tag[4:]
+                if len(digits) >= 3:
+                    return f"{digits[0]}.{digits[1]}.{digits[2:]}"
+        return "4.1.2"
+
     def _calculate_axe_score(self, axe_results: dict) -> int:
-        """
+        """Calculate score based on axe-core violations."""
-        Calculate score based on axe-core violations.
-        critical=-20, serious=-10, moderate=-5, minor=-2
-        """
         severity_weights = {
             "critical": 20,
             "serious": 10,
@@ -284,7 +364,6 @@ class AccessibilityChecker(BaseChecker):
             if inp.get("aria-label") or inp.get("aria-labelledby") or inp.get("title"):
                 has_label = True
 
-            # Check if wrapped in label
             parent_label = inp.find_parent("label")
             if parent_label:
                 has_label = True
@@ -377,10 +456,9 @@ class AccessibilityChecker(BaseChecker):
 
     def _bs_check_skip_nav(self, soup: BeautifulSoup) -> list[Issue]:
         """A-09: Check for skip navigation link."""
-        # Look for skip nav patterns
         skip_links = soup.find_all("a", href=True)
         has_skip = False
-        for link in skip_links[:10]:  # Check first 10 links
+        for link in skip_links[:10]:
             href = link.get("href", "")
             text = link.get_text(strip=True).lower()
             if href.startswith("#") and any(
@@ -417,6 +495,6 @@ class AccessibilityChecker(BaseChecker):
                         suggestion="autoplay 미디어에 controls 속성을 추가하거나 muted 속성을 사용하세요",
                         wcag_criterion="1.4.2",
                     ))
-                    break  # Report only first
+                    break
 
         return issues

backend/app/engines/html_css.py

@@ -2,6 +2,7 @@
 HTML/CSS Standards Checker Engine (F-002).
 Checks HTML5 validity, semantic tags, CSS inline usage, etc.
 Uses BeautifulSoup4 + html5lib for parsing.
+Rules loaded from rules/html_css.yaml.
 """
 
 import re
@@ -13,15 +14,28 @@ from bs4 import BeautifulSoup
 
 from app.engines.base import BaseChecker
 from app.models.schemas import CategoryResult, Issue
+from app.rules import get_rules
 
 logger = logging.getLogger(__name__)
 
-DEPRECATED_TAGS = [
-    "font", "center", "marquee", "blink", "strike", "big", "tt",
-    "basefont", "applet", "dir", "isindex",
-]
 
-SEMANTIC_TAGS = ["header", "nav", "main", "footer", "section", "article"]
+def _load_obsolete_elements() -> list[dict]:
+    """Load obsolete elements from YAML."""
+    rules = get_rules("html_css")
+    return rules.get("obsolete_elements", [])
+
+
+def _load_obsolete_attributes() -> dict[str, list[dict]]:
+    """Load obsolete attributes from YAML, keyed by element name."""
+    rules = get_rules("html_css")
+    return rules.get("obsolete_attributes", {})
+
+
+def _load_semantic_tags() -> list[str]:
+    """Load structural semantic tag names from YAML."""
+    rules = get_rules("html_css")
+    structural = rules.get("semantic_elements", {}).get("structural", [])
+    return [item["tag"] for item in structural]
 
 
 class HtmlCssChecker(BaseChecker):
@@ -50,16 +64,21 @@ class HtmlCssChecker(BaseChecker):
         await self.update_progress(50, "시맨틱 태그 검사 중...")
         issues += self._check_semantic_tags(soup)
 
-        await self.update_progress(60, "이미지 alt 속성 검사 중...")
+        await self.update_progress(55, "이미지 alt 속성 검사 중...")
         issues += self._check_img_alt(soup)
 
-        await self.update_progress(70, "중복 ID 검사 중...")
+        await self.update_progress(60, "중복 ID 검사 중...")
         issues += self._check_duplicate_ids(soup)
 
-        await self.update_progress(80, "링크 및 스타일 검사 중...")
+        await self.update_progress(65, "링크 및 스타일 검사 중...")
         issues += self._check_empty_links(soup)
         issues += self._check_inline_styles(soup)
-        issues += self._check_deprecated_tags(soup)
+
+        await self.update_progress(75, "Obsolete 태그 검사 중...")
+        issues += self._check_obsolete_tags(soup)
+
+        await self.update_progress(80, "Obsolete 속성 검사 중...")
+        issues += self._check_obsolete_attributes(soup)
 
         await self.update_progress(90, "heading 구조 검사 중...")
         issues += self._check_heading_hierarchy(soup)
@@ -134,21 +153,22 @@ class HtmlCssChecker(BaseChecker):
 
     def _check_semantic_tags(self, soup: BeautifulSoup) -> list[Issue]:
         """H-05: Check for semantic HTML5 tag usage."""
+        semantic_tags = _load_semantic_tags()
         found_tags = set()
-        for tag_name in SEMANTIC_TAGS:
+        for tag_name in semantic_tags:
             if soup.find(tag_name):
                 found_tags.add(tag_name)
 
         if not found_tags:
+            tag_list = ", ".join(semantic_tags)
             return [self._create_issue(
                 code="H-05",
                 severity="minor",
-                message="시맨틱 태그가 사용되지 않았습니다 (header, nav, main, footer, section, article)",
+                message=f"시맨틱 태그가 사용되지 않았습니다 ({tag_list})",
                 suggestion="적절한 시맨틱 태그를 사용하여 문서 구조를 명확히 하세요",
             )]
 
-        missing = set(SEMANTIC_TAGS) - found_tags
+        missing = set(semantic_tags) - found_tags
-        # Only report if major structural elements are missing (main is most important)
         if "main" in missing:
             return [self._create_issue(
                 code="H-05",
@@ -240,20 +260,102 @@ class HtmlCssChecker(BaseChecker):
             ))
         return issues
 
-    def _check_deprecated_tags(self, soup: BeautifulSoup) -> list[Issue]:
+    def _check_obsolete_tags(self, soup: BeautifulSoup) -> list[Issue]:
-        """H-10: Check for deprecated HTML tags."""
+        """H-10: Check for obsolete HTML tags (loaded from YAML)."""
         issues = []
-        for tag_name in DEPRECATED_TAGS:
+        obsolete = _load_obsolete_elements()
+
+        for entry in obsolete:
+            tag_name = entry["tag"]
             found = soup.find_all(tag_name)
             if found:
+                replacement = entry.get("replacement", "CSS")
+                severity = entry.get("severity", "major")
                 first_el = found[0]
                 issues.append(self._create_issue(
                     code="H-10",
-                    severity="major",
+                    severity=severity,
-                    message=f"사용 중단된(deprecated) 태그 <{tag_name}>이(가) {len(found)}회 사용되었습니다",
+                    message=f"사용 중단된(obsolete) 태그 <{tag_name}>이(가) {len(found)}회 사용되었습니다",
                     element=self._truncate_element(str(first_el)),
                     line=self._get_line_number(first_el),
-                    suggestion=f"<{tag_name}> 대신 CSS를 사용하여 스타일을 적용하세요",
+                    suggestion=f"<{tag_name}> 대신 {replacement}을(를) 사용하세요",
+                ))
+        return issues
+
+    def _check_obsolete_attributes(self, soup: BeautifulSoup) -> list[Issue]:
+        """H-13: Check for obsolete HTML attributes (loaded from YAML)."""
+        issues = []
+        obsolete_attrs = _load_obsolete_attributes()
+
+        # Check element-specific obsolete attributes
+        element_checks = {
+            "a": "a", "body": "body", "br": "br", "form": "form",
+            "hr": "hr", "html": "html", "iframe": "iframe", "img": "img",
+            "input": "input", "link": "link", "meta": "meta", "script": "script",
+            "style": "style", "table": "table", "embed": "embed",
+        }
+        # Multi-element groups
+        multi_checks = {
+            "td_th": ["td", "th"],
+            "tr": ["tr"],
+            "thead_tbody_tfoot": ["thead", "tbody", "tfoot"],
+            "ol_ul": ["ol", "ul"],
+            "heading": ["h1", "h2", "h3", "h4", "h5", "h6"],
+            "embed": ["embed"],
+        }
+
+        found_count = 0
+        first_element = None
+        first_line = None
+        first_attr = None
+
+        # Single-element checks
+        for yaml_key, html_tag in element_checks.items():
+            attr_list = obsolete_attrs.get(yaml_key, [])
+            for attr_entry in attr_list:
+                attr_name = attr_entry["attr"]
+                elements = soup.find_all(html_tag, attrs={attr_name: True})
+                if elements:
+                    found_count += len(elements)
+                    if first_element is None:
+                        first_element = self._truncate_element(str(elements[0]))
+                        first_line = self._get_line_number(elements[0])
+                        first_attr = f'{html_tag}[{attr_name}]'
+
+        # Multi-element group checks
+        for yaml_key, html_tags in multi_checks.items():
+            attr_list = obsolete_attrs.get(yaml_key, [])
+            for attr_entry in attr_list:
+                attr_name = attr_entry["attr"]
+                for html_tag in html_tags:
+                    elements = soup.find_all(html_tag, attrs={attr_name: True})
+                    if elements:
+                        found_count += len(elements)
+                        if first_element is None:
+                            first_element = self._truncate_element(str(elements[0]))
+                            first_line = self._get_line_number(elements[0])
+                            first_attr = f'{html_tag}[{attr_name}]'
+
+        # Global obsolete attributes
+        global_attrs = obsolete_attrs.get("global", [])
+        for attr_entry in global_attrs:
+            attr_name = attr_entry["attr"]
+            elements = soup.find_all(attrs={attr_name: True})
+            if elements:
+                found_count += len(elements)
+                if first_element is None:
+                    first_element = self._truncate_element(str(elements[0]))
+                    first_line = self._get_line_number(elements[0])
+                    first_attr = attr_name
+
+        if found_count > 0:
+            issues.append(self._create_issue(
+                code="H-13",
+                severity="minor",
+                message=f"사용 중단된(obsolete) HTML 속성이 {found_count}개 발견되었습니다 (예: {first_attr})",
+                element=first_element,
+                line=first_line,
+                suggestion="사용 중단된 HTML 속성 대신 CSS를 사용하세요 (W3C HTML Living Standard 참조)",
             ))
         return issues
 
@@ -277,7 +379,7 @@ class HtmlCssChecker(BaseChecker):
                     line=self._get_line_number(heading),
                     suggestion=f"h{prev_level} 다음에는 h{prev_level + 1}을 사용하세요",
                 ))
-                break  # Only report first skip
+                break
             prev_level = level
         return issues
 
@@ -295,14 +397,12 @@ class HtmlCssChecker(BaseChecker):
 
     @staticmethod
     def _get_line_number(element) -> Optional[int]:
-        """Extract source line number from a BeautifulSoup element."""
         if element and hasattr(element, "sourceline"):
             return element.sourceline
         return None
 
     @staticmethod
     def _truncate_element(element_str: str, max_len: int = 200) -> str:
-        """Truncate element string for display."""
         if len(element_str) > max_len:
             return element_str[:max_len] + "..."
         return element_str

backend/app/engines/performance_security.py

@@ -10,13 +10,14 @@ import logging
 import time
 from datetime import datetime, timezone
 from urllib.parse import urlparse
-from typing import Optional
+from typing import Any, Optional
 
 import httpx
 from bs4 import BeautifulSoup
 
 from app.engines.base import BaseChecker
 from app.models.schemas import CategoryResult, Issue, calculate_grade
+from app.rules import get_rules
 
 logger = logging.getLogger(__name__)
 
@@ -24,6 +25,32 @@ logger = logging.getLogger(__name__)
 class PerformanceSecurityChecker(BaseChecker):
     """Performance and security checker engine."""
 
+    def __init__(self, **kwargs):
+        super().__init__(**kwargs)
+        self._rules_data = get_rules("performance_security")
+
+    def _get_security_headers(self) -> list[dict[str, Any]]:
+        """Load required security headers from YAML."""
+        return self._rules_data.get("security", {}).get("headers", [])
+
+    def _get_headers_to_remove(self) -> list[dict[str, Any]]:
+        """Load information disclosure headers from YAML."""
+        return self._rules_data.get("security", {}).get("headers_to_remove", [])
+
+    def _get_ttfb_thresholds(self) -> dict[str, int]:
+        """Load TTFB thresholds from YAML."""
+        for metric in self._rules_data.get("performance", {}).get("additional_metrics", []):
+            if metric.get("id") == "perf-ttfb":
+                return metric.get("thresholds", {})
+        return {"good": 800, "needs_improvement": 1800}
+
+    def _get_page_size_thresholds(self) -> dict[str, int]:
+        """Load total page size thresholds from YAML."""
+        for check in self._rules_data.get("performance", {}).get("resource_checks", []):
+            if check.get("id") == "perf-total-page-size":
+                return check.get("thresholds", {})
+        return {"good": 1500, "needs_improvement": 3000, "poor": 5000}
+
     @property
     def category_name(self) -> str:
         return "performance_security"
@@ -46,6 +73,12 @@ class PerformanceSecurityChecker(BaseChecker):
         issues += self._check_x_xss_protection(headers)
         issues += self._check_referrer_policy(headers)
         issues += self._check_permissions_policy(headers)
+        issues += self._check_coop(headers)
+        issues += self._check_coep(headers)
+        issues += self._check_corp(headers)
+
+        await self.update_progress(50, "정보 노출 헤더 검사 중...")
+        issues += self._check_info_disclosure(headers)
 
         await self.update_progress(60, "응답 시간 측정 중...")
         issues += await self._check_ttfb(url, metrics)
@@ -163,15 +196,24 @@ class PerformanceSecurityChecker(BaseChecker):
 
         return []
 
+    def _get_security_header_rule(self, rule_id: str) -> dict[str, Any]:
+        """Find a specific security header rule from YAML."""
+        for h in self._get_security_headers():
+            if h.get("id") == rule_id:
+                return h
+        return {}
+
     def _check_hsts(self, headers: dict) -> list[Issue]:
         """P-03: Check Strict-Transport-Security header."""
+        rule = self._get_security_header_rule("sec-strict-transport-security")
+        recommended = rule.get("details", {}).get("recommended_value", "max-age=31536000; includeSubDomains")
         hsts = self._get_header(headers, "Strict-Transport-Security")
         if not hsts:
             return [self._create_issue(
                 code="P-03",
                 severity="major",
                 message="Strict-Transport-Security(HSTS) 헤더가 설정되지 않았습니다",
-                suggestion="HSTS 헤더를 추가하세요: Strict-Transport-Security: max-age=31536000; includeSubDomains",
+                suggestion=f"HSTS 헤더를 추가하세요: Strict-Transport-Security: {recommended}",
             )]
         return []
 
@@ -225,13 +267,15 @@ class PerformanceSecurityChecker(BaseChecker):
 
     def _check_referrer_policy(self, headers: dict) -> list[Issue]:
         """P-08: Check Referrer-Policy header."""
+        rule = self._get_security_header_rule("sec-referrer-policy")
+        recommended = rule.get("details", {}).get("recommended_value", "strict-origin-when-cross-origin")
         rp = self._get_header(headers, "Referrer-Policy")
         if not rp:
             return [self._create_issue(
                 code="P-08",
                 severity="minor",
                 message="Referrer-Policy 헤더가 설정되지 않았습니다",
-                suggestion="Referrer-Policy: strict-origin-when-cross-origin을 설정하세요",
+                suggestion=f"Referrer-Policy: {recommended}을 설정하세요",
             )]
         return []
 
@@ -247,8 +291,69 @@ class PerformanceSecurityChecker(BaseChecker):
             )]
         return []
 
+    def _check_coop(self, headers: dict) -> list[Issue]:
+        """P-15: Check Cross-Origin-Opener-Policy header."""
+        rule = self._get_security_header_rule("sec-cross-origin-opener-policy")
+        recommended = rule.get("details", {}).get("recommended_value", "same-origin")
+        coop = self._get_header(headers, "Cross-Origin-Opener-Policy")
+        if not coop:
+            return [self._create_issue(
+                code="P-15",
+                severity="minor",
+                message="Cross-Origin-Opener-Policy(COOP) 헤더가 설정되지 않았습니다",
+                suggestion=f"COOP 헤더를 추가하세요: Cross-Origin-Opener-Policy: {recommended}",
+            )]
+        return []
+
+    def _check_coep(self, headers: dict) -> list[Issue]:
+        """P-16: Check Cross-Origin-Embedder-Policy header."""
+        rule = self._get_security_header_rule("sec-cross-origin-embedder-policy")
+        recommended = rule.get("details", {}).get("recommended_value", "require-corp")
+        coep = self._get_header(headers, "Cross-Origin-Embedder-Policy")
+        if not coep:
+            return [self._create_issue(
+                code="P-16",
+                severity="minor",
+                message="Cross-Origin-Embedder-Policy(COEP) 헤더가 설정되지 않았습니다",
+                suggestion=f"COEP 헤더를 추가하세요: Cross-Origin-Embedder-Policy: {recommended}",
+            )]
+        return []
+
+    def _check_corp(self, headers: dict) -> list[Issue]:
+        """P-17: Check Cross-Origin-Resource-Policy header."""
+        rule = self._get_security_header_rule("sec-cross-origin-resource-policy")
+        recommended = rule.get("details", {}).get("recommended_value", "same-site")
+        corp = self._get_header(headers, "Cross-Origin-Resource-Policy")
+        if not corp:
+            return [self._create_issue(
+                code="P-17",
+                severity="minor",
+                message="Cross-Origin-Resource-Policy(CORP) 헤더가 설정되지 않았습니다",
+                suggestion=f"CORP 헤더를 추가하세요: Cross-Origin-Resource-Policy: {recommended}",
+            )]
+        return []
+
+    def _check_info_disclosure(self, headers: dict) -> list[Issue]:
+        """P-18: Check for information disclosure headers (Server, X-Powered-By)."""
+        issues = []
+        for rule in self._get_headers_to_remove():
+            header_name = rule.get("details", {}).get("header", "")
+            value = self._get_header(headers, header_name)
+            if value:
+                issues.append(self._create_issue(
+                    code="P-18",
+                    severity="info",
+                    message=f"{header_name} 헤더가 서버 정보를 노출하고 있습니다: {value[:80]}",
+                    suggestion=f"{header_name} 헤더를 제거하여 서버 기술 스택 노출을 방지하세요",
+                ))
+        return issues
+
     async def _check_ttfb(self, url: str, metrics: dict) -> list[Issue]:
-        """P-10: Check Time To First Byte (TTFB)."""
+        """P-10: Check Time To First Byte (TTFB) using YAML thresholds."""
+        thresholds = self._get_ttfb_thresholds()
+        good_ms = thresholds.get("good", 800)
+        needs_improvement_ms = thresholds.get("needs_improvement", 1800)
+
         try:
             start = time.monotonic()
             async with httpx.AsyncClient(
@@ -262,18 +367,18 @@ class PerformanceSecurityChecker(BaseChecker):
                 ttfb_ms = round((time.monotonic() - start) * 1000)
                 metrics["ttfb_ms"] = ttfb_ms
 
-                if ttfb_ms > 2000:
+                if ttfb_ms > needs_improvement_ms:
                     return [self._create_issue(
                         code="P-10",
                         severity="major",
-                        message=f"응답 시간(TTFB)이 느립니다: {ttfb_ms}ms (권장 < 1000ms)",
+                        message=f"응답 시간(TTFB)이 느립니다: {ttfb_ms}ms (권장 < {good_ms}ms)",
                         suggestion="서버 응답 속도를 개선하세요 (캐싱, CDN, 서버 최적화)",
                     )]
-                elif ttfb_ms > 1000:
+                elif ttfb_ms > good_ms:
                     return [self._create_issue(
                         code="P-10",
                         severity="minor",
-                        message=f"응답 시간(TTFB)이 다소 느립니다: {ttfb_ms}ms (권장 < 1000ms)",
+                        message=f"응답 시간(TTFB)이 다소 느립니다: {ttfb_ms}ms (권장 < {good_ms}ms)",
                         suggestion="서버 응답 속도 개선을 고려하세요",
                     )]
         except Exception as e:
@@ -288,15 +393,19 @@ class PerformanceSecurityChecker(BaseChecker):
         return []
 
     def _check_page_size(self, html_content: str, metrics: dict) -> list[Issue]:
-        """P-11: Check HTML page size."""
+        """P-11: Check HTML page size using YAML thresholds."""
+        thresholds = self._get_page_size_thresholds()
+        poor_kb = thresholds.get("poor", 5000)
+        poor_bytes = poor_kb * 1024
+
         size_bytes = len(html_content.encode("utf-8"))
         metrics["page_size_bytes"] = size_bytes
 
-        if size_bytes > 3 * 1024 * 1024:  # 3MB
+        if size_bytes > poor_bytes:
             return [self._create_issue(
                 code="P-11",
                 severity="minor",
-                message=f"페이지 크기가 큽니다: {round(size_bytes / 1024 / 1024, 1)}MB (권장 < 3MB)",
+                message=f"페이지 크기가 큽니다: {round(size_bytes / 1024 / 1024, 1)}MB (권장 < {poor_kb // 1024}MB)",
                 suggestion="페이지 크기를 줄이세요 (불필요한 코드 제거, 이미지 최적화, 코드 분할)",
             )]
         return []
@@ -387,8 +496,9 @@ class PerformanceSecurityChecker(BaseChecker):
         https_ssl_score = max(0, https_ssl_score)
 
         # Security headers component (40% of security)
-        header_issues = [i for i in issues if i.code in ("P-03", "P-04", "P-05", "P-06", "P-07", "P-08", "P-09")]
+        header_codes = {"P-03", "P-04", "P-05", "P-06", "P-07", "P-08", "P-09", "P-15", "P-16", "P-17"}
-        total_header_checks = 7
+        header_issues = [i for i in issues if i.code in header_codes]
+        total_header_checks = len(header_codes)
         passed_headers = total_header_checks - len(header_issues)
         header_score = round(passed_headers / total_header_checks * 100) if total_header_checks else 100
 
@@ -398,13 +508,16 @@ class PerformanceSecurityChecker(BaseChecker):
         perf_score = 100
 
         # TTFB component (40% of performance)
+        ttfb_thresholds = self._get_ttfb_thresholds()
+        ttfb_good = ttfb_thresholds.get("good", 800)
+        ttfb_ni = ttfb_thresholds.get("needs_improvement", 1800)
         ttfb = metrics.get("ttfb_ms")
         if ttfb is not None:
-            if ttfb <= 500:
+            if ttfb <= ttfb_good // 2:
                 ttfb_score = 100
-            elif ttfb <= 1000:
+            elif ttfb <= ttfb_good:
                 ttfb_score = 80
-            elif ttfb <= 2000:
+            elif ttfb <= ttfb_ni:
                 ttfb_score = 60
             else:
                 ttfb_score = 30
@@ -412,12 +525,16 @@ class PerformanceSecurityChecker(BaseChecker):
             ttfb_score = 50
 
         # Page size component (30% of performance)
+        size_thresholds = self._get_page_size_thresholds()
+        good_kb = size_thresholds.get("good", 1500)
+        ni_kb = size_thresholds.get("needs_improvement", 3000)
+        poor_kb = size_thresholds.get("poor", 5000)
         page_size = metrics.get("page_size_bytes", 0)
-        if page_size <= 1024 * 1024:  # 1MB
+        if page_size <= good_kb * 1024:
             size_score = 100
-        elif page_size <= 2 * 1024 * 1024:  # 2MB
+        elif page_size <= ni_kb * 1024:
             size_score = 80
-        elif page_size <= 3 * 1024 * 1024:  # 3MB
+        elif page_size <= poor_kb * 1024:
             size_score = 60
         else:
             size_score = 30

backend/app/engines/seo.py

@@ -7,13 +7,14 @@ import re
 import json
 import logging
 from urllib.parse import urlparse, urljoin
-from typing import Optional
+from typing import Any, Optional
 
 import httpx
 from bs4 import BeautifulSoup
 
 from app.engines.base import BaseChecker
 from app.models.schemas import CategoryResult, Issue
+from app.rules import get_rules
 
 logger = logging.getLogger(__name__)
 
@@ -21,6 +22,23 @@ logger = logging.getLogger(__name__)
 class SeoChecker(BaseChecker):
     """SEO optimization checker engine."""
 
+    def __init__(self, **kwargs):
+        super().__init__(**kwargs)
+        self._rules_data = get_rules("seo")
+
+    def _get_seo_rule(self, rule_id: str) -> dict[str, Any]:
+        """Lookup a rule by id from YAML data."""
+        for rule in self._rules_data.get("rules", []):
+            if rule.get("id") == rule_id:
+                return rule
+        return {}
+
+    def _get_threshold(self, rule_id: str, key: str, default: Any = None) -> Any:
+        """Get a specific threshold from a rule's details."""
+        rule = self._get_seo_rule(rule_id)
+        details = rule.get("details", {})
+        return details.get(key, default)
+
     @property
     def category_name(self) -> str:
         return "seo"
@@ -73,9 +91,11 @@ class SeoChecker(BaseChecker):
         )
 
     def _check_title(self, soup: BeautifulSoup, meta_info: dict) -> list[Issue]:
-        """S-01: Check title tag existence and length (10-60 chars)."""
+        """S-01: Check title tag existence and length."""
         issues = []
         title = soup.find("title")
+        min_len = self._get_threshold("seo-title-tag", "min_length", 10)
+        max_len = self._get_threshold("seo-title-tag", "max_length", 60)
 
         if title is None or not title.string or title.string.strip() == "":
             meta_info["title"] = None
@@ -84,7 +104,7 @@ class SeoChecker(BaseChecker):
                 code="S-01",
                 severity="critical",
                 message="<title> 태그가 없거나 비어있습니다",
-                suggestion="검색 결과에 표시될 10-60자 길이의 페이지 제목을 설정하세요",
+                suggestion=f"검색 결과에 표시될 {min_len}-{max_len}자 길이의 페이지 제목을 설정하세요",
             ))
             return issues
 
@@ -93,28 +113,30 @@ class SeoChecker(BaseChecker):
         meta_info["title"] = title_text
         meta_info["title_length"] = title_len
 
-        if title_len < 10:
+        if title_len < min_len:
             issues.append(self._create_issue(
                 code="S-01",
                 severity="critical",
-                message=f"title이 너무 짧습니다 ({title_len}자, 권장 10-60자)",
+                message=f"title이 너무 짧습니다 ({title_len}자, 권장 {min_len}-{max_len}자)",
                 element=f"<title>{title_text}</title>",
-                suggestion="검색 결과에 효과적으로 표시되도록 10자 이상의 제목을 작성하세요",
+                suggestion=f"검색 결과에 효과적으로 표시되도록 {min_len}자 이상의 제목을 작성하세요",
             ))
-        elif title_len > 60:
+        elif title_len > max_len:
             issues.append(self._create_issue(
                 code="S-01",
                 severity="minor",
-                message=f"title이 너무 깁니다 ({title_len}자, 권장 10-60자)",
+                message=f"title이 너무 깁니다 ({title_len}자, 권장 {min_len}-{max_len}자)",
                 element=f"<title>{title_text[:50]}...</title>",
-                suggestion="검색 결과에서 잘리지 않도록 60자 이내로 제목을 줄이세요",
+                suggestion=f"검색 결과에서 잘리지 않도록 {max_len}자 이내로 제목을 줄이세요",
             ))
         return issues
 
     def _check_meta_description(self, soup: BeautifulSoup, meta_info: dict) -> list[Issue]:
-        """S-02: Check meta description existence and length (50-160 chars)."""
+        """S-02: Check meta description existence and length."""
         issues = []
         desc = soup.find("meta", attrs={"name": re.compile(r"^description$", re.I)})
+        min_len = self._get_threshold("seo-meta-description", "min_length", 50)
+        max_len = self._get_threshold("seo-meta-description", "max_length", 160)
 
         if desc is None or not desc.get("content"):
             meta_info["description"] = None
@@ -123,7 +145,7 @@ class SeoChecker(BaseChecker):
                 code="S-02",
                 severity="major",
                 message="meta description이 없습니다",
-                suggestion='<meta name="description" content="페이지 설명">을 추가하세요 (50-160자 권장)',
+                suggestion=f'<meta name="description" content="페이지 설명">을 추가하세요 ({min_len}-{max_len}자 권장)',
             ))
             return issues
 
@@ -132,19 +154,19 @@ class SeoChecker(BaseChecker):
         meta_info["description"] = content
         meta_info["description_length"] = content_len
 
-        if content_len < 50:
+        if content_len < min_len:
             issues.append(self._create_issue(
                 code="S-02",
                 severity="major",
-                message=f"meta description이 너무 짧습니다 ({content_len}자, 권장 50-160자)",
+                message=f"meta description이 너무 짧습니다 ({content_len}자, 권장 {min_len}-{max_len}자)",
-                suggestion="검색 결과에서 페이지를 효과적으로 설명하도록 50자 이상으로 작성하세요",
+                suggestion=f"검색 결과에서 페이지를 효과적으로 설명하도록 {min_len}자 이상으로 작성하세요",
             ))
-        elif content_len > 160:
+        elif content_len > max_len:
             issues.append(self._create_issue(
                 code="S-02",
                 severity="minor",
-                message=f"meta description이 너무 깁니다 ({content_len}자, 권장 50-160자)",
+                message=f"meta description이 너무 깁니다 ({content_len}자, 권장 {min_len}-{max_len}자)",
-                suggestion="검색 결과에서 잘리지 않도록 160자 이내로 줄이세요",
+                suggestion=f"검색 결과에서 잘리지 않도록 {max_len}자 이내로 줄이세요",
             ))
         return issues
 
@@ -163,9 +185,13 @@ class SeoChecker(BaseChecker):
         return []
 
     def _check_og_tags(self, soup: BeautifulSoup) -> list[Issue]:
-        """S-04: Check Open Graph tags (og:title, og:description, og:image)."""
+        """S-04: Check Open Graph tags from YAML rule definitions."""
         issues = []
-        required_og = ["og:title", "og:description", "og:image"]
+        rule = self._get_seo_rule("seo-open-graph")
+        required_tags = rule.get("details", {}).get("required_tags", [])
+        required_og = [t["property"] for t in required_tags] if required_tags else [
+            "og:title", "og:description", "og:image",
+        ]
         missing = []
 
         for prop in required_og:

backend/app/rules/__init__.py

@@ -0,0 +1,67 @@
+"""
+Rules Loader - YAML 기반 표준 규칙 데이터 로드 및 캐싱.
+
+Usage:
+    from app.rules import get_rules
+    rules = get_rules("html_css")      # html_css.yaml 전체 로드
+    rules = get_rules("accessibility")  # accessibility.yaml 전체 로드
+"""
+
+import logging
+from pathlib import Path
+from typing import Any
+
+import yaml
+
+logger = logging.getLogger(__name__)
+
+RULES_DIR = Path(__file__).parent
+_cache: dict[str, dict[str, Any]] = {}
+
+
+def get_rules(category: str) -> dict[str, Any]:
+    """
+    Load and cache YAML rules for a given category.
+
+    Args:
+        category: One of "html_css", "accessibility", "seo", "performance_security"
+
+    Returns:
+        Parsed YAML data as a dictionary.
+    """
+    if category in _cache:
+        return _cache[category]
+
+    yaml_path = RULES_DIR / f"{category}.yaml"
+    if not yaml_path.exists():
+        logger.error("Rules file not found: %s", yaml_path)
+        return {}
+
+    with open(yaml_path, "r", encoding="utf-8") as f:
+        data = yaml.safe_load(f) or {}
+
+    _cache[category] = data
+    logger.info("Loaded rules: %s (%d bytes)", category, yaml_path.stat().st_size)
+    return data
+
+
+def reload_rules(category: str | None = None) -> None:
+    """
+    Clear cache and reload rules.
+    If category is None, reload all cached rules.
+    """
+    if category:
+        _cache.pop(category, None)
+        get_rules(category)
+    else:
+        categories = list(_cache.keys())
+        _cache.clear()
+        for cat in categories:
+            get_rules(cat)
+
+
+def get_all_categories() -> list[str]:
+    """Return list of available rule categories."""
+    return [
+        p.stem for p in RULES_DIR.glob("*.yaml")
+    ]

backend/app/rules/accessibility.yaml

@@ -0,0 +1,830 @@
+# ============================================================
+# WCAG Accessibility Rules
+# Based on: W3C WCAG 2.0, 2.1, 2.2 + axe-core Rule Mapping
+# ============================================================
+
+metadata:
+  name: "WCAG Accessibility Standards"
+  version: "1.0.0"
+  last_updated: "2026-02-13"
+  sources:
+    - name: "Web Content Accessibility Guidelines (WCAG) 2.2"
+      url: "https://www.w3.org/TR/WCAG22/"
+      version: "2.2"
+      date: "2023-10-05"
+    - name: "Web Content Accessibility Guidelines (WCAG) 2.1"
+      url: "https://www.w3.org/TR/WCAG21/"
+      version: "2.1"
+      date: "2018-06-05"
+    - name: "Web Content Accessibility Guidelines (WCAG) 2.0"
+      url: "https://www.w3.org/TR/WCAG20/"
+      version: "2.0"
+      date: "2008-12-11"
+    - name: "axe-core Rule Descriptions"
+      url: "https://github.com/dequelabs/axe-core/blob/develop/doc/rule-descriptions.md"
+    - name: "axe-core API Documentation"
+      url: "https://www.deque.com/axe/core-documentation/api-documentation/"
+
+# ============================================================
+# axe-core Tag Mapping
+# These tags control which rules axe-core runs
+# IMPORTANT: Tags are NOT inclusive - wcag2aa only runs AA rules,
+# NOT A rules. Combine tags for full compliance testing.
+# ============================================================
+axe_core_tags:
+  wcag20:
+    - tag: "wcag2a"
+      description: "WCAG 2.0 Level A rules only"
+    - tag: "wcag2aa"
+      description: "WCAG 2.0 Level AA rules only"
+    - tag: "wcag2aaa"
+      description: "WCAG 2.0 Level AAA rules only"
+  wcag21:
+    - tag: "wcag21a"
+      description: "WCAG 2.1 Level A rules only (new in 2.1)"
+    - tag: "wcag21aa"
+      description: "WCAG 2.1 Level AA rules only (new in 2.1)"
+  wcag22:
+    - tag: "wcag22aa"
+      description: "WCAG 2.2 Level AA rules only (new in 2.2)"
+  other:
+    - tag: "best-practice"
+      description: "Common accessibility best practices (not WCAG-specific)"
+    - tag: "section508"
+      description: "Section 508 compliance rules"
+
+# Compliance presets (combine tags for full testing)
+compliance_presets:
+  wcag_20_a:
+    tags: ["wcag2a"]
+    description: "WCAG 2.0 Level A compliance"
+  wcag_20_aa:
+    tags: ["wcag2a", "wcag2aa"]
+    description: "WCAG 2.0 Level AA compliance"
+  wcag_21_aa:
+    tags: ["wcag2a", "wcag2aa", "wcag21a", "wcag21aa"]
+    description: "WCAG 2.1 Level AA compliance (most common requirement)"
+  wcag_22_aa:
+    tags: ["wcag2a", "wcag2aa", "wcag21a", "wcag21aa", "wcag22aa"]
+    description: "WCAG 2.2 Level AA compliance (latest standard)"
+  wcag_22_full:
+    tags: ["wcag2a", "wcag2aa", "wcag2aaa", "wcag21a", "wcag21aa", "wcag22aa"]
+    description: "WCAG 2.2 all levels including AAA"
+
+# ============================================================
+# WCAG 2.2 Complete Success Criteria
+# Total: 86 criteria (4.1.1 Parsing removed in 2.2)
+# Distribution: Level A (32), Level AA (24), Level AAA (30)
+# ============================================================
+
+principles:
+  # ========================================================
+  # Principle 1: PERCEIVABLE
+  # ========================================================
+  - id: "perceivable"
+    name: "Perceivable"
+    description: "Information and user interface components must be presentable to users in ways they can perceive"
+
+    guidelines:
+      # --- 1.1 Text Alternatives ---
+      - id: "1.1"
+        name: "Text Alternatives"
+        description: "Provide text alternatives for any non-text content"
+        criteria:
+          - id: "1.1.1"
+            name: "Non-text Content"
+            level: "A"
+            since: "2.0"
+            description: "All non-text content has a text alternative that serves the equivalent purpose"
+            axe_rules: ["image-alt", "input-image-alt", "area-alt", "object-alt", "svg-img-alt"]
+
+      # --- 1.2 Time-based Media ---
+      - id: "1.2"
+        name: "Time-based Media"
+        description: "Provide alternatives for time-based media"
+        criteria:
+          - id: "1.2.1"
+            name: "Audio-only and Video-only (Prerecorded)"
+            level: "A"
+            since: "2.0"
+            description: "An alternative is provided for prerecorded audio-only and video-only media"
+            axe_rules: ["audio-caption", "video-caption"]
+
+          - id: "1.2.2"
+            name: "Captions (Prerecorded)"
+            level: "A"
+            since: "2.0"
+            description: "Captions are provided for all prerecorded audio content in synchronized media"
+            axe_rules: ["video-caption"]
+
+          - id: "1.2.3"
+            name: "Audio Description or Media Alternative (Prerecorded)"
+            level: "A"
+            since: "2.0"
+            description: "An alternative for time-based media or audio description is provided"
+            axe_rules: ["video-description"]
+
+          - id: "1.2.4"
+            name: "Captions (Live)"
+            level: "AA"
+            since: "2.0"
+            description: "Captions are provided for all live audio content in synchronized media"
+
+          - id: "1.2.5"
+            name: "Audio Description (Prerecorded)"
+            level: "AA"
+            since: "2.0"
+            description: "Audio description is provided for all prerecorded video content"
+
+          - id: "1.2.6"
+            name: "Sign Language (Prerecorded)"
+            level: "AAA"
+            since: "2.0"
+            description: "Sign language interpretation is provided for prerecorded audio"
+
+          - id: "1.2.7"
+            name: "Extended Audio Description (Prerecorded)"
+            level: "AAA"
+            since: "2.0"
+            description: "Extended audio description is provided when pauses are insufficient"
+
+          - id: "1.2.8"
+            name: "Media Alternative (Prerecorded)"
+            level: "AAA"
+            since: "2.0"
+            description: "A text alternative is provided for all prerecorded synchronized media"
+
+          - id: "1.2.9"
+            name: "Audio-only (Live)"
+            level: "AAA"
+            since: "2.0"
+            description: "A text alternative is provided for live audio-only content"
+
+      # --- 1.3 Adaptable ---
+      - id: "1.3"
+        name: "Adaptable"
+        description: "Create content that can be presented in different ways without losing information"
+        criteria:
+          - id: "1.3.1"
+            name: "Info and Relationships"
+            level: "A"
+            since: "2.0"
+            description: "Information, structure, and relationships can be programmatically determined"
+            axe_rules: ["aria-required-parent", "aria-required-children", "definition-list", "dlitem", "list", "listitem", "th-has-data-cells", "td-headers-attr", "p-as-heading"]
+
+          - id: "1.3.2"
+            name: "Meaningful Sequence"
+            level: "A"
+            since: "2.0"
+            description: "Correct reading sequence can be programmatically determined"
+
+          - id: "1.3.3"
+            name: "Sensory Characteristics"
+            level: "A"
+            since: "2.0"
+            description: "Instructions do not rely solely on sensory characteristics"
+
+          - id: "1.3.4"
+            name: "Orientation"
+            level: "AA"
+            since: "2.1"
+            description: "Content does not restrict viewing to a single display orientation"
+
+          - id: "1.3.5"
+            name: "Identify Input Purpose"
+            level: "AA"
+            since: "2.1"
+            description: "Input field purpose can be programmatically determined"
+            axe_rules: ["autocomplete-valid"]
+
+          - id: "1.3.6"
+            name: "Identify Purpose"
+            level: "AAA"
+            since: "2.1"
+            description: "The purpose of UI components, icons, and regions can be programmatically determined"
+
+      # --- 1.4 Distinguishable ---
+      - id: "1.4"
+        name: "Distinguishable"
+        description: "Make it easier for users to see and hear content"
+        criteria:
+          - id: "1.4.1"
+            name: "Use of Color"
+            level: "A"
+            since: "2.0"
+            description: "Color is not the only visual means of conveying information"
+            axe_rules: ["link-in-text-block"]
+
+          - id: "1.4.2"
+            name: "Audio Control"
+            level: "A"
+            since: "2.0"
+            description: "Mechanism to pause/stop/control volume of auto-playing audio"
+            axe_rules: ["no-autoplay-audio"]
+
+          - id: "1.4.3"
+            name: "Contrast (Minimum)"
+            level: "AA"
+            since: "2.0"
+            description: "Text has contrast ratio of at least 4.5:1 (3:1 for large text)"
+            axe_rules: ["color-contrast"]
+
+          - id: "1.4.4"
+            name: "Resize Text"
+            level: "AA"
+            since: "2.0"
+            description: "Text can be resized up to 200% without loss of content or functionality"
+            axe_rules: ["meta-viewport-large"]
+
+          - id: "1.4.5"
+            name: "Images of Text"
+            level: "AA"
+            since: "2.0"
+            description: "Text is used instead of images of text where possible"
+
+          - id: "1.4.6"
+            name: "Contrast (Enhanced)"
+            level: "AAA"
+            since: "2.0"
+            description: "Text has contrast ratio of at least 7:1 (4.5:1 for large text)"
+            axe_rules: ["color-contrast-enhanced"]
+
+          - id: "1.4.7"
+            name: "Low or No Background Audio"
+            level: "AAA"
+            since: "2.0"
+            description: "Prerecorded speech audio has low or no background noise"
+
+          - id: "1.4.8"
+            name: "Visual Presentation"
+            level: "AAA"
+            since: "2.0"
+            description: "Text blocks have configurable visual presentation"
+
+          - id: "1.4.9"
+            name: "Images of Text (No Exception)"
+            level: "AAA"
+            since: "2.0"
+            description: "Images of text are only used for pure decoration or essential cases"
+
+          - id: "1.4.10"
+            name: "Reflow"
+            level: "AA"
+            since: "2.1"
+            description: "Content can reflow without scrolling in two dimensions at 320px/256px"
+
+          - id: "1.4.11"
+            name: "Non-text Contrast"
+            level: "AA"
+            since: "2.1"
+            description: "UI components and graphics have contrast ratio of at least 3:1"
+
+          - id: "1.4.12"
+            name: "Text Spacing"
+            level: "AA"
+            since: "2.1"
+            description: "Content adapts to specified text spacing without loss"
+
+          - id: "1.4.13"
+            name: "Content on Hover or Focus"
+            level: "AA"
+            since: "2.1"
+            description: "Hoverable/focusable additional content is dismissible, hoverable, persistent"
+
+  # ========================================================
+  # Principle 2: OPERABLE
+  # ========================================================
+  - id: "operable"
+    name: "Operable"
+    description: "User interface components and navigation must be operable"
+
+    guidelines:
+      # --- 2.1 Keyboard Accessible ---
+      - id: "2.1"
+        name: "Keyboard Accessible"
+        description: "Make all functionality available from a keyboard"
+        criteria:
+          - id: "2.1.1"
+            name: "Keyboard"
+            level: "A"
+            since: "2.0"
+            description: "All functionality is operable through a keyboard interface"
+            axe_rules: ["scrollable-region-focusable"]
+
+          - id: "2.1.2"
+            name: "No Keyboard Trap"
+            level: "A"
+            since: "2.0"
+            description: "Keyboard focus can be moved away from any component"
+
+          - id: "2.1.3"
+            name: "Keyboard (No Exception)"
+            level: "AAA"
+            since: "2.0"
+            description: "All functionality is operable through keyboard without exception"
+
+          - id: "2.1.4"
+            name: "Character Key Shortcuts"
+            level: "A"
+            since: "2.1"
+            description: "Single character key shortcuts can be turned off or remapped"
+            axe_rules: ["accesskeys"]
+
+      # --- 2.2 Enough Time ---
+      - id: "2.2"
+        name: "Enough Time"
+        description: "Provide users enough time to read and use content"
+        criteria:
+          - id: "2.2.1"
+            name: "Timing Adjustable"
+            level: "A"
+            since: "2.0"
+            description: "Time limits can be turned off, adjusted, or extended"
+            axe_rules: ["meta-refresh"]
+
+          - id: "2.2.2"
+            name: "Pause, Stop, Hide"
+            level: "A"
+            since: "2.0"
+            description: "Moving, blinking, scrolling, or auto-updating content can be controlled"
+            axe_rules: ["blink", "marquee"]
+
+          - id: "2.2.3"
+            name: "No Timing"
+            level: "AAA"
+            since: "2.0"
+            description: "Timing is not an essential part of the activity"
+
+          - id: "2.2.4"
+            name: "Interruptions"
+            level: "AAA"
+            since: "2.0"
+            description: "Interruptions can be postponed or suppressed"
+
+          - id: "2.2.5"
+            name: "Re-authenticating"
+            level: "AAA"
+            since: "2.0"
+            description: "Data is preserved when re-authenticating after session expiry"
+
+          - id: "2.2.6"
+            name: "Timeouts"
+            level: "AAA"
+            since: "2.1"
+            description: "Users are warned about data loss from inactivity timeouts"
+
+      # --- 2.3 Seizures and Physical Reactions ---
+      - id: "2.3"
+        name: "Seizures and Physical Reactions"
+        description: "Do not design content that causes seizures or physical reactions"
+        criteria:
+          - id: "2.3.1"
+            name: "Three Flashes or Below Threshold"
+            level: "A"
+            since: "2.0"
+            description: "Pages do not contain content that flashes more than three times per second"
+
+          - id: "2.3.2"
+            name: "Three Flashes"
+            level: "AAA"
+            since: "2.0"
+            description: "Pages do not contain any content that flashes more than three times per second"
+
+          - id: "2.3.3"
+            name: "Animation from Interactions"
+            level: "AAA"
+            since: "2.1"
+            description: "Motion animation triggered by interaction can be disabled"
+
+      # --- 2.4 Navigable ---
+      - id: "2.4"
+        name: "Navigable"
+        description: "Provide ways to help users navigate, find content, and determine where they are"
+        criteria:
+          - id: "2.4.1"
+            name: "Bypass Blocks"
+            level: "A"
+            since: "2.0"
+            description: "Mechanism available to bypass blocks of content repeated on pages"
+            axe_rules: ["bypass", "region"]
+
+          - id: "2.4.2"
+            name: "Page Titled"
+            level: "A"
+            since: "2.0"
+            description: "Web pages have titles that describe topic or purpose"
+            axe_rules: ["document-title"]
+
+          - id: "2.4.3"
+            name: "Focus Order"
+            level: "A"
+            since: "2.0"
+            description: "Focus order preserves meaning and operability"
+            axe_rules: ["tabindex"]
+
+          - id: "2.4.4"
+            name: "Link Purpose (In Context)"
+            level: "A"
+            since: "2.0"
+            description: "Link purpose can be determined from link text or context"
+            axe_rules: ["link-name"]
+
+          - id: "2.4.5"
+            name: "Multiple Ways"
+            level: "AA"
+            since: "2.0"
+            description: "More than one way available to locate a page in a set"
+
+          - id: "2.4.6"
+            name: "Headings and Labels"
+            level: "AA"
+            since: "2.0"
+            description: "Headings and labels describe topic or purpose"
+            axe_rules: ["empty-heading"]
+
+          - id: "2.4.7"
+            name: "Focus Visible"
+            level: "AA"
+            since: "2.0"
+            description: "Keyboard focus indicator is visible"
+
+          - id: "2.4.8"
+            name: "Location"
+            level: "AAA"
+            since: "2.0"
+            description: "Information about the user's location within a set of pages is available"
+
+          - id: "2.4.9"
+            name: "Link Purpose (Link Only)"
+            level: "AAA"
+            since: "2.0"
+            description: "Link purpose can be determined from link text alone"
+
+          - id: "2.4.10"
+            name: "Section Headings"
+            level: "AAA"
+            since: "2.0"
+            description: "Section headings are used to organize content"
+
+          - id: "2.4.11"
+            name: "Focus Not Obscured (Minimum)"
+            level: "AA"
+            since: "2.2"
+            description: "Focused component is not entirely hidden by author-created content"
+
+          - id: "2.4.12"
+            name: "Focus Not Obscured (Enhanced)"
+            level: "AAA"
+            since: "2.2"
+            description: "No part of the focused component is hidden by author-created content"
+
+          - id: "2.4.13"
+            name: "Focus Appearance"
+            level: "AAA"
+            since: "2.2"
+            description: "Focus indicator meets minimum area and contrast requirements"
+
+      # --- 2.5 Input Modalities ---
+      - id: "2.5"
+        name: "Input Modalities"
+        description: "Make it easier to operate through various inputs beyond keyboard"
+        criteria:
+          - id: "2.5.1"
+            name: "Pointer Gestures"
+            level: "A"
+            since: "2.1"
+            description: "Multipoint/path-based gestures have single-pointer alternatives"
+
+          - id: "2.5.2"
+            name: "Pointer Cancellation"
+            level: "A"
+            since: "2.1"
+            description: "Functions using single pointer can be cancelled"
+
+          - id: "2.5.3"
+            name: "Label in Name"
+            level: "A"
+            since: "2.1"
+            description: "Visible label is part of the accessible name"
+            axe_rules: ["label-title-only"]
+
+          - id: "2.5.4"
+            name: "Motion Actuation"
+            level: "A"
+            since: "2.1"
+            description: "Motion-activated functions have UI alternatives and can be disabled"
+
+          - id: "2.5.5"
+            name: "Target Size (Enhanced)"
+            level: "AAA"
+            since: "2.1"
+            description: "Target size is at least 44 by 44 CSS pixels"
+
+          - id: "2.5.6"
+            name: "Concurrent Input Mechanisms"
+            level: "A"
+            since: "2.1"
+            description: "Content does not restrict use of available input modalities"
+
+          - id: "2.5.7"
+            name: "Dragging Movements"
+            level: "AA"
+            since: "2.2"
+            description: "Drag functions have single-pointer alternatives"
+
+          - id: "2.5.8"
+            name: "Target Size (Minimum)"
+            level: "AA"
+            since: "2.2"
+            description: "Target size is at least 24 by 24 CSS pixels"
+            axe_rules: ["target-size"]
+
+  # ========================================================
+  # Principle 3: UNDERSTANDABLE
+  # ========================================================
+  - id: "understandable"
+    name: "Understandable"
+    description: "Information and the operation of user interface must be understandable"
+
+    guidelines:
+      # --- 3.1 Readable ---
+      - id: "3.1"
+        name: "Readable"
+        description: "Make text content readable and understandable"
+        criteria:
+          - id: "3.1.1"
+            name: "Language of Page"
+            level: "A"
+            since: "2.0"
+            description: "Default human language of each page can be programmatically determined"
+            axe_rules: ["html-has-lang", "html-lang-valid"]
+
+          - id: "3.1.2"
+            name: "Language of Parts"
+            level: "AA"
+            since: "2.0"
+            description: "Language of each passage or phrase can be programmatically determined"
+            axe_rules: ["valid-lang"]
+
+          - id: "3.1.3"
+            name: "Unusual Words"
+            level: "AAA"
+            since: "2.0"
+            description: "Mechanism is available for unusual words or jargon"
+
+          - id: "3.1.4"
+            name: "Abbreviations"
+            level: "AAA"
+            since: "2.0"
+            description: "Mechanism for identifying expanded form of abbreviations"
+
+          - id: "3.1.5"
+            name: "Reading Level"
+            level: "AAA"
+            since: "2.0"
+            description: "Supplemental content for text beyond lower secondary education level"
+
+          - id: "3.1.6"
+            name: "Pronunciation"
+            level: "AAA"
+            since: "2.0"
+            description: "Mechanism for identifying pronunciation of ambiguous words"
+
+      # --- 3.2 Predictable ---
+      - id: "3.2"
+        name: "Predictable"
+        description: "Make web pages appear and operate in predictable ways"
+        criteria:
+          - id: "3.2.1"
+            name: "On Focus"
+            level: "A"
+            since: "2.0"
+            description: "Receiving focus does not initiate a change of context"
+
+          - id: "3.2.2"
+            name: "On Input"
+            level: "A"
+            since: "2.0"
+            description: "Changing a UI component setting does not automatically cause a change of context"
+
+          - id: "3.2.3"
+            name: "Consistent Navigation"
+            level: "AA"
+            since: "2.0"
+            description: "Navigation repeated on pages occurs in the same relative order"
+
+          - id: "3.2.4"
+            name: "Consistent Identification"
+            level: "AA"
+            since: "2.0"
+            description: "Components with the same functionality are identified consistently"
+
+          - id: "3.2.5"
+            name: "Change on Request"
+            level: "AAA"
+            since: "2.0"
+            description: "Changes of context are initiated only by user request"
+
+          - id: "3.2.6"
+            name: "Consistent Help"
+            level: "A"
+            since: "2.2"
+            description: "Help mechanisms occur in the same relative order across pages"
+
+      # --- 3.3 Input Assistance ---
+      - id: "3.3"
+        name: "Input Assistance"
+        description: "Help users avoid and correct mistakes"
+        criteria:
+          - id: "3.3.1"
+            name: "Error Identification"
+            level: "A"
+            since: "2.0"
+            description: "Input errors are automatically detected and described to the user"
+            axe_rules: ["aria-input-field-name"]
+
+          - id: "3.3.2"
+            name: "Labels or Instructions"
+            level: "A"
+            since: "2.0"
+            description: "Labels or instructions are provided when content requires user input"
+            axe_rules: ["label", "input-button-name", "select-name"]
+
+          - id: "3.3.3"
+            name: "Error Suggestion"
+            level: "AA"
+            since: "2.0"
+            description: "Error suggestions are provided when errors are detected and suggestions are known"
+
+          - id: "3.3.4"
+            name: "Error Prevention (Legal, Financial, Data)"
+            level: "AA"
+            since: "2.0"
+            description: "Submissions are reversible, checked, or confirmed for legal/financial/data"
+
+          - id: "3.3.5"
+            name: "Help"
+            level: "AAA"
+            since: "2.0"
+            description: "Context-sensitive help is available"
+
+          - id: "3.3.6"
+            name: "Error Prevention (All)"
+            level: "AAA"
+            since: "2.0"
+            description: "Submissions are reversible, checked, or confirmed for all user input"
+
+          - id: "3.3.7"
+            name: "Redundant Entry"
+            level: "A"
+            since: "2.2"
+            description: "Previously entered information is auto-populated or available for selection"
+
+          - id: "3.3.8"
+            name: "Accessible Authentication (Minimum)"
+            level: "AA"
+            since: "2.2"
+            description: "Cognitive function test is not required for authentication"
+
+          - id: "3.3.9"
+            name: "Accessible Authentication (Enhanced)"
+            level: "AAA"
+            since: "2.2"
+            description: "No cognitive function test is required for authentication (no exceptions)"
+
+  # ========================================================
+  # Principle 4: ROBUST
+  # ========================================================
+  - id: "robust"
+    name: "Robust"
+    description: "Content must be robust enough to be interpreted by a wide variety of user agents"
+
+    guidelines:
+      # --- 4.1 Compatible ---
+      - id: "4.1"
+        name: "Compatible"
+        description: "Maximize compatibility with current and future user agents"
+        criteria:
+          # Note: 4.1.1 Parsing was REMOVED in WCAG 2.2
+          # It was deemed obsolete as modern browsers handle parsing errors gracefully
+
+          - id: "4.1.2"
+            name: "Name, Role, Value"
+            level: "A"
+            since: "2.0"
+            description: "Name, role, and value of all UI components can be programmatically determined"
+            axe_rules: ["aria-allowed-attr", "aria-allowed-role", "aria-hidden-body", "aria-hidden-focus", "aria-roles", "aria-valid-attr", "aria-valid-attr-value", "button-name", "frame-title", "image-alt", "input-button-name", "input-image-alt", "label", "link-name", "select-name"]
+
+          - id: "4.1.3"
+            name: "Status Messages"
+            level: "AA"
+            since: "2.1"
+            description: "Status messages can be programmatically determined without receiving focus"
+            axe_rules: ["aria-progressbar-name"]
+
+# ============================================================
+# Version Diff Summary
+# What's new in each version
+# ============================================================
+version_diff:
+  removed_in_22:
+    - id: "4.1.1"
+      name: "Parsing"
+      reason: "Modern browsers handle parsing errors; criterion was obsolete"
+
+  new_in_21:
+    level_a:
+      - "1.3.4 Orientation"  # Note: Listed as A in some sources, AA in W3C spec
+      - "2.1.4 Character Key Shortcuts"
+      - "2.5.1 Pointer Gestures"
+      - "2.5.2 Pointer Cancellation"
+      - "2.5.3 Label in Name"
+      - "2.5.4 Motion Actuation"
+      - "2.5.6 Concurrent Input Mechanisms"
+    level_aa:
+      - "1.3.4 Orientation"
+      - "1.3.5 Identify Input Purpose"
+      - "1.4.10 Reflow"
+      - "1.4.11 Non-text Contrast"
+      - "1.4.12 Text Spacing"
+      - "1.4.13 Content on Hover or Focus"
+    level_aaa:
+      - "1.3.6 Identify Purpose"
+      - "2.2.6 Timeouts"
+      - "2.3.3 Animation from Interactions"
+      - "2.5.5 Target Size (Enhanced)"
+
+  new_in_22:
+    level_a:
+      - "3.2.6 Consistent Help"
+      - "3.3.7 Redundant Entry"
+    level_aa:
+      - "2.4.11 Focus Not Obscured (Minimum)"
+      - "2.5.7 Dragging Movements"
+      - "2.5.8 Target Size (Minimum)"
+      - "3.3.8 Accessible Authentication (Minimum)"
+    level_aaa:
+      - "2.4.12 Focus Not Obscured (Enhanced)"
+      - "2.4.13 Focus Appearance"
+      - "3.3.9 Accessible Authentication (Enhanced)"
+
+# ============================================================
+# Additional axe-core Best Practice Rules
+# (Not mapped to specific WCAG criteria but recommended)
+# ============================================================
+best_practices:
+  - id: "landmark-one-main"
+    description: "Document should have one main landmark"
+    severity: "major"
+
+  - id: "landmark-complementary-is-top-level"
+    description: "Aside/complementary should be top-level"
+    severity: "minor"
+
+  - id: "landmark-no-duplicate-banner"
+    description: "Document should have at most one banner landmark"
+    severity: "major"
+
+  - id: "landmark-no-duplicate-contentinfo"
+    description: "Document should have at most one contentinfo landmark"
+    severity: "major"
+
+  - id: "landmark-no-duplicate-main"
+    description: "Document should have at most one main landmark"
+    severity: "major"
+
+  - id: "page-has-heading-one"
+    description: "Page should contain a level-one heading"
+    severity: "major"
+
+  - id: "heading-order"
+    description: "Heading levels should increase by one"
+    severity: "minor"
+
+  - id: "scope-attr-valid"
+    description: "scope attribute should be used correctly"
+    severity: "minor"
+
+  - id: "skip-link"
+    description: "Skip navigation link should be provided"
+    severity: "minor"
+
+  - id: "tabindex"
+    description: "Tabindex should not be greater than zero"
+    severity: "major"
+
+  - id: "duplicate-id-active"
+    description: "Active elements should not have duplicate IDs"
+    severity: "critical"
+
+  - id: "duplicate-id-aria"
+    description: "ARIA IDs should be unique"
+    severity: "critical"
+
+  - id: "frame-tested"
+    description: "Frames should be tested with axe-core"
+    severity: "minor"
+
+  - id: "aria-text"
+    description: "Elements with role=text should have no focusable descendants"
+    severity: "minor"

backend/app/rules/html_css.yaml

@@ -0,0 +1,821 @@
+# ============================================================
+# HTML/CSS Web Standards Rules
+# Based on: W3C HTML Living Standard (WHATWG), CSS Specifications
+# ============================================================
+
+metadata:
+  name: "HTML/CSS Web Standards"
+  version: "1.0.0"
+  last_updated: "2026-02-13"
+  sources:
+    - name: "HTML Living Standard (WHATWG)"
+      url: "https://html.spec.whatwg.org/multipage/"
+      section: "16 Obsolete features"
+    - name: "HTML Living Standard - Obsolete Features"
+      url: "https://html.spec.whatwg.org/multipage/obsolete.html"
+    - name: "MDN Web Docs - HTML Elements Reference"
+      url: "https://developer.mozilla.org/en-US/docs/Web/HTML/Element"
+    - name: "W3C CSS Specifications"
+      url: "https://www.w3.org/Style/CSS/"
+
+# ============================================================
+# 1. Obsolete (Non-Conforming) HTML Elements
+# Source: HTML Living Standard Section 16
+# ============================================================
+obsolete_elements:
+  # --- Entirely Obsolete (must not be used) ---
+  - tag: "applet"
+    replacement: "embed or object"
+    reason: "Outdated plugin technology (Java applets)"
+    severity: "critical"
+
+  - tag: "acronym"
+    replacement: "abbr"
+    reason: "Redundant; abbr covers both abbreviations and acronyms"
+    severity: "major"
+
+  - tag: "bgsound"
+    replacement: "audio"
+    reason: "Proprietary (IE-only) audio element"
+    severity: "critical"
+
+  - tag: "dir"
+    replacement: "ul"
+    reason: "Non-standard directory list"
+    severity: "major"
+
+  - tag: "frame"
+    replacement: "iframe with CSS, or server-side includes"
+    reason: "Frame-based layouts are obsolete"
+    severity: "critical"
+
+  - tag: "frameset"
+    replacement: "iframe with CSS, or server-side includes"
+    reason: "Frame-based layouts are obsolete"
+    severity: "critical"
+
+  - tag: "noframes"
+    replacement: "N/A (remove with frame/frameset)"
+    reason: "Related to obsolete frames"
+    severity: "major"
+
+  - tag: "isindex"
+    replacement: "form with input[type=text]"
+    reason: "Outdated form method"
+    severity: "critical"
+
+  - tag: "keygen"
+    replacement: "Web Cryptography API"
+    reason: "Certificate enrollment; use Web Crypto API"
+    severity: "major"
+
+  - tag: "listing"
+    replacement: "pre + code"
+    reason: "Obsolete code presentation element"
+    severity: "major"
+
+  - tag: "menuitem"
+    replacement: "Script handling contextmenu event"
+    reason: "Context menu item (never widely supported)"
+    severity: "minor"
+
+  - tag: "nextid"
+    replacement: "GUIDs or UUIDs"
+    reason: "Obsolete identifier generation"
+    severity: "minor"
+
+  - tag: "noembed"
+    replacement: "object instead of embed"
+    reason: "Fallback for embed; use object element"
+    severity: "minor"
+
+  - tag: "param"
+    replacement: "data attribute on object"
+    reason: "Object parameter passing"
+    severity: "minor"
+
+  - tag: "plaintext"
+    replacement: "MIME type text/plain"
+    reason: "Obsolete text rendering mode"
+    severity: "major"
+
+  - tag: "rb"
+    replacement: "ruby element directly"
+    reason: "Ruby base text (use ruby directly)"
+    severity: "minor"
+
+  - tag: "rtc"
+    replacement: "Nested ruby elements"
+    reason: "Ruby text container (use nested ruby)"
+    severity: "minor"
+
+  - tag: "strike"
+    replacement: "del (edits) or s (no longer relevant)"
+    reason: "Presentational strikethrough"
+    severity: "major"
+
+  - tag: "xmp"
+    replacement: "pre + code with escaped entities"
+    reason: "Obsolete code display element"
+    severity: "major"
+
+  # --- Presentational Elements (use CSS instead) ---
+  - tag: "basefont"
+    replacement: "CSS font properties"
+    reason: "Base font styling (presentational)"
+    severity: "critical"
+
+  - tag: "big"
+    replacement: "CSS font-size or semantic elements (h1-h6, strong, mark)"
+    reason: "Presentational text sizing"
+    severity: "major"
+
+  - tag: "blink"
+    replacement: "CSS animations/transitions"
+    reason: "Presentational text animation"
+    severity: "critical"
+
+  - tag: "center"
+    replacement: "CSS text-align or margin auto"
+    reason: "Presentational centering"
+    severity: "major"
+
+  - tag: "font"
+    replacement: "CSS font properties"
+    reason: "Presentational font styling"
+    severity: "critical"
+
+  - tag: "marquee"
+    replacement: "CSS animations/transitions"
+    reason: "Presentational scrolling text"
+    severity: "critical"
+
+  - tag: "multicol"
+    replacement: "CSS columns"
+    reason: "Presentational multi-column layout"
+    severity: "major"
+
+  - tag: "nobr"
+    replacement: "CSS white-space: nowrap"
+    reason: "Presentational no-break text"
+    severity: "minor"
+
+  - tag: "spacer"
+    replacement: "CSS margin/padding"
+    reason: "Presentational spacing"
+    severity: "major"
+
+  - tag: "tt"
+    replacement: "kbd, var, code, or samp (context-dependent)"
+    reason: "Presentational monospace text"
+    severity: "major"
+
+# ============================================================
+# 2. Obsolete HTML Attributes
+# Source: HTML Living Standard Section 16
+# ============================================================
+obsolete_attributes:
+  # --- Global Attributes ---
+  global:
+    - attr: "contextmenu"
+      replacement: "Script for contextmenu event"
+      severity: "minor"
+    - attr: "datasrc"
+      replacement: "XMLHttpRequest / Fetch API"
+      severity: "minor"
+    - attr: "datafld"
+      replacement: "XMLHttpRequest / Fetch API"
+      severity: "minor"
+    - attr: "dataformatas"
+      replacement: "XMLHttpRequest / Fetch API"
+      severity: "minor"
+    - attr: "dropzone"
+      replacement: "Script for drag/drop events"
+      severity: "minor"
+
+  # --- Element-Specific Attributes ---
+  a:
+    - attr: "charset"
+      replacement: "HTTP Content-Type header"
+      severity: "minor"
+    - attr: "coords"
+      replacement: "area element for image maps"
+      severity: "minor"
+    - attr: "shape"
+      replacement: "area element for image maps"
+      severity: "minor"
+    - attr: "methods"
+      replacement: "HTTP OPTIONS"
+      severity: "minor"
+    - attr: "name"
+      replacement: "id attribute"
+      severity: "major"
+    - attr: "rev"
+      replacement: "rel with opposite term"
+      severity: "minor"
+    - attr: "urn"
+      replacement: "href attribute"
+      severity: "minor"
+
+  body:
+    - attr: "alink"
+      replacement: "CSS :active pseudo-class"
+      severity: "major"
+    - attr: "bgcolor"
+      replacement: "CSS background-color"
+      severity: "major"
+    - attr: "bottommargin"
+      replacement: "CSS margin-bottom"
+      severity: "major"
+    - attr: "leftmargin"
+      replacement: "CSS margin-left"
+      severity: "major"
+    - attr: "link"
+      replacement: "CSS color for links"
+      severity: "major"
+    - attr: "marginheight"
+      replacement: "CSS margin"
+      severity: "major"
+    - attr: "marginwidth"
+      replacement: "CSS margin"
+      severity: "major"
+    - attr: "rightmargin"
+      replacement: "CSS margin-right"
+      severity: "major"
+    - attr: "text"
+      replacement: "CSS color"
+      severity: "major"
+    - attr: "topmargin"
+      replacement: "CSS margin-top"
+      severity: "major"
+    - attr: "vlink"
+      replacement: "CSS :visited pseudo-class"
+      severity: "major"
+
+  br:
+    - attr: "clear"
+      replacement: "CSS clear property"
+      severity: "minor"
+
+  form:
+    - attr: "accept"
+      replacement: "accept attribute on individual input elements"
+      severity: "minor"
+
+  head:
+    - attr: "profile"
+      replacement: "Omit (unnecessary)"
+      severity: "minor"
+
+  hr:
+    - attr: "align"
+      replacement: "CSS margin"
+      severity: "minor"
+    - attr: "color"
+      replacement: "CSS border-color / background-color"
+      severity: "minor"
+    - attr: "noshade"
+      replacement: "CSS border/background"
+      severity: "minor"
+    - attr: "size"
+      replacement: "CSS height"
+      severity: "minor"
+    - attr: "width"
+      replacement: "CSS width"
+      severity: "minor"
+
+  html:
+    - attr: "manifest"
+      replacement: "Service Workers"
+      severity: "major"
+    - attr: "version"
+      replacement: "Omit (unnecessary)"
+      severity: "minor"
+
+  iframe:
+    - attr: "align"
+      replacement: "CSS"
+      severity: "minor"
+    - attr: "allowtransparency"
+      replacement: "CSS"
+      severity: "minor"
+    - attr: "frameborder"
+      replacement: "CSS border"
+      severity: "minor"
+    - attr: "framespacing"
+      replacement: "CSS"
+      severity: "minor"
+    - attr: "hspace"
+      replacement: "CSS margin"
+      severity: "minor"
+    - attr: "longdesc"
+      replacement: "Link to description page"
+      severity: "minor"
+    - attr: "marginheight"
+      replacement: "CSS padding"
+      severity: "minor"
+    - attr: "marginwidth"
+      replacement: "CSS padding"
+      severity: "minor"
+    - attr: "scrolling"
+      replacement: "CSS overflow"
+      severity: "minor"
+    - attr: "vspace"
+      replacement: "CSS margin"
+      severity: "minor"
+
+  img:
+    - attr: "align"
+      replacement: "CSS float or vertical-align"
+      severity: "minor"
+    - attr: "border"
+      replacement: "CSS border"
+      severity: "major"
+    - attr: "hspace"
+      replacement: "CSS margin"
+      severity: "minor"
+    - attr: "lowsrc"
+      replacement: "Progressive JPEG or srcset"
+      severity: "minor"
+    - attr: "name"
+      replacement: "id attribute"
+      severity: "minor"
+    - attr: "vspace"
+      replacement: "CSS margin"
+      severity: "minor"
+
+  input:
+    - attr: "align"
+      replacement: "CSS"
+      severity: "minor"
+    - attr: "border"
+      replacement: "CSS border"
+      severity: "minor"
+    - attr: "hspace"
+      replacement: "CSS margin"
+      severity: "minor"
+    - attr: "vspace"
+      replacement: "CSS margin"
+      severity: "minor"
+
+  link:
+    - attr: "charset"
+      replacement: "HTTP Content-Type header"
+      severity: "minor"
+    - attr: "methods"
+      replacement: "HTTP OPTIONS"
+      severity: "minor"
+    - attr: "rev"
+      replacement: "rel with opposite term"
+      severity: "minor"
+    - attr: "target"
+      replacement: "Omit"
+      severity: "minor"
+
+  meta:
+    - attr: "scheme"
+      replacement: "Include scheme in value"
+      severity: "minor"
+
+  object:
+    - attr: "align"
+      replacement: "CSS"
+      severity: "minor"
+    - attr: "archive"
+      replacement: "data and type attributes"
+      severity: "minor"
+    - attr: "border"
+      replacement: "CSS border"
+      severity: "minor"
+    - attr: "classid"
+      replacement: "data and type attributes"
+      severity: "minor"
+    - attr: "code"
+      replacement: "data and type attributes"
+      severity: "minor"
+    - attr: "codebase"
+      replacement: "data and type attributes"
+      severity: "minor"
+    - attr: "codetype"
+      replacement: "data and type attributes"
+      severity: "minor"
+    - attr: "declare"
+      replacement: "Repeat element"
+      severity: "minor"
+    - attr: "hspace"
+      replacement: "CSS margin"
+      severity: "minor"
+    - attr: "standby"
+      replacement: "Optimize resource loading"
+      severity: "minor"
+    - attr: "typemustmatch"
+      replacement: "Avoid untrusted resources"
+      severity: "minor"
+    - attr: "vspace"
+      replacement: "CSS margin"
+      severity: "minor"
+
+  script:
+    - attr: "charset"
+      replacement: "Omit (UTF-8 required)"
+      severity: "minor"
+    - attr: "event"
+      replacement: "DOM event listeners"
+      severity: "minor"
+    - attr: "for"
+      replacement: "DOM event listeners"
+      severity: "minor"
+    - attr: "language"
+      replacement: "Omit for JavaScript"
+      severity: "minor"
+
+  style:
+    - attr: "type"
+      replacement: "Omit for CSS (default)"
+      severity: "info"
+
+  table:
+    - attr: "align"
+      replacement: "CSS margin"
+      severity: "major"
+    - attr: "bgcolor"
+      replacement: "CSS background-color"
+      severity: "major"
+    - attr: "border"
+      replacement: "CSS border"
+      severity: "major"
+    - attr: "bordercolor"
+      replacement: "CSS border-color"
+      severity: "minor"
+    - attr: "cellpadding"
+      replacement: "CSS padding on td/th"
+      severity: "major"
+    - attr: "cellspacing"
+      replacement: "CSS border-spacing"
+      severity: "major"
+    - attr: "frame"
+      replacement: "CSS border"
+      severity: "minor"
+    - attr: "height"
+      replacement: "CSS height"
+      severity: "minor"
+    - attr: "rules"
+      replacement: "CSS border on td/th"
+      severity: "minor"
+    - attr: "summary"
+      replacement: "caption element or aria-describedby"
+      severity: "minor"
+    - attr: "width"
+      replacement: "CSS width"
+      severity: "minor"
+
+  td_th:
+    - attr: "abbr"
+      applies_to: "td only"
+      replacement: "Descriptive text or title attribute"
+      severity: "minor"
+    - attr: "align"
+      replacement: "CSS text-align"
+      severity: "minor"
+    - attr: "axis"
+      replacement: "scope on th"
+      severity: "minor"
+    - attr: "bgcolor"
+      replacement: "CSS background-color"
+      severity: "minor"
+    - attr: "char"
+      replacement: "CSS"
+      severity: "minor"
+    - attr: "charoff"
+      replacement: "CSS"
+      severity: "minor"
+    - attr: "height"
+      replacement: "CSS height"
+      severity: "minor"
+    - attr: "nowrap"
+      replacement: "CSS white-space"
+      severity: "minor"
+    - attr: "valign"
+      replacement: "CSS vertical-align"
+      severity: "minor"
+    - attr: "width"
+      replacement: "CSS width"
+      severity: "minor"
+
+  tr:
+    - attr: "align"
+      replacement: "CSS text-align"
+      severity: "minor"
+    - attr: "bgcolor"
+      replacement: "CSS background-color"
+      severity: "minor"
+    - attr: "char"
+      replacement: "CSS"
+      severity: "minor"
+    - attr: "charoff"
+      replacement: "CSS"
+      severity: "minor"
+    - attr: "height"
+      replacement: "CSS height"
+      severity: "minor"
+    - attr: "valign"
+      replacement: "CSS vertical-align"
+      severity: "minor"
+
+  thead_tbody_tfoot:
+    - attr: "align"
+      replacement: "CSS text-align"
+      severity: "minor"
+    - attr: "char"
+      replacement: "CSS"
+      severity: "minor"
+    - attr: "charoff"
+      replacement: "CSS"
+      severity: "minor"
+    - attr: "height"
+      replacement: "CSS height"
+      severity: "minor"
+    - attr: "valign"
+      replacement: "CSS vertical-align"
+      severity: "minor"
+
+  ol_ul:
+    - attr: "compact"
+      replacement: "CSS"
+      severity: "minor"
+    - attr: "type"
+      applies_to: "ul only (ol type is valid)"
+      replacement: "CSS list-style-type"
+      severity: "minor"
+
+  heading:
+    - attr: "align"
+      applies_to: "h1-h6"
+      replacement: "CSS text-align"
+      severity: "minor"
+
+  embed:
+    - attr: "align"
+      replacement: "CSS"
+      severity: "minor"
+    - attr: "hspace"
+      replacement: "CSS margin"
+      severity: "minor"
+    - attr: "name"
+      replacement: "id attribute"
+      severity: "minor"
+    - attr: "vspace"
+      replacement: "CSS margin"
+      severity: "minor"
+
+# ============================================================
+# 3. Semantic HTML5 Elements
+# Source: HTML Living Standard - Sections, Grouping
+# ============================================================
+semantic_elements:
+  structural:
+    - tag: "header"
+      description: "Introductory content or navigational aids for a section/page"
+      typical_use: "Site header, section header"
+    - tag: "nav"
+      description: "Section with navigation links"
+      typical_use: "Main navigation, breadcrumbs, table of contents"
+    - tag: "main"
+      description: "Dominant content of the body (unique per page)"
+      typical_use: "Primary content area (one per page)"
+    - tag: "footer"
+      description: "Footer for its nearest sectioning content/root"
+      typical_use: "Site footer, section footer"
+    - tag: "aside"
+      description: "Content tangentially related to surrounding content"
+      typical_use: "Sidebar, pull quotes, related links"
+    - tag: "section"
+      description: "Generic standalone section of a document"
+      typical_use: "Thematic grouping with heading"
+    - tag: "article"
+      description: "Self-contained composition independently distributable"
+      typical_use: "Blog post, news article, forum post, comment"
+
+  text_level:
+    - tag: "figure"
+      description: "Self-contained content with optional caption"
+      typical_use: "Images, diagrams, code listings with captions"
+    - tag: "figcaption"
+      description: "Caption for a figure element"
+      typical_use: "Image caption, diagram description"
+    - tag: "details"
+      description: "Disclosure widget for additional information"
+      typical_use: "FAQ, expandable sections"
+    - tag: "summary"
+      description: "Visible heading for a details element"
+      typical_use: "Click-to-expand label"
+    - tag: "mark"
+      description: "Text highlighted for reference or notation"
+      typical_use: "Search result highlighting"
+    - tag: "time"
+      description: "Machine-readable date/time"
+      typical_use: "Publication dates, event times"
+    - tag: "address"
+      description: "Contact information for author/owner"
+      typical_use: "Author contact info in article/footer"
+    - tag: "search"
+      description: "Container for search functionality"
+      typical_use: "Search form wrapper (new in HTML5.2+)"
+
+  interactive:
+    - tag: "dialog"
+      description: "Dialog box or interactive component"
+      typical_use: "Modal dialogs, alerts"
+    - tag: "menu"
+      description: "List of commands or options"
+      typical_use: "Context menus, toolbars"
+
+# ============================================================
+# 4. Required/Recommended Meta Tags
+# Source: HTML Living Standard, MDN Web Docs
+# ============================================================
+meta_tags:
+  required:
+    - name: "charset"
+      element: '<meta charset="UTF-8">'
+      description: "Character encoding declaration (must be UTF-8)"
+      severity: "critical"
+      standard: "HTML Living Standard"
+
+    - name: "viewport"
+      element: '<meta name="viewport" content="width=device-width, initial-scale=1">'
+      description: "Viewport configuration for responsive design"
+      severity: "critical"
+      standard: "CSS Device Adaptation"
+
+  recommended:
+    - name: "description"
+      element: '<meta name="description" content="...">'
+      description: "Page description for search engines (150-160 chars)"
+      severity: "major"
+      standard: "HTML Living Standard"
+
+    - name: "title"
+      element: "<title>Page Title</title>"
+      description: "Document title (required by spec, shown in browser tab)"
+      severity: "critical"
+      standard: "HTML Living Standard"
+
+    - name: "lang"
+      element: '<html lang="ko">'
+      description: "Document language declaration"
+      severity: "major"
+      standard: "HTML Living Standard"
+
+    - name: "content-type"
+      element: 'Content-Type HTTP header or <meta http-equiv="Content-Type">'
+      description: "MIME type and encoding declaration"
+      severity: "major"
+      standard: "HTML Living Standard"
+
+  social_media:
+    - name: "og:title"
+      element: '<meta property="og:title" content="...">'
+      description: "Open Graph title for social sharing"
+      severity: "minor"
+      standard: "Open Graph Protocol"
+
+    - name: "og:description"
+      element: '<meta property="og:description" content="...">'
+      description: "Open Graph description for social sharing"
+      severity: "minor"
+      standard: "Open Graph Protocol"
+
+    - name: "og:image"
+      element: '<meta property="og:image" content="...">'
+      description: "Open Graph image for social sharing"
+      severity: "minor"
+      standard: "Open Graph Protocol"
+
+    - name: "og:url"
+      element: '<meta property="og:url" content="...">'
+      description: "Canonical URL for Open Graph"
+      severity: "minor"
+      standard: "Open Graph Protocol"
+
+    - name: "og:type"
+      element: '<meta property="og:type" content="website">'
+      description: "Content type for Open Graph"
+      severity: "minor"
+      standard: "Open Graph Protocol"
+
+    - name: "twitter:card"
+      element: '<meta name="twitter:card" content="summary_large_image">'
+      description: "Twitter Card type"
+      severity: "info"
+      standard: "Twitter Cards"
+
+    - name: "twitter:title"
+      element: '<meta name="twitter:title" content="...">'
+      description: "Twitter Card title"
+      severity: "info"
+      standard: "Twitter Cards"
+
+    - name: "twitter:description"
+      element: '<meta name="twitter:description" content="...">'
+      description: "Twitter Card description"
+      severity: "info"
+      standard: "Twitter Cards"
+
+# ============================================================
+# 5. Document Structure Rules
+# Source: HTML Living Standard
+# ============================================================
+document_structure:
+  doctype:
+    rule: "Document must start with <!DOCTYPE html>"
+    severity: "critical"
+    description: "HTML5 doctype declaration required"
+
+  heading_hierarchy:
+    rule: "Headings must follow proper hierarchy (h1 > h2 > h3...)"
+    severity: "major"
+    checks:
+      - id: "single-h1"
+        description: "Page should have exactly one h1 element"
+        severity: "major"
+      - id: "no-skipped-levels"
+        description: "Heading levels should not be skipped (e.g., h1 to h3)"
+        severity: "major"
+      - id: "logical-order"
+        description: "Headings should follow logical document outline"
+        severity: "minor"
+
+  image_alt:
+    rule: "All img elements must have alt attribute"
+    severity: "critical"
+    description: "Alternative text for images (accessibility + validity)"
+    exceptions:
+      - "Decorative images may use alt=''"
+      - "Images with role='presentation' may omit alt"
+
+  inline_styles:
+    rule: "Avoid inline style attributes"
+    severity: "minor"
+    description: "Inline styles reduce maintainability and violate separation of concerns"
+
+  duplicate_ids:
+    rule: "Element id attributes must be unique within the document"
+    severity: "critical"
+    description: "Duplicate IDs cause accessibility and JavaScript issues"
+
+  empty_links:
+    rule: "Anchor elements should have accessible content"
+    severity: "major"
+    description: "Links without text or aria-label are not accessible"
+
+  table_structure:
+    rule: "Data tables should have proper structure"
+    severity: "major"
+    checks:
+      - id: "table-has-thead"
+        description: "Data tables should have thead with th elements"
+      - id: "table-has-caption"
+        description: "Complex tables should have caption or aria-label"
+      - id: "th-has-scope"
+        description: "th elements should have scope attribute"
+
+  form_structure:
+    rule: "Form elements should have proper labels"
+    severity: "major"
+    checks:
+      - id: "input-has-label"
+        description: "Every form input should have an associated label"
+      - id: "form-has-submit"
+        description: "Forms should have a submit mechanism"
+      - id: "fieldset-has-legend"
+        description: "Fieldset elements should have a legend"
+
+  link_integrity:
+    rule: "Links and resources should be valid"
+    severity: "minor"
+    checks:
+      - id: "no-empty-href"
+        description: "Links should not have empty href attributes"
+      - id: "valid-rel"
+        description: "Link rel values should be valid"
+
+# ============================================================
+# 6. CSS Best Practices
+# Source: CSS Specifications, MDN Web Docs
+# ============================================================
+css_checks:
+  - id: "no-important-overuse"
+    description: "Avoid excessive use of !important declarations"
+    severity: "minor"
+    standard: "CSS Cascading and Inheritance"
+
+  - id: "vendor-prefix-check"
+    description: "Check for unnecessary vendor prefixes on well-supported properties"
+    severity: "info"
+    standard: "CSS Specifications"
+
+  - id: "no-universal-selector-performance"
+    description: "Avoid universal selector (*) in complex selectors for performance"
+    severity: "info"
+    standard: "CSS Selectors Level 4"

backend/app/rules/performance_security.yaml

@@ -0,0 +1,730 @@
+# ============================================================
+# Performance & Security Rules
+# Based on: Core Web Vitals, Lighthouse, OWASP, Mozilla Observatory
+# ============================================================
+
+metadata:
+  name: "Performance & Security Standards"
+  version: "1.0.0"
+  last_updated: "2026-02-13"
+  sources:
+    - name: "Google Core Web Vitals"
+      url: "https://developers.google.com/search/docs/appearance/core-web-vitals"
+    - name: "Lighthouse Performance Audits"
+      url: "https://developer.chrome.com/docs/lighthouse/performance/"
+    - name: "OWASP Secure Headers Project"
+      url: "https://owasp.org/www-project-secure-headers/"
+    - name: "OWASP HTTP Headers Cheat Sheet"
+      url: "https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html"
+    - name: "Mozilla Observatory"
+      url: "https://observatory.mozilla.org/"
+    - name: "OWASP Top 10 (2021)"
+      url: "https://owasp.org/www-project-top-ten/"
+
+# ============================================================
+# PERFORMANCE RULES
+# ============================================================
+
+performance:
+  # --- Core Web Vitals ---
+  core_web_vitals:
+    - id: "perf-lcp"
+      name: "Largest Contentful Paint (LCP)"
+      description: "Measures loading performance - time to render the largest content element"
+      severity: "critical"
+      category: "loading"
+      standard: "Google Core Web Vitals"
+      thresholds:
+        good: 2500  # ms
+        needs_improvement: 4000
+        poor: 4001  # above this
+      unit: "milliseconds"
+      tips:
+        - "Optimize and compress images (WebP/AVIF format)"
+        - "Preload critical resources"
+        - "Remove render-blocking resources"
+        - "Use a CDN for static assets"
+        - "Optimize server response time (TTFB < 800ms)"
+
+    - id: "perf-inp"
+      name: "Interaction to Next Paint (INP)"
+      description: "Measures responsiveness - latency of all user interactions"
+      severity: "critical"
+      category: "interactivity"
+      standard: "Google Core Web Vitals"
+      note: "Replaced FID (First Input Delay) in March 2024"
+      thresholds:
+        good: 200  # ms
+        needs_improvement: 500
+        poor: 501
+      unit: "milliseconds"
+      tips:
+        - "Break up long tasks (> 50ms)"
+        - "Reduce JavaScript execution time"
+        - "Use web workers for heavy computation"
+        - "Minimize main thread work"
+        - "Optimize event handlers"
+
+    - id: "perf-cls"
+      name: "Cumulative Layout Shift (CLS)"
+      description: "Measures visual stability - unexpected layout shifts during page life"
+      severity: "critical"
+      category: "visual_stability"
+      standard: "Google Core Web Vitals"
+      thresholds:
+        good: 0.1
+        needs_improvement: 0.25
+        poor: 0.26
+      unit: "score"
+      tips:
+        - "Set explicit width/height on images and video"
+        - "Reserve space for ads and embeds"
+        - "Avoid inserting content above existing content"
+        - "Use CSS contain for dynamic content"
+        - "Preload web fonts and use font-display: swap"
+
+  # --- Additional Performance Metrics ---
+  additional_metrics:
+    - id: "perf-fcp"
+      name: "First Contentful Paint (FCP)"
+      description: "Time to render the first piece of DOM content"
+      severity: "major"
+      category: "loading"
+      standard: "Lighthouse"
+      thresholds:
+        good: 1800  # ms
+        needs_improvement: 3000
+        poor: 3001
+      unit: "milliseconds"
+
+    - id: "perf-ttfb"
+      name: "Time to First Byte (TTFB)"
+      description: "Time from request to first byte of response"
+      severity: "major"
+      category: "server"
+      standard: "Lighthouse"
+      thresholds:
+        good: 800  # ms
+        needs_improvement: 1800
+        poor: 1801
+      unit: "milliseconds"
+      tips:
+        - "Use a CDN"
+        - "Optimize server-side rendering"
+        - "Enable HTTP/2 or HTTP/3"
+        - "Optimize database queries"
+
+    - id: "perf-si"
+      name: "Speed Index"
+      description: "How quickly content is visually displayed during page load"
+      severity: "major"
+      category: "loading"
+      standard: "Lighthouse"
+      thresholds:
+        good: 3400  # ms
+        needs_improvement: 5800
+        poor: 5801
+      unit: "milliseconds"
+
+    - id: "perf-tbt"
+      name: "Total Blocking Time (TBT)"
+      description: "Total time where main thread was blocked for > 50ms between FCP and TTI"
+      severity: "major"
+      category: "interactivity"
+      standard: "Lighthouse"
+      thresholds:
+        good: 200  # ms
+        needs_improvement: 600
+        poor: 601
+      unit: "milliseconds"
+
+  # --- Resource Optimization ---
+  resource_checks:
+    - id: "perf-total-page-size"
+      name: "Total Page Size"
+      description: "Total size of all resources loaded by the page"
+      severity: "major"
+      category: "resources"
+      standard: "Web Performance Best Practice"
+      thresholds:
+        good: 1500  # KB
+        needs_improvement: 3000
+        poor: 5000
+      unit: "kilobytes"
+
+    - id: "perf-total-requests"
+      name: "Total HTTP Requests"
+      description: "Total number of HTTP requests made by the page"
+      severity: "major"
+      category: "resources"
+      standard: "Web Performance Best Practice"
+      thresholds:
+        good: 50
+        needs_improvement: 80
+        poor: 100
+      unit: "count"
+
+    - id: "perf-image-optimization"
+      name: "Image Optimization"
+      description: "Images should be properly optimized"
+      severity: "major"
+      category: "resources"
+      standard: "Lighthouse"
+      checks:
+        - id: "uses-webp-avif"
+          description: "Use modern image formats (WebP, AVIF)"
+          severity: "minor"
+        - id: "responsive-images"
+          description: "Use srcset for responsive images"
+          severity: "minor"
+        - id: "lazy-loading"
+          description: "Offscreen images should use lazy loading"
+          severity: "minor"
+        - id: "image-dimensions"
+          description: "Images should have explicit width and height"
+          severity: "major"
+        - id: "oversized-images"
+          description: "Images should not be larger than their display size"
+          severity: "minor"
+
+    - id: "perf-js-optimization"
+      name: "JavaScript Optimization"
+      description: "JavaScript should be properly optimized"
+      severity: "major"
+      category: "resources"
+      standard: "Lighthouse"
+      checks:
+        - id: "minified-js"
+          description: "JavaScript should be minified"
+          severity: "minor"
+        - id: "no-render-blocking-js"
+          description: "Non-critical JS should use async or defer"
+          severity: "major"
+        - id: "unused-js"
+          description: "Remove unused JavaScript"
+          severity: "minor"
+        - id: "js-bundle-size"
+          description: "Individual JS bundles should be under 250KB (compressed)"
+          max_size_kb: 250
+          severity: "major"
+
+    - id: "perf-css-optimization"
+      name: "CSS Optimization"
+      description: "CSS should be properly optimized"
+      severity: "minor"
+      category: "resources"
+      standard: "Lighthouse"
+      checks:
+        - id: "minified-css"
+          description: "CSS should be minified"
+          severity: "minor"
+        - id: "no-render-blocking-css"
+          description: "Non-critical CSS should be deferred"
+          severity: "major"
+        - id: "unused-css"
+          description: "Remove unused CSS rules"
+          severity: "minor"
+        - id: "critical-css-inlined"
+          description: "Critical CSS should be inlined"
+          severity: "info"
+
+    - id: "perf-font-optimization"
+      name: "Font Optimization"
+      description: "Web fonts should be properly optimized"
+      severity: "minor"
+      category: "resources"
+      standard: "Web Performance Best Practice"
+      checks:
+        - id: "font-display"
+          description: "Use font-display: swap or optional"
+          severity: "minor"
+        - id: "preload-fonts"
+          description: "Preload critical fonts"
+          severity: "minor"
+        - id: "font-subsetting"
+          description: "Use font subsetting for CJK fonts"
+          severity: "info"
+        - id: "woff2-format"
+          description: "Use WOFF2 format for web fonts"
+          severity: "minor"
+
+  # --- Caching & Compression ---
+  caching:
+    - id: "perf-compression"
+      name: "Text Compression"
+      description: "Text resources should be served with compression"
+      severity: "major"
+      category: "network"
+      standard: "Lighthouse"
+      details:
+        supported_encodings:
+          - "gzip"
+          - "br (Brotli - preferred)"
+          - "zstd"
+        applies_to:
+          - "text/html"
+          - "text/css"
+          - "application/javascript"
+          - "application/json"
+          - "image/svg+xml"
+
+    - id: "perf-cache-headers"
+      name: "Cache Headers"
+      description: "Static resources should have proper cache headers"
+      severity: "major"
+      category: "network"
+      standard: "HTTP Caching (RFC 7234)"
+      details:
+        checks:
+          - id: "has-cache-control"
+            description: "Static assets should have Cache-Control header"
+          - id: "long-cache-lifetime"
+            description: "Static assets should have cache lifetime >= 1 year"
+            recommended: "Cache-Control: public, max-age=31536000, immutable"
+          - id: "etag"
+            description: "Resources should have ETag for validation"
+
+    - id: "perf-http2"
+      name: "HTTP/2 or HTTP/3"
+      description: "Site should use HTTP/2 or HTTP/3 protocol"
+      severity: "minor"
+      category: "network"
+      standard: "IETF RFC 9113 (HTTP/2), RFC 9114 (HTTP/3)"
+      details:
+        description: "HTTP/2+ provides multiplexing, header compression, and server push"
+
+# ============================================================
+# SECURITY RULES
+# ============================================================
+
+security:
+  # --- HTTP Security Headers (OWASP) ---
+  headers:
+    - id: "sec-strict-transport-security"
+      name: "Strict-Transport-Security (HSTS)"
+      description: "Enforces HTTPS-only access to prevent protocol downgrade attacks"
+      severity: "critical"
+      category: "transport"
+      standard: "OWASP Secure Headers Project"
+      standard_ref: "RFC 6797"
+      check_type: "header_check"
+      details:
+        header: "Strict-Transport-Security"
+        recommended_value: "max-age=63072000; includeSubDomains; preload"
+        directives:
+          - name: "max-age"
+            description: "Time in seconds browser should remember HTTPS-only"
+            recommended: 63072000  # 2 years
+            minimum: 31536000  # 1 year
+          - name: "includeSubDomains"
+            description: "Apply to all subdomains"
+            recommended: true
+          - name: "preload"
+            description: "Allow inclusion in browser HSTS preload list"
+            recommended: true
+        note: "Only effective over HTTPS connections"
+
+    - id: "sec-content-security-policy"
+      name: "Content-Security-Policy (CSP)"
+      description: "Restricts content origins to prevent XSS and injection attacks"
+      severity: "critical"
+      category: "injection"
+      standard: "OWASP Secure Headers Project"
+      standard_ref: "W3C CSP Level 3"
+      check_type: "header_check"
+      details:
+        header: "Content-Security-Policy"
+        recommended_directives:
+          - directive: "default-src"
+            description: "Fallback for other directives"
+            recommended: "'self'"
+          - directive: "script-src"
+            description: "Valid sources for JavaScript"
+            recommended: "'self'"
+            avoid: "'unsafe-inline', 'unsafe-eval'"
+          - directive: "style-src"
+            description: "Valid sources for stylesheets"
+            recommended: "'self'"
+          - directive: "img-src"
+            description: "Valid sources for images"
+            recommended: "'self' data:"
+          - directive: "font-src"
+            description: "Valid sources for fonts"
+            recommended: "'self'"
+          - directive: "connect-src"
+            description: "Valid targets for XMLHttpRequest, Fetch, WebSocket"
+            recommended: "'self'"
+          - directive: "frame-ancestors"
+            description: "Valid parents for embedding (replaces X-Frame-Options)"
+            recommended: "'none'"
+          - directive: "base-uri"
+            description: "Restricts URLs for base element"
+            recommended: "'self'"
+          - directive: "form-action"
+            description: "Restricts form submission targets"
+            recommended: "'self'"
+          - directive: "object-src"
+            description: "Valid sources for plugins"
+            recommended: "'none'"
+          - directive: "upgrade-insecure-requests"
+            description: "Upgrade HTTP requests to HTTPS"
+            recommended: true
+
+    - id: "sec-x-frame-options"
+      name: "X-Frame-Options"
+      description: "Prevents page from being displayed in frames (clickjacking protection)"
+      severity: "critical"
+      category: "clickjacking"
+      standard: "OWASP Secure Headers Project"
+      standard_ref: "RFC 7034"
+      check_type: "header_check"
+      details:
+        header: "X-Frame-Options"
+        recommended_value: "DENY"
+        valid_values:
+          - value: "DENY"
+            description: "Page cannot be displayed in any frame"
+          - value: "SAMEORIGIN"
+            description: "Page can only be displayed in frame on same origin"
+        note: "CSP frame-ancestors is the modern replacement"
+
+    - id: "sec-x-content-type-options"
+      name: "X-Content-Type-Options"
+      description: "Prevents MIME type sniffing attacks"
+      severity: "major"
+      category: "injection"
+      standard: "OWASP Secure Headers Project"
+      check_type: "header_check"
+      details:
+        header: "X-Content-Type-Options"
+        recommended_value: "nosniff"
+        description: "Blocks browsers from guessing MIME types, preventing XSS via MIME confusion"
+
+    - id: "sec-referrer-policy"
+      name: "Referrer-Policy"
+      description: "Controls referrer information sent with requests"
+      severity: "major"
+      category: "privacy"
+      standard: "OWASP Secure Headers Project"
+      standard_ref: "W3C Referrer Policy"
+      check_type: "header_check"
+      details:
+        header: "Referrer-Policy"
+        recommended_value: "strict-origin-when-cross-origin"
+        valid_values:
+          - value: "no-referrer"
+            description: "Never send referrer"
+            security: "highest"
+          - value: "no-referrer-when-downgrade"
+            description: "Don't send referrer on HTTPS → HTTP"
+            security: "medium"
+          - value: "origin"
+            description: "Only send the origin"
+            security: "high"
+          - value: "origin-when-cross-origin"
+            description: "Full URL for same-origin, origin for cross-origin"
+            security: "medium"
+          - value: "same-origin"
+            description: "Only send referrer for same-origin requests"
+            security: "high"
+          - value: "strict-origin"
+            description: "Send origin when protocol stays same"
+            security: "high"
+          - value: "strict-origin-when-cross-origin"
+            description: "Full URL for same-origin, origin for cross-origin (same protocol)"
+            security: "medium-high"
+          - value: "unsafe-url"
+            description: "Always send full URL"
+            security: "none"
+
+    - id: "sec-permissions-policy"
+      name: "Permissions-Policy"
+      description: "Controls browser feature access (geolocation, camera, etc.)"
+      severity: "major"
+      category: "privacy"
+      standard: "OWASP Secure Headers Project"
+      standard_ref: "W3C Permissions Policy"
+      check_type: "header_check"
+      details:
+        header: "Permissions-Policy"
+        recommended_value: "geolocation=(), camera=(), microphone=(), payment=(), usb=(), magnetometer=(), gyroscope=(), accelerometer=()"
+        controllable_features:
+          - feature: "geolocation"
+            description: "Access to user's location"
+            default_recommendation: "()"  # deny all
+          - feature: "camera"
+            description: "Access to device camera"
+            default_recommendation: "()"
+          - feature: "microphone"
+            description: "Access to device microphone"
+            default_recommendation: "()"
+          - feature: "payment"
+            description: "Payment Request API"
+            default_recommendation: "()"
+          - feature: "usb"
+            description: "WebUSB API"
+            default_recommendation: "()"
+          - feature: "magnetometer"
+            description: "Magnetometer sensor"
+            default_recommendation: "()"
+          - feature: "gyroscope"
+            description: "Gyroscope sensor"
+            default_recommendation: "()"
+          - feature: "accelerometer"
+            description: "Accelerometer sensor"
+            default_recommendation: "()"
+          - feature: "autoplay"
+            description: "Auto-play media"
+            default_recommendation: "(self)"
+          - feature: "fullscreen"
+            description: "Fullscreen API"
+            default_recommendation: "(self)"
+          - feature: "interest-cohort"
+            description: "FLoC / Topics API (ad tracking)"
+            default_recommendation: "()"
+
+    - id: "sec-cross-origin-opener-policy"
+      name: "Cross-Origin-Opener-Policy (COOP)"
+      description: "Isolates browsing context to prevent Spectre-type attacks"
+      severity: "minor"
+      category: "isolation"
+      standard: "OWASP Secure Headers Project"
+      check_type: "header_check"
+      details:
+        header: "Cross-Origin-Opener-Policy"
+        recommended_value: "same-origin"
+        valid_values:
+          - "unsafe-none"
+          - "same-origin-allow-popups"
+          - "same-origin"
+
+    - id: "sec-cross-origin-embedder-policy"
+      name: "Cross-Origin-Embedder-Policy (COEP)"
+      description: "Restricts cross-origin resource loading"
+      severity: "minor"
+      category: "isolation"
+      standard: "OWASP Secure Headers Project"
+      check_type: "header_check"
+      details:
+        header: "Cross-Origin-Embedder-Policy"
+        recommended_value: "require-corp"
+        valid_values:
+          - "unsafe-none"
+          - "require-corp"
+          - "credentialless"
+
+    - id: "sec-cross-origin-resource-policy"
+      name: "Cross-Origin-Resource-Policy (CORP)"
+      description: "Blocks resource loading from unauthorized origins"
+      severity: "minor"
+      category: "isolation"
+      standard: "OWASP Secure Headers Project"
+      check_type: "header_check"
+      details:
+        header: "Cross-Origin-Resource-Policy"
+        recommended_value: "same-site"
+        valid_values:
+          - "same-site"
+          - "same-origin"
+          - "cross-origin"
+
+  # --- Headers to Remove (Information Disclosure) ---
+  headers_to_remove:
+    - id: "sec-remove-server"
+      name: "Remove Server Header"
+      description: "Server header exposes web server technology"
+      severity: "minor"
+      category: "information_disclosure"
+      standard: "OWASP Secure Headers Project"
+      details:
+        header: "Server"
+        action: "Remove or set to non-informative value"
+        reason: "Prevents fingerprinting of web server software"
+
+    - id: "sec-remove-x-powered-by"
+      name: "Remove X-Powered-By Header"
+      description: "X-Powered-By exposes application framework"
+      severity: "minor"
+      category: "information_disclosure"
+      standard: "OWASP Secure Headers Project"
+      details:
+        header: "X-Powered-By"
+        action: "Remove entirely"
+        reason: "Prevents fingerprinting of application framework (Express, PHP, ASP.NET)"
+
+    - id: "sec-remove-x-aspnet-version"
+      name: "Remove X-AspNet-Version Header"
+      description: "Exposes .NET framework version"
+      severity: "minor"
+      category: "information_disclosure"
+      standard: "OWASP Secure Headers Project"
+      details:
+        header: "X-AspNet-Version"
+        action: "Remove entirely"
+
+    - id: "sec-remove-x-aspnetmvc-version"
+      name: "Remove X-AspNetMvc-Version Header"
+      description: "Exposes ASP.NET MVC version"
+      severity: "minor"
+      category: "information_disclosure"
+      standard: "OWASP Secure Headers Project"
+      details:
+        header: "X-AspNetMvc-Version"
+        action: "Remove entirely"
+
+  # --- Deprecated Headers ---
+  deprecated_headers:
+    - id: "sec-no-x-xss-protection"
+      name: "X-XSS-Protection (Deprecated)"
+      description: "Legacy XSS filter - should be disabled in favor of CSP"
+      severity: "info"
+      category: "legacy"
+      standard: "OWASP Secure Headers Project"
+      details:
+        header: "X-XSS-Protection"
+        recommended_value: "0"
+        reason: "Modern browsers have removed XSS auditor; use CSP instead"
+        note: "Setting to 1; mode=block can introduce vulnerabilities in older browsers"
+
+    - id: "sec-no-public-key-pins"
+      name: "Public-Key-Pins (HPKP) - Removed"
+      description: "HTTP Public Key Pinning is deprecated and should not be used"
+      severity: "info"
+      category: "legacy"
+      standard: "OWASP Secure Headers Project"
+      details:
+        header: "Public-Key-Pins"
+        action: "Do not use"
+        reason: "Risk of permanent site lockout; replaced by Certificate Transparency"
+
+  # --- Transport Security ---
+  transport:
+    - id: "sec-https"
+      name: "HTTPS Enforcement"
+      description: "Site must be served over HTTPS"
+      severity: "critical"
+      category: "transport"
+      standard: "OWASP / Google"
+      checks:
+        - id: "uses-https"
+          description: "Page is served over HTTPS"
+          severity: "critical"
+        - id: "no-mixed-content"
+          description: "No HTTP resources loaded on HTTPS page"
+          severity: "critical"
+        - id: "http-redirects-to-https"
+          description: "HTTP requests redirect to HTTPS"
+          severity: "major"
+        - id: "valid-certificate"
+          description: "SSL/TLS certificate is valid and not expired"
+          severity: "critical"
+        - id: "strong-tls-version"
+          description: "Uses TLS 1.2 or higher"
+          severity: "major"
+          details:
+            minimum_version: "TLS 1.2"
+            recommended_version: "TLS 1.3"
+            deprecated_versions:
+              - "SSL 2.0"
+              - "SSL 3.0"
+              - "TLS 1.0"
+              - "TLS 1.1"
+
+  # --- Cookie Security ---
+  cookies:
+    - id: "sec-cookie-secure"
+      name: "Secure Cookie Flag"
+      description: "Cookies should have Secure flag over HTTPS"
+      severity: "major"
+      category: "cookies"
+      standard: "OWASP Session Management"
+      details:
+        flag: "Secure"
+        description: "Cookie only sent over HTTPS connections"
+
+    - id: "sec-cookie-httponly"
+      name: "HttpOnly Cookie Flag"
+      description: "Session cookies should have HttpOnly flag"
+      severity: "major"
+      category: "cookies"
+      standard: "OWASP Session Management"
+      details:
+        flag: "HttpOnly"
+        description: "Cookie not accessible via JavaScript (prevents XSS theft)"
+
+    - id: "sec-cookie-samesite"
+      name: "SameSite Cookie Attribute"
+      description: "Cookies should have SameSite attribute"
+      severity: "major"
+      category: "cookies"
+      standard: "OWASP Session Management"
+      details:
+        attribute: "SameSite"
+        recommended_value: "Lax"
+        valid_values:
+          - value: "Strict"
+            description: "Cookie not sent in any cross-site request"
+          - value: "Lax"
+            description: "Cookie sent in top-level navigations (recommended default)"
+          - value: "None"
+            description: "Cookie sent in all contexts (requires Secure flag)"
+
+  # --- Content Security ---
+  content:
+    - id: "sec-subresource-integrity"
+      name: "Subresource Integrity (SRI)"
+      description: "External scripts/styles should use integrity attribute"
+      severity: "minor"
+      category: "supply_chain"
+      standard: "W3C Subresource Integrity"
+      check_type: "attribute_check"
+      details:
+        applies_to:
+          - "script[src] from CDN"
+          - "link[rel=stylesheet] from CDN"
+        attribute: "integrity"
+        description: "Hash-based verification of external resources"
+
+    - id: "sec-form-action-https"
+      name: "Form Action HTTPS"
+      description: "Form actions should use HTTPS"
+      severity: "major"
+      category: "transport"
+      standard: "OWASP"
+      check_type: "form_check"
+      details:
+        description: "Form submissions should always go to HTTPS endpoints"
+
+    - id: "sec-target-blank-rel"
+      name: "Target Blank Security"
+      description: "Links with target=_blank should have rel=noopener"
+      severity: "minor"
+      category: "injection"
+      standard: "Web Security Best Practice"
+      check_type: "link_check"
+      details:
+        description: "Prevents tab-napping attacks via window.opener"
+        recommended: 'rel="noopener noreferrer"'
+        note: "Modern browsers set noopener by default, but explicit is safer"
+
+    - id: "sec-no-inline-event-handlers"
+      name: "No Inline Event Handlers"
+      description: "Avoid inline event handlers (onclick, onload, etc.)"
+      severity: "minor"
+      category: "injection"
+      standard: "OWASP / CSP"
+      check_type: "attribute_check"
+      details:
+        description: "Inline event handlers are incompatible with strict CSP"
+        blocked_attributes:
+          - "onclick"
+          - "onload"
+          - "onerror"
+          - "onmouseover"
+          - "onsubmit"
+          - "onfocus"
+          - "onblur"
+          - "onchange"
+          - "onkeydown"
+          - "onkeyup"
+          - "onkeypress"

backend/app/rules/seo.yaml

@@ -0,0 +1,529 @@
+# ============================================================
+# SEO (Search Engine Optimization) Rules
+# Based on: Google Search Essentials, Schema.org, Core Web Vitals
+# ============================================================
+
+metadata:
+  name: "SEO Standards"
+  version: "1.0.0"
+  last_updated: "2026-02-13"
+  sources:
+    - name: "Google Search Essentials"
+      url: "https://developers.google.com/search/docs/essentials"
+      description: "Google's core guidelines for search visibility"
+    - name: "Google Search Central - Technical Requirements"
+      url: "https://developers.google.com/search/docs/crawling-indexing"
+    - name: "Core Web Vitals"
+      url: "https://developers.google.com/search/docs/appearance/core-web-vitals"
+    - name: "Schema.org"
+      url: "https://schema.org/"
+      description: "Structured data vocabulary"
+    - name: "Open Graph Protocol"
+      url: "https://ogp.me/"
+    - name: "Lighthouse SEO Audit"
+      url: "https://developer.chrome.com/docs/lighthouse/seo/"
+
+# ============================================================
+# 1. Title & Meta Tags
+# ============================================================
+rules:
+  # --- Essential Meta Tags ---
+  - id: "seo-title-tag"
+    name: "Title Tag"
+    description: "Page must have a unique, descriptive <title> tag"
+    severity: "critical"
+    category: "meta"
+    standard: "Google Search Essentials"
+    check_type: "meta_tag_check"
+    details:
+      tag: "title"
+      requirements:
+        - "Must be present and non-empty"
+        - "Should be 30-60 characters for optimal display"
+        - "Should be unique across the site"
+        - "Should accurately describe page content"
+      max_length: 60
+      min_length: 10
+
+  - id: "seo-meta-description"
+    name: "Meta Description"
+    description: "Page should have a descriptive meta description"
+    severity: "major"
+    category: "meta"
+    standard: "Google Search Essentials"
+    check_type: "meta_tag_check"
+    details:
+      tag: '<meta name="description">'
+      requirements:
+        - "Should be 120-160 characters for optimal display"
+        - "Should be unique across the site"
+        - "Should accurately summarize page content"
+      max_length: 160
+      min_length: 50
+
+  - id: "seo-meta-viewport"
+    name: "Viewport Meta Tag"
+    description: "Page must have viewport meta tag for mobile compatibility"
+    severity: "critical"
+    category: "meta"
+    standard: "Google Mobile-First Indexing"
+    check_type: "meta_tag_check"
+    details:
+      tag: '<meta name="viewport">'
+      recommended_value: "width=device-width, initial-scale=1"
+
+  - id: "seo-charset"
+    name: "Character Encoding"
+    description: "Page must declare character encoding"
+    severity: "major"
+    category: "meta"
+    standard: "HTML Living Standard"
+    check_type: "meta_tag_check"
+    details:
+      tag: '<meta charset="UTF-8">'
+
+  - id: "seo-lang-attribute"
+    name: "HTML Language Attribute"
+    description: "HTML element should have lang attribute"
+    severity: "major"
+    category: "meta"
+    standard: "Google Search Essentials"
+    check_type: "attribute_check"
+    details:
+      element: "html"
+      attribute: "lang"
+      description: "Helps search engines serve language-appropriate results"
+
+  # --- Canonical & Duplicate Content ---
+  - id: "seo-canonical-url"
+    name: "Canonical URL"
+    description: "Page should have a canonical URL to prevent duplicate content"
+    severity: "major"
+    category: "meta"
+    standard: "Google Search Central"
+    check_type: "link_tag_check"
+    details:
+      tag: '<link rel="canonical">'
+      requirements:
+        - "Should be an absolute URL"
+        - "Should point to the preferred version of the page"
+        - "Must be self-referencing or point to a valid page"
+
+  - id: "seo-hreflang"
+    name: "Hreflang Tags"
+    description: "Multilingual pages should have hreflang annotations"
+    severity: "minor"
+    category: "meta"
+    standard: "Google Search Central - Internationalization"
+    check_type: "link_tag_check"
+    details:
+      tag: '<link rel="alternate" hreflang="...">'
+      description: "Tells Google which language versions exist for a page"
+
+  # --- Robots Control ---
+  - id: "seo-meta-robots"
+    name: "Meta Robots Tag"
+    description: "Check for meta robots directives"
+    severity: "major"
+    category: "crawling"
+    standard: "Google Search Central"
+    check_type: "meta_tag_check"
+    details:
+      tag: '<meta name="robots">'
+      valid_values:
+        - "index"
+        - "noindex"
+        - "follow"
+        - "nofollow"
+        - "noarchive"
+        - "nosnippet"
+        - "max-snippet"
+        - "max-image-preview"
+        - "max-video-preview"
+      warning_values:
+        - value: "noindex"
+          message: "Page is blocked from indexing"
+        - value: "nofollow"
+          message: "Links on this page will not be followed"
+        - value: "none"
+          message: "Page is blocked from indexing and links won't be followed"
+
+# ============================================================
+# 2. Content Structure
+# ============================================================
+  - id: "seo-heading-structure"
+    name: "Heading Structure"
+    description: "Page should have proper heading hierarchy for SEO"
+    severity: "major"
+    category: "content"
+    standard: "Google Search Essentials"
+    check_type: "heading_check"
+    details:
+      checks:
+        - id: "has-h1"
+          description: "Page should have exactly one H1 tag"
+          severity: "critical"
+        - id: "h1-not-empty"
+          description: "H1 tag should not be empty"
+          severity: "critical"
+        - id: "heading-hierarchy"
+          description: "Headings should follow logical hierarchy (no skipping levels)"
+          severity: "major"
+        - id: "heading-keywords"
+          description: "Headings should contain relevant keywords"
+          severity: "minor"
+        - id: "no-multiple-h1"
+          description: "Page should not have multiple H1 tags"
+          severity: "major"
+
+  - id: "seo-image-alt"
+    name: "Image Alt Text"
+    description: "Images should have descriptive alt attributes for SEO"
+    severity: "major"
+    category: "content"
+    standard: "Google Search Essentials - Images"
+    check_type: "image_check"
+    details:
+      checks:
+        - id: "has-alt"
+          description: "All images should have alt attribute"
+          severity: "critical"
+        - id: "alt-not-empty"
+          description: "Alt text should not be empty (unless decorative)"
+          severity: "major"
+        - id: "alt-not-filename"
+          description: "Alt text should not be just a filename"
+          severity: "minor"
+        - id: "alt-not-too-long"
+          description: "Alt text should be under 125 characters"
+          max_length: 125
+          severity: "minor"
+
+  - id: "seo-internal-links"
+    name: "Internal Linking"
+    description: "Page should have internal links for crawlability"
+    severity: "minor"
+    category: "content"
+    standard: "Google Search Central - Links"
+    check_type: "link_check"
+    details:
+      checks:
+        - id: "has-internal-links"
+          description: "Page should contain internal links"
+        - id: "no-broken-links"
+          description: "Internal links should not return 404"
+        - id: "descriptive-anchor"
+          description: "Link anchor text should be descriptive (not 'click here')"
+
+  - id: "seo-content-length"
+    name: "Content Length"
+    description: "Page should have sufficient text content"
+    severity: "minor"
+    category: "content"
+    standard: "SEO Best Practice"
+    check_type: "content_check"
+    details:
+      min_word_count: 300
+      description: "Pages with thin content may rank poorly"
+
+# ============================================================
+# 3. Technical SEO
+# ============================================================
+  - id: "seo-robots-txt"
+    name: "Robots.txt"
+    description: "Site should have a valid robots.txt file"
+    severity: "major"
+    category: "crawling"
+    standard: "Google Search Central - Robots.txt"
+    check_type: "file_check"
+    details:
+      path: "/robots.txt"
+      checks:
+        - id: "exists"
+          description: "robots.txt file should exist"
+        - id: "valid-syntax"
+          description: "robots.txt should have valid syntax"
+        - id: "not-blocking-important"
+          description: "Should not block important resources (CSS, JS, images)"
+        - id: "has-sitemap-reference"
+          description: "Should reference XML sitemap"
+
+  - id: "seo-sitemap-xml"
+    name: "XML Sitemap"
+    description: "Site should have a valid XML sitemap"
+    severity: "major"
+    category: "crawling"
+    standard: "Google Search Central - Sitemaps"
+    check_type: "file_check"
+    details:
+      paths:
+        - "/sitemap.xml"
+        - "/sitemap_index.xml"
+      checks:
+        - id: "exists"
+          description: "XML sitemap should exist"
+        - id: "valid-xml"
+          description: "Sitemap should be valid XML"
+        - id: "referenced-in-robots"
+          description: "Sitemap should be referenced in robots.txt"
+
+  - id: "seo-https"
+    name: "HTTPS"
+    description: "Site should be served over HTTPS"
+    severity: "critical"
+    category: "security_seo"
+    standard: "Google Search Essentials"
+    check_type: "protocol_check"
+    details:
+      description: "HTTPS is a confirmed Google ranking signal"
+
+  - id: "seo-mobile-friendly"
+    name: "Mobile Friendliness"
+    description: "Page should be mobile-friendly (mobile-first indexing)"
+    severity: "critical"
+    category: "mobile"
+    standard: "Google Mobile-First Indexing"
+    check_type: "mobile_check"
+    details:
+      checks:
+        - id: "viewport-meta"
+          description: "Has viewport meta tag"
+        - id: "responsive-design"
+          description: "Uses responsive CSS (media queries or fluid layout)"
+        - id: "no-horizontal-scroll"
+          description: "No horizontal scrolling at mobile widths"
+        - id: "readable-font-size"
+          description: "Font size is readable without zooming (>= 16px base)"
+        - id: "tap-targets"
+          description: "Tap targets are at least 48x48 CSS pixels"
+
+  - id: "seo-page-speed"
+    name: "Page Load Speed"
+    description: "Page should load quickly for better SEO"
+    severity: "major"
+    category: "performance_seo"
+    standard: "Google Core Web Vitals"
+    check_type: "performance_check"
+    details:
+      metrics:
+        - name: "LCP"
+          description: "Largest Contentful Paint"
+          good: "<= 2.5s"
+          needs_improvement: "<= 4.0s"
+          poor: "> 4.0s"
+        - name: "INP"
+          description: "Interaction to Next Paint"
+          good: "<= 200ms"
+          needs_improvement: "<= 500ms"
+          poor: "> 500ms"
+        - name: "CLS"
+          description: "Cumulative Layout Shift"
+          good: "<= 0.1"
+          needs_improvement: "<= 0.25"
+          poor: "> 0.25"
+
+  - id: "seo-url-structure"
+    name: "URL Structure"
+    description: "URLs should be clean and descriptive"
+    severity: "minor"
+    category: "technical"
+    standard: "Google Search Essentials - URL Structure"
+    check_type: "url_check"
+    details:
+      checks:
+        - id: "readable-url"
+          description: "URL should be human-readable (not query strings)"
+        - id: "no-underscores"
+          description: "URLs should use hyphens, not underscores"
+        - id: "lowercase"
+          description: "URLs should be lowercase"
+        - id: "no-excessive-depth"
+          description: "URL path should not be excessively deep (> 4 levels)"
+          max_depth: 4
+
+  - id: "seo-redirect-check"
+    name: "Redirect Handling"
+    description: "Check for proper redirect implementation"
+    severity: "major"
+    category: "technical"
+    standard: "Google Search Central - Redirects"
+    check_type: "redirect_check"
+    details:
+      checks:
+        - id: "no-redirect-chains"
+          description: "Avoid redirect chains (>2 hops)"
+        - id: "use-301"
+          description: "Permanent redirects should use 301 status"
+        - id: "no-meta-refresh-redirect"
+          description: "Avoid meta refresh redirects"
+
+# ============================================================
+# 4. Structured Data
+# ============================================================
+  - id: "seo-structured-data"
+    name: "Structured Data (Schema.org)"
+    description: "Page should include structured data for rich results"
+    severity: "minor"
+    category: "structured_data"
+    standard: "Schema.org / Google Structured Data"
+    check_type: "structured_data_check"
+    details:
+      formats:
+        - "JSON-LD (recommended)"
+        - "Microdata"
+        - "RDFa"
+      common_types:
+        - type: "WebSite"
+          description: "Site-level information with search action"
+        - type: "Organization"
+          description: "Organization/company information"
+        - type: "BreadcrumbList"
+          description: "Breadcrumb navigation structure"
+        - type: "Article"
+          description: "News article, blog post"
+        - type: "Product"
+          description: "Product information with reviews/pricing"
+        - type: "FAQPage"
+          description: "Frequently asked questions"
+        - type: "LocalBusiness"
+          description: "Local business information"
+        - type: "Event"
+          description: "Event information"
+        - type: "Recipe"
+          description: "Recipe with ingredients and instructions"
+        - type: "HowTo"
+          description: "Step-by-step instructions"
+        - type: "VideoObject"
+          description: "Video content metadata"
+
+  - id: "seo-json-ld-valid"
+    name: "JSON-LD Validity"
+    description: "JSON-LD structured data should be valid"
+    severity: "minor"
+    category: "structured_data"
+    standard: "Schema.org"
+    check_type: "structured_data_check"
+    details:
+      checks:
+        - id: "valid-json"
+          description: "JSON-LD must be valid JSON"
+        - id: "has-context"
+          description: "Must include @context: https://schema.org"
+        - id: "has-type"
+          description: "Must include @type property"
+        - id: "required-properties"
+          description: "Must include required properties for the type"
+
+# ============================================================
+# 5. Social Media / Open Graph
+# ============================================================
+  - id: "seo-open-graph"
+    name: "Open Graph Tags"
+    description: "Page should have Open Graph meta tags for social sharing"
+    severity: "minor"
+    category: "social"
+    standard: "Open Graph Protocol"
+    check_type: "meta_tag_check"
+    details:
+      required_tags:
+        - property: "og:title"
+          description: "Title for social sharing"
+        - property: "og:description"
+          description: "Description for social sharing"
+        - property: "og:image"
+          description: "Image for social sharing (min 1200x630px recommended)"
+        - property: "og:url"
+          description: "Canonical URL for social sharing"
+        - property: "og:type"
+          description: "Content type (website, article, etc.)"
+      recommended_tags:
+        - property: "og:site_name"
+          description: "Website name"
+        - property: "og:locale"
+          description: "Locale for the content"
+
+  - id: "seo-twitter-cards"
+    name: "Twitter Card Tags"
+    description: "Page should have Twitter Card meta tags"
+    severity: "info"
+    category: "social"
+    standard: "Twitter Cards"
+    check_type: "meta_tag_check"
+    details:
+      tags:
+        - name: "twitter:card"
+          description: "Card type (summary, summary_large_image, player)"
+          required: true
+        - name: "twitter:title"
+          description: "Title for Twitter sharing"
+          required: false
+        - name: "twitter:description"
+          description: "Description for Twitter sharing"
+          required: false
+        - name: "twitter:image"
+          description: "Image for Twitter sharing"
+          required: false
+
+# ============================================================
+# 6. Crawling & Indexing
+# ============================================================
+  - id: "seo-crawlability"
+    name: "Page Crawlability"
+    description: "Page should be crawlable by search engines"
+    severity: "critical"
+    category: "crawling"
+    standard: "Google Search Central"
+    check_type: "crawl_check"
+    details:
+      checks:
+        - id: "status-200"
+          description: "Page should return HTTP 200 status"
+        - id: "not-blocked-robots"
+          description: "Page should not be blocked by robots.txt"
+        - id: "not-noindex"
+          description: "Page should not have noindex directive (unless intended)"
+        - id: "content-type-html"
+          description: "Content-Type should be text/html"
+
+  - id: "seo-favicon"
+    name: "Favicon"
+    description: "Site should have a favicon"
+    severity: "info"
+    category: "technical"
+    standard: "Google Search Central"
+    check_type: "file_check"
+    details:
+      description: "Favicons appear in search results and browser tabs"
+      check_locations:
+        - '<link rel="icon">'
+        - '<link rel="shortcut icon">'
+        - "/favicon.ico"
+
+  - id: "seo-404-page"
+    name: "Custom 404 Page"
+    description: "Site should have a custom 404 error page"
+    severity: "minor"
+    category: "technical"
+    standard: "Google Search Essentials"
+    check_type: "http_check"
+    details:
+      description: "Custom 404 pages help users navigate back to working pages"
+
+  - id: "seo-nofollow-usage"
+    name: "Nofollow Link Usage"
+    description: "Check for proper use of rel=nofollow on links"
+    severity: "info"
+    category: "links"
+    standard: "Google Search Central - Links"
+    check_type: "link_check"
+    details:
+      rel_values:
+        - value: "nofollow"
+          description: "Do not follow this link"
+          use_case: "User-generated content, untrusted links"
+        - value: "ugc"
+          description: "User-generated content"
+          use_case: "Comments, forum posts"
+        - value: "sponsored"
+          description: "Paid/sponsored link"
+          use_case: "Advertisements, sponsored content"

backend/requirements.txt

@@ -30,5 +30,8 @@ playwright>=1.49.0
 weasyprint>=62.0
 Jinja2>=3.1.0
 
+# Rules (YAML)
+PyYAML>=6.0.0
+
 # Utilities
 python-slugify>=8.0.0