---
uai: "1.0"
type: standards
status: active
project: iarpg.com
updated_utc: "2026-07-19T05:00:00Z"
---
# Coding Standards
- PHP 8.1+ with `declare(strict_types=1);`.
- Vanilla JavaScript only.
- No third-party runtime dependencies.
- Escape rendered values and validate request parameters.
- Use Content Security Policy, CSRF protection, rate limiting, and server-side validation.
- Use UTC timestamps in data, logs, manifests, and ledgers.
- Preserve source files byte-for-byte when copying or extracting.
- Corrections to canonical reports create traceable replacements or manifest updates; do not silently mutate source originals.