# References

> Canonical index of external standards, frameworks, services, and tooling referenced by Orla Numis's documentation and configuration. Prefer linking here from new docs rather than repeating long URLs everywhere.

## How to add a reference

1. Add the entry to the most specific category below.
2. Use the official vendor/specification URL when possible.
3. Record the project's current version pin or range exactly as it appears in repo config; use `n/a` only when the project consumes a hosted service rather than a package.
4. Link the place(s) in this repo where the reference is actively used.

## Standards & RFCs

| Name | URL | Version pin | Where used in this project |
|---|---|---|---|
| JSON Web Token (RFC 7519) | <https://www.rfc-editor.org/rfc/rfc7519> | n/a | [docs/authentication.md](authentication.md), [src/api/services/auth_service.go](../src/api/services/auth_service.go) |
| OWASP ASVS | <https://owasp.org/www-project-application-security-verification-standard/> | 4.0.3 | [docs/security-principles.md](security-principles.md), [docs/threat-model.md](threat-model.md) |
| OWASP Top 10 | <https://owasp.org/www-project-top-ten/> | 2021 | [docs/security-principles.md](security-principles.md), [docs/threat-model.md](threat-model.md) |
| CWE Catalog | <https://cwe.mitre.org/> | n/a | [docs/security-principles.md](security-principles.md), [docs/threat-model.md](threat-model.md) |
| CWE-79: Cross-site Scripting | <https://cwe.mitre.org/data/definitions/79.html> | n/a | [docs/threat-model.md](threat-model.md) |
| CWE-89: SQL Injection | <https://cwe.mitre.org/data/definitions/89.html> | n/a | [docs/threat-model.md](threat-model.md), [src/api/handlers/analysis.go](../src/api/handlers/analysis.go) |
| CWE-798: Use of Hard-coded Credentials | <https://cwe.mitre.org/data/definitions/798.html> | n/a | [docs/threat-model.md](threat-model.md), [Taskfile.yml](../Taskfile.yml) |
| Swagger / OpenAPI 2.0 | <https://swagger.io/specification/v2/> | generated by Swaggo | [docs/api-reference.md](api-reference.md), [src/api/docs/swagger.json](../src/api/docs/swagger.json), [src/api/docs/swagger.yaml](../src/api/docs/swagger.yaml) |

## Frameworks & libraries

| Name | URL | Version pin | Where used in this project |
|---|---|---|---|
| Gin | <https://gin-gonic.com/> | `v1.12.0` | [src/api/go.mod](../src/api/go.mod), [src/api/main.go](../src/api/main.go), [docs/ARCHITECTURE.md](ARCHITECTURE.md) |
| GORM | <https://gorm.io/> | `v1.30.5` | [src/api/go.mod](../src/api/go.mod), [src/api/repository/](../src/api/repository/), [docs/ARCHITECTURE.md](ARCHITECTURE.md) |
| pure-Go SQLite (`github.com/glebarez/sqlite`) | <https://github.com/glebarez/sqlite> | `v1.11.0` | [src/api/go.mod](../src/api/go.mod), [src/api/database/database.go](../src/api/database/database.go) |
| golang-jwt/jwt/v5 | <https://github.com/golang-jwt/jwt> | `v5.3.1` | [src/api/go.mod](../src/api/go.mod), [src/api/services/auth_service.go](../src/api/services/auth_service.go) |
| Vue | <https://vuejs.org/> | `^3.5.33` | [src/web/package.json](../src/web/package.json), [src/web/src/](../src/web/src/), [docs/ARCHITECTURE.md](ARCHITECTURE.md) |
| Pinia | <https://pinia.vuejs.org/> | `^3.0.4` | [src/web/package.json](../src/web/package.json), [src/web/src/stores/](../src/web/src/stores/) |
| Vite | <https://vite.dev/> | `^7.3.2` | [src/web/package.json](../src/web/package.json), [src/web/vite.config.ts](../src/web/vite.config.ts) |
| Axios | <https://axios-http.com/> | `^1.15.2` | [src/web/package.json](../src/web/package.json), [src/web/src/api/client.ts](../src/web/src/api/client.ts) |
| DOMPurify | <https://github.com/cure53/DOMPurify> | `^3.4.1` | [src/web/package.json](../src/web/package.json), [src/web/src/components/CoinSearchChat.vue](../src/web/src/components/CoinSearchChat.vue) |
| markdown-it | <https://github.com/markdown-it/markdown-it> | `^14.1.1` | [src/web/package.json](../src/web/package.json), [src/web/src/pages/CoinDetailPage.vue](../src/web/src/pages/CoinDetailPage.vue) |
| FastAPI | <https://fastapi.tiangolo.com/> | `>=0.115.0,<1.0` | [src/agent/pyproject.toml](../src/agent/pyproject.toml), [src/agent/app/main.py](../src/agent/app/main.py), [docs/ARCHITECTURE.md](ARCHITECTURE.md) |
| LangGraph | <https://langchain-ai.github.io/langgraph/> | `>=0.4.0,<2.0` | [src/agent/pyproject.toml](../src/agent/pyproject.toml), [src/agent/app/supervisor.py](../src/agent/app/supervisor.py), [docs/ARCHITECTURE.md](ARCHITECTURE.md) |
| LangChain | <https://python.langchain.com/> | `>=0.3.0,<2.0` | [src/agent/pyproject.toml](../src/agent/pyproject.toml), [src/agent/app/teams/](../src/agent/app/teams/) |
| Pydantic | <https://docs.pydantic.dev/> | `>=2.10.0,<3.0` | [src/agent/pyproject.toml](../src/agent/pyproject.toml), [src/agent/app/models/](../src/agent/app/models/) |

## External services

| Name | URL | Version pin | Where used in this project |
|---|---|---|---|
| Anthropic API / Claude | <https://docs.anthropic.com/> | n/a | [src/agent/app/llm/provider.py](../src/agent/app/llm/provider.py), [docs/ARCHITECTURE.md](ARCHITECTURE.md), [docs/getting-started.md](getting-started.md) |
| Ollama | <https://ollama.com/> | n/a | [src/api/services/ollama_service.go](../src/api/services/ollama_service.go), [src/agent/app/llm/provider.py](../src/agent/app/llm/provider.py), [docs/getting-started.md](getting-started.md) |
| SearXNG | <https://docs.searxng.org/> | n/a | [src/agent/app/tools/search.py](../src/agent/app/tools/search.py), [docs/ARCHITECTURE.md](ARCHITECTURE.md) |
| Numista API | <https://api.numista.com/> | n/a | [src/api/handlers/numista.go](../src/api/handlers/numista.go), [docs/getting-started.md](getting-started.md) |
| GitHub Security Advisories | <https://docs.github.com/en/code-security/security-advisories> | n/a | [SECURITY.md](../SECURITY.md), [docs/incident-response.md](incident-response.md) |

## Tooling & build chain

| Name | URL | Version pin | Where used in this project |
|---|---|---|---|
| Task | <https://taskfile.dev/> | task runner via `Taskfile.yml` | [Taskfile.yml](../Taskfile.yml), [README.md](../README.md), [docs/getting-started.md](getting-started.md) |
| Docker | <https://docs.docker.com/> | base images pinned in Dockerfiles, not a single repo package | [Dockerfile](../Dockerfile), [src/agent/Dockerfile](../src/agent/Dockerfile), [docs/deployment.md](deployment.md) |
| Docker Compose | <https://docs.docker.com/compose/> | compose spec via local CLI | [docker-compose.dev.yml](../docker-compose.dev.yml), [docs/deployment.md](deployment.md) |
| uv | <https://docs.astral.sh/uv/> | `0.11.22` | [src/agent/uv.lock](../src/agent/uv.lock), [src/agent/Dockerfile](../src/agent/Dockerfile), [.github/workflows/ci.yml](../.github/workflows/ci.yml) |
| Swaggo / swag | <https://github.com/swaggo/swag> | `v1.16.6` | [src/api/go.mod](../src/api/go.mod), [src/api/docs/](../src/api/docs/), [docs/api-reference.md](api-reference.md) |
| Ruff | <https://docs.astral.sh/ruff/> | `>=0.9.0,<1.0` | [src/agent/pyproject.toml](../src/agent/pyproject.toml), [.pre-commit-config.yaml](../.pre-commit-config.yaml) |
| Pytest | <https://docs.pytest.org/> | `>=8.0,<10.0` | [src/agent/pyproject.toml](../src/agent/pyproject.toml), [src/agent/tests/](../src/agent/tests/) |
| pip-audit | <https://pypi.org/project/pip-audit/> | `>=2.9.0,<3.0` | [src/agent/pyproject.toml](../src/agent/pyproject.toml) |
| Vitest | <https://vitest.dev/> | `^4.1.5` | [src/web/package.json](../src/web/package.json), [src/web/src/__tests__/](../src/web/src/__tests__/) |
| ESLint | <https://eslint.org/> | `^10.3.0` | [src/web/package.json](../src/web/package.json), [src/web/eslint.config.js](../src/web/eslint.config.js) |
| Gitleaks | <https://github.com/gitleaks/gitleaks> | `v8.30.1` (via pre-commit hook) | [.gitleaks.toml](../.gitleaks.toml), [.pre-commit-config.yaml](../.pre-commit-config.yaml), [docs/incident-response.md](incident-response.md) |