Research: industry rulesets, and why there is only one

[kinlane]

The industry-ruleset counterpart to the alias research, arguing api-commons/spotlight-spec#21.

What is here

• research/industry-rulesets.md → /research/industry-rulesets/
• research/index.md — a fifth card
• _posts/2026-09-11-one-industry-ruleset.md — queued, not published

The finding

The ecosystem has exactly one ruleset encoding an industry standard — OWASP, last functionally changed September 2024, 21 open issues. There has never been a FHIR one: not on npm, not in the stoplightio org, and the project's own community index has never contained the word at any point in its history.

Read against a public catalog of 610 standards, 118 typed as industry standards — call it ~95 after stripping catalog buckets ("ISO Standard", "IT Standards") and Java platform specs filed under the same label.

It is not a demand problem. Where implementer counts exist they cluster hard: NACHA 83 companies, ISO 20022 27, FHIR and EDIFACT 20 each.

It is a "what can a linter even see" problem. Sorted by that, industry standards fall into three unlike tiers:

• A — the standard is an API description (CAMARA, TM Forum, FDX, UK Open Banking, OGC API). Conformance is checkable. Servable today; nothing serves it.
• B — the standard is a data model inside descriptions (FHIR, US Core, GS1, MISMO). A useful subset is checkable; conformance is not, because it is defined against profile logic outside the description. Most useful tier, most dangerous — passing is not conformance.
• C — the wire format is not a structured document (NACHA, X12, EDIFACT, FIX, ISO 8583, HL7 v2). A JSON linter cannot see it.

The inversion is the story: the standard with the largest implementer count is the one a ruleset can say least about.

What it asks of #21

Four requirements, none of them "more rules": a ruleset must be able to declare what standard and version it encodes; it must be able to declare what it does not check, or every industry ruleset silently overclaims and the badge in #10 inherits it; composition needs precedence; and the maintenance model is the actual blocker, since standards bodies will not maintain rulesets and three of the four published add-ons have been dead since 2024.

It argues a first ruleset should target FDX or CAMARA rather than FHIR — not because they matter more, but because they are where a claim can be stood behind.

Notes

• Disclosure is in the page. The standards catalog is maintained by the same person as this fork; it is used because it is public and checkable, not because it is neutral, and the page says so.
• The three-tier classification is explicitly offered as a first pass to argue with, not a finished taxonomy — I did not individually verify all 118.
• Every external link fetched and returns 200. Jekyll builds clean.