@evolith/core-domain 1.0.0 → 1.0.1

package/rulesets/opa/README.md

@@ -0,0 +1,22 @@
+# OPA Policies and Input Schemas
+
+This directory contains the core Open Policy Agent (OPA) `.rego` policies used for architecture and governance validation in the Evolith platform.
+
+Every OPA policy defines a formal contract for its input, backed by a versioned JSON Schema.
+
+## OPA Policies and Schemas
+
+| Policy File | Test File | Input JSON Schema | Description |
+|---|---|---|---|
+| [governance.rego](./governance.rego) | [governance.test.rego](./governance.test.rego) | [governance.input.schema.json](./schemas/governance.input.schema.json) | Verifies satellite inheritance boundaries and mandatory decisions. |
+| [mcp.rego](./mcp.rego) | [mcp.test.rego](./mcp.test.rego) | [mcp.input.schema.json](./schemas/mcp.input.schema.json) | Verifies Model Context Protocol (MCP) compliance and smoke testing evidence. |
+| [version-pinning.rego](./version-pinning.rego) | [version-pinning.test.rego](./version-pinning.test.rego) | [version-pinning.input.schema.json](./schemas/version-pinning.input.schema.json) | Enforces strict package dependency pinning rules. |
+| [cli-readiness.rego](./cli-readiness.rego) | [cli-readiness.test.rego](./cli-readiness.test.rego) | [cli-readiness.input.schema.json](./schemas/cli-readiness.input.schema.json) | Validates Smart CLI compilation, documentation, and lock file readiness. |
+| [knowledge-intake.rego](./knowledge-intake.rego) | [knowledge-intake.test.rego](./knowledge-intake.test.rego) | [knowledge-intake.input.schema.json](./schemas/knowledge-intake.input.schema.json) | Governs the intake lifecycle, review status, and topology matching of external knowledge. |
+| [taxonomy.rego](./taxonomy.rego) | [taxonomy.test.rego](./taxonomy.test.rego) | [taxonomy.input.schema.json](./schemas/taxonomy.input.schema.json) | Validates repository directory taxonomy, ADR file names, and bilingual pairs. |
+| [ci-cd.rego](./ci-cd.rego) | [ci-cd.test.rego](./ci-cd.test.rego) | [ci-cd.input.schema.json](./schemas/ci-cd.input.schema.json) | Asserts that dependency scanning, workflow scripts, and dependency updates are present. |
+| [evidence.rego](./evidence.rego) | [evidence.test.rego](./evidence.test.rego) | [evidence.input.schema.json](./schemas/evidence.input.schema.json) | Validates the schema, retention periods, and ownership of gate evidence artifacts. |
+| [abac-mcp-tool-access.rego](./abac-mcp-tool-access.rego) | [abac-mcp-tool-access.test.rego](./abac-mcp-tool-access.test.rego) | [abac-mcp-tool-access.input.schema.json](./schemas/abac-mcp-tool-access.input.schema.json) | Restricts Model Context Protocol (MCP) tool execution by role, action, and environment. |
+
+---
+[Back to Rulesets Hub](../README.md)

package/rulesets/opa/abac-mcp-tool-access.rego

@@ -0,0 +1,122 @@
+# ABAC Policy for Agentic MCP Tool Execution
+# Reference implementation for ADR-0087
+# Dual-Engine Parity: This policy mirrors the TypeScript ABAC evaluator
+#
+# Input schema:
+# {
+#   "user": { "id": string, "roles": [string], "tenant": string },
+#   "tool_name": string,
+#   "resource_domain": string,
+#   "environment": string
+# }
+
+package evolith.abac
+
+import rego.v1
+
+# ---------------------------------------------------------------------------
+# Role hierarchy
+# ---------------------------------------------------------------------------
+read_only_roles  := {"viewer", "auditor"}
+developer_roles  := {"developer", "qa"}
+operator_roles   := {"operator", "sre"}
+architect_roles  := {"architect", "admin"}
+
+# ---------------------------------------------------------------------------
+# Tool classification
+# ---------------------------------------------------------------------------
+read_tools := {
+  "evolith-ping",
+  "evolith-echo",
+  "evolith-read-gap-tracking",
+  "evolith-read-file",
+  "evolith-list-dir",
+  "evolith-gate-evaluate",
+  "evolith-gate-status"
+}
+
+write_tools := {
+  "evolith-write-file",
+  "evolith-replace-file",
+  "evolith-run-command"
+}
+
+deploy_tools := {
+  "evolith-deploy",
+  "evolith-merge-branch",
+  "evolith-publish-release"
+}
+
+# ---------------------------------------------------------------------------
+# Helper: check if the user holds at least one of the allowed roles
+# ---------------------------------------------------------------------------
+user_has_role(allowed_roles) if {
+  role := input.user.roles[_]
+  allowed_roles[role]
+}
+
+# ---------------------------------------------------------------------------
+# ABAC decision rules
+# ---------------------------------------------------------------------------
+
+# Allow read tools for ALL authenticated users
+allow if {
+  read_tools[input.tool_name]
+  count(input.user.roles) > 0
+}
+
+# Allow write tools for operator and architect roles
+allow if {
+  write_tools[input.tool_name]
+  user_has_role(operator_roles | architect_roles)
+}
+
+# Allow write tools in non-production environments for developers
+allow if {
+  write_tools[input.tool_name]
+  user_has_role(developer_roles)
+  input.environment != "production"
+}
+
+# Allow deploy tools ONLY for architects and operators
+allow if {
+  deploy_tools[input.tool_name]
+  user_has_role(architect_roles | operator_roles)
+}
+
+# Block ALL deploy tools in production unless user is architect
+deny if {
+  deploy_tools[input.tool_name]
+  input.environment == "production"
+  not user_has_role(architect_roles)
+}
+
+# ---------------------------------------------------------------------------
+# Violations: deny overrides allow
+# ---------------------------------------------------------------------------
+
+violations contains {"id": "ABAC-01", "message": msg} if {
+  deny
+  msg := sprintf(
+    "Tool '%v' explicitly denied for user '%v' with roles %v in environment '%v'",
+    [input.tool_name, input.user.id, input.user.roles, input.environment]
+  )
+}
+
+violations contains {"id": "ABAC-01", "message": msg} if {
+  not allow
+  msg := sprintf(
+    "Tool '%v' not allowed for user '%v' with roles %v in environment '%v'",
+    [input.tool_name, input.user.id, input.user.roles, input.environment]
+  )
+}
+
+violations contains {"id": "ABAC-02", "message": "No roles present on user context; all tool calls denied"} if {
+  count(input.user.roles) == 0
+}
+
+violations contains {"id": "ABAC-03", "message": "Unknown tool requested; not in any known classification"} if {
+  not read_tools[input.tool_name]
+  not write_tools[input.tool_name]
+  not deploy_tools[input.tool_name]
+}

package/rulesets/opa/abac-mcp-tool-access.test.rego

@@ -0,0 +1,33 @@
+package evolith.abac_test
+
+import data.evolith.abac
+
+test_architect_can_deploy_in_production {
+  violations := abac.violations with input as {"user": {"id": "arch-1", "roles": ["architect"], "tenant": "evolith"}, "tool_name": "evolith-deploy", "resource_domain": "core", "environment": "production"}
+  count(violations) == 0
+}
+
+test_viewer_cannot_write {
+  violations := abac.violations with input as {"user": {"id": "viewer-1", "roles": ["viewer"], "tenant": "evolith"}, "tool_name": "evolith-write-file", "resource_domain": "core", "environment": "production"}
+  violations[_].id == "ABAC-01"
+}
+
+test_empty_roles_is_rejected {
+  violations := abac.violations with input as {"user": {"id": "anon", "roles": [], "tenant": "evolith"}, "tool_name": "evolith-ping", "resource_domain": "core", "environment": "production"}
+  violations[_].id == "ABAC-02"
+}
+
+test_unknown_tool_is_rejected {
+  violations := abac.violations with input as {"user": {"id": "arch-1", "roles": ["architect"], "tenant": "evolith"}, "tool_name": "evolith-unknown-tool", "resource_domain": "core", "environment": "production"}
+  violations[_].id == "ABAC-03"
+}
+
+test_developer_can_write_in_non_production {
+  violations := abac.violations with input as {"user": {"id": "dev-1", "roles": ["developer"], "tenant": "evolith"}, "tool_name": "evolith-write-file", "resource_domain": "core", "environment": "staging"}
+  count(violations) == 0
+}
+
+test_operator_cannot_deploy_in_production {
+  violations := abac.violations with input as {"user": {"id": "op-1", "roles": ["operator"], "tenant": "evolith"}, "tool_name": "evolith-deploy", "resource_domain": "core", "environment": "production"}
+  violations[_].id == "ABAC-01"
+}

package/rulesets/opa/anti-corruption-layer.rego

@@ -0,0 +1,39 @@
+package evolith.acl
+
+violations[{"id": "ACL-01", "message": "Adapter must pass schema validation before ingestion"}] {
+    not input.adapter.schemaValidated
+}
+
+violations[{"id": "ACL-02", "message": "Adapter transformations must be traceable to original source"}] {
+    not input.adapter.transformationTraceable
+}
+
+violations[{"id": "ACL-03", "message": "Adapter must not perform silent normalization of external data"}] {
+    input.adapter.silentNormalization
+}
+
+violations[{"id": "ACL-04", "message": "Adapter must declare coreCompatibilityVersion"}] {
+    not input.adapter.coreCompatibilityVersion
+}
+
+violations[{"id": "ACL-04", "message": "Adapter coreCompatibilityVersion must be a non-empty string"}] {
+    val := input.adapter.coreCompatibilityVersion
+    not is_string(val)
+}
+
+violations[{"id": "ACL-04", "message": "Adapter coreCompatibilityVersion must be a non-empty string"}] {
+    val := input.adapter.coreCompatibilityVersion
+    is_string(val)
+    count(val) == 0
+}
+
+violations[{"id": "ACL-05", "message": "Adapter must not expose raw external domain objects to Core — all external types must be mapped to Core domain types before crossing the boundary"}] {
+    input.adapter.exposesRawExternalTypes
+}
+
+violations[{"id": "ACL-06", "message": "ACL adapter must be located in 'adapter' or 'infrastructure' path, not domain"}] {
+    loc := lower(input.adapter.location)
+    not contains(loc, "/adapter")
+    not contains(loc, "/adapters")
+    not contains(loc, "/infrastructure")
+}

package/rulesets/opa/anti-corruption-layer.test.rego

@@ -0,0 +1,118 @@
+package evolith.acl_test
+
+import data.evolith.acl
+
+test_compliant_adapter_has_no_violations {
+    violations := acl.violations with input as {
+        "adapter": {
+            "schemaValidated": true,
+            "transformationTraceable": true,
+            "silentNormalization": false,
+            "coreCompatibilityVersion": "1.0.0",
+            "location": "src/Infrastructure/Adapters/jira-adapter.ts"
+        }
+    }
+    count(violations) == 0
+}
+
+test_schema_not_validated_is_violation {
+    violations := acl.violations with input as {
+        "adapter": {
+            "schemaValidated": false,
+            "transformationTraceable": true,
+            "silentNormalization": false,
+            "coreCompatibilityVersion": "1.0.0",
+            "location": "src/Infrastructure/Adapters/jira-adapter.ts"
+        }
+    }
+    violations[_].id == "ACL-01"
+}
+
+test_transformation_not_traceable_is_violation {
+    violations := acl.violations with input as {
+        "adapter": {
+            "schemaValidated": true,
+            "transformationTraceable": false,
+            "silentNormalization": false,
+            "coreCompatibilityVersion": "1.0.0",
+            "location": "src/Infrastructure/Adapters/jira-adapter.ts"
+        }
+    }
+    violations[_].id == "ACL-02"
+}
+
+test_silent_normalization_is_violation {
+    violations := acl.violations with input as {
+        "adapter": {
+            "schemaValidated": true,
+            "transformationTraceable": true,
+            "silentNormalization": true,
+            "coreCompatibilityVersion": "1.0.0",
+            "location": "src/Infrastructure/Adapters/jira-adapter.ts"
+        }
+    }
+    violations[_].id == "ACL-03"
+}
+
+test_missing_core_compatibility_version_is_violation {
+    violations := acl.violations with input as {
+        "adapter": {
+            "schemaValidated": true,
+            "transformationTraceable": true,
+            "silentNormalization": false,
+            "location": "src/Infrastructure/Adapters/jira-adapter.ts"
+        }
+    }
+    violations[_].id == "ACL-04"
+}
+
+test_empty_core_compatibility_version_is_violation {
+    violations := acl.violations with input as {
+        "adapter": {
+            "schemaValidated": true,
+            "transformationTraceable": true,
+            "silentNormalization": false,
+            "coreCompatibilityVersion": "",
+            "location": "src/Infrastructure/Adapters/jira-adapter.ts"
+        }
+    }
+    violations[_].id == "ACL-04"
+}
+
+test_adapter_in_domain_path_is_violation {
+    violations := acl.violations with input as {
+        "adapter": {
+            "schemaValidated": true,
+            "transformationTraceable": true,
+            "silentNormalization": false,
+            "coreCompatibilityVersion": "1.0.0",
+            "location": "src/Domain/jira-adapter.ts"
+        }
+    }
+    violations[_].id == "ACL-06"
+}
+
+test_adapter_in_infrastructure_path_is_not_violation {
+    violations := acl.violations with input as {
+        "adapter": {
+            "schemaValidated": true,
+            "transformationTraceable": true,
+            "silentNormalization": false,
+            "coreCompatibilityVersion": "1.0.0",
+            "location": "src/Infrastructure/Adapters/jira-adapter.ts"
+        }
+    }
+    count(violations) == 0
+}
+
+test_all_violations_detected {
+    violations := acl.violations with input as {
+        "adapter": {
+            "schemaValidated": false,
+            "transformationTraceable": false,
+            "silentNormalization": true,
+            "location": "src/Domain/jira-adapter.ts"
+        }
+    }
+    count(violations) >= 4
+}

package/rulesets/opa/ci-cd.rego

@@ -0,0 +1,41 @@
+package evolith.ci_cd
+
+violations[{"id": "DEP-04", "message": "package-lock.json not found at project or workspace root"}] {
+    not input.satellite.hasPackageLock
+    not input.core.hasPackageLock
+}
+
+workflows_with_ci := [name | content := input.satellite.workflows[name]; contains(content, "npm ci")]
+violations[{"id": "DEP-05", "message": "No .github/workflows directory found"}] {
+    count(input.satellite.workflows) == 0
+}
+
+violations[{"id": "DEP-05", "message": "CI workflow does not use \"npm ci\""}] {
+    count(input.satellite.workflows) > 0
+    count(workflows_with_ci) == 0
+}
+
+workflows_with_audit := [name | content := input.satellite.workflows[name]; contains(content, "npm audit")]
+violations[{"id": "DEP-06", "message": "No .github/workflows directory found"}] {
+    count(input.satellite.workflows) == 0
+}
+
+violations[{"id": "DEP-06", "message": "CI workflow does not run \"npm audit\""}] {
+    count(input.satellite.workflows) > 0
+    count(workflows_with_audit) == 0
+}
+
+violations[{"id": "DEP-07", "message": "No .github/workflows directory found"}] {
+    count(input.satellite.workflows) == 0
+}
+
+violations[{"id": "DEP-07", "message": "CI workflow does not run \"npm audit\""}] {
+    count(input.satellite.workflows) > 0
+    count(workflows_with_audit) == 0
+}
+
+violations[{"id": "DEP-09", "message": "No .github/dependabot.yml or .renovaterc.json found"}] {
+    not input.satellite.hasDependabot
+    not input.satellite.hasRenovate
+    not input.core.hasDependabot
+}

package/rulesets/opa/ci-cd.test.rego

@@ -0,0 +1,23 @@
+package evolith.ci_cd_test
+
+import data.evolith.ci_cd
+
+test_ci_compliant_project_has_no_violations {
+  violations := ci_cd.violations with input as {"satellite": {"hasPackageLock": true, "workflows": {"ci.yml": "npm ci\ntests", "audit.yml": "npm audit"}, "hasDependabot": true}, "core": {"hasPackageLock": true}}
+  count(violations) == 0
+}
+
+test_missing_package_lock_is_rejected {
+  violations := ci_cd.violations with input as {"satellite": {"hasPackageLock": false, "workflows": {}, "hasDependabot": false}, "core": {"hasPackageLock": false}}
+  violations[_].id == "DEP-04"
+}
+
+test_missing_npm_ci_in_workflow_is_rejected {
+  violations := ci_cd.violations with input as {"satellite": {"hasPackageLock": true, "workflows": {"ci.yml": "npm install"}, "hasDependabot": true}, "core": {"hasPackageLock": true}}
+  violations[_].id == "DEP-05"
+}
+
+test_missing_dependabot_is_rejected {
+  violations := ci_cd.violations with input as {"satellite": {"hasPackageLock": true, "workflows": {"ci.yml": "npm ci"}, "hasDependabot": false, "hasRenovate": false}, "core": {"hasPackageLock": true, "hasDependabot": false}}
+  violations[_].id == "DEP-09"
+}

package/rulesets/opa/cicd-quality-gates.rego

@@ -0,0 +1,29 @@
+package evolith.cicd_quality_gates
+
+violations[{"id": "CICD-01", "message": "CodeQL static analysis not configured in CI pipeline"}] {
+    not input.satellite.ci.hasCodeql
+}
+
+violations[{"id": "CICD-02", "message": "Dependency vulnerability audit not configured in CI pipeline"}] {
+    not input.satellite.ci.hasDependencyAudit
+}
+
+violations[{"id": "CICD-03", "message": "Secret detection not enabled on repository"}] {
+    not input.satellite.ci.hasSecretDetection
+}
+
+violations[{"id": "CICD-04", "message": "Not all quality gates are required before merge"}] {
+    not input.satellite.ci.gatesRequiredBeforeMerge
+}
+
+violations[{"id": "CICD-05", "message": "Security findings without documented justification or accepted risk — all findings must have a linked justification or resolution ticket"}] {
+    input.satellite.findings.hasUnjustifiedSecurityFindings
+}
+
+violations[{"id": "CICD-06", "message": "Critical findings SLA (24h) not tracked in issue tracker"}] {
+    input.satellite.findings.criticalAgeHours > 24
+}
+
+violations[{"id": "CICD-07", "message": "High findings SLA (72h) not tracked in issue tracker"}] {
+    input.satellite.findings.highAgeHours > 72
+}

package/rulesets/opa/cicd-quality-gates.test.rego

@@ -0,0 +1,54 @@
+package evolith.cicd_quality_gates_test
+
+import data.evolith.cicd_quality_gates
+
+compliant_input := {"satellite": {
+  "ci": {
+    "hasCodeql": true,
+    "hasDependencyAudit": true,
+    "hasSecretDetection": true,
+    "gatesRequiredBeforeMerge": true,
+  },
+  "findings": {"criticalAgeHours": 12, "highAgeHours": 48},
+}}
+
+test_compliant_ci_cd_gates_has_no_violations {
+  violations := cicd_quality_gates.violations with input as compliant_input
+  count(violations) == 0
+}
+
+test_missing_codeql_is_rejected {
+  i := json.patch(compliant_input, [{"op": "replace", "path": "/satellite/ci/hasCodeql", "value": false}])
+  violations := cicd_quality_gates.violations with input as i
+  violations[_].id == "CICD-01"
+}
+
+test_missing_dependency_audit_is_rejected {
+  i := json.patch(compliant_input, [{"op": "replace", "path": "/satellite/ci/hasDependencyAudit", "value": false}])
+  violations := cicd_quality_gates.violations with input as i
+  violations[_].id == "CICD-02"
+}
+
+test_missing_secret_detection_is_rejected {
+  i := json.patch(compliant_input, [{"op": "replace", "path": "/satellite/ci/hasSecretDetection", "value": false}])
+  violations := cicd_quality_gates.violations with input as i
+  violations[_].id == "CICD-03"
+}
+
+test_gates_not_required_before_merge_is_rejected {
+  i := json.patch(compliant_input, [{"op": "replace", "path": "/satellite/ci/gatesRequiredBeforeMerge", "value": false}])
+  violations := cicd_quality_gates.violations with input as i
+  violations[_].id == "CICD-04"
+}
+
+test_critical_sla_breach_is_rejected {
+  i := json.patch(compliant_input, [{"op": "replace", "path": "/satellite/findings/criticalAgeHours", "value": 48}])
+  violations := cicd_quality_gates.violations with input as i
+  violations[_].id == "CICD-06"
+}
+
+test_high_sla_breach_is_rejected {
+  i := json.patch(compliant_input, [{"op": "replace", "path": "/satellite/findings/highAgeHours", "value": 100}])
+  violations := cicd_quality_gates.violations with input as i
+  violations[_].id == "CICD-07"
+}

package/rulesets/opa/cli-core-parity.rego

@@ -0,0 +1,17 @@
+package evolith.cli_core_parity
+
+violations[{"id": "CLI-PAR-01", "message": "Executable Core rule missing parity record (CLI status, MCP status, test status, evidence status)"}] {
+    input.satellite.coreParity.ruleWithoutParityRecord
+}
+
+violations[{"id": "CLI-PAR-02", "message": "CLI and MCP implement divergent business logic for same capability"}] {
+    input.satellite.coreParity.divergentValidationLogic
+}
+
+violations[{"id": "CLI-PAR-03", "message": "CLI and MCP return inconsistent results for same validation request"}] {
+    input.satellite.coreParity.inconsistentResults
+}
+
+violations[{"id": "CLI-PAR-04", "message": "Parity gap not documented with owner, priority, and planned closure date"}] {
+    input.satellite.coreParity.undocumentedParityGap
+}

package/rulesets/opa/cli-core-parity.test.rego

@@ -0,0 +1,39 @@
+package evolith.cli_core_parity_test
+
+import data.evolith.cli_core_parity
+
+compliant_input := {"satellite": {"coreParity": {
+  "ruleWithoutParityRecord": false,
+  "divergentValidationLogic": false,
+  "inconsistentResults": false,
+  "undocumentedParityGap": false,
+}}}
+
+test_compliant_core_parity_has_no_violations {
+  violations := cli_core_parity.violations with input as compliant_input
+  count(violations) == 0
+}
+
+test_rule_without_parity_record_is_rejected {
+  i := json.patch(compliant_input, [{"op": "replace", "path": "/satellite/coreParity/ruleWithoutParityRecord", "value": true}])
+  violations := cli_core_parity.violations with input as i
+  violations[_].id == "CLI-PAR-01"
+}
+
+test_divergent_logic_is_rejected {
+  i := json.patch(compliant_input, [{"op": "replace", "path": "/satellite/coreParity/divergentValidationLogic", "value": true}])
+  violations := cli_core_parity.violations with input as i
+  violations[_].id == "CLI-PAR-02"
+}
+
+test_inconsistent_results_is_rejected {
+  i := json.patch(compliant_input, [{"op": "replace", "path": "/satellite/coreParity/inconsistentResults", "value": true}])
+  violations := cli_core_parity.violations with input as i
+  violations[_].id == "CLI-PAR-03"
+}
+
+test_undocumented_parity_gap_is_rejected {
+  i := json.patch(compliant_input, [{"op": "replace", "path": "/satellite/coreParity/undocumentedParityGap", "value": true}])
+  violations := cli_core_parity.violations with input as i
+  violations[_].id == "CLI-PAR-04"
+}

package/rulesets/opa/cli-readiness.rego

@@ -0,0 +1,32 @@
+package evolith.cli_readiness
+
+violations[{"id": "CLI-RR-01", "message": "dist/main.js not found — run npm run build in sdk/cli"}] {
+    not input.core.cli.hasMainJs
+}
+
+violations[{"id": "CLI-RR-02", "message": "No compiled spec files in dist/ — run npm test to confirm"}] {
+    not input.core.cli.hasTests
+}
+
+violations[{"id": "CLI-RR-03", "message": "package-lock.json not found"}] {
+    not input.core.hasPackageLock
+    not input.core.cli.hasPackageLock
+}
+
+violations[{"id": "CLI-RR-04", "message": "No MCP smoke evidence found in .harness/evidence/"}] {
+    smoke_keys := [k | input.core.evidence[k]; contains(k, "mcp")]
+    count(smoke_keys) == 0
+}
+
+violations[{"id": "CLI-RR-04", "message": sprintf("MCP smoke evidence status: %v", [status])}] {
+    smoke_keys := [k | input.core.evidence[k]; contains(k, "mcp")]
+    count(smoke_keys) > 0
+    smoke := input.core.evidence[smoke_keys[0]]
+    status := smoke.status
+    status != "passed"
+}
+
+violations[{"id": "CLI-RR-05", "message": "CLI missing README.md or ARCHITECTURE.md"}] {
+    not input.core.cli.hasReadme
+    not input.core.cli.hasArchitectureMd
+}

package/rulesets/opa/cli-readiness.test.rego

@@ -0,0 +1,23 @@
+package evolith.cli_readiness_test
+
+import data.evolith.cli_readiness
+
+test_cli_ready_has_no_violations {
+  violations := cli_readiness.violations with input as {"core": {"cli": {"hasMainJs": true, "hasTests": true, "hasPackageLock": true, "hasReadme": true, "hasArchitectureMd": true}, "hasPackageLock": true, "evidence": {"mcp-smoke.json": {"status": "passed"}}}}
+  count(violations) == 0
+}
+
+test_missing_main_js_is_rejected {
+  violations := cli_readiness.violations with input as {"core": {"cli": {"hasMainJs": false, "hasTests": false, "hasPackageLock": false, "hasReadme": false, "hasArchitectureMd": false}, "hasPackageLock": false, "evidence": {}}}
+  violations[_].id == "CLI-RR-01"
+}
+
+test_missing_mcp_evidence_is_rejected {
+  violations := cli_readiness.violations with input as {"core": {"cli": {"hasMainJs": true, "hasTests": true, "hasPackageLock": true, "hasReadme": true, "hasArchitectureMd": true}, "hasPackageLock": true, "evidence": {}}}
+  violations[_].id == "CLI-RR-04"
+}
+
+test_missing_readme_is_rejected {
+  violations := cli_readiness.violations with input as {"core": {"cli": {"hasMainJs": true, "hasTests": true, "hasPackageLock": true, "hasReadme": false, "hasArchitectureMd": false}, "hasPackageLock": true, "evidence": {"mcp-smoke.json": {"status": "passed"}}}}
+  violations[_].id == "CLI-RR-05"
+}

package/rulesets/opa/cli-release-readiness.rego

@@ -0,0 +1,21 @@
+package evolith.cli_release_readiness
+
+violations[{"id": "CLI-RR-01", "message": "TypeScript build does not pass — npm run build must exit 0 before release"}] {
+    not input.satellite.releaseReadiness.buildPasses
+}
+
+violations[{"id": "CLI-RR-02", "message": "Unit and integration tests do not pass — npm test must exit 0 before release"}] {
+    not input.satellite.releaseReadiness.testsPass
+}
+
+violations[{"id": "CLI-RR-03", "message": "Dependency graph not reproducible — package-lock.json missing or transitive dependencies broken"}] {
+    not input.satellite.releaseReadiness.lockFilePresent
+}
+
+violations[{"id": "CLI-RR-04", "message": "MCP smoke test does not pass — initialize and tools/list must respond over release transport"}] {
+    not input.satellite.releaseReadiness.mcpSmokePasses
+}
+
+violations[{"id": "CLI-RR-05", "message": "Release documentation does not match implementation — README exists but describes outdated state"}] {
+    not input.satellite.releaseReadiness.readmeExists
+}