@evolith/core-domain 1.0.0 → 1.0.1

package/rulesets/opa/engineering-manifesto.test.rego

@@ -0,0 +1,133 @@
+package evolith.engineering_manifesto_test
+
+import data.evolith.engineering_manifesto
+
+test_compliant_code_has_no_violations {
+    violations := engineering_manifesto.violations with input as {
+        "classLineCount": 100,
+        "classMethodCount": 8,
+        "liskovViolations": 0,
+        "domainImportsInfrastructure": false,
+        "maxCyclomaticComplexity": 10,
+        "circularDependencies": false,
+        "magicNumbersCount": 0
+    }
+    count(violations) == 0
+}
+
+test_class_exceeding_200_lines_is_violation {
+    violations := engineering_manifesto.violations with input as {
+        "classLineCount": 250,
+        "classMethodCount": 10,
+        "liskovViolations": 0,
+        "domainImportsInfrastructure": false,
+        "maxCyclomaticComplexity": 10,
+        "circularDependencies": false,
+        "magicNumbersCount": 0
+    }
+    violations[_].id == "EM-S-01"
+}
+
+test_liskov_violations_detected {
+    violations := engineering_manifesto.violations with input as {
+        "classLineCount": 100,
+        "classMethodCount": 8,
+        "liskovViolations": 2,
+        "domainImportsInfrastructure": false,
+        "maxCyclomaticComplexity": 10,
+        "circularDependencies": false,
+        "magicNumbersCount": 0
+    }
+    violations[_].id == "EM-S-03"
+}
+
+test_domain_imports_infrastructure_is_violation {
+    violations := engineering_manifesto.violations with input as {
+        "classLineCount": 100,
+        "classMethodCount": 8,
+        "liskovViolations": 0,
+        "domainImportsInfrastructure": true,
+        "maxCyclomaticComplexity": 10,
+        "circularDependencies": false,
+        "magicNumbersCount": 0
+    }
+    violations[_].id == "EM-S-05"
+}
+
+test_cyclomatic_complexity_exceeds_threshold {
+    violations := engineering_manifesto.violations with input as {
+        "classLineCount": 100,
+        "classMethodCount": 8,
+        "liskovViolations": 0,
+        "domainImportsInfrastructure": false,
+        "maxCyclomaticComplexity": 20,
+        "circularDependencies": false,
+        "magicNumbersCount": 0
+    }
+    violations[_].id == "EM-K-01"
+}
+
+test_god_class_by_line_count {
+    violations := engineering_manifesto.violations with input as {
+        "classLineCount": 600,
+        "classMethodCount": 10,
+        "liskovViolations": 0,
+        "domainImportsInfrastructure": false,
+        "maxCyclomaticComplexity": 10,
+        "circularDependencies": false,
+        "magicNumbersCount": 0
+    }
+    violations[_].id == "AP-01"
+}
+
+test_god_class_by_method_count {
+    violations := engineering_manifesto.violations with input as {
+        "classLineCount": 300,
+        "classMethodCount": 25,
+        "liskovViolations": 0,
+        "domainImportsInfrastructure": false,
+        "maxCyclomaticComplexity": 10,
+        "circularDependencies": false,
+        "magicNumbersCount": 0
+    }
+    violations[_].id == "AP-01"
+}
+
+test_circular_dependencies_detected {
+    violations := engineering_manifesto.violations with input as {
+        "classLineCount": 100,
+        "classMethodCount": 8,
+        "liskovViolations": 0,
+        "domainImportsInfrastructure": false,
+        "maxCyclomaticComplexity": 10,
+        "circularDependencies": true,
+        "magicNumbersCount": 0
+    }
+    violations[_].id == "AP-02"
+}
+
+test_magic_numbers_detected {
+    violations := engineering_manifesto.violations with input as {
+        "classLineCount": 100,
+        "classMethodCount": 8,
+        "liskovViolations": 0,
+        "domainImportsInfrastructure": false,
+        "maxCyclomaticComplexity": 10,
+        "circularDependencies": false,
+        "magicNumbersCount": 5
+    }
+    violations[_].id == "AP-05"
+}
+
+test_all_violations_detected {
+    violations := engineering_manifesto.violations with input as {
+        "classLineCount": 600,
+        "classMethodCount": 25,
+        "liskovViolations": 3,
+        "domainImportsInfrastructure": true,
+        "maxCyclomaticComplexity": 25,
+        "circularDependencies": true,
+        "magicNumbersCount": 10
+    }
+    count(violations) >= 5
+}

package/rulesets/opa/evidence.rego

@@ -0,0 +1,64 @@
+package evolith.evidence
+
+# Helper to get all evidence files
+evidence_files := [file | input.core.evidence[file]]
+
+violations[{"id": "EVD-01", "message": ".harness/evidence directory not found or empty"}] {
+    count(evidence_files) == 0
+}
+
+violations[{"id": "EVD-02", "message": ".harness/evidence directory not found or empty"}] {
+    count(evidence_files) == 0
+}
+
+violations[{"id": "EVD-03", "message": ".harness/evidence directory not found or empty"}] {
+    count(evidence_files) == 0
+}
+
+violations[{"id": "EVD-04", "message": ".harness/evidence directory not found or empty"}] {
+    count(evidence_files) == 0
+}
+
+violations[{"id": "EVD-01", "message": msg}] {
+    manifest := input.core.evidence[file]
+    required := {"id", "source", "generatedAt", "producer"}
+    actual := {k | manifest[k]}
+    missing := required - actual
+    count(missing) > 0
+    msg := sprintf("%v missing fields: %v", [file, concat(", ", missing)])
+}
+
+violations[{"id": "EVD-01", "message": msg}] {
+    manifest := input.core.evidence[file]
+    not manifest.evaluatedRules
+    not manifest.relatedRuleIds
+    not manifest.relatedGateId
+    msg := sprintf("%v missing evaluatedRules or relatedGateId", [file])
+}
+
+violations[{"id": "EVD-02", "message": msg}] {
+    manifest := input.core.evidence[file]
+    not manifest.sourceRef
+    msg := sprintf("%v missing sourceRef", [file])
+}
+
+violations[{"id": "EVD-03", "message": msg}] {
+    manifest := input.core.evidence[file]
+    required := {"status", "evaluatedRules", "blockingFailures"}
+    actual := {k | manifest[k]}
+    missing := required - actual
+    count(missing) > 0
+    msg := sprintf("%v missing fields: %v", [file, concat(", ", missing)])
+}
+
+violations[{"id": "EVD-04", "message": msg}] {
+    manifest := input.core.evidence[file]
+    not manifest.retentionPeriod
+    msg := sprintf("%v missing retentionPeriod or owner", [file])
+}
+
+violations[{"id": "EVD-04", "message": msg}] {
+    manifest := input.core.evidence[file]
+    not manifest.owner
+    msg := sprintf("%v missing retentionPeriod or owner", [file])
+}

package/rulesets/opa/evidence.test.rego

@@ -0,0 +1,23 @@
+package evolith.evidence_test
+
+import data.evolith.evidence
+
+test_complete_evidence_has_no_violations {
+  violations := evidence.violations with input as {"core": {"evidence": {"gate-evidence.json": {"id": "gate-001", "source": "cli", "generatedAt": "2026-06-20", "producer": "evolith-cli", "evaluatedRules": ["MM-R01"], "relatedGateId": "gate-01", "sourceRef": "main", "status": "passed", "blockingFailures": [], "retentionPeriod": "90d", "owner": "architecture-team"}}}}
+  count(violations) == 0
+}
+
+test_missing_evidence_directory_is_rejected {
+  violations := evidence.violations with input as {"core": {"evidence": {}}}
+  violations[_].id == "EVD-01"
+}
+
+test_evidence_missing_source_ref_is_rejected {
+  violations := evidence.violations with input as {"core": {"evidence": {"gate-evidence.json": {"id": "gate-001", "source": "cli", "generatedAt": "2026-06-20", "producer": "evolith-cli", "evaluatedRules": ["MM-R01"], "relatedGateId": "gate-01", "status": "passed", "blockingFailures": [], "retentionPeriod": "90d", "owner": "architecture-team"}}}}
+  violations[_].id == "EVD-02"
+}
+
+test_evidence_missing_retention_period_is_rejected {
+  violations := evidence.violations with input as {"core": {"evidence": {"gate-evidence.json": {"id": "gate-001", "source": "cli", "generatedAt": "2026-06-20", "producer": "evolith-cli", "evaluatedRules": ["MM-R01"], "relatedGateId": "gate-01", "sourceRef": "main", "status": "passed", "blockingFailures": []}}}}
+  violations[_].id == "EVD-04"
+}

package/rulesets/opa/executive-scorecards.rego

@@ -0,0 +1,41 @@
+package evolith.executive_scorecards
+
+violations[{"id": "DORA-01", "message": "Deployment Frequency metric not declared or dashboard required but missing"}] {
+    not input.satellite.scorecards.deploymentFrequencyDeclared
+}
+
+violations[{"id": "DORA-02", "message": "Lead Time for Changes metric not declared or dashboard required but missing"}] {
+    not input.satellite.scorecards.leadTimeDeclared
+}
+
+violations[{"id": "DORA-03", "message": "Change Failure Rate metric not declared or dashboard required but missing"}] {
+    not input.satellite.scorecards.changeFailureRateDeclared
+}
+
+violations[{"id": "DORA-04", "message": "Time to Restore (MTTR) metric not declared or dashboard required but missing"}] {
+    not input.satellite.scorecards.timeToRestoreDeclared
+}
+
+violations[{"id": "SPACE-01", "message": "Observability infrastructure (traces, logs, metrics) not operational in production"}] {
+    not input.satellite.scorecards.observabilityOperational
+}
+
+violations[{"id": "SPACE-02", "message": "Satellite performance (P95 latency) not measured or dashboard not linked in scorecards"}] {
+    not input.satellite.scorecards.performanceDashboardLinked
+}
+
+violations[{"id": "SPACE-03", "message": "Team cognitive load survey not completed or score not recorded in satellite scorecards"}] {
+    not input.satellite.scorecards.cognitivLoadSurveyCompleted
+}
+
+violations[{"id": "SPACE-04", "message": "Collaboration index (cross-team PRs and shared ADRs) not computed — required for SPACE executive review"}] {
+    not input.satellite.scorecards.collaborationIndexComputed
+}
+
+violations[{"id": "SPACE-05", "message": "Executive sponsor not assigned or quarterly review not documented"}] {
+    not input.satellite.scorecards.executiveSponsorAssigned
+}
+
+violations[{"id": "DRIFT-01", "message": "Architecture Drift Index not measured or exceeds 10% threshold"}] {
+    input.satellite.scorecards.architectureDriftIndex > 10
+}

package/rulesets/opa/executive-scorecards.test.rego

@@ -0,0 +1,60 @@
+package evolith.executive_scorecards_test
+
+import data.evolith.executive_scorecards
+
+compliant_input := {"satellite": {"scorecards": {
+  "deploymentFrequencyDeclared": true,
+  "leadTimeDeclared": true,
+  "changeFailureRateDeclared": true,
+  "timeToRestoreDeclared": true,
+  "observabilityOperational": true,
+  "executiveSponsorAssigned": true,
+  "architectureDriftIndex": 5,
+}}}
+
+test_compliant_scorecards_has_no_violations {
+  violations := executive_scorecards.violations with input as compliant_input
+  count(violations) == 0
+}
+
+test_missing_deployment_frequency_is_rejected {
+  i := json.patch(compliant_input, [{"op": "replace", "path": "/satellite/scorecards/deploymentFrequencyDeclared", "value": false}])
+  violations := executive_scorecards.violations with input as i
+  violations[_].id == "DORA-01"
+}
+
+test_missing_lead_time_is_rejected {
+  i := json.patch(compliant_input, [{"op": "replace", "path": "/satellite/scorecards/leadTimeDeclared", "value": false}])
+  violations := executive_scorecards.violations with input as i
+  violations[_].id == "DORA-02"
+}
+
+test_missing_change_failure_rate_is_rejected {
+  i := json.patch(compliant_input, [{"op": "replace", "path": "/satellite/scorecards/changeFailureRateDeclared", "value": false}])
+  violations := executive_scorecards.violations with input as i
+  violations[_].id == "DORA-03"
+}
+
+test_missing_time_to_restore_is_rejected {
+  i := json.patch(compliant_input, [{"op": "replace", "path": "/satellite/scorecards/timeToRestoreDeclared", "value": false}])
+  violations := executive_scorecards.violations with input as i
+  violations[_].id == "DORA-04"
+}
+
+test_missing_observability_is_rejected {
+  i := json.patch(compliant_input, [{"op": "replace", "path": "/satellite/scorecards/observabilityOperational", "value": false}])
+  violations := executive_scorecards.violations with input as i
+  violations[_].id == "SPACE-01"
+}
+
+test_missing_executive_sponsor_is_rejected {
+  i := json.patch(compliant_input, [{"op": "replace", "path": "/satellite/scorecards/executiveSponsorAssigned", "value": false}])
+  violations := executive_scorecards.violations with input as i
+  violations[_].id == "SPACE-05"
+}
+
+test_drift_index_exceeding_threshold_is_rejected {
+  i := json.patch(compliant_input, [{"op": "replace", "path": "/satellite/scorecards/architectureDriftIndex", "value": 15}])
+  violations := executive_scorecards.violations with input as i
+  violations[_].id == "DRIFT-01"
+}

package/rulesets/opa/gitflow-branching.rego

@@ -0,0 +1,41 @@
+package evolith.gitflow_branching
+
+violations[{"id": "GIT-01", "message": "Branch name does not follow pattern: type/ticket-id-description"}] {
+    input.satellite.git.branchNameInvalid
+}
+
+violations[{"id": "GIT-02", "message": "Direct push to protected branch detected — all changes must come through PRs"}] {
+    input.satellite.git.directPushToProtectedBranch
+}
+
+violations[{"id": "GIT-03", "message": "PR merged without minimum 1 approved review"}] {
+    not input.satellite.git.prHasMinimumReview
+}
+
+violations[{"id": "GIT-04", "message": "Release tag does not follow semver format v{major}.{minor}.{patch}"}] {
+    input.satellite.git.releaseTagInvalid
+}
+
+violations[{"id": "GIT-05", "message": "Feature branches must merge via squash or rebase — merge commits that clutter history with intermediary commits are not allowed on protected branches"}] {
+    input.satellite.git.featureBranchMergeNotSquashOrRebase
+}
+
+violations[{"id": "GIT-06", "message": "Hotfix branch not following expedited merge path — hotfix/* must merge directly to main and back-merge to develop within the release cycle"}] {
+    input.satellite.git.hotfixNotExpeditedPath
+}
+
+violations[{"id": "GIT-07", "message": "Stale branch not deleted after merge — branches merged more than 7 days ago must be removed from remote"}] {
+    input.satellite.git.hasStaleBranchesAfterMerge
+}
+
+violations[{"id": "GIT-08", "message": "Commit message does not follow Conventional Commits format"}] {
+    input.satellite.git.commitMessageInvalid
+}
+
+violations[{"id": "GIT-09", "message": "Environment promotion does not follow develop→qa→uat→main sequence"}] {
+    input.satellite.git.promotionSequenceInvalid
+}
+
+violations[{"id": "GIT-10", "message": "PR into qa/uat/main/release/hotfix without minimum 2 approvals"}] {
+    not input.satellite.git.higherEnvPrHasTwoApprovals
+}

package/rulesets/opa/gitflow-branching.test.rego

@@ -0,0 +1,60 @@
+package evolith.gitflow_branching_test
+
+import data.evolith.gitflow_branching
+
+compliant_input := {"satellite": {"git": {
+  "branchNameInvalid": false,
+  "directPushToProtectedBranch": false,
+  "prHasMinimumReview": true,
+  "releaseTagInvalid": false,
+  "commitMessageInvalid": false,
+  "promotionSequenceInvalid": false,
+  "higherEnvPrHasTwoApprovals": true,
+}}}
+
+test_compliant_gitflow_has_no_violations {
+  violations := gitflow_branching.violations with input as compliant_input
+  count(violations) == 0
+}
+
+test_invalid_branch_name_is_rejected {
+  i := json.patch(compliant_input, [{"op": "replace", "path": "/satellite/git/branchNameInvalid", "value": true}])
+  violations := gitflow_branching.violations with input as i
+  violations[_].id == "GIT-01"
+}
+
+test_direct_push_to_protected_branch_is_rejected {
+  i := json.patch(compliant_input, [{"op": "replace", "path": "/satellite/git/directPushToProtectedBranch", "value": true}])
+  violations := gitflow_branching.violations with input as i
+  violations[_].id == "GIT-02"
+}
+
+test_pr_without_review_is_rejected {
+  i := json.patch(compliant_input, [{"op": "replace", "path": "/satellite/git/prHasMinimumReview", "value": false}])
+  violations := gitflow_branching.violations with input as i
+  violations[_].id == "GIT-03"
+}
+
+test_invalid_release_tag_is_rejected {
+  i := json.patch(compliant_input, [{"op": "replace", "path": "/satellite/git/releaseTagInvalid", "value": true}])
+  violations := gitflow_branching.violations with input as i
+  violations[_].id == "GIT-04"
+}
+
+test_invalid_commit_message_is_rejected {
+  i := json.patch(compliant_input, [{"op": "replace", "path": "/satellite/git/commitMessageInvalid", "value": true}])
+  violations := gitflow_branching.violations with input as i
+  violations[_].id == "GIT-08"
+}
+
+test_invalid_promotion_sequence_is_rejected {
+  i := json.patch(compliant_input, [{"op": "replace", "path": "/satellite/git/promotionSequenceInvalid", "value": true}])
+  violations := gitflow_branching.violations with input as i
+  violations[_].id == "GIT-09"
+}
+
+test_higher_env_pr_without_two_approvals_is_rejected {
+  i := json.patch(compliant_input, [{"op": "replace", "path": "/satellite/git/higherEnvPrHasTwoApprovals", "value": false}])
+  violations := gitflow_branching.violations with input as i
+  violations[_].id == "GIT-10"
+}

package/rulesets/opa/governance.rego

@@ -0,0 +1,39 @@
+package evolith.governance
+
+violations[{"id": "INH-01", "message": "Satellite contains a rulesets/ directory — inheriting from Core only is required"}] {
+    input.satellitePath != input.corePath
+    
+    # Check if "rulesets" is in satellite directories
+    dirs := {dir | dir := input.satellite.directories[_]}
+    dirs["rulesets"]
+}
+
+violations[{"id": "INH-02", "message": "Satellite coreRef.version must be a specific semver — 'latest' or unpinned references are prohibited"}] {
+    input.satellitePath != input.corePath
+    not input.satellite.contracts.coreVersionPinned
+}
+
+violations[{"id": "INH-03", "message": "Satellite governance version cannot be downgraded — downgrade requires Architecture Board exception with --force flag"}] {
+    input.satellitePath != input.corePath
+    input.satellite.contracts.governanceVersionDowngraded
+}
+
+violations[{"id": "INH-04", "message": "Satellite local ADRs must reference Core corpus — DECISIONS.md or local ADR registry with coreRef is required for extension decisions"}] {
+    input.satellitePath != input.corePath
+    files := {file | file := input.satellite.files[_]}
+    not files["DECISIONS.md"]
+    not input.satellite.contracts.hasLocalAdrRegistry
+}
+
+violations[{"id": "INH-05", "message": "Local ADR promotion to Core requires Architecture Board review artifact — no approval evidence found for this ADR promotion"}] {
+    input.satellitePath != input.corePath
+    input.satellite.contracts.hasAdrsAwaitingPromotion
+    not input.satellite.contracts.hasArchitectureBoardApproval
+}
+
+violations[{"id": "INH-06", "message": "Satellite missing DECISIONS.md in root directory"}] {
+    input.satellitePath != input.corePath
+
+    files := {file | file := input.satellite.files[_]}
+    not files["DECISIONS.md"]
+}

package/rulesets/opa/governance.test.rego

@@ -0,0 +1,23 @@
+package evolith.governance_test
+
+import data.evolith.governance
+
+test_satellite_without_rulesets_has_no_violations {
+  violations := governance.violations with input as {"satellitePath": "/satellite", "corePath": "/core", "satellite": {"directories": ["src", "docs"], "files": ["DECISIONS.md", "README.md"]}}
+  count(violations) == 0
+}
+
+test_satellite_with_rulesets_is_rejected {
+  violations := governance.violations with input as {"satellitePath": "/satellite", "corePath": "/core", "satellite": {"directories": ["rulesets", "src"], "files": ["DECISIONS.md"]}}
+  violations[_].id == "INH-01"
+}
+
+test_satellite_missing_decisions_md_is_rejected {
+  violations := governance.violations with input as {"satellitePath": "/satellite", "corePath": "/core", "satellite": {"directories": ["src"], "files": ["README.md"]}}
+  violations[_].id == "INH-06"
+}
+
+test_core_repo_is_exempt_from_inheritance_rules {
+  violations := governance.violations with input as {"satellitePath": "/core", "corePath": "/core", "satellite": {"directories": ["rulesets"], "files": []}}
+  count(violations) == 0
+}

package/rulesets/opa/hexagonal-architecture.rego

@@ -0,0 +1,33 @@
+package evolith.hexagonal_architecture
+
+violations[{"id": "HXA-01", "message": "Core (Domain) layer has framework imports — must be pure TypeScript only"}] {
+    input.satellite.layers.core.hasFrameworkImports
+}
+
+violations[{"id": "HXA-02", "message": "Application layer has infrastructure imports — may import Core and NestJS DI only"}] {
+    input.satellite.layers.application.hasInfrastructureImports
+}
+
+violations[{"id": "HXA-03", "message": "Infrastructure layer does not implement Core port interfaces"}] {
+    not input.satellite.layers.infrastructure.implementsPorts
+}
+
+violations[{"id": "HXA-04", "message": "Dependency direction violated — backward imports detected"}] {
+    input.satellite.layers.hasBackwardImports
+}
+
+violations[{"id": "HXA-05", "message": "AOP concerns found in Core/Application layers — prohibited"}] {
+    input.satellite.layers.core.hasAopDecorators
+}
+
+violations[{"id": "HXA-05", "message": "AOP concerns found in Core/Application layers — prohibited"}] {
+    input.satellite.layers.application.hasAopDecorators
+}
+
+violations[{"id": "HXA-06", "message": "AOP concerns (interceptors, decorators) must be implemented exclusively in Infrastructure layer — not in Core or Application"}] {
+    input.satellite.layers.infrastructure.aopNotInInfrastructure
+}
+
+violations[{"id": "HXA-07", "message": "Core domain tests require framework bootstrap — must run without framework"}] {
+    input.satellite.layers.core.domainTestsRequireBootstrap
+}

package/rulesets/opa/hexagonal-architecture.test.rego

@@ -0,0 +1,57 @@
+package evolith.hexagonal_architecture_test
+
+import data.evolith.hexagonal_architecture
+
+compliant_input := {"satellite": {"layers": {
+  "core": {"hasFrameworkImports": false, "hasAopDecorators": false, "domainTestsRequireBootstrap": false},
+  "application": {"hasInfrastructureImports": false, "hasAopDecorators": false},
+  "infrastructure": {"implementsPorts": true},
+  "hasBackwardImports": false,
+}}}
+
+test_compliant_hexagonal_has_no_violations {
+  violations := hexagonal_architecture.violations with input as compliant_input
+  count(violations) == 0
+}
+
+test_core_framework_imports_is_rejected {
+  i := json.patch(compliant_input, [{"op": "replace", "path": "/satellite/layers/core/hasFrameworkImports", "value": true}])
+  violations := hexagonal_architecture.violations with input as i
+  violations[_].id == "HXA-01"
+}
+
+test_application_infrastructure_imports_is_rejected {
+  i := json.patch(compliant_input, [{"op": "replace", "path": "/satellite/layers/application/hasInfrastructureImports", "value": true}])
+  violations := hexagonal_architecture.violations with input as i
+  violations[_].id == "HXA-02"
+}
+
+test_infrastructure_not_implementing_ports_is_rejected {
+  i := json.patch(compliant_input, [{"op": "replace", "path": "/satellite/layers/infrastructure/implementsPorts", "value": false}])
+  violations := hexagonal_architecture.violations with input as i
+  violations[_].id == "HXA-03"
+}
+
+test_backward_imports_is_rejected {
+  i := json.patch(compliant_input, [{"op": "replace", "path": "/satellite/layers/hasBackwardImports", "value": true}])
+  violations := hexagonal_architecture.violations with input as i
+  violations[_].id == "HXA-04"
+}
+
+test_aop_in_core_is_rejected {
+  i := json.patch(compliant_input, [{"op": "replace", "path": "/satellite/layers/core/hasAopDecorators", "value": true}])
+  violations := hexagonal_architecture.violations with input as i
+  violations[_].id == "HXA-05"
+}
+
+test_aop_in_application_is_rejected {
+  i := json.patch(compliant_input, [{"op": "replace", "path": "/satellite/layers/application/hasAopDecorators", "value": true}])
+  violations := hexagonal_architecture.violations with input as i
+  violations[_].id == "HXA-05"
+}
+
+test_domain_tests_requiring_bootstrap_is_rejected {
+  i := json.patch(compliant_input, [{"op": "replace", "path": "/satellite/layers/core/domainTestsRequireBootstrap", "value": true}])
+  violations := hexagonal_architecture.violations with input as i
+  violations[_].id == "HXA-07"
+}

package/rulesets/opa/infrastructure/helm-enforcement.rego

@@ -0,0 +1,33 @@
+package evolith.infrastructure.helm
+
+import rego.v1
+
+# INFRA-001: Helm Charts Over Raw Manifests Enforcement
+# Native counterpart: rulesets/infrastructure/helm-enforcement.rules.json
+# ADR ref: ADR-0076
+
+violations contains {"id": "INFRA-001", "message": msg} if {
+    file := input.infrastructure.kubernetesFiles[_]
+    not contains(file, "Chart.yaml")
+    not contains(file, "values.yaml")
+    not contains(file, "templates/")
+    endswith(file, ".yaml")
+    msg := sprintf("Raw Kubernetes manifest detected: %v — wrap in a Helm Chart (Chart.yaml required)", [file])
+}
+
+violations contains {"id": "INFRA-001", "message": "No Helm Chart.yaml found in Kubernetes infrastructure directory — all Kubernetes configs must use Helm"} if {
+    dirs := {d | d := input.infrastructure.directories[_]}
+    dirs["kubernetes"]
+    not any_chart_yaml
+}
+
+any_chart_yaml if {
+    file := input.infrastructure.kubernetesFiles[_]
+    contains(file, "Chart.yaml")
+}
+
+default allow := false
+
+allow if {
+    count(violations) == 0
+}

package/rulesets/opa/infrastructure/opa-sidecar-bundle.rego

@@ -0,0 +1,42 @@
+package evolith.infrastructure.opa_sidecar
+
+import rego.v1
+
+# INFRA-OPA-001: OPA Sidecar Bundle Integrity
+# Native counterpart: rulesets/infrastructure/opa-sidecar-bundle.rules.json
+
+violations contains {"id": "INFRA-OPA-001", "message": msg} if {
+    sidecar := input.infrastructure.opaSidecars[_]
+    not startswith(sidecar.bundleUrl, "https://")
+    msg := sprintf("OPA sidecar '%v' bundle URL must use HTTPS — unauthenticated transport prohibited", [sidecar.name])
+}
+
+violations contains {"id": "INFRA-OPA-001", "message": msg} if {
+    sidecar := input.infrastructure.opaSidecars[_]
+    not sidecar.credentialsFromSecret
+    msg := sprintf("OPA sidecar '%v' must source credentials from a Kubernetes Secret, not inline config", [sidecar.name])
+}
+
+violations contains {"id": "INFRA-OPA-001", "message": msg} if {
+    sidecar := input.infrastructure.opaSidecars[_]
+    not sidecar.bundleSignatureVerified
+    msg := sprintf("OPA sidecar '%v' does not verify bundle signatures — signed bundle verification is required", [sidecar.name])
+}
+
+violations contains {"id": "INFRA-OPA-001", "message": msg} if {
+    sidecar := input.infrastructure.opaSidecars[_]
+    not sidecar.bundleDigestPinned
+    msg := sprintf("OPA sidecar '%v' does not pin expected SHA-256 bundle digest — digest pinning required", [sidecar.name])
+}
+
+violations contains {"id": "INFRA-OPA-001", "message": msg} if {
+    sidecar := input.infrastructure.opaSidecars[_]
+    not sidecar.failClosedOnBundleLoad
+    msg := sprintf("OPA sidecar '%v' is not configured to fail-closed if bundle activation fails — readiness probe must block traffic until bundle is active", [sidecar.name])
+}
+
+default allow := false
+
+allow if {
+    count(violations) == 0
+}