@evolith/core-domain 1.0.0 → 1.0.1

package/rulesets/opa/multi-tenancy.test.rego

@@ -0,0 +1,53 @@
+package evolith.multi_tenancy_test
+
+import data.evolith.multi_tenancy
+
+compliant_input := {"satellite": {"multiTenancy": {
+  "applicationFiltering": true,
+  "databaseEnforcement": true,
+  "tenantContextPropagation": true,
+  "crossTenantAccess": false,
+  "schemaStrategyDefined": true,
+  "apiTenantValidation": true,
+}}}
+
+test_compliant_multi_tenancy_has_no_violations {
+  violations := multi_tenancy.violations with input as compliant_input
+  count(violations) == 0
+}
+
+test_missing_application_filtering_is_rejected {
+  i := json.patch(compliant_input, [{"op": "replace", "path": "/satellite/multiTenancy/applicationFiltering", "value": false}])
+  violations := multi_tenancy.violations with input as i
+  violations[_].id == "MTN-01"
+}
+
+test_missing_database_enforcement_is_rejected {
+  i := json.patch(compliant_input, [{"op": "replace", "path": "/satellite/multiTenancy/databaseEnforcement", "value": false}])
+  violations := multi_tenancy.violations with input as i
+  violations[_].id == "MTN-02"
+}
+
+test_missing_tenant_context_propagation_is_rejected {
+  i := json.patch(compliant_input, [{"op": "replace", "path": "/satellite/multiTenancy/tenantContextPropagation", "value": false}])
+  violations := multi_tenancy.violations with input as i
+  violations[_].id == "MTN-03"
+}
+
+test_cross_tenant_access_is_rejected {
+  i := json.patch(compliant_input, [{"op": "replace", "path": "/satellite/multiTenancy/crossTenantAccess", "value": true}])
+  violations := multi_tenancy.violations with input as i
+  violations[_].id == "MTN-04"
+}
+
+test_missing_schema_strategy_is_rejected {
+  i := json.patch(compliant_input, [{"op": "replace", "path": "/satellite/multiTenancy/schemaStrategyDefined", "value": false}])
+  violations := multi_tenancy.violations with input as i
+  violations[_].id == "MTN-05"
+}
+
+test_missing_api_tenant_validation_is_rejected {
+  i := json.patch(compliant_input, [{"op": "replace", "path": "/satellite/multiTenancy/apiTenantValidation", "value": false}])
+  violations := multi_tenancy.violations with input as i
+  violations[_].id == "MTN-08"
+}

package/rulesets/opa/open-core-boundary.rego

@@ -0,0 +1,33 @@
+package evolith.open_core_boundary
+
+violations[{"id": "OCB-01", "message": "Core rulesets/schemas reference commercial license, paid feature flag, or enterprise-only dependency"}] {
+    input.satellite.openCore.coreHasEnterpriseReferences
+}
+
+violations[{"id": "OCB-02", "message": "Enterprise-only artifact missing explicit 'availability: enterprise' metadata"}] {
+    input.satellite.openCore.enterpriseArtifactNotMarked
+}
+
+violations[{"id": "OCB-03", "message": "ACL implementation code found in Core — must be in Enterprise layer only"}] {
+    input.satellite.openCore.aclImplementationInCore
+}
+
+violations[{"id": "OCB-04", "message": "CLI/MCP implementation gated behind paid license — must remain fully open in Core"}] {
+    input.satellite.openCore.cliMcpGated
+}
+
+violations[{"id": "OCB-05", "message": "Tracker-specific concepts found in Core rulesets — Tracker features cannot penetrate Core"}] {
+    input.satellite.openCore.trackerConceptsInCore
+}
+
+violations[{"id": "OCB-06", "message": "Core reference corpus contains tiered access (premium/enterprise) — all standards must be equal"}] {
+    input.satellite.openCore.tieredAccessInCore
+}
+
+violations[{"id": "OCB-07", "message": "Enterprise feature promoted to Core without Architecture Board approval — promotion requires formal review and accepted ADR before Core inclusion"}] {
+    input.satellite.openCore.hasEnterprisePromotionWithoutApproval
+}
+
+violations[{"id": "OCB-08", "message": "Core rules require enterprise features to function — Core must be independently viable"}] {
+    input.satellite.openCore.coreRequiresEnterprise
+}

package/rulesets/opa/open-core-boundary.test.rego

@@ -0,0 +1,60 @@
+package evolith.open_core_boundary_test
+
+import data.evolith.open_core_boundary
+
+compliant_input := {"satellite": {"openCore": {
+  "coreHasEnterpriseReferences": false,
+  "enterpriseArtifactNotMarked": false,
+  "aclImplementationInCore": false,
+  "cliMcpGated": false,
+  "trackerConceptsInCore": false,
+  "tieredAccessInCore": false,
+  "coreRequiresEnterprise": false,
+}}}
+
+test_compliant_open_core_has_no_violations {
+  violations := open_core_boundary.violations with input as compliant_input
+  count(violations) == 0
+}
+
+test_core_enterprise_references_is_rejected {
+  i := json.patch(compliant_input, [{"op": "replace", "path": "/satellite/openCore/coreHasEnterpriseReferences", "value": true}])
+  violations := open_core_boundary.violations with input as i
+  violations[_].id == "OCB-01"
+}
+
+test_enterprise_artifact_not_marked_is_rejected {
+  i := json.patch(compliant_input, [{"op": "replace", "path": "/satellite/openCore/enterpriseArtifactNotMarked", "value": true}])
+  violations := open_core_boundary.violations with input as i
+  violations[_].id == "OCB-02"
+}
+
+test_acl_in_core_is_rejected {
+  i := json.patch(compliant_input, [{"op": "replace", "path": "/satellite/openCore/aclImplementationInCore", "value": true}])
+  violations := open_core_boundary.violations with input as i
+  violations[_].id == "OCB-03"
+}
+
+test_cli_mcp_gated_is_rejected {
+  i := json.patch(compliant_input, [{"op": "replace", "path": "/satellite/openCore/cliMcpGated", "value": true}])
+  violations := open_core_boundary.violations with input as i
+  violations[_].id == "OCB-04"
+}
+
+test_tracker_concepts_in_core_is_rejected {
+  i := json.patch(compliant_input, [{"op": "replace", "path": "/satellite/openCore/trackerConceptsInCore", "value": true}])
+  violations := open_core_boundary.violations with input as i
+  violations[_].id == "OCB-05"
+}
+
+test_tiered_access_in_core_is_rejected {
+  i := json.patch(compliant_input, [{"op": "replace", "path": "/satellite/openCore/tieredAccessInCore", "value": true}])
+  violations := open_core_boundary.violations with input as i
+  violations[_].id == "OCB-06"
+}
+
+test_core_requires_enterprise_is_rejected {
+  i := json.patch(compliant_input, [{"op": "replace", "path": "/satellite/openCore/coreRequiresEnterprise", "value": true}])
+  violations := open_core_boundary.violations with input as i
+  violations[_].id == "OCB-08"
+}

package/rulesets/opa/protocol-selection.rego

@@ -0,0 +1,29 @@
+package evolith.protocol_selection
+
+violations[{"id": "PROT-01", "message": "Internal service-to-service communication not using gRPC"}] {
+    input.satellite.protocol.internalServiceCallsNotGrpc
+}
+
+violations[{"id": "PROT-02", "message": "Public/external API not using REST"}] {
+    input.satellite.protocol.publicApiNotRest
+}
+
+violations[{"id": "PROT-04", "message": "GraphQL resolvers found in Core or Application layer — must be BFF only"}] {
+    input.satellite.protocol.graphqlInDomainLayer
+}
+
+violations[{"id": "PROT-05", "message": "Proto files not centralized in shared Contracts library"}] {
+    not input.satellite.protocol.protoCentralized
+}
+
+violations[{"id": "PROT-03", "message": "BFF must use REST as primary protocol. If GraphQL is used, it must be targeted only (not as general-purpose BFF API)"}] {
+    input.satellite.protocol.bffUsesGraphqlAsGeneral
+}
+
+violations[{"id": "PROT-06", "message": "File uploads and stream operations should prefer gRPC streaming over multipart REST — use gRPC for large binary payloads"}] {
+    input.satellite.protocol.fileUploadsNotGrpc
+}
+
+violations[{"id": "PROT-07", "message": "Breaking contract changes without version bump detected"}] {
+    input.satellite.protocol.breakingChangesWithoutVersionBump
+}

package/rulesets/opa/protocol-selection.test.rego

@@ -0,0 +1,46 @@
+package evolith.protocol_selection_test
+
+import data.evolith.protocol_selection
+
+compliant_input := {"satellite": {"protocol": {
+  "internalServiceCallsNotGrpc": false,
+  "publicApiNotRest": false,
+  "graphqlInDomainLayer": false,
+  "protoCentralized": true,
+  "breakingChangesWithoutVersionBump": false,
+}}}
+
+test_compliant_protocol_selection_has_no_violations {
+  violations := protocol_selection.violations with input as compliant_input
+  count(violations) == 0
+}
+
+test_internal_not_grpc_is_rejected {
+  i := json.patch(compliant_input, [{"op": "replace", "path": "/satellite/protocol/internalServiceCallsNotGrpc", "value": true}])
+  violations := protocol_selection.violations with input as i
+  violations[_].id == "PROT-01"
+}
+
+test_public_api_not_rest_is_rejected {
+  i := json.patch(compliant_input, [{"op": "replace", "path": "/satellite/protocol/publicApiNotRest", "value": true}])
+  violations := protocol_selection.violations with input as i
+  violations[_].id == "PROT-02"
+}
+
+test_graphql_in_domain_layer_is_rejected {
+  i := json.patch(compliant_input, [{"op": "replace", "path": "/satellite/protocol/graphqlInDomainLayer", "value": true}])
+  violations := protocol_selection.violations with input as i
+  violations[_].id == "PROT-04"
+}
+
+test_proto_not_centralized_is_rejected {
+  i := json.patch(compliant_input, [{"op": "replace", "path": "/satellite/protocol/protoCentralized", "value": false}])
+  violations := protocol_selection.violations with input as i
+  violations[_].id == "PROT-05"
+}
+
+test_breaking_changes_without_version_bump_is_rejected {
+  i := json.patch(compliant_input, [{"op": "replace", "path": "/satellite/protocol/breakingChangesWithoutVersionBump", "value": true}])
+  violations := protocol_selection.violations with input as i
+  violations[_].id == "PROT-07"
+}

package/rulesets/opa/rbac/gate-role-enforcement.rego

@@ -0,0 +1,112 @@
+package evolith.rbac.gate
+
+import future.keywords.if
+import future.keywords.contains
+
+# ---------------------------------------------------------------------------
+# GT-320 — Gate role enforcement
+#
+# Input schema:
+#   input.actor.roles         array of role strings (e.g. ["product_owner"])
+#   input.gate.accountableRole  string | null  — required role to approve
+#   input.gate.waiverAuthority  string | null  — required role to waive
+#   input.action              "approve" | "waive"
+#
+# Role hierarchy (mirrors ROLE_HIERARCHY in role.ts)
+# ---------------------------------------------------------------------------
+
+# admin and cto supersede every gate role
+superseding_roles := {"admin", "cto"}
+
+# Hierarchy expressed as: implied_by[required_role] = set of roles that satisfy it
+implied_by := {
+  "product_owner":    {"admin", "cto"},
+  "architect":        {"admin", "cto"},
+  "tech_lead":        {"admin", "cto", "architect"},
+  "qa_lead":          {"admin", "cto"},
+  "devops_lead":      {"admin", "cto"},
+  "developer":        {"admin", "cto", "architect", "tech_lead"},
+  "qa_engineer":      {"admin", "cto", "qa_lead"},
+  "devops_engineer":  {"admin", "cto", "devops_lead"},
+  "security_engineer": {"admin", "cto"},
+}
+
+# Map human-readable gate labels to canonical role values (mirrors GATE_ROLE_MAP)
+gate_role_map := {
+  "Product Owner":      "product_owner",
+  "Software Architect": "architect",
+  "Tech Lead":          "tech_lead",
+  "QA Lead":            "qa_lead",
+  "DevOps Lead":        "devops_lead",
+}
+
+# Resolve a gate label (or already-canonical string) to a canonical role string
+canonical_role(label) := role if {
+  role := gate_role_map[label]
+} else := label
+
+# Returns true when actor_role satisfies required_role (direct or via hierarchy)
+role_satisfies(actor_role, required) if { actor_role == required }
+role_satisfies(actor_role, required) if { actor_role in implied_by[required] }
+
+# ---------------------------------------------------------------------------
+# default deny
+# ---------------------------------------------------------------------------
+
+default allow := false
+
+# ---------------------------------------------------------------------------
+# approve
+# ---------------------------------------------------------------------------
+
+# Open gate — no accountableRole set
+allow if {
+  input.action == "approve"
+  not input.gate.accountableRole
+}
+
+allow if {
+  input.action == "approve"
+  input.gate.accountableRole != null
+  required := canonical_role(input.gate.accountableRole)
+  some actor_role in input.actor.roles
+  role_satisfies(actor_role, required)
+}
+
+# ---------------------------------------------------------------------------
+# waive
+# ---------------------------------------------------------------------------
+
+# Open gate — no waiverAuthority set
+allow if {
+  input.action == "waive"
+  not input.gate.waiverAuthority
+}
+
+allow if {
+  input.action == "waive"
+  input.gate.waiverAuthority != null
+  required := canonical_role(input.gate.waiverAuthority)
+  some actor_role in input.actor.roles
+  role_satisfies(actor_role, required)
+}
+
+# ---------------------------------------------------------------------------
+# Violation detail (used by tests / audit logs)
+# ---------------------------------------------------------------------------
+
+deny_reason := reason if {
+  not allow
+  input.action == "approve"
+  reason := sprintf(
+    "actor roles [%s] do not satisfy accountableRole '%s' for action 'approve'",
+    [concat(", ", input.actor.roles), input.gate.accountableRole],
+  )
+} else := reason if {
+  not allow
+  input.action == "waive"
+  reason := sprintf(
+    "actor roles [%s] do not satisfy waiverAuthority '%s' for action 'waive'",
+    [concat(", ", input.actor.roles), input.gate.waiverAuthority],
+  )
+}

package/rulesets/opa/repository-taxonomy.rego

@@ -0,0 +1,98 @@
+package evolith.repository_taxonomy
+
+# ---------------------------------------------------------------------------
+# TAX-01..04: Naming conventions (checked via source file analysis)
+# TAX-05..08, TAX-11: Structural checks (already implemented below)
+# TAX-09..10: Artifact placement checks
+# ---------------------------------------------------------------------------
+
+violations[{"id": "TAX-01", "message": msg}] {
+    file := input.repository.files[_]
+    name := split(file, "/")[count(split(file, "/")) - 1]
+    not endswith(name, ".md")
+    not endswith(name, ".json")
+    not endswith(name, ".yaml")
+    not endswith(name, ".yml")
+    not endswith(name, ".rego")
+    not endswith(name, ".ts")
+    not endswith(name, ".mjs")
+    not endswith(name, ".js")
+    regex.match(`[A-Z_\s]`, name)
+    msg := sprintf("File name does not use kebab-case: %v", [name])
+}
+
+violations[{"id": "TAX-02", "message": msg}] {
+    input.repository.naming.pascalCaseViolations > 0
+    msg := sprintf("Class/type names violate PascalCase convention (%d violations)", [input.repository.naming.pascalCaseViolations])
+}
+
+violations[{"id": "TAX-03", "message": msg}] {
+    input.repository.naming.camelCaseViolations > 0
+    msg := sprintf("Variable/function names violate camelCase convention (%d violations)", [input.repository.naming.camelCaseViolations])
+}
+
+violations[{"id": "TAX-04", "message": msg}] {
+    input.repository.naming.constantCaseViolations > 0
+    msg := sprintf("Constant names violate UPPER_SNAKE_CASE convention (%d violations)", [input.repository.naming.constantCaseViolations])
+}
+
+violations[{"id": "TAX-09", "message": msg}] {
+    input.repository.type == "core"
+    file := input.repository.files[_]
+    contains(file, "product-specific")
+    not startswith(file, "reference/knowledge/demo")
+    msg := sprintf("Product-specific artifact found in Core reference/: %v", [file])
+}
+
+violations[{"id": "TAX-10", "message": msg}] {
+    file := input.repository.files[_]
+    startswith(file, "reference/")
+    input.repository.productArtifacts[file]
+    msg := sprintf("Product-specific artifact must not be in reference/: %v (use docs/ or satellite repo)", [file])
+}
+
+violations[{"id": "TAX-05", "message": msg}] {
+    input.repository.type == "core"
+    expected := {"reference", "sdk", "rulesets"}
+    actual := {dir | dir := input.repository.directories[_]}
+    missing := expected - actual
+    count(missing) > 0
+    msg := sprintf("Core repository missing directories: %v", [concat(", ", missing)])
+}
+
+violations[{"id": "TAX-06", "message": msg}] {
+    input.repository.type == "satellite"
+    expected := {"src", "tests", "docs"}
+    actual := {dir | dir := input.repository.directories[_]}
+    missing := expected - actual
+    count(missing) > 0
+    msg := sprintf("Satellite repository missing directories: %v", [concat(", ", missing)])
+}
+
+is_valid_adr_name(name) {
+    regex.match(`^[0-9]{4}-[a-z0-9-]+\.md$`, name)
+}
+
+violations[{"id": "TAX-07", "message": msg}] {
+    adr := input.repository.adrs[_]
+    name := split(adr, "/")[count(split(adr, "/")) - 1]
+    not endswith(name, ".es.md")
+    not is_valid_adr_name(name)
+    msg := sprintf("ADR filename does not match pattern ^[0-9]{4}-[a-z-]+\\.md$: %v", [name])
+}
+
+violations[{"id": "TAX-08", "message": msg}] {
+    adr := input.repository.adrs[_]
+    name := split(adr, "/")[count(split(adr, "/")) - 1]
+    endswith(name, ".md")
+    not endswith(name, ".es.md")
+    es_name := replace(name, ".md", ".es.md")
+    adrs_set := {split(a, "/")[count(split(a, "/")) - 1] | a := input.repository.adrs[_]}
+    not adrs_set[es_name]
+    msg := sprintf("ADR missing bilingual pair: %v", [name])
+}
+
+violations[{"id": "TAX-11", "message": "Root-level topologies/ directory is prohibited"}] {
+    dir := input.repository.directories[_]
+    dir == "topologies"
+}

package/rulesets/opa/repository-taxonomy.test.rego

@@ -0,0 +1,91 @@
+package evolith.repository_taxonomy_test
+
+import data.evolith.repository_taxonomy
+
+test_core_with_required_dirs_has_no_violations {
+    violations := repository_taxonomy.violations with input as {
+        "repository": {
+            "type": "core",
+            "directories": ["reference", "sdk", "rulesets", "src"],
+            "adrs": ["reference/architecture/adrs/core/0001-monorepo-orchestration.md", "reference/architecture/adrs/core/0001-monorepo-orchestration.es.md"]
+        }
+    }
+    count(violations) == 0
+}
+
+test_core_missing_reference_dir_is_violation {
+    violations := repository_taxonomy.violations with input as {
+        "repository": {
+            "type": "core",
+            "directories": ["sdk", "rulesets"],
+            "adrs": []
+        }
+    }
+    violations[_].id == "TAX-05"
+}
+
+test_satellite_with_required_dirs_has_no_violations {
+    violations := repository_taxonomy.violations with input as {
+        "repository": {
+            "type": "satellite",
+            "directories": ["src", "tests", "docs"],
+            "adrs": []
+        }
+    }
+    count(violations) == 0
+}
+
+test_satellite_missing_dirs_is_violation {
+    violations := repository_taxonomy.violations with input as {
+        "repository": {
+            "type": "satellite",
+            "directories": ["src"],
+            "adrs": []
+        }
+    }
+    violations[_].id == "TAX-06"
+}
+
+test_adr_with_valid_name_has_no_violation {
+    violations := repository_taxonomy.violations with input as {
+        "repository": {
+            "type": "core",
+            "directories": ["reference", "sdk", "rulesets"],
+            "adrs": ["reference/architecture/adrs/core/0002-clean-architecture.md", "reference/architecture/adrs/core/0002-clean-architecture.es.md"]
+        }
+    }
+    count(violations) == 0
+}
+
+test_adr_invalid_name_is_violation {
+    violations := repository_taxonomy.violations with input as {
+        "repository": {
+            "type": "core",
+            "directories": ["reference", "sdk", "rulesets"],
+            "adrs": ["reference/architecture/adrs/core/invalid-adr-name.md"]
+        }
+    }
+    violations[_].id == "TAX-07"
+}
+
+test_adr_missing_bilingual_pair_is_violation {
+    violations := repository_taxonomy.violations with input as {
+        "repository": {
+            "type": "core",
+            "directories": ["reference", "sdk", "rulesets"],
+            "adrs": ["reference/architecture/adrs/core/0001-feature.md"]
+        }
+    }
+    violations[_].id == "TAX-08"
+}
+
+test_root_topologies_dir_is_violation {
+    violations := repository_taxonomy.violations with input as {
+        "repository": {
+            "type": "core",
+            "directories": ["reference", "sdk", "rulesets", "topologies"],
+            "adrs": []
+        }
+    }
+    violations[_].id == "TAX-11"
+}

package/rulesets/opa/satellite-contracts.rego

@@ -0,0 +1,42 @@
+package evolith.satellite_contracts
+
+violations[{"id": "SVC-01", "message": "evolith.yaml not found at repository root or multiple evolith.yaml files found"}] {
+    not input.satellite.contracts.hasEvolyamlAtRoot
+}
+
+violations[{"id": "SVC-03", "message": "F1 phase satellite must reference core/ADR-0047 in spec.compliance.adrRegistry"}] {
+    input.satellite.contracts.phase == "F1"
+    not input.satellite.contracts.hasAdr0047
+}
+
+violations[{"id": "SVC-04", "message": "F2/F3 satellite missing extraction readiness score documentation"}] {
+    input.satellite.contracts.phase == "F2"
+    not input.satellite.contracts.hasExtractionReadinessScore
+}
+
+violations[{"id": "SVC-04", "message": "F2/F3 satellite missing extraction readiness score documentation"}] {
+    input.satellite.contracts.phase == "F3"
+    not input.satellite.contracts.hasExtractionReadinessScore
+}
+
+violations[{"id": "SVC-05", "message": "Core version referenced does not exist in Evolith Core registry"}] {
+    not input.satellite.contracts.coreVersionExists
+}
+
+violations[{"id": "SVC-02", "message": "Satellite name must be unique across all registered Evolith satellites — name conflict detected in registry"}] {
+    not input.satellite.contracts.nameIsUnique
+}
+
+violations[{"id": "MIG-01", "message": "No documented upgrade path for satellite governance version — run 'evolith upgrade --target <version>' to document the upgrade procedure"}] {
+    input.satellite.contracts.needsGovernanceUpgrade
+    not input.satellite.contracts.upgradePathDocumented
+}
+
+violations[{"id": "MIG-02", "message": "Phase transition attempted without Architecture Board approval artifact"}] {
+    input.satellite.contracts.phaseTransitionWithoutApproval
+}
+
+violations[{"id": "MIG-03", "message": "Satellite deprecated without marking status in evolith.yaml"}] {
+    input.satellite.contracts.isDeprecated
+    not input.satellite.contracts.deprecatedStatusMarked
+}

package/rulesets/opa/satellite-contracts.test.rego

@@ -0,0 +1,70 @@
+package evolith.satellite_contracts_test
+
+import data.evolith.satellite_contracts
+
+compliant_f1_input := {"satellite": {"contracts": {
+  "hasEvolyamlAtRoot": true,
+  "phase": "F1",
+  "hasAdr0047": true,
+  "hasExtractionReadinessScore": false,
+  "coreVersionExists": true,
+  "phaseTransitionWithoutApproval": false,
+  "isDeprecated": false,
+  "deprecatedStatusMarked": false,
+}}}
+
+test_compliant_f1_satellite_has_no_violations {
+  violations := satellite_contracts.violations with input as compliant_f1_input
+  count(violations) == 0
+}
+
+test_missing_evolyaml_is_rejected {
+  i := json.patch(compliant_f1_input, [{"op": "replace", "path": "/satellite/contracts/hasEvolyamlAtRoot", "value": false}])
+  violations := satellite_contracts.violations with input as i
+  violations[_].id == "SVC-01"
+}
+
+test_f1_missing_adr0047_is_rejected {
+  i := json.patch(compliant_f1_input, [{"op": "replace", "path": "/satellite/contracts/hasAdr0047", "value": false}])
+  violations := satellite_contracts.violations with input as i
+  violations[_].id == "SVC-03"
+}
+
+test_f2_missing_extraction_readiness_is_rejected {
+  i := json.patch(compliant_f1_input, [
+    {"op": "replace", "path": "/satellite/contracts/phase", "value": "F2"},
+    {"op": "replace", "path": "/satellite/contracts/hasExtractionReadinessScore", "value": false},
+  ])
+  violations := satellite_contracts.violations with input as i
+  violations[_].id == "SVC-04"
+}
+
+test_f3_missing_extraction_readiness_is_rejected {
+  i := json.patch(compliant_f1_input, [
+    {"op": "replace", "path": "/satellite/contracts/phase", "value": "F3"},
+    {"op": "replace", "path": "/satellite/contracts/hasExtractionReadinessScore", "value": false},
+  ])
+  violations := satellite_contracts.violations with input as i
+  violations[_].id == "SVC-04"
+}
+
+test_core_version_not_found_is_rejected {
+  i := json.patch(compliant_f1_input, [{"op": "replace", "path": "/satellite/contracts/coreVersionExists", "value": false}])
+  violations := satellite_contracts.violations with input as i
+  violations[_].id == "SVC-05"
+}
+
+test_phase_transition_without_approval_is_rejected {
+  i := json.patch(compliant_f1_input, [{"op": "replace", "path": "/satellite/contracts/phaseTransitionWithoutApproval", "value": true}])
+  violations := satellite_contracts.violations with input as i
+  violations[_].id == "MIG-02"
+}
+
+test_deprecated_without_status_marked_is_rejected {
+  i := json.patch(compliant_f1_input, [
+    {"op": "replace", "path": "/satellite/contracts/isDeprecated", "value": true},
+    {"op": "replace", "path": "/satellite/contracts/deprecatedStatusMarked", "value": false},
+  ])
+  violations := satellite_contracts.violations with input as i
+  violations[_].id == "MIG-03"
+}

package/rulesets/opa/schemas/abac-mcp-tool-access.input.schema.json

@@ -0,0 +1,21 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "https://evolith.dev/schema/opa/abac-mcp-tool-access.input.schema.json",
+  "title": "ABAC MCP Tool Access OPA Policy Input Schema",
+  "type": "object",
+  "required": ["user", "tool_name", "environment"],
+  "properties": {
+    "user": {
+      "type": "object",
+      "required": ["id", "roles"],
+      "properties": {
+        "id": { "type": "string" },
+        "roles": { "type": "array", "items": { "type": "string" } },
+        "tenant": { "type": "string" }
+      }
+    },
+    "tool_name": { "type": "string" },
+    "resource_domain": { "type": "string" },
+    "environment": { "type": "string" }
+  }
+}