@evolith/core-domain 1.0.0 → 1.0.1

package/rulesets/opa/version-pinning.rego

@@ -0,0 +1,99 @@
+package evolith.version_pinning
+
+# Define a set of violations.
+# A violation is an object with a rule `id` and a `message`.
+violations[{"id": "DEP-01", "message": msg}] {
+    # Check satellite package.json
+    deps := input.satellite.packageJson.dependencies
+    some pkg
+    version := deps[pkg]
+    startswith(version, "^")
+    msg := sprintf("package.json#dependencies.%v=%v (Caret pinning not allowed)", [pkg, version])
+}
+
+violations[{"id": "DEP-02", "message": msg}] {
+    deps := input.satellite.packageJson.dependencies
+    some pkg
+    version := deps[pkg]
+    startswith(version, "~")
+    msg := sprintf("package.json#dependencies.%v=%v (Tilde pinning not allowed)", [pkg, version])
+}
+
+violations[{"id": "DEP-03", "message": msg}] {
+    deps := input.satellite.packageJson.dependencies
+    some pkg
+    version := deps[pkg]
+    disallowed := {"*", "latest", "x", "X", ""}
+    disallowed[version]
+    msg := sprintf("package.json#dependencies.%v=%v (Wildcard/Latest pinning not allowed)", [pkg, version])
+}
+
+# Also check devDependencies
+violations[{"id": "DEP-01", "message": msg}] {
+    deps := input.satellite.packageJson.devDependencies
+    some pkg
+    version := deps[pkg]
+    startswith(version, "^")
+    msg := sprintf("package.json#devDependencies.%v=%v (Caret pinning not allowed)", [pkg, version])
+}
+
+violations[{"id": "DEP-02", "message": msg}] {
+    deps := input.satellite.packageJson.devDependencies
+    some pkg
+    version := deps[pkg]
+    startswith(version, "~")
+    msg := sprintf("package.json#devDependencies.%v=%v (Tilde pinning not allowed)", [pkg, version])
+}
+
+violations[{"id": "DEP-03", "message": msg}] {
+    deps := input.satellite.packageJson.devDependencies
+    some pkg
+    version := deps[pkg]
+    disallowed := {"*", "latest", "x", "X", ""}
+    disallowed[version]
+    msg := sprintf("package.json#devDependencies.%v=%v (Wildcard/Latest pinning not allowed)", [pkg, version])
+}
+
+# DEP-10 applies to all packages in the workspace
+violations[{"id": "DEP-10", "message": msg}] {
+    ws := input.satellite.workspacePackageJsons[_]
+    deps := ws.content.dependencies
+    some pkg
+    version := deps[pkg]
+    startswith(version, "^")
+    msg := sprintf("%v#dependencies.%v=%v", [ws.path, pkg, version])
+}
+
+violations[{"id": "DEP-10", "message": msg}] {
+    ws := input.satellite.workspacePackageJsons[_]
+    deps := ws.content.devDependencies
+    some pkg
+    version := deps[pkg]
+    startswith(version, "^")
+    msg := sprintf("%v#devDependencies.%v=%v", [ws.path, pkg, version])
+}
+
+violations[{"id": "DEP-10", "message": msg}] {
+    ws := input.satellite.workspacePackageJsons[_]
+    deps := ws.content.dependencies
+    some pkg
+    version := deps[pkg]
+    startswith(version, "~")
+    msg := sprintf("%v#dependencies.%v=%v", [ws.path, pkg, version])
+}
+
+violations[{"id": "DEP-10", "message": msg}] {
+    ws := input.satellite.workspacePackageJsons[_]
+    deps := ws.content.devDependencies
+    some pkg
+    version := deps[pkg]
+    startswith(version, "~")
+    msg := sprintf("%v#devDependencies.%v=%v", [ws.path, pkg, version])
+}
+
+violations[{"id": "DEP-08", "message": msg}] {
+    overrides := input.satellite.packageJson.overrides
+    count(overrides) > 0
+    not input.satellite.overridesRationaleDocumented
+    msg := sprintf("package.json 'overrides' section has %d entries without a companion overrides-rationale.json — each override must document the CVE or compatibility reason", [count(overrides)])
+}

package/rulesets/opa/version-pinning.test.rego

@@ -0,0 +1,28 @@
+package evolith.version_pinning_test
+
+import data.evolith.version_pinning
+
+test_no_pinning_violations_for_exact_versions {
+  violations := version_pinning.violations with input as {"satellite": {"packageJson": {"dependencies": {"express": "4.18.2"}, "devDependencies": {}}, "workspacePackageJsons": []}}
+  count(violations) == 0
+}
+
+test_caret_pinning_in_dependencies_is_rejected {
+  violations := version_pinning.violations with input as {"satellite": {"packageJson": {"dependencies": {"express": "^4.18.2"}, "devDependencies": {}}, "workspacePackageJsons": []}}
+  violations[_].id == "DEP-01"
+}
+
+test_tilde_pinning_in_dev_dependencies_is_rejected {
+  violations := version_pinning.violations with input as {"satellite": {"packageJson": {"dependencies": {}, "devDependencies": {"mocha": "~10.0.0"}}, "workspacePackageJsons": []}}
+  violations[_].id == "DEP-02"
+}
+
+test_wildcard_pinning_is_rejected {
+  violations := version_pinning.violations with input as {"satellite": {"packageJson": {"dependencies": {"lodash": "*"}, "devDependencies": {}}, "workspacePackageJsons": []}}
+  violations[_].id == "DEP-03"
+}
+
+test_workspace_caret_pinning_is_rejected {
+  violations := version_pinning.violations with input as {"satellite": {"packageJson": {"dependencies": {}, "devDependencies": {}}, "workspacePackageJsons": [{"path": "packages/foo", "content": {"dependencies": {"react": "^18.0.0"}, "devDependencies": {}}}]}}
+  violations[_].id == "DEP-10"
+}

package/rulesets/phase-gates/README.es.md

@@ -0,0 +1,28 @@
+# Ruleset de Gates de Fase
+
+> **Bilingual navigation:** [English version](./README.md)
+
+Punto de entrada WS1 canonico para el contrato de phase gates del SDLC Evolith.
+
+## Proposito
+
+El ruleset de gates de fase define la evidencia obligatoria, criterios bloqueantes, roles responsables, autoridades de waiver y campos de waiver requeridos para salir de cada fase SDLC de Evolith. Este punto de entrada mantiene estable la ruta de auditoria WS1 mientras conserva el indice de la categoria SDLC.
+
+## Artefactos
+
+| Artefacto | Ruta | Proposito |
+|---|---|---|
+| Ruleset nativo | [phase-gates.rules.json](./phase-gates.rules.json) | Contrato machine-readable de gates de fase SDLC |
+| Fuente de categoria SDLC | [../sdlc/phase-gates.rules.json](../sdlc/phase-gates.rules.json) | Contrato existente de la categoria SDLC conservado por compatibilidad |
+| Politica OPA | [../opa/cicd-quality-gates.rego](../opa/cicd-quality-gates.rego) | Enforcement Rego para controles de quality gates CI/CD |
+| Pruebas OPA | [../opa/cicd-quality-gates.test.rego](../opa/cicd-quality-gates.test.rego) | Pruebas reproducibles de politica para controles de quality gates |
+
+## Validacion
+
+Ejecuta los checks focalizados Native y OPA:
+
+```bash
+node --test .harness/scripts/run-evolith-intelligent-data-audit.test.mjs
+npx jest --config packages/core-domain/jest.config.js --rootDir packages/core-domain --testPathPatterns='ruleset-validation.mode' --no-coverage
+.harness/bin/opa test rulesets/opa/cicd-quality-gates.rego rulesets/opa/cicd-quality-gates.test.rego -v
+```

package/rulesets/phase-gates/README.md

@@ -0,0 +1,28 @@
+# Phase Gates Ruleset
+
+> **Navegación bilingüe:** [Versión en Español](./README.es.md)
+
+Canonical WS1 entrypoint for the Evolith SDLC phase-gate contract.
+
+## Purpose
+
+The phase-gates ruleset defines the mandatory evidence, blocking criteria, accountable roles, waiver authorities, and waiver fields required to exit each Evolith SDLC phase. This entrypoint keeps the WS1 audit path stable while preserving the SDLC category index.
+
+## Artifacts
+
+| Artifact | Path | Purpose |
+|---|---|---|
+| Native ruleset | [phase-gates.rules.json](./phase-gates.rules.json) | Machine-readable SDLC phase-gate contract |
+| SDLC category source | [../sdlc/phase-gates.rules.json](../sdlc/phase-gates.rules.json) | Existing SDLC category contract retained for backward compatibility |
+| OPA policy | [../opa/cicd-quality-gates.rego](../opa/cicd-quality-gates.rego) | Rego enforcement for CI/CD quality-gate controls |
+| OPA tests | [../opa/cicd-quality-gates.test.rego](../opa/cicd-quality-gates.test.rego) | Reproducible policy tests for quality-gate controls |
+
+## Validation
+
+Run the focused Native and OPA checks:
+
+```bash
+node --test .harness/scripts/run-evolith-intelligent-data-audit.test.mjs
+npx jest --config packages/core-domain/jest.config.js --rootDir packages/core-domain --testPathPatterns='ruleset-validation.mode' --no-coverage
+.harness/bin/opa test rulesets/opa/cicd-quality-gates.rego rulesets/opa/cicd-quality-gates.test.rego -v
+```

package/rulesets/phase-gates/phase-gates.rules.json

@@ -0,0 +1,297 @@
+{
+  "$schema": "../schema/ruleset-sdlc.schema.json",
+  "$id": "https://evolith.dev/rulesets/phase-gates/phase-gates.rules.json",
+  "title": "SDLC Phase Gate Rules",
+  "description": "Canonical phase exit gate criteria for the Evolith 5-phase SDLC. Each gate requires objective evidence; manual confidence cannot override a failed gate.",
+  "version": "1.0.0",
+  "effectiveDate": "2026-01-01",
+  "gates": [
+    {
+      "phase": 1,
+      "name": "Business Sign-Off",
+      "description": "Scope frozen; funding authorized; architectural constraints aligned.",
+      "playbookRef": "../../reference/governance/sdlc/01-playbooks/phase-1-business-signoff.md",
+      "mandatoryEvidence": [
+        {
+          "artifact": "PRD",
+          "schemaRef": "../schema/prd.schema.json",
+          "status": "Approved",
+          "validation": "PRD status = Approved AND approvalEvidence present AND date filled"
+        },
+        {
+          "artifact": "Discovery Canvas",
+          "validation": "Initiative registered with customer pain points and expected value"
+        },
+        {
+          "artifact": "Technical Feasibility Canvas",
+          "schemaRef": "../schema/technical-feasibility.schema.json",
+          "validation": "Technical feasibility and quality attributes documented with NFRs"
+        },
+        {
+          "artifact": "Ballpark Estimation",
+          "validation": "T-Shirt sizing completed with team composition"
+        },
+        {
+          "artifact": "MoSCoW Prioritization Matrix",
+          "validation": "MoSCoW analysis completed for Phase 0 with at least one MUST item and valid priority distribution"
+        },
+        {
+          "artifact": "Build-versus-Compose Analysis",
+          "schemaRef": "../schema/build-vs-compose.schema.json",
+          "validation": "Discovery evaluated open-source/free-tier/commercial alternatives with a governed Adopt/Embed/Integrate/Extend/Build/Reject disposition, three-year cost, licensing, tenant isolation, provider replaceability, and PoC requirements; native development requires explicit justification (Product Vision §5.3)"
+        }
+      ],
+      "blockingCriteria": [
+        {
+          "criterion": "Scope is ambiguous",
+          "action": "BLOCK — return to Phase 1"
+        },
+        {
+          "criterion": "Technical constraints or cloud quotas are unaligned",
+          "action": "BLOCK — return to Phase 1"
+        },
+        {
+          "criterion": "Architecture constraints are ignored",
+          "action": "BLOCK — return to Phase 1"
+        }
+      ],
+      "accountableRole": "Product Owner",
+      "waiverAuthority": "Executive Sponsor",
+      "waiverRequiredFields": [
+        "criterion",
+        "justification",
+        "risk",
+        "owner",
+        "expirationDate",
+        "mitigationPlan"
+      ]
+    },
+    {
+      "phase": 2,
+      "name": "Design Baseline Approved",
+      "description": "Architecture decisions are documented; bounded contexts defined; functional stories written.",
+      "playbookRef": "../../reference/governance/sdlc/01-playbooks/phase-2-design-baseline.md",
+      "mandatoryEvidence": [
+        {
+          "artifact": "ADR Registry",
+          "validation": "All architecture decisions have corresponding ADR. No undocumented decisions."
+        },
+        {
+          "artifact": "Functional Stories",
+          "schemaRef": "../schema/functional-story.schema.json",
+          "validation": "All Functional Stories in Ready state with BDD acceptance criteria"
+        },
+        {
+          "artifact": "Reference Blueprint Alignment",
+          "validation": "Product architecture diagrams traceable to Evolith Reference Blueprint"
+        },
+        {
+          "artifact": "Simplicity Checklist Phase 1",
+          "validation": "Passed — no over-engineering detected"
+        },
+        {
+          "artifact": "Bounded Context Map",
+          "validation": "All contexts identified with ownership and persistence strategy"
+        }
+      ],
+      "blockingCriteria": [
+        {
+          "criterion": "Significant architecture decisions are undocumented",
+          "action": "BLOCK — require ADR before design baseline"
+        },
+        {
+          "criterion": "Bounded context boundaries are contradictory",
+          "action": "BLOCK — require context map resolution"
+        },
+        {
+          "criterion": "Functional stories lack acceptance criteria",
+          "action": "BLOCK — return to story writing"
+        }
+      ],
+      "accountableRole": "Software Architect",
+      "waiverAuthority": "Architecture Board",
+      "waiverRequiredFields": [
+        "criterion",
+        "justification",
+        "risk",
+        "owner",
+        "expirationDate",
+        "mitigationPlan"
+      ]
+    },
+    {
+      "phase": 3,
+      "name": "Successful Build",
+      "description": "All code merged to main; CI passes; quality gates green; definition of done satisfied.",
+      "mandatoryEvidence": [
+        {
+          "artifact": "Technical Stories",
+          "schemaRef": "../schema/technical-story.schema.json",
+          "validation": "All technical stories Done; traceable to Functional Stories"
+        },
+        {
+          "artifact": "CI Pipeline",
+          "validation": "CI run green on main branch. No failing tests, no lint errors, no security scan failures"
+        },
+        {
+          "artifact": "Definition of Done Checklist",
+          "validation": "All DoD items checked per Technical Story"
+        },
+        {
+          "artifact": "Documentation Delta",
+          "validation": "Updated ADRs, inline documentation, README changes included in merge"
+        },
+        {
+          "artifact": "Coverage Report",
+          "validation": "Business logic coverage >= 80% per Quality Thresholds rules"
+        }
+      ],
+      "blockingCriteria": [
+        {
+          "criterion": "CI fails on main branch",
+          "action": "BLOCK merge — fix CI before merge"
+        },
+        {
+          "criterion": "Coverage below threshold (< 80%)",
+          "action": "BLOCK merge — add tests or request waiver"
+        },
+        {
+          "criterion": "High or Critical CVEs detected",
+          "action": "BLOCK merge — remediate CVEs or request security waiver"
+        },
+        {
+          "criterion": "Missing code review approval",
+          "action": "BLOCK merge — require review"
+        }
+      ],
+      "accountableRole": "Tech Lead",
+      "waiverAuthority": "Architecture Board (with exception for CVEs requires Executive Risk Acceptance)",
+      "waiverRequiredFields": [
+        "criterion",
+        "justification",
+        "risk",
+        "owner",
+        "expirationDate",
+        "mitigationPlan",
+        "approvalAuthority"
+      ]
+    },
+    {
+      "phase": 4,
+      "name": "RC Stamped",
+      "description": "All quality thresholds verified; security scans clean; UAT passed; release candidate formally approved.",
+      "playbookRef": "../../reference/governance/sdlc/01-playbooks/phase-4-rc-stamp.md",
+      "mandatoryEvidence": [
+        {
+          "artifact": "Test Summary Report",
+          "schemaRef": "../schema/test-summary-report.schema.json",
+          "templateRef": "../../reference/governance/sdlc/04-artifact-templates/test-summary-report-template.md",
+          "validation": "All quality gates green or explicitly waived. RC stamped by QA Lead and Tech Lead."
+        },
+        {
+          "artifact": "Acceptance Validation",
+          "validation": "Product Owner signs off on acceptance criteria verification"
+        },
+        {
+          "artifact": "Security Scan Report",
+          "schemaRef": "../schema/security-scan-report.schema.json",
+          "templateRef": "../../reference/governance/sdlc/04-artifact-templates/security-scan-report-template.md",
+          "validation": "Zero High/Critical CVEs in production-bound artifacts; structure conforms to security-scan-report.schema.json"
+        },
+        {
+          "artifact": "Integration Evidence",
+          "schemaRef": "../schema/integration-evidence.schema.json",
+          "templateRef": "../../reference/governance/sdlc/04-artifact-templates/integration-evidence-template.md",
+          "validation": "Every declared inter-component contract exercised; no FAIL entries without waiver; structure conforms to integration-evidence.schema.json"
+        },
+        {
+          "artifact": "Pyramid Distribution",
+          "validation": "70% unit / 20% integration / 10% E2E target met or deviation explained"
+        }
+      ],
+      "blockingCriteria": [
+        {
+          "criterion": "Any mandatory quality metric fails",
+          "action": "BLOCK RC stamp — remediate or waiver"
+        },
+        {
+          "criterion": "Acceptance criteria remain unverified",
+          "action": "BLOCK RC stamp — return to validation"
+        },
+        {
+          "criterion": "Technical debt ratio exceeds 5%",
+          "action": "BLOCK RC stamp — remediation plan required"
+        }
+      ],
+      "accountableRole": "QA Lead",
+      "waiverAuthority": "Architecture Board",
+      "waiverRequiredFields": [
+        "criterion",
+        "justification",
+        "risk",
+        "owner",
+        "expirationDate",
+        "mitigationPlan"
+      ]
+    },
+    {
+      "phase": 5,
+      "name": "Production Live",
+      "description": "Deployment executed; observability verified nominal; monitoring active; rollback procedure confirmed.",
+      "playbookRef": "../../reference/governance/sdlc/01-playbooks/zero-downtime-release.md",
+      "mandatoryEvidence": [
+        {
+          "artifact": "Release Notes",
+          "schemaRef": "../schema/release-notes.schema.json",
+          "validation": "Release scope, deployment steps, rollback procedure, observability checklist all present and complete"
+        },
+        {
+          "artifact": "Observability Validation",
+          "schemaRef": "../schema/observability-validation.schema.json",
+          "templateRef": "../../reference/governance/sdlc/04-artifact-templates/observability-validation-template.md",
+          "validation": "Metrics nominal, logs flowing, traces complete for all production paths; structure conforms to observability-validation.schema.json"
+        },
+        {
+          "artifact": "Rollback Procedure",
+          "schemaRef": "../schema/rollback-rehearsal.schema.json",
+          "templateRef": "../../reference/governance/sdlc/04-artifact-templates/rollback-rehearsal-template.md",
+          "validation": "Rollback steps documented and tested. Last good version identified. Rehearsal evidence confirms rollback within budget."
+        },
+        {
+          "artifact": "On-Call Handoff",
+          "schemaRef": "../schema/on-call-handoff.schema.json",
+          "templateRef": "../../reference/governance/sdlc/04-artifact-templates/on-call-handoff-template.md",
+          "validation": "On-call team briefed with runbook references, escalation paths, alert ownership, and SLA acknowledgement confirmed."
+        },
+        {
+          "artifact": "Deployment Evidence",
+          "validation": "Deployment artifacts (images, configs) traceable to RC"
+        }
+      ],
+      "blockingCriteria": [
+        {
+          "criterion": "Monitoring is not nominal",
+          "action": "BLOCK Production Live — investigate before deploy"
+        },
+        {
+          "criterion": "Rollback procedure is undefined",
+          "action": "BLOCK Production Live — document rollback first"
+        },
+        {
+          "criterion": "Release is not traceable to RC",
+          "action": "BLOCK Production Live — ensure RC → Release chain"
+        }
+      ],
+      "accountableRole": "DevOps Lead",
+      "waiverAuthority": "Technology Director",
+      "waiverRequiredFields": [
+        "criterion",
+        "justification",
+        "risk",
+        "owner",
+        "expirationDate",
+        "mitigationPlan"
+      ]
+    }
+  ]
+}

package/rulesets/quality-thresholds/README.es.md

@@ -0,0 +1,28 @@
+# Ruleset de Umbrales de Calidad
+
+> **Bilingual navigation:** [English version](./README.md)
+
+Punto de entrada WS1 canonico para los umbrales de calidad bloqueantes de release de Evolith.
+
+## Proposito
+
+El ruleset de umbrales de calidad define los minimos de testing, calidad de codigo, seguridad, documentacion, operaciones y contratos que pueden bloquear merge, RC stamp o Production Live. Este punto de entrada mantiene estable la ruta de auditoria WS1 mientras conserva el indice de la categoria SDLC.
+
+## Artefactos
+
+| Artefacto | Ruta | Proposito |
+|---|---|---|
+| Ruleset nativo | [quality-thresholds.rules.json](./quality-thresholds.rules.json) | Contrato machine-readable de umbrales bloqueantes de release |
+| Fuente de categoria SDLC | [../sdlc/quality-thresholds.rules.json](../sdlc/quality-thresholds.rules.json) | Contrato existente de la categoria SDLC conservado por compatibilidad |
+| Politica OPA | [../opa/testing-pyramid.rego](../opa/testing-pyramid.rego) | Enforcement Rego para umbrales de cobertura y testing pyramid |
+| Pruebas OPA | [../opa/testing-pyramid.test.rego](../opa/testing-pyramid.test.rego) | Pruebas reproducibles de politica para controles de testing y cobertura |
+
+## Validacion
+
+Ejecuta los checks focalizados Native y OPA:
+
+```bash
+node --test .harness/scripts/run-evolith-intelligent-data-audit.test.mjs
+npx jest --config packages/core-domain/jest.config.js --rootDir packages/core-domain --testPathPatterns='ruleset-validation.mode' --no-coverage
+.harness/bin/opa test rulesets/opa/testing-pyramid.rego rulesets/opa/testing-pyramid.test.rego -v
+```

package/rulesets/quality-thresholds/README.md

@@ -0,0 +1,28 @@
+# Quality Thresholds Ruleset
+
+> **Navegación bilingüe:** [Versión en Español](./README.es.md)
+
+Canonical WS1 entrypoint for the Evolith release-blocking quality thresholds.
+
+## Purpose
+
+The quality-thresholds ruleset defines the minimum testing, code-quality, security, documentation, operations, and contract thresholds that can block merge, RC stamp, or Production Live gates. This entrypoint keeps the WS1 audit path stable while preserving the SDLC category index.
+
+## Artifacts
+
+| Artifact | Path | Purpose |
+|---|---|---|
+| Native ruleset | [quality-thresholds.rules.json](./quality-thresholds.rules.json) | Machine-readable release-blocking threshold contract |
+| SDLC category source | [../sdlc/quality-thresholds.rules.json](../sdlc/quality-thresholds.rules.json) | Existing SDLC category contract retained for backward compatibility |
+| OPA policy | [../opa/testing-pyramid.rego](../opa/testing-pyramid.rego) | Rego enforcement for coverage and testing-pyramid thresholds |
+| OPA tests | [../opa/testing-pyramid.test.rego](../opa/testing-pyramid.test.rego) | Reproducible policy tests for testing and coverage controls |
+
+## Validation
+
+Run the focused Native and OPA checks:
+
+```bash
+node --test .harness/scripts/run-evolith-intelligent-data-audit.test.mjs
+npx jest --config packages/core-domain/jest.config.js --rootDir packages/core-domain --testPathPatterns='ruleset-validation.mode' --no-coverage
+.harness/bin/opa test rulesets/opa/testing-pyramid.rego rulesets/opa/testing-pyramid.test.rego -v
+```

package/rulesets/quality-thresholds/quality-thresholds.rules.json

@@ -0,0 +1,96 @@
+{
+  "$schema": "../schema/ruleset-standard.schema.json",
+  "$id": "https://evolith.dev/rulesets/quality-thresholds/quality-thresholds.rules.json",
+  "title": "SDLC Quality Threshold Rules",
+  "description": "Canonical release-blocking quality thresholds for Evolith satellites. These thresholds apply to all SDLC phases where construction or validation occurs.",
+  "version": "1.0.0",
+  "effectiveDate": "2026-01-01",
+  "waiverPolicy": {
+    "description": "A waiver may be used only when the organization deliberately accepts a temporary deviation.",
+    "requiredFields": [
+      "criterion",
+      "justification",
+      "risk",
+      "owner",
+      "expirationDate",
+      "mitigationPlan",
+      "approvalAuthority"
+    ],
+    "exceptions": {
+      "cves": "High/Critical security vulnerabilities cannot be waived in production releases without explicit Executive Risk Acceptance",
+      "coverage": "Business logic coverage below 80% cannot be waived without Architecture Board approval and remediation plan"
+    }
+  },
+  "rules": [
+    {
+      "id": "QT-01",
+      "severity": "MUST",
+      "category": "testing",
+      "title": "Code Coverage",
+      "description": "Coverage below 80% on business logic BLOCKS merge (Phase 3) and RC stamp (Phase 4).",
+      "blocking": true
+    },
+    {
+      "id": "QT-02",
+      "severity": "MUST",
+      "category": "code-quality",
+      "title": "Cyclomatic Complexity",
+      "description": "Methods or functions exceeding cyclomatic complexity of 15 BLOCK merge or RC stamp without refactoring plan or explicit waiver.",
+      "blocking": true
+    },
+    {
+      "id": "QT-03",
+      "severity": "MUST",
+      "category": "security",
+      "title": "Security Vulnerabilities",
+      "description": "Any High or Critical CVE BLOCKS merge, RC stamp, and production release. Medium CVEs require justification.",
+      "blocking": true
+    },
+    {
+      "id": "QT-04",
+      "severity": "MUST",
+      "category": "code-quality",
+      "title": "Technical Debt Ratio",
+      "description": "Technical debt ratio > 5% BLOCKS RC stamp unless a remediation plan with explicit timeline and owner is approved.",
+      "blocking": true
+    },
+    {
+      "id": "QT-05",
+      "severity": "MUST",
+      "category": "testing",
+      "title": "Testing Pyramid Distribution",
+      "description": "Release with materially skewed distribution (e.g., 40% unit / 50% integration) requires written explanation. Not a hard block but must be reviewed.",
+      "blocking": true
+    },
+    {
+      "id": "QT-06",
+      "severity": "MUST",
+      "category": "documentation",
+      "title": "Documentation Delta",
+      "description": "Code changes that alter behavior, introduce new API endpoints, change architecture, or modify operations without corresponding documentation BLOCK merge and Production Live.",
+      "blocking": true
+    },
+    {
+      "id": "QT-07",
+      "severity": "MUST",
+      "category": "operations",
+      "title": "Observability Evidence",
+      "description": "Any production API path without traces, structured logs, or metrics BLOCKS Production Live declaration.",
+      "blocking": true
+    },
+    {
+      "id": "QT-08",
+      "severity": "MUST",
+      "category": "contract",
+      "title": "API Contract Compatibility",
+      "description": "Breaking changes to inter-module (gRPC/REST) contracts BLOCK merge. Consumer-driven contract tests must pass.",
+      "blocking": true
+    }
+  ],
+  "references": [
+    "../sdlc/phase-gates.rules.json",
+    "adr/0018-testing-pyramid-quality-gates.md",
+    "adr/0049-naming-semantics-clean-code-policy.md",
+    "adr/0005-ci-cd-quality-codeql.md"
+  ]
+}

package/rulesets/repository-taxonomy/README.es.md

@@ -0,0 +1,26 @@
+# Ruleset de Taxonomía del Repositorio
+
+> **Navegación Bilingüe:** [English Version](./README.md)
+
+Punto de entrada ejecutable WS1 para el ruleset de Taxonomía del Repositorio de Evolith.
+
+## Propósito
+
+Este directorio expone `rulesets/repository-taxonomy` como la ruta ejecutable canónica que verifica la auditoría de fortaleza como data inteligente. El ruleset codifica restricciones de nomenclatura, estructura de directorios, nombres ADR, pares bilingües y clasificación de artefactos consumidas por el validador nativo de rulesets y los flujos de evidencia CI.
+
+## Artefactos
+
+| Artefacto | Propósito |
+|---|---|
+| [repository-taxonomy.rules.json](./repository-taxonomy.rules.json) | Ruleset nativo machine-readable para validación de Taxonomía del Repositorio |
+| [../opa/repository-taxonomy.rego](../opa/repository-taxonomy.rego) | Artefacto de paridad OPA para validación de Taxonomía del Repositorio |
+| [../opa/repository-taxonomy.test.rego](../opa/repository-taxonomy.test.rego) | Cobertura de pruebas OPA para la política de Taxonomía del Repositorio |
+
+## Validación
+
+Ejecuta estos checks después de cambiar el ruleset:
+
+```bash
+npx jest --config packages/core-domain/jest.config.js --rootDir packages/core-domain --testPathPatterns='ruleset-validation.mode' --no-coverage
+.harness/bin/opa test rulesets/opa/repository-taxonomy.rego rulesets/opa/repository-taxonomy.test.rego -v
+```