@evolith/core-domain 1.0.0 → 1.0.1

package/rulesets/topologies/agentic-ai/README.es.md

@@ -0,0 +1,142 @@
+# Perfil Topologico de IA Agentica
+
+> **Navegacion bilingue:** [Version en ingles](./README.md)
+
+**Estado:** Aceptada
+**Dimension:** `ai`
+**ID de topologia:** `agentic-ai`
+**Manifiesto:** [topology.manifest.json](./topology.manifest.json)
+
+La IA agentica es la topologia para sistemas donde un agente de IA puede inspeccionar contexto, planificar trabajo, invocar herramientas o proponer cambios. Se compone con cualquier perfil de eje progresivo; no es una fase de entrega ni un sustituto de la propiedad de producto.
+
+## Proposito y Alcance
+
+Usa este perfil cuando un agente tenga acceso a contexto de repositorio, servicio u operacion. El perfil gobierna el limite del agente, no el proveedor del modelo ni el framework de orquestacion.
+
+Todo satelite que lo adopte DEBE proporcionar `agent.config.json`. El evaluador nativo y la politica OPA aplican los mismos controles:
+
+| Regla | Control requerido |
+|---|---|
+| AAI-R01 | Identidad estable del agente y una o mas capacidades declaradas |
+| AAI-R02 | Sandbox aislado con acceso de red y proceso en deny o allowlist |
+| AAI-R03 | Fuentes de prompts y raices de implementacion que no se superponen |
+| AAI-R04 | Politica `approval-required` para herramientas mutativas |
+| AAI-R05 | Ejecucion efimera con duracion, memoria y CPU acotadas |
+| AAI-R06 | Contexto no confiable tratado como dato con procedencia y validacion de schema |
+| AAI-R07 | Delegacion acotada por capacidad y evidencia de accion correlacionada append-only |
+| AAI-R08 | Limites positivos de tokens y contexto, concurrencia MCP acotada y ruta legible de runbook |
+| AAI-R09 | Delegacion acotada, cadencia de rotacion de credenciales y revocacion ante incidentes |
+
+## Contrato de Configuracion
+
+`agent.config.json` es una declaracion portable, no un archivo de un framework de agentes especifico de runtime. Mantiene prompts, implementacion determinista y permisos de ejecucion revisables por separado.
+
+```json
+{
+  "agent": {
+    "id": "architecture-reviewer",
+    "capabilities": ["read-architecture", "review-changes"]
+  },
+  "sandbox": {
+    "mode": "isolated",
+    "network": "allowlist",
+    "process": "deny",
+    "ephemeral": true,
+    "maxDurationSeconds": 30,
+    "maxMemoryMb": 512,
+    "maxCpuCores": 1
+  },
+  "promptSources": ["prompts"],
+  "implementationRoots": ["src/agents"],
+  "contextPolicy": {
+    "untrustedContent": "data-only",
+    "provenanceRequired": true,
+    "toolOutputSchemaValidation": true
+  },
+  "toolPolicy": {
+    "mutative": "approval-required",
+    "capabilityDelegation": "scoped-and-expiring"
+  },
+  "audit": {
+    "appendOnly": true,
+    "correlationId": "required"
+  },
+  "operationalBudgets": {
+    "maxPromptTokens": 16000,
+    "maxCompletionTokens": 4000,
+    "maxContextWindowTokens": 128000,
+    "mcpToolConcurrency": {
+      "maxInFlight": 4,
+      "perToolMaxInFlight": 2
+    },
+    "runbooksPath": "docs/agentic-ai-runbooks.md"
+  },
+  "credentialLifecycle": {
+    "delegationMaxTtlSeconds": 900,
+    "rotationCadenceDays": 30,
+    "revocation": {
+      "onIncident": "immediate",
+      "maxPropagationSeconds": 60
+    }
+  }
+}
+```
+
+Las rutas declaradas de prompts e implementacion NO DEBEN superponerse. Una capacidad no es un permiso: el sandbox y la politica de herramientas son la autoridad de ejecucion. El contexto no confiable sigue siendo dato, nunca autoridad; toda accion lleva una capacidad acotada y evidencia correlacionada append-only.
+
+## Contrato Operativo
+
+`operationalBudgets` declara limites aplicables para una ejecucion. `maxPromptTokens` limita las instrucciones y el contexto suministrado, `maxCompletionTokens` limita la salida generada y `maxContextWindowTokens` limita el contexto combinado del modelo. `mcpToolConcurrency.maxInFlight` limita todas las llamadas concurrentes a herramientas; `perToolMaxInFlight` evita que una sola herramienta consuma todo el presupuesto. Un adoptante DEBE elegir valores adecuados para su modelo aprobado y su capacidad, y DEBE apuntar `runbooksPath` a su guia de incidentes mantenida.
+
+`credentialLifecycle` limita la autoridad delegada a `delegationMaxTtlSeconds`, exige rotacion como minimo cada `rotationCadenceDays` y define la rapidez con que la revocacion por incidente llega a cada ejecutor. `onIncident` DEBERIA ser `immediate`; `scheduled` solo se permite cuando una dependencia operativa documentada impide la revocacion inmediata. Los runbooks de referencia de la topologia estan [disponibles aqui](./runbooks.es.md).
+
+## Interaccion y Limite de Seguridad
+
+```mermaid
+flowchart LR
+    C["Contexto gobernado"] --> A["Agente"]
+    P["Fuentes de prompts"] --> A
+    A --> S["Sandbox aislado"]
+    S --> R["Herramientas de solo lectura"]
+    S --> M{"Herramienta mutativa"}
+    M -->|"approval-required"| H["Aprobacion humana o de politica"]
+    H --> T["Ejecucion aprobada"]
+    I["Raices de implementacion"] -. "separadas de los prompts" .-> A
+```
+
+El sandbox es la unica ruta hacia la ejecucion de herramientas. Los prompts aportan instrucciones; las raices de implementacion contienen codigo determinista. Ninguno puede otorgar silenciosamente acceso de red, proceso o mutacion.
+
+## Decisiones Rectoras y Validacion
+
+[ADR-0058](../../../adrs/core/0058-ai-consumable-architecture-knowledge.es.md) gobierna el conocimiento de arquitectura consumible por IA. [ADR-0081](../../../adrs/core/0081-agentic-ai-sandbox-isolation.es.md), [ADR-0082](../../../adrs/core/0082-agentic-ai-trust-boundary.es.md) y [ADR-0083](../../../adrs/core/0083-agentic-ai-action-authorization-audit.es.md) establecen los limites de sandbox, confianza y autorizacion. [ADR-AI-001](../../../../governance/standards/ai-augmented/06-adrs/adr-ai-001-harness-strategy.es.md) y [ADR-AI-005](../../../../governance/standards/ai-augmented/06-adrs/adr-ai-005-human-in-the-loop-policy.es.md) siguen siendo decisiones propuestas de apoyo.
+
+Ejecuta el perfil mediante el validador consciente de topologias:
+
+```bash
+evolith validate --topology agentic-ai
+```
+
+El ruleset nativo es [agentic-ai.rules.json](./agentic-ai.rules.json); su politica OPA equivalente es [agentic-ai.rego](./agentic-ai.rego). Ambos evaluan el mismo contrato de `agent.config.json`.
+
+## Frontera de Negocio
+
+Este perfil es solo tecnico. No define propiedad de negocio, priorizacion, ROI, costo, presupuesto, staffing, calendario de entrega ni Funnel 0. Evolith Tracker posee esas preocupaciones mediante su ACL.
+
+## Navegacion del Corpus
+
+El corpus de IA agentica es la linea base de implementacion obligatoria para esta topologia:
+
+| Area | Guia |
+|---|---|
+| Adopcion | [Guia de adopcion](./adoption.es.md) |
+| Operacion | [Guia de operacion](./operations.es.md) |
+| Seguridad | [Guia de seguridad](./security.es.md) |
+| Resiliencia | [Guia de resiliencia](./resilience.es.md) |
+| Diseno | [Patrones y anti-patrones](./patterns.es.md) |
+| Evolucion | [Guia de evolucion](./evolution.es.md) |
+| Resumen | [Guia de adopcion, operacion y evolucion](./maturity.es.md) |
+
+Este corpus implementa el [Estandar de Corpus de Topologias](../../topology-corpus-standard.es.md) para IA agentica. Un perfil no esta listo para aceptacion hasta que esten presentes y validados todas estas guias, controles ejecutables, fixtures de contrato, pruebas e interfaces de plano de control.
+
+---
+[Volver al Hub de Topologias](../../README.es.md)

package/rulesets/topologies/agentic-ai/README.md

@@ -0,0 +1,142 @@
+# Agentic AI Topology Profile
+
+> **Bilingual Navigation:** [Version en Espanol](./README.es.md)
+
+**Status:** Accepted
+**Dimension:** `ai`
+**Topology ID:** `agentic-ai`
+**Manifest:** [topology.manifest.json](./topology.manifest.json)
+
+Agentic AI is the topology for systems where an AI agent can inspect context, plan work, call tools, or propose changes. It is composable with every progressive-axis profile; it is not a delivery phase or a substitute for product ownership.
+
+## Purpose and Scope
+
+Use this profile when an agent has access to repository, service, or operational context. The profile governs the agent boundary, not the model vendor or orchestration framework.
+
+Every adopting satellite MUST provide `agent.config.json`. The native evaluator and the OPA policy enforce the same controls:
+
+| Rule | Required control |
+|---|---|
+| AAI-R01 | Stable agent identity and one or more declared capabilities |
+| AAI-R02 | An isolated sandbox with deny or allowlist network and process access |
+| AAI-R03 | Non-overlapping prompt sources and implementation roots |
+| AAI-R04 | `approval-required` policy for mutative tools |
+| AAI-R05 | Ephemeral execution with bounded duration, memory, and CPU |
+| AAI-R06 | Untrusted context treated as data with provenance and schema validation |
+| AAI-R07 | Capability-scoped delegation and append-only correlated action evidence |
+| AAI-R08 | Positive token and context ceilings, bounded MCP concurrency, and a readable runbook path |
+| AAI-R09 | Bounded delegation, credential rotation cadence, and incident revocation |
+
+## Configuration Contract
+
+`agent.config.json` is a portable declaration, not a runtime-specific agent framework file. It keeps prompts, deterministic implementation, and execution permissions independently reviewable.
+
+```json
+{
+  "agent": {
+    "id": "architecture-reviewer",
+    "capabilities": ["read-architecture", "review-changes"]
+  },
+  "sandbox": {
+    "mode": "isolated",
+    "network": "allowlist",
+    "process": "deny",
+    "ephemeral": true,
+    "maxDurationSeconds": 30,
+    "maxMemoryMb": 512,
+    "maxCpuCores": 1
+  },
+  "promptSources": ["prompts"],
+  "implementationRoots": ["src/agents"],
+  "contextPolicy": {
+    "untrustedContent": "data-only",
+    "provenanceRequired": true,
+    "toolOutputSchemaValidation": true
+  },
+  "toolPolicy": {
+    "mutative": "approval-required",
+    "capabilityDelegation": "scoped-and-expiring"
+  },
+  "audit": {
+    "appendOnly": true,
+    "correlationId": "required"
+  },
+  "operationalBudgets": {
+    "maxPromptTokens": 16000,
+    "maxCompletionTokens": 4000,
+    "maxContextWindowTokens": 128000,
+    "mcpToolConcurrency": {
+      "maxInFlight": 4,
+      "perToolMaxInFlight": 2
+    },
+    "runbooksPath": "docs/agentic-ai-runbooks.md"
+  },
+  "credentialLifecycle": {
+    "delegationMaxTtlSeconds": 900,
+    "rotationCadenceDays": 30,
+    "revocation": {
+      "onIncident": "immediate",
+      "maxPropagationSeconds": 60
+    }
+  }
+}
+```
+
+The declared prompt and implementation paths MUST not overlap. A capability is not permission: the sandbox and tool policy are the execution authority. Untrusted context remains data, never authority; every action carries a scoped capability and append-only correlated evidence.
+
+## Operational Contract
+
+`operationalBudgets` declares enforceable ceilings for one execution. `maxPromptTokens` limits supplied instructions and context, `maxCompletionTokens` limits generated output, and `maxContextWindowTokens` limits the combined model context. `mcpToolConcurrency.maxInFlight` caps all concurrent tool calls; `perToolMaxInFlight` prevents a single tool from consuming the whole budget. An adopter MUST choose values appropriate to its approved model and capacity, and MUST point `runbooksPath` to its maintained incident guide.
+
+`credentialLifecycle` limits delegated authority to `delegationMaxTtlSeconds`, requires rotation no less frequently than `rotationCadenceDays`, and defines how quickly incident revocation reaches every executor. `onIncident` SHOULD be `immediate`; `scheduled` is permitted only when a documented operational dependency prevents immediate revocation. The topology reference runbooks are [available here](./runbooks.md).
+
+## Interaction and Security Boundary
+
+```mermaid
+flowchart LR
+    C["Governed context"] --> A["Agent"]
+    P["Prompt sources"] --> A
+    A --> S["Isolated sandbox"]
+    S --> R["Read-only tools"]
+    S --> M{"Mutative tool"}
+    M -->|"approval-required"| H["Human or policy approval"]
+    H --> T["Approved execution"]
+    I["Implementation roots"] -. "separate from prompts" .-> A
+```
+
+The sandbox is the only route to tool execution. Prompts provide instructions; implementation roots contain deterministic code. Neither can silently grant network, process, or mutative access.
+
+## Governing Decisions and Validation
+
+[ADR-0058](../../../adrs/core/0058-ai-consumable-architecture-knowledge.md) governs AI-consumable architecture knowledge. [ADR-0081](../../../adrs/core/0081-agentic-ai-sandbox-isolation.md), [ADR-0082](../../../adrs/core/0082-agentic-ai-trust-boundary.md), and [ADR-0083](../../../adrs/core/0083-agentic-ai-action-authorization-audit.md) establish the sandbox, trust, and authorization boundaries. [ADR-AI-001](../../../../governance/standards/ai-augmented/06-adrs/adr-ai-001-harness-strategy.md) and [ADR-AI-005](../../../../governance/standards/ai-augmented/06-adrs/adr-ai-005-human-in-the-loop-policy.md) remain supporting proposed decisions.
+
+Run the profile through the topology-aware validator:
+
+```bash
+evolith validate --topology agentic-ai
+```
+
+The native ruleset is [agentic-ai.rules.json](./agentic-ai.rules.json); its equivalent OPA policy is [agentic-ai.rego](./agentic-ai.rego). Both evaluate the same `agent.config.json` contract.
+
+## Business Boundary
+
+This profile is technical-only. It does not define business ownership, prioritization, ROI, cost, budget, staffing, delivery timing, or Funnel 0. Evolith Tracker owns those concerns through its ACL.
+
+## Corpus Navigation
+
+The Agentic AI corpus is the required implementation baseline for this topology:
+
+| Area | Guidance |
+|---|---|
+| Adoption | [Adoption guide](./adoption.md) |
+| Operations | [Operations guide](./operations.md) |
+| Security | [Security guide](./security.md) |
+| Resilience | [Resilience guide](./resilience.md) |
+| Design | [Patterns and anti-patterns](./patterns.md) |
+| Evolution | [Evolution guide](./evolution.md) |
+| Summary | [Adoption, operations, and evolution guide](./maturity.md) |
+
+This corpus implements the [Topology Corpus Standard](../../topology-corpus-standard.md) for Agentic AI. A profile is not ready for acceptance until all of these guides, executable controls, contract fixtures, tests, and control-plane interfaces are present and validated.
+
+---
+[Back to Topology Hub](../../README.md)

package/rulesets/topologies/agentic-ai/adoption.es.md

@@ -0,0 +1,37 @@
+# Guia de Adopcion de IA Agentica
+
+> **Navegacion bilingue:** [Version en ingles](./adoption.md)
+
+## Criterios de Entrada
+
+Adopta IA agentica solo cuando un flujo acotado necesite razonamiento gobernado sobre contexto y uso acotado de herramientas. El bounded context propietario conserva la responsabilidad de la decision de negocio; el agente es un componente de ejecucion asistente, no un propietario de politica de dominio.
+
+Antes de habilitar un agente, el adoptante DEBE identificar al propietario responsable, declarar un conjunto inicial de capacidades de solo lectura y registrar las herramientas, fuentes de contexto y autoridad de aprobacion. La topologia se compone con un perfil de eje progresivo; no reemplaza las reglas de extraccion ni de propiedad de datos de ese perfil.
+
+## Secuencia de Adopcion
+
+1. Crea `agent.config.json` con identidad estable, capacidades explicitas, sandbox aislado y politica mutativa `approval-required`.
+2. Comienza con herramientas de solo lectura y contexto representativo que no sea de produccion.
+3. Valida el contrato con `evolith validate --topology agentic-ai` mediante los motores Native y OPA.
+4. Ejercita rutas de denegacion, timeout, contexto invalido y rechazo de aprobacion antes de habilitar una capacidad en un entorno superior.
+5. Agrega una herramienta mutativa solo despues de revisar su propietario, delegacion acotada, ruta de aprobacion y evidencia append-only correlacionada.
+
+## Lista de Adopcion
+
+- Hay un propietario de bounded context y un propietario de herramienta identificados.
+- Las fuentes de contexto tienen procedencia y clasificacion declaradas.
+- Las fuentes de prompts y las raices deterministas de implementacion estan separadas.
+- El sandbox tiene autoridad finita de CPU, memoria, duracion, proceso y red.
+- Las herramientas mutativas fallan cerrado cuando falta aprobacion o evidencia de politica.
+- Fixtures validos e invalidos bloqueantes cubren el contrato previsto.
+
+## Salida y No Adopcion
+
+No adoptes esta topologia para trabajo determinista que un servicio de aplicacion normal puede realizar, para flujos sin un limite seguro de herramientas o donde no se pueda retener evidencia y aprobacion. Deshabilita una capacidad cuando ya no esten disponibles su evidencia, propietario, control de sandbox o ruta de aprobacion requeridos.
+
+## Guia Relacionada
+
+Lee la [guia de seguridad](./security.es.md), [guia de operacion](./operations.es.md) y [guia de evolucion](./evolution.es.md) antes de la adopcion en produccion. [ADR-0081](../../../adrs/core/0081-agentic-ai-sandbox-isolation.es.md), [ADR-0082](../../../adrs/core/0082-agentic-ai-trust-boundary.es.md) y [ADR-0083](../../../adrs/core/0083-agentic-ai-action-authorization-audit.es.md) son autoridad obligatoria.
+
+---
+[Volver al Perfil de IA Agentica](./README.es.md)

package/rulesets/topologies/agentic-ai/adoption.md

@@ -0,0 +1,37 @@
+# Agentic AI Adoption Guide
+
+> **Bilingual Navigation:** [Version en Espanol](./adoption.es.md)
+
+## Entry Criteria
+
+Adopt Agentic AI only when a bounded workflow needs governed reasoning over context and bounded tool use. The owning bounded context remains accountable for the business decision; the agent is an assisting execution component, not an owner of domain policy.
+
+Before enabling an agent, the adopter MUST identify the accountable owner, declare a read-only initial capability set, and record the tools, context sources, and approval authority. The topology composes with a progressive-axis profile; it does not replace that profile's extraction or data-ownership rules.
+
+## Adoption Sequence
+
+1. Create `agent.config.json` with a stable identity, explicit capabilities, isolated sandbox, and `approval-required` mutative policy.
+2. Start with read-only tools and representative non-production context.
+3. Validate the contract with `evolith validate --topology agentic-ai` using both Native and OPA engines.
+4. Exercise denial, timeout, invalid-context, and approval-rejection paths before enabling a capability in a higher environment.
+5. Add a mutative tool only after its owner, scoped delegation, approval path, and correlated append-only evidence are reviewed.
+
+## Adoption Checklist
+
+- A bounded-context owner and tool owner are named.
+- Context sources have a declared provenance and classification.
+- Prompt sources and deterministic implementation roots are separate.
+- The sandbox has finite CPU, memory, duration, process, and network authority.
+- Mutative tools fail closed when approval or policy evidence is absent.
+- Valid and blocking-invalid fixtures cover the intended contract.
+
+## Exit and Non-Adoption
+
+Do not adopt this topology for deterministic work that a normal application service can perform, for workflows without a safe tool boundary, or where evidence and approval cannot be retained. Disable a capability when its required evidence, owner, sandbox control, or approval path is no longer available.
+
+## Related Guidance
+
+Read the [security guide](./security.md), [operations guide](./operations.md), and [evolution guide](./evolution.md) before production adoption. [ADR-0081](../../../adrs/core/0081-agentic-ai-sandbox-isolation.md), [ADR-0082](../../../adrs/core/0082-agentic-ai-trust-boundary.md), and [ADR-0083](../../../adrs/core/0083-agentic-ai-action-authorization-audit.md) are mandatory authority.
+
+---
+[Back to Agentic AI Profile](./README.md)

package/rulesets/topologies/agentic-ai/agent.config.schema.json

@@ -0,0 +1,100 @@
+{
+  "$id": "https://evolith.dev/schemas/agentic-ai/agent.config.schema.json",
+  "title": "Evolith Agentic AI Configuration",
+  "type": "object",
+  "required": ["agent", "sandbox", "promptSources", "implementationRoots", "contextPolicy", "toolPolicy", "audit", "operationalBudgets", "credentialLifecycle"],
+  "additionalProperties": false,
+  "properties": {
+    "agent": {
+      "type": "object",
+      "required": ["id", "capabilities"],
+      "additionalProperties": false,
+      "properties": {
+        "id": { "type": "string", "minLength": 1 },
+        "capabilities": { "type": "array", "minItems": 1, "items": { "type": "string", "minLength": 1 }, "uniqueItems": true }
+      }
+    },
+    "sandbox": {
+      "type": "object",
+      "required": ["mode", "network", "process", "ephemeral", "maxDurationSeconds", "maxMemoryMb", "maxCpuCores"],
+      "additionalProperties": false,
+      "properties": {
+        "mode": { "const": "isolated" },
+        "network": { "enum": ["deny", "allowlist"] },
+        "process": { "enum": ["deny", "allowlist"] },
+        "ephemeral": { "const": true },
+        "maxDurationSeconds": { "type": "integer", "minimum": 1 },
+        "maxMemoryMb": { "type": "integer", "minimum": 1 },
+        "maxCpuCores": { "type": "number", "exclusiveMinimum": 0 }
+      }
+    },
+    "promptSources": { "type": "array", "minItems": 1, "items": { "type": "string", "minLength": 1 }, "uniqueItems": true },
+    "implementationRoots": { "type": "array", "minItems": 1, "items": { "type": "string", "minLength": 1 }, "uniqueItems": true },
+    "contextPolicy": {
+      "type": "object",
+      "required": ["untrustedContent", "provenanceRequired", "toolOutputSchemaValidation"],
+      "additionalProperties": false,
+      "properties": {
+        "untrustedContent": { "const": "data-only" },
+        "provenanceRequired": { "const": true },
+        "toolOutputSchemaValidation": { "const": true }
+      }
+    },
+    "toolPolicy": {
+      "type": "object",
+      "required": ["mutative", "capabilityDelegation"],
+      "additionalProperties": false,
+      "properties": {
+        "mutative": { "const": "approval-required" },
+        "capabilityDelegation": { "const": "scoped-and-expiring" }
+      }
+    },
+    "audit": {
+      "type": "object",
+      "required": ["appendOnly", "correlationId"],
+      "additionalProperties": false,
+      "properties": {
+        "appendOnly": { "const": true },
+        "correlationId": { "const": "required" }
+      }
+    },
+    "operationalBudgets": {
+      "type": "object",
+      "required": ["maxPromptTokens", "maxCompletionTokens", "maxContextWindowTokens", "mcpToolConcurrency", "runbooksPath"],
+      "additionalProperties": false,
+      "properties": {
+        "maxPromptTokens": { "type": "integer", "minimum": 1 },
+        "maxCompletionTokens": { "type": "integer", "minimum": 1 },
+        "maxContextWindowTokens": { "type": "integer", "minimum": 1 },
+        "mcpToolConcurrency": {
+          "type": "object",
+          "required": ["maxInFlight", "perToolMaxInFlight"],
+          "additionalProperties": false,
+          "properties": {
+            "maxInFlight": { "type": "integer", "minimum": 1 },
+            "perToolMaxInFlight": { "type": "integer", "minimum": 1 }
+          }
+        },
+        "runbooksPath": { "type": "string", "minLength": 1 }
+      }
+    },
+    "credentialLifecycle": {
+      "type": "object",
+      "required": ["delegationMaxTtlSeconds", "rotationCadenceDays", "revocation"],
+      "additionalProperties": false,
+      "properties": {
+        "delegationMaxTtlSeconds": { "type": "integer", "minimum": 1 },
+        "rotationCadenceDays": { "type": "integer", "minimum": 1 },
+        "revocation": {
+          "type": "object",
+          "required": ["onIncident", "maxPropagationSeconds"],
+          "additionalProperties": false,
+          "properties": {
+            "onIncident": { "enum": ["immediate", "scheduled"] },
+            "maxPropagationSeconds": { "type": "integer", "minimum": 1 }
+          }
+        }
+      }
+    }
+  }
+}

package/rulesets/topologies/agentic-ai/agentic-ai.rego

@@ -0,0 +1,46 @@
+package evolith.topologies.agentic_ai
+
+violations[{"id": "AAI-R01", "severity": "MUST", "title": "Declared Agent Identity and Capabilities", "blocking": true, "message": message}] {
+    not input.satellite.agenticAi.hasIdentity
+    message := "agent.config.json must declare agent.id and a non-empty capabilities array (AAI-R01)."
+}
+
+violations[{"id": "AAI-R02", "severity": "MUST", "title": "Explicit Sandbox Boundary", "blocking": true, "message": message}] {
+    not input.satellite.agenticAi.hasIsolatedSandbox
+    message := "agent.config.json must declare an isolated sandbox with deny or allowlist network and process access (AAI-R02)."
+}
+
+violations[{"id": "AAI-R03", "severity": "MUST", "title": "Prompt and Implementation Separation", "blocking": true, "message": message}] {
+    not input.satellite.agenticAi.hasSeparatedPromptAndImplementation
+    message := "agent.config.json must declare non-overlapping promptSources and implementationRoots (AAI-R03)."
+}
+
+violations[{"id": "AAI-R04", "severity": "MUST", "title": "Approval for Mutative Tools", "blocking": true, "message": message}] {
+    not input.satellite.agenticAi.requiresApprovalForMutativeTools
+    message := "agent.config.json must set toolPolicy.mutative to approval-required (AAI-R04)."
+}
+
+violations[{"id": "AAI-R05", "severity": "MUST", "title": "Ephemeral Sandbox Resource Limits", "blocking": true, "message": message}] {
+    not input.satellite.agenticAi.hasEphemeralSandboxLimits
+    message := "agent.config.json must require ephemeral execution with positive duration, memory, and CPU limits (AAI-R05)."
+}
+
+violations[{"id": "AAI-R06", "severity": "MUST", "title": "Untrusted Context Is Data", "blocking": true, "message": message}] {
+    not input.satellite.agenticAi.hasTrustedContextPolicy
+    message := "agent.config.json must treat untrusted context as data, require provenance, and validate tool output schemas (AAI-R06)."
+}
+
+violations[{"id": "AAI-R07", "severity": "MUST", "title": "Capability-Scoped, Auditable Actions", "blocking": true, "message": message}] {
+    not input.satellite.agenticAi.hasAccountableActions
+    message := "agent.config.json must require scoped-and-expiring capabilities and append-only correlated action evidence (AAI-R07)."
+}
+
+violations[{"id": "AAI-R08", "severity": "MUST", "title": "Operational Budgets and Concurrency Limits", "blocking": true, "message": message}] {
+    not input.satellite.agenticAi.hasOperationalBudgets
+    message := "agent.config.json must declare operationalBudgets with positive token, context window, and MCP concurrency limits plus a runbooksPath that exists (AAI-R08)."
+}
+
+violations[{"id": "AAI-R09", "severity": "MUST", "title": "Satellite Credential Lifecycle", "blocking": true, "message": message}] {
+    not input.satellite.agenticAi.hasCredentialLifecycle
+    message := "agent.config.json must declare credentialLifecycle with positive delegation TTL, rotation cadence, and bounded incident revocation (AAI-R09)."
+}

package/rulesets/topologies/agentic-ai/agentic-ai.rules.json

@@ -0,0 +1,109 @@
+{
+  "$schema": "../../../../../rulesets/schema/ruleset-standard.schema.json",
+  "$id": "https://evolith.dev/rulesets/topologies/agentic-ai.rules.json",
+  "title": "Agentic AI Topology Rules",
+  "description": "Architectural rules for the agentic AI topology.",
+  "version": "1.1.0",
+  "effectiveDate": "2026-06-21",
+  "references": [
+    "rulesets/topologies/agentic-ai/README.md",
+    "reference/architecture/adrs/core/0058-ai-consumable-architecture-knowledge.md",
+    "reference/architecture/adrs/core/0081-agentic-ai-sandbox-isolation.md",
+    "reference/architecture/adrs/core/0082-agentic-ai-trust-boundary.md",
+    "reference/architecture/adrs/core/0083-agentic-ai-action-authorization-audit.md",
+    "reference/governance/standards/ai-augmented/06-adrs/adr-ai-001-harness-strategy.md",
+    "reference/governance/standards/ai-augmented/06-adrs/adr-ai-005-human-in-the-loop-policy.md"
+  ],
+  "rules": [
+    {
+      "id": "AAI-R01",
+      "severity": "MUST",
+      "category": "agent-identity",
+      "title": "Declared Agent Identity and Capabilities",
+      "description": "An Agentic AI satellite MUST provide agent.config.json with a stable agent.id and a non-empty capabilities array.",
+      "rationale": "A governed agent cannot be reviewed, authorized, or audited when its identity and intended capabilities are implicit.",
+      "validationQuery": "Read agent.config.json and require agent.id plus at least one declared capability.",
+      "blocking": true
+    },
+    {
+      "id": "AAI-R02",
+      "severity": "MUST",
+      "category": "agent-sandbox",
+      "title": "Explicit Sandbox Boundary",
+      "description": "agent.config.json MUST declare an isolated sandbox and set both network and process access to deny or allowlist.",
+      "rationale": "An agent requires a least-privilege execution boundary before it can invoke tools or handle untrusted content.",
+      "validationQuery": "Require sandbox.mode=isolated and sandbox.network and sandbox.process in {deny, allowlist}.",
+      "blocking": true
+    },
+    {
+      "id": "AAI-R03",
+      "severity": "MUST",
+      "category": "agent-prompt-boundaries",
+      "title": "Prompt and Implementation Separation",
+      "description": "agent.config.json MUST declare non-empty promptSources and implementationRoots that do not overlap.",
+      "rationale": "Keeping prompts separate from deterministic implementation logic makes prompt changes reviewable and prevents hidden policy from leaking into application code.",
+      "validationQuery": "Require non-empty promptSources and implementationRoots arrays; no configured path may be an ancestor or descendant of a path in the other array.",
+      "blocking": true
+    },
+    {
+      "id": "AAI-R04",
+      "severity": "MUST",
+      "category": "agent-tool-approval",
+      "title": "Approval for Mutative Tools",
+      "description": "agent.config.json MUST set toolPolicy.mutative to approval-required.",
+      "rationale": "Mutative actions must remain behind an explicit human or policy-governed approval boundary.",
+      "validationQuery": "Require toolPolicy.mutative=approval-required.",
+      "blocking": true
+    },
+    {
+      "id": "AAI-R05",
+      "severity": "MUST",
+      "category": "agent-sandbox-limits",
+      "title": "Ephemeral Sandbox Resource Limits",
+      "description": "agent.config.json MUST require ephemeral execution and positive duration, memory, and CPU limits in sandbox.",
+      "rationale": "Isolation without bounded lifetime and resources still permits persistence, denial of service, and uncontrolled cost.",
+      "validationQuery": "Require sandbox.ephemeral=true plus positive maxDurationSeconds, maxMemoryMb, and maxCpuCores values.",
+      "blocking": true
+    },
+    {
+      "id": "AAI-R06",
+      "severity": "MUST",
+      "category": "agent-context-trust",
+      "title": "Untrusted Context Is Data",
+      "description": "agent.config.json MUST declare contextPolicy.untrustedContent=data-only, provenanceRequired=true, and toolOutputSchemaValidation=true.",
+      "rationale": "Retrieved context and tool output can be attacker-controlled and must not silently become instructions or authority.",
+      "validationQuery": "Require the three contextPolicy fields and their safe values.",
+      "blocking": true
+    },
+    {
+      "id": "AAI-R07",
+      "severity": "MUST",
+      "category": "agent-action-accountability",
+      "title": "Capability-Scoped, Auditable Actions",
+      "description": "agent.config.json MUST require scoped-and-expiring capability delegation and append-only action evidence with correlation IDs.",
+      "rationale": "An agent action must be attributable, revocable, and reconstructible without relying on the prompt transcript.",
+      "validationQuery": "Require toolPolicy.capabilityDelegation=scoped-and-expiring, audit.appendOnly=true, and audit.correlationId=required.",
+      "blocking": true
+    },
+    {
+      "id": "AAI-R08",
+      "severity": "MUST",
+      "category": "agent-operational-budgets",
+      "title": "Operational Budgets and Concurrency Limits",
+      "description": "agent.config.json MUST declare operationalBudgets with positive maxPromptTokens, maxCompletionTokens, maxContextWindowTokens, an mcpToolConcurrency object with positive maxInFlight and perToolMaxInFlight, and a non-empty runbooksPath that points at a readable runbook document.",
+      "rationale": "Without quantitative ceilings the topology cannot reason about token overflow, MCP tool stampedes, or hung agents, and operators have no documented recovery path to point to during an incident.",
+      "validationQuery": "Require operationalBudgets.{maxPromptTokens,maxCompletionTokens,maxContextWindowTokens} > 0, operationalBudgets.mcpToolConcurrency.{maxInFlight,perToolMaxInFlight} > 0, and operationalBudgets.runbooksPath naming a file that exists on disk.",
+      "blocking": true
+    },
+    {
+      "id": "AAI-R09",
+      "severity": "MUST",
+      "category": "agent-credential-lifecycle",
+      "title": "Satellite Credential Lifecycle",
+      "description": "agent.config.json MUST declare credentialLifecycle with a positive delegationMaxTtlSeconds, a positive rotationCadenceDays, revocation.onIncident in {immediate, scheduled}, and a positive revocation.maxPropagationSeconds.",
+      "rationale": "Delegated agent credentials must rotate on a cadence and be revocable within a bounded window so a compromised satellite cannot retain authority indefinitely.",
+      "validationQuery": "Require credentialLifecycle.delegationMaxTtlSeconds > 0, credentialLifecycle.rotationCadenceDays > 0, credentialLifecycle.revocation.onIncident in {immediate, scheduled}, and credentialLifecycle.revocation.maxPropagationSeconds > 0.",
+      "blocking": true
+    }
+  ]
+}