@evolith/core-domain 1.0.0 → 1.0.1

package/rulesets/topologies/serverless/security.es.md

@@ -0,0 +1,36 @@
+# Guía de Seguridad Sin Servidor
+
+> **Navegación Bilingüe:** [English](./security.md) | [Español](./security.es.md)
+
+**Propietario:** Ingeniería de Plataforma
+**Topología:** Sin Servidor
+
+---
+
+## Roles IAM por Función
+
+Aplicar roles IAM de privilegio mínimo a cada función. Ninguna función comparte un rol IAM con otra a menos que sus conjuntos de permisos sean idénticos. Rotar credenciales automáticamente. Auditar asignaciones de roles trimestralmente.
+
+## Aislamiento VPC
+
+Desplegar funciones en subnets privadas al acceder a recursos internos. Usar grupos de seguridad para restringir el tráfico de salida. Evitar subnets públicas para funciones de plano de datos. Monitorear logs de flujo VPC en busca de patrones de tráfico anómalos.
+
+## Gestión de Secretos
+
+Nunca incrustar secretos en paquetes de despliegue o variables de entorno en texto plano. Utilizar un almacén de secretos gestionado (AWS Secrets Manager, Azure Key Vault, GCP Secret Manager). Rotar secretos en un calendario definido. Almacenar secretos en caché en memoria con TTL corto para reducir llamadas al almacén.
+
+## Seguridad de Red (SV-SEC-01)
+
+Aplicar segmentación de red entre capas de funciones. Bloquear todo acceso de entrada a Internet a menos que sea explícitamente requerido. Usar reglas WAF a nivel de API Gateway. Validar y sanitizar todas las entradas externas en el límite de la función.
+
+## TLS Mutuo (SV-SEC-02)
+
+Implementar mTLS para comunicación entre servicios en topologías distribuidas. Usar una autoridad de certificados compartida o proveedor mTLS gestionado. Validar certificados de cliente en la puerta de enlace de la función. Rotar certificados en un ciclo de 90 días.
+
+## Endurecimiento del Runtime
+
+Usar imágenes base mínimas para funciones basadas en contenedores. Aplicar parches del nivel de SO de manera oportuna. Deshabilitar características y runtimes de lenguaje no utilizados. Escanear paquetes de despliegue en busca de vulnerabilidades conocidas antes de publicar.
+
+---
+
+[Volver al Perfil Sin Servidor](./README.es.md)

package/rulesets/topologies/serverless/security.md

@@ -0,0 +1,36 @@
+# Serverless — Security Guide
+
+> **Bilingual Navigation:** [English](./security.md) | [Español](./security.es.md)
+
+**Owner:** Platform Engineering
+**Topology:** Serverless
+
+---
+
+## IAM Roles Per Function
+
+Apply least-privilege IAM roles to each function. No function shares an IAM role with another unless their permission sets are identical. Rotate credentials automatically. Audit role assignments quarterly.
+
+## VPC Isolation
+
+Deploy functions into private subnets when accessing internal resources. Use security groups to restrict egress. Avoid public subnets for data-plane functions. Monitor VPC flow logs for anomalous traffic patterns.
+
+## Secret Management
+
+Never embed secrets in deployment packages or environment variables in plaintext. Use a managed secrets store (AWS Secrets Manager, Azure Key Vault, GCP Secret Manager). Rotate secrets on a defined schedule. Cache secrets in-memory with short TTL to reduce store calls.
+
+## Network Security (SV-SEC-01)
+
+Enforce network segmentation between function layers. Block all inbound internet access unless explicitly required. Use WAF rules at API Gateway level. Validate and sanitize all external inputs at the function boundary.
+
+## Mutual TLS (SV-SEC-02)
+
+Implement mTLS for service-to-service communication in distributed topologies. Use a shared certificate authority or managed mTLS provider. Validate client certificates at the function gateway. Rotate certificates on a 90-day cycle.
+
+## Runtime Hardening
+
+Use minimal base images for container-based functions. Apply OS-level patches promptly. Disable unused language features and runtimes. Scan deployment packages for known vulnerabilities before publishing.
+
+---
+
+[Back to Serverless Profile](./README.md)

package/rulesets/topologies/serverless/serverless.rego

@@ -0,0 +1,32 @@
+package evolith.topologies.serverless
+
+# Inlined from common-execution.rego (self-contained WASM per topology)
+
+violations[{"id":"SV-SEC-01","blocking":true,"message":"Serverless components MUST define a 'networkSecurity' profile."}] {
+    not input.config.networkSecurity
+}
+
+violations[{"id":"SV-SEC-02","blocking":true,"message":"mTLS must be enabled for all serverless network communications."}] {
+    input.config.networkSecurity
+    not input.config.networkSecurity.mtlsEnabled
+}
+
+# SV-R01: Declared Serverless Contract
+violations[{"id":"SV-R01","blocking":true,"message":"serverless.config.json is required (SV-R01)."}] {
+    not input.config.hasContract
+}
+
+# SV-R02: Stateless Execution
+violations[{"id":"SV-R02","blocking":true,"message":"Serverless execution must be stateless (SV-R02)."}] {
+    not input.config.isStateless
+}
+
+# SV-R03: Bounded Deployment Package
+violations[{"id":"SV-R03","blocking":true,"message":"Package size must be positive and no greater than 50 MB (SV-R03)."}] {
+    not input.config.hasBoundedPackage
+}
+
+# SV-R04: Cold-Start Readiness
+violations[{"id":"SV-R04","blocking":true,"message":"Cold-start limits and lazy initialization are required (SV-R04)."}] {
+    not input.config.hasColdStartReadiness
+}

package/rulesets/topologies/serverless/serverless.rules.json

@@ -0,0 +1,33 @@
+{
+  "$schema": "../../../../../rulesets/schema/ruleset-standard.schema.json",
+  "$id": "https://evolith.dev/rulesets/topologies/serverless.rules.json",
+  "title": "Serverless Topology Rules",
+  "description": "Architectural rules for the serverless execution topology.",
+  "version": "1.0.0",
+  "effectiveDate": "2026-06-20",
+  "rules": [
+    {
+      "id": "SV-SEC-01",
+      "severity": "MUST",
+      "category": "execution-security",
+      "title": "Network Security Profile",
+      "description": "Serverless components MUST define a 'networkSecurity' profile in their config.",
+      "blocking": true
+    },
+    {
+      "id": "SV-SEC-02",
+      "severity": "MUST",
+      "category": "execution-mtls",
+      "title": "mTLS Enforcement",
+      "description": "mTLS must be enabled for all serverless network communications.",
+      "blocking": true
+    },
+    {
+      "id": "SV-R01",
+      "severity": "MUST", "category": "serverless-config", "title": "Declared Serverless Contract", "description": "A Serverless satellite MUST provide serverless.config.json.", "blocking": true
+    },
+    { "id": "SV-R02", "severity": "MUST", "category": "serverless-stateless", "title": "Stateless Execution", "description": "serverless.config.json MUST declare stateless=true.", "blocking": true },
+    { "id": "SV-R03", "severity": "MUST", "category": "serverless-package", "title": "Bounded Deployment Package", "description": "serverless.config.json MUST declare a positive package.maxSizeMb not exceeding 50.", "blocking": true },
+    { "id": "SV-R04", "severity": "MUST", "category": "serverless-cold-start", "title": "Cold-Start Readiness", "description": "serverless.config.json MUST declare positive coldStart.maxInitMilliseconds and coldStart.lazyInitialization=true.", "blocking": true }
+  ]
+}

package/rulesets/topologies/serverless/serverless.test.rego

@@ -0,0 +1,28 @@
+package evolith.topologies.serverless_test
+
+import data.evolith.topologies.serverless
+
+test_compliant_serverless_has_no_violations {
+  violations := serverless.violations with input as {"topology": "serverless", "config": {"networkSecurity": {"mtlsEnabled": true}, "hasContract": true, "isStateless": true, "hasBoundedPackage": true, "hasColdStartReadiness": true}}
+  count(violations) == 0
+}
+
+test_missing_contract_is_rejected {
+  violations := serverless.violations with input as {"topology": "serverless", "config": {"networkSecurity": {"mtlsEnabled": true}, "hasContract": false, "isStateless": true, "hasBoundedPackage": true, "hasColdStartReadiness": true}}
+  violations[_].id == "SV-R01"
+}
+
+test_non_stateless_is_rejected {
+  violations := serverless.violations with input as {"topology": "serverless", "config": {"networkSecurity": {"mtlsEnabled": true}, "hasContract": true, "isStateless": false, "hasBoundedPackage": true, "hasColdStartReadiness": true}}
+  violations[_].id == "SV-R02"
+}
+
+test_missing_package_bound_is_rejected {
+  violations := serverless.violations with input as {"topology": "serverless", "config": {"networkSecurity": {"mtlsEnabled": true}, "hasContract": true, "isStateless": true, "hasBoundedPackage": false, "hasColdStartReadiness": true}}
+  violations[_].id == "SV-R03"
+}
+
+test_missing_cold_start_readiness_is_rejected {
+  violations := serverless.violations with input as {"topology": "serverless", "config": {"networkSecurity": {"mtlsEnabled": true}, "hasContract": true, "isStateless": true, "hasBoundedPackage": true, "hasColdStartReadiness": false}}
+  violations[_].id == "SV-R04"
+}

package/rulesets/topologies/serverless/topology.config.schema.json

@@ -0,0 +1,28 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "title": "Serverless Topology Configuration",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["topology", "stateless", "package", "coldStart"],
+  "properties": {
+    "topology": { "const": "serverless" },
+    "stateless": { "const": true },
+    "package": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["maxSizeMb"],
+      "properties": {
+        "maxSizeMb": { "type": "integer", "minimum": 1, "maximum": 50 }
+      }
+    },
+    "coldStart": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["maxInitMilliseconds", "lazyInitialization"],
+      "properties": {
+        "maxInitMilliseconds": { "type": "integer", "minimum": 1 },
+        "lazyInitialization": { "const": true }
+      }
+    }
+  }
+}

package/rulesets/topologies/serverless/topology.manifest.json

@@ -0,0 +1,114 @@
+{
+  "apiVersion": "evolith.dev/topology/v1",
+  "kind": "TopologyManifest",
+  "metadata": {
+    "id": "serverless",
+    "name": "Serverless",
+    "dimension": "execution",
+    "status": "accepted",
+    "version": "1.0.0",
+    "governance": {
+      "owner": "Platform Engineering",
+      "criticality": "P1"
+    }
+  },
+  "spec": {
+    "summary": "Managed event-scaled execution topology for isolated capabilities governed by contracts, idempotency, observability, and provider-neutral architecture rules.",
+    "topologyType": "serverless",
+    "compatibility": {
+      "progressiveAxis": {
+        "phase": "cross",
+        "profile": "cross"
+      },
+      "composableWith": [
+        "modular-monolith",
+        "distributed-modules",
+        "microservices",
+        "event-driven",
+        "data-mesh",
+        "agentic-ai"
+      ]
+    },
+    "artifacts": {
+      "adrs": [
+        "reference/architecture/adrs/core/0079-multi-topology-reference-corpus.md",
+        "reference/architecture/adrs/core/0095-serverless-architecture-governance.md"
+      ],
+      "rulesets": [
+        "rulesets/topologies/serverless/serverless.rules.json"
+      ],
+      "opaPolicies": [
+        "rulesets/topologies/serverless/serverless.rego"
+      ],
+      "aiRulesets": [
+        "rulesets/topologies/serverless/README.md"
+      ],
+      "umsContracts": [
+        "reference/knowledge/demo/ums-reference-model.md"
+      ]
+    },
+    "corpus": {
+      "guidance": {
+        "profile": "rulesets/topologies/serverless/README.md",
+        "maturityGuide": "rulesets/topologies/serverless/maturity.md"
+      },
+      "configurationContract": "rulesets/topologies/serverless/topology.config.schema.json",
+      "fixtures": {
+        "valid": "rulesets/topologies/serverless/fixtures/valid.topology.config.json",
+        "invalid": "rulesets/topologies/serverless/fixtures/invalid.topology.config.json"
+      },
+      "nativeEvaluator": "packages/core-domain/src/application/validators/ruleset-validator.service.ts",
+      "tests": {
+        "positive": "packages/core-domain/src/application/validators/ruleset-validator-architecture.spec.ts",
+        "negative": "packages/core-domain/src/application/validators/ruleset-validator-architecture.spec.ts"
+      },
+      "evidence": "reference/governance/standards/vision/maturity-evidence.json"
+    },
+    "operationalBudgets": {
+      "latencyBudgetMs": 1500,
+      "coldStartCeilingMs": 1000,
+      "costCeilingPerExecutionCents": 1
+    },
+    "operationalInterfaces": {
+      "cli": {
+        "validators": [
+          "validate-architecture",
+          "validate-topology"
+        ]
+      },
+      "mcp": {
+        "resources": [
+          "evolith://topologies/serverless/manifest",
+          "evolith://topologies/serverless/rulesets"
+        ],
+        "tools": [
+          "evolith-topology-inspect",
+          "evolith-topology-validate"
+        ],
+        "prompts": [
+          "serverless-readiness-review",
+          "topology-aware-implementation"
+        ]
+      },
+      "coreApi": {
+        "endpoints": [
+          "GET /topologies/{id}",
+          "GET /topologies/{id}/manifest",
+          "POST /topologies/{id}/validate"
+        ]
+      }
+    }
+  },
+  "businessBoundary": {
+    "technicalOnly": true,
+    "trackerOwns": [
+      "timing",
+      "ownership",
+      "prioritization",
+      "roi",
+      "cost",
+      "budget",
+      "funnel-0"
+    ]
+  }
+}