@evolith/core-domain 1.0.1 → 1.0.2

package/rulesets/cross-cutting/definition-of-done.rules.json

@@ -1,135 +0,0 @@
-{
-  "$schema": "../schema/ruleset-standard.schema.json",
-  "$id": "https://evolith.dev/rulesets/cross-cutting/definition-of-done.rules.json",
-  "title": "Definition of Done Rules",
-  "description": "Machine-readable encoding of the Evolith Definition of Done. Mandatory checklist for every Technical Story before it can be marked Done.",
-  "version": "1.0.0",
-  "effectiveDate": "2026-01-01",
-  "rules": [
-    {
-      "id": "DOD-01",
-      "severity": "MUST",
-      "category": "code",
-      "title": "Code implemented and reviewed",
-      "description": "All implementation code is written and at least one peer review approval exists. Self-review does not count.",
-      "validationQuery": "PR has minimum 1 approved review. No direct push to main/develop.",
-      "blocking": true,
-      "checklistItem": "code-implemented"
-    },
-    {
-      "id": "DOD-02",
-      "severity": "MUST",
-      "category": "testing",
-      "title": "Unit tests meet coverage threshold",
-      "description": "Unit test coverage for business logic >= 80%. Layer-specific thresholds apply: Domain >= 95%, Application >= 85%, Infrastructure >= 60%.",
-      "validationQuery": "Coverage report from CI shows >= 80% for business logic. Per-layer thresholds validated.",
-      "blocking": true,
-      "checklistItem": "tests-passing"
-    },
-    {
-      "id": "DOD-03",
-      "severity": "MUST",
-      "category": "testing",
-      "title": "All acceptance criteria verified",
-      "description": "All acceptance criteria from the Functional Story are verified and pass. Manual or automated verification documented.",
-      "validationQuery": "All acceptance criteria marked as verified in story tracker. E2E or integration tests confirm criteria.",
-      "blocking": true,
-      "checklistItem": "acceptance-criteria-verified"
-    },
-    {
-      "id": "DOD-04",
-      "severity": "MUST",
-      "category": "documentation",
-      "title": "Documentation updated",
-      "description": "Documentation delta is produced alongside code changes. This includes: updated ADRs if decisions were made, inline code documentation for complex logic, README updates if public interfaces changed.",
-      "validationQuery": "PR includes documentation changes. Reviewer validates documentation completeness.",
-      "blocking": true,
-      "checklistItem": "documentation-updated"
-    },
-    {
-      "id": "DOD-05",
-      "severity": "MUST",
-      "category": "observability",
-      "title": "Observability instrumentation added",
-      "description": "Production paths have observable telemetry: traces with CorrelationId, structured logs with SessionTrackingId, metrics for key operations.",
-      "validationQuery": "OTel spans present for production API paths. Logs include required context fields.",
-      "blocking": true,
-      "checklistItem": "observability-added"
-    },
-    {
-      "id": "DOD-06",
-      "severity": "MUST",
-      "category": "security",
-      "title": "Security gates passed",
-      "description": "CodeQL scan passed with zero High/Critical findings. No new CVEs introduced. Secret scanning passed.",
-      "validationQuery": "CI security gates all green. CodeQL, dependency scan, secret scan passed.",
-      "blocking": true,
-      "checklistItem": "security-gates-passed"
-    },
-    {
-      "id": "DOD-07",
-      "severity": "MUST",
-      "category": "architecture",
-      "title": "ADR created if architectural decision made",
-      "description": "If the implementation required a new architectural decision (boundary change, technology selection, security model change), an ADR is created and linked to the story.",
-      "validationQuery": "Architectural decisions documented in ADR. Story links to relevant ADR IDs.",
-      "blocking": false,
-      "checklistItem": "adr-created-if-needed"
-    },
-    {
-      "id": "DOD-08",
-      "severity": "MUST",
-      "category": "integration",
-      "title": "Integration tests pass",
-      "description": "Integration tests (adapter tests with testcontainers) pass. Tests cover persistence adapters, gateway adapters, and inter-service contracts.",
-      "validationQuery": "Integration test suite passes. Contract tests for inter-service calls pass.",
-      "blocking": true,
-      "checklistItem": "integration-tests-passing"
-    },
-    {
-      "id": "DOD-09",
-      "severity": "MUST",
-      "category": "lint",
-      "title": "Linting and formatting passed",
-      "description": "All linting rules pass (ESLint, Prettier formatting). No lint errors, no formatting violations.",
-      "validationQuery": "CI lint step green. No ESLint errors, Prettier formatted.",
-      "blocking": true,
-      "checklistItem": "lint-passing"
-    },
-    {
-      "id": "DOD-10",
-      "severity": "MUST",
-      "category": "ci",
-      "title": "CI pipeline green on target branch",
-      "description": "CI pipeline runs successfully on the feature branch with all quality gates passing before merge.",
-      "validationQuery": "All CI checks green. Pipeline completed successfully on feature branch.",
-      "blocking": true,
-      "checklistItem": "ci-green"
-    }
-  ],
-  "summaryChecklist": [
-    "code-implemented",
-    "tests-passing",
-    "acceptance-criteria-verified",
-    "documentation-updated",
-    "observability-added",
-    "security-gates-passed",
-    "adr-created-if-needed",
-    "integration-tests-passing",
-    "lint-passing",
-    "ci-green"
-  ],
-  "references": [
-    "reference/governance/sdlc/02-engineering/construction-focused-sdlc-framework.md",
-    "reference/governance/sdlc/quality-gates.md"
-  ],
-  "exitCriteria": {
-    "description": "All MUST items checked. Story cannot be marked Done without all blocking items satisfied.",
-    "validationTools": [
-      "CI pipeline",
-      "coverage reports",
-      "PR review",
-      "story tracker"
-    ]
-  }
-}

package/rulesets/cross-cutting/engineering-manifesto.rules.json

@@ -1,145 +0,0 @@
-{
-  "$schema": "../schema/ruleset-standard.schema.json",
-  "$id": "https://evolith.dev/rulesets/cross-cutting/engineering-manifesto.rules.json",
-  "title": "Engineering Manifesto Rules",
-  "description": "Machine-readable encoding of the Evolith Engineering Manifesto principles. SOLID, DRY, KISS, YAGNI, and anti-pattern rules enforced via linting and review.",
-  "version": "1.0.0",
-  "effectiveDate": "2026-01-01",
-  "antiPatterns": [
-    {
-      "id": "AP-01",
-      "name": "God Class / Object",
-      "description": "Class with too many responsibilities (> 500 lines, > 20 methods). Violates SRP.",
-      "detection": "ESLint max-lines-per-file, max-classes-per-file"
-    },
-    {
-      "id": "AP-02",
-      "name": "Circular Dependency",
-      "description": "Module A imports Module B which imports Module A directly or indirectly.",
-      "detection": "dependency-cruiser no-circular"
-    },
-    {
-      "id": "AP-03",
-      "name": "Shotgun Surgery",
-      "description": "One change requires modifying many different classes across the codebase.",
-      "detection": "Code review; refactoring debt"
-    },
-    {
-      "id": "AP-04",
-      "name": "Spaghetti Code",
-      "description": "Code with complex nested control structures, no clear structure, tangled logic.",
-      "detection": "High cyclomatic complexity + low cohesion metrics"
-    },
-    {
-      "id": "AP-05",
-      "name": "Magic Numbers/Strings",
-      "description": "Unnamed constants scattered throughout code instead of named constants.",
-      "detection": "ESLint no-magic-numbers"
-    }
-  ],
-  "references": [
-    "reference/governance/standards/engineering/engineering-manifesto.md",
-    "reference/architecture/adrs/core/0049-naming-semantics-clean-code-policy.md"
-  ],
-  "exitCriteria": {
-    "description": "All SOLID violations blocked in CI. DRY violations detected and fixed. Anti-patterns flagged in code review.",
-    "validationTools": [
-      "ESLint",
-      "SonarQube",
-      "dependency-cruiser",
-      "code review"
-    ]
-  },
-  "rules": [
-    {
-      "id": "EM-S-01",
-      "severity": "MUST",
-      "category": "SOLID",
-      "title": "Single Responsibility: one reason to change",
-      "description": "Every class and module has one, and only one, reason to change. No God classes or multipurpose utilities.",
-      "validationQuery": "ESLint rule max-classes-per-file or equivalent. Class length < 200 lines.",
-      "blocking": false
-    },
-    {
-      "id": "EM-S-02",
-      "severity": "MUST",
-      "category": "SOLID",
-      "title": "Open/Closed: open for extension, closed for modification",
-      "description": "Software entities (classes, modules, functions) are open for extension but closed for modification. New behavior added via inheritance/composition, not by editing existing code.",
-      "validationQuery": "Code review verifies no modification of tested/approved classes for new features. Extension via polymorphism preferred.",
-      "blocking": false
-    },
-    {
-      "id": "EM-S-03",
-      "severity": "MUST",
-      "category": "SOLID",
-      "title": "Liskov Substitution: subtype substitutable for base",
-      "description": "Objects of a superclass shall be replaceable with objects of a subclass without affecting correctness. No违背 Liskov anywhere.",
-      "validationQuery": "TypeScript: no unsafe casting. Liskov violations detected via type checking and test coverage.",
-      "blocking": true
-    },
-    {
-      "id": "EM-S-04",
-      "severity": "MUST",
-      "category": "SOLID",
-      "title": "Interface Segregation: fine-grained interfaces",
-      "description": "Clients should not be forced to depend on interfaces they do not use. Prefer many small interfaces over one large interface.",
-      "validationQuery": "Interface size checked. No interface with > 10 methods without documented justification.",
-      "blocking": false
-    },
-    {
-      "id": "EM-S-05",
-      "severity": "MUST",
-      "category": "SOLID",
-      "title": "Dependency Inversion: depend on abstractions",
-      "description": "High-level modules must not depend on low-level modules. Both must depend on abstractions. Abstractions must not depend on details.",
-      "validationQuery": "Dependency direction validated via eslint-plugin-boundaries. Core has no Infrastructure imports.",
-      "blocking": true
-    },
-    {
-      "id": "EM-D-01",
-      "severity": "MUST",
-      "category": "DRY",
-      "title": "Don't Repeat Yourself",
-      "description": "Every piece of knowledge must have a single, unambiguous, authoritative representation within a system. Duplicated logic must be extracted to a single source.",
-      "validationQuery": "AST analysis detects duplicated code blocks > 5 lines. ESLint no-duplicate-imports or equivalent.",
-      "blocking": false
-    },
-    {
-      "id": "EM-D-02",
-      "severity": "MUST",
-      "category": "DRY",
-      "title": "Configuration not duplicated",
-      "description": "Configuration values (strings, numbers, URLs) must not be hardcoded in multiple places. Centralized config or constants.",
-      "validationQuery": "Magic numbers/strings detected. Configuration centralized in config files or env vars.",
-      "blocking": false
-    },
-    {
-      "id": "EM-K-01",
-      "severity": "MUST",
-      "category": "KISS",
-      "title": "Keep It Simple, Stupid",
-      "description": "Simplicity is the ultimate sophistication. Prefer simple solutions over complex ones. Complexity is the enemy of reliability.",
-      "validationQuery": "Cyclomatic complexity < 15 per method/function. Nested ternaries and complex conditions flagged.",
-      "blocking": true
-    },
-    {
-      "id": "EM-K-02",
-      "severity": "SHOULD NOT",
-      "category": "KISS",
-      "title": "Avoid premature abstraction",
-      "description": "Do not abstract for hypothetical future reuse. Abstract when duplication appears, not before.",
-      "validationQuery": "Unused interfaces or abstract classes flagged. Abstraction must have concrete use.",
-      "blocking": false
-    },
-    {
-      "id": "EM-Y-01",
-      "severity": "MUST NOT",
-      "category": "YAGNI",
-      "title": "You Aren't Gonna Need It",
-      "description": "Do not implement features or abstractions until they are actually needed. Building for hypothetical futures creates complexity debt.",
-      "validationQuery": "Code review checks for unused code paths or interfaces with no implementing classes.",
-      "blocking": false
-    }
-  ]
-}

package/rulesets/cross-cutting/repository-taxonomy.rules.json

@@ -1,172 +0,0 @@
-{
-  "$schema": "../schema/ruleset-standard.schema.json",
-  "$id": "https://evolith.dev/rulesets/cross-cutting/repository-taxonomy.rules.json",
-  "title": "Repository Taxonomy Rules",
-  "description": "Machine-readable encoding of the Evolith Repository Taxonomy. Naming, structure, and artifact classification rules for all Evolith repositories.",
-  "version": "1.0.0",
-  "effectiveDate": "2026-01-01",
-  "rules": [
-    {
-      "id": "TAX-01",
-      "severity": "MUST",
-      "category": "naming-conventions",
-      "title": "File names use kebab-case",
-      "description": "All file names use kebab-case (lowercase with hyphens). No spaces, no underscores in file names. Example: my-file-name.md, user-service.ts.",
-      "validationQuery": "File names validated via linting or CI script. Pattern: ^[a-z0-9-]+\\.[a-z]+$",
-      "blocking": true,
-      "examples": [
-        "my-file.md",
-        "user-service.ts",
-        "api-gateway.ts"
-      ]
-    },
-    {
-      "id": "TAX-02",
-      "severity": "MUST",
-      "category": "naming-conventions",
-      "title": "Class and type names use PascalCase",
-      "description": "Classes, interfaces, types, enums, and UI components use PascalCase.",
-      "rationale": "ADR-0056: Ubiquitous language enforcement. PascalCase for types/components.",
-      "validationQuery": "ESLint naming-convention for classes and interfaces.",
-      "blocking": true,
-      "examples": [
-        "UserService",
-        "HttpClient",
-        "ApiResponse"
-      ]
-    },
-    {
-      "id": "TAX-03",
-      "severity": "MUST",
-      "category": "naming-conventions",
-      "title": "Variable and function names use camelCase",
-      "description": "Variables, functions, methods use camelCase.",
-      "rationale": "ADR-0056: camelCase for variables and functions.",
-      "validationQuery": "ESLint naming-convention for variables and functions.",
-      "blocking": true,
-      "examples": [
-        "getUserById",
-        "userData",
-        "isValid"
-      ]
-    },
-    {
-      "id": "TAX-04",
-      "severity": "MUST",
-      "category": "naming-conventions",
-      "title": "Constants use UPPER_SNAKE_CASE",
-      "description": "Compile-time constants and configuration keys use UPPER_SNAKE_CASE.",
-      "validationQuery": "ESLint naming-convention for constants.",
-      "blocking": false,
-      "examples": [
-        "MAX_RETRY_COUNT",
-        "API_BASE_URL"
-      ]
-    },
-    {
-      "id": "TAX-05",
-      "severity": "MUST",
-      "category": "directory-structure",
-      "title": "Evolith Core structure: reference/, sdk/, rulesets/",
-      "description": "Evolith Core repository uses three primary directories: reference/ (human-authored standards), sdk/ (CLI, MCP, and executable access tooling), rulesets/ (machine-readable rules, including rulesets/topologies/ for executable topology rules). No other top-level content directories.",
-      "rationale": "Repository Taxonomy defines three entry points with clear ownership.",
-      "validationQuery": "Top-level directories match taxonomy. No arbitrary content directories added.",
-      "blocking": true,
-      "structure": [
-        "reference/",
-        "sdk/",
-        "rulesets/",
-        "rulesets/topologies/"
-      ]
-    },
-    {
-      "id": "TAX-06",
-      "severity": "MUST",
-      "category": "directory-structure",
-      "title": "Satellite structure: src/, tests/, docs/",
-      "description": "Satellite repositories follow standard structure: src/ (source code), tests/ (test code), docs/ (documentation). Infrastructure code lives under src/Infrastructure, domain code under src/Domain.",
-      "rationale": "Repository Taxonomy standard satellite structure.",
-      "validationQuery": "Satellite root has src/, tests/, docs/ directories. Hexagonal layers under src/.",
-      "blocking": true,
-      "structure": [
-        "src/Domain",
-        "src/Application",
-        "src/Infrastructure",
-        "src/Api"
-      ]
-    },
-    {
-      "id": "TAX-07",
-      "severity": "MUST",
-      "category": "adr-naming",
-      "title": "ADR files named with zero-padded ID",
-      "description": "ADR files use format: NNNN-descriptive-name.md where NNNN is zero-padded 4-digit number. Example: 0002-clean-architecture-nestjs.md, 0069-dotnet-grpc-service.md.",
-      "rationale": "core/ADR-0048: Canonical numbering enables sorting and referencing.",
-      "validationQuery": "ADR filenames match pattern: ^[0-9]{4}-[a-z-]+\\.md$",
-      "blocking": true,
-      "examples": [
-        "0002-clean-architecture-nestjs.md",
-        "0069-dotnet-grpc-service-setup-protobuf-contracts.md"
-      ]
-    },
-    {
-      "id": "TAX-08",
-      "severity": "MUST",
-      "category": "adr-naming",
-      "title": "Bilingual ADR files use .es.md suffix",
-      "description": "Spanish translations of ADRs use .es.md suffix in same directory. Example: 0002-clean-architecture-nestjs.es.md alongside 0002-clean-architecture-nestjs.md.",
-      "rationale": "Bilingual naming convention: Pattern A for individual files.",
-      "validationQuery": "Bilingual parity: every .md ADR has corresponding .es.md in same directory.",
-      "blocking": true
-    },
-    {
-      "id": "TAX-09",
-      "severity": "MUST",
-      "category": "artifact-classification",
-      "title": "Evolith reference artifacts in reference/",
-      "description": "Reusable policy, decision criteria, accepted trade-offs, and human-authored topology profiles go in reference/architecture/, reference/architecture/topologies/, reference/governance/, reference/knowledge/. These are normative or decisional depending on document status.",
-      "rationale": "Repository Taxonomy: Canonical Reference goes in reference/.",
-      "validationQuery": "Architecture decisions, standards, and patterns placed in correct reference/ subdirectory.",
-      "blocking": true
-    },
-    {
-      "id": "TAX-10",
-      "severity": "MUST",
-      "category": "artifact-classification",
-      "title": "Product-specific evidence not in reference/",
-      "description": "Product-specific routes, schemas, seeds, and branding do NOT go in reference/. They go in the satellite repository. Enterprise policy changes go through Evolith governance.",
-      "rationale": "Repository Taxonomy: Product evidence stays in product repo, not reference.",
-      "validationQuery": "No product-specific files in reference/. Product evidence in satellite repositories.",
-      "blocking": true
-    },
-    {
-      "id": "TAX-11",
-      "severity": "MUST",
-      "category": "directory-structure",
-      "title": "No root-level topologies directory",
-      "description": "Evolith Core MUST NOT create /topologies/ at repository root. Multi-topology documentation and executable rules must stay within taxonomy-approved corpus and ruleset locations, specifically reference/architecture/topologies/ and rulesets/topologies/, unless a future accepted ADR supersedes the root taxonomy.",
-      "rationale": "core/ADR-0079 rejects root-level /topologies/ to preserve ADR-0048 and ADR-0070 root taxonomy constraints.",
-      "validationQuery": "Repository root directory listing does not contain topologies/.",
-      "blocking": true,
-      "examples": [
-        "reference/architecture/topologies/",
-        "rulesets/topologies/"
-      ]
-    }
-  ],
-  "references": [
-    "reference/governance/standards/repository-taxonomy.md",
-    "reference/architecture/adrs/core/0048-enterprise-taxonomy-reference-layout.md",
-    "reference/architecture/adrs/core/0056-enterprise-naming-design-conventions.md",
-    "reference/architecture/adrs/core/0070-lean-root-repository-taxonomy.md",
-    "reference/architecture/adrs/core/0079-multi-topology-reference-corpus.md"
-  ],
-  "exitCriteria": {
-    "description": "All files follow naming conventions. Directory structure matches taxonomy. ADR files correctly numbered.",
-    "validationTools": [
-      "CI naming validation",
-      "directory structure check",
-      "ADR numbering validation"
-    ]
-  }
-}

package/rulesets/definition-of-done/README.es.md

@@ -1,26 +0,0 @@
-# Ruleset de Definition of Done
-
-> **Navegación Bilingüe:** [English Version](./README.md)
-
-Punto de entrada ejecutable WS1 para el ruleset Definition of Done de Evolith.
-
-## Propósito
-
-Este directorio expone `rulesets/definition-of-done` como la ruta ejecutable canónica que verifica la auditoría de fortaleza como data inteligente. El ruleset codifica el checklist obligatorio para cierre de historias consumido por el validador nativo de rulesets y los flujos de evidencia CI.
-
-## Artefactos
-
-| Artefacto | Propósito |
-|---|---|
-| [definition-of-done.rules.json](./definition-of-done.rules.json) | Ruleset nativo machine-readable para validación de Definition of Done |
-| [../opa/dod.rego](../opa/dod.rego) | Artefacto de paridad OPA para validación de Definition of Done |
-| [../opa/dod.test.rego](../opa/dod.test.rego) | Cobertura de pruebas OPA para la política Definition of Done |
-
-## Validación
-
-Ejecuta estos checks después de cambiar el ruleset:
-
-```bash
-npx jest --config packages/core-domain/jest.config.js --rootDir packages/core-domain --testPathPatterns='ruleset-validation.mode' --no-coverage
-.harness/bin/opa test rulesets/opa/dod.rego rulesets/opa/dod.test.rego -v
-```

package/rulesets/definition-of-done/README.md

@@ -1,26 +0,0 @@
-# Definition of Done Ruleset
-
-> **Bilingual Navigation:** [Versión en Español](./README.es.md)
-
-Executable WS1 entrypoint for the Evolith Definition of Done ruleset.
-
-## Purpose
-
-This directory exposes `rulesets/definition-of-done` as the canonical executable path checked by the intelligent data strength audit. The ruleset encodes the mandatory story-closure checklist consumed by the native ruleset validator and CI evidence flows.
-
-## Artifacts
-
-| Artifact | Purpose |
-|---|---|
-| [definition-of-done.rules.json](./definition-of-done.rules.json) | Native machine-readable ruleset for Definition of Done validation |
-| [../opa/dod.rego](../opa/dod.rego) | OPA policy parity artifact for Definition of Done validation |
-| [../opa/dod.test.rego](../opa/dod.test.rego) | OPA test coverage for the Definition of Done policy |
-
-## Validation
-
-Run these checks after changing the ruleset:
-
-```bash
-npx jest --config packages/core-domain/jest.config.js --rootDir packages/core-domain --testPathPatterns='ruleset-validation.mode' --no-coverage
-.harness/bin/opa test rulesets/opa/dod.rego rulesets/opa/dod.test.rego -v
-```

package/rulesets/definition-of-done/definition-of-done.rules.json

@@ -1,135 +0,0 @@
-{
-  "$schema": "../schema/ruleset-standard.schema.json",
-  "$id": "https://evolith.dev/rulesets/definition-of-done/definition-of-done.rules.json",
-  "title": "Definition of Done Rules",
-  "description": "Machine-readable encoding of the Evolith Definition of Done. Mandatory checklist for every Technical Story before it can be marked Done.",
-  "version": "1.0.0",
-  "effectiveDate": "2026-01-01",
-  "rules": [
-    {
-      "id": "DOD-01",
-      "severity": "MUST",
-      "category": "code",
-      "title": "Code implemented and reviewed",
-      "description": "All implementation code is written and at least one peer review approval exists. Self-review does not count.",
-      "validationQuery": "PR has minimum 1 approved review. No direct push to main/develop.",
-      "blocking": true,
-      "checklistItem": "code-implemented"
-    },
-    {
-      "id": "DOD-02",
-      "severity": "MUST",
-      "category": "testing",
-      "title": "Unit tests meet coverage threshold",
-      "description": "Unit test coverage for business logic >= 80%. Layer-specific thresholds apply: Domain >= 95%, Application >= 85%, Infrastructure >= 60%.",
-      "validationQuery": "Coverage report from CI shows >= 80% for business logic. Per-layer thresholds validated.",
-      "blocking": true,
-      "checklistItem": "tests-passing"
-    },
-    {
-      "id": "DOD-03",
-      "severity": "MUST",
-      "category": "testing",
-      "title": "All acceptance criteria verified",
-      "description": "All acceptance criteria from the Functional Story are verified and pass. Manual or automated verification documented.",
-      "validationQuery": "All acceptance criteria marked as verified in story tracker. E2E or integration tests confirm criteria.",
-      "blocking": true,
-      "checklistItem": "acceptance-criteria-verified"
-    },
-    {
-      "id": "DOD-04",
-      "severity": "MUST",
-      "category": "documentation",
-      "title": "Documentation updated",
-      "description": "Documentation delta is produced alongside code changes. This includes: updated ADRs if decisions were made, inline code documentation for complex logic, README updates if public interfaces changed.",
-      "validationQuery": "PR includes documentation changes. Reviewer validates documentation completeness.",
-      "blocking": true,
-      "checklistItem": "documentation-updated"
-    },
-    {
-      "id": "DOD-05",
-      "severity": "MUST",
-      "category": "observability",
-      "title": "Observability instrumentation added",
-      "description": "Production paths have observable telemetry: traces with CorrelationId, structured logs with SessionTrackingId, metrics for key operations.",
-      "validationQuery": "OTel spans present for production API paths. Logs include required context fields.",
-      "blocking": true,
-      "checklistItem": "observability-added"
-    },
-    {
-      "id": "DOD-06",
-      "severity": "MUST",
-      "category": "security",
-      "title": "Security gates passed",
-      "description": "CodeQL scan passed with zero High/Critical findings. No new CVEs introduced. Secret scanning passed.",
-      "validationQuery": "CI security gates all green. CodeQL, dependency scan, secret scan passed.",
-      "blocking": true,
-      "checklistItem": "security-gates-passed"
-    },
-    {
-      "id": "DOD-07",
-      "severity": "MUST",
-      "category": "architecture",
-      "title": "ADR created if architectural decision made",
-      "description": "If the implementation required a new architectural decision (boundary change, technology selection, security model change), an ADR is created and linked to the story.",
-      "validationQuery": "Architectural decisions documented in ADR. Story links to relevant ADR IDs.",
-      "blocking": false,
-      "checklistItem": "adr-created-if-needed"
-    },
-    {
-      "id": "DOD-08",
-      "severity": "MUST",
-      "category": "integration",
-      "title": "Integration tests pass",
-      "description": "Integration tests (adapter tests with testcontainers) pass. Tests cover persistence adapters, gateway adapters, and inter-service contracts.",
-      "validationQuery": "Integration test suite passes. Contract tests for inter-service calls pass.",
-      "blocking": true,
-      "checklistItem": "integration-tests-passing"
-    },
-    {
-      "id": "DOD-09",
-      "severity": "MUST",
-      "category": "lint",
-      "title": "Linting and formatting passed",
-      "description": "All linting rules pass (ESLint, Prettier formatting). No lint errors, no formatting violations.",
-      "validationQuery": "CI lint step green. No ESLint errors, Prettier formatted.",
-      "blocking": true,
-      "checklistItem": "lint-passing"
-    },
-    {
-      "id": "DOD-10",
-      "severity": "MUST",
-      "category": "ci",
-      "title": "CI pipeline green on target branch",
-      "description": "CI pipeline runs successfully on the feature branch with all quality gates passing before merge.",
-      "validationQuery": "All CI checks green. Pipeline completed successfully on feature branch.",
-      "blocking": true,
-      "checklistItem": "ci-green"
-    }
-  ],
-  "summaryChecklist": [
-    "code-implemented",
-    "tests-passing",
-    "acceptance-criteria-verified",
-    "documentation-updated",
-    "observability-added",
-    "security-gates-passed",
-    "adr-created-if-needed",
-    "integration-tests-passing",
-    "lint-passing",
-    "ci-green"
-  ],
-  "references": [
-    "reference/governance/sdlc/02-engineering/construction-focused-sdlc-framework.md",
-    "reference/governance/sdlc/quality-gates.md"
-  ],
-  "exitCriteria": {
-    "description": "All MUST items checked. Story cannot be marked Done without all blocking items satisfied.",
-    "validationTools": [
-      "CI pipeline",
-      "coverage reports",
-      "PR review",
-      "story tracker"
-    ]
-  }
-}