@evolith/core-domain 1.0.1 → 1.0.2

package/rulesets/opa/README.md

@@ -1,22 +0,0 @@
-# OPA Policies and Input Schemas
-
-This directory contains the core Open Policy Agent (OPA) `.rego` policies used for architecture and governance validation in the Evolith platform.
-
-Every OPA policy defines a formal contract for its input, backed by a versioned JSON Schema.
-
-## OPA Policies and Schemas
-
-| Policy File | Test File | Input JSON Schema | Description |
-|---|---|---|---|
-| [governance.rego](./governance.rego) | [governance.test.rego](./governance.test.rego) | [governance.input.schema.json](./schemas/governance.input.schema.json) | Verifies satellite inheritance boundaries and mandatory decisions. |
-| [mcp.rego](./mcp.rego) | [mcp.test.rego](./mcp.test.rego) | [mcp.input.schema.json](./schemas/mcp.input.schema.json) | Verifies Model Context Protocol (MCP) compliance and smoke testing evidence. |
-| [version-pinning.rego](./version-pinning.rego) | [version-pinning.test.rego](./version-pinning.test.rego) | [version-pinning.input.schema.json](./schemas/version-pinning.input.schema.json) | Enforces strict package dependency pinning rules. |
-| [cli-readiness.rego](./cli-readiness.rego) | [cli-readiness.test.rego](./cli-readiness.test.rego) | [cli-readiness.input.schema.json](./schemas/cli-readiness.input.schema.json) | Validates Smart CLI compilation, documentation, and lock file readiness. |
-| [knowledge-intake.rego](./knowledge-intake.rego) | [knowledge-intake.test.rego](./knowledge-intake.test.rego) | [knowledge-intake.input.schema.json](./schemas/knowledge-intake.input.schema.json) | Governs the intake lifecycle, review status, and topology matching of external knowledge. |
-| [taxonomy.rego](./taxonomy.rego) | [taxonomy.test.rego](./taxonomy.test.rego) | [taxonomy.input.schema.json](./schemas/taxonomy.input.schema.json) | Validates repository directory taxonomy, ADR file names, and bilingual pairs. |
-| [ci-cd.rego](./ci-cd.rego) | [ci-cd.test.rego](./ci-cd.test.rego) | [ci-cd.input.schema.json](./schemas/ci-cd.input.schema.json) | Asserts that dependency scanning, workflow scripts, and dependency updates are present. |
-| [evidence.rego](./evidence.rego) | [evidence.test.rego](./evidence.test.rego) | [evidence.input.schema.json](./schemas/evidence.input.schema.json) | Validates the schema, retention periods, and ownership of gate evidence artifacts. |
-| [abac-mcp-tool-access.rego](./abac-mcp-tool-access.rego) | [abac-mcp-tool-access.test.rego](./abac-mcp-tool-access.test.rego) | [abac-mcp-tool-access.input.schema.json](./schemas/abac-mcp-tool-access.input.schema.json) | Restricts Model Context Protocol (MCP) tool execution by role, action, and environment. |
-
----
-[Back to Rulesets Hub](../README.md)

package/rulesets/opa/abac-mcp-tool-access.rego

@@ -1,122 +0,0 @@
-# ABAC Policy for Agentic MCP Tool Execution
-# Reference implementation for ADR-0087
-# Dual-Engine Parity: This policy mirrors the TypeScript ABAC evaluator
-#
-# Input schema:
-# {
-#   "user": { "id": string, "roles": [string], "tenant": string },
-#   "tool_name": string,
-#   "resource_domain": string,
-#   "environment": string
-# }
-
-package evolith.abac
-
-import rego.v1
-
-# ---------------------------------------------------------------------------
-# Role hierarchy
-# ---------------------------------------------------------------------------
-read_only_roles  := {"viewer", "auditor"}
-developer_roles  := {"developer", "qa"}
-operator_roles   := {"operator", "sre"}
-architect_roles  := {"architect", "admin"}
-
-# ---------------------------------------------------------------------------
-# Tool classification
-# ---------------------------------------------------------------------------
-read_tools := {
-  "evolith-ping",
-  "evolith-echo",
-  "evolith-read-gap-tracking",
-  "evolith-read-file",
-  "evolith-list-dir",
-  "evolith-gate-evaluate",
-  "evolith-gate-status"
-}
-
-write_tools := {
-  "evolith-write-file",
-  "evolith-replace-file",
-  "evolith-run-command"
-}
-
-deploy_tools := {
-  "evolith-deploy",
-  "evolith-merge-branch",
-  "evolith-publish-release"
-}
-
-# ---------------------------------------------------------------------------
-# Helper: check if the user holds at least one of the allowed roles
-# ---------------------------------------------------------------------------
-user_has_role(allowed_roles) if {
-  role := input.user.roles[_]
-  allowed_roles[role]
-}
-
-# ---------------------------------------------------------------------------
-# ABAC decision rules
-# ---------------------------------------------------------------------------
-
-# Allow read tools for ALL authenticated users
-allow if {
-  read_tools[input.tool_name]
-  count(input.user.roles) > 0
-}
-
-# Allow write tools for operator and architect roles
-allow if {
-  write_tools[input.tool_name]
-  user_has_role(operator_roles | architect_roles)
-}
-
-# Allow write tools in non-production environments for developers
-allow if {
-  write_tools[input.tool_name]
-  user_has_role(developer_roles)
-  input.environment != "production"
-}
-
-# Allow deploy tools ONLY for architects and operators
-allow if {
-  deploy_tools[input.tool_name]
-  user_has_role(architect_roles | operator_roles)
-}
-
-# Block ALL deploy tools in production unless user is architect
-deny if {
-  deploy_tools[input.tool_name]
-  input.environment == "production"
-  not user_has_role(architect_roles)
-}
-
-# ---------------------------------------------------------------------------
-# Violations: deny overrides allow
-# ---------------------------------------------------------------------------
-
-violations contains {"id": "ABAC-01", "message": msg} if {
-  deny
-  msg := sprintf(
-    "Tool '%v' explicitly denied for user '%v' with roles %v in environment '%v'",
-    [input.tool_name, input.user.id, input.user.roles, input.environment]
-  )
-}
-
-violations contains {"id": "ABAC-01", "message": msg} if {
-  not allow
-  msg := sprintf(
-    "Tool '%v' not allowed for user '%v' with roles %v in environment '%v'",
-    [input.tool_name, input.user.id, input.user.roles, input.environment]
-  )
-}
-
-violations contains {"id": "ABAC-02", "message": "No roles present on user context; all tool calls denied"} if {
-  count(input.user.roles) == 0
-}
-
-violations contains {"id": "ABAC-03", "message": "Unknown tool requested; not in any known classification"} if {
-  not read_tools[input.tool_name]
-  not write_tools[input.tool_name]
-  not deploy_tools[input.tool_name]
-}

package/rulesets/opa/abac-mcp-tool-access.test.rego

@@ -1,33 +0,0 @@
-package evolith.abac_test
-
-import data.evolith.abac
-
-test_architect_can_deploy_in_production {
-  violations := abac.violations with input as {"user": {"id": "arch-1", "roles": ["architect"], "tenant": "evolith"}, "tool_name": "evolith-deploy", "resource_domain": "core", "environment": "production"}
-  count(violations) == 0
-}
-
-test_viewer_cannot_write {
-  violations := abac.violations with input as {"user": {"id": "viewer-1", "roles": ["viewer"], "tenant": "evolith"}, "tool_name": "evolith-write-file", "resource_domain": "core", "environment": "production"}
-  violations[_].id == "ABAC-01"
-}
-
-test_empty_roles_is_rejected {
-  violations := abac.violations with input as {"user": {"id": "anon", "roles": [], "tenant": "evolith"}, "tool_name": "evolith-ping", "resource_domain": "core", "environment": "production"}
-  violations[_].id == "ABAC-02"
-}
-
-test_unknown_tool_is_rejected {
-  violations := abac.violations with input as {"user": {"id": "arch-1", "roles": ["architect"], "tenant": "evolith"}, "tool_name": "evolith-unknown-tool", "resource_domain": "core", "environment": "production"}
-  violations[_].id == "ABAC-03"
-}
-
-test_developer_can_write_in_non_production {
-  violations := abac.violations with input as {"user": {"id": "dev-1", "roles": ["developer"], "tenant": "evolith"}, "tool_name": "evolith-write-file", "resource_domain": "core", "environment": "staging"}
-  count(violations) == 0
-}
-
-test_operator_cannot_deploy_in_production {
-  violations := abac.violations with input as {"user": {"id": "op-1", "roles": ["operator"], "tenant": "evolith"}, "tool_name": "evolith-deploy", "resource_domain": "core", "environment": "production"}
-  violations[_].id == "ABAC-01"
-}

package/rulesets/opa/anti-corruption-layer.rego

@@ -1,39 +0,0 @@
-package evolith.acl
-
-violations[{"id": "ACL-01", "message": "Adapter must pass schema validation before ingestion"}] {
-    not input.adapter.schemaValidated
-}
-
-violations[{"id": "ACL-02", "message": "Adapter transformations must be traceable to original source"}] {
-    not input.adapter.transformationTraceable
-}
-
-violations[{"id": "ACL-03", "message": "Adapter must not perform silent normalization of external data"}] {
-    input.adapter.silentNormalization
-}
-
-violations[{"id": "ACL-04", "message": "Adapter must declare coreCompatibilityVersion"}] {
-    not input.adapter.coreCompatibilityVersion
-}
-
-violations[{"id": "ACL-04", "message": "Adapter coreCompatibilityVersion must be a non-empty string"}] {
-    val := input.adapter.coreCompatibilityVersion
-    not is_string(val)
-}
-
-violations[{"id": "ACL-04", "message": "Adapter coreCompatibilityVersion must be a non-empty string"}] {
-    val := input.adapter.coreCompatibilityVersion
-    is_string(val)
-    count(val) == 0
-}
-
-violations[{"id": "ACL-05", "message": "Adapter must not expose raw external domain objects to Core — all external types must be mapped to Core domain types before crossing the boundary"}] {
-    input.adapter.exposesRawExternalTypes
-}
-
-violations[{"id": "ACL-06", "message": "ACL adapter must be located in 'adapter' or 'infrastructure' path, not domain"}] {
-    loc := lower(input.adapter.location)
-    not contains(loc, "/adapter")
-    not contains(loc, "/adapters")
-    not contains(loc, "/infrastructure")
-}

package/rulesets/opa/anti-corruption-layer.test.rego

@@ -1,118 +0,0 @@
-package evolith.acl_test
-
-import data.evolith.acl
-
-test_compliant_adapter_has_no_violations {
-    violations := acl.violations with input as {
-        "adapter": {
-            "schemaValidated": true,
-            "transformationTraceable": true,
-            "silentNormalization": false,
-            "coreCompatibilityVersion": "1.0.0",
-            "location": "src/Infrastructure/Adapters/jira-adapter.ts"
-        }
-    }
-    count(violations) == 0
-}
-
-test_schema_not_validated_is_violation {
-    violations := acl.violations with input as {
-        "adapter": {
-            "schemaValidated": false,
-            "transformationTraceable": true,
-            "silentNormalization": false,
-            "coreCompatibilityVersion": "1.0.0",
-            "location": "src/Infrastructure/Adapters/jira-adapter.ts"
-        }
-    }
-    violations[_].id == "ACL-01"
-}
-
-test_transformation_not_traceable_is_violation {
-    violations := acl.violations with input as {
-        "adapter": {
-            "schemaValidated": true,
-            "transformationTraceable": false,
-            "silentNormalization": false,
-            "coreCompatibilityVersion": "1.0.0",
-            "location": "src/Infrastructure/Adapters/jira-adapter.ts"
-        }
-    }
-    violations[_].id == "ACL-02"
-}
-
-test_silent_normalization_is_violation {
-    violations := acl.violations with input as {
-        "adapter": {
-            "schemaValidated": true,
-            "transformationTraceable": true,
-            "silentNormalization": true,
-            "coreCompatibilityVersion": "1.0.0",
-            "location": "src/Infrastructure/Adapters/jira-adapter.ts"
-        }
-    }
-    violations[_].id == "ACL-03"
-}
-
-test_missing_core_compatibility_version_is_violation {
-    violations := acl.violations with input as {
-        "adapter": {
-            "schemaValidated": true,
-            "transformationTraceable": true,
-            "silentNormalization": false,
-            "location": "src/Infrastructure/Adapters/jira-adapter.ts"
-        }
-    }
-    violations[_].id == "ACL-04"
-}
-
-test_empty_core_compatibility_version_is_violation {
-    violations := acl.violations with input as {
-        "adapter": {
-            "schemaValidated": true,
-            "transformationTraceable": true,
-            "silentNormalization": false,
-            "coreCompatibilityVersion": "",
-            "location": "src/Infrastructure/Adapters/jira-adapter.ts"
-        }
-    }
-    violations[_].id == "ACL-04"
-}
-
-test_adapter_in_domain_path_is_violation {
-    violations := acl.violations with input as {
-        "adapter": {
-            "schemaValidated": true,
-            "transformationTraceable": true,
-            "silentNormalization": false,
-            "coreCompatibilityVersion": "1.0.0",
-            "location": "src/Domain/jira-adapter.ts"
-        }
-    }
-    violations[_].id == "ACL-06"
-}
-
-test_adapter_in_infrastructure_path_is_not_violation {
-    violations := acl.violations with input as {
-        "adapter": {
-            "schemaValidated": true,
-            "transformationTraceable": true,
-            "silentNormalization": false,
-            "coreCompatibilityVersion": "1.0.0",
-            "location": "src/Infrastructure/Adapters/jira-adapter.ts"
-        }
-    }
-    count(violations) == 0
-}
-
-test_all_violations_detected {
-    violations := acl.violations with input as {
-        "adapter": {
-            "schemaValidated": false,
-            "transformationTraceable": false,
-            "silentNormalization": true,
-            "location": "src/Domain/jira-adapter.ts"
-        }
-    }
-    count(violations) >= 4
-}

package/rulesets/opa/ci-cd.rego

@@ -1,41 +0,0 @@
-package evolith.ci_cd
-
-violations[{"id": "DEP-04", "message": "package-lock.json not found at project or workspace root"}] {
-    not input.satellite.hasPackageLock
-    not input.core.hasPackageLock
-}
-
-workflows_with_ci := [name | content := input.satellite.workflows[name]; contains(content, "npm ci")]
-violations[{"id": "DEP-05", "message": "No .github/workflows directory found"}] {
-    count(input.satellite.workflows) == 0
-}
-
-violations[{"id": "DEP-05", "message": "CI workflow does not use \"npm ci\""}] {
-    count(input.satellite.workflows) > 0
-    count(workflows_with_ci) == 0
-}
-
-workflows_with_audit := [name | content := input.satellite.workflows[name]; contains(content, "npm audit")]
-violations[{"id": "DEP-06", "message": "No .github/workflows directory found"}] {
-    count(input.satellite.workflows) == 0
-}
-
-violations[{"id": "DEP-06", "message": "CI workflow does not run \"npm audit\""}] {
-    count(input.satellite.workflows) > 0
-    count(workflows_with_audit) == 0
-}
-
-violations[{"id": "DEP-07", "message": "No .github/workflows directory found"}] {
-    count(input.satellite.workflows) == 0
-}
-
-violations[{"id": "DEP-07", "message": "CI workflow does not run \"npm audit\""}] {
-    count(input.satellite.workflows) > 0
-    count(workflows_with_audit) == 0
-}
-
-violations[{"id": "DEP-09", "message": "No .github/dependabot.yml or .renovaterc.json found"}] {
-    not input.satellite.hasDependabot
-    not input.satellite.hasRenovate
-    not input.core.hasDependabot
-}

package/rulesets/opa/ci-cd.test.rego

@@ -1,23 +0,0 @@
-package evolith.ci_cd_test
-
-import data.evolith.ci_cd
-
-test_ci_compliant_project_has_no_violations {
-  violations := ci_cd.violations with input as {"satellite": {"hasPackageLock": true, "workflows": {"ci.yml": "npm ci\ntests", "audit.yml": "npm audit"}, "hasDependabot": true}, "core": {"hasPackageLock": true}}
-  count(violations) == 0
-}
-
-test_missing_package_lock_is_rejected {
-  violations := ci_cd.violations with input as {"satellite": {"hasPackageLock": false, "workflows": {}, "hasDependabot": false}, "core": {"hasPackageLock": false}}
-  violations[_].id == "DEP-04"
-}
-
-test_missing_npm_ci_in_workflow_is_rejected {
-  violations := ci_cd.violations with input as {"satellite": {"hasPackageLock": true, "workflows": {"ci.yml": "npm install"}, "hasDependabot": true}, "core": {"hasPackageLock": true}}
-  violations[_].id == "DEP-05"
-}
-
-test_missing_dependabot_is_rejected {
-  violations := ci_cd.violations with input as {"satellite": {"hasPackageLock": true, "workflows": {"ci.yml": "npm ci"}, "hasDependabot": false, "hasRenovate": false}, "core": {"hasPackageLock": true, "hasDependabot": false}}
-  violations[_].id == "DEP-09"
-}

package/rulesets/opa/cicd-quality-gates.rego

@@ -1,29 +0,0 @@
-package evolith.cicd_quality_gates
-
-violations[{"id": "CICD-01", "message": "CodeQL static analysis not configured in CI pipeline"}] {
-    not input.satellite.ci.hasCodeql
-}
-
-violations[{"id": "CICD-02", "message": "Dependency vulnerability audit not configured in CI pipeline"}] {
-    not input.satellite.ci.hasDependencyAudit
-}
-
-violations[{"id": "CICD-03", "message": "Secret detection not enabled on repository"}] {
-    not input.satellite.ci.hasSecretDetection
-}
-
-violations[{"id": "CICD-04", "message": "Not all quality gates are required before merge"}] {
-    not input.satellite.ci.gatesRequiredBeforeMerge
-}
-
-violations[{"id": "CICD-05", "message": "Security findings without documented justification or accepted risk — all findings must have a linked justification or resolution ticket"}] {
-    input.satellite.findings.hasUnjustifiedSecurityFindings
-}
-
-violations[{"id": "CICD-06", "message": "Critical findings SLA (24h) not tracked in issue tracker"}] {
-    input.satellite.findings.criticalAgeHours > 24
-}
-
-violations[{"id": "CICD-07", "message": "High findings SLA (72h) not tracked in issue tracker"}] {
-    input.satellite.findings.highAgeHours > 72
-}

package/rulesets/opa/cicd-quality-gates.test.rego

@@ -1,54 +0,0 @@
-package evolith.cicd_quality_gates_test
-
-import data.evolith.cicd_quality_gates
-
-compliant_input := {"satellite": {
-  "ci": {
-    "hasCodeql": true,
-    "hasDependencyAudit": true,
-    "hasSecretDetection": true,
-    "gatesRequiredBeforeMerge": true,
-  },
-  "findings": {"criticalAgeHours": 12, "highAgeHours": 48},
-}}
-
-test_compliant_ci_cd_gates_has_no_violations {
-  violations := cicd_quality_gates.violations with input as compliant_input
-  count(violations) == 0
-}
-
-test_missing_codeql_is_rejected {
-  i := json.patch(compliant_input, [{"op": "replace", "path": "/satellite/ci/hasCodeql", "value": false}])
-  violations := cicd_quality_gates.violations with input as i
-  violations[_].id == "CICD-01"
-}
-
-test_missing_dependency_audit_is_rejected {
-  i := json.patch(compliant_input, [{"op": "replace", "path": "/satellite/ci/hasDependencyAudit", "value": false}])
-  violations := cicd_quality_gates.violations with input as i
-  violations[_].id == "CICD-02"
-}
-
-test_missing_secret_detection_is_rejected {
-  i := json.patch(compliant_input, [{"op": "replace", "path": "/satellite/ci/hasSecretDetection", "value": false}])
-  violations := cicd_quality_gates.violations with input as i
-  violations[_].id == "CICD-03"
-}
-
-test_gates_not_required_before_merge_is_rejected {
-  i := json.patch(compliant_input, [{"op": "replace", "path": "/satellite/ci/gatesRequiredBeforeMerge", "value": false}])
-  violations := cicd_quality_gates.violations with input as i
-  violations[_].id == "CICD-04"
-}
-
-test_critical_sla_breach_is_rejected {
-  i := json.patch(compliant_input, [{"op": "replace", "path": "/satellite/findings/criticalAgeHours", "value": 48}])
-  violations := cicd_quality_gates.violations with input as i
-  violations[_].id == "CICD-06"
-}
-
-test_high_sla_breach_is_rejected {
-  i := json.patch(compliant_input, [{"op": "replace", "path": "/satellite/findings/highAgeHours", "value": 100}])
-  violations := cicd_quality_gates.violations with input as i
-  violations[_].id == "CICD-07"
-}

package/rulesets/opa/cli-core-parity.rego

@@ -1,17 +0,0 @@
-package evolith.cli_core_parity
-
-violations[{"id": "CLI-PAR-01", "message": "Executable Core rule missing parity record (CLI status, MCP status, test status, evidence status)"}] {
-    input.satellite.coreParity.ruleWithoutParityRecord
-}
-
-violations[{"id": "CLI-PAR-02", "message": "CLI and MCP implement divergent business logic for same capability"}] {
-    input.satellite.coreParity.divergentValidationLogic
-}
-
-violations[{"id": "CLI-PAR-03", "message": "CLI and MCP return inconsistent results for same validation request"}] {
-    input.satellite.coreParity.inconsistentResults
-}
-
-violations[{"id": "CLI-PAR-04", "message": "Parity gap not documented with owner, priority, and planned closure date"}] {
-    input.satellite.coreParity.undocumentedParityGap
-}

package/rulesets/opa/cli-core-parity.test.rego

@@ -1,39 +0,0 @@
-package evolith.cli_core_parity_test
-
-import data.evolith.cli_core_parity
-
-compliant_input := {"satellite": {"coreParity": {
-  "ruleWithoutParityRecord": false,
-  "divergentValidationLogic": false,
-  "inconsistentResults": false,
-  "undocumentedParityGap": false,
-}}}
-
-test_compliant_core_parity_has_no_violations {
-  violations := cli_core_parity.violations with input as compliant_input
-  count(violations) == 0
-}
-
-test_rule_without_parity_record_is_rejected {
-  i := json.patch(compliant_input, [{"op": "replace", "path": "/satellite/coreParity/ruleWithoutParityRecord", "value": true}])
-  violations := cli_core_parity.violations with input as i
-  violations[_].id == "CLI-PAR-01"
-}
-
-test_divergent_logic_is_rejected {
-  i := json.patch(compliant_input, [{"op": "replace", "path": "/satellite/coreParity/divergentValidationLogic", "value": true}])
-  violations := cli_core_parity.violations with input as i
-  violations[_].id == "CLI-PAR-02"
-}
-
-test_inconsistent_results_is_rejected {
-  i := json.patch(compliant_input, [{"op": "replace", "path": "/satellite/coreParity/inconsistentResults", "value": true}])
-  violations := cli_core_parity.violations with input as i
-  violations[_].id == "CLI-PAR-03"
-}
-
-test_undocumented_parity_gap_is_rejected {
-  i := json.patch(compliant_input, [{"op": "replace", "path": "/satellite/coreParity/undocumentedParityGap", "value": true}])
-  violations := cli_core_parity.violations with input as i
-  violations[_].id == "CLI-PAR-04"
-}

package/rulesets/opa/cli-readiness.rego

@@ -1,32 +0,0 @@
-package evolith.cli_readiness
-
-violations[{"id": "CLI-RR-01", "message": "dist/main.js not found — run npm run build in sdk/cli"}] {
-    not input.core.cli.hasMainJs
-}
-
-violations[{"id": "CLI-RR-02", "message": "No compiled spec files in dist/ — run npm test to confirm"}] {
-    not input.core.cli.hasTests
-}
-
-violations[{"id": "CLI-RR-03", "message": "package-lock.json not found"}] {
-    not input.core.hasPackageLock
-    not input.core.cli.hasPackageLock
-}
-
-violations[{"id": "CLI-RR-04", "message": "No MCP smoke evidence found in .harness/evidence/"}] {
-    smoke_keys := [k | input.core.evidence[k]; contains(k, "mcp")]
-    count(smoke_keys) == 0
-}
-
-violations[{"id": "CLI-RR-04", "message": sprintf("MCP smoke evidence status: %v", [status])}] {
-    smoke_keys := [k | input.core.evidence[k]; contains(k, "mcp")]
-    count(smoke_keys) > 0
-    smoke := input.core.evidence[smoke_keys[0]]
-    status := smoke.status
-    status != "passed"
-}
-
-violations[{"id": "CLI-RR-05", "message": "CLI missing README.md or ARCHITECTURE.md"}] {
-    not input.core.cli.hasReadme
-    not input.core.cli.hasArchitectureMd
-}

package/rulesets/opa/cli-readiness.test.rego

@@ -1,23 +0,0 @@
-package evolith.cli_readiness_test
-
-import data.evolith.cli_readiness
-
-test_cli_ready_has_no_violations {
-  violations := cli_readiness.violations with input as {"core": {"cli": {"hasMainJs": true, "hasTests": true, "hasPackageLock": true, "hasReadme": true, "hasArchitectureMd": true}, "hasPackageLock": true, "evidence": {"mcp-smoke.json": {"status": "passed"}}}}
-  count(violations) == 0
-}
-
-test_missing_main_js_is_rejected {
-  violations := cli_readiness.violations with input as {"core": {"cli": {"hasMainJs": false, "hasTests": false, "hasPackageLock": false, "hasReadme": false, "hasArchitectureMd": false}, "hasPackageLock": false, "evidence": {}}}
-  violations[_].id == "CLI-RR-01"
-}
-
-test_missing_mcp_evidence_is_rejected {
-  violations := cli_readiness.violations with input as {"core": {"cli": {"hasMainJs": true, "hasTests": true, "hasPackageLock": true, "hasReadme": true, "hasArchitectureMd": true}, "hasPackageLock": true, "evidence": {}}}
-  violations[_].id == "CLI-RR-04"
-}
-
-test_missing_readme_is_rejected {
-  violations := cli_readiness.violations with input as {"core": {"cli": {"hasMainJs": true, "hasTests": true, "hasPackageLock": true, "hasReadme": false, "hasArchitectureMd": false}, "hasPackageLock": true, "evidence": {"mcp-smoke.json": {"status": "passed"}}}}
-  violations[_].id == "CLI-RR-05"
-}

package/rulesets/opa/cli-release-readiness.rego

@@ -1,21 +0,0 @@
-package evolith.cli_release_readiness
-
-violations[{"id": "CLI-RR-01", "message": "TypeScript build does not pass — npm run build must exit 0 before release"}] {
-    not input.satellite.releaseReadiness.buildPasses
-}
-
-violations[{"id": "CLI-RR-02", "message": "Unit and integration tests do not pass — npm test must exit 0 before release"}] {
-    not input.satellite.releaseReadiness.testsPass
-}
-
-violations[{"id": "CLI-RR-03", "message": "Dependency graph not reproducible — package-lock.json missing or transitive dependencies broken"}] {
-    not input.satellite.releaseReadiness.lockFilePresent
-}
-
-violations[{"id": "CLI-RR-04", "message": "MCP smoke test does not pass — initialize and tools/list must respond over release transport"}] {
-    not input.satellite.releaseReadiness.mcpSmokePasses
-}
-
-violations[{"id": "CLI-RR-05", "message": "Release documentation does not match implementation — README exists but describes outdated state"}] {
-    not input.satellite.releaseReadiness.readmeExists
-}