@evolith/core-domain 1.0.1 → 1.0.2

package/rulesets/sdlc/dependency-pinning.rules.json

@@ -1,183 +0,0 @@
-{
-  "$schema": "../schema/ruleset-standard.schema.json",
-  "$id": "https://evolith.dev/rulesets/sdlc/dependency-pinning.rules.json",
-  "title": "Dependency Pinning and Vulnerability Management Rules",
-  "description": "Machine-readable enforcement of ADR-0009 (Strict Dependency Pinning and Automated Vulnerability Management). Applies to all Evolith satellite repositories containing package.json files.",
-  "version": "1.0.0",
-  "adrId": "ADR-0009",
-  "adrTitle": "Strict Dependency Pinning and Automated Vulnerability Management",
-  "status": "Approved",
-  "effectiveDate": "2026-06-07",
-  "rules": [
-    {
-      "id": "DEP-01",
-      "severity": "MUST NOT",
-      "category": "version-pinning",
-      "title": "No caret (^) range specifiers in package.json",
-      "description": "Every dependency in package.json (dependencies, devDependencies, peerDependencies, optionalDependencies) MUST use an exact version string. The caret prefix (^) is prohibited. Example: use '18.3.1', not '^18.3.1'.",
-      "rationale": "ADR-0009 §1: Caret ranges allow automatic minor/patch upgrades during npm install, breaking reproducibility and making CVE introduction unpredictable.",
-      "validationQuery": "grep -r '\"\\^' package.json — zero matches expected in any package.json file.",
-      "blocking": true,
-      "checklistItem": "no-caret-ranges",
-      "autoFixStrategy": "Remove ^ prefix from all dependency versions. Run 'npm install --save-exact' or 'npm pkg set dependencies.<pkg>=<version>' with exact version.",
-      "appliesTo": [
-        "dependencies",
-        "devDependencies",
-        "peerDependencies",
-        "optionalDependencies"
-      ]
-    },
-    {
-      "id": "DEP-02",
-      "severity": "MUST NOT",
-      "category": "version-pinning",
-      "title": "No tilde (~) range specifiers in package.json",
-      "description": "Every dependency in package.json MUST use an exact version string. The tilde prefix (~) is prohibited. Example: use '18.3.1', not '~18.3.1'.",
-      "rationale": "ADR-0009 §1: Tilde ranges allow automatic patch upgrades, breaking reproducibility in the same way as caret ranges.",
-      "validationQuery": "grep -r '\"~' package.json — zero matches expected in any package.json file.",
-      "blocking": true,
-      "checklistItem": "no-tilde-ranges",
-      "autoFixStrategy": "Remove ~ prefix from all dependency versions. Pin to exact current resolved version from package-lock.json.",
-      "appliesTo": [
-        "dependencies",
-        "devDependencies",
-        "peerDependencies",
-        "optionalDependencies"
-      ]
-    },
-    {
-      "id": "DEP-03",
-      "severity": "MUST NOT",
-      "category": "version-pinning",
-      "title": "No wildcard (*) or latest-tag version specifiers",
-      "description": "Version specifiers using '*', 'latest', 'x', or 'X' wildcards are prohibited. Every package must reference a specific semver string.",
-      "rationale": "ADR-0009 §1: Wildcard versions resolve to arbitrary latest at install time, making the dependency tree completely non-deterministic.",
-      "validationQuery": "Verify no dependency value matches: *, latest, x, X, or empty string.",
-      "blocking": true,
-      "checklistItem": "no-wildcard-versions"
-    },
-    {
-      "id": "DEP-04",
-      "severity": "MUST",
-      "category": "lock-file",
-      "title": "package-lock.json (or equivalent) must be committed",
-      "description": "A lock file (package-lock.json for npm, yarn.lock for Yarn, pnpm-lock.yaml for pnpm) MUST be committed to version control and kept current. The lock file is the source of truth for reproducible builds.",
-      "rationale": "ADR-0009 §4: CI pipelines must execute 'npm ci' which requires a committed lock file. Without it, npm install resolves fresh versions on every run.",
-      "validationQuery": "Lock file exists in repository root (or workspace root) and is not in .gitignore.",
-      "blocking": true,
-      "checklistItem": "lock-file-committed"
-    },
-    {
-      "id": "DEP-05",
-      "severity": "MUST",
-      "category": "ci-installation",
-      "title": "CI pipelines use 'npm ci' not 'npm install'",
-      "description": "Continuous Integration pipelines MUST use 'npm ci' (clean install) to install dependencies. 'npm install' is prohibited in CI because it may update the lock file and resolve different versions.",
-      "rationale": "ADR-0009 §4: 'npm ci' installs exactly what the lock file specifies. 'npm install' may silently update packages, defeating the purpose of pinning.",
-      "validationQuery": "CI workflow files (.github/workflows/*.yml) contain 'npm ci' for dependency installation. No 'npm install' step present in CI dependency installation steps.",
-      "blocking": true,
-      "checklistItem": "ci-uses-npm-ci"
-    },
-    {
-      "id": "DEP-06",
-      "severity": "MUST",
-      "category": "security-audit",
-      "title": "CI pipeline runs npm audit at high severity level",
-      "description": "Every PR and main branch CI run MUST execute 'npm audit --audit-level=high'. Any High or Critical CVE causes an immediate build failure and blocks merge.",
-      "rationale": "ADR-0009 §3: Zero-Tolerance CI check for High/Critical vulnerabilities is the primary automated security gate.",
-      "validationQuery": "CI workflow includes 'npm audit --audit-level=high' or equivalent. Build fails when exit code is non-zero.",
-      "blocking": true,
-      "checklistItem": "ci-npm-audit-high"
-    },
-    {
-      "id": "DEP-07",
-      "severity": "MUST",
-      "category": "security-audit",
-      "title": "Zero High or Critical CVEs in production dependencies",
-      "description": "No High or Critical CVEs may be present in the production dependency tree at time of merge to main or at release. Medium CVEs require documented justification.",
-      "rationale": "ADR-0009 §3 and quality-thresholds QT-03: Zero High/Critical CVE tolerance in production releases. This rule is consistent with the cross-cutting security threshold.",
-      "baseline": {
-        "critical": 0,
-        "high": 0,
-        "medium": "documented-justification-required"
-      },
-      "blocking": true,
-      "checklistItem": "zero-high-critical-cves"
-    },
-    {
-      "id": "DEP-08",
-      "severity": "SHOULD",
-      "category": "overrides",
-      "title": "npm overrides entries must be documented with CVE reference",
-      "description": "When the 'overrides' field in package.json is used to force a transitive dependency to a safe version, each override entry MUST include a comment or corresponding entry in a companion overrides-rationale.json documenting the CVE or reason for the override.",
-      "rationale": "Overrides are a powerful escape hatch that can mask dependency resolution issues if undocumented. Each override should be traceable to a specific security finding or compatibility requirement.",
-      "validationQuery": "If package.json contains an 'overrides' section, each override key corresponds to a documented rationale. Check CHANGELOG.md, PR description, or companion overrides-rationale.json.",
-      "blocking": false,
-      "checklistItem": "overrides-documented"
-    },
-    {
-      "id": "DEP-09",
-      "severity": "SHOULD",
-      "category": "bot-policy",
-      "title": "Automated dependency update bot configured",
-      "description": "Repositories SHOULD have Dependabot or Renovate configured to propose dependency bump PRs automatically. This ensures managed incremental upgrades rather than accumulated drift.",
-      "rationale": "ADR-0009 §2: Automated bot policy is required for sustainable maintenance of exact-pinned dependencies. Without it, pins become stale security liabilities.",
-      "validationQuery": "File .github/dependabot.yml or .renovaterc.json (or equivalent) exists and is configured for the npm ecosystem.",
-      "blocking": false,
-      "checklistItem": "dependency-bot-configured"
-    },
-    {
-      "id": "DEP-10",
-      "severity": "MUST",
-      "category": "version-pinning",
-      "title": "Workspaces inherit the exact-version policy",
-      "description": "In monorepos using npm workspaces, Yarn workspaces, or pnpm workspaces, the exact-version policy (no ^ or ~) applies to ALL workspace package.json files, not just the root package.json.",
-      "rationale": "ADR-0009 §1 applies universally. Workspace packages that use ranges introduce non-determinism even when the root is pinned.",
-      "validationQuery": "All package.json files in workspace packages (not just root) are free of ^ and ~ prefixes.",
-      "blocking": true,
-      "checklistItem": "workspaces-pinned"
-    }
-  ],
-  "waiverPolicy": {
-    "description": "A waiver may be used only when the organization deliberately accepts a temporary deviation from the pinning or audit policy.",
-    "requiredFields": [
-      "rule",
-      "justification",
-      "affectedPackages",
-      "owner",
-      "expirationDate",
-      "mitigationPlan"
-    ],
-    "exceptions": {
-      "cves": "High/Critical CVEs cannot be waived in production releases without explicit Executive Risk Acceptance. Medium CVEs require documented justification with remediation timeline.",
-      "ranges": "Range specifiers (^ or ~) cannot be used in production package.json files. peerDependencies in published libraries may use ranges by exception with Architecture Board approval."
-    }
-  },
-  "summaryChecklist": [
-    "no-caret-ranges",
-    "no-tilde-ranges",
-    "no-wildcard-versions",
-    "lock-file-committed",
-    "ci-uses-npm-ci",
-    "ci-npm-audit-high",
-    "zero-high-critical-cves",
-    "overrides-documented",
-    "dependency-bot-configured",
-    "workspaces-pinned"
-  ],
-  "references": [
-    "reference/architecture/adrs/core/0009-strict-dependency-pinning-vulnerability-management.md",
-    "rulesets/sdlc/quality-thresholds.rules.json",
-    "rulesets/definition-of-done/definition-of-done.rules.json",
-    "reference/architecture/adrs/core/0005-ci-cd-quality-codeql.md"
-  ],
-  "exitCriteria": {
-    "description": "All MUST rules must pass. SHOULD rules are strongly recommended but advisory. A dependency-pinning violation BLOCKS merge to main.",
-    "validationTools": [
-      "npm audit",
-      "grep for ^ and ~ in package.json files",
-      "lock file presence check",
-      "CI workflow analysis"
-    ]
-  }
-}

package/rulesets/sdlc/phase-gates.rules.json

@@ -1,297 +0,0 @@
-{
-  "$schema": "../schema/ruleset-sdlc.schema.json",
-  "$id": "https://evolith.dev/rulesets/sdlc/phase-gates.rules.json",
-  "title": "SDLC Phase Gate Rules",
-  "description": "Canonical phase exit gate criteria for the Evolith 5-phase SDLC. Each gate requires objective evidence; manual confidence cannot override a failed gate.",
-  "version": "1.0.0",
-  "effectiveDate": "2026-01-01",
-  "gates": [
-    {
-      "phase": 1,
-      "name": "Business Sign-Off",
-      "description": "Scope frozen; funding authorized; architectural constraints aligned.",
-      "playbookRef": "../../reference/governance/sdlc/01-playbooks/phase-1-business-signoff.md",
-      "mandatoryEvidence": [
-        {
-          "artifact": "PRD",
-          "schemaRef": "../schema/prd.schema.json",
-          "status": "Approved",
-          "validation": "PRD status = Approved AND approvalEvidence present AND date filled"
-        },
-        {
-          "artifact": "Discovery Canvas",
-          "validation": "Initiative registered with customer pain points and expected value"
-        },
-        {
-          "artifact": "Technical Feasibility Canvas",
-          "schemaRef": "../schema/technical-feasibility.schema.json",
-          "validation": "Technical feasibility and quality attributes documented with NFRs"
-        },
-        {
-          "artifact": "Ballpark Estimation",
-          "validation": "T-Shirt sizing completed with team composition"
-        },
-        {
-          "artifact": "MoSCoW Prioritization Matrix",
-          "validation": "MoSCoW analysis completed for Phase 0 with at least one MUST item and valid priority distribution"
-        },
-        {
-          "artifact": "Build-versus-Compose Analysis",
-          "schemaRef": "../schema/build-vs-compose.schema.json",
-          "validation": "Discovery evaluated open-source/free-tier/commercial alternatives with a governed Adopt/Embed/Integrate/Extend/Build/Reject disposition, three-year cost, licensing, tenant isolation, provider replaceability, and PoC requirements; native development requires explicit justification (Product Vision §5.3)"
-        }
-      ],
-      "blockingCriteria": [
-        {
-          "criterion": "Scope is ambiguous",
-          "action": "BLOCK — return to Phase 1"
-        },
-        {
-          "criterion": "Technical constraints or cloud quotas are unaligned",
-          "action": "BLOCK — return to Phase 1"
-        },
-        {
-          "criterion": "Architecture constraints are ignored",
-          "action": "BLOCK — return to Phase 1"
-        }
-      ],
-      "accountableRole": "Product Owner",
-      "waiverAuthority": "Executive Sponsor",
-      "waiverRequiredFields": [
-        "criterion",
-        "justification",
-        "risk",
-        "owner",
-        "expirationDate",
-        "mitigationPlan"
-      ]
-    },
-    {
-      "phase": 2,
-      "name": "Design Baseline Approved",
-      "description": "Architecture decisions are documented; bounded contexts defined; functional stories written.",
-      "playbookRef": "../../reference/governance/sdlc/01-playbooks/phase-2-design-baseline.md",
-      "mandatoryEvidence": [
-        {
-          "artifact": "ADR Registry",
-          "validation": "All architecture decisions have corresponding ADR. No undocumented decisions."
-        },
-        {
-          "artifact": "Functional Stories",
-          "schemaRef": "../schema/functional-story.schema.json",
-          "validation": "All Functional Stories in Ready state with BDD acceptance criteria"
-        },
-        {
-          "artifact": "Reference Blueprint Alignment",
-          "validation": "Product architecture diagrams traceable to Evolith Reference Blueprint"
-        },
-        {
-          "artifact": "Simplicity Checklist Phase 1",
-          "validation": "Passed — no over-engineering detected"
-        },
-        {
-          "artifact": "Bounded Context Map",
-          "validation": "All contexts identified with ownership and persistence strategy"
-        }
-      ],
-      "blockingCriteria": [
-        {
-          "criterion": "Significant architecture decisions are undocumented",
-          "action": "BLOCK — require ADR before design baseline"
-        },
-        {
-          "criterion": "Bounded context boundaries are contradictory",
-          "action": "BLOCK — require context map resolution"
-        },
-        {
-          "criterion": "Functional stories lack acceptance criteria",
-          "action": "BLOCK — return to story writing"
-        }
-      ],
-      "accountableRole": "Software Architect",
-      "waiverAuthority": "Architecture Board",
-      "waiverRequiredFields": [
-        "criterion",
-        "justification",
-        "risk",
-        "owner",
-        "expirationDate",
-        "mitigationPlan"
-      ]
-    },
-    {
-      "phase": 3,
-      "name": "Successful Build",
-      "description": "All code merged to main; CI passes; quality gates green; definition of done satisfied.",
-      "mandatoryEvidence": [
-        {
-          "artifact": "Technical Stories",
-          "schemaRef": "../schema/technical-story.schema.json",
-          "validation": "All technical stories Done; traceable to Functional Stories"
-        },
-        {
-          "artifact": "CI Pipeline",
-          "validation": "CI run green on main branch. No failing tests, no lint errors, no security scan failures"
-        },
-        {
-          "artifact": "Definition of Done Checklist",
-          "validation": "All DoD items checked per Technical Story"
-        },
-        {
-          "artifact": "Documentation Delta",
-          "validation": "Updated ADRs, inline documentation, README changes included in merge"
-        },
-        {
-          "artifact": "Coverage Report",
-          "validation": "Business logic coverage >= 80% per Quality Thresholds rules"
-        }
-      ],
-      "blockingCriteria": [
-        {
-          "criterion": "CI fails on main branch",
-          "action": "BLOCK merge — fix CI before merge"
-        },
-        {
-          "criterion": "Coverage below threshold (< 80%)",
-          "action": "BLOCK merge — add tests or request waiver"
-        },
-        {
-          "criterion": "High or Critical CVEs detected",
-          "action": "BLOCK merge — remediate CVEs or request security waiver"
-        },
-        {
-          "criterion": "Missing code review approval",
-          "action": "BLOCK merge — require review"
-        }
-      ],
-      "accountableRole": "Tech Lead",
-      "waiverAuthority": "Architecture Board (with exception for CVEs requires Executive Risk Acceptance)",
-      "waiverRequiredFields": [
-        "criterion",
-        "justification",
-        "risk",
-        "owner",
-        "expirationDate",
-        "mitigationPlan",
-        "approvalAuthority"
-      ]
-    },
-    {
-      "phase": 4,
-      "name": "RC Stamped",
-      "description": "All quality thresholds verified; security scans clean; UAT passed; release candidate formally approved.",
-      "playbookRef": "../../reference/governance/sdlc/01-playbooks/phase-4-rc-stamp.md",
-      "mandatoryEvidence": [
-        {
-          "artifact": "Test Summary Report",
-          "schemaRef": "../schema/test-summary-report.schema.json",
-          "templateRef": "../../reference/governance/sdlc/04-artifact-templates/test-summary-report-template.md",
-          "validation": "All quality gates green or explicitly waived. RC stamped by QA Lead and Tech Lead."
-        },
-        {
-          "artifact": "Acceptance Validation",
-          "validation": "Product Owner signs off on acceptance criteria verification"
-        },
-        {
-          "artifact": "Security Scan Report",
-          "schemaRef": "../schema/security-scan-report.schema.json",
-          "templateRef": "../../reference/governance/sdlc/04-artifact-templates/security-scan-report-template.md",
-          "validation": "Zero High/Critical CVEs in production-bound artifacts; structure conforms to security-scan-report.schema.json"
-        },
-        {
-          "artifact": "Integration Evidence",
-          "schemaRef": "../schema/integration-evidence.schema.json",
-          "templateRef": "../../reference/governance/sdlc/04-artifact-templates/integration-evidence-template.md",
-          "validation": "Every declared inter-component contract exercised; no FAIL entries without waiver; structure conforms to integration-evidence.schema.json"
-        },
-        {
-          "artifact": "Pyramid Distribution",
-          "validation": "70% unit / 20% integration / 10% E2E target met or deviation explained"
-        }
-      ],
-      "blockingCriteria": [
-        {
-          "criterion": "Any mandatory quality metric fails",
-          "action": "BLOCK RC stamp — remediate or waiver"
-        },
-        {
-          "criterion": "Acceptance criteria remain unverified",
-          "action": "BLOCK RC stamp — return to validation"
-        },
-        {
-          "criterion": "Technical debt ratio exceeds 5%",
-          "action": "BLOCK RC stamp — remediation plan required"
-        }
-      ],
-      "accountableRole": "QA Lead",
-      "waiverAuthority": "Architecture Board",
-      "waiverRequiredFields": [
-        "criterion",
-        "justification",
-        "risk",
-        "owner",
-        "expirationDate",
-        "mitigationPlan"
-      ]
-    },
-    {
-      "phase": 5,
-      "name": "Production Live",
-      "description": "Deployment executed; observability verified nominal; monitoring active; rollback procedure confirmed.",
-      "playbookRef": "../../reference/governance/sdlc/01-playbooks/zero-downtime-release.md",
-      "mandatoryEvidence": [
-        {
-          "artifact": "Release Notes",
-          "schemaRef": "../schema/release-notes.schema.json",
-          "validation": "Release scope, deployment steps, rollback procedure, observability checklist all present and complete"
-        },
-        {
-          "artifact": "Observability Validation",
-          "schemaRef": "../schema/observability-validation.schema.json",
-          "templateRef": "../../reference/governance/sdlc/04-artifact-templates/observability-validation-template.md",
-          "validation": "Metrics nominal, logs flowing, traces complete for all production paths; structure conforms to observability-validation.schema.json"
-        },
-        {
-          "artifact": "Rollback Procedure",
-          "schemaRef": "../schema/rollback-rehearsal.schema.json",
-          "templateRef": "../../reference/governance/sdlc/04-artifact-templates/rollback-rehearsal-template.md",
-          "validation": "Rollback steps documented and tested. Last good version identified. Rehearsal evidence confirms rollback within budget."
-        },
-        {
-          "artifact": "On-Call Handoff",
-          "schemaRef": "../schema/on-call-handoff.schema.json",
-          "templateRef": "../../reference/governance/sdlc/04-artifact-templates/on-call-handoff-template.md",
-          "validation": "On-call team briefed with runbook references, escalation paths, alert ownership, and SLA acknowledgement confirmed."
-        },
-        {
-          "artifact": "Deployment Evidence",
-          "validation": "Deployment artifacts (images, configs) traceable to RC"
-        }
-      ],
-      "blockingCriteria": [
-        {
-          "criterion": "Monitoring is not nominal",
-          "action": "BLOCK Production Live — investigate before deploy"
-        },
-        {
-          "criterion": "Rollback procedure is undefined",
-          "action": "BLOCK Production Live — document rollback first"
-        },
-        {
-          "criterion": "Release is not traceable to RC",
-          "action": "BLOCK Production Live — ensure RC → Release chain"
-        }
-      ],
-      "accountableRole": "DevOps Lead",
-      "waiverAuthority": "Technology Director",
-      "waiverRequiredFields": [
-        "criterion",
-        "justification",
-        "risk",
-        "owner",
-        "expirationDate",
-        "mitigationPlan"
-      ]
-    }
-  ]
-}

package/rulesets/sdlc/quality-thresholds.rules.json

@@ -1,96 +0,0 @@
-{
-  "$schema": "../schema/ruleset-standard.schema.json",
-  "$id": "https://evolith.dev/rulesets/sdlc/quality-thresholds.rules.json",
-  "title": "SDLC Quality Threshold Rules",
-  "description": "Canonical release-blocking quality thresholds for Evolith satellites. These thresholds apply to all SDLC phases where construction or validation occurs.",
-  "version": "1.0.0",
-  "effectiveDate": "2026-01-01",
-  "waiverPolicy": {
-    "description": "A waiver may be used only when the organization deliberately accepts a temporary deviation.",
-    "requiredFields": [
-      "criterion",
-      "justification",
-      "risk",
-      "owner",
-      "expirationDate",
-      "mitigationPlan",
-      "approvalAuthority"
-    ],
-    "exceptions": {
-      "cves": "High/Critical security vulnerabilities cannot be waived in production releases without explicit Executive Risk Acceptance",
-      "coverage": "Business logic coverage below 80% cannot be waived without Architecture Board approval and remediation plan"
-    }
-  },
-  "rules": [
-    {
-      "id": "QT-01",
-      "severity": "MUST",
-      "category": "testing",
-      "title": "Code Coverage",
-      "description": "Coverage below 80% on business logic BLOCKS merge (Phase 3) and RC stamp (Phase 4).",
-      "blocking": true
-    },
-    {
-      "id": "QT-02",
-      "severity": "MUST",
-      "category": "code-quality",
-      "title": "Cyclomatic Complexity",
-      "description": "Methods or functions exceeding cyclomatic complexity of 15 BLOCK merge or RC stamp without refactoring plan or explicit waiver.",
-      "blocking": true
-    },
-    {
-      "id": "QT-03",
-      "severity": "MUST",
-      "category": "security",
-      "title": "Security Vulnerabilities",
-      "description": "Any High or Critical CVE BLOCKS merge, RC stamp, and production release. Medium CVEs require justification.",
-      "blocking": true
-    },
-    {
-      "id": "QT-04",
-      "severity": "MUST",
-      "category": "code-quality",
-      "title": "Technical Debt Ratio",
-      "description": "Technical debt ratio > 5% BLOCKS RC stamp unless a remediation plan with explicit timeline and owner is approved.",
-      "blocking": true
-    },
-    {
-      "id": "QT-05",
-      "severity": "MUST",
-      "category": "testing",
-      "title": "Testing Pyramid Distribution",
-      "description": "Release with materially skewed distribution (e.g., 40% unit / 50% integration) requires written explanation. Not a hard block but must be reviewed.",
-      "blocking": true
-    },
-    {
-      "id": "QT-06",
-      "severity": "MUST",
-      "category": "documentation",
-      "title": "Documentation Delta",
-      "description": "Code changes that alter behavior, introduce new API endpoints, change architecture, or modify operations without corresponding documentation BLOCK merge and Production Live.",
-      "blocking": true
-    },
-    {
-      "id": "QT-07",
-      "severity": "MUST",
-      "category": "operations",
-      "title": "Observability Evidence",
-      "description": "Any production API path without traces, structured logs, or metrics BLOCKS Production Live declaration.",
-      "blocking": true
-    },
-    {
-      "id": "QT-08",
-      "severity": "MUST",
-      "category": "contract",
-      "title": "API Contract Compatibility",
-      "description": "Breaking changes to inter-module (gRPC/REST) contracts BLOCK merge. Consumer-driven contract tests must pass.",
-      "blocking": true
-    }
-  ],
-  "references": [
-    "../sdlc/phase-gates.rules.json",
-    "adr/0018-testing-pyramid-quality-gates.md",
-    "adr/0049-naming-semantics-clean-code-policy.md",
-    "adr/0005-ci-cd-quality-codeql.md"
-  ]
-}

package/rulesets/topologies/README.es.md

@@ -1,42 +0,0 @@
-# Hub de Rulesets Topologicos
-
-> **Navegacion Bilingue:** [English Version](./README.md)
-
-Esta area define el modelo canonico de resolucion de rulesets topologicos para la gobernanza de Evolith Core.
-
-**GT-329:** Las 5 topologias avanzadas (`serverless`, `edge-computing`, `event-driven`, `data-mesh`, `agentic-ai`) han sido reubicadas aqui desde `reference/architecture/topologies/` como su **ubicacion ejecutable canonica**. Las topologias de `progressive-axis` permanecen en `reference/architecture/topologies/progressive-axis/` por razones historicas. La guia topologica legible por humanos vive en `reference/architecture/topologies/`. Esta carpeta contiene las reglas legibles por maquina que consumen CLI, MCP, Service CORE API, CI y futuros resolvers topologicos.
-
-## Modelo de Ejecucion
-
-| Preocupacion | Ubicacion Canonica | Proposito |
-|---|---|---|
-| Schema de manifiesto | `rulesets/schema/topology-manifest.schema.json` | Validar cada `topology.manifest.json`. |
-| Reglas topologicas Native | `spec.artifacts.rulesets[]` declarado por el manifiesto | Ejecutar checks especificos de topologia en el evaluador Native. |
-| Politicas topologicas OPA | `spec.artifacts.opaPolicies[]` declarado por el manifiesto | Ejecutar politicas Rego equivalentes para paridad OPA. |
-| Corpus humano | `reference/architecture/topologies/` | Explicar intencion, restricciones, ADRs y reglas de composicion topologica. |
-
-## Dimensiones Gobernadas
-
-| Dimension | Topologias | Patron de Ruta de Reglas |
-|---|---|---|
-| `progressive-axis` | `modular-monolith`, `distributed-modules`, `microservices` | `rulesets/topologies/progressive-axis/<topology>/` |
-| `execution` | `serverless`, `edge-computing` | `rulesets/topologies/serverless/`, `rulesets/topologies/edge-computing/` |
-| `integration` | `event-driven` | `rulesets/topologies/event-driven/` |
-| `data` | `data-mesh` | `rulesets/topologies/data-mesh/` |
-| `ai` | `agentic-ai` | `rulesets/topologies/agentic-ai/` |
-
-## Reglas de Enforcement
-
-- No crear un CLI, servidor MCP o Core API separado por topologia.
-- No colocar diseno topologico legible por humanos como fuente ejecutable de verdad; manifiestos y sus rulesets declarados son el contrato ejecutable.
-- No construyas rutas legacy de archivos F1/F2/F3. Resuelve el alias de compatibilidad mediante el manifiesto topologico del eje progresivo.
-- Cada nueva regla topologica ejecutable debe preservar Dual-Engine Parity cuando ambos motores apliquen.
-- Las politicas OPA no deben desviarse de la semantica de reglas Native.
-- Las reglas topologicas no deben codificar presupuesto, ROI, costo, staffing, priorizacion, timing ni ownership de negocio.
-
-## Estado Actual
-
-La ubicacion de rulesets topologicos esta autorizada. Los perfiles topologicos concretos y sus reglas Native mas OPA se rastrean en el [Tablero de Seguimiento de Gaps](../../reference/governance/standards/vision/gap-tracking.es.md).
-
----
-[Volver al Hub de Rulesets](../README.es.md)

package/rulesets/topologies/README.md

@@ -1,42 +0,0 @@
-# Topology Rulesets Hub
-
-> **Bilingual Navigation:** [Version en Espanol](./README.es.md)
-
-This area defines the canonical topology-ruleset resolution model for Evolith Core governance.
-
-**GT-329:** The 5 advanced topologies (`serverless`, `edge-computing`, `event-driven`, `data-mesh`, `agentic-ai`) have been relocated here from `reference/architecture/topologies/` as their **canonical executable location**. The `progressive-axis` topologies remain in `reference/architecture/topologies/progressive-axis/` for historical reasons. Human-readable topology guidance lives in `reference/architecture/topologies/`. This folder contains the machine-readable rules that CLI, MCP, Service CORE API, CI, and future topology resolvers consume.
-
-## Execution Model
-
-| Concern | Canonical Location | Purpose |
-|---|---|---|
-| Manifest schema | `rulesets/schema/topology-manifest.schema.json` | Validate every `topology.manifest.json`. |
-| Native topology rules | Manifest-declared `spec.artifacts.rulesets[]` | Execute topology-specific checks in the Native evaluator. |
-| OPA topology policies | Manifest-declared `spec.artifacts.opaPolicies[]` | Execute equivalent Rego policies for OPA parity. |
-| Human corpus | `reference/architecture/topologies/` | Explain topology intent, constraints, ADRs, and composition rules. |
-
-## Governed Dimensions
-
-| Dimension | Topologies | Rule Path Pattern |
-|---|---|---|
-| `progressive-axis` | `modular-monolith`, `distributed-modules`, `microservices` | `rulesets/topologies/progressive-axis/<topology>/` |
-| `execution` | `serverless`, `edge-computing` | `rulesets/topologies/serverless/`, `rulesets/topologies/edge-computing/` |
-| `integration` | `event-driven` | `rulesets/topologies/event-driven/` |
-| `data` | `data-mesh` | `rulesets/topologies/data-mesh/` |
-| `ai` | `agentic-ai` | `rulesets/topologies/agentic-ai/` |
-
-## Enforcement Rules
-
-- Do not create a separate CLI, MCP server, or Core API per topology.
-- Do not place human-readable topology design as the source of executable truth; manifests and their declared rulesets are the executable contract.
-- Do not construct legacy F1/F2/F3 file paths. Resolve the compatibility alias through the progressive-axis topology manifest.
-- Every new enforceable topology rule must preserve Dual-Engine Parity when both engines apply.
-- OPA policies must not drift from Native rule semantics.
-- Topology rules must not encode business budget, ROI, cost, staffing, prioritization, timing, or business ownership.
-
-## Current Status
-
-The topology ruleset location is authorized. Concrete topology profiles and their Native plus OPA rules are tracked in the [Gap Tracking Board](../../reference/governance/standards/vision/gap-tracking.md).
-
----
-[Back to Rulesets Hub](../README.md)