@evolith/core-domain 1.0.1 → 1.0.2

package/rulesets/topologies/agentic-ai/README.es.md

@@ -1,142 +0,0 @@
-# Perfil Topologico de IA Agentica
-
-> **Navegacion bilingue:** [Version en ingles](./README.md)
-
-**Estado:** Aceptada
-**Dimension:** `ai`
-**ID de topologia:** `agentic-ai`
-**Manifiesto:** [topology.manifest.json](./topology.manifest.json)
-
-La IA agentica es la topologia para sistemas donde un agente de IA puede inspeccionar contexto, planificar trabajo, invocar herramientas o proponer cambios. Se compone con cualquier perfil de eje progresivo; no es una fase de entrega ni un sustituto de la propiedad de producto.
-
-## Proposito y Alcance
-
-Usa este perfil cuando un agente tenga acceso a contexto de repositorio, servicio u operacion. El perfil gobierna el limite del agente, no el proveedor del modelo ni el framework de orquestacion.
-
-Todo satelite que lo adopte DEBE proporcionar `agent.config.json`. El evaluador nativo y la politica OPA aplican los mismos controles:
-
-| Regla | Control requerido |
-|---|---|
-| AAI-R01 | Identidad estable del agente y una o mas capacidades declaradas |
-| AAI-R02 | Sandbox aislado con acceso de red y proceso en deny o allowlist |
-| AAI-R03 | Fuentes de prompts y raices de implementacion que no se superponen |
-| AAI-R04 | Politica `approval-required` para herramientas mutativas |
-| AAI-R05 | Ejecucion efimera con duracion, memoria y CPU acotadas |
-| AAI-R06 | Contexto no confiable tratado como dato con procedencia y validacion de schema |
-| AAI-R07 | Delegacion acotada por capacidad y evidencia de accion correlacionada append-only |
-| AAI-R08 | Limites positivos de tokens y contexto, concurrencia MCP acotada y ruta legible de runbook |
-| AAI-R09 | Delegacion acotada, cadencia de rotacion de credenciales y revocacion ante incidentes |
-
-## Contrato de Configuracion
-
-`agent.config.json` es una declaracion portable, no un archivo de un framework de agentes especifico de runtime. Mantiene prompts, implementacion determinista y permisos de ejecucion revisables por separado.
-
-```json
-{
-  "agent": {
-    "id": "architecture-reviewer",
-    "capabilities": ["read-architecture", "review-changes"]
-  },
-  "sandbox": {
-    "mode": "isolated",
-    "network": "allowlist",
-    "process": "deny",
-    "ephemeral": true,
-    "maxDurationSeconds": 30,
-    "maxMemoryMb": 512,
-    "maxCpuCores": 1
-  },
-  "promptSources": ["prompts"],
-  "implementationRoots": ["src/agents"],
-  "contextPolicy": {
-    "untrustedContent": "data-only",
-    "provenanceRequired": true,
-    "toolOutputSchemaValidation": true
-  },
-  "toolPolicy": {
-    "mutative": "approval-required",
-    "capabilityDelegation": "scoped-and-expiring"
-  },
-  "audit": {
-    "appendOnly": true,
-    "correlationId": "required"
-  },
-  "operationalBudgets": {
-    "maxPromptTokens": 16000,
-    "maxCompletionTokens": 4000,
-    "maxContextWindowTokens": 128000,
-    "mcpToolConcurrency": {
-      "maxInFlight": 4,
-      "perToolMaxInFlight": 2
-    },
-    "runbooksPath": "docs/agentic-ai-runbooks.md"
-  },
-  "credentialLifecycle": {
-    "delegationMaxTtlSeconds": 900,
-    "rotationCadenceDays": 30,
-    "revocation": {
-      "onIncident": "immediate",
-      "maxPropagationSeconds": 60
-    }
-  }
-}
-```
-
-Las rutas declaradas de prompts e implementacion NO DEBEN superponerse. Una capacidad no es un permiso: el sandbox y la politica de herramientas son la autoridad de ejecucion. El contexto no confiable sigue siendo dato, nunca autoridad; toda accion lleva una capacidad acotada y evidencia correlacionada append-only.
-
-## Contrato Operativo
-
-`operationalBudgets` declara limites aplicables para una ejecucion. `maxPromptTokens` limita las instrucciones y el contexto suministrado, `maxCompletionTokens` limita la salida generada y `maxContextWindowTokens` limita el contexto combinado del modelo. `mcpToolConcurrency.maxInFlight` limita todas las llamadas concurrentes a herramientas; `perToolMaxInFlight` evita que una sola herramienta consuma todo el presupuesto. Un adoptante DEBE elegir valores adecuados para su modelo aprobado y su capacidad, y DEBE apuntar `runbooksPath` a su guia de incidentes mantenida.
-
-`credentialLifecycle` limita la autoridad delegada a `delegationMaxTtlSeconds`, exige rotacion como minimo cada `rotationCadenceDays` y define la rapidez con que la revocacion por incidente llega a cada ejecutor. `onIncident` DEBERIA ser `immediate`; `scheduled` solo se permite cuando una dependencia operativa documentada impide la revocacion inmediata. Los runbooks de referencia de la topologia estan [disponibles aqui](./runbooks.es.md).
-
-## Interaccion y Limite de Seguridad
-
-```mermaid
-flowchart LR
-    C["Contexto gobernado"] --> A["Agente"]
-    P["Fuentes de prompts"] --> A
-    A --> S["Sandbox aislado"]
-    S --> R["Herramientas de solo lectura"]
-    S --> M{"Herramienta mutativa"}
-    M -->|"approval-required"| H["Aprobacion humana o de politica"]
-    H --> T["Ejecucion aprobada"]
-    I["Raices de implementacion"] -. "separadas de los prompts" .-> A
-```
-
-El sandbox es la unica ruta hacia la ejecucion de herramientas. Los prompts aportan instrucciones; las raices de implementacion contienen codigo determinista. Ninguno puede otorgar silenciosamente acceso de red, proceso o mutacion.
-
-## Decisiones Rectoras y Validacion
-
-[ADR-0058](../../../adrs/core/0058-ai-consumable-architecture-knowledge.es.md) gobierna el conocimiento de arquitectura consumible por IA. [ADR-0081](../../../adrs/core/0081-agentic-ai-sandbox-isolation.es.md), [ADR-0082](../../../adrs/core/0082-agentic-ai-trust-boundary.es.md) y [ADR-0083](../../../adrs/core/0083-agentic-ai-action-authorization-audit.es.md) establecen los limites de sandbox, confianza y autorizacion. [ADR-AI-001](../../../../governance/standards/ai-augmented/06-adrs/adr-ai-001-harness-strategy.es.md) y [ADR-AI-005](../../../../governance/standards/ai-augmented/06-adrs/adr-ai-005-human-in-the-loop-policy.es.md) siguen siendo decisiones propuestas de apoyo.
-
-Ejecuta el perfil mediante el validador consciente de topologias:
-
-```bash
-evolith validate --topology agentic-ai
-```
-
-El ruleset nativo es [agentic-ai.rules.json](./agentic-ai.rules.json); su politica OPA equivalente es [agentic-ai.rego](./agentic-ai.rego). Ambos evaluan el mismo contrato de `agent.config.json`.
-
-## Frontera de Negocio
-
-Este perfil es solo tecnico. No define propiedad de negocio, priorizacion, ROI, costo, presupuesto, staffing, calendario de entrega ni Funnel 0. Evolith Tracker posee esas preocupaciones mediante su ACL.
-
-## Navegacion del Corpus
-
-El corpus de IA agentica es la linea base de implementacion obligatoria para esta topologia:
-
-| Area | Guia |
-|---|---|
-| Adopcion | [Guia de adopcion](./adoption.es.md) |
-| Operacion | [Guia de operacion](./operations.es.md) |
-| Seguridad | [Guia de seguridad](./security.es.md) |
-| Resiliencia | [Guia de resiliencia](./resilience.es.md) |
-| Diseno | [Patrones y anti-patrones](./patterns.es.md) |
-| Evolucion | [Guia de evolucion](./evolution.es.md) |
-| Resumen | [Guia de adopcion, operacion y evolucion](./maturity.es.md) |
-
-Este corpus implementa el [Estandar de Corpus de Topologias](../../topology-corpus-standard.es.md) para IA agentica. Un perfil no esta listo para aceptacion hasta que esten presentes y validados todas estas guias, controles ejecutables, fixtures de contrato, pruebas e interfaces de plano de control.
-
----
-[Volver al Hub de Topologias](../../README.es.md)

package/rulesets/topologies/agentic-ai/README.md

@@ -1,142 +0,0 @@
-# Agentic AI Topology Profile
-
-> **Bilingual Navigation:** [Version en Espanol](./README.es.md)
-
-**Status:** Accepted
-**Dimension:** `ai`
-**Topology ID:** `agentic-ai`
-**Manifest:** [topology.manifest.json](./topology.manifest.json)
-
-Agentic AI is the topology for systems where an AI agent can inspect context, plan work, call tools, or propose changes. It is composable with every progressive-axis profile; it is not a delivery phase or a substitute for product ownership.
-
-## Purpose and Scope
-
-Use this profile when an agent has access to repository, service, or operational context. The profile governs the agent boundary, not the model vendor or orchestration framework.
-
-Every adopting satellite MUST provide `agent.config.json`. The native evaluator and the OPA policy enforce the same controls:
-
-| Rule | Required control |
-|---|---|
-| AAI-R01 | Stable agent identity and one or more declared capabilities |
-| AAI-R02 | An isolated sandbox with deny or allowlist network and process access |
-| AAI-R03 | Non-overlapping prompt sources and implementation roots |
-| AAI-R04 | `approval-required` policy for mutative tools |
-| AAI-R05 | Ephemeral execution with bounded duration, memory, and CPU |
-| AAI-R06 | Untrusted context treated as data with provenance and schema validation |
-| AAI-R07 | Capability-scoped delegation and append-only correlated action evidence |
-| AAI-R08 | Positive token and context ceilings, bounded MCP concurrency, and a readable runbook path |
-| AAI-R09 | Bounded delegation, credential rotation cadence, and incident revocation |
-
-## Configuration Contract
-
-`agent.config.json` is a portable declaration, not a runtime-specific agent framework file. It keeps prompts, deterministic implementation, and execution permissions independently reviewable.
-
-```json
-{
-  "agent": {
-    "id": "architecture-reviewer",
-    "capabilities": ["read-architecture", "review-changes"]
-  },
-  "sandbox": {
-    "mode": "isolated",
-    "network": "allowlist",
-    "process": "deny",
-    "ephemeral": true,
-    "maxDurationSeconds": 30,
-    "maxMemoryMb": 512,
-    "maxCpuCores": 1
-  },
-  "promptSources": ["prompts"],
-  "implementationRoots": ["src/agents"],
-  "contextPolicy": {
-    "untrustedContent": "data-only",
-    "provenanceRequired": true,
-    "toolOutputSchemaValidation": true
-  },
-  "toolPolicy": {
-    "mutative": "approval-required",
-    "capabilityDelegation": "scoped-and-expiring"
-  },
-  "audit": {
-    "appendOnly": true,
-    "correlationId": "required"
-  },
-  "operationalBudgets": {
-    "maxPromptTokens": 16000,
-    "maxCompletionTokens": 4000,
-    "maxContextWindowTokens": 128000,
-    "mcpToolConcurrency": {
-      "maxInFlight": 4,
-      "perToolMaxInFlight": 2
-    },
-    "runbooksPath": "docs/agentic-ai-runbooks.md"
-  },
-  "credentialLifecycle": {
-    "delegationMaxTtlSeconds": 900,
-    "rotationCadenceDays": 30,
-    "revocation": {
-      "onIncident": "immediate",
-      "maxPropagationSeconds": 60
-    }
-  }
-}
-```
-
-The declared prompt and implementation paths MUST not overlap. A capability is not permission: the sandbox and tool policy are the execution authority. Untrusted context remains data, never authority; every action carries a scoped capability and append-only correlated evidence.
-
-## Operational Contract
-
-`operationalBudgets` declares enforceable ceilings for one execution. `maxPromptTokens` limits supplied instructions and context, `maxCompletionTokens` limits generated output, and `maxContextWindowTokens` limits the combined model context. `mcpToolConcurrency.maxInFlight` caps all concurrent tool calls; `perToolMaxInFlight` prevents a single tool from consuming the whole budget. An adopter MUST choose values appropriate to its approved model and capacity, and MUST point `runbooksPath` to its maintained incident guide.
-
-`credentialLifecycle` limits delegated authority to `delegationMaxTtlSeconds`, requires rotation no less frequently than `rotationCadenceDays`, and defines how quickly incident revocation reaches every executor. `onIncident` SHOULD be `immediate`; `scheduled` is permitted only when a documented operational dependency prevents immediate revocation. The topology reference runbooks are [available here](./runbooks.md).
-
-## Interaction and Security Boundary
-
-```mermaid
-flowchart LR
-    C["Governed context"] --> A["Agent"]
-    P["Prompt sources"] --> A
-    A --> S["Isolated sandbox"]
-    S --> R["Read-only tools"]
-    S --> M{"Mutative tool"}
-    M -->|"approval-required"| H["Human or policy approval"]
-    H --> T["Approved execution"]
-    I["Implementation roots"] -. "separate from prompts" .-> A
-```
-
-The sandbox is the only route to tool execution. Prompts provide instructions; implementation roots contain deterministic code. Neither can silently grant network, process, or mutative access.
-
-## Governing Decisions and Validation
-
-[ADR-0058](../../../adrs/core/0058-ai-consumable-architecture-knowledge.md) governs AI-consumable architecture knowledge. [ADR-0081](../../../adrs/core/0081-agentic-ai-sandbox-isolation.md), [ADR-0082](../../../adrs/core/0082-agentic-ai-trust-boundary.md), and [ADR-0083](../../../adrs/core/0083-agentic-ai-action-authorization-audit.md) establish the sandbox, trust, and authorization boundaries. [ADR-AI-001](../../../../governance/standards/ai-augmented/06-adrs/adr-ai-001-harness-strategy.md) and [ADR-AI-005](../../../../governance/standards/ai-augmented/06-adrs/adr-ai-005-human-in-the-loop-policy.md) remain supporting proposed decisions.
-
-Run the profile through the topology-aware validator:
-
-```bash
-evolith validate --topology agentic-ai
-```
-
-The native ruleset is [agentic-ai.rules.json](./agentic-ai.rules.json); its equivalent OPA policy is [agentic-ai.rego](./agentic-ai.rego). Both evaluate the same `agent.config.json` contract.
-
-## Business Boundary
-
-This profile is technical-only. It does not define business ownership, prioritization, ROI, cost, budget, staffing, delivery timing, or Funnel 0. Evolith Tracker owns those concerns through its ACL.
-
-## Corpus Navigation
-
-The Agentic AI corpus is the required implementation baseline for this topology:
-
-| Area | Guidance |
-|---|---|
-| Adoption | [Adoption guide](./adoption.md) |
-| Operations | [Operations guide](./operations.md) |
-| Security | [Security guide](./security.md) |
-| Resilience | [Resilience guide](./resilience.md) |
-| Design | [Patterns and anti-patterns](./patterns.md) |
-| Evolution | [Evolution guide](./evolution.md) |
-| Summary | [Adoption, operations, and evolution guide](./maturity.md) |
-
-This corpus implements the [Topology Corpus Standard](../../topology-corpus-standard.md) for Agentic AI. A profile is not ready for acceptance until all of these guides, executable controls, contract fixtures, tests, and control-plane interfaces are present and validated.
-
----
-[Back to Topology Hub](../../README.md)

package/rulesets/topologies/agentic-ai/adoption.es.md

@@ -1,37 +0,0 @@
-# Guia de Adopcion de IA Agentica
-
-> **Navegacion bilingue:** [Version en ingles](./adoption.md)
-
-## Criterios de Entrada
-
-Adopta IA agentica solo cuando un flujo acotado necesite razonamiento gobernado sobre contexto y uso acotado de herramientas. El bounded context propietario conserva la responsabilidad de la decision de negocio; el agente es un componente de ejecucion asistente, no un propietario de politica de dominio.
-
-Antes de habilitar un agente, el adoptante DEBE identificar al propietario responsable, declarar un conjunto inicial de capacidades de solo lectura y registrar las herramientas, fuentes de contexto y autoridad de aprobacion. La topologia se compone con un perfil de eje progresivo; no reemplaza las reglas de extraccion ni de propiedad de datos de ese perfil.
-
-## Secuencia de Adopcion
-
-1. Crea `agent.config.json` con identidad estable, capacidades explicitas, sandbox aislado y politica mutativa `approval-required`.
-2. Comienza con herramientas de solo lectura y contexto representativo que no sea de produccion.
-3. Valida el contrato con `evolith validate --topology agentic-ai` mediante los motores Native y OPA.
-4. Ejercita rutas de denegacion, timeout, contexto invalido y rechazo de aprobacion antes de habilitar una capacidad en un entorno superior.
-5. Agrega una herramienta mutativa solo despues de revisar su propietario, delegacion acotada, ruta de aprobacion y evidencia append-only correlacionada.
-
-## Lista de Adopcion
-
-- Hay un propietario de bounded context y un propietario de herramienta identificados.
-- Las fuentes de contexto tienen procedencia y clasificacion declaradas.
-- Las fuentes de prompts y las raices deterministas de implementacion estan separadas.
-- El sandbox tiene autoridad finita de CPU, memoria, duracion, proceso y red.
-- Las herramientas mutativas fallan cerrado cuando falta aprobacion o evidencia de politica.
-- Fixtures validos e invalidos bloqueantes cubren el contrato previsto.
-
-## Salida y No Adopcion
-
-No adoptes esta topologia para trabajo determinista que un servicio de aplicacion normal puede realizar, para flujos sin un limite seguro de herramientas o donde no se pueda retener evidencia y aprobacion. Deshabilita una capacidad cuando ya no esten disponibles su evidencia, propietario, control de sandbox o ruta de aprobacion requeridos.
-
-## Guia Relacionada
-
-Lee la [guia de seguridad](./security.es.md), [guia de operacion](./operations.es.md) y [guia de evolucion](./evolution.es.md) antes de la adopcion en produccion. [ADR-0081](../../../adrs/core/0081-agentic-ai-sandbox-isolation.es.md), [ADR-0082](../../../adrs/core/0082-agentic-ai-trust-boundary.es.md) y [ADR-0083](../../../adrs/core/0083-agentic-ai-action-authorization-audit.es.md) son autoridad obligatoria.
-
----
-[Volver al Perfil de IA Agentica](./README.es.md)

package/rulesets/topologies/agentic-ai/adoption.md

@@ -1,37 +0,0 @@
-# Agentic AI Adoption Guide
-
-> **Bilingual Navigation:** [Version en Espanol](./adoption.es.md)
-
-## Entry Criteria
-
-Adopt Agentic AI only when a bounded workflow needs governed reasoning over context and bounded tool use. The owning bounded context remains accountable for the business decision; the agent is an assisting execution component, not an owner of domain policy.
-
-Before enabling an agent, the adopter MUST identify the accountable owner, declare a read-only initial capability set, and record the tools, context sources, and approval authority. The topology composes with a progressive-axis profile; it does not replace that profile's extraction or data-ownership rules.
-
-## Adoption Sequence
-
-1. Create `agent.config.json` with a stable identity, explicit capabilities, isolated sandbox, and `approval-required` mutative policy.
-2. Start with read-only tools and representative non-production context.
-3. Validate the contract with `evolith validate --topology agentic-ai` using both Native and OPA engines.
-4. Exercise denial, timeout, invalid-context, and approval-rejection paths before enabling a capability in a higher environment.
-5. Add a mutative tool only after its owner, scoped delegation, approval path, and correlated append-only evidence are reviewed.
-
-## Adoption Checklist
-
-- A bounded-context owner and tool owner are named.
-- Context sources have a declared provenance and classification.
-- Prompt sources and deterministic implementation roots are separate.
-- The sandbox has finite CPU, memory, duration, process, and network authority.
-- Mutative tools fail closed when approval or policy evidence is absent.
-- Valid and blocking-invalid fixtures cover the intended contract.
-
-## Exit and Non-Adoption
-
-Do not adopt this topology for deterministic work that a normal application service can perform, for workflows without a safe tool boundary, or where evidence and approval cannot be retained. Disable a capability when its required evidence, owner, sandbox control, or approval path is no longer available.
-
-## Related Guidance
-
-Read the [security guide](./security.md), [operations guide](./operations.md), and [evolution guide](./evolution.md) before production adoption. [ADR-0081](../../../adrs/core/0081-agentic-ai-sandbox-isolation.md), [ADR-0082](../../../adrs/core/0082-agentic-ai-trust-boundary.md), and [ADR-0083](../../../adrs/core/0083-agentic-ai-action-authorization-audit.md) are mandatory authority.
-
----
-[Back to Agentic AI Profile](./README.md)

package/rulesets/topologies/agentic-ai/agent.config.schema.json

@@ -1,100 +0,0 @@
-{
-  "$id": "https://evolith.dev/schemas/agentic-ai/agent.config.schema.json",
-  "title": "Evolith Agentic AI Configuration",
-  "type": "object",
-  "required": ["agent", "sandbox", "promptSources", "implementationRoots", "contextPolicy", "toolPolicy", "audit", "operationalBudgets", "credentialLifecycle"],
-  "additionalProperties": false,
-  "properties": {
-    "agent": {
-      "type": "object",
-      "required": ["id", "capabilities"],
-      "additionalProperties": false,
-      "properties": {
-        "id": { "type": "string", "minLength": 1 },
-        "capabilities": { "type": "array", "minItems": 1, "items": { "type": "string", "minLength": 1 }, "uniqueItems": true }
-      }
-    },
-    "sandbox": {
-      "type": "object",
-      "required": ["mode", "network", "process", "ephemeral", "maxDurationSeconds", "maxMemoryMb", "maxCpuCores"],
-      "additionalProperties": false,
-      "properties": {
-        "mode": { "const": "isolated" },
-        "network": { "enum": ["deny", "allowlist"] },
-        "process": { "enum": ["deny", "allowlist"] },
-        "ephemeral": { "const": true },
-        "maxDurationSeconds": { "type": "integer", "minimum": 1 },
-        "maxMemoryMb": { "type": "integer", "minimum": 1 },
-        "maxCpuCores": { "type": "number", "exclusiveMinimum": 0 }
-      }
-    },
-    "promptSources": { "type": "array", "minItems": 1, "items": { "type": "string", "minLength": 1 }, "uniqueItems": true },
-    "implementationRoots": { "type": "array", "minItems": 1, "items": { "type": "string", "minLength": 1 }, "uniqueItems": true },
-    "contextPolicy": {
-      "type": "object",
-      "required": ["untrustedContent", "provenanceRequired", "toolOutputSchemaValidation"],
-      "additionalProperties": false,
-      "properties": {
-        "untrustedContent": { "const": "data-only" },
-        "provenanceRequired": { "const": true },
-        "toolOutputSchemaValidation": { "const": true }
-      }
-    },
-    "toolPolicy": {
-      "type": "object",
-      "required": ["mutative", "capabilityDelegation"],
-      "additionalProperties": false,
-      "properties": {
-        "mutative": { "const": "approval-required" },
-        "capabilityDelegation": { "const": "scoped-and-expiring" }
-      }
-    },
-    "audit": {
-      "type": "object",
-      "required": ["appendOnly", "correlationId"],
-      "additionalProperties": false,
-      "properties": {
-        "appendOnly": { "const": true },
-        "correlationId": { "const": "required" }
-      }
-    },
-    "operationalBudgets": {
-      "type": "object",
-      "required": ["maxPromptTokens", "maxCompletionTokens", "maxContextWindowTokens", "mcpToolConcurrency", "runbooksPath"],
-      "additionalProperties": false,
-      "properties": {
-        "maxPromptTokens": { "type": "integer", "minimum": 1 },
-        "maxCompletionTokens": { "type": "integer", "minimum": 1 },
-        "maxContextWindowTokens": { "type": "integer", "minimum": 1 },
-        "mcpToolConcurrency": {
-          "type": "object",
-          "required": ["maxInFlight", "perToolMaxInFlight"],
-          "additionalProperties": false,
-          "properties": {
-            "maxInFlight": { "type": "integer", "minimum": 1 },
-            "perToolMaxInFlight": { "type": "integer", "minimum": 1 }
-          }
-        },
-        "runbooksPath": { "type": "string", "minLength": 1 }
-      }
-    },
-    "credentialLifecycle": {
-      "type": "object",
-      "required": ["delegationMaxTtlSeconds", "rotationCadenceDays", "revocation"],
-      "additionalProperties": false,
-      "properties": {
-        "delegationMaxTtlSeconds": { "type": "integer", "minimum": 1 },
-        "rotationCadenceDays": { "type": "integer", "minimum": 1 },
-        "revocation": {
-          "type": "object",
-          "required": ["onIncident", "maxPropagationSeconds"],
-          "additionalProperties": false,
-          "properties": {
-            "onIncident": { "enum": ["immediate", "scheduled"] },
-            "maxPropagationSeconds": { "type": "integer", "minimum": 1 }
-          }
-        }
-      }
-    }
-  }
-}

package/rulesets/topologies/agentic-ai/agentic-ai.rego

@@ -1,46 +0,0 @@
-package evolith.topologies.agentic_ai
-
-violations[{"id": "AAI-R01", "severity": "MUST", "title": "Declared Agent Identity and Capabilities", "blocking": true, "message": message}] {
-    not input.satellite.agenticAi.hasIdentity
-    message := "agent.config.json must declare agent.id and a non-empty capabilities array (AAI-R01)."
-}
-
-violations[{"id": "AAI-R02", "severity": "MUST", "title": "Explicit Sandbox Boundary", "blocking": true, "message": message}] {
-    not input.satellite.agenticAi.hasIsolatedSandbox
-    message := "agent.config.json must declare an isolated sandbox with deny or allowlist network and process access (AAI-R02)."
-}
-
-violations[{"id": "AAI-R03", "severity": "MUST", "title": "Prompt and Implementation Separation", "blocking": true, "message": message}] {
-    not input.satellite.agenticAi.hasSeparatedPromptAndImplementation
-    message := "agent.config.json must declare non-overlapping promptSources and implementationRoots (AAI-R03)."
-}
-
-violations[{"id": "AAI-R04", "severity": "MUST", "title": "Approval for Mutative Tools", "blocking": true, "message": message}] {
-    not input.satellite.agenticAi.requiresApprovalForMutativeTools
-    message := "agent.config.json must set toolPolicy.mutative to approval-required (AAI-R04)."
-}
-
-violations[{"id": "AAI-R05", "severity": "MUST", "title": "Ephemeral Sandbox Resource Limits", "blocking": true, "message": message}] {
-    not input.satellite.agenticAi.hasEphemeralSandboxLimits
-    message := "agent.config.json must require ephemeral execution with positive duration, memory, and CPU limits (AAI-R05)."
-}
-
-violations[{"id": "AAI-R06", "severity": "MUST", "title": "Untrusted Context Is Data", "blocking": true, "message": message}] {
-    not input.satellite.agenticAi.hasTrustedContextPolicy
-    message := "agent.config.json must treat untrusted context as data, require provenance, and validate tool output schemas (AAI-R06)."
-}
-
-violations[{"id": "AAI-R07", "severity": "MUST", "title": "Capability-Scoped, Auditable Actions", "blocking": true, "message": message}] {
-    not input.satellite.agenticAi.hasAccountableActions
-    message := "agent.config.json must require scoped-and-expiring capabilities and append-only correlated action evidence (AAI-R07)."
-}
-
-violations[{"id": "AAI-R08", "severity": "MUST", "title": "Operational Budgets and Concurrency Limits", "blocking": true, "message": message}] {
-    not input.satellite.agenticAi.hasOperationalBudgets
-    message := "agent.config.json must declare operationalBudgets with positive token, context window, and MCP concurrency limits plus a runbooksPath that exists (AAI-R08)."
-}
-
-violations[{"id": "AAI-R09", "severity": "MUST", "title": "Satellite Credential Lifecycle", "blocking": true, "message": message}] {
-    not input.satellite.agenticAi.hasCredentialLifecycle
-    message := "agent.config.json must declare credentialLifecycle with positive delegation TTL, rotation cadence, and bounded incident revocation (AAI-R09)."
-}

package/rulesets/topologies/agentic-ai/agentic-ai.rules.json

@@ -1,109 +0,0 @@
-{
-  "$schema": "../../../../../rulesets/schema/ruleset-standard.schema.json",
-  "$id": "https://evolith.dev/rulesets/topologies/agentic-ai.rules.json",
-  "title": "Agentic AI Topology Rules",
-  "description": "Architectural rules for the agentic AI topology.",
-  "version": "1.1.0",
-  "effectiveDate": "2026-06-21",
-  "references": [
-    "rulesets/topologies/agentic-ai/README.md",
-    "reference/architecture/adrs/core/0058-ai-consumable-architecture-knowledge.md",
-    "reference/architecture/adrs/core/0081-agentic-ai-sandbox-isolation.md",
-    "reference/architecture/adrs/core/0082-agentic-ai-trust-boundary.md",
-    "reference/architecture/adrs/core/0083-agentic-ai-action-authorization-audit.md",
-    "reference/governance/standards/ai-augmented/06-adrs/adr-ai-001-harness-strategy.md",
-    "reference/governance/standards/ai-augmented/06-adrs/adr-ai-005-human-in-the-loop-policy.md"
-  ],
-  "rules": [
-    {
-      "id": "AAI-R01",
-      "severity": "MUST",
-      "category": "agent-identity",
-      "title": "Declared Agent Identity and Capabilities",
-      "description": "An Agentic AI satellite MUST provide agent.config.json with a stable agent.id and a non-empty capabilities array.",
-      "rationale": "A governed agent cannot be reviewed, authorized, or audited when its identity and intended capabilities are implicit.",
-      "validationQuery": "Read agent.config.json and require agent.id plus at least one declared capability.",
-      "blocking": true
-    },
-    {
-      "id": "AAI-R02",
-      "severity": "MUST",
-      "category": "agent-sandbox",
-      "title": "Explicit Sandbox Boundary",
-      "description": "agent.config.json MUST declare an isolated sandbox and set both network and process access to deny or allowlist.",
-      "rationale": "An agent requires a least-privilege execution boundary before it can invoke tools or handle untrusted content.",
-      "validationQuery": "Require sandbox.mode=isolated and sandbox.network and sandbox.process in {deny, allowlist}.",
-      "blocking": true
-    },
-    {
-      "id": "AAI-R03",
-      "severity": "MUST",
-      "category": "agent-prompt-boundaries",
-      "title": "Prompt and Implementation Separation",
-      "description": "agent.config.json MUST declare non-empty promptSources and implementationRoots that do not overlap.",
-      "rationale": "Keeping prompts separate from deterministic implementation logic makes prompt changes reviewable and prevents hidden policy from leaking into application code.",
-      "validationQuery": "Require non-empty promptSources and implementationRoots arrays; no configured path may be an ancestor or descendant of a path in the other array.",
-      "blocking": true
-    },
-    {
-      "id": "AAI-R04",
-      "severity": "MUST",
-      "category": "agent-tool-approval",
-      "title": "Approval for Mutative Tools",
-      "description": "agent.config.json MUST set toolPolicy.mutative to approval-required.",
-      "rationale": "Mutative actions must remain behind an explicit human or policy-governed approval boundary.",
-      "validationQuery": "Require toolPolicy.mutative=approval-required.",
-      "blocking": true
-    },
-    {
-      "id": "AAI-R05",
-      "severity": "MUST",
-      "category": "agent-sandbox-limits",
-      "title": "Ephemeral Sandbox Resource Limits",
-      "description": "agent.config.json MUST require ephemeral execution and positive duration, memory, and CPU limits in sandbox.",
-      "rationale": "Isolation without bounded lifetime and resources still permits persistence, denial of service, and uncontrolled cost.",
-      "validationQuery": "Require sandbox.ephemeral=true plus positive maxDurationSeconds, maxMemoryMb, and maxCpuCores values.",
-      "blocking": true
-    },
-    {
-      "id": "AAI-R06",
-      "severity": "MUST",
-      "category": "agent-context-trust",
-      "title": "Untrusted Context Is Data",
-      "description": "agent.config.json MUST declare contextPolicy.untrustedContent=data-only, provenanceRequired=true, and toolOutputSchemaValidation=true.",
-      "rationale": "Retrieved context and tool output can be attacker-controlled and must not silently become instructions or authority.",
-      "validationQuery": "Require the three contextPolicy fields and their safe values.",
-      "blocking": true
-    },
-    {
-      "id": "AAI-R07",
-      "severity": "MUST",
-      "category": "agent-action-accountability",
-      "title": "Capability-Scoped, Auditable Actions",
-      "description": "agent.config.json MUST require scoped-and-expiring capability delegation and append-only action evidence with correlation IDs.",
-      "rationale": "An agent action must be attributable, revocable, and reconstructible without relying on the prompt transcript.",
-      "validationQuery": "Require toolPolicy.capabilityDelegation=scoped-and-expiring, audit.appendOnly=true, and audit.correlationId=required.",
-      "blocking": true
-    },
-    {
-      "id": "AAI-R08",
-      "severity": "MUST",
-      "category": "agent-operational-budgets",
-      "title": "Operational Budgets and Concurrency Limits",
-      "description": "agent.config.json MUST declare operationalBudgets with positive maxPromptTokens, maxCompletionTokens, maxContextWindowTokens, an mcpToolConcurrency object with positive maxInFlight and perToolMaxInFlight, and a non-empty runbooksPath that points at a readable runbook document.",
-      "rationale": "Without quantitative ceilings the topology cannot reason about token overflow, MCP tool stampedes, or hung agents, and operators have no documented recovery path to point to during an incident.",
-      "validationQuery": "Require operationalBudgets.{maxPromptTokens,maxCompletionTokens,maxContextWindowTokens} > 0, operationalBudgets.mcpToolConcurrency.{maxInFlight,perToolMaxInFlight} > 0, and operationalBudgets.runbooksPath naming a file that exists on disk.",
-      "blocking": true
-    },
-    {
-      "id": "AAI-R09",
-      "severity": "MUST",
-      "category": "agent-credential-lifecycle",
-      "title": "Satellite Credential Lifecycle",
-      "description": "agent.config.json MUST declare credentialLifecycle with a positive delegationMaxTtlSeconds, a positive rotationCadenceDays, revocation.onIncident in {immediate, scheduled}, and a positive revocation.maxPropagationSeconds.",
-      "rationale": "Delegated agent credentials must rotate on a cadence and be revocable within a bounded window so a compromised satellite cannot retain authority indefinitely.",
-      "validationQuery": "Require credentialLifecycle.delegationMaxTtlSeconds > 0, credentialLifecycle.rotationCadenceDays > 0, credentialLifecycle.revocation.onIncident in {immediate, scheduled}, and credentialLifecycle.revocation.maxPropagationSeconds > 0.",
-      "blocking": true
-    }
-  ]
-}