@evolith/core-domain 1.0.1 → 1.0.3

package/rulesets/governance/satellite-contracts.rules.json

@@ -1,183 +0,0 @@
-{
-  "$schema": "../schema/ruleset-standard.schema.json",
-  "$id": "https://evolith.dev/rulesets/governance/satellite-contracts.rules.json",
-  "title": "Satellite Contract Rules",
-  "description": "Rules defining the required and optional structure of satellite evolith.yaml files. These contracts enable the federated governance model.",
-  "version": "1.0.0",
-  "effectiveDate": "2026-01-01",
-  "contractFields": {
-    "required": [
-      {
-        "field": "apiVersion",
-        "path": "$.apiVersion",
-        "type": "string",
-        "constraint": "Must be 'evolith.dev/v1'",
-        "rationale": "API version enables future governance format evolution without breaking existing satellites."
-      },
-      {
-        "field": "kind",
-        "path": "$.kind",
-        "type": "string",
-        "constraint": "Must be 'Satellite'",
-        "rationale": "Kind distinguishes Evolith resources (Satellite, Policy, Standard) in the same repository."
-      },
-      {
-        "field": "metadata.name",
-        "path": "$.metadata.name",
-        "type": "string",
-        "constraint": "kebab-case, lowercase, alphanumeric + hyphens only",
-        "rationale": "Name is the satellite's identity in governance tooling and Architecture Board communications."
-      },
-      {
-        "field": "metadata.phase",
-        "path": "$.metadata.phase",
-        "type": "string",
-        "constraint": "Must be F1, F2, or F3",
-        "rationale": "Phase determines which architecture rules apply. F1 is mandatory starting point unless exception approved."
-      },
-      {
-        "field": "metadata.architectureVersion",
-        "path": "$.metadata.architectureVersion",
-        "type": "string",
-        "constraint": "semver format",
-        "rationale": "Tracks architectural evolution of the satellite independently of product version."
-      },
-      {
-        "field": "spec.coreRef.version",
-        "path": "$.spec.coreRef.version",
-        "type": "string",
-        "constraint": "semver format, must reference existing Evolith Core version",
-        "rationale": "Core version pin ensures reproducible governance validation."
-      },
-      {
-        "field": "spec.coreRef.rulesetVersion",
-        "path": "$.spec.coreRef.rulesetVersion",
-        "type": "string",
-        "constraint": "semver format",
-        "rationale": "Ruleset version allows Core to publish rule updates without bumping full Core version."
-      },
-      {
-        "field": "spec.runtime.language",
-        "path": "$.spec.runtime.language",
-        "type": "string",
-        "constraint": "Must be one of: TypeScript, CSharp, Kotlin, Go, Python",
-        "rationale": "Runtime language determines which runtime-specific ADRs and patterns apply."
-      },
-      {
-        "field": "spec.runtime.framework",
-        "path": "$.spec.runtime.framework",
-        "type": "string",
-        "rationale": "Framework identifies the specific framework (NestJS, ASP.NET Core, Spring Boot) for pattern enforcement."
-      },
-      {
-        "field": "spec.sdlc.currentPhase",
-        "path": "$.spec.sdlc.currentPhase",
-        "type": "integer",
-        "constraint": "Must be 1, 2, 3, 4, or 5",
-        "rationale": "SDLC phase determines which gate rules and artifact requirements apply."
-      }
-    ],
-    "optional": [
-      {
-        "field": "spec.coreRef.inheritancePath",
-        "path": "$.spec.coreRef.inheritancePath",
-        "type": "array",
-        "description": "Chain of inheritance if satellite extends another satellite",
-        "default": "[]"
-      },
-      {
-        "field": "spec.runtime.runtimeVersion",
-        "path": "$.spec.runtime.runtimeVersion",
-        "type": "string",
-        "description": "Runtime version (e.g., Node 20, .NET 8)"
-      },
-      {
-        "field": "spec.sdlc.gates",
-        "path": "$.spec.sdlc.gates",
-        "type": "object",
-        "description": "Gate completion dates for traceability"
-      },
-      {
-        "field": "spec.boundedContexts",
-        "path": "$.spec.boundedContexts",
-        "type": "array",
-        "description": "List of bounded contexts in this satellite"
-      },
-      {
-        "field": "spec.compliance.adrRegistry",
-        "path": "$.spec.compliance.adrRegistry",
-        "type": "array",
-        "description": "Local ADRs maintained by this satellite"
-      },
-      {
-        "field": "spec.compliance.coverageTarget",
-        "path": "$.spec.compliance.coverageTarget",
-        "type": "number",
-        "description": "Coverage target (minimum 80)"
-      },
-      {
-        "field": "spec.compliance.qualityWaivers",
-        "path": "$.spec.compliance.qualityWaivers",
-        "type": "array",
-        "description": "Active quality waivers with expiration dates"
-      }
-    ]
-  },
-  "rules": [
-    {
-      "id": "SVC-01",
-      "title": "Satellite must have exactly one evolith.yaml in repository root",
-      "enforcement": "CLI validates single evolith.yaml at repo root. Nested evolith.yaml files are prohibited.",
-      "description": "CLI validates single evolith.yaml at repo root. Nested evolith.yaml files are prohibited."
-    },
-    {
-      "id": "SVC-02",
-      "title": "Satellite name must be unique across all Evolith satellites",
-      "enforcement": "CLI checks against Evolith satellite registry before allowing first push.",
-      "description": "CLI checks against Evolith satellite registry before allowing first push."
-    },
-    {
-      "id": "SVC-03",
-      "title": "F1 phase satellites must reference core/ADR-0047 in spec.compliance.adrRegistry",
-      "enforcement": "Satellites in F1 phase must include core/ADR-0047 confirming modular monolith starting point.",
-      "description": "Satellites in F1 phase must include core/ADR-0047 confirming modular monolith starting point."
-    },
-    {
-      "id": "SVC-04",
-      "title": "Satellites in F2 or F3 must have extraction readiness score documented",
-      "enforcement": "Satellites with phase F2 or F3 must have core/ADR-0045 assessment with score >= 70% (F2) or >= 80% (F3).",
-      "description": "Satellites with phase F2 or F3 must have core/ADR-0045 assessment with score >= 70% (F2) or >= 80% (F3)."
-    },
-    {
-      "id": "SVC-05",
-      "title": "Core version referenced must exist in Evolith Core registry",
-      "enforcement": "CLI validates coreRef.version against Evolith Core releases. Unknown versions trigger error.",
-      "description": "CLI validates coreRef.version against Evolith Core releases. Unknown versions trigger error."
-    }
-  ],
-  "migrationRules": [
-    {
-      "id": "MIG-01",
-      "title": "Satellite can upgrade governance version via CLI upgrade command",
-      "command": "evolith upgrade --target-version <version>",
-      "description": "CLI automates version update, rule diff review, and CI validation"
-    },
-    {
-      "id": "MIG-02",
-      "title": "Phase transition (F1 → F2 → F3) requires Architecture Board approval artifact",
-      "description": "Phase transition is not automated. Board must review and explicitly approve before satellite updates metadata.phase"
-    },
-    {
-      "id": "MIG-03",
-      "title": "Satellite archival: satellite marks itself as Deprecated in evolith.yaml",
-      "description": "Deprecated satellites are retained for audit but no longer receive Core rule updates"
-    }
-  ],
-  "reference": {
-    "evolithYamlSchema": "../schema/evolith-yaml.schema.json",
-    "inheritanceRules": "./inheritance.rules.json",
-    "f1Rules": "../../reference/architecture/topologies/progressive-axis/modular-monolith/modular-monolith.rules.json",
-    "f2Rules": "../../reference/architecture/topologies/progressive-axis/distributed-modules/distributed-modules.rules.json",
-    "f3Rules": "../../reference/architecture/topologies/progressive-axis/microservices/microservices.rules.json"
-  }
-}

package/rulesets/infrastructure/helm-enforcement.rules.json

@@ -1,21 +0,0 @@
-{
-  "$schema": "../../schema/rule-definition.schema.json",
-  "id": "INFRA-001",
-  "category": "infrastructure",
-  "name": "Helm Charts Over Raw Manifests Enforcement",
-  "description": "Ensures that Kubernetes configurations use Helm charts (Chart.yaml) rather than raw standalone YAML manifests.",
-  "severity": "error",
-  "rationale": "Helm provides versioning, templating, and rollback capabilities which are required by ADR-0076 and the authoritative tech stack. Raw manifests lead to drift and duplication.",
-  "validation": {
-    "type": "file_pattern_ban",
-    "target": [
-      "reference/infrastructure/kubernetes/**/*.yaml"
-    ],
-    "exclude": [
-      "reference/infrastructure/kubernetes/**/Chart.yaml",
-      "reference/infrastructure/kubernetes/**/values.yaml"
-    ],
-    "message": "Raw Kubernetes YAML manifests are prohibited. Wrap your deployments in a Helm Chart.",
-    "opa_equivalent": "infrastructure/opa/helm-enforcement.rego"
-  }
-}

package/rulesets/infrastructure/opa/helm-enforcement.rego

@@ -1,25 +0,0 @@
-package evolith.infrastructure
-
-import future.keywords.contains
-import future.keywords.if
-import future.keywords.in
-
-# Default deny
-default allow := false
-
-# OPA rule to reject raw Kubernetes manifests that aren't part of a Helm chart.
-# In a real setup, input would be the file paths or Kubernetes objects.
-deny contains msg if {
-    some path in input.files
-    endswith(path, ".yaml")
-    contains(path, "reference/infrastructure/kubernetes/")
-    not endswith(path, "Chart.yaml")
-    not endswith(path, "values.yaml")
-    not contains(path, "templates/")
-    
-    msg := sprintf("File %s is a raw Kubernetes manifest. Helm charts must be used (Chart.yaml and templates/).", [path])
-}
-
-allow if {
-    count(deny) == 0
-}

package/rulesets/infrastructure/opa/helm-enforcement.test.rego

@@ -1,31 +0,0 @@
-package evolith.infrastructure_test
-
-import data.evolith.infrastructure
-
-test_valid_helm_chart_is_allowed {
-	infrastructure.allow with input as {"files": ["Chart.yaml", "values.yaml", "templates/deployment.yaml"]}
-}
-
-test_empty_file_list_is_allowed {
-	infrastructure.allow with input as {"files": []}
-}
-
-test_raw_k8s_manifest_is_denied {
-	count(infrastructure.deny) > 0 with input as {"files": ["reference/infrastructure/kubernetes/deploy.yaml"]}
-}
-
-test_file_in_templates_is_allowed {
-	infrastructure.allow with input as {"files": ["templates/service.yaml"]}
-}
-
-test_chart_yaml_is_allowed {
-	infrastructure.allow with input as {"files": ["Chart.yaml"]}
-}
-
-test_values_yaml_is_allowed {
-	infrastructure.allow with input as {"files": ["values.yaml"]}
-}
-
-test_non_k8s_yaml_is_allowed {
-	infrastructure.allow with input as {"files": ["README.yaml"]}
-}

package/rulesets/infrastructure/opa/opa-sidecar-bundle.rego

@@ -1,115 +0,0 @@
-package evolith.infrastructure.opa_sidecar_bundle
-
-import future.keywords.contains
-import future.keywords.if
-import future.keywords.in
-
-default allow := false
-
-valid_algorithms := {"RS256", "ES256", "HS256"}
-
-deny contains msg if {
-	some chart in input.charts
-	not startswith(chart.bundle.url, "https://")
-	msg := sprintf("%s OPA bundle endpoint must use https://", [chart.name])
-}
-
-deny contains msg if {
-	some chart in input.charts
-	chart.bundle.resource == ""
-	msg := sprintf("%s OPA bundle resource must be explicit", [chart.name])
-}
-
-deny contains msg if {
-	some chart in input.charts
-	not regex.match("^sha256:[a-f0-9]{64}$", chart.bundle.expectedSha256)
-	msg := sprintf("%s OPA bundle expectedSha256 must be a sha256:<64 hex> digest", [chart.name])
-}
-
-deny contains msg if {
-	some chart in input.charts
-	chart.bundle.credentials.existingSecretName == ""
-	msg := sprintf("%s OPA bundle credentials must come from a Kubernetes secret", [chart.name])
-}
-
-deny contains msg if {
-	some chart in input.charts
-	chart.bundle.credentials.regionKey == ""
-	msg := sprintf("%s OPA bundle credentials must include AWS_REGION for S3 signing", [chart.name])
-}
-
-deny contains msg if {
-	some chart in input.charts
-	not chart.bundle.signing.enabled
-	msg := sprintf("%s OPA bundle signature verification must be enabled", [chart.name])
-}
-
-deny contains msg if {
-	some chart in input.charts
-	chart.bundle.signing.existingSecretName == ""
-	msg := sprintf("%s OPA bundle signing public key must come from a Kubernetes secret", [chart.name])
-}
-
-deny contains msg if {
-	some chart in input.charts
-	not chart.bundle.signing.algorithm in valid_algorithms
-	msg := sprintf("%s OPA bundle signing algorithm is unsupported", [chart.name])
-}
-
-deny contains msg if {
-	some chart in input.charts
-	chart.bundle.signing.keyId == ""
-	msg := sprintf("%s OPA bundle signing keyId must be explicit", [chart.name])
-}
-
-deny contains msg if {
-	some chart in input.charts
-	not chart.bundle.readinessFailClosed
-	msg := sprintf("%s OPA sidecar readiness must fail closed on bundle activation", [chart.name])
-}
-
-deny contains msg if {
-	some chart in input.charts
-	not chart.rendered.hasConfigFileArg
-	msg := sprintf("%s OPA sidecar must load config.yaml through --config-file", [chart.name])
-}
-
-deny contains msg if {
-	some chart in input.charts
-	not chart.rendered.hasSigningKeyFileArg
-	msg := sprintf("%s OPA sidecar must load the signing public key with --set-file", [chart.name])
-}
-
-deny contains msg if {
-	some chart in input.charts
-	not chart.rendered.hasCredentialsEnv
-	msg := sprintf("%s OPA sidecar must expose S3 credentials from secret-backed environment variables", [chart.name])
-}
-
-deny contains msg if {
-	some chart in input.charts
-	not chart.rendered.hasDigestEnv
-	msg := sprintf("%s OPA sidecar must expose the expected bundle digest", [chart.name])
-}
-
-deny contains msg if {
-	some chart in input.charts
-	not chart.rendered.hasFailClosedReadiness
-	msg := sprintf("%s OPA sidecar must render /health?bundles readiness", [chart.name])
-}
-
-deny contains msg if {
-	some chart in input.charts
-	not chart.rendered.config.credentialsFromEnvironment
-	msg := sprintf("%s OPA config must enable s3_signing.environment_credentials", [chart.name])
-}
-
-deny contains msg if {
-	some chart in input.charts
-	chart.rendered.config.signingKeyId != chart.bundle.signing.keyId
-	msg := sprintf("%s OPA config signing keyid must match values", [chart.name])
-}
-
-allow if {
-	count(deny) == 0
-}

package/rulesets/infrastructure/opa/opa-sidecar-bundle.test.rego

@@ -1,66 +0,0 @@
-package evolith.infrastructure.opa_sidecar_bundle
-
-import future.keywords.if
-import future.keywords.in
-
-valid_chart := {
-	"name": "evolith-bff",
-	"bundle": {
-		"url": "https://ums-minio.ums-system.svc.cluster.local:9000",
-		"resource": "opa-bundles/bundle.tar.gz",
-		"expectedSha256": "sha256:7bffa731a4b3dfde851d0a2ee50a5bd654f8e2413ec4bb7f668a39550f9d42f7",
-		"credentials": {
-			"existingSecretName": "opa-bundle-credentials",
-			"regionKey": "AWS_REGION",
-		},
-		"signing": {
-			"enabled": true,
-			"existingSecretName": "opa-bundle-signing-key",
-			"keyId": "evolith-opa-bundle-rs256",
-			"algorithm": "RS256",
-		},
-		"readinessFailClosed": true,
-	},
-	"rendered": {
-		"hasConfigFileArg": true,
-		"hasSigningKeyFileArg": true,
-		"hasCredentialsEnv": true,
-		"hasDigestEnv": true,
-		"hasFailClosedReadiness": true,
-		"config": {
-			"credentialsFromEnvironment": true,
-			"signingKeyId": "evolith-opa-bundle-rs256",
-		},
-	},
-}
-
-test_valid_chart_allows if {
-	allow with input as {"charts": [valid_chart]}
-}
-
-test_http_endpoint_denied if {
-	invalid := object.union_n([
-		valid_chart,
-		{"bundle": object.union(valid_chart.bundle, {"url": "http://ums-minio:9000"})},
-	])
-	some msg in deny with input as {"charts": [invalid]}
-	contains(msg, "https://")
-}
-
-test_unsigned_bundle_denied if {
-	invalid := object.union_n([
-		valid_chart,
-		{"bundle": object.union(valid_chart.bundle, {"signing": object.union(valid_chart.bundle.signing, {"enabled": false})})},
-	])
-	some msg in deny with input as {"charts": [invalid]}
-	contains(msg, "signature verification")
-}
-
-test_missing_readiness_denied if {
-	invalid := object.union_n([
-		valid_chart,
-		{"rendered": object.union(valid_chart.rendered, {"hasFailClosedReadiness": false})},
-	])
-	some msg in deny with input as {"charts": [invalid]}
-	contains(msg, "/health?bundles")
-}

package/rulesets/infrastructure/opa-sidecar-bundle.rules.json

@@ -1,18 +0,0 @@
-{
-  "$schema": "../schema/rule-definition.schema.json",
-  "id": "INFRA-OPA-001",
-  "category": "infrastructure",
-  "name": "OPA Sidecar Bundle Integrity",
-  "description": "Ensures Helm-based OPA sidecars fetch bundles from authenticated TLS endpoints, verify signed bundles, pin the expected bundle digest, and fail closed until bundle activation succeeds.",
-  "severity": "error",
-  "rationale": "OPA sidecars enforce executable governance at runtime. Unsigned or unauthenticated bundle distribution allows policy tampering and makes Native/OPA parity meaningful only in repository tests, not in deployed services.",
-  "validation": {
-    "type": "helm_opa_bundle_integrity",
-    "target": [
-      "reference/infrastructure/helm/evolith-bff",
-      "reference/infrastructure/helm/evolith-mcp"
-    ],
-    "message": "OPA sidecar bundles must use HTTPS, Kubernetes secret-backed credentials, signed bundle verification, expected SHA-256 digest metadata, and fail-closed readiness.",
-    "opa_equivalent": "infrastructure/opa/opa-sidecar-bundle.rego"
-  }
-}

package/rulesets/mcp/README.es.md

@@ -1,12 +0,0 @@
-# Rulesets MCP
-
-> **Navegación bilingüe:** [English version](./README.md)
-
-Reglas para exposición del protocolo MCP de Evolith, comportamiento de transporte y contexto de gobernanza consumible por IA.
-
-## Rulesets
-
-| Ruleset | Propósito |
-|---|---|
-| [Cumplimiento del Protocolo MCP](./protocol-compliance.rules.json) | Define el comportamiento mínimo del protocolo para los transportes MCP soportados. |
-

package/rulesets/mcp/README.md

@@ -1,12 +0,0 @@
-# MCP Rulesets
-
-> **Bilingual navigation:** [Versión en Español](./README.es.md)
-
-Rules for Evolith MCP protocol exposure, transport behavior, and AI-consumable governance context.
-
-## Rulesets
-
-| Ruleset | Purpose |
-|---|---|
-| [MCP Protocol Compliance](./protocol-compliance.rules.json) | Defines minimum protocol behavior for supported MCP transports. |
-

package/rulesets/mcp/protocol-compliance.rules.json

@@ -1,57 +0,0 @@
-{
-  "$schema": "../schema/ruleset-standard.schema.json",
-  "$id": "https://evolith.dev/rulesets/mcp/protocol-compliance.rules.json",
-  "title": "MCP Protocol Compliance Rules",
-  "description": "Minimum behavior required for Evolith MCP server transports and handlers.",
-  "version": "1.0.0",
-  "effectiveDate": "2026-06-08",
-  "scope": "core-cli",
-  "category": "mcp",
-  "rules": [
-    {
-      "id": "MCP-01",
-      "severity": "MUST",
-      "category": "protocol",
-      "title": "Initialize Request Must Return Capabilities",
-      "description": "The MCP server MUST respond to initialize with protocolVersion, capabilities, and serverInfo.",
-      "validationQuery": "Send JSON-RPC initialize request and validate response shape.",
-      "blocking": true
-    },
-    {
-      "id": "MCP-02",
-      "severity": "MUST",
-      "category": "tools",
-      "title": "Tools List Must Be Complete and Stable",
-      "description": "tools/list MUST expose every supported tool with name, description, and inputSchema.",
-      "validationQuery": "Call tools/list and validate each tool descriptor.",
-      "blocking": true
-    },
-    {
-      "id": "MCP-03",
-      "severity": "MUST",
-      "category": "resources",
-      "title": "Resources Must Preserve Core Traceability",
-      "description": "resources/read responses MUST identify the Core artifact or ruleset source behind the returned context.",
-      "validationQuery": "Read representative resources and verify source traceability metadata or content path.",
-      "blocking": true
-    },
-    {
-      "id": "MCP-04",
-      "severity": "MUST",
-      "category": "security",
-      "title": "HTTP Transport Requires Explicit Authentication Mode",
-      "description": "When HTTP transport is enabled outside local development, an API key or equivalent authentication mode MUST be configured.",
-      "validationQuery": "Inspect MCP transport config for apiKey or local-only mode.",
-      "blocking": true
-    },
-    {
-      "id": "MCP-05",
-      "severity": "SHOULD",
-      "category": "observability",
-      "title": "MCP Calls Should Emit Metrics",
-      "description": "Tool calls SHOULD record latency, success, failure, and error class metrics.",
-      "validationQuery": "Call a tool and inspect MCP metrics output.",
-      "blocking": false
-    }
-  ]
-}

package/rulesets/observability/README.es.md

@@ -1,12 +0,0 @@
-# Rulesets de Observabilidad
-
-> **Navegación bilingüe:** [English version](./README.md)
-
-Reglas para evidencia de telemetría requerida por gates Evolith y preparación operativa.
-
-## Rulesets
-
-| Ruleset | Propósito |
-|---|---|
-| [Evidencia de Telemetría](./telemetry-evidence.rules.json) | Define evidencia mínima de trazas, logs, métricas y dashboards para rutas productivas. |
-

package/rulesets/observability/README.md

@@ -1,12 +0,0 @@
-# Observability Rulesets
-
-> **Bilingual navigation:** [Versión en Español](./README.es.md)
-
-Rules for telemetry evidence required by Evolith phase gates and operational readiness.
-
-## Rulesets
-
-| Ruleset | Purpose |
-|---|---|
-| [Telemetry Evidence](./telemetry-evidence.rules.json) | Defines minimum trace, log, metric, and dashboard evidence for production paths. |
-

package/rulesets/observability/telemetry-evidence.rules.json

@@ -1,48 +0,0 @@
-{
-  "$schema": "../schema/ruleset-standard.schema.json",
-  "$id": "https://evolith.dev/rulesets/observability/telemetry-evidence.rules.json",
-  "title": "Telemetry Evidence Rules",
-  "description": "Minimum observability evidence for phase gates and production readiness.",
-  "version": "1.0.0",
-  "effectiveDate": "2026-06-08",
-  "scope": "satellite",
-  "category": "observability",
-  "rules": [
-    {
-      "id": "OBS-EVD-01",
-      "severity": "MUST",
-      "category": "tracing",
-      "title": "Production Paths Emit Trace Context",
-      "description": "Production request paths MUST emit TraceId, SpanId, and CorrelationId or runtime-equivalent trace context.",
-      "validationQuery": "Inspect OTel traces for representative production paths.",
-      "blocking": true
-    },
-    {
-      "id": "OBS-EVD-02",
-      "severity": "MUST",
-      "category": "logging",
-      "title": "Structured Logs Carry Request Context",
-      "description": "Structured logs MUST include request correlation fields and avoid raw PII.",
-      "validationQuery": "Sample production logs and verify correlation fields plus PII-safe logging policy.",
-      "blocking": true
-    },
-    {
-      "id": "OBS-EVD-03",
-      "severity": "MUST",
-      "category": "metrics",
-      "title": "Service Health Metrics Are Reported",
-      "description": "Production services MUST report error rate, latency percentile, throughput, and availability metrics.",
-      "validationQuery": "Inspect metrics backend or dashboard export for required service health metrics.",
-      "blocking": true
-    },
-    {
-      "id": "OBS-EVD-04",
-      "severity": "SHOULD",
-      "category": "dashboards",
-      "title": "Gate Evidence References Dashboard",
-      "description": "Phase 5 evidence SHOULD reference the dashboard or query used to verify nominal monitoring.",
-      "validationQuery": "Verify release notes or evidence manifest includes dashboardRef.",
-      "blocking": false
-    }
-  ]
-}

package/rulesets/opa/README.es.md

@@ -1,22 +0,0 @@
-# Políticas OPA y Schemas de Entrada
-
-Esta carpeta contiene las políticas principales de Open Policy Agent (OPA) `.rego` utilizadas para la validación de arquitectura y gobernanza en la plataforma Evolith.
-
-Cada política OPA define un contrato formal para su entrada, respaldado por un JSON Schema versionado.
-
-## Políticas y Schemas OPA
-
-| Archivo de Política | Archivo de Prueba | JSON Schema de Entrada | Descripción |
-|---|---|---|---|
-| [governance.rego](./governance.rego) | [governance.test.rego](./governance.test.rego) | [governance.input.schema.json](./schemas/governance.input.schema.json) | Verifica los límites de herencia de satélites y decisiones obligatorias. |
-| [mcp.rego](./mcp.rego) | [mcp.test.rego](./mcp.test.rego) | [mcp.input.schema.json](./schemas/mcp.input.schema.json) | Verifica el cumplimiento del protocolo MCP y la evidencia de pruebas de humo. |
-| [version-pinning.rego](./version-pinning.rego) | [version-pinning.test.rego](./version-pinning.test.rego) | [version-pinning.input.schema.json](./schemas/version-pinning.input.schema.json) | Aplica reglas estrictas de fijación (pinning) de dependencias de paquetes. |
-| [cli-readiness.rego](./cli-readiness.rego) | [cli-readiness.test.rego](./cli-readiness.test.rego) | [cli-readiness.input.schema.json](./schemas/cli-readiness.input.schema.json) | Valida la compilación, documentación y preparación del archivo lock del Smart CLI. |
-| [knowledge-intake.rego](./knowledge-intake.rego) | [knowledge-intake.test.rego](./knowledge-intake.test.rego) | [knowledge-intake.input.schema.json](./schemas/knowledge-intake.input.schema.json) | Gobierna el ciclo de vida de ingesta, estado de revisión y emparejamiento topológico de conocimiento externo. |
-| [taxonomy.rego](./taxonomy.rego) | [taxonomy.test.rego](./taxonomy.test.rego) | [taxonomy.input.schema.json](./schemas/taxonomy.input.schema.json) | Valida la taxonomía de directorios del repositorio, nombres de archivos ADR y pares bilingües. |
-| [ci-cd.rego](./ci-cd.rego) | [ci-cd.test.rego](./ci-cd.test.rego) | [ci-cd.input.schema.json](./schemas/ci-cd.input.schema.json) | Asegura que el escaneo de dependencias, scripts de flujo de trabajo y actualizaciones de dependencias estén presentes. |
-| [evidence.rego](./evidence.rego) | [evidence.test.rego](./evidence.test.rego) | [evidence.input.schema.json](./schemas/evidence.input.schema.json) | Valida el esquema, periodos de retención y propiedad de los artefactos de evidencia de gates. |
-| [abac-mcp-tool-access.rego](./abac-mcp-tool-access.rego) | [abac-mcp-tool-access.test.rego](./abac-mcp-tool-access.test.rego) | [abac-mcp-tool-access.input.schema.json](./schemas/abac-mcp-tool-access.input.schema.json) | Restringe la ejecución de herramientas del Model Context Protocol (MCP) por rol, acción y entorno. |
-
----
-[Volver al Centro de Rulesets](../README.es.md)