@evolith/core-domain 1.0.1 → 1.0.3

package/rulesets/opa/engineering-manifesto.test.rego

@@ -1,133 +0,0 @@
-package evolith.engineering_manifesto_test
-
-import data.evolith.engineering_manifesto
-
-test_compliant_code_has_no_violations {
-    violations := engineering_manifesto.violations with input as {
-        "classLineCount": 100,
-        "classMethodCount": 8,
-        "liskovViolations": 0,
-        "domainImportsInfrastructure": false,
-        "maxCyclomaticComplexity": 10,
-        "circularDependencies": false,
-        "magicNumbersCount": 0
-    }
-    count(violations) == 0
-}
-
-test_class_exceeding_200_lines_is_violation {
-    violations := engineering_manifesto.violations with input as {
-        "classLineCount": 250,
-        "classMethodCount": 10,
-        "liskovViolations": 0,
-        "domainImportsInfrastructure": false,
-        "maxCyclomaticComplexity": 10,
-        "circularDependencies": false,
-        "magicNumbersCount": 0
-    }
-    violations[_].id == "EM-S-01"
-}
-
-test_liskov_violations_detected {
-    violations := engineering_manifesto.violations with input as {
-        "classLineCount": 100,
-        "classMethodCount": 8,
-        "liskovViolations": 2,
-        "domainImportsInfrastructure": false,
-        "maxCyclomaticComplexity": 10,
-        "circularDependencies": false,
-        "magicNumbersCount": 0
-    }
-    violations[_].id == "EM-S-03"
-}
-
-test_domain_imports_infrastructure_is_violation {
-    violations := engineering_manifesto.violations with input as {
-        "classLineCount": 100,
-        "classMethodCount": 8,
-        "liskovViolations": 0,
-        "domainImportsInfrastructure": true,
-        "maxCyclomaticComplexity": 10,
-        "circularDependencies": false,
-        "magicNumbersCount": 0
-    }
-    violations[_].id == "EM-S-05"
-}
-
-test_cyclomatic_complexity_exceeds_threshold {
-    violations := engineering_manifesto.violations with input as {
-        "classLineCount": 100,
-        "classMethodCount": 8,
-        "liskovViolations": 0,
-        "domainImportsInfrastructure": false,
-        "maxCyclomaticComplexity": 20,
-        "circularDependencies": false,
-        "magicNumbersCount": 0
-    }
-    violations[_].id == "EM-K-01"
-}
-
-test_god_class_by_line_count {
-    violations := engineering_manifesto.violations with input as {
-        "classLineCount": 600,
-        "classMethodCount": 10,
-        "liskovViolations": 0,
-        "domainImportsInfrastructure": false,
-        "maxCyclomaticComplexity": 10,
-        "circularDependencies": false,
-        "magicNumbersCount": 0
-    }
-    violations[_].id == "AP-01"
-}
-
-test_god_class_by_method_count {
-    violations := engineering_manifesto.violations with input as {
-        "classLineCount": 300,
-        "classMethodCount": 25,
-        "liskovViolations": 0,
-        "domainImportsInfrastructure": false,
-        "maxCyclomaticComplexity": 10,
-        "circularDependencies": false,
-        "magicNumbersCount": 0
-    }
-    violations[_].id == "AP-01"
-}
-
-test_circular_dependencies_detected {
-    violations := engineering_manifesto.violations with input as {
-        "classLineCount": 100,
-        "classMethodCount": 8,
-        "liskovViolations": 0,
-        "domainImportsInfrastructure": false,
-        "maxCyclomaticComplexity": 10,
-        "circularDependencies": true,
-        "magicNumbersCount": 0
-    }
-    violations[_].id == "AP-02"
-}
-
-test_magic_numbers_detected {
-    violations := engineering_manifesto.violations with input as {
-        "classLineCount": 100,
-        "classMethodCount": 8,
-        "liskovViolations": 0,
-        "domainImportsInfrastructure": false,
-        "maxCyclomaticComplexity": 10,
-        "circularDependencies": false,
-        "magicNumbersCount": 5
-    }
-    violations[_].id == "AP-05"
-}
-
-test_all_violations_detected {
-    violations := engineering_manifesto.violations with input as {
-        "classLineCount": 600,
-        "classMethodCount": 25,
-        "liskovViolations": 3,
-        "domainImportsInfrastructure": true,
-        "maxCyclomaticComplexity": 25,
-        "circularDependencies": true,
-        "magicNumbersCount": 10
-    }
-    count(violations) >= 5
-}

package/rulesets/opa/evidence.rego

@@ -1,64 +0,0 @@
-package evolith.evidence
-
-# Helper to get all evidence files
-evidence_files := [file | input.core.evidence[file]]
-
-violations[{"id": "EVD-01", "message": ".harness/evidence directory not found or empty"}] {
-    count(evidence_files) == 0
-}
-
-violations[{"id": "EVD-02", "message": ".harness/evidence directory not found or empty"}] {
-    count(evidence_files) == 0
-}
-
-violations[{"id": "EVD-03", "message": ".harness/evidence directory not found or empty"}] {
-    count(evidence_files) == 0
-}
-
-violations[{"id": "EVD-04", "message": ".harness/evidence directory not found or empty"}] {
-    count(evidence_files) == 0
-}
-
-violations[{"id": "EVD-01", "message": msg}] {
-    manifest := input.core.evidence[file]
-    required := {"id", "source", "generatedAt", "producer"}
-    actual := {k | manifest[k]}
-    missing := required - actual
-    count(missing) > 0
-    msg := sprintf("%v missing fields: %v", [file, concat(", ", missing)])
-}
-
-violations[{"id": "EVD-01", "message": msg}] {
-    manifest := input.core.evidence[file]
-    not manifest.evaluatedRules
-    not manifest.relatedRuleIds
-    not manifest.relatedGateId
-    msg := sprintf("%v missing evaluatedRules or relatedGateId", [file])
-}
-
-violations[{"id": "EVD-02", "message": msg}] {
-    manifest := input.core.evidence[file]
-    not manifest.sourceRef
-    msg := sprintf("%v missing sourceRef", [file])
-}
-
-violations[{"id": "EVD-03", "message": msg}] {
-    manifest := input.core.evidence[file]
-    required := {"status", "evaluatedRules", "blockingFailures"}
-    actual := {k | manifest[k]}
-    missing := required - actual
-    count(missing) > 0
-    msg := sprintf("%v missing fields: %v", [file, concat(", ", missing)])
-}
-
-violations[{"id": "EVD-04", "message": msg}] {
-    manifest := input.core.evidence[file]
-    not manifest.retentionPeriod
-    msg := sprintf("%v missing retentionPeriod or owner", [file])
-}
-
-violations[{"id": "EVD-04", "message": msg}] {
-    manifest := input.core.evidence[file]
-    not manifest.owner
-    msg := sprintf("%v missing retentionPeriod or owner", [file])
-}

package/rulesets/opa/evidence.test.rego

@@ -1,23 +0,0 @@
-package evolith.evidence_test
-
-import data.evolith.evidence
-
-test_complete_evidence_has_no_violations {
-  violations := evidence.violations with input as {"core": {"evidence": {"gate-evidence.json": {"id": "gate-001", "source": "cli", "generatedAt": "2026-06-20", "producer": "evolith-cli", "evaluatedRules": ["MM-R01"], "relatedGateId": "gate-01", "sourceRef": "main", "status": "passed", "blockingFailures": [], "retentionPeriod": "90d", "owner": "architecture-team"}}}}
-  count(violations) == 0
-}
-
-test_missing_evidence_directory_is_rejected {
-  violations := evidence.violations with input as {"core": {"evidence": {}}}
-  violations[_].id == "EVD-01"
-}
-
-test_evidence_missing_source_ref_is_rejected {
-  violations := evidence.violations with input as {"core": {"evidence": {"gate-evidence.json": {"id": "gate-001", "source": "cli", "generatedAt": "2026-06-20", "producer": "evolith-cli", "evaluatedRules": ["MM-R01"], "relatedGateId": "gate-01", "status": "passed", "blockingFailures": [], "retentionPeriod": "90d", "owner": "architecture-team"}}}}
-  violations[_].id == "EVD-02"
-}
-
-test_evidence_missing_retention_period_is_rejected {
-  violations := evidence.violations with input as {"core": {"evidence": {"gate-evidence.json": {"id": "gate-001", "source": "cli", "generatedAt": "2026-06-20", "producer": "evolith-cli", "evaluatedRules": ["MM-R01"], "relatedGateId": "gate-01", "sourceRef": "main", "status": "passed", "blockingFailures": []}}}}
-  violations[_].id == "EVD-04"
-}

package/rulesets/opa/executive-scorecards.rego

@@ -1,41 +0,0 @@
-package evolith.executive_scorecards
-
-violations[{"id": "DORA-01", "message": "Deployment Frequency metric not declared or dashboard required but missing"}] {
-    not input.satellite.scorecards.deploymentFrequencyDeclared
-}
-
-violations[{"id": "DORA-02", "message": "Lead Time for Changes metric not declared or dashboard required but missing"}] {
-    not input.satellite.scorecards.leadTimeDeclared
-}
-
-violations[{"id": "DORA-03", "message": "Change Failure Rate metric not declared or dashboard required but missing"}] {
-    not input.satellite.scorecards.changeFailureRateDeclared
-}
-
-violations[{"id": "DORA-04", "message": "Time to Restore (MTTR) metric not declared or dashboard required but missing"}] {
-    not input.satellite.scorecards.timeToRestoreDeclared
-}
-
-violations[{"id": "SPACE-01", "message": "Observability infrastructure (traces, logs, metrics) not operational in production"}] {
-    not input.satellite.scorecards.observabilityOperational
-}
-
-violations[{"id": "SPACE-02", "message": "Satellite performance (P95 latency) not measured or dashboard not linked in scorecards"}] {
-    not input.satellite.scorecards.performanceDashboardLinked
-}
-
-violations[{"id": "SPACE-03", "message": "Team cognitive load survey not completed or score not recorded in satellite scorecards"}] {
-    not input.satellite.scorecards.cognitivLoadSurveyCompleted
-}
-
-violations[{"id": "SPACE-04", "message": "Collaboration index (cross-team PRs and shared ADRs) not computed — required for SPACE executive review"}] {
-    not input.satellite.scorecards.collaborationIndexComputed
-}
-
-violations[{"id": "SPACE-05", "message": "Executive sponsor not assigned or quarterly review not documented"}] {
-    not input.satellite.scorecards.executiveSponsorAssigned
-}
-
-violations[{"id": "DRIFT-01", "message": "Architecture Drift Index not measured or exceeds 10% threshold"}] {
-    input.satellite.scorecards.architectureDriftIndex > 10
-}

package/rulesets/opa/executive-scorecards.test.rego

@@ -1,60 +0,0 @@
-package evolith.executive_scorecards_test
-
-import data.evolith.executive_scorecards
-
-compliant_input := {"satellite": {"scorecards": {
-  "deploymentFrequencyDeclared": true,
-  "leadTimeDeclared": true,
-  "changeFailureRateDeclared": true,
-  "timeToRestoreDeclared": true,
-  "observabilityOperational": true,
-  "executiveSponsorAssigned": true,
-  "architectureDriftIndex": 5,
-}}}
-
-test_compliant_scorecards_has_no_violations {
-  violations := executive_scorecards.violations with input as compliant_input
-  count(violations) == 0
-}
-
-test_missing_deployment_frequency_is_rejected {
-  i := json.patch(compliant_input, [{"op": "replace", "path": "/satellite/scorecards/deploymentFrequencyDeclared", "value": false}])
-  violations := executive_scorecards.violations with input as i
-  violations[_].id == "DORA-01"
-}
-
-test_missing_lead_time_is_rejected {
-  i := json.patch(compliant_input, [{"op": "replace", "path": "/satellite/scorecards/leadTimeDeclared", "value": false}])
-  violations := executive_scorecards.violations with input as i
-  violations[_].id == "DORA-02"
-}
-
-test_missing_change_failure_rate_is_rejected {
-  i := json.patch(compliant_input, [{"op": "replace", "path": "/satellite/scorecards/changeFailureRateDeclared", "value": false}])
-  violations := executive_scorecards.violations with input as i
-  violations[_].id == "DORA-03"
-}
-
-test_missing_time_to_restore_is_rejected {
-  i := json.patch(compliant_input, [{"op": "replace", "path": "/satellite/scorecards/timeToRestoreDeclared", "value": false}])
-  violations := executive_scorecards.violations with input as i
-  violations[_].id == "DORA-04"
-}
-
-test_missing_observability_is_rejected {
-  i := json.patch(compliant_input, [{"op": "replace", "path": "/satellite/scorecards/observabilityOperational", "value": false}])
-  violations := executive_scorecards.violations with input as i
-  violations[_].id == "SPACE-01"
-}
-
-test_missing_executive_sponsor_is_rejected {
-  i := json.patch(compliant_input, [{"op": "replace", "path": "/satellite/scorecards/executiveSponsorAssigned", "value": false}])
-  violations := executive_scorecards.violations with input as i
-  violations[_].id == "SPACE-05"
-}
-
-test_drift_index_exceeding_threshold_is_rejected {
-  i := json.patch(compliant_input, [{"op": "replace", "path": "/satellite/scorecards/architectureDriftIndex", "value": 15}])
-  violations := executive_scorecards.violations with input as i
-  violations[_].id == "DRIFT-01"
-}

package/rulesets/opa/gitflow-branching.rego

@@ -1,41 +0,0 @@
-package evolith.gitflow_branching
-
-violations[{"id": "GIT-01", "message": "Branch name does not follow pattern: type/ticket-id-description"}] {
-    input.satellite.git.branchNameInvalid
-}
-
-violations[{"id": "GIT-02", "message": "Direct push to protected branch detected — all changes must come through PRs"}] {
-    input.satellite.git.directPushToProtectedBranch
-}
-
-violations[{"id": "GIT-03", "message": "PR merged without minimum 1 approved review"}] {
-    not input.satellite.git.prHasMinimumReview
-}
-
-violations[{"id": "GIT-04", "message": "Release tag does not follow semver format v{major}.{minor}.{patch}"}] {
-    input.satellite.git.releaseTagInvalid
-}
-
-violations[{"id": "GIT-05", "message": "Feature branches must merge via squash or rebase — merge commits that clutter history with intermediary commits are not allowed on protected branches"}] {
-    input.satellite.git.featureBranchMergeNotSquashOrRebase
-}
-
-violations[{"id": "GIT-06", "message": "Hotfix branch not following expedited merge path — hotfix/* must merge directly to main and back-merge to develop within the release cycle"}] {
-    input.satellite.git.hotfixNotExpeditedPath
-}
-
-violations[{"id": "GIT-07", "message": "Stale branch not deleted after merge — branches merged more than 7 days ago must be removed from remote"}] {
-    input.satellite.git.hasStaleBranchesAfterMerge
-}
-
-violations[{"id": "GIT-08", "message": "Commit message does not follow Conventional Commits format"}] {
-    input.satellite.git.commitMessageInvalid
-}
-
-violations[{"id": "GIT-09", "message": "Environment promotion does not follow develop→qa→uat→main sequence"}] {
-    input.satellite.git.promotionSequenceInvalid
-}
-
-violations[{"id": "GIT-10", "message": "PR into qa/uat/main/release/hotfix without minimum 2 approvals"}] {
-    not input.satellite.git.higherEnvPrHasTwoApprovals
-}

package/rulesets/opa/gitflow-branching.test.rego

@@ -1,60 +0,0 @@
-package evolith.gitflow_branching_test
-
-import data.evolith.gitflow_branching
-
-compliant_input := {"satellite": {"git": {
-  "branchNameInvalid": false,
-  "directPushToProtectedBranch": false,
-  "prHasMinimumReview": true,
-  "releaseTagInvalid": false,
-  "commitMessageInvalid": false,
-  "promotionSequenceInvalid": false,
-  "higherEnvPrHasTwoApprovals": true,
-}}}
-
-test_compliant_gitflow_has_no_violations {
-  violations := gitflow_branching.violations with input as compliant_input
-  count(violations) == 0
-}
-
-test_invalid_branch_name_is_rejected {
-  i := json.patch(compliant_input, [{"op": "replace", "path": "/satellite/git/branchNameInvalid", "value": true}])
-  violations := gitflow_branching.violations with input as i
-  violations[_].id == "GIT-01"
-}
-
-test_direct_push_to_protected_branch_is_rejected {
-  i := json.patch(compliant_input, [{"op": "replace", "path": "/satellite/git/directPushToProtectedBranch", "value": true}])
-  violations := gitflow_branching.violations with input as i
-  violations[_].id == "GIT-02"
-}
-
-test_pr_without_review_is_rejected {
-  i := json.patch(compliant_input, [{"op": "replace", "path": "/satellite/git/prHasMinimumReview", "value": false}])
-  violations := gitflow_branching.violations with input as i
-  violations[_].id == "GIT-03"
-}
-
-test_invalid_release_tag_is_rejected {
-  i := json.patch(compliant_input, [{"op": "replace", "path": "/satellite/git/releaseTagInvalid", "value": true}])
-  violations := gitflow_branching.violations with input as i
-  violations[_].id == "GIT-04"
-}
-
-test_invalid_commit_message_is_rejected {
-  i := json.patch(compliant_input, [{"op": "replace", "path": "/satellite/git/commitMessageInvalid", "value": true}])
-  violations := gitflow_branching.violations with input as i
-  violations[_].id == "GIT-08"
-}
-
-test_invalid_promotion_sequence_is_rejected {
-  i := json.patch(compliant_input, [{"op": "replace", "path": "/satellite/git/promotionSequenceInvalid", "value": true}])
-  violations := gitflow_branching.violations with input as i
-  violations[_].id == "GIT-09"
-}
-
-test_higher_env_pr_without_two_approvals_is_rejected {
-  i := json.patch(compliant_input, [{"op": "replace", "path": "/satellite/git/higherEnvPrHasTwoApprovals", "value": false}])
-  violations := gitflow_branching.violations with input as i
-  violations[_].id == "GIT-10"
-}

package/rulesets/opa/governance.rego

@@ -1,39 +0,0 @@
-package evolith.governance
-
-violations[{"id": "INH-01", "message": "Satellite contains a rulesets/ directory — inheriting from Core only is required"}] {
-    input.satellitePath != input.corePath
-    
-    # Check if "rulesets" is in satellite directories
-    dirs := {dir | dir := input.satellite.directories[_]}
-    dirs["rulesets"]
-}
-
-violations[{"id": "INH-02", "message": "Satellite coreRef.version must be a specific semver — 'latest' or unpinned references are prohibited"}] {
-    input.satellitePath != input.corePath
-    not input.satellite.contracts.coreVersionPinned
-}
-
-violations[{"id": "INH-03", "message": "Satellite governance version cannot be downgraded — downgrade requires Architecture Board exception with --force flag"}] {
-    input.satellitePath != input.corePath
-    input.satellite.contracts.governanceVersionDowngraded
-}
-
-violations[{"id": "INH-04", "message": "Satellite local ADRs must reference Core corpus — DECISIONS.md or local ADR registry with coreRef is required for extension decisions"}] {
-    input.satellitePath != input.corePath
-    files := {file | file := input.satellite.files[_]}
-    not files["DECISIONS.md"]
-    not input.satellite.contracts.hasLocalAdrRegistry
-}
-
-violations[{"id": "INH-05", "message": "Local ADR promotion to Core requires Architecture Board review artifact — no approval evidence found for this ADR promotion"}] {
-    input.satellitePath != input.corePath
-    input.satellite.contracts.hasAdrsAwaitingPromotion
-    not input.satellite.contracts.hasArchitectureBoardApproval
-}
-
-violations[{"id": "INH-06", "message": "Satellite missing DECISIONS.md in root directory"}] {
-    input.satellitePath != input.corePath
-
-    files := {file | file := input.satellite.files[_]}
-    not files["DECISIONS.md"]
-}

package/rulesets/opa/governance.test.rego

@@ -1,23 +0,0 @@
-package evolith.governance_test
-
-import data.evolith.governance
-
-test_satellite_without_rulesets_has_no_violations {
-  violations := governance.violations with input as {"satellitePath": "/satellite", "corePath": "/core", "satellite": {"directories": ["src", "docs"], "files": ["DECISIONS.md", "README.md"]}}
-  count(violations) == 0
-}
-
-test_satellite_with_rulesets_is_rejected {
-  violations := governance.violations with input as {"satellitePath": "/satellite", "corePath": "/core", "satellite": {"directories": ["rulesets", "src"], "files": ["DECISIONS.md"]}}
-  violations[_].id == "INH-01"
-}
-
-test_satellite_missing_decisions_md_is_rejected {
-  violations := governance.violations with input as {"satellitePath": "/satellite", "corePath": "/core", "satellite": {"directories": ["src"], "files": ["README.md"]}}
-  violations[_].id == "INH-06"
-}
-
-test_core_repo_is_exempt_from_inheritance_rules {
-  violations := governance.violations with input as {"satellitePath": "/core", "corePath": "/core", "satellite": {"directories": ["rulesets"], "files": []}}
-  count(violations) == 0
-}

package/rulesets/opa/hexagonal-architecture.rego

@@ -1,33 +0,0 @@
-package evolith.hexagonal_architecture
-
-violations[{"id": "HXA-01", "message": "Core (Domain) layer has framework imports — must be pure TypeScript only"}] {
-    input.satellite.layers.core.hasFrameworkImports
-}
-
-violations[{"id": "HXA-02", "message": "Application layer has infrastructure imports — may import Core and NestJS DI only"}] {
-    input.satellite.layers.application.hasInfrastructureImports
-}
-
-violations[{"id": "HXA-03", "message": "Infrastructure layer does not implement Core port interfaces"}] {
-    not input.satellite.layers.infrastructure.implementsPorts
-}
-
-violations[{"id": "HXA-04", "message": "Dependency direction violated — backward imports detected"}] {
-    input.satellite.layers.hasBackwardImports
-}
-
-violations[{"id": "HXA-05", "message": "AOP concerns found in Core/Application layers — prohibited"}] {
-    input.satellite.layers.core.hasAopDecorators
-}
-
-violations[{"id": "HXA-05", "message": "AOP concerns found in Core/Application layers — prohibited"}] {
-    input.satellite.layers.application.hasAopDecorators
-}
-
-violations[{"id": "HXA-06", "message": "AOP concerns (interceptors, decorators) must be implemented exclusively in Infrastructure layer — not in Core or Application"}] {
-    input.satellite.layers.infrastructure.aopNotInInfrastructure
-}
-
-violations[{"id": "HXA-07", "message": "Core domain tests require framework bootstrap — must run without framework"}] {
-    input.satellite.layers.core.domainTestsRequireBootstrap
-}

package/rulesets/opa/hexagonal-architecture.test.rego

@@ -1,57 +0,0 @@
-package evolith.hexagonal_architecture_test
-
-import data.evolith.hexagonal_architecture
-
-compliant_input := {"satellite": {"layers": {
-  "core": {"hasFrameworkImports": false, "hasAopDecorators": false, "domainTestsRequireBootstrap": false},
-  "application": {"hasInfrastructureImports": false, "hasAopDecorators": false},
-  "infrastructure": {"implementsPorts": true},
-  "hasBackwardImports": false,
-}}}
-
-test_compliant_hexagonal_has_no_violations {
-  violations := hexagonal_architecture.violations with input as compliant_input
-  count(violations) == 0
-}
-
-test_core_framework_imports_is_rejected {
-  i := json.patch(compliant_input, [{"op": "replace", "path": "/satellite/layers/core/hasFrameworkImports", "value": true}])
-  violations := hexagonal_architecture.violations with input as i
-  violations[_].id == "HXA-01"
-}
-
-test_application_infrastructure_imports_is_rejected {
-  i := json.patch(compliant_input, [{"op": "replace", "path": "/satellite/layers/application/hasInfrastructureImports", "value": true}])
-  violations := hexagonal_architecture.violations with input as i
-  violations[_].id == "HXA-02"
-}
-
-test_infrastructure_not_implementing_ports_is_rejected {
-  i := json.patch(compliant_input, [{"op": "replace", "path": "/satellite/layers/infrastructure/implementsPorts", "value": false}])
-  violations := hexagonal_architecture.violations with input as i
-  violations[_].id == "HXA-03"
-}
-
-test_backward_imports_is_rejected {
-  i := json.patch(compliant_input, [{"op": "replace", "path": "/satellite/layers/hasBackwardImports", "value": true}])
-  violations := hexagonal_architecture.violations with input as i
-  violations[_].id == "HXA-04"
-}
-
-test_aop_in_core_is_rejected {
-  i := json.patch(compliant_input, [{"op": "replace", "path": "/satellite/layers/core/hasAopDecorators", "value": true}])
-  violations := hexagonal_architecture.violations with input as i
-  violations[_].id == "HXA-05"
-}
-
-test_aop_in_application_is_rejected {
-  i := json.patch(compliant_input, [{"op": "replace", "path": "/satellite/layers/application/hasAopDecorators", "value": true}])
-  violations := hexagonal_architecture.violations with input as i
-  violations[_].id == "HXA-05"
-}
-
-test_domain_tests_requiring_bootstrap_is_rejected {
-  i := json.patch(compliant_input, [{"op": "replace", "path": "/satellite/layers/core/domainTestsRequireBootstrap", "value": true}])
-  violations := hexagonal_architecture.violations with input as i
-  violations[_].id == "HXA-07"
-}

package/rulesets/opa/infrastructure/helm-enforcement.rego

@@ -1,33 +0,0 @@
-package evolith.infrastructure.helm
-
-import rego.v1
-
-# INFRA-001: Helm Charts Over Raw Manifests Enforcement
-# Native counterpart: rulesets/infrastructure/helm-enforcement.rules.json
-# ADR ref: ADR-0076
-
-violations contains {"id": "INFRA-001", "message": msg} if {
-    file := input.infrastructure.kubernetesFiles[_]
-    not contains(file, "Chart.yaml")
-    not contains(file, "values.yaml")
-    not contains(file, "templates/")
-    endswith(file, ".yaml")
-    msg := sprintf("Raw Kubernetes manifest detected: %v — wrap in a Helm Chart (Chart.yaml required)", [file])
-}
-
-violations contains {"id": "INFRA-001", "message": "No Helm Chart.yaml found in Kubernetes infrastructure directory — all Kubernetes configs must use Helm"} if {
-    dirs := {d | d := input.infrastructure.directories[_]}
-    dirs["kubernetes"]
-    not any_chart_yaml
-}
-
-any_chart_yaml if {
-    file := input.infrastructure.kubernetesFiles[_]
-    contains(file, "Chart.yaml")
-}
-
-default allow := false
-
-allow if {
-    count(violations) == 0
-}

package/rulesets/opa/infrastructure/opa-sidecar-bundle.rego

@@ -1,42 +0,0 @@
-package evolith.infrastructure.opa_sidecar
-
-import rego.v1
-
-# INFRA-OPA-001: OPA Sidecar Bundle Integrity
-# Native counterpart: rulesets/infrastructure/opa-sidecar-bundle.rules.json
-
-violations contains {"id": "INFRA-OPA-001", "message": msg} if {
-    sidecar := input.infrastructure.opaSidecars[_]
-    not startswith(sidecar.bundleUrl, "https://")
-    msg := sprintf("OPA sidecar '%v' bundle URL must use HTTPS — unauthenticated transport prohibited", [sidecar.name])
-}
-
-violations contains {"id": "INFRA-OPA-001", "message": msg} if {
-    sidecar := input.infrastructure.opaSidecars[_]
-    not sidecar.credentialsFromSecret
-    msg := sprintf("OPA sidecar '%v' must source credentials from a Kubernetes Secret, not inline config", [sidecar.name])
-}
-
-violations contains {"id": "INFRA-OPA-001", "message": msg} if {
-    sidecar := input.infrastructure.opaSidecars[_]
-    not sidecar.bundleSignatureVerified
-    msg := sprintf("OPA sidecar '%v' does not verify bundle signatures — signed bundle verification is required", [sidecar.name])
-}
-
-violations contains {"id": "INFRA-OPA-001", "message": msg} if {
-    sidecar := input.infrastructure.opaSidecars[_]
-    not sidecar.bundleDigestPinned
-    msg := sprintf("OPA sidecar '%v' does not pin expected SHA-256 bundle digest — digest pinning required", [sidecar.name])
-}
-
-violations contains {"id": "INFRA-OPA-001", "message": msg} if {
-    sidecar := input.infrastructure.opaSidecars[_]
-    not sidecar.failClosedOnBundleLoad
-    msg := sprintf("OPA sidecar '%v' is not configured to fail-closed if bundle activation fails — readiness probe must block traffic until bundle is active", [sidecar.name])
-}
-
-default allow := false
-
-allow if {
-    count(violations) == 0
-}