@evolith/core-domain 1.0.1 → 1.0.3

package/rulesets/opa/multi-tenancy.test.rego

@@ -1,53 +0,0 @@
-package evolith.multi_tenancy_test
-
-import data.evolith.multi_tenancy
-
-compliant_input := {"satellite": {"multiTenancy": {
-  "applicationFiltering": true,
-  "databaseEnforcement": true,
-  "tenantContextPropagation": true,
-  "crossTenantAccess": false,
-  "schemaStrategyDefined": true,
-  "apiTenantValidation": true,
-}}}
-
-test_compliant_multi_tenancy_has_no_violations {
-  violations := multi_tenancy.violations with input as compliant_input
-  count(violations) == 0
-}
-
-test_missing_application_filtering_is_rejected {
-  i := json.patch(compliant_input, [{"op": "replace", "path": "/satellite/multiTenancy/applicationFiltering", "value": false}])
-  violations := multi_tenancy.violations with input as i
-  violations[_].id == "MTN-01"
-}
-
-test_missing_database_enforcement_is_rejected {
-  i := json.patch(compliant_input, [{"op": "replace", "path": "/satellite/multiTenancy/databaseEnforcement", "value": false}])
-  violations := multi_tenancy.violations with input as i
-  violations[_].id == "MTN-02"
-}
-
-test_missing_tenant_context_propagation_is_rejected {
-  i := json.patch(compliant_input, [{"op": "replace", "path": "/satellite/multiTenancy/tenantContextPropagation", "value": false}])
-  violations := multi_tenancy.violations with input as i
-  violations[_].id == "MTN-03"
-}
-
-test_cross_tenant_access_is_rejected {
-  i := json.patch(compliant_input, [{"op": "replace", "path": "/satellite/multiTenancy/crossTenantAccess", "value": true}])
-  violations := multi_tenancy.violations with input as i
-  violations[_].id == "MTN-04"
-}
-
-test_missing_schema_strategy_is_rejected {
-  i := json.patch(compliant_input, [{"op": "replace", "path": "/satellite/multiTenancy/schemaStrategyDefined", "value": false}])
-  violations := multi_tenancy.violations with input as i
-  violations[_].id == "MTN-05"
-}
-
-test_missing_api_tenant_validation_is_rejected {
-  i := json.patch(compliant_input, [{"op": "replace", "path": "/satellite/multiTenancy/apiTenantValidation", "value": false}])
-  violations := multi_tenancy.violations with input as i
-  violations[_].id == "MTN-08"
-}

package/rulesets/opa/open-core-boundary.rego

@@ -1,33 +0,0 @@
-package evolith.open_core_boundary
-
-violations[{"id": "OCB-01", "message": "Core rulesets/schemas reference commercial license, paid feature flag, or enterprise-only dependency"}] {
-    input.satellite.openCore.coreHasEnterpriseReferences
-}
-
-violations[{"id": "OCB-02", "message": "Enterprise-only artifact missing explicit 'availability: enterprise' metadata"}] {
-    input.satellite.openCore.enterpriseArtifactNotMarked
-}
-
-violations[{"id": "OCB-03", "message": "ACL implementation code found in Core — must be in Enterprise layer only"}] {
-    input.satellite.openCore.aclImplementationInCore
-}
-
-violations[{"id": "OCB-04", "message": "CLI/MCP implementation gated behind paid license — must remain fully open in Core"}] {
-    input.satellite.openCore.cliMcpGated
-}
-
-violations[{"id": "OCB-05", "message": "Tracker-specific concepts found in Core rulesets — Tracker features cannot penetrate Core"}] {
-    input.satellite.openCore.trackerConceptsInCore
-}
-
-violations[{"id": "OCB-06", "message": "Core reference corpus contains tiered access (premium/enterprise) — all standards must be equal"}] {
-    input.satellite.openCore.tieredAccessInCore
-}
-
-violations[{"id": "OCB-07", "message": "Enterprise feature promoted to Core without Architecture Board approval — promotion requires formal review and accepted ADR before Core inclusion"}] {
-    input.satellite.openCore.hasEnterprisePromotionWithoutApproval
-}
-
-violations[{"id": "OCB-08", "message": "Core rules require enterprise features to function — Core must be independently viable"}] {
-    input.satellite.openCore.coreRequiresEnterprise
-}

package/rulesets/opa/open-core-boundary.test.rego

@@ -1,60 +0,0 @@
-package evolith.open_core_boundary_test
-
-import data.evolith.open_core_boundary
-
-compliant_input := {"satellite": {"openCore": {
-  "coreHasEnterpriseReferences": false,
-  "enterpriseArtifactNotMarked": false,
-  "aclImplementationInCore": false,
-  "cliMcpGated": false,
-  "trackerConceptsInCore": false,
-  "tieredAccessInCore": false,
-  "coreRequiresEnterprise": false,
-}}}
-
-test_compliant_open_core_has_no_violations {
-  violations := open_core_boundary.violations with input as compliant_input
-  count(violations) == 0
-}
-
-test_core_enterprise_references_is_rejected {
-  i := json.patch(compliant_input, [{"op": "replace", "path": "/satellite/openCore/coreHasEnterpriseReferences", "value": true}])
-  violations := open_core_boundary.violations with input as i
-  violations[_].id == "OCB-01"
-}
-
-test_enterprise_artifact_not_marked_is_rejected {
-  i := json.patch(compliant_input, [{"op": "replace", "path": "/satellite/openCore/enterpriseArtifactNotMarked", "value": true}])
-  violations := open_core_boundary.violations with input as i
-  violations[_].id == "OCB-02"
-}
-
-test_acl_in_core_is_rejected {
-  i := json.patch(compliant_input, [{"op": "replace", "path": "/satellite/openCore/aclImplementationInCore", "value": true}])
-  violations := open_core_boundary.violations with input as i
-  violations[_].id == "OCB-03"
-}
-
-test_cli_mcp_gated_is_rejected {
-  i := json.patch(compliant_input, [{"op": "replace", "path": "/satellite/openCore/cliMcpGated", "value": true}])
-  violations := open_core_boundary.violations with input as i
-  violations[_].id == "OCB-04"
-}
-
-test_tracker_concepts_in_core_is_rejected {
-  i := json.patch(compliant_input, [{"op": "replace", "path": "/satellite/openCore/trackerConceptsInCore", "value": true}])
-  violations := open_core_boundary.violations with input as i
-  violations[_].id == "OCB-05"
-}
-
-test_tiered_access_in_core_is_rejected {
-  i := json.patch(compliant_input, [{"op": "replace", "path": "/satellite/openCore/tieredAccessInCore", "value": true}])
-  violations := open_core_boundary.violations with input as i
-  violations[_].id == "OCB-06"
-}
-
-test_core_requires_enterprise_is_rejected {
-  i := json.patch(compliant_input, [{"op": "replace", "path": "/satellite/openCore/coreRequiresEnterprise", "value": true}])
-  violations := open_core_boundary.violations with input as i
-  violations[_].id == "OCB-08"
-}

package/rulesets/opa/protocol-selection.rego

@@ -1,29 +0,0 @@
-package evolith.protocol_selection
-
-violations[{"id": "PROT-01", "message": "Internal service-to-service communication not using gRPC"}] {
-    input.satellite.protocol.internalServiceCallsNotGrpc
-}
-
-violations[{"id": "PROT-02", "message": "Public/external API not using REST"}] {
-    input.satellite.protocol.publicApiNotRest
-}
-
-violations[{"id": "PROT-04", "message": "GraphQL resolvers found in Core or Application layer — must be BFF only"}] {
-    input.satellite.protocol.graphqlInDomainLayer
-}
-
-violations[{"id": "PROT-05", "message": "Proto files not centralized in shared Contracts library"}] {
-    not input.satellite.protocol.protoCentralized
-}
-
-violations[{"id": "PROT-03", "message": "BFF must use REST as primary protocol. If GraphQL is used, it must be targeted only (not as general-purpose BFF API)"}] {
-    input.satellite.protocol.bffUsesGraphqlAsGeneral
-}
-
-violations[{"id": "PROT-06", "message": "File uploads and stream operations should prefer gRPC streaming over multipart REST — use gRPC for large binary payloads"}] {
-    input.satellite.protocol.fileUploadsNotGrpc
-}
-
-violations[{"id": "PROT-07", "message": "Breaking contract changes without version bump detected"}] {
-    input.satellite.protocol.breakingChangesWithoutVersionBump
-}

package/rulesets/opa/protocol-selection.test.rego

@@ -1,46 +0,0 @@
-package evolith.protocol_selection_test
-
-import data.evolith.protocol_selection
-
-compliant_input := {"satellite": {"protocol": {
-  "internalServiceCallsNotGrpc": false,
-  "publicApiNotRest": false,
-  "graphqlInDomainLayer": false,
-  "protoCentralized": true,
-  "breakingChangesWithoutVersionBump": false,
-}}}
-
-test_compliant_protocol_selection_has_no_violations {
-  violations := protocol_selection.violations with input as compliant_input
-  count(violations) == 0
-}
-
-test_internal_not_grpc_is_rejected {
-  i := json.patch(compliant_input, [{"op": "replace", "path": "/satellite/protocol/internalServiceCallsNotGrpc", "value": true}])
-  violations := protocol_selection.violations with input as i
-  violations[_].id == "PROT-01"
-}
-
-test_public_api_not_rest_is_rejected {
-  i := json.patch(compliant_input, [{"op": "replace", "path": "/satellite/protocol/publicApiNotRest", "value": true}])
-  violations := protocol_selection.violations with input as i
-  violations[_].id == "PROT-02"
-}
-
-test_graphql_in_domain_layer_is_rejected {
-  i := json.patch(compliant_input, [{"op": "replace", "path": "/satellite/protocol/graphqlInDomainLayer", "value": true}])
-  violations := protocol_selection.violations with input as i
-  violations[_].id == "PROT-04"
-}
-
-test_proto_not_centralized_is_rejected {
-  i := json.patch(compliant_input, [{"op": "replace", "path": "/satellite/protocol/protoCentralized", "value": false}])
-  violations := protocol_selection.violations with input as i
-  violations[_].id == "PROT-05"
-}
-
-test_breaking_changes_without_version_bump_is_rejected {
-  i := json.patch(compliant_input, [{"op": "replace", "path": "/satellite/protocol/breakingChangesWithoutVersionBump", "value": true}])
-  violations := protocol_selection.violations with input as i
-  violations[_].id == "PROT-07"
-}

package/rulesets/opa/rbac/gate-role-enforcement.rego

@@ -1,112 +0,0 @@
-package evolith.rbac.gate
-
-import future.keywords.if
-import future.keywords.contains
-
-# ---------------------------------------------------------------------------
-# GT-320 — Gate role enforcement
-#
-# Input schema:
-#   input.actor.roles         array of role strings (e.g. ["product_owner"])
-#   input.gate.accountableRole  string | null  — required role to approve
-#   input.gate.waiverAuthority  string | null  — required role to waive
-#   input.action              "approve" | "waive"
-#
-# Role hierarchy (mirrors ROLE_HIERARCHY in role.ts)
-# ---------------------------------------------------------------------------
-
-# admin and cto supersede every gate role
-superseding_roles := {"admin", "cto"}
-
-# Hierarchy expressed as: implied_by[required_role] = set of roles that satisfy it
-implied_by := {
-  "product_owner":    {"admin", "cto"},
-  "architect":        {"admin", "cto"},
-  "tech_lead":        {"admin", "cto", "architect"},
-  "qa_lead":          {"admin", "cto"},
-  "devops_lead":      {"admin", "cto"},
-  "developer":        {"admin", "cto", "architect", "tech_lead"},
-  "qa_engineer":      {"admin", "cto", "qa_lead"},
-  "devops_engineer":  {"admin", "cto", "devops_lead"},
-  "security_engineer": {"admin", "cto"},
-}
-
-# Map human-readable gate labels to canonical role values (mirrors GATE_ROLE_MAP)
-gate_role_map := {
-  "Product Owner":      "product_owner",
-  "Software Architect": "architect",
-  "Tech Lead":          "tech_lead",
-  "QA Lead":            "qa_lead",
-  "DevOps Lead":        "devops_lead",
-}
-
-# Resolve a gate label (or already-canonical string) to a canonical role string
-canonical_role(label) := role if {
-  role := gate_role_map[label]
-} else := label
-
-# Returns true when actor_role satisfies required_role (direct or via hierarchy)
-role_satisfies(actor_role, required) if { actor_role == required }
-role_satisfies(actor_role, required) if { actor_role in implied_by[required] }
-
-# ---------------------------------------------------------------------------
-# default deny
-# ---------------------------------------------------------------------------
-
-default allow := false
-
-# ---------------------------------------------------------------------------
-# approve
-# ---------------------------------------------------------------------------
-
-# Open gate — no accountableRole set
-allow if {
-  input.action == "approve"
-  not input.gate.accountableRole
-}
-
-allow if {
-  input.action == "approve"
-  input.gate.accountableRole != null
-  required := canonical_role(input.gate.accountableRole)
-  some actor_role in input.actor.roles
-  role_satisfies(actor_role, required)
-}
-
-# ---------------------------------------------------------------------------
-# waive
-# ---------------------------------------------------------------------------
-
-# Open gate — no waiverAuthority set
-allow if {
-  input.action == "waive"
-  not input.gate.waiverAuthority
-}
-
-allow if {
-  input.action == "waive"
-  input.gate.waiverAuthority != null
-  required := canonical_role(input.gate.waiverAuthority)
-  some actor_role in input.actor.roles
-  role_satisfies(actor_role, required)
-}
-
-# ---------------------------------------------------------------------------
-# Violation detail (used by tests / audit logs)
-# ---------------------------------------------------------------------------
-
-deny_reason := reason if {
-  not allow
-  input.action == "approve"
-  reason := sprintf(
-    "actor roles [%s] do not satisfy accountableRole '%s' for action 'approve'",
-    [concat(", ", input.actor.roles), input.gate.accountableRole],
-  )
-} else := reason if {
-  not allow
-  input.action == "waive"
-  reason := sprintf(
-    "actor roles [%s] do not satisfy waiverAuthority '%s' for action 'waive'",
-    [concat(", ", input.actor.roles), input.gate.waiverAuthority],
-  )
-}

package/rulesets/opa/repository-taxonomy.rego

@@ -1,98 +0,0 @@
-package evolith.repository_taxonomy
-
-# ---------------------------------------------------------------------------
-# TAX-01..04: Naming conventions (checked via source file analysis)
-# TAX-05..08, TAX-11: Structural checks (already implemented below)
-# TAX-09..10: Artifact placement checks
-# ---------------------------------------------------------------------------
-
-violations[{"id": "TAX-01", "message": msg}] {
-    file := input.repository.files[_]
-    name := split(file, "/")[count(split(file, "/")) - 1]
-    not endswith(name, ".md")
-    not endswith(name, ".json")
-    not endswith(name, ".yaml")
-    not endswith(name, ".yml")
-    not endswith(name, ".rego")
-    not endswith(name, ".ts")
-    not endswith(name, ".mjs")
-    not endswith(name, ".js")
-    regex.match(`[A-Z_\s]`, name)
-    msg := sprintf("File name does not use kebab-case: %v", [name])
-}
-
-violations[{"id": "TAX-02", "message": msg}] {
-    input.repository.naming.pascalCaseViolations > 0
-    msg := sprintf("Class/type names violate PascalCase convention (%d violations)", [input.repository.naming.pascalCaseViolations])
-}
-
-violations[{"id": "TAX-03", "message": msg}] {
-    input.repository.naming.camelCaseViolations > 0
-    msg := sprintf("Variable/function names violate camelCase convention (%d violations)", [input.repository.naming.camelCaseViolations])
-}
-
-violations[{"id": "TAX-04", "message": msg}] {
-    input.repository.naming.constantCaseViolations > 0
-    msg := sprintf("Constant names violate UPPER_SNAKE_CASE convention (%d violations)", [input.repository.naming.constantCaseViolations])
-}
-
-violations[{"id": "TAX-09", "message": msg}] {
-    input.repository.type == "core"
-    file := input.repository.files[_]
-    contains(file, "product-specific")
-    not startswith(file, "reference/knowledge/demo")
-    msg := sprintf("Product-specific artifact found in Core reference/: %v", [file])
-}
-
-violations[{"id": "TAX-10", "message": msg}] {
-    file := input.repository.files[_]
-    startswith(file, "reference/")
-    input.repository.productArtifacts[file]
-    msg := sprintf("Product-specific artifact must not be in reference/: %v (use docs/ or satellite repo)", [file])
-}
-
-violations[{"id": "TAX-05", "message": msg}] {
-    input.repository.type == "core"
-    expected := {"reference", "sdk", "rulesets"}
-    actual := {dir | dir := input.repository.directories[_]}
-    missing := expected - actual
-    count(missing) > 0
-    msg := sprintf("Core repository missing directories: %v", [concat(", ", missing)])
-}
-
-violations[{"id": "TAX-06", "message": msg}] {
-    input.repository.type == "satellite"
-    expected := {"src", "tests", "docs"}
-    actual := {dir | dir := input.repository.directories[_]}
-    missing := expected - actual
-    count(missing) > 0
-    msg := sprintf("Satellite repository missing directories: %v", [concat(", ", missing)])
-}
-
-is_valid_adr_name(name) {
-    regex.match(`^[0-9]{4}-[a-z0-9-]+\.md$`, name)
-}
-
-violations[{"id": "TAX-07", "message": msg}] {
-    adr := input.repository.adrs[_]
-    name := split(adr, "/")[count(split(adr, "/")) - 1]
-    not endswith(name, ".es.md")
-    not is_valid_adr_name(name)
-    msg := sprintf("ADR filename does not match pattern ^[0-9]{4}-[a-z-]+\\.md$: %v", [name])
-}
-
-violations[{"id": "TAX-08", "message": msg}] {
-    adr := input.repository.adrs[_]
-    name := split(adr, "/")[count(split(adr, "/")) - 1]
-    endswith(name, ".md")
-    not endswith(name, ".es.md")
-    es_name := replace(name, ".md", ".es.md")
-    adrs_set := {split(a, "/")[count(split(a, "/")) - 1] | a := input.repository.adrs[_]}
-    not adrs_set[es_name]
-    msg := sprintf("ADR missing bilingual pair: %v", [name])
-}
-
-violations[{"id": "TAX-11", "message": "Root-level topologies/ directory is prohibited"}] {
-    dir := input.repository.directories[_]
-    dir == "topologies"
-}

package/rulesets/opa/repository-taxonomy.test.rego

@@ -1,91 +0,0 @@
-package evolith.repository_taxonomy_test
-
-import data.evolith.repository_taxonomy
-
-test_core_with_required_dirs_has_no_violations {
-    violations := repository_taxonomy.violations with input as {
-        "repository": {
-            "type": "core",
-            "directories": ["reference", "sdk", "rulesets", "src"],
-            "adrs": ["reference/architecture/adrs/core/0001-monorepo-orchestration.md", "reference/architecture/adrs/core/0001-monorepo-orchestration.es.md"]
-        }
-    }
-    count(violations) == 0
-}
-
-test_core_missing_reference_dir_is_violation {
-    violations := repository_taxonomy.violations with input as {
-        "repository": {
-            "type": "core",
-            "directories": ["sdk", "rulesets"],
-            "adrs": []
-        }
-    }
-    violations[_].id == "TAX-05"
-}
-
-test_satellite_with_required_dirs_has_no_violations {
-    violations := repository_taxonomy.violations with input as {
-        "repository": {
-            "type": "satellite",
-            "directories": ["src", "tests", "docs"],
-            "adrs": []
-        }
-    }
-    count(violations) == 0
-}
-
-test_satellite_missing_dirs_is_violation {
-    violations := repository_taxonomy.violations with input as {
-        "repository": {
-            "type": "satellite",
-            "directories": ["src"],
-            "adrs": []
-        }
-    }
-    violations[_].id == "TAX-06"
-}
-
-test_adr_with_valid_name_has_no_violation {
-    violations := repository_taxonomy.violations with input as {
-        "repository": {
-            "type": "core",
-            "directories": ["reference", "sdk", "rulesets"],
-            "adrs": ["reference/architecture/adrs/core/0002-clean-architecture.md", "reference/architecture/adrs/core/0002-clean-architecture.es.md"]
-        }
-    }
-    count(violations) == 0
-}
-
-test_adr_invalid_name_is_violation {
-    violations := repository_taxonomy.violations with input as {
-        "repository": {
-            "type": "core",
-            "directories": ["reference", "sdk", "rulesets"],
-            "adrs": ["reference/architecture/adrs/core/invalid-adr-name.md"]
-        }
-    }
-    violations[_].id == "TAX-07"
-}
-
-test_adr_missing_bilingual_pair_is_violation {
-    violations := repository_taxonomy.violations with input as {
-        "repository": {
-            "type": "core",
-            "directories": ["reference", "sdk", "rulesets"],
-            "adrs": ["reference/architecture/adrs/core/0001-feature.md"]
-        }
-    }
-    violations[_].id == "TAX-08"
-}
-
-test_root_topologies_dir_is_violation {
-    violations := repository_taxonomy.violations with input as {
-        "repository": {
-            "type": "core",
-            "directories": ["reference", "sdk", "rulesets", "topologies"],
-            "adrs": []
-        }
-    }
-    violations[_].id == "TAX-11"
-}

package/rulesets/opa/satellite-contracts.rego

@@ -1,42 +0,0 @@
-package evolith.satellite_contracts
-
-violations[{"id": "SVC-01", "message": "evolith.yaml not found at repository root or multiple evolith.yaml files found"}] {
-    not input.satellite.contracts.hasEvolyamlAtRoot
-}
-
-violations[{"id": "SVC-03", "message": "F1 phase satellite must reference core/ADR-0047 in spec.compliance.adrRegistry"}] {
-    input.satellite.contracts.phase == "F1"
-    not input.satellite.contracts.hasAdr0047
-}
-
-violations[{"id": "SVC-04", "message": "F2/F3 satellite missing extraction readiness score documentation"}] {
-    input.satellite.contracts.phase == "F2"
-    not input.satellite.contracts.hasExtractionReadinessScore
-}
-
-violations[{"id": "SVC-04", "message": "F2/F3 satellite missing extraction readiness score documentation"}] {
-    input.satellite.contracts.phase == "F3"
-    not input.satellite.contracts.hasExtractionReadinessScore
-}
-
-violations[{"id": "SVC-05", "message": "Core version referenced does not exist in Evolith Core registry"}] {
-    not input.satellite.contracts.coreVersionExists
-}
-
-violations[{"id": "SVC-02", "message": "Satellite name must be unique across all registered Evolith satellites — name conflict detected in registry"}] {
-    not input.satellite.contracts.nameIsUnique
-}
-
-violations[{"id": "MIG-01", "message": "No documented upgrade path for satellite governance version — run 'evolith upgrade --target <version>' to document the upgrade procedure"}] {
-    input.satellite.contracts.needsGovernanceUpgrade
-    not input.satellite.contracts.upgradePathDocumented
-}
-
-violations[{"id": "MIG-02", "message": "Phase transition attempted without Architecture Board approval artifact"}] {
-    input.satellite.contracts.phaseTransitionWithoutApproval
-}
-
-violations[{"id": "MIG-03", "message": "Satellite deprecated without marking status in evolith.yaml"}] {
-    input.satellite.contracts.isDeprecated
-    not input.satellite.contracts.deprecatedStatusMarked
-}

package/rulesets/opa/satellite-contracts.test.rego

@@ -1,70 +0,0 @@
-package evolith.satellite_contracts_test
-
-import data.evolith.satellite_contracts
-
-compliant_f1_input := {"satellite": {"contracts": {
-  "hasEvolyamlAtRoot": true,
-  "phase": "F1",
-  "hasAdr0047": true,
-  "hasExtractionReadinessScore": false,
-  "coreVersionExists": true,
-  "phaseTransitionWithoutApproval": false,
-  "isDeprecated": false,
-  "deprecatedStatusMarked": false,
-}}}
-
-test_compliant_f1_satellite_has_no_violations {
-  violations := satellite_contracts.violations with input as compliant_f1_input
-  count(violations) == 0
-}
-
-test_missing_evolyaml_is_rejected {
-  i := json.patch(compliant_f1_input, [{"op": "replace", "path": "/satellite/contracts/hasEvolyamlAtRoot", "value": false}])
-  violations := satellite_contracts.violations with input as i
-  violations[_].id == "SVC-01"
-}
-
-test_f1_missing_adr0047_is_rejected {
-  i := json.patch(compliant_f1_input, [{"op": "replace", "path": "/satellite/contracts/hasAdr0047", "value": false}])
-  violations := satellite_contracts.violations with input as i
-  violations[_].id == "SVC-03"
-}
-
-test_f2_missing_extraction_readiness_is_rejected {
-  i := json.patch(compliant_f1_input, [
-    {"op": "replace", "path": "/satellite/contracts/phase", "value": "F2"},
-    {"op": "replace", "path": "/satellite/contracts/hasExtractionReadinessScore", "value": false},
-  ])
-  violations := satellite_contracts.violations with input as i
-  violations[_].id == "SVC-04"
-}
-
-test_f3_missing_extraction_readiness_is_rejected {
-  i := json.patch(compliant_f1_input, [
-    {"op": "replace", "path": "/satellite/contracts/phase", "value": "F3"},
-    {"op": "replace", "path": "/satellite/contracts/hasExtractionReadinessScore", "value": false},
-  ])
-  violations := satellite_contracts.violations with input as i
-  violations[_].id == "SVC-04"
-}
-
-test_core_version_not_found_is_rejected {
-  i := json.patch(compliant_f1_input, [{"op": "replace", "path": "/satellite/contracts/coreVersionExists", "value": false}])
-  violations := satellite_contracts.violations with input as i
-  violations[_].id == "SVC-05"
-}
-
-test_phase_transition_without_approval_is_rejected {
-  i := json.patch(compliant_f1_input, [{"op": "replace", "path": "/satellite/contracts/phaseTransitionWithoutApproval", "value": true}])
-  violations := satellite_contracts.violations with input as i
-  violations[_].id == "MIG-02"
-}
-
-test_deprecated_without_status_marked_is_rejected {
-  i := json.patch(compliant_f1_input, [
-    {"op": "replace", "path": "/satellite/contracts/isDeprecated", "value": true},
-    {"op": "replace", "path": "/satellite/contracts/deprecatedStatusMarked", "value": false},
-  ])
-  violations := satellite_contracts.violations with input as i
-  violations[_].id == "MIG-03"
-}

package/rulesets/opa/schemas/abac-mcp-tool-access.input.schema.json

@@ -1,21 +0,0 @@
-{
-  "$schema": "http://json-schema.org/draft-07/schema#",
-  "$id": "https://evolith.dev/schema/opa/abac-mcp-tool-access.input.schema.json",
-  "title": "ABAC MCP Tool Access OPA Policy Input Schema",
-  "type": "object",
-  "required": ["user", "tool_name", "environment"],
-  "properties": {
-    "user": {
-      "type": "object",
-      "required": ["id", "roles"],
-      "properties": {
-        "id": { "type": "string" },
-        "roles": { "type": "array", "items": { "type": "string" } },
-        "tenant": { "type": "string" }
-      }
-    },
-    "tool_name": { "type": "string" },
-    "resource_domain": { "type": "string" },
-    "environment": { "type": "string" }
-  }
-}