@maycombhq/atticus 0.0.0-stage → 2.0.0-beta.11

package/dist/fixtures/forge/README.md

@@ -0,0 +1,19 @@
+# Forge: the invented test ecosystem
+
+Everything here is made up. Forge is an invented company and an invented in-house framework (`@ForgeService`, `@ForgeEndpoint`, `@ForgeClient`, ...); Northwind Pay is an invented vendor. Every stage of the Atticus build is tested against this ecosystem, because its correct answers are known in advance.
+
+| Folder | What it holds |
+| --- | --- |
+| `repos/forge-portal-ui` | A TypeScript SPA calling its BFF |
+| `repos/forge-portal-bff` | Plain Spring Boot: a controller, a Feign client through the gateway, a direct REST call, a Kafka publish, timeouts in config |
+| `repos/forge-ledger` | A service on the invented Forge framework: endpoints, a vendor client, event subscribe and publish, Flyway migrations, an OpenAPI spec |
+| `repos/forge-reports-job` | A batch job that reads the ledger's table directly and listens to an event |
+| `repos/forge-gateway` | A gateway proxy bundle (Apigee-style XML) with OAuth and spike-arrest policies |
+| `repos/forge-events` | Topic definitions with producers and consumers |
+| `repos/forge-infra` | Kubernetes deployments, Terraform for the database, alerts as code |
+| `inputs/` | The architect's draw.io diagram, wiki pages, a partner spec and sample ticket exports |
+| `expected/scan.yaml` | The catalog a correct scan must produce |
+| `expected/inputs.yaml` | What a correct read of the diagram and documents must produce |
+| `expected/discrepancies.yaml` | Thirteen seeded problems that reconcile, the critic, intake and knowledge-gap checks must each find |
+
+Rules: the expected files are written by hand and reviewed by a person; never regenerate them from extractor output. Files under `fixtures/` are byte-exact (excluded from formatting) because evidence points at line numbers and documents are hashed.

package/dist/fixtures/forge/expected/discrepancies.yaml

@@ -0,0 +1,54 @@
+# Seeded problems. Each later stage must find every one of these.
+# found_by: the feature that must report it.
+- id: d01-vendor-direct
+  found_by: reconcile
+  what: Diagram edge e4 says Ledger → Northwind Pay via the gateway (S.GW.VND); code calls the vendor directly.
+  refs: [if-e7344c9455608119]
+- id: d02-reports-reads-db
+  found_by: reconcile
+  what: Diagram edge e5 says Reports calls the Ledger API; code reads table ledger-db.entry directly (pattern D.JDBC, not S.GW.SOR).
+  refs: [ledger-db.entry]
+- id: d03-undocumented-audit
+  found_by: reconcile
+  what: Code-only edge Portal BFF → audit-svc is missing from the diagram.
+  refs: [if-5c55930b735276a9]
+- id: d04-undocumented-transfers-event
+  found_by: reconcile
+  what: Code-only edge ledger-api → reports-job (transfers.completed) is missing from the diagram.
+  refs: [if-f1cd1f189eaa4b7b]
+- id: d05-planned-notifications
+  found_by: reconcile
+  what: Diagram-only edge to Notifications Service is marked New; it becomes a planned-new interface in a change.
+  refs: []
+- id: d06-name-mismatch
+  found_by: reconcile
+  what: Diagram box "Ledger Platform" must be aliased to ledger-api before edges match.
+  refs: [ledger-api]
+- id: d07-pattern-typo
+  found_by: critic
+  what: Edge e5 uses unknown pattern code S.GW.SRO, a likely typo of S.GW.SOR.
+  refs: []
+- id: d08-unlabelled-hop
+  found_by: critic
+  what: Edge e1 (Portal UI → Portal BFF) has no pattern code.
+  refs: [if-f5c8b4b06d75284f]
+- id: d09-no-vendor-timeouts
+  found_by: knowledge-gap
+  what: No timeout or retry settings are known for ledger-api's Northwind client, so the vendor call can't be checked against S.GW.VND controls.
+  refs: [if-e7344c9455608119]
+- id: d10-no-reports-alerts
+  found_by: knowledge-gap
+  what: reports-job has no alert or dashboard definitions.
+  refs: [reports-job]
+- id: d11-audit-unknown-owner
+  found_by: knowledge-gap
+  what: audit-svc is known only from a caller; it has no repo, owner or spec.
+  refs: [audit-svc]
+- id: d12-doc-conflicts
+  found_by: intake
+  what: The ledger solution spec contradicts code twice (see inputs.yaml documentConflicts); code wins and the conflicts go to triage.
+  refs: [if-e7344c9455608119, ledger-db.entry]
+- id: d13-poor-story
+  found_by: critic
+  what: ADO story 102 ("Transfers") has no acceptance criteria.
+  refs: []

package/dist/fixtures/forge/expected/inputs.yaml

@@ -0,0 +1,38 @@
+# Expected results from reading fixtures/forge/inputs (diagram, wiki, partner spec).
+# Hand-written ground truth for the diagram ingestor, intake and pattern scan.
+
+# Edges the draw.io ingestor must read from inputs/diagrams/forge-context.drawio.
+diagramEdges:
+  - { cell: e1, from: Portal UI, to: Portal BFF, label: "", pattern: null }
+  - { cell: e2, from: Portal BFF, to: Ledger Platform, pattern: S.GW.SOR, method: GET, path: "/ledger/v1/accounts/{id}/balance" }
+  - { cell: e3, from: Portal BFF, to: Ledger Platform, pattern: S.GW.SOR, method: POST, path: /ledger/v1/transfers }
+  - { cell: e4, from: Ledger Platform, to: Northwind Pay, pattern: S.GW.VND, method: POST, path: /v2/payments }
+  - { cell: e5, from: Reports Job, to: Ledger Platform, pattern: S.GW.SRO, method: GET, path: /ledger/v1/entries }
+  - { cell: e6, from: Portal BFF, to: Ledger Platform, pattern: A.EB.PUB, topic: payments.initiated }
+  - { cell: e7, from: Portal BFF, to: Notifications Service, pattern: A.EB.PUB, topic: notifications.requested, legend: new }
+
+# Diagram names that need an alias to match catalog ids (found by name matching or a person).
+aliases:
+  Portal UI: portal-ui
+  Portal BFF: portal-bff
+  Ledger Platform: ledger-api
+  Reports Job: reports-job
+  Northwind Pay: northwind-pay
+  Notifications Service: null # planned, not in code yet
+
+# Pattern codes the pattern scan must find in inputs/wiki/integration-patterns.md.
+patterns: [S.GW.SOR, S.GW.VND, S.DIR.BFF, A.EB.PUB, D.JDBC]
+
+# Facts in documents that conflict with code (the document never overrides code).
+documentConflicts:
+  - doc: inputs/wiki/ledger-solution-spec.md
+    claim: Payments to Northwind Pay go out through the gateway
+    code: interface if-e7344c9455608119 is via direct
+  - doc: inputs/wiki/ledger-solution-spec.md
+    claim: Reports read entries through the Ledger API
+    code: reports-job reads table ledger-db.entry directly
+
+# Facts only documents give; they need an owner to confirm before they become asserted.
+documentOnlyFacts:
+  - { system: ledger, fact: "SLO 99.9% monthly availability", becomes: Obligation }
+  - { system: ledger, fact: "Peak load 200 requests per second", becomes: Obligation }

package/dist/fixtures/forge/expected/scan.yaml

@@ -0,0 +1,342 @@
+# Expected catalog from scanning fixtures/forge/repos plus the partner spec, once the
+# M1 extractors (OpenAPI, gateway, Spring) and the Forge dialect exist.
+# Hand-written ground truth. Do not generate it from extractor output.
+# Records omit `schemaVersion` and `status: current`; the test adds them.
+- kind: System
+  id: portal
+  confidence: verified
+  name: Portal
+  boundary: product
+  owner: team-portal
+  repos: [forge-portal-ui, forge-portal-bff]
+  evidence: [{ source: config, repo: forge-portal-bff, path: pom.xml }]
+- kind: System
+  id: ledger
+  confidence: verified
+  name: Ledger
+  boundary: product
+  owner: team-ledger
+  repos: [forge-ledger]
+  evidence: [{ source: config, repo: forge-ledger, path: forge.yaml, line: 3 }]
+- kind: System
+  id: reports
+  confidence: verified
+  name: Reports
+  boundary: product
+  owner: team-reports
+  repos: [forge-reports-job]
+  evidence: [{ source: code, repo: forge-reports-job, path: src/main/java/forge/reports/DailyEntriesJob.java }]
+- kind: System
+  id: audit
+  confidence: inferred
+  name: Audit
+  boundary: internal
+  evidence: [{ source: config, repo: forge-portal-bff, path: src/main/resources/application.yml, line: 4, side: caller }]
+- kind: System
+  id: northwind-pay
+  confidence: verified
+  name: Northwind Pay
+  boundary: vendor
+  evidence: [{ source: spec, path: inputs/partner-specs/northwind-pay-openapi.yaml, side: definition }]
+
+- kind: Component
+  id: portal-ui
+  confidence: verified
+  system: portal
+  repo: forge-portal-ui
+  type: spa
+  evidence: [{ source: config, repo: forge-portal-ui, path: package.json }]
+- kind: Component
+  id: portal-bff
+  confidence: verified
+  system: portal
+  repo: forge-portal-bff
+  type: spring-boot
+  runtime: kubernetes
+  evidence: [{ source: config, repo: forge-portal-bff, path: pom.xml }]
+- kind: Component
+  id: ledger-api
+  confidence: verified
+  system: ledger
+  repo: forge-ledger
+  type: forge-service
+  runtime: kubernetes
+  evidence: [{ source: config, repo: forge-ledger, path: forge.yaml, line: 2 }]
+- kind: Component
+  id: reports-job
+  confidence: verified
+  system: reports
+  repo: forge-reports-job
+  type: spring-batch
+  evidence: [{ source: code, repo: forge-reports-job, path: src/main/java/forge/reports/DailyEntriesJob.java }]
+- kind: Component
+  id: audit-svc
+  confidence: inferred
+  system: audit
+  type: service
+  evidence: [{ source: config, repo: forge-portal-bff, path: src/main/resources/application.yml, line: 4, side: caller }]
+
+- kind: Endpoint
+  id: portal-bff.get-balance
+  confidence: verified
+  component: portal-bff
+  endpointType: rest
+  method: GET
+  pathOrTopic: /api/balance/{accountId}
+  normalizedPath: /api/balance/{}
+  evidence: [{ source: code, repo: forge-portal-bff, path: src/main/java/forge/portal/BalanceController.java, line: 12, side: callee }]
+- kind: Endpoint
+  id: ledger-api.get-balance
+  confidence: verified
+  component: ledger-api
+  endpointType: rest
+  method: GET
+  pathOrTopic: /accounts/{id}/balance
+  normalizedPath: /accounts/{}/balance
+  auth: oauth2
+  evidence:
+    - { source: code, repo: forge-ledger, path: src/main/java/forge/ledger/LedgerEndpoints.java, line: 8, side: callee, dialect: forge@0.1.0 }
+    - { source: spec, repo: forge-ledger, path: api/ledger-openapi.yaml, line: 6, side: definition }
+- kind: Endpoint
+  id: ledger-api.post-transfer
+  confidence: verified
+  component: ledger-api
+  endpointType: rest
+  method: POST
+  pathOrTopic: /transfers
+  normalizedPath: /transfers
+  auth: oauth2
+  evidence:
+    - { source: code, repo: forge-ledger, path: src/main/java/forge/ledger/LedgerEndpoints.java, line: 11, side: callee, dialect: forge@0.1.0 }
+    - { source: spec, repo: forge-ledger, path: api/ledger-openapi.yaml, line: 14, side: definition }
+- kind: Endpoint
+  id: northwind-pay.post-payment
+  confidence: verified
+  component: northwind-pay
+  endpointType: rest
+  method: POST
+  pathOrTopic: /v2/payments
+  normalizedPath: /v2/payments
+  evidence: [{ source: spec, path: inputs/partner-specs/northwind-pay-openapi.yaml, line: 6, side: definition }]
+- kind: Endpoint
+  id: topic.payments-initiated
+  confidence: verified
+  component: portal-bff
+  endpointType: event-topic
+  pathOrTopic: payments.initiated
+  evidence: [{ source: event-config, repo: forge-events, path: topics/payments.initiated.yaml, line: 1, side: definition }]
+- kind: Endpoint
+  id: topic.transfers-completed
+  confidence: verified
+  component: ledger-api
+  endpointType: event-topic
+  pathOrTopic: transfers.completed
+  evidence: [{ source: event-config, repo: forge-events, path: topics/transfers.completed.yaml, line: 1, side: definition }]
+
+- kind: GatewayRoute
+  id: gw-ledger-v1
+  confidence: verified
+  proxy: ledger-v1
+  basepath: /ledger/v1
+  target: http://ledger-api.forge.internal
+  policies: [VerifyOAuth, SpikeArrest]
+  scopes: [ledger.read, ledger.write]
+  evidence:
+    - { source: gateway, repo: forge-gateway, path: proxies/ledger-v1/apiproxy/proxies/default.xml, line: 9, side: gateway }
+    - { source: gateway, repo: forge-gateway, path: proxies/ledger-v1/apiproxy/targets/ledger.xml, line: 3, side: gateway }
+
+- kind: Interface
+  id: if-f5c8b4b06d75284f
+  confidence: verified
+  from: portal-ui
+  to: portal-bff
+  endpoint: portal-bff.get-balance
+  via: direct
+  method: GET
+  normalizedPath: /api/balance/{}
+  sync: sync
+  pattern: { code: S.DIR.BFF, source: inferred }
+  evidence:
+    - { source: code, repo: forge-portal-ui, path: src/api/balance.ts, line: 3, side: caller }
+    - { source: code, repo: forge-portal-bff, path: src/main/java/forge/portal/BalanceController.java, line: 12, side: callee }
+- kind: Interface
+  id: if-75b5e8d8aa780837
+  confidence: verified
+  from: portal-bff
+  to: ledger-api
+  endpoint: ledger-api.get-balance
+  via: gateway
+  route: gw-ledger-v1
+  method: GET
+  normalizedPath: /accounts/{}/balance
+  auth: oauth2
+  sync: sync
+  pattern: { code: S.GW.SOR, source: inferred }
+  evidence:
+    - { source: code, repo: forge-portal-bff, path: src/main/java/forge/portal/LedgerClient.java, line: 8, side: caller }
+    - { source: gateway, repo: forge-gateway, path: proxies/ledger-v1/apiproxy/proxies/default.xml, line: 9, side: gateway }
+    - { source: code, repo: forge-ledger, path: src/main/java/forge/ledger/LedgerEndpoints.java, line: 8, side: callee, dialect: forge@0.1.0 }
+- kind: Interface
+  id: if-d99f508a2ac9b6e0
+  confidence: verified
+  from: portal-bff
+  to: ledger-api
+  endpoint: ledger-api.post-transfer
+  via: gateway
+  route: gw-ledger-v1
+  method: POST
+  normalizedPath: /transfers
+  auth: oauth2
+  sync: sync
+  pattern: { code: S.GW.SOR, source: inferred }
+  evidence:
+    - { source: code, repo: forge-portal-bff, path: src/main/java/forge/portal/LedgerClient.java, line: 11, side: caller }
+    - { source: gateway, repo: forge-gateway, path: proxies/ledger-v1/apiproxy/proxies/default.xml, line: 9, side: gateway }
+    - { source: code, repo: forge-ledger, path: src/main/java/forge/ledger/LedgerEndpoints.java, line: 11, side: callee, dialect: forge@0.1.0 }
+- kind: Interface
+  id: if-e7344c9455608119
+  confidence: verified
+  from: ledger-api
+  to: northwind-pay
+  endpoint: northwind-pay.post-payment
+  via: direct
+  method: POST
+  normalizedPath: /v2/payments
+  sync: sync
+  evidence:
+    - { source: code, repo: forge-ledger, path: src/main/java/forge/ledger/NorthwindClient.java, line: 8, side: caller, dialect: forge@0.1.0 }
+    - { source: spec, path: inputs/partner-specs/northwind-pay-openapi.yaml, line: 6, side: callee }
+- kind: Interface
+  id: if-5c55930b735276a9
+  confidence: inferred
+  from: portal-bff
+  to: audit-svc
+  via: direct
+  method: POST
+  normalizedPath: /audit/events
+  sync: sync
+  evidence: [{ source: code, repo: forge-portal-bff, path: src/main/java/forge/portal/AuditPublisher.java, line: 10, side: caller }]
+- kind: Interface
+  id: if-32d38aecd11b86b1
+  confidence: verified
+  from: portal-bff
+  to: ledger-api
+  endpoint: topic.payments-initiated
+  via: event-bus
+  normalizedPath: payments.initiated
+  sync: async
+  pattern: { code: A.EB.PUB, source: inferred }
+  evidence:
+    - { source: code, repo: forge-portal-bff, path: src/main/java/forge/portal/PaymentEvents.java, line: 11, side: caller }
+    - { source: event-config, repo: forge-events, path: topics/payments.initiated.yaml, line: 1, side: definition }
+    - { source: code, repo: forge-ledger, path: src/main/java/forge/ledger/LedgerEvents.java, line: 6, side: callee, dialect: forge@0.1.0 }
+- kind: Interface
+  id: if-f1cd1f189eaa4b7b
+  confidence: verified
+  from: ledger-api
+  to: reports-job
+  endpoint: topic.transfers-completed
+  via: event-bus
+  normalizedPath: transfers.completed
+  sync: async
+  pattern: { code: A.EB.PUB, source: inferred }
+  evidence:
+    - { source: code, repo: forge-ledger, path: src/main/java/forge/ledger/LedgerEvents.java, line: 9, side: caller, dialect: forge@0.1.0 }
+    - { source: event-config, repo: forge-events, path: topics/transfers.completed.yaml, line: 1, side: definition }
+    - { source: code, repo: forge-reports-job, path: src/main/java/forge/reports/DailyEntriesJob.java, line: 17, side: callee }
+
+- kind: DataStore
+  id: ledger-db
+  confidence: verified
+  storeType: postgresql
+  ownerComponent: ledger-api
+  entitiesHeld: [account, entry]
+  evidence:
+    - { source: infrastructure, repo: forge-infra, path: terraform/ledger-db.tf, line: 1 }
+    - { source: migration, repo: forge-ledger, path: src/main/resources/db/migration/V1__create_account.sql, line: 1 }
+- kind: Table
+  id: ledger-db.account
+  confidence: verified
+  dataStore: ledger-db
+  name: account
+  tableKind: table
+  ownerComponent: ledger-api
+  writers: [ledger-api]
+  readers: [ledger-api]
+  evidence: [{ source: migration, repo: forge-ledger, path: src/main/resources/db/migration/V1__create_account.sql, line: 1 }]
+- kind: Table
+  id: ledger-db.entry
+  confidence: verified
+  dataStore: ledger-db
+  name: entry
+  tableKind: table
+  ownerComponent: ledger-api
+  writers: [ledger-api]
+  readers: [ledger-api, reports-job]
+  evidence:
+    - { source: migration, repo: forge-ledger, path: src/main/resources/db/migration/V2__create_entry.sql, line: 1 }
+    - { source: code, repo: forge-reports-job, path: src/main/java/forge/reports/DailyEntriesJob.java, line: 14, side: caller }
+- { kind: Column, id: ledger-db.account.id, confidence: verified, table: ledger-db.account, name: id, type: bigint, nullable: false, evidence: [{ source: migration, repo: forge-ledger, path: src/main/resources/db/migration/V1__create_account.sql, line: 2 }] }
+- { kind: Column, id: ledger-db.account.account-number, confidence: verified, table: ledger-db.account, name: account_number, type: varchar(34), nullable: false, evidence: [{ source: migration, repo: forge-ledger, path: src/main/resources/db/migration/V1__create_account.sql, line: 3 }] }
+- { kind: Column, id: ledger-db.account.holder-name, confidence: verified, table: ledger-db.account, name: holder_name, type: varchar(200), nullable: false, evidence: [{ source: migration, repo: forge-ledger, path: src/main/resources/db/migration/V1__create_account.sql, line: 4 }] }
+- { kind: Column, id: ledger-db.entry.id, confidence: verified, table: ledger-db.entry, name: id, type: bigint, nullable: false, evidence: [{ source: migration, repo: forge-ledger, path: src/main/resources/db/migration/V2__create_entry.sql, line: 2 }] }
+- { kind: Column, id: ledger-db.entry.account-id, confidence: verified, table: ledger-db.entry, name: account_id, type: bigint, nullable: false, evidence: [{ source: migration, repo: forge-ledger, path: src/main/resources/db/migration/V2__create_entry.sql, line: 3 }] }
+- { kind: Column, id: ledger-db.entry.amount, confidence: verified, table: ledger-db.entry, name: amount, type: "numeric(18,2)", nullable: false, evidence: [{ source: migration, repo: forge-ledger, path: src/main/resources/db/migration/V2__create_entry.sql, line: 4 }] }
+- { kind: Column, id: ledger-db.entry.posted-at, confidence: verified, table: ledger-db.entry, name: posted_at, type: timestamp, nullable: false, evidence: [{ source: migration, repo: forge-ledger, path: src/main/resources/db/migration/V2__create_entry.sql, line: 5 }] }
+- { kind: IndexConstraint, id: ledger-db.account.pk, confidence: verified, table: ledger-db.account, constraintKind: primary-key, columns: [id], evidence: [{ source: migration, repo: forge-ledger, path: src/main/resources/db/migration/V1__create_account.sql, line: 2 }] }
+- { kind: IndexConstraint, id: ledger-db.entry.pk, confidence: verified, table: ledger-db.entry, constraintKind: primary-key, columns: [id], evidence: [{ source: migration, repo: forge-ledger, path: src/main/resources/db/migration/V2__create_entry.sql, line: 2 }] }
+- { kind: IndexConstraint, id: ledger-db.entry.fk-account, confidence: verified, table: ledger-db.entry, constraintKind: foreign-key, columns: [account_id], references: { table: ledger-db.account, columns: [id] }, evidence: [{ source: migration, repo: forge-ledger, path: src/main/resources/db/migration/V2__create_entry.sql, line: 3 }] }
+- { kind: IndexConstraint, id: ledger-db.entry.idx-entry-account, confidence: verified, table: ledger-db.entry, constraintKind: index, columns: [account_id], evidence: [{ source: migration, repo: forge-ledger, path: src/main/resources/db/migration/V2__create_entry.sql, line: 7 }] }
+- { kind: Migration, id: ledger-db.v1, confidence: verified, dataStore: ledger-db, version: "1", tool: flyway, file: src/main/resources/db/migration/V1__create_account.sql, operations: [create table account], evidence: [{ source: migration, repo: forge-ledger, path: src/main/resources/db/migration/V1__create_account.sql, line: 1 }] }
+- { kind: Migration, id: ledger-db.v2, confidence: verified, dataStore: ledger-db, version: "2", tool: flyway, file: src/main/resources/db/migration/V2__create_entry.sql, operations: [create table entry, create index idx_entry_account], evidence: [{ source: migration, repo: forge-ledger, path: src/main/resources/db/migration/V2__create_entry.sql, line: 1 }] }
+
+- kind: Deployment
+  id: ledger-api.prod
+  confidence: verified
+  component: ledger-api
+  env: prod
+  platform: kubernetes
+  replicas: 3
+  resources: { cpu: "1", memory: 1Gi }
+  evidence: [{ source: infrastructure, repo: forge-infra, path: k8s/ledger-api.yaml, line: 7 }]
+- kind: Deployment
+  id: portal-bff.prod
+  confidence: verified
+  component: portal-bff
+  env: prod
+  platform: kubernetes
+  replicas: 2
+  evidence: [{ source: infrastructure, repo: forge-infra, path: k8s/portal-bff.yaml, line: 7 }]
+- kind: Setting
+  id: portal-bff.ledger-read-timeout
+  confidence: verified
+  component: portal-bff
+  settingKind: timeout
+  key: ledger.client.read-timeout
+  valueOrRef: 2000ms
+  target: ledger-api
+  evidence: [{ source: config, repo: forge-portal-bff, path: src/main/resources/application.yml, line: 7 }]
+- kind: Setting
+  id: portal-bff.ledger-connect-timeout
+  confidence: verified
+  component: portal-bff
+  settingKind: timeout
+  key: ledger.client.connect-timeout
+  valueOrRef: 500ms
+  target: ledger-api
+  evidence: [{ source: config, repo: forge-portal-bff, path: src/main/resources/application.yml, line: 8 }]
+- kind: ObservabilityAsset
+  id: ledger-api.alert.error-rate
+  confidence: verified
+  component: ledger-api
+  assetKind: alert
+  name: Ledger API error rate
+  evidence: [{ source: infrastructure, repo: forge-infra, path: alerts/ledger-api.yaml, line: 3 }]
+- kind: AccessGrant
+  id: gw-ledger-v1.oauth-scopes
+  confidence: inferred
+  subjectKind: oauth-client
+  subject: portal-bff
+  resource: ledger-v1
+  scopesOrPermissions: [ledger.read, ledger.write]
+  evidence: [{ source: gateway, repo: forge-gateway, path: proxies/ledger-v1/apiproxy/policies/VerifyOAuth.xml, line: 3, side: gateway }]

package/dist/fixtures/forge/inputs/diagrams/forge-context.drawio

@@ -0,0 +1,23 @@
+<mxfile host="drawio">
+  <diagram id="ctx" name="Forge context (as the architect drew it)">
+    <mxGraphModel>
+      <root>
+        <mxCell id="0"/>
+        <mxCell id="1" parent="0"/>
+        <mxCell id="ui" value="Portal UI" style="rounded=1;" vertex="1" parent="1"/>
+        <mxCell id="bff" value="Portal BFF" style="rounded=1;" vertex="1" parent="1"/>
+        <mxCell id="ledger" value="Ledger Platform" style="rounded=1;" vertex="1" parent="1"/>
+        <mxCell id="reports" value="Reports Job" style="rounded=1;" vertex="1" parent="1"/>
+        <mxCell id="northwind" value="Northwind Pay" style="shape=cloud;" vertex="1" parent="1"/>
+        <mxCell id="notify" value="Notifications Service" style="rounded=1;dashed=1;legend=new;" vertex="1" parent="1"/>
+        <mxCell id="e1" value="" edge="1" source="ui" target="bff" parent="1"/>
+        <mxCell id="e2" value="S.GW.SOR GET /ledger/v1/accounts/{id}/balance" edge="1" source="bff" target="ledger" parent="1"/>
+        <mxCell id="e3" value="S.GW.SOR POST /ledger/v1/transfers" edge="1" source="bff" target="ledger" parent="1"/>
+        <mxCell id="e4" value="S.GW.VND POST /v2/payments" edge="1" source="ledger" target="northwind" parent="1"/>
+        <mxCell id="e5" value="S.GW.SRO GET /ledger/v1/entries" edge="1" source="reports" target="ledger" parent="1"/>
+        <mxCell id="e6" value="A.EB.PUB payments.initiated" edge="1" source="bff" target="ledger" parent="1"/>
+        <mxCell id="e7" value="A.EB.PUB notifications.requested" style="legend=new;" edge="1" source="bff" target="notify" parent="1"/>
+      </root>
+    </mxGraphModel>
+  </diagram>
+</mxfile>

package/dist/fixtures/forge/inputs/partner-specs/northwind-pay-openapi.yaml

@@ -0,0 +1,11 @@
+openapi: 3.0.3
+info:
+  title: Northwind Pay
+  version: "2.0"
+paths:
+  /v2/payments:
+    post:
+      operationId: createPayment
+      responses:
+        "202":
+          description: Accepted

package/dist/fixtures/forge/inputs/tickets/ado-stories.json

@@ -0,0 +1,4 @@
+[
+  { "id": 101, "type": "User Story", "title": "As a customer I can see my available balance", "acceptanceCriteria": "Given an account with holds, when I open the balance, then I see ledger balance minus holds.", "rating": "good" },
+  { "id": 102, "type": "User Story", "title": "Transfers", "acceptanceCriteria": "", "rating": "poor" }
+]

package/dist/fixtures/forge/inputs/tickets/closed-service-requests.json

@@ -0,0 +1,5 @@
+[
+  { "type": "network-firewall-rule", "number": "SR-0001", "fields": { "source": "ledger-api", "destination": "api.northwind.example", "port": 443 }, "opened": "2026-03-02", "closed": "2026-03-16", "approvalGroup": "network-team" },
+  { "type": "network-firewall-rule", "number": "SR-0002", "fields": { "source": "reports-job", "destination": "ledger-db.forge.internal", "port": 5432 }, "opened": "2026-04-06", "closed": "2026-04-17", "approvalGroup": "network-team" },
+  { "type": "gateway-route-review", "number": "SR-0003", "fields": { "proxy": "ledger-v1" }, "opened": "2026-02-10", "closed": "2026-02-13", "approvalGroup": "gateway-team" }
+]

package/dist/fixtures/forge/inputs/wiki/integration-patterns.md

@@ -0,0 +1,11 @@
+# Integration patterns
+
+Every hop on an architecture diagram carries one of these codes.
+
+| Code | Name | Interaction | Required controls |
+| --- | --- | --- | --- |
+| S.GW.SOR | Synchronous via the gateway to a system of record | sync | OAuth2 at the gateway, timeout under 3 s, circuit breaker |
+| S.GW.VND | Synchronous via the gateway to a vendor | sync | OAuth2 or mTLS at the gateway, timeout, retry with idempotency key |
+| S.DIR.BFF | Synchronous, direct from a UI to its own BFF | sync | Session auth |
+| A.EB.PUB | Asynchronous publish to the event bus | async | Schema in the registry, dead-letter topic |
+| D.JDBC | Direct database access | data-access | Read-only account, owner approval |

package/dist/fixtures/forge/inputs/wiki/ledger-solution-spec.md

@@ -0,0 +1,9 @@
+# Ledger Platform: solution spec
+
+Owner: Ledger team (ledger-team@forge.example)
+
+The Ledger Platform keeps accounts and entries. The portal reads balances and creates transfers through the gateway.
+Payments to Northwind Pay go out through the gateway (pattern S.GW.VND).
+Reports read entries through the Ledger API.
+
+Service level: 99.9% monthly availability. Peak load: 200 requests per second.

package/dist/fixtures/forge/inputs/wiki/snow-firewall-request.md

@@ -0,0 +1,4 @@
+# How to request a firewall rule
+
+Raise a "Network firewall rule" request in the service desk. Fields: source app, destination host, port, protocol, business justification, approver (network team).
+Typical lead time: 10 working days.

package/dist/fixtures/forge/metarepo/judgments/reaches/84af5b6af24f7ca8c23013f3.yaml

@@ -0,0 +1,17 @@
+# A judgment (ADR 0117): reaches, decided by avery. To override it, change verdict, set confirmedBy to { by: person, name: <your Git user> } and keep what it said under overrides; commit it for review.
+schemaVersion: 1
+kind: reaches
+key: 84af5b6af24f7ca8c23013f3
+verdict: gateway
+at: 2026-10-19T10:00:00Z
+confirmedBy:
+  by: person
+  name: avery
+inputs:
+  from: portal
+  sentence: The portal reads balances and creates transfers through the gateway.
+  to: ledger
+  v: 1
+quotes:
+  - of: sentence
+    text: through the gateway

package/dist/fixtures/forge/metarepo/judgments/reaches/c3917555edebddce8cecb647.yaml

@@ -0,0 +1,17 @@
+# A judgment (ADR 0117): reaches, decided by avery. To override it, change verdict, set confirmedBy to { by: person, name: <your Git user> } and keep what it said under overrides; commit it for review.
+schemaVersion: 1
+kind: reaches
+key: c3917555edebddce8cecb647
+verdict: api-only
+at: 2026-10-19T10:00:00Z
+confirmedBy:
+  by: person
+  name: avery
+inputs:
+  from: reports
+  sentence: Reports read entries through the Ledger API.
+  to: ledger
+  v: 1
+quotes:
+  - of: sentence
+    text: read entries through the Ledger API

package/dist/fixtures/forge/metarepo/judgments/reaches/c5fafd6601f8ca9e34e0bbd0.yaml

@@ -0,0 +1,17 @@
+# A judgment (ADR 0117): reaches, decided by avery. To override it, change verdict, set confirmedBy to { by: person, name: <your Git user> } and keep what it said under overrides; commit it for review.
+schemaVersion: 1
+kind: reaches
+key: c5fafd6601f8ca9e34e0bbd0
+verdict: gateway
+at: 2026-10-19T10:00:00Z
+confirmedBy:
+  by: person
+  name: avery
+inputs:
+  from: ledger
+  sentence: Payments to Northwind Pay go out through the gateway (pattern S.GW.VND).
+  to: northwind-pay
+  v: 1
+quotes:
+  - of: sentence
+    text: go out through the gateway

package/dist/fixtures/forge/metarepo/org-pack/agents/architecture-critic.yaml

@@ -0,0 +1,9 @@
+schemaVersion: 1
+id: architecture-critic
+role: architect
+description: Reviews interfaces and design against the catalog and the architecture checklist, looking for reasons they are wrong.
+inputs: [interfaces, design, data, catalog-slice, patterns, checklist]
+outputArtifact: findings
+checklist: forge-architecture
+tokenBudget: 80000
+allowedRuntimes: [hand-off, mock, replay]

package/dist/fixtures/forge/metarepo/org-pack/agents/story-writer.yaml

@@ -0,0 +1,10 @@
+# Contract C5 agent definition (fixture sample).
+schemaVersion: 1
+id: story-writer
+role: business-analyst
+description: Writes user stories with Given/When/Then acceptance criteria that trace to the brief and the spec scenarios.
+inputs: [brief, proposal, specs, design, catalog-slice]
+outputArtifact: stories
+checklist: forge-architecture
+tokenBudget: 60000
+allowedRuntimes: [hand-off, headless-claude-code, mock, replay]