From a620ed3d950c7b6ed6392f820420d30a898957f5 Mon Sep 17 00:00:00 2001 From: aarroyo Date: Sun, 9 Aug 2026 22:52:41 -0500 Subject: [PATCH 1/9] =?UTF-8?q?Closes=20GT-668=20=E2=80=94=20the=20proof?= =?UTF-8?q?=20that=20a=20guard=20had=20been=20seen=20failing=20was=20pinne?= =?UTF-8?q?d=20to=20a=20branch,=20so=20it=20expired=20the=20day=20the=20fi?= =?UTF-8?q?x=20landed?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit GT-666's self-test kept one case that mattered more than the other eighteen: the guard checked against the REAL pre-fix artifact, not a sketch of one. Its comment says why, and it is right — «Reconstructed fixtures agree with whatever the author believed was wrong; this one cannot.» It got that artifact with `git show ${PRE_FIX_REF}:iso-5055-mapping.json`, and PRE_FIX_REF defaulted to origin/develop. True while the fix lived on a branch. 59d62bae merged, origin/develop began serving the CORRECTED artifact, and a case written to count 64 findings started counting 0 — green on its own branch, red the moment it mattered, blocking promotion PR #483. Reproduced on develop before anything was touched: 19 tests, 18 pass, `AssertionError: 0 !== 64`. The worse half is the one nobody would have seen. The case carried a shallow-clone escape — `if (before.status !== 0) return void assert.ok(true, 'SKIPPED: …')`. Under fetch-depth:1, a detached history, or a fork without origin/develop, the identical rot PASSES IN SILENCE. That is an escape hatch out of the one case establishing this guard has ever been OBSERVED failing rather than declared able to. So: keep the intent, freeze the evidence. The pre-fix mapping is committed at .harness/fixtures/standards-rule-class/iso-5055-mapping.pre-gt-666.json, taken from 01308346 (59d62bae^, blob 6684e8a4) — the fixtures home this repo already uses, not a new one. Not trimmed: all 412 rows, because trimming is an editorial act on a fixture whose whole value is that no author's belief touched it. One `_fixture` provenance key added (JSON has no comments) and the claim is checkable, not asserted — drop it, re-serialise, and the blob reproduces byte for byte. The git show, the env var and the skip are deleted. No replacement skip: a shallow clone constrains a test that shells out to git, not one that reads a file in its own tree, so an unreadable fixture is a real failure and red is correct. Assertions unchanged and unweakened — 64 findings, 16 of them `is classified governance`. One case ADDED, not relaxed: a fixture "refreshed" from the live mapping is RED, and that was observed rather than argued. Simulating the refresh turns 2 of 20 cases red, so the negative fixture cannot quietly become a copy of the artifact it exists to catch. Measured: node --test 20/20 pass, 0 skipped. 42 -> 78 guards classified, 57/57 refuse a zero-element scan. 43 -> 54/54 exercised guards turned red. core-domain clean rebuild, 157 suites / 1853 tests green. 01, 04, 09, 46 pass; ci-runner governance fails only on this commit's own PENDING closureCommit. No corpus file, no generator and no derived artifact touched — deliberately off build-iso-5055-mapping.mjs and iso-5055-mapping.json, where a parallel session is changing analyser.adoptable. That work moves neither ruleClass nor the pack rule count, so the frozen 64/16 figures are unaffected by it. Registered GT-668, not GT-667: GT-667 is claimed by branch name on two concurrent branches (gt-667-analyser-adoptable, claude/gt-667-iso5055-adoptable) carrying that follow-on. Guard 49 compares against origin/main and could not have seen either, so the id was taken by union of branches. Co-Authored-By: Claude Opus 5 --- .../iso-5055-mapping.pre-gt-666.json | 8501 +++++++++++++++++ .../65-validate-standards-rule-class.test.mjs | 70 +- .../evidence/gap-closure-evidence.json | 25 + .../gaps/gap-reference-catalog.es.md | 35 + .../gaps/gap-reference-catalog.md | 35 + .../control-center/gaps/gap-tracking.es.md | 3 +- .../core/control-center/gaps/gap-tracking.md | 3 +- .../maturity-reports/executive-summary.es.md | 6 +- .../maturity-reports/executive-summary.md | 6 +- .../maturity-reconciliation.json | 6 +- 10 files changed, 8663 insertions(+), 27 deletions(-) create mode 100644 .harness/fixtures/standards-rule-class/iso-5055-mapping.pre-gt-666.json diff --git a/.harness/fixtures/standards-rule-class/iso-5055-mapping.pre-gt-666.json b/.harness/fixtures/standards-rule-class/iso-5055-mapping.pre-gt-666.json new file mode 100644 index 000000000..b0c363752 --- /dev/null +++ b/.harness/fixtures/standards-rule-class/iso-5055-mapping.pre-gt-666.json @@ -0,0 +1,8501 @@ +{ + "_fixture": "FROZEN NEGATIVE FIXTURE — src/rulesets/standards/iso-5055-mapping.json exactly as committed BEFORE the GT-666 fix, taken verbatim from commit 0130834678599d7b7ba3f1295ee9ea4a7ee0e1bd (blob 6684e8a42e9d179d36c308a0cf22909c210a18e3); its 16 standards-pack rows still carry `ruleClass: \"governance\"`, which is the defect. It is evidence, not an artifact: DO NOT regenerate, refresh or reconcile it with the live mapping — copying the fixed mapping over this file turns the guard's only observed failure into a copy of the thing it is supposed to catch. Nothing below this line was edited; verify with `git cat-file blob 6684e8a42e9d179d36c308a0cf22909c210a18e3`. Read only by .harness/scripts/ci/65-validate-standards-rule-class.test.mjs.", + "$id": "https://evolith.dev/rulesets/standards/iso-5055-mapping.json", + "title": "Evolith ruleset corpus mapped to ISO/IEC 5055:2021", + "description": "One row per rule in the Evolith corpus: the ISO/IEC 5055 weakness it corresponds to (as CWE), or an explicit statement that it has no international equivalent, plus whether an existing standards-based analyser could already evaluate it. Generated by build-iso-5055-mapping.mjs — do not edit by hand.", + "version": "1.0.0", + "generatedBy": "src/rulesets/standards/build-iso-5055-mapping.mjs", + "gap": "GT-598", + "taxonomyNote": "ISO/IEC 25010:2023 (2nd edition) defines NINE product-quality characteristics: Functional suitability, Performance efficiency, Compatibility, Interaction capability (formerly Usability), Reliability, Security, Maintainability, Flexibility (formerly Portability) and Safety (new). ISO/IEC 5055 automates four of them: Reliability, Security, Performance efficiency and Maintainability. Any mapping to the 2011 eight-characteristic model is stale.", + "standard": { + "id": "ISO/IEC 5055:2021", + "title": "Information technology - Software measurement - Software quality measurement - Automated source code quality measures", + "weaknessCount": 138 + }, + "corpus": { + "rulesetFiles": 180, + "rules": 412, + "note": "Files that carry gate definitions or topology recommendations rather than conformance rules contribute no rows: architecture/topology-recommendation.rules.json and sdlc/phase-gates.rules.json." + }, + "summary": { + "rules": 412, + "mappedToIso5055": 37, + "mappedDirect": 8, + "mappedPartial": 29, + "noInternationalEquivalent": 375, + "adoptedFraction": 0.0898, + "analyserAdoptable": 42, + "analyserAdoptablePartial": 23, + "analyserAdoptableFraction": 0.1019, + "analyserAdoptableFractionIncludingPartial": 0.1578, + "byClass": { + "architecture-decision": { + "rules": 163, + "mapped": 12, + "adoptable": 6 + }, + "code-hygiene": { + "rules": 19, + "mapped": 2, + "adoptable": 8 + }, + "code-structure": { + "rules": 26, + "mapped": 18, + "adoptable": 13 + }, + "deployment": { + "rules": 2, + "mapped": 0, + "adoptable": 0 + }, + "governance": { + "rules": 71, + "mapped": 1, + "adoptable": 0 + }, + "operations": { + "rules": 4, + "mapped": 0, + "adoptable": 0 + }, + "platform-surface": { + "rules": 17, + "mapped": 0, + "adoptable": 0 + }, + "process": { + "rules": 34, + "mapped": 0, + "adoptable": 6 + }, + "supply-chain": { + "rules": 10, + "mapped": 0, + "adoptable": 7 + }, + "topology": { + "rules": 66, + "mapped": 4, + "adoptable": 2 + } + } + }, + "handlerBacklog": { + "source": "native-evaluability-snapshot.json", + "sourceAuthority": [ + "src/packages/core-domain/src/application/validators/rule-evaluability.ts (RULE_TRIAGE, classifyRule, ADR_CONFORMANCE_CATEGORY)", + "src/packages/core-domain/src/application/validators/evaluators/native-evaluator.ts (registered handler set)", + "src/packages/core-domain/src/application/validators/evaluators/handlers/**/*.ts (canHandle predicates)", + "src/packages/core-domain/test/rule-corpus-triage.ts (corpus loader, classification and this renderer)" + ], + "note": "The handler backlog is the `unimplemented-native` class only. `documentation-only` and `underspecified` rules are not handler work at all, and the two adapter classes are closed by the enforcer seam rather than by a rule handler.", + "realBacklogSize": 52, + "adoptableFromAnalyser": 5, + "adoptableFromAnalyserIncludingPartial": 10, + "adoptedFractionOfBacklog": 0.0962, + "adoptedFractionOfBacklogIncludingPartial": 0.1923, + "remainderToAuthor": 42, + "byEvaluabilityClass": { + "unimplemented-native": { + "rules": 52, + "mappedToIso5055": 6, + "analyserAdoptable": 5, + "analyserAdoptablePartial": 5, + "adoptableRuleIds": [ + "HXA-03", + "SEC-INJ-01", + "SEC-PATH-01", + "SEC-PATH-02", + "SEC-TIMING-01" + ], + "adoptablePartialRuleIds": [ + "CICD-01", + "CICD-02", + "MTN-01", + "SEC-INJ-02", + "SEC-TIMING-02" + ] + }, + "needs-external-system": { + "rules": 20, + "mappedToIso5055": 1, + "analyserAdoptable": 3, + "analyserAdoptablePartial": 0, + "adoptableRuleIds": [ + "CICD-03", + "GIT-01", + "GIT-04" + ], + "adoptablePartialRuleIds": [] + }, + "needs-runtime": { + "rules": 17, + "mappedToIso5055": 2, + "analyserAdoptable": 0, + "analyserAdoptablePartial": 0, + "adoptableRuleIds": [], + "adoptablePartialRuleIds": [] + }, + "documentation-only": { + "rules": 137, + "mappedToIso5055": 9, + "analyserAdoptable": 6, + "analyserAdoptablePartial": 7, + "adoptableRuleIds": [ + "CORE-0009-01", + "CORE-0049-01", + "CORE-0056-01", + "CORE-0092-01", + "CORE-0093-01", + "NODE-0003-01" + ], + "adoptablePartialRuleIds": [ + "CORE-0011-01", + "CORE-0014-01", + "CORE-0037-01", + "CORE-0071-01", + "CORE-0091-01", + "DOT-0065-01", + "NODE-0038-01" + ] + }, + "underspecified": { + "rules": 14, + "mappedToIso5055": 0, + "analyserAdoptable": 0, + "analyserAdoptablePartial": 0, + "adoptableRuleIds": [], + "adoptablePartialRuleIds": [] + }, + "native-handler": { + "rules": 170, + "mappedToIso5055": 19, + "analyserAdoptable": 28, + "analyserAdoptablePartial": 11, + "adoptableRuleIds": [ + "HXA-01", + "HXA-02", + "HXA-04", + "GIT-08", + "DOD-02", + "DOD-09", + "EM-D-01", + "EM-K-01", + "EM-S-01", + "EM-S-05", + "EM-Y-01", + "TAX-01", + "TAX-02", + "TAX-03", + "TAX-04", + "DEP-01", + "DEP-02", + "DEP-03", + "DEP-04", + "DEP-06", + "DEP-07", + "DEP-09", + "QT-01", + "QT-02", + "QT-03", + "QT-04", + "MM-R09", + "MM-R10" + ], + "adoptablePartialRuleIds": [ + "HXA-05", + "EM-D-02", + "EM-K-02", + "EM-S-03", + "EM-S-04", + "QT-08", + "SEC-RL-01", + "SEC-RL-02", + "AAI-R09", + "MM-R12", + "SV-R02" + ] + }, + "not-in-snapshot": { + "rules": 2, + "mappedToIso5055": 0, + "analyserAdoptable": 0, + "analyserAdoptablePartial": 0, + "adoptableRuleIds": [], + "adoptablePartialRuleIds": [] + } + } + }, + "rules": [ + { + "ruleId": "ACL-01", + "sourceFile": "acl/anti-corruption-layer.rules.json", + "title": "Schema Validation Before Ingestion", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "ACL-02", + "sourceFile": "acl/anti-corruption-layer.rules.json", + "title": "Transformation Traceability", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "ACL-03", + "sourceFile": "acl/anti-corruption-layer.rules.json", + "title": "Reject Non-Compliant Data", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "ACL-04", + "sourceFile": "acl/anti-corruption-layer.rules.json", + "title": "ACL Version Synchronization with Core", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "ACL-05", + "sourceFile": "acl/anti-corruption-layer.rules.json", + "title": "Explicit Contract Required", + "severity": "SHOULD", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "ACL-06", + "sourceFile": "acl/anti-corruption-layer.rules.json", + "title": "Isolate External Dependencies", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "HXA-01", + "sourceFile": "adr/adr-0002-hexagonal-architecture.rules.json", + "title": "Core (Domain) has zero framework dependencies", + "severity": "MUST", + "ruleClass": "code-structure", + "iso5055": { + "cwes": [ + 1054 + ], + "weaknesses": [ + "Invocation of a Control Element at an Unnecessarily Deep Horizontal Layer (Layer-skipping Call)" + ], + "measures": [ + "Maintainability" + ], + "strength": "partial" + }, + "analyser": { + "adoptable": "yes", + "examples": [ + "dependency-cruiser", + "ArchUnit", + "eslint-plugin-boundaries" + ] + }, + "nativeEvaluability": "native-handler", + "note": "Framework imports in the domain layer are a layering violation; 5055 models layering as the layer-skipping call." + }, + { + "ruleId": "HXA-02", + "sourceFile": "adr/adr-0002-hexagonal-architecture.rules.json", + "title": "Application layer imports Core only", + "severity": "MUST", + "ruleClass": "code-structure", + "iso5055": { + "cwes": [ + 1054 + ], + "weaknesses": [ + "Invocation of a Control Element at an Unnecessarily Deep Horizontal Layer (Layer-skipping Call)" + ], + "measures": [ + "Maintainability" + ], + "strength": "partial" + }, + "analyser": { + "adoptable": "yes", + "examples": [ + "dependency-cruiser", + "ArchUnit" + ] + }, + "nativeEvaluability": "native-handler", + "note": "Structural rule with no counterpart among the 138 weaknesses." + }, + { + "ruleId": "HXA-03", + "sourceFile": "adr/adr-0002-hexagonal-architecture.rules.json", + "title": "Infrastructure (Adapters) implements Core ports", + "severity": "MUST", + "ruleClass": "code-structure", + "iso5055": { + "cwes": [ + 1054 + ], + "weaknesses": [ + "Invocation of a Control Element at an Unnecessarily Deep Horizontal Layer (Layer-skipping Call)" + ], + "measures": [ + "Maintainability" + ], + "strength": "partial" + }, + "analyser": { + "adoptable": "yes", + "examples": [ + "dependency-cruiser", + "ArchUnit" + ] + }, + "nativeEvaluability": "unimplemented-native", + "note": "Structural rule with no counterpart among the 138 weaknesses." + }, + { + "ruleId": "HXA-04", + "sourceFile": "adr/adr-0002-hexagonal-architecture.rules.json", + "title": "Dependency direction: Infrastructure → Application → Core", + "severity": "MUST", + "ruleClass": "code-structure", + "iso5055": { + "cwes": [ + 1054, + 1047 + ], + "weaknesses": [ + "Invocation of a Control Element at an Unnecessarily Deep Horizontal Layer (Layer-skipping Call)", + "Modules with Circular Dependencies" + ], + "measures": [ + "Maintainability" + ], + "strength": "direct" + }, + "analyser": { + "adoptable": "yes", + "examples": [ + "dependency-cruiser no-circular + layer rules", + "ArchUnit layeredArchitecture()" + ] + }, + "nativeEvaluability": "native-handler", + "note": "Dependency direction is exactly what CWE-1054 and CWE-1047 measure." + }, + { + "ruleId": "HXA-05", + "sourceFile": "adr/adr-0002-hexagonal-architecture.rules.json", + "title": "AOP concerns prohibited in Core/Application layers", + "severity": "MUST NOT", + "ruleClass": "code-structure", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "partial", + "examples": [ + "ESLint no-restricted-imports" + ] + }, + "nativeEvaluability": "native-handler", + "note": "AOP placement is an Evolith convention; import bans approximate it." + }, + { + "ruleId": "HXA-06", + "sourceFile": "adr/adr-0002-hexagonal-architecture.rules.json", + "title": "AOP implemented exclusively in Infrastructure layer", + "severity": "MUST", + "ruleClass": "code-structure", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "unimplemented-native", + "note": "Structural rule with no counterpart among the 138 weaknesses." + }, + { + "ruleId": "HXA-07", + "sourceFile": "adr/adr-0002-hexagonal-architecture.rules.json", + "title": "Core domain tests run without framework bootstrap", + "severity": "MUST", + "ruleClass": "code-structure", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "needs-runtime", + "note": "A property of the test process, not of code structure." + }, + { + "ruleId": "CICD-01", + "sourceFile": "adr/adr-0005-cicd-quality-gates.rules.json", + "title": "CodeQL Static Analysis runs on every PR", + "severity": "MUST", + "ruleClass": "process", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "partial", + "examples": [ + "workflow inspection" + ] + }, + "nativeEvaluability": "unimplemented-native", + "note": "A property of the development process (pipeline, branch, review, test strategy), which is outside the scope of a source-code measure." + }, + { + "ruleId": "CICD-02", + "sourceFile": "adr/adr-0005-cicd-quality-gates.rules.json", + "title": "Dependency vulnerability scan blocks merge", + "severity": "MUST", + "ruleClass": "process", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "partial", + "examples": [ + "workflow inspection" + ] + }, + "nativeEvaluability": "unimplemented-native", + "note": "A property of the development process (pipeline, branch, review, test strategy), which is outside the scope of a source-code measure." + }, + { + "ruleId": "CICD-03", + "sourceFile": "adr/adr-0005-cicd-quality-gates.rules.json", + "title": "Secret detection enabled on repository", + "severity": "MUST", + "ruleClass": "process", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "yes", + "examples": [ + "gitleaks", + "trufflehog", + "GitHub secret scanning" + ] + }, + "nativeEvaluability": "needs-external-system", + "note": "A property of the development process (pipeline, branch, review, test strategy), which is outside the scope of a source-code measure." + }, + { + "ruleId": "CICD-04", + "sourceFile": "adr/adr-0005-cicd-quality-gates.rules.json", + "title": "All quality gates execute before merge", + "severity": "MUST", + "ruleClass": "process", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "needs-external-system", + "note": "A property of the development process (pipeline, branch, review, test strategy), which is outside the scope of a source-code measure." + }, + { + "ruleId": "CICD-05", + "sourceFile": "adr/adr-0005-cicd-quality-gates.rules.json", + "title": "Security findings documented with justification", + "severity": "MUST", + "ruleClass": "process", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "unimplemented-native", + "note": "A property of the development process (pipeline, branch, review, test strategy), which is outside the scope of a source-code measure." + }, + { + "ruleId": "CICD-06", + "sourceFile": "adr/adr-0005-cicd-quality-gates.rules.json", + "title": "Critical findings resolved within 24 hours", + "severity": "MUST", + "ruleClass": "process", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "needs-external-system", + "note": "A property of the development process (pipeline, branch, review, test strategy), which is outside the scope of a source-code measure." + }, + { + "ruleId": "CICD-07", + "sourceFile": "adr/adr-0005-cicd-quality-gates.rules.json", + "title": "High findings resolved within 72 hours", + "severity": "MUST", + "ruleClass": "process", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "needs-external-system", + "note": "A property of the development process (pipeline, branch, review, test strategy), which is outside the scope of a source-code measure." + }, + { + "ruleId": "MTN-01", + "sourceFile": "adr/adr-0010-multi-tenancy.rules.json", + "title": "Application-layer tenant filtering is primary", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [ + 1057 + ], + "weaknesses": [ + "Data Access Operations Outside of Expected Data Manager Component" + ], + "measures": [ + "Performance Efficiency", + "Security" + ], + "strength": "partial" + }, + "analyser": { + "adoptable": "partial", + "examples": [ + "CAST ASCPEM/ASCSM data-access-outside-manager" + ] + }, + "nativeEvaluability": "unimplemented-native", + "note": "Data access outside the expected data manager is the structural half of \"filtering happens in one layer\"." + }, + { + "ruleId": "MTN-02", + "sourceFile": "adr/adr-0010-multi-tenancy.rules.json", + "title": "Database-native tenant enforcement is secondary", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [ + 1057 + ], + "weaknesses": [ + "Data Access Operations Outside of Expected Data Manager Component" + ], + "measures": [ + "Performance Efficiency", + "Security" + ], + "strength": "partial" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "needs-external-system", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "MTN-03", + "sourceFile": "adr/adr-0010-multi-tenancy.rules.json", + "title": "Tenant context propagated through all layers", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "unimplemented-native", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "MTN-04", + "sourceFile": "adr/adr-0010-multi-tenancy.rules.json", + "title": "Cross-tenant data access prohibited", + "severity": "MUST NOT", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [ + 732 + ], + "weaknesses": [ + "Incorrect Permission Assignment for Critical Resource" + ], + "measures": [ + "Security" + ], + "strength": "partial" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "needs-runtime", + "note": "Cross-tenant reachability is a product invariant; no analyser knows what a tenant is here." + }, + { + "ruleId": "MTN-05", + "sourceFile": "adr/adr-0010-multi-tenancy.rules.json", + "title": "Multi-tenant schema strategy defined upfront", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "MTN-06", + "sourceFile": "adr/adr-0010-multi-tenancy.rules.json", + "title": "Tenant-scoped audit trail maintained", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "needs-runtime", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "MTN-07", + "sourceFile": "adr/adr-0010-multi-tenancy.rules.json", + "title": "Tenant migration path defined for schema changes", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "unimplemented-native", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "MTN-08", + "sourceFile": "adr/adr-0010-multi-tenancy.rules.json", + "title": "External APIs validate tenant context on every request", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "unimplemented-native", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "TPY-01", + "sourceFile": "adr/adr-0018-testing-pyramid.rules.json", + "title": "Test distribution follows 70/20/10 pyramid", + "severity": "MUST", + "ruleClass": "process", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "needs-runtime", + "note": "A property of the development process (pipeline, branch, review, test strategy), which is outside the scope of a source-code measure." + }, + { + "ruleId": "TPY-02", + "sourceFile": "adr/adr-0018-testing-pyramid.rules.json", + "title": "Unit tests dominate total test volume", + "severity": "MUST", + "ruleClass": "process", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "needs-runtime", + "note": "A property of the development process (pipeline, branch, review, test strategy), which is outside the scope of a source-code measure." + }, + { + "ruleId": "TPY-03", + "sourceFile": "adr/adr-0018-testing-pyramid.rules.json", + "title": "Integration tests use ephemeral containers", + "severity": "MUST", + "ruleClass": "process", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "unimplemented-native", + "note": "A property of the development process (pipeline, branch, review, test strategy), which is outside the scope of a source-code measure." + }, + { + "ruleId": "TPY-04", + "sourceFile": "adr/adr-0018-testing-pyramid.rules.json", + "title": "E2E tests cover full HTTP routes", + "severity": "MUST", + "ruleClass": "process", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "unimplemented-native", + "note": "A property of the development process (pipeline, branch, review, test strategy), which is outside the scope of a source-code measure." + }, + { + "ruleId": "TPY-05", + "sourceFile": "adr/adr-0018-testing-pyramid.rules.json", + "title": "Business logic coverage >= 80%", + "severity": "MUST", + "ruleClass": "process", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "needs-runtime", + "note": "A property of the development process (pipeline, branch, review, test strategy), which is outside the scope of a source-code measure." + }, + { + "ruleId": "TPY-06", + "sourceFile": "adr/adr-0018-testing-pyramid.rules.json", + "title": "Per-layer coverage thresholds enforced", + "severity": "MUST", + "ruleClass": "process", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "unimplemented-native", + "note": "A property of the development process (pipeline, branch, review, test strategy), which is outside the scope of a source-code measure." + }, + { + "ruleId": "TPY-07", + "sourceFile": "adr/adr-0018-testing-pyramid.rules.json", + "title": "Unit tests do not execute IO", + "severity": "MUST NOT", + "ruleClass": "process", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "needs-runtime", + "note": "A property of the development process (pipeline, branch, review, test strategy), which is outside the scope of a source-code measure." + }, + { + "ruleId": "PROT-01", + "sourceFile": "adr/adr-0032-protocol-selection.rules.json", + "title": "Internal service-to-service uses gRPC", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "needs-runtime", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "PROT-02", + "sourceFile": "adr/adr-0032-protocol-selection.rules.json", + "title": "Public and external APIs use REST", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "unimplemented-native", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "PROT-03", + "sourceFile": "adr/adr-0032-protocol-selection.rules.json", + "title": "BFF uses REST primary, GraphQL targeted", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "PROT-04", + "sourceFile": "adr/adr-0032-protocol-selection.rules.json", + "title": "GraphQL resolvers never in domain layer", + "severity": "MUST NOT", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "unimplemented-native", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "PROT-05", + "sourceFile": "adr/adr-0032-protocol-selection.rules.json", + "title": "Proto files centralized in Contracts library", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "unimplemented-native", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "PROT-06", + "sourceFile": "adr/adr-0032-protocol-selection.rules.json", + "title": "File uploads/streams prefer gRPC streaming", + "severity": "SHOULD", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "PROT-07", + "sourceFile": "adr/adr-0032-protocol-selection.rules.json", + "title": "Breaking changes require version bump", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "unimplemented-native", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "RUNT-01", + "sourceFile": "adr/adr-0040-multi-runtime.rules.json", + "title": "Runtime selected by workload profile only", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "unimplemented-native", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "RUNT-02", + "sourceFile": "adr/adr-0040-multi-runtime.rules.json", + "title": "Web APIs and BFF use Node.js/TypeScript", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "unimplemented-native", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "RUNT-03", + "sourceFile": "adr/adr-0040-multi-runtime.rules.json", + "title": "High compute and batch use .NET (C#)", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "unimplemented-native", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "RUNT-04", + "sourceFile": "adr/adr-0040-multi-runtime.rules.json", + "title": "Mobile with hardware access uses Android/Kotlin", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "unimplemented-native", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "RUNT-05", + "sourceFile": "adr/adr-0040-multi-runtime.rules.json", + "title": "Direct runtime dependency forbidden", + "severity": "MUST NOT", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "unimplemented-native", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "RUNT-06", + "sourceFile": "adr/adr-0040-multi-runtime.rules.json", + "title": "Synchronous inter-op uses gRPC", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "unimplemented-native", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "RUNT-07", + "sourceFile": "adr/adr-0040-multi-runtime.rules.json", + "title": "Asynchronous inter-op uses message broker", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "unimplemented-native", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "RUNT-08", + "sourceFile": "adr/adr-0040-multi-runtime.rules.json", + "title": "Contracts centrally stored and versioned", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "unimplemented-native", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "GIT-01", + "sourceFile": "adr/adr-0050-gitflow-branching.rules.json", + "title": "Branch names follow pattern: type/ticket-id-description", + "severity": "MUST", + "ruleClass": "process", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "yes", + "examples": [ + "branch-name regex in any CI" + ] + }, + "nativeEvaluability": "needs-external-system", + "note": "A property of the development process (pipeline, branch, review, test strategy), which is outside the scope of a source-code measure." + }, + { + "ruleId": "GIT-02", + "sourceFile": "adr/adr-0050-gitflow-branching.rules.json", + "title": "Protected branches enforce direct push prohibition", + "severity": "MUST", + "ruleClass": "process", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "needs-external-system", + "note": "A property of the development process (pipeline, branch, review, test strategy), which is outside the scope of a source-code measure." + }, + { + "ruleId": "GIT-03", + "sourceFile": "adr/adr-0050-gitflow-branching.rules.json", + "title": "PR requires minimum 1 approved review", + "severity": "MUST", + "ruleClass": "process", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "needs-external-system", + "note": "A property of the development process (pipeline, branch, review, test strategy), which is outside the scope of a source-code measure." + }, + { + "ruleId": "GIT-04", + "sourceFile": "adr/adr-0050-gitflow-branching.rules.json", + "title": "Release tags follow semver format", + "severity": "MUST", + "ruleClass": "process", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "yes", + "examples": [ + "semver tag regex" + ] + }, + "nativeEvaluability": "needs-external-system", + "note": "A property of the development process (pipeline, branch, review, test strategy), which is outside the scope of a source-code measure." + }, + { + "ruleId": "GIT-05", + "sourceFile": "adr/adr-0050-gitflow-branching.rules.json", + "title": "Feature branches merge via squash or rebase", + "severity": "MUST", + "ruleClass": "process", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "needs-external-system", + "note": "A property of the development process (pipeline, branch, review, test strategy), which is outside the scope of a source-code measure." + }, + { + "ruleId": "GIT-06", + "sourceFile": "adr/adr-0050-gitflow-branching.rules.json", + "title": "Hotfixes follow expedited merge path", + "severity": "MUST", + "ruleClass": "process", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "needs-external-system", + "note": "A property of the development process (pipeline, branch, review, test strategy), which is outside the scope of a source-code measure." + }, + { + "ruleId": "GIT-07", + "sourceFile": "adr/adr-0050-gitflow-branching.rules.json", + "title": "Stale branches must be deleted after merge", + "severity": "MUST NOT", + "ruleClass": "process", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "needs-external-system", + "note": "A property of the development process (pipeline, branch, review, test strategy), which is outside the scope of a source-code measure." + }, + { + "ruleId": "GIT-08", + "sourceFile": "adr/adr-0050-gitflow-branching.rules.json", + "title": "Commit messages follow Conventional Commits", + "severity": "MUST", + "ruleClass": "process", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "yes", + "examples": [ + "commitlint @commitlint/config-conventional" + ] + }, + "nativeEvaluability": "native-handler", + "note": "A property of the development process (pipeline, branch, review, test strategy), which is outside the scope of a source-code measure." + }, + { + "ruleId": "GIT-09", + "sourceFile": "adr/adr-0050-gitflow-branching.rules.json", + "title": "Environment promotion follows develop to qa to uat to main", + "severity": "MUST", + "ruleClass": "process", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "needs-external-system", + "note": "A property of the development process (pipeline, branch, review, test strategy), which is outside the scope of a source-code measure." + }, + { + "ruleId": "GIT-10", + "sourceFile": "adr/adr-0050-gitflow-branching.rules.json", + "title": "Higher environments require stronger approval", + "severity": "MUST", + "ruleClass": "process", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "needs-external-system", + "note": "A property of the development process (pipeline, branch, review, test strategy), which is outside the scope of a source-code measure." + }, + { + "ruleId": "CORE-0001-01", + "sourceFile": "adr/generated/adr-0001-monorepo-orchestration-principle.rules.json", + "title": "Conform to ADR-0001: Monorepo Orchestration Principle", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "CORE-0006-01", + "sourceFile": "adr/generated/adr-0006-microservices-transition-via-sidecar-pattern.rules.json", + "title": "Conform to ADR-0006: Microservices Transition via Sidecar Pattern", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "CORE-0009-01", + "sourceFile": "adr/generated/adr-0009-strict-dependency-pinning-and-automated-vulnerability-manage.rules.json", + "title": "Conform to ADR-0009: Strict Dependency Pinning and Automated Vulnerability Management", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "yes", + "examples": [ + "npm audit", + "OSV-Scanner", + "Renovate" + ] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "CORE-0011-01", + "sourceFile": "adr/generated/adr-0011-fault-tolerance-and-resiliency-patterns.rules.json", + "title": "Conform to ADR-0011: Fault Tolerance and Resiliency Patterns", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [ + 703, + 390 + ], + "weaknesses": [ + "Improper Check or Handling of Exceptional Conditions", + "Detection of Error Condition Without Action" + ], + "measures": [ + "Reliability" + ], + "strength": "partial" + }, + "analyser": { + "adoptable": "partial", + "examples": [ + "SonarQube empty-catch rules" + ] + }, + "nativeEvaluability": "documentation-only", + "note": "Resiliency ADR; the analysable part is exception handling that does nothing." + }, + { + "ruleId": "CORE-0013-01", + "sourceFile": "adr/generated/adr-0013-cloud-infrastructure-topology-and-disaster-recovery-dr.rules.json", + "title": "Honor design decision in ADR-0013: Cloud Infrastructure Topology and Disaster Recovery (DR)", + "severity": "SHOULD", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "CORE-0014-01", + "sourceFile": "adr/generated/adr-0014-multi-layer-distributed-caching-strategy.rules.json", + "title": "Conform to ADR-0014: Multi-Layer Distributed Caching Strategy", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [ + 1049, + 1067 + ], + "weaknesses": [ + "Excessive Data Query Operations in a Large Data Table", + "Excessive Execution of Sequential Searches of Data Resource" + ], + "measures": [ + "Maintainability", + "Performance Efficiency" + ], + "strength": "partial" + }, + "analyser": { + "adoptable": "partial", + "examples": [ + "CAST ASCPEM" + ] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "CORE-0015-01", + "sourceFile": "adr/generated/adr-0015-event-driven-architecture-eda-for-intra-domain-communication.rules.json", + "title": "Conform to ADR-0015: Event-Driven Architecture (EDA) for Intra-Domain Communication", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "CORE-0016-01", + "sourceFile": "adr/generated/adr-0016-immutable-business-audit-trail-and-change-tracking.rules.json", + "title": "Conform to ADR-0016: Immutable Business Audit Trail and Change Tracking", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "CORE-0017-01", + "sourceFile": "adr/generated/adr-0017-feature-flagging-strategy-for-progressive-delivery.rules.json", + "title": "Honor design decision in ADR-0017: Feature Flagging Strategy for Progressive Delivery", + "severity": "SHOULD", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "CORE-0019-01", + "sourceFile": "adr/generated/adr-0019-tactical-design-patterns-for-future-proofing.rules.json", + "title": "Conform to ADR-0019: Tactical Design Patterns for Future-Proofing", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "CORE-0020-01", + "sourceFile": "adr/generated/adr-0020-identity-provider-abstraction-strategy.rules.json", + "title": "Honor design decision in ADR-0020: Identity Provider Abstraction Strategy", + "severity": "SHOULD", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "CORE-0024-01", + "sourceFile": "adr/generated/adr-0024-centralized-configuration-feature-platform.rules.json", + "title": "Honor design decision in ADR-0024: Centralized Configuration & Feature Platform", + "severity": "SHOULD", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "CORE-0025-01", + "sourceFile": "adr/generated/adr-0025-feature-flag-provider-abstraction-strategy.rules.json", + "title": "Conform to ADR-0025: Feature Flag Provider Abstraction Strategy", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "CORE-0028-01", + "sourceFile": "adr/generated/adr-0028-self-hosted-open-source-hybrid-infrastructure.rules.json", + "title": "Conform to ADR-0028: Self-Hosted, Open-Source Hybrid Infrastructure", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "CORE-0030-01", + "sourceFile": "adr/generated/adr-0030-two-tier-distributed-gateway-model.rules.json", + "title": "Honor design decision in ADR-0030: Two-Tier Distributed Gateway Model", + "severity": "SHOULD", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "CORE-0031-01", + "sourceFile": "adr/generated/adr-0031-schema-per-bounded-context-and-domain-event-catalog.rules.json", + "title": "Conform to ADR-0031: Schema-per-Bounded-Context and Domain Event Catalog", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "CORE-0033-01", + "sourceFile": "adr/generated/adr-0033-transactional-outbox-pattern-for-async-messaging.rules.json", + "title": "Honor design decision in ADR-0033: Transactional Outbox Pattern for Async Messaging", + "severity": "SHOULD", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "CORE-0034-01", + "sourceFile": "adr/generated/adr-0034-cqrs-pattern-application-matrix.rules.json", + "title": "Conform to ADR-0034: CQRS Pattern Application Matrix", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "CORE-0035-01", + "sourceFile": "adr/generated/adr-0035-distributed-saga-pattern-implementation-strategy.rules.json", + "title": "Conform to ADR-0035: Distributed Saga Pattern Implementation Strategy", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "CORE-0036-01", + "sourceFile": "adr/generated/adr-0036-message-bus-delivery-flow-control-strategy.rules.json", + "title": "Conform to ADR-0036: Message Bus Delivery & Flow Control Strategy", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "CORE-0037-01", + "sourceFile": "adr/generated/adr-0037-enterprise-performance-concurrency-chaos-verification-strate.rules.json", + "title": "Honor design decision in ADR-0037: Enterprise Performance, Concurrency & Chaos Verification Strategy", + "severity": "SHOULD", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [ + 407, + 1050 + ], + "weaknesses": [ + "Algorithmic Complexity", + "Excessive Platform Resource Consumption within a Loop" + ], + "measures": [ + "Maintainability", + "Performance Efficiency" + ], + "strength": "partial" + }, + "analyser": { + "adoptable": "partial", + "examples": [ + "CAST ASCPEM" + ] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "CORE-0039-01", + "sourceFile": "adr/generated/adr-0039-deployment-topology-abstraction-environment-switcher.rules.json", + "title": "Conform to ADR-0039: Deployment Topology Abstraction & Environment Switcher", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "CORE-0041-01", + "sourceFile": "adr/generated/adr-0041-dual-engine-policy-evaluation-native-opa.rules.json", + "title": "Conform to ADR-0041: Dual-Engine Policy Evaluation (Native + OPA)", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "CORE-0044-01", + "sourceFile": "adr/generated/adr-0044-configurable-security-persistence-strategy-agnosticism-vs-na.rules.json", + "title": "Conform to ADR-0044: Configurable Security Persistence Strategy (Agnosticism vs. Native RLS)", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "CORE-0045-01", + "sourceFile": "adr/generated/adr-0045-microservice-extraction-readiness-criteria.rules.json", + "title": "Conform to ADR-0045: Microservice Extraction Readiness Criteria", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "CORE-0046-01", + "sourceFile": "adr/generated/adr-0046-unified-traceability-via-w3c-tracecontext.rules.json", + "title": "Conform to ADR-0046: Unified Traceability via W3C TraceContext", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "CORE-0047-01", + "sourceFile": "adr/generated/adr-0047-progressive-architecture-evolution-framework-modular-monolit.rules.json", + "title": "Conform to ADR-0047: Progressive Architecture Evolution Framework: Modular Monolith → Microservices", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "CORE-0048-01", + "sourceFile": "adr/generated/adr-0048-enterprise-taxonomy-standardization-and-reference-layout.rules.json", + "title": "Conform to ADR-0048: Enterprise Taxonomy Standardization and Reference Layout", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "CORE-0049-01", + "sourceFile": "adr/generated/adr-0049-naming-semantics-clean-code-policy-e2e-and-global.rules.json", + "title": "Conform to ADR-0049: Naming Semantics & Clean Code Policy (E2E and Global)", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "yes", + "examples": [ + "ESLint naming-convention", + "SonarQube naming rules" + ] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "CORE-0051-01", + "sourceFile": "adr/generated/adr-0051-enterprise-database-engine-selection-strategy.rules.json", + "title": "Conform to ADR-0051: Enterprise Database Engine Selection Strategy", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "CORE-0052-01", + "sourceFile": "adr/generated/adr-0052-unit-testing-isolation-strategy-mocks-vs-stubs.rules.json", + "title": "Conform to ADR-0052: Unit Testing Isolation Strategy (Mocks vs Stubs)", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "CORE-0053-01", + "sourceFile": "adr/generated/adr-0053-integration-and-e2e-testing-strategy.rules.json", + "title": "Conform to ADR-0053: Integration and E2E Testing Strategy", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "CORE-0054-01", + "sourceFile": "adr/generated/adr-0054-database-design-and-normalization-standards.rules.json", + "title": "Conform to ADR-0054: Database Design and Normalization Standards", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "CORE-0055-01", + "sourceFile": "adr/generated/adr-0055-microfrontends-architecture-strategy.rules.json", + "title": "Conform to ADR-0055: Microfrontends Architecture Strategy", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "CORE-0056-01", + "sourceFile": "adr/generated/adr-0056-enterprise-naming-design-conventions-multi-language-multi-pl.rules.json", + "title": "Conform to ADR-0056: Enterprise Naming & Design Conventions - Multi-Language, Multi-Platform", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "yes", + "examples": [ + "ESLint", + "Checkstyle", + "dotnet format" + ] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "CORE-0057-01", + "sourceFile": "adr/generated/adr-0057-architecture-intelligence-catalog.rules.json", + "title": "Honor design decision in ADR-0057: Architecture Intelligence Catalog", + "severity": "SHOULD", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "CORE-0058-01", + "sourceFile": "adr/generated/adr-0058-ai-consumable-architecture-knowledge.rules.json", + "title": "Honor design decision in ADR-0058: AI-Consumable Architecture Knowledge", + "severity": "SHOULD", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "CORE-0067-01", + "sourceFile": "adr/generated/adr-0067-modular-monolith-persistence-boundaries.rules.json", + "title": "Conform to ADR-0067: Modular Monolith Persistence Boundaries", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "CORE-0068-01", + "sourceFile": "adr/generated/adr-0068-documentation-release-gitflow.rules.json", + "title": "Conform to ADR-0068: Documentation Release GitFlow", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "CORE-0069-01", + "sourceFile": "adr/generated/adr-0069-ai-agent-context-protocol-integration.rules.json", + "title": "Honor design decision in ADR-0069: AI Agent Context Protocol Integration", + "severity": "SHOULD", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "CORE-0070-01", + "sourceFile": "adr/generated/adr-0070-lean-root-repository-taxonomy.rules.json", + "title": "Conform to ADR-0070: Lean Root Repository Taxonomy", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "CORE-0071-01", + "sourceFile": "adr/generated/adr-0071-domain-layer-base-class-and-inheritance-strategy.rules.json", + "title": "Conform to ADR-0071: Domain Layer Base Class and Inheritance Strategy", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [ + 1074, + 1086 + ], + "weaknesses": [ + "Class with Excessively Deep Inheritance", + "Class with Excessive Number of Child Classes" + ], + "measures": [ + "Maintainability" + ], + "strength": "partial" + }, + "analyser": { + "adoptable": "partial", + "examples": [ + "SonarQube inheritance metrics" + ] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "CORE-0072-01", + "sourceFile": "adr/generated/adr-0072-utc-date-storage-browser-timezone-detection-and-language-res.rules.json", + "title": "Conform to ADR-0072: UTC Date Storage, Browser Timezone Detection, and Language Resolution", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "CORE-0073-01", + "sourceFile": "adr/generated/adr-0073-unified-cli-mcp-output-contract-and-gate-evidence-schema.rules.json", + "title": "Conform to ADR-0073: Unified CLI/MCP Output Contract and Gate Evidence Schema", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "CORE-0074-01", + "sourceFile": "adr/generated/adr-0074-evolith-core-api-native-exposure-layer.rules.json", + "title": "Conform to ADR-0074: Evolith Core API Native Exposure Layer", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "CORE-0075-01", + "sourceFile": "adr/generated/adr-0075-core-api-authentication-strategy.rules.json", + "title": "Honor design decision in ADR-0075: Core API Authentication Strategy", + "severity": "SHOULD", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "CORE-0076-01", + "sourceFile": "adr/generated/adr-0076-domain-oriented-microservice-architecture-doma.rules.json", + "title": "Honor design decision in ADR-0076: Domain-Oriented Microservice Architecture (DOMA)", + "severity": "SHOULD", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "CORE-0077-01", + "sourceFile": "adr/generated/adr-0077-masstransit-v9-commercial-pivot-stay-on-v8-monitor-opentrans.rules.json", + "title": "Honor design decision in ADR-0077: MassTransit v9 Commercial Pivot — Stay on v8, Monitor OpenTransit", + "severity": "SHOULD", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "CORE-0078-01", + "sourceFile": "adr/generated/adr-0078-domain-financial-separation-governance.rules.json", + "title": "Conform to ADR-0078: Domain Financial Separation Governance", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "CORE-0079-01", + "sourceFile": "adr/generated/adr-0079-multi-topology-reference-corpus-and-topology-manifest-contra.rules.json", + "title": "Conform to ADR-0079: Multi-Topology Reference Corpus and Topology Manifest Contract", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "CORE-0080-01", + "sourceFile": "adr/generated/adr-0080-remote-repository-reference-contract.rules.json", + "title": "Conform to ADR-0080: Remote Repository Reference Contract", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "CORE-0081-01", + "sourceFile": "adr/generated/adr-0081-agentic-ai-sandbox-isolation-boundary.rules.json", + "title": "Conform to ADR-0081: Agentic AI Sandbox Isolation Boundary", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "CORE-0082-01", + "sourceFile": "adr/generated/adr-0082-agentic-ai-prompt-context-and-tool-trust-boundary.rules.json", + "title": "Honor design decision in ADR-0082: Agentic AI Prompt, Context, and Tool Trust Boundary", + "severity": "SHOULD", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "CORE-0083-01", + "sourceFile": "adr/generated/adr-0083-agentic-ai-action-authorization-and-audit.rules.json", + "title": "Conform to ADR-0083: Agentic AI Action Authorization and Audit", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "CORE-0084-01", + "sourceFile": "adr/generated/adr-0084-data-mesh-and-data-as-a-product.rules.json", + "title": "Conform to ADR-0084: Data Mesh and Data as a Product", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "CORE-0085-01", + "sourceFile": "adr/generated/adr-0085-agnostic-opa-wasm-distribution-architecture.rules.json", + "title": "Conform to ADR-0085: Agnostic OPA Wasm Distribution Architecture", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "CORE-0086-01", + "sourceFile": "adr/generated/adr-0086-agentic-ai-telemetry-cost-control-standard.rules.json", + "title": "Honor design decision in ADR-0086: Agentic AI Telemetry & Cost Control Standard", + "severity": "SHOULD", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "CORE-0087-01", + "sourceFile": "adr/generated/adr-0087-attribute-based-access-control-abac-for-agentic-tool-executi.rules.json", + "title": "Conform to ADR-0087: Attribute-Based Access Control (ABAC) for Agentic Tool Execution", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [ + 732 + ], + "weaknesses": [ + "Incorrect Permission Assignment for Critical Resource" + ], + "measures": [ + "Security" + ], + "strength": "partial" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "CORE-0088-01", + "sourceFile": "adr/generated/adr-0088-sovereign-identity-for-agentic-ai.rules.json", + "title": "Conform to ADR-0088: Sovereign Identity for Agentic AI", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "CORE-0089-01", + "sourceFile": "adr/generated/adr-0089-event-driven-agentic-workflow-pattern.rules.json", + "title": "Honor design decision in ADR-0089: Event-Driven Agentic Workflow Pattern", + "severity": "SHOULD", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "CORE-0090-01", + "sourceFile": "adr/generated/adr-0090-rag-knowledge-governance-standard.rules.json", + "title": "Conform to ADR-0090: RAG Knowledge Governance Standard", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "CORE-0091-01", + "sourceFile": "adr/generated/adr-0091-workload-identity-token-rotation-standard.rules.json", + "title": "Conform to ADR-0091: Workload Identity Token Rotation Standard", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [ + 798 + ], + "weaknesses": [ + "Use of Hard-coded Credentials" + ], + "measures": [ + "Security" + ], + "strength": "partial" + }, + "analyser": { + "adoptable": "partial", + "examples": [ + "gitleaks", + "CodeQL hardcoded credentials" + ] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "CORE-0092-01", + "sourceFile": "adr/generated/adr-0092-agent-infinite-loop-prevention-and-circuit-breaker-rules.rules.json", + "title": "Conform to ADR-0092: Agent Infinite Loop Prevention and Circuit Breaker Rules", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [ + 835 + ], + "weaknesses": [ + "Loop with Unreachable Exit Condition ('Infinite Loop')" + ], + "measures": [ + "Reliability", + "Security" + ], + "strength": "partial" + }, + "analyser": { + "adoptable": "yes", + "examples": [ + "SonarQube S2189 infinite loop", + "CodeQL js/loop-with-unreachable-exit" + ] + }, + "nativeEvaluability": "documentation-only", + "note": "The agent-loop ADR names circuit breakers; the code-level half is the unreachable-exit loop weakness." + }, + { + "ruleId": "CORE-0093-01", + "sourceFile": "adr/generated/adr-0093-concurrency-control-and-resource-locking-standard-for-mcp-to.rules.json", + "title": "Conform to ADR-0093: Concurrency Control and Resource Locking Standard for MCP Tools", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [ + 667 + ], + "weaknesses": [ + "Improper Locking" + ], + "measures": [ + "Reliability", + "Security" + ], + "strength": "partial" + }, + "analyser": { + "adoptable": "yes", + "examples": [ + "SonarQube locking rules", + "CodeQL concurrency queries" + ] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "CORE-0094-01", + "sourceFile": "adr/generated/adr-0094-multi-agent-handoff-and-task-delegation-standards.rules.json", + "title": "Conform to ADR-0094: Multi-Agent Handoff and Task Delegation Standards", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "CORE-0095-01", + "sourceFile": "adr/generated/adr-0095-serverless-architecture-governance.rules.json", + "title": "Conform to ADR-0095: Serverless Architecture Governance", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "CORE-0096-01", + "sourceFile": "adr/generated/adr-0096-edge-computing-architecture-governance.rules.json", + "title": "Conform to ADR-0096: Edge Computing Architecture Governance", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "CORE-0097-01", + "sourceFile": "adr/generated/adr-0097-knowledge-lifecycle-governance-standard.rules.json", + "title": "Conform to ADR-0097: Knowledge Lifecycle Governance Standard", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "CORE-0098-01", + "sourceFile": "adr/generated/adr-0098-rest-uri-versioning-and-deprecation-policy.rules.json", + "title": "Conform to ADR-0098: REST URI Versioning and Deprecation Policy", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "CORE-0099-01", + "sourceFile": "adr/generated/adr-0099-opa-bundle-distribution-via-s3-minio.rules.json", + "title": "Honor design decision in ADR-0099: OPA Bundle Distribution via S3 (MinIO)", + "severity": "SHOULD", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "CORE-0100-01", + "sourceFile": "adr/generated/adr-0100-governance-execution-boundary-producto-and-iniciativa-as-pri.rules.json", + "title": "Honor design decision in ADR-0100: Governance/Execution Boundary — Producto and Iniciativa as Primary Units, with Advisory Capability", + "severity": "SHOULD", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "CORE-0101-01", + "sourceFile": "adr/generated/adr-0101-evolith-core-as-a-stateless-evaluation-engine.rules.json", + "title": "Honor design decision in ADR-0101: Evolith Core as a Stateless Evaluation Engine", + "severity": "SHOULD", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "CORE-0102-01", + "sourceFile": "adr/generated/adr-0102-evolith-agent-runtime-as-a-decoupled-agentic-layer.rules.json", + "title": "Conform to ADR-0102: Evolith Agent Runtime as a Decoupled Agentic Layer", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "CORE-0103-01", + "sourceFile": "adr/generated/adr-0103-architecture-planning-gate-as-pre-discovery-intake.rules.json", + "title": "Conform to ADR-0103: Architecture Planning Gate as Pre-Discovery Intake", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "CORE-0104-01", + "sourceFile": "adr/generated/adr-0104-topology-driven-advisory-design-phase-governance-blueprint-a.rules.json", + "title": "Conform to ADR-0104: Topology-Driven Advisory Design-Phase Governance (Blueprint as Composable Development Guide)", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "CORE-0105-01", + "sourceFile": "adr/generated/adr-0105-okf-as-the-portable-projection-of-the-knowledge-os.rules.json", + "title": "Conform to ADR-0105: OKF as the Portable Projection of the Knowledge OS", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "CORE-0106-01", + "sourceFile": "adr/generated/adr-0106-master-tenant-and-context-projections.rules.json", + "title": "Honor design decision in ADR-0106: Master Tenant and Context Projections", + "severity": "SHOULD", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "CORE-0107-01", + "sourceFile": "adr/generated/adr-0107-single-cluster-kubernetes-deployment-topology-for-the-evolit.rules.json", + "title": "Conform to ADR-0107: Single-Cluster Kubernetes Deployment Topology for the Evolith Suite", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "CORE-0108-01", + "sourceFile": "adr/generated/adr-0108-masstransit-owns-the-message-topology-broker-crds-are-rbac-o.rules.json", + "title": "Honor design decision in ADR-0108: MassTransit Owns the Message Topology; Broker CRDs Are RBAC-Only", + "severity": "SHOULD", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "CORE-0109-01", + "sourceFile": "adr/generated/adr-0109-multi-project-satellite-governance-monorepo-satellites.rules.json", + "title": "Conform to ADR-0109: Multi-Project Satellite Governance (Monorepo Satellites)", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "CORE-0110-01", + "sourceFile": "adr/generated/adr-0110-stay-on-masstransit-v8-apache-2-0-v9-is-commercial-and-non-s.rules.json", + "title": "Conform to ADR-0110: Stay on MassTransit v8 (Apache-2.0); v9 Is Commercial and Non-Sublicensable", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "CORE-0111-01", + "sourceFile": "adr/generated/adr-0111-quality-signal-provider-port-external-evidence-via-adapters.rules.json", + "title": "Conform to ADR-0111: Quality Signal Provider Port — External Evidence via Adapters", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "CORE-0112-01", + "sourceFile": "adr/generated/adr-0112-rag-embedding-vector-store-platform-qwen3-embedding-on-pgvec.rules.json", + "title": "Honor design decision in ADR-0112: RAG Embedding & Vector-Store Platform (Qwen3-Embedding on pgvector)", + "severity": "SHOULD", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "CORE-0113-01", + "sourceFile": "adr/generated/adr-0113-node-js-platform-lighthouse-apache-2-0-as-the-reference-evid.rules.json", + "title": "Conform to ADR-0113: Node.js Platform — Lighthouse (Apache-2.0) as the Reference Evidence Adapter", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "CORE-0115-01", + "sourceFile": "adr/generated/adr-0115-emergent-knowledge-axis-knowledge-originated-by-applying-the.rules.json", + "title": "Conform to ADR-0115: Emergent Knowledge Axis — Knowledge Originated by Applying the Standard", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "CORE-0116-01", + "sourceFile": "adr/generated/adr-0116-canonical-finding-contract-and-an-executable-advisory-author.rules.json", + "title": "Conform to ADR-0116: Canonical Finding Contract and an Executable Advisory-Authority Boundary", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "CORE-0117-01", + "sourceFile": "adr/generated/adr-0117-bilingual-parity-applies-to-authored-sources-not-generated-p.rules.json", + "title": "Conform to ADR-0117: Bilingual Parity Applies to Authored Sources, Not Generated Projections", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "CORE-0118-01", + "sourceFile": "adr/generated/adr-0118-the-core-hub-has-its-own-root-taxonomy-distinct-from-satelli.rules.json", + "title": "Conform to ADR-0118: The Core Hub Has Its Own Root Taxonomy, Distinct From Satellites", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "CORE-0119-01", + "sourceFile": "adr/generated/adr-0119-api-security-configuration-hardening.rules.json", + "title": "Conform to ADR-0119: API Security Configuration Hardening", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "CORE-0120-01", + "sourceFile": "adr/generated/adr-0120-ssrf-prevention-standard.rules.json", + "title": "Honor design decision in ADR-0120: SSRF Prevention Standard", + "severity": "SHOULD", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "CORE-0121-01", + "sourceFile": "adr/generated/adr-0121-input-validation-and-sanitization-standard.rules.json", + "title": "Honor design decision in ADR-0121: Input Validation and Sanitization Standard", + "severity": "SHOULD", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "CORE-0122-01", + "sourceFile": "adr/generated/adr-0122-shell-execution-safety-standard.rules.json", + "title": "Conform to ADR-0122: Shell Execution Safety Standard", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "CORE-0123-01", + "sourceFile": "adr/generated/adr-0123-timing-safe-comparison-standard.rules.json", + "title": "Conform to ADR-0123: Timing-Safe Comparison Standard", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "CORE-0124-01", + "sourceFile": "adr/generated/adr-0124-credential-and-secret-management-standard.rules.json", + "title": "Conform to ADR-0124: Credential and Secret Management Standard", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "CORE-0125-01", + "sourceFile": "adr/generated/adr-0125-a-single-artifact-registry-keyed-by-slug.rules.json", + "title": "Conform to ADR-0125: A Single Artifact Registry, Keyed by Slug", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "AI-0001-01", + "sourceFile": "adr/generated/adr-ai-augmented-0001-harness-engineering-for-ai-augmented-development.rules.json", + "title": "Conform to ADR-0001: Harness Engineering for AI-Augmented Development", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "AI-0002-01", + "sourceFile": "adr/generated/adr-ai-augmented-0002-mcp-integration-protocol-for-agent-tool-invocation.rules.json", + "title": "Conform to ADR-0002: MCP Integration Protocol for Agent Tool Invocation", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "AI-0003-01", + "sourceFile": "adr/generated/adr-ai-augmented-0003-model-selection-governance-for-ai-augmented-workflows.rules.json", + "title": "Conform to ADR-0003: Model Selection Governance for AI-Augmented Workflows", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "AI-0004-01", + "sourceFile": "adr/generated/adr-ai-augmented-0004-agents-md-as-mandatory-repository-artifact.rules.json", + "title": "Conform to ADR-0004: AGENTS.md as Mandatory Repository Artifact", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "AI-0005-01", + "sourceFile": "adr/generated/adr-ai-augmented-0005-human-in-the-loop-policy-for-autonomous-agent-operations.rules.json", + "title": "Conform to ADR-0005: Human-in-the-Loop Policy for Autonomous Agent Operations", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "AI-0104-01", + "sourceFile": "adr/generated/adr-ai-augmented-0104-interaction-adapter-port-for-evolith-agent-runtime.rules.json", + "title": "Honor design decision in ADR-0104: Interaction Adapter Port for Evolith Agent Runtime", + "severity": "SHOULD", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "AND-0042-01", + "sourceFile": "adr/generated/adr-android-0042-canonical-android-native-mobile-architecture.rules.json", + "title": "Conform to ADR-0042: Canonical Android Native Mobile Architecture", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "DOT-0041-01", + "sourceFile": "adr/generated/adr-dotnet-0041-canonical-net-c-backend-architecture.rules.json", + "title": "Conform to ADR-0041: Canonical .NET (C#) Backend Architecture", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "DOT-0060-01", + "sourceFile": "adr/generated/adr-dotnet-0060-net-multi-tenancy-dual-layer-strategy-ef-core-sql-server.rules.json", + "title": "Conform to ADR-0060: .NET Multi-Tenancy Dual-Layer Strategy (EF Core & SQL Server)", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "DOT-0061-01", + "sourceFile": "adr/generated/adr-dotnet-0061-transactional-event-lifecycle-in-ef-core.rules.json", + "title": "Honor design decision in ADR-0061: Transactional Event Lifecycle in EF Core", + "severity": "SHOULD", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "DOT-0062-01", + "sourceFile": "adr/generated/adr-dotnet-0062-net-immutable-audit-trail-via-ddl-triggers-delta-capture.rules.json", + "title": "Conform to ADR-0062: .NET Immutable Audit Trail via DDL Triggers & Delta Capture", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "DOT-0063-01", + "sourceFile": "adr/generated/adr-dotnet-0063-b2b-request-idempotency-middleware-in-asp-net-core.rules.json", + "title": "Honor design decision in ADR-0063: B2B Request Idempotency Middleware in ASP.NET Core", + "severity": "SHOULD", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "DOT-0064-01", + "sourceFile": "adr/generated/adr-dotnet-0064-net-request-scope-observability-context-propagation.rules.json", + "title": "Conform to ADR-0064: .NET Request-Scope Observability Context Propagation", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "DOT-0065-01", + "sourceFile": "adr/generated/adr-dotnet-0065-net-pii-safe-structured-logging-pipeline-serilog.rules.json", + "title": "Conform to ADR-0065: .NET PII-Safe Structured Logging Pipeline (Serilog)", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "partial", + "examples": [ + "Semgrep PII-in-logs patterns" + ] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "DOT-0066-01", + "sourceFile": "adr/generated/adr-dotnet-0066-net-lightweight-http-idempotency-via-imemorycache-idistribut.rules.json", + "title": "Honor design decision in ADR-0066: .NET Lightweight HTTP Idempotency via IMemoryCache / IDistributedCache", + "severity": "SHOULD", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "DOT-0069-01", + "sourceFile": "adr/generated/adr-dotnet-0069-net-grpc-service-setup-protobuf-contracts.rules.json", + "title": "Conform to ADR-0069: .NET gRPC Service Setup & Protobuf Contracts", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "DOT-0070-01", + "sourceFile": "adr/generated/adr-dotnet-0070-net-api-endpoint-strategy.rules.json", + "title": "Conform to ADR-0070: .NET API Endpoint Strategy", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "DOT-0071-01", + "sourceFile": "adr/generated/adr-dotnet-0071-net-data-access-strategy-ef-core-as-default-orm-dapper-for-o.rules.json", + "title": "Honor design decision in ADR-0071: .NET Data Access Strategy — EF Core as Default ORM, Dapper for Optimized Reads", + "severity": "SHOULD", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "DOT-0072-01", + "sourceFile": "adr/generated/adr-dotnet-0072-net-aop-cross-cutting-concern-strategy-dispatchproxy-over-pi.rules.json", + "title": "Conform to ADR-0072: .NET AOP Cross-Cutting Concern Strategy — DispatchProxy over Pipeline Behaviors", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "NODE-0003-01", + "sourceFile": "adr/generated/adr-nodejs-0003-strict-typescript-standards.rules.json", + "title": "Conform to ADR-0003: Strict TypeScript Standards", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "yes", + "examples": [ + "tsc --strict", + "typescript-eslint strict config" + ] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "NODE-0004-01", + "sourceFile": "adr/generated/adr-nodejs-0004-frontend-offline-resilience.rules.json", + "title": "Honor design decision in ADR-0004: Frontend Offline Resilience", + "severity": "SHOULD", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "NODE-0007-01", + "sourceFile": "adr/generated/adr-nodejs-0007-observability-with-opentelemetry-loki-and-jaeger.rules.json", + "title": "Conform to ADR-0007: Observability with OpenTelemetry, Loki, and Jaeger", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "NODE-0008-01", + "sourceFile": "adr/generated/adr-nodejs-0008-progressive-multi-module-evolution-with-api-gateway-and-bff-.rules.json", + "title": "Honor design decision in ADR-0008: Progressive Multi-Module Evolution with API Gateway and BFF Patterns", + "severity": "SHOULD", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "NODE-0012-01", + "sourceFile": "adr/generated/adr-nodejs-0012-advanced-authorization-rbac-abac-strategy.rules.json", + "title": "Honor design decision in ADR-0012: Advanced Authorization (RBAC/ABAC) Strategy", + "severity": "SHOULD", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "NODE-0021-01", + "sourceFile": "adr/generated/adr-nodejs-0021-high-performance-authentication-graph-compilation.rules.json", + "title": "Honor design decision in ADR-0021: High-Performance Authentication Graph Compilation", + "severity": "SHOULD", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "NODE-0022-01", + "sourceFile": "adr/generated/adr-nodejs-0022-contextual-authentication-and-pluggable-output-projections.rules.json", + "title": "Honor design decision in ADR-0022: Contextual Authentication and Pluggable Output Projections", + "severity": "SHOULD", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "NODE-0023-01", + "sourceFile": "adr/generated/adr-nodejs-0023-centralized-authorization-core-strategy.rules.json", + "title": "Honor design decision in ADR-0023: Centralized Authorization Core Strategy", + "severity": "SHOULD", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "NODE-0026-01", + "sourceFile": "adr/generated/adr-nodejs-0026-adaptive-mfa-and-passwordless-platform.rules.json", + "title": "Honor design decision in ADR-0026: Adaptive MFA and Passwordless Platform", + "severity": "SHOULD", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "NODE-0027-01", + "sourceFile": "adr/generated/adr-nodejs-0027-dual-protocol-api-strategy-rest-grpc.rules.json", + "title": "Honor design decision in ADR-0027: Dual-Protocol API Strategy (REST & gRPC)", + "severity": "SHOULD", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "NODE-0029-01", + "sourceFile": "adr/generated/adr-nodejs-0029-adoption-of-tactical-ddd-primitives-library.rules.json", + "title": "Conform to ADR-0029: Adoption of Tactical DDD Primitives Library", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "NODE-0038-01", + "sourceFile": "adr/generated/adr-nodejs-0038-enterprise-error-handling-result-pattern-strategy.rules.json", + "title": "Conform to ADR-0038: Enterprise Error Handling & Result Pattern Strategy", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [ + 390, + 703 + ], + "weaknesses": [ + "Detection of Error Condition Without Action", + "Improper Check or Handling of Exceptional Conditions" + ], + "measures": [ + "Reliability" + ], + "strength": "partial" + }, + "analyser": { + "adoptable": "partial", + "examples": [ + "SonarQube empty-catch / ignored-return rules" + ] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "NODE-0043-01", + "sourceFile": "adr/generated/adr-nodejs-0043-data-access-and-orm-strategy-for-node-js.rules.json", + "title": "Conform to ADR-0043: Data Access and ORM Strategy for Node.js", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "NODE-0044-01", + "sourceFile": "adr/generated/adr-nodejs-0044-frontend-clean-architecture-layer-boundaries-react.rules.json", + "title": "Conform to ADR-0044: Frontend Clean Architecture Layer Boundaries (React)", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "NODE-0045-01", + "sourceFile": "adr/generated/adr-nodejs-0045-frontend-state-management-zustand-tanstack-query-dual-strate.rules.json", + "title": "Conform to ADR-0045: Frontend State Management — Zustand + TanStack Query Dual Strategy", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "NODE-0046-01", + "sourceFile": "adr/generated/adr-nodejs-0046-prohibition-of-raw-technical-identifiers-in-user-interfaces.rules.json", + "title": "Conform to ADR-0046: Prohibition of Raw Technical Identifiers in User Interfaces", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "NODE-0047-01", + "sourceFile": "adr/generated/adr-nodejs-0047-actionable-user-error-contract-and-correlated-diagnostics.rules.json", + "title": "Conform to ADR-0047: Actionable User Error Contract and Correlated Diagnostics", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "NODE-0048-01", + "sourceFile": "adr/generated/adr-nodejs-0048-feature-flag-system-scope-and-structured-criteria-model.rules.json", + "title": "Conform to ADR-0048: Feature Flag System Scope and Structured Criteria Model", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "NODE-0074-01", + "sourceFile": "adr/generated/adr-nodejs-0074-monorepo-orchestration-with-nx.rules.json", + "title": "Conform to ADR-0074: Monorepo Orchestration with Nx", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "NODE-0075-01", + "sourceFile": "adr/generated/adr-nodejs-0075-application-gateway-bff-with-nestjs.rules.json", + "title": "Conform to ADR-0075: Application Gateway (BFF) with NestJS", + "severity": "MUST", + "ruleClass": "architecture-decision", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "Conformance to a recorded architecture decision. ISO/IEC 5055 measures source structure, not whether a decision was honoured." + }, + { + "ruleId": "CLI-PAR-01", + "sourceFile": "cli/core-parity.rules.json", + "title": "Every Executable Core Rule Has a Parity Record", + "severity": "MUST", + "ruleClass": "platform-surface", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "unimplemented-native", + "note": "A CLI / MCP surface contract. Specific to this product; no standards analyser models it." + }, + { + "ruleId": "CLI-PAR-02", + "sourceFile": "cli/core-parity.rules.json", + "title": "CLI and MCP Must Use Shared Validation Logic", + "severity": "MUST", + "ruleClass": "platform-surface", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "unimplemented-native", + "note": "A CLI / MCP surface contract. Specific to this product; no standards analyser models it." + }, + { + "ruleId": "CLI-PAR-03", + "sourceFile": "cli/core-parity.rules.json", + "title": "Equivalent CLI and MCP Results Must Be Semantically Consistent", + "severity": "MUST", + "ruleClass": "platform-surface", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "needs-runtime", + "note": "A CLI / MCP surface contract. Specific to this product; no standards analyser models it." + }, + { + "ruleId": "CLI-PAR-04", + "sourceFile": "cli/core-parity.rules.json", + "title": "Parity Gaps Must Remain Visible", + "severity": "SHOULD", + "ruleClass": "platform-surface", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "unimplemented-native", + "note": "A CLI / MCP surface contract. Specific to this product; no standards analyser models it." + }, + { + "ruleId": "CLI-EXIT-01", + "sourceFile": "cli/exit-code-taxonomy.rules.json", + "title": "No CLI Command May Exit Outside The Published Taxonomy", + "severity": "MUST", + "ruleClass": "platform-surface", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "A CLI / MCP surface contract. Specific to this product; no standards analyser models it." + }, + { + "ruleId": "CLI-EXIT-02", + "sourceFile": "cli/exit-code-taxonomy.rules.json", + "title": "The Taxonomy Scan Must Be Non-Vacuous", + "severity": "MUST", + "ruleClass": "platform-surface", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "A CLI / MCP surface contract. Specific to this product; no standards analyser models it." + }, + { + "ruleId": "CLI-EXIT-03", + "sourceFile": "cli/exit-code-taxonomy.rules.json", + "title": "The Published Taxonomy Must Not Be Widened", + "severity": "MUST", + "ruleClass": "platform-surface", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "A CLI / MCP surface contract. Specific to this product; no standards analyser models it." + }, + { + "ruleId": "CLI-RR-01", + "sourceFile": "cli/release-readiness.rules.json", + "title": "TypeScript Build Must Pass", + "severity": "MUST", + "ruleClass": "platform-surface", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "A CLI / MCP surface contract. Specific to this product; no standards analyser models it." + }, + { + "ruleId": "CLI-RR-02", + "sourceFile": "cli/release-readiness.rules.json", + "title": "Unit and Integration Tests Must Start and Pass", + "severity": "MUST", + "ruleClass": "platform-surface", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "A CLI / MCP surface contract. Specific to this product; no standards analyser models it." + }, + { + "ruleId": "CLI-RR-03", + "sourceFile": "cli/release-readiness.rules.json", + "title": "Dependency Graph Must Be Reproducible", + "severity": "MUST", + "ruleClass": "platform-surface", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "A CLI / MCP surface contract. Specific to this product; no standards analyser models it." + }, + { + "ruleId": "CLI-RR-04", + "sourceFile": "cli/release-readiness.rules.json", + "title": "MCP Smoke Test Must Pass", + "severity": "MUST", + "ruleClass": "platform-surface", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "A CLI / MCP surface contract. Specific to this product; no standards analyser models it." + }, + { + "ruleId": "CLI-RR-05", + "sourceFile": "cli/release-readiness.rules.json", + "title": "Release Documentation Must Match Implementation", + "severity": "SHOULD", + "ruleClass": "platform-surface", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "A CLI / MCP surface contract. Specific to this product; no standards analyser models it." + }, + { + "ruleId": "CB-01", + "sourceFile": "cross-cutting/compliance-baseline.rules.json", + "title": "Technology selection respects Agnostic Baseline", + "severity": "MUST", + "ruleClass": "governance", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "A governance invariant over Evolith artifacts (inheritance, open-core boundary, satellites, evidence). No international structural equivalent." + }, + { + "ruleId": "CB-02", + "sourceFile": "cross-cutting/compliance-baseline.rules.json", + "title": "Product architecture traceable to Reference Blueprint", + "severity": "MUST", + "ruleClass": "governance", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "A governance invariant over Evolith artifacts (inheritance, open-core boundary, satellites, evidence). No international structural equivalent." + }, + { + "ruleId": "CB-03", + "sourceFile": "cross-cutting/compliance-baseline.rules.json", + "title": "Engineering Manifesto principles enforced", + "severity": "MUST", + "ruleClass": "governance", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "A governance invariant over Evolith artifacts (inheritance, open-core boundary, satellites, evidence). No international structural equivalent." + }, + { + "ruleId": "CB-04", + "sourceFile": "cross-cutting/compliance-baseline.rules.json", + "title": "Definition of Done satisfied before story closure", + "severity": "MUST", + "ruleClass": "governance", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "A governance invariant over Evolith artifacts (inheritance, open-core boundary, satellites, evidence). No international structural equivalent." + }, + { + "ruleId": "CB-05", + "sourceFile": "cross-cutting/compliance-baseline.rules.json", + "title": "Repository structure follows Taxonomy", + "severity": "MUST", + "ruleClass": "governance", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "A governance invariant over Evolith artifacts (inheritance, open-core boundary, satellites, evidence). No international structural equivalent." + }, + { + "ruleId": "CB-VAL-01", + "sourceFile": "cross-cutting/compliance-baseline.rules.json", + "title": "All 5 baseline pillars must be present in evolith.yaml spec.compliance", + "severity": "MUST", + "ruleClass": "governance", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "A governance invariant over Evolith artifacts (inheritance, open-core boundary, satellites, evidence). No international structural equivalent." + }, + { + "ruleId": "CB-VAL-02", + "sourceFile": "cross-cutting/compliance-baseline.rules.json", + "title": "Baseline references must point to existing Evolith Core documents", + "severity": "MUST", + "ruleClass": "governance", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "A governance invariant over Evolith artifacts (inheritance, open-core boundary, satellites, evidence). No international structural equivalent." + }, + { + "ruleId": "DOD-01", + "sourceFile": "cross-cutting/definition-of-done.rules.json", + "title": "Code implemented and reviewed", + "severity": "MUST", + "ruleClass": "process", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "A property of the development process (pipeline, branch, review, test strategy), which is outside the scope of a source-code measure." + }, + { + "ruleId": "DOD-02", + "sourceFile": "cross-cutting/definition-of-done.rules.json", + "title": "Unit tests meet coverage threshold", + "severity": "MUST", + "ruleClass": "process", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "yes", + "examples": [ + "Istanbul / SonarQube coverage gate" + ] + }, + "nativeEvaluability": "native-handler", + "note": "A property of the development process (pipeline, branch, review, test strategy), which is outside the scope of a source-code measure." + }, + { + "ruleId": "DOD-03", + "sourceFile": "cross-cutting/definition-of-done.rules.json", + "title": "All acceptance criteria verified", + "severity": "MUST", + "ruleClass": "process", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "A property of the development process (pipeline, branch, review, test strategy), which is outside the scope of a source-code measure." + }, + { + "ruleId": "DOD-04", + "sourceFile": "cross-cutting/definition-of-done.rules.json", + "title": "Documentation updated", + "severity": "MUST", + "ruleClass": "process", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "A property of the development process (pipeline, branch, review, test strategy), which is outside the scope of a source-code measure." + }, + { + "ruleId": "DOD-05", + "sourceFile": "cross-cutting/definition-of-done.rules.json", + "title": "Observability instrumentation added", + "severity": "MUST", + "ruleClass": "process", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "A property of the development process (pipeline, branch, review, test strategy), which is outside the scope of a source-code measure." + }, + { + "ruleId": "DOD-06", + "sourceFile": "cross-cutting/definition-of-done.rules.json", + "title": "Security gates passed", + "severity": "MUST", + "ruleClass": "process", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "A property of the development process (pipeline, branch, review, test strategy), which is outside the scope of a source-code measure." + }, + { + "ruleId": "DOD-07", + "sourceFile": "cross-cutting/definition-of-done.rules.json", + "title": "ADR created if architectural decision made", + "severity": "MUST", + "ruleClass": "process", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "A property of the development process (pipeline, branch, review, test strategy), which is outside the scope of a source-code measure." + }, + { + "ruleId": "DOD-08", + "sourceFile": "cross-cutting/definition-of-done.rules.json", + "title": "Integration tests pass", + "severity": "MUST", + "ruleClass": "process", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "A property of the development process (pipeline, branch, review, test strategy), which is outside the scope of a source-code measure." + }, + { + "ruleId": "DOD-09", + "sourceFile": "cross-cutting/definition-of-done.rules.json", + "title": "Linting and formatting passed", + "severity": "MUST", + "ruleClass": "process", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "yes", + "examples": [ + "ESLint", + "Prettier --check" + ] + }, + "nativeEvaluability": "native-handler", + "note": "A property of the development process (pipeline, branch, review, test strategy), which is outside the scope of a source-code measure." + }, + { + "ruleId": "DOD-10", + "sourceFile": "cross-cutting/definition-of-done.rules.json", + "title": "CI pipeline green on target branch", + "severity": "MUST", + "ruleClass": "process", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "A property of the development process (pipeline, branch, review, test strategy), which is outside the scope of a source-code measure." + }, + { + "ruleId": "EM-D-01", + "sourceFile": "cross-cutting/engineering-manifesto.rules.json", + "title": "Don't Repeat Yourself", + "severity": "MUST", + "ruleClass": "code-structure", + "iso5055": { + "cwes": [ + 1041 + ], + "weaknesses": [ + "Use of Redundant Code (Copy-Paste)" + ], + "measures": [ + "Maintainability" + ], + "strength": "direct" + }, + "analyser": { + "adoptable": "yes", + "examples": [ + "PMD CPD", + "SonarQube duplication", + "jscpd" + ] + }, + "nativeEvaluability": "native-handler", + "note": "DRY is CWE-1041 (redundant / copy-paste code) and clone detection is commodity." + }, + { + "ruleId": "EM-D-02", + "sourceFile": "cross-cutting/engineering-manifesto.rules.json", + "title": "Configuration not duplicated", + "severity": "MUST", + "ruleClass": "code-structure", + "iso5055": { + "cwes": [ + 1051, + 1052 + ], + "weaknesses": [ + "Initialization with Hard-Coded Network Resource Configuration Data", + "Excessive Use of Hard-Coded Literals in Initialization" + ], + "measures": [ + "Maintainability", + "Reliability" + ], + "strength": "partial" + }, + "analyser": { + "adoptable": "partial", + "examples": [ + "SonarQube hard-coded literal rules" + ] + }, + "nativeEvaluability": "native-handler", + "note": "Structural rule with no counterpart among the 138 weaknesses." + }, + { + "ruleId": "EM-K-01", + "sourceFile": "cross-cutting/engineering-manifesto.rules.json", + "title": "Keep It Simple, Stupid", + "severity": "MUST", + "ruleClass": "code-structure", + "iso5055": { + "cwes": [ + 1121 + ], + "weaknesses": [ + "Excessive McCabe Cyclomatic Complexity" + ], + "measures": [ + "Maintainability" + ], + "strength": "direct" + }, + "analyser": { + "adoptable": "yes", + "examples": [ + "SonarQube S3776 / cyclomatic complexity", + "ESLint complexity" + ] + }, + "nativeEvaluability": "native-handler", + "note": "Structural rule with no counterpart among the 138 weaknesses." + }, + { + "ruleId": "EM-K-02", + "sourceFile": "cross-cutting/engineering-manifesto.rules.json", + "title": "Avoid premature abstraction", + "severity": "SHOULD NOT", + "ruleClass": "code-structure", + "iso5055": { + "cwes": [ + 1074 + ], + "weaknesses": [ + "Class with Excessively Deep Inheritance" + ], + "measures": [ + "Maintainability" + ], + "strength": "partial" + }, + "analyser": { + "adoptable": "partial", + "examples": [ + "SonarQube inheritance depth" + ] + }, + "nativeEvaluability": "native-handler", + "note": "Structural rule with no counterpart among the 138 weaknesses." + }, + { + "ruleId": "EM-S-01", + "sourceFile": "cross-cutting/engineering-manifesto.rules.json", + "title": "Single Responsibility: one reason to change", + "severity": "MUST", + "ruleClass": "code-structure", + "iso5055": { + "cwes": [ + 1048, + 1080, + 1121 + ], + "weaknesses": [ + "Invokable Control Element with Large Number of Outward Calls (Excessive Coupling / Fan-out)", + "Source Code File with Excessive Number of Lines of Code", + "Excessive McCabe Cyclomatic Complexity" + ], + "measures": [ + "Maintainability" + ], + "strength": "partial" + }, + "analyser": { + "adoptable": "yes", + "examples": [ + "SonarQube complexity + size metrics", + "CAST ASCMM" + ] + }, + "nativeEvaluability": "native-handler", + "note": "Single Responsibility is not a weakness; 5055 measures its symptoms (fan-out, file size, complexity)." + }, + { + "ruleId": "EM-S-02", + "sourceFile": "cross-cutting/engineering-manifesto.rules.json", + "title": "Open/Closed: open for extension, closed for modification", + "severity": "MUST", + "ruleClass": "code-structure", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "Open/Closed has no structural signature." + }, + { + "ruleId": "EM-S-03", + "sourceFile": "cross-cutting/engineering-manifesto.rules.json", + "title": "Liskov Substitution: subtype substitutable for base", + "severity": "MUST", + "ruleClass": "code-structure", + "iso5055": { + "cwes": [ + 1055, + 1074 + ], + "weaknesses": [ + "Multiple Inheritance from Concrete Classes", + "Class with Excessively Deep Inheritance" + ], + "measures": [ + "Maintainability" + ], + "strength": "partial" + }, + "analyser": { + "adoptable": "partial", + "examples": [ + "SonarQube inheritance-depth rules" + ] + }, + "nativeEvaluability": "native-handler", + "note": "Liskov violations are not decidable statically; inheritance shape is the available proxy." + }, + { + "ruleId": "EM-S-04", + "sourceFile": "cross-cutting/engineering-manifesto.rules.json", + "title": "Interface Segregation: fine-grained interfaces", + "severity": "MUST", + "ruleClass": "code-structure", + "iso5055": { + "cwes": [ + 1064 + ], + "weaknesses": [ + "Invokable Control Element with Signature Containing an Excessive Number of Parameters" + ], + "measures": [ + "Maintainability" + ], + "strength": "partial" + }, + "analyser": { + "adoptable": "partial", + "examples": [ + "SonarQube S107" + ] + }, + "nativeEvaluability": "native-handler", + "note": "Structural rule with no counterpart among the 138 weaknesses." + }, + { + "ruleId": "EM-S-05", + "sourceFile": "cross-cutting/engineering-manifesto.rules.json", + "title": "Dependency Inversion: depend on abstractions", + "severity": "MUST", + "ruleClass": "code-structure", + "iso5055": { + "cwes": [ + 1047 + ], + "weaknesses": [ + "Modules with Circular Dependencies" + ], + "measures": [ + "Maintainability" + ], + "strength": "partial" + }, + "analyser": { + "adoptable": "yes", + "examples": [ + "dependency-cruiser no-circular", + "ArchUnit" + ] + }, + "nativeEvaluability": "native-handler", + "note": "Structural rule with no counterpart among the 138 weaknesses." + }, + { + "ruleId": "EM-Y-01", + "sourceFile": "cross-cutting/engineering-manifesto.rules.json", + "title": "You Aren't Gonna Need It", + "severity": "MUST NOT", + "ruleClass": "code-structure", + "iso5055": { + "cwes": [ + 561, + 1041 + ], + "weaknesses": [ + "Dead Code", + "Use of Redundant Code (Copy-Paste)" + ], + "measures": [ + "Maintainability" + ], + "strength": "direct" + }, + "analyser": { + "adoptable": "yes", + "examples": [ + "SonarQube dead-code rules", + "ts-prune", + "knip" + ] + }, + "nativeEvaluability": "native-handler", + "note": "Structural rule with no counterpart among the 138 weaknesses." + }, + { + "ruleId": "TAX-01", + "sourceFile": "cross-cutting/repository-taxonomy.rules.json", + "title": "File names use kebab-case", + "severity": "MUST", + "ruleClass": "code-hygiene", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "yes", + "examples": [ + "ESLint filenames", + "Checkstyle" + ] + }, + "nativeEvaluability": "native-handler", + "note": "CWE-1099 (inconsistent naming) is not among the 138, but linters decide this rule outright." + }, + { + "ruleId": "TAX-02", + "sourceFile": "cross-cutting/repository-taxonomy.rules.json", + "title": "Class and type names use PascalCase", + "severity": "MUST", + "ruleClass": "code-hygiene", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "yes", + "examples": [ + "ESLint @typescript-eslint/naming-convention" + ] + }, + "nativeEvaluability": "native-handler", + "note": "Code-adjacent convention with no ISO/IEC 5055 weakness, though a linter may still decide it." + }, + { + "ruleId": "TAX-03", + "sourceFile": "cross-cutting/repository-taxonomy.rules.json", + "title": "Variable and function names use camelCase", + "severity": "MUST", + "ruleClass": "code-hygiene", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "yes", + "examples": [ + "ESLint @typescript-eslint/naming-convention" + ] + }, + "nativeEvaluability": "native-handler", + "note": "Code-adjacent convention with no ISO/IEC 5055 weakness, though a linter may still decide it." + }, + { + "ruleId": "TAX-04", + "sourceFile": "cross-cutting/repository-taxonomy.rules.json", + "title": "Constants use UPPER_SNAKE_CASE", + "severity": "MUST", + "ruleClass": "code-hygiene", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "yes", + "examples": [ + "ESLint @typescript-eslint/naming-convention" + ] + }, + "nativeEvaluability": "native-handler", + "note": "Code-adjacent convention with no ISO/IEC 5055 weakness, though a linter may still decide it." + }, + { + "ruleId": "TAX-05", + "sourceFile": "cross-cutting/repository-taxonomy.rules.json", + "title": "Evolith Core structure: reference/, sdk/, rulesets/", + "severity": "MUST", + "ruleClass": "code-hygiene", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "Code-adjacent convention with no ISO/IEC 5055 weakness, though a linter may still decide it." + }, + { + "ruleId": "TAX-06", + "sourceFile": "cross-cutting/repository-taxonomy.rules.json", + "title": "Satellite structure: src/, tests/, docs/", + "severity": "MUST", + "ruleClass": "code-hygiene", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "Code-adjacent convention with no ISO/IEC 5055 weakness, though a linter may still decide it." + }, + { + "ruleId": "TAX-07", + "sourceFile": "cross-cutting/repository-taxonomy.rules.json", + "title": "ADR files named with zero-padded ID", + "severity": "MUST", + "ruleClass": "code-hygiene", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "Code-adjacent convention with no ISO/IEC 5055 weakness, though a linter may still decide it." + }, + { + "ruleId": "TAX-08", + "sourceFile": "cross-cutting/repository-taxonomy.rules.json", + "title": "Bilingual ADR files use .es.md suffix", + "severity": "MUST", + "ruleClass": "code-hygiene", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "Code-adjacent convention with no ISO/IEC 5055 weakness, though a linter may still decide it." + }, + { + "ruleId": "TAX-09", + "sourceFile": "cross-cutting/repository-taxonomy.rules.json", + "title": "Evolith reference artifacts in reference/", + "severity": "MUST", + "ruleClass": "code-hygiene", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "Code-adjacent convention with no ISO/IEC 5055 weakness, though a linter may still decide it." + }, + { + "ruleId": "TAX-10", + "sourceFile": "cross-cutting/repository-taxonomy.rules.json", + "title": "Product-specific evidence not in reference/", + "severity": "MUST", + "ruleClass": "code-hygiene", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "Code-adjacent convention with no ISO/IEC 5055 weakness, though a linter may still decide it." + }, + { + "ruleId": "TAX-11", + "sourceFile": "cross-cutting/repository-taxonomy.rules.json", + "title": "No root-level topologies directory", + "severity": "MUST", + "ruleClass": "code-hygiene", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "Code-adjacent convention with no ISO/IEC 5055 weakness, though a linter may still decide it." + }, + { + "ruleId": "EVD-01", + "sourceFile": "evidence/evidence-manifest.rules.json", + "title": "Evidence Has Stable Identity", + "severity": "MUST", + "ruleClass": "governance", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "A governance invariant over Evolith artifacts (inheritance, open-core boundary, satellites, evidence). No international structural equivalent." + }, + { + "ruleId": "EVD-02", + "sourceFile": "evidence/evidence-manifest.rules.json", + "title": "Evidence Links to Source Artifact", + "severity": "MUST", + "ruleClass": "governance", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "A governance invariant over Evolith artifacts (inheritance, open-core boundary, satellites, evidence). No international structural equivalent." + }, + { + "ruleId": "EVD-03", + "sourceFile": "evidence/evidence-manifest.rules.json", + "title": "Evidence Captures Validation Outcome", + "severity": "MUST", + "ruleClass": "governance", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "A governance invariant over Evolith artifacts (inheritance, open-core boundary, satellites, evidence). No international structural equivalent." + }, + { + "ruleId": "EVD-04", + "sourceFile": "evidence/evidence-manifest.rules.json", + "title": "Evidence Declares Retention Expectation", + "severity": "SHOULD", + "ruleClass": "governance", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "A governance invariant over Evolith artifacts (inheritance, open-core boundary, satellites, evidence). No international structural equivalent." + }, + { + "ruleId": "PEA-01", + "sourceFile": "evidence/probabilistic-evidence-admissibility.rules.json", + "title": "Probabilistic Evidence Declares A Measured Error Rate Before It May Block", + "severity": "MUST", + "ruleClass": "governance", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "A governance invariant over Evolith artifacts (inheritance, open-core boundary, satellites, evidence). No international structural equivalent." + }, + { + "ruleId": "PEA-02", + "sourceFile": "evidence/probabilistic-evidence-admissibility.rules.json", + "title": "A Measured Error Rate Below The Declared Floor Degrades To Advisory", + "severity": "MUST", + "ruleClass": "governance", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "A governance invariant over Evolith artifacts (inheritance, open-core boundary, satellites, evidence). No international structural equivalent." + }, + { + "ruleId": "PEA-03", + "sourceFile": "evidence/probabilistic-evidence-admissibility.rules.json", + "title": "A Stale Or Unreadable Measurement Degrades To Advisory", + "severity": "MUST", + "ruleClass": "governance", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "A governance invariant over Evolith artifacts (inheritance, open-core boundary, satellites, evidence). No international structural equivalent." + }, + { + "ruleId": "PEA-04", + "sourceFile": "evidence/probabilistic-evidence-admissibility.rules.json", + "title": "An Admitted Measurement Says How It Was Obtained", + "severity": "SHOULD", + "ruleClass": "governance", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "A governance invariant over Evolith artifacts (inheritance, open-core boundary, satellites, evidence). No international structural equivalent." + }, + { + "ruleId": "ABAC-01", + "sourceFile": "governance/abac-mcp-access.rules.json", + "title": "Tool Access Requires Authorization", + "severity": "MUST", + "ruleClass": "governance", + "iso5055": { + "cwes": [ + 732 + ], + "weaknesses": [ + "Incorrect Permission Assignment for Critical Resource" + ], + "measures": [ + "Security" + ], + "strength": "partial" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "needs-runtime", + "note": "A governance invariant over Evolith artifacts (inheritance, open-core boundary, satellites, evidence). No international structural equivalent." + }, + { + "ruleId": "ABAC-02", + "sourceFile": "governance/abac-mcp-access.rules.json", + "title": "User Context Must Carry Roles", + "severity": "MUST", + "ruleClass": "governance", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "needs-runtime", + "note": "A governance invariant over Evolith artifacts (inheritance, open-core boundary, satellites, evidence). No international structural equivalent." + }, + { + "ruleId": "ABAC-03", + "sourceFile": "governance/abac-mcp-access.rules.json", + "title": "Tool Must Be Classified in the Tool Registry", + "severity": "MUST", + "ruleClass": "governance", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "needs-runtime", + "note": "A governance invariant over Evolith artifacts (inheritance, open-core boundary, satellites, evidence). No international structural equivalent." + }, + { + "ruleId": "DORA-01", + "sourceFile": "governance/executive-scorecards.rules.json", + "title": "Deployment Frequency", + "severity": "MUST", + "ruleClass": "governance", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "A governance invariant over Evolith artifacts (inheritance, open-core boundary, satellites, evidence). No international structural equivalent." + }, + { + "ruleId": "DORA-02", + "sourceFile": "governance/executive-scorecards.rules.json", + "title": "Lead Time for Changes", + "severity": "MUST", + "ruleClass": "governance", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "A governance invariant over Evolith artifacts (inheritance, open-core boundary, satellites, evidence). No international structural equivalent." + }, + { + "ruleId": "DORA-03", + "sourceFile": "governance/executive-scorecards.rules.json", + "title": "Change Failure Rate", + "severity": "MUST", + "ruleClass": "governance", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "A governance invariant over Evolith artifacts (inheritance, open-core boundary, satellites, evidence). No international structural equivalent." + }, + { + "ruleId": "DORA-04", + "sourceFile": "governance/executive-scorecards.rules.json", + "title": "Time to Restore", + "severity": "MUST", + "ruleClass": "governance", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "A governance invariant over Evolith artifacts (inheritance, open-core boundary, satellites, evidence). No international structural equivalent." + }, + { + "ruleId": "DRIFT-01", + "sourceFile": "governance/executive-scorecards.rules.json", + "title": "Architecture Drift Index", + "severity": "MUST", + "ruleClass": "governance", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "A governance invariant over Evolith artifacts (inheritance, open-core boundary, satellites, evidence). No international structural equivalent." + }, + { + "ruleId": "SPACE-01", + "sourceFile": "governance/executive-scorecards.rules.json", + "title": "Reliability (Observability)", + "severity": "MUST", + "ruleClass": "governance", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "A governance invariant over Evolith artifacts (inheritance, open-core boundary, satellites, evidence). No international structural equivalent." + }, + { + "ruleId": "SPACE-02", + "sourceFile": "governance/executive-scorecards.rules.json", + "title": "Culture (Team Health)", + "severity": "SHOULD", + "ruleClass": "governance", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "A governance invariant over Evolith artifacts (inheritance, open-core boundary, satellites, evidence). No international structural equivalent." + }, + { + "ruleId": "SPACE-03", + "sourceFile": "governance/executive-scorecards.rules.json", + "title": "Execution (Throughput)", + "severity": "SHOULD", + "ruleClass": "governance", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "A governance invariant over Evolith artifacts (inheritance, open-core boundary, satellites, evidence). No international structural equivalent." + }, + { + "ruleId": "SPACE-04", + "sourceFile": "governance/executive-scorecards.rules.json", + "title": "Communication (Visibility)", + "severity": "SHOULD", + "ruleClass": "governance", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "A governance invariant over Evolith artifacts (inheritance, open-core boundary, satellites, evidence). No international structural equivalent." + }, + { + "ruleId": "SPACE-05", + "sourceFile": "governance/executive-scorecards.rules.json", + "title": "Sponsorship (Leadership Alignment)", + "severity": "MUST", + "ruleClass": "governance", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "A governance invariant over Evolith artifacts (inheritance, open-core boundary, satellites, evidence). No international structural equivalent." + }, + { + "ruleId": "INH-01", + "sourceFile": "governance/inheritance.rules.json", + "title": "Core Immutability", + "severity": "", + "ruleClass": "governance", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "A governance invariant over Evolith artifacts (inheritance, open-core boundary, satellites, evidence). No international structural equivalent." + }, + { + "ruleId": "INH-02", + "sourceFile": "governance/inheritance.rules.json", + "title": "Version Pinning", + "severity": "", + "ruleClass": "governance", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "A governance invariant over Evolith artifacts (inheritance, open-core boundary, satellites, evidence). No international structural equivalent." + }, + { + "ruleId": "INH-03", + "sourceFile": "governance/inheritance.rules.json", + "title": "Upgrade Only, Never Downgrade", + "severity": "", + "ruleClass": "governance", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "underspecified", + "note": "A governance invariant over Evolith artifacts (inheritance, open-core boundary, satellites, evidence). No international structural equivalent." + }, + { + "ruleId": "INH-04", + "sourceFile": "governance/inheritance.rules.json", + "title": "Satellite Extension via Local ADRs", + "severity": "", + "ruleClass": "governance", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "underspecified", + "note": "A governance invariant over Evolith artifacts (inheritance, open-core boundary, satellites, evidence). No international structural equivalent." + }, + { + "ruleId": "INH-05", + "sourceFile": "governance/inheritance.rules.json", + "title": "Promotion via Architecture Board", + "severity": "", + "ruleClass": "governance", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "underspecified", + "note": "A governance invariant over Evolith artifacts (inheritance, open-core boundary, satellites, evidence). No international structural equivalent." + }, + { + "ruleId": "INH-06", + "sourceFile": "governance/inheritance.rules.json", + "title": "Mandatory Architecture Tracker", + "severity": "", + "ruleClass": "governance", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "A governance invariant over Evolith artifacts (inheritance, open-core boundary, satellites, evidence). No international structural equivalent." + }, + { + "ruleId": "KI-R01", + "sourceFile": "governance/knowledge-intake.rules.json", + "title": "Provenance and rights are mandatory", + "severity": "MUST", + "ruleClass": "governance", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "underspecified", + "note": "A governance invariant over Evolith artifacts (inheritance, open-core boundary, satellites, evidence). No international structural equivalent." + }, + { + "ruleId": "KI-R02", + "sourceFile": "governance/knowledge-intake.rules.json", + "title": "Winston owns review", + "severity": "MUST", + "ruleClass": "governance", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "underspecified", + "note": "A governance invariant over Evolith artifacts (inheritance, open-core boundary, satellites, evidence). No international structural equivalent." + }, + { + "ruleId": "KI-R03", + "sourceFile": "governance/knowledge-intake.rules.json", + "title": "Promotion requires executable evidence", + "severity": "MUST", + "ruleClass": "governance", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "underspecified", + "note": "A governance invariant over Evolith artifacts (inheritance, open-core boundary, satellites, evidence). No international structural equivalent." + }, + { + "ruleId": "KI-R04", + "sourceFile": "governance/knowledge-intake.rules.json", + "title": "Topology contract completeness", + "severity": "MUST", + "ruleClass": "governance", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "underspecified", + "note": "A governance invariant over Evolith artifacts (inheritance, open-core boundary, satellites, evidence). No international structural equivalent." + }, + { + "ruleId": "KI-R05", + "sourceFile": "governance/knowledge-intake.rules.json", + "title": "Source registry linkage", + "severity": "MUST", + "ruleClass": "governance", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "underspecified", + "note": "A governance invariant over Evolith artifacts (inheritance, open-core boundary, satellites, evidence). No international structural equivalent." + }, + { + "ruleId": "KI-R06", + "sourceFile": "governance/knowledge-intake.rules.json", + "title": "Promotion state machine", + "severity": "MUST", + "ruleClass": "governance", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "underspecified", + "note": "A governance invariant over Evolith artifacts (inheritance, open-core boundary, satellites, evidence). No international structural equivalent." + }, + { + "ruleId": "KI-R07", + "sourceFile": "governance/knowledge-intake.rules.json", + "title": "Promotion evidence and disposition", + "severity": "MUST", + "ruleClass": "governance", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "underspecified", + "note": "A governance invariant over Evolith artifacts (inheritance, open-core boundary, satellites, evidence). No international structural equivalent." + }, + { + "ruleId": "OCB-01", + "sourceFile": "governance/open-core-boundary.rules.json", + "title": "Core Remains License-Agnostic", + "severity": "MUST", + "ruleClass": "governance", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "A governance invariant over Evolith artifacts (inheritance, open-core boundary, satellites, evidence). No international structural equivalent." + }, + { + "ruleId": "OCB-02", + "sourceFile": "governance/open-core-boundary.rules.json", + "title": "Enterprise Features Explicitly Marked", + "severity": "MUST", + "ruleClass": "governance", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "unimplemented-native", + "note": "A governance invariant over Evolith artifacts (inheritance, open-core boundary, satellites, evidence). No international structural equivalent." + }, + { + "ruleId": "OCB-03", + "sourceFile": "governance/open-core-boundary.rules.json", + "title": "ACLs Are Enterprise Features", + "severity": "MUST", + "ruleClass": "governance", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "unimplemented-native", + "note": "A governance invariant over Evolith artifacts (inheritance, open-core boundary, satellites, evidence). No international structural equivalent." + }, + { + "ruleId": "OCB-04", + "sourceFile": "governance/open-core-boundary.rules.json", + "title": "CLI and MCP Remain Core", + "severity": "MUST", + "ruleClass": "governance", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "unimplemented-native", + "note": "A governance invariant over Evolith artifacts (inheritance, open-core boundary, satellites, evidence). No international structural equivalent." + }, + { + "ruleId": "OCB-05", + "sourceFile": "governance/open-core-boundary.rules.json", + "title": "Tracker Features Cannot Penetrate Core", + "severity": "MUST", + "ruleClass": "governance", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "unimplemented-native", + "note": "A governance invariant over Evolith artifacts (inheritance, open-core boundary, satellites, evidence). No international structural equivalent." + }, + { + "ruleId": "OCB-06", + "sourceFile": "governance/open-core-boundary.rules.json", + "title": "Reference Corpus Is Core", + "severity": "MUST", + "ruleClass": "governance", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "unimplemented-native", + "note": "A governance invariant over Evolith artifacts (inheritance, open-core boundary, satellites, evidence). No international structural equivalent." + }, + { + "ruleId": "OCB-07", + "sourceFile": "governance/open-core-boundary.rules.json", + "title": "Enterprise Innovations Can Promote to Core", + "severity": "SHOULD", + "ruleClass": "governance", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "documentation-only", + "note": "A governance invariant over Evolith artifacts (inheritance, open-core boundary, satellites, evidence). No international structural equivalent." + }, + { + "ruleId": "OCB-08", + "sourceFile": "governance/open-core-boundary.rules.json", + "title": "Core Cannot Require Enterprise to Function", + "severity": "MUST", + "ruleClass": "governance", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "needs-runtime", + "note": "A governance invariant over Evolith artifacts (inheritance, open-core boundary, satellites, evidence). No international structural equivalent." + }, + { + "ruleId": "SVC-01", + "sourceFile": "governance/satellite-contracts.rules.json", + "title": "Each satellite project must have exactly one evolith.yaml at its project root", + "severity": "", + "ruleClass": "governance", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "A governance invariant over Evolith artifacts (inheritance, open-core boundary, satellites, evidence). No international structural equivalent." + }, + { + "ruleId": "SVC-02", + "sourceFile": "governance/satellite-contracts.rules.json", + "title": "Satellite name must be unique across all Evolith satellites", + "severity": "", + "ruleClass": "governance", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "A governance invariant over Evolith artifacts (inheritance, open-core boundary, satellites, evidence). No international structural equivalent." + }, + { + "ruleId": "SVC-03", + "sourceFile": "governance/satellite-contracts.rules.json", + "title": "F1 phase satellites must reference core/ADR-0047 in spec.compliance.adrRegistry", + "severity": "", + "ruleClass": "governance", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "A governance invariant over Evolith artifacts (inheritance, open-core boundary, satellites, evidence). No international structural equivalent." + }, + { + "ruleId": "SVC-04", + "sourceFile": "governance/satellite-contracts.rules.json", + "title": "Satellites in F2 or F3 must have extraction readiness score documented", + "severity": "", + "ruleClass": "governance", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "A governance invariant over Evolith artifacts (inheritance, open-core boundary, satellites, evidence). No international structural equivalent." + }, + { + "ruleId": "SVC-05", + "sourceFile": "governance/satellite-contracts.rules.json", + "title": "Core version referenced must exist in Evolith Core registry", + "severity": "", + "ruleClass": "governance", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "A governance invariant over Evolith artifacts (inheritance, open-core boundary, satellites, evidence). No international structural equivalent." + }, + { + "ruleId": "SVC-06", + "sourceFile": "governance/satellite-contracts.rules.json", + "title": "Workspace integrity: declared projects and discovered manifests must correspond one-to-one", + "severity": "", + "ruleClass": "governance", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "A governance invariant over Evolith artifacts (inheritance, open-core boundary, satellites, evidence). No international structural equivalent." + }, + { + "ruleId": "INFRA-001", + "sourceFile": "infrastructure/helm-enforcement.rules.json", + "title": "Helm Charts Over Raw Manifests Enforcement", + "severity": "high", + "ruleClass": "deployment", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "not-in-snapshot", + "note": "A deployment / chart packaging invariant, outside the scope of a source-code measure." + }, + { + "ruleId": "INFRA-OPA-001", + "sourceFile": "infrastructure/opa-sidecar-bundle.rules.json", + "title": "OPA Sidecar Bundle Integrity", + "severity": "critical", + "ruleClass": "deployment", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "not-in-snapshot", + "note": "A deployment / chart packaging invariant, outside the scope of a source-code measure." + }, + { + "ruleId": "MCP-01", + "sourceFile": "mcp/protocol-compliance.rules.json", + "title": "Initialize Request Must Return Capabilities", + "severity": "MUST", + "ruleClass": "platform-surface", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "A CLI / MCP surface contract. Specific to this product; no standards analyser models it." + }, + { + "ruleId": "MCP-02", + "sourceFile": "mcp/protocol-compliance.rules.json", + "title": "Tools List Must Be Complete and Stable", + "severity": "MUST", + "ruleClass": "platform-surface", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "A CLI / MCP surface contract. Specific to this product; no standards analyser models it." + }, + { + "ruleId": "MCP-03", + "sourceFile": "mcp/protocol-compliance.rules.json", + "title": "Resources Must Preserve Core Traceability", + "severity": "MUST", + "ruleClass": "platform-surface", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "A CLI / MCP surface contract. Specific to this product; no standards analyser models it." + }, + { + "ruleId": "MCP-04", + "sourceFile": "mcp/protocol-compliance.rules.json", + "title": "HTTP Transport Requires Explicit Authentication Mode", + "severity": "MUST", + "ruleClass": "platform-surface", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "A CLI / MCP surface contract. Specific to this product; no standards analyser models it." + }, + { + "ruleId": "MCP-05", + "sourceFile": "mcp/protocol-compliance.rules.json", + "title": "MCP Calls Should Emit Metrics", + "severity": "SHOULD", + "ruleClass": "platform-surface", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "A CLI / MCP surface contract. Specific to this product; no standards analyser models it." + }, + { + "ruleId": "OBS-EVD-01", + "sourceFile": "observability/telemetry-evidence.rules.json", + "title": "Production Paths Emit Trace Context", + "severity": "MUST", + "ruleClass": "operations", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "needs-runtime", + "note": "An operational telemetry expectation, evaluated from runtime evidence rather than source structure." + }, + { + "ruleId": "OBS-EVD-02", + "sourceFile": "observability/telemetry-evidence.rules.json", + "title": "Structured Logs Carry Request Context", + "severity": "MUST", + "ruleClass": "operations", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "needs-runtime", + "note": "An operational telemetry expectation, evaluated from runtime evidence rather than source structure." + }, + { + "ruleId": "OBS-EVD-03", + "sourceFile": "observability/telemetry-evidence.rules.json", + "title": "Service Health Metrics Are Reported", + "severity": "MUST", + "ruleClass": "operations", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "needs-external-system", + "note": "An operational telemetry expectation, evaluated from runtime evidence rather than source structure." + }, + { + "ruleId": "OBS-EVD-04", + "sourceFile": "observability/telemetry-evidence.rules.json", + "title": "Gate Evidence References Dashboard", + "severity": "SHOULD", + "ruleClass": "operations", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "unimplemented-native", + "note": "An operational telemetry expectation, evaluated from runtime evidence rather than source structure." + }, + { + "ruleId": "DEP-01", + "sourceFile": "sdlc/dependency-pinning.rules.json", + "title": "No caret (^) range specifiers in package.json", + "severity": "MUST NOT", + "ruleClass": "supply-chain", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "yes", + "examples": [ + "npm-package-json-lint", + "custom lint on package.json" + ] + }, + "nativeEvaluability": "native-handler", + "note": "Dependency-management hygiene. Covered by SCA tooling rather than by ISO/IEC 5055." + }, + { + "ruleId": "DEP-02", + "sourceFile": "sdlc/dependency-pinning.rules.json", + "title": "No tilde (~) range specifiers in package.json", + "severity": "MUST NOT", + "ruleClass": "supply-chain", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "yes", + "examples": [ + "npm-package-json-lint" + ] + }, + "nativeEvaluability": "native-handler", + "note": "Dependency-management hygiene. Covered by SCA tooling rather than by ISO/IEC 5055." + }, + { + "ruleId": "DEP-03", + "sourceFile": "sdlc/dependency-pinning.rules.json", + "title": "No wildcard (*) or latest-tag version specifiers", + "severity": "MUST NOT", + "ruleClass": "supply-chain", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "yes", + "examples": [ + "npm-package-json-lint" + ] + }, + "nativeEvaluability": "native-handler", + "note": "Dependency-management hygiene. Covered by SCA tooling rather than by ISO/IEC 5055." + }, + { + "ruleId": "DEP-04", + "sourceFile": "sdlc/dependency-pinning.rules.json", + "title": "package-lock.json (or equivalent) must be committed", + "severity": "MUST", + "ruleClass": "supply-chain", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "yes", + "examples": [ + "file presence check in any CI linter" + ] + }, + "nativeEvaluability": "native-handler", + "note": "Dependency-management hygiene. Covered by SCA tooling rather than by ISO/IEC 5055." + }, + { + "ruleId": "DEP-05", + "sourceFile": "sdlc/dependency-pinning.rules.json", + "title": "CI pipelines use 'npm ci' not 'npm install'", + "severity": "MUST", + "ruleClass": "supply-chain", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "Dependency-management hygiene. Covered by SCA tooling rather than by ISO/IEC 5055." + }, + { + "ruleId": "DEP-06", + "sourceFile": "sdlc/dependency-pinning.rules.json", + "title": "CI pipeline runs npm audit at high severity level", + "severity": "MUST", + "ruleClass": "supply-chain", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "yes", + "examples": [ + "npm audit", + "OWASP Dependency-Check", + "Trivy" + ] + }, + "nativeEvaluability": "native-handler", + "note": "Dependency-management hygiene. Covered by SCA tooling rather than by ISO/IEC 5055." + }, + { + "ruleId": "DEP-07", + "sourceFile": "sdlc/dependency-pinning.rules.json", + "title": "Zero High or Critical CVEs in production dependencies", + "severity": "MUST", + "ruleClass": "supply-chain", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "yes", + "examples": [ + "npm audit", + "OSV-Scanner", + "Trivy" + ] + }, + "nativeEvaluability": "native-handler", + "note": "CVE state in dependencies is SCA territory; ISO/IEC 5055 measures the code you own, not the code you import." + }, + { + "ruleId": "DEP-08", + "sourceFile": "sdlc/dependency-pinning.rules.json", + "title": "npm overrides entries must be documented with CVE reference", + "severity": "SHOULD", + "ruleClass": "supply-chain", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "Dependency-management hygiene. Covered by SCA tooling rather than by ISO/IEC 5055." + }, + { + "ruleId": "DEP-09", + "sourceFile": "sdlc/dependency-pinning.rules.json", + "title": "Automated dependency update bot configured", + "severity": "SHOULD", + "ruleClass": "supply-chain", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "yes", + "examples": [ + "Renovate / Dependabot config presence" + ] + }, + "nativeEvaluability": "native-handler", + "note": "Dependency-management hygiene. Covered by SCA tooling rather than by ISO/IEC 5055." + }, + { + "ruleId": "DEP-10", + "sourceFile": "sdlc/dependency-pinning.rules.json", + "title": "Workspaces inherit the exact-version policy", + "severity": "MUST", + "ruleClass": "supply-chain", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "Dependency-management hygiene. Covered by SCA tooling rather than by ISO/IEC 5055." + }, + { + "ruleId": "QT-01", + "sourceFile": "sdlc/quality-thresholds.rules.json", + "title": "Code Coverage", + "severity": "MUST", + "ruleClass": "code-hygiene", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "yes", + "examples": [ + "Jest/Istanbul coverage", + "SonarQube coverage" + ] + }, + "nativeEvaluability": "native-handler", + "note": "Coverage is a test measure, not a structural weakness; 5055 does not model it, but no handler is needed either." + }, + { + "ruleId": "QT-02", + "sourceFile": "sdlc/quality-thresholds.rules.json", + "title": "Cyclomatic Complexity", + "severity": "MUST", + "ruleClass": "code-hygiene", + "iso5055": { + "cwes": [ + 1121 + ], + "weaknesses": [ + "Excessive McCabe Cyclomatic Complexity" + ], + "measures": [ + "Maintainability" + ], + "strength": "direct" + }, + "analyser": { + "adoptable": "yes", + "examples": [ + "SonarQube S3776", + "ESLint complexity" + ] + }, + "nativeEvaluability": "native-handler", + "note": "Code-adjacent convention with no ISO/IEC 5055 weakness, though a linter may still decide it." + }, + { + "ruleId": "QT-03", + "sourceFile": "sdlc/quality-thresholds.rules.json", + "title": "Security Vulnerabilities", + "severity": "MUST", + "ruleClass": "code-hygiene", + "iso5055": { + "cwes": [ + 22, + 78, + 89, + 79, + 798, + 732 + ], + "weaknesses": [ + "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", + "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", + "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", + "Improper Neutralizationof Input During Web Page Generati on (' Cross-site Scripting')", + "Use of Hard-coded Credentials", + "Incorrect Permission Assignment for Critical Resource" + ], + "measures": [ + "Security" + ], + "strength": "partial" + }, + "analyser": { + "adoptable": "yes", + "examples": [ + "CodeQL security suite", + "SonarQube security hotspots" + ] + }, + "nativeEvaluability": "native-handler", + "note": "The rule is a threshold over the whole 5055 Security measure (74 weaknesses); the CWEs listed are representatives, not the closed set." + }, + { + "ruleId": "QT-04", + "sourceFile": "sdlc/quality-thresholds.rules.json", + "title": "Technical Debt Ratio", + "severity": "MUST", + "ruleClass": "code-hygiene", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "yes", + "examples": [ + "SonarQube SQALE debt ratio", + "OMG ATDM V2" + ] + }, + "nativeEvaluability": "native-handler", + "note": "Technical debt ratio is derived FROM 5055 by OMG ATDM V2, not a weakness in it. See GT-599." + }, + { + "ruleId": "QT-05", + "sourceFile": "sdlc/quality-thresholds.rules.json", + "title": "Testing Pyramid Distribution", + "severity": "MUST", + "ruleClass": "code-hygiene", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "Code-adjacent convention with no ISO/IEC 5055 weakness, though a linter may still decide it." + }, + { + "ruleId": "QT-06", + "sourceFile": "sdlc/quality-thresholds.rules.json", + "title": "Documentation Delta", + "severity": "MUST", + "ruleClass": "code-hygiene", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "Code-adjacent convention with no ISO/IEC 5055 weakness, though a linter may still decide it." + }, + { + "ruleId": "QT-07", + "sourceFile": "sdlc/quality-thresholds.rules.json", + "title": "Observability Evidence", + "severity": "MUST", + "ruleClass": "code-hygiene", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "Code-adjacent convention with no ISO/IEC 5055 weakness, though a linter may still decide it." + }, + { + "ruleId": "QT-08", + "sourceFile": "sdlc/quality-thresholds.rules.json", + "title": "API Contract Compatibility", + "severity": "MUST", + "ruleClass": "code-hygiene", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "partial", + "examples": [ + "openapi-diff", + "Buf breaking" + ] + }, + "nativeEvaluability": "native-handler", + "note": "Code-adjacent convention with no ISO/IEC 5055 weakness, though a linter may still decide it." + }, + { + "ruleId": "SEC-INJ-01", + "sourceFile": "security/injection-prevention.rules.json", + "title": "No shell exec with user input", + "severity": "MUST", + "ruleClass": "code-structure", + "iso5055": { + "cwes": [ + 78, + 77 + ], + "weaknesses": [ + "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", + "Improper Neutralization of Special Elements used in a Command ('Command Injection')" + ], + "measures": [ + "Security" + ], + "strength": "direct" + }, + "analyser": { + "adoptable": "yes", + "examples": [ + "CodeQL js/command-line-injection", + "Semgrep javascript.lang.security.detect-child-process", + "SonarQube S2076" + ] + }, + "nativeEvaluability": "unimplemented-native", + "note": "Shell execution with interpolated user input is OS command injection verbatim." + }, + { + "ruleId": "SEC-INJ-02", + "sourceFile": "security/injection-prevention.rules.json", + "title": "Parameter allowlists for scaffold tools", + "severity": "MUST", + "ruleClass": "code-structure", + "iso5055": { + "cwes": [ + 77, + 88 + ], + "weaknesses": [ + "Improper Neutralization of Special Elements used in a Command ('Command Injection')", + "Argument Injection or Modification" + ], + "measures": [ + "Security" + ], + "strength": "partial" + }, + "analyser": { + "adoptable": "partial", + "examples": [ + "CodeQL taint tracking to child_process sinks" + ] + }, + "nativeEvaluability": "unimplemented-native", + "note": "Taint analysis proves the sink is unsanitised; it cannot prove an allowlist exists, which is what the rule actually demands." + }, + { + "ruleId": "SEC-PATH-01", + "sourceFile": "security/path-containment.rules.json", + "title": "Path input sanitization", + "severity": "MUST", + "ruleClass": "code-structure", + "iso5055": { + "cwes": [ + 22, + 23, + 36 + ], + "weaknesses": [ + "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", + "Relative Path Traversal", + "Absolute Path Traversal" + ], + "measures": [ + "Security" + ], + "strength": "direct" + }, + "analyser": { + "adoptable": "yes", + "examples": [ + "CodeQL js/path-injection", + "Semgrep path-traversal rules", + "SonarQube S2083" + ] + }, + "nativeEvaluability": "unimplemented-native", + "note": "Structural rule with no counterpart among the 138 weaknesses." + }, + { + "ruleId": "SEC-PATH-02", + "sourceFile": "security/path-containment.rules.json", + "title": "Base directory containment", + "severity": "MUST", + "ruleClass": "code-structure", + "iso5055": { + "cwes": [ + 22 + ], + "weaknesses": [ + "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" + ], + "measures": [ + "Security" + ], + "strength": "direct" + }, + "analyser": { + "adoptable": "yes", + "examples": [ + "CodeQL js/path-injection" + ] + }, + "nativeEvaluability": "unimplemented-native", + "note": "Structural rule with no counterpart among the 138 weaknesses." + }, + { + "ruleId": "SEC-RL-01", + "sourceFile": "security/rate-limiting.rules.json", + "title": "Rate limiting on HTTP endpoints", + "severity": "MUST", + "ruleClass": "code-structure", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "partial", + "examples": [ + "Semgrep express-rate-limit presence rules" + ] + }, + "nativeEvaluability": "native-handler", + "note": "CWE-770 is not in the 138; presence of a limiter is checkable, correct configuration is not." + }, + { + "ruleId": "SEC-RL-02", + "sourceFile": "security/rate-limiting.rules.json", + "title": "Request body size limits", + "severity": "MUST", + "ruleClass": "code-structure", + "iso5055": { + "cwes": [ + 789 + ], + "weaknesses": [ + "Uncontrolled Memory Allocation" + ], + "measures": [ + "Security" + ], + "strength": "partial" + }, + "analyser": { + "adoptable": "partial", + "examples": [ + "Semgrep express-body-parser-limit" + ] + }, + "nativeEvaluability": "native-handler", + "note": "Unbounded request bodies are the uncontrolled-allocation weakness reached through a framework default." + }, + { + "ruleId": "SEC-RL-03", + "sourceFile": "security/rate-limiting.rules.json", + "title": "HTTP server timeouts", + "severity": "SHOULD", + "ruleClass": "code-structure", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "unimplemented-native", + "note": "HTTP server timeout configuration has no 5055 weakness and no off-the-shelf check." + }, + { + "ruleId": "SEC-TIMING-01", + "sourceFile": "security/timing-safe-comparison.rules.json", + "title": "Constant-time credential comparison", + "severity": "MUST", + "ruleClass": "code-structure", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "yes", + "examples": [ + "Semgrep javascript.lang.security.audit.timing-attack", + "CodeQL js/timing-attack" + ] + }, + "nativeEvaluability": "unimplemented-native", + "note": "CWE-208 (observable timing discrepancy) is NOT one of the 138, so this is adoptable from an analyser but not countable against 5055." + }, + { + "ruleId": "SEC-TIMING-02", + "sourceFile": "security/timing-safe-comparison.rules.json", + "title": "No early rejection on credential length", + "severity": "MUST", + "ruleClass": "code-structure", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "partial", + "examples": [ + "Semgrep timing-attack rules" + ] + }, + "nativeEvaluability": "unimplemented-native", + "note": "Same as SEC-TIMING-01; the early-length-rejection variant needs a bespoke pattern." + }, + { + "ruleId": "ISO5055-MAINT", + "sourceFile": "standards/iso-5055.rules.json", + "title": "ISO/IEC 5055 — Maintainability", + "severity": "MUST", + "ruleClass": "governance", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "unimplemented-native", + "note": "A governance invariant over Evolith artifacts (inheritance, open-core boundary, satellites, evidence). No international structural equivalent." + }, + { + "ruleId": "ISO5055-PERF", + "sourceFile": "standards/iso-5055.rules.json", + "title": "ISO/IEC 5055 — Performance Efficiency", + "severity": "MUST", + "ruleClass": "governance", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "unimplemented-native", + "note": "A governance invariant over Evolith artifacts (inheritance, open-core boundary, satellites, evidence). No international structural equivalent." + }, + { + "ruleId": "ISO5055-REL", + "sourceFile": "standards/iso-5055.rules.json", + "title": "ISO/IEC 5055 — Reliability", + "severity": "MUST", + "ruleClass": "governance", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "unimplemented-native", + "note": "A governance invariant over Evolith artifacts (inheritance, open-core boundary, satellites, evidence). No international structural equivalent." + }, + { + "ruleId": "ISO5055-SEC", + "sourceFile": "standards/iso-5055.rules.json", + "title": "ISO/IEC 5055 — Security", + "severity": "MUST", + "ruleClass": "governance", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "unimplemented-native", + "note": "A governance invariant over Evolith artifacts (inheritance, open-core boundary, satellites, evidence). No international structural equivalent." + }, + { + "ruleId": "SLSA-AUTH-L2", + "sourceFile": "standards/slsa-v1.rules.json", + "title": "Build L2 — the PUBLISHING job can mint the identity that signs the provenance", + "severity": "MUST", + "ruleClass": "governance", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "A governance invariant over Evolith artifacts (inheritance, open-core boundary, satellites, evidence). No international structural equivalent." + }, + { + "ruleId": "SLSA-BUILD-L1", + "sourceFile": "standards/slsa-v1.rules.json", + "title": "Build L1 — the artifact is built by the run whose provenance describes it", + "severity": "MUST", + "ruleClass": "governance", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "A governance invariant over Evolith artifacts (inheritance, open-core boundary, satellites, evidence). No international structural equivalent." + }, + { + "ruleId": "SLSA-HOSTED-L2", + "sourceFile": "standards/slsa-v1.rules.json", + "title": "Build L2 — nothing offers a way to publish from a workstation", + "severity": "MUST", + "ruleClass": "governance", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "A governance invariant over Evolith artifacts (inheritance, open-core boundary, satellites, evidence). No international structural equivalent." + }, + { + "ruleId": "SLSA-PROV-L1", + "sourceFile": "standards/slsa-v1.rules.json", + "title": "Build L1 — EVERY publishing path generates provenance, not just the main one", + "severity": "MUST", + "ruleClass": "governance", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "A governance invariant over Evolith artifacts (inheritance, open-core boundary, satellites, evidence). No international structural equivalent." + }, + { + "ruleId": "SSDF-PO.3.1", + "sourceFile": "standards/ssdf-v1.1.rules.json", + "title": "PO.3.1 — the toolchain is specified as code, not as recollection", + "severity": "SHOULD", + "ruleClass": "governance", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "A governance invariant over Evolith artifacts (inheritance, open-core boundary, satellites, evidence). No international structural equivalent." + }, + { + "ruleId": "SSDF-PS.3.2", + "sourceFile": "standards/ssdf-v1.1.rules.json", + "title": "PS.3.2 — an SBOM that is generated but never published satisfies nothing", + "severity": "MUST", + "ruleClass": "governance", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "A governance invariant over Evolith artifacts (inheritance, open-core boundary, satellites, evidence). No international structural equivalent." + }, + { + "ruleId": "SSDF-PW.4.1", + "sourceFile": "standards/ssdf-v1.1.rules.json", + "title": "PW.4.1 — third-party components resolve to pinned versions in CI", + "severity": "MUST", + "ruleClass": "governance", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "A governance invariant over Evolith artifacts (inheritance, open-core boundary, satellites, evidence). No international structural equivalent." + }, + { + "ruleId": "SSDF-PW.4.4", + "sourceFile": "standards/ssdf-v1.1.rules.json", + "title": "PW.4.4 — components are re-verified over their life cycle, not once at adoption", + "severity": "MUST", + "ruleClass": "governance", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "A governance invariant over Evolith artifacts (inheritance, open-core boundary, satellites, evidence). No international structural equivalent." + }, + { + "ruleId": "SSDF-PW.6.1", + "sourceFile": "standards/ssdf-v1.1.rules.json", + "title": "PW.6.1 — build tooling is configured to improve executable security", + "severity": "SHOULD", + "ruleClass": "governance", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "A governance invariant over Evolith artifacts (inheritance, open-core boundary, satellites, evidence). No international structural equivalent." + }, + { + "ruleId": "SSDF-PW.7.2", + "sourceFile": "standards/ssdf-v1.1.rules.json", + "title": "PW.7.2 — code is analysed by both a code scanner and a secret scanner", + "severity": "MUST", + "ruleClass": "governance", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "A governance invariant over Evolith artifacts (inheritance, open-core boundary, satellites, evidence). No international structural equivalent." + }, + { + "ruleId": "SSDF-RV.1.2", + "sourceFile": "standards/ssdf-v1.1.rules.json", + "title": "RV.1.2 — the code scanner sees the whole change, not a filtered slice", + "severity": "MUST", + "ruleClass": "governance", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "A governance invariant over Evolith artifacts (inheritance, open-core boundary, satellites, evidence). No international structural equivalent." + }, + { + "ruleId": "SSDF-RV.1.3", + "sourceFile": "standards/ssdf-v1.1.rules.json", + "title": "RV.1.3 — there is a disclosure policy that names how to report", + "severity": "MUST", + "ruleClass": "governance", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "A governance invariant over Evolith artifacts (inheritance, open-core boundary, satellites, evidence). No international structural equivalent." + }, + { + "ruleId": "AAI-R01", + "sourceFile": "topologies/agentic-ai/agentic-ai.rules.json", + "title": "Declared Agent Identity and Capabilities", + "severity": "MUST", + "ruleClass": "topology", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "A contract of a named architecture topology. The predicate is about declared topology configuration, not about code structure." + }, + { + "ruleId": "AAI-R02", + "sourceFile": "topologies/agentic-ai/agentic-ai.rules.json", + "title": "Explicit Sandbox Boundary", + "severity": "MUST", + "ruleClass": "topology", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "A contract of a named architecture topology. The predicate is about declared topology configuration, not about code structure." + }, + { + "ruleId": "AAI-R03", + "sourceFile": "topologies/agentic-ai/agentic-ai.rules.json", + "title": "Prompt and Implementation Separation", + "severity": "MUST", + "ruleClass": "topology", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "A contract of a named architecture topology. The predicate is about declared topology configuration, not about code structure." + }, + { + "ruleId": "AAI-R04", + "sourceFile": "topologies/agentic-ai/agentic-ai.rules.json", + "title": "Approval for Mutative Tools", + "severity": "MUST", + "ruleClass": "topology", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "A contract of a named architecture topology. The predicate is about declared topology configuration, not about code structure." + }, + { + "ruleId": "AAI-R05", + "sourceFile": "topologies/agentic-ai/agentic-ai.rules.json", + "title": "Ephemeral Sandbox Resource Limits", + "severity": "MUST", + "ruleClass": "topology", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "A contract of a named architecture topology. The predicate is about declared topology configuration, not about code structure." + }, + { + "ruleId": "AAI-R06", + "sourceFile": "topologies/agentic-ai/agentic-ai.rules.json", + "title": "Untrusted Context Is Data", + "severity": "MUST", + "ruleClass": "topology", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "A contract of a named architecture topology. The predicate is about declared topology configuration, not about code structure." + }, + { + "ruleId": "AAI-R07", + "sourceFile": "topologies/agentic-ai/agentic-ai.rules.json", + "title": "Capability-Scoped, Auditable Actions", + "severity": "MUST", + "ruleClass": "topology", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "A contract of a named architecture topology. The predicate is about declared topology configuration, not about code structure." + }, + { + "ruleId": "AAI-R08", + "sourceFile": "topologies/agentic-ai/agentic-ai.rules.json", + "title": "Operational Budgets and Concurrency Limits", + "severity": "MUST", + "ruleClass": "topology", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "A contract of a named architecture topology. The predicate is about declared topology configuration, not about code structure." + }, + { + "ruleId": "AAI-R09", + "sourceFile": "topologies/agentic-ai/agentic-ai.rules.json", + "title": "Satellite Credential Lifecycle", + "severity": "MUST", + "ruleClass": "topology", + "iso5055": { + "cwes": [ + 798 + ], + "weaknesses": [ + "Use of Hard-coded Credentials" + ], + "measures": [ + "Security" + ], + "strength": "partial" + }, + "analyser": { + "adoptable": "partial", + "examples": [ + "gitleaks", + "CodeQL js/hardcoded-credentials" + ] + }, + "nativeEvaluability": "native-handler", + "note": "A contract of a named architecture topology. The predicate is about declared topology configuration, not about code structure." + }, + { + "ruleId": "DAM-R01", + "sourceFile": "topologies/data-mesh/data-mesh.rules.json", + "title": "Data Product Designation", + "severity": "MUST", + "ruleClass": "topology", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "A contract of a named architecture topology. The predicate is about declared topology configuration, not about code structure." + }, + { + "ruleId": "DAM-R02", + "sourceFile": "topologies/data-mesh/data-mesh.rules.json", + "title": "Data Contracts", + "severity": "MUST", + "ruleClass": "topology", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "A contract of a named architecture topology. The predicate is about declared topology configuration, not about code structure." + }, + { + "ruleId": "DAM-R03", + "sourceFile": "topologies/data-mesh/data-mesh.rules.json", + "title": "Federated Governance", + "severity": "MUST", + "ruleClass": "topology", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "A contract of a named architecture topology. The predicate is about declared topology configuration, not about code structure." + }, + { + "ruleId": "DAM-R04", + "sourceFile": "topologies/data-mesh/data-mesh.rules.json", + "title": "Data Product Lineage Tracking", + "severity": "MUST", + "ruleClass": "topology", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "needs-external-system", + "note": "A contract of a named architecture topology. The predicate is about declared topology configuration, not about code structure." + }, + { + "ruleId": "DAM-R05", + "sourceFile": "topologies/data-mesh/data-mesh.rules.json", + "title": "Retention Policy on Data Products", + "severity": "MUST", + "ruleClass": "topology", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "A contract of a named architecture topology. The predicate is about declared topology configuration, not about code structure." + }, + { + "ruleId": "DAM-R06", + "sourceFile": "topologies/data-mesh/data-mesh.rules.json", + "title": "Explicit Consumption Contracts", + "severity": "MUST", + "ruleClass": "topology", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "needs-external-system", + "note": "A contract of a named architecture topology. The predicate is about declared topology configuration, not about code structure." + }, + { + "ruleId": "DAM-R07", + "sourceFile": "topologies/data-mesh/data-mesh.rules.json", + "title": "Data Quality SLO Declaration", + "severity": "MUST", + "ruleClass": "topology", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "A contract of a named architecture topology. The predicate is about declared topology configuration, not about code structure." + }, + { + "ruleId": "DAM-R08", + "sourceFile": "topologies/data-mesh/data-mesh.rules.json", + "title": "Data Contract Backward Compatibility", + "severity": "MUST", + "ruleClass": "topology", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "unimplemented-native", + "note": "A contract of a named architecture topology. The predicate is about declared topology configuration, not about code structure." + }, + { + "ruleId": "DAM-R09", + "sourceFile": "topologies/data-mesh/data-mesh.rules.json", + "title": "Data Product Discoverability Registration", + "severity": "SHOULD", + "ruleClass": "topology", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "needs-external-system", + "note": "A contract of a named architecture topology. The predicate is about declared topology configuration, not about code structure." + }, + { + "ruleId": "EC-R01", + "sourceFile": "topologies/edge-computing/edge-computing.rules.json", + "title": "Mandatory Synchronization Strategy", + "severity": "MUST", + "ruleClass": "topology", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "A contract of a named architecture topology. The predicate is about declared topology configuration, not about code structure." + }, + { + "ruleId": "EC-R02", + "sourceFile": "topologies/edge-computing/edge-computing.rules.json", + "title": "Edge Node Isolation", + "severity": "MUST", + "ruleClass": "topology", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "A contract of a named architecture topology. The predicate is about declared topology configuration, not about code structure." + }, + { + "ruleId": "EC-R03", + "sourceFile": "topologies/edge-computing/edge-computing.rules.json", + "title": "Conflict Resolution Strategy", + "severity": "MUST", + "ruleClass": "topology", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "A contract of a named architecture topology. The predicate is about declared topology configuration, not about code structure." + }, + { + "ruleId": "EC-SEC-01", + "sourceFile": "topologies/edge-computing/edge-computing.rules.json", + "title": "Network Security Profile", + "severity": "MUST", + "ruleClass": "topology", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "underspecified", + "note": "A contract of a named architecture topology. The predicate is about declared topology configuration, not about code structure." + }, + { + "ruleId": "EC-SEC-02", + "sourceFile": "topologies/edge-computing/edge-computing.rules.json", + "title": "mTLS Enforcement", + "severity": "MUST", + "ruleClass": "topology", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "underspecified", + "note": "A contract of a named architecture topology. The predicate is about declared topology configuration, not about code structure." + }, + { + "ruleId": "ED-R01", + "sourceFile": "topologies/event-driven/event-driven.rules.json", + "title": "Strict AsyncAPI Contract", + "severity": "MUST", + "ruleClass": "topology", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "A contract of a named architecture topology. The predicate is about declared topology configuration, not about code structure." + }, + { + "ruleId": "ED-R02", + "sourceFile": "topologies/event-driven/event-driven.rules.json", + "title": "Transactional Outbox", + "severity": "MUST", + "ruleClass": "topology", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "A contract of a named architecture topology. The predicate is about declared topology configuration, not about code structure." + }, + { + "ruleId": "ED-R03", + "sourceFile": "topologies/event-driven/event-driven.rules.json", + "title": "Dead Letter Queue", + "severity": "MUST", + "ruleClass": "topology", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "A contract of a named architecture topology. The predicate is about declared topology configuration, not about code structure." + }, + { + "ruleId": "ED-R04", + "sourceFile": "topologies/event-driven/event-driven.rules.json", + "title": "Event Ordering Guarantee", + "severity": "MUST", + "ruleClass": "topology", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "A contract of a named architecture topology. The predicate is about declared topology configuration, not about code structure." + }, + { + "ruleId": "ED-R05", + "sourceFile": "topologies/event-driven/event-driven.rules.json", + "title": "Idempotent Consumer Contract", + "severity": "MUST", + "ruleClass": "topology", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "A contract of a named architecture topology. The predicate is about declared topology configuration, not about code structure." + }, + { + "ruleId": "ED-R06", + "sourceFile": "topologies/event-driven/event-driven.rules.json", + "title": "Backward-Compatible Schema Evolution", + "severity": "MUST", + "ruleClass": "topology", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "A contract of a named architecture topology. The predicate is about declared topology configuration, not about code structure." + }, + { + "ruleId": "ED-R07", + "sourceFile": "topologies/event-driven/event-driven.rules.json", + "title": "Retention Policy Declaration", + "severity": "MUST", + "ruleClass": "topology", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "unimplemented-native", + "note": "A contract of a named architecture topology. The predicate is about declared topology configuration, not about code structure." + }, + { + "ruleId": "ED-R08", + "sourceFile": "topologies/event-driven/event-driven.rules.json", + "title": "Event Observability (Correlation and Trace Propagation)", + "severity": "MUST", + "ruleClass": "topology", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "A contract of a named architecture topology. The predicate is about declared topology configuration, not about code structure." + }, + { + "ruleId": "ED-R09", + "sourceFile": "topologies/event-driven/event-driven.rules.json", + "title": "Explicit Consumer Group Registration", + "severity": "SHOULD", + "ruleClass": "topology", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "unimplemented-native", + "note": "A contract of a named architecture topology. The predicate is about declared topology configuration, not about code structure." + }, + { + "ruleId": "DM-R01", + "sourceFile": "topologies/progressive-axis/distributed-modules/distributed-modules.rules.json", + "title": "Module Owns Its Lifecycle", + "severity": "MUST", + "ruleClass": "topology", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "A contract of a named architecture topology. The predicate is about declared topology configuration, not about code structure." + }, + { + "ruleId": "DM-R02", + "sourceFile": "topologies/progressive-axis/distributed-modules/distributed-modules.rules.json", + "title": "Inter-Module Contracts are Explicit and Versioned", + "severity": "MUST", + "ruleClass": "topology", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "A contract of a named architecture topology. The predicate is about declared topology configuration, not about code structure." + }, + { + "ruleId": "DM-R03", + "sourceFile": "topologies/progressive-axis/distributed-modules/distributed-modules.rules.json", + "title": "Module Data Isolation Enforced", + "severity": "MUST", + "ruleClass": "topology", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "A contract of a named architecture topology. The predicate is about declared topology configuration, not about code structure." + }, + { + "ruleId": "DM-R04", + "sourceFile": "topologies/progressive-axis/distributed-modules/distributed-modules.rules.json", + "title": "Async Events Have Schema-Validated Payloads", + "severity": "MUST", + "ruleClass": "topology", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "A contract of a named architecture topology. The predicate is about declared topology configuration, not about code structure." + }, + { + "ruleId": "DM-R05", + "sourceFile": "topologies/progressive-axis/distributed-modules/distributed-modules.rules.json", + "title": "Distributed Tracing Across Modules", + "severity": "MUST", + "ruleClass": "topology", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "A contract of a named architecture topology. The predicate is about declared topology configuration, not about code structure." + }, + { + "ruleId": "DM-R06", + "sourceFile": "topologies/progressive-axis/distributed-modules/distributed-modules.rules.json", + "title": "Modules Deployable Independently", + "severity": "MUST", + "ruleClass": "topology", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "unimplemented-native", + "note": "A contract of a named architecture topology. The predicate is about declared topology configuration, not about code structure." + }, + { + "ruleId": "DM-R07", + "sourceFile": "topologies/progressive-axis/distributed-modules/distributed-modules.rules.json", + "title": "Circuit Breaker for Inter-Module Calls", + "severity": "MUST", + "ruleClass": "topology", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "unimplemented-native", + "note": "A contract of a named architecture topology. The predicate is about declared topology configuration, not about code structure." + }, + { + "ruleId": "DM-R08", + "sourceFile": "topologies/progressive-axis/distributed-modules/distributed-modules.rules.json", + "title": "Maintain F2 Extraction Score", + "severity": "MUST", + "ruleClass": "topology", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "A contract of a named architecture topology. The predicate is about declared topology configuration, not about code structure." + }, + { + "ruleId": "MS-R01", + "sourceFile": "topologies/progressive-axis/microservices/microservices.rules.json", + "title": "True Independent Deployability", + "severity": "MUST", + "ruleClass": "topology", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "unimplemented-native", + "note": "A contract of a named architecture topology. The predicate is about declared topology configuration, not about code structure." + }, + { + "ruleId": "MS-R02", + "sourceFile": "topologies/progressive-axis/microservices/microservices.rules.json", + "title": "Service Mesh Readiness", + "severity": "MUST", + "ruleClass": "topology", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "needs-external-system", + "note": "A contract of a named architecture topology. The predicate is about declared topology configuration, not about code structure." + }, + { + "ruleId": "MS-R03", + "sourceFile": "topologies/progressive-axis/microservices/microservices.rules.json", + "title": "Bulkhead Pattern per Service", + "severity": "MUST", + "ruleClass": "topology", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "needs-runtime", + "note": "A contract of a named architecture topology. The predicate is about declared topology configuration, not about code structure." + }, + { + "ruleId": "MS-R04", + "sourceFile": "topologies/progressive-axis/microservices/microservices.rules.json", + "title": "Fallback Behavior for All External Calls", + "severity": "MUST", + "ruleClass": "topology", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "needs-runtime", + "note": "A contract of a named architecture topology. The predicate is about declared topology configuration, not about code structure." + }, + { + "ruleId": "MS-R05", + "sourceFile": "topologies/progressive-axis/microservices/microservices.rules.json", + "title": "Contract Tests for All Inter-Service Contracts", + "severity": "MUST", + "ruleClass": "topology", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "unimplemented-native", + "note": "A contract of a named architecture topology. The predicate is about declared topology configuration, not about code structure." + }, + { + "ruleId": "MS-R06", + "sourceFile": "topologies/progressive-axis/microservices/microservices.rules.json", + "title": "Service Owns Its Data — No Shared Persistence", + "severity": "MUST", + "ruleClass": "topology", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "unimplemented-native", + "note": "A contract of a named architecture topology. The predicate is about declared topology configuration, not about code structure." + }, + { + "ruleId": "MS-R07", + "sourceFile": "topologies/progressive-axis/microservices/microservices.rules.json", + "title": "Service-Level Observability with SLOs", + "severity": "MUST", + "ruleClass": "topology", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "A contract of a named architecture topology. The predicate is about declared topology configuration, not about code structure." + }, + { + "ruleId": "MS-R08", + "sourceFile": "topologies/progressive-axis/microservices/microservices.rules.json", + "title": "Service-Level On-Call Ownership", + "severity": "MUST", + "ruleClass": "topology", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "needs-external-system", + "note": "A contract of a named architecture topology. The predicate is about declared topology configuration, not about code structure." + }, + { + "ruleId": "MM-R01", + "sourceFile": "topologies/progressive-axis/modular-monolith/modular-monolith.rules.json", + "title": "Single Deployment Unit", + "severity": "MUST", + "ruleClass": "topology", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "A contract of a named architecture topology. The predicate is about declared topology configuration, not about code structure." + }, + { + "ruleId": "MM-R02", + "sourceFile": "topologies/progressive-axis/modular-monolith/modular-monolith.rules.json", + "title": "Explicit Bounded Context Boundaries", + "severity": "MUST", + "ruleClass": "topology", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "A contract of a named architecture topology. The predicate is about declared topology configuration, not about code structure." + }, + { + "ruleId": "MM-R03", + "sourceFile": "topologies/progressive-axis/modular-monolith/modular-monolith.rules.json", + "title": "Ports and Adapters Boundary", + "severity": "MUST", + "ruleClass": "topology", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "A contract of a named architecture topology. The predicate is about declared topology configuration, not about code structure." + }, + { + "ruleId": "MM-R04", + "sourceFile": "topologies/progressive-axis/modular-monolith/modular-monolith.rules.json", + "title": "Inter-Context Communication via Ports", + "severity": "MUST", + "ruleClass": "topology", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "A contract of a named architecture topology. The predicate is about declared topology configuration, not about code structure." + }, + { + "ruleId": "MM-R05", + "sourceFile": "topologies/progressive-axis/modular-monolith/modular-monolith.rules.json", + "title": "No Shared Database Across Bounded Contexts", + "severity": "MUST", + "ruleClass": "topology", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "A contract of a named architecture topology. The predicate is about declared topology configuration, not about code structure." + }, + { + "ruleId": "MM-R06", + "sourceFile": "topologies/progressive-axis/modular-monolith/modular-monolith.rules.json", + "title": "Async Events Use Domain Events", + "severity": "MUST", + "ruleClass": "topology", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "A contract of a named architecture topology. The predicate is about declared topology configuration, not about code structure." + }, + { + "ruleId": "MM-R07", + "sourceFile": "topologies/progressive-axis/modular-monolith/modular-monolith.rules.json", + "title": "Maintain Extraction Readiness Score", + "severity": "MUST", + "ruleClass": "topology", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "A contract of a named architecture topology. The predicate is about declared topology configuration, not about code structure." + }, + { + "ruleId": "MM-R08", + "sourceFile": "topologies/progressive-axis/modular-monolith/modular-monolith.rules.json", + "title": "Observability Instrumentation", + "severity": "MUST", + "ruleClass": "topology", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "A contract of a named architecture topology. The predicate is about declared topology configuration, not about code structure." + }, + { + "ruleId": "MM-R09", + "sourceFile": "topologies/progressive-axis/modular-monolith/modular-monolith.rules.json", + "title": "Strict Dependency Inversion Principle (DIP)", + "severity": "MUST", + "ruleClass": "topology", + "iso5055": { + "cwes": [ + 1047 + ], + "weaknesses": [ + "Modules with Circular Dependencies" + ], + "measures": [ + "Maintainability" + ], + "strength": "partial" + }, + "analyser": { + "adoptable": "yes", + "examples": [ + "dependency-cruiser", + "ArchUnit" + ] + }, + "nativeEvaluability": "native-handler", + "note": "A contract of a named architecture topology. The predicate is about declared topology configuration, not about code structure." + }, + { + "ruleId": "MM-R10", + "sourceFile": "topologies/progressive-axis/modular-monolith/modular-monolith.rules.json", + "title": "AST-Based Code Analysis Mandatory", + "severity": "MUST", + "ruleClass": "topology", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "yes", + "examples": [ + "any AST analyser" + ] + }, + "nativeEvaluability": "native-handler", + "note": "The rule literally requires that an AST analyser be in place; adopting one satisfies it." + }, + { + "ruleId": "MM-R11", + "sourceFile": "topologies/progressive-axis/modular-monolith/modular-monolith.rules.json", + "title": "Strict UI and Logic Isolation (SoC)", + "severity": "MUST", + "ruleClass": "topology", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "A contract of a named architecture topology. The predicate is about declared topology configuration, not about code structure." + }, + { + "ruleId": "MM-R12", + "sourceFile": "topologies/progressive-axis/modular-monolith/modular-monolith.rules.json", + "title": "Pure Domain Model (Data Mapper Enforcement)", + "severity": "SHOULD", + "ruleClass": "topology", + "iso5055": { + "cwes": [ + 1090 + ], + "weaknesses": [ + "Method Containing Access of a Member Element from Another Class" + ], + "measures": [ + "Maintainability" + ], + "strength": "partial" + }, + "analyser": { + "adoptable": "partial", + "examples": [ + "SonarQube feature-envy style rules" + ] + }, + "nativeEvaluability": "native-handler", + "note": "A contract of a named architecture topology. The predicate is about declared topology configuration, not about code structure." + }, + { + "ruleId": "SV-R01", + "sourceFile": "topologies/serverless/serverless.rules.json", + "title": "Declared Serverless Contract", + "severity": "MUST", + "ruleClass": "topology", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "A contract of a named architecture topology. The predicate is about declared topology configuration, not about code structure." + }, + { + "ruleId": "SV-R02", + "sourceFile": "topologies/serverless/serverless.rules.json", + "title": "Stateless Execution", + "severity": "MUST", + "ruleClass": "topology", + "iso5055": { + "cwes": [ + 1042 + ], + "weaknesses": [ + "Static Member Data Element outside of a Singleton Class Element" + ], + "measures": [ + "Performance Efficiency" + ], + "strength": "partial" + }, + "analyser": { + "adoptable": "partial", + "examples": [ + "ESLint no-module-level-mutable-state style rules" + ] + }, + "nativeEvaluability": "native-handler", + "note": "Serverless statelessness shows up as static/module-level mutable state." + }, + { + "ruleId": "SV-R03", + "sourceFile": "topologies/serverless/serverless.rules.json", + "title": "Bounded Deployment Package", + "severity": "MUST", + "ruleClass": "topology", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "A contract of a named architecture topology. The predicate is about declared topology configuration, not about code structure." + }, + { + "ruleId": "SV-R04", + "sourceFile": "topologies/serverless/serverless.rules.json", + "title": "Cold-Start Readiness", + "severity": "MUST", + "ruleClass": "topology", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "native-handler", + "note": "A contract of a named architecture topology. The predicate is about declared topology configuration, not about code structure." + }, + { + "ruleId": "SV-SEC-01", + "sourceFile": "topologies/serverless/serverless.rules.json", + "title": "Network Security Profile", + "severity": "MUST", + "ruleClass": "topology", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "underspecified", + "note": "A contract of a named architecture topology. The predicate is about declared topology configuration, not about code structure." + }, + { + "ruleId": "SV-SEC-02", + "sourceFile": "topologies/serverless/serverless.rules.json", + "title": "mTLS Enforcement", + "severity": "MUST", + "ruleClass": "topology", + "iso5055": { + "cwes": [], + "weaknesses": [], + "measures": [], + "strength": "none" + }, + "analyser": { + "adoptable": "no", + "examples": [] + }, + "nativeEvaluability": "underspecified", + "note": "A contract of a named architecture topology. The predicate is about declared topology configuration, not about code structure." + } + ] +} diff --git a/.harness/scripts/ci/65-validate-standards-rule-class.test.mjs b/.harness/scripts/ci/65-validate-standards-rule-class.test.mjs index 309857d48..aaaf946ed 100644 --- a/.harness/scripts/ci/65-validate-standards-rule-class.test.mjs +++ b/.harness/scripts/ci/65-validate-standards-rule-class.test.mjs @@ -12,6 +12,10 @@ * generator and watched fail. The two that pass either way are labelled * REGRESSION rather than counted as proof of the fix. * + * GT-668 — that real pre-fix artifact is now a COMMITTED fixture + * (`.harness/fixtures/standards-rule-class/iso-5055-mapping.pre-gt-666.json`) + * rather than a `git show` of a moving branch ref. See `PRE_FIX_FIXTURE` below. + * * Run it with: node --test .harness/scripts/ci/65-validate-standards-rule-class.test.mjs */ import { test, describe } from 'node:test'; @@ -35,8 +39,26 @@ const HERE = path.dirname(fileURLToPath(import.meta.url)); const GUARD = path.join(HERE, '65-validate-standards-rule-class.mjs'); const REPO_ROOT = path.resolve(HERE, '../../..'); -/** The last commit that carried the defect. `develop` is where this branch left. */ -const PRE_FIX_REF = process.env.GT666_PRE_FIX_REF ?? 'origin/develop'; +/** + * The pre-fix artifact, COMMITTED (GT-668). + * + * This used to be `git show origin/develop:` — evidence anchored to a + * moving ref, which is not evidence. It read the defect for exactly as long as + * the fix lived on a branch; the moment GT-666 merged, `origin/develop` began + * serving the CORRECTED artifact and the case asserting 64 findings found 0. A + * test whose meaning changes without anyone editing it cannot be relied on to + * mean anything. Worse, it carried a shallow-clone skip, so in a slightly + * different checkout the same rot would have passed in silence. + * + * The intent — a REAL pre-fix artifact rather than a reconstruction, because a + * reconstruction only ever agrees with whatever the author believed was wrong — + * was right, and is preserved by freezing the artifact in the repository instead + * of fetching it at test time. See the fixture's own `_fixture` header. + */ +const PRE_FIX_FIXTURE = path.join( + REPO_ROOT, + '.harness/fixtures/standards-rule-class/iso-5055-mapping.pre-gt-666.json', +); /** The reason text the defect published, verbatim from the pre-fix artifact. */ const GOVERNANCE_NOTE = @@ -272,25 +294,41 @@ describe('65-validate-standards-rule-class', () => { test('the REAL pre-fix artifact, against the REAL packs, is RED — 16 rules, 4 findings each', () => { // The strongest available fixture: the mapping exactly as it was committed - // before this fix, read out of git rather than reconstructed, checked against - // today's packs. Reconstructed fixtures agree with whatever the author - // believed was wrong; this one cannot. - const before = spawnSync('git', ['show', `${PRE_FIX_REF}:${MAPPING_FILE}`], { - cwd: REPO_ROOT, - encoding: 'utf8', - maxBuffer: 64 * 1024 * 1024, - }); - if (before.status !== 0) { - // A shallow clone or a detached history cannot answer this. Skipping is - // honest; passing silently would not be. - return void assert.ok(true, `SKIPPED: git show ${PRE_FIX_REF}:${MAPPING_FILE} is unavailable here`); - } + // before GT-666, checked against today's packs. Reconstructed fixtures agree + // with whatever the author believed was wrong; this one cannot — its body is + // byte-identical to the blob GT-666's parent commit carried. + // + // No skip and no env override on purpose. Both were escape hatches out of the + // one case that proves the guard was ever observed failing, and an escape + // hatch out of THAT can only ever hide a failure. The fixture is in the + // repository, so there is no checkout in which this cannot be answered; if it + // is unreadable, the right outcome is red. + const mapping = JSON.parse(readFileSync(PRE_FIX_FIXTURE, 'utf8')); const { packs } = findPacks(REPO_ROOT); - const findings = checkClassification({ packs, undeclaredInDir: [], mapping: JSON.parse(before.stdout) }); + const findings = checkClassification({ packs, undeclaredInDir: [], mapping }); assert.equal(findings.length, 64, 'each of the 16 rules should fail the class rule, the naming rule and both false-claim rules'); assert.equal(findings.filter((f) => /is classified `governance`/.test(f.message)).length, 16); }); + test('the frozen fixture is still the DEFECT, not a refresh of the fixed mapping', () => { + // The failure mode this fixture invites: somebody "updates" it from the live + // artifact, every assertion above still passes shape-wise with zero findings, + // and the only observed failure of this guard quietly becomes a copy of the + // thing it catches. The 64/16 counts above already go red if that happens; + // this states the reason out loud, and pins that the fixture is NOT the file + // the repository ships today. + const frozen = JSON.parse(readFileSync(PRE_FIX_FIXTURE, 'utf8')); + const live = JSON.parse(readFileSync(path.join(REPO_ROOT, MAPPING_FILE), 'utf8')); + assert.match(frozen._fixture ?? '', /FROZEN NEGATIVE FIXTURE/, 'the fixture lost its provenance header'); + const keyOf = (r) => `${r.ruleId}@${r.sourceFile}`; + const frozenRows = new Map(frozen.rules.map((r) => [keyOf(r), r])); + const standardsRows = live.rules.filter((r) => r.ruleClass === STANDARD_CLASS).map(keyOf); + assert.equal(standardsRows.length, 16, 'the live mapping should carry 16 international-standard rows'); + for (const key of standardsRows) { + assert.equal(frozenRows.get(key)?.ruleClass, 'governance', `${key} is no longer frozen at the defect`); + } + }); + // --- REGRESSION (passes before and after the fix; kept, not counted as proof) test('REGRESSION: a valid row yields no findings', () => { diff --git a/reference/core/control-center/evidence/gap-closure-evidence.json b/reference/core/control-center/evidence/gap-closure-evidence.json index 1d471f389..53c78f82f 100644 --- a/reference/core/control-center/evidence/gap-closure-evidence.json +++ b/reference/core/control-center/evidence/gap-closure-evidence.json @@ -10027,6 +10027,31 @@ ], "dependencyDisposition": "none", "dependencyRationale": "No dependency added or changed. The generator gains no import: the classification signal is a field the packs already carry, and the reason text is built from that same field. The new guard imports only node builtins plus the repository's own .harness/scripts/lib/coverage.mjs. Deliberately NOT done, and named rather than left to be discovered: (1) the analyser.adoptable correction on the four ISO5055-* rows, which is a different claim with its own arithmetic and is registered separately; (2) any change to the corpus itself - no rule was added, removed or re-authored, which is why every pinned count in rule-corpus-triage.spec.ts is unchanged and why that is stated as the assertion rather than as an incidental. Also observed and stated rather than presented as part of the fix: the standards README figures had been stale since GT-662..GT-665 (391 rules / 175 files against a real 412 / 180); they were refreshed from the regenerated artifact in the same pass because the class breakdown this change moves is one of the sentences they carry, and leaving it would have made the prose more wrong than before." + }, + { + "id": "GT-668", + "closedAt": "2026-08-09", + "closureCommit": "PENDING", + "evidence": [ + ".harness/scripts/ci/65-validate-standards-rule-class.test.mjs", + ".harness/fixtures/standards-rule-class/iso-5055-mapping.pre-gt-666.json" + ], + "validationCommands": [ + "THE DEFECT, REPRODUCED BEFORE IT WAS ACTED ON rather than taken from the handover: on develop at 59d62bae, `node --test .harness/scripts/ci/65-validate-standards-rule-class.test.mjs` -> 19 tests, 18 pass, 1 fail. The failing case is 'the REAL pre-fix artifact, against the REAL packs, is RED' with AssertionError 0 !== 64. Cause located in the case itself: it read the pre-fix mapping with spawnSync('git', ['show', `${PRE_FIX_REF}:${MAPPING_FILE}`]) and PRE_FIX_REF defaulted to 'origin/develop' — a MOVING ref that served the defective artifact only while the fix lived on a branch. 59d62bae merged it, so origin/develop now serves the CORRECTED artifact and the case finds 0 findings where it asserts 64.", + "THE SECOND DEFECT, worse than the stale number: the same case carried `if (before.status !== 0) return void assert.ok(true, 'SKIPPED: ...')` for shallow clones. Under fetch-depth:1, a detached history, or a fork without origin/develop, the identical rot PASSES IN SILENCE instead of failing — an escape hatch out of the one case that establishes this guard has ever been OBSERVED failing.", + "THE FIXTURE, taken from git history and not reconstructed: `git rev-parse 59d62bae^` -> 0130834678599d7b7ba3f1295ee9ea4a7ee0e1bd (the last commit carrying the defect); `git rev-parse 59d62bae^:src/rulesets/standards/iso-5055-mapping.json` -> blob 6684e8a42e9d179d36c308a0cf22909c210a18e3. Committed verbatim at .harness/fixtures/standards-rule-class/iso-5055-mapping.pre-gt-666.json — the fixtures location this repository already uses (.harness/fixtures//, alongside rag-eval/), not a new home.", + "NOT TRIMMED, and the claim is checkable rather than asserted: all 412 rows kept (284 KB, same order as the live artifact already tracked). One top-level `_fixture` provenance key added because JSON has no comments; checkClassification reads only `rules` and `summary.byClass`, so it is inert. Dropping `_fixture` and re-serialising reproduces the blob BYTE FOR BYTE against `git cat-file blob 6684e8a4` -> true.", + "THE FINDINGS, MEASURED against the frozen fixture and the live packs: 64 total, broken down as 16 `is classified governance, not international-standard` + 16 `no international structural equivalent` + 16 `a governance invariant over Evolith artifacts` + 8 `never names NIST SP 800-218` + 4 `never names ISO/IEC 5055:2021` + 4 `never names SLSA`. Identical to the counts the case asserted before this change: nothing was weakened into a shape test.", + "THE GIT SHOW, THE ENV VAR AND THE SKIP ARE DELETED. No replacement skip: a shallow clone constrains a test that shells out to git, not one that reads a file in its own working tree, so an unreadable fixture is a genuine failure and red is the right outcome.", + "THE REFRESH FAILURE MODE, OBSERVED not argued: simulated by writing the live src/rulesets/standards/iso-5055-mapping.json into the fixture (keeping the _fixture header) and re-running -> 20 tests, 18 pass, 2 FAIL ('the REAL pre-fix artifact ...' and the new 'the frozen fixture is still the DEFECT, not a refresh of the fixed mapping'). Fixture then restored and re-verified byte-identical to blob 6684e8a4.", + "node --test .harness/scripts/ci/65-validate-standards-rule-class.test.mjs -> 20 tests, 20 pass, 0 fail, 0 skipped (19/18-pass/1-fail before).", + "node .harness/scripts/ci/42-validate-guard-denominators.mjs -> 78 guards classified, 57/57 scanning guards refuse a zero-element scan, 0 PENDING.", + "node .harness/scripts/ci/43-validate-guard-negative-fixtures.mjs -> 54/54 exercised guards turned RED on the empty fixture, 0 reported a pass.", + "SCOPE, and why it does not collide with concurrent work: no corpus file, no generator and no derived artifact was touched. src/rulesets/standards/build-iso-5055-mapping.mjs and src/rulesets/standards/iso-5055-mapping.json are deliberately untouched — a parallel session is changing analyser.adoptable on the four ISO5055-* rows, which alters neither ruleClass nor the pack rule count, so the frozen 64/16 figures are unaffected by it.", + "ID ALLOCATION: node .harness/scripts/ci/49-validate-gap-id-allocation.mjs -> 0 collisions. Registered as GT-668 and NOT GT-667: GT-667 is claimed by branch name (guard 50 claims by `gt-NNN` branch) on two concurrent branches, gt-667-analyser-adoptable and claude/gt-667-iso5055-adoptable, both carrying the analyser.adoptable follow-on GT-666's closure record deferred. Guard 49 compares against origin/main and could not have seen either; the id was taken by UNION OF BRANCHES." + ], + "dependencyDisposition": "none", + "dependencyRationale": "No dependency added or changed, and none could be: the change deletes a dependency rather than adding one. The test previously depended on git AND on the remote-tracking ref origin/develop being present and pointing at the pre-fix artifact — an external, mutable input. It now reads a file committed in this repository, using only node:fs, which the file already imported. The fixture itself is inert data with no imports. Nothing is imported by relative path from domain code: this is a harness test reading a harness fixture, and the corpus JSON under src/rulesets is untouched." } ] } diff --git a/reference/core/control-center/gaps/gap-reference-catalog.es.md b/reference/core/control-center/gaps/gap-reference-catalog.es.md index c1147b919..767bdf7e4 100644 --- a/reference/core/control-center/gaps/gap-reference-catalog.es.md +++ b/reference/core/control-center/gaps/gap-reference-catalog.es.md @@ -8787,3 +8787,38 @@ La declaración tiene un hueco — un pack que no declara — y el directorio lo **Medido después.** 16 filas en `international-standard`; `governance` 71 → 55; totales del corpus intactos en 412 reglas sobre 180 archivos de ruleset; `mappedToIso5055`, `adoptedFraction` y todos los veredictos `analyser.adoptable` sin cambio. Esto reclasifica el mapeo y no toca el corpus, que es por lo que **ningún conteo fijado en `rule-corpus-triage.spec.ts` se movió** — una reconstrucción limpia completa de core-domain corre 157 suites / 1853 tests en verde. Las cifras de `README.md`/`README.es.md` se refrescaron desde el artefacto regenerado en la misma pasada; estaban obsoletas desde `GT-662`…`GT-665` (391 reglas / 175 archivos frente a 412 / 180 reales), lo cual precede a esta fila y se declara en vez de presentarse como parte del arreglo. **Lo que NO se afirma, y se halló al medir.** Las cuatro filas `ISO5055-*` siguen con `analyser.adoptable: no`, cuyo significado en la propia cabecera de este generador es *«el predicado es específico del repositorio o del producto y hay que escribirlo»*. Es falso: el pack lo decide el SARIF de un analizador estándar, que es lo que entregaron `GT-662`…`GT-664`, y las reglas lo declaran ellas mismas en `enforce.config.analyser` — una señal que llevan exactamente 4 reglas de las 412 del corpus, así que la corrección sería derivable y su radio son esas 4 filas. Es un segundo campo falso en las mismas filas que toca este cierre, y se deja a su propio gap en vez de colarlo en este diff, porque mueve `analyserAdoptable` y la aritmética del backlog de handlers que `GT-598` existe para producir — otra afirmación, que necesita su propio argumento. + +#### GT-668 + +**Título:** La prueba de GT-666 de que a su guarda se la había visto fallar estaba anclada a una referencia móvil, así que dejó de ser evidencia en el momento en que el arreglo se mergeó + +- **Propósito:** Convertir el único caso que prueba que `65-validate-standards-rule-class` estuvo roja alguna vez en evidencia que no puede pudrirse — un artefacto previo al arreglo commiteado en lugar de un `git show` de una rama — sin debilitar ni una sola afirmación, y quitar el salto que habría ocultado la podredumbre en vez de reportarla. +- **Evidencia:** **Reproducido sobre `develop` antes de cambiar nada, no tomado del traspaso.** `node --test .harness/scripts/ci/65-validate-standards-rule-class.test.mjs` en `59d62bae` falla exactamente uno de 19 casos — *the REAL pre-fix artifact, against the REAL packs, is RED* — con `AssertionError: 0 !== 64`. La causa está en el propio caso: obtenía el mapeo previo al arreglo con `spawnSync('git', ['show', `${PRE_FIX_REF}:${MAPPING_FILE}`])` y `PRE_FIX_REF` valía `origin/develop` por defecto. Esa referencia servía el artefacto DEFECTUOSO solo mientras el arreglo vivía en una rama; `59d62bae` lo mergeó, `origin/develop` empezó a servir el CORREGIDO, y un caso escrito para contar 64 hallazgos empezó a contar 0. Era verde en su propia rama y rojo justo cuando el arreglo aterrizó, bloqueando el PR de promoción `develop` → `main` **#483** en `Governance guards (GT-578)`. +- **Impacto:** Dos defectos distintos, y el segundo es peor que el número obsoleto. **Primero:** un test anclado a una referencia móvil cambia de significado sin que nadie lo edite — la fuente que lee la reescribe el mismísimo merge al que debía sobrevivir. **Segundo:** el caso llevaba `if (before.status !== 0) return void assert.ok(true, 'SKIPPED: …')` para clones superficiales. Un checkout de CI con `fetch-depth: 1`, un historial desprendido, un fork sin `origin/develop` — con cualquiera de esos, la misma podredumbre **pasa en silencio**. Ese salto es una vía de escape del ÚNICO caso que prueba que a esta guarda se la ha visto fallar en vez de solo haberla declarado capaz de hacerlo, que es justo la propiedad que `43-validate-guard-negative-fixtures` existe para establecer y la que este backlog encuentra ausente una y otra vez. +- **Archivos afectados:** `.harness/scripts/ci/65-validate-standards-rule-class.test.mjs`, `.harness/fixtures/standards-rule-class/iso-5055-mapping.pre-gt-666.json` +- **Componente:** `Evolith Core` · **Criticidad:** P1 · **Complejidad:** XS +- **Principal:** `XS` · **Interés:** `HIGH` · **Base:** `estimate` +- **Procedencia:** Registrado el 2026-08-09 a partir del job rojo `Governance guards (GT-578)` en el PR de promoción #483. **Registrado como `GT-668` y no `GT-667`:** `GT-667` está reclamado por dos ramas concurrentes — `gt-667-analyser-adoptable` y `claude/gt-667-iso5055-adoptable` — que llevan el seguimiento de `analyser.adoptable` que el propio registro de cierre de `GT-666` difirió. `49-validate-gap-id-allocation` compara contra `origin/main` y no podía ver ninguna de las dos, así que el id se tomó por unión de ramas y no solo por la respuesta de la guarda. +- **Criterios de aceptación:** + - [x] El `iso-5055-mapping.json` previo al arreglo queda COMMITEADO como fixture, tomado del historial de git y no reconstruido, y su procedencia se declara dentro del propio archivo. + - [x] La llamada a `git show`, la variable de entorno `PRE_FIX_REF` y el salto por clon superficial quedan eliminados — el test lee el repositorio y nada más. + - [x] Las afirmaciones quedan sin cambios y sin debilitar: 64 hallazgos, 16 de ellos `is classified `governance``. + - [x] Un «refresco» posterior del fixture desde el artefacto arreglado es ROJO, y se le vio estar rojo en vez de argumentarse que lo estaría. + - [x] `42-validate-guard-denominators` y `43-validate-guard-negative-fixtures` siguen pasando. +- **Estado:** `COMPLETADO` (2026-08-09) + +**La intención era correcta; solo el mecanismo estaba mal.** El comentario del propio caso explica por qué importa un artefacto real, y merece conservarse palabra por palabra: *«leído de git en vez de reconstruido … Los fixtures reconstruidos coinciden con lo que el autor creía que estaba mal; este no puede.»* Eso es un argumento a favor de un artefacto REAL previo al arreglo. No es un argumento para ir a buscarlo en tiempo de test, y ambas cosas se confundieron. El arreglo las separa: el artefacto sigue siendo real y deja de buscarse. + +**Qué se congeló y de dónde.** `src/rulesets/standards/iso-5055-mapping.json` tal como estaba en `01308346` — el padre de `59d62bae`, es decir el último commit que llevaba el defecto — blob `6684e8a4`, ahora commiteado en `.harness/fixtures/standards-rule-class/iso-5055-mapping.pre-gt-666.json`. La ubicación de fixtures es la que este repositorio ya usa para evidencia de CI commiteada, `.harness/fixtures//`, junto a `rag-eval/`; no se inventó un sitio nuevo. + +**NO está recortado.** Se conservan las 412 filas, no solo las 16 que sostienen la afirmación. Recortar es un acto editorial, y un acto editorial sobre un fixture cuyo valor entero es que no lo tocó la creencia de ningún autor es exactamente aquello contra lo que advierte el comentario. El coste son 284 KB, el mismo orden que el artefacto vivo que este repositorio ya versiona, que no es un tamaño que exija aplicar criterio. + +**Se añadió una clave y es verificable.** JSON no admite comentarios, así que la cabecera de procedencia es una cadena `_fixture` de primer nivel que nombra qué es el archivo, de qué commit y blob viene, y que está congelado a propósito. `checkClassification` lee solo `rules` y `summary.byClass`, así que la clave es inerte para la afirmación. Que nada más cambió es comprobable en vez de afirmado: quitar `_fixture` y volver a serializar reproduce el blob **byte a byte**, verificado con `git cat-file blob 6684e8a4`. + +**No se relajó nada; se añadió un caso.** Los conteos son los dos que el caso siempre hizo — `findings.length === 64` y 16 coincidencias de `is classified `governance`` — medidos contra el fixture congelado y los packs vivos de hoy. El caso añadido, *the frozen fixture is still the DEFECT, not a refresh of the fixed mapping*, cierra el modo de fallo que crea la congelación: alguien regenera el fixture desde el artefacto vivo y el único fallo observado de esta guarda en el repositorio se convierte en silencio en una copia de lo que atrapa. **Esto se observó, no se razonó** — el refresco se simuló escribiendo el mapeo vivo dentro del fixture, y 2 de 20 casos se ponen rojos, el que cuenta entre ellos. + +**Por qué no se sustituyó el salto por otro.** Un clon superficial era una restricción real para un test que invocaba `git`; no lo es para un test que lee un archivo de su propio árbol de trabajo. No existe checkout en el que el fixture no esté disponible, así que un fixture ilegible es un fallo genuino y el resultado correcto es rojo. Quitar el salto elimina el único camino por el que este caso podía reportar un pase sin haber comprobado nada. + +**Medido después.** `node --test` sobre el archivo rehecho: **20 casos, 20 pasan, 0 fallan, 0 saltados** (19 antes, todos pasando salvo el caso que cuenta). `42-validate-guard-denominators`: 78 guardas clasificadas, 57/57 escáneres rechazan un escaneo de cero elementos. `43-validate-guard-negative-fixtures`: 54/54 guardas ejercitadas se pusieron rojas sobre el fixture vacío. **No se tocó ningún archivo del corpus, ningún generador ni ningún artefacto derivado** — esta fila cambia un test y añade un fixture, que es también por lo que no colisiona con el trabajo concurrente de `analyser.adoptable` sobre `build-iso-5055-mapping.mjs` e `iso-5055-mapping.json`. + +**Lo que NO se afirma.** El fixture congelado fija el lado previo al arreglo de la comparación; el lado vivo se sigue leyendo del repositorio, así que los conteos de aquí se sostienen mientras los tres packs de estándares conserven sus 16 reglas. Eso se afirma en otro punto del mismo archivo (`their rules … 16`) y deliberadamente no se duplica como segundo denominador. Esta fila tampoco reaudita los otros 64 autotests de guardas buscando el mismo patrón de referencia móvil; si `git show` contra una rama aparece en algún otro sitio, no se midió. diff --git a/reference/core/control-center/gaps/gap-reference-catalog.md b/reference/core/control-center/gaps/gap-reference-catalog.md index 62da7d284..ae42b9b1e 100644 --- a/reference/core/control-center/gaps/gap-reference-catalog.md +++ b/reference/core/control-center/gaps/gap-reference-catalog.md @@ -8881,3 +8881,38 @@ The declaration has one hole — a pack that does not declare — and the direct **Measured after.** 16 rows at `international-standard`; `governance` 71 → 55; corpus totals unmoved at 412 rules across 180 ruleset files; `mappedToIso5055`, `adoptedFraction` and every `analyser.adoptable` verdict unchanged. This reclassifies the mapping and does not touch the corpus, which is why **no pinned count in `rule-corpus-triage.spec.ts` moved** — a full clean rebuild of core-domain runs 157 suites / 1853 tests green. The `README.md`/`README.es.md` figures were refreshed from the regenerated artifact in the same pass; they had been stale since `GT-662`…`GT-665` (391 rules / 175 files against a real 412 / 180), which predates this row and is stated rather than presented as part of the fix. **What is NOT claimed, and was found while measuring.** The four `ISO5055-*` rows still carry `analyser.adoptable: no`, whose meaning in this generator's own header is *«the predicate is repository- or product-specific and must be authored»*. That is false: the pack is decided by an off-the-shelf analyser's SARIF, which is what `GT-662`…`GT-664` shipped, and the rules declare it themselves in `enforce.config.analyser` — a signal carried by exactly 4 rules in the whole 412-rule corpus, so the correction would be derivable and its blast radius is those 4 rows. It is a second false field in the same rows this closure touches, and it is left to its own gap rather than ridden in on this diff, because it moves `analyserAdoptable` and the handler-backlog arithmetic that `GT-598` exists to produce — a different claim, needing its own argument. + +#### GT-668 + +**Title:** GT-666's proof that its guard had been observed failing was anchored to a moving ref, so it stopped being evidence at the moment the fix merged + +- **Purpose:** Turn the one case that proves `65-validate-standards-rule-class` was ever red into evidence that cannot rot — a committed pre-fix artifact rather than a `git show` of a branch — without weakening a single assertion, and remove the skip that would have hidden the rot instead of reporting it. +- **Evidence:** **Reproduced on `develop` before anything was changed, not taken from the handover.** `node --test .harness/scripts/ci/65-validate-standards-rule-class.test.mjs` at `59d62bae` fails exactly one of 19 cases — *the REAL pre-fix artifact, against the REAL packs, is RED* — with `AssertionError: 0 !== 64`. The cause is in the case itself: it obtained the pre-fix mapping with `spawnSync('git', ['show', `${PRE_FIX_REF}:${MAPPING_FILE}`])` and `PRE_FIX_REF` defaulted to `origin/develop`. That ref served the DEFECTIVE artifact only while the fix lived on a branch; `59d62bae` merged it, `origin/develop` began serving the CORRECTED one, and a case written to count 64 findings started counting 0. It was green on its own branch and red exactly when the fix landed, blocking the `develop` → `main` promotion PR **#483** in `Governance guards (GT-578)`. +- **Impact:** Two distinct defects, and the second is worse than the stale number. **First:** a test anchored to a moving ref changes meaning without anyone editing it — the source it reads is rewritten by the very merge it is supposed to survive. **Second:** the case carried `if (before.status !== 0) return void assert.ok(true, 'SKIPPED: …')` for shallow clones. A CI checkout with `fetch-depth: 1`, a detached history, a fork without `origin/develop` — any of those and the identical rot **passes in silence**. That skip is an escape hatch out of the ONE case that proves this guard has ever been observed failing rather than merely declared able to, which is the property `43-validate-guard-negative-fixtures` exists to establish and the property this backlog keeps finding absent. +- **Affected files:** `.harness/scripts/ci/65-validate-standards-rule-class.test.mjs`, `.harness/fixtures/standards-rule-class/iso-5055-mapping.pre-gt-666.json` +- **Component:** `Evolith Core` · **Criticality:** P1 · **Complexity:** XS +- **Principal:** `XS` · **Interest:** `HIGH` · **Basis:** `estimate` +- **Provenance:** Registered 2026-08-09 from the red `Governance guards (GT-578)` job on promotion PR #483. **Registered as `GT-668` and not `GT-667`:** `GT-667` is claimed by two concurrent branches — `gt-667-analyser-adoptable` and `claude/gt-667-iso5055-adoptable` — carrying the `analyser.adoptable` follow-on that `GT-666`'s own closure record deferred. `49-validate-gap-id-allocation` compares against `origin/main` and could not have seen either, so the id was taken by union of branches rather than by the guard's answer alone. +- **Acceptance criteria:** + - [x] The pre-fix `iso-5055-mapping.json` is COMMITTED as a fixture, taken from git history rather than reconstructed, and its provenance is stated inside the file. + - [x] The `git show` call, the `PRE_FIX_REF` env var and the shallow-clone skip are deleted — the test reads the repository and nothing else. + - [x] The assertions are unchanged and unweakened: 64 findings, 16 of them `is classified `governance``. + - [x] A later "refresh" of the fixture from the fixed artifact is RED, and was observed being red rather than argued to be. + - [x] `42-validate-guard-denominators` and `43-validate-guard-negative-fixtures` still pass. +- **Status:** `DONE` (2026-08-09) + +**The intent was right; only the mechanism was wrong.** The case's own comment states why a real artifact matters, and it is worth keeping verbatim: *«read out of git rather than reconstructed … Reconstructed fixtures agree with whatever the author believed was wrong; this one cannot.»* That is an argument for a REAL pre-fix artifact. It is not an argument for fetching one at test time, and the two were conflated. The fix separates them: the artifact stays real, and it stops being fetched. + +**What was frozen, and from where.** `src/rulesets/standards/iso-5055-mapping.json` as it stood at `01308346` — the parent of `59d62bae`, i.e. the last commit that carried the defect — blob `6684e8a4`, now committed at `.harness/fixtures/standards-rule-class/iso-5055-mapping.pre-gt-666.json`. The fixtures location is the one this repository already uses for committed CI evidence, `.harness/fixtures//`, alongside `rag-eval/`; no new home was invented. + +**It is NOT trimmed.** All 412 rows are kept, not just the 16 that carry the assertion. Trimming is an editorial act, and an editorial act on a fixture whose entire value is that no author's belief touched it is the thing the comment warns against. The cost is 284 KB, the same order as the live artifact this repository already tracks, which is not a size that demands judgement be applied. + +**One key was added and it is verifiable.** JSON has no comments, so the provenance header is a top-level `_fixture` string naming what the file is, the commit and blob it came from, and that it is deliberately frozen. `checkClassification` reads `rules` and `summary.byClass` only, so the key is inert to the assertion. The claim that nothing else changed is checkable rather than asserted: dropping `_fixture` and re-serialising reproduces the blob **byte for byte**, verified with `git cat-file blob 6684e8a4`. + +**Nothing was relaxed; one case was added.** The counts are the same two the case always made — `findings.length === 64` and 16 matching `is classified `governance`` — measured against the frozen fixture and today's live packs. The added case, *the frozen fixture is still the DEFECT, not a refresh of the fixed mapping*, closes the failure mode the freeze creates: somebody regenerates the fixture from the live artifact, and the repository's only observed failure of this guard quietly becomes a copy of the thing it catches. **This was observed, not reasoned about** — the refresh was simulated by writing the live mapping into the fixture, and 2 of 20 cases turn red, the counting case among them. + +**Why no skip replaced it.** A shallow clone was a real constraint on a test that shelled out to `git`; it is not a constraint on a test that reads a file in its own working tree. There is no checkout in which the fixture is unavailable, so an unreadable fixture is a genuine failure and the right outcome is red. Removing the skip removes the only path by which this case could report a pass without having checked anything. + +**Measured after.** `node --test` on the reworked file: **20 cases, 20 pass, 0 fail, 0 skipped** (19 before, all passing except the counting case). `42-validate-guard-denominators`: 78 guards classified, 57/57 scanners refuse a zero-element scan. `43-validate-guard-negative-fixtures`: 54/54 exercised guards turned red on the empty fixture. **No corpus file, no generator and no derived artifact was touched** — this row changes a test and adds a fixture, which is also why it does not collide with the concurrent `analyser.adoptable` work on `build-iso-5055-mapping.mjs` and `iso-5055-mapping.json`. + +**What is NOT claimed.** The frozen fixture pins the pre-fix side of the comparison; the live side is still read from the repository, so the counts here hold as long as the three standards packs keep their 16 rules. That is asserted elsewhere in the same file (`their rules … 16`) and is deliberately not duplicated as a second denominator. This row also does not re-audit the other 64 guard self-tests for the same moving-ref pattern; whether `git show` against a branch appears anywhere else was not measured. diff --git a/reference/core/control-center/gaps/gap-tracking.es.md b/reference/core/control-center/gaps/gap-tracking.es.md index 7c39e76e2..efec4229c 100644 --- a/reference/core/control-center/gaps/gap-tracking.es.md +++ b/reference/core/control-center/gaps/gap-tracking.es.md @@ -679,9 +679,10 @@ Este tablero es la única fuente de verdad para deuda técnica, gaps, oportunida | [`GT-664`](./gap-reference-catalog.es.md#gt-664) | **ISO/IEC 5055 no se podía medir en absoluto desde `evolith validate`, y la superficie decía `passed`.** `GT-663` le dio denominador a la medición y salió **Reliability 0/74** y **Performance Efficiency 0/18** — dos de cuatro medidas jamás medidas, porque CodeQL y semgrep no las buscan. **ENTREGADO el 2026-08-09**, y lo primero que encontró el trabajo era peor que el hueco por el que se abrió: `evolith validate --select src/rulesets/standards/iso-5055.rules.json` devolvía en **0,24s con `status: passed`, `rulesChecked: 0`, `rulesSkipped: 4`**. Dos causas, ambas corregidas. (1) `ValidateSatelliteUseCase` reconstruye el validador cuando se nombra un motor — la CLI nombra uno en cada corrida — y copiaba cuatro colaboradores soltando el `processRunner`, así que el subsistema enforcer que `app.module.ts` cablea para «paridad GT-519» se creaba y se tiraba una llamada después. **Ninguna regla `enforce:` había corrido nunca en esta superficie**, incluidas las seis reglas `blocking: true` de dependency-cruiser de ADR-0002. (2) `DEFAULT_SANDBOX_POLICY` no permitía ni `semgrep`, ni `eslint`, ni `cat`, así que el adapter era denegado antes de lanzarse. **ESLint es ahora un segundo productor**, vía `src/rulesets/standards/eslint-cwe-map.json`: 14 reglas core → 11 de las 138 debilidades, cada fila argumentada desde el comportamiento documentado de la regla contra la Description del propio CWE y **verificada en build** contra el ESLint instalado (el id existe, no está deprecado, la descripción no cambió). **La procedencia nunca se colapsa:** ESLint no declara CWE para ninguna regla, así que un hallazgo mapeado se etiqueta como afirmación de Evolith — en el mensaje de la violación, en el aviso de cobertura y separado de los hallazgos etiquetados por el analizador. **Medido después: `status: warning`, `rulesChecked: 4`, `rulesSkipped: 0`, 445 hallazgos → 5 de 138 — Security 0/74, Reliability 0→1/74 (CWE-597, 23 hallazgos), Performance Efficiency 0/18, Maintainability 4/31.** **Performance Efficiency NO se movió, y el pack lo dice en su propio texto:** las dos reglas candidatas se rechazaron al leer los CWE — CWE-1050 es un bucle que consume recursos de plataforma, no paralelismo desaprovechado; CWE-1049 son consultas de datos, no un microtask de más. Otros doce mapeos candidatos quedan registrados como `rejected` con el argumento que mató a cada uno. Sin puntuación: un conteo de debilidades no es un veredicto, y 401 de los 445 vienen de reglas con umbral cuyos números no son portables. | `Evolith Core` | Cross | P1 | M | `COMPLETADO` | | [`GT-665`](./gap-reference-catalog.es.md#gt-665) | **SLSA era el último de los cuatro estándares que nombró `GT-600` sin implementación — y este repositorio lleva todo este tiempo produciendo procedencia SLSA real sin que nada la mida.** Verificado en vivo el 2026-08-09: `npm view @beyondnet/evolith-cli@1.2.2 --json` devuelve `dist.attestations.provenance.predicateType: "https://slsa.dev/provenance/v1"`, servido por el registry. El ítem 5 del documento de postura de cadena de suministro ya había escrito la consecuencia: *nada verifica automáticamente la presencia de la atestación; una release futura podría quitar `--provenance` en silencio y ningún check lo notaría.* **ENTREGADO 2026-08-09** como `src/rulesets/standards/slsa-v1.rules.json` más `SlsaRuleHandler`, cuatro reglas, las cuatro evaluadas. **Construido NATIVO, no como adaptador, y la diferencia es el punto:** `GT-662`/`GT-663` entregaron ISO/IEC 5055 sobre un analizador externo porque sus 138 debilidades son CWE estructurales que un handler sin parser no puede decidir — el Build track de SLSA pregunta qué DECLARA el productor, y un fichero de workflow más un manifiesto de paquete lo responden. Requisitos leídos de la especificación ese mismo día (`/spec/v1.0/levels`, `/requirements`, `/provenance`, `/spec/v1.2/build-track-basics`), no de memoria: Build L1 = la procedencia existe y se distribuye; Build L2 = la procedencia es auténtica (firmada con la identidad de la plataforma) y la construcción es hospedada. **Medido contra este repositorio: 4 evaluadas, 0 omitidas, 0 con error, `status: passed`** — 2 pasos de publicación entre `npm-release.yml` y `sdk-cli-release.yml`, ambos con `--provenance`, ambos construyendo antes de publicar, ambos jobs con `id-token: write`, y ninguno de los 12 manifiestos de paquete ofrece un script que publique. **Un dato del encargo había caducado y se corrige aquí:** la ruta `--tag beta` de `ci-cd.yml` que publicaba sin procedencia fue RETIRADA por `GT-570` el 2026-07-27, así que la asimetría para la que se escribió la regla ya no existe — la regla queda como su guarda de regresión y se afirma por PASO y no por fichero, que es la única forma que la habría cazado. **Dos falsos positivos míos, hallados al correrlo contra la realidad y fijados como fixtures:** un bloque de comentarios que explicaba `npm publish` se contó como paso de publicación (el defecto `RV.1.2` del pack SSDF, reproducido), y `id-token: write # required for npm provenance` falló un patrón anclado al final, reportando como incapaz de firmar justamente al workflow cuya atestación sirve el registry. **Lo que NO se afirma, nombrado en `notEvaluableHere` en vez de dejarlo por descubrir:** Build L3 completo (procedencia infalsificable y aislamiento son propiedades de la PLATAFORMA de construcción, no de ningún fichero), el tipo de predicado que sirve el registry, la verificación de firma — y **el pinning de acciones, que este repositorio incumpliría** (47 `actions/checkout@v7` y 41 `actions/setup-node@v7` frente a 4 usos fijados por SHA) **y que deliberadamente no se autoriza como regla SLSA**, porque las construcciones herméticas se aplazaron fuera de v1.0 y el pinning es un check de OpenSSF Scorecard. Poner un defecto real bajo el nombre del estándar equivocado es como una afirmación de conformidad deja de significar algo. | `Evolith Core` | Cross | P1 | M | `COMPLETADO` | | [`GT-666`](./gap-reference-catalog.es.md#gt-666) | **El mapeo del corpus describía 16 controles de conformidad de tres estándares internacionales publicados como invariantes de gobierno de Evolith — en el único documento cuyo propósito entero es que lo verifique alguien que no confía en nosotros.** `build-iso-5055-mapping.mjs` clasificaba cada regla por PREFIJO DE RUTA con una tabla `CLASS_BY_FILE` cuyo valor por defecto es `governance`, y la tabla no tenía fila `standards/`. Así que las 16 reglas de los tres packs — NIST SP 800-218 (8), ISO/IEC 5055:2021 (4), SLSA v1.0 Build track (4) — no coincidían con ningún prefijo, se publicaban como `ruleClass: governance` y heredaban el motivo de gobierno palabra por palabra: *«A governance invariant over Evolith artifacts (inheritance, open-core boundary, satellites, evidence). No international structural equivalent.»* **Cada cláusula de esa frase es falsa para una práctica del SSDF.** Nada estaba obsoleto y nada faltaba — `--check` pasaba, `46-validate-derived-artifact-order` reportaba la cadena al día y en punto fijo, y el artefacto afirmaba lo contrario de la verdad sobre su propio corpus en el registro de un argumento razonado. **ENTREGADO 2026-08-09.** El defecto se **verificó antes de actuar sobre él**, no se tomó del traspaso: las 16 filas se leyeron del `iso-5055-mapping.json` commiteado y el motivo citado arriba es su texto literal. **El arreglo deriva, no enumera.** Una fila `['standards/', 'international-standard']` habría hecho desaparecer el síntoma dejando intacto el mecanismo — el cuarto pack, si cae en otro sitio, volvería a caer en `governance`. La clasificación lee ahora **el bloque `standard` que el propio pack declara**, una declaración que viaja con el archivo, así que un pack se clasifica bien caiga donde caiga; se leen las dos formas que hay (`{id}` para ISO/IEC 5055, `{name, edition}` para SSDF y SLSA), porque un lector de una sola forma habría descartado en silencio dos de los tres packs y aun así habría reportado un pase. **El directorio es la segunda señal y se exige en la OTRA dirección:** un `*.rules.json` bajo `standards/` que lleve reglas sin declarar `standard` ahora **hace fallar al generador**, así que la única vía de reentrada que quedaba es un fallo de build y no un valor por defecto silencioso. **Cada motivo se deriva de esa misma declaración y nombra el estándar al que la regla pertenece** — una frase por clase habría sido el mismo defecto un nivel más abajo, un texto afirmado sobre todos los estándares y cierto de ninguno en particular; el pack de ISO/IEC 5055 recibe un motivo distinto al de los otros dos, y cuál aplica también se deriva, comparando el estándar declarado por el pack contra el que publica el índice de debilidades. **`65-validate-standards-rule-class.mjs` + autotest de 19 casos**, cableado en `Governance guards (GT-578)`, sostiene ambas direcciones y **se le VIO fallar contra el artefacto REAL previo al arreglo leído de git** — 64 hallazgos, 16 reglas x 4 reglas rotas — y no contra un fixture reconstruido que solo coincidiría con lo que el autor creía que estaba mal. **El autotest de la propia guarda encontró un defecto en la guarda:** contar solo los packs QUE DECLARAN como denominador hacía que un árbol cuyos packs hubieran perdido la declaración muriera con «el corpus se movió», el único diagnóstico seguramente falso — roja igual, nombrando la causa equivocada. **Medido después: 16 filas `international-standard`, `governance` 71 → 55, totales del corpus intactos en 412 reglas / 180 archivos, y todos los conteos fijados en `rule-corpus-triage.spec.ts` sin cambio** — esto reclasifica el mapeo, no toca el corpus. **Lo que NO se afirma, hallado al medir:** las cuatro filas `ISO5055-*` siguen con `analyser.adoptable: no`, cuyo significado declarado es «hay que escribirlo», mientras el pack lo decide el SARIF de un analizador estándar (`GT-662`…`GT-664`). Es un segundo campo falso en las mismas filas, es derivable de `enforce.config.analyser`, y se registra aparte en vez de colarlo en este diff. | `Evolith Core` | Cross | P1 | S | `COMPLETADO` | +| [`GT-668`](./gap-reference-catalog.es.md#gt-668) | **La prueba de `GT-666` de que a su guarda se la había visto fallar alguna vez estaba anclada a una REFERENCIA MÓVIL, así que dejó de ser evidencia justo en el momento en que el arreglo aterrizó.** El único caso que lee el artefacto real previo al arreglo lo obtenía con `git show ${PRE_FIX_REF}:iso-5055-mapping.json`, con `PRE_FIX_REF` por defecto a `origin/develop`. Eso solo es cierto mientras el arreglo vive en una rama: **`59d62bae` se mergeó, `origin/develop` empezó a servir el artefacto CORREGIDO, y el caso que afirma 64 hallazgos encontró 0** — verde en su propia rama, rojo justo cuando importaba, bloqueando el PR de promoción `develop` → `main` **#483** en `Governance guards (GT-578)`. **Reproducido antes de actuar**, no tomado del traspaso: `node --test` sobre `develop` en `59d62bae` falla ese caso con `0 !== 64` mientras los otros 18 pasan. **La mitad peor es la que nadie habría visto:** el caso llevaba `if (before.status !== 0) return void assert.ok(true, 'SKIPPED: …')` para clones superficiales, así que en un checkout con historial truncado la misma podredumbre habría **pasado en silencio** en vez de fallar — una vía de escape de la única prueba de que la guarda estuvo roja alguna vez. **ENTREGADO 2026-08-09.** El razonamiento del comentario era correcto y se conserva: *«leído de git en vez de reconstruido … Los fixtures reconstruidos coinciden con lo que el autor creía que estaba mal; este no puede.»* Eso argumenta a favor de un artefacto REAL previo al arreglo, no de leer una rama en tiempo de test — así que el artefacto queda **congelado en el repositorio**: `.harness/fixtures/standards-rule-class/iso-5055-mapping.pre-gt-666.json`, tomado de `01308346` (`59d62bae^`, blob `6684e8a4`), **sin recortar**, y verificado byte a byte idéntico a ese blob una vez se quita su única clave añadida `_fixture` de procedencia. El `git show`, la variable de entorno `PRE_FIX_REF` y el salto por clon superficial quedan **eliminados** — un salto solo puede ocultar un fallo. **Afirmaciones sin cambios y sin debilitar: 64 hallazgos, 16 de ellos `is classified `governance``**, medidos contra el fixture congelado y los packs de hoy. Se AÑADE un caso en vez de relajar ninguno: un fixture «refrescado» desde el mapeo vivo es ROJO, y eso se **observó** — se simuló el refresco y pone en rojo 2 de 20 casos, así que el fixture negativo no puede convertirse en silencio en una copia del artefacto que existe para atrapar. Metaguardas reejecutadas: `42` 78/78 clasificadas, `43` 54/54 vistas fallar. | `Evolith Core` | Cross | P1 | XS | `COMPLETADO` | -**Progreso:** 652 / 664 completados · 2 en progreso · 0 pendientes · 10 diferidos +**Progreso:** 653 / 665 completados · 2 en progreso · 0 pendientes · 10 diferidos **Oleada 2026-06-23 (auditoría profunda de Winston III):** Añadidos 14 gaps nuevos `GT-212`…`GT-225` del Winston Audit Playbook que cubren: higiene de estado ADR (GT-212), metadata + presupuestos operativos + corpus de guías por topología (GT-213, GT-217, GT-219), observabilidad + OpenAPI en controladores REST (GT-214, GT-215), paridad de input-schemas OPA + densidad de tests por topología (GT-216, GT-222), plantillas de rollback + on-call de Fase 05 (GT-218), cobertura de ramas CLI + paridad de envelope --format + limpieza de skip-list (GT-220, GT-224, GT-225), audit logging HTTP de MCP (GT-221), y tests e2e de paridad cross-surface (GT-223). diff --git a/reference/core/control-center/gaps/gap-tracking.md b/reference/core/control-center/gaps/gap-tracking.md index a092f2bac..67263afe6 100644 --- a/reference/core/control-center/gaps/gap-tracking.md +++ b/reference/core/control-center/gaps/gap-tracking.md @@ -679,9 +679,10 @@ This board is the single source of truth for technical debt, gaps, opportunities | [`GT-664`](./gap-reference-catalog.md#gt-664) | **ISO/IEC 5055 could not be measured at all from `evolith validate`, and the surface said `passed`.** `GT-663` gave the measurement a denominator and it read **Reliability 0/74** and **Performance Efficiency 0/18** — two of four measures never once measured, because CodeQL and semgrep do not look for them. **DELIVERED 2026-08-09**, and the first thing the work found was worse than the gap it was opened for: `evolith validate --select src/rulesets/standards/iso-5055.rules.json` returned in **0.24s with `status: passed`, `rulesChecked: 0`, `rulesSkipped: 4`**. Two causes, both fixed. (1) `ValidateSatelliteUseCase` rebuilds the validator whenever an engine is named — the CLI names one on every run — and copied four collaborators while dropping the `processRunner`, so the enforcer subsystem `app.module.ts` wires for «GT-519 parity» was created and discarded one call later. **No `enforce:` rule had ever run on this surface**, including ADR-0002's six `blocking: true` dependency-cruiser rules. (2) `DEFAULT_SANDBOX_POLICY` allowlisted none of `semgrep`/`eslint`/`cat`, so the adapter was denied before it spawned. **ESLint is now a second producer**, through `src/rulesets/standards/eslint-cwe-map.json`: 14 core rules → 11 of the 138 weaknesses, every row argued from the rule's documented behaviour against the CWE's own Description and **verified at build time** against the installed ESLint (id exists, not deprecated, description unchanged). **Provenance never collapses:** ESLint declares no CWE for any rule, so a mapped finding is labelled Evolith's claim — in the violation message, in the coverage advisory, split from analyser-tagged findings in the coverage record. **Measured after: `status: warning`, `rulesChecked: 4`, `rulesSkipped: 0`, 445 findings → 5 of 138 — Security 0/74, Reliability 0→1/74 (CWE-597, 23 findings), Performance Efficiency 0/18, Maintainability 4/31.** **Performance Efficiency did NOT move, and the pack now says so in its own text:** both candidate rules were rejected on reading the CWEs — CWE-1050 is a loop consuming platform resources, not forfeited parallelism; CWE-1049 is data queries, not one extra microtask. Twelve other candidate mappings are recorded as `rejected` with the argument that killed each. No scoring: a count of weaknesses is not a verdict, and 401 of the 445 come from threshold rules whose numbers are not portable. | `Evolith Core` | Cross | P1 | M | `DONE` | | [`GT-665`](./gap-reference-catalog.md#gt-665) | **SLSA was the last of the four standards `GT-600` named with no implementation — and this repository has been producing real SLSA provenance the whole time with nothing measuring it.** Verified live on 2026-08-09: `npm view @beyondnet/evolith-cli@1.2.2 --json` returns `dist.attestations.provenance.predicateType: "https://slsa.dev/provenance/v1"`, served by the registry. Item 5 of the supply-chain posture document had already written down the consequence — *nothing verifies attestation presence automatically; a future release could silently drop `--provenance` and no check would notice.* **DELIVERED 2026-08-09** as `src/rulesets/standards/slsa-v1.rules.json` plus `SlsaRuleHandler`, four rules, all four evaluated. **Built NATIVE, not as an adapter, and the difference is the point:** `GT-662`/`GT-663` shipped ISO/IEC 5055 over an external analyser because its 138 weaknesses are structural CWEs a handler with no parser cannot decide — the SLSA Build track asks what the PRODUCER declares, and a workflow file plus a package manifest answer it. Requirements read from the specification on the day (`/spec/v1.0/levels`, `/requirements`, `/provenance`, `/spec/v1.2/build-track-basics`), not recalled: Build L1 = provenance exists and is distributed; Build L2 = provenance is authentic (signed via the platform's identity) and the build is hosted. **Measured against this repository: 4 checked, 0 skipped, 0 errored, `status: passed`** — 2 publishing steps across `npm-release.yml` and `sdk-cli-release.yml`, both with `--provenance`, both building before they publish, both jobs carrying `id-token: write`, and none of 12 package manifests offering a script that publishes. **A fact in the assignment had expired and is corrected here:** the `--tag beta` path in `ci-cd.yml` that published without provenance was RETIRED by `GT-570` on 2026-07-27, so the asymmetry the rule was written for no longer exists — the rule stays as its regression guard and is asserted per STEP rather than per file, which is the only shape that would have caught it. **Two false positives of my own, found by running it against reality and pinned as fixtures:** a comment block explaining `npm publish` was counted as a publishing step (the SSDF pack's `RV.1.2` defect, reproduced), and `id-token: write # required for npm provenance` failed an end-anchored pattern, reporting the one workflow whose attestation the registry actually serves as unable to sign. **What is NOT claimed, and named in `notEvaluableHere` rather than left to be discovered:** Build L3 in full (unforgeable provenance and isolation are properties of the build PLATFORM, not of any file), the predicate type the registry serves, signature verification — and **action pinning, which this repository would fail** (47 `actions/checkout@v7` and 41 `actions/setup-node@v7` against 4 SHA-pinned uses) **and which is deliberately not authored as a SLSA rule**, because hermetic builds were deferred out of v1.0 and pinning is an OpenSSF Scorecard check. Putting a real defect under the wrong standard's name is how a compliance claim stops meaning anything. | `Evolith Core` | Cross | P1 | M | `DONE` | | [`GT-666`](./gap-reference-catalog.md#gt-666) | **The corpus mapping described 16 conformance controls of three published international standards as Evolith governance invariants — in the one document whose whole purpose is to be checkable by a reader who does not trust us.** `build-iso-5055-mapping.mjs` classified every rule by PATH PREFIX through a `CLASS_BY_FILE` table with `governance` as the fallback, and the table had no `standards/` row. So all 16 rules of the three packs — NIST SP 800-218 (8), ISO/IEC 5055:2021 (4), SLSA v1.0 Build track (4) — matched no prefix, were published as `ruleClass: governance`, and inherited the governance reason verbatim: *«A governance invariant over Evolith artifacts (inheritance, open-core boundary, satellites, evidence). No international structural equivalent.»* **Every clause of that sentence is false of an SSDF practice.** Nothing was stale and nothing was missing — `--check` passed, `46-validate-derived-artifact-order` reported the chain current and at a fixed point, and the artifact stated the opposite of the truth about its own corpus in the register of a considered argument. **DELIVERED 2026-08-09.** The defect was **verified before it was acted on**, not taken from the handover: the 16 rows were read out of the committed `iso-5055-mapping.json` and the note quoted above is its literal text. **The fix derives, it does not enumerate.** A `['standards/', 'international-standard']` row would have made the symptom disappear and left the mechanism intact — the fourth pack, landing anywhere else, would fall through to `governance` again. Classification now reads **the pack's own top-level `standard` block**, a declaration that travels with the file, so a pack classifies correctly wherever it lands; the two shipped shapes (`{id}` for ISO/IEC 5055, `{name, edition}` for SSDF and SLSA) are both read, because a reader of one shape would have silently dropped two of three packs and still reported a pass. **The directory is the second signal and it is enforced in the OTHER direction:** a `*.rules.json` under `standards/` carrying rules without a `standard` declaration now **fails the generator**, so the one remaining way back in is a build failure rather than a silent default. **Each note is derived from that same declaration and names the standard the rule belongs to** — a class-wide sentence would have been the same defect one level down, one text asserted over every standard and true of none in particular; the ISO/IEC 5055 pack gets a different note from the other two, and which one applies is itself derived by comparing the pack's declared standard against the one the weakness index publishes. **`65-validate-standards-rule-class.mjs` + 19-case self-test**, wired into `Governance guards (GT-578)`, holds both directions and **was observed failing against the REAL pre-fix artifact read out of git** — 64 findings, 16 rules x 4 rules broken — rather than against a reconstructed fixture that would only ever agree with what the author believed was wrong. **The guard's own self-test found a defect in the guard:** counting only DECLARING packs as the denominator meant a tree whose packs had all lost their declaration died with «the corpus moved», the one diagnosis certainly wrong — red either way, naming the wrong cause. **Measured after: 16 rows `international-standard`, `governance` 71 → 55, corpus totals unmoved at 412 rules / 180 files, and every pinned count in `rule-corpus-triage.spec.ts` unchanged** — this reclassifies the mapping, it does not touch the corpus. **NOT claimed, and found while measuring:** the four `ISO5055-*` rows still carry `analyser.adoptable: no`, whose stated meaning is «must be authored», while the pack is decided by an off-the-shelf analyser's SARIF (`GT-662`…`GT-664`). That is a second false field in the same rows, it is derivable from `enforce.config.analyser`, and it is registered separately rather than smuggled into this diff. | `Evolith Core` | Cross | P1 | S | `DONE` | +| [`GT-668`](./gap-reference-catalog.md#gt-668) | **`GT-666`'s proof that its guard had ever been observed failing was anchored to a MOVING REF, so it stopped being evidence at the exact moment the fix landed.** The one case that reads the real pre-fix artifact obtained it with `git show ${PRE_FIX_REF}:iso-5055-mapping.json`, `PRE_FIX_REF` defaulting to `origin/develop`. That is true only while the fix lives on a branch: **`59d62bae` merged, `origin/develop` began serving the CORRECTED artifact, and the case asserting 64 findings found 0** — green on its own branch, red the moment it mattered, blocking the `develop` → `main` promotion PR **#483** in `Governance guards (GT-578)`. **Reproduced before acting**, not taken from the handover: `node --test` on `develop` at `59d62bae` fails that one case with `0 !== 64` while the other 18 pass. **The worse half is the one nobody would have seen:** the case carried `if (before.status !== 0) return void assert.ok(true, 'SKIPPED: …')` for shallow clones, so in a checkout with a truncated history the same rot would have **passed in silence** rather than failing — an escape hatch out of the only case that proves the guard was ever red. **DELIVERED 2026-08-09.** The comment's reasoning was right and is kept: *«read out of git rather than reconstructed … Reconstructed fixtures agree with whatever the author believed was wrong; this one cannot.»* That argues for a REAL pre-fix artifact, not for reading a branch at test time — so the artifact is **frozen in the repository**: `.harness/fixtures/standards-rule-class/iso-5055-mapping.pre-gt-666.json`, taken from `01308346` (`59d62bae^`, blob `6684e8a4`), **not trimmed**, and verified byte-identical to that blob once its one added `_fixture` provenance key is dropped. The `git show`, the `PRE_FIX_REF` env var and the shallow-clone skip are **deleted** — a skip can only ever hide a failure. **Assertions unchanged and unweakened: 64 findings, 16 of them `is classified `governance``**, measured against the frozen fixture and today's packs. One case is ADDED rather than any relaxed: a fixture «refreshed» from the live mapping is RED, and that was **observed** — the refresh was simulated and turns 2 of 20 cases red, so the negative fixture cannot silently become a copy of the artifact it exists to catch. Meta-guards re-run: `42` 78/78 classified, `43` 54/54 observed failing. | `Evolith Core` | Cross | P1 | XS | `DONE` | -**Progress:** 652 / 664 done · 2 in progress · 0 pending · 10 deferred +**Progress:** 653 / 665 done · 2 in progress · 0 pending · 10 deferred **Wave 2026-06-23 (Winston deep audit III):** Added 14 new gaps `GT-212`…`GT-225` from the Winston Audit Playbook covering: ADR status hygiene (GT-212), topology manifest metadata + operational budgets + guidance corpus (GT-213, GT-217, GT-219), REST controller observability + OpenAPI (GT-214, GT-215), OPA input-schema parity + per-topology test density (GT-216, GT-222), SDLC Phase 05 rollback + on-call templates (GT-218), CLI branch coverage + envelope format coverage + skip-list cleanup (GT-220, GT-224, GT-225), MCP HTTP audit logging (GT-221), and cross-surface parity e2e tests (GT-223). diff --git a/reference/core/control-center/maturity-reports/executive-summary.es.md b/reference/core/control-center/maturity-reports/executive-summary.es.md index 109e9d8d9..b97732fb3 100644 --- a/reference/core/control-center/maturity-reports/executive-summary.es.md +++ b/reference/core/control-center/maturity-reports/executive-summary.es.md @@ -42,14 +42,14 @@ La forma correcta de usar este resumen es simple: si necesitas contexto, abre so | Indicador | Valor | |---|---:| | Fecha canónica del tablero | 2026-08-08 | -| Gaps totales | 664 | -| Gaps cerrados | 652 | +| Gaps totales | 665 | +| Gaps cerrados | 653 | | Gaps pendientes | 12 | | P0 abiertos | 1 | | P1 abiertos | 3 | | P2 abiertos | 5 | | Cierre total | 98.2% | -| Registros de evidencia de cierre | 634 | +| Registros de evidencia de cierre | 635 | | Readiness registrado | 4 PASS | | Área | Pendientes | P0 | P1 | Primeros IDs | diff --git a/reference/core/control-center/maturity-reports/executive-summary.md b/reference/core/control-center/maturity-reports/executive-summary.md index d39b63084..e19cb41da 100644 --- a/reference/core/control-center/maturity-reports/executive-summary.md +++ b/reference/core/control-center/maturity-reports/executive-summary.md @@ -42,14 +42,14 @@ Use this summary with a simple rule: if you need context, open only the linked I | Indicator | Value | |---|---:| | Canonical board date | 2026-08-08 | -| Total gaps | 664 | -| Closed gaps | 652 | +| Total gaps | 665 | +| Closed gaps | 653 | | Open gaps | 12 | | Open P0 | 1 | | Open P1 | 3 | | Open P2 | 5 | | Total closure | 98.2% | -| Closure evidence records | 634 | +| Closure evidence records | 635 | | Recorded readiness | 4 PASS | | Area | Open | P0 | P1 | First IDs | diff --git a/reference/core/control-center/maturity-reports/maturity-reconciliation.json b/reference/core/control-center/maturity-reports/maturity-reconciliation.json index a49824ff6..6788ab542 100644 --- a/reference/core/control-center/maturity-reports/maturity-reconciliation.json +++ b/reference/core/control-center/maturity-reports/maturity-reconciliation.json @@ -3,14 +3,14 @@ "scope": "evolith-core", "asOf": "2026-08-08", "gaps": { - "total": 664, - "done": 652, + "total": 665, + "done": 653, "pending": 0, "inProgress": 2, "deferred": 10 }, "evidence": { - "closureRecords": 634, + "closureRecords": 635, "cliPackage": "@beyondnet/evolith-cli@1.2.2", "adrCount": 140, "rulesetCount": 180, From 546e73e429797ef7cb9fd41401241598850e0c66 Mon Sep 17 00:00:00 2001 From: aarroyo Date: Sun, 9 Aug 2026 22:54:17 -0500 Subject: [PATCH 2/9] chore(evidence): point GT-668's closure at the commit that carries it a620ed3d is the commit with the frozen fixture and the reworked self-test. 08-validate-tracking now passes: 665 gaps, 641/641 EN/ES catalog sections, 635 closure records. Co-Authored-By: Claude Opus 5 --- .../core/control-center/evidence/gap-closure-evidence.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/reference/core/control-center/evidence/gap-closure-evidence.json b/reference/core/control-center/evidence/gap-closure-evidence.json index 53c78f82f..77f644e1f 100644 --- a/reference/core/control-center/evidence/gap-closure-evidence.json +++ b/reference/core/control-center/evidence/gap-closure-evidence.json @@ -10031,7 +10031,7 @@ { "id": "GT-668", "closedAt": "2026-08-09", - "closureCommit": "PENDING", + "closureCommit": "a620ed3d", "evidence": [ ".harness/scripts/ci/65-validate-standards-rule-class.test.mjs", ".harness/fixtures/standards-rule-class/iso-5055-mapping.pre-gt-666.json" From dc67f7771cee98e2b2b013e63eb0fa064ad8a166 Mon Sep 17 00:00:00 2001 From: aarroyo Date: Sun, 9 Aug 2026 22:56:27 -0500 Subject: [PATCH 3/9] docs(gaps): GT-666's catalog entry described a mechanism GT-668 replaced MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit That paragraph said, in the present tense, that the self-test "reads the pre-fix iso-5055-mapping.json out of git" — which stopped being true one commit later. Left alone it is the same class of thing GT-668 is about: a document whose claim quietly diverged from the artifact without anyone editing it. The counts it reports (64 findings, 16 rules x 4 broken rules) are unchanged and still measured, so only the mechanism is marked superseded. EN and ES both. Co-Authored-By: Claude Opus 5 --- reference/core/control-center/gaps/gap-reference-catalog.es.md | 2 +- reference/core/control-center/gaps/gap-reference-catalog.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/reference/core/control-center/gaps/gap-reference-catalog.es.md b/reference/core/control-center/gaps/gap-reference-catalog.es.md index 767bdf7e4..84e961c52 100644 --- a/reference/core/control-center/gaps/gap-reference-catalog.es.md +++ b/reference/core/control-center/gaps/gap-reference-catalog.es.md @@ -8780,7 +8780,7 @@ La declaración tiene un hueco — un pack que no declara — y el directorio lo **El motivo también se deriva, y eso no es adorno.** El motivo de una fila se busca por clase en todo el resto del generador. Para esta clase, una sola frase por clase habría sido el mismo defecto un nivel más abajo — un texto afirmado sobre todos los estándares, cierto de ninguno en particular. En su lugar el motivo se construye desde la declaración del propio pack y nombra su estándar, así que un cuarto pack recibe un motivo cierto el día que llega sin añadir nada al generador. Cuál de las dos cosas ciertas decir también se deriva: se compara el estándar declarado por el pack contra el que publica el índice de debilidades, de modo que el pack de ISO/IEC 5055 se describe como *ese estándar a granularidad de medida y no como una de las 138 debilidades*, y los otros packs como *un control de otro estándar publicado, que no está entre las 138*. -**A la guarda se la vio fallar contra el artefacto real, no contra un esbozo.** `65-validate-standards-rule-class.test.mjs` lee de git el `iso-5055-mapping.json` previo al arreglo y lo comprueba contra los packs de hoy: **64 hallazgos, 16 reglas × 4 reglas rotas** (clase equivocada, motivo que no nombra ningún estándar, y las dos afirmaciones falsas publicadas). Un fixture reconstruido solo coincide con lo que su autor creía que estaba mal; este no puede. La guarda además se pone roja contra el árbol vacío con forma de repo de `43-validate-guard-negative-fixtures`, publica su denominador vía `assertScanned`, y `42-validate-guard-denominators` la registra INSTRUMENTED sin exención. +**A la guarda se la vio fallar contra el artefacto real, no contra un esbozo.** `65-validate-standards-rule-class.test.mjs` leía de git el `iso-5055-mapping.json` previo al arreglo y lo comprobaba contra los packs de hoy — *el mecanismo, aunque no los conteos, quedó superado por `GT-668`, que descubrió que leerlo de la referencia móvil `origin/develop` dejó de funcionar justo cuando este arreglo se mergeó, y congeló el artefacto como fixture commiteado en su lugar*: **64 hallazgos, 16 reglas × 4 reglas rotas** (clase equivocada, motivo que no nombra ningún estándar, y las dos afirmaciones falsas publicadas). Un fixture reconstruido solo coincide con lo que su autor creía que estaba mal; este no puede. La guarda además se pone roja contra el árbol vacío con forma de repo de `43-validate-guard-negative-fixtures`, publica su denominador vía `assertScanned`, y `42-validate-guard-denominators` la registra INSTRUMENTED sin exención. **El autotest encontró un defecto en la guarda, que es para lo que existe.** El denominador se escribió primero como el número de packs QUE DECLARAN. Un árbol cuyos packs hubieran perdido el bloque `standard` escaneaba por tanto cero y moría con «este check no corrió — la ubicación se movió», que es el único diagnóstico seguramente falso: el corpus está ahí y lo que se fue son las declaraciones. La guarda estaba roja igual; nombraba la causa equivocada, y una guarda roja que nombra la causa equivocada cuesta una hora en vez de ahorrarla. El denominador ahora cuenta los packs de estándares declaren o no. diff --git a/reference/core/control-center/gaps/gap-reference-catalog.md b/reference/core/control-center/gaps/gap-reference-catalog.md index ae42b9b1e..5e4dcd3da 100644 --- a/reference/core/control-center/gaps/gap-reference-catalog.md +++ b/reference/core/control-center/gaps/gap-reference-catalog.md @@ -8874,7 +8874,7 @@ The declaration has one hole — a pack that does not declare — and the direct **The note is derived too, and that is not decoration.** The reason a row carries is looked up by class everywhere else in this generator. For this class a single class-wide sentence would have been the same defect one level down — one text asserted over every standard, true of none of them in particular. Instead the note is built from the pack's own declaration and names its standard, so a fourth pack gets a true note the day it lands with nothing added to the generator. Which of the two true things to say is itself derived: the pack's declared standard is compared against the one the weakness index publishes, so the ISO/IEC 5055 pack is described as *that standard at measure granularity rather than one of the 138 weaknesses*, and the other packs as *a control of a different published standard, not among the 138*. -**The guard was seen failing against the real artifact, not against a sketch of it.** `65-validate-standards-rule-class.test.mjs` reads the pre-fix `iso-5055-mapping.json` out of git and checks it against today's packs: **64 findings, 16 rules × 4 broken rules** (wrong class, note naming no standard, and both published false claims). A reconstructed fixture only ever agrees with what its author believed was wrong; this one cannot. The guard also turns red on the empty repo-shaped tree of `43-validate-guard-negative-fixtures`, publishes its denominator through `assertScanned`, and is registered INSTRUMENTED by `42-validate-guard-denominators` with no exemption. +**The guard was seen failing against the real artifact, not against a sketch of it.** `65-validate-standards-rule-class.test.mjs` read the pre-fix `iso-5055-mapping.json` out of git and checked it against today's packs — *the mechanism, though not the counts, was superseded by `GT-668`, which found that reading it from the moving ref `origin/develop` stopped working the moment this fix merged and froze the artifact as a committed fixture instead*: **64 findings, 16 rules × 4 broken rules** (wrong class, note naming no standard, and both published false claims). A reconstructed fixture only ever agrees with what its author believed was wrong; this one cannot. The guard also turns red on the empty repo-shaped tree of `43-validate-guard-negative-fixtures`, publishes its denominator through `assertScanned`, and is registered INSTRUMENTED by `42-validate-guard-denominators` with no exemption. **The self-test found a defect in the guard, which is the reason it exists.** The denominator was first written as the number of DECLARING packs. A tree whose packs had all lost their `standard` block therefore scanned zero and died with «this check did not run — the location moved», which is the one diagnosis that is certainly wrong: the corpus is right there and the declarations are what went. The guard was red either way; it named the wrong cause, and a red guard that names the wrong cause costs an hour instead of saving one. The denominator now counts standards packs whether or not they declare. From bdd22294ab46d6b4d5361f9753639824f0b981ff Mon Sep 17 00:00:00 2001 From: aarroyo Date: Thu, 13 Aug 2026 19:20:53 -0500 Subject: [PATCH 4/9] fix(audit): correct paths in deep audit script for src monorepo --- .harness/playbooks/sdlc-deep-audit.mjs | 52 +++++++++++++------------- 1 file changed, 26 insertions(+), 26 deletions(-) diff --git a/.harness/playbooks/sdlc-deep-audit.mjs b/.harness/playbooks/sdlc-deep-audit.mjs index 0eb69d9f1..fcc27f2ba 100644 --- a/.harness/playbooks/sdlc-deep-audit.mjs +++ b/.harness/playbooks/sdlc-deep-audit.mjs @@ -191,27 +191,27 @@ function auditEvaluationEngine() { } // Check for SatelliteEvaluationPipeline (GT-281) - const pipelineFile = "packages/core-domain/src/application/services/satellite-evaluation-pipeline.service.ts"; + const pipelineFile = "src/packages/core-domain/src/application/services/satellite-evaluation-pipeline.service.ts"; const hasPipeline = exists(pipelineFile); // Check for SatelliteManifest type - const manifestTypeFile = "packages/core-domain/src/domain/satellite-manifest.ts"; + const manifestTypeFile = "src/packages/core-domain/src/domain/satellite-manifest.ts"; const hasManifestType = exists(manifestTypeFile); // Check for end-to-end pipeline test - const pipelineTest = "packages/core-domain/src/application/services/satellite-evaluation-pipeline.spec.ts"; + const pipelineTest = "src/packages/core-domain/src/application/services/satellite-evaluation-pipeline.spec.ts"; const hasPipelineTest = exists(pipelineTest); // Check for CLI --manifest/--phase options in validate command - const cliCommand = "sdk/cli/src/commands/validate/validate.command.ts"; + const cliCommand = "src/sdk/cli/src/commands/validate/validate.command.ts"; const cliHasManifest = exists(cliCommand) ? (read(cliCommand) || "").includes("--manifest") : false; // Check that ValidateSatelliteUseCase accepts manifest input - const useCaseFile = "packages/core-domain/src/application/use-cases/validate-satellite.use-case.ts"; + const useCaseFile = "src/packages/core-domain/src/application/use-cases/validate-satellite.use-case.ts"; const useCaseAcceptsManifest = exists(useCaseFile) ? (read(useCaseFile) || "").includes("manifest?:") : false; // Check the 3 interfaces converge on same UseCase - const mcpToolFile = "packages/mcp-server/src/tools/validate.tool.ts"; + const mcpToolFile = "src/packages/mcp-server/src/tools/validate.tool.ts"; const mcpCallsPipeline = exists(mcpToolFile) ? (read(mcpToolFile) || "").includes("runPipeline") : false; return { @@ -267,30 +267,30 @@ function auditClientIngestion() { // ── 5. LAS TRES INTERFACES ─────────────────────────────────────────── function auditThreeInterfaces() { - const cliCommands = exists("sdk/cli/src/commands") ? fs.readdirSync(path.join(root, "sdk/cli/src/commands")).filter(f => !f.startsWith(".")) : []; - const mcpTools = exists("packages/mcp-server/src/tools") ? fs.readdirSync(path.join(root, "packages/mcp-server/src/tools")).filter(f => f.endsWith(".ts") && !f.includes("spec")) : []; - const coreApiControllers = exists("apps/core-api/src/presentation/controllers") ? fs.readdirSync(path.join(root, "apps/core-api/src/presentation/controllers")).filter(f => f.endsWith(".ts") && !f.includes("spec")) : []; + const cliCommands = exists("src/sdk/cli/src/commands") ? fs.readdirSync(path.join(root, "src/sdk/cli/src/commands")).filter(f => !f.startsWith(".")) : []; + const mcpTools = exists("src/packages/mcp-server/src/tools") ? fs.readdirSync(path.join(root, "src/packages/mcp-server/src/tools")).filter(f => f.endsWith(".ts") && !f.includes("spec")) : []; + const coreApiControllers = exists("src/apps/core-api/src/presentation/controllers") ? fs.readdirSync(path.join(root, "src/apps/core-api/src/presentation/controllers")).filter(f => f.endsWith(".ts") && !f.includes("spec")) : []; // Check if each surface exposes an EVALUATION operation let cliHasEval = false; let mcpHasEval = false; let apiHasEval = false; - const cliEvalFiles = globFiles("sdk/cli/src/commands/**/*.ts").filter(f => !f.includes("spec")); + const cliEvalFiles = globFiles("src/sdk/cli/src/commands/**/*.ts").filter(f => !f.includes("spec")); for (const f of cliEvalFiles) { const c = read(f); if (!c) continue; if (c.includes("evaluate") || c.includes("validate") || c.includes("gate")) { cliHasEval = true; break; } } - const mcpEvalFiles = globFiles("packages/mcp-server/src/tools/**/*.ts"); + const mcpEvalFiles = globFiles("src/packages/mcp-server/src/tools/**/*.ts"); for (const f of mcpEvalFiles) { const c = read(f); if (!c) continue; if (c.includes("evaluate") || c.includes("validate") || c.includes("gate")) { mcpHasEval = true; break; } } - const apiEvalFiles = globFiles("apps/core-api/src/**/*.ts"); + const apiEvalFiles = globFiles("src/apps/core-api/src/**/*.ts"); for (const f of apiEvalFiles) { const c = read(f); if (!c) continue; @@ -298,7 +298,7 @@ function auditThreeInterfaces() { } // Check if all three route to same underlying service - const coreDomainFiles = globFiles("packages/core-domain/src/**/*.ts").filter(f => !f.includes("spec")); + const coreDomainFiles = globFiles("src/packages/core-domain/src/**/*.ts").filter(f => !f.includes("spec")); let sharedUseCase = null; for (const f of coreDomainFiles) { const c = read(f); @@ -329,7 +329,7 @@ function auditThreeInterfaces() { function auditActionableReports() { // GT-282: check for structured evaluation types with actionable detail fields - const manifestType = "packages/core-domain/src/domain/satellite-manifest.ts"; + const manifestType = "src/packages/core-domain/src/domain/satellite-manifest.ts"; const manifestContent = read(manifestType); const hasRemediation = manifestContent?.includes("remediation"); @@ -337,23 +337,23 @@ function auditActionableReports() { const hasGateRef = manifestContent?.includes("gateRef"); // Check for ADR-0073 output envelope in evaluation verdict - const pipelineService = "packages/core-domain/src/application/services/satellite-evaluation-pipeline.service.ts"; + const pipelineService = "src/packages/core-domain/src/application/services/satellite-evaluation-pipeline.service.ts"; const pipelineContent = read(pipelineService); const hasOutputEnvelope = pipelineContent?.includes("outputEnvelope") && pipelineContent?.includes("createSuccessEnvelope"); const hasADREnvelope = read(pipelineService)?.includes("ADR-0073") || read(manifestType)?.includes("ADR-0073"); // Check MCP includes actionable fields - const mcpTool = "packages/mcp-server/src/tools/validate.tool.ts"; + const mcpTool = "src/packages/mcp-server/src/tools/validate.tool.ts"; const mcpContent = read(mcpTool); const mcpShowsRemediation = mcpContent?.includes("remediation"); // Check CLI shows actionable details - const cliCommand = "sdk/cli/src/commands/validate/validate.command.ts"; + const cliCommand = "src/sdk/cli/src/commands/validate/validate.command.ts"; const cliContent = read(cliCommand); const cliShowsRemediation = cliContent?.includes("remediation") || cliContent?.includes("Remedio"); // Check tests verify actionable fields - const pipelineTest = "packages/core-domain/src/application/services/satellite-evaluation-pipeline.spec.ts"; + const pipelineTest = "src/packages/core-domain/src/application/services/satellite-evaluation-pipeline.spec.ts"; const testContent = read(pipelineTest); const testChecksRemediation = testContent?.includes("remediation"); const testChecksOutputEnvelope = testContent?.includes("outputEnvelope"); @@ -423,8 +423,8 @@ function auditGovernance() { // GT-412: runtime policy enforcement must be mandatory before governed // capabilities execute, and hosted defaults must use the real OPA adapter. - const runtimeService = read("packages/agent-runtime/src/application/agent-runtime.service.ts") || ""; - const runtimeFactory = read("apps/agent-runtime-api/src/agent-runtime/runtime.factory.ts") || ""; + const runtimeService = read("src/packages/agent-runtime/src/application/agent-runtime.service.ts") || ""; + const runtimeFactory = read("src/apps/agent-runtime-api/src/agent-runtime/runtime.factory.ts") || ""; const preflightIdx = runtimeService.indexOf("steps.push('policy-preflight')"); const harnessIdx = runtimeService.indexOf("steps.push('harness-execute')"); const approvalIdx = runtimeService.indexOf("steps.push('approval')"); @@ -454,7 +454,7 @@ function auditGovernance() { // ── 8. VERIFICACIONES PUNTUALES ────────────────────────────────────── function auditPointChecks() { - const scaffoldCmdExists = exists("sdk/cli/src/commands/architecture/scaffold.command.ts"); + const scaffoldCmdExists = exists("src/sdk/cli/src/commands/architecture/scaffold.command.ts"); // Check for broken ADR references let brokenAdrRefs = 0; @@ -472,7 +472,7 @@ function auditPointChecks() { // Check for invented commands in docs let inventedCommands = 0; const realCommands = new Set( - walk("sdk/cli/src/commands").filter(f => f.endsWith(".ts") && !f.includes("spec")) + walk("src/sdk/cli/src/commands").filter(f => f.endsWith(".ts") && !f.includes("spec")) .map(f => f.split("/").pop().replace(".command.ts", "").replace(".ts", "")) ); for (const f of allFiles) { @@ -500,14 +500,14 @@ function auditPointChecks() { // ── 9. INTEGRACIÓN AGENT RUNTIME ───────────────────────────────────── function auditAgentRuntimeConnectivity() { - const hasAgentRuntimeApi = exists("apps/agent-runtime-api"); + const hasAgentRuntimeApi = exists("src/apps/agent-runtime-api"); - const sdkAgentClient = exists("packages/sdk-client/src/rest/agent.client.ts"); + const sdkAgentClient = exists("src/packages/sdk-client/src/rest/agent.client.ts"); - const cliAgentCmd = "sdk/cli/src/commands/agents/agents.command.ts"; + const cliAgentCmd = "src/sdk/cli/src/commands/agents/agents.command.ts"; const cliHasAgentRun = exists(cliAgentCmd) ? (read(cliAgentCmd) || "").includes("runAgent") : false; - const mcpAgentTool = "packages/mcp-server/src/tools/agent.tools.ts"; + const mcpAgentTool = "src/packages/mcp-server/src/tools/agent.tools.ts"; const mcpHasAgentRun = exists(mcpAgentTool) ? (read(mcpAgentTool) || "").includes("evolith-agent-run") : false; const connected = hasAgentRuntimeApi && sdkAgentClient && cliHasAgentRun && mcpHasAgentRun; From 7f4b76123242651c50b174025cc23672fd487d04 Mon Sep 17 00:00:00 2001 From: aarroyo Date: Thu, 13 Aug 2026 19:44:28 -0500 Subject: [PATCH 5/9] fix(audit): match class declaration to resolve codex review --- .harness/playbooks/sdlc-deep-audit.mjs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.harness/playbooks/sdlc-deep-audit.mjs b/.harness/playbooks/sdlc-deep-audit.mjs index fcc27f2ba..627f50c7e 100644 --- a/.harness/playbooks/sdlc-deep-audit.mjs +++ b/.harness/playbooks/sdlc-deep-audit.mjs @@ -303,7 +303,7 @@ function auditThreeInterfaces() { for (const f of coreDomainFiles) { const c = read(f); if (!c) continue; - if (c.includes("ValidateSatelliteUseCase")) { + if (c.includes("class ValidateSatelliteUseCase")) { const name = f.split("/").pop().replace(".ts", ""); sharedUseCase = name; break; From ec033536c26b4c67679485ee502df2d2a43a8e8e Mon Sep 17 00:00:00 2001 From: aarroyo Date: Thu, 13 Aug 2026 20:49:03 -0500 Subject: [PATCH 6/9] feat(docs): add commercial narrative brochure and enable swagger locally --- README.es.md | 1 + README.md | 1 + .../helm/evolith-core-api/values-local.yaml | 2 + .../vision/evolith-commercial-brochure.es.md | 83 +++++++++++++++++++ .../vision/evolith-commercial-brochure.md | 83 +++++++++++++++++++ 5 files changed, 170 insertions(+) create mode 100644 product/suite/vision/evolith-commercial-brochure.es.md create mode 100644 product/suite/vision/evolith-commercial-brochure.md diff --git a/README.es.md b/README.es.md index f556fc350..13cc3710c 100644 --- a/README.es.md +++ b/README.es.md @@ -147,6 +147,7 @@ Evolith se distribuye como una suite de productos coordinados sobre una base com | **[MCP Services](product/products/mcp-services/README.es.md)** | Gobernanza como contexto en vivo para LLMs y agentes de IA (47 tools, 9 resources, 8 prompts) | | **[Agent Runtime](reference/core/architecture/foundations/README.es.md)** | Capa de mediación agéntica — orquesta el Core mediante Puertos y Adaptadores; Hermes es uno de los adaptadores reemplazables | | **[Evolith Tracker](product/products/evolith-tracker/README.es.md)** | Gobernanza del ciclo de vida del negocio — fases, propietarios, financiación y ROI | +| **[Narrativa Comercial](product/suite/vision/evolith-commercial-brochure.es.md)** | Estrategia de producto y monetización empresarial (Despliegue Hub & Spoke) | | **[Rulesets](src/rulesets/README.es.md)** | Reglas de aplicación legibles por máquina por topología | | **[Políticas OPA](src/rulesets/opa/README.es.md)** | Controles de política granulares integrados en el pipeline | | **[Schemas y Manifests](src/rulesets/schema/README.es.md)** | Contratos estructurados para artefactos y definiciones de topología | diff --git a/README.md b/README.md index 94e26b661..d3b3c516e 100644 --- a/README.md +++ b/README.md @@ -148,6 +148,7 @@ Evolith ships as a suite of coordinated products built on a common foundation. | **[MCP Services](product/products/mcp-services/README.md)** | Governance as live context for LLMs and AI agents (47 tools, 9 resources, 8 prompts) | | **[Agent Runtime](reference/core/architecture/foundations/README.md)** | Agentic mediation layer — orchestrates Core through Ports & Adapters; Hermes is one replaceable adapter | | **[Evolith Tracker](product/products/evolith-tracker/README.md)** | Business lifecycle governance — phases, owners, funding, and ROI | +| **[Commercial Vision](product/suite/vision/evolith-commercial-brochure.md)** | Product strategy and enterprise monetization narrative (Hub & Spoke deployment) | | **[Rulesets](src/rulesets/README.md)** | Machine-readable enforcement rules per topology | | **[OPA Policies](src/rulesets/opa/README.md)** | Fine-grained policy checks integrated into the pipeline | | **[Schemas & Manifests](src/rulesets/schema/README.md)** | Structured contracts for artifacts and topology definitions | diff --git a/product/infra/helm/evolith-core-api/values-local.yaml b/product/infra/helm/evolith-core-api/values-local.yaml index 5ad87e47d..5e94cd5dc 100644 --- a/product/infra/helm/evolith-core-api/values-local.yaml +++ b/product/infra/helm/evolith-core-api/values-local.yaml @@ -49,3 +49,5 @@ podDisruptionBudget: networkPolicy: enabled: false +extraEnv: + SWAGGER_ENABLED: "true" diff --git a/product/suite/vision/evolith-commercial-brochure.es.md b/product/suite/vision/evolith-commercial-brochure.es.md new file mode 100644 index 000000000..a4f1fc616 --- /dev/null +++ b/product/suite/vision/evolith-commercial-brochure.es.md @@ -0,0 +1,83 @@ +# Evolith: Narrativa Comercial y Estrategia de Producto + +> **Visión Central:** Evolith es un framework ejecutable de gobernanza arquitectónica. Democratizamos el *cómo* se estructura el software (Open Source), pero comercializamos la *observabilidad y control* empresarial (Evolith Tracker). + +--- + +## 1. El Problema (El Dolor del Mercado) + +Las empresas invierten miles de dólares en arquitectos de software para diseñar sistemas robustos y escribir Documentos de Decisión Arquitectónica (ADRs). Sin embargo, la realidad operativa es otra: +* **La documentación muere:** Los ADRs viven en wikis estáticas que nadie consulta durante el desarrollo. +* **Degradación silenciosa:** Con la rotación de personal y la presión por entregar rápido (y ahora, con agentes de IA generando código a gran velocidad), la arquitectura se desvía del diseño original (Architecture Drift). +* **Deuda Técnica incontrolable:** Cuando la gerencia se da cuenta del desorden, refactorizar el sistema es costoso y paraliza el negocio. + +## 2. La Solución Base: Evolith Core (Open Source) + +**Evolith Core** transforma las reglas de arquitectura de simples "documentos de texto" a **código ejecutable**. + +* **Para el Desarrollador:** Funciona como un linter arquitectónico. Con un simple `evolith validate` en su CLI, sabe en segundos si su código cumple las reglas. +* **Para los Agentes de IA:** A través del Servidor MCP, agentes como Claude o Cursor entienden instantáneamente los estándares de la empresa antes de escribir una sola línea de código. +* **Para el Pipeline (CI/CD):** Funciona como un guardia de seguridad automatizado, bloqueando cualquier *Pull Request* que intente introducir violaciones a la arquitectura (Phase Gates). + +> [!TIP] +> **La estrategia de adopción (El Caballo de Troya):** Evolith Core es **gratuito y Open Source**. El objetivo es que los desarrolladores y líderes técnicos lo adopten masivamente porque reduce la fricción, acelera los code-reviews y mejora la calidad de su trabajo diario. + +--- + +## 3. Arquitectura del Despliegue en el Cliente (Modelo Hub & Spoke) + +Cuando vendemos e instalamos Evolith en una corporación, la arquitectura de gobierno funciona bajo un modelo centralizado de "Hub y Satélites", separando claramente dónde *nacen* las reglas y dónde se *ejecutan*. + +### A. La Fuente de la Verdad (El Repositorio Central) +Se crea un único repositorio en la empresa, por convención llamado **`[empresa]-evolith-core`** o **`architecture-baseline`**. +* Este repositorio actúa como la "Constitución" técnica. Aquí viven todos los ADRs (Markdown), Rulesets (JSON/YAML) y Políticas OPA (`.rego`). +* Estas reglas se empaquetan en el contenedor del motor (Core API) y se ejecutan centralmente a velocidad de milisegundos gracias a la compilación a `policy.wasm`. +* Solo los Arquitectos Empresariales tienen permisos para aprobar cambios en este repositorio. + +### B. Los Consumidores (Repositorios Satélites) +Los cientos de repositorios de producto o microservicios que tienen los desarrolladores se denominan **satélites**. +* Estos repositorios **no contienen las reglas**. +* Cuando el programador en un satélite ejecuta `evolith validate`, el CLI consulta remotamente el motor del repositorio central. +* **Ventaja competitiva:** Si la empresa actualiza un estándar de seguridad en el repositorio `[empresa]-evolith-core`, automáticamente todos los repositorios satélites de la organización comienzan a ser auditados bajo la nueva regla, sin tener que hacer actualizaciones manuales en 500 proyectos distintos. + +--- + +## 4. Evolución y Adaptabilidad (Future-Proofing) + +La tecnología cambia rápido. Lo que hoy es un estándar, mañana queda obsoleto. ¿Cómo sobrevive Evolith a la aparición de nuevas topologías (ej. Agentic AI, Data Mesh)? + +* **Motor Agnóstico:** La magia de Evolith es que **no tiene arquitecturas específicas quemadas (hardcoded) en su código**. El motor solo sabe procesar reglas abstractas. Si la empresa quiere adoptar un nuevo patrón, solo añade una nueva carpeta con reglas en el repositorio central, y el motor aprende a evaluarlo instantáneamente. +* **El Eje Progresivo (Progressive Axis):** Evolith no asume que todos los proyectos son Microservicios perfectos. Permite mapear reglas evolutivas: desde un MVP rápido, pasando por un Monolito Modular, hasta servicios distribuidos, aplicando las reglas justas según la etapa de madurez del producto. + +### Ingesta de Nuevo Conocimiento (Automatización y GitOps) +Actualizar estas reglas no es un trabajo manual y tedioso; está automatizado en las 3 interfaces: +1. **La Vía de la IA (Servidor MCP):** El servidor MCP es bidireccional. Un agente de IA autorizado puede analizar una nueva tendencia en la industria, redactar automáticamente un borrador de ADR y un archivo `.rego`, y proponer un *Pull Request* en el repositorio central. +2. **La Vía del Desarrollador (CLI):** El CLI cuenta con herramientas de *scaffolding* (ej. `evolith adr create`) que generan toda la estructura base para añadir un nuevo estándar en segundos. +3. **La Vía de Infraestructura (GitOps):** Al aprobarse un *Pull Request* en el repositorio central corporativo, la infraestructura se actualiza vía *Webhooks*. El motor Core API descarga las nuevas políticas compiladas y hace un **hot-reload** (recarga en caliente), actualizando el cerebro de la empresa sin interrupciones en el servicio. + +--- + +## 5. El Modelo de Monetización: Evolith Tracker (Enterprise) + +Mientras que Evolith Core resuelve el problema del desarrollador individual en su repositorio (visión táctica), el CTO y los Directores de Ingeniería tienen un problema mayor (visión estratégica). + +Aquí es donde entra **Evolith Tracker**, nuestro producto comercial. + +### El Cierre de la Venta: +Una vez que el cliente tiene Evolith Core corriendo en 50 proyectos distintos (satélites), el CTO se enfrenta a un punto ciego corporativo: +* *"¿Cómo sé cuáles de nuestros 50 proyectos están cumpliendo la arquitectura central y cuáles son un riesgo?"* +* *"¿Cómo administro reglas distintas para la División de Pagos y la División de Logística?"* + +**Evolith Tracker se vende como el Centro de Control Corporativo (Control Plane):** +* **Observabilidad Global:** Dashboards ejecutivos con el "Maturity Report" de toda la organización. +* **Multi-Tenancy:** Gestión centralizada de políticas, inquilinos (tenants) y repositorios. +* **Gestión de Excepciones:** Flujos de aprobación visual para cuando un equipo necesita romper una regla por una emergencia de negocio. +* **Trazabilidad del ROI:** Gráficos que demuestran a la gerencia cómo la deuda técnica está disminuyendo a lo largo del tiempo gracias a Evolith Core. + +--- + +## 6. Resumen de la Estrategia (Product-Led Growth) + +1. **Atraer (Seed):** Distribuimos Evolith Core gratis. Los equipos técnicos lo instalan por el inmenso valor de automatizar las validaciones de arquitectura y gobernar a sus Agentes de IA vía MCP. +2. **Expandir (Land):** Evolith se vuelve el estándar de facto en los pipelines CI/CD de la empresa. La arquitectura de los satélites se ancla al repositorio central (`[empresa]-evolith-core`), evoluciona dinámicamente y deja de degradarse. +3. **Monetizar (Expand):** Le vendemos **Evolith Tracker** a los tomadores de decisión (CTOs/Enterprise Architects) que necesitan visibilidad, reportes agregados y control centralizado de los cientos de nodos de Evolith Core desplegados en su ecosistema. diff --git a/product/suite/vision/evolith-commercial-brochure.md b/product/suite/vision/evolith-commercial-brochure.md new file mode 100644 index 000000000..1a999e588 --- /dev/null +++ b/product/suite/vision/evolith-commercial-brochure.md @@ -0,0 +1,83 @@ +# Evolith: Commercial Narrative and Product Strategy + +> **Core Vision:** Evolith is an executable architectural governance framework. We democratize *how* software is structured (Open Source), but we commercialize enterprise *observability and control* (Evolith Tracker). + +--- + +## 1. The Problem (The Market Pain) + +Companies invest thousands of dollars in software architects to design robust systems and write Architecture Decision Records (ADRs). However, the operational reality is different: +* **Documentation dies:** ADRs live in static wikis that no one consults during development. +* **Silent degradation:** With staff turnover and the pressure to deliver fast (and now, with AI agents generating code at high speed), the architecture deviates from the original design (Architecture Drift). +* **Uncontrollable Technical Debt:** By the time management realizes the mess, refactoring the system is expensive and paralyzes the business. + +## 2. The Baseline Solution: Evolith Core (Open Source) + +**Evolith Core** transforms architecture rules from simple "text documents" into **executable code**. + +* **For the Developer:** It works like an architectural linter. With a simple `evolith validate` in their CLI, they know in seconds if their code complies with the rules. +* **For AI Agents:** Through the MCP Server, agents like Claude or Cursor instantly understand the company's standards before writing a single line of code. +* **For the Pipeline (CI/CD):** It acts as an automated security guard, blocking any *Pull Request* that attempts to introduce architecture violations (Phase Gates). + +> [!TIP] +> **The Adoption Strategy (The Trojan Horse):** Evolith Core is **free and Open Source**. The goal is for developers and technical leads to adopt it massively because it reduces friction, speeds up code-reviews, and improves the quality of their daily work. + +--- + +## 3. Client Deployment Architecture (Hub & Spoke Model) + +When we sell and install Evolith in a corporation, the governance architecture operates under a centralized "Hub and Satellite" model, clearly separating where rules are *born* and where they are *executed*. + +### A. The Source of Truth (The Central Repository) +A single repository is created in the company, conventionally named **`[company]-evolith-core`** or **`architecture-baseline`**. +* This repository acts as the technical "Constitution". All ADRs (Markdown), Rulesets (JSON/YAML), and OPA Policies (`.rego`) live here. +* These rules are packaged in the engine container (Core API) and executed centrally at millisecond speeds thanks to compilation to `policy.wasm`. +* Only Enterprise Architects have permissions to approve changes in this repository. + +### B. The Consumers (Satellite Repositories) +The hundreds of product or microservice repositories that developers have are called **satellites**. +* These repositories **do not contain the rules**. +* When a programmer in a satellite runs `evolith validate`, the CLI remotely queries the central repository's engine. +* **Competitive Advantage:** If the company updates a security standard in the `[company]-evolith-core` repository, all satellite repositories in the organization automatically start being audited under the new rule, without having to make manual updates in 500 different projects. + +--- + +## 4. Evolution and Adaptability (Future-Proofing) + +Technology changes fast. What is a standard today is obsolete tomorrow. How does Evolith survive the emergence of new topologies (e.g., Agentic AI, Data Mesh)? + +* **Agnostic Engine:** Evolith's magic is that **it has no specific architectures hardcoded in its code**. The engine only knows how to process abstract rules. If the company wants to adopt a new pattern, it just adds a new folder with rules in the central repository, and the engine learns to evaluate it instantly. +* **The Progressive Axis:** Evolith does not assume that all projects are perfect Microservices. It allows mapping evolutionary rules: from a fast MVP, to a Modular Monolith, to distributed services, applying the right rules according to the product's maturity stage. + +### Ingestion of New Knowledge (Automation and GitOps) +Updating these rules is not a tedious, manual job; it is automated across the 3 interfaces: +1. **The AI Path (MCP Server):** The MCP server is bidirectional. An authorized AI agent can analyze a new industry trend, automatically draft an ADR and a `.rego` file, and propose a *Pull Request* in the central repository. +2. **The Developer Path (CLI):** The CLI has *scaffolding* tools (e.g., `evolith adr create`) that generate the entire base structure to add a new standard in seconds. +3. **The Infrastructure Path (GitOps):** When a *Pull Request* is approved in the central corporate repository, the infrastructure updates via *Webhooks*. The Core API engine downloads the newly compiled policies and performs a **hot-reload**, updating the company's brain without service interruptions. + +--- + +## 5. The Monetization Model: Evolith Tracker (Enterprise) + +While Evolith Core solves the individual developer's problem in their repository (tactical vision), the CTO and Engineering Directors have a bigger problem (strategic vision). + +This is where **Evolith Tracker**, our commercial product, comes in. + +### Closing the Sale: +Once the client has Evolith Core running in 50 different projects (satellites), the CTO faces a corporate blind spot: +* *"How do I know which of our 50 projects are complying with the central architecture and which are a risk?"* +* *"How do I manage different rules for the Payments Division and the Logistics Division?"* + +**Evolith Tracker is sold as the Corporate Control Center (Control Plane):** +* **Global Observability:** Executive dashboards with the "Maturity Report" of the entire organization. +* **Multi-Tenancy:** Centralized management of policies, tenants, and repositories. +* **Exception Management:** Visual approval workflows for when a team needs to break a rule due to a business emergency. +* **ROI Traceability:** Charts demonstrating to management how technical debt is decreasing over time thanks to Evolith Core. + +--- + +## 6. Strategy Summary (Product-Led Growth) + +1. **Seed:** We distribute Evolith Core for free. Technical teams install it for the immense value of automating architecture validations and governing their AI Agents via MCP. +2. **Land:** Evolith becomes the de facto standard in the company's CI/CD pipelines. The architecture of the satellites anchors to the central repository (`[company]-evolith-core`), evolves dynamically, and stops degrading. +3. **Expand:** We sell **Evolith Tracker** to decision-makers (CTOs/Enterprise Architects) who need visibility, aggregated reports, and centralized control of the hundreds of Evolith Core nodes deployed in their ecosystem. From 4387f6dc9a56b01040a780a17c075c647703d716 Mon Sep 17 00:00:00 2001 From: aarroyo Date: Thu, 13 Aug 2026 21:26:04 -0500 Subject: [PATCH 7/9] feat(docs): add quickstart guide and update readmes --- README.es.md | 2 + README.md | 2 + docs/guides/evolith-quickstart.es.md | 68 ++++++++++++++++++++++++++++ docs/guides/evolith-quickstart.md | 68 ++++++++++++++++++++++++++++ 4 files changed, 140 insertions(+) create mode 100644 docs/guides/evolith-quickstart.es.md create mode 100644 docs/guides/evolith-quickstart.md diff --git a/README.es.md b/README.es.md index 13cc3710c..ff8651c18 100644 --- a/README.es.md +++ b/README.es.md @@ -8,6 +8,8 @@ [![License](https://img.shields.io/badge/License-MIT-informational?style=for-the-badge)]() [![CI](https://img.shields.io/github/actions/workflow/status/beyondnetcode/evolith_arch32/docs.yml?style=for-the-badge&label=CI)](https://github.com/beyondnetcode/evolith_arch32/actions) +> 🚀 **[Comenzar Aquí: Guía de Instalación Paso a Paso](./docs/guides/evolith-quickstart.es.md)** +
diff --git a/README.md b/README.md index d3b3c516e..f542644a7 100644 --- a/README.md +++ b/README.md @@ -9,6 +9,8 @@ [![License](https://img.shields.io/badge/License-MIT-informational?style=for-the-badge)]() [![CI](https://img.shields.io/github/actions/workflow/status/beyondnetcode/evolith_arch32/docs.yml?style=for-the-badge&label=CI)](https://github.com/beyondnetcode/evolith_arch32/actions) +> 🚀 **[Start Here: Step-by-Step Quickstart Guide](./docs/guides/evolith-quickstart.md)** +
diff --git a/docs/guides/evolith-quickstart.es.md b/docs/guides/evolith-quickstart.es.md new file mode 100644 index 000000000..2492babe6 --- /dev/null +++ b/docs/guides/evolith-quickstart.es.md @@ -0,0 +1,68 @@ +# Guía de Inicio Rápido: Evolith (Paso a Paso) + +Esta guía te ayudará a instalar y poner en marcha Evolith en **menos de 5 minutos**, para que puedas comenzar a validar la arquitectura de tu código. + +--- + +## Paso 1: Levantar el Cerebro (Evolith Core API) + +El Core API es el servidor central que contiene las reglas de arquitectura de tu empresa. Debes levantarlo primero para que los clientes puedan consultarlo. + +Tienes dos opciones para iniciarlo en tu máquina local: + +### Opción A: Vía Docker Compose (Más Rápido) +Ideal para desarrolladores. Levanta la API y la base de datos PostgreSQL mínima necesaria. +```bash +docker-compose -f product/infra/docker-compose.yml up -d postgres +``` + +### Opción B: Vía Kubernetes / Helm (Entorno Completo) +Ideal para simulaciones de producción o arquitectos. Levanta el clúster local, la base de datos, el Gateway y el Core API. +```bash +./.harness/scripts/run-core-local.sh +``` + +Una vez que termine, el servidor estará escuchando en `http://localhost:30080`. Puedes ver la documentación de la API generada en `http://localhost:30080/api/docs`. + +--- + +## Paso 2: Instalar el Cliente (Evolith CLI) + +El CLI es la herramienta que utilizarán los desarrolladores en su día a día. + +1. Instala el paquete de forma global usando npm: +```bash +npm install -g @beyondnet/evolith-cli +``` + +2. Configura la URL del servidor al que el CLI debe apuntar (el que levantamos en el Paso 1). Puedes hacerlo exportando una variable de entorno: +```bash +export EVOLITH_CORE_URL="http://localhost:30080/api/v1" +``` + +--- + +## Paso 3: Tu Primera Validación + +Ve a la carpeta raíz de cualquier proyecto de software (satélite) que quieras validar y ejecuta el comando de validación. + +```bash +cd mi-proyecto-backend +evolith validate +``` + +**¿Qué sucede detrás de escena?** +El CLI tomará el estado actual de tu código, se conectará al Core API central y evaluará tu proyecto contra las reglas OPA y los ADRs oficiales de la empresa. En segundos, te devolverá un reporte indicando si cumples con el estándar o si hay violaciones de arquitectura. + +--- + +## Paso 4: (Opcional) Conectar a tu Agente de IA + +Evolith no es solo para humanos. Puedes conectar tu editor de código basado en IA (Cursor, Claude Desktop, etc.) para que "entienda" tu arquitectura. + +Para arrancar el servidor MCP, simplemente ejecuta: +```bash +evolith mcp start +``` + +Luego, en la configuración de Cursor o Claude Desktop, añade este servidor MCP local. A partir de ese momento, tu Agente de IA sabrá qué patrones usar, qué librerías están prohibidas y cómo debe estructurar el código antes de escribir una sola línea. diff --git a/docs/guides/evolith-quickstart.md b/docs/guides/evolith-quickstart.md new file mode 100644 index 000000000..6899ba04e --- /dev/null +++ b/docs/guides/evolith-quickstart.md @@ -0,0 +1,68 @@ +# Quickstart Guide: Evolith (Step by Step) + +This guide will help you install and run Evolith in **less than 5 minutes**, so you can start validating your code's architecture right away. + +--- + +## Step 1: Boot the Brain (Evolith Core API) + +The Core API is the central server containing your enterprise architecture rules. You must boot it up first so that clients can query it. + +You have two options to start it on your local machine: + +### Option A: Via Docker Compose (Fastest) +Ideal for developers. This boots up the API and the minimum required PostgreSQL database. +```bash +docker-compose -f product/infra/docker-compose.yml up -d postgres +``` + +### Option B: Via Kubernetes / Helm (Full Environment) +Ideal for production simulations or architects. This spins up the local cluster, the database, the API Gateway, and the Core API. +```bash +./.harness/scripts/run-core-local.sh +``` + +Once finished, the server will be listening on `http://localhost:30080`. You can view the generated API documentation at `http://localhost:30080/api/docs`. + +--- + +## Step 2: Install the Client (Evolith CLI) + +The CLI is the tool developers will use in their day-to-day workflow. + +1. Install the package globally using npm: +```bash +npm install -g @beyondnet/evolith-cli +``` + +2. Configure the server URL the CLI should point to (the one we booted in Step 1). You can do this by exporting an environment variable: +```bash +export EVOLITH_CORE_URL="http://localhost:30080/api/v1" +``` + +--- + +## Step 3: Your First Validation + +Navigate to the root folder of any software project (satellite) you want to validate and run the validation command. + +```bash +cd my-backend-project +evolith validate +``` + +**What happens behind the scenes?** +The CLI will take the current state of your code, connect to the central Core API, and evaluate your project against the official OPA rules and ADRs of the company. In seconds, it will return a report indicating whether you comply with the standard or if there are any architecture violations. + +--- + +## Step 4: (Optional) Connect your AI Agent + +Evolith isn't just for humans. You can connect your AI-powered code editor (Cursor, Claude Desktop, etc.) so it "understands" your architecture. + +To start the MCP server, simply run: +```bash +evolith mcp start +``` + +Then, in your Cursor or Claude Desktop settings, add this local MCP server. From that moment on, your AI Agent will know which patterns to use, which libraries are forbidden, and how it should structure the code before writing a single line. From 023de251e7ef60f387c5ff59ecd69e66e02b0a06 Mon Sep 17 00:00:00 2001 From: aarroyo Date: Thu, 13 Aug 2026 21:31:15 -0500 Subject: [PATCH 8/9] fix(docs): remove emoji from README to satisfy UTF-8 CI rule --- README.es.md | 2 +- README.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/README.es.md b/README.es.md index ff8651c18..3d129f0a2 100644 --- a/README.es.md +++ b/README.es.md @@ -8,7 +8,7 @@ [![License](https://img.shields.io/badge/License-MIT-informational?style=for-the-badge)]() [![CI](https://img.shields.io/github/actions/workflow/status/beyondnetcode/evolith_arch32/docs.yml?style=for-the-badge&label=CI)](https://github.com/beyondnetcode/evolith_arch32/actions) -> 🚀 **[Comenzar Aquí: Guía de Instalación Paso a Paso](./docs/guides/evolith-quickstart.es.md)** +> **[Comenzar Aquí: Guía de Instalación Paso a Paso](./docs/guides/evolith-quickstart.es.md)**
diff --git a/README.md b/README.md index f542644a7..bf11b6328 100644 --- a/README.md +++ b/README.md @@ -9,7 +9,7 @@ [![License](https://img.shields.io/badge/License-MIT-informational?style=for-the-badge)]() [![CI](https://img.shields.io/github/actions/workflow/status/beyondnetcode/evolith_arch32/docs.yml?style=for-the-badge&label=CI)](https://github.com/beyondnetcode/evolith_arch32/actions) -> 🚀 **[Start Here: Step-by-Step Quickstart Guide](./docs/guides/evolith-quickstart.md)** +> **[Start Here: Step-by-Step Quickstart Guide](./docs/guides/evolith-quickstart.md)**
From dd4b58f1da99aa108c738db6639c3b55b3e35e34 Mon Sep 17 00:00:00 2001 From: aarroyo Date: Thu, 13 Aug 2026 21:50:23 -0500 Subject: [PATCH 9/9] fix(ci): whitelist docs/ in root cleanliness script --- .harness/scripts/ci/03-validate-root-cleanliness.mjs | 1 + 1 file changed, 1 insertion(+) diff --git a/.harness/scripts/ci/03-validate-root-cleanliness.mjs b/.harness/scripts/ci/03-validate-root-cleanliness.mjs index 9af0094a5..255e28fac 100755 --- a/.harness/scripts/ci/03-validate-root-cleanliness.mjs +++ b/.harness/scripts/ci/03-validate-root-cleanliness.mjs @@ -89,6 +89,7 @@ const allowedDirectories = new Set([ // sdk/, tests/) was relocated here, so those are no longer permitted at root. "src", // Product documentation corpus. + "docs", "product", "examples", "wiki"