version: 1
policy:
  contract_first:
    required: true
    rules:
      - id: CF-001
        statement: "API changes require OpenAPI update before implementation."
      - id: CF-002
        statement: "No UI feature may bypass API contract."
  security:
    required: true
    rules:
      - id: SEC-001
        statement: "No secrets in code or repo-tracked config."
      - id: SEC-002
        statement: "All privileged endpoints enforce server-side authorization."
      - id: SEC-003
        statement: "All external inputs validated with explicit schema."
  reliability:
    required: true
    rules:
      - id: REL-001
        statement: "Mutation endpoints support idempotency keys."
      - id: REL-002
        statement: "Async workflows use durable queue + retry + DLQ."
  data_integrity:
    required: true
    rules:
      - id: DATA-001
        statement: "Balances are derived from immutable ledger entries."
      - id: DATA-002
        statement: "No direct mutable balance writes as source of truth."
      - id: DATA-003
        statement: "No hardcoded runtime business-policy constants; policy values must resolve from config/DB with audited updates."
  observability:
    required: true
    rules:
      - id: OBS-001
        statement: "All request paths emit structured logs and correlation IDs."
      - id: OBS-002
        statement: "Critical workflows emit metrics and traces."
      - id: OBS-003
        statement: "All privileged operations and state-mutating actions emit a structured audit log entry containing actor_user_id, actor_role, action, target_type, target_id, result, and correlation_id."
  compatibility:
    required: true
    rules:
      - id: COMP-001
        statement: "Breaking API changes require version bump and migration notes."
      - id: COMP-002
        statement: "SDK generation must succeed from current spec."
ci_gates:
  - name: openapi_validation
    required: true
  - name: api_breaking_change_check
    required: true
  - name: security_scan
    required: true
  - name: test_suite
    required: true
  - name: sdk_codegen_smoke
    required: true
  - name: audit_log_coverage
    required: true
