# Planning source of truth for a MetaSolve rollout.
# This file is not automatically consumed by the current MetaSolve CI client.
version: 1
organization:
  owner: security-engineering
  reviewers: [application-security, service-owner]
scope:
  repositories: []
  supported_languages: [python, javascript, typescript, java]
  enterprise_scoping_required: [cpp, go, rust]
pipeline:
  mode: report_only  # report_only -> block_critical -> governed
  metasolve_base_url: https://app.metasolve.ca
  evidence_endpoint: /api/v1/trust/verify
  api_key_scope: write:verification
  fail_on_release_decisions: [blocked]
  never_send_raw_source: true
local_scanners:
  sast: bandit-and-eslint
  dependency: organization-approved-sca
  secrets: organization-approved-secret-scanner
  sbom_output: out/security/sbom.cdx.json
governance:
  policy_id: CHANGE-ME
  policy_version: "1.0"
  clause_id: RELEASE-GATE
  policy_approval_status: Approved
  human_review_required_for: [critical, accepted_risk, exception]
evidence:
  retain_ci_artifacts_days: 90
  hash_algorithm: sha256
  exclude: [raw_source, credentials, tokens, personal_data]
