# Foundation Documentation

This folder is the operating manual for the architecture rails introduced in
Phase 0 and Phase 1 of the BMW readiness work. ADRs (`docs/adr/010` …
`docs/adr/020`) explain *why* — these documents explain *how to live with* the
rules day to day.

## Index

| Doc | Topic | When to read |
| --- | --- | --- |
| [architecture-rails.md](./architecture-rails.md) | The four-circle model, layer map, boundary rules | Before adding a new module or import |
| [composition-profiles.md](./composition-profiles.md) | What profiles are, how to add/extend one | Before customer-specific configuration |
| [logger-usage.md](./logger-usage.md) | Structured logger facade, redaction, fields | Any time you'd reach for `console.*` |
| [module-workflow.md](./module-workflow.md) | `npm run new:module`, ownership, README convention | Creating a new feature module |
| [ci-security.md](./ci-security.md) | CodeQL, gitleaks, dependency-review, portability matrix | When CI fails on a security/portability check |
| [csp-strategy.md](./csp-strategy.md) | Phased rollout: report-only → enforced | Adding a new third-party origin |
| [follow-ups.md](./follow-ups.md) | Known gaps and Phase 2 entry points | Planning the next phase or onboarding |

## Status

Phase 0 and Phase 1 are complete. Boundaries lint and forbidden-strings check
run in **warn** mode; CSP runs in **report-only**. Phase 2 promotes both to
enforced and migrates remaining customer coupling out of the product core.
See [follow-ups.md](./follow-ups.md).