# Governance

Practical governance artefacts for KADi: risks, decisions, scorecards, and
customer-specific governance packs.

## Layout

```
governance/
  scorecard/
    risk-register.md          # active risks tracked across the programme
    decision-register.md      # high-level decisions (cross-references ADRs)
    architecture-scorecard.md # measurable health of architectural rails
    bypass-log.md             # justified eslint-disable / suppression entries
  bmw/                        # BMW-specific governance pack (Phase 9 deliverable)
    .keep
```

## How to use

- **risk-register.md** — append a row when a real risk surfaces; link to the
  PR or ADR that resolves it.
- **decision-register.md** — append a row when a non-trivial decision lands;
  link to the ADR. ADRs are the long-form record; this register is the index.
- **architecture-scorecard.md** — update monthly with the four-circle health
  score and the top three rules currently violated (with counts).
- **bypass-log.md** — every `eslint-disable` for `boundaries/*` rules and
  every CSP exception is logged here with rationale.

## Rules

1. Customer-specific governance never lives under `governance/scorecard/`. It
   lives under `governance/<customer>/`.
2. The scorecards are read by humans, not generated. Keep them short.
3. ADRs live in `docs/adr/`; this folder records what is currently true, not
   why we chose it.