B.6.10 — Janus event-broker refusal (no Kafka SaaS US) for event-driven-eu

[Bogala]

Summary

Implements B.6.10 (docs/new-archetypes-plan.md §6.1) — the standard
interdiction "pas de Kafka SaaS US (Confluent Cloud), Redpanda acceptable
(EU deployable)" — as scaffold-time Janus refusal rules for the
event-driven-eu archetype. The direct sibling of b7-9-janus-ai
(J.8.c), reusing that brick's machinery verbatim.

Two new rules in the J8-RULE-NNN catalogue (next free block after 006):

• J8-RULE-007 — Confluent Cloud (US-managed Kafka SaaS) refused as
  the event broker regardless of tier (tier: any, never a valid default;
  mirrors J8-RULE-004/005).
• J8-RULE-008 — at --eu-tier T3, any US-managed Kafka SaaS
  (Confluent Cloud / AWS MSK / Azure Event Hubs) refused (tier: T3; mirrors
  J8-RULE-006), forcing self-hosted NATS JetStream / Redpanda on EU infra.

Grounded in the archetype schema flag
event_specifics.eu_sovereignty.no_kafka_saas_us: true (whose comment names
B.6.10 as its enforcement) + acceptable: [nats-jetstream, redpanda]. The
rule is a forward-looking guard: NATS JetStream is the sovereign default
(never refused); Redpanda is the sanctioned Kafka-API-compatible alternative;
Confluent Cloud is forbidden.

What changed

• Reuse, not re-create: appends two entries to the EXISTING
  dispatch-table.yml::forbidden_combinations: list and adds a call site to
  bin/forge-init-event-driven-eu.sh for the EXISTING
  _refuse_if_forbidden_combination helper (both shipped by b7-9-janus-ai).
  No new registry, no new/duplicated helper.
• New ### Event-broker rules (event-driven-eu) H3 in
  cross-layer-orchestrator.md (inside the existing "Forbidden archetypes &
  combinations" H2).
• Standards: janus-orchestration-rules.md +2 catalogue rows;
  compliance-tiers.md::forbidden: += confluent-cloud (1.1.0→1.2.0) so the
  generic I.3 T3-RULE-005 review-time linter catches it, with a matching
  constitution-linter.sh REMEDIATION hint; forbidden-components-rules.md
  event-broker coupling note (1.1.0→1.2.0). No new T3-RULE-NNN — the
  reserved T3-RULE-008 Persistence slot is untouched.
• Sibling-harness coupling: relaxed b7-9.test.sh::_test_b7_9_005
  numbering guard (it hard-pinned 006 as the last rule) to permit the
  newly-allocated 007/008 while still catching a 009+ collision — the same
  discipline b7-9 applied to i2/i3. Prevents main CI going red on merge.
• Docs: docs/ARCHETYPES.md rows + note; CHANGELOG.md [Unreleased] entry.
• Change pipeline in .forge/changes/b6-10-janus-rule/ (archived); B.6.10
  block appended to .forge/specs/janus-rules.md.

Constitution: no amendment (ENFORCES existing EU-sovereign posture); additive
per "Extending the catalogue"; J8-RULE-007/008 never-reused (ADR-J8-004).

Test plan

New harness .forge/scripts/tests/b6-10.test.sh (12 tests: 9 L1 + 3 L2),
registered in forge-ci.yml. TDD RED→GREEN witnessed (11 fail → 12 pass).

• b6-10.test.sh --level 1,2 — 12/12 (L1 anchors/registry/wrapper/std/token
  • numbering invariant; L2 exercises the reused helper: confluent-cloud@any ⇒
    exit 3 + J8-RULE-007, T3+us-managed-kafka ⇒ exit 3 + J8-RULE-008,
    T3+nats-jetstream ⇒ exit 0 no refusal).
• End-to-end wrapper (FORGE_EDE_FORCE_SCAFFOLD=1): confluent-cloud and
  T3+us-managed-kafka both emit the structured [REFUSAL: …] and exit 3;
  fresh init still refuses as candidate ("not-yet-scaffoldable", not a
  J8-RULE); NATS default at T3 fires 0 refusals.
• No regression: b7-9 15/15, j8 20/20, i2 14, i3 18, j7 21, k4 22,
  b6-1 19, b6-2 10, b7-pythia 19, foundations 22 (+ t4/i5/i6/k3/k5/b7-1/b7-2a).
• verify.sh PASS (b6-10 change validates against schema, no open questions);
  constitution-linter.sh PASS 76/0; validate-standards-yaml.sh all STD-PASS.

Parallel-lane note

Shared files (CHANGELOG.md, forge-ci.yml, dispatch-table.yml,
cross-layer-orchestrator.md) are co-edited additively/disjointly with the
five sibling B.6 lanes — merge conflicts are expected and handled centrally.

🤖 Generated with Claude Code