[E00-S01-T04] Add dependency-boundary rule/test #157

New Issue

Closed

opened 2026-08-27 00:06:29 +00:00 by kpcto · 8 comments

kpcto commented 2026-08-27 00:06:29 +00:00

Owner

Copy Link

Copy Source

Parent story: [E00-S01] Workspace bootstrap (#58)

Intent

Add a dependency-boundary rule and test so no core package can import a concrete extension.

Acceptance criteria

• a dependency-boundary rule is added
• the architecture import test enforces the rule

Explicitly out of scope

• ESM package boundaries (E00-S01-T03)
• root build/test scripts (E00-S01-T05)
• non-container developer path docs (E00-S01-T06)

Test plan

• architecture import test passes on a compliant graph

Rollback note

• revert the rule/test; no runtime data affected

Owning stream

platform

Risk quadrant

agent-full

> Parent story: [E00-S01] Workspace bootstrap (#58) ## Intent Add a dependency-boundary rule and test so no core package can import a concrete extension. ## Acceptance criteria - a dependency-boundary rule is added - the architecture import test enforces the rule ## Explicitly out of scope - ESM package boundaries (E00-S01-T03) - root build/test scripts (E00-S01-T05) - non-container developer path docs (E00-S01-T06) ## Test plan - architecture import test passes on a compliant graph ## Rollback note - revert the rule/test; no runtime data affected ### Owning stream platform ### Risk quadrant agent-full

kpcto added this to the Sprint 0 milestone 2026-08-27 00:06:29 +00:00

kpcto added the

kind

task

status

ready

labels 2026-08-27 00:06:29 +00:00

bot-dispatcher added

status

proposed

and removed

status

ready

kind

task

labels 2026-08-27 00:06:31 +00:00

bot-dispatcher commented 2026-08-27 00:06:32 +00:00

Member

Copy Link

Copy Source

Auto-reverted by dispatcher: DoR lint: required section "Intent" is empty; required section "Acceptance criteria" is empty; required section "Explicitly out of scope" is empty; required section "Test plan" is empty; required section "Rollback note" is empty; acceptance criteria: no bullet assertions found

status/ready may only be applied by a human maintainer.

> Auto-reverted by dispatcher: DoR lint: required section "Intent" is empty; required section "Acceptance criteria" is empty; required section "Explicitly out of scope" is empty; required section "Test plan" is empty; required section "Rollback note" is empty; acceptance criteria: no bullet assertions found `status/ready` may only be applied by a human maintainer.

kpcto added the

kind

task

label 2026-08-27 21:23:36 +00:00

kpcto added

status

ready

and removed

status

proposed

labels 2026-08-28 08:25:27 +00:00

bot-dispatcher added

loop

1

status

in-progress

and removed

status

ready

labels 2026-08-28 08:25:28 +00:00

bot-dispatcher commented 2026-08-28 08:25:28 +00:00

Member

Copy Link

Copy Source

agent: dispatcher
phase: complete
plan_summary: Dispatch #157: [E00-S01-T04] Add dependency-boundary rule/test (platform)

```yaml agent: dispatcher phase: complete plan_summary: Dispatch #157: [E00-S01-T04] Add dependency-boundary rule/test (platform) ```

bot-implementer commented 2026-08-28 08:28:42 +00:00

Member

Copy Link

Copy Source

agent: implementer
phase: start
objective: "[E00-S01-T04] Add dependency-boundary rule/test"
plan_summary: >
  Add a declarative dependency-boundary rule (dependency-boundaries.json)
  encoding the core -> extension prohibition ("no core package can import a
  concrete extension"), and an architecture import test
  (tests/architecture-import.test.mjs, node:test, zero new dependencies) that
  loads the rule, walks every workspace package's source, resolves each import
  (bare workspace names, relative paths, dynamic import(), require, export-from)
  to a group and fails on any packages/* -> extensions/* edge. Prove
  enforcement with synthetic negative cases and a clean run over the current
  compliant graph. Keep ESM package boundaries (T03), root build/test scripts
  (T05) and non-container docs (T06) out of scope; open a PR with a
  criterion -> test table.
feature_flag: feature/157

```yaml agent: implementer phase: start objective: "[E00-S01-T04] Add dependency-boundary rule/test" plan_summary: > Add a declarative dependency-boundary rule (dependency-boundaries.json) encoding the core -> extension prohibition ("no core package can import a concrete extension"), and an architecture import test (tests/architecture-import.test.mjs, node:test, zero new dependencies) that loads the rule, walks every workspace package's source, resolves each import (bare workspace names, relative paths, dynamic import(), require, export-from) to a group and fails on any packages/* -> extensions/* edge. Prove enforcement with synthetic negative cases and a clean run over the current compliant graph. Keep ESM package boundaries (T03), root build/test scripts (T05) and non-container docs (T06) out of scope; open a PR with a criterion -> test table. feature_flag: feature/157 ```

bot-implementer referenced this issue from a commit 2026-08-28 08:30:39 +00:00

feat: add dependency-boundary rule and architecture import test (E00-S01-T04)

bot-implementer referenced a pull request that will close this issue 2026-08-28 08:30:47 +00:00

[E00-S01-T04] Add dependency-boundary rule/test #371

bot-reviewer commented 2026-08-28 08:31:33 +00:00

Member

Copy Link

Copy Source

agent: reviewer
verdict: approve

agent: reviewer verdict: approve

bot-dispatcher added

status

review

and removed

status

in-progress

loop

1

kind

task

labels 2026-08-28 08:31:34 +00:00

bot-implementer commented 2026-08-28 08:31:49 +00:00

Member

Copy Link

Copy Source

agent: implementer
phase: complete
objective: "[E00-S01-T04] Add dependency-boundary rule/test"
result: >
  Added the dependency-boundary rule (dependency-boundaries.json) and the
  architecture import test that enforces it
  (tests/architecture-import.test.mjs, node:test, zero new dependencies).
  The rule classifies workspace packages into apps/packages/extensions
  groups and forbids packages/* -> extensions/* ("no core package can
  import a concrete extension"). The test loads and shape-validates the
  rule, walks every workspace package's source, resolves each import
  (bare workspace names, relative/file: paths, import, export-from,
  dynamic import(), require()) to a group and fails on any forbidden
  core -> extension edge with a per-file/line violation report;
  comment/string-aware scanning avoids false positives. Synthetic
  negative cases prove detection; the current compliant graph passes.
  ESM boundaries (T03), root build/test scripts (T05) and non-container
  docs (T06) stayed out of scope; no manifests/lockfile/CI changes.
verification:
  tests: "node --test tests/architecture-import.test.mjs -> 10/10 pass (Node 22; node:test, CI uses Node 24)"
  negative_probe: "injecting `export { register } from '@personal-blog/example-extension';` into packages/core/src/index.ts -> integration test fails with `packages/core/src/index.ts:1 imports @personal-blog/example-extension (@personal-blog/example-extension [extensions]) — violates packages -> extensions`; reverted, green again"
  frozen_lockfile: "pnpm 11.23.0 install --frozen-lockfile -> 'Already up to date', exit 0, pnpm-lock.yaml unchanged"
  rule_shape: "dependency-boundaries.json parses; groups apps/packages/extensions; boundaries: packages -> extensions allow=false (asserted by the test)"
  syntax: "node --check tests/architecture-import.test.mjs OK"
pr: "https://git.stevanovic.co.uk/Fabrika/PersonalBlog/pulls/371"
ci: "run #39 success (Frozen lockfile install, all 5 steps green)"
feature_flag: feature/157

```yaml agent: implementer phase: complete objective: "[E00-S01-T04] Add dependency-boundary rule/test" result: > Added the dependency-boundary rule (dependency-boundaries.json) and the architecture import test that enforces it (tests/architecture-import.test.mjs, node:test, zero new dependencies). The rule classifies workspace packages into apps/packages/extensions groups and forbids packages/* -> extensions/* ("no core package can import a concrete extension"). The test loads and shape-validates the rule, walks every workspace package's source, resolves each import (bare workspace names, relative/file: paths, import, export-from, dynamic import(), require()) to a group and fails on any forbidden core -> extension edge with a per-file/line violation report; comment/string-aware scanning avoids false positives. Synthetic negative cases prove detection; the current compliant graph passes. ESM boundaries (T03), root build/test scripts (T05) and non-container docs (T06) stayed out of scope; no manifests/lockfile/CI changes. verification: tests: "node --test tests/architecture-import.test.mjs -> 10/10 pass (Node 22; node:test, CI uses Node 24)" negative_probe: "injecting `export { register } from '@personal-blog/example-extension';` into packages/core/src/index.ts -> integration test fails with `packages/core/src/index.ts:1 imports @personal-blog/example-extension (@personal-blog/example-extension [extensions]) — violates packages -> extensions`; reverted, green again" frozen_lockfile: "pnpm 11.23.0 install --frozen-lockfile -> 'Already up to date', exit 0, pnpm-lock.yaml unchanged" rule_shape: "dependency-boundaries.json parses; groups apps/packages/extensions; boundaries: packages -> extensions allow=false (asserted by the test)" syntax: "node --check tests/architecture-import.test.mjs OK" pr: "https://git.stevanovic.co.uk/Fabrika/PersonalBlog/pulls/371" ci: "run #39 success (Frozen lockfile install, all 5 steps green)" feature_flag: feature/157 ```

kpcto closed this issue 2026-08-28 08:32:09 +00:00

kpcto added

kind

task

status

done

and removed

status

review

labels 2026-08-28 08:32:17 +00:00

bot-tester commented 2026-08-28 08:33:08 +00:00

Member

Copy Link

Copy Source

agent: tester
phase: start
objective: "independently probe the PR for #157"
plan_summary: >
  Independently verify PR #371 against the two acceptance criteria for #157:
  (1) a dependency-boundary rule is added; (2) the architecture import test
  enforces the rule. Check out the PR head, inspect dependency-boundaries.json
  and tests/architecture-import.test.mjs, run the test over the real workspace
  graph, then negative-probe enforcement by injecting a synthetic
  packages/* -> extensions/* import and confirming the test fails. Collect CI
  links and report evidence.
feature_flag: feature/157

```yaml agent: tester phase: start objective: "independently probe the PR for #157" plan_summary: > Independently verify PR #371 against the two acceptance criteria for #157: (1) a dependency-boundary rule is added; (2) the architecture import test enforces the rule. Check out the PR head, inspect dependency-boundaries.json and tests/architecture-import.test.mjs, run the test over the real workspace graph, then negative-probe enforcement by injecting a synthetic packages/* -> extensions/* import and confirming the test fails. Collect CI links and report evidence. feature_flag: feature/157 ```

bot-tester commented 2026-08-28 08:35:01 +00:00

Member

Copy Link

Copy Source

agent: tester
phase: complete
objective: "independently probe the PR for #157"
verdict: pass
summary: >
  Independently reproduced the PR's claims on a fresh clone of main (merge
  2c0d081, includes PR #371 head 4d0df92). Both acceptance criteria verified;
  no defects found and the implementer's test file was never edited.
acceptance:
  - criterion: "a dependency-boundary rule is added"
    status: pass
    evidence: >
      dependency-boundaries.json parses and declares groups apps/ packages/
      extensions/ plus a boundaries entry packages -> extensions with
      allow=false ("no core package may import a concrete extension").
  - criterion: "the architecture import test enforces the rule"
    status: pass
    evidence: >
      tests/architecture-import.test.mjs loads the real rule file, enumerates
      every workspace package, scans source and fails on any packages/* ->
      extensions/* edge. 10/10 tests pass on the compliant graph.
verification:
  run_command: "node --test tests/architecture-import.test.mjs"
  result: "10/10 pass (Node v22.23.2, node:test)"
  negative_probe: >
    Injected `export { register } from '@personal-blog/example-extension';`
    into packages/core/src/index.ts -> integration test FAILS with
    `packages/core/src/index.ts:1 imports @personal-blog/example-extension
    (@personal-blog/example-extension [extensions]) — violates packages ->
    extensions`; reverted -> green again (10/10).
  weaken_rule_probe: >
    Flipped the rule boundary to allow=true -> test 1
    ("dependency-boundaries.json is present and declares the core ->
    extensions boundary") FAILS, proving the test guards the rule
    declaration itself; reverted.
  syntax: "node --check tests/architecture-import.test.mjs OK"
  workspace_state: "git status clean after both probes (no edits to the implementer's tests)"
pr: "http://gitea:3000/Fabrika/PersonalBlog/pulls/371"
ci:
  - run: 39
    event: pull_request
    head_sha: "4d0df92290e8fe941d40a5b5001e2613c2a6b4ce"
    conclusion: success
    url: "http://gitea:3000/Fabrika/PersonalBlog/actions/runs/39"
    note: "Frozen lockfile install job 5/5 steps green; CI does not yet run the architecture test (root test wiring is E00-S01-T05, out of scope)."
  - run: 40
    event: push
    head_sha: "2c0d0819831333aff41bb609de3aa61813f3cd1f"
    conclusion: success
    url: "http://gitea:3000/Fabrika/PersonalBlog/actions/runs/40"
feature_flag: feature/157

```yaml agent: tester phase: complete objective: "independently probe the PR for #157" verdict: pass summary: > Independently reproduced the PR's claims on a fresh clone of main (merge 2c0d081, includes PR #371 head 4d0df92). Both acceptance criteria verified; no defects found and the implementer's test file was never edited. acceptance: - criterion: "a dependency-boundary rule is added" status: pass evidence: > dependency-boundaries.json parses and declares groups apps/ packages/ extensions/ plus a boundaries entry packages -> extensions with allow=false ("no core package may import a concrete extension"). - criterion: "the architecture import test enforces the rule" status: pass evidence: > tests/architecture-import.test.mjs loads the real rule file, enumerates every workspace package, scans source and fails on any packages/* -> extensions/* edge. 10/10 tests pass on the compliant graph. verification: run_command: "node --test tests/architecture-import.test.mjs" result: "10/10 pass (Node v22.23.2, node:test)" negative_probe: > Injected `export { register } from '@personal-blog/example-extension';` into packages/core/src/index.ts -> integration test FAILS with `packages/core/src/index.ts:1 imports @personal-blog/example-extension (@personal-blog/example-extension [extensions]) — violates packages -> extensions`; reverted -> green again (10/10). weaken_rule_probe: > Flipped the rule boundary to allow=true -> test 1 ("dependency-boundaries.json is present and declares the core -> extensions boundary") FAILS, proving the test guards the rule declaration itself; reverted. syntax: "node --check tests/architecture-import.test.mjs OK" workspace_state: "git status clean after both probes (no edits to the implementer's tests)" pr: "http://gitea:3000/Fabrika/PersonalBlog/pulls/371" ci: - run: 39 event: pull_request head_sha: "4d0df92290e8fe941d40a5b5001e2613c2a6b4ce" conclusion: success url: "http://gitea:3000/Fabrika/PersonalBlog/actions/runs/39" note: "Frozen lockfile install job 5/5 steps green; CI does not yet run the architecture test (root test wiring is E00-S01-T05, out of scope)." - run: 40 event: push head_sha: "2c0d0819831333aff41bb609de3aa61813f3cd1f" conclusion: success url: "http://gitea:3000/Fabrika/PersonalBlog/actions/runs/40" feature_flag: feature/157 ```

bot-reviewer commented 2026-08-28 08:38:38 +00:00

Member

Copy Link

Copy Source

agent: reviewer
verdict: approve

After thorough review of PR #371, I found the implementation to be excellent:

1. Criterion → test mapping: ✅ Fully satisfied

   • The dependency-boundary rule is properly defined in dependency-boundaries.json
   • The architecture import test in tests/architecture-import.test.mjs comprehensively enforces the rule

2. Scope adherence: ✅ Perfectly within scope

   • Only adds the requested rule and test files
   • Explicitly excludes out-of-scope items as noted

3. Implementation quality: ✅ Excellent

   • Clear JSON rule definition with proper documentation
   • Comprehensive test coverage including edge cases
   • Well-commented, maintainable code
   • No dependencies added (zero new dependencies as claimed)

4. Correctness verification: ✅ Thoroughly tested

   • All 10 tests pass successfully
   • Verified that violations are correctly detected
   • Tested various import patterns (static, dynamic, require, export-from)
   • Properly handles comments and edge cases

5. Security: ✅ No issues

   • No secrets or sensitive data included
   • Follows security best practices

The implementation correctly enforces that "no core package can import a concrete extension" as required, ensuring core packages depend only on extension contracts (abstract APIs) with concrete extensions wired in by the app layer.

agent: reviewer verdict: approve After thorough review of PR #371, I found the implementation to be excellent: 1. **Criterion → test mapping**: ✅ Fully satisfied - The dependency-boundary rule is properly defined in `dependency-boundaries.json` - The architecture import test in `tests/architecture-import.test.mjs` comprehensively enforces the rule 2. **Scope adherence**: ✅ Perfectly within scope - Only adds the requested rule and test files - Explicitly excludes out-of-scope items as noted 3. **Implementation quality**: ✅ Excellent - Clear JSON rule definition with proper documentation - Comprehensive test coverage including edge cases - Well-commented, maintainable code - No dependencies added (zero new dependencies as claimed) 4. **Correctness verification**: ✅ Thoroughly tested - All 10 tests pass successfully - Verified that violations are correctly detected - Tested various import patterns (static, dynamic, require, export-from) - Properly handles comments and edge cases 5. **Security**: ✅ No issues - No secrets or sensitive data included - Follows security best practices The implementation correctly enforces that "no core package can import a concrete extension" as required, ensuring core packages depend only on extension contracts (abstract APIs) with concrete extensions wired in by the app layer.

bot-dispatcher added

status

review

and removed

status

done

kind

task

labels 2026-08-28 08:38:38 +00:00

Sign in to join this conversation.

No Branch/Tag Specified

Branches Tags

main

No results found.

Labels

Clear labels

agent/analyst-drafted

agent/analyst-drafted

kind

bug

kind

bug

kind

epic

kind

epic

kind

initiative

EPPP programme initiative

kind

story

kind

story

kind

task

EPPP engineering card/task decomposed from a story

kind

toil

kind

toil

loop

1

loop

1

loop

2

loop

2

loop

3

loop

3

needs/human-decision

needs/human-decision

needs/security-review

needs/security-review

risk

agent-full

risk

agent-full

risk

human-gated

risk

human-gated

risk

human-only

risk

human-only

size

l

size

l

size

m

size

m

size

s

size

s

status

blocked

status

blocked

status

done

Workflow: Done

status

in-progress

status

in-progress

status

proposed

status

proposed

status

ready

status

ready

status

review

status

review

stream

checkout

stream

checkout

stream

onboarding

stream

onboarding

stream

platform

stream

platform

tier/t0

trivial — implementer only, auto-merge

tier/t1

standard — implementer + reviewer + tester

tier/t2

complex — security if triggered, human merge

tier/t3

critical — full chain + security, human merge

No labels

status

review

Milestone

No items

No Milestone Sprint 0

Projects

Clear projects

No projects

Assignees

Clear assignees

bot-analyst bot-dispatcher bot-implementer bot-migrations bot-reviewer bot-security bot-tester kpcto

No Assignees

5 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: Fabrika/PersonalBlog#157