Module-boundary guard: domain stays Android-free and ads cannot reach cycle data #7

New Issue

Closed

opened 2026-08-18 02:14:37 -05:00 by null · 0 comments

null commented

2026-08-18 02:14:37 -05:00

Owner

Two boundaries in this project are load-bearing, and both are currently held up by nothing but the fact that the offending code has not been written yet.

domain/* must not see the Android SDK. It is kotlin("jvm") today, so this half is already a compile error — but a future contributor converting it to com.android.library to get one convenient API would remove that guarantee with no test failing.
The ads subsystem must never reach cycle data. PRODUCT_PLAN.md §34 states it as non-negotiable: no menstrual date, cycle length, fertility status, ovulation estimate, prediction confidence, prediction history or spotting record may reach advertising, ever.

Build a Gradle check that enumerates each module's permitted dependencies from the table in docs/architecture/README.md and fails the build on anything outside it. Wire it into ./gradlew check.

The guard is not finished when it passes. docs/architecture/GUARDS.md §1: a guard nobody has seen fail is not yet evidence. Add a deliberate forbidden dependency — domain/prediction on app, say — watch the guard go red, then restore the file. scripts/prove-guard.sh does exactly this with a trap so the file comes back even if the run dies.

Why now rather than in Batch 07 with the ads module: a guard written before the code it constrains is a guard that was never shaped around an exception somebody wanted to make.

Verify: bash scripts/prove-guard.sh shows the guard failing on an injected forbidden dependency and passing after restore, and ./gradlew check runs it.

Two boundaries in this project are load-bearing, and both are currently held up by nothing but the fact that the offending code has not been written yet. 1. **`domain/*` must not see the Android SDK.** It is `kotlin("jvm")` today, so this half is already a compile error — but a future contributor converting it to `com.android.library` to get one convenient API would remove that guarantee with no test failing. 2. **The ads subsystem must never reach cycle data.** PRODUCT_PLAN.md §34 states it as non-negotiable: no menstrual date, cycle length, fertility status, ovulation estimate, prediction confidence, prediction history or spotting record may reach advertising, ever. Build a Gradle check that enumerates each module's permitted dependencies from the table in `docs/architecture/README.md` and fails the build on anything outside it. Wire it into `./gradlew check`. **The guard is not finished when it passes.** `docs/architecture/GUARDS.md` §1: a guard nobody has seen fail is not yet evidence. Add a deliberate forbidden dependency — `domain/prediction` on `app`, say — watch the guard go red, then restore the file. `scripts/prove-guard.sh` does exactly this with a trap so the file comes back even if the run dies. Why now rather than in Batch 07 with the ads module: a guard written before the code it constrains is a guard that was never shaped around an exception somebody wanted to make. Verify: `bash scripts/prove-guard.sh` shows the guard failing on an injected forbidden dependency and passing after restore, and `./gradlew check` runs it.