Enforce graph-checkable dependency invariants with cargo-deny #152

New issue

Open

opened 2026-08-08 23:15:48 +00:00 by rosa · 0 comments

rosa commented

2026-08-08 23:15:48 +00:00

Owner

Goal

The dependency invariants in ARCHITECTURE.md ("Invariants" section) are
currently upheld only by review. The graph-checkable ones could be asserted
mechanically with cargo-deny (or per-package workspace lints), so a violating
use/dependency fails CI instead of slipping past a reviewer.

Invariants worth enforcing

Expressible from the dependency graph alone:

domain depends on no other Vernier crate, and on neither axum nor sqlx.
config depends on no other Vernier crate and pulls in no domain logic or ports.
apalis / apalis-sql appear only in infra and server.
The crate graph stays acyclic and inward-pointing (nothing depends on web or server).

Out of scope

"Persistence behind ports" (web performs no database access) is not
graph-checkable: web -> infra puts sqlx in web's transitive tree, so no
cargo-deny ban can distinguish a legitimate transitive presence from a stray
direct query. That one stays a review-only rule.

Suggested approach

Add a deny.toml with [bans] entries scoped per package, or use
[workspace.lints] / [package.metadata]-driven bans.
Wire the check into the ci mise task.
Once enforced, revisit whether ARCHITECTURE.md should note the enforcement.

## Goal The dependency invariants in `ARCHITECTURE.md` ("Invariants" section) are currently upheld only by review. The graph-checkable ones could be asserted mechanically with `cargo-deny` (or per-package workspace lints), so a violating `use`/dependency fails CI instead of slipping past a reviewer. ## Invariants worth enforcing Expressible from the dependency graph alone: - `domain` depends on no other Vernier crate, and on neither `axum` nor `sqlx`. - `config` depends on no other Vernier crate and pulls in no domain logic or ports. - `apalis` / `apalis-sql` appear only in `infra` and `server`. - The crate graph stays acyclic and inward-pointing (nothing depends on `web` or `server`). ## Out of scope "Persistence behind ports" (`web` performs no database access) is **not** graph-checkable: `web -> infra` puts `sqlx` in web's transitive tree, so no `cargo-deny` ban can distinguish a legitimate transitive presence from a stray direct query. That one stays a review-only rule. ## Suggested approach - Add a `deny.toml` with `[bans]` entries scoped per package, or use `[workspace.lints]` / `[package.metadata]`-driven bans. - Wire the check into the `ci` mise task. - Once enforced, revisit whether `ARCHITECTURE.md` should note the enforcement.