yak(boundary-repo-as-sibling-boundary-web-repo-forbidden-tgrc): boundary: Repo as sibling boundary, web->Repo forbidden

blogex/mix.exs

@@ -46,6 +46,10 @@ defmodule Blogex.MixProject do
       {:phoenix_live_view, "~> 1.0"},
       {:jason, "~> 1.4"},
       {:plug, "~> 1.15"},
+      # Declared directly although unused today (no boundaries, no compiler
+      # entry): `ex_crap` supplies boundary transitively, and a compile-time
+      # tool must not arrive or vanish as a side effect of a metric tool.
+      {:boundary, "~> 0.11", runtime: false},
       {:ex_doc, "~> 0.34", only: :dev, runtime: false},
       {:rustler, "~> 0.38.0", optional: true},
       {:ex_crap, "~> 0.1.1", only: [:dev, :test], runtime: false},

blogex/test/blogex/boundary_dependency_test.exs

@@ -0,0 +1,27 @@
+defmodule Blogex.BoundaryDependencyTest do
+  use ExUnit.Case, async: true
+
+  alias Mix.Dep.Lock
+
+  # blogex declares no boundaries and does not run the boundary compiler, so
+  # this dependency is inert today. It is declared directly anyway (app/mix.exs
+  # does the same) so the compiler cannot arrive or vanish as a side effect of
+  # `ex_crap`, which supplies it transitively. This pins "direct, and locked to a
+  # version that satisfies the requirement"; if boundary is ever wired up here,
+  # the compile gate is that change's pin, not this test.
+  describe "boundary dependency" do
+    test "boundary is a direct dependency, not one inherited from ex_crap" do
+      assert {:boundary, requirement, opts} =
+               List.keyfind(Mix.Project.config()[:deps], :boundary, 0)
+
+      assert opts[:runtime] == false, "boundary is compile-time only; it must not ship at runtime"
+      assert Version.match?(locked_version(:boundary), requirement)
+    end
+  end
+
+  defp locked_version(app) do
+    Lock.read()
+    |> Map.fetch!(app)
+    |> elem(2)
+  end
+end