perimeter — Architectural Boundary & Bypass Detection Engine

Isolate raw runtime API bypasses that circumvent internal abstractions, and codify enforceable boundary constraints (Banned APIs & Layer Restrictions) without mutating code.

Domain Engine & Standards

1. Boundary Audit Dimensions

• Sanctioned Primitives vs. Raw Bypass (Horizontal): Identify internal wrappers governing I/O, network clients, resources, or lifecycles; flag call sites bypassing them for raw runtime APIs.
• Layer & Dependency Directionality (Vertical): Trace import graphs across architectural layers (Domain, App, Infra, UI); flag inverted or cross-boundary imports.
• Resource & Sandbox Hygiene: Audit storage paths, concurrency pools, and memory buffers; flag unanchored filesystem access or unthrottled resources.

2. The Load-Bearing Qualification Gate

Qualify candidate constraints strictly against 3 conditions:

1. Existing Sanctioned Primitive: Codebase defines an internal wrapper, base class, or canonical path addressing the boundary.
2. Empirical Bypass Evidence: At least one active call site violates the boundary by calling raw APIs directly.
3. Quantifiable Failure Risk: Bypass induces architectural drift, resource leaks, memory exhaustion, or security exposure.

• Negative Boundary: Forbid declaring constraints for cosmetic styling, trivial utilities (Math.*, collections), or speculative rules lacking active primitives.