Dev-Architecture — Module Boundaries & Structural Integrity

Enforces architectural rules that prevent structural decay: circular dependencies, implicit coupling, barrel abuse, and misplaced validation. These rules are mechanical — an AI coding agent can follow them without subjective judgment.

Before architecture work, read dev for classification, fast paths, rule authority, family invariants, verification, and safety; current/public evidence follows its Conditional Routes.

Use browser verification only after candidate URLs exist.

Modular References

Condition	Reference
Change boundaries, seams, layers, shared packages, or public exports above C0/C1; choose module owners/depth	Module boundaries (ARCH-DECISION-01, ARCH-MAP-01)
Detect/fix import cycles or classify coupling	Import structure, cycle commands, coupling examples
Create/modify index or re-export files	Barrel policy, barrel examples
Place shape parsing, domain invariants, or security checks	Validation matrices and exceptions
Review structural changes, add CI conformance, query structural indexes, or use decision trees	Architecture review
Durable architecture documentation	cxc-dev-scaffolding
Security policy/auth, observability, review, RCA, or infrastructure boundaries	Cross-skill owners

4. Boundary-Only Defensive Programming

Severity: CRITICAL Rule: Parse untrusted data at trust boundaries and avoid repeating shape validation inside one trusted typed boundary. Domain invariants (valid ranges, state transitions, relational constraints) belong to the domain owner even for in-process callers. Authorization and assertions for genuinely reachable invalid states remain allowed.

Ownership: this section distinguishes ingress shape parsing, domain invariants and reachable-state assertions. dev-security owns security validation and authorization policy; placement must not erase a business invariant or required defense-in-depth.