Add a qbit-guardrails test jar and a parent profile that runs it in every
qbit's build via surefire dependenciesToScan. The enforcer runs at
validate.
- G1: bannedDependencies on com.kingsrook.qbits:* outside test scope,
except qbit-object-storage and *-api artifacts. An ArchUnit check that
main classes use only their own packages, QQQ, libraries and allowed
com.kingsrook.qbits.<x>.api packages. A scan for string literals that
name another qbit's classes, as in Class.forName.
- G2: qbit.guardrails.strictUiApiRoutes=true forwards
qqq.uiApi.strictRoutes=true to tests.
- G3: a qbit that references MiddlewareSpecExtension must commit
openapi/qqq-v1/*.yaml and have a contract test (UiApiContract or
UiApiContractAssertions). Raw /qqq/v1 routes are listed as warnings.
- G4: STAND-IN(core=OWNER/REPO#N, removeBy=VERSION) markers fail once the
qqq-backend-core version on the classpath is at or past removeBy, or
when the marker is malformed.
- G7: requireReleaseDeps for com.kingsrook.qqq and com.kingsrook.qbits.
Everything only reports by default. A qbit opts in with
qbit.guardrails.enforce=true. Version 2.1.0.
Closes#9 (architecture review QRun-IO/qqq#1150, section 5; G5 waits for
the core typed widgets).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
james.maesandClaude Opus 5.5