H.5.2 Dependency Boundaries

A shared repository needs an intended dependency graph, not every edge that happens to compile.

• Define public surfaces, allowed direction, layer or domain rules, forbidden edges, cycle policy, and high-influence boundaries.
• Use visibility, imports, linters, architecture tests, graph queries, and review policy for the facets they can actually enforce.
• Track unused dependencies, cycles, fan-out, binary or image growth, invalidation, and abandoned components.
• Keep findings actionable and low-noise, with automated repairs where possible.
• Separate dependency policy from source confidentiality, artifact access, runtime authorization, and change authority.