ADR 0009 — Public foundation and private consumers

ADR 0009 — Public foundation and private consumers An architecture diagram generated by Archify. Public foundation, private consumers · app → catalog → foundation · never imports private code · Architecture component Public foundation, private consumers app → catalog → foundation · never imports private code require a tag · replace between tags · consumer go.mod: published version · sibling checkout · the mechanism require a tag · replace between tags consumer go.mod: published version · sibling checkout loc-budget.json · packages-budget.json · tools/locbudget · check_packages.sh · only ratchet down · the mechanism loc-budget.json · packages-budget.json tools/locbudget · check_packages.sh · only ratchet down release.yml · CHANGELOG.md · a v* tag on main · make check, make e2e · image + SBOM · the mechanism release.yml · CHANGELOG.md a v* tag on main · make check, make e2e · image + SBOM make check-loc · make check-packages · and CI fails a ceiling that went up · kept true by make check-loc · make check-packages and CI fails a ceiling that went up Rejected: needing private source to build · or credentials; consumers have other owners and access · Architecture component Rejected: needing private source to build or credentials; consumers have other owners and access the private catalog and application · pin a published version · own compatibility tests · Architecture component the private catalog and application pin a published version · own compatibility tests public documentation · the docs site · describes the seam without naming a private repository · Architecture component public documentation · the docs site describes the seam without naming a private repository pinned committed as cut by checked by instead of describes the seam pin the published version the mechanism kept true by Legend Backend Security External

Context

  • • The foundation builds and runs without private source or credentials; its consumers have other owners and access requirements
  • • One public module does not require publishing its consumers; published source history is not reversible

Consequences

  • • Never imports or requires private code; boundaries are crossed through contracts; a consumer pins a published version
  • • A local replace can hide a stale pin, so the consumer release tests the required version without a machine-local path

Evidence

  • • make check-loc, make check-packages against loc-budget.json and packages-budget.json; a raise is a separate owner review
  • • CI fails a ceiling that went up; scripts/check_imports.sh keeps imports in contracts/; a release certifies no private product