Refine Rust architecture boundaries

scripts/check-rust-boundaries.sh

@@ -4,3 +4,4 @@ set -euo pipefail
 ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 
 python3 "$ROOT_DIR/scripts/check-rust-boundaries.py" "$@"
+"$ROOT_DIR/scripts/check-rust-module-boundaries.sh"

scripts/check-rust-module-boundaries.sh

@@ -0,0 +1,65 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR="${CRANK_RUST_BOUNDARY_ROOT:-$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)}"
+status=0
+
+check_no_match() {
+  local description="$1"
+  local pattern="$2"
+  shift 2
+  local output
+
+  output="$(rg -n "$pattern" "$@" 2>/dev/null || true)"
+  if [[ -n "$output" ]]; then
+    echo "error: $description" >&2
+    echo "$output" >&2
+    status=1
+  fi
+}
+
+echo "Rust module boundary check: checking module-level imports"
+
+check_no_match \
+  "admin-api service modules must not depend on axum HTTP types" \
+  '^\s*use\s+axum(::|[;\{])' \
+  "$ROOT_DIR/apps/admin-api/src/service" \
+  "$ROOT_DIR/apps/admin-api/src/service.rs"
+
+check_no_match \
+  "admin-api route modules must not call runtime directly" \
+  '^\s*use\s+crank_runtime(::|[;\{])' \
+  "$ROOT_DIR/apps/admin-api/src/routes" \
+  "$ROOT_DIR/apps/admin-api/src/routes.rs"
+
+check_no_match \
+  "crank-core production modules must not depend on axum, sqlx, reqwest, tokio or tracing" \
+  '^\s*use\s+(axum|sqlx|reqwest|tokio|tracing)(::|[;\{])' \
+  "$ROOT_DIR/crates/crank-core/src"
+
+check_no_match \
+  "crank-registry production modules must not depend on axum or reqwest" \
+  '^\s*use\s+(axum|reqwest)(::|[;\{])' \
+  "$ROOT_DIR/crates/crank-registry/src"
+
+check_no_match \
+  "crank-runtime production modules must not depend on axum or sqlx" \
+  '^\s*use\s+(axum|sqlx)(::|[;\{])' \
+  "$ROOT_DIR/crates/crank-runtime/src"
+
+if (( status != 0 )); then
+  cat >&2 <<'EOF'
+
+Rust module boundary check failed.
+
+Rules:
+- routes own HTTP extraction/response details;
+- service modules own application use-cases and must not import axum;
+- core remains framework/storage agnostic;
+- registry remains storage-only and HTTP-client agnostic;
+- runtime remains execution-only and storage/framework agnostic.
+
+EOF
+fi
+
+exit "$status"