Guard rules · 24 rules
These rules help teams make fewer mistakes — each one really runs at build time.
Generated by the build; matches what actually runs. · 2026-10-10T01:08:01.331Z
| Domain | Blocks | How | Failure output |
|---|---|---|---|
| Layering and dependency direction | app layer importing infra.mapper directly | Architecture assertion | Build fails and names the file and line |
| Dependency direction | A handler returning an app-layer type, creating a reverse dependency | Architecture assertion | Build fails |
| Banned patterns | @Autowired field injection / controller reaching straight to Mapper | Banned-pattern assertion | Build fails and names the class |
| Banned patterns | System.out / new Date() / domain referencing Spring Web | Banned-pattern assertion | Build fails and names the class |
| Contract consistency | Registered endpoint count not matching the real count | Consistency test | Build fails and prints the difference |
| Permission-code consistency | Referencing an unregistered permission-code constant | Consistency test | Build fails and lists every reference |
| Permission-code consistency | A permission-code literal appearing in code | Repository-wide scan | Build fails and lists file and line |
| Deny-by-default authorization | A new endpoint without an auth annotation | Startup guard | Startup fails; anonymous access returns a fixed error code |
| Data access | Hand-written XML query missing the soft-delete condition | SQL assertion | Test fails and prints the real SQL |
| Transaction boundary | @Transactional appearing in the repository layer | Architecture assertion | Build fails and names the method |
| Migration scripts | Modifying an already applied migration | Changeset check | Build fails and names the script |
| Reproducible builds | Committing unformatted code | Commit hook plus CI | The commit is rejected |
| Layering and dependency direction | domain layer depending on an app-layer DTO | Architecture assertion | Build fails and names the file and line |
| Dependency direction | common layer referencing a business module back | Architecture assertion | Build fails and names the file and line |
| Banned patterns | new Thread and self-built thread pools | Banned-pattern assertion | Build fails and names the class |
| Contract consistency | Error-code ranges not matching the registry | Consistency test | Build fails and prints the difference |
| Data access | An unannotated field entering a query condition | Condition allowlist | The condition is dropped and a warning is raised |
| Data access | Unescaped wildcards in a fuzzy search | Automatic escaping by the framework | No error; injection-style matching is impossible |
| Data access | Pagination without a stable sort causing jitter across pages | Sort allowlist plus fallback sort | No error; row order stays stable |
| Migration scripts | A new changeset whose sequence goes backwards or repeats | Changeset check | Build fails and names the script |
| Logging and masking | Phone numbers or passwords in clear text in logs | Serialization masking | No error; the output is already masked |
| Observability | Async entry points losing the traceId | Executor propagation | No error; all five entry points read the same value |
| Reproducible builds | A dependency without a locked version | Version catalog lock | Build fails |
| Reproducible builds | Missing test skeleton leaving generated code unable to build | Generator ships tests | Build fails |
Domain
Layering and dependency direction
2 rules
Dependency direction
2 rules
Banned patterns
3 rules
Contract consistency
2 rules
Permission-code consistency
2 rules
Deny-by-default authorization
1 rules
Data access
4 rules
Transaction boundary
1 rules
Migration scripts
2 rules
Reproducible builds
3 rules
Logging and masking
1 rules
Observability
1 rules
By the way: code that fails the architecture check cannot be merged.