docs: update HANDOFF.md — age-native redesign progress (tasks 1–7 complete)

scripts/check-dep-boundaries.py

@@ -0,0 +1,56 @@
+#!/usr/bin/env python3
+"""
+Enforce crate dependency boundaries for the notfiles workspace:
+  - notcore must remain a leaf crate (no deps on other notfiles crates)
+  - notfiles, notsecrets, nothooks may depend on notcore but NOT on each other
+  - notstrap may depend on notcore + feature crates (it's the orchestrator)
+
+Exits 0 if boundaries are clean, 1 if violations found.
+"""
+import json
+import subprocess
+import sys
+
+LEAF = "notcore"
+FEATURE_CRATES = {"notfiles", "notsecrets", "nothooks"}
+ORCHESTRATOR = "notstrap"
+WORKSPACE_CRATES = FEATURE_CRATES | {LEAF, ORCHESTRATOR}
+
+result = subprocess.run(
+    ["cargo", "metadata", "--no-deps", "--format-version", "1"],
+    capture_output=True, text=True, check=True,
+)
+meta = json.loads(result.stdout)
+
+# Build name -> deps map for workspace members only
+crate_deps: dict[str, set[str]] = {}
+for pkg in meta["packages"]:
+    name = pkg["name"]
+    if name not in WORKSPACE_CRATES:
+        continue
+    deps = {d["name"] for d in pkg["dependencies"] if d["name"] in WORKSPACE_CRATES}
+    crate_deps[name] = deps
+
+violations = []
+
+# notcore must have no workspace deps
+if crate_deps.get(LEAF):
+    violations.append(f"{LEAF} depends on workspace crates: {crate_deps[LEAF]}")
+
+# feature crates must not depend on each other
+for crate in FEATURE_CRATES:
+    forbidden = crate_deps.get(crate, set()) & FEATURE_CRATES
+    if forbidden:
+        violations.append(f"{crate} depends on sibling feature crates: {forbidden}")
+
+if violations:
+    print("FAIL: crate dependency boundary violations detected:")
+    for v in violations:
+        print(f"  - {v}")
+    sys.exit(1)
+
+print("OK: crate dependency boundaries are clean")
+print(f"  {LEAF}: no workspace deps (leaf)")
+for c in sorted(FEATURE_CRATES):
+    print(f"  {c}: depends only on {LEAF}")
+print(f"  {ORCHESTRATOR}: orchestrator (unrestricted)")