# Project and dependency boundaries

Tracking: #3

```text
FinalFactory.Rendezvous.Contracts  <-  FinalFactory.Rendezvous.Client
                ^                               ^
                |                               |
FinalFactory.Rendezvous.Server     FinalFactory.Rendezvous.TestClient
```

- `Contracts` targets `netstandard2.1` and contains only versioned,
  transport-neutral IDs and wire contracts. It cannot reference Server,
  LiteNetLib, or Godot. Its only package is `System.Text.Json`, used for the
  canonical cross-runtime JSON contract.
- `Client` targets `netstandard2.1`, references Contracts and the pinned
  LiteNetLib package, and contains no Godot or Server dependency.
- `Server` targets .NET 10 LTS, references Contracts, LiteNetLib, and the
  first-party ASP.NET Core OpenAPI generator, and owns HTTP hosting, UDP
  mediation, application policy, and ephemeral state.
- `TestClient` targets .NET 8, references only the public Client/Contracts seams
  and LiteNetLib, and must never reach into Server internals.
- `Tests` target .NET 10 and may reference every project solely to verify public
  behavior and architecture boundaries.

The dependency-boundary tests inspect compiled assembly references. A forbidden
engine, transport, or server dependency therefore fails the normal test gate.

## Supported toolchain

- Build SDK: .NET SDK 10.0.301, pinned by `global.json`.
- Verification runtime: .NET SDK 8.0.128 supplies the pinned .NET 8.0.28
  runtime used by TestClient process tests and release verification.
- Server runtime: .NET 10 LTS.
- Client/contracts compatibility target: .NET Standard 2.1, consumable by the
  .NET 8-or-later runtime used by current Godot 4 C# projects.
- TestClient runtime: .NET 8.
- LiteNetLib: 2.1.4, pinned centrally and restored from the lock files.
- Microsoft.OpenApi: patched 2.7.5 line, centrally pinned because the version
  originally pulled by the .NET 10 generator is affected by CVE-2026-49451.

The repository uses central package versions, per-project lock files,
deterministic compilation, nullable reference types, warnings as errors, current
.NET analyzers, and formatting verification. CI restores in locked mode so a
package graph change must be deliberate and committed.

Primary compatibility references:

- [.NET support policy](https://dotnet.microsoft.com/en-us/platform/support/policy)
- [Godot stable C# prerequisites](https://docs.godotengine.org/en/stable/tutorials/scripting/c_sharp/c_sharp_basics.html)
- [LiteNetLib 2.1.4 on NuGet](https://www.nuget.org/packages/LiteNetLib/2.1.4)
- [ASP.NET Core OpenAPI generation](https://learn.microsoft.com/en-us/aspnet/core/fundamentals/openapi/overview?view=aspnetcore-10.0)
- [Microsoft.OpenApi security advisory](https://github.com/advisories/GHSA-v5pm-xwqc-g5wc)