Rendezvous/docs/architecture/project-boundaries.md

Project and dependency boundaries

Tracking: #3

FinalFactory.Rendezvous.Contracts  <-  FinalFactory.Rendezvous.Client
                ^                               ^
                |                               |
FinalFactory.Rendezvous.Server     FinalFactory.Rendezvous.TestClient

• Contracts targets netstandard2.1 and contains only versioned, transport-neutral IDs and wire contracts. It cannot reference Server, LiteNetLib, or Godot. Its only package is System.Text.Json, used for the canonical cross-runtime JSON contract.
• Client targets netstandard2.1, references Contracts and the pinned LiteNetLib package, and contains no Godot or Server dependency.
• Server targets .NET 10 LTS, references Contracts, LiteNetLib, and the first-party ASP.NET Core OpenAPI generator, and owns HTTP hosting, UDP mediation, application policy, and ephemeral state.
• TestClient targets .NET 8, references only the public Client/Contracts seams and LiteNetLib, and must never reach into Server internals.
• Tests target .NET 10 and may reference every project solely to verify public behavior and architecture boundaries.

The dependency-boundary tests inspect compiled assembly references. A forbidden engine, transport, or server dependency therefore fails the normal test gate.

Supported toolchain

• Build SDK: .NET SDK 10.0.301, pinned by global.json.
• Server runtime: .NET 10 LTS.
• Client/contracts compatibility target: .NET Standard 2.1, consumable by the .NET 8-or-later runtime used by current Godot 4 C# projects.
• TestClient runtime: .NET 8.
• LiteNetLib: 2.1.4, pinned centrally and restored from the lock files.
• Microsoft.OpenApi: patched 2.7.5 line, centrally pinned because the version originally pulled by the .NET 10 generator is affected by CVE-2026-49451.

The repository uses central package versions, per-project lock files, deterministic compilation, nullable reference types, warnings as errors, current .NET analyzers, and formatting verification. CI restores in locked mode so a package graph change must be deliberate and committed.

Primary compatibility references:

• .NET support policy
• Godot stable C# prerequisites
• LiteNetLib 2.1.4 on NuGet
• ASP.NET Core OpenAPI generation
• Microsoft.OpenApi security advisory