refactor: separate config debt from boundaries

tests/fixtures/architecture/configuration-debt-baseline.json

@@ -1,5 +1,32 @@
 {
-  "schema_version": 1,
+  "composition_root_oper_boundaries": {
+    "count": 1,
+    "entries": [
+      {
+        "file": "app/startup/initializers/modules.py",
+        "name": "SystemConfigOper",
+        "reason": "启动组合根负责构造唯一的系统配置数据库适配器"
+      }
+    ]
+  },
+  "foundational_settings_boundaries": {
+    "count": 3,
+    "entries": [
+      {
+        "file": "app/db/base.py",
+        "reason": "模型声明阶段必须在运行时配置服务装配前确定数据库主键类型"
+      },
+      {
+        "file": "app/db/engine.py",
+        "reason": "数据库引擎是运行时配置服务的底层依赖，不能通过兼容代理自递归"
+      },
+      {
+        "file": "app/db/session.py",
+        "reason": "数据库会话与连接配额必须在应用组合根装配前可用"
+      }
+    ]
+  },
+  "schema_version": 2,
   "scope": {
     "excluded": [
       "app/plugins",
@@ -10,20 +37,11 @@
     "root": "app"
   },
   "settings_imports": {
-    "count": 3,
-    "files": [
-      "app/db/base.py",
-      "app/db/engine.py",
-      "app/db/session.py"
-    ]
+    "count": 0,
+    "files": []
   },
   "system_config_oper_constructions": {
-    "calls": [
-      {
-        "file": "app/startup/initializers/modules.py",
-        "name": "SystemConfigOper"
-      }
-    ],
-    "count": 1
+    "calls": [],
+    "count": 0
   }
 }

tests/test_architecture_baseline_cli.py

@@ -53,7 +53,7 @@ def _performance_sample(
 def _transaction_sample(methods: list[dict[str, str]]) -> dict:
     """构造最小事务债务 fixture，供单向 ratchet 行为测试。"""
     return {
-        "schema_version": 1,
+        "schema_version": 2,
         "scope": "app/db/models and app/db/oper transaction ownership debt",
         "model_decorators": {
             "count": len(methods),
@@ -75,8 +75,12 @@ def _transaction_sample(methods: list[dict[str, str]]) -> dict:
 def _configuration_sample(
     settings_files: list[str],
     oper_calls: list[dict[str, str]],
+    foundational_entries: list[dict[str, str]] | None = None,
+    composition_entries: list[dict[str, str]] | None = None,
 ) -> dict:
     """构造最小配置债务 fixture，供单向 ratchet 行为测试。"""
+    foundational_entries = foundational_entries or []
+    composition_entries = composition_entries or []
     return {
         "schema_version": 1,
         "scope": {
@@ -91,6 +95,14 @@ def _configuration_sample(
             "count": len(oper_calls),
             "calls": oper_calls,
         },
+        "foundational_settings_boundaries": {
+            "count": len(foundational_entries),
+            "entries": foundational_entries,
+        },
+        "composition_root_oper_boundaries": {
+            "count": len(composition_entries),
+            "entries": composition_entries,
+        },
     }
 
 
@@ -414,6 +426,22 @@ def test_configuration_ratchet_allows_removal_but_rejects_new_access() -> None:
     )
 
 
+def test_configuration_ratchet_rejects_new_approved_boundaries() -> None:
+    """批准边界同样只能减少，不能借新增理由把新债务改名为豁免。"""
+    existing = {"file": "app/db/base.py", "reason": "model declaration"}
+    added = {"file": "app/db/new.py", "reason": "new exemption"}
+    expected = _configuration_sample([], [], [existing])
+
+    assert architecture_baseline.configuration_ratchet_matches(
+        expected,
+        _configuration_sample([], [], []),
+    )
+    assert not architecture_baseline.configuration_ratchet_matches(
+        expected,
+        _configuration_sample([], [], [existing, added]),
+    )
+
+
 def test_architecture_write_host_only_updates_host_files(
     tmp_path: Path,
     monkeypatch,

tests/test_architecture_contract_baseline.py

@@ -173,11 +173,11 @@ def test_host_oper_does_not_call_base_implicit_write_wrappers() -> None:
 
 
 def test_configuration_debt_baseline_tracks_canonical_direct_access() -> None:
-    """配置债务基线必须排除插件兼容面，并冻结两个可下降的直接访问集合。"""
+    """配置基线必须把零债务与固定基础设施边界分开冻结。"""
     baseline_path = BASELINE_ROOT / "configuration-debt-baseline.json"
     baseline = json.loads(baseline_path.read_text(encoding="utf-8"))
 
-    assert baseline["schema_version"] == 1
+    assert baseline["schema_version"] == 2
     assert baseline["scope"]["excluded"] == [
         "app/plugins",
         "app/sdk",
@@ -190,6 +190,20 @@ def test_configuration_debt_baseline_tracks_canonical_direct_access() -> None:
     assert baseline["system_config_oper_constructions"]["count"] == len(
         baseline["system_config_oper_constructions"]["calls"]
     )
+    assert baseline["settings_imports"] == {"count": 0, "files": []}
+    assert baseline["system_config_oper_constructions"] == {
+        "count": 0,
+        "calls": [],
+    }
+    assert {
+        entry["file"]
+        for entry in baseline["foundational_settings_boundaries"]["entries"]
+    } == {"app/db/base.py", "app/db/engine.py", "app/db/session.py"}
+    assert baseline["foundational_settings_boundaries"]["count"] == 3
+    assert baseline["composition_root_oper_boundaries"]["count"] == 1
+    assert baseline["composition_root_oper_boundaries"]["entries"][0]["file"] == (
+        "app/startup/initializers/modules.py"
+    )
 
 
 def test_startup_performance_baseline_records_normal_and_safe_lifecycle_resources():