STRICT ALLOWLIST policy: Only packages explicitly listed in CONVENTIONS.md
may be imported. No exceptions.

## Changes

- Updates CONVENTIONS.md with strict allowlist language
- Adds scripts/check-deps.sh to enforce the allowlist
- Adds 'make check-deps' and 'make precommit' targets
- CI will fail if any unapproved dependency is detected

## Approved packages

- gopkg.in/yaml.v3 — YAML parsing
- github.com/google/go-cmp — test comparisons

## Process for new dependencies

1. Open a PR that ONLY updates CONVENTIONS.md
2. Requires explicit approval from Aaron
3. After merge, a separate PR may use the package

@@ -7,0 +9,4 @@
+
+| Package | Use Case | Notes |
+|---------|----------|-------|
+| `gopkg.in/yaml.v3` | YAML parsing | Persona files, config |

@@ -7,0 +12,4 @@
+| `gopkg.in/yaml.v3` | YAML parsing | Persona files, config |
+| `github.com/google/go-cmp` | Test comparisons | `cmp.Diff` for readable diffs |
+
+To add a new dependency:

@@ -0,0 +11,4 @@
+)
+
+# Build regex pattern from allowed list
+ALLOWED_PATTERN=""

@@ -0,0 +24,4 @@
+IMPORTS=$(go list -m all 2>/dev/null | tail -n +2 | awk '{print $1}' || true)
+
+if [ -z "$IMPORTS" ]; then
+    echo "✅ No external dependencies"

@@ -0,0 +48,4 @@
+done <<< "$IMPORTS"
+
+if [ -n "$VIOLATIONS" ]; then
+    echo "❌ UNAPPROVED DEPENDENCIES DETECTED"

@@ -20,1 +23,4 @@
 	go tool cover -func=coverage.out
+
+# Precommit runs all checks required before pushing
+precommit: check-deps lint test

@@ -0,0 +5,4 @@
+set -euo pipefail
+
+# Approved third-party packages (from CONVENTIONS.md)
+ALLOWED=(

@@ -0,0 +21,4 @@
+done
+
+# Get all imports from go.mod (excluding the module itself and stdlib)
+IMPORTS=$(go list -m all 2>/dev/null | tail -n +2 | awk '{print $1}' || true)

@@ -7,0 +8,4 @@
+### Approved Third-Party Packages
+
+| Package | Use Case |
+|---------|----------|

@@ -7,0 +10,4 @@
+| Package | Use Case |
+|---------|----------|
+| `gopkg.in/yaml.v3` | YAML parsing (persona files, config) |
+| `github.com/google/go-cmp` | Test comparisons (`cmp.Diff`) |

@@ -1,4 +1,4 @@
-.PHONY: build test test-integration lint clean coverage
+.PHONY: build test test-integration lint clean coverage check-deps

@@ -0,0 +5,4 @@
+set -euo pipefail
+
+# Approved third-party packages (from CONVENTIONS.md)
+ALLOWED=(

@@ -0,0 +12,4 @@
+
+# Build regex pattern from allowed list
+ALLOWED_PATTERN=""
+for pkg in "${ALLOWED[@]}"; do

@@ -7,0 +11,4 @@
+|---------|----------|-------|
+| `gopkg.in/yaml.v3` | YAML parsing (persona files, config) | production |
+| `github.com/google/go-cmp` | Test comparisons (`cmp.Diff`) | test only |
+

@@ -0,0 +31,4 @@
+
+# Get DIRECT dependencies only (exclude indirect/transitive)
+# Fail closed: if go list fails, we exit non-zero
+IMPORTS=$(go list -m -f '{{if not .Indirect}}{{.Path}}{{end}}' all 2>&1) || {

@@ -0,0 +41,4 @@
+
+if [ -z "$IMPORTS" ]; then
+    echo "✅ No external dependencies"
+    exit 0

@@ -0,0 +81,4 @@
+fi
+
+echo "✅ All dependencies are approved"
+echo "   Direct deps: $(echo "$IMPORTS" | wc -l | tr -d ' ')"

@@ -0,0 +17,4 @@
+# Looks for lines like: | `gopkg.in/yaml.v3` | ...
+ALLOWED=()
+while IFS= read -r line; do
+    # Extract package from markdown table cell: | `package` |

@@ -0,0 +20,4 @@
+    # Extract package from markdown table cell: | `package` |
+    pkg=$(echo "$line" | grep -oP '\| `\K[^`]+' | head -1 || true)
+    if [ -n "$pkg" ] && [[ "$pkg" != "Package" ]]; then
+        ALLOWED+=("$pkg")

@@ -0,0 +23,4 @@
+        ALLOWED+=("$pkg")
+    fi
+done < <(grep -E '^\| `[a-zA-Z]' "$CONVENTIONS_FILE" || true)
+

@@ -0,0 +51,4 @@
+    # Check if import matches any allowed package (prefix match for subpackages)
+    MATCHED=false
+    for allowed in "${ALLOWED[@]}"; do
+        if [[ "$import" == "$allowed" ]] || [[ "$import" == "$allowed/"* ]]; then

@@ -7,0 +17,4 @@
+Transitive dependencies of approved packages are automatically allowed.
+
+To request a new dependency:
+1. Open a PR that ONLY updates this table

@@ -0,0 +19,4 @@
+# Output: package:scope (e.g., "gopkg.in/yaml.v3:production")
+declare -A ALLOWED_PROD=()
+declare -A ALLOWED_TEST=()
+

@@ -0,0 +65,4 @@
+# Fail closed: if go list fails, we exit non-zero
+IMPORTS=$(go list -m -f '{{if not .Indirect}}{{.Path}}{{end}}' all 2>&1) || {
+    echo "❌ Failed to list dependencies: $IMPORTS"
+    exit 1

@@ -0,0 +96,4 @@
+    exit 1
+fi
+
+# Enforce Scope: test-only packages must not appear in non-test code

@@ -0,0 +105,4 @@
+    if echo "$PROD_IMPORTS" | grep -q "^${test_pkg}"; then
+        TEST_ONLY_IN_PROD="${TEST_ONLY_IN_PROD}  - ${test_pkg} (marked 'test only' but used in production code)"$'\n'
+    fi
+done

@@ -0,0 +98,4 @@
+
+# Enforce Scope: test-only packages must not appear in non-test code
+# Get imports used by non-test code only
+PROD_IMPORTS=$(go list -deps -f '{{if not .Standard}}{{.ImportPath}}{{end}}' ./... 2>/dev/null | grep -v '_test' || true)

@@ -0,0 +102,4 @@
+
+TEST_ONLY_IN_PROD=""
+for test_pkg in "${!ALLOWED_TEST[@]}"; do
+    if echo "$PROD_IMPORTS" | grep -q "^${test_pkg}"; then

@@ -0,0 +17,4 @@
+# Parse approved packages from CONVENTIONS.md table using awk (POSIX-compatible)
+# Format: | `package` | use case | scope |
+# Output: package:scope (e.g., "gopkg.in/yaml.v3:production")
+declare -A ALLOWED_PROD=()

@@ -0,0 +62,4 @@
+}
+
+# Get DIRECT dependencies only (exclude indirect/transitive)
+# Fail closed: if go list fails, we exit non-zero

@@ -0,0 +96,4 @@
+    exit 1
+fi
+
+# Enforce Scope: test-only packages must not appear in non-test code

@@ -0,0 +100,4 @@
+# Get imports used by non-test code only
+PROD_IMPORTS=$(go list -deps -f '{{if not .Standard}}{{.ImportPath}}{{end}}' ./... 2>/dev/null | grep -v '_test' || true)
+
+TEST_ONLY_IN_PROD=""

@@ -7,0 +11,4 @@
+|---------|----------|-------|
+| `gopkg.in/yaml.v3` | YAML parsing (persona files, config) | production |
+| `github.com/google/go-cmp` | Test comparisons (`cmp.Diff`) | test only |
+

@@ -0,0 +54,4 @@
+    local import="$1"
+    shift
+    local -n allowlist=$1
+    

@@ -0,0 +68,4 @@
+    return 1
+}
+
+# Get direct module dependencies from go.mod

@@ -0,0 +70,4 @@
+
+# Get direct module dependencies from go.mod
+DIRECT_IMPORTS=$(go list -m -f '{{if and (not .Indirect) (not .Main)}}{{.Path}}{{end}}' all 2>&1) || {
+    echo "❌ Failed to list dependencies: $DIRECT_IMPORTS"

@@ -0,0 +101,4 @@
+fi
+
+# Enforce Scope: test-only packages must not appear in non-test code
+# Get imports used by non-test code only (go list -deps without -test excludes test deps)

@@ -12,9 +12,15 @@ test-integration:
 lint:
 	go vet ./...
 
+check-deps:

@@ -0,0 +29,4 @@
+declare -A ALLOWED_TEST=()
+
+while IFS= read -r line; do
+    # Use awk to extract package and scope from table row

@@ -0,0 +32,4 @@
+    # Use awk to extract package and scope from table row
+    pkg=$(echo "$line" | awk -F'|' '{gsub(/^[[:space:]]*`|`[[:space:]]*$/, "", $2); print $2}')
+    scope=$(echo "$line" | awk -F'|' '{gsub(/^[[:space:]]+|[[:space:]]+$/, "", $4); print tolower($4)}')
+    

@@ -0,0 +106,4 @@
+
+TEST_ONLY_IN_PROD=""
+for test_pkg in "${!ALLOWED_TEST[@]}"; do
+    # Use word-boundary matching: exact match or followed by /