[abrichr]

Summary

Closes #1876.

Adds packages/flow/import_layers.json and tests/test_import_layers.py so core flow modules cannot import forbidden demo / mockmed paths, including transitively.

Main already switched qualification_oracle_gate to _UnchangedStore, so the old mockmed.fault_server exception is not needed. This PR lands the contract with exceptions: [] and registers import_layers.json in public-artifacts.json.

Note for #1874: that PR still carries the old exception and the MockMed gate path. After rebase onto main it should drop the exception and avoid reintroducing fault_server.

Testing done

• pytest packages/flow/tests/test_import_layers.py -n 4 → 7 passed
• Confirmed qualification_oracle_gate.py has no fault_server import on this branch
• ruff check on the new test file → clean

Untested

• Full flow suite
• CI matrix beyond local targeted run
• Whether test(flow): enforce import layers for the core runtime and verifier #1874 still green after dropping its exception (left for that PR's author)

[abrichr]

Independent adversarial review: BLOCK

Reviewed head 3d74bb440039562d428dae1acd3c7bbdd18b6a59 and literal parent e3765a4e55925f879019408c39dd5fa8a82ec1d0 in clean detached worktrees, with the frozen tests on Linux/Python 3.12.16.

P2 — executed literal imports escape the new boundary check. The contract and packages/flow/tests/test_import_layers.py:6 say lazy imports and requested package reexports count. However, build_graph at :99 handles only Import/ImportFrom; _lazy_exports at :52 also handles only ImportFrom, while :93 skips the rest of __getattr__. Four fixed core paths using literal importlib.import_module, its imported alias, literal __import__, and a lazy export map each executed the forbidden synthetic module: its independently observed import counter changed from 0 to 1 and its loaded file matched the planted module. Both violation lists nevertheless remained empty. Recognize these literal edges and lazy-map reexports before treating a green check as enforcement of the stated boundary. Ordinary direct/lazy imports and clean unused-export controls behaved correctly. These are four reproductions of one checker coverage gap.

The native author file passed 7/7. The independent head matrix had 9 passed / 4 failed, with 0 errors and 0 skips. The parent lacks both new files; its one passing control explicitly overlays the exact head checker and contract onto parent source for AST analysis. It is not a native parent guard or runtime regression result. Both actual source graphs were clean with empty exceptions, and all 616 runtime files were byte-identical between refs. I did not establish a current forbidden production import.

Head Ruff, format and generality passed, as did release consistency on both refs; source/input hashes and loaded native-author origins matched. The registered scoped mypy command failed on two assignments at test_import_layers.py:95 and :173. The local source-boundary command exited 2 because the copied tree lacks .git; that check did not pass locally. Hosted lint/source-boundary and the seven author tests passed on CI merge 8b102e2b4695bcf16fc14472363422901c7a8e01, separately from this exact-head run. No full-suite/build/main run was repeated. The independent checker probes used a ROOT-only package stub and executed only fresh synthetic modules; they imported no arbitrary product code. No reviewed source was changed or pushed.

[abrichr]

Parked (coordinator, 2026-11-09) until #1924 lands. #1924 now carries the import-layer checker together with its debt baseline, so this PR will rebase onto it, or be closed if it's superseded.