28. Repository Layout and Dependency Governance

apps/glitchpad/          Shared TypeScript, React, renderers, workers, and UI tests
crates/glitchpad-core/   Platform-independent document, detection, metadata, and persistence rules
crates/glitchpad-host/   Tauri host, scoped capabilities, desktop adapters, generated Android host
crates/xtask/            Cross-platform doctor, bootstrap, check, test, docs, package, and release gates
docs/                    Technical specification, ADRs, brand, contributor, security, and operations docs
fixtures/                Licensed document corpus, hostile cases, expected outputs, and provenance
specs/                   Spec Kit feature specifications, plans, contracts, tasks, and analysis
scripts/                 Narrow helpers invoked and validated by xtask

Dependency direction is renderer → shared renderer contracts, shell → session and renderer contracts, host → core, adapters → host ports. Core code never imports application UI or Tauri. Renderer code never imports host adapters.

Cargo.lock, pnpm-lock.yaml, and Gradle dependency locks are committed. Rust default features are disabled for parser and codec crates unless every default is reviewed. JavaScript production dependencies are separated from development dependencies. Generated files identify their source and have drift checks.

The automatic license allowlist is Apache-2.0, MIT, BSD-2-Clause, BSD-3-Clause, ISC, Zlib, Unicode-3.0, CC0-1.0, and 0BSD. MPL-2.0, LGPL, fonts, media, standards fixtures, and licenses outside the allowlist require a dated Spec Kit decision and documented obligations. GPL, AGPL, SSPL, Commons Clause, Business Source License, non-commercial, no-derivatives, source-available, custom ambiguous, and unlicensed inputs are prohibited in distributed artifacts.

Every dependency requires package-registry provenance, upstream repository, license evidence, maintenance review, advisory review, bundle impact, platform support, test seam, and removal fallback. Abandoned parsers and renderers are replaced or disabled before their unsupported state becomes a security exposure.