{"row":{"id":"ADR-115","title":"nika-check size-cap member split: the analysis substrate descends to nika-check-analyzer","file":"adr-115-nika-check-analyzer-member-split.md","status":"accepted","date":"2026-08-18","cites":4,"supersedes":[],"superseded_by":[],"layers":["L0"],"tags":["architecture","crates","split","size-cap"],"room":true},"pin":{"release_tag":"v0.109.2","commit":"1da35b6859a8f54cd09cfed7ca0e35d1f40fe590"}}

[{"k":"h","depth":1,"text":"ADR-115: nika-check size-cap member split — nika-check-analyzer","id":"adr-115-nika-check-size-cap-member-split--nika-check-analyzer"},{"k":"h","depth":2,"text":"Context","id":"context"},{"k":"p","inline":[{"k":"text","text":"Vector 24 measured "},{"k":"code","text":"nika-check"},{"k":"text","text":" at "},{"k":"strong","text":"14,995 prod LOC against the 15,000\nDiamond invariant"},{"k":"text","text":" — five lines from a push that blocks. "},{"k":"code","text":"nika-runtime"},{"k":"text","text":"\nsat at 14,929 (seventy-one). Neither was visible: the hygiene dashboard\nrenders one line per vector, and that line said only "},{"k":"code","text":"crate(s) in [12000, 15000) LOC range"},{"k":"text","text":" — the same sentence at 12,001 as at 14,999. A\n3,000-wide band reported as a single bit (fixed separately · the vector\nnow names the tightest crate and its headroom)."}]},{"k":"p","inline":[{"k":"code","text":"nika-check"},{"k":"text","text":" is itself the product of this exact move: it descended from\n"},{"k":"code","text":"nika-schema"},{"k":"text","text":" at the same wall on 2026-07-21 (parser there, judgment\nhere). The cap is a locked maintainability budget (nika-invariants.md),\nnot advisory."}]},{"k":"h","depth":2,"text":"Decision","id":"decision"},{"k":"p","inline":[{"k":"text","text":"Per "},{"k":"strong","text":"D-2026-07-09-N1"},{"k":"text","text":" (a size-cap split is ONE architectural unit in\nTWO workspace members), the "},{"k":"strong","text":"analysis substrate"},{"k":"text","text":" descends to a new L0\nmember crate "},{"k":"code","text":"nika-check-analyzer"},{"k":"text","text":":"}]},{"k":"list","ordered":false,"items":[[{"k":"code","text":"analyze"},{"k":"text","text":" + "},{"k":"code","text":"AnalyzedWorkflow"},{"k":"text","text":" (the Core conformance pass — envelope ·\nduplicate ids · "},{"k":"code","text":"NIKA-DAG-002"},{"k":"text","text":" edge-target resolution · "},{"k":"code","text":"NIKA-DAG-001"},{"k":"text","text":"\ncycle detection over "},{"k":"code","text":"G_p"},{"k":"text","text":" · the "},{"k":"code","text":"tasks.*"},{"k":"text","text":" reference boundary ·\nnamespace resolution · "},{"k":"code","text":"when:"},{"k":"text","text":" shape · output binding rules · the full\n"},{"k":"code","text":"TypeExpr"},{"k":"text","text":" on io "},{"k":"code","text":"type:"},{"k":"text","text":")"}],[{"k":"code","text":"edges"},{"k":"text","text":" (the derived DAG edges every surface projects) + "},{"k":"code","text":"dag"},{"k":"text","text":"\n(topological waves)"}],[{"k":"code","text":"scan"},{"k":"text","text":" · "},{"k":"code","text":"builtin_shape"},{"k":"text","text":" · "},{"k":"code","text":"jq_lint"},{"k":"text","text":" (the jaq compile-check) ·\n"},{"k":"code","text":"schema_lint"},{"k":"text","text":" (the jsonschema meta-check) · "},{"k":"code","text":"schema_paths"},{"k":"text","text":" ·\n"},{"k":"code","text":"types_contract"}]]},{"k":"p","inline":[{"k":"code","text":"nika-check"},{"k":"text","text":" re-exports the member at its "},{"k":"strong","text":"historical path"},{"k":"text","text":" —\n"},{"k":"code","text":"pub use nika_check_analyzer as analyzer;"},{"k":"text","text":" — so every call site inside\nand outside the crate keeps writing "},{"k":"code","text":"nika_check::analyzer::…"},{"k":"text","text":" and\n"},{"k":"code","text":"crate::analyzer::…"},{"k":"text","text":" unchanged. The boundary moved; the surface did not."}]},{"k":"h","depth":3,"text":"Why this boundary, measured","id":"why-this-boundary-measured"},{"k":"p","inline":[{"k":"text","text":"The seam was not chosen by theme, it was measured on the module graph:"}]},{"k":"list","ordered":false,"items":[[{"k":"text","text":"direction · edges"}],[{"k":"text","text":"the rest of `nika-check` → `analyzer` · **33**"}],[{"k":"text","text":"`analyzer` → the rest of `nika-check` · **0**"}]]},{"k":"p","inline":[{"k":"code","text":"analyzer"},{"k":"text","text":" is the substrate everything reads and it reads nothing back —\na pure leaf downward, which is exactly what can descend without breaking\na cycle. The only back-references from inside the subtree to the ladder\n("},{"k":"code","text":"crate::analyze"},{"k":"text","text":") live in "},{"k":"code","text":"#[cfg(test)]"},{"k":"text","text":" blocks and became internal\n"},{"k":"code","text":"crate::"},{"k":"text","text":" paths on the move."}]},{"k":"h","depth":2,"text":"Alternatives rejected","id":"alternatives-rejected"},{"k":"list","ordered":false,"items":[[{"k":"strong","text":"`LOC-EXEMPT` markers"},{"k":"text","text":" · the whitelist (codegen · lookup-table ·\nenum-mega) does not cover organic judgment growth; exempting erodes\nthe ratchet."}],[{"k":"strong","text":"Descending the authority plane instead"},{"k":"text","text":" ("},{"k":"code","text":"permit_taint"},{"k":"text","text":" ·\n"},{"k":"code","text":"permits_fit"},{"k":"text","text":" · "},{"k":"code","text":"permits_infer"},{"k":"text","text":" · "},{"k":"code","text":"certificate"},{"k":"text","text":" · "},{"k":"code","text":"secrets"},{"k":"text","text":" ·\n"},{"k":"code","text":"consent"},{"k":"text","text":" · "},{"k":"code","text":"declass"},{"k":"text","text":" · "},{"k":"code","text":"data_journey"},{"k":"text","text":") · measured as a leaf on the\ninbound side (nothing but "},{"k":"code","text":"lib.rs"},{"k":"text","text":" references it) but it "},{"k":"em","text":"depends on"},{"k":"text","text":"\n"},{"k":"code","text":"analyzer"},{"k":"text","text":"/"},{"k":"code","text":"analysis"},{"k":"text","text":"/"},{"k":"code","text":"reach"},{"k":"text","text":"/"},{"k":"code","text":"hints"},{"k":"text","text":" — nine edges from three files.\nExtracting it while the ladder stays in "},{"k":"code","text":"nika-check"},{"k":"text","text":" makes\n"},{"k":"code","text":"nika-check"},{"k":"text","text":" → authority → "},{"k":"code","text":"nika-check"},{"k":"text","text":" a "},{"k":"strong","text":"cycle"},{"k":"text","text":". Cargo forbids it.\nDescending the substrate first is precisely what removes that cycle."}],[{"k":"strong","text":"A logic split inside one crate"},{"k":"text","text":" · moves no prod LOC out of the\ncrate; churns module bodies for no budget gain."}]]},{"k":"h","depth":2,"text":"Consequences","id":"consequences"},{"k":"list","ordered":false,"items":[[{"k":"code","text":"nika-check"},{"k":"text","text":" "},{"k":"strong","text":"14,995 → 12,455 prod LOC"},{"k":"text","text":" · headroom "},{"k":"strong","text":"5 → 2,545"},{"k":"text","text":".\nThe crate is off the wall."}],[{"k":"code","text":"nika-check-analyzer"},{"k":"text","text":" ≈ 2,540 prod (5,688 raw across 9 files — the\ndifference is "},{"k":"code","text":"#[cfg(test)]"},{"k":"text","text":" mass the counter correctly subtracts)."}],[{"k":"strong","text":"Still YELLOW"},{"k":"text","text":" (>12,000): this buys a planning window, it does not\nend the descent. The next unit to leave is the authority plane, and\nADR-115 is what makes it extractable — with the substrate in its own\nmember, "},{"k":"code","text":"nika-check-authority"},{"k":"text","text":" would depend on "},{"k":"code","text":"nika-check-analyzer"},{"k":"text","text":",\nnot on its own parent."}],[{"k":"text","text":"New "},{"k":"code","text":"crates/nika-check-analyzer/public-api.txt"},{"k":"text","text":" baseline joins the\ndiff gate; "},{"k":"code","text":"crates/nika-check/public-api.txt"},{"k":"text","text":" re-baselines (the\n"},{"k":"code","text":"analyzer"},{"k":"text","text":" items become re-exports)."}],[{"k":"code","text":"nika-check-analyzer"},{"k":"text","text":" is a member of the "},{"k":"code","text":"nika-check"},{"k":"text","text":" unit, not a new\narchitectural unit: same L0 row, "},{"k":"code","text":"publish = false"},{"k":"text","text":", one public surface\nre-exported by the judgment crate. The ADR-037 count horizon is\nunaffected (a size-cap split adds a member, never a unit)."}]]},{"k":"h","depth":2,"text":"Security boundary","id":"security-boundary"},{"k":"p","inline":[{"k":"strong","text":"None moved."},{"k":"text","text":" The authority model stays whole in "},{"k":"code","text":"nika-check"},{"k":"text","text":" —\npermits fit, capability escape, secret-leak IFC, consent, declassify,\nthe trifecta and the "},{"k":"code","text":"RunCertificate"},{"k":"text","text":" are untouched, and the substrate\ncarries no verdict of policy. The one authority-adjacent item that\ntravels is "},{"k":"code","text":"jq_lint"},{"k":"text","text":"'s read of "},{"k":"code","text":"nika_cap::is_withheld_jq_native"},{"k":"text","text":" — the\nwithheld-native list ("},{"k":"code","text":"env"},{"k":"text","text":", refused since 2026-08-15) — which is a\n"},{"k":"em","text":"compile-check"},{"k":"text","text":" over the jq program, not a permits decision."}]},{"k":"h","depth":2,"text":"Rollback","id":"rollback"},{"k":"p","inline":[{"k":"text","text":"Reverse "},{"k":"code","text":"git mv"},{"k":"text","text":" + drop the member from workspace "},{"k":"code","text":"members"},{"k":"text","text":", the\n"},{"k":"code","text":"layers."},{"k":"text","text":" entry and the "},{"k":"code","text":"nika-check"},{"k":"text","text":" dep. The re-export shim keeps the\nsurface stable in both directions, so no call site changes either way."}]}]

ADR-115

nika-check size-cap member split: the analysis substrate descends to nika-check-analyzer

accepted · 2026-08-18 · L0 · cites 4

ADR-115: nika-check size-cap member split — nika-check-analyzer #

Context #

Vector 24 measured nika-check at 14,995 prod LOC against the 15,000 Diamond invariant — five lines from a push that blocks. nika-runtime sat at 14,929 (seventy-one). Neither was visible: the hygiene dashboard renders one line per vector, and that line said only crate(s) in [12000, 15000) LOC range — the same sentence at 12,001 as at 14,999. A 3,000-wide band reported as a single bit (fixed separately · the vector now names the tightest crate and its headroom).

nika-check is itself the product of this exact move: it descended from nika-schema at the same wall on 2026-07-21 (parser there, judgment here). The cap is a locked maintainability budget (nika-invariants.md), not advisory.

Decision #

Per D-2026-07-09-N1 (a size-cap split is ONE architectural unit in TWO workspace members), the analysis substrate descends to a new L0 member crate nika-check-analyzer:

analyze + AnalyzedWorkflow (the Core conformance pass — envelope · duplicate ids · NIKA-DAG-002 edge-target resolution · NIKA-DAG-001 cycle detection over G_p · the tasks.* reference boundary · namespace resolution · when: shape · output binding rules · the full TypeExpr on io type:)
edges (the derived DAG edges every surface projects) + dag (topological waves)
scan · builtin_shape · jq_lint (the jaq compile-check) · schema_lint (the jsonschema meta-check) · schema_paths · types_contract

nika-check re-exports the member at its historical path — pub use nika_check_analyzer as analyzer; — so every call site inside and outside the crate keeps writing nika_check::analyzer::… and crate::analyzer::… unchanged. The boundary moved; the surface did not.

Why this boundary, measured #

The seam was not chosen by theme, it was measured on the module graph:

direction · edges
the rest of `nika-check` → `analyzer` · **33**
`analyzer` → the rest of `nika-check` · **0**

analyzer is the substrate everything reads and it reads nothing back — a pure leaf downward, which is exactly what can descend without breaking a cycle. The only back-references from inside the subtree to the ladder (crate::analyze) live in #[cfg(test)] blocks and became internal crate:: paths on the move.

Alternatives rejected #

`LOC-EXEMPT` markers · the whitelist (codegen · lookup-table · enum-mega) does not cover organic judgment growth; exempting erodes the ratchet.
Descending the authority plane instead (permit_taint · permits_fit · permits_infer · certificate · secrets · consent · declass · data_journey) · measured as a leaf on the inbound side (nothing but lib.rs references it) but it depends on analyzer/analysis/reach/hints — nine edges from three files. Extracting it while the ladder stays in nika-check makes nika-check → authority → nika-check a cycle. Cargo forbids it. Descending the substrate first is precisely what removes that cycle.
A logic split inside one crate · moves no prod LOC out of the crate; churns module bodies for no budget gain.

Consequences #

nika-check 14,995 → 12,455 prod LOC · headroom 5 → 2,545. The crate is off the wall.
nika-check-analyzer ≈ 2,540 prod (5,688 raw across 9 files — the difference is #[cfg(test)] mass the counter correctly subtracts).
Still YELLOW (>12,000): this buys a planning window, it does not end the descent. The next unit to leave is the authority plane, and ADR-115 is what makes it extractable — with the substrate in its own member, nika-check-authority would depend on nika-check-analyzer, not on its own parent.
New crates/nika-check-analyzer/public-api.txt baseline joins the diff gate; crates/nika-check/public-api.txt re-baselines (the analyzer items become re-exports).
nika-check-analyzer is a member of the nika-check unit, not a new architectural unit: same L0 row, publish = false, one public surface re-exported by the judgment crate. The ADR-037 count horizon is unaffected (a size-cap split adds a member, never a unit).

Security boundary #

None moved. The authority model stays whole in nika-check — permits fit, capability escape, secret-leak IFC, consent, declassify, the trifecta and the RunCertificate are untouched, and the substrate carries no verdict of policy. The one authority-adjacent item that travels is jq_lint's read of nika_cap::is_withheld_jq_native — the withheld-native list (env, refused since 2026-08-15) — which is a compile-check over the jq program, not a permits decision.

Rollback #

Reverse git mv + drop the member from workspace members, the layers. entry and the nika-check dep. The re-export shim keeps the surface stable in both directions, so no call site changes either way.

read at v0.109.2 · the decision record ships with the engine

Every decision, with its status This one in the repo