Exclude forge contracts from runtime dependencies

docs/roadmap/remediation.md

@@ -81,7 +81,12 @@ it adds no token-format restriction, remote permission requirement, or probe.
 
 ## 2. Protect the runtime boundary from the new forge contract — P2
 
-Status: open.
+Status: complete.
+
+**Completed:** Added `forge` to the runtime dependency exclusions and covered
+both direct and transitive forbidden dependencies with focused graph fixtures.
+The complete checker test package and the actual compiled API/dependency check
+passed; the current runtime dependency graph remains accepted.
 
 **Evidence:** [dependency checker](../../internal/apicheck/main.go), especially
 `forbiddenRuntimeDependency`, and the runtime boundary in

internal/apicheck/main.go

@@ -281,7 +281,7 @@ func commandInternalRoot(path string) string {
 func forbiddenRuntimeDependency(path string) bool {
 	for _, part := range strings.Split(strings.ToLower(path), "/") {
 		switch part {
-		case "orchestration", "orchestrator", "engine", "release", "process", "build", "builder", "gitea", "delivery", "cli":
+		case "orchestration", "orchestrator", "engine", "release", "process", "build", "builder", "gitea", "forge", "delivery", "cli":
 			return true
 		}
 	}

internal/apicheck/main_test.go

@@ -10,6 +10,26 @@ import (
 	"testing"
 )
 
+func TestRuntimeFacadeCannotDependOnForge(t *testing.T) {
+	for _, indirect := range []bool{false, true} {
+		name := "direct"
+		dependency := modulePath + "/internal/forge"
+		packages := []listedPackage{{ImportPath: dependency}}
+		if indirect {
+			name = "transitive"
+			packages = append(packages, listedPackage{ImportPath: modulePath + "/internal/runtime", Imports: []string{dependency}})
+			dependency = modulePath + "/internal/runtime"
+		}
+		packages = append(packages, listedPackage{ImportPath: modulePath + "/buildinfo", Imports: []string{dependency}})
+		t.Run(name, func(t *testing.T) {
+			err := checkImportDirections(packages)
+			if err == nil || !strings.Contains(err.Error(), "buildinfo") || !strings.Contains(err.Error(), "/internal/forge") {
+				t.Fatalf("dependency check = %v, want excluded forge runtime dependency", err)
+			}
+		})
+	}
+}
+
 func TestExportedContractBoundaries(t *testing.T) {
 	tests := []struct {
 		name      string