[EPAC-1770]: tighten backend APNs boundary check

[riddim-developer-bot]

Why

The backend boundary check only blocked the third-party github.com/sideshow/apns2 client. In this repo, APNs delivery currently lives in the repo-local epac/topic-notifier module, so a future backend/*/application/ package could still depend on that local adapter and incorrectly pass the boundary script.

What changed

• Expanded the APNs boundary check to fail on repo-local epac/topic-notifier imports in addition to github.com/sideshow/apns2.
• Kept the check grep-based so it matches the rest of scripts/check-boundaries.sh and remains easy to extend when EPAC-1743 introduces more backend application packages.
• Documented the repo-local adapter rationale inline beside the check so the next refactor preserves the intended boundary.

Trade-offs not taken

• I did not add a heavier parser-based Go import inspection step; the existing script already uses grep-based guards and this change stays consistent with that contract.
• I did not broaden the pattern to every possible apns substring, which would risk false positives unrelated to the actual adapter/module shape we need to block here.

Test plan

• scripts/check-boundaries.sh
• bash -n scripts/check-boundaries.sh
• Temp-repo verification: copied scripts/check-boundaries.sh into synthetic repos and confirmed:
  • clean backend/demo/application/usecase.go => exit 0
  • import "epac/topic-notifier/apns" => exit 1
  • import "github.com/sideshow/apns2" => exit 1
• cd ios && make build failed because xcbeautify is not installed in this environment.
• Fallback per repo instructions: cd ios && xcodebuild -project epac.xcodeproj -scheme epac -destination 'platform=iOS Simulator,name=iPhone 17 Pro' build => ** BUILD SUCCEEDED **

Screenshots (if UI)

N/A — script-only change.

Resolves EPAC-1770

Reviewer-Boundary: review-only
Estimate-Note: Linear estimate was missing in the handoff, so this run treated the issue as the standard complexity tier.

[riddim-reviewer-bot]

⚠️ Autonomous review liveness watchdog

Symphony expected a reviewer-bot review for the current autonomous PR head within the configured SLA window, but none was found.

• PR: [EPAC-1770]: tighten backend APNs boundary check #402
• Repo: RiddimSoftware/epac
• Head SHA: 74b3468dd1c478dc835e7ad0be68cba37df298b3
• Suspected missing reviewer owner: RiddimSoftware/epac
• Review SLA window: 300000 ms
• PR last activity: 2026-05-10T01:52:47Z
• Last heartbeat: missing

[riddim-reviewer-bot]

ReviewAutonomousPR

• Verdict: approve
• Reviewer boundary: review_only
• Acceptance criteria coverage: covered=0, missing=0, unclear=0

Summary

Correct and minimal fix. The brace-group pattern { grep1; grep2; } 2>/dev/null || true is valid bash — the || true handles the case where the last grep finds no matches, stderr from both greps is suppressed, and stdout from either grep is captured. The pattern "epac/topic-notifier matches the module's exact go.mod name (epac/topic-notifier) and catches all sub-packages. Both required import shapes are now blocked from backend/*/application/ packages.

Actionable findings

• None.

Acceptance criteria coverage

• Not explicitly assessed.