R16.5: Production bundle minimization

Short answer: DevDependencies not imported in production runtime code. A dev dependency imported in production code is missing in the production image.

Group: Supply chain. Status: stable. Generated from the rule definitions; do not edit by hand.

Playground: https://brevio.pro/tools/agent-guard-playground?rule=R16.5

What it catches

Production bundle minimization: devDependencies not imported in production runtime code.

Why

A dev dependency imported in production code is missing in the production image.

A bad example

import { faker } from '@faker-js/faker';  // in src/

A good example

import { randomUUID } from 'node:crypto';

How it is checked

Nothing yet. No scanner and no slice card checks it: it is a standing rule for authors and reviewers.

How to silence it

A person can silence one finding with brevio-core: ignore R16.5 -- reason on the line or the line above. Without the reason it does not count. An agent cannot silence it: the agent hook and the MCP tools never honour the comment, and a pull request that adds one is reported until a reviewer allows it. Fixing the code is still the better answer.

To change what the rule flags, edit its definition in dev_rules.py or code_rules/__init__.py. That is a code change and is reviewed like one.

R16.6 License compliance
R16.7 Single package manager
R16.8 Deterministic engine constraints
R16.1 Lockfile integrity enforcement
Every rule