Extracting what survived.

Why it exists

Every modular codebase I've worked on decayed the same way: rules that lived in memos instead of tooling. Saraf's ongoing migration proved the cure — a legacy tree that still compiles next to 25 new feature modules while it's replaced one flow at a time. That machinery deserves to exist outside one trading app.

What ships

A dependency-rule lint as an SPM build plugin, composition-root and deep-link routing primitives so features never import features, and a module generator with test scaffolds and ownership entries built in.

Roadmap

• Now — public API freeze; docs written as compiled examples
• Q4 2026 — 1.0 with the template CLI
• 2027 — evaluate Swift macros to replace generated boilerplate

Why it exists

Most apps copy their pinning code from a blog post and their Keychain code from despair. Two years building a KYC SDK that has to clear five separate banks' security reviews taught me what a tiny, honest security surface looks like — including the failure policies nobody writes down. Those decisions shouldn't need to be relearned per company.

What ships

Payload-encryption helpers with a real key-rotation story, an obfuscation checklist distilled from five separate bank audits, and biometric-handling patterns written for the reviewer, not just the developer.

Roadmap

• Q4 2026 — API published for public design review before freezing
• H1 2027 — 1.0 after external review and fuzzing of validation paths
• Beyond — track hybrid post-quantum signatures as platform support lands

Why it exists

Networking layers fail by ambition: middleware pipelines, clever generics, magic retries. Every production app I've worked on ends up back at the same two or three concrete request paths and nothing cleverer than that. This package is that lesson, generalized.

What ships

Typed endpoints with compile-checked payloads, clients fakeable in one line, retry and backoff policies as plain values testable without a network, and first-class hooks for BlurSecurity’s pinning. No third-party dependencies — like everything here.

Roadmap

• H1 2027 — beta, integrated with BlurSecurity from the first commit
• H2 2027 — 1.0 once two real apps run on it in production

Why it exists

Every fast system I've built stayed fast for one reason: budgets enforced by CI, not by memory. The launch gates, widget memory assertions, and footprint helpers scattered across my projects keep getting rebuilt from scratch on the next one. Once is enough.

What ships

XCTest budget assertions for launch time and memory, phys_footprint helpers usable inside extensions, and MetricKit summaries reduced to the numbers a team will actually look at weekly.

Roadmap

• H2 2027 — beta, gating the other Blur packages’ own CI first
• 1.0 — when the suite enforces its own standards, the point of the whole exercise