# raw-allocserializer-usage

## AUDIT (2026-02-01)

Pattern: Raw `AllocSerializer` usage outside canonical `stemedb_core::serde` module

### Search Results

| Location | Lines | Context | Violation? |
|----------|-------|---------|------------|
| `stemedb-core/src/lib.rs` | 26, 58, 105, 140, 170, 211, 239 | `#[cfg(test)]` module | NO |
| `stemedb-core/src/serde.rs` | 5, 39, 65, 100, 102 | Canonical implementation | NO |
| `stemedb-query/src/engine.rs` | 247, 269 | `#[cfg(test)]` module | NO |
| `stemedb-storage/src/serde_helpers.rs` | 30 | Type bound, delegates to core | NO |

### Conclusion

**Found: 0 production code violations**

All `AllocSerializer` usages are either:
1. Inside the canonical `stemedb_core::serde` module (correct)
2. Inside `#[cfg(test)]` blocks (allowed)
3. Type bounds that delegate to the canonical module (correct)

## RESOLUTION (2026-02-01)

Status: **No Action Required**

The codebase is already compliant.

## ENFORCEMENT (Already Exists)

CLAUDE.md line 39:
> **Zero-Copy:** Use `rkyv` for serialization. ALWAYS use `stemedb_core::serde::{serialize, deserialize}` — NEVER use raw `AllocSerializer` in production code.

No additional enforcement needed.