Hexagonal layering

Reference shape, taken from auth and repeated in social, feed, expense, media, messaging, and notification:

Layer	Package	Allowed to do
API	api.controller, api.request, api.response	HTTP, Bean Validation, map to a use-case command
Application	application.usecase, application.port	Transactions, orchestration, call ports
Domain	domain	Rules and types. No Spring, no JDBC, no HTTP
Infrastructure	infrastructure	JPA, Redis, HTTP adapters that implement ports

Controllers do not call repositories. A use case that needs another service depends on a port interface; the adapter lives in infrastructure.

Communication-service skips a domain package because it is a delivery adapter with little invariant logic. Do not copy that shortcut into a context that owns money or identity rules.

GlobalExceptionHandler in shared-web maps domain errors to the shared error body, including traceId.