---
id: review-001-dependency-hygiene
name: Dependency and feature hygiene (HY-01, HY-05, HY-08, HY-12, CON-10)
status: pending
depends_on: []
scope: narrow
risk: trivial
impact: project
level: implementation
tags: [infra, review-001, cargo]
---

## Description

Review 001 hygiene findings that are pure Cargo.toml / dependency work —
mechanical, parallelizable, worth landing any time:

- **HY-01 [major]**: `openapiv3` is a production dependency used only
  inside `#[cfg(test)]` (`to_openapi.rs:1103`). Move to
  `[dev-dependencies]`.
- **HY-05**: `bytes` declared, zero direct use in src/ (only axum's
  re-export); `parking_lot` declared, zero direct use; `tokio` features =
  `["full"]` drags in `process`/`signal` extras. Prune to what's used.
- **HY-08**: `tokio-tungstenite` declared three times with different
  feature sets (`wss`, `test-support`, dev-deps); make `test-support`
  extend `wss` (also resolves CON-10's class of fragility) — note
  `required-features` fix itself is tracked in
  review-001-consumer-adapter-hygiene (CON-10).
- **HY-12**: duplicate dependency roots (`getrandom 0.3/0.4`,
  `cpufeatures 0.2/0.3`) driven by `tokio-tungstenite 0.28` here vs
  `tungstenite 0.29` via axum's ws — align versions to collapse.
- Related slack: HY-07 (`READ_SLOTS` pub constant leak in a public
  module — privatize or document) can ride along.

Deliberately deferred to a later pass: HY-02 (the 110-warning
`missing_docs` sweep — better done once the remediation stabilizes the
API), HY-04 (test-support `unwrap`, documented as intentional), HY-06
(`ExponentialBackoff` in public API — revisit when the client config
settles), HY-10 (stale docs — several overlap fixes landing in other
tasks), HY-11 (`docs/` in the package — needs a publishing decision).

## Acceptance Criteria

- [ ] `openapiv3` in dev-dependencies only
- [ ] `cargo tree -d` duplicate roots reduced (getrandom/cpufeatures collapse)
- [ ] Unused deps pruned; tokio features tightened (build passes in default, `mcp`-only, `wss`, `--all-features`, `--no-default-features`)
- [ ] HY-07 resolved (privatized or documented)
- [ ] Full feature matrix still green: default, `--all-features`, `mcp`-only, `wss`-only, `--no-default-features`

## References

- docs/reviews/001-initial-implementation-review.md (Part H, HY-01, HY-05, HY-07, HY-08, HY-12)

## Notes

> Agent fills during implementation. Safe to land any time; keep it
> separate from behavioral tasks so reverts are clean.

## Summary

> Filled on completion.