alkhttp/tasks/infra/review-001-dependency-hygiene.md

id, name, status, depends_on, scope, risk, impact, level, tags

id	name	status	depends_on	scope	risk	impact	level	tags
review-001-dependency-hygiene	Dependency and feature hygiene (HY-01, HY-05, HY-08, HY-12, CON-10)	completed		narrow	trivial	project	implementation	infra review-001 cargo

Description

Review 001 hygiene findings that are pure Cargo.toml / dependency work — mechanical, parallelizable, worth landing any time:

• HY-01 [major]: openapiv3 is a production dependency used only inside #[cfg(test)] (to_openapi.rs:1103). Move to [dev-dependencies].
• HY-05: bytes declared, zero direct use in src/ (only axum's re-export); parking_lot declared, zero direct use; tokio features = ["full"] drags in process/signal extras. Prune to what's used.
• HY-08: tokio-tungstenite declared three times with different feature sets (wss, test-support, dev-deps); make test-support extend wss (also resolves CON-10's class of fragility) — note required-features fix itself is tracked in review-001-consumer-adapter-hygiene (CON-10).
• HY-12: duplicate dependency roots (getrandom 0.3/0.4, cpufeatures 0.2/0.3) driven by tokio-tungstenite 0.28 here vs tungstenite 0.29 via axum's ws — align versions to collapse.
• Related slack: HY-07 (READ_SLOTS pub constant leak in a public module — privatize or document) can ride along.

Deliberately deferred to a later pass: HY-02 (the 110-warning missing_docs sweep — better done once the remediation stabilizes the API), HY-04 (test-support unwrap, documented as intentional), HY-06 (ExponentialBackoff in public API — revisit when the client config settles), HY-10 (stale docs — several overlap fixes landing in other tasks), HY-11 (docs/ in the package — needs a publishing decision).

Acceptance Criteria

• openapiv3 in dev-dependencies only
• cargo tree -d duplicate roots reduced (getrandom/cpufeatures collapse)
• Unused deps pruned; tokio features tightened (build passes in default, mcp-only, wss, --all-features, --no-default-features)
• HY-07 resolved (privatized or documented)
• Full feature matrix still green: default, --all-features, mcp-only, wss-only, --no-default-features

References

• docs/reviews/001-initial-implementation-review.md (Part H, HY-01, HY-05, HY-07, HY-08, HY-12)

Notes

HY-05 nuance: bytes turned out to be load-bearing in src/ — five bytes::Bytes sites (byte_adapter.rs, server/adapter.rs, adapters/forward.rs) had been relying on the declared dependency (axum's re-export satisfies the same items, so the mechanical fix was to rename to axum::body::Bytes, which axum re-exports from bytes — no behavior change). parking_lot is genuinely used (server/adapter.rs, websocket/upgrade.rs Mutex) — kept.

HY-12: aligning tokio-tungstenite to 0.29 (matching axum's tungstenite 0.29) collapsed tungstenite 0.28/0.29, cpufeatures 0.2/0.3, and rand 0.9/0.10 duplicate roots. cargo tree -d root count went from 9 to 6 (getrandom 0.3/0.4 and hashbrown 0.16/0.17 remain — both are required by unrelated crates: getrandom 0.4 via alkcall/uuid/retry-policies, 0.3 via jsonschema/ahash; hashbrown 0.17 via indexmap/h2, 0.16 via referencing). syn 2/3 also remains (thiserror 2 vs rmcp 1.8). cargo update was run; retry-policies pinned to 0.5.1 (--precise) because its 0.5.2 bump pulled rand 0.10 back in (via getrandom-only rand_core 0.10).

HY-08: test-support feature now extends wss (declared via ["wss"] equivalent — both activate the same optional tokio-tungstenite dep); the wss-feature feature set already matched the dev-deps set (connect + handshake-capable, default-features off), so the dev-dependency declaration was aligned to that exact set.

CON-10 residue: already fixed before this task landed — [[test]] full_surface has required-features = ["mcp", "test-support"]; verified by cargo test --features mcp passing.

HY-07: READ_SLOTS privatized (pub const → const) in src/websocket/byte_adapter.rs; it is internal plumbing (inbound backpressure slot count), not part of the public API. No external references existed (verified by grep over src/, tests/, docs/).

Summary

Completed as specified. Changes:

• HY-01: openapiv3 moved from [dependencies] to [dev-dependencies] (both use sites are test-only: to_openapi.rs unit test, tests/full_surface.rs).
• HY-05: bytes removed after renaming the five bytes::Bytes sites to axum::body::Bytes (axum's re-export of the same type; no behavior change). parking_lot kept — genuinely used. tokio features = ["full"] tightened to ["macros", "rt-multi-thread", "io-util", "net", "fs", "time", "sync"], derived from actual usage (tokio::test → macros+rt, io/ duplex/split → io-util, TcpListener/TcpStream → net, tokio::fs → fs, time/sleep/timeout/interval → time, mpsc/oneshot/watch/Semaphore → sync; select!/pin!/join! are core, process/signal were pure slack from full).
• HY-08: test-support extends wss; dev-deps tokio-tungstenite pinned to the same feature set as the wss feature.
• HY-12: tokio-tungstenite/tungstenite 0.28 → 0.29 aligned with the version axum 0.8's ws feature uses. Duplicate roots: 9 → 6 (tungstenite 0.28/0.29, tokio-tungstenite 0.28/0.29, cpufeatures 0.2/0.3, rand 0.9/0.10 collapsed; remaining: getrandom 0.3/0.4, hashbrown 0.16/0.17, syn 2/3 — all required by distinct unrelated crates, not alignable from this crate).
• HY-07: READ_SLOTS privatized.
• CON-10: verified already fixed (required-features = ["mcp", "test-support"] on full_surface).

Verification matrix (all green):

• cargo test — 300 passed
• cargo test --all-features — 371 + 9 + 6 + 8 + 13 passed
• cargo test --features mcp — 355 + 9 passed
• cargo test --features wss — 316 passed
• cargo check --no-default-features — compiles
• cargo clippy --all-targets -- -D warnings — clean
• cargo clippy --all-features --all-targets -- -D warnings — clean
• cargo fmt --check — clean
• cargo tree -d — duplicate roots 9 → 6