alkhttp/tasks/infra/review-001-dependency-hygiene.md at 12b35e2c5f8bb16217d937296ca6df9135318843

Files

T

glm-5.3-flash 12b35e2c5f docs(tasks): decompose review 001 remediation Units 1-5 into taskgraph tasks

21 review-001 tasks across server/adapters/client/gateway/websocket/infra,
chunked from the 7-unit remediation plan in
docs/reviews/001-initial-implementation-review.md.

- Scope split by mechanism, not one-per-finding: 15 tasks in generation 1
  (parallelizable), 6 sequenced after their file-sharing precursors
- Deliberately deferred until dependent fixes land: projection/doc
  fidelity partial (Unit 6 beyond dependency hygiene), coverage backfills
  (COV-01..07 via in-task acceptance for forward.rs), and per-finding
  minors (OAI-06/07, HY-02/04/06/10/11, CON-08)
- Cross-crate WS-12 (alkcall demux 4 GiB discard alloc) noted for filing
  in alkcall, not here

taskgraph: validate clean, no cycles, 6 generations

2026-08-29 07:10:15 +00:00

2.5 KiB

Raw Blame History

id, name, status, depends_on, scope, risk, impact, level, tags

name

status

depends_on

scope

risk

impact

level

Description

Review 001 hygiene findings that are pure Cargo.toml / dependency work — mechanical, parallelizable, worth landing any time:

HY-01 [major]: openapiv3 is a production dependency used only inside #[cfg(test)] (to_openapi.rs:1103). Move to [dev-dependencies].
HY-05: bytes declared, zero direct use in src/ (only axum's re-export); parking_lot declared, zero direct use; tokio features = ["full"] drags in process/signal extras. Prune to what's used.
HY-08: tokio-tungstenite declared three times with different feature sets (wss, test-support, dev-deps); make test-support extend wss (also resolves CON-10's class of fragility) — note required-features fix itself is tracked in review-001-consumer-adapter-hygiene (CON-10).
HY-12: duplicate dependency roots (getrandom 0.3/0.4, cpufeatures 0.2/0.3) driven by tokio-tungstenite 0.28 here vs tungstenite 0.29 via axum's ws — align versions to collapse.
Related slack: HY-07 (READ_SLOTS pub constant leak in a public module — privatize or document) can ride along.

Deliberately deferred to a later pass: HY-02 (the 110-warning missing_docs sweep — better done once the remediation stabilizes the API), HY-04 (test-support unwrap, documented as intentional), HY-06 (ExponentialBackoff in public API — revisit when the client config settles), HY-10 (stale docs — several overlap fixes landing in other tasks), HY-11 (docs/ in the package — needs a publishing decision).

Acceptance Criteria

openapiv3 in dev-dependencies only
cargo tree -d duplicate roots reduced (getrandom/cpufeatures collapse)
Unused deps pruned; tokio features tightened (build passes in default, mcp-only, wss, --all-features, --no-default-features)
HY-07 resolved (privatized or documented)
Full feature matrix still green: default, --all-features, mcp-only, wss-only, --no-default-features

References

docs/reviews/001-initial-implementation-review.md (Part H, HY-01, HY-05, HY-07, HY-08, HY-12)

Notes

Agent fills during implementation. Safe to land any time; keep it separate from behavioral tasks so reverts are clean.

Summary

Filled on completion.

2.5 KiB Raw Blame History