alkhttp/tasks/infra/review-001-dependency-hygiene.md

---
id: review-001-dependency-hygiene
name: Dependency and feature hygiene (HY-01, HY-05, HY-08, HY-12, CON-10)
status: completed
depends_on: []
scope: narrow
risk: trivial
impact: project
level: implementation
tags: [infra, review-001, cargo]
---

## Description

Review 001 hygiene findings that are pure Cargo.toml / dependency work —
mechanical, parallelizable, worth landing any time:

- **HY-01 [major]**: `openapiv3` is a production dependency used only
  inside `#[cfg(test)]` (`to_openapi.rs:1103`). Move to
  `[dev-dependencies]`.
- **HY-05**: `bytes` declared, zero direct use in src/ (only axum's
  re-export); `parking_lot` declared, zero direct use; `tokio` features =
  `["full"]` drags in `process`/`signal` extras. Prune to what's used.
- **HY-08**: `tokio-tungstenite` declared three times with different
  feature sets (`wss`, `test-support`, dev-deps); make `test-support`
  extend `wss` (also resolves CON-10's class of fragility) — note
  `required-features` fix itself is tracked in
  review-001-consumer-adapter-hygiene (CON-10).
- **HY-12**: duplicate dependency roots (`getrandom 0.3/0.4`,
  `cpufeatures 0.2/0.3`) driven by `tokio-tungstenite 0.28` here vs
  `tungstenite 0.29` via axum's ws — align versions to collapse.
- Related slack: HY-07 (`READ_SLOTS` pub constant leak in a public
  module — privatize or document) can ride along.

Deliberately deferred to a later pass: HY-02 (the 110-warning
`missing_docs` sweep — better done once the remediation stabilizes the
API), HY-04 (test-support `unwrap`, documented as intentional), HY-06
(`ExponentialBackoff` in public API — revisit when the client config
settles), HY-10 (stale docs — several overlap fixes landing in other
tasks), HY-11 (`docs/` in the package — needs a publishing decision).

## Acceptance Criteria

- [x] `openapiv3` in dev-dependencies only
- [x] `cargo tree -d` duplicate roots reduced (getrandom/cpufeatures collapse)
- [x] Unused deps pruned; tokio features tightened (build passes in default, `mcp`-only, `wss`, `--all-features`, `--no-default-features`)
- [x] HY-07 resolved (privatized or documented)
- [x] Full feature matrix still green: default, `--all-features`, `mcp`-only, `wss`-only, `--no-default-features`

## References

- docs/reviews/001-initial-implementation-review.md (Part H, HY-01, HY-05, HY-07, HY-08, HY-12)

## Notes

> HY-05 nuance: `bytes` turned out to be load-bearing in src/ — five
> `bytes::Bytes` sites (byte_adapter.rs, server/adapter.rs,
> adapters/forward.rs) had been relying on the declared dependency
> (axum's re-export satisfies the same items, so the mechanical fix was
> to rename to `axum::body::Bytes`, which axum re-exports from bytes —
> no behavior change). `parking_lot` is genuinely used (server/adapter.rs,
> websocket/upgrade.rs `Mutex`) — kept.
>
> HY-12: aligning tokio-tungstenite to 0.29 (matching axum's
> tungstenite 0.29) collapsed `tungstenite` 0.28/0.29, `cpufeatures`
> 0.2/0.3, and `rand` 0.9/0.10 duplicate roots. `cargo tree -d`
> root count went from 9 to 6 (getrandom 0.3/0.4 and hashbrown
> 0.16/0.17 remain — both are required by unrelated crates: getrandom
> 0.4 via alkcall/uuid/retry-policies, 0.3 via jsonschema/ahash;
> hashbrown 0.17 via indexmap/h2, 0.16 via referencing). `syn` 2/3
> also remains (thiserror 2 vs rmcp 1.8). `cargo update` was run;
> `retry-policies` pinned to 0.5.1 (`--precise`) because its 0.5.2
> bump pulled `rand` 0.10 back in (via getrandom-only rand_core 0.10).
>
> HY-08: `test-support` feature now extends `wss` (declared via
> `["wss"]` equivalent — both activate the same optional
> tokio-tungstenite dep); the wss-feature feature set already matched
> the dev-deps set (`connect` + handshake-capable, default-features off),
> so the dev-dependency declaration was aligned to that exact set.
>
> CON-10 residue: already fixed before this task landed —
> `[[test]] full_surface` has `required-features = ["mcp",
> "test-support"]`; verified by `cargo test --features mcp` passing.
>
> HY-07: `READ_SLOTS` privatized (`pub const` → `const`) in
> src/websocket/byte_adapter.rs; it is internal plumbing (inbound
> backpressure slot count), not part of the public API. No external
> references existed (verified by grep over src/, tests/, docs/).

## Summary

> Completed as specified. Changes:
>
> - HY-01: `openapiv3` moved from `[dependencies]` to
>   `[dev-dependencies]` (both use sites are test-only: to_openapi.rs
>   unit test, tests/full_surface.rs).
> - HY-05: `bytes` removed after renaming the five `bytes::Bytes` sites
>   to `axum::body::Bytes` (axum's re-export of the same type; no
>   behavior change). `parking_lot` kept — genuinely used. tokio
>   `features = ["full"]` tightened to
>   `["macros", "rt-multi-thread", "io-util", "net", "fs", "time",
>   "sync"]`, derived from actual usage (`tokio::test` → macros+rt,
>   io/ duplex/split → io-util, TcpListener/TcpStream → net, tokio::fs →
>   fs, time/sleep/timeout/interval → time, mpsc/oneshot/watch/Semaphore →
>   sync; `select!`/`pin!`/`join!` are core, `process`/`signal` were
>   pure slack from `full`).
> - HY-08: `test-support` extends `wss`; dev-deps
>   tokio-tungstenite pinned to the same feature set as the wss feature.
> - HY-12: tokio-tungstenite/tungstenite 0.28 → 0.29 aligned with the
>   version axum 0.8's `ws` feature uses. Duplicate roots: 9 → 6
>   (tungstenite 0.28/0.29, tokio-tungstenite 0.28/0.29, cpufeatures
>   0.2/0.3, rand 0.9/0.10 collapsed; remaining: getrandom 0.3/0.4,
>   hashbrown 0.16/0.17, syn 2/3 — all required by distinct unrelated
>   crates, not alignable from this crate).
> - HY-07: `READ_SLOTS` privatized.
> - CON-10: verified already fixed (`required-features = ["mcp",
>   "test-support"]` on `full_surface`).
>
> Verification matrix (all green):
>
> - `cargo test` — 300 passed
> - `cargo test --all-features` — 371 + 9 + 6 + 8 + 13 passed
> - `cargo test --features mcp` — 355 + 9 passed
> - `cargo test --features wss` — 316 passed
> - `cargo check --no-default-features` — compiles
> - `cargo clippy --all-targets -- -D warnings` — clean
> - `cargo clippy --all-features --all-targets -- -D warnings` — clean
> - `cargo fmt --check` — clean
> - `cargo tree -d` — duplicate roots 9 → 6