SYN-339 dependency inventory verification
Tracking: SYN-339 (#341).
Source baseline: 21242ae0c2a2d592dedad439631ecc8e0a97df1e.
Status: stable-toolchain gates passed against source commit
4f51d6a4e37356cf9761fcc79b9530132a72de58. Independent source review found no actionable removal issue. The Rust 1.89 CI
build remains a publication prerequisite. No diagnostic tool installation, release
or tag was performed.
The independently modified primary checkout and developer benchmark are outside
this worktree and remain untouched.
Inventory
| Declaration | Source evidence | Candidate change |
|---|---|---|
anstream | No direct imports; clap still owns its transitive stream adapter | Remove direct runtime declaration |
anyhow | The actual binary reports typed synapse::Error; build script returns a boxed standard error | Remove direct runtime declaration |
fluent | The loader is imported through i18n_embed::fluent | Remove direct runtime declaration |
i18n-embed-fl | No fl! or crate imports; fluent_language_loader! expands through i18n_embed | Remove unused macro declaration |
gray_matter | Frontmatter code uses the maintained yaml_serde boundary directly | Remove direct runtime declaration |
tracing-subscriber | No direct subscriber initialization or imports | Remove direct runtime declaration |
rstest | No imports or attributes across production, tests, examples or build script | Remove unused dev declaration and old roadmap reservation |
build clap, clap_complete, clap_mangen | build.rs uses only vergen_gix; actual generation imports are in src/cli/generate.rs | Remove build declarations; preserve all three runtime declarations |
| cargo-shear ignore table | Four entries already have real source use; rstest is an obsolete reservation | Remove the complete obsolete ignore table |
All Rust sources, feature declarations, examples and the actual loader macro implementation were inspected. Static search cannot replace compilation of macro expansion and every supported feature. No runtime behavior or compiled-size claim is inferred from this inventory.
cargo update --offline --workspace reconciled the lockfile without compiling.
It added or upgraded zero package versions and removed 21 unreachable packages.
The package count changed from 611 to 590. The exact removed declarations,
removed package versions and candidate hashes are recorded in the adjacent
inventory receipt.
The product remains Rust 1.89. anstream, anyhow and fluent remain transitive
where the retained dependencies need them. Direct-declaration removal is not a
claim that those packages disappeared from the binary or graph.
The removed i18n-embed-fl path was the only locked parent of
proc-macro-error2. Its now-unused advisory exception is removed. The maintained
YAML decision and all other bans/advisory policy remain in force. No new advisory
exception is introduced and dependency pruning is not a runtime security proof.
Diagnostic semantics
The installed package manifest identifies cargo-shear 1.8.0, while its version
command prints dev. The observed executable SHA-256 is
c22d74ed51f276869f7134d51861e599ac4b0dee2752c0ccd58616eace2ea585.
Its --format=json is unsupported. A fresh direct command, with the subprocess
status captured before any later command, reports six unused errors and exits 1:
cargo shear --locked --offline --color never
The earlier historical report of exit 0 is not reproduced. It is not evidence of a proven tool defect. The pinned 1.8.0 implementation returns 1 for analysis errors and 2 for processing/rendering errors. Warnings alone may return zero. Text diagnostics and a compiler error are not an application assertion RED or a supported structured test adapter.
The selected diagnostic package is pinned to 1.8.0. An equivalent installation
can request cargo install cargo-shear --version '=1.8.0' --locked; this task used
the existing verified installation. Its observed host binary hash identifies
this run, not every installation of that package version.
The actual control used an isolated valid Cargo fixture containing an unused
serde = "=1.0.228" declaration. Locked offline Cargo metadata succeeded. The
direct diagnostic returned 1 and named serde; after removing the declaration
and reconciling the fixture lockfile, it returned 0. The candidate repository
also returned 0 with no issues. No compiler was invoked for this control. Exact
commands and statuses are retained in diagnostic-control.json in the raw
evidence directory. A missing package, compiler failure, processing error, empty
result or unrelated warning does not satisfy the control. A later CI gate should
pin the verified tool version, invoke it directly and preserve its subprocess
status. Do not raise the product MSRV to install a diagnostic utility.
Completed stable gates and remaining limits
The new source-only checkout is approximately 14 MiB. Its local target directory
was not created. Baseline, reconciliation and validation logs are retained in
/tmp/syn339-adversary-preparation-20261017.
The inactive Synapse adversarial Cargo target was identified for a coordinated handoff. The owner reclaimed 874 MiB of root-package outputs while retaining its dependency artifacts. All compilation used that warm custom target with two jobs, debug information disabled and incremental output disabled. An initial Clippy attempt used the wrong debug profile and was deliberately interrupted with exit 255. Its log is retained separately and is not an acceptance result. The smaller Soma55 Synapse target belongs to another native journey; it is not assumed available. Pinned guarded executables and all raw evidence remain outside cleanup.
| Gate | Actual result |
|---|---|
| Formatting, file-size and diff checks | Passed |
| Dependency inventory and valid unused-declaration control | Candidate 0, unused declaration 1, restored fixture 0 |
| Clippy, all targets and all features, warnings denied | Passed in 2m 38s on Rust 1.95.0 |
| Full all-feature Rust tests, including doctests | 555 passed, zero failed, nine existing ignored |
| Native guarded rejection and direct core contracts | 15 passed, zero skipped |
| Native Memory CI contracts | Seven passed, zero skipped |
| API docs, all features, warnings denied | Passed |
| Cargo deny advisories, bans, licenses and sources | Passed |
| Pre-push Git environment and required-gate regression | Passed |
| Rust 1.89.0 offline metadata | Passed; no higher declared dependency MSRV |
| Rust 1.89 actual compilation | Deferred to exact-source PR CI under resource coordination |
The nine ignored Rust tests comprise four model/network checks, four subprocess
workers launched by their owning crash tests and one release performance budget.
No model download, live API or release performance result is claimed. The native
runner built the actual candidate binary and direct core probe in
/tmp/synapse-rejection-adversary-target-20261017; it did not use the preserved
guarded binary. That external pinned binary retained its original SHA-256.
The actual MSRV build remains an acceptance prerequisite. Offline metadata checks declared compatibility and cannot prove compilation. No separate cold MSRV cache was started while higher-priority native and review gates held the disk budget. No Xcode or native application UI work was performed by this task.
The Cargo update reference describes the conservative workspace update used here. Stable compiler and native results prove the unchanged functional gates on this host. Independent review is complete; exact-source Rust 1.89 CI is still required before publication acceptance.
Independent source review
A separate reviewer pinned the implementation at 4f51d6a and inspected all 304
tracked Rust files, conditional/test/build/example paths and relevant procedural
macro expansions. The reviewer independently reconciled all 21 removed package
versions, retained versions, lockfile edges and receipt hashes. Runtime CLI
generators remain declared; embedded localization still uses the retained loader
and its required features. The removed advisory exception has no remaining
package in the lockfile. No actionable finding was identified.
This is source review with explicit bounds. The reviewer did not rerun compiler gates or claim that this host establishes every release target. The existing Linux MSRV and CI gates remain required.