Document dependency consolidation candidates

[Finesssee]

Summary

• document an evidence-driven dependency consolidation strategy in ADR 0006
• rank high-confidence candidates (strum, ts-rs, serde_with, url, parking_lot, itertools, bon, serde_path_to_error)
• keep architecture-specific crates behind focused prototypes (tokio-util, secrecy, moka, HTTP middleware/retry, rust_decimal, phf)
• require each dependency PR to delete or centralize measured existing code instead of adding dormant crates

Audit evidence

• ProviderId: 70 variants; rust/src/core/provider.rs: 1,131 LOC
• frontend bridge: 958 LOC / 101 exported types and interfaces
• Tauri invoke wrapper: 534 LOC / 91 wrappers; backend exposes 98 commands
• FetchContext: 26 manual construction sites
• about 20 lock().unwrap* sites, including 8 explicit poison-recovery paths

Validation

• rebased onto the latest port/upstream-0.56.0 before commit
• re-ran the measured audit counts after the rebase
• git diff --check passed
• docs-only change; no runtime dependency, source, lockfile, or UI behavior changed

This ADR stays Proposed so review can reject or reorder individual candidates before any implementation PR lands.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Team

Run ID: 5bbe6b6b-2b15-4815-a5d7-51e0a5e394f5

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[Finesssee]

Thermo-nuclear review: APPROVE AS A PROPOSED ADR

No code-quality blocker. This is documentation only and, importantly, it does not authorize dependency accumulation: every candidate is gated on deleting/centralizing measured code, Tier 2 requires a concrete problem/prototype, and the ADR remains Proposed. That is consistent with the repo rule that tooling/dependency additions require explicit confirmation.

Process note: the PR targets the older port/upstream-0.56.0 line rather than the active rebuilt review/upstream-0.56.0 review train. Retarget if the ADR is intended to land with the current branch sequence.

No runtime code, 1,000-line threshold, or CUA issue applies.

[Finesssee]

Thermo-nuclear code quality review: CHANGES

P1: the current PR diff is structurally contaminated by fourteen unrelated porting commits

The PR is titled as a dependency-consolidation ADR, but its current main-base diff is 31 files and about 2.6k additions. The ADR commit sits on top of fourteen upstream-port/review commits touching Antigravity history/quota, Cursor token costs, Codex API/reset handling, Grok, OpenRouter, localization, and other provider code. Examples include a new 570-line rust/src/providers/antigravity/local_sqlite.rs and a 419-line rewrite in rust/src/providers/cursor/token_cost.rs.

That makes a documentation decision impossible to review or merge atomically. Do not try to clean the mixed history in place. Use the clean one-commit replacement PR for the ADR and close this contaminated PR. The existing clean replacement is #456.

[Finesssee]

Superseded by #456, which carries the same intended ADR change on clean history and is now merged. Closing this original instead of resolving/importing its unrelated porting commits.