docs(ai): track dependency slimming efforts

ai/notes.md

@@ -95,5 +95,28 @@ Open questions:
 - Stretch goals:
   - Emit additional artefacts (e.g., `docs/CHANGELOG.md`) from the same source
     modules.
-  - Allow embedding generated tables from Cargo metadata (dependency stats,
+- Allow embedding generated tables from Cargo metadata (dependency stats,
   feature lists).
+
+# Dependency Slimming Log
+
+- 2025-03: Replaced `reqwest`/`tokio` async stack with `ureq`; default builds
+  now avoid pulling in hyper/quinn/tower trees. GraphQL feature gate still pulls
+  Actix/tokio, but only when enabled.
+- Added `.cargo/config.toml` profiles: dev stays at `opt-level=0`, release uses
+  LTO fat + `-O3`, and PGO profiles expose `cargo pgo-instrument`/`cargo
+  pgo-build` aliases.
+- All SVG artefacts (core logo, Nixette logo/mascot/wallpaper) are now generated
+  by Rust binaries under `src/bin/*_gen.rs` using a shared `svg_builder` module.
+  Regeneration steps:
+  ```bash
+  cargo run --bin logo_gen
+  cargo run --bin nixette_logo_gen
+  cargo run --bin nixette_mascot_gen
+  cargo run --bin nixette_wallpaper_gen
+  ```
+- README is produced via `cargo run --bin readme_gen`; contributors should edit
+  the builder source instead of the Markdown output.
+- Remaining work: trim tracing/Actix dependencies inside the TUI path,
+  investigate replacing `gptman` for non-critical disk UI builds, and pin a
+  cargo `deny` audit to alert on large transitive graphs.

ai/tasks.json

@@ -83,6 +83,24 @@
         "mlfs-package-import",
         "lfs-html-parsers"
       ]
+    },
+    {
+      "id": "dependency-audit",
+      "title": "Keep lpkg dependency footprint lean",
+      "description": "Regularly evaluate crates for bloat and replace heavy stacks with std or lightweight alternatives.",
+      "owner": "default_cli",
+      "priority": "medium",
+      "next_actions": [
+        "Track remaining crates pulling in large transitive trees (e.g. tracing, actix-only paths)",
+        "Automate cargo-tree diff reports in CI",
+        "Document substitution patterns (tokio ➜ std, reqwest ➜ ureq, etc.)"
+      ],
+      "success_metrics": [
+        "Default `cargo build` compiles < 140 crates",
+        "No async runtimes linked when GraphQL feature is disabled",
+        "README lists regeneration commands for all generated assets"
+      ],
+      "notes": "Continue pruning optional crates (tracing, gptman, uuid) when the TUI feature is off; surface findings in ai/notes.md."
     }
   ],
   "solved": [
@@ -113,6 +131,13 @@
       "description": "Cache wget-list/md5sums from jhalfs and expose a CLI refresh command so harvesting can populate source URLs and checksums reliably.",
       "resolution": "Extended metadata_indexer with a `refresh` subcommand, cached manifests under ai/metadata/cache/, and hooked harvest to populate MD5 checksums via jhalfs data.",
       "owner": "default_cli"
+    },
+    {
+      "id": "lightweight-http-stack",
+      "title": "Replace async HTTP stack with lightweight blocking client",
+      "description": "Remove tokio/reqwest default dependency and adopt a minimal HTTP client for CLI workflows.",
+      "resolution": "Swapped reqwest/tokio for ureq across html, ingest, and metadata tooling; added PGO-aware Cargo profiles and documented regeneration commands.",
+      "owner": "default_cli"
     }
   ]
 }