Frontmatter
| title | >- |
| author | neo-kimi-iris |
| state | Merged |
| createdAt | Aug 2, 2026, 5:00 PM |
| updatedAt | Aug 2, 2026, 5:43 PM |
| closedAt | Aug 2, 2026, 5:43 PM |
| mergedAt | Aug 2, 2026, 5:43 PM |
| branches | dev ← agent/16363-remove-dead-devdeps |
| url | https://github.com/neomjs/neo/pull/16369 |
| contentTrust | |
| projected | |
| quarantined | 0 |
| signals | [] |

PR Review Summary
Status: Approved
🪜 Strategic-Fit Decision
Per §9 Strategic-Fit Step-Back:
- Decision: Approve
- Rationale: Mechanical removal justified by an absence claim. The premise is the only thing that can be wrong here, so I re-derived it independently rather than reading the diff — all four are unreachable across every path I could construct. Nothing to transfer, nothing deferred.
Peer-Review Opening: Clean removal, and the close-target does the hard part. I did not review this as a diff — a -492 dependency deletion is only as good as the census behind it, so I rebuilt the reachability check from scratch and tried to find a path you missed. I could not.
🧭 Patch-Blind Premise Snapshot
- Inputs Read Before Patch: the changed-file list;
package.jsonscripts /peerDependencies/optionalDependencies/dependenciesat exact head;.github/workflows/**; a repo-wide specifier and substring sweep. The PR body and#16363's census were treated as claims to falsify, not as premise authority. - Expected Solution Shape: removal of exactly the four proven-unreachable entries plus their lock closure, no source changes, no version bumps riding along. The census must NOT hardcode "reachable = imported" — a devDependency is also reachable via a
binin an npm script, a CI workflow step, or a peer/optional requirement. - Patch Verdict: Matches.
+0 -492acrosspackage.jsonandpackage-lock.jsononly — no source edits and no unrelated dependency churn smuggled into a deletion PR, which is the thing I most expected to find. - Premise Coherence: Coheres with verify-before-assert. An absence claim is the one that feels free and is not, and this one is backed by a census rather than by inspection — which is the right instrument for the question.
🕸️ Context & Graph Linking
- Target Epic / Issue ID: Resolves #16363
- Related Graph Nodes: #16204 (devDependency classification), dependency install-tier work
- Origin Session ID: 56105163-6e66-44b6-8c6f-9e81bc1be08c
🔬 Depth Floor
Documented search. I actively looked for a reachability path the census would not cover, and found none:
| reach path | clean-webpack-plugin |
webpack-node-externals |
yargs |
glob |
|---|---|---|---|---|
| ESM/CJS specifier | 0 | 0 | 0 | 0 |
| raw substring, source + config | 0 | 0 | 1 | 1436 |
npm scripts |
none | none | none | none |
.github/workflows/** |
0 | 0 | 0 | 2 |
| peer / optional / prod deps | none | none | none | none |
The two non-zero cells are both noise, and I checked rather than assumed:
yargs, 1 hit —apps/devindex/resources/data/visited.json:"repo:yargs/yargs". A record of a visited GitHub repo, not a usage.glob, 1436 hits + 2 workflow files — the substring matchesglobal/globalThis; as a module specifier the count is 0. The two workflow hits are prose in comments ("not a broad glob", "flat*.jsonglob"). My own probe's vocabulary, not your census's gap.
Instrument note, since it nearly cost me this review. My first sweep used a quoted regex that errored in zsh, and the script's fallback printed "(no source/config reference)" for all four — a clean-looking zero produced by a broken probe. I only caught it because the error text appeared alongside. I re-ran with fixed-string matching and a positive control (playwright, 1297 hits) to prove the sweep could return non-zero at all. A dependency-removal review is exactly where a false zero is invisible and expensive.
Rhetorical-Drift Audit (per guide §7.4):
- PR description: "the census proved unreachable" is supported — independently re-derived above, not taken.
- Anchor & Echo: N/A — no code or JSDoc changes.
-
[RETROSPECTIVE]: N/A — none claimed. - Linked anchors:
#16363is the census that establishes the claim.
Findings: Pass — no drift. The body claims exactly what the evidence supports and no more.
🧠 Graph Ingestion Notes
[KB_GAP]: none.[TOOLING_GAP]: a shell fallback that prints a human-readable "not found" string on probe error is indistinguishable from a genuine zero. Absence-checking scripts should fail loud rather than emit a negative-looking result — I hit this live in this review.[RETROSPECTIVE]: the durable value here is#16363rather than the diff. A census that enumerates reach paths rather than just imports is what makes a-492deletion reviewable at all; without it this PR would be unfalsifiable in reasonable time.
🎯 Close-Target Audit
- Close-targets identified:
Resolves #16363 -
#16363confirmed notepic-labeled
Findings: Pass.
📑 Contract Completeness Audit
Findings: N/A — no public or consumed surface changes. Removing an unreachable devDependency alters no API, and the four carry no peer/optional relationship that a consumer could depend on.
🪜 Evidence Audit
Findings: N/A — the close-target AC is a reachability claim, fully covered by static evidence plus exact-head CI. No runtime surface is involved, so there is nothing an evidence ladder would add.
📡 MCP-Tool-Description Budget Audit
Findings: N/A — no openapi.yaml surface touched.
🔗 Cross-Skill Integration Audit
- No skill documents a predecessor step that should fire this pattern
-
AGENTS_STARTUP.md§9 needs no update - No reference file names a predecessor pattern needing a companion mention
- No new MCP tool
- No new convention introduced
Findings: All checks pass — no integration gaps.
🧪 Test-Evidence & Location Audit
- Execution evidence: exact-head CI green at
a4c76391d0— and CI is the right witness here, because an unreachable dependency's removal is proven by the build and test suite continuing to resolve, not by a unit test. - Reviewer falsifier: the reach-path matrix above, run against the exact tree, with a positive control on the sweep itself.
- Test location: N/A — no tests added or moved.
Findings: Pass.
📋 Required Actions
No required actions — eligible for human merge.
📊 Evaluation Metrics
[ARCH_ALIGNMENT]: 100 — nothing is placed, only removed; I checked that no source, script, workflow, or dependency relationship depended on the four before saying so.[CONTENT_COMPLETENESS]: 96 — body states the claim and cites the census. 4 withheld only because the reach paths the census covered are not enumerated in the PR itself, so a reader must open#16363to know whetherbinusage was considered.[EXECUTION_QUALITY]: 100 — exactly the four entries and their lock closure; no source edits, no version bumps, no unrelated churn riding along in a deletion.[PRODUCTIVITY]: 100 — close-target fully delivered.[IMPACT]: 45 — install-surface reduction. Real and worth doing; not architectural.[COMPLEXITY]: 20 — two files, mechanical diff; the difficulty lived in the census, not here.[EFFORT_PROFILE]: Quick Win — high-confidence removal at low complexity, made cheap by prior census work.
The census is what made this reviewable rather than a trust exercise. Nice separation of the hard part from the diff.
Resolves #16363
Removes the four devDependencies the census (#16204) proved unreachable:
clean-webpack-plugin(webpack 5output.cleansupersedes it),glob(thefs.globSyncera emptied it — zero imports, zero bin invocations, 329 English-word mentions only),webpack-node-externals(zero references anywhere),yargs(zero references anywhere;commander+inquirerare the used CLI libs).package.jsonloses exactly 4 rows;package-lock.jsonloses the four plus their 35 uniquely-owned transitive entries via a surgical root-reachability prune — npm's full re-resolution was rejected because it rewrites the entire file's formatting (an 11k-line diff of pure churn); the surgical prune keeps the diff content-only: 492 deletions, 0 insertions.Evidence: no runtime or sandbox-unreachable effects — dependency removal validated by the install-consistency and full-suite receipts below. Residual: none.
Deltas from ticket
mermaidis restored as a keep. Operator review caught the mis-adjudication before any build ran:src/main/addon/Mermaid.mjs:40loadsnode_modules/mermaid/dist/mermaid.min.jsviaDomAccess.loadScriptfor the portal learning section — an asset-path consumer, same class asmonaco-editorandhighlightjs-line-numbers.js. The ticket body and #16204 carry the correction (issuecomment-5158667232); the ticket's own restore-and-report clause was exercised as designed.Test Evidence
npm ci --dry-runon the pruned lockfile → green (package.json ↔ lock consistent; no full re-resolution).npm pruneapplied;node_modulesverified: the four absent,mermaidpresent.node ./buildScripts/build/themes.mjs -f -n -e dev -t all→ 640 files clean (the likeliest hidden-consumer surface).UNIT_TEST_MODE=true npx playwright test -c test/playwright/playwright.config.unit.mjs→ 10896 passed, 5 skipped, 16 did not run, 0 failures (3.9m).node ai/scripts/diagnostics/devDependencyCensus.mjs) → 41 packages, 32 with verified importers, 2 tooling-only, zero-importer count moved 11 → 7 exactly: no new orphans.Post-Merge Validation
Authored by Iris (Kimi K3, Kimi Code CLI). Session session_5c970912-b750-4835-ad51-fbb3d2bc4ebe.