[fullsend-ai-coder]

Description

Adds a Dependency Removal Cleanup subsection to the Dependency Update Process guidance in AGENTS.md. The existing checklist covers adding and updating dependencies (pyproject.toml, uv.lock, Konflux, Tekton) but did not address the removal case. This gap led to stale references being left behind when packages were dropped (e.g., PR #3057 removed litellm but left references in 6+ files, tracked in #3066).

The new section instructs contributors to:

1. Grep the entire repo for the removed package name across all relevant file types
2. Check for package-specific environment variables
3. Remove or update all stale references in docs, scripts, configs, and examples
4. Verify no runtime imports of the removed package remain

Type of change

• Documentation Update

Tools used to create PR

• Generated by: fullsend-code (pi runtime)

Related Tickets and Documents

• Related Issue Clean up stale litellm and fastuuid references after dependency removal in PR #3057 #3066 (tracks concrete cleanup of stale litellm/fastuuid references)

Checklist before requesting a review

• I have performed a self-review of my code.
• PR has passed all pre-merge test jobs.
• If it is a core feature, I have added thorough tests.

Testing

This is a documentation-only change to AGENTS.md. No code or tests are affected. Verified the markdown renders correctly and the new subsection is properly nested under the existing Dependency Update Process (Konflux) section.

---

Closes #3067

Post-script verification

• Branch is not main/master (agent/3067-dependency-removal-guidance)
• Secret scan passed (gitleaks — 401a7b55cd7f1561ef69e67ecbf9279e06c8e017..HEAD)
• PR body secret scan passed (gitleaks — no-git)
• Final PR description secret scan passed (gitleaks — no-git)

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: lightspeed-core/lightspeed-stack
• Branch: main
• File: .coderabbit.yaml
• Commit: 401a7b5
• Layers: Repository YAML
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 6475f84c-2522-446d-8a05-b16eed513b9c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 4:32 PM UTC · Completed 4:42 PM UTC

Commit: ea2f9a4 · View workflow run →

Runtime: pi · Model: opus → claude-opus-4-6 · Effort: high · Cost: $2.30

[fullsend-ai-review]

Review

Findings

Medium

• [protected-path] AGENTS.md — This PR modifies AGENTS.md, which is a protected governance file. The PR links to issue Expand AGENTS.md dependency update guidance to cover package removal cleanup #3067 and the description explains the rationale (adding dependency removal cleanup guidance to address a process gap identified in PR LCORE-5106: Updated dependencies #3057). Human approval is always required for protected-path changes, regardless of context.

Low

• [edge-case] AGENTS.md:471 — The example grep command in the new "Dependency Removal Cleanup" section omits --include='*.sh' and --include='*.json', yet the repository contains 10+ shell scripts (e.g., scripts/entrypoint.sh, scripts/generate_local_run.sh) and JSON config files (e.g., .github/renovate.json) where a removed package name could appear as a reference. A developer following this checklist literally would miss those file types.

---

Risk assessment missing — risk assessment is enabled but no score was
produced. A human reviewer must evaluate this PR.

---

Labels: PR adds documentation guidance to AGENTS.md for dependency removal cleanup.

[fullsend-ai-review]

See the review comment for full details.

[fullsend-ai-review]

[low] edge-case

The example grep command in the new Dependency Removal Cleanup section omits --include=.sh and --include=.json, yet the repository contains 10+ shell scripts (e.g., scripts/entrypoint.sh, scripts/generate_local_run.sh) and JSON config files (e.g., .github/renovate.json) where a removed package name could appear as a reference. A developer following this checklist literally would miss those file types.

[tisnik]

LGTM

[fullsend-ai-retro]

🤖 Finished Retro · ✅ Success · Started 10:10 AM UTC · Completed 10:18 AM UTC

Commit: ea2f9a4 · View workflow run →

Runtime: pi · Model: opus → claude-opus-4-6 · Effort: high · Cost: $1.70

[fullsend-ai-retro]

Retro: PR #3071 — Dependency removal cleanup checklist

Timeline

1. Oct 29, 15:33 — PR LCORE-5106: Updated dependencies #3057 merged (removed litellm, left stale references in 6+ files)
2. Oct 29, 15:46 — Retro agent created issue Expand AGENTS.md dependency update guidance to cover package removal cleanup #3067 (add dependency removal guidance to AGENTS.md) and Clean up stale litellm and fastuuid references after dependency removal in PR #3057 #3066 (clean up stale litellm references)
3. Oct 29, 15:55 — Triage completed ($0.74), issue labeled ready-to-code
4. Oct 29, 16:11 — Code agent opened PR docs(#3067): add dependency removal cleanup checklist #3071 ($0.64) — 26-line docs-only addition to AGENTS.md
5. Oct 29, 16:42 — Review agent posted findings ($2.30): 1 medium (protected-path, requires human approval) and 1 low (incomplete grep file types — missing *.sh and *.json)
6. Oct 30, 09:25 — Human reviewer approved with "LGTM"
7. Oct 30, 10:09 — PR merged

What went well

• Full automation loop worked: retro identified a process gap → issue created → triage → code → review → merge, all within 24 hours.
• Code agent was efficient: $0.64 for a clean docs-only change that faithfully implemented the retro agent's specification.
• Review agent caught a valid gap: the example grep command omits --include='*.sh' and --include='*.json', yet the repo has 15+ shell scripts and 15+ JSON configs where removed package names could appear.

What could improve

• The review agent's valid edge-case finding was not addressed before merge. The grep command in the merged AGENTS.md is incomplete — users following it literally will miss shell scripts and JSON configs. One proposal filed below.
• Root cause was in the retro agent's specification, not the code agent. The retro agent's original issue Expand AGENTS.md dependency update guidance to cover package removal cleanup #3067 proposed the same incomplete grep command. The code agent faithfully reproduced it. The review agent was the first to notice the gap.
• Tirith blocked 3 review agent bash commands (nested $() substitutions). The agent adapted and completed the review, but this cost tokens on retries. This is already tracked in tirith shell-safety check flags heredoc nested inside command substitution as analysis_incomplete/HIGH fullsend-ai/fullsend#7219. This retro provides additional evidence: the blocks occurred on commands like date +%s > file; echo "$(cat file)" and PR_NUMBER=$(echo "$PR_URL" | grep -oP '\d+$'), which are routine agent operations.
• Risk assessment was missing. The review agent stated "risk assessment is enabled but no score was produced," forcing mandatory manual evaluation. For a docs-only change, this adds unnecessary friction.

Existing issues corroborated

• tirith shell-safety check flags heredoc nested inside command substitution as analysis_incomplete/HIGH fullsend-ai/fullsend#7219 — Tirith analysis_incomplete blocking nested command substitutions. This retro adds 3 more blocked commands as evidence.
• Review agent should alert when human approves with unresolved Medium+ findings fullsend-ai/fullsend#2099 — Review agent alerting on human approval with unresolved findings. In this PR, the findings were appropriately low severity / non-actionable, so the scenario is less severe than Extract shared helper to eliminate duplication between dump_models and dump_schema #2099's original case, but the human did approve without engaging with the edge-case finding.

Proposals filed

• AGENTS.md dependency removal grep command should include *.sh and *.json file types (in lightspeed-core/lightspeed-stack)