codex-proxy-rs/docs/dependency-policy.md

Dependency Policy

• Use current stable crate releases for normal Rust dependencies.
• Commit Cargo.lock because this is an application.
• Run cargo update in dedicated dependency-refresh changes.
• Keep reqwest = 0.12.28 and rustls = 0.23.36 pinned until a TLS fingerprint review proves a newer pair matches real Codex Desktop behavior.
• reqwest is built with rustls-tls-native-roots, json, stream, cookies, and response compression features used by the Codex client builder. Do not switch back to default native-tls.
• tokio includes net for the Axum listener, and tower includes util for route tests using ServiceExt.
• Do not add unmaintained crates when a maintained community-standard crate exists.
• Every dependency change must run:

cargo fmt --check
cargo clippy --all-targets --all-features --locked -- -D warnings
cargo test