Dependencies, Build, Infra & Doc Hygiene
Toolchain currency, build/CI, cloud cost, security, and documentation hygiene. Canonical infra runbooks live in infra/. Back to register.
Dependency currency (TD-03, TD-04)
Versions from gradle/libs.versions.toml (2026-06-03). The toolchain is aggressively current — which is good for features but carries upgrade/stability risk:
| Library | Version | Note |
|---|---|---|
| Kotlin | 2.3.21 | Current |
| AGP | 9.2.1 | Current |
| Ktor | 3.3.0 | Current |
| Koin | 4.1.1 | Current (server 4.1.1) |
| Compose Multiplatform | 1.11.0 | Current |
| Compose UI / foundation / runtime | 1.11.1 | Current |
| Exposed | 1.0.0-rc-4 | ⚠️ Release candidate — pin to GA when shipped |
| compose-lifecycle | 2.11.0-beta01 | ⚠️ Beta |
| kotlinx-datetime | 0.7.1-0.6.x-compat | Compat shim pin — revisit |
TD-03 — Done (2026-06). All dead Hilt, Room, compose-hilt-navigation, WorkManager, mockwebserver, runner, junit, and test-core-ktx pins were removed from libs.versions.toml (versions + libraries + plugins). See Phase 1a of the doc cleanup.
web-frontend: Next 16.0.7, React 19.2.0, TypeScript 5, Tailwind 4, Zustand 5, Axios 1.13 — all current.
Target: define an upgrade cadence; move pre-release pins (Exposed, compose-lifecycle) to GA when available; prune dead Hilt/Room aliases.
Build / CI
- CI/Gradle tuning notes exist: CI/Gradle tuning.
- Android modules are excludable via
INCLUDE_ANDROIDfor faster KMP-only builds (seesettings.gradle.kts). - The pipeline (Testing & QA): Lint (Detekt + ktlint) → Build → Test → Coverage (JaCoCo) → Deploy. Coverage numbers are not yet enforced as a gate (see testing.md).
Cloud cost & infra hardening (TD-14)
- Cost: GCP billing, GCP cost cuts (Apr baseline → May 2026 cuts), Cloud Run for server + web.
- Backlog from Roadmap “Technical Debt and Infrastructure”: caching (Redis), DB query optimization / indexing / partitioning / read replicas, observability (metrics, tracing, alerting), security (MFA, OAuth2 hardening, encryption at rest, token-refresh improvements). These are long-horizon — keep here rather than in the active register until scheduled.
Documentation hygiene (TD-13)
- TD-13 — Done (2026-06). Root-level duplicates (
WEB_MIGRATION_PLAN.md,RELEASE_CHECKLIST.md,DOCR_SETUP.md,FCM_TROUBLESHOOTING.md,STUDY_SYSTEM.md) were replaced with redirect stubs pointing to the canonicaldocs/versions. The Roadmap was updated with a staleness warning and forward links to the tech-debt register. - After the module-folder deletion (2026-06), doc links were repaired in
README.mdandarchitecture/plan-patterns-and-tradeoffs.md; re-run the link sweep below after future deletions.
Link sweep:
grep -rnE '\]\([^)]*(core-data\|core-ui\|/navigation/\|test-core\|_domain/\|_data/\|_presentation/)[^)]*\)' docs --include='*.md'