# ADR-0007: Dependency policy — stdlib-first, hand-rolled REST clients

**Status:** Accepted — 2026-06-10

## Context

go-llm leans on SDKs (openai-go, go-anthropic, genai) and carries their
transitive weight and churn. The kickoff mandates minimal dependencies with
full control over multimodal payloads and capability handling.

## Decision

- **Hand-rolled `net/http` JSON clients** for OpenAI(+compatible),
  Anthropic(+compatible), Ollama (cloud + local), and foreman. Their REST
  surfaces are small and stable; owning the wire shapes gives exact control
  over tool calls, structured output, streaming, and image payloads.
- **One approved third-party dependency:** the official Google Gen AI Go SDK
  (`google.golang.org/genai`) for the Gemini provider — Google's surface
  moves too much to hand-roll profitably.
- Image normalization uses stdlib `image`, `image/jpeg`, `image/png`.
  `golang.org/x/image` may be added **only** if a needed format demands it,
  via a new ADR.
- Any other third-party dependency requires its own ADR justifying it.
- No persistent store, no metrics stack, no config framework, no CLI beyond
  `examples/` (out-of-scope guardrails).

## Consequences

- `go.mod` stays near-empty; consumers inherit almost nothing transitively.
- We own wire-format drift: provider docs are verified against current
  documentation at implementation time and recorded in the provider ADRs.