stacklisted

You own `docs/stack.md`. The rule it enforces is in `.claude/rules/knowledge-base.md`, and it is short: **technology not listed here is an open decision, never something adopted silently.** This is checkable because dependency manifests are structured data. `scc validate` reads the direct dependencies out of `go.mod` and `package.json` and reports any that `stack.md` does not mention. Indirect dependencies are skipped — nobody decided those. ## Adding a dependency is two steps Adding it to the manifest is the first. The second is here, and it happens in the same change, not later: 1. **Say what problem it solves** — the one you actually have, not the category. 2. **Say what it was chosen over**, if anything real was considered. This is the line that pays off in a year, when someone asks why not the obvious alternative. 3. **Say what it costs.** Every dependency is a supply-chain surface, a version to keep current, and an API someone will have to learn. If you cannot name the cost you have not finished evaluating it. ```markdown ## Go - **stdlib only** — the binary ships to six platforms and every dependency is a supply-chain surface. A dependency has to be worth that. ``` The validator matches on the module path or its last segment, so writing `chi` for `github.com/go-chi/chi` is enough. It is looking for a decision, not a spelling. ## Before you add anything Ask the three questions, in this order: 1. **Can the standard library do it?** For most of what a