Single-source the dependency pins
needs-decision tech-debt · carried forward from Phase 1
requirements.txt and pyproject.toml carry the same ~200 fully-pinned packages — transitive dependencies and the entire CUDA/torch stack included — alongside a uv.lock. Two hand-maintained copies of a pip freeze, which will drift.
They already did. Phase 1 had to make the same two corrections in both files in lockstep (baabfa0):
attr==0.3.2 was pinned where reasoning_modules.py:1 wanted attrs — and that import should have been dataclasses.dataclass regardless, which is what it is now;finch-api==1.44.1 was an unrelated HR/payroll SDK, not the FINCH clustering algorithm — which is why g-memory clustering has never run.
Editing two files in lockstep to fix one wrong pin is precisely the failure mode.
Why this is a decision, not a cleanup. Which file is canonical depends on whether the conda path in the README is still supported. If it is, requirements.txt has to keep working for people not using uv. If it is not, pyproject.toml plus uv.lock is the whole story and requirements.txt should be generated or deleted.
Options.
pyproject.toml canonical, requirements.txt generated by uv export --no-hashes in CI and committed, or deleted outright. Cleanest if conda is gone.- Keep both by hand, and add a CI check that they agree. Cheap insurance if the conda path must stay.
Either way: the pins should name direct dependencies, not a frozen transitive closure. Phase 1's [dependency-groups] dev group names 8 packages and installs 26, which is the shape to aim for.
The Phase 6 Dockerfile fix (see the separate issue) needs this resolved before it can uv sync --frozen.
Migrated from docs/BACKLOG.md.
Single-source the dependency pins
needs-decisiontech-debt· carried forward from Phase 1requirements.txtandpyproject.tomlcarry the same ~200 fully-pinned packages — transitive dependencies and the entire CUDA/torch stack included — alongside auv.lock. Two hand-maintained copies of apip freeze, which will drift.They already did. Phase 1 had to make the same two corrections in both files in lockstep (
baabfa0):attr==0.3.2was pinned wherereasoning_modules.py:1wantedattrs— and that import should have beendataclasses.dataclassregardless, which is what it is now;finch-api==1.44.1was an unrelated HR/payroll SDK, not the FINCH clustering algorithm — which is whyg-memoryclustering has never run.Editing two files in lockstep to fix one wrong pin is precisely the failure mode.
Why this is a decision, not a cleanup. Which file is canonical depends on whether the conda path in the README is still supported. If it is,
requirements.txthas to keep working for people not usinguv. If it is not,pyproject.tomlplusuv.lockis the whole story andrequirements.txtshould be generated or deleted.Options.
pyproject.tomlcanonical,requirements.txtgenerated byuv export --no-hashesin CI and committed, or deleted outright. Cleanest if conda is gone.Either way: the pins should name direct dependencies, not a frozen transitive closure. Phase 1's
[dependency-groups] devgroup names 8 packages and installs 26, which is the shape to aim for.The Phase 6 Dockerfile fix (see the separate issue) needs this resolved before it can
uv sync --frozen.Migrated from
docs/BACKLOG.md.