fix(deps): keep boto3 in core; [aws] extra is forward-compat alias

Reverts the breaking-change part of the previous deps refactor. boto3 +
botocore stay in [project.dependencies] for now so pip install orb-py
continues to work for existing AWS users. The [aws] extra is preserved
as the canonical install path going forward — when the second provider
lands, AWS deps will move out of core and operators already using
pip install orb-py[aws] will see no change.

Version reverted to 1.6.2 (semantic-release manages bumps).

Author: fgogolli

CHANGELOG.md

@@ -6,33 +6,38 @@ The format is based on [Keep a Changelog](http://keepachangelog.com/en/1.0.0/)
 and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.html).
 
 <!-- insertion marker -->
-## [1.7.0] — Breaking Change
-
-### Breaking Changes
-
-- `boto3` and `botocore` removed from core `[project.dependencies]`.
-  Install `orb-py[aws]` (or `orb-py[all]`) to restore the previous behaviour.
-  Plain `pip install orb-py` no longer installs the AWS SDK.
+## Unreleased
 
 ### Added
 
-- New `[aws]` extra: `boto3>=1.42.21`, `botocore>=1.42.21`.
+- New `[aws]` extra (alias for AWS deps currently in core). The canonical install
+  command going forward is `pip install orb-py[aws]`. This continues to work
+  unchanged when AWS deps move out of core in a future major version.
 - New `[all-providers]` meta-extra: pulls in all currently implemented providers.
 - New `[monitoring-aws]` extra: AWS-specific OpenTelemetry boto instrumentation (previously bundled inside `[monitoring]`).
 - New `[test-aws]` extra: moto + response-mocking deps for AWS test suites.
-- Architecture test `test_boto3_leak_detection.py`: asserts boto3/botocore are never imported outside `providers/aws/`.
-- Unit tests `test_no_provider_install.py`: verifies ORB core modules boot cleanly when `[aws]` extra is absent.
+- Architecture test `test_boto3_leak_detection.py`: asserts boto3/botocore are never imported outside `providers/aws/` except by guarded backward-compat shims.
+- Unit tests `test_no_provider_install.py`: verifies ORB core modules boot cleanly when AWS deps are absent.
 
 ### Changed
 
 - `[monitoring]` extra no longer includes `opentelemetry-instrumentation-boto` (use `[monitoring-aws]`).
 - `[all]` extra now includes `[all-providers]` so `pip install orb-py[all]` still pulls everything.
 - `[dev]` shim extra now includes `[all-providers]` for full local development.
-- Three module-level import leaks fixed with `try/except ImportError` guards:
+- Three module-level import sites guarded with `try/except ImportError` so ORB core boots when AWS extras are absent:
   `config/schemas/cleanup_schema.py`, `infrastructure/storage/registration.py`,
   `providers/registration.py` (deprecated shims).
 - `tests/conftest.py`: bare `import boto3` replaced with guarded `AWS_AVAILABLE` flag; AWS provider tests auto-skip when `[aws]` extra is absent.
 
+### Notes
+
+- `boto3` + `botocore` **remain in core** `[project.dependencies]` for now to
+  preserve backward compatibility — `pip install orb-py` still works unchanged.
+- When the second provider (Azure / GCP / OCI) lands, AWS deps will move from
+  core to the `[aws]` extra and a major-version bump will signal the breaking
+  change. Operators who use `pip install orb-py[aws]` today will see no
+  behavior change at that cutover.
+
 ## Unreleased
 
 <small>[Compare with latest](https://github.com/awslabs/open-resource-broker/compare/v0.1.0rc0...HEAD)</small>

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "orb-py"
-version = "1.7.0"
+version = "1.6.2"
 description = "Open Resource Broker (ORB) — dynamic cloud resource provisioning via CLI and REST API"
 readme = "README.md"
 license = "Apache-2.0"
@@ -53,11 +53,21 @@ dependencies = [
     "requests>=2.31.0",
     "PyYAML>=6.0.0", # Exported API (lazy-loaded)
     "jsonschema>=4.17.0",
+    # AWS provider deps — currently in core for backward compatibility.
+    # The canonical install path going forward is `pip install orb-py[aws]`,
+    # which already works today.  When the second provider lands these will
+    # move to the [aws] extra and a major-version bump will signal the
+    # breaking change for operators who installed without extras.
+    "boto3>=1.42.21",
+    "botocore>=1.42.21",
 ]
 
 [project.optional-dependencies]
 # ── Provider extras ────────────────────────────────────────────────────────
-# AWS provider — boto3 and botocore (moved from core in 1.7.0; breaking change)
+# AWS provider — explicit opt-in alias for the AWS deps currently in core.
+# Pinning the same versions keeps `pip install orb-py[aws]` resolving identically
+# to the bare install and future-proofs operator install commands for the day
+# AWS deps move out of core.
 aws = [
     "boto3>=1.42.21",
     "botocore>=1.42.21",