[codex] bump finqa env minimum openenv version

[burtenshaw]

Summary

• raise envs/finqa_env's minimum openenv dependency from 0.2.2 to 0.2.3
• refresh the env-local lock metadata to match the new floor

Why

Issue #460 tracked follow-up env package bumps after the websocket timeout fix landed. echo_env has already moved past that floor, but finqa_env was still advertising openenv>=0.2.2.

Addresses #460.

Validation

• uv lock --check --project envs/finqa_env

[cursor]

Alignment Review Report

Scope: a dependency floor bump for envs/finqa_env — openenv>=0.2.2 → >=0.2.3 in pyproject.toml (line 12) plus the matching requires-dist specifier in uv.lock (line 1626), and removal of a trailing blank line in pyproject.toml. 2 files, +2/-3.

Automated Checks

• Lint: N/A (effectively PASS) — the diff touches only pyproject.toml (TOML) and uv.lock; no Python files, so usort/ruff have nothing to process (and the CI lint job scopes to src/+tests/ only). The trailing-blank-line removal is cosmetic — the file still ends with a single newline, and TOML isn't linted. Ran uv lock --check --project envs/finqa_env → passes ("Resolved 121 packages"), confirming the lockfile is consistent with the new floor.
• Debug code: CLEAN — check-debug.sh reports only pre-existing findings in src/ (test_local_docker_provider.py prints, uv_provider.py/providers.py docstring examples, serve.py/__main__.py TODOs). This PR modifies no src/ or Python files, so none of it is introduced here.

Open RFCs Context

Open/active RFCs — 000-project-phases, 001-abstractions, 002-env-spec, 003-mcp-support, 005-agentic-harnesses (In Review), 010-echo-env-token-world-model (Draft), 004-rubrics — all concern project phases, abstractions, env spec, MCP support, rubrics/rewards, agentic harnesses, and the token world model. None govern packaging, dependency floors, or lockfile/PyPI management, so none intersect this change.

Tier 1: Fixes Required

None.

Tier 2: Alignment Discussion

Principle Conflicts

None identified. A dependency-floor bump does not touch the Gymnasium API surface, reward computation, client/server separation, the MCP/WebSocket boundary, or container isolation.

RFC Conflicts

None identified. No open RFC covers dependency management or version floors.

Summary

• 0 mechanical issues to fix
• 0 alignment points for human review
• 0 RFC conflicts to discuss

---

Verification notes (positive signals)

• Well-grounded: matches the tracked follow-up in #460 (bump FinQAEnvironment to openenv>=0.2.3 for the websocket-timeout fix); echo_env was already past this floor (>=0.3.1). openenv 0.2.3 is a real PyPI release.
• Lock is clean & consistent: resolved openenv is already 0.3.1 (uv.lock line 1577), which satisfies >=0.2.3, so no re-resolution was needed. The diff carries no index-source flip (lock is already fully on pypi.org/simple) and no lock-revision churn (already revision = 3) — just the one specifier line.
• Bump is complete: no stale openenv>=0.2.2 references remain in the env. The Dockerfile installs openenv via pyproject.toml (no separate pin), and README.md/openenv.yaml carry no version pin.

LGTM — clean, minimal, and verifiable.

  

_{Sent by Cursor Automation: Pre-review}