chore(deps): pin conda environment.yml; tighten postgres/pgvector extras

.github/workflows/environment.yml

@@ -12,24 +12,36 @@ channels:
 dependencies:
   - python=3.12
   - pip
-  # Core runtime (conda-forge versions for binary stability)
-  - fastapi
-  - uvicorn
-  - pydantic
-  - pyyaml
-  - httpx
-  - langchain-core
-  - chromadb  # Note: Use embedded/PersistentClient only. See SECURITY.md
-  - sentence-transformers
-  - numpy
-  - nltk
-  # Test & Dev tooling
-  - pytest
-  - pytest-asyncio
-  - ruff
-  - mypy
-  - bandit
-  - pytest-cov
+  # Core runtime — pinned to match pyproject.toml / constraints.txt exactly
+  # (each version verified present on conda-forge, 2026-07). Keep these pins in
+  # sync with pyproject.toml [project.dependencies] and constraints.txt; a bare
+  # unpinned resolve here can silently drift from the pip path (e.g. numpy
+  # floating to 2.x, which breaks chromadb/onnxruntime per CLAUDE.md).
+  #
+  # fastapi is the one deliberate exception: conda-forge's chromadb=1.5.9
+  # build hard-pins fastapi==0.115.9 (confirmed via a live `mamba env create`
+  # solve failure -- "fastapi=0.138.0 is not installable because it conflicts
+  # with any installable versions previously reported"). This is a conda-forge
+  # packaging constraint, not a CyClaw choice; the pip path stays on
+  # fastapi==0.138.0 (pyproject.toml/constraints.txt) since PyPI's chromadb
+  # 1.5.9 carries no such pin. Re-check this pin if chromadb is ever bumped here.
+  - fastapi=0.115.9
+  - uvicorn=0.49.0
+  - pydantic=2.13.4
+  - pyyaml=6.0.3
+  - httpx=0.28.1
+  - langchain-core=1.4.8
+  - chromadb=1.5.9  # Note: Use embedded/PersistentClient only. See SECURITY.md
+  - sentence-transformers=5.6.0
+  - numpy=1.26.4
+  - nltk=3.9.4
+  # Test & Dev tooling — pinned to match pyproject.toml's test/dev extras
+  - pytest=9.1.1
+  - pytest-asyncio=1.4.0
+  - ruff=0.15.20
+  - mypy=2.1.0
+  - bandit=1.9.4
+  - pytest-cov=7.1.0
   - pip:
       - langgraph==1.2.6
       - rank-bm25==0.2.2

pyproject.toml

@@ -42,11 +42,11 @@ torch-cpu = ["torch==2.12.1+cpu"]  # Minimum safe version post CVE-2025-32434 (w
 # Optional Postgres backend for the soul DB + rate limiter (CYCLAW_DB_URL). Stays
 # OUT of the base deps so the default SQLite/offline-first install is zero-extra;
 # psycopg is lazy-imported, so installs without this extra never load it.
-postgres = ["psycopg[binary]>=3.2.0"]
+postgres = ["psycopg[binary]==3.2.13"]
 # Optional pgvector vector backend (indexing.vector_backend: pgvector). Superset of
 # `postgres` — adds the pgvector adapter; ChromaDB remains the default vector store.
-pgvector = ["psycopg[binary]>=3.2.0", "pgvector>=0.3.6"]
-full = ["torch==2.12.1+cpu", "pytest==9.1.1", "pytest-asyncio==1.4.0", "ruff==0.15.20", "mypy==2.1.0", "bandit==1.9.4", "pytest-cov==7.1.0", "psycopg[binary]>=3.2.0", "pgvector>=0.3.6"]
+pgvector = ["psycopg[binary]==3.2.13", "pgvector==0.4.2"]
+full = ["torch==2.12.1+cpu", "pytest==9.1.1", "pytest-asyncio==1.4.0", "ruff==0.15.20", "mypy==2.1.0", "bandit==1.9.4", "pytest-cov==7.1.0", "psycopg[binary]==3.2.13", "pgvector==0.4.2"]
 
 [project.scripts]
 cyclaw-server = "gate:main"

requirements.txt

@@ -38,8 +38,8 @@ pytest-cov==7.1.0
 
 # Optional Postgres / pgvector backends (NOT installed by default — the base install
 # stays SQLite + ChromaDB, offline-first). Enable via the pyproject extras instead:
-#   pip install 'cyclaw[postgres]'   # soul DB + rate limiter over Postgres (CYCLAW_DB_URL)
-#   pip install 'cyclaw[pgvector]'   # also the pgvector vector backend
+#   pip install 'cyclaw[postgres]' -c constraints.txt   # soul DB + rate limiter over Postgres (CYCLAW_DB_URL)
+#   pip install 'cyclaw[pgvector]' -c constraints.txt   # also the pgvector vector backend
 # psycopg / pgvector are lazy-imported, so leaving these out costs nothing.
 # psycopg[binary]>=3.2.0
 # pgvector>=0.3.6