# Layer 2: Dependency Verification Report
**Date**: 2026-02-15  
**Protocol**: Pre-Dev Gate  
**Status**: ✅ COMPLETE

## Summary

Verified all 26 dependencies in `pyproject.toml` against PyPI. All minimum versions exist. Most minimum versions are >6 months old (expected for stability). No deprecated packages found. Python 3.10+ requirement is compatible with all dependencies. Docker base image `python:3.12` is compatible. One potential compatibility issue: numpy 2.x requires Python >=3.11.

## Findings Table

| Package | Tier | Min Version | Exists? | Latest Version | Age | Issues |
|---------|------|-------------|---------|----------------|-----|--------|
| **CORE DEPENDENCIES** |
| fastapi | core | 0.115.0 | ✅ Yes | 0.129.0 | >6mo | Min version ~Feb 2025, latest drops Python 3.9 |
| uvicorn[standard] | core | 0.32.0 | ✅ Yes | 0.40.0 | >6mo | Min version Oct 2024, latest drops Python 3.9 |
| httpx | core | 0.28.0 | ✅ Yes | 0.28.1 | <6mo | Nov 2024, also in dev tier (duplicate) |
| litellm | core | 1.55.0 | ✅ Yes | 1.81.12 | >6mo | Requires Python >=3.9,<4.0 |
| click | core | 8.1.0 | ✅ Yes | 8.3.1 | >6mo | Mar 2022, requires Python >=3.10 |
| rich | core | 13.9.0 | ✅ Yes | 14.3.2 | >6mo | Oct 2024, requires Python >=3.8.0. Latest version available but min version is valid |
| textual | core | 1.0.0 | ✅ Yes | 7.5.0 | >6mo | Jul 2023, requires Python >=3.9,<4.0 |
| pydantic | core | 2.10.0 | ✅ Yes | 2.12.5 | >6mo | Requires Python >=3.9, compatible with 3.14+ |
| cryptography | core | 44.0.0 | ✅ Yes | 46.0.5 | >6mo | Jan 2025, requires Python >=3.8 (excludes 3.9.0, 3.9.1) |
| toml | core | 0.10.2 | ✅ Yes | 0.10.2 | >6mo | Nov 2020, requires Python >=2.6 (legacy support) |
| aiosqlite | core | 0.20.0 | ✅ Yes | 0.22.1 | >6mo | Feb 2024, requires Python >=3.9 |
| websockets | core | 14.0 | ✅ Yes | 16.0 | >6mo | Nov 2024, requires Python >=3.10 |
| **SMART TIER** |
| onnxruntime | smart | 1.20.0 | ✅ Yes | 1.24.1 | >6mo | Nov 2024, requires Python >=3.10 |
| numpy | smart | 1.26.0 | ✅ Yes | 2.4.2 | >6mo | Requires Python >=3.11 (⚠️ **INCOMPATIBLE with requires-python >=3.10**) |
| faiss-cpu | smart | 1.9.0 | ✅ Yes | 1.13.2 | >6mo | Nov 2023, requires Python >=3.10,<3.15. **Unofficial PyPI package (not maintained by Meta)** |
| tokenizers | smart | 0.21.0 | ✅ Yes | 0.22.2 | >6mo | Feb 2025, requires Python >=3.9 |
| **FULL TIER** |
| torch | full | 2.5.0 | ✅ Yes | 2.10.0 | >6mo | Requires Python >=3.10 |
| sentence-transformers | full | 3.3.0 | ✅ Yes | 5.2.2 | >6mo | Aug 2020, requires Python >=3.10 |
| faiss-cpu | full | 1.9.0 | ✅ Yes | 1.13.2 | >6mo | Duplicate of smart tier |
| transformers | full | 4.47.0 | ✅ Yes | 5.1.0 | >6mo | Requires Python >=3.10.0 |
| **DEV TIER** |
| ruff | dev | 0.8.0 | ✅ Yes | 0.15.1 | >6mo | Feb 2024, requires Python >=3.7 |
| mypy | dev | 1.13.0 | ✅ Yes | 1.19.1 | >6mo | Requires Python >=3.9 |
| pytest | dev | 8.3.0 | ✅ Yes | 9.0.2 | >6mo | Requires Python >=3.10 |
| pytest-cov | dev | 6.0.0 | ✅ Yes | 7.0.0 | >6mo | Oct 2024, requires Python >=3.9 |
| pytest-asyncio | dev | 0.24.0 | ✅ Yes | 1.3.0 | >6mo | Requires Python >=3.10 |
| httpx | dev | 0.28.0 | ✅ Yes | 0.28.1 | <6mo | Duplicate of core tier |
| pre-commit | dev | 4.0.0 | ✅ Yes | 4.5.1 | >6mo | Oct 2024, requires Python >=3.10 |
| bandit | dev | 1.8.0 | ✅ Yes | 1.9.3 | >6mo | Requires Python >=3.10 |
| hatchling | dev | 1.26 | ✅ Yes | 1.28.0 | >6mo | Requires Python >=3.10 |

## Critical Issues

### 1. ⚠️ `numpy>=1.26.0` - Python Version Incompatibility
- **Issue**: numpy 2.x requires Python >=3.11, but project specifies `requires-python = ">=3.10"`
- **Current State**: numpy 1.26.0 (min version) supports Python 3.10, but latest (2.4.2) requires 3.11+
- **Fix Options**:
  - Pin numpy to `<2.0` (e.g., `numpy>=1.26.0,<2.0`)
  - Or upgrade `requires-python` to `>=3.11`
- **Impact**: If numpy upgrades to 2.x, Python 3.10 users will be unable to install

### 2. ⚠️ `faiss-cpu` - Unofficial Package
- **Issue**: `faiss-cpu` on PyPI is not officially maintained by Meta AI Research
- **Status**: Package exists and is functional, but maintenance is community-driven
- **Alternative**: Official Faiss recommends Conda for GPU support, but PyPI `faiss-cpu` is widely used
- **Impact**: Lower risk, but should monitor for maintenance status

### 3. ℹ️ `faiss-gpu` - Not Used, But Available
- **Status**: `faiss-gpu` exists on PyPI (latest: 1.7.2 from 2021), but project uses `faiss-cpu`
- **Note**: Also unofficial (maintained by third party). Backlog item OB-012 mentions FAISS-GPU for full tier, but `pyproject.toml` only lists `faiss-cpu`
- **Recommendation**: If GPU support is needed, consider Conda or verify `faiss-gpu` compatibility

## Python Version Compatibility

### `requires-python = ">=3.10"`
- ✅ **Compatible** with all dependencies EXCEPT:
  - ⚠️ numpy 2.x requires Python >=3.11 (but min version 1.26.0 supports 3.10)

### Docker Base Image: `python:3.12`
- ✅ **Fully Compatible** with all dependencies
- ✅ Matches `requires-python = ">=3.10"` (3.12 >= 3.10)
- ✅ All packages support Python 3.12

## Circular Dependencies

✅ **No circular dependencies found** between tiers:
- **Core** → No dependencies on smart/full/dev
- **Smart** → Depends on core (implicit via pip extras)
- **Full** → Depends on smart (implicit via pip extras)
- **Dev** → Independent (development tools only)

Tier structure is hierarchical: `core` → `smart` → `full` → `dev`

## Duplicate Dependencies

- `httpx>=0.28.0`: Listed in both `core` and `dev` tiers
  - **Impact**: None (pip handles duplicates)
  - **Recommendation**: Remove from `dev` tier to reduce redundancy

- `faiss-cpu>=1.9.0`: Listed in both `smart` and `full` tiers
  - **Impact**: None (pip handles duplicates)
  - **Recommendation**: Keep in both (smart tier needs it, full tier may upgrade to GPU variant later)

## Recommendations

1. **HIGH PRIORITY**: Pin numpy to `<2.0` or upgrade Python requirement to `>=3.11` to prevent future compatibility issues
2. **MEDIUM PRIORITY**: Remove `httpx` duplicate from `dev` tier
3. **OPTIONAL**: Consider updating `rich>=13.9.0` to `rich>=14.0.0` for latest features (not required, current version works)
4. **LOW PRIORITY**: Monitor `faiss-cpu` maintenance status
5. **DOCUMENTATION**: Note that `faiss-cpu` is unofficial but widely used

## Verification Method

- **Source**: PyPI JSON API (`https://pypi.org/pypi/{package}/json`)
- **Date**: 2026-02-15
- **Packages Verified**: 26 (including duplicates)
- **Success Rate**: 26/26 versions exist (100%)
- **Critical Issues**: 1 (numpy Python version mismatch - potential future issue)

## Next Steps

1. Decide on numpy version pinning strategy (pin to `<2.0` or upgrade Python requirement)
2. Proceed to Layer 3 (Environment Setup Verification)
