chore(agentic-ci): declare numpy as direct dep of data-designer-engine

[github-actions]

Summary

Declare numpy as a direct dependency of data-designer-engine.

Why

Per AGENTS.md and the dependencies-suite audit (2026-05-19): the
engine imports numpy directly but only data-designer-config
declared it. Engine relied on transitive resolution via the config
package, which works for the monorepo install but is fragile if
data-designer-engine is ever installed standalone, and it bypasses
the "each package declares what it directly imports" contract.

Direct imports detected:

• packages/data-designer-engine/src/data_designer/engine/sampling_gen/constraints.py
  (from numpy.typing import NDArray at module import time, plus
  import numpy as np under TYPE_CHECKING)
• packages/data-designer-engine/src/data_designer/engine/sampling_gen/data_sources/base.py
  (TYPE_CHECKING-guarded import numpy as np and
  from numpy.typing import NDArray)

(Audit also flagged additional engine modules using numpy via the
lazy-import system — those will be covered by their own findings if
present; this PR only adds the missing declaration.)

What changed

A single line — "numpy>=1.23.5,<3", — added to the
[tool.hatch.metadata.hooks.uv-dynamic-versioning].dependencies list
in packages/data-designer-engine/pyproject.toml, in alphabetical
position between networkx and python-multipart. The specifier is
copied verbatim from packages/data-designer-config/pyproject.toml
where numpy>=1.23.5,<3 is already declared, so no version-range
reconciliation is required.

Tests

• make install-dev resolved the lockfile cleanly (only the engine's
  own version metadata changed in uv.lock).
• make test-engine — 2055 passed in 34.91s.

Provenance

Generated by the agentic-ci dependencies suite (daily run,
2026-05-19). Finding id b10e09fc453c, fix confidence 0.85, severity
high (heavy import bypassing the declared-deps contract).

[greptile-apps]

Greptile Summary

Declares numpy as a direct dependency of data-designer-engine to honour the monorepo contract that each package lists every package it directly imports. Previously the engine relied on transitive resolution through data-designer-config.

• Adds a single line \"numpy>=1.23.5,<3\" to the engine's pyproject.toml dependency list, in alphabetical position between networkx and python-multipart.
• The version specifier is identical to the one already in data-designer-config, so no version-range reconciliation is required and the lockfile change is minimal.

Confidence Score: 5/5

A one-line addition to a dependency list with no logic changes; safe to merge.

The change adds a single dependency declaration that is already present in a sibling package with an identical version range, and the PR description confirms the lockfile resolved cleanly and all tests passed. There is nothing to go wrong here.

No files require special attention.

Important Files Changed

Filename	Overview
packages/data-designer-engine/pyproject.toml	Adds numpy>=1.23.5,<3 as a direct dependency in alphabetical order, matching the version range already declared in data-designer-config.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[data-designer-engine] -->|direct dep| B[data-designer-config]
    A -->|direct dep — NEW| C[numpy>=1.23.5,<3]
    B -->|direct dep| C
    A -->|direct dep| D[scipy>=1.11.0,<2]
    D -->|requires| C

Loading

_{Reviews (1): Last reviewed commit: "chore(agentic-ci): declare numpy as dire..." | Re-trigger Greptile}