[infra] - Keep Dependabot out of locks/ and split pip majors into their own PR by cgfixit · Pull Request #1726 · cgfixit/CyClaw

cgfixit · 2026-10-20T13:39:19Z

Proposed changes

Dependabot's pip PRs have been red by construction. #1717 and #1724 (a 54/55-package pip-all batch) each rewrote every hashed lock in locks/ but never the locks/runtime-inputs.json / locks/ci-inputs.json records. scripts/check_lock_contract.py therefore failed them, and every one conflicted with any other lock change. The locks can only be regenerated by scripts/refresh-runtime-lock.sh / refresh-ci-locks.sh on arm64 macOS, which Dependabot cannot run.

This PR changes only .github/dependabot.yml, and only its pip block:

Setting	Before	After	Why
`exclude-paths`	—	`locks/**`	Dependabot moves pins only in `constraints.txt` / `pyproject.toml` / `requirements*.txt`; the operator re-locks on the Mac
`schedule`	weekly, Tuesday	monthly	each PR costs a Mac re-lock, so weekly 50-package batches only went stale
`groups`	one `pip-all`	`pip-minor-patch` + `pip-major`	majors (huggingface-hub 1.32 → 2.2 and websockets 15 → 17 rode inside #1724) arrive in their own PR

Majors are grouped, not ignored. GitHub's options reference marks ignore as also affecting security updates, so ignoring majors could silence a security fix that only ships as a major.

The header comment is corrected too. It claimed constraints.txt is never fetched, and #1717/#1724 both edited it. Why Dependabot reads it now is marked unverified. The header also states what a pip PR now is, a shopping list rather than a merge candidate, and points at the daily pip-audit cron on main as the backstop for indirect dependencies that have no constraints.txt pin.

Docker and github-actions are unchanged.

Invariant / Governance Impact: none. Config for a GitHub bot; no code path changes.

Types of changes

Dependencies (added, removed, or bumped)
CI / infrastructure (workflows, hooks, templates, or checkers)

Scope: Infrastructure / CI only.

Benefits / why

A pip PR is a reviewable diff of pins, not ~1,400 lines of hash churn per lock file.
No more lock-file conflicts between Dependabot and real lock changes.
A major bump gets its own PR and its own decision.
Fewer re-lock cycles: at most two pip PRs a month instead of a weekly batch.

Risks to monitor

pip PRs stay red until you push a Mac re-lock onto the branch, because runtime-inputs.json hashes constraints.txt. That is intended. The workflow is in locks/README.md under "Changing a pin".
Indirect dependencies without a constraints.txt pin get no Dependabot PR. Before [security] - Pin aiohttp to 3.14.4 for three pip-audit advisories #1715, aiohttp was only visible in the locks, and that is how Bump aiohttp from 3.14.3 to 3.14.4 in /locks in the pip group across 1 directory #1718 happened. The daily pip-audit cron on main catches those.
- I am deliberately not proposing to make scan a required check. pip-audit.yml only runs on PRs that touch dependency paths, so a required scan would never report on other PRs and would block them.
exclude-paths is documented for version updates only. A Dependabot security update could still touch locks/. If one does, treat it like Bump the pip-all group across 1 directory with 55 updates #1724.
Unverified here: that GitHub accepts the new keys. GitHub validates dependabot.yml on push to the default branch and reports errors in the repo's Dependabot view. The syntax follows the current options reference (exclude-paths, groups.*.update-types with minor/patch/major, interval: monthly). The file parses as YAML locally.

Checklist

I have read docs/THREAT_MODEL.md, INVARIANTS.md and SECURITY.md (and any relevant Phase docs)
This change preserves all 6 security invariants and I6 module isolation (no code touched)
Full sandbox validation has been run (per CLAUDE.md §5, left to CI)
No new external network dependencies or mandatory online LLM assumptions were introduced
Commit messages follow the title prefix convention above

Further comments

Run directly:

YAML parse of .github/dependabot.yml.
python3 .claude/skills/dep-guard/check_deps.py: 0 failures, 0 warnings.

Only GitHub can check: Dependabot's own schema validation, after merge.

Companion: #1724 is closed in favour of this PR. Dependabot should open a fresh, lock-free PR on its next monthly run after this merges.

Suggested merge order of open PRs

Trial merges verified (git merge --no-commit --no-ff + abort, each on its own) against main @ cdcef76 on 2026-10-20.

This PR · Blocked (draft)
Impact: Dependabot pip config only.
Action: Merge when CI is green. Clean; touches no file the other PR does.

Installer test timeout PR · Blocked (draft)
Impact: tests/test_installer_python_contract.py timeout and diagnostics.
Action: Independent; either order. Clean.

ELI5

Dependabot is a helper that checks for newer versions of the packages CyClaw uses and opens PRs to bump them. It has been rewriting the sealed, hash-checked package lists in locks/ too. Those lists can only be regenerated by a script on the Mac, and the helper's edits never updated the seal records next to them, so every one of its PRs failed CI and fought with real lock changes.

Now .github/dependabot.yml tells it to keep out of locks/ entirely. Its PRs only change the human pin files, which makes them a shopping list: you check one out on the Mac, re-lock, and push. It also runs monthly instead of weekly, and big version jumps come in their own PR, so they don't hide inside a 55-package batch.

Enhances: small, readable bump PRs.
Obsoletes: red-by-design lock rewrites.
Retrieves: the original rule in that file's own comment ("Dependabot cannot regenerate hashes").
Reverses when pushed to extremes: if you never do the re-lock, the shopping lists pile up unread, and the daily pip-audit run becomes the only alarm.

I checked that the file parses and that dep-guard is clean. GitHub's acceptance of the new keys shows only after merge.

🤖 Generated with Claude Code

https://claude.ai/code/session_014FZ8JTF2v1eQd1L5CKQR8j

Last updated: 2026-10-20 09:55 ET

Generated by Claude Code

…ir own PR Dependabot's pip-all PRs (#1717, #1724) rewrote every hashed lock without the locks/*-inputs.json records, so the lock contract failed them by construction and each one conflicted with any other lock change. pip now: - excludes locks/** (exclude-paths); pins move only in constraints.txt, pyproject.toml and requirements*.txt, and the operator re-locks on the Mac - runs monthly instead of weekly, since every PR costs a re-lock - groups minor+patch together and majors separately, so a major such as huggingface-hub 1->2 is reviewed on its own (grouped, not ignored, because ignore rules also suppress security updates) Also corrects the header comment that said constraints.txt is never fetched. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014FZ8JTF2v1eQd1L5CKQR8j

Comment-only; the parsed config is byte-identical before and after. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014FZ8JTF2v1eQd1L5CKQR8j

…c removal and extras drop Doc pass against main @ cdcef76 with the two open PRs (#1726, #1727) treated as merged; the deterministic checkers (doc-sync, dep-guard, env drift, lock contract, invariant-guard) were already green, so every change is prose. - README: the agentic loop no longer appears in the ship-off list, the security-model row or "Current development"; the docs map stops crediting setup-guide.md with Docker/conda and gains locks/README.md. - setup-guide.md: the self-install line is `pip install -e . -c constraints.txt` on Linux/Windows and `pip install -e . --no-deps` on macOS (the old `/tmp/constraints-macos.txt` no longer exists, and the install goes through the hashed locks, not requirements.txt); the lock contract covers 19 locks, not 25; "step 4b" is step 4; the stranded lock-freshness section sits above the footer; reconciled date 2026-10-20. - locks/README.md: records that constraints.txt and requirements*.txt are hashed byte-for-byte into the lock records, and what a Dependabot pip PR is under the #1726 config. - docs/DOCKER.md, macos/README.md, powershell/README.md, AGENTS.md, CLAUDE.md section 8: stale agentic-registry/agentic-writes wording, the verify-deps name, and the macOS note on the editable install. - docs/audits/2026-10-20-dependency-currency-sweep.md: PyPI currency and advisory sweep over all 42 pins. No pin changed: the hashed locks regenerate only on arm64 macOS and the contract hashes the manifests, so bump candidates are listed for the owner. 0 new advisories. Checks run directly: doc_sync.py, check_deps.py, check_env_drift.py, check_lock_contract.py, check_invariants.py (all 0 failures); `pip install --dry-run --no-deps -e .` in a 3.12 venv. CI only: everything else. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0196C68GFwq9cXGmpqDMDGJe

…c removal and extras drop (#1731) ## Proposed changes Documentation and dependency resync against `main` @ `b0683515` (after #1726 and #1727 merged). The five deterministic checkers (doc-sync D1-D13, dep-guard D1-D11, env drift E1-E7, `check_lock_contract.py`, invariant-guard) were already green, so every change here is prose plus one dated audit. **No pin, lock, manifest, or code line changes.** - `README.md`: the removed agentic coding loop no longer appears in the ship-off list, the security-model "Optional surfaces" row, or "Current development"; the docs map stops crediting `setup-guide.md` with Docker/conda and gains a `locks/README.md` row. - `setup-guide.md`: the editable self-install is `pip install -e . -c constraints.txt` on Linux/Windows and `pip install -e . --no-deps` on macOS. The old text pointed at `/tmp/constraints-macos.txt` (exists nowhere in the repo) and said the install went through `requirements.txt` (it goes through the hashed locks). Lock count 25 -> 19 (six locks left with #1700). "step 4b" -> step 4 (no 4b exists). The lock-freshness section was stranded after the footer and now sits above it. Reconciled date 2026-10-20. Option C step 5 notes `GH_TOKEN` is optional and unread by the runtime. - `locks/README.md`: records that `constraints.txt`, `requirements*.txt` and `scripts/ci-lock-inputs/` are hashed byte-for-byte into the lock records (a comment edit alone fails the contract), and a Dependabot section matching #1726. - `docs/DOCKER.md`, `macos/README.md`, `powershell/README.md`: "agentic registry" / "agentic writes" / "Agentic / registry" wording replaced with what exists (model caches, fsconnect writes, connectors). - `AGENTS.md`: `verify-dep` -> `verify-deps`. `CLAUDE.md` §8: one trailing comment on the macOS editable install. Both files steer agent sessions; the diff is those two lines, nothing copied from any external source. - `docs/audits/2026-10-20-dependency-currency-sweep.md` (new) and a `docs/changelog.txt` row: PyPI currency + per-release advisory sweep over all 42 pins. 0 new advisories (chromadb and nltk remain the two accepted in `SECURITY.md`). Bump candidates are grouped for the owner; the stale `constraints.txt` pydantic comment is flagged but left alone because fixing it would re-hash the file. **Invariant / Governance Impact:** none. No core file, graph edge, config value, sanitizer pattern, auth path, or manifest changed. `check_invariants.py`: 46 passed, 0 failed on the pushed head. --- ## Types of changes - [ ] Bugfix (non-breaking change which fixes an issue) - [ ] New feature (non-breaking change which adds functionality) - [ ] Breaking change (fix or feature that would cause existing functionality to not work as expected) - [ ] Security (auth, privacy, injection, egress, redaction, or secrets) - [ ] Invariant / Governance refinement (use this for changes that strengthen or evolve the 6 invariants, I6 isolation, or harness phases) - [ ] Dependencies (added, removed, or bumped) - [ ] CI / infrastructure (workflows, hooks, templates, or checkers) - [ ] Refactor or tests (behavior-preserving, no new capability) - [x] Documentation update - [ ] Other (none of the boxes above fit) Scope note: Docs + audits. --- ## Benefits / why - An operator following `setup-guide.md` on macOS was told to pass a constraints file that does not exist; the new line (`--no-deps`) was run and resolves. - README, Docker and installer docs stop describing a subsystem removed two days ago (#1699/#1700), so a reader cannot go looking for the agentic loop, registry, or `/ops/agentic`. - `locks/README.md` now states the one rule that bites a would-be contributor: the manifests are hashed, so a pin or comment edit needs the Mac re-lock. Dependabot's role (#1726) is documented where the locks live. - The currency sweep gives the owner a reviewed bump list without landing a red lock contract. --- ## Risks to monitor - Prose only; the only executable claim is the macOS `pip install -e . --no-deps` line. Signal if wrong: `cyclaw-*` shims missing after that command on a Mac. Verified on Linux 3.12 only (dry-run, "Would install cyclaw-1.9.0"); not run on macOS. - `doc_sync.py` D9/D10 would catch a broken link or anchor from the moved section; it reports 0 drift on the head. - The sweep is a point-in-time PyPI read (2026-10-20); it is not a pin change and goes stale like every dated audit. --- ## Checklist - [x] I have read `docs/THREAT_MODEL.md`, `INVARIANTS.md` and `SECURITY.md` (and any relevant Phase docs) - [x] This change preserves all 6 security invariants and I6 module isolation (explicit evidence or invariant matrix included for core changes) - [ ] Full sandbox validation has been run (docs-only; per CLAUDE.md §5 the suites are CI's to run) - [x] No new external network dependencies or mandatory online LLM assumptions were introduced without explicit justification + offline fallback path - [ ] For any agentic/fsconnect change: n/a - [x] Relevant architecture docs or threat model notes have been updated if core behavior or topology changed - [x] Commit messages follow the title prefix convention above - [ ] For large or complex changes: n/a --- ## Further comments Checks run directly on the pushed head: `doc_sync.py` (0 drift), `check_deps.py` (0/0), `check_env_drift.py` (0/0), `check_lock_contract.py` (passed), `check_invariants.py` (46/0), a lock-vs-constraints agreement pass over 148 shared entries, and `pip install --dry-run --no-deps -e .` in a Python 3.12 venv. CI only: ruff, the four test legs, coverage, pr-template-check. --- ## Suggested merge order of open PRs _Trial merges verified against main @ b068351 on 2026-10-20: this branch is rebased directly onto that SHA (fast-forward, nothing to merge)._ **#1728** · Blocked Impact: Dependabot Docker base 3.12 -> 3.15; `requires-python <3.13`, so this cannot merge as proposed. Action: Close or re-pin; independent of this PR. **#1729** · Blocked Impact: Dependabot pip minor+patch, 16 packages; red on the lock contract until the Mac re-lock (see `locks/README.md` Dependabot section in this PR). Action: Owner re-locks on arm64 macOS, then merge; does not touch this PR's files. **this PR** · Safe Impact: Docs and one audit only; no shared file with #1728/#1729. Action: Merge any time; squash. ## ELI5 The code moved on (the agentic coding loop and its extras were deleted last week, the lock set shrank, Dependabot got new rules) and the instruction manuals did not. This PR is the manual catching up; it changes no behavior. - **What was broken or missing:** like a museum map still showing a wing that was demolished. `README.md`, `docs/DOCKER.md` and the macOS/PowerShell READMEs still named the agentic loop, its registry and its writes. `setup-guide.md` told Mac users to pass `-c /tmp/constraints-macos.txt` (a file nothing creates), said the install went through `requirements.txt` (it goes through `locks/`), counted 25 locks (there are 19), referenced a "step 4b" that does not exist, and had its lock-freshness section sitting after the signature line. - **What changed:** those sentences now say what the tree does. The macOS self-install is `pip install -e . --no-deps`, because `constraints.txt` pins `torch==2.13.0+cpu` and no such wheel exists for macOS. `locks/README.md` gains two facts: the manifests are hashed into the lock records byte-for-byte, and a Dependabot pip PR is a shopping list until someone re-locks on the Mac. A new dated audit lists every pin against PyPI today with advisories checked per pinned release; two advisories exist (chromadb, nltk) and both were already accepted in `SECURITY.md`. Deliberately not done: no pin bumped, no `constraints.txt` comment fixed, because either one turns `check_lock_contract.py` red until the arm64 re-lock. - **What could still go wrong:** the only runnable claim is the macOS `--no-deps` line. It was dry-run on Linux 3.12 and resolved; it was not run on a Mac. If it is wrong, `cyclaw-user` and friends stay "command not found" after it. Everything else is words; `doc_sync.py` D9/D10 guard the links and anchors and report 0 drift. Last updated: 2026-10-20 10:12 ET --- _Generated by [Claude Code](https://claude.ai/code/session_0196C68GFwq9cXGmpqDMDGJe)_

This was referenced Oct 20, 2026

Bump the pip-all group across 1 directory with 55 updates #1724

Closed

[fix] - Give the installer contract tests headroom and fail fast on prompts #1727

Merged

[docs] - Reword the locks note in the dependabot.yml header comment

f68700f

Comment-only; the parsed config is byte-identical before and after. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014FZ8JTF2v1eQd1L5CKQR8j

cgfixit marked this pull request as ready for review October 20, 2026 14:05

cgfixit merged commit b068351 into main Oct 20, 2026
60 checks passed

cgfixit deleted the claude/dependabot-skip-locks branch October 20, 2026 14:06

This was referenced Oct 20, 2026

ci tightening #1709

Open

[docs] - Resync README, setup guide and install docs after the agentic removal and extras drop #1731

Merged

Navigation Menu

Repository navigation

[infra] - Keep Dependabot out of locks/ and split pip majors into their own PR - #1726

[infra] - Keep Dependabot out of locks/ and split pip majors into their own PR#1726
cgfixit merged 2 commits into
mainfrom
claude/dependabot-skip-locks

cgfixit commented Oct 20, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

cgfixit commented Oct 20, 2026

Proposed changes

Types of changes

Benefits / why

Risks to monitor

Checklist

Further comments

Suggested merge order of open PRs

ELI5

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants