[itswl]

Dependabot's first proposal for the investigator's runtime since #35, plus the pipe's and the judge's test tooling, relocked as one change. A second commit sets one engine option the new SDK brings, because reading the SDK's changelog for this bump turned up a hole the guard could not see.

Versions.

package	service	before	after
claude-agent-sdk	investigator	0.2.140	0.2.176
fastapi	investigator	0.141.1	0.162.0
uvicorn	investigator	0.52.4	0.54.0
pytest	all three	9.1.1	9.2.0
ruff	all three	0.17.2	0.17.3
mypy	all three	2.4.0	2.4.1

Exact pins follow the bot and floors take the newest, so the SDK is 0.2.176 where the bot proposed 0.2.175; the newer release only updates the bundled CLI. Each version has its upstream tag, and nothing else moved in the locks. The investigator's setuptools build floor rises to 84.2.1 as proposed.

The CLI the engine runs moves too. The SDK wheel bundles a Claude Code CLI and looks for it before anything on PATH. Read back from the images:

image	CLI the engine runs	npm CLI on PATH
published 0.9.2	2.1.235	2.1.259
this branch	2.1.316	2.1.259

So the Dockerfile's CLAUDE_CODE_VERSION has not decided the engine's CLI since the SDK began bundling one; the lock has. This pull request does not change that. Whether the image should drop the npm CLI or point the engine at it is left to the operator.

What verified the SDK bump. The gate's tests replace the SDK client, so they cannot. mypy checks the engine's options against 0.2.176's types and is clean; it rejects a made-up option name, so the check is real. The changelog for 0.2.141 to 0.2.176 is bundled-CLI updates plus additive options and typing. And the real service ran in both images against a recording stand-in for the model API on an internal Docker network, under a third-party model name:

image	turn completed	allowed read ran	protected write refused, no file left	@path file reached the model	/cost show me reached the model
published 0.9.2	yes	yes	yes	yes	no, it ran as a CLI command
this branch	yes	yes	yes	no	yes, as text

Not verified: a real model. None is reachable from here, so an investigation with real tool choices on CLI 2.1.316 is still unobserved. The new CLI words the guard's refusal as PreToolUse:Bash hook error: input guard: …; the write is still refused.

The message reaches the model as words. SDK 0.2.158 added verbatim_prompts. Without it, an @path anywhere in alert or chat text made the CLI read that file and hand it to the model as a Read result no PreToolUse hook saw, so neither the guard nor the audit knew; and a message starting with / ran a CLI command instead of an investigation. The second commit sets it, with a test, a guard mutation that requires the test to fail, the containment row, and a decision note. No message the service builds relies on either expansion.

Images. The SDK, fastapi and uvicorn are runtime for the investigator, so its image changes at the next release. Nothing is deployed.

Supersedes #36, #37 and #38.

Gate: STACK GATE GREEN locally; CI read back before merging.