atomic-agents-stack/pyproject.toml at main · dep0we/atomic-agents-stack · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
[build-system]
requires = ["hatchling"]
build-backend = "hatchling.build"

[project]
name = "atomic-agents-stack"
version = "2.0.0"
description = "Spec + reference implementation for vault-native, multi-runtime AI agents"
readme = "README.md"
requires-python = ">=3.11"
license = { text = "MIT" }
authors = [
    { name = "atomic-agents-stack contributors" },
]
keywords = ["ai", "agents", "llm", "anthropic", "claude", "openai", "framework"]
classifiers = [
    "Development Status :: 5 - Production/Stable",
    "Intended Audience :: Developers",
    "License :: OSI Approved :: MIT License",
    "Programming Language :: Python :: 3.11",
    "Programming Language :: Python :: 3.12",
    "Topic :: Software Development :: Libraries",
]
dependencies = [
    "anthropic>=0.40",
    "mcp>=1.0.0",
    "opentelemetry-api>=1.20,<2.0",
    "python-frontmatter>=1.1",
    "pyyaml>=6.0",
    "rich>=13.0",
]

[project.optional-dependencies]
openai = ["openai>=1.30"]
vertex = ["google-genai>=1.0"]
validation = ["jsonschema>=4.0"]
redis = ["redis>=5.0,<9.0"]
# postgres extra — psycopg 3 binary driver for PostgresLogBackend and
# PostgresMemoryBackend (#258 PR 1). Capped pin mirrors the redis>=5.0,<9.0
# pattern. Lazy-imported — base package startup does NOT load psycopg even
# when installed.
postgres = ["psycopg[binary]>=3.1,<4.0"]
# pgvector extra — Python pgvector client (vector type adapter for psycopg 3).
# SEPARATE from [postgres] so a Postgres-only deployment need not pull it in.
# Required for PgvectorMemoryBackend and PgvectorCorpusBackend. Lazy-imported;
# base package startup does NOT load pgvector even when installed.
pgvector = ["pgvector>=0.3.0"]
http = ["httpx>=0.27"]
# serve extra — thin HTTP wrapper for Cloud Run / containerized environments.
# Starlette (ASGI framework) + uvicorn (ASGI server). Opt-in only; base package
# import does not load these. See docs/spec/37-serve.md and atomic_agents/serve/.
serve = ["starlette>=1.0.1", "uvicorn>=0.20"]
# gcp extra: GCP Secret Manager backend for atomic_agents/secret_backend/gcp.py.
# Lazy-imported; base package startup does NOT load the SDK. See
# docs/spec/38-secret-backend.md. Single token alongside redis/postgres/vertex/otel/serve.
gcp = ["google-cloud-secret-manager>=2.16"]
# otel extra — OpenTelemetry SDK + OTLP/HTTP exporter for distributed tracing.
# opentelemetry-api is in core (zero cost when tracing off — the API ships a
# genuine no-op TracerProvider). The SDK and exporter are opt-in here because
# they add background threads, span processors, and the grpcio-free HTTP exporter
# dependency tree. HTTP exporter ONLY — no gRPC (avoids grpcio weight).
# See docs/spec/39-otel-export.md for the operator-facing surface.
otel = [
    "opentelemetry-sdk>=1.20,<2.0",
    "opentelemetry-exporter-otlp-proto-http>=1.20,<2.0",
]
dev = [
    "pytest>=8.0",
]

[project.scripts]
atomic-agents = "atomic_agents.cli:main"

[project.urls]
"Homepage" = "https://github.com/dep0we/atomic-agents-stack"
"Repository" = "https://github.com/dep0we/atomic-agents-stack"
"Issues" = "https://github.com/dep0we/atomic-agents-stack/issues"

[tool.hatch.build.targets.wheel]
packages = ["atomic_agents"]

[tool.pytest.ini_options]
testpaths = ["tests"]
python_files = ["test_*.py"]
# Suppress the deprecation warnings emitted by the ``atomic_agents._locks``
# shim (#60 PR 2 — sunset planned for v1.0). The shim is intentionally
# noisy on import to nudge operator migration; suppressing in the test
# suite keeps CI output focused on real warnings. Tests that positively
# assert the warning fires use ``warnings.catch_warnings(record=True)
# warnings.simplefilter('always')`` to override the filter locally.
filterwarnings = [
    # Filter by message text (not module path) because the shim's
    # ``warnings.warn(..., stacklevel=2)`` attributes the warning to the
    # caller's module, not ``atomic_agents._locks``.
    "ignore:atomic_agents\\._locks\\.AgentLock is deprecated.*:DeprecationWarning",
    "ignore:atomic_agents\\._locks\\.acquire\\(\\) is deprecated.*:DeprecationWarning",
]

[dependency-groups]
dev = [
    "pytest>=9.0.3",
    # fakeredis for in-memory Redis simulation in the lock conformance
    # + integration tests (#60 PR 3). Dev-only — no production import
    # path depends on it.
    "fakeredis[lua]>=2.0",
    # psycopg[binary] for Postgres conformance + integration tests (#258 PR 1).
    # Dev-only — mirrors the fakeredis precedent (fakeredis for Redis,
    # psycopg[binary] for Postgres). Production import path is lazy-gated
    # behind the [postgres] optional extra.
    "psycopg[binary]>=3.1,<4.0",
    # pgvector Python client for PgvectorMemoryBackend/PgvectorCorpusBackend
    # integration tests (#200 PR 3). Dev-only — mirrors psycopg precedent.
    # Production import path is lazy-gated behind the [pgvector] optional extra.
    "pgvector>=0.3.0",
    # ruff for lint + format. Dev-only; CI runs pytest, not ruff,
    # but contributors run `uv run ruff check` locally before /ship.
    "ruff>=0.15.13",
    "pytest-cov>=7.1.0",
    # twine for pre-publish metadata validation (twine check dist/*).
    # Required for the v1.0.0 release ceremony and all future PyPI publishes.
    # Use alongside `uv build` before `uv publish`.
    "twine>=6.0",
    # opentelemetry-sdk for tracing seam conformance tests (#341 PR 1).
    # Dev-only — mirrors the fakeredis/psycopg precedent: SDK installed in the
    # dev group so test_otel_tracing.py can exercise real spans; production
    # import path is lazy-gated behind the [otel] optional extra.
    "opentelemetry-sdk>=1.20,<2.0",
    "opentelemetry-exporter-otlp-proto-http>=1.20,<2.0",
    # google-cloud-secret-manager for GCP secret backend conformance tests (#340 PR 2).
    # Dev-only: mirrors the fakeredis/psycopg precedent. Production import path is
    # lazy-gated behind the [gcp] optional extra. google.api_core.exceptions must be
    # importable in the dev environment even when tests fake the SDK via mocking.
    "google-cloud-secret-manager>=2.16",
]

[tool.hatch.build.targets.sdist]
exclude = ["tests/", "docs/", "extras/", ".claude/", ".github/"]

# Security hygiene floors for transitive dependencies.
# idna: CVE-2026-45409 (triaged unreachable in this framework; hygiene bump 3.13->3.15).
# pyjwt: PYSEC-2026-175/177/178/179 (triaged unreachable; bump 2.12.1->2.13.0).
# These are pulled transitively (idna via httpx/anyio/requests; pyjwt via mcp).
# constraint-dependencies pins them for the lock without adding them to the
# user-visible project requirements.
[tool.uv]
constraint-dependencies = [
    "idna>=3.15",
    "pyjwt>=2.13.0",
]