fix #20: [11] requirements-prod.txt and requirements.txt differ by 20 major versions on critical packages

[CuriosityQuantified]

Closes #20

Problem

requirements.txt and requirements-prod.txt diverged by major versions on critical packages: groq 0.4.1 (prod) vs 0.24.0 (dev), pydantic 2.6.0 (prod) vs 2.11.3 (dev). Prod also carried obsolete google-generativeai==0.3.2 (Gemini was removed) and redis==5.0.1 (never used). Worse, prod omitted the entire langchain family that services/llm_service.py and services/simulation_service.py import — so a prod install that "works in dev" would ImportError at boot.

Fix — one coherent, reproducible dependency contract

• requirements-prod.txt: every shared package now pins the exact same version as requirements.txt (groq 0.4.1→0.24.0, pydantic 2.6.0→2.11.3, fastapi/uvicorn/requests/aiohttp >=→==). Added the runtime langchain deps that were missing (langchain, langchain-core, langchain-groq, langchain-text-splitters). Removed google-generativeai and redis. Prod = runtime subset of dev, omitting only test tooling (pytest, pytest-asyncio, httpx).
• requirements.txt: removed redis and langchain-openai (0 imports anywhere).
• env.example: removed OPENAI_API_KEY (0 code usage) and the REDIS_* block (unused). Kept GOOGLE_API_KEY — still read by api/app.py init and documented in README (out of scope to remove; not requested by the issue).

Investigation (imports verified, not assumed)

• Used at runtime: langchain/langchain_groq (llm_service, simulation_service), groq (groq_tts_service, llm_service), plus fastapi/uvicorn/pydantic/boto3/aiohttp/requests/huggingface_hub/python-multipart/python-dotenv.
• 0 imports: redis, langchain-openai. google-generativeai not imported (only commented-out Gemini code; the tests/test_gemini.py fossil imports the different google.genai/google.adk packages and is not CI-collected). Left the pre-existing fossil/docs untouched to avoid scope creep.

New regression coverage

tests/unit/test_requirements_alignment.py — hermetic (stdlib + pytest only, no network, no app import). Fails if:

• the two files diverge on any shared package's version specifier,
• an obsolete package (redis/google-generativeai/langchain-openai) returns to either file,
• a runtime dep drops out of prod (dev - prod == {pytest, pytest-asyncio, httpx} exactly),
• env.example regains OPENAI_API_KEY or any REDIS_* var.

CI

Added a named "Run requirements alignment regression" step to the unit-tests job. Repo's 3-job shape preserved (unit-tests, regressions, build) — no code-graph job (repo has no graphify-out/).

Files changed

• requirements.txt
• requirements-prod.txt
• env.example
• tests/unit/test_requirements_alignment.py (new)
• .github/workflows/ci.yml

Tests / checks (local)

• Python unit (CI-equivalent, 8 deselects): 209 passed, 1 skipped, 8 deselected (was 184 baseline; +25 new).
• New regression alone: 25 passed; negative sanity check confirmed it fails when divergence/obsolete entries are reinjected.
• Runtime import smoke: langchain, langchain_groq, groq, fastapi, pydantic, boto3, aiohttp, requests all import OK.
• Next.js npm run build: success.

Four-subagent pipeline outcomes

1. Implementation + CI: reconciled files, new regression, CI step. No commit.
2. Code review (mattpocock): 0 blockers, 2 benign nits (langchain ordering; explicit transitive pin). Adversarially confirmed the regression catches every divergence/obsolete/drop scenario.
3. Code simplifier: one safe no-op removal in the test ({n for n in X} → X); tests unchanged at 25 passed.
4. Security (claude-security scan-changes): no blocking findings; net security improvement (removes stale prod pins, shrinks attack surface). Secrets/CI-injection/test-file/availability all clean. INFO: python-multipart/huggingface_hub keep aligned >= floors (both fixed above known-CVE floors); optional pip-audit suggested. Live CVE DB lookup was unavailable this session.

Graph status: repo has no graphify-out/ and no code-graph CI job — none added.

Claude did not merge; Hermes owns merge after fail-closed CI verification.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
save-the-world	Ready	Preview	Aug 9, 2026 4:19pm
sim-local	Ready	Preview	Aug 9, 2026 4:19pm