# CI-only pip constraints (S4 fix).
#
# This is NOT a lockfile for the published package — skill-harness is a
# LIBRARY (see pyproject.toml's open-ended ">=" runtime pins, which stay
# open so downstream installers can resolve compatible versions in their own
# environment). Loosely-pinned library deps + no lockfile meant CI resolved
# "latest at run time" on every run: digest-pinned sandbox images and
# bit-equality determinism claims coexisted with an unpinned Python dep
# surface, so a fresh CI install could silently resolve different transitive
# versions than any published result was measured against.
#
# This file is consumed ONLY via `pip install -c requirements-ci.txt ...` in
# .github/workflows/ci.yml — it constrains CI's OWN installs to a known-good,
# actually-resolved snapshot (captured via `pip install -e ".[dev,geometry]"`
# into a clean venv, then `pip freeze`) without changing install semantics for a
# downstream consumer of the published package, who never sees this file.
#
# Regenerate after any pyproject.toml dependency change:
#   python -m venv /tmp/ci-clean-venv && /tmp/ci-clean-venv/bin/pip install -e ".[dev,geometry]" \
#     && /tmp/ci-clean-venv/bin/pip freeze | grep -v '^-e ' | sort > requirements-ci.txt
# (then restore this header — freeze doesn't preserve comments).
#
# The extra list is every extra any workflow installs, and [geometry] joined it
# for #589. Only the designated geometry cell installs that extra, but the file
# constrains what it resolves there, and an unconstrained browser dependency is
# the drift this file exists to stop.
#
# Captured 2026-07-19 from a clean venv running `pip install -e ".[dev]"`;
# jsonschema 4.26.0 (+ attrs/jsonschema-specifications/referencing/rpds-py)
# added 2026-08-10 for SERS conformance (#182; owner-approved 2026-08-09;
# python-jsonschema org reference implementation); playwright 1.63.0 and
# pytest-playwright 0.9.0 (+ greenlet/pyee/pytest-base-url/python-slugify/
# text-unidecode) added 2026-09-20 for the rendered-geometry harness (#589).
#
# Those seven were captured the way jsonschema was, by resolving the new extra
# AGAINST this file rather than re-resolving the whole environment, so every
# pre-existing pin is byte-identical and the diff is the browser surface alone.
# A full unconstrained re-freeze today is a larger and separate change: it drops
# pip-audit and tqdm, replaces httpcore/httpx with httpcore2/httpx2, and adds
# eleven pre-commit transitives this snapshot has never carried.
Pygments==2.20.0
annotated-types==0.8.0
anthropic==1.15.0
anyio==4.15.1
ast_serialize==0.13.0
attrs==26.1.0
certifi==2026.10.19
charset-normalizer==3.5.1
click==8.5.0
colorama==0.4.6
coverage==7.16.0
distro==1.9.0
docstring_parser==0.18.0
execnet==2.1.2
greenlet==3.5.6
h11==0.16.0
httpcore==1.0.9
httpx==0.28.1
hypothesis==6.168.3
idna==3.20
iniconfig==2.3.0
jiter==0.16.0
jsonschema-specifications==2025.9.1
jsonschema==4.26.0
librt==0.15.0
markdown-it-py==4.2.0
mdurl==0.1.2
mypy==2.3.1
mypy_extensions==1.1.0
numpy==2.5.3
openai==3.31.0
packaging==26.3
pandas==3.0.5
pathspec==1.1.1
patsy==1.0.3
pip-audit==2.10.1
playwright==1.63.0
pluggy==1.6.0
pydantic==2.14.1
pydantic_core==2.50.1
pyee==13.0.1
pytest-cov==7.1.0
pytest-randomly==5.0.0
pytest-socket==0.8.1
pytest-xdist==3.8.0
pytest==9.1.1
python-dateutil==2.9.0.post0
referencing==0.37.0
regex==2026.7.19
requests==2.34.2
rich==15.0.0
rpds-py==2026.6.3
ruff==0.16.1
scipy==1.18.1
six==1.17.0
sniffio==1.3.1
sortedcontainers==2.4.0
statsmodels==0.15.0
tiktoken==0.14.0
tqdm==4.70.1
typing-inspection==0.4.4
typing_extensions==4.16.0
tzdata==2026.3
urllib3==2.8.0
