# Gateway runtime — exact pins for reproducible builds.
#
# The flagship `server.py` uses the mcp SDK's bundled FastMCP
# (`from mcp.server.fastmcp import FastMCP`), NOT the standalone `fastmcp`
# package — so only `mcp` + `uvicorn` matter here. http_server.py imports
# `mcp.server.transport_security` and calls `mcp.custom_route` / `mcp.run`,
# all verified present in mcp 1.27.2.
#
# 2026-07-28 spec migration is an `mcp` SDK upgrade (+ flagship code), tracked
# in LISTING.md — bump the pin below deliberately when the SDK ships support.
#
# `pytest` is in the runtime because the smoke job runs the keystone server
# tests as a guard against `server.py` regressions. Without it the workflow
# can only assert `import OK` — which we already proved doesn't catch
# missing tools, missing env, or broken decorators.
mcp==1.28.0
uvicorn[standard]==0.49.0
pytest
# meok_crown.py — Ed25519 root-of-trust + sigil seal (the asymmetric attestation
# layer; HMAC in meok_x402.py stays for x402 receipts). See CROWN_ROOT_KEY_HARDENING_SPEC.md.
cryptography==46.0.7
