pyproject.toml

[project]
name = "agentfoundry-labs"
version = "0.1.0"
description = "Failure-driven laboratories for production multi-agent systems"
readme = "README.md"
requires-python = ">=3.12"
license = "Apache-2.0"
authors = [{ name = "Bhaskar Kurasala" }]
dependencies = [
  "langgraph>=1.2",
  "langchain-anthropic>=1.5",
  "langgraph-checkpoint-postgres>=3.1",
  "anthropic>=0.121",
  "pydantic>=2.9",
  "pydantic-settings>=2.6",
  "psycopg[binary,pool]>=3.2",
  "redis>=7,<9",
  "pgvector>=0.3",
  "httpx>=0.28",
  "tenacity>=9.0",
  "opentelemetry-sdk>=1.29",
  "opentelemetry-exporter-otlp-proto-grpc>=1.29",
  "fastapi>=0.115",
  "uvicorn[standard]>=0.32",
  "cryptography==48.0.0",
  "langchain-mcp-adapters>=0.1.0",
  "mcp>=1.27,<2",
  "pyjwt[crypto]>=2.10,<3",
  "litellm>=1.80,<2",
  "minio>=7.2,<8",
  "cedarpy>=4.8,<5",
  # Declared directly because the runtime genuinely needs it — vector_store, memory,
  # redteam and resilience all import it. It used to arrive only as scipy's transitive,
  # which meant the serving image's dependency on numpy was invisible and would have
  # vanished the moment the eval extras moved. A transitive that the application
  # imports by name is a direct dependency that nobody has written down yet.
  "numpy>=2,<3",
  "structlog>=25,<26",
  "prometheus-client>=0.21,<1",
  "opentelemetry-api>=1.29",
  "opentelemetry-instrumentation-fastapi>=0.50b0",
  "opentelemetry-instrumentation-httpx>=0.50b0",
  "opentelemetry-instrumentation-redis>=0.50b0",
  "tavily-python>=0.7,<1",
]

[project.optional-dependencies]
dev = [
  # Offline analysis only: scipy backs the bootstrap CI in eval/significance.py and
  # sklearn backs Cohen's kappa in eval/kappa.py. Neither is reachable from the serving
  # path — `import agentfoundry.api.asgi` loads no sklearn and no scipy — so shipping
  # them put ~200 MB of numerical toolchain into every running container to support
  # code that only ever runs against a results file on someone's laptop or in CI.
  "scikit-learn>=1.6,<2",
  "scipy>=1.15,<2",
  "pytest>=8.3,<10",
  "pytest-cov>=6,<8",
  "pytest-asyncio>=0.24",
  "testcontainers[postgres,redis]>=4.9",
  "respx>=0.22",
  "ruff>=0.8",
  "mypy>=1.13",
]
deepagents = [
    "deepagents>=0.6,<1",
]

[build-system]
requires = ["setuptools>=75"]
build-backend = "setuptools.build_meta"

[tool.setuptools.packages.find]
include = ["agentfoundry*"]

# Pinned explicitly. Without a `select`, ruff lints against whatever its current default
# set happens to be, so the same source tree passes on one machine and fails on the next
# after an unrelated `uv sync` — a lint gate that changes underneath you is not a gate.
[tool.ruff]
target-version = "py312"
line-length = 100

[tool.ruff.lint]
select = ["E", "F", "I", "B", "UP", "SIM", "RUF"]
ignore = [
  # Long lines are overwhelmingly the explanatory comments that carry this repo's
  # reasoning. Reflowing prose to satisfy a column count trades signal for tidiness.
  "E501",
  # `dict[str, Any]` state payloads cross the LangGraph seam constantly; PEP 695 generic
  # syntax there buys nothing and churns every signature.
  "UP046", "UP047",
  # En dashes and arrows in prose are intentional. RUF002/003 exist to catch homoglyph
  # attacks in identifiers, not typography in comments.
  "RUF002", "RUF003",
  # `class X(str, Enum)` is not interchangeable with `StrEnum`: `str(X.A)` yields "X.A"
  # under the former and "A" under the latter. These values reach log lines, policy
  # reasons and audit records, so the rewrite is a silent output change, not a cleanup.
  "UP042",
  # Environment variable names are the deployment's contract, not ours to case-correct.
  "SIM112",
  # Many `# noqa` directives here name rules this config does not select, and carry the
  # reason in the same breath ("fail-closed is the point", "deny stands regardless").
  # RUF100 calls them unused and deletes them; what it deletes is the reasoning.
  "RUF100",

  # --- Tracked debt, not accepted style -------------------------------------------
  # These fire on ~110 pre-existing sites. They are listed here so the gate below is a
  # real gate rather than a permanently-red one, and listed *individually* so that
  # adopting each rule is a reviewable commit rather than an invisible drift. Nothing
  # here is a correctness finding — ruff's F, B9xx and F821 classes are enforced, and
  # the defects they surfaced during adoption were fixed rather than ignored.
  "SIM105",  # contextlib.suppress over try/except/pass
  "SIM102", "SIM110", "SIM117",  # collapsible if / any() / nested with
  "RUF005", "RUF007", "RUF059",  # literal concat, pairwise, unused unpacked
  "B007", "B017", "B905",  # unused loop var, blind pytest.raises, zip strict=
  "E402", "E701", "E702", "E731", "E741",  # import placement, one-liners, naming
  "F841",  # assigned-but-unused locals
  "SIM115",  # open() without a context manager
]

[tool.ruff.lint.per-file-ignores]
# Tests deliberately import for side effects and shadow names across parametrised cases.
"tests/**" = ["F401", "B008"]

[tool.pytest.ini_options]
testpaths = ["tests"]
addopts = "--strict-config --strict-markers"
asyncio_mode = "auto"
markers = [
  "integration: requires a local infrastructure dependency",
  "gvisor: requires a rootless runsc installation",
  "live: uses an external provider and credentials",
  "smoke: verifies a running deployment over HTTP, not the source tree",
]

[tool.coverage.run]
branch = true
source = ["agentfoundry"]

[dependency-groups]
dev = [
    "fakeredis>=2.30,<3",
]