| # AIOS web API — the FastAPI backend + the platform data-layer deps it reuses. |
| # |
| # ⛔ STREAMLIT IS GONE (EXIT-6, 2026-08-04) — do not add it back. The line here read |
| # `streamlit==1.58.0` with the comment "included only because the shared modules/core may import |
| # it at load; it is never served". That stopped being true when the shared layer was cleaned, and |
| # it stayed in THIS file — the one the Dockerfile actually installs — while `api/requirements.txt` |
| # had already dropped it and a gate reported the omission "verified". ~250 MB of image for a |
| # package nothing imported. |
| # |
| # The lesson is the file, not the package: the PINNED intent and the SHIPPED manifest are two |
| # different documents, and checking only the one you wrote is how the other rots. |
| # `api/verify_no_streamlit.py` now checks BOTH, and proves the API imports with streamlit, |
| # plotly, altair, openpyxl, reportlab and jinja2 all blocked at sys.meta_path. |
| # No altair/plotly/reportlab either — those were Streamlit UI/export only. openpyxl RETURNED in |
| # wave 21 (C5) as a LAZY dep of routes_uploads.py — the boot proof above still holds because the |
| # import lives inside the handler, and the gate now asserts this line exists here. |
| fastapi>=0.139 |
| uvicorn[standard]>=0.30 |
| python-dotenv>=1.0 |
| pandas>=2.0 |
| requests>=2.28 |
| huggingface_hub>=0.20 |
| duckdb>=1.0 |
| pyyaml>=6.0 |
| pillow>=10.0 |
| beautifulsoup4>=4.12 |
| lxml>=5.0 |
| cryptography>=42.0 |
| # ⭐ WAVE 20 (R1 / D-4) — THE POSTGRES DRIVER, AND IT IS LOAD-BEARING IN THIS FILE SPECIFICALLY. |
| # `core/store_pg.py` is the store backend from this wave on, and it is deliberately FAIL-CLOSED: |
| # `_pool()` raises rather than falling back to the HF file store, so a container that gets |
| # `STORE_BACKEND=pg` without this line does not degrade — it refuses every request that touches |
| # the store, which is every authenticated request. |
| # |
| # ⛔ AND THIS IS THE FILE THAT MATTERS: the Dockerfile does `COPY requirements.txt` from the |
| # Space root, i.e. THIS manifest, not `api/requirements.txt`. That header's own streamlit story |
| # is the same defect in the other direction — the pinned intent and the shipped manifest are two |
| # documents. psycopg is now in BOTH, and `ops/verify_portability.py` gates the pair. |
| psycopg[binary,pool]>=3.2 |
| # ⭐ WAVE 21 (item 11, C5) — .xlsx preview for Select-from-file; lazy-imported in |
| # routes_uploads.py only. verify_no_streamlit asserts this line in BOTH manifests. |
| openpyxl>=3.1 |
| # ⛔ AND ITS TRANSPORT, learned from a RUNTIME_ERROR on the first v6 boot: FastAPI demands |
| # python-multipart AT IMPORT TIME for any route declaring File(...)/Form(...). Every local gate |
| # was green because the dev box happens to have it for unrelated reasons — the container |
| # installs exactly this file. The environment-parity twin of the streamlit lesson above. |
| python-multipart>=0.0.20 |
|
|
