fix(deps): keep a vulnerable cryptography out of the AGT lock entirely

.github/workflows/ci.yml

@@ -88,8 +88,10 @@ jobs:
       - name: Install governance tooling in an isolated environment
         run: |
           python -m venv .agt-venv
-          .agt-venv/bin/pip install --require-hashes -r requirements/agt.txt
-          .agt-venv/bin/pip install --require-hashes --no-deps -r requirements/agt-override.txt
+          # --no-deps because the lock already lists every transitive
+          # dependency, and pip would otherwise re-resolve and reject the
+          # cryptography override the compile deliberately applied.
+          .agt-venv/bin/pip install --require-hashes --no-deps -r requirements/agt.txt
 
       - name: Generate evidence file
         run: python scripts/gen_agt_evidence.py

.github/workflows/release.yml

@@ -97,8 +97,10 @@ jobs:
       - name: Install governance tooling in an isolated environment
         run: |
           python -m venv .agt-venv
-          .agt-venv/bin/pip install --require-hashes -r requirements/agt.txt
-          .agt-venv/bin/pip install --require-hashes --no-deps -r requirements/agt-override.txt
+          # --no-deps because the lock already lists every transitive
+          # dependency, and pip would otherwise re-resolve and reject the
+          # cryptography override the compile deliberately applied.
+          .agt-venv/bin/pip install --require-hashes --no-deps -r requirements/agt.txt
 
       - name: Generate evidence file
         run: python scripts/gen_agt_evidence.py

requirements/agt-overrides.txt

@@ -0,0 +1,16 @@
+# Dependency overrides applied when compiling requirements/agt.txt.
+#
+# agent-governance-toolkit[full] caps cryptography below 49.0 through its own
+# dependencies. This runtime requires >=50.0, and 50.0.0 is the first release
+# without PYSEC-2026-3552 (PKCS#7 EnvelopedData Bleichenbacher oracle). AGT's
+# ceiling is stale rather than a real incompatibility, so the scanner runs
+# against 50.x.
+#
+# This is deliberately an override, not a resolution: uv is told to ignore that
+# constraint. Recorded here, in a committed file, so the violation is reviewable
+# rather than buried in a workflow step. The alternative was resolving AGT
+# honestly and lifting cryptography afterwards, which left a vulnerable pin in
+# the lock for Dependabot to flag forever while never actually running it.
+#
+# Remove this file when AGT raises its ceiling past 50.
+cryptography>=50.0

requirements/agt.in

@@ -1,11 +1,11 @@
-# The governance scanner, installed into its own venv on purpose.
+# The governance scanner, resolved for its own isolated venv.
+#
+# agent-governance-toolkit caps cryptography below 49.0, which sits under this
+# runtime's floor and under the first release without PYSEC-2026-3552, so the
+# compile applies an override rather than accepting that stale ceiling. See
+# requirements/agt-overrides.txt.
 #
-# AGT 4.1 depends on cryptography>=46.0.7,<49.0 while this runtime requires
-# >=50.0, so the two cannot be resolved together and the scanner must not share
-# an environment with the package under test. This lock is AGT's own resolution;
-# requirements/agt-override.txt then lifts cryptography past AGT's stale ceiling
-# inside that isolated venv, which is what the unpinned two-step did before.
 # Compile with:
-#   uv pip compile requirements/agt.in --generate-hashes --universal \
-#     --python-version 3.11 -o requirements/agt.txt
+#   uv pip compile requirements/agt.in --override requirements/agt-overrides.txt \
+#     --generate-hashes --universal --python-version 3.11 -o requirements/agt.txt
 agent-governance-toolkit[full]>=4.1