refactor(deps): isolate optional dependency environments

[tangym]

Summary

Updates vulnerable frontend and Python dependencies, then narrows published ASSERT dependency metadata to runtime product features. Framework examples and optional scripts now own their dependencies through adjacent requirements files instead of one combined installation environment.

Motivation / linked issue

Reduce dependency vulnerability exposure, remove cross-framework resolver coupling, and make optional dependency ownership explicit.

Changes

• Update viewer dependencies and pin patched SvelteKit and PostCSS releases.
• Replace the website's vulnerable Keyv cache chain through file-entry-cache.
• Remove framework-only langgraph, dspy, and examples extras from published ASSERT metadata.
• Remove the unused regression extra and script-only packages from base and analysis.
• Split heavyweight local embedding support into assert-ai[embeddings].
• Cap ACS Generator below 0.4 because ASSERT uses the 0.3 GenerationEngine API.
• Keep all limited to product features: tracing, analysis, embeddings, Azure identity, and ACS.
• Add independently installable requirements files for the flagship LangGraph planner, Azure Doc QA, Bank Manager, the default OpenAI auto-trace path, Foundry hosting, and optional scripts.
• Update canonical setup, CI, dev container, assistant guides, and example documentation to use root product extras plus adjacent requirements files.

The multi-framework auto-trace gallery keeps its alternate framework modules as explicit opt-ins: install the framework and matching OpenInference instrumentor named in the gallery table. CrewAI is not committed to a requirements manifest while its ChromaDB dependency has no patched release.

Testing

• Root and isolated requirements audits: 0 known vulnerabilities
• Python: 1,453 passed, 22 skipped, 1 Docker-host test deselected
• Every requirements file resolves and imports on Python 3.11
• uv lock --check
• Viewer: npm audit, npm ci, npm run check, npm run build
• Website: npm audit, npm ci, npm run build
• Package: python -m build, twine check dist/*

Checklist

• Tests pass locally.
• Setup and example documentation updated for the new dependency boundaries.
• No secrets, credentials, or customer data committed.
• No breaking runtime API change.

[Jake Present (jakepresent)]

Two blockers on exact head ed539e3:

1. The documented Bank Manager install leaves an incompatible environment. I ran the README sequence in a clean Python 3.11 venv:

   python -m pip install -e ".[acs,otel]"
   python -m pip install -r examples/bank_manager_agent_control/requirements.txt
   python -m pip check

   Both install commands exit successfully, but pip check fails because langchain-azure-ai>=1.2.4 pulls azure-ai-projects 2.5.0, which requires openai>=3.0.0, while the installed litellm 1.98.0 requires openai>=2.20.0,<3.0.0. The resulting environment has openai 3.5.0 and is inconsistent. This contradicts the PR's requirements-resolution claim and can fail after an apparently successful setup. Please use a compatible version set or isolate that provider path, and add a required clean-venv test of the documented two-step install followed by pip check.

2. The package silently removes existing public extras without a compatibility or release migration. The built wheel no longer provides langgraph, dspy, examples, or regression, and it changes the meaning of all, while CHANGELOG.md has no Unreleased entry. A clean pip install -e ".[langgraph]" exits 0 with WARNING: assert-ai 0.2.0 does not provide the extra 'langgraph', then leaves langgraph uninstalled. Existing setup automation can therefore report a successful install and fail later at import time. Please either preserve safe compatibility aliases for a transition or make this an explicit breaking release change with the appropriate version/migration and changelog treatment. The vulnerable all-framework bundle does not need to be restored merely for compatibility.

Two smaller consistency issues:

• The new OpenAI auto-trace quickstart (.[otel] plus examples/phoenix_auto_trace/requirements.txt) emits DependencyConflict: requested: "langchain_core >= 0.1.0" but found: "None" because the otel extra still installs the LangChain instrumentor after LangChain moved to target-owned requirements. The framework instrumentor should move with the framework dependency or otherwise stop producing a conflict on the default OpenAI path.
• scripts/render_trade_off.py:25-26 still says Matplotlib is a base assert-ai dependency, although this PR moves it to scripts/requirements.txt.

Other verification on this head was healthy: the full suite passed (1454 passed, 22 skipped, 840 subtests); viewer and website audits/builds passed with zero known npm vulnerabilities; pip-audit found no known vulnerabilities in the root and isolated requirement environments; the wheel and sdist passed twine check; the Travel Planner, Azure Doc QA, OpenAI auto-trace, scripts, and standalone Foundry-host requirements installed and imported; lockfiles use the public npm registry with SHA-512 integrity; and uv lock --check plus diff checks passed.

[Chang Liu (changliu2)]

Jake Present (@jakepresent) Ready for re-review at 59b9cd91.

The commits after your ed539e3 review address both blockers and both consistency issues:

• the Bank Manager documented install now resolves a compatible OpenAI/LiteLLM set and its clean install plus pip check is enforced in CI;
• the removed extras are documented as a planned 0.3.0 breaking migration and locked by the public-extra contract test;
• the LangChain instrumentor moved with the LangChain-owned example dependencies; and
• render_trade_off.py now points to the script requirements instead of calling Matplotlib a core dependency.

All current-head checks are green, and an independent exact-head review found no remaining blocker. It also verified that mcp>=1.29.1 is published on public PyPI and receives the <2 cap transitively from langchain-mcp-adapters; the earlier resolution concern came from a stale corporate mirror.

Please re-review the current head. We need #336’s dependency boundary merged before applying the approved article-faithful reset to #313.