microsoft / microsoft/agent-governance-toolkit

agent-governance-toolkit-core[migrate] extra pins an unresolvable agt-policies range

Open
#4,019 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
6.3k
Forks
1.1k
Avg merge
5d 11h
Merged PRs (30d)
142

Description

## Context

Follow-up from #4017 (draft PR moving `agt-policies` from a base dependency
of `agent-governance-toolkit-core` to an opt-in `migrate` extra, so the base
package and `[full]` install again without an unpublished transitive pin).

## The remaining gap

The `migrate` extra itself still pins:

```toml
migrate = [
"agt-policies>=5.1.0,<6.0",
]
```

This range predates #4017 and was not changed by it — `agt-policies>=5.1.0`
is not published on PyPI yet (latest is `5.0.0`), so `pip install
agent-governance-toolkit-core[migrate]` is unresolvable today.

It gets worse once `agt-policies>=5.1.0` *is* published: that release pins
`agent-control-specification>=0.4.0b0,<0.5.0`, which does not overlap
`agent-governance-toolkit-core`'s own base pin of
`agent-control-specification>=0.3.1b0,<0.4.0` (added in #4017 so `agent_os`'s
direct ACS imports keep working). Installing `[migrate]` would then require
two mutually exclusive ACS ranges at once.

This is the same class of bug as #3414 and #3733 — a package pinning an
unpublished (or, here, soon-to-conflict) transitive dependency floor — this
time recurring one level down inside an opt-in extra rather than the base
install.

## Suggested fix

Once an `agent-control-specification` release exists that both
`agent-governance-toolkit-core` and `agt-policies` can share, widen the base
ACS pin (or narrow `agt-policies`'s pin) so `[migrate]` resolves again. Until
then, this is worth tracking so it isn't rediscovered as a fresh "pip install
is broken" report.

Contributor guide

Open the contributing guide

Research direction

Inspect the package metadata that defines the `migrate` extra and its `agent-control-specification` constraint. First verify the currently published versions on PyPI and compare the constraints from `agt-policies` and the base package. Done means the extra has compatible dependency ranges and `pip install agent-governance-toolkit-core[migrate]` resolves successfully once the required release exists.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
build-system
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.