Inconsistent dependency resolution across documented install paths (torch, torchaudio, torchvision)

Summary

The repository documents more than one way to install it, and they do not produce the same environment: following pip install . installs torch 2.14.0 from PyPI, while following packages/agentic-llm/Dockerfile:29 installs torch 2.5.1+cu121 from download.pytorch.org/whl/cu121; 2 further package(s) differ the same way (torchaudio, torchvision). A user who reads the README/Dockerfile expects the CUDA/ROCm build named there, but depending on the installer and index order gets a different variant or major version, which is confusing to debug (GPU silently unused, mismatched CUDA libraries) and means the two paths are not tested against the same dependencies. Because the selection is decided by index visibility and installer semantics rather than by the project, it is also an exposure: whichever index publishes a higher version of these names decides what gets installed.

Description

torch:

• pip install . (pyproject/requirements only, PyPI) → torch 2.14.0 from PyPI
• packages/agentic-llm/Dockerfile:29 (pip3 install torch torchvision torchaudio --index-url https://download.pytorch.org/whl/cu121) → torch 2.5.1+cu121 from download.pytorch.org/whl/cu121

torchaudio (transitive):

• pip install . (pyproject/requirements only, PyPI) → torchaudio 2.11.0 from PyPI
• packages/agentic-llm/Dockerfile:29 (pip3 install torch torchvision torchaudio --index-url https://download.pytorch.org/whl/cu121) → torchaudio 2.5.1+cu121 from download.pytorch.org/whl/cu121

torchvision (transitive):

• pip install . (pyproject/requirements only, PyPI) → torchvision 0.29.0 from PyPI
• packages/agentic-llm/Dockerfile:29 (pip3 install torch torchvision torchaudio --index-url https://download.pytorch.org/whl/cu121) → torchvision 0.20.1+cu121 from download.pytorch.org/whl/cu121

Steps to reproduce

Dry-run resolutions (nothing is installed), Python 3.11, Linux x86_64, pip 26.2.1 / uv 0.12.10, index state of 2026-09-07:

# A: `pip install .` (pyproject/requirements only, PyPI)
pip install --dry-run --report a.json "torch" "torchaudio" "torchvision"
#   -> `torch 2.14.0` from PyPI; `torchaudio 2.11.0` from PyPI; `torchvision 0.29.0` from PyPI

# B: `packages/agentic-llm/Dockerfile:29` (`pip3 install torch torchvision torchaudio --index-url https://download.pytorch.org/whl/cu121`)
pip install --dry-run --report b.json "torch" "torchaudio" "torchvision" --index-url https://download.pytorch.org/whl/cu121
#   -> `torch 2.5.1+cu121` from download.pytorch.org/whl/cu121; `torchaudio 2.5.1+cu121` from download.pytorch.org/whl/cu121; `torchvision 0.20.1+cu121` from download.pytorch.org/whl/cu121

Expected behavior

Every documented install path selects the same file for the package(s) above (same version, same index, same hash), or the documentation states which build is intended.

Actual behavior

• torch: 2.14.0 (PyPI) vs 2.5.1+cu121 (download.pytorch.org/whl/cu121).
• torchaudio: 2.11.0 (PyPI) vs 2.5.1+cu121 (download.pytorch.org/whl/cu121).
• torchvision: 0.29.0 (PyPI) vs 0.20.1+cu121 (download.pytorch.org/whl/cu121).

Consequences

• Users following one path get a different PyTorch build (CUDA/ROCm/CPU variant or major version) than users following the other; GPU code may run on CPU or fail to load CUDA libraries.
• The environment produced by one path is not the one exercised in CI, so bug reports are hard to reproduce.
• The two paths install files with different hashes from different indexes; which build (and whose build) ends up in the environment is decided by index order and installer behaviour rather than by the project's declaration, and the two files were not verified against each other here.

Root cause

• Cases 1, 2, 3: pip applies version priority across all indexes it can see (PEP 766): when PyPI is visible next to a download.pytorch.org channel, the newer PyPI release wins over the +cuXXX build. uv's default first-index strategy does the opposite (first index that has the name). The selected build therefore depends on the installer and on whether the channel is passed as --index-url or --extra-index-url, not on the declaration.

Where the repo binds these packages to an index

• packages/agentic-llm/cloudrun/Dockerfile.gpu:25 — torch → https://download.pytorch.org/whl/cu121 (pip3 install --no-cache-dir torch==2.2.0 torchvision==0.17.0 torchaudio==2.2.0 --index-url https)
• packages/agentic-llm/Dockerfile:29 — torch → https://download.pytorch.org/whl/cu121 (pip3 install torch torchvision torchaudio --index-url https://download.pytorch.org/whl/cu121)
• packages/agentic-llm/cloudrun/Dockerfile.gpu:25 — torchaudio → https://download.pytorch.org/whl/cu121 (pip3 install --no-cache-dir torch==2.2.0 torchvision==0.17.0 torchaudio==2.2.0 --index-url https)
• packages/agentic-llm/Dockerfile:29 — torchaudio → https://download.pytorch.org/whl/cu121 (pip3 install torch torchvision torchaudio --index-url https://download.pytorch.org/whl/cu121)
• packages/agentic-llm/cloudrun/Dockerfile.gpu:25 — torchvision → https://download.pytorch.org/whl/cu121 (pip3 install --no-cache-dir torch==2.2.0 torchvision==0.17.0 torchaudio==2.2.0 --index-url https)
• packages/agentic-llm/Dockerfile:29 — torchvision → https://download.pytorch.org/whl/cu121 (pip3 install torch torchvision torchaudio --index-url https://download.pytorch.org/whl/cu121)

Proposed fix

1. Pin the channel build explicitly in the install command(s) (packages/agentic-llm/Dockerfile:29): e.g. torch==<ver>+cu121 torchaudio==<ver>+cu121 torchvision==<ver>+cu121 --index-url https://download.pytorch.org/whl/cu121 instead of unpinned names.
2. Install the PyTorch packages in a dedicated step with --index-url <channel> (single index), then install the remaining requirements from PyPI. Avoid --extra-index-url for the channel: with pip it makes PyPI's newer release win.
3. For uv, declare the channel explicit = true and bind the packages to it so uv never takes them from PyPI:

[[tool.uv.index]]
name = "pytorch"
url = "https://download.pytorch.org/whl/cu121"
explicit = true

[tool.uv.sources]
torch = { index = "pytorch" }
torchaudio = { index = "pytorch" }
torchvision = { index = "pytorch" }

4. Commit a lock (uv.lock, or pip-compile/pip lock output with hashes) and make the README/Dockerfile/CI install from it, so every documented path resolves identical files.

Environment

• pip 26.2.1, uv 0.12.10, CPython 3.11, Linux x86_64 (Ubuntu 24.04 on WSL2)
• repository at commit d3735a33533da2e12a68439177a791bf1c5c91e1
• index contents as observed on 2026-09-07; file URLs and sha256 in the table below make the result re-checkable

Selected files

case	install path	package	version	index	file	sha256
1	pip install . (pyproject/requirements only, PyPI)	torch	2.14.0	PyPI	torch-2.14.0-cp311-cp311-manylinux_2_28_x86_64.whl	8d9e232b6376c62f
1	packages/agentic-llm/Dockerfile:29 (pip3 install torch torchvision torchaudio --index-url https://download.pytorch.org/whl/cu121)	torch	2.5.1+cu121	download.pytorch.org/whl/cu121	torch-2.5.1+cu121-cp311-cp311-linux_x86_64.whl	c8ab8c92eab928a9
2	pip install . (pyproject/requirements only, PyPI)	torchaudio	2.11.0	PyPI	torchaudio-2.11.0-cp311-cp311-manylinux_2_28_x86_64.whl	1a07ec72fd6f26a5
2	packages/agentic-llm/Dockerfile:29 (pip3 install torch torchvision torchaudio --index-url https://download.pytorch.org/whl/cu121)	torchaudio	2.5.1+cu121	download.pytorch.org/whl/cu121	torchaudio-2.5.1+cu121-cp311-cp311-linux_x86_64.whl	9e6f03e6410cb355
3	pip install . (pyproject/requirements only, PyPI)	torchvision	0.29.0	PyPI	torchvision-0.29.0-cp311-cp311-manylinux_2_28_x86_64.whl	85fa54bec1f7d922
3	packages/agentic-llm/Dockerfile:29 (pip3 install torch torchvision torchaudio --index-url https://download.pytorch.org/whl/cu121)	torchvision	0.20.1+cu121	download.pytorch.org/whl/cu121	torchvision-0.20.1+cu121-cp311-cp311-linux_x86_64.whl	237609a3551c2b68

---

Found by an automated check that resolves the declared dependencies under each documented install path and diffs the selected files. File URLs and sha256 hashes are listed above so the result can be re-checked independently.

Start by running the two dry-run resolution commands described in the issue, then inspect packages/agentic-llm/Dockerfile:29 and packages/agentic-llm/cloudrun/Dockerfile.gpu:25 alongside the declarations used by pip install .. Align the documented paths so torch, torchaudio, and torchvision select the intended pinned files and index, then re-run the dry runs to verify identical resolutions.