bug(deploy): backend requirements declare openpyxl and python-pptx twice with different floors, so pip aborts provisioning #14228

Hit on a live /opt/autobot provisioning run, immediately after #14226 unblocked the SSH task.

The failure

TASK [backend : Install filtered backend requirements] ***
fatal: [node_00_SLM_Manager]: FAILED! =>
  ERROR: Double requirement given: openpyxl>=3.1.5
  (from -r /opt/autobot/code_source/requirements.txt (line 25))
  (already in openpyxl>=3.1.0 (from -r /tmp/requirements-filtered.txt (line 30)), name='openpyxl')

Root cause

autobot-backend/requirements.txt declares two packages that the root requirements.txt also declares, with different floors — and it pulls the root file in at line 62 via -r ../requirements.txt:

pip refuses when the same distribution arrives twice with different specifiers.

Why it surfaced now rather than earlier

scripts/build-filtered-requirements.sh rewrites the relative -r ../requirements.txt to an absolute code_source path so the include actually resolves (#11134, #11117, #11135). Before that rewrite the include did not resolve, so the root file's pins never reached pip and the duplicate never materialised. The include fix is correct; it exposed a latent conflict rather than causing one.

The next failure is already queued behind this one

pip reports only the first duplicate. Enumerating both files by parsing them:

packages declared in BOTH files: 6
  same spec   aiosqlite     backend:22   >=0.22.1          root:48  >=0.22.1
  same spec   defusedxml    backend:117  >=0.7.1           root:52  >=0.7.1
  DIFFERENT   openpyxl      backend:31   >=3.1.0           root:25  >=3.1.5
  same spec   protobuf      backend:39   >=7.35.1,<8.0.0   root:12  >=7.35.1,<8.0.0
  same spec   python-docx   backend:26   >=1.2.0           root:24  >=1.2.0
  DIFFERENT   python-pptx   backend:32   >=0.6.23          root:26  >=1.0.2

So fixing openpyxl alone moves the failure to python-pptx on the next run. Both must go in one change, or the deploy fails twice.

The four identical duplicates are tolerated by pip — aiosqlite (backend line 22) precedes openpyxl (line 31) and did not error, which is what establishes that pip only rejects differing specifiers. They are redundant but not breaking, and are deliberately left alone here.

Suggested fix

Drop the two weaker declarations from autobot-backend/requirements.txt. The root file is included anyway and carries the stricter floor in both cases, so the dependency is preserved and the constraint tightens rather than loosens.

Acceptance criteria

• openpyxl and python-pptx are declared once across the two files
• A guard detects a package declared in both with differing specifiers, mutation-verified by reintroducing one
• Evidence is a provisioning run reaching past Install filtered backend requirements, not a diff — this is host behaviour

Related

• DRY: filtered-requirements + -c constraint rewrite duplicated in backend ansible role and role_registry post_sync_cmd #11134 / Backend dep-install broken: -c ../constraints/shared.txt unresolvable on deploy (constraints/ not synced) #11117 / Backend requirements '-r ../requirements.txt' unresolvable on deploy + stripped by filter (root deps may be uninstalled) #11135 — the include rewrite that made the root pins reach pip
• bug(deploy): provisioning fails with 'autobot_ssh_key_path is undefined' when the play runs against an inventory without group_vars #14226 — the SSH-key failure immediately before this one in the same run
• plugin(connectors): Microsoft OneDrive / SharePoint data source connector #9004 — where the backend's Excel/PowerPoint parsing deps were added