fix(ci): reconcile the dependabot train's ansible-floor-sync and CI pin fixes onto main (#16591)

[mrveiss]

Thinking Path

Fast-track base fix: main (tip b688b3e48, the dependabot train's 10th member landing) is red on two shards because the train's own vehicle CI caught two real cross-cutting issues during validation, and the fix commits for both were still sitting on the disposable vehicle branch when the members got merged -- the vehicle itself was never meant to merge, so its own fix commits needed to travel as this standalone PR, but that PR wasn't opened before the members landed. This closes that gap.

Both fixes were already verified against the combined vehicle tree before the members merged (the vehicle's own CI went fully green after these two commits landed on it) -- this PR is exactly those two commits, cherry-picked onto current main with no changes.

What Changed

• autobot-slm-backend/ansible/roles/ai-stack/tasks/main.yml: transformers>=5.16.1 -> >=5.17.0, matching requirements-ai.txt (bumped by the train's own chore(deps): bump the all-dependencies group in /autobot-infrastructure/shared/docker/ai-stack with 5 updates #16585 member).
• autobot-slm-backend/ansible/roles/dependency_patching/defaults/main.yml: langchain-core floor 1.6.1,<2.0.0 -> 1.6.2,<2.0.0 and pypdf 6.17.0 -> 6.18.0, matching what every manifest in the tree now states (bumped by the train's own chore(deps): bump the all-dependencies group across 1 directory with 9 updates #16572 member).
• requirements-ci/storage.txt: alembic==1.19.1 -> 1.19.2, matching autobot-backend/requirements.txt:21's floor.
• requirements-ci/ai-ml.txt: anthropic==1.3.0 -> 1.4.0, matching autobot-backend/requirements.txt:40's floor.
• requirements-ci/document.txt: pypdf==6.17.0 -> 6.18.0, matching requirements.txt:43's floor.

Verification

• Root-caused against main's actual two failing shards:
  • Shard 1 (check_dependency_floors.py --strict): alembic 1.19.1<1.19.2, anthropic 1.3.0<1.4.0, pypdf 6.17.0<6.18.0 -- all three fixed here. websockets also prints in that report but is the pre-existing, non-gating KNOWN_CROSS_VENV_EXEMPTIONS entry (ci: run SLM backend tests in their own venv, so CI stops forcing the backend's websockets<16 cap onto the SLM #16394), untouched.
  • Shard 8 (repo_tests/ansible_requirements_parity_test.py): test_the_pre_15623_ai_stack_floors_are_a_regression_case and test_every_cross_manifest_divergence_is_in_the_baseline -- both fixed by the ansible floor sync above.
  • The "Dependabot" check also failed on main at this tip: its recreate job errors "Expected content to change!" on the anthropic 1.3.0 -> 1.4.0 bump, because that bump is effectively already in the tree (from chore(deps): bump the all-dependencies group across 1 directory with 9 updates #16572's merge). Not a test failure and not a second root cause -- it should stop failing once these pins land here.
• Both commits already ran green on the dependabot vehicle's own combined-tree CI before the vehicle's members were merged individually.
• Pre-push hook (now pointed at origin/main) ran clean on this exact 5-file changeset.

Risks

Low -- pure version-pin/floor mirroring, no behavior change. Diff is exactly 5 lines across 5 files.

Model Used

Claude Sonnet 5 (claude-sonnet-5)

Issue Link

N/A -- CI base-fix for the dependabot train (#16591), no application issue.

Single-issue rationale

N/A -- this is the vehicle's own reconciliation, finishing the existing train per merge-all-first.

Changelog fragment

• N/A -- dependency-floor/CI-pin fixes, not user-facing.

Checklist

• Code follows AutoBot patterns from CLAUDE.md
• Tests added or updated (N/A -- existing ansible_requirements_parity_test.py and check_dependency_floors.py --strict are the tests this fixes)
• Documentation updated if behavior changed (N/A)
• Pre-commit hooks pass
• PR targets main
• No secrets or credentials in the diff

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: ce7ad2d5-9daa-45d8-a488-76706735c0e0

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

✅ SSOT Configuration Compliance: Passing

🎉 No new hardcoded values of either class — ssot and other both block.

Known backlog in pipeline-scripts/hardcoded_values_baseline.txt is suppressed and tracked in #14371.

[github-actions]

Notice: 29 open PRs — past the runaway threshold (25)

There is no PR queue limit, and this is not a request to defer this PR. Work proceeds one issue at a time without a cap on open PRs; review capacity is the constraint.

This notice only means the count is high enough to be worth a glance for a runaway — something opening PRs in a loop, or a merge pipeline that has stalled so nothing is draining.

Currently open:

• security(redis): optional ACL username in every Redis client, unset by default (#16626) #16632 security(redis): optional ACL username in every Redis client, unset by default (security(redis): P1a — optional username support in every Redis consumer, default unset (#13568) #16626)
• chore(deps): bump the all-dependencies group across 1 directory with 8 updates #16631 chore(deps): bump the all-dependencies group across 1 directory with 8 updates
• chore(deps): bump the all-dependencies group across 1 directory with 12 updates #16611 chore(deps): bump the all-dependencies group across 1 directory with 12 updates
• chore(deps): bump the uv group across 1 directory with 2 updates #16597 chore(deps): bump the uv group across 1 directory with 2 updates
• chore(deps): dependabot train — 10 members onto current main [no-merge] #16591 chore(deps): dependabot train — 10 members onto current main [no-merge]
• feat(llm): wire extractive prompt compression and enforce per-provider concurrency cap (#16526, #16527) #16546 feat(llm): wire extractive prompt compression and enforce per-provider concurrency cap (Wire the existing extractive prompt compressor into the live LLM completion path #16526, Enforce the existing per-provider LLM concurrency cap #16527)
• fix(infra): consolidate the last 3 private TLS-cert-generation copies (#16020) #16522 fix(infra): consolidate the last 3 private TLS-cert-generation copies (nginx cannot start on a node with no TLS cert: five roles consume the shared keypair, four provision it #16020)
• security(routers): gate knowledge_search, knowledge_search_aggregator, knowledge_suggestions and voice_stream (#16507) #16508 security(routers): gate knowledge_search, knowledge_search_aggregator, knowledge_suggestions and voice_stream (security(routers): gate knowledge_search, knowledge_search_aggregator, knowledge_suggestions and voice_stream #16507)
• fix(frontend): retire four dead settings API paths, stop a fifth calling admin-gated settings from non-admin surfaces (#16481) #16484 fix(frontend): retire four dead settings API paths, stop a fifth calling admin-gated settings from non-admin surfaces (retire useSettingsApi/SystemRepository/services-api.ts/CacheService.ts dead settings paths #16481)
• feat(llm): cross-worker quota headroom store, persist real 429 headroom #16483 feat(llm): cross-worker quota headroom store, persist real 429 headroom
• chore(activity-tracking): retire the terminal/file/browser tracking hooks as dead code (#16466) #16475 chore(activity-tracking): retire the terminal/file/browser tracking hooks as dead code (chore(activity-tracking): wire in or retire terminal/file/browser activity tracking + secret_usage audit (backend) #16466)
• chore(deps): bump the npm_and_yarn group across 4 directories with 2 updates #16474 chore(deps): bump the npm_and_yarn group across 4 directories with 2 updates
• feat(collaboration): surface pending invitations in the collaboration panel (#16470) #16472 feat(collaboration): surface pending invitations in the collaboration panel (impl gap: surface pending collaboration invitations in a UI #16470)
• feat(collaboration): persist activity/notification history, add invitation list+respond endpoints (#16460) #16471 feat(collaboration): persist activity/notification history, add invitation list+respond endpoints (feat(collaboration): persist activity/notification history and add invitation list+respond endpoints #16460)
• security(settings): record the real caller on /sync and /hardware-priority, and test the anonymous and cross-org refusals (#16278) #16469 security(settings): record the real caller on /sync and /hardware-priority, and test the anonymous and cross-org refusals (security(settings): the core /api/settings routes read and write system config with no authentication #16278)
• feat(collaboration): wire the collaboration UI onto the real backend (#16443) #16462 feat(collaboration): wire the collaboration UI onto the real backend (impl gap: wire in the real-time collaborative-session UI (#608 phases 5-7 / #874) — 6 components + useSessionCollaboration, zero callers #16443)
• feat(mcp): admin-configured external MCP server bridge #16458 feat(mcp): admin-configured external MCP server bridge
• fix(mcp): rename autobot-backend/mcp/ off the name it shadows (#16449) #16454 fix(mcp): rename autobot-backend/mcp/ off the name it shadows (chore(mcp): autobot-backend/mcp/ shadows the real mcp PyPI SDK, making it unreachable by name #16449)
• docs(adr): supersede ADR-001's fixed VM count with role-separation placement (#15194) #16452 docs(adr): supersede ADR-001's fixed VM count with role-separation placement (docs: a fixed 6-VM topology is documented as the architecture — AutoBot scales from one VM or Docker to whatever is needed, and ADR-001 enshrines the wrong invariant #15194)
• docs: describe role-based placement instead of a fixed VM count (#15194) #16445 docs: describe role-based placement instead of a fixed VM count (docs: a fixed 6-VM topology is documented as the architecture — AutoBot scales from one VM or Docker to whatever is needed, and ADR-001 enshrines the wrong invariant #15194)
• feat(secrets): bridge connector credential templates to ConnectorCredentialStore (#16428) #16444 feat(secrets): bridge connector credential templates to ConnectorCredentialStore (secrets: connector credential templates must write where knowledge connectors read #16428)
• security(secrets): admin-gate infrastructure hosts, fix vault-backed template names (#16426, #16427) #16442 security(secrets): admin-gate infrastructure hosts, fix vault-backed template names (security(secrets): any logged-in user can list and delete infrastructure hosts through /api/infrastructure/hosts #16426, bug(secrets): the OpenAI and Anthropic quick-add templates save names the vault mirror never recognizes, so the key never reaches the runtime #16427)
• security(auth): fail closed when the password-epoch check cannot reach Redis (#16411) #16433 security(auth): fail closed when the password-epoch check cannot reach Redis (security(backend-auth): password-epoch revocation check fails open when Redis errors (backend equivalent of #16387) #16411)
• fix(security): deny an SLM token when its revocation check cannot run, HS256 and RS256 (#16387, #16412) #16413 fix(security): deny an SLM token when its revocation check cannot run, HS256 and RS256 (security(slm-auth): token revocation checks fail open when Redis errors, so a revoked token is accepted #16387, security(slm-auth): RS256 authority-token revocation check fails open when Redis errors #16412)
• feat(slm): Redis control and detailed health live in the SLM only; remove the unreachable user-GUI copies (#16245, #16252) #16352 feat(slm): Redis control and detailed health live in the SLM only; remove the unreachable user-GUI copies (tech-debt(frontend): move SettingsPanel's detailed system health and Redis service management into the SLM #16245, bug(frontend): RedisServiceControl calls /api/service-monitor/services/* and no mounted router serves those paths #16252)
• fix(code-sync): delete files removed from source through the updater, and check drift across every file (#16310, #16322) #16351 fix(code-sync): delete files removed from source through the updater, and check drift across every file (deploy: the builtin updater never removes files deleted from source, so deleted modules pile up on every host #16310, deploy: ansible synchronize never deletes files removed from source on remote fleet nodes #16322)
• ci(python-suite): queue the shards first in, first out across PRs, with a per-shard job-level queue: max group (#16320) #16328 ci(python-suite): queue the shards first in, first out across PRs, with a per-shard job-level queue: max group (ci: queue python-suite shards FIFO across PRs (queue: max), so one PR's suite finishes before the next starts #16320)
• docs(env): move the generated env-var table into ENV_VARS.md and drop its count line, so env-var PRs stop conflicting (#16317) #16318 docs(env): move the generated env-var table into ENV_VARS.md and drop its count line, so env-var PRs stop conflicting (docs: the generated env-var table and its count line live in CLAUDE_RULES.md, so every env-var PR conflicts with every other #16317)
• feat(slm): nodes report their GPUs in the heartbeat, and the SLM serves them per node (#16280, #16281) #16292 feat(slm): nodes report their GPUs in the heartbeat, and the SLM serves them per node (feat(slm-agent): report per-node GPU telemetry in the heartbeat, from one shared nvidia-smi/rocm-smi parser #16280, feat(slm-backend): serve per-node GPU state (GET /api/monitoring/gpu/nodes) and the autobot_gpu_* series Grafana already queries #16281)

If the queue is draining normally, ignore this. Otherwise:

1. Check whether CI is dispatching at all — see the ci-dispatch-watchdog status on these PRs
2. Merge the ones whose CI has finished and review has passed: gh pr merge <number> --squash --delete-branch
3. Look for a loop opening near-identical PRs

Warn-only runaway detector — .github/workflows/pr-queue-gate.yml. It never blocks a merge.