kai_mcp_solution_server: hash-locked requirements for Hermeto permissive mode

.gitattributes

@@ -0,0 +1,2 @@
+kai_mcp_solution_server/requirements.txt merge=ours
+.github/workflows/verify-requirements-txt.yml merge=ours

.github/workflows/verify-requirements-txt.yml

@@ -20,21 +20,26 @@ jobs:
         with:
           version: "latest"
 
-      - name: Sync production environment
+      - name: Regenerate Hermeto-compatible requirements files
         run: |
           cd kai_mcp_solution_server/
-          uv sync --no-dev
-          uv pip freeze --exclude-editable > new-requirements.txt
+          cp requirements.txt committed-requirements.txt
+          cp requirements-build.txt committed-requirements-build.txt
+          cd ..
+          ./scripts/post-sync.sh
 
-      - name: Compare with committed requirements.txt
+      - name: Compare with committed files
         run: |
           cd kai_mcp_solution_server/
-
-          # Normalize line endings
-          sed -i 's/\r$//' requirements.txt new-requirements.txt
-
-          # Show unified diff and fail if different
-          if ! diff -u requirements.txt new-requirements.txt ; then
-            echo "::error file=requirements.txt::Committed requirements.txt is stale. Run 'uv sync --no-dev && uv pip freeze > requirements.txt' and commit the result."
-            exit 1
+          sed -i 's/\r$//' requirements.txt committed-requirements.txt
+          sed -i 's/\r$//' requirements-build.txt committed-requirements-build.txt
+          fail=0
+          if ! diff -u committed-requirements.txt requirements.txt ; then
+            echo "::error file=kai_mcp_solution_server/requirements.txt::Stale. Run './scripts/post-sync.sh' from the repo root and commit."
+            fail=1
+          fi
+          if ! diff -u committed-requirements-build.txt requirements-build.txt ; then
+            echo "::error file=kai_mcp_solution_server/requirements-build.txt::Stale. Run './scripts/post-sync.sh' from the repo root and commit."
+            fail=1
           fi
+          exit $fail

kai_mcp_solution_server/requirements-build-constraints.txt

@@ -0,0 +1,11 @@
+# Build-time constraints for packages whose latest version ships only wheels on
+# PyPI. pybuild-deps fetches sdists to introspect build dependencies and errors
+# on wheel-only releases. These pins force resolution to the last sdist-bearing
+# version. Consumed by ../scripts/post-sync.sh; concatenated with requirements.txt
+# before pybuild-deps compile.
+
+# meson >=1.10 ships wheels only; 1.9.2 is the latest with an sdist on PyPI.
+# Pulled in transitively as a build dep of meson-python (a build dep of numpy).
+meson==1.9.2 \
+    --hash=sha256:1a284dc1912929098a6462401af58dc49ae3f324e94814a38a8f1020cee07cba \
+    --hash=sha256:3499b59bb23982496e01e57b4103ac2f826f9c3a3f59e507a0a832487fe55e3d