chore: update context — agno 2.6.16→2.7.0a6, hygiene audit

[ashpreetbedi]

Overnight maintenance pass bringing context up to the agentos-railway Starter reference standard (per prompts/apps-update.md). Bump + hygiene only — no refactors.

What changed

agno 2.6.16 → 2.7.0a6 (multi-minor jump: 2.6.16 → 2.6.x tail → 2.7.0a1–a6)

• pyproject.toml: agno was unpinned (agno[os,slack], lock held it at 2.6.16). Now pinned to the reference target: agno[os,mcp,slack]==2.7.0a6.
• Dropped the direct fastmcp<3 dependency: it existed because agno 2.6.x only shipped fastmcp in its test extra and targeted the fastmcp 2.x API. agno 2.7.x declares fastmcp in the mcp extra and pins the 3.x line — keeping fastmcp<3 would have held the lock on 2.14.7 against an agno that targets 3.4.3.
• requirements.txt regenerated with the repo's own scripts/generate_requirements.sh flow (targeted --upgrade-package for agno-adjacent pins, mirroring railway's agnoctl refresh mode, which this repo's script predates). Now matching the reference lock:
  • agno 2.6.16 → 2.7.0a6
  • fastmcp 2.14.7 → 3.4.3 (+ fastmcp-slim 3.4.3)
  • openinference-instrumentation-agno 0.1.37 → 0.1.38
  • openinference-instrumentation 0.1.53 → 0.1.54
  • agnoctl 0.1.0a5 (new in lock, floored by agno)

Known drift bugs — audited, all already clean at public HEAD (no changes needed):

• railway.json numReplicas is already 1 (single-replica scheduler constraint holds).
• No .claude/settings.local.json in the repo; .claude/settings.json has no cross-repo references or stale absolute paths.
• No stale *.egg-info or tmp/ scratch tracked.
• CLAUDE.md is already a symlink to AGENTS.md.

Migration hazards to watch (from docs/decisions.md)

• fastmcp 3.x host-guard (the 421 episode): agno 2.7.0a4 + fastmcp 3.4.3 returned 421 Misdirected Request on /mcp for every non-localhost host. 2.7.0a6 is past the a5 fix, but any deployed check of this PR must probe /mcp over the public domain, never just localhost.
• fastmcp 2.x → 3.x API jump: this repo previously ran fastmcp 2.14.7. No first-party code imports fastmcp (verified via grep), so exposure is limited to agno's own MCP server — but the MCP handshake is the thing to verify hardest.
• JWT default-excluded routes: agno's JWT middleware default-excludes /, /health, /info, /docs, /redoc, /openapi.json. Verify prod behavior unchanged after the bump (health checks pass, everything else still gated).
• In-process scheduler: must stay single replica (numReplicas: 1 — unchanged here); confirm scheduled jobs still fire once and AGENTOS_URL is set in prod.
• DB migrations across 2.6 → 2.7: watch for schema changes on first boot against an existing database — e.g. the agno_service_accounts.user_id column addition. Take a snapshot before pointing this at a production DB.

Verified autonomously (no secrets used)

• ./scripts/validate.sh — ruff clean, mypy clean (27 source files).
• docker compose config — parses.
• python -c "import agents, app, db, workflows" under the new lock — imports OK, agno 2.7.0a6 confirmed live in the venv.

NOT verified — reviewer checklist (full verify gate before merge)

No .env in this fresh clone, so the live gate was skipped entirely:

• docker compose up -d --build — containers build and serve from this branch
• curl localhost:8000/docs → 200
• MCP handshake at /mcp (e.g. uvx agno connect or an MCP client) — tool list returns; re-verify over the public domain after any deploy
• ./scripts/venv_setup.sh && python -m evals --tag smoke — all pass
• Manual smoke of the core flow: chat with the context agent, confirm sessions/memory persist, Slack interface loads if tokens set
• First boot against a copy of an existing DB to surface any 2.6 → 2.7 migrations
• docker compose down after the gate (ports 8000/5432 are shared across templates)

[ashpreetbedi]

🤖 Automated re-review

No blocking issues found. Re-checked the updated diff for correctness, reuse/simplification, and efficiency issues; no verified findings remain.