[justgithubaccount]

Summary

• derive the runtime task registry from behavior.yaml and fail closed at startup when any flow references an unknown task
• remove proven-generated output markdown, ignore runtime output, and preserve documented optional MCP/knowledge/layer scaffolds
• declare requests directly and remove the unused crewai-tools extra while preserving custom BaseTool implementations, API flows, deterministic checks, mutation guard, and OTLP behavior
• add mypy to CI and regression coverage for configuration and repository hygiene

Validation

• uv sync --locked --dev
• Ruff and mypy passed
• 64 pytest tests passed
• container entrypoint tests passed
• rebuilt runtime image passed /health, /flows (2 configured flows), /agents (9 configured agents), and kubectl client checks
• pip-audit: 41 records / 4 packages -> 40 records / 3 transitive packages; crewai-tools advisory path removed
• actionlint passed

Known compatibility decision

CrewAI 0.203.2 pins vulnerable chromadb 1.1.1, json-repair 0.25.2, and litellm 1.74.9. Their fixed versions require a CrewAI/LiteLLM migration outside this low-risk compatibility PR. No advisory is represented as resolved until that staged migration is approved and tested.

No live CrewAI flow, provider API, Kubernetes, release, deployment, or cloud operation was run.

Refs justgithubaccount/app-poly-gitops-infra#30
Refs justgithubaccount/app-poly-gitops-infra#27