chore: update scout — agno 2.6.4→2.7.0a6, replica/hygiene fixes

[ashpreetbedi]

Overnight maintenance pass bringing scout up to the agentos-railway Starter reference standard (per prompts/apps-update.md). Bump + known-bug fixes + hygiene only — no refactors.

What changed

• agno 2.6.4 → 2.7.0a6 — pyproject.toml now pins agno[os,slack]==2.7.0a6 (it was previously unpinned; the lock held 2.6.4). Matches the reference pin in agentos-railway.
• requirements.txt regenerated via ./scripts/generate_requirements.sh (uv pip compile). Notable lock movement:
  • openinference-instrumentation-agno 0.1.31 → 0.1.38 (+ openinference-instrumentation 0.1.47 → 0.1.54, openinference-semantic-conventions 0.1.29 → 0.1.30) — matches the reference.
  • agnoctl==0.1.0a5 is now an explicit dependency of agno 2.7.
  • agno 2.7 dropped the fastapi[standard] extra tree: fastapi-cli, fastapi-cloud-cli, uvloop, watchfiles, jinja2, email-validator, sentry-sdk, gitpython etc. fell out of the lock. uvicorn now runs the plain asyncio loop — no code change needed, but worth knowing.
• railway.json numReplicas 2 → 1 — the scheduler runs in-process; two replicas double-fire every cron (docs/decisions.md, single-replica-scheduler). This was a live production-behavior bug.

Hygiene bugs checked, already clean at public HEAD

• CLAUDE.md is already a symlink to AGENTS.md (not a byte copy).
• No tracked .claude/settings.local.json, no stale *.egg-info, no tmp/ scratch.

Migration hazards to keep in mind (2.6.4 → 2.7.0a6 is a multi-version jump)

• Prod boot now requires a JWT verification key. Verified locally: with RUNTIME_ENV=prd (the default), import app.main now raises ValueError: AgentOS(authorization=True) requires a JWT verification key: set JWT_VERIFICATION_KEY or JWT_JWKS_FILE.... On 2.6.4 this was not a hard startup failure. Any Railway deploy of this branch must have JWT_VERIFICATION_KEY (or JWKS) set, or it will crash-loop.
• fastmcp ≥3.4.3 host-guard (the 421 episode): agno 2.7.0a4 + fastmcp 3.4.3 returned 421 Misdirected Request for /mcp on every non-localhost host. Fixed by the 2.7.0a5+ pin (we're on a6), and scout's lock doesn't currently pull fastmcp (plain mcp==1.27.0) — but probe MCP over the public domain after deploy, never just localhost.
• JWT middleware default-excluded routes: agno's JWT middleware excludes /, /health, /info, /docs, /redoc, /openapi.json — health checks and /docs keep working with auth on. If scout relies on any additional unauthenticated route, re-verify it post-bump.
• In-process scheduler: this PR pins replicas to 1 for exactly this reason; do not scale out without making the scheduler single-instance first. Also AGENTOS_URL must be set in prod or scheduled jobs silently never fire.
• Possible DB migrations: the 2.6→2.7 jump may alter agno-managed tables (e.g. agno_service_accounts.user_id). agno migrates its own tables on boot; take a DB snapshot before deploying and verify sessions/memory/knowledge reads afterward.

Reviewer checklist (full verify gate — run before merge)

• docker compose up -d --build (needs the real .env; ports 8000/5432 free — serialize with other template gates)
• curl localhost:8000/docs → 200
• MCP handshake succeeds (tools list over /mcp); after any cloud deploy, probe MCP over the public domain
• source .venv/bin/activate && python -m evals --tag smoke → all pass
• Manual smoke of the core flow: ask scout a question that hits the knowledge graph / company sources end-to-end
• Confirm JWT_VERIFICATION_KEY is present in the Railway environment before deploying (new hard requirement, see hazards)
• docker compose down when done

Not verified autonomously

• No .env in this fresh clone → no live gate ran: no docker compose up, no /docs probe, no MCP handshake, no python -m evals --tag smoke (needs OPENAI_API_KEY etc.).
• No Railway deploy — numReplicas: 1 takes effect on the next deploy from this repo; the currently-deployed service (if any) still runs 2 replicas until then.
• What DID pass locally without secrets: ./scripts/validate.sh (ruff + mypy clean, 19 files), docker compose config parses, import scout and RUNTIME_ENV=dev python -c "import app.main" both OK against agno 2.7.0a6 in the repo venv.

🤖 Generated with Claude Code

[ashpreetbedi]

🤖 Automated re-review

1 issue found.

• [low] requirements.txt:49 — Lock is not a faithful output of the stated ./scripts/generate_requirements.sh (standard mode); the three openinference pins were bumped by a targeted upgrade or hand-edit the script does not expose. Reproduced with uv 0.5.13: standard mode preserves the old pins (0.1.31/0.1.47/0.1.29), while the committed file has 0.1.54/0.1.38/0.1.30. Upgrade mode yields the committed openinference trio but would also move fastapi (0.139.0 vs 0.136.1), openai (2.44.0 vs 2.32.0) and agnoctl (0.1.0a7 vs 0.1.0a5), which the committed file keeps old. No single exclude-newer date reconciles it (fastapi 0.137.0 released 2026-06-14 vs openinference-instrumentation-agno 0.1.38 released 2026-06-19). No runtime impact — the trio is internally consistent with the unchanged opentelemetry/wrapt pins; the defect is purely a provenance inaccuracy in the header/PR body.