chore(deps): tilde-pin all deps; delete requirements.txt

Every direct dep in pyproject.toml now has a ~X.Y.Z bound
(patch-only). The 7 unconstrained deps (imgui-bundle,
anthropic, google-genai, openai, fastapi, mcp, uvicorn,
plus tomli-w) get explicit tilde bounds discovered from
uv.lock. The 6 >=X.Y.Z deps are normalized to tilde-style
(pinned to the current lock version).

The local-rag optional dep (sentence-transformers) is also
tilde-pinned.

requirements.txt is deleted (was redundant with uv.lock;
the uv project uses uv.lock as the canonical lock file,
which is regenerated locally and gitignored per project
policy at .gitignore:9).

Re-running the audit confirms 0 PIN_VIOLATION (was 7). The
final.md report records the post-cleanup state.

Also adds --report-name CLI flag to the audit script
(default 'initial') so the script can write either
initial.md (Phase 1) or final.md (Phase 2) into the same
report directory.

pyproject.toml

@@ -4,31 +4,31 @@ name = "manual_slop"
 version = "0.1.0"
 requires-python = ">=3.11"
 dependencies = [
-    "imgui-bundle",
-    "pyopengl>=3.1.10",
+    "imgui-bundle~=1.92.5",
+    "pyopengl~=3.1.10",
 
-    "tomli-w",
-    "tree-sitter>=0.25.2",
-    "tree-sitter-python>=0.25.0",
-    "tree-sitter-c>=0.23.2",
-    "tree-sitter-cpp>=0.23.2",
+    "tomli-w~=1.2.0",
+    "tree-sitter~=0.25.2",
+    "tree-sitter-python~=0.25.0",
+    "tree-sitter-c~=0.24.2",
+    "tree-sitter-cpp~=0.23.4",
 
-    "psutil>=7.2.2",
-    "fastapi",
-    "mcp>=1.0.0",
-    "pytest-timeout>=2.4.0",
-    "uvicorn",
+    "psutil~=7.2.2",
+    "fastapi~=0.133.0",
+    "mcp~=1.26.0",
+    "pytest-timeout~=2.4.0",
+    "uvicorn~=0.41.0",
 
-    "anthropic",
-    "google-genai",
-    "openai",
+    "anthropic~=0.83.0",
+    "google-genai~=1.64.0",
+    "openai~=2.26.0",
 
-    "chromadb>=1.5.8",
+    "chromadb~=1.5.8",
 ]
 
 [project.optional-dependencies]
 local-rag = [
-    "sentence-transformers>=5.4.1",
+    "sentence-transformers~=5.4.1",
 ]
 
 [dependency-groups]

scripts/audit_license_cve.py

@@ -179,6 +179,7 @@ def main() -> int:
  parser.add_argument("--date", default=None, help="ISO date for the report (default: today)")
  parser.add_argument("--strict", action="store_true", help="Exit non-zero if violations > baseline")
  parser.add_argument("--dump-baseline", action="store_true", help="Write current violations as the new baseline")
+ parser.add_argument("--report-name", default="initial", help="Report filename (default: 'initial'; use 'final' for post-cleanup)")
  args = parser.parse_args()
 
  violations: list[Violation] = []
@@ -199,7 +200,7 @@ def main() -> int:
  date_str = args.date or date.today().isoformat()
  report_dir = Path(args.report_dir) / date_str
  report_dir.mkdir(parents=True, exist_ok=True)
- report_path = report_dir / "initial.md"
+ report_path = report_dir / f"{args.report_name}.md"
  _write_report(violations, report_path, args)
 
  if args.strict: