From 461444001c5ee46f1c5e529f29bcf1b606a79b88 Mon Sep 17 00:00:00 2001
From: Srinivasa Consultants <78673153+dinakarjs@users.noreply.github.com>
Date: Wed, 28 Oct 2026 19:28:58 +0530
Subject: [PATCH] fix(ci): check installed dependencies in CI and release
 validation

Rebase the existing six dependency-consistency gates onto current main as requested. CI and its credential-free release mirror remain aligned.

Prepared with OpenAI Codex.

Signed-off-by: Srinivasa Consultants <78673153+dinakarjs@users.noreply.github.com>
---
 .github/workflows/ci.yml                 | 9 +++++++++
 .github/workflows/release-validation.yml | 9 +++++++++
 2 files changed, 18 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 9fa9e8a2..cdb698b0 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -41,6 +41,9 @@ jobs:
 
       - name: Install local package
         run: python -m pip install --no-deps -e .
+
+      - name: Check installed dependency consistency
+        run: python -m pip check
 
       - name: Security scan
         # bandit and pip-audit are already in the dev extra above, so the
@@ -90,6 +93,9 @@ jobs:
       - name: Install local package
         run: python -m pip install --no-deps -e .
 
+      - name: Check installed dependency consistency
+        run: python -m pip check
+
       # AGT 4.1 currently constrains cryptography below 49, while the runtime
       # requires 50+ for published security fixes. Keep the scanner isolated
       # so its tooling constraints cannot downgrade the package under test,
@@ -143,6 +149,9 @@ jobs:
 
       - name: Install local package
         run: python -m pip install --no-deps -e .
+
+      - name: Check installed dependency consistency
+        run: python -m pip check
 
       - name: Run benchmark (software-only, CI gate p99 < 5ms)
         run: python -m ca2a_runtime.benchmarks --provider software-only --hops 10000 --out benchmarks/
diff --git a/.github/workflows/release-validation.yml b/.github/workflows/release-validation.yml
index 1ceda389..9079ce8b 100644
--- a/.github/workflows/release-validation.yml
+++ b/.github/workflows/release-validation.yml
@@ -32,6 +32,9 @@ jobs:
       - name: Install local package
         run: python -m pip install --no-deps -e .
 
+      - name: Check installed dependency consistency
+        run: python -m pip check
+
       - name: Security scan
         # bandit and pip-audit are already in the dev extra above, so the
         # scan runs against the same pinned versions rather than fetching
@@ -73,6 +76,9 @@ jobs:
       - name: Install local package
         run: python -m pip install --no-deps -e .
 
+      - name: Check installed dependency consistency
+        run: python -m pip check
+
       # AGT 4.1 currently constrains cryptography below 49, while the runtime
       # requires 50+ for published security fixes. Keep the scanner isolated
       # so its tooling constraints cannot downgrade the package under test,
@@ -127,6 +133,9 @@ jobs:
       - name: Install local package
         run: python -m pip install --no-deps -e .
 
+      - name: Check installed dependency consistency
+        run: python -m pip check
+
       - name: Run benchmark (software-only, CI gate p99 < 5ms)
         run: python -m ca2a_runtime.benchmarks --provider software-only --hops 10000 --out benchmarks/