chore: update dash — agno 2.5.14→2.7.0a6, replica/hygiene sweep

[ashpreetbedi]

Brings dash up to the agentos-railway Starter reference standard (agno pin + hygiene), per prompts/apps-update.md. Overnight automated pass — draft on purpose; do not merge before running the reviewer checklist below.

What changed

• agno 2.5.14 → 2.7.0a6 (the reference pin). pyproject.toml had agno[os] unpinned — the lock was what held 2.5.14. Now pinned explicitly: agno[os]==2.7.0a6.
• requirements.txt regenerated with the repo's own ./scripts/generate_requirements.sh. Notable lock movement:
  • agno==2.7.0a6, new transitive agnoctl==0.1.0a5.
  • agno 2.7 dropped the fastapi[standard] extras, so uvloop, watchfiles, httptools, jinja2, email-validator, fastapi-cli, gitpython, sentry-sdk etc. fell out of the lock — this matches the reference's lock shape.
  • openinference-instrumentation-agno stayed at 0.1.29 (compile keeps compatible pins; the reference lock carries 0.1.38). It is transitive, not declared — bump with ./scripts/generate_requirements.sh upgrade if you want lock parity.
• evals/run.py compat fix (1 line): AccuracyEval results' avg_score is float | None in agno 2.7 — added a None guard so mypy is clean again. No other code changes.

Known drift bugs — verified against public HEAD

The stale local-clone findings did not reproduce at public HEAD; nothing needed fixing:

• railway.json numReplicas is already 1 (in-process scheduler must never run 2 replicas) — verified, unchanged.
• No .claude/settings.local.json (the /Users/ab/code/coda reference existed only in a local checkout) — nothing to scrub.
• No *.egg-info (incl. the reported data_agent.egg-info), no tmp/ scratch — nothing to delete.
• CLAUDE.md is standalone (no AGENTS.md exists), so the symlink rule doesn't apply.

Migration hazards to keep in mind (from templates/docs/decisions.md)

This is a multi-version jump (2.5.14 → 2.7.0a6); these are the known landmines:

• fastmcp 421 host-guard: agno 2.7.0a4 + fastmcp 3.4.3 returned 421 Misdirected Request for /mcp on any non-localhost host; fixed as of 2.7.0a5. Dash does not enable the MCP server, so no fastmcp is in the lock — but if you enable enable_mcp_server later, use the agno[mcp] extra and probe /mcp over the public domain, never just localhost.
• JWT default-excluded routes: agno's JWT middleware default-excludes /, /health, /info, /docs, /redoc, /openapi.json. Dash runs authorization=True when RUNTIME_ENV=prd — verify after the bump that only those routes are open and everything else still 401s (including the custom POST /knowledge/reload endpoint).
• In-process scheduler: dash registers a daily knowledge-refresh cron via ScheduleManager in the lifespan. Single replica is mandatory (double-fires on 2 — numReplicas stays 1), and AGENTOS_URL is load-bearing in prod: left at the localhost default, scheduled jobs silently never fire.
• DB migrations: agno 2.6/2.7 evolve agno-managed tables (e.g. agno_service_accounts.user_id). First boot against an existing 2.5.14 database should be watched — check startup logs for schema-migration errors, and back up prod Postgres before deploying this.

Reviewer checklist — full verify gate before merge

Needs a real .env (OPENAI_API_KEY at minimum) and free ports 8000/5432 (gates are serial across templates):

• docker compose up -d --build — API + Postgres come up healthy, startup logs clean (watch for agno schema-migration errors against pre-existing data)
• curl localhost:8000/docs → 200
• MCP handshake — n/a while enable_mcp_server is off in dash; if enabled, run the MCP check over the public domain too (421 guard)
• ./scripts/venv_setup.sh && ./scripts/validate.sh → ruff + mypy clean (passed in this run, re-confirm)
• python -m evals --tag smoke (or dash's evals/run.py flow) → all pass
• Manual smoke of the core flow: ask the Dash team a text-to-SQL question end-to-end (and via Slack if creds are set); confirm the answer and that learnings/knowledge writes land
• Scheduler sanity: knowledge-refresh schedule registered once, POST /knowledge/reload returns {"status": "ok"}

Not verified autonomously

• No .env in this fresh clone → docker compose up, live /docs, evals, and the Slack path were not run. Only validated: ruff clean, mypy clean, docker compose config parses, and import app.main under agno 2.7.0a6 loads all module wiring (it fails only at the Postgres connection, as expected with no DB running).
• The eval suite (LLM-judged) was not executed — the avg_score guard is type-level verified only.
• No live check of DB schema migration against a database holding real 2.5.14-era data.

🤖 Generated with Claude Code

[ashpreetbedi]

🤖 Automated re-review

No blocking issues found.

Re-checked the changed files for correctness, simplification, and efficiency regressions; none of the previously flagged concerns reproduced.