build(deps): CPU-only torch in the image — 9.50 GB → 2.95 GB (P2-5)

[jwvanderstam]

Independent of #403–#407: it touches the lock, CI and docs, none of which those PRs change. Merge order doesn't matter, apart from a likely trivial CHANGELOG/ROADMAP rebase.

What changes

sentence-transformers pulled PyPI's CUDA torch into the app image, together with fifteen nvidia-* packages, three cuda-* and triton. The app container never has a GPU; Ollama owns it.

• requirements.in names the PyTorch CPU index (--extra-index-url https://download.pytorch.org/whl/cpu). PEP 440 orders 2.13.0+cpu above 2.13.0, so the resolver picks the CPU build without a torch pin.
• The locks were recompiled on Linux with the documented command. Nothing else moved: torch became 2.13.0+cpu, the 19 GPU packages left, and the dev lock gained only the index line.
• The image and CI install the same wheels, so the lock still describes what runs.

Measured

Image (built from the same commit, 2026-09-29)	Size
main, CUDA torch	9.50 GB
this branch, CPU torch	2.95 GB (−69%)

The CPU image passes, by hand, every assertion docker-smoke makes:

• uid 65532, no shell;
• native imports, with torch 2.13.0+cpu and torch.version.cuda is None;
• it boots against Postgres, and /api/health returns 200 with the database healthy.

The cross-encoder reranker, the one torch consumer, loaded and completed its warm-up on the CPU build.

Caught before it shipped: torch had silently left the vulnerability scan

pip-audit -r requirements.txt skips torch 2.13.0+cpu ("Dependency not found on PyPI and could not be audited") and still passes. CI now does three things instead:

• Strips the local tag. A +cpu build is compiled from the public release's source and carries its advisories.
• Audits the pins as written (--disable-pip --no-deps). The lock is the full closure, so nothing is lost, and resolving would pick the +cpu wheel again through the index line.
• Adds --strict, so a package that can't be audited fails the step instead of disappearing from it.

Verified locally: the strict audit passes on the stripped lock and fails on the raw one, and pip-audit does report advisories for an old torch pinned the same way.

Guards

• docker-smoke asserts torch.version.cuda is None inside the image.
• tests/unit/test_lock_is_cpu_only.py fails if the lock regains a CUDA torch or any nvidia-*, cuda-* or triton package. This matters because a CPU index that lags a release would make the resolver fall back to CUDA silently. All three checks fail on main's lock.

Verification

ruff, mypy, bandit: clean. Fast suite: 3185 passed, 0 failed. The workflow YAML parses.

Not verifiable before it happens

• How Dependabot handles the +cpu pin on its next bump. It supports pip-compile with index options, but local version labels are a known weak spot. The worst case is that torch bumps arrive ungrouped or need a manual recompile, not that the image regresses, because the lock test would catch a CUDA fallback.
• The extra index serves some common packages too. pip picks the highest version across both indexes. The lock pins every version, so the practical exposure is which host a pinned wheel comes from.

🤖 Generated with Claude Code

[Copilot]

Copilot review overview

🟡 Changes recommended

The exact +cpu pin breaks the documented macOS host installation path.

Review effort: Balanced
Findings: None

What changed in this PR

Reduces the application image size by switching PyTorch to its CPU-only build and strengthening dependency auditing.

Changes:

• Uses the PyTorch CPU index and removes CUDA dependencies.
• Adds CI guards for CPU-only Torch and strict vulnerability auditing.
• Documents the resulting image-size reduction.

File	Description
requirements.in	Configures the CPU wheel index.
requirements.txt	Locks CPU-only Torch and removes CUDA packages.
requirements-dev.txt	Propagates the CPU index.
.github/​workflows/​tests.yml	Strengthens auditing and image checks.
tests/​unit/​test_lock_is_cpu_only.py	Guards the CPU-only lock.
docs/​DEPLOYMENT.md	Records operational impact.
docs/​ROADMAP.md	Marks P2-5 complete.
CHANGELOG.md	Announces the dependency change.
.claude/​rules/​file-map.md	Registers the new test.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud