chore(deps,integrations): update agentflow-client requirement from <2,>=1.0.1 to >=1.0.1,<3 in /integrations

[dependabot]

Updates the requirements on agentflow-client to permit the latest version.

Release notes

Sourced from agentflow-client's releases.

AgentFlow v2.0.0 — re-founded demo universe, PostgreSQL control plane, three-node demo topology

The major release: the demo's business universe is re-founded on a legend the project owns end-to-end, the control plane gets its scale profile, and the demo goes multi-node — three federated Spaces live on Hugging Face.

Why major

• The business legend is re-pinned across every surface — an own-brand kitchen-appliance importer selling through five sales programs, seeded in ₽ (domain.md is the source of truth, with unit-economics and data-generation specs alongside). Generator, seeds, serving demo store, demo evidence, notebooks, fixtures, benchmarks and narration all moved; breaking for anything that consumed the retired fashion-retail/USD surfaces.
• The external real-retailer dataset is removed outright — loader package and its tests deleted, the at-scale benchmark captured from it retired as historical (the load-test harness stays fully runnable at seed scale, same P99 gate). Breaking for the deleted loader API.

Headline

• Control plane externalized to PostgreSQL (ADR 0010, slices 1–6): a ControlPlaneStore port with embedded and PostgreSQL adapters — webhook queue/log, alert history + rules, replay outbox + dead-letter, API-usage/session analytics — shipped as PostgresControlPlaneStore with the Helm scale profile behind a render-time scaling gate.
• Operational read surfaces split out of the agent catalog (ADR 0011): Order 360 timeline, stuck-orders worklist with SLA-stage contract, and the exception inbox (dead-letter/webhook overlay with R1/R2 reconciliation).
• Three-node demo topology live (ADR 0012): a center hub + two edge branches, one image differentiated purely by environment, federating canonical events over HTTPS with a token-authenticated ingest (distinct from the public demo key), a cross-branch live view, sleep-tolerant choreography, and N1–N12 invariants pinned as tests. Deployed as three Docker Spaces under liovina (agentflow-center, agentflow-edge-spb, agentflow-edge-ekb) and live-verified end-to-end.

Also in this release

• G2 audit closure: spec/seed number consistency (daily rate, valid GTIN-13 check digits, re-centered amount bands, FX honesty), bounded + deterministic journal scans, a boot-time node-token guard, live re-captures of the DV2 evidence on a kind stand (two real bugs caught and fixed: CDC source-DB grant, MinIO alias), and re-recorded demo narration.
• Single-container demo deploys pin SERVING_BACKEND=duckdb — post-cutover images crashed on boot without it; caught on the first three-node bring-up.
• bv_order_canonical PostgreSQL smoke seed + verify (17/17 live).

Full detail in CHANGELOG.md [2.0.0].

Packages

• PyPI: agentflow-runtime==2.0.0, agentflow-client==2.0.0
• npm: @yuliaedomskikh/agentflow-client@2.0.0

All published via OIDC Trusted Publishing on the v2.0.0 tag push (verified live on both registries, upload 2026-07-06 16:23 UTC).

Changelog

Sourced from agentflow-client's changelog.

[2.0.0] - 2026-07-06

Fixed — single-container demo deploys pin the DuckDB serving backend (G2 S7, 2026-07-06)

• SERVING_BACKEND=duckdb is now pinned in deploy/hf-space/Dockerfile (ENV), deploy/fly/fly.toml ([env]), and the deploy/fly/README.md local docker-run example. config/serving.yaml has defaulted to ClickHouse since the ADR 0006 Phase 1 cutover and ships inside the demo image, so any demo built from post-cutover main crashed on boot (BackendExecutionError: connection refused — no ClickHouse runs beside a single-container demo). Caught live on the first three-node HF Space bring-up; the standalone demo Space never showed it only because it still ran a pre-cutover image.

Added — Three-node demo topology: center hub + two edge branches, live on HF Spaces (ADR 0012 — F1/F2 2026-07-04, deployed G2 S7 2026-07-06)

• Node roles land in the serving API (AGENTFLOW_NODE_ROLE = center | edge; standalone stays byte-identical without it). The center mounts POST /v1/node/events — bearer-token ingest, distinct from the public demo-key and hidden from the public OpenAPI catalog, applying each pushed event through the existing _process_event path — and GET /v1/node/branches, the cross-branch summary (seeded baseline, live delta, last-seen per branch, waking for silent ones). Edges run a background emitter that applies each generated event locally and forwards the same canonical dict to the hub; a cold hub is tolerated (bounded retries, then drop). The N1–N12 node invariants are pinned as unit/integration tests.
• Deployed as three Docker Spaces under the liovina account (agentflow-center, agentflow-edge-spb, agentflow-edge-ekb) from deploy/hf-space/three-node/ — one shared image built from public main, role set purely by Space environment. Center + edge-spb live-verified end-to-end via the §12 checklist: auth ladder (401/403), applied:1 token ingest, idempotent re-POST, cross-branch delta movement.

Changed — spec/seed number consistency: daily rate, GTIN check digits, band centering, FX honesty (G2 S3, 2026-07-06)

• Seed daily rate now matches §1 (audit m5). satellite_seed*.sql order dates spread over a ~122-hour (≈ 5.1-day) flat window instead of 21 days: 10,000 orders ≈ 1,965/day — generator-spec §1's baseline rate. §11 now documents that §4's monthly seasonality is deliberately not encoded in a 5-baseline-day seed (a 5-day snapshot cannot express a 12-month curve).
• Vault-seed GTINs are valid GTIN-13 (audit m6). synthetic_seed.sql's gs1_gtin values now append the genuine GS1 mod-10 check digit via a pinned 160-digit string, asserted against reference/gs1.py's gtin13_check_digit by a new invariant test — §12 #7 now holds for the vault seed too, not only the reference catalog.
• Amount bands re-centered on §1's average checks (audit m7). The old equal-width bands ran ~5% (dxb: ~12%) above target; new bands are centered and multipliers re-chosen so small branch slices equidistribute: marketplace 1.5k–2.8k (mean ≈ 2,150), D2C 2k–4.6k (≈ 3,300), B2B RU 30k–74k (≈ 52k), dxb 60k–120k (≈ 90k), ala 25k–65k (≈ 45k).

... (truncated)

Commits

• a47d000 chore(release): cut v2.0.0 (#166)
• 6146f16 fix(g2-s7): pin SERVING_BACKEND=duckdb for single-container demo deploys (#165)
• fa4ba22 G2 S6: Mac-tail cluster re-capture (live kind stand) (#164)
• 509902a Merge pull request #163 from brownjuly2003-code/docs/g2-s8-followup-cleanup
• 879b39e chore(g2-s8): drop literal retired-dataset name from provenance comments; rep...
• a9ac1fa docs(g2-s8): fix stale factual claims — probe count 29, node-label narration,...
• 3564664 fix(g2-s5-b2): rewrite dv2 demo narration off the fashion-retailer legend (#162)
• b332778 fix(g2-followup): tiebreak newest-first journal scans on event_id (#159)
• 945fb00 G2 S4: hardening — bounded journal scan, node-token guard, doc/test follow-up...
• a577705 fix(g2-s3): close audit minors m4/m5/m6/m7/n2 — spec/seed number consistency ...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: integrations, python. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[github-actions]

DORA Metrics

• Window: last 30 days
• Branch: main
• Deployment frequency: 11 total / 2.57 per week
• Lead time for changes: avg 0.13h / median 0.0h
• Change failure rate: 63.64% (7/11)
• MTTR: 0.98h across 6 incident(s)