# Model-lab training stack (issue #1585).
#
# Version-pinned for reproducibility — a manifest that can't reproduce its
# own eval numbers is a bug (issue #1585 pitfall). These pins are a
# security-clean starting set for PR2's encoder baseline; PR2 captures the
# EXACT versions of a real train run into the manifest's hyperparams/hardware.
#
# IMPORTANT: this file is NOT needed for CI. The seeded data generator
# (generate-data.py) and its selfcheck/determinism tests are stdlib-only and
# run on plain `python3` with no `pip install`. This file only matters on
# the lab GPU box, for train.py / eval.py.
#
# Trimmed to what the recipes truly import (train.py: torch/transformers/
# datasets + numpy-via-torch; eval.py: torch/transformers; hf_push needs
# huggingface-hub). sentence-transformers / scikit-learn were not imported.

# --- Encoder baseline stack (DeBERTa-v3-large, first choice per #1585) -----
# Security pins (dependency-review, fail-on-severity: high):
#   torch >= 2.6.0   — patches GHSA-53q9-r3pm-6pq6 (torch.load weights_only RCE)
#   PyTorch 2.12 defaults to CUDA 13.0 on PyPI; the lab RTX 3090 box stays on
#   the CUDA 12.x / 550-570 driver stack, so install the CUDA 12.6 wheel.
#   transformers >= 5.3.0 — patches GHSA-29pf-2h5f-8g72 (RCE) plus the
#     deserialization cluster GHSA-qxrp-vhvm-j765 / -hxxf-235m-72v3 /
#     -wrfc-pvp9-mr9g (all < 4.48.0).
--extra-index-url https://download.pytorch.org/whl/cu126
torch==2.12.1+cu126
transformers==5.3.0
datasets==3.6.0
huggingface-hub==1.3.0  # transformers 5.3.0 requires huggingface-hub>=1.3.0
# Trainer runtime deps the pinned base model + Trainer need (review round 2):
#   sentencepiece — microsoft/deberta-v3-large SentencePiece tokenizer.
#   accelerate    — Trainer / TrainingArguments device management.
sentencepiece==0.2.1  # >=0.2.1: GHSA-38vq-g6vr-w8wf
accelerate==1.14.0

# --- Correction-intent causal-LM stack (issue #1585 PR3) -------------------
# A ≤4B instruct LM fine-tuned to emit the #1581 corrections[] JSON block.
# LoRA is the default method (policy-table ≤8B); bitsandbytes enables QLoRA
# (4-bit base + paged optimizer, ≤14B ceiling — out of policy for these tasks
# but available for the 8B escape hatch). accelerate already pinned above.
trl==0.16.6
peft==0.13.2
bitsandbytes==0.44.1   # QLoRA 4-bit base + paged optimizer (8B escape hatch)
