chore(agent): upgrade Python 3.13 → 3.14

[scottschreckengaust]

Summary

Upgrade the agent container base image from python:3.13-slim to python:3.14-slim.

Related: #104 (toolchain monitoring RFC)

Risk Assessment: SAFE

Comprehensive codebase analysis shows zero code changes required:

Check	Result
requires-python constraint	>=3.13 — already permits 3.14
Removed stdlib modules (asyncore, cgi, etc.)	None used
Typing features	All stable since 3.11/3.12; PEP 649 compatible
Native extension wheels (cedarpy, pydantic-core, grpcio, cffi)	All have cp314 wheels in uv.lock
Major deps (boto3, fastapi, uvicorn, opentelemetry, claude-agent-sdk)	All pure-Python or have 3.14 wheels
C extensions in agent source	None — all pre-built wheels
asyncio event loop policy usage	Diagnostic only; no behavior change in 3.14

Changes Required

1. agent/Dockerfile line 11: python:3.13-slim → python:3.14-slim
2. agent/pyproject.toml: target-version = "py313" → "py314" (ruff)
3. agent/pyproject.toml: python-version = "3.13" → "3.14" (ty)
4. Re-lock: uv lock (lockfile already has 3.14 resolution markers)

Testing Required

• Docker image builds
• uv sync --frozen works (or re-lock if needed)
• Agent unit tests pass
• Trivy image scan passes
• Smoke test: full agent task execution

Notes

• Consider doing this separately from the Debian trixie upgrade (chore(agent): upgrade Debian base from bookworm to trixie #106) to isolate variables
• Python 3.14 is stable with 5 patch releases as of May 2026
• The uv.lock already contains resolution markers for python_full_version >= '3.14'

[scottschreckengaust]

Dependency Compatibility Matrix (Python 3.14)

All pinned dependencies verified compatible with Python 3.14 as of 2026-05-15:

Dependency	Pinned	Latest	3.14 Classifier	Wheel Type	Status
boto3	1.43.6	1.43.9	Yes	py3-none-any (pure Python)	Compatible
claude-agent-sdk	0.2.82	0.2.82	No	py3-none-manylinux (bundled binary)	Compatible
requests	2.34.0	2.34.2	Yes	py3-none-any	Compatible
fastapi	0.136.1	0.136.1	Yes	py3-none-any	Compatible
uvicorn	0.46.0	0.47.0	Yes	py3-none-any	Compatible
aws-opentelemetry-distro	~=0.17.0	0.17.0	No	py3-none-any (pure Python)	Compatible
mcp	1.27.1	1.27.1	No	py3-none-any (pure Python)	Compatible
cedarpy	>=4.8.1	4.8.3	No	cp314 native wheels shipped	Compatible

Zero blockers. Packages without explicit Programming Language :: Python :: 3.14 classifiers are still compatible — they're either pure-Python (runs on any Python 3.x) or ship pre-built cp314 wheels (cedarpy).

Notes on "No classifier" packages

• claude-agent-sdk: Ships platform-specific bundles with embedded Claude Code binary; py3-none tag means Python-version-independent
• aws-opentelemetry-distro: Pure Python wrapper around OpenTelemetry; no native code
• mcp: Pure Python Model Context Protocol implementation
• cedarpy: Rust extension compiled to cp314 wheels — explicitly built for Python 3.14