Guard Anthropic SDK major before API 2026-10-21 migration #2457

Resolution — verified security merge

Resolved by PR #2456, merge e93fd0e975cda0f3a59cb7fa812c19c64f6b2a52, approved head 9a76e5d64bfa9d37e002dba12ac27eb8d4c5fa9b. Current execution receipt records the exact mutation, evidence, limitations and post-merge check state. The findings below are the original issue history; they do not describe current main.

Problem

Anthropic released API version 2026-10-21 and Python SDK 2.0.0 on 2026-10-21. The SDK major defaults to the new API version and includes breaking request/response changes.

EventRelay's ml extra declared anthropic>=0.105.0 with no upper bound. A fresh resolution could therefore cross into 2.x without a deliberate migration, while the canonical lock still selects 0.120.2.

Official evidence:

• https://platform.claude.com/docs/en/api/migration-2026-10-21
• https://github.com/anthropics/anthropic-sdk-python/releases/tag/v2.0.0
• https://github.com/anthropics/anthropic-sdk-python/releases/tag/v2.1.0

Acceptance criteria

• Bound the currently supported Anthropic SDK major.
• Preserve the known-good locked artifact.
• Assert the EventRelay request shape omits removed temperature, top_p, and top_k fields.
• Pass uv lock --check, the targeted unified SDK unit tests, Ruff, and diff checks.
• Keep SDK 2.x adoption as a separate deliberate migration after the broader lock can be refreshed.

Evidence already gathered

Offline transport checks confirmed that the current EventRelay request shape serializes under both the highest current anthropic<2 resolution (1.17.0, API 2023-06-01) and SDK 2.1.0 (API 2026-10-21). No provider call, production deployment, cost, or latency measurement occurred.

Implementation: #2456