ci: drop Python 3.11, test on 3.12 + 3.14, add job timeouts

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -62,4 +62,4 @@ body:
     id: python
     attributes:
       label: Python version
-      placeholder: "3.11.x"
+      placeholder: "3.12.x"

.github/workflows/ci.yml

@@ -17,13 +17,16 @@ jobs:
   test:
     name: tests (py${{ matrix.python-version }})
     runs-on: ubuntu-latest
+    # A deadlocked test otherwise runs to GitHub's 6-hour default; three runs
+    # burned ~14 hours of runner time that way before anyone noticed.
+    timeout-minutes: 15
     strategy:
       fail-fast: false
       matrix:
-        # 3.11 is the floor (`requires-python`); 3.14 is what the Dockerfile
+        # 3.12 is the floor (`requires-python`); 3.14 is what the Dockerfile
         # ships, so it must stay in the matrix or the deployed interpreter is
         # the one version never tested. Bump both together.
-        python-version: ["3.11", "3.12", "3.14"]
+        python-version: ["3.12", "3.14"]
 
     steps:
       - uses: actions/checkout@v7
@@ -53,6 +56,7 @@ jobs:
   lockfile:
     name: lockfile
     runs-on: ubuntu-latest
+    timeout-minutes: 10
 
     steps:
       - uses: actions/checkout@v7
@@ -72,6 +76,7 @@ jobs:
   types:
     name: types & formatting (advisory)
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     # Advisory only. Both checks carry a backlog inherited from before this
     # project was open sourced; they report so the debt stays visible, but they
     # do not block a pull request. See CONTRIBUTING.md.

.roborev.toml

@@ -26,7 +26,7 @@ review_guidelines = """
 Verikan — a FastAPI + LangGraph service that answers natural-language questions about public
 statistical data and emits a reproducible Jupyter notebook, with citations, for every answer.
 
-Python 3.11, Pydantic v2, ruff (line length 100). `src/data_concierge/ui/web.py` is the real
+Python 3.12, Pydantic v2, ruff (line length 100). `src/data_concierge/ui/web.py` is the real
 entrypoint; `api/main.py` is a secondary REST-only app.
 
 Flag these project-specific defects. They are recurring, they pass tests, and they are the

.serena/memories/task_completion.md

@@ -4,7 +4,7 @@ Run from the repo root (see the cwd trap in `mem:suggested_commands`):
 
 ```bash
 ruff check src/ tests/ scripts/    # must pass — CI gate
-pytest -q --no-cov                 # must pass on 3.11 and 3.12 — CI gate
+pytest -q --no-cov                 # must pass on 3.12 and 3.14 — CI gate
 ```
 
 Advisory, run on code you touched but do not chase repo-wide:

.serena/memories/tech_stack.md

@@ -1,6 +1,8 @@
 # Tech Stack
 
-- Python `>=3.11`; CI matrix 3.11 + 3.12. `target-version = "py311"`, mypy `python_version = "3.11"`. Do not use 3.12+-only syntax.
+- Python `>=3.12`; CI matrix 3.12 + 3.14. `target-version = "py312"`, mypy `python_version = "3.12"`. Do not use 3.13+-only syntax.
+- **3.11 was dropped deliberately.** `tests/unit/test_query_stream.py::test_cancelled_stream_reader_cancels_worker` deadlocks on 3.11 only: `gateway/query_stream.py::query_events` does `worker.cancel()` then `await worker` inside `anyio.CancelScope(shield=True)` in its `finally`, and on 3.11 that shielded await never completes when the *consumer* task is cancelled. Introduced by `fa50bfb` (PR #7). The suite passes on 3.12 and 3.14. If anyone proposes restoring 3.11, that deadlock is the blocker.
+- 3.14 is in the matrix because the Dockerfile ships `python:3.14-slim`. Bump the two together or the deployed interpreter goes untested.
 - FastAPI + uvicorn + Jinja2 templates; Pydantic v2 (`pydantic-settings` for `core/config.py`).
 - LangGraph for agent orchestration; `anthropic` SDK directly (no LangChain LLM wrappers).
 - pandas / numpy for computation; `nbformat` + `nbclient` + `ipykernel` for notebook generation and execution.
@@ -20,7 +22,7 @@
 Check locally with `uv lock --check` — read-only, writes neither the lockfile nor `.venv`.
 
 CI enforces it in the **`lockfile` job — blocking**, a third gate alongside `test`'s `pytest` and `ruff check`. Same rationale as `ruff check`: no backlog, so keeping it clean is free.
-- Its own job, not a step in `test`: the lock does not vary by Python version (so the 3.11/3.12 matrix would check it twice) and the check needs no project install, making it ~15s instead of a full dep install.
+- Its own job, not a step in `test`: the lock does not vary by Python version (so the 3.12/3.14 matrix would check it twice) and the check needs no project install, making it ~15s instead of a full dep install.
 - Changes under `[tool.ruff]`, `[tool.mypy]`, etc. do not invalidate the lock — only dependency metadata does. False positives are unlikely.
 - `.roborev.toml` still lists `uv.lock` in `exclude_patterns`, so the adversarial PR reviewer never reads the file; the gate is the only thing watching it.
 

CONTRIBUTING.md

@@ -23,7 +23,7 @@ boundary, or make it a manual script.
 
 | Check | Blocking | Notes |
 |---|---|---|
-| `pytest` | **Yes** | Must stay green on 3.11 and 3.12 |
+| `pytest` | **Yes** | Must stay green on 3.12 and 3.14 |
 | `ruff check src/ tests/ scripts/` | **Yes** | Currently clean — please keep it that way |
 | `ruff format --check` | No — advisory | Pre-existing drift across many files |
 | `mypy src/` | No — advisory | ~90 pre-existing errors, mostly missing annotations |

README.md

@@ -7,7 +7,7 @@
 **Verikan takes the friction out of turning data into verifiable answers. Ask questions about your data in plain English – the system finds the right dataset – and Verikan enriches it with data from high-value data sources, runs real Python code against it, and explains the results clearly. Every answer is reproducible, citable, independently verifiable, and yours to keep. Over time, this positive feedback loop creates a Knowledgebase of Verified, Evidence-based Answers.**
 
 [![CI](https://github.com/dathere/Verikan/actions/workflows/ci.yml/badge.svg)](https://github.com/dathere/Verikan/actions/workflows/ci.yml)
-[![Python](https://img.shields.io/badge/python-3.11%2B-3776AB?logo=python&logoColor=white)](https://www.python.org/)
+[![Python](https://img.shields.io/badge/python-3.12%2B-3776AB?logo=python&logoColor=white)](https://www.python.org/)
 [![License: MIT](https://img.shields.io/badge/license-MIT-green.svg)](LICENSE)
 [![FastAPI](https://img.shields.io/badge/FastAPI-009688?logo=fastapi&logoColor=white)](https://fastapi.tiangolo.com/)
 [![LangGraph](https://img.shields.io/badge/LangGraph-1C3C3C)](https://langchain-ai.github.io/langgraph/)
@@ -105,7 +105,7 @@ starting over, then puts the revision through the same execution and review pass
 
 ### Prerequisites
 
-- **Python 3.11+**
+- **Python 3.12+**
 - An **Anthropic API key** ([console.anthropic.com](https://console.anthropic.com/))
 
 No other credential is required. The default data source — [WPRDC](https://data.wprdc.org)

pyproject.toml

@@ -3,7 +3,7 @@ name = "data-concierge"
 version = "0.1.0"
 description = "Verikan — the verified Data Concierge: citation-backed answers about public statistical data, with a reproducible notebook for every answer"
 readme = "README.md"
-requires-python = ">=3.11"
+requires-python = ">=3.12"
 license = {text = "MIT"}
 authors = [
     {name = "datHere"}
@@ -13,8 +13,8 @@ classifiers = [
     "Development Status :: 3 - Alpha",
     "Intended Audience :: Science/Research",
     "License :: OSI Approved :: MIT License",
-    "Programming Language :: Python :: 3.11",
     "Programming Language :: Python :: 3.12",
+    "Programming Language :: Python :: 3.14",
 ]
 
 dependencies = [
@@ -90,7 +90,7 @@ build-backend = "setuptools.build_meta"
 where = ["src"]
 
 [tool.ruff]
-target-version = "py311"
+target-version = "py312"
 line-length = 100
 
 [tool.ruff.lint]
@@ -119,7 +119,7 @@ ignore = [
 known-first-party = ["data_concierge"]
 
 [tool.mypy]
-python_version = "3.11"
+python_version = "3.12"
 warn_return_any = true
 warn_unused_configs = true
 disallow_untyped_defs = true