CLAUDE.md

@@ -81,6 +81,23 @@ class MyCog(commands.Cog):
 - API errors → verify `DB_URL` points to correct database API and `API_TOKEN` matches
 - Redis errors are non-fatal (graceful fallback when `REDIS_URL` is empty)
 
+## Dependencies
+
+### Pinning Policy
+All dependencies are pinned to exact versions (`==`). This ensures every Docker build
+produces an identical image — a `git revert` actually rolls back to the previous working state.
+
+- **`requirements.txt`** — production runtime deps only (used by Dockerfile)
+- **`requirements-dev.txt`** — includes `-r requirements.txt` plus dev/test tools
+
+When installing for local development or running tests:
+```bash
+pip install -r requirements-dev.txt
+```
+
+When upgrading a dependency, update BOTH the `==` pin and (if applicable) the comment in
+the file. Test before committing. Never use `>=` or `~=` constraints.
+
 ## API Reference
 - OpenAPI spec: https://sba.manticorum.com/api/openapi.json (use WebFetch for current endpoints)
 

requirements-dev.txt

@@ -0,0 +1,9 @@
+-r requirements.txt
+
+# Development & Testing
+pytest==8.4.1
+pytest-asyncio==1.0.0
+pytest-mock==3.15.1
+aioresponses==0.7.8
+black==26.1.0
+ruff==0.15.0

requirements.txt

@@ -6,15 +6,7 @@ aiohttp==3.12.13
 
 # Utilities
 python-dotenv==1.1.1
-redis>=5.0.0  # For optional API response caching (not currently installed)
-
-# Development & Testing
-pytest==8.4.1
-pytest-asyncio==1.0.0
-pytest-mock>=3.10.0  # Not currently installed
-aioresponses==0.7.8
-black>=23.0.0  # Not currently installed
-ruff>=0.1.0  # Not currently installed
+redis==7.3.0
 
 # Optional Dependencies
-pygsheets==2.0.6  # For Google Sheets integration (scorecard submission)
+pygsheets==2.0.6  # For Google Sheets integration (scorecard submission)