- Added `pyyaml>=6.0.3` dependency constraint to pyproject.toml after
  aiohttp to prevent installation of vulnerable older versions with known
  YAML parsing security issues.
- Updated uv.lock package dependencies and requires-dist to include pyyaml
  entry with specifier '>=6.0.3'.
- Added changelog Security section entry under [Unreleased] documenting the
  upgrade for issue #9055.
- Updated CONTRIBUTORS.md with contribution note (PR #9244).
- Added BDD test scenario verifying PyYAML security dependency constraint.

ISSUES CLOSED: #9055

@@ -36,1 +35,4 @@
+* HAL 9000 has contributed the error-suppression removal fix (PR #9247 / issue #9060): removed both `try...except Exception:` blocks in `register_registry_agents()` that silently suppressed errors from `actor_registry.list_actors()` and the route bridge refresh, enabling exceptions to propagate per CONTRIBUTING.md fail-fast policy. Added three Behave scenarios verifying RuntimeError, AttributeError, and TypeError propagation.
+
+* HAL 9000 has contributed the PyYAML security upgrade (PR #9244 / issue #9055): added `pyyaml>=6.0.3` dependency constraint to address known YAML parsing vulnerabilities.

@@ -0,0 +69,4 @@
+def step_pyyaml_minimum_version(context: Context, expected: str) -> None:
+    """Assert that the PyYAML minimum version is >= expected version."""
+    min_version = context.pyyaml_min_version
+    assert min_version == expected, (

@@ -0,0 +94,4 @@
+
+
+@then('the version constraint in uv.lock should include specifier "{specifier}"')
+def step_uv_lock_specifier(context: Context, specifier: str) -> None:

@@ -0,0 +129,4 @@
+        # Fallback for older Python versions without tomllib
+        import tomlkit
+
+        return tomlkit.parse(content.decode("utf-8")).unwrap()  # type: ignore[no-any-return]

@@ -47,6 +47,7 @@ dependencies = [
     "tomlkit>=0.13.0",  # TOML writing with comment preservation for config CLI
     "tenacity>=8.2.0",  # Retry framework for service layer resilience
     "aiohttp>=3.13.4",  # CVE-2026-34515 mitigation: open redirect vulnerability
+    "pyyaml>=6.0.3",  # Security: address known YAML parsing vulnerabilities

@@ -35,3 +35,4 @@ Below are some of the specific details of various contributions.
 * HAL 9000 has contributed the ACMS Index Data Model and File Traversal Engine (PR #9664 / issue #9579): foundational data structures for indexed context entries with hot/warm/cold/archive storage tier classification, tag system, and a timeout-safe chunked file traversal engine for large projects with 10,000+ files.
 * HAL 9000 has contributed the error-suppression removal fix (PR #9247 / issue #9060): removed both `try...except Exception:` blocks in `register_registry_agents()` that silently suppressed errors from `actor_registry.list_actors()` and the route bridge refresh, enabling exceptions to propagate per CONTRIBUTING.md fail-fast policy. Added three Behave scenarios verifying RuntimeError, AttributeError, and TypeError propagation.
 * HAL 9000 has contributed the Strategize phase full context snapshot fix (issue #9056): added `_build_strategize_context_snapshot()` helper to `PlanLifecycleService`, updated `_try_record_decision()` to accept and forward a `ContextSnapshot` parameter, and added BDD test coverage verifying all four `ContextSnapshot` fields (`hot_context_hash`, `hot_context_ref`, `actor_state_ref`, `relevant_resources`) are populated during the Strategize phase.
+* HAL 9000 has contributed the PyYAML security upgrade (PR #9244 / issue #9055): added `pyyaml>=6.0.3` dependency constraint to address known YAML parsing vulnerabilities.

@@ -0,0 +69,4 @@
+def step_pyyaml_minimum_version(context: Context, expected: str) -> None:
+    """Assert that the PyYAML minimum version is >= expected version."""
+    min_version = context.pyyaml_min_version
+    assert min_version == expected, (

@@ -0,0 +94,4 @@
+
+
+@then('the version constraint in uv.lock should include specifier "{specifier}"')
+def step_uv_lock_specifier(context: Context, specifier: str) -> None:

@@ -0,0 +129,4 @@
+        # Fallback for older Python versions without tomllib
+        import tomlkit
+
+        return tomlkit.parse(content.decode("utf-8")).unwrap()  # type: ignore[no-any-return]

@@ -35,3 +35,4 @@ Below are some of the specific details of various contributions.
 * HAL 9000 has contributed the ACMS Index Data Model and File Traversal Engine (PR #9664 / issue #9579): foundational data structures for indexed context entries with hot/warm/cold/archive storage tier classification, tag system, and a timeout-safe chunked file traversal engine for large projects with 10,000+ files.
 * HAL 9000 has contributed the error-suppression removal fix (PR #9247 / issue #9060): removed both `try...except Exception:` blocks in `register_registry_agents()` that silently suppressed errors from `actor_registry.list_actors()` and the route bridge refresh, enabling exceptions to propagate per CONTRIBUTING.md fail-fast policy. Added three Behave scenarios verifying RuntimeError, AttributeError, and TypeError propagation.
 * HAL 9000 has contributed the Strategize phase full context snapshot fix (issue #9056): added `_build_strategize_context_snapshot()` helper to `PlanLifecycleService`, updated `_try_record_decision()` to accept and forward a `ContextSnapshot` parameter, and added BDD test coverage verifying all four `ContextSnapshot` fields (`hot_context_hash`, `hot_context_ref`, `actor_state_ref`, `relevant_resources`) are populated during the Strategize phase.
+* HAL 9000 has contributed the PyYAML security upgrade (PR #9244 / issue #9055): added `pyyaml>=6.0.3` dependency constraint to address known YAML parsing vulnerabilities.

@@ -0,0 +69,4 @@
+def step_pyyaml_minimum_version(context: Context, expected: str) -> None:
+    """Assert that the PyYAML minimum version is >= expected version."""
+    min_version = context.pyyaml_min_version
+    assert min_version == expected, (

@@ -0,0 +94,4 @@
+
+
+@then('the version constraint in uv.lock should include specifier "{specifier}"')
+def step_uv_lock_specifier(context: Context, specifier: str) -> None:

@@ -0,0 +129,4 @@
+        # Fallback for older Python versions without tomllib
+        import tomlkit
+
+        return tomlkit.parse(content.decode("utf-8")).unwrap()  # type: ignore[no-any-return]

@@ -47,6 +47,7 @@ dependencies = [
     "tomlkit>=0.13.0",  # TOML writing with comment preservation for config CLI
     "tenacity>=8.2.0",  # Retry framework for service layer resilience
     "aiohttp>=3.13.4",  # CVE-2026-34515 mitigation: open redirect vulnerability
+    "pyyaml>=6.0.3",  # Security: address known YAML parsing vulnerabilities

@@ -0,0 +76,4 @@
+
+
+@when('I attempt to import the "{module_name}" module')
+def step_attempt_import(context: Context, module_name: str) -> None:

@@ -0,0 +100,4 @@
+    content = lock_path.read_bytes().decode("utf-8")
+
+    # Check that pyyaml is in the cleveragents package dependencies section
+    assert (

@@ -35,3 +35,4 @@ Below are some of the specific details of various contributions.
 * HAL 9000 has contributed the ACMS Index Data Model and File Traversal Engine (PR #9664 / issue #9579): foundational data structures for indexed context entries with hot/warm/cold/archive storage tier classification, tag system, and a timeout-safe chunked file traversal engine for large projects with 10,000+ files.
 * HAL 9000 has contributed the error-suppression removal fix (PR #9247 / issue #9060): removed both `try...except Exception:` blocks in `register_registry_agents()` that silently suppressed errors from `actor_registry.list_actors()` and the route bridge refresh, enabling exceptions to propagate per CONTRIBUTING.md fail-fast policy. Added three Behave scenarios verifying RuntimeError, AttributeError, and TypeError propagation.
 * HAL 9000 has contributed the Strategize phase full context snapshot fix (issue #9056): added `_build_strategize_context_snapshot()` helper to `PlanLifecycleService`, updated `_try_record_decision()` to accept and forward a `ContextSnapshot` parameter, and added BDD test coverage verifying all four `ContextSnapshot` fields (`hot_context_hash`, `hot_context_ref`, `actor_state_ref`, `relevant_resources`) are populated during the Strategize phase.
+* HAL 9000 has contributed the PyYAML security upgrade (PR #9244 / issue #9055): added `pyyaml>=6.0.3` dependency constraint to address known YAML parsing vulnerabilities.

@@ -0,0 +69,4 @@
+def step_pyyaml_minimum_version(context: Context, expected: str) -> None:
+    """Assert that the PyYAML minimum version is >= expected version."""
+    min_version = context.pyyaml_min_version
+    assert min_version == expected, (

@@ -0,0 +94,4 @@
+
+
+@then('the version constraint in uv.lock should include specifier "{specifier}"')
+def step_uv_lock_specifier(context: Context, specifier: str) -> None:

@@ -0,0 +129,4 @@
+        # Fallback for older Python versions without tomllib
+        import tomlkit
+
+        return tomlkit.parse(content.decode("utf-8")).unwrap()  # type: ignore[no-any-return]

@@ -47,6 +47,7 @@ dependencies = [
     "tomlkit>=0.13.0",  # TOML writing with comment preservation for config CLI
     "tenacity>=8.2.0",  # Retry framework for service layer resilience
     "aiohttp>=3.13.4",  # CVE-2026-34515 mitigation: open redirect vulnerability
+    "pyyaml>=6.0.3",  # Security: address known YAML parsing vulnerabilities

@@ -36,3 +36,4 @@ Below are some of the specific details of various contributions.
 * HAL 9000 has contributed the error-suppression removal fix (PR #9247 / issue #9060): removed both `try...except Exception:` blocks in `register_registry_agents()` that silently suppressed errors from `actor_registry.list_actors()` and the route bridge refresh, enabling exceptions to propagate per CONTRIBUTING.md fail-fast policy. Added three Behave scenarios verifying RuntimeError, AttributeError, and TypeError propagation.
 * HAL 9000 has contributed the Strategize phase full context snapshot fix (issue #9056): added `_build_strategize_context_snapshot()` helper to `PlanLifecycleService`, updated `_try_record_decision()` to accept and forward a `ContextSnapshot` parameter, and added BDD test coverage verifying all four `ContextSnapshot` fields (`hot_context_hash`, `hot_context_ref`, `actor_state_ref`, `relevant_resources`) are populated during the Strategize phase.
 * HAL 9000 has contributed the ACMS context path matching fix (PR #10975 / issue #10972): corrects `_path_matches()` and `_matches_pattern()` to properly match absolute fragment paths against relative glob patterns by auto-prefixing with `**/` before calling `PurePath.full_match()`, preventing silent inefficacy of include/exclude filters for absolute paths in fragment metadata.
+* HAL 9000 has contributed the PyYAML security upgrade (PR #9244 / issue #9055): added `pyyaml>=6.0.3` dependency constraint to address known YAML parsing vulnerabilities.

@@ -0,0 +2,4 @@
+
+from __future__ import annotations
+
+import importlib

@@ -0,0 +66,4 @@
+    context.pyyaml_min_version = match.group(1)
+
+
+@then("the minimum version should be at least \"{expected}\"")

@@ -0,0 +95,4 @@
+
+
+@then('the version constraint in uv.lock should include specifier "{specifier}"')
+def step_uv_lock_specifier(context: Context, specifier: str) -> None:

@@ -0,0 +111,4 @@
+def _toml_to_python(data: object) -> dict[str, Any]:
+    """Convert a TOML document from tomlkit (or tomllib) to plain Python dicts."""
+    if isinstance(data, dict):
+        def _flatten(d: dict[Any, Any]) -> dict[str, Any]:

@@ -0,0 +1,146 @@
+"""Step definitions for PyYAML security dependency verification (#9055)."""
+
+from __future__ import annotations
+

@@ -0,0 +10,4 @@
+from behave import given, then, when
+from behave.runner import Context
+from packaging.version import parse as parse_version
+

@@ -0,0 +68,4 @@
+    # Examples: "pyyaml>=6.0.3", "pyyaml>=6.0", "pyyaml==6.0.2"
+    match = re.search(r"(?:>=|==|~>)([\d]+(?:\.[\d]+)*(?:\.\w+)*)", pyyaml_dep)
+    assert match is not None, (
+        f"Could not parse version from PyYAML dependency: {pyyaml_dep}"

@@ -0,0 +79,4 @@
+def step_pyyaml_minimum_version(context: Context, expected: str) -> None:
+    """Assert that the PyYAML minimum version is >= expected version."""
+    min_version = context.pyyaml_min_version
+    assert parse_version(min_version) >= parse_version(expected), (