nvidia-alchemi: fix dependency advisories and release smoke import path

agents/nvidia-alchemi/CHANGELOG.md

@@ -14,6 +14,12 @@ checkpoint bytes are unchanged from 1.1.1.
 
 - Updated GitPython, hydra-core, multidict and urllib3 to patched versions after
   dependency review identified published advisories.
+- Updated certifi to 2026.10.19 to remove the compromised emSign root CAs
+  (GHSA-6q48-6c7w-9gw2).
+- Updated aiohttp 3.14.4, filelock 4.2.1, GitPython 3.2.1, hydra-core 1.3.8 and
+  Pillow 13.0.0 for high and critical advisories reviewed after the previous
+  update, and setuptools 84.1.0 for a low-severity advisory. yarl moves to 1.25.1,
+  the minimum aiohttp 3.14.4 requires.
 - Checkpoints are downloaded, size/hash verified, and only then deserialized.
 - Runtime learned-model aliases resolve only to hash-verified checkpoints baked
   into the image; explicit existing local paths remain available for training
@@ -36,7 +42,9 @@ checkpoint bytes are unchanged from 1.1.1.
 ### Fixed
 
 - Image-build tests can import the checkpoint downloader from `/app/build`
-  without adding that directory to the runtime import path.
+  without adding that directory to the runtime import path, so
+  `python /app/release_smoke.py` runs unchanged in the deployed image. Image-build
+  tests now run with the runtime `PYTHONPATH` to catch import-path regressions.
 - Screening validation tests explicitly use the selected test device, and the
   release-manifest test checks the shared AIMNet cache under `/opt/cache/aimnet`.
 

agents/nvidia-alchemi/README.md

@@ -139,11 +139,11 @@ cannot alone prove logical independence; callers must retain real observations.
 
 Tests are in [tools/nvidia-alchemi/tests](tools/nvidia-alchemi/tests). Run them using
 Python's `unittest` discovery with the tool directory on `PYTHONPATH`; no pytest
-dependency is required. Inside the image, include `/app/build` for the checkpoint
-downloader tests:
+dependency is required. Inside the image, the runtime `PYTHONPATH` is sufficient; the
+checkpoint downloader tests locate `/app/build` themselves:
 
 ```bash
-PYTHONPATH=/app:/app/build python -B -m unittest discover -s /app/tests -v
+python -B -m unittest discover -s /app/tests -v
 ```
 
 Image-build tests explicitly use the CPU test path. Set `ALCHEMI_TEST_GPU=1` on

agents/nvidia-alchemi/tools/nvidia-alchemi/Dockerfile

@@ -54,6 +54,6 @@ ENV PYTHONPATH="/app" \
     ALCHEMI_AGENT_RELEASE="1.1.2" \
     ALCHEMI_BASE_IMAGE="${BASE_IMAGE}"
 RUN python /app/build_release_manifest.py \
-    && PYTHONPATH="/app:/app/build" python -B -m unittest discover -s /app/tests -v
+    && python -B -m unittest discover -s /app/tests -v
 WORKDIR /app/workdir
 CMD ["/bin/bash"]

agents/nvidia-alchemi/tools/nvidia-alchemi/requirements-build.txt

@@ -6,7 +6,7 @@ absl-py==2.5.0
 aimnet==0.2.0
 aiobotocore==3.9.0
 aiohappyeyeballs==2.7.1
-aiohttp==3.14.3
+aiohttp==3.14.4
 aioitertools==0.13.0
 aiosignal==1.4.0
 annotated-types==0.8.0
@@ -19,7 +19,7 @@ beartype==0.22.9
 bibtexparser==1.4.4
 botocore==1.43.56
 cachetools==7.1.7
-certifi==2026.7.22
+certifi==2026.10.19
 cftime==1.6.5
 charset-normalizer==3.5.1
 click==8.4.2
@@ -44,21 +44,21 @@ donfig==0.8.1.post1
 e3nn==0.4.4
 einops==0.8.2
 fastrlock==0.8.3
-filelock==3.32.3
+filelock==4.2.1
 fonttools==4.63.0
 frozenlist==1.8.0
 fsspec==2026.7.0
 gast==0.7.0
 gitdb==4.0.12
-GitPython==3.1.62
+GitPython==3.2.1
 google-crc32c==1.8.0
 h11==0.16.0
 h5py==3.16.0
 hf-xet==1.6.0
 httpcore==1.0.9
 httpx==0.28.1
 huggingface_hub==1.28.0
-hydra-core==1.3.7
+hydra-core==1.3.8
 idna==3.19
 importlib_metadata==9.0.0
 jaxtyping==0.3.11
@@ -136,7 +136,7 @@ packaging==26.2
 palettable==3.3.3
 pandas==2.3.3
 periodictable==2.0.2
-pillow==12.3.0
+pillow==13.0.0
 pip==26.2.1
 platformdirs==4.11.3
 plotext==5.3.2
@@ -169,7 +169,7 @@ safetensors==0.8.0
 scikit-learn==1.9.0
 scipy==1.18.0
 seaborn==0.13.2
-setuptools==84.0.0
+setuptools==84.1.0
 six==1.17.0
 smmap==5.0.3
 spglib==2.7.0
@@ -197,6 +197,6 @@ warp-lang==1.16.0
 wcwidth==0.8.2
 wheel==0.48.0
 wrapt==2.3.0
-yarl==1.24.5
+yarl==1.25.1
 zarr==3.3.0
 zipp==4.1.0

agents/nvidia-alchemi/tools/nvidia-alchemi/tests/test_download_checkpoints.py

@@ -3,10 +3,18 @@
 import hashlib
 import json
 from pathlib import Path
+import sys
 import tempfile
 import unittest
 from unittest.mock import patch
 
+# The downloader lives beside the tests in the repository and in /app/build in
+# the image, which is deliberately not on the runtime PYTHONPATH.
+_TOOL_DIR = Path(__file__).resolve().parents[1]
+for _candidate in (_TOOL_DIR, _TOOL_DIR / "build"):
+    if (_candidate / "download_checkpoints.py").is_file() and str(_candidate) not in sys.path:
+        sys.path.append(str(_candidate))
+
 import download_checkpoints as downloader