v0.13.3 — upstream mcp 2.0 broke fresh installs; capped, fixed, and guarded

If you installed Columna between 13:45 UTC on 2026-07-28 and now, and it failed on import — this is the fix. pip install --upgrade columna.

Nothing in this repository changed. The break arrived by resolver.

when (UTC)	what
2026-07-27	0.13.2 published; public launch. columna-server declared mcp>=1.0 — no ceiling.
2026-07-28 13:41:40	upstream publishes mcp 1.29.0, the last of the 1.x line.
2026-07-28 13:45:28	upstream publishes mcp 2.0.0, four minutes later. It moves/removes mcp.server.fastmcp.
2026-07-28 ~13:45 → 2026-07-29	every fresh pip install columna resolves to 2.0.0 and dies at import: ModuleNotFoundError: No module named 'mcp.server.fastmcp', exit 1, before a single mood prints.
2026-07-29 03:47	our CI goes red on main — on a specs-only merge. That red was the upstream break surfacing.
2026-07-29	0.13.3 / columna-server 0.8.2. Fixed.

Anyone who installed before 13:45 on the 28th is unaffected — their resolver already took a 1.x. The people this hit are exactly the ones the quickstart is written for: strangers, arriving after launch, typing the install-page command for the first time. We are sorry, and we would rather say what happened with timestamps than describe this release as "dependency maintenance".

What shipped

• mcp>=1.0,<2.0 — resolves to 1.29.0. The door is named, not closed: the cap lifts to <3.0 when the server is ported to the 2.x import path and the MCP stdio acceptance suite is green against it.
• A repo-wide cap sweep — every dependency in every package now carries an upper bound: runtime, optional extras, and build backends.
• A guard that makes it permanent — scripts/assert_dep_caps.py runs in CI on every push and PR and fails, naming the offender, if any dependency lacks a ceiling. Twice is a class: an unbounded requires-python on launch eve (0.13.2, found by a human on a Windows pass), an unbounded mcp the day after (found by CI going red on a commit that touched no code). The third instance should be impossible by construction, not by vigilance.
• CI now resolves the server's dependencies from its own package metadata, not from a hand-copied spec. The previous arrangement meant the shipped constraint was never the thing under test — which is how this stayed invisible.

An uncapped dependency is not permissiveness. It is an untested claim about versions that do not exist yet, and it breaks strangers' installs with nothing in the repo changing.

Versions

columna 0.13.3 · columna-core 0.13.3 · columna-server 0.8.2. The umbrella floor moves to columna-server>=0.8.2, so pip install columna cannot resolve to the broken build. No surface, wire, or behaviour change — contract_version stays "1".

Full detail: packages/columna-server/CHANGELOG.md (0.8.2) and packages/columna-core/CHANGELOG.md (0.13.3).