Production-grade LangGraph template

Highlights

• LLM_PROVIDER=mock fully works end-to-end. BaseAgent no longer crashes calling bind_tools() on the mock chat model, and the mock's canned LLM responses now match the real pipeline's call sequence — a fresh clone + uv sync + LLM_PROVIDER=mock gives a coherent POST /run response with zero cost and no API key. cp .env.example .env also no longer crashes on the empty PACK_DEFAULT_BUDGET_USD default.
• Current-generation LLM model defaults across every provider: Anthropic claude-sonnet-5, OpenAI gpt-5.5, Google gemini-3.5-flash, Bedrock anthropic.claude-sonnet-5 (config, .env.example, and the core/cost.py pricing table).
• api/main.py split into modules — api/app.py, lifespan.py, middleware.py, dependencies.py, router_factory.py, api/endpoints/* — instead of one monolithic file.
• 13 domain packs, namespaced by business domain (research/, productivity/, hr/, finance/, legal/), each with typed request/response schemas and auto-generated API routes. Regulated verticals (HR/legal/finance) ship compliance guardrails and are gated behind REGULATED_PACKS_ENABLED=false (HTTP 403 until you opt in after completing the pack's COMPLIANCE.md).
• Security hardening: Security Scanning workflow green on main (gitleaks allowlist for confirmed false positives, patched starlette/langsmith CVEs), plus the existing rate limiting, input validation, and prompt-injection guards.
• Supply chain: GHCR images signed with Cosign and published with an SBOM (Syft) on every main build.
• README rewritten for public launch: an honest "Why this instead of…" section (vs. LangGraph Platform, vs. generic agent-service-toolkit templates), a bulletproof quickstart (mock-provider callout, uv install link, cost estimate, mock-search note), and credibility signals (758+ tests, ~87% coverage, scaling guidance, PR template, SECURITY.md).

Upgrading

No breaking config changes since 0.5.0 for existing deployments. If you pin ANTHROPIC_MODEL / OPENAI_MODEL / GOOGLE_MODEL / BEDROCK_MODEL explicitly in your .env, your override is unaffected — only the defaults changed.

See CHANGELOG.md for the full list of changes.