pip install hindsight-all silently backtracks to 0.4.17 on glibc < 2.35 Linux (local-ml deps publish no compatible wheels, no sdist)

Bug Description

On Linux hosts with glibc < 2.35 (e.g. RHEL/Alma/Rocky 8, Ubuntu 20.04, Debian 11, CentOS 8), the README quickstart pip install hindsight-all never installs a current release: it silently backtracks to hindsight-all 0.4.17 (2026-03-10), the last release that doesn't depend on hindsight-api-slim[all].

This is the Linux sibling of #2115 (same silent-backtrack failure mode on Intel macOS), with a sharper edge: the backtracked set includes torch-2.5.1, below the torch>=2.6.0 floor that current releases pin explicitly as a remote-code-execution CVE fix — a months-old dependency set including known-vulnerable versions, installed with no error and no warning.

uv (which does not backtrack by default) surfaces the underlying reason instead:

$ uv pip install "hindsight-all==0.10.0"
  × No solution found when resolving dependencies:
  ╰─▶ Because mlx{sys_platform != 'win32'}>=0.31.0 has no wheels with a
      matching platform tag (e.g., `manylinux_2_32_x86_64`) and
      hindsight-api-slim[all]==0.10.0 depends on mlx{sys_platform != 'win32'}>=0.31.0,
      we can conclude that hindsight-api-slim[all]==0.10.0 cannot be used.
    hint: Wheels are available for `mlx` (v0.32.2) on the following platforms:
      `manylinux_2_35_aarch64`, `manylinux_2_35_x86_64`, `macosx_14_0_arm64`, ...

Root cause: in hindsight-api-slim's local-ml extra (pulled in by [all]), mlx/mlx-lm are gated with sys_platform != 'win32'. But mlx publishes Linux wheels only for manylinux_2_35 (glibc ≥ 2.35) and ships no sdist — so on glibc 2.28–2.34 the requirement is unsatisfiable, [all]/[local-ml] cannot resolve at all, and pip backtracks the metapackage to a pre-slim release. The supported-platforms docs currently mark Linux bare-metal as fully supported with no glibc caveat.

Steps to Reproduce

On a glibc 2.28 host (ldd --version → 2.28), Python 3.12:

$ pip install --dry-run --only-binary :all: hindsight-all
...
Would install ... hindsight-all-0.4.17 hindsight-api-0.1.5 ...
... torch-2.5.1 ... sentence-transformers-3.2.1 transformers-4.45.2 ...

Current release is 0.10.0, and torch 2.5.1 < 2.6.0 (the pinned CVE floor) — pip backtracks through every release since 0.4.17 with no diagnostic.

Expected Behavior

pip install hindsight-all on glibc 2.28–2.34 Linux installs the current release. The mlx-based Apple-Silicon local-generation path was never usable there (no wheels exist and never have been), so the rest of the bundle — torch-backed embeddings/reranker included — should resolve without it.

Actual Behavior

pip silently backtracks to hindsight-all 0.4.17 with a stale dependency set that includes torch-2.5.1, below the project's own torch>=2.6.0 CVE floor. uv fails outright. Nothing in the docs mentions a glibc requirement.

Version

hindsight-all current release (0.10.0) affected. Reproduced with pip 26.2.1 / uv 0.10.8, Python 3.12, glibc 2.28 (CentOS 8-based).

Happy to send a PR implementing per-platform wheel metadata (same pure-Python wheel, three tags, mlx metadata only where mlx actually ships wheels) if that direction sounds good.