build: bump fastmcp from 3.4.4 to 3.4.5

.gitattributes

@@ -0,0 +1,2 @@
+tests/okf/LICENSE.upstream.md whitespace=-blank-at-eof linguist-vendored
+tests/okf/upstream-sample/** linguist-vendored

.github/workflows/ci.yaml

@@ -10,9 +10,35 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
+        with:
+          # The benchmark receipt binds artifacts to the execution commit,
+          # which is intentionally the parent of the receipt commit.
+          fetch-depth: 0
       - uses: astral-sh/setup-uv@v7
       - run: uv venv --python 3.13
       - run: uv pip install -e '.[dev]'
+      - name: Read pinned OKF revision
+        id: okf-pin
+        run: |
+          python3 - <<'PY' >> "$GITHUB_OUTPUT"
+          import json
+          from pathlib import Path
+
+          pin = json.loads(Path("tests/okf/reference.json").read_text())
+          print(f"sha={pin['commit']}")
+          PY
+      - name: Check out the exact official OKF revision
+        uses: actions/checkout@v7
+        with:
+          repository: GoogleCloudPlatform/knowledge-catalog
+          ref: ${{ steps.okf-pin.outputs.sha }}
+          path: to-delete/okf-reference
+          persist-credentials: false
+      - name: Prove bidirectional OKF interoperability
+        run: |
+          uv run python scripts/okf_conformance.py verify-pin
+          uv run python scripts/okf_conformance.py consume-data-olympus --upstream-root to-delete/okf-reference
+          uv run python scripts/okf_conformance.py consume-upstream
       - run: uv run ruff check .
       - run: uv run mypy src
       - name: Benchmark docs drift guard (docs match committed results)

.github/workflows/okf-pin-freshness.yml

@@ -0,0 +1,140 @@
+name: OKF pin freshness
+
+on:
+  schedule:
+    - cron: "17 7 * * 1"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  issues: write
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - name: Compare the pin with official OKF main
+        uses: actions/github-script@v8
+        with:
+          script: |
+            const fs = require("fs");
+            const crypto = require("crypto");
+            const pin = JSON.parse(
+              fs.readFileSync("tests/okf/reference.json", "utf8")
+            );
+            const title = "[automation] OKF reference pin is stale";
+            const upstream = await github.rest.repos.getCommit({
+              owner: "GoogleCloudPlatform",
+              repo: "knowledge-catalog",
+              ref: "main",
+            });
+            const upstreamSha = upstream.data.sha;
+            const tree = await github.rest.git.getTree({
+              owner: "GoogleCloudPlatform",
+              repo: "knowledge-catalog",
+              tree_sha: upstream.data.commit.tree.sha,
+              recursive: "true",
+            });
+            if (tree.data.truncated) {
+              throw new Error("upstream tree response was truncated");
+            }
+            const prefix = `${pin.fixture_path}/`;
+            const blobs = tree.data.tree
+              .filter(item => item.type === "blob" && item.path.startsWith(prefix))
+              .sort((left, right) =>
+                left.path < right.path ? -1 : left.path > right.path ? 1 : 0
+              );
+            if (blobs.length === 0) {
+              throw new Error(`upstream fixture is missing at ${pin.fixture_path}`);
+            }
+            const hash = crypto.createHash("sha256");
+            for (const blob of blobs) {
+              const response = await github.rest.git.getBlob({
+                owner: "GoogleCloudPlatform",
+                repo: "knowledge-catalog",
+                file_sha: blob.sha,
+              });
+              const content = Buffer.from(response.data.content.replace(/\n/g, ""), "base64");
+              hash.update(`./${blob.path.slice(prefix.length)}`);
+              hash.update("\0");
+              hash.update(content);
+              hash.update("\0");
+            }
+            const upstreamFixtureSha256 = hash.digest("hex");
+            const listed = await github.paginate(
+              github.rest.issues.listForRepo,
+              {
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                state: "all",
+                per_page: 100,
+              }
+            );
+            const matches = listed.filter(
+              issue => !issue.pull_request && issue.title === title
+            );
+            const canonical = matches[0];
+
+            for (const duplicate of matches.slice(1)) {
+              if (duplicate.state === "open") {
+                await github.rest.issues.update({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  issue_number: duplicate.number,
+                  state: "closed",
+                  state_reason: "not_planned",
+                });
+              }
+            }
+
+            if (pin.fixture_sha256 === upstreamFixtureSha256) {
+              core.info(`OKF fixture remains current at upstream ${upstreamSha}`);
+              if (canonical && canonical.state === "open") {
+                await github.rest.issues.createComment({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  issue_number: canonical.number,
+                  body: `The pinned fixture content is current again at upstream \`${upstreamSha}\`. Closing.`,
+                });
+                await github.rest.issues.update({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  issue_number: canonical.number,
+                  state: "closed",
+                  state_reason: "completed",
+                });
+              }
+              return;
+            }
+
+            const body = [
+              "The official Google OKF fixture has changed beyond the reviewed pin.",
+              "",
+              `* Recorded pin: \`${pin.commit}\``,
+              `* Current upstream: \`${upstreamSha}\``,
+              `* Recorded fixture SHA256: \`${pin.fixture_sha256}\``,
+              `* Current fixture SHA256: \`${upstreamFixtureSha256}\``,
+              "",
+              "Review the upstream diff, refresh the vendored fixture and license provenance,",
+              "rerun both conformance directions, and update the pin in a reviewed pull request.",
+              "This workflow never changes the pin automatically.",
+            ].join("\n");
+
+            if (canonical) {
+              await github.rest.issues.update({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: canonical.number,
+                title,
+                body,
+                state: "open",
+              });
+            } else {
+              await github.rest.issues.create({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                title,
+                body,
+              });
+            }

.github/workflows/publish-pypi-reusable.yml

@@ -1,16 +1,13 @@
 # .github/workflows/publish-pypi-reusable.yml
 #
-# INERT UNTIL OPERATOR SETUP. This workflow uploads to PyPI via Trusted
-# Publishing (OIDC, no API token). It CANNOT succeed until the operator creates
-# a pending publisher on pypi.org. PyPI binds the publisher to the TOP-LEVEL
-# workflow that starts the run, and this reusable workflow is called from TWO of
-# them, so BOTH need a publisher (same owner=knaisoma, repo=data-olympus,
-# environment=pypi):
-#   - workflow=tag-release.yml     (PRIMARY: normal main-merge release path)
-#   - workflow=publish-pypi.yml    (fallback: human-pushed tag / manual dispatch)
-# See docs/releases/pypi-trusted-publishing.md for the exact click-path. Until
-# then the `upload` job's publish STEP fails (nothing is uploaded); the `build`
-# job and `twine check` still pass, so the release tag/image are unaffected.
+# This workflow uploads to PyPI via Trusted Publishing (OIDC, no API token).
+# PyPI binds the publisher to the TOP-LEVEL
+# workflow that starts the run. This reusable workflow is now called only from
+# publish-pypi.yml, the human-pushed tag and manual fallback. The primary
+# rc-publish.yml and tag-release.yml paths publish inline and have their own
+# publisher identities.
+# See docs/releases/pypi-trusted-publishing.md for the exact setup path. A
+# missing publisher or a registry mismatch fails the caller closed.
 name: publish-pypi-reusable
 
 on:
@@ -31,6 +28,8 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: read
+    outputs:
+      version: ${{ steps.version.outputs.version }}
     steps:
       - name: Checkout
         uses: actions/checkout@v7
@@ -39,16 +38,27 @@ jobs:
           fetch-depth: 0
       - name: Set up uv
         uses: astral-sh/setup-uv@v7
+      - name: Read expected package version
+        id: version
+        run: |
+          python3 - <<'PY' >> "$GITHUB_OUTPUT"
+          import tomllib
+
+          with open("pyproject.toml", "rb") as stream:
+              print(f"version={tomllib.load(stream)['project']['version']}")
+          PY
       - name: Build sdist + wheel
         run: uv build
       - name: Verify metadata (twine check)
         run: uvx twine check --strict dist/*
-      - name: Smoke-test the built wheel
-        # Confirms the console entry point and the packaged bin/ machinery ship
-        # correctly, so a broken build is caught BEFORE any PyPI upload.
+      - name: Smoke-test the built distributions
+        env:
+          VERSION: ${{ steps.version.outputs.version }}
         run: |
-          uvx --from ./dist/*.whl data-olympus --help
-          uvx --from ./dist/*.whl data-olympus setup --check --no-version-check
+          for artifact in dist/*.whl dist/*.tar.gz; do
+            uv run python scripts/smoke_installed_wheel.py \
+              --artifact "$artifact" --expected-version "$VERSION"
+          done
       - name: Upload build artifacts
         uses: actions/upload-artifact@v7
         with:
@@ -79,15 +89,42 @@ jobs:
           path: dist/
       - name: Publish to PyPI (Trusted Publishing)
         uses: pypa/gh-action-pypi-publish@release/v1
-        # continue-on-error keeps this INERT until the operator configures the
-        # pypi.org Trusted Publisher: before that, the OIDC exchange fails, but a
-        # failed upload here must not fail the release (the tag + image are already
-        # published by the caller). Once the publisher exists the upload succeeds.
-        # A step-level continue-on-error is the correct mechanism; a `uses:` job in
-        # the caller cannot carry continue-on-error.
-        continue-on-error: true
-        # No `password:` / token: OIDC Trusted Publishing only. skip-existing so a
+        # No `password:` or token: OIDC Trusted Publishing only. skip-existing so a
         # partial-failure rerun of an already-uploaded version is a no-op, not an
         # error (mirrors the idempotent tag/image/release jobs).
         with:
           skip-existing: true
+      - name: Verify PyPI files by SHA256
+        env:
+          PYPI_VERSION: ${{ needs.build.outputs.version }}
+        run: |
+          python3 - <<'PY'
+          import hashlib
+          import json
+          import os
+          import pathlib
+          import time
+          import urllib.request
+
+          url = f"https://pypi.org/pypi/data-olympus/{os.environ['PYPI_VERSION']}/json"
+          for attempt in range(12):
+              try:
+                  with urllib.request.urlopen(url, timeout=15) as response:
+                      payload = json.load(response)
+                  break
+              except Exception:
+                  if attempt == 11:
+                      raise
+                  time.sleep(5)
+          remote = {item["filename"]: item["digests"]["sha256"] for item in payload["urls"]}
+          dist = pathlib.Path("dist")
+          artifacts = sorted([*dist.glob("*.whl"), *dist.glob("*.tar.gz")])
+          if not artifacts:
+              raise SystemExit("No publishable Python artifacts found")
+          local = {
+              path.name: hashlib.sha256(path.read_bytes()).hexdigest()
+              for path in artifacts
+          }
+          if remote != local:
+              raise SystemExit(f"PyPI SHA256 mismatch: local={local}, remote={remote}")
+          PY

.github/workflows/publish-pypi.yml

@@ -1,16 +1,15 @@
 # .github/workflows/publish-pypi.yml
 #
-# INERT UNTIL OPERATOR SETUP. The `upload` path (real releases + manual tag)
-# cannot succeed until the operator configures a PyPI Trusted Publisher on
+# REQUIRES OPERATOR SETUP. The `upload` path for real releases and manual tags
+# fails closed until the operator configures a PyPI Trusted Publisher on
 # pypi.org: owner=knaisoma, repo=data-olympus, workflow=publish-pypi.yml,
 # environment=pypi. See docs/releases/pypi-trusted-publishing.md.
 #
 # NORMAL RELEASE PATH: this file is NOT the primary release trigger. The live
-# release chain is tag-release.yml (on: push main -> should_tag.py -> tag pushed
-# with GITHUB_TOKEN). Because GITHUB_TOKEN-created tag pushes do NOT trigger
+# release chain uses inline Trusted Publishing jobs in rc-publish.yml and
+# tag-release.yml. Because GITHUB_TOKEN-created tag pushes do NOT trigger
 # `on: push tags` workflows, the `release` job below does not fire in the normal
-# flow; tag-release.yml calls publish-pypi-reusable.yml directly (mirroring how
-# it builds the image). This file provides two things tag-release.yml cannot:
+# flow. This file provides two independent fallback paths:
 #   1. a PR-time DRY RUN (build + twine check, no upload) for packaging changes;
 #   2. a manual-tag / human-pushed-tag FALLBACK (same rationale as
 #      release-image.yml's tag trigger, STD-U-810 section 9).
@@ -23,6 +22,8 @@ on:
       - "pyproject.toml"
       - "src/**"
       - "bin/**"
+      - "scripts/smoke_installed_wheel.py"
+      - "tests/test_installed_wheel_smoke.py"
       - ".github/workflows/publish-pypi*.yml"
   # FALLBACK for a human-pushed tag (tag-release.yml's GITHUB_TOKEN push does not
   # reach here). Real upload.