Skip to content

feat: prepare data-olympus 0.6.0 Glama catalog readiness#165

Merged
ajdelaguila merged 42 commits into
mainfrom
feature/kna-141
Jul 18, 2026
Merged

feat: prepare data-olympus 0.6.0 Glama catalog readiness#165
ajdelaguila merged 42 commits into
mainfrom
feature/kna-141

Conversation

@ajdelaguila

@ajdelaguila ajdelaguila commented Jul 17, 2026

Copy link
Copy Markdown
Contributor

Summary

This draft integration PR carries the KNA-141 release batch for data-olympus 0.6.0 Glama catalog readiness.

Included work:

Review evidence:

  • KNA-147 approved KNA-143.
  • KNA-148 approved KNA-144.
  • KNA-149 approved KNA-142.
  • KNA-150 approved KNA-146.
  • KNA-152 approved KNA-145 with concerns limited to integration bookkeeping and post-merge Glama rescan scope.

Local verification on feature/kna-141:

  • uv run pytest -q: passed, with two optional dependency skips.
  • uv run ruff check .: passed.
  • uv run mypy src: passed.
  • bats -r tests: passed, with the existing bats warning for an expected missing command path.
  • uv lock --check: passed.
  • uv run python scripts/compute_release.py: releasable minor, next_version 0.6.0.

Known release gates before merge:

@ajdelaguila
feat: improve kb_record_event tool definition for Glama catalog (gh #153
d241305 
 / KNA-143)

Rewrite the kb_record_event docstring to cover all three Glama
dimensions that scored below A:

- Behavior: discloses that the tool appends a durable, non-destructive
  entry to the audit log and requires write capability.
- Completeness: documents both event_type values (gate_bypass,
  gate_degraded), all required params, and that reason is optional but
  recommended for gate_bypass entries.
- Usage Guidelines: when to call (enforce hook bypassed or degraded the
  gate and the fallback must be recorded) vs. when not to (use
  kb_gate_check to check, kb_consult to consult, kb_audit or
  kb_compliance to read back events).
@ajdelaguila
feat: improve tool definitions for 7 tools (gh #154 / KNA-144)
94b1cc2 
Add a 'Use when / use X instead when Y' guidance sentence to each of
kb_outline, kb_get, kb_list, kb_onboarding_status, kb_cleanup_plan,
kb_gate_check, and kb_compliance.

Also discloses kb_gate_check's audit-log side effect: each check is
recorded non-destructively (readOnlyHint=false is intentional).

Target: Usage Guidelines avg >= 4.3 and Behavior avg >= 4.2 on next
Glama re-score; Conciseness avg must not regress below 4.50.
@ajdelaguila
fix(deps): bump mcp for security gate
9995e55
@ajdelaguila
fix(index): harden Glama empty index reads
6d821db
@ajdelaguila
docs(glama): add related server metadata
2ec7ffd
@ajdelaguila

ajdelaguila commented Jul 17, 2026

Copy link
Copy Markdown
Contributor Author

Codex recovery check for KNA-141 on 2026-07-17. The feature/kna-141 branch is clean and still matches origin/feature/kna-141 at 2ec7ffd. Fresh local gates passed: uv run pytest -q, uv run ruff check ., uv run mypy src, bats -r tests, uv lock --check, and uv run python scripts/compute_release.py reports next_version 0.6.0. GitHub PR checks are green. KNA-153 is APPROVE WITH CONCERNS, with both concerns non-blocking. This PR is ready for GitHub review and release-cutter handling, but it is not ready to merge until the cutter adds the version and release notes commit and completes the RC approval path. KNA-151 remains blocked until integration merge and release image availability.

@ajdelaguila
ajdelaguila marked this pull request as ready for review July 17, 2026 14:36
@ajdelaguila
ajdelaguila requested a review from a team as a code owner July 17, 2026 14:36
ajdelaguila and others added 9 commits July 18, 2026 07:32
@ajdelaguila
Merge remote-tracking branch 'origin/main' into feature/kna-141
aa3d0fc
@dependabot
build: bump fastmcp from 3.4.3 to 3.4.4
58918c9 
Bumps [fastmcp](https://github.com/PrefectHQ/fastmcp) from 3.4.3 to 3.4.4.
- [Release notes](https://github.com/PrefectHQ/fastmcp/releases)
- [Changelog](https://github.com/PrefectHQ/fastmcp/blob/main/docs/changelog.mdx)
- [Commits](PrefectHQ/fastmcp@v3.4.3...v3.4.4)

---
updated-dependencies:
- dependency-name: fastmcp
  dependency-version: 3.4.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
build: bump regex from 2026.5.9 to 2026.7.10
2512811 
Bumps [regex](https://github.com/mrabarnett/mrab-regex) from 2026.5.9 to 2026.7.10.
- [Changelog](https://github.com/mrabarnett/mrab-regex/blob/hg/changelog.txt)
- [Commits](mrabarnett/mrab-regex@2026.5.9...2026.7.10)

---
updated-dependencies:
- dependency-name: regex
  dependency-version: 2026.7.10
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
build: bump types-regex from 2026.6.28.20260630 to 2026.7.10.20260711
4175e3a 
Bumps [types-regex](https://github.com/python/typeshed) from 2026.6.28.20260630 to 2026.7.10.20260711.
- [Commits](https://github.com/python/typeshed/commits)

---
updated-dependencies:
- dependency-name: types-regex
  dependency-version: 2026.7.10.20260711
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
build: bump mypy from 2.2.0 to 2.3.0
31e1678 
Bumps [mypy](https://github.com/python/mypy) from 2.2.0 to 2.3.0.
- [Changelog](https://github.com/python/mypy/blob/master/CHANGELOG.md)
- [Commits](python/mypy@v2.2.0...v2.3.0)

---
updated-dependencies:
- dependency-name: mypy
  dependency-version: 2.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
build: bump ruff from 0.15.20 to 0.15.22
e527663 
Bumps [ruff](https://github.com/astral-sh/ruff) from 0.15.20 to 0.15.22.
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.15.20...0.15.22)

---
updated-dependencies:
- dependency-name: ruff
  dependency-version: 0.15.21
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@ajdelaguila
docs(changelog): record torch security update
737b6a6
@ajdelaguila
chore(release): v0.6.0
c4fad07
@ajdelaguila
docs(changelog): add 0.6.0 compare links
e2c1e0f
@ajdelaguila

ajdelaguila commented Jul 18, 2026

Copy link
Copy Markdown
Contributor Author

Exact-SHA release review update

Claude independently reconfirmed APPROVE for e2c1e0f57b70163229659de962cf532d5c92b43d. The only delta from the previously approved full review is the two CHANGELOG comparison references: [Unreleased] now starts at v0.6.0, and [0.6.0] compares v0.5.0...v0.6.0. No other file changed.

All exact-SHA gates are green: full test, Ruff, mypy, pytest, 74 Bats CLI tests, changelog guard, version-free guard, documentation consistency guard, dry-run build, title lint, and CodeQL. Security gate is clear with zero open Dependabot or CodeQL alerts.

Verdict: APPROVE, bound to e2c1e0f57b70163229659de962cf532d5c92b43d.

@ajdelaguila

ajdelaguila commented Jul 18, 2026

Copy link
Copy Markdown
Contributor Author

Exact SHA release review update

Current release HEAD ba269eb received independent whole branch APPROVE. The prior approved release tree is unchanged except for the independently approved release image provenance fix from PR 167. All exact SHA CI gates and local workflow, lock, and security checks are green.

RC.1 was rejected before deployment because it was built by the former reusable workflow from main rather than the requested release branch. The defect is now fixed on trusted main and synchronized into this release SHA. RC.2 will be the first deployable candidate.

Verdict: APPROVE, bound to ba269eb.

@ajdelaguila

ajdelaguila commented Jul 18, 2026

Copy link
Copy Markdown
Contributor Author

RC canary evidence for operator ship decision

Release candidate: 0.6.0-rc.2
Reviewed source SHA: ba269eb
Image digest: sha256:328068a53c826b0941c031c649848fcfa16c1437733b04137075ae0ea426c8d3
Pull request: #165

The Git tag, GitHub prerelease target, image checkout, OCI revision label, and deployed kn-dev pod all bind to the reviewed SHA and digest. Exact SHA CI is fully green. Security is clear with zero open Dependabot and CodeQL alerts. Live verification is 4 of 4 green. Catalog MCP calls for health, search, get, list, outline, onboarding, and cleanup all return structured responses without raw SQLite errors.

Rollback is prepared: v0.5.0 at sha256:89776da7bba30c9efbdfb29084cc98df3c93bf4bfb3a6a86bd2583d1cb2bca6d.

RC.1 was rejected, never deployed, and is now marked DO NOT DEPLOY. No merge, stable tag, PyPI package, or final GitHub release has occurred.

ajdelaguila added 17 commits July 18, 2026 15:47
@ajdelaguila
test(deps): verify hidden tool delegation
f1155d4
@ajdelaguila
feat(mcp): add searchable tool discovery
bd69d27
@ajdelaguila
test(okf): add executable reference conformance
a7d04cf
@ajdelaguila
feat(release): verify candidate artifact provenance
5f3dccd
@ajdelaguila
docs(changelog): record searchable tool discovery
5d5d596
@ajdelaguila
feat(release): publish complete candidate channels
56b2124
@ajdelaguila
docs(quickstart): make PyPI the primary install path
0a07b67
@ajdelaguila
fix(release): require explicit stable promotion
b242bd8
@ajdelaguila
feat(benchmarks): add provenance receipt support
4895499
@ajdelaguila
fix(benchmarks): validate receipt source commit
2d288df
@ajdelaguila
feat(benchmarks): add reproduction provenance receipt
b4043ad
@ajdelaguila
fix(benchmarks): verify derived receipt claims
f309332
@ajdelaguila
test(benchmarks): refresh verified provenance
d425a07
@ajdelaguila
docs(release): align complete candidate contract
1eadbcd
@ajdelaguila
fix(ci): fetch benchmark receipt source history
588377e
@ajdelaguila
fix(release): allow optional skipped checks
a7d28cd
@ajdelaguila
fix(release): close candidate verification gaps
b2fc85f
@ajdelaguila

ajdelaguila commented Jul 18, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

Release gate evidence for exact source ee04c6ca65e525e63337bba30daf8f194d3b3062:

  1. All required GitHub CI and CodeQL checks pass.
  2. Claude CLI independently reviewed the exact commit and returned APPROVE after focused tests, an actionlint run, and behavioral verification of the PyPI readback fix.
  3. Candidate 0.6.0-rc.4 completed protected PyPI publication, GHCR publication, provenance finalization, and GitHub prerelease creation.
  4. Local verification matched GitHub asset hashes, PyPI hashes, and release provenance for both the wheel and source distribution.
  5. Clean installation smoke tests passed for both distributions as version 0.6.0rc4.
  6. GHCR digest sha256:d2388b3c5a96b2cda6f968db0b7403aae225d4a9cc3417c04fee4c59b6e3d77f matches release provenance and carries source revision ee04c6ca65e525e63337bba30daf8f194d3b3062.
  7. The candidate image executed on local cluster kn-dev and exited 0.
  8. The requested reviewer team contains only the PR author, so the required review gate cannot be satisfied through a nonauthor GitHub review. Administrator merge is being used with the independent Claude review and the evidence above as the auditable exception.

@ajdelaguila
ajdelaguila merged commit 671655a into main Jul 18, 2026
20 checks passed
@ajdelaguila
ajdelaguila deleted the feature/kna-141 branch July 18, 2026 17:05
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@ajdelaguila