mlsys-io
diff --git a/‎.env.template‎
Lines changed: 0 additions & 43 deletions b/‎.env.template‎
Lines changed: 0 additions & 43 deletions
diff --git a/‎.github/dependabot.yml‎
Lines changed: 3 additions & 0 deletions b/‎.github/dependabot.yml‎
Lines changed: 3 additions & 0 deletions
diff --git a/‎.github/workflows/env-examples.yml‎
Lines changed: 41 additions & 0 deletions b/‎.github/workflows/env-examples.yml‎
Lines changed: 41 additions & 0 deletions
diff --git a/‎.github/workflows/package-build.yml‎
Lines changed: 44 additions & 0 deletions b/‎.github/workflows/package-build.yml‎
Lines changed: 44 additions & 0 deletions
diff --git a/‎.gitleaksignore‎
Lines changed: 0 additions & 1 deletion b/‎.gitleaksignore‎
Lines changed: 0 additions & 1 deletion
diff --git a/‎AGENTS.md‎
Lines changed: 1 addition & 1 deletion b/‎AGENTS.md‎
Lines changed: 1 addition & 1 deletion
diff --git a/‎README.md‎
Lines changed: 1 addition & 1 deletion b/‎README.md‎
Lines changed: 1 addition & 1 deletion
diff --git a/‎pyproject.toml‎
Lines changed: 1 addition & 6 deletions b/‎pyproject.toml‎
Lines changed: 1 addition & 6 deletions
diff --git a/‎scripts/ci/check_package_build.py‎
Lines changed: 77 additions & 0 deletions b/‎scripts/ci/check_package_build.py‎
Lines changed: 77 additions & 0 deletions
diff --git a/‎scripts/dev/check_env_examples.py‎
Lines changed: 65 additions & 0 deletions b/‎scripts/dev/check_env_examples.py‎
Lines changed: 65 additions & 0 deletions
@@ -5,6 +5,9 @@ updates:
     schedule:
       interval: weekly
     labels: ["ci"]
+    commit-message:
+      prefix: "build"
+      include: "scope"
     # Wait 7 days after an action is released before bumping. Protects
     # against actively-malicious releases and 0-days in fresh versions.
     cooldown:
 
@@ -0,0 +1,41 @@
+name: env-examples Check
+
+on:
+  push:
+    branches:
+      - main
+    paths-ignore:
+      - '**.md'
+      - 'docs/**'
+  pull_request:
+    paths-ignore:
+      - '**.md'
+      - 'docs/**'
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  verify:
+    name: Verify env example files
+    runs-on: self-hosted
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6
+        with:
+          persist-credentials: false
+
+      - name: Set up uv
+        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b  # v8.1.0
+        with:
+          version: "0.11.8"
+
+      - name: Install dependencies
+        run: uv sync --frozen
+
+      - name: Verify env example files
+        run: uv run scripts/dev/check_env_examples.py
@@ -0,0 +1,44 @@
+name: Package Build
+
+on:
+  push:
+    branches:
+      - main
+    paths-ignore:
+      - '**.md'
+      - 'docs/**'
+  pull_request:
+    paths-ignore:
+      - '**.md'
+      - 'docs/**'
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  package-build:
+    name: Build and smoke-test package
+    runs-on: self-hosted
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6
+        with:
+          persist-credentials: false
+
+      - name: Set up uv
+        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b  # v8.1.0
+        with:
+          version: "0.11.8"
+
+      - name: Install build environment
+        run: uv sync --all-groups --all-extras --frozen
+
+      - name: Build distributions
+        run: uv build --out-dir dist
+
+      - name: Verify distributions
+        run: uv run scripts/ci/check_package_build.py --dist dist
@@ -7,7 +7,7 @@ Guidance for agentic tools (Claude Code, Cursor, Aider, etc.) working in this re
 - Environment is managed by `uv`. The system may not have Python installed directly. Always use `uv run ...` to execute commands.
 - `uv sync --group lint --group test --extra cli` installs everything a development-focused agent needs.
 - `uv run pre-commit run --all-files` runs every formatting / lint / type-check / spell-check the CI runs. This must pass before any PR lands. The exact tool set lives in `.pre-commit-config.yaml`.
-- **Scratch space.** Keep throwaway scripts / experiments under `agent_space/` (gitignored) or alongside existing `.bak` files. Never commit scratch.
+- **Scratch.** Never commit throwaway scripts / experiments.
 
 ## Design Discipline
 
 
@@ -86,7 +86,7 @@ The Docker image installs from `pyproject.toml` directly via `pip install .` on
 uv sync --group test --group lint
 
 # Environment for a local run — can be exported or placed in .env
-cp .env.template .env
+cp .env.example .env
 $EDITOR .env
 
 uv run python -m lumilake.server.main
 
@@ -12,7 +12,6 @@ dependencies = [
 server = [
     "fastapi[standard]>=0.115.6",
     "openai>=1.58.1",
-    "backoff>=2.2.1",
     "requests>=2.32.3",
     "urllib3>=2.7.0",
     "aiohttp>=3.11.11",
@@ -21,13 +20,10 @@ server = [
     "minio>=7.2.8",
     "networkx[default]>=3.4.2",
     "matplotlib>=3.10.1",
-    "cachetools>=6.2.0",
     "dill>=0.4.0",
     "psycopg[binary]>=3.2.0",
     "psycopg-pool>=3.2.0",
-    "sqlglot>=26.30.0",
     "rich>=13.6.0",
-    "tabulate>=0.9.0",
     "lumid-hooks==0.1.0",
     "flowmesh-sdk==0.1.0",
     "lumid-data-sdk==0.1.0",
@@ -59,7 +55,6 @@ lint = [
     "codespell==2.4.2",
     "isort==8.0.1",
     "types-requests==2.33.0.20260503",
-    "types-cachetools==7.0.0.20260503",
     "types-pyyaml==6.0.12.20260408",
     "types-docker==7.1.0.20260409",
     "pre-commit==4.6.0",
@@ -91,7 +86,7 @@ skip = [".venv"]
 
 [tool.ruff]
 target-version = "py312"
-exclude = [".venv", "agent_space"]
+exclude = [".venv"]
 
 [tool.ruff.lint]
 select = ["E", "F", "UP", "I"]
 
@@ -0,0 +1,77 @@
+"""Validate built Lumilake distributions."""
+
+import argparse
+import subprocess
+import tempfile
+import venv
+from pathlib import Path
+from zipfile import ZipFile
+
+REQUIRED_TOP_LEVELS = {"lumilake", "lumilake_hook"}
+
+
+def _script_bin(env_dir: Path, name: str) -> Path:
+    return env_dir / "bin" / name
+
+
+def _run(cmd: list[str]) -> None:
+    subprocess.run(cmd, check=True)  # nosec B603: fixed argv list, no shell.
+
+
+def _single_file(dist_dir: Path, pattern: str) -> Path:
+    matches = sorted(dist_dir.glob(pattern))
+    if len(matches) != 1:
+        raise SystemExit(f"Expected one {pattern!r}, found {len(matches)}")
+    return matches[0]
+
+
+def _check_wheel(wheel: Path) -> None:
+    with ZipFile(wheel) as zf:
+        names = set(zf.namelist())
+    top_levels = {name.split("/", 1)[0] for name in names if "/" in name}
+    missing = sorted(REQUIRED_TOP_LEVELS - top_levels)
+    if missing:
+        raise SystemExit("wheel missing top-level packages: " + ", ".join(missing))
+    if "lumilake/py.typed" not in names:
+        raise SystemExit("wheel missing lumilake/py.typed")
+    entry_points = [
+        name for name in names if name.endswith(".dist-info/entry_points.txt")
+    ]
+    if len(entry_points) != 1:
+        raise SystemExit("wheel missing entry_points.txt")
+    if any(name.startswith("tests/") for name in names):
+        raise SystemExit("wheel should not contain tests/")
+
+
+def _smoke_import(wheel: Path) -> None:
+    with tempfile.TemporaryDirectory(prefix="lumilake-package-smoke-") as tmp:
+        env_dir = Path(tmp) / ".venv"
+        venv.EnvBuilder(with_pip=True).create(env_dir)
+        python = _script_bin(env_dir, "python")
+        _run([python.as_posix(), "-m", "pip", "install", "--no-deps", wheel.as_posix()])
+        _run([python.as_posix(), "-c", "import lumilake; assert lumilake.__version__"])
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument(
+        "--dist",
+        default="dist",
+        type=Path,
+        help="Directory containing distributions built by `uv build`.",
+    )
+    args = parser.parse_args()
+
+    dist_dir = args.dist.resolve()
+    if not dist_dir.is_dir():
+        raise SystemExit(f"Distribution directory does not exist: {dist_dir}")
+
+    wheel = _single_file(dist_dir, "lumilake-*-py3-none-any.whl")
+    _single_file(dist_dir, "lumilake-*.tar.gz")
+    _check_wheel(wheel)
+    _smoke_import(wheel)
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
@@ -0,0 +1,65 @@
+"""Verify committed Lumilake env examples match the deploy schema."""
+
+import argparse
+import re
+from pathlib import Path
+
+from lumilake.deploy import doctor
+
+REPO_ROOT = Path(__file__).resolve().parents[2]
+ENV_EXAMPLE = REPO_ROOT / ".env.example"
+
+_ASSIGNMENT_RE = re.compile(r"^\s*#?\s*([A-Z][A-Z0-9_]*)\s*=")
+_FORBIDDEN_KEYS = frozenset(
+    {
+        "LUMILAKE_STRATEGY_AUTOLOAD_MODULES",
+        "DEPLOY_PROFILE",
+        "CREDENTIALS_JSON",
+    }
+)
+
+
+def _example_keys(path: Path) -> set[str]:
+    keys: set[str] = set()
+    for line in path.read_text().splitlines():
+        match = _ASSIGNMENT_RE.match(line)
+        if match:
+            keys.add(match.group(1))
+    return keys
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.parse_args()
+
+    if not ENV_EXAMPLE.is_file():
+        raise SystemExit(f"Missing env example: {ENV_EXAMPLE.relative_to(REPO_ROOT)}")
+
+    keys = _example_keys(ENV_EXAMPLE)
+    required = set(doctor._ALWAYS_REQUIRED + doctor._DIRECT_MODE_REQUIRED)
+    missing = sorted(required - keys)
+    unknown = sorted(keys - doctor._KNOWN_KEYS)
+    forbidden = sorted(keys & _FORBIDDEN_KEYS)
+
+    failed = False
+    if missing:
+        failed = True
+        print("Missing required env example keys:")
+        for key in missing:
+            print(f"- {key}")
+    if unknown:
+        failed = True
+        print("Unknown env example keys:")
+        for key in unknown:
+            print(f"- {key}")
+    if forbidden:
+        failed = True
+        print("Forbidden legacy env example keys:")
+        for key in forbidden:
+            print(f"- {key}")
+
+    return 1 if failed else 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())