data-olympus 0.7.2__tar.gz → 0.7.3__tar.gz

{data_olympus-0.7.2 → data_olympus-0.7.3}/CHANGELOG.md

@@ -12,6 +12,35 @@ This project uses [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
+## [0.7.3] - 2026-09-07
+
+### Fixed
+
+* **A blank `KB_MAIN_PATH` no longer makes the server index its own working
+  directory.** `KB_MAIN_PATH=` and `KB_INDEX_PATH=` -- what an unsubstituted
+  compose, Helm or CI variable produces -- reached `Path("")`, which is
+  `Path(".")`, so the server silently indexed whatever happened to be in its
+  working directory. A blank or whitespace-only value now means unset and the
+  documented default applies, while a non-blank value is used verbatim. And
+  when the
+  corpus path does not resolve to a directory, startup now fails with a message
+  naming the setting, the path it resolved to, and whether that path came from
+  the environment or the built-in default, instead of
+  `KB root not a directory: /kb-main` -- a path the operator never configured
+  and no setting name to search for. An existing but empty corpus keeps
+  starting normally, as before. A deployment that relied on blank-means-cwd
+  changes behaviour; that reliance was on the silent defect being fixed here.
+  ([#244](https://github.com/knaisoma/data-olympus/issues/244))
+
+* **The Kubernetes first-boot log no longer prints the configured git remote.**
+  The StatefulSet initContainer echoed the remote URL immediately before
+  cloning it. The remote is documented as "SSH or HTTPS", and an HTTPS remote
+  may carry a credential inside the URL, so an adopter using one wrote that
+  credential into the pod log on every first boot, where no application-level
+  redaction reaches it. The message now names no URL, matching the Docker
+  entrypoint. Nothing else about the clone changes.
+  ([#248](https://github.com/knaisoma/data-olympus/issues/248))
+
 ## [0.7.2] - 2026-09-07
 
 ### Changed
@@ -1983,7 +2012,8 @@ This project uses [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 - `docs/adoption.md`: bring-your-own-KB guide (author, lint, index, serve, wire an agent).
 - `docs/comparison.md`: how data-olympus relates to OKF, enterprise catalogs, markdown KB tools, agent-context conventions, RAG, and ADR tooling.
 
-[Unreleased]: https://github.com/knaisoma/data-olympus/compare/v0.6.0...HEAD
+[Unreleased]: https://github.com/knaisoma/data-olympus/compare/v0.7.3...HEAD
+[0.7.3]: https://github.com/knaisoma/data-olympus/compare/v0.7.2...v0.7.3
 [0.6.0]: https://github.com/knaisoma/data-olympus/compare/v0.5.0...v0.6.0
 [0.5.0]: https://github.com/knaisoma/data-olympus/compare/v0.4.2...v0.5.0
 [0.4.1]: https://github.com/knaisoma/data-olympus/compare/v0.4.0...v0.4.1

{data_olympus-0.7.2 → data_olympus-0.7.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: data-olympus
-Version: 0.7.2
+Version: 0.7.3
 Summary: Governance-grade knowledge-base format (OKF-compatible) plus CLI and single-writer MCP server
 Project-URL: Homepage, https://github.com/knaisoma/data-olympus
 Project-URL: Repository, https://github.com/knaisoma/data-olympus

{data_olympus-0.7.2 → data_olympus-0.7.3}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "data-olympus"
-version = "0.7.2"
+version = "0.7.3"
 description = "Governance-grade knowledge-base format (OKF-compatible) plus CLI and single-writer MCP server"
 readme = "README.md"
 requires-python = ">=3.13"

{data_olympus-0.7.2 → data_olympus-0.7.3}/src/data_olympus/config.py

@@ -11,6 +11,12 @@ from data_olympus.tool_discovery import ToolDiscoveryMode, load_tool_discovery_m
 
 _log = logging.getLogger("data_olympus.config")
 
+# How a path setting got its value, for error messages that tell the operator
+# where to look. A path that came from the environment is the operator's to fix;
+# a path that came from the default means the setting was never supplied.
+PATH_SOURCE_ENV = "environment"
+PATH_SOURCE_DEFAULT = "default"
+
 
 @dataclass(frozen=True, slots=True)
 class Config:
@@ -90,6 +96,14 @@ class Config:
     # intentionally reverses the #114 "never guess status" stance: for the narrow
     # legacy-upgrade case, a seamless default beats conservative flagging.
     status_autofill: bool = True
+    # Where kb_main_path / kb_index_path came from: PATH_SOURCE_ENV when the
+    # operator supplied a non-blank value, PATH_SOURCE_DEFAULT when the setting
+    # was absent or blank. Used only to make a startup failure name the setting
+    # and say whether the operator ever configured it. Defaults to
+    # PATH_SOURCE_DEFAULT so a programmatic caller that passes paths directly
+    # (build_app in tests) does not have to supply provenance it does not have.
+    kb_main_path_source: str = PATH_SOURCE_DEFAULT
+    kb_index_path_source: str = PATH_SOURCE_DEFAULT
     # Streamable-http session reaping: terminate transports idle beyond this many
     # seconds to bound _server_instances (see session_metrics). 0 disables the
     # reaper (observability-only). The scan runs every session_reap_interval_sec.
@@ -200,6 +214,65 @@ def _load_status_weights(raw: str) -> dict[str, float] | None:
             f"got {type(data).__name__}"
         )
     return {str(k): float(v) for k, v in data.items()}
+
+
+def _env_path(name: str, default: str) -> tuple[Path, str]:
+    """Resolve a filesystem path setting, treating blank as unset.
+
+    ``os.environ.get(name, default)`` only falls back when the variable is
+    ABSENT. A variable that is set but empty -- which is exactly what an
+    unsubstituted compose/Helm/CI variable produces -- returns ``""``, and
+    ``Path("")`` is ``Path(".")``. So a blank ``KB_MAIN_PATH`` used to make the
+    server silently index its own working directory instead of the corpus, with
+    no error and no log line naming the setting.
+
+    A whitespace-only value is the same mistake with a space in it, so it is
+    treated as unset too. A value that is NOT blank is used verbatim: a path may
+    legitimately carry leading or trailing whitespace, and silently rewriting an
+    operator's path is a different bug from the one being fixed. A padded path
+    that does not exist now fails through :func:`corpus_path_problem`, which
+    names the setting and the exact resolved value.
+
+    Returns the resolved path and which of :data:`PATH_SOURCE_ENV` /
+    :data:`PATH_SOURCE_DEFAULT` it came from.
+    """
+    raw = os.environ.get(name)
+    if raw is None or not raw.strip():
+        return Path(default), PATH_SOURCE_DEFAULT
+    return Path(raw), PATH_SOURCE_ENV
+
+
+def corpus_path_problem(config: Config) -> str | None:
+    """Return an actionable message when the configured corpus is unusable.
+
+    ``None`` when ``kb_main_path`` is a directory. The message names the
+    setting, the path it resolved to, and whether that path came from the
+    environment or the built-in default -- the three things the previous
+    ``NotADirectoryError: KB root not a directory: /kb-main`` left the operator
+    to guess, since it printed a path they had never configured and no setting
+    name to search for.
+    """
+    path = config.kb_main_path
+    if path.is_dir():
+        return None
+    if config.kb_main_path_source == PATH_SOURCE_ENV:
+        origin = "That path came from the KB_MAIN_PATH environment variable."
+        fix = "Point KB_MAIN_PATH at the knowledge-base checkout."
+    else:
+        origin = (
+            "KB_MAIN_PATH is unset or blank, so that path is the built-in "
+            "default."
+        )
+        fix = (
+            f"Set KB_MAIN_PATH to the knowledge-base checkout, or mount the "
+            f"corpus at {path}."
+        )
+    what = "does not exist" if not path.exists() else "is not a directory"
+    return (
+        f"KB_MAIN_PATH resolves to {path}, which {what}. {origin} {fix}"
+    )
+
+
 def _env_bool(raw: str) -> bool:
     """Parse a truthy env string. True for 1/true/yes/on (case-insensitive);
     everything else (including empty) is False."""
@@ -299,9 +372,15 @@ def load_config() -> Config:
     version_check_interval_sec = int(
         os.getenv("KB_VERSION_CHECK_INTERVAL_SEC", "86400")
     )
+    kb_main_path, kb_main_path_source = _env_path("KB_MAIN_PATH", "/kb-main")
+    kb_index_path, kb_index_path_source = _env_path(
+        "KB_INDEX_PATH", "/index/kb.db"
+    )
     return Config(
-        kb_main_path=Path(os.environ.get("KB_MAIN_PATH", "/kb-main")),
-        kb_index_path=Path(os.environ.get("KB_INDEX_PATH", "/index/kb.db")),
+        kb_main_path=kb_main_path,
+        kb_index_path=kb_index_path,
+        kb_main_path_source=kb_main_path_source,
+        kb_index_path_source=kb_index_path_source,
         kb_remote_url=os.environ.get("KB_REMOTE_URL", ""),
         sync_interval_sec=int(os.environ.get("KB_SYNC_INTERVAL_SEC", "60")),
         staleness_degraded_sec=int(os.environ.get("KB_STALENESS_DEGRADED_SEC", "600")),

{data_olympus-0.7.2 → data_olympus-0.7.3}/src/data_olympus/server.py

@@ -23,7 +23,12 @@ if TYPE_CHECKING:
 
 from data_olympus.audit_log import AuditLog
 from data_olympus.auth import PathBlocklist
-from data_olympus.config import Config, load_config
+from data_olympus.config import (
+    PATH_SOURCE_DEFAULT,
+    Config,
+    corpus_path_problem,
+    load_config,
+)
 from data_olympus.cooccurrence import (
     DEFAULT_MAX_TERMS,
     compose_expanders,
@@ -447,6 +452,8 @@ def build_app(
     maintenance_recently_expired_days: int = 30,
     maintenance_expiring_soon_days: int = 30,
     status_autofill: bool = True,
+    kb_main_path_source: str = PATH_SOURCE_DEFAULT,
+    kb_index_path_source: str = PATH_SOURCE_DEFAULT,
 ) -> FastMCP:
     """Construct a FastMCP app with the read tools registered.
 
@@ -500,6 +507,8 @@ def build_app(
         maintenance_recently_expired_days=maintenance_recently_expired_days,
         maintenance_expiring_soon_days=maintenance_expiring_soon_days,
         status_autofill=status_autofill,
+        kb_main_path_source=kb_main_path_source,
+        kb_index_path_source=kb_index_path_source,
     )
     if audit_log_path is not None:
         config_kwargs["audit_log_path"] = audit_log_path
@@ -1185,7 +1194,16 @@ def build_app_from_config(config: Config, *, bootstrap_now: bool = True) -> Fast
     integration tests that need env-driven config to reach the app state.
     Every Config field is threaded through to build_app, so no value is silently
     dropped or overridden by a hardcoded default.
+
+    When bootstrapping, the corpus path is checked first so the failure names
+    KB_MAIN_PATH, the path it resolved to, and whether the operator supplied it.
+    Index.build would otherwise raise ``KB root not a directory: /kb-main``,
+    naming a path the operator never configured and no setting to search for.
     """
+    if bootstrap_now:
+        problem = corpus_path_problem(config)
+        if problem is not None:
+            raise NotADirectoryError(problem)
     return build_app(
         kb_main_path=config.kb_main_path,
         kb_index_path=config.kb_index_path,
@@ -1229,6 +1247,8 @@ def build_app_from_config(config: Config, *, bootstrap_now: bool = True) -> Fast
         maintenance_recently_expired_days=config.maintenance_recently_expired_days,
         maintenance_expiring_soon_days=config.maintenance_expiring_soon_days,
         status_autofill=config.status_autofill,
+        kb_main_path_source=config.kb_main_path_source,
+        kb_index_path_source=config.kb_index_path_source,
     )
 
 

{data_olympus-0.7.2 → data_olympus-0.7.3}/src/data_olympus/write_gate.py

@@ -536,15 +536,21 @@ _LLM_PROVIDER_KEY_RE = re.compile(
     r")(?![A-Za-z0-9])"
 )
 # Google API key. Not LLM-specific -- the same shape authenticates Gemini, Maps
-# and every other Google API -- so it gets its own class rather than being
-# folded into the one above.
+# and the other Google APIs that accept an API key -- so it gets its own class
+# rather than being folded into the one above. It is not every Google API:
+# many require OAuth or a service account and reject an API key outright, so
+# this class says the credential is Google-shaped, not that it opens any given
+# Google service.
 #
 # The tail is a negative lookahead rather than ``\b``. The body is a fixed
 # ``{35}`` with nothing to backtrack into, so a trailing ``\b`` would demand a
 # word character in the 35th position: a key whose last character is ``-``
 # (roughly one in 64, since the alphabet includes it) would fail to match at
-# all. The lookahead asserts the key is not a prefix of a longer token without
-# constraining its final character.
+# all. The lookahead refuses a continuation in ``[A-Za-z0-9-]`` without
+# constraining the key's own final character. It is deliberately weaker than
+# "not a prefix of a longer token": ``_`` is in the key alphabet and is NOT
+# excluded, for the reason the next paragraph gives. Tightening the lookahead
+# to cover ``_`` would satisfy the stronger reading and destroy that detection.
 # The trailing exclusion omits ``_`` deliberately. A key is exactly 39
 # characters, so a following ``_`` is either a delimiter or proof the token was
 # never a key; treating it as a delimiter costs a possible needless flag and