gitlab-api 27.3.13__tar.gz → 27.3.15__tar.gz

{gitlab_api-27.3.13 → gitlab_api-27.3.15}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: gitlab-api
-Version: 27.3.13
+Version: 27.3.15
 Summary: GitLab API + MCP Server
 Author-email: Repository Maintainers <maintainers@knuckles.team>
 License: MIT

gitlab_api-27.3.15/gitlab_api/ontology/access_contracts.ttl

@@ -0,0 +1,287 @@
+@prefix ac: <https://knuckles-team.github.io/agent-connector-sdk/access#> .
+@prefix gl: <http://knuckles.team/kg#> .
+
+# Read contracts for the classes declared by gitlab.ttl.  The MCP tools expose
+# both read and write actions, but these mappings are read-only query routes:
+# callers select the listed get action through the operation's action envelope.
+# The source classes stay in GitLab's ontology namespace.  No heuristic
+# crosswalk to a hub class is asserted here.
+
+gl:gitlabGroupAccess a ac:AccessContract ;
+    ac:classIri gl:GitLabGroup ;
+    ac:sourceId "gitlab-api" ;
+    ac:entity "group" ;
+    ac:keyField "id" ;
+    ac:accessKind "mcp_tool" ;
+    ac:operation "gitlab_groups" ;
+    ac:parameter "action", "params_json" ;
+    ac:pagination "page" ;
+    ac:pushdown "filter", "limit", "sort" ;
+    ac:authRef "env://GITLAB_TOKEN" ;
+    ac:rateLimitPerMinute 60 ;
+    ac:freshnessSeconds 300 ;
+    ac:costHint "medium" .
+
+gl:gitlabGroupWebUrlBinding a ac:PropertyBinding ;
+    ac:contract gl:gitlabGroupAccess ; ac:property gl:webUrl ; ac:field "web_url" .
+
+gl:projectAccess a ac:AccessContract ;
+    ac:classIri gl:Project ;
+    ac:sourceId "gitlab-api" ;
+    ac:entity "project" ;
+    ac:keyField "id" ;
+    ac:accessKind "mcp_tool" ;
+    ac:operation "gitlab_projects" ;
+    ac:parameter "action", "params_json" ;
+    ac:pagination "page" ;
+    ac:pushdown "filter", "limit", "sort" ;
+    ac:authRef "env://GITLAB_TOKEN" ;
+    ac:rateLimitPerMinute 60 ;
+    ac:freshnessSeconds 300 ;
+    ac:costHint "low" .
+
+gl:projectWebUrlBinding a ac:PropertyBinding ;
+    ac:contract gl:projectAccess ; ac:property gl:webUrl ; ac:field "web_url" .
+
+gl:mergeRequestAccess a ac:AccessContract ;
+    ac:classIri gl:MergeRequest ;
+    ac:sourceId "gitlab-api" ;
+    ac:entity "merge_request" ;
+    ac:keyField "id" ;
+    ac:accessKind "mcp_tool" ;
+    ac:operation "gitlab_merge_requests" ;
+    ac:parameter "action", "params_json" ;
+    ac:pagination "page" ;
+    ac:pushdown "filter", "limit", "sort" ;
+    ac:authRef "env://GITLAB_TOKEN" ;
+    ac:rateLimitPerMinute 60 ;
+    ac:freshnessSeconds 60 ;
+    ac:costHint "medium" .
+
+gl:mergeRequestIidBinding a ac:PropertyBinding ;
+    ac:contract gl:mergeRequestAccess ; ac:property gl:iid ; ac:field "iid" .
+
+gl:mergeRequestStateBinding a ac:PropertyBinding ;
+    ac:contract gl:mergeRequestAccess ; ac:property gl:state ; ac:field "state" .
+
+gl:mergeRequestWebUrlBinding a ac:PropertyBinding ;
+    ac:contract gl:mergeRequestAccess ; ac:property gl:webUrl ; ac:field "web_url" .
+
+gl:pipelineAccess a ac:AccessContract ;
+    ac:classIri gl:Pipeline ;
+    ac:sourceId "gitlab-api" ;
+    ac:entity "pipeline" ;
+    ac:keyField "id" ;
+    ac:accessKind "mcp_tool" ;
+    ac:operation "gitlab_pipelines" ;
+    ac:parameter "action", "params_json" ;
+    ac:pagination "page" ;
+    ac:pushdown "filter", "limit", "sort" ;
+    ac:authRef "env://GITLAB_TOKEN" ;
+    ac:rateLimitPerMinute 60 ;
+    ac:freshnessSeconds 60 ;
+    ac:costHint "medium" .
+
+gl:pipelineStatusBinding a ac:PropertyBinding ;
+    ac:contract gl:pipelineAccess ; ac:property gl:pipelineStatus ; ac:field "status" .
+
+gl:pipelineRefBinding a ac:PropertyBinding ;
+    ac:contract gl:pipelineAccess ; ac:property gl:ref ; ac:field "ref" .
+
+gl:pipelineShaBinding a ac:PropertyBinding ;
+    ac:contract gl:pipelineAccess ; ac:property gl:sha ; ac:field "sha" .
+
+gl:pipelineWebUrlBinding a ac:PropertyBinding ;
+    ac:contract gl:pipelineAccess ; ac:property gl:webUrl ; ac:field "web_url" .
+
+gl:pipelineRunAccess a ac:AccessContract ;
+    ac:classIri gl:PipelineRun ;
+    ac:sourceId "gitlab-api" ;
+    ac:entity "pipeline" ;
+    ac:keyField "id" ;
+    ac:accessKind "mcp_tool" ;
+    ac:operation "gitlab_pipelines" ;
+    ac:parameter "action", "params_json" ;
+    ac:pagination "page" ;
+    ac:pushdown "filter", "limit", "sort" ;
+    ac:authRef "env://GITLAB_TOKEN" ;
+    ac:rateLimitPerMinute 60 ;
+    ac:freshnessSeconds 60 ;
+    ac:costHint "medium" .
+
+gl:jobAccess a ac:AccessContract ;
+    ac:classIri gl:Job ;
+    ac:sourceId "gitlab-api" ;
+    ac:entity "job" ;
+    ac:keyField "id" ;
+    ac:accessKind "mcp_tool" ;
+    ac:operation "gitlab_jobs" ;
+    ac:parameter "action", "params_json" ;
+    ac:pagination "page" ;
+    ac:pushdown "filter", "limit", "sort" ;
+    ac:authRef "env://GITLAB_TOKEN" ;
+    ac:rateLimitPerMinute 60 ;
+    ac:freshnessSeconds 60 ;
+    ac:costHint "medium" .
+
+gl:jobStatusBinding a ac:PropertyBinding ;
+    ac:contract gl:jobAccess ; ac:property gl:pipelineStatus ; ac:field "status" .
+
+gl:jobRefBinding a ac:PropertyBinding ;
+    ac:contract gl:jobAccess ; ac:property gl:ref ; ac:field "ref" .
+
+gl:jobWebUrlBinding a ac:PropertyBinding ;
+    ac:contract gl:jobAccess ; ac:property gl:webUrl ; ac:field "web_url" .
+
+gl:checkRunAccess a ac:AccessContract ;
+    ac:classIri gl:CheckRun ;
+    ac:sourceId "gitlab-api" ;
+    ac:entity "job" ;
+    ac:keyField "id" ;
+    ac:accessKind "mcp_tool" ;
+    ac:operation "gitlab_jobs" ;
+    ac:parameter "action", "params_json" ;
+    ac:pagination "page" ;
+    ac:pushdown "filter", "limit", "sort" ;
+    ac:authRef "env://GITLAB_TOKEN" ;
+    ac:rateLimitPerMinute 60 ;
+    ac:freshnessSeconds 60 ;
+    ac:costHint "medium" .
+
+gl:issueAccess a ac:AccessContract ;
+    ac:classIri gl:Issue ;
+    ac:sourceId "gitlab-api" ;
+    ac:entity "issue" ;
+    ac:keyField "id" ;
+    ac:accessKind "mcp_tool" ;
+    ac:operation "gitlab_issues" ;
+    ac:parameter "action", "params_json" ;
+    ac:pagination "page" ;
+    ac:pushdown "filter", "limit", "sort" ;
+    ac:authRef "env://GITLAB_TOKEN" ;
+    ac:rateLimitPerMinute 60 ;
+    ac:freshnessSeconds 60 ;
+    ac:costHint "medium" .
+
+gl:issueIidBinding a ac:PropertyBinding ;
+    ac:contract gl:issueAccess ; ac:property gl:iid ; ac:field "iid" .
+
+gl:issueStateBinding a ac:PropertyBinding ;
+    ac:contract gl:issueAccess ; ac:property gl:state ; ac:field "state" .
+
+gl:issueWebUrlBinding a ac:PropertyBinding ;
+    ac:contract gl:issueAccess ; ac:property gl:webUrl ; ac:field "web_url" .
+
+gl:epicAccess a ac:AccessContract ;
+    ac:classIri gl:Epic ;
+    ac:sourceId "gitlab-api" ;
+    ac:entity "epic" ;
+    ac:keyField "id" ;
+    ac:accessKind "mcp_tool" ;
+    ac:operation "gitlab_epics" ;
+    ac:parameter "action", "params_json" ;
+    ac:pagination "page" ;
+    ac:pushdown "filter", "limit", "sort" ;
+    ac:authRef "env://GITLAB_TOKEN" ;
+    ac:rateLimitPerMinute 60 ;
+    ac:freshnessSeconds 300 ;
+    ac:costHint "medium" .
+
+gl:epicIidBinding a ac:PropertyBinding ;
+    ac:contract gl:epicAccess ; ac:property gl:iid ; ac:field "iid" .
+
+gl:epicWebUrlBinding a ac:PropertyBinding ;
+    ac:contract gl:epicAccess ; ac:property gl:webUrl ; ac:field "web_url" .
+
+gl:milestoneAccess a ac:AccessContract ;
+    ac:classIri gl:Milestone ;
+    ac:sourceId "gitlab-api" ;
+    ac:entity "milestone" ;
+    ac:keyField "id" ;
+    ac:accessKind "mcp_tool" ;
+    ac:operation "gitlab_milestones" ;
+    ac:parameter "action", "params_json" ;
+    ac:pagination "page" ;
+    ac:pushdown "filter", "limit", "sort" ;
+    ac:authRef "env://GITLAB_TOKEN" ;
+    ac:rateLimitPerMinute 60 ;
+    ac:freshnessSeconds 300 ;
+    ac:costHint "medium" .
+
+gl:milestoneStateBinding a ac:PropertyBinding ;
+    ac:contract gl:milestoneAccess ; ac:property gl:state ; ac:field "state" .
+
+gl:milestoneWebUrlBinding a ac:PropertyBinding ;
+    ac:contract gl:milestoneAccess ; ac:property gl:webUrl ; ac:field "web_url" .
+
+gl:commitAccess a ac:AccessContract ;
+    ac:classIri gl:Commit ;
+    ac:sourceId "gitlab-api" ;
+    ac:entity "commit" ;
+    ac:keyField "id" ;
+    ac:accessKind "mcp_tool" ;
+    ac:operation "gitlab_commits" ;
+    ac:parameter "action", "params_json" ;
+    ac:pagination "page" ;
+    ac:pushdown "filter", "limit", "sort" ;
+    ac:authRef "env://GITLAB_TOKEN" ;
+    ac:rateLimitPerMinute 60 ;
+    ac:freshnessSeconds 60 ;
+    ac:costHint "medium" .
+
+gl:commitShaBinding a ac:PropertyBinding ;
+    ac:contract gl:commitAccess ; ac:property gl:sha ; ac:field "sha" .
+
+gl:commitWebUrlBinding a ac:PropertyBinding ;
+    ac:contract gl:commitAccess ; ac:property gl:webUrl ; ac:field "web_url" .
+
+gl:branchAccess a ac:AccessContract ;
+    ac:classIri gl:Branch ;
+    ac:sourceId "gitlab-api" ;
+    ac:entity "branch" ;
+    ac:keyField "name" ;
+    ac:accessKind "mcp_tool" ;
+    ac:operation "gitlab_branches" ;
+    ac:parameter "action", "params_json" ;
+    ac:pagination "page" ;
+    ac:pushdown "filter", "limit", "sort" ;
+    ac:authRef "env://GITLAB_TOKEN" ;
+    ac:rateLimitPerMinute 60 ;
+    ac:freshnessSeconds 300 ;
+    ac:costHint "low" .
+
+gl:branchWebUrlBinding a ac:PropertyBinding ;
+    ac:contract gl:branchAccess ; ac:property gl:webUrl ; ac:field "web_url" .
+
+gl:releaseAccess a ac:AccessContract ;
+    ac:classIri gl:Release ;
+    ac:sourceId "gitlab-api" ;
+    ac:entity "release" ;
+    ac:keyField "tag_name" ;
+    ac:accessKind "mcp_tool" ;
+    ac:operation "gitlab_releases" ;
+    ac:parameter "action", "params_json" ;
+    ac:pagination "page" ;
+    ac:pushdown "filter", "limit", "sort" ;
+    ac:authRef "env://GITLAB_TOKEN" ;
+    ac:rateLimitPerMinute 60 ;
+    ac:freshnessSeconds 300 ;
+    ac:costHint "medium" .
+
+gl:runnerAccess a ac:AccessContract ;
+    ac:classIri gl:Runner ;
+    ac:sourceId "gitlab-api" ;
+    ac:entity "runner" ;
+    ac:keyField "id" ;
+    ac:accessKind "mcp_tool" ;
+    ac:operation "gitlab_runners" ;
+    ac:parameter "action", "params_json" ;
+    ac:pagination "page" ;
+    ac:pushdown "filter", "limit", "sort" ;
+    ac:authRef "env://GITLAB_TOKEN" ;
+    ac:rateLimitPerMinute 60 ;
+    ac:freshnessSeconds 300 ;
+    ac:costHint "medium" .
+
+gl:runnerStateBinding a ac:PropertyBinding ;
+    ac:contract gl:runnerAccess ; ac:property gl:state ; ac:field "status" .

{gitlab_api-27.3.13 → gitlab_api-27.3.15}/gitlab_api/ontology/certification.json

@@ -29,5 +29,5 @@
   "signer": "UNSIGNED-PREVIEW",
   "signing_public_key": "",
   "status": "source-validated",
-  "validated_at": "2026-10-24T15:46:04Z"
+  "validated_at": "2026-10-27T03:44:15Z"
 }

gitlab_api-27.3.15/gitlab_api/skills/gitlab-api-development/SKILL.md

@@ -0,0 +1,132 @@
+---
+name: gitlab-api-development
+skill_type: skill
+domain: development
+description: >-
+  Develop, test, gate, and release the GitLab REST and GraphQL connector. Use
+  this skill when changing API mappings, governed MCP tools, authentication,
+  tenant selection, KG ingestion, packaged content, or repository gates.
+license: MIT
+tags: [gitlab, rest, graphql, mcp, development, connector, test, gates]
+tier: repository
+metadata:
+  author: Genius
+  version: '0.1.0'
+---
+
+# gitlab-api development
+
+This repository owns the GitLab REST and GraphQL API facades, tenant and
+authentication boundary, action-routed MCP tools, GitLab ontology and KG
+ingestion mappings, and packaged connector content. Shared connector
+contracts, transports, TLS profiles, and credential helpers belong to
+`agent-connector-sdk`; admission, serving, and durable graph state belong to
+their owning repositories. Read `AGENTS.md` before changing code and keep
+credentials, private endpoints, tenant data, and customer records out of
+source, logs, fixtures, and skill content.
+
+## Rapid delivery: the 5-minute contract
+
+Specs are already designed. Deliver small, reviewable slices and cite the
+owning spec row in the commit trailer.
+
+- Find the owning row first with `git grep -n "<term>" -- specs` and extend the
+  existing spec before adding requirement text.
+- Reuse the single `Connector` in `gitlab_api/__init__.py`, the `Api` facade in
+  `gitlab_api/api_client.py`, the modular clients under `gitlab_api/api/`, and
+  the action dispatch tables in `gitlab_api/mcp_server.py`. Keep GraphQL
+  operations in `gitlab_api/gitlab_gql.py`; do not create a second API, MCP,
+  authentication, or transport plane.
+- Preserve the multi-tenant resolution in `gitlab_api/instances.py`. A named
+  instance, bare URL, or default selection must retain caller entitlement
+  checks and the `GITLAB_INSTANCES` shared setting. The legacy
+  `GITLAB_URL`/`GITLAB_TOKEN` fallback remains supported.
+- Preserve `GITLAB_URL`, `GITLAB_TOKEN`, `GITLAB_TLS_PROFILE`, and
+  `ENABLE_DELEGATION` handling in `gitlab_api/auth.py`. Delegated RFC 8693
+  token exchange and fixed credentials stay behind the SDK identity/TLS
+  helpers. Never print tokens or add a TLS verification bypass.
+- Keep the REST resource paths, GraphQL typed-operation boundary, action names,
+  pagination, and response models stable. Use `run_blocking` for blocking API
+  calls from MCP tools and return typed refusal/error envelopes instead of
+  bypassing the shared dispatcher. Keep `MCP_TOOL_MODE` (`condensed`,
+  `verbose`, or `both`) and each action group's toggle behavior aligned with
+  the generated tool surface.
+- Preserve typed KG ingestion through `gitlab_api/kg_ingest.py`, source
+  declarations in `gitlab_api/connector_sources.py`, and neutral ontology
+  mappings. Project, issue, merge-request, pipeline, job, runner, group, and
+  person records use the existing stable IDs and relationship names.
+- Mock HTTP, GraphQL, and authentication responses in local tests; never call a
+  live GitLab instance or use live credentials in a gate. Every delivered
+  requirement needs a bound focused test. Generated `specs/*/status.json` files
+  come from shared hooks; never hand-edit them.
+- Keep `skills/**`, `ontology/**`, `connectors/**`, prompts, and
+  `mcp_config.json` coherent with package data and the
+  `agent_connector_sdk.connector` entry point (`gitlab-mcp =
+  gitlab_api:connector`). Do not add a second publisher or runtime plane.
+
+## Setup and gates
+
+Use the pinned environment from `uv sync --locked`, then run the shared gates:
+
+```bash
+uv sync --locked
+uvx pre-commit run --all-files
+uvx pre-commit run --all-files --hook-stage pre-push
+```
+
+For focused feedback, run the smallest affected tests with the locked
+environment, for example:
+
+```bash
+uv run --locked --extra test pytest -q tests/test_gitlab_api_development_skill.py
+uv run --locked --extra test pytest -q tests/test_pages_workflow.py
+uv run --locked --extra test pytest -q tests/test_auth.py tests/test_gitlab_mcp_validation.py
+```
+
+The canonical `.pre-commit-config.yaml` delegates connector-standard, secrets,
+spec, tests-fast, and dependency-readiness to `Knuckles-Team/pipelines`. Do not
+copy those hooks locally or bypass a failing check.
+
+## Connector-specific checks
+
+- Keep REST resource paths, GraphQL operation names, action selectors,
+  pagination, and Pydantic response normalization stable. Add focused mocked
+  request tests for a changed provider path.
+- Keep OIDC token exchange and fixed-token fallback at the existing
+  authentication boundary. Resolve TLS policy through the SDK and never bake
+  static bearer tokens into the client.
+- Preserve identity-scoped tenant discovery and refusal of an instance the
+  caller is not entitled to use. Discovery returns names, URLs, and profile
+  state only; it never returns tokens.
+- Keep projects, issues, merge requests, pipelines, jobs, runners, groups, and
+  people as the typed records already mapped by `gitlab_api/kg_ingest.py`.
+  Ingestion stays best-effort when the graph engine is unavailable.
+- Keep `gitlab_api/skills/`, `gitlab_api/ontology/`,
+  `gitlab_api/connectors/`, prompts, and `gitlab_api/mcp_config.json` in package
+  data. Keep source metadata tenant-neutral.
+- Documentation is published by the existing Pages workflow and checked-in
+  dashboard configuration; source status records under `specs/` are generated
+  by shared hooks.
+
+## Packaging and publication
+
+`pyproject.toml` declares the `agent_connector_sdk.connector` entry point
+`gitlab-mcp = "gitlab_api:connector"` and packages `skills/**`, `ontology/**`,
+`connectors/**`, prompts, and `mcp_config.json`. When packaged content changes,
+use `uv version --bump patch` and let the lockfile update with the project; add
+the release note to `CHANGELOG.md`. Inspect `uv build` output for
+`gitlab_api/skills/gitlab-api-development/SKILL.md`.
+
+The canonical release caller delegates publication and connector rendering to
+the shared pipelines. Do not commit generated Docker artifacts or claim
+package, container, or Pages publication from a local build; require exact
+source hosted evidence and the public artifact.
+
+## Delivery discipline
+
+Work in a real Git worktree based on `origin/main`. Inspect the complete diff,
+stage only reviewed paths, and verify `git status --short` after every gate. Do
+not use `git stash`, `git add -A`, or `git add .`; preserve unrelated working
+tree changes. Keep runtime, ontology, status, and generated artifacts outside
+this bounded skill slice unless the owning requirement explicitly requires
+them.

{gitlab_api-27.3.13 → gitlab_api-27.3.15}/gitlab_api.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: gitlab-api
-Version: 27.3.13
+Version: 27.3.15
 Summary: GitLab API + MCP Server
 Author-email: Repository Maintainers <maintainers@knuckles.team>
 License: MIT

{gitlab_api-27.3.13 → gitlab_api-27.3.15}/gitlab_api.egg-info/SOURCES.txt

@@ -33,6 +33,7 @@ gitlab_api/api/api_client_system.py
 gitlab_api/api/api_client_users_groups.py
 gitlab_api/api/api_client_vulnerabilities.py
 gitlab_api/ontology/__init__.py
+gitlab_api/ontology/access_contracts.ttl
 gitlab_api/ontology/certification.json
 gitlab_api/ontology/gitlab.ttl
 gitlab_api/ontology/fixtures/records.json
@@ -40,6 +41,7 @@ gitlab_api/ontology/mappings/source.yaml
 gitlab_api/ontology/migrations/manifest.json
 gitlab_api/ontology/shapes/connector.shacl.ttl
 gitlab_api/prompts/devops_specialist.json
+gitlab_api/skills/gitlab-api-development/SKILL.md
 gitlab_api/skills/gitlab-api-operations/SKILL.md
 gitlab_api/skills/gitlab-api-operations/agents/openai.yaml
 gitlab_api/skills/gitlab-api-operations/references/catalog.md
@@ -57,6 +59,7 @@ scripts/check_import_safety.py
 scripts/security_contract.py
 tests/__init__.py
 tests/conftest.py
+tests/test_access_contracts.py
 tests/test_api_wrapper.py
 tests/test_auth.py
 tests/test_catalog_edges.py
@@ -65,6 +68,7 @@ tests/test_cq_paths.py
 tests/test_fleet_name.py
 tests/test_gitlab_a2a_validation.py
 tests/test_gitlab_api_brute_force_coverage.py
+tests/test_gitlab_api_development_skill.py
 tests/test_gitlab_gql.py
 tests/test_gitlab_mcp_validation.py
 tests/test_gitlab_models.py
@@ -75,6 +79,7 @@ tests/test_instances.py
 tests/test_kg_ingest.py
 tests/test_mock_coverage.py
 tests/test_ontology_parent_link.py
+tests/test_pages_workflow.py
 tests/test_startup.py
 tests/test_tool_modes.py
 tests/test_verify_agent.py

{gitlab_api-27.3.13 → gitlab_api-27.3.15}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "gitlab-api"
-version = "27.3.13"
+version = "27.3.15"
 description = "GitLab API + MCP Server"
 readme = "README.md"
 classifiers = [ "Development Status :: 5 - Production/Stable", "License :: OSI Approved :: MIT License", "Environment :: Console", "Operating System :: POSIX :: Linux", "Programming Language :: Python :: 3",]

gitlab_api-27.3.15/tests/test_access_contracts.py

@@ -0,0 +1,75 @@
+"""GitLab's read-only source access contracts stay source-local."""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+from agent_connector_sdk.access_contract import parse_access_contracts
+
+
+ROOT = Path(__file__).resolve().parents[1]
+CONTRACTS = ROOT / "gitlab_api" / "ontology" / "access_contracts.ttl"
+KG = "http://knuckles.team/kg#"
+
+EXPECTED = {
+    "GitLabGroup": ("gitlab_groups", "group", "id"),
+    "Project": ("gitlab_projects", "project", "id"),
+    "MergeRequest": ("gitlab_merge_requests", "merge_request", "id"),
+    "Pipeline": ("gitlab_pipelines", "pipeline", "id"),
+    "PipelineRun": ("gitlab_pipelines", "pipeline", "id"),
+    "Job": ("gitlab_jobs", "job", "id"),
+    "CheckRun": ("gitlab_jobs", "job", "id"),
+    "Issue": ("gitlab_issues", "issue", "id"),
+    "Epic": ("gitlab_epics", "epic", "id"),
+    "Milestone": ("gitlab_milestones", "milestone", "id"),
+    "Commit": ("gitlab_commits", "commit", "id"),
+    "Branch": ("gitlab_branches", "branch", "name"),
+    "Release": ("gitlab_releases", "release", "tag_name"),
+    "Runner": ("gitlab_runners", "runner", "id"),
+}
+
+
+def _contracts():
+    return parse_access_contracts(CONTRACTS.read_text(encoding="utf-8"))
+
+
+def test_every_declared_gitlab_class_has_a_typed_read_contract() -> None:
+    contracts = _contracts()
+    by_class = {contract.class_iri.rsplit("#", 1)[-1]: contract for contract in contracts}
+
+    assert set(by_class) == set(EXPECTED)
+    for class_name, (operation, entity, key_field) in EXPECTED.items():
+        contract = by_class[class_name]
+        assert contract.class_iri == KG + class_name
+        assert contract.source_id == "gitlab-api"
+        assert contract.access_kind == "mcp_tool"
+        assert contract.operation == operation
+        assert contract.entity == entity
+        assert contract.key_field == key_field
+        assert contract.parameters == ("action", "params_json")
+        assert contract.auth_ref == "env://GITLAB_TOKEN"
+        assert contract.pagination == "page"
+        assert contract.pushdown == frozenset({"filter", "limit", "sort"})
+
+
+def test_gitlab_contracts_do_not_promote_draft_crosswalks() -> None:
+    contracts = _contracts()
+
+    assert all(contract.class_iri.startswith(KG) for contract in contracts)
+    assert all(
+        contract.class_iri not in {KG + "Incident", KG + "SoftwareProject"}
+        for contract in contracts
+    )
+    assert all(contract.source_id == "gitlab-api" for contract in contracts)
+
+
+def test_gitlab_contract_artifact_is_packaged_under_ontology() -> None:
+    assert CONTRACTS.is_file()
+
+
+def test_gitlab_contract_bindings_use_declared_fields() -> None:
+    contracts = {contract.class_iri.rsplit("#", 1)[-1]: contract for contract in _contracts()}
+
+    assert (KG + "webUrl", "web_url") in contracts["Project"].predicates
+    assert (KG + "pipelineStatus", "status") in contracts["Pipeline"].predicates
+    assert (KG + "sha", "sha") in contracts["Commit"].predicates

gitlab_api-27.3.15/tests/test_gitlab_api_development_skill.py

@@ -0,0 +1,54 @@
+"""PIPE-CONNSPEC-R125.4: the GitLab API development skill is packaged."""
+
+from __future__ import annotations
+
+import re
+import tomllib
+from pathlib import Path
+
+import pytest
+
+ROOT = Path(__file__).resolve().parents[1]
+SKILL = ROOT / "gitlab_api" / "skills" / "gitlab-api-development" / "SKILL.md"
+
+pytestmark = pytest.mark.spec("PIPE-CONNSPEC-R125.4")
+
+
+def test_development_skill_has_rapid_contract_and_package_binding() -> None:
+    text = SKILL.read_text(encoding="utf-8")
+    frontmatter = text.split("---", 2)[1]
+    project = tomllib.loads((ROOT / "pyproject.toml").read_text(encoding="utf-8"))
+
+    assert SKILL.is_file()
+    assert re.search(r"^name:\s*gitlab-api-development\s*$", frontmatter, re.M)
+    assert re.search(r"^skill_type:\s*skill\s*$", frontmatter, re.M)
+    assert "## Rapid delivery: the 5-minute contract" in text
+    for term in (
+        "gitlab_api/__init__.py",
+        "gitlab_api/api_client.py",
+        "gitlab_api/api/",
+        "gitlab_api/auth.py",
+        "gitlab_api/instances.py",
+        "gitlab_api/mcp_server.py",
+        "gitlab_api/gitlab_gql.py",
+        "gitlab_api/kg_ingest.py",
+        "gitlab_api/connector_sources.py",
+        "GITLAB_URL",
+        "GITLAB_TOKEN",
+        "GITLAB_TLS_PROFILE",
+        "GITLAB_INSTANCES",
+        "ENABLE_DELEGATION",
+        "MCP_TOOL_MODE",
+        "skills/**",
+        "ontology/**",
+        "uv run --locked --extra test pytest",
+    ):
+        assert term in text
+
+    assert "verify=False" not in text
+    assert "--no-verify" not in text
+    package_data = project["tool"]["setuptools"]["package-data"]["gitlab_api"]
+    assert "skills/**" in package_data
+    assert project["project"]["entry-points"]["agent_connector_sdk.connector"] == {
+        "gitlab-mcp": "gitlab_api:connector"
+    }

gitlab_api-27.3.15/tests/test_pages_workflow.py

@@ -0,0 +1,52 @@
+"""PIPE-CONNSPEC-R125.3: GitLab API Pages and spec-dashboard contract."""
+
+from __future__ import annotations
+
+import json
+import re
+from pathlib import Path
+
+import pytest
+
+ROOT = Path(__file__).resolve().parents[1]
+WORKFLOW = ROOT / ".github/workflows/pages.yml"
+DASHBOARD = ROOT / ".github/spec-dashboard.json"
+
+pytestmark = pytest.mark.spec("PIPE-CONNSPEC-R125.3")
+
+
+def test_pages_caller_enables_dashboard_and_rebuilds_for_spec_changes() -> None:
+    assert not (ROOT / ".github/workflows/docs.yml").exists()
+
+    workflow = WORKFLOW.read_text(encoding="utf-8")
+
+    assert "uses: Knuckles-Team/pipelines/.github/workflows/pages_pipeline.yml@main" in workflow
+    assert re.search(r"^      content_source: docs$", workflow, re.MULTILINE)
+    assert re.search(r"^      spec_dashboard_enabled: true$", workflow, re.MULTILINE)
+    assert re.search(
+        r"^      spec_dashboard_config: \.github/spec-dashboard\.json$",
+        workflow,
+        re.MULTILINE,
+    )
+    assert re.search(r"^  workflow_dispatch: \{\}$", workflow, re.MULTILINE)
+    for path in (
+        "'docs/**'",
+        "'mkdocs.yml'",
+        "'README.md'",
+        "'specs/**'",
+        "'.github/spec-dashboard.json'",
+        "'.github/workflows/pages.yml'",
+    ):
+        assert path in workflow
+
+    assert re.search(r"(?m)^      pages: write$", workflow)
+    assert re.search(r"(?m)^      id-token: write$", workflow)
+
+
+def test_dashboard_reads_only_canonical_spec_status_files() -> None:
+    config = json.loads(DASHBOARD.read_text(encoding="utf-8"))
+
+    assert config == {
+        "version": 1,
+        "sources": [{"glob": "specs/*/status.json", "kind": "spec"}],
+    }