org-knowledge-layer 0.4.1__tar.gz → 0.6.0__tar.gz

org_knowledge_layer-0.6.0/PKG-INFO

@@ -0,0 +1,33 @@
+Metadata-Version: 2.4
+Name: org-knowledge-layer
+Version: 0.6.0
+Summary: Renamed: install observed-knowledge-ledger. This package only depends on it.
+Author: Joshua Dell
+License: MIT
+Project-URL: Homepage, https://github.com/emeraldleaf/okl
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+Requires-Dist: observed-knowledge-ledger>=0.6.0
+Provides-Extra: service
+Requires-Dist: observed-knowledge-ledger[service]>=0.6.0; extra == "service"
+Provides-Extra: postgres
+Requires-Dist: observed-knowledge-ledger[postgres]>=0.6.0; extra == "postgres"
+Provides-Extra: mcp
+Requires-Dist: observed-knowledge-ledger[mcp]>=0.6.0; extra == "mcp"
+Provides-Extra: all
+Requires-Dist: observed-knowledge-ledger[all]>=0.6.0; extra == "all"
+
+# org-knowledge-layer → observed-knowledge-ledger
+
+This package has been renamed. Install the new one:
+
+```bash
+pipx install observed-knowledge-ledger
+```
+
+`okl` — the command, the import package and the `.okl/` folder — is unchanged. This final
+release of `org-knowledge-layer` contains no code; it only depends on
+`observed-knowledge-ledger`, so existing installs and CI steps keep working. Switch the name
+when convenient.
+
+Project: https://github.com/emeraldleaf/okl

org_knowledge_layer-0.6.0/README.md

@@ -0,0 +1,14 @@
+# org-knowledge-layer → observed-knowledge-ledger
+
+This package has been renamed. Install the new one:
+
+```bash
+pipx install observed-knowledge-ledger
+```
+
+`okl` — the command, the import package and the `.okl/` folder — is unchanged. This final
+release of `org-knowledge-layer` contains no code; it only depends on
+`observed-knowledge-ledger`, so existing installs and CI steps keep working. Switch the name
+when convenient.
+
+Project: https://github.com/emeraldleaf/okl

org_knowledge_layer-0.6.0/org_knowledge_layer.egg-info/PKG-INFO

@@ -0,0 +1,33 @@
+Metadata-Version: 2.4
+Name: org-knowledge-layer
+Version: 0.6.0
+Summary: Renamed: install observed-knowledge-ledger. This package only depends on it.
+Author: Joshua Dell
+License: MIT
+Project-URL: Homepage, https://github.com/emeraldleaf/okl
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+Requires-Dist: observed-knowledge-ledger>=0.6.0
+Provides-Extra: service
+Requires-Dist: observed-knowledge-ledger[service]>=0.6.0; extra == "service"
+Provides-Extra: postgres
+Requires-Dist: observed-knowledge-ledger[postgres]>=0.6.0; extra == "postgres"
+Provides-Extra: mcp
+Requires-Dist: observed-knowledge-ledger[mcp]>=0.6.0; extra == "mcp"
+Provides-Extra: all
+Requires-Dist: observed-knowledge-ledger[all]>=0.6.0; extra == "all"
+
+# org-knowledge-layer → observed-knowledge-ledger
+
+This package has been renamed. Install the new one:
+
+```bash
+pipx install observed-knowledge-ledger
+```
+
+`okl` — the command, the import package and the `.okl/` folder — is unchanged. This final
+release of `org-knowledge-layer` contains no code; it only depends on
+`observed-knowledge-ledger`, so existing installs and CI steps keep working. Switch the name
+when convenient.
+
+Project: https://github.com/emeraldleaf/okl

org_knowledge_layer-0.6.0/org_knowledge_layer.egg-info/SOURCES.txt

@@ -0,0 +1,8 @@
+README.md
+pyproject.toml
+org_knowledge_layer.egg-info/PKG-INFO
+org_knowledge_layer.egg-info/SOURCES.txt
+org_knowledge_layer.egg-info/dependency_links.txt
+org_knowledge_layer.egg-info/entry_points.txt
+org_knowledge_layer.egg-info/requires.txt
+org_knowledge_layer.egg-info/top_level.txt

org_knowledge_layer-0.6.0/org_knowledge_layer.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

org_knowledge_layer-0.6.0/org_knowledge_layer.egg-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+okl = okl.cli:main

org_knowledge_layer-0.6.0/org_knowledge_layer.egg-info/requires.txt

@@ -0,0 +1,13 @@
+observed-knowledge-ledger>=0.6.0
+
+[all]
+observed-knowledge-ledger[all]>=0.6.0
+
+[mcp]
+observed-knowledge-ledger[mcp]>=0.6.0
+
+[postgres]
+observed-knowledge-ledger[postgres]>=0.6.0
+
+[service]
+observed-knowledge-ledger[service]>=0.6.0

org_knowledge_layer-0.6.0/org_knowledge_layer.egg-info/top_level.txt

@@ -0,0 +1 @@
+

org_knowledge_layer-0.6.0/pyproject.toml

@@ -0,0 +1,37 @@
+# The old distribution name, kept installable. okl was published as org-knowledge-layer
+# until 0.5.0 and renamed to observed-knowledge-ledger (the name now says what is different
+# about it: knowledge proven by observed checks). PyPI cannot rename a project, so this
+# final release carries no code and depends on the new name; installs of the old name,
+# extras included, keep working. publish.yml builds it only on the tag matching `version`.
+[build-system]
+requires = ["setuptools>=68"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "org-knowledge-layer"
+version = "0.6.0"
+description = "Renamed: install observed-knowledge-ledger. This package only depends on it."
+readme = "README.md"
+requires-python = ">=3.10"
+license = { text = "MIT" }
+authors = [{ name = "Joshua Dell" }]
+dependencies = ["observed-knowledge-ledger>=0.6.0"]
+
+[project.optional-dependencies]
+service = ["observed-knowledge-ledger[service]>=0.6.0"]
+postgres = ["observed-knowledge-ledger[postgres]>=0.6.0"]
+mcp = ["observed-knowledge-ledger[mcp]>=0.6.0"]
+all = ["observed-knowledge-ledger[all]>=0.6.0"]
+
+# The same `okl` command, pointing at code the dependency installs. Without it, `pipx
+# install org-knowledge-layer` refuses outright: pipx exposes only the named package's own
+# apps, never a dependency's, and a code-free package has none (found in review of #46,
+# reproduced with pipx before this line was added).
+[project.scripts]
+okl = "okl.cli:main"
+
+[project.urls]
+Homepage = "https://github.com/emeraldleaf/okl"
+
+[tool.setuptools]
+packages = []

org_knowledge_layer-0.6.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

org_knowledge_layer-0.4.1/.claude/agents/architecture-reviewer.md

@@ -1,41 +0,0 @@
----
-name: architecture-reviewer
-description: Reviews a diff or a proposed change against this repo's encoded rules and the org knowledge layer. Invoke on non-pattern-conforming changes (new bounded context, novel dependency, security-model change, multi-step refactor) and before merging anything touching published results. Returns a pattern-checklist verdict, not a rewrite.
-tools: Read, Grep, Glob, Bash
-model: inherit
-memory: project   # persists to .claude/agent-memory/architecture-reviewer/ (committed, team-shared)
-skills:
-  - encoding-loop
----
-
-# Architecture reviewer
-
-You are a reviewer, not an implementer. You read the change and judge it against the encoded body —
-you do not rewrite it. Your output is a checklist verdict with specific file:line findings.
-
-## Before you start
-1. Run `okl check --task "<one-line summary of the change under review>"` and treat the returned
-   armed gates, retractions, tombstones, and THREAT prior-art as binding review criteria.
-2. Read `.claude/rules/` entries whose `paths:` match the changed files.
-
-## Pattern checklist (extend as the repo encodes new rules)
-- **Smallest-surface / speculative coupling** — is there an abstraction (interface, factory, layer)
-  with exactly one implementation and no test substitution and no concrete second impl on the
-  roadmap? If so, flag it as speculative — the concrete class should be used directly.
-- **Assert-from-memory** — does any spec/config/scaffold claim something is "correct"/"valid"
-  without a mechanical `validate` step? Flag it; this is the #14-class defect.
-- **Retracted claim restated** — does any prose restate a claim in `registries/RETRACTIONS.md`
-  without also retracting it? Fail.
-- **Resurrected identifier** — does the diff reintroduce anything in `registries/tombstones.txt`? Fail.
-- **Missing gate receipt** — does a fix reference a defect class that has a gate, without the gate
-  running in CI on this change?
-- **Report-the-result** — if this change is a "fix" that confirms a hypothesis, was the control run?
-
-<!-- <<FILL: STACK-SPECIFIC REVIEW CHECKS>>
-     Add checks specific to this stack (e.g. IDOR predicate in the SQL Where clause; N+1 queries;
-     async-over-sync; mass-assignment of server-controlled fields). Keep each as one scan rule. -->
-
-## Memory
-Use your persistent memory dir to accumulate this repo's recurring findings and architectural
-decisions across reviews. When you see the same finding class a third time, propose promoting it to
-a mechanical gate (surface 5) via the encoding-loop skill.

org_knowledge_layer-0.4.1/.claude/hooks/stop-okl-encode.sh

@@ -1,78 +0,0 @@
-#!/usr/bin/env bash
-# Stop hook — the write-side mechanical catch for the encoding loop.
-#
-# The read side (okl check) is enforced by the PreToolUse hook; nothing enforced the WRITE
-# side, so a session could end without recording what it learned ("a merged fix without the
-# rule is a half-finished job"). This hook asks the question at the ship moment, once:
-# if the session changed the working tree, block the first stop (exit 2) with a prompt to
-# either `okl record` the lesson or state that there is none. It never fires twice in one
-# session (marker file) and never loops (stop_hook_active guard).
-set -uo pipefail
-
-# Same resolver as pretooluse-okl-check.sh (env → pinned config → PATH → python3 -m okl);
-# the reminder is best-effort, so an unresolvable okl silently disables it rather than blocking.
-resolve_okl() {
-  if [ -n "${OKL_BIN:-}" ]; then printf '%s' "$OKL_BIN"; return 0; fi
-  local d="$PWD"
-  while [ "$d" != "/" ]; do
-    if [ -f "$d/.okl/config.json" ]; then
-      local bin
-      bin=$(python3 -c 'import json,sys; print(json.load(open(sys.argv[1])).get("okl_bin") or "")' \
-            "$d/.okl/config.json" 2>/dev/null || true)
-      if [ -n "$bin" ]; then printf '%s' "$bin"; return 0; fi
-      break
-    fi
-    d=$(dirname "$d")
-  done
-  if command -v okl >/dev/null 2>&1; then printf '%s' "okl"; return 0; fi
-  if python3 -c "import okl" >/dev/null 2>&1; then printf '%s' "python3 -m okl"; return 0; fi
-  return 1
-}
-
-OKL=$(resolve_okl) || exit 0
-
-payload=$(cat 2>/dev/null || true)
-parsed=$(printf '%s' "$payload" | python3 -c '
-import json, sys
-try:
-    d = json.load(sys.stdin)
-except Exception:
-    d = {}
-print(d.get("session_id", ""))
-print("true" if d.get("stop_hook_active") else "false")
-' 2>/dev/null) || parsed=""
-session_id=$(printf '%s\n' "$parsed" | sed -n 1p)
-stop_hook_active=$(printf '%s\n' "$parsed" | sed -n 2p)
-[ -n "$stop_hook_active" ] || stop_hook_active="false"
-
-# Never loop: if we already blocked once and Claude is stopping again, let it stop.
-[ "${stop_hook_active}" = "true" ] && exit 0
-
-# Only fire when the session plausibly did work: uncommitted changes, or a commit in the
-# last hour (covers commit-then-stop sessions).
-changed=0
-if [ -n "$(git status --porcelain 2>/dev/null)" ]; then
-  changed=1
-elif last=$(git log -1 --format=%ct 2>/dev/null); then
-  now=$(date +%s)
-  [ $((now - last)) -lt 3600 ] && changed=1
-fi
-[ "$changed" = "1" ] || exit 0
-
-# Once per session (fall back to a repo-scoped marker when no session id is provided).
-marker="${TMPDIR:-/tmp}/okl-encode-reminder-${session_id:-$(pwd | cksum | cut -d' ' -f1)}"
-[ -e "$marker" ] && exit 0
-touch "$marker" 2>/dev/null || true
-
-cat >&2 <<'MSG'
-ENCODING LOOP — before this session ends: did it surface a lesson worth keeping?
-A non-obvious failure mode, a rule discovered the hard way, a decision that shouldn't be
-silently reversed? If yes, record it now (choose the scope deliberately — 'org' spreads
-to every repo, 'repo' stays local — and tag the subject):
-
-  okl record --type Defect|Rule|Decision --scope org|repo --tags "<subjects>" \
-    --title "..." --symptom "..." --body "cause: ..." --fix "..."
-
-If the session genuinely learned nothing durable, state that explicitly and finish.
-MSG
-exit 2

org_knowledge_layer-0.4.1/.claude/hooks/userpromptsubmit-okl-check.sh

@@ -1,68 +0,0 @@
-#!/usr/bin/env bash
-# UserPromptSubmit hook — inject the org's relevant lessons into the model's context
-# BEFORE it starts the task. This event is the only correct one for delivery: its stdout
-# (exit 0) is added to Claude's context, and its stdin carries the actual prompt text, so
-# the briefing is retrieved for the task the user really asked for.
-#
-# (The earlier PreToolUse version fired on every edit and printed the briefing to a channel
-# the model never sees — PreToolUse exit-0 stdout goes to the transcript only. Discovered by
-# an end-to-end test: hook fired, briefing correct, defect reproduced anyway.)
-#
-# FAILS CLOSED via exit 2: if the knowledge layer is unreachable, the prompt is blocked
-# rather than letting the agent proceed blind. A check that reports "clean" while broken is
-# worse than no check.
-set -uo pipefail
-
-# Resolve how to invoke okl (env → pinned config → PATH → python3 -m okl); hooks run in
-# whatever environment the harness spawns, which often lacks the venv/pipx bin dir.
-resolve_okl() {
-  if [ -n "${OKL_BIN:-}" ]; then printf '%s' "$OKL_BIN"; return 0; fi
-  local d="$PWD"
-  while [ "$d" != "/" ]; do
-    if [ -f "$d/.okl/config.json" ]; then
-      local bin
-      bin=$(python3 -c 'import json,sys; print(json.load(open(sys.argv[1])).get("okl_bin") or "")' \
-            "$d/.okl/config.json" 2>/dev/null || true)
-      if [ -n "$bin" ]; then printf '%s' "$bin"; return 0; fi
-      break
-    fi
-    d=$(dirname "$d")
-  done
-  if command -v okl >/dev/null 2>&1; then printf '%s' "okl"; return 0; fi
-  if python3 -c "import okl" >/dev/null 2>&1; then printf '%s' "python3 -m okl"; return 0; fi
-  return 1
-}
-
-if ! OKL=$(resolve_okl); then
-  [ "${OKL_OFFLINE:-0}" = "1" ] && exit 0
-  echo "okl NOT FOUND — blocking (a check that can't run must not pass as clean)." >&2
-  echo "Install it (pip install okl), set OKL_BIN, or re-run 'okl init' from a shell where it" >&2
-  echo "works (pins okl_bin into .okl/config.json). OKL_OFFLINE=1 proceeds without the layer." >&2
-  exit 2
-fi
-
-# The task is the prompt itself (stdin JSON: {"prompt": "..."}); OKL_TASK overrides;
-# last-commit-message is only the fallback of last resort.
-payload=$(cat 2>/dev/null || true)
-prompt=$(printf '%s' "$payload" | python3 -c '
-import json, sys
-try:
-    print((json.load(sys.stdin).get("prompt") or "").strip()[:2000])
-except Exception:
-    print("")
-' 2>/dev/null || true)
-TASK="${OKL_TASK:-${prompt:-$(git log -1 --pretty=%s 2>/dev/null || echo 'general work')}}"
-
-# $OKL unquoted on purpose: it may be a command + args ("python3 -m okl").
-if out=$($OKL check --task "$TASK" --format agent 2>/dev/null); then
-  printf '%s\n' "$out"      # stdout → the model's context
-  exit 0
-fi
-
-if [ "${OKL_OFFLINE:-0}" = "1" ]; then
-  echo "OKL offline (OKL_OFFLINE=1 acknowledged) — proceeding without the layer." >&2
-  exit 0
-fi
-echo "OKL UNREACHABLE — blocking this prompt. A check that reports 'clean' while broken is worse than no check." >&2
-echo "Fix connectivity, or set OKL_OFFLINE=1 to explicitly proceed without the org knowledge layer." >&2
-exit 2

org_knowledge_layer-0.4.1/.claude/settings.json

@@ -1,24 +0,0 @@
-{
-  "hooks": {
-    "Stop": [
-      {
-        "hooks": [
-          {
-            "type": "command",
-            "command": "\"$CLAUDE_PROJECT_DIR\"/.claude/hooks/stop-okl-encode.sh"
-          }
-        ]
-      }
-    ],
-    "UserPromptSubmit": [
-      {
-        "hooks": [
-          {
-            "type": "command",
-            "command": "\"$CLAUDE_PROJECT_DIR\"/.claude/hooks/userpromptsubmit-okl-check.sh"
-          }
-        ]
-      }
-    ]
-  }
-}

org_knowledge_layer-0.4.1/.github/ISSUE_TEMPLATE/bug_report.md

@@ -1,21 +0,0 @@
----
-name: Bug report
-about: Something behaves differently than documented
-labels: bug
----
-
-**What you ran** (the exact command, and `okl --help` version if relevant)
-
-**What you expected**
-
-**What actually happened** (paste the real output, not a summary)
-
-**Environment**
-- OS:
-- Python:
-- Installed via: `pip install org-knowledge-layer` / `pip install -e .`
-- Mode: local store / shared service
-
-**Especially useful:** if the tool reported success it had not earned (a check that
-passed without running, a stamp without evidence, a hook that fired but changed
-nothing), say so explicitly. That class of defect is this project's subject.

org_knowledge_layer-0.4.1/.github/ISSUE_TEMPLATE/feature_request.md

@@ -1,15 +0,0 @@
----
-name: Proposal
-about: Suggest a change to how the loop works
-labels: proposal
----
-
-**The symptom you hit** (what went wrong in real use, not the feature you want)
-
-**Why the current design does not cover it**
-
-**What you would change**
-
-**How you would know it worked** — the check, measurement, or test that would show it.
-Proposals that name their own evidence get adopted faster; see `evals/REPORT.md` for
-the standard this repo holds itself to.

org_knowledge_layer-0.4.1/.github/dependabot.yml

@@ -1,32 +0,0 @@
-# Dependabot.
-#
-# This exists because of the SHA pinning, not despite it. Pinning actions to a commit
-# closes the "a mutable tag moved under me" hole and opens a quieter one: the pin never
-# updates, so a security fix in an action never arrives. Pinning without an update path
-# is how a repo ends up on a two-year-old checkout action and calls it hardening.
-# Dependabot rewrites the SHA and the trailing `# v5` comment together.
-version: 2
-
-updates:
-  - package-ecosystem: github-actions
-    directory: "/"
-    schedule:
-      interval: weekly
-    labels: ["dependencies", "ci"]
-    commit-message:
-      prefix: "ci"
-
-  - package-ecosystem: pip
-    directory: "/"
-    schedule:
-      interval: weekly
-    labels: ["dependencies"]
-    commit-message:
-      prefix: "deps"
-    # The gating tools are pinned exactly on purpose (a range lets a new release
-    # retro-fail a branch that changed nothing). Dependabot is the intended way to move
-    # those pins: a PR that runs the full suite against the new version before it lands,
-    # rather than a range that upgrades silently mid-branch.
-    groups:
-      dev-tooling:
-        patterns: ["pytest", "ruff", "mypy"]

org_knowledge_layer-0.4.1/.github/pull_request_template.md

@@ -1,15 +0,0 @@
-## What changed
-
-## Why
-
-## What you ran to check it
-
-<!-- Paste real output. `pytest -q`, `ruff check .`, and `okl drift` at minimum. -->
-
-## Checklist
-
-- [ ] `pytest -q` green
-- [ ] `ruff check .` clean
-- [ ] `okl drift` green, or affected records re-verified with `okl verify --run`
-- [ ] Mirror files still byte-identical (`ci/`, `.github/workflows/`, `hooks/` and their `src/okl/scaffold/` twins)
-- [ ] Any number quoted has a committed receipt in `evals/results/`

org_knowledge_layer-0.4.1/.github/workflows/ci.yml

@@ -1,100 +0,0 @@
-# Repo CI — lints, type-checks and tests okl itself. (okl-verify.yml is different: it
-# demonstrates the product's own drift/method gates, the workflow consumers copy.)
-#
-# Hardened per the org rule this repo's own store carries ("CI workflow baseline:
-# pipefail, no persisted credentials, least-privilege permissions, concurrency groups —
-# pin actions"). It satisfied none of the five until this commit, which is the rule's own
-# symptom: an enforcement surface nothing triggers runs never.
-name: ci
-
-on:
-  push:
-    branches: [ "main" ]
-  pull_request:
-    branches: [ "main" ]
-
-# Least privilege: this job reads code and reports status. It never pushes.
-permissions:
-  contents: read
-
-# One run per ref. A superseded push should stop burning minutes on a result nobody
-# will read.
-concurrency:
-  group: ci-${{ github.ref }}
-  cancel-in-progress: true
-
-defaults:
-  run:
-    # Without pipefail a run block continues past a failed segment of a pipeline, so a
-    # green step can hide a red command.
-    shell: bash -euo pipefail {0}
-
-jobs:
-  lint-and-test:
-    runs-on: ubuntu-latest
-    steps:
-      # Actions pinned to a commit SHA, not a tag: a tag is mutable, so `@v5` is an
-      # unpinned dependency with write access to the runner.
-      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09  # v5
-        with:
-          # The diagram gate reads committed history (git show HEAD:...), not the
-          # checkout tree, so it needs more than the default shallow fetch.
-          fetch-depth: 0
-          # This job never pushes; leaving the token in .git/config lets any later step
-          # (or a compromised dependency) use it.
-          persist-credentials: false
-
-      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6
-        with:
-          python-version: "3.12"
-
-      - name: Install (dev extras)
-        run: pip install -e ".[dev]"
-
-      - name: Lint — ruff (config in pyproject.toml)
-        run: ruff check .
-
-      - name: Types — mypy
-        run: mypy src/okl
-
-      - name: Tests (with the coverage ratchet)
-        run: pytest -q --cov=okl
-
-      - name: Diagram figures trace to committed receipts
-        run: ./ci/check-diagram-figures.sh
-
-      # The content audits okl ships to consumers, run against okl itself. They were
-      # shipped for weeks without this repo running any of them — the "enforcement
-      # surface nothing triggers" failure, one level up: a gate whose author has never
-      # run it on their own tree.
-      - name: Method gates (links, doc orphans, diagram pairs, tombstones, canon size)
-        run: bash gates/run-gates.sh
-
-      # Secret scan over the FULL history, not the working tree. okl writes a bearer
-      # token into .okl/config.json, and the .gitignore it now drops there is the only
-      # thing between that and a commit — this is the check for when that fails.
-      #
-      # The upstream gitleaks-action is deliberately not used: it requires a paid licence
-      # key for organization-owned repositories, so it would break for anyone who forks
-      # this into an org. The binary has no such condition, and pinning the release keeps
-      # a new detection rule from retro-failing a branch that changed nothing.
-      # The reviewer okl ships, run on okl. It was listed as a review surface with nothing
-      # triggering it — the "enforcement surface that only runs on-demand runs never"
-      # failure this repo's own store names. Off unless REVIEW_CMD is set, so it costs
-      # nothing until someone decides it should.
-      - name: Architecture review (off unless REVIEW_CMD is set)
-        if: github.event_name == 'pull_request'
-        env:
-          REVIEW_CMD: ${{ vars.REVIEW_CMD }}
-          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
-          REVIEW_BASE_REF: origin/${{ github.base_ref }}
-        run: bash ci/review-agent.sh
-
-      - name: Secret scan — gitleaks
-        env:
-          GITLEAKS_VERSION: "8.30.1"
-        run: |
-          curl -sSfL -o /tmp/gitleaks.tar.gz \
-            "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz"
-          tar -xzf /tmp/gitleaks.tar.gz -C /tmp gitleaks
-          /tmp/gitleaks git . --no-banner --redact --exit-code 1

org_knowledge_layer-0.4.1/.github/workflows/okl-verify.yml

@@ -1,85 +0,0 @@
-# Installed by `okl init` into .github/workflows/okl-verify.yml (also stamped by `okl scaffold`).
-#
-# The knowledge layer's CI verifier — real checks, not placeholders:
-#   1. `okl drift --gate`  — fails the build when a rule's governed files changed after the
-#      rule was last verified (a stale rule is a rule nobody re-checked).
-#   2. `gates/run-gates.sh` — the repo's mechanical method gates, when the scaffold is present.
-#
-# Shared-layer connection is optional: without OKL_SERVICE_URL the drift gate runs against
-# the repo's local .okl store. Configure the secrets to verify against the org layer and to
-# let gate scripts emit receipts (`okl link <gate_id> VERIFIED_ON <defect_id>`) — emit those
-# from inside the gate that proved itself against real drift, where the ids are known.
-name: okl-verify
-
-on:
-  pull_request:
-  push:
-    branches: [main]
-
-# Least privilege: this workflow reads code and reports a status. It never writes.
-permissions:
-  contents: read
-
-concurrency:
-  group: okl-verify-${{ github.ref }}
-  cancel-in-progress: true
-
-defaults:
-  run:
-    # Without pipefail a run block continues past a failed segment of a pipeline, so a
-    # green step can hide a red command.
-    shell: bash -euo pipefail {0}
-
-jobs:
-  okl-verify:
-    runs-on: ubuntu-latest
-    env:
-      # Set at job level so every okl command below resolves the shared layer from the
-      # environment. This replaces an `okl connect --token` step, which wrote the bearer
-      # token into .okl/config.json on the runner — needless, since the client reads both
-      # variables directly, and one more place for a credential to end up.
-      # Unset secrets leave these empty, and okl falls back to the repo-local store.
-      OKL_SERVICE_URL: ${{ secrets.OKL_SERVICE_URL }}
-      OKL_TOKEN: ${{ secrets.OKL_TOKEN }}
-    steps:
-      # Actions are pinned to a commit SHA: a tag is mutable, so `@v5` is an unpinned
-      # dependency with access to your runner. If you copy this file into your own repo,
-      # add a .github/dependabot.yml with the `github-actions` ecosystem so these pins get
-      # security updates — a pin with no update path goes stale and that is its own risk.
-      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09  # v5
-        with:
-          fetch-depth: 0   # drift needs history: it compares governed-file commits vs verified_at
-          persist-credentials: false   # this job never pushes
-
-      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6
-        with:
-          python-version: "3.13"
-
-      - name: Install okl
-        # Detect by the package source, not the distribution name: the name changed once
-        # (PyPI rejects "okl" as confusable) and a name-based check silently broke with it.
-        run: |
-          if [ -f src/okl/cli.py ]; then
-            pip install -e .
-          else
-            pip install org-knowledge-layer
-          fi
-
-      - name: Report which store the gate will run against
-        run: |
-          if [ -n "${OKL_SERVICE_URL:-}" ]; then
-            echo "verifying against the shared layer at $OKL_SERVICE_URL"
-          else
-            echo "no OKL_SERVICE_URL secret — verifying against the repo-local store"
-          fi
-
-      - name: Drift gate — rules whose governed code changed after last verification
-        run: okl drift --gate
-
-      - name: Method gates (when the scaffold kit is present)
-        run: |
-          if [ -x gates/run-gates.sh ]; then
-            bash gates/run-gates.sh
-          else
-            echo "no gates/run-gates.sh — method-kit gates not installed (okl scaffold adds them)"
-          fi