v0.1.0 — first release

First tagged release of hf-data-agent — an internal data agent that funnels
several entrypoints into one orchestrator, grounds an open-weights Hugging Face
model in a knowledge base built offline, and lets it query a data platform live.

What it does

• One funnel. Agent UI, HTTP API, local MCP (stdio), remote MCP (HTTP) and
  Slack all reach the same Orchestrator.
• Bounded tool-calling loop. The model answers or requests a tool; the tool
  runs; the result returns as an observation, up to DA_MAX_TOOL_STEPS. A
  failed call — unknown tool, missing argument, rejected SQL — comes back as an
  observation the model can correct, so a bad call costs a round, not the
  request.
• Streaming. POST /ask/stream emits Server-Sent Events. A tool-call turn is
  never streamed as text, so the protocol cannot leak into the answer.
• Swappable model. mock (offline default), transformers, OpenAI-compatible
  (vLLM/TGI) and HF Inference, all behind one ModelProvider.
• Knowledge offline, data live. Filesystem, Notion, Slack and Google Docs
  connectors build the store; warehouse, Airflow and catalog are queried per
  request. JSON store by default, Qdrant optional.
• Runs with zero configuration. make install seed ingest api needs no GPU,
  no API token and no model download.

Security

• warehouse_query is guarded: one read-only statement, no DDL/DML, no stacked
  statements, row caps, optional table allow-list. The guard is a safety net —
  the boundary is a database user holding SELECT and nothing else.
• /ask and /tool take a bearer token (DA_API_TOKEN), compared in constant
  time; the remote MCP transport takes the same token via an ASGI gate.
• Both bind loopback by default and refuse to start on a routable interface
  without a token, unless explicitly told the port is protected elsewhere.
• Internal exception text is never returned to callers; failures carry a request
  id instead.

See SECURITY.md for the threat model, including what is not
covered.

Known limitations

• The Notion, Slack and Google Docs connectors have not been run against
  their live APIs. Parsing, pagination, thread deduplication and rate-limit
  handling are tested against mocks; the response shapes are taken from the
  documented APIs. Treat the first real ingest as the test.
• The example Airflow DAG has not been parsed by a real scheduler. Its
  behaviour lives in a tested entrypoint; the DAG file itself is checked
  structurally.
• The default hashing embedder has no notion of meaning, so paraphrased
  questions can miss. The eval harness reports this honestly: 18 cases,
  hit rate 0.889, MRR 0.653, with two cases left failing on purpose to show
  the limit. DA_EMBEDDER_BACKEND=sentence_transformers is the intended fix.

Quality

391 tests, 93% coverage, mypy --strict clean, CI across Python 3.10–3.13 plus
Windows and macOS, plus retrieval evals, a container check and CodeQL.

Full detail in CHANGELOG.md.