0.6.0-rc.4

data-olympus 0.6.0

New features

• MCP discovery is compact and searchable by default. Agents initially see the
  seven core tools plus tool_search and call_tool, while hidden tools remain
  callable with unchanged authorization. Operators can select the complete
  catalog with KB_TOOL_DISCOVERY_MODE=all.
• PyPI is now the primary install path. uvx provides an immediate first run,
  uv tool install provides a persistent CLI, and the installed wheel includes
  both console entry points and the enforcement machinery used by setup.
• Release candidates are complete across PyPI, GHCR, and GitHub. Every candidate
  includes a wheel, sdist, image, GitHub prerelease, and provenance receipt from
  one exact source SHA. Stable publication uses Trusted Publishing and requires
  an explicit human approved promotion of the highest complete candidate.
• Executable OKF conformance now proves both interoperability directions against
  a pinned upstream Google reference revision and checksummed fixtures.
• Benchmark evidence now includes a deterministic provenance receipt covering
  source, inputs, dependencies, commands, seeds, environment, and result hashes.
  Public benchmark claims are labeled as maintainer produced and not independently
  reproduced.
• MCP catalog discovery is clearer. Eight tool definitions now describe their
  behavior, parameters, side effects, and when to use a related tool instead,
  giving registries and agents more useful guidance without changing the API.
• The Glama sandbox now starts with the bundled example corpus, publishes
  related server metadata, and documents the maintenance checks used to keep
  the catalog profile complete.

Fixed

• Search, document reads, lists, outlines, onboarding status, and cleanup
  planning now handle an empty or incomplete SQLite index without exposing raw
  database errors. They return safe empty results until the index is ready.
• The transitive MCP SDK was updated to 1.28.1, closing the WebSocket transport
  advisory tracked as GHSA-vj7q-gjh5-988w. Data Olympus uses Streamable HTTP,
  but the patched dependency removes the vulnerable code from the lock.
• The optional benchmark stack now resolves torch 2.13.0, closing
  GHSA-rrmf-rvhw-rf47 in torch.jit.script. Production embeddings do not use
  torch, and the benchmark integration remains compatible with
  sentence-transformers.