# data-olympus v0.4.0

The governance release: knowledge in your bundle now carries an explicit
lifecycle that retrieval actually enforces, and agents can propose knowledge
but only humans can promote it to a governing rule.

## New features

- **Agents propose, humans promote.** A new governed-lane protection (on by
  default, `KB_GOVERNED_LANE_PROTECTION=off` to disable) stops any
  agent-initiated write from minting or silently rewriting a governing rule:
  writes that claim in-force status or edit an in-force document are queued
  for your review instead of committed, with an advisory injection-pattern
  scan annotating anything suspicious. Nothing is rejected, and every demotion
  is reported per write, per session (`kb session-recap`), and in the
  consultation envelope.
- **Rules can expire.** Documents may declare a `validity` window
  (`valid_from`, `valid_until`, `last_verified`, `recheck_by`). An expired
  rule disappears from every default search until you explicitly ask for it
  (`include_expired`, `validity_state` filters, or `kb_get` by id), because an
  expired rule with no successor must not keep governing decisions. A new
  `data-olympus validity-report` command lists what expired and what is about
  to.
- **Supersession is now enforced, not just documented.** `supersedes`,
  `superseded_by`, and the new `contradicts` fields are parsed, indexed as
  edges, lint-validated across the whole bundle (dangling, asymmetric, and
  cyclic chains are flagged), and in-force retrieval excludes anything
  superseded by an in-force document, even when someone forgot to flip the
  old document's status.
- **The enforcement surface only serves governing rules.** `kb_consult` is
  hard-filtered to in-force content, server-rendered memories are stamped
  `type: memory` / `status: proposed`, memory-inbox documents can never be in
  force regardless of claimed status, and responses expose a computed
  `in_force` flag plus proposal provenance (`source_session`, `reason`, a new
  `evidence` list).
- **The bundle audits itself.** A maintenance ledger, committed to the bundle
  and recomputed at every index build, tracks corpus health (documents missing
  `status`, recently expired and soon-to-expire rules) and surfaces open items
  as `pending_actions` on `kb_consult` and `kb_health` until they are fixed.
- **Secrets cannot reach your knowledge base.** Every write path (memory
  proposals, edits, onboarding bootstrap, review resolutions) is scanned for
  credential patterns (private keys, GitHub/AWS/Slack tokens, passwords in
  connection strings) and rejected with a redacted report; only an explicit
  operator override through review can commit a flagged write.
- **Start a new bundle in one command.** `data-olympus init <dir>` scaffolds a
  complete, lint-clean bundle with an example of every document type,
  including a working supersession pair and `applies_when` triggers, so a new
  team learns the differentiating features from the artifact itself.
- **New documents must declare a status.** The write path now rejects new
  documents without `status`, while legacy documents keep working through a
  guided migration driven by the maintenance ledger.
- **The format is documented as an OKF profile.** `docs/okf-profile.md` maps
  every field to OKF baseline compatibility, lint coverage, and stability
  tier, so adjacent implementers can compare semantics without reading the
  code.

## Fixed

- `data-olympus index` silently generated zero index files when the bundle's
  absolute path passed through a directory with a skip-listed name (such as
  `.venv` or `node_modules`); skip matching is now relative to the bundle
  root.
- The "Publish to PyPI" workflow failed at startup on every pull request due
  to a reusable-workflow permissions mismatch; the dry-run build now runs on
  packaging PRs as intended.
