fix: point Knuckles-Team/pipelines calls at @main, fix pages permissions (#7)

* docs(agents): add upstream currency edict (fleet standardization)

Propagates the upstream-currency edict (target the newest release; a pin is a
hypothesis, not a fact) from agent-utilities/AGENTS.md, following the same
fleet-wide pattern the Version & lockfile drift edict used. D-upgrade-edict-1,
reports/deferred/lane-upgrade-edict.md.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* chore(connectors): repair the MCP server alias and re-certify the bundle

The fleet registry (deploy/mcp-fleet.registry.yml in agent-utilities) is the one
authority for what this provider's MCP server is called. connectors/mcp_source_presets.json
restated that name and had rotted to the *distribution* name, so a source_sync
mcp_tool preset could not bind. The alias is now the registry's, and the whole
capability bundle -- connector_manifest.yml, ontology/shapes, ontology/mappings,
ontology/fixtures, ontology/migrations, ontology/certification.json -- was
regenerated over the corrected input and re-signed with the release authority
ontology.lock pins (QkigdPNpcUU7...), recovered from versioned OpenBao KV v2
custody.

a2a.json is generated too: the certification pipeline now derives it from this
package's own pyproject.toml before the ledger hashes it, so the previously
hand-maintained card can no longer drift from what the certification signs.

Nothing here was hand-edited; every artifact is generator output.

Requires agent-utilities feat/connector-alias-recert, which composes
feat/drift-proof-release-system (registry-derived alias, derived
SOURCE_COMPATIBILITY, versioned-custody + lock-agreement signing gate) with
61ff41ec (generated a2a.json).

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* lane-guard: reach the lane-concurrency canonical-checkout guard (D-CP-3)

Adds the same lane-guard local hook agent-utilities/epistemic-graph/universal-skills already carry -- shells out, unmodified, to agent-utilities' check_lane_guard.py via the AGENT_UTILITIES_ROOT sibling-checkout idiom this repo already uses for check-stubs/check-sprawl. No new dependency.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* fix: point Knuckles-Team/pipelines calls at @main, fix pages permissions

The stale pin dc60f5ca0cfd00bf2e66f912a33d6d0f8ee62874 broke pages.yml CI
with "Invalid workflow file ... requesting 'contents: write', but is only
allowed 'contents: read'" because the callee pages_pipeline.yml declares
permissions: contents: write, pages: write, id-token: write. Bumped the
job's contents permission from read to write to match.

python_pipeline.yml and container_pipeline.yml (called from pipeline.yml)
declare no permissions block, so no permission mismatch there -- only the
stale ref needed fixing.

Per operator intent: track main so the fleet always uses the latest
pipeline release. This repo carries no supply-chain-source-contract
SHA-pin gate, so a floating @main ref is appropriate (contrast
agent-utilities, which does carry that gate and stays pinned to a
concrete tip SHA instead).

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: Knucklessg1

.github/workflows/pages.yml

@@ -16,6 +16,6 @@ jobs:
   publish-pages:
     uses: Knuckles-Team/pipelines/.github/workflows/pages_pipeline.yml@main
     permissions:
-      contents: read
+      contents: write
       pages: write
       id-token: write

.pre-commit-config.yaml

@@ -82,6 +82,12 @@ repos:
     language: system
     files: \.md$
     pass_filenames: true
+  - id: lane-guard
+    name: Lane guard — canonical checkout read-only + stray CARGO_TARGET_DIR (D-CP-3/D-CP-4 reach)
+    entry: bash -c 'repo=$(dirname "$(git rev-parse --path-format=absolute --git-common-dir)"); root=${AGENT_UTILITIES_ROOT:-"$(dirname "$repo")/agent-utilities"}; python3 "$root/scripts/check_lane_guard.py"'
+    language: system
+    pass_filenames: false
+    always_run: true
   - id: check-stubs
     name: Check for Active Stubs and TODOs
     entry: bash -c 'repo=$(dirname "$(git rev-parse --path-format=absolute --git-common-dir)"); root=${AGENT_UTILITIES_ROOT:-"$(dirname "$repo")/agent-utilities"}; python3 "$root/scripts/check_stubs.py" "$@"' --

AGENTS.md

@@ -390,3 +390,33 @@ is what Dependabot flags. Rules:
    Dependabot/security surface.
 4. **Patch CVEs with a version floor at the source, then re-lock.** `uv` resolves one version
    graph-wide, so a lower-bound in the extra that pulls a dependency raises it for the whole lock.
+
+## Upstream currency edict — target the newest release; a pin is a hypothesis, not a fact (READ BEFORE capping, deferring, or opt-in-gating an upgrade)
+
+This governs how we treat **other people's** releases, deprecations, and version caps in
+this repo (fleet-wide edict, propagated from `agent-utilities/AGENTS.md`).
+
+1. **Latest by default.** Target the newest upstream release -- including a pre-release
+   where the ecosystem has already moved onto it. Sitting on an old major because the
+   upgrade is work is not a reason to defer it.
+2. **A conservative upstream pin is a hypothesis, not a fact -- test it, don't inherit
+   it.** Upstream maintainers cap defensively (an unreleased major, an untested surface)
+   as often as they cap for a known break. Worked example (from `agent-utilities`):
+   `pydantic-ai-slim` 2.18.0 declared `fastmcp-slim[client]>=3.3.0` with no upper bound;
+   2.19.0 added `<4` purely as a defensive guard while fastmcp 4 was still pre-release --
+   not because of an observed incompatibility. Blocking an upgrade on that kind of cap
+   without testing it is the wrong default.
+3. **Forward-fix only.** When an upgrade breaks something, fix the break to proceed --
+   do not pin backwards, vendor a fork, or route around it. If a break is genuinely
+   unfixable inside this repo, say exactly what and why, and carry a plan to unblock it
+   -- never an indefinite pin.
+4. **Deprecations are fixed on sight, in code AND in tests.** A `DeprecationWarning` from
+   an upstream library is a defect to fix now, not noise to filter. **Never** silence one
+   with a warning filter, `# noqa`, or a pytest `filterwarnings` entry in order to go
+   green.
+5. **Adopt upstream features rather than reimplementing them.** If upstream ships a
+   capability this repo hand-rolled, migrate to theirs and delete the local one.
+6. **Nothing built on an upgrade ships opt-in.** A new capability an upgrade unlocks is
+   default-on unless it genuinely costs compute, in which case it is policy-selected,
+   never flag-gated. An opt-in extra or a dependency-conflict fork is an interim state
+   that must carry a written plan to become the default, never a resting place.

a2a.json

@@ -2,14 +2,25 @@
   "name": "gitlab-api-agent",
   "type": "agent",
   "version": "27.0.0",
-  "description": "Agent package for gitlab-api",
+  "description": "GitLab API + MCP Server + A2A Server",
   "url": "https://github.com/Knuckles-Team/gitlab-api/tree/main",
   "license": "MIT",
   "capabilities": [
     {
       "id": "run_graph_flow",
       "name": "Graph Flow Execution",
       "description": "Execute a workflow through the agent's graph orchestration engine"
+    },
+    {
+      "id": "epistemic-answer",
+      "name": "Epistemic Answer",
+      "description": "Answers epistemic_status/why/what_changed queries over the shared knowledge graph: calibrated confidence, evidence/source citations, belief justification trees, bitemporal valid/tx history, and policy-redaction-aware provenance.",
+      "tags": [
+        "epistemic",
+        "provenance",
+        "confidence",
+        "kg"
+      ]
     }
   ],
   "tools": [

connector_manifest.yml

@@ -83,6 +83,11 @@ resources:
   id_prefix: runner
   relations: []
 actions:
+- id: epistemic-answer
+  name: Epistemic Answer
+  description: 'Answers epistemic_status/why/what_changed queries over the shared knowledge graph: calibrated
+    confidence, evidence/source citations, belief justification trees, bitemporal valid/tx history, and
+    policy-redaction-aware provenance.'
 - id: run_graph_flow
   name: Graph Flow Execution
   description: Execute a workflow through the agent's graph orchestration engine
@@ -330,7 +335,7 @@ schema_mappings:
       webUrl: xsd:string
 sync:
 - preset: gitlab-projects
-  server: gitlab-api
+  server: gitlab-mcp
   tool: gitlab_projects
   action: get
   records_path: data
@@ -342,7 +347,7 @@ sync:
   doc_type: repository
   tool_schema_sha256: 9949c8ae5d2415f22ebf5357da3a43b27a6e79758d56c641cf4d90db6aa41e24
   raw:
-    server: gitlab-api
+    server: gitlab-mcp
     tool: gitlab_projects
     action: get
     records_path: data
@@ -357,7 +362,7 @@ sync:
     doc_type: repository
 provenance:
   generated_by: scripts/generate_connector_manifests.py
-  generated_at: '2026-07-18T15:00:00Z'
+  generated_at: '2026-07-31T04:00:00Z'
   source_artifacts:
   - a2a.json
   - gitlab_api/connectors/mcp_source_presets.json
@@ -369,8 +374,8 @@ provenance:
     triple_count: 113
   signer: ontology-manifest-generator
   signature_algorithm: ed25519
-  signing_public_key: q0Cp7bmQMqJhbofGKKw8xXC6KbFzukBDDke0UYVi8y4
-  signature: rcp7_l7pwsKtsDEEA97SE1UfVWfYMe1vsvZoSyybLuq-Kg8xgG4ADnbI9ZLgeJXLjbsJEjIFtLcbUs31rI7NCQ
+  signing_public_key: QkigdPNpcUU7x7NcSkwCsUXIQpaFncMQbYSoiSgI2SY
+  signature: BTYLm4xWqKMjRQpCU__C6Bdve_9nRL0yefTC8kmm_H-zNQtipceMaAdzCwg9ob6G9GDIKfb5KjOMgKFVlyQtDA
 policy:
   pii_fields: {}
   tenant_boundary: null

gitlab_api/connectors/mcp_source_presets.json

@@ -1,7 +1,7 @@
 {
   "_comment": "Tier-1 mcp_tool source presets for gitlab-api (AU-KG.ingest.mcp-tool-connector). Syncs GitLab projects into the KG as repository documents via the gitlab-api MCP server. Contributed presets win over the central MCP_TOOL_PRESETS. Extend with merge-request / pipeline presets as needed.",
   "gitlab-projects": {
-    "server": "gitlab-api",
+    "server": "gitlab-mcp",
     "tool": "gitlab_projects",
     "action": "get",
     "records_path": "data",

gitlab_api/ontology/certification.json

@@ -1,13 +1,13 @@
 {
   "api_version": "graphos.io/v1",
   "artifacts": {
-    "a2a.json": "c6a3a0e5b70db8d37aa0e25013f94fbe375ac0a743ec61c2e8687bf0fb8d7352",
-    "connector_manifest.yml": "52eecad24646d9bca3561dc9ade22ee20568cdc7f1a2b71d4be7eab855fa8a6f",
-    "gitlab_api/connectors/mcp_source_presets.json": "a7093f28b0eb3a211531a66fea312e0400bea643ac9f8536c14298079c0fdd35",
+    "a2a.json": "a62ddb8b86cfa7c1d25732483601b16d0b71130cdec99da6813dcada61d7b9ff",
+    "connector_manifest.yml": "7c9e8cc963c00ab0d57cb12655d74b7466254ab4e781b284ccbfd25407ebe7ae",
+    "gitlab_api/connectors/mcp_source_presets.json": "e3d608244e0b66694fc82ab039613181a98e9e4c25a9bf2c8f0a2b09a0c23061",
     "gitlab_api/connectors/tool_schema_fingerprints.json": "74f3e6a172be003056bb74279281308a900b53c4d2d12de7fc2affee9fbcc6a3",
     "gitlab_api/ontology/fixtures/records.json": "5f0417820053941933f15b3f459750753f4e8e34cf1e7853fd030c1143356b40",
     "gitlab_api/ontology/gitlab.ttl": "19fa64000d2e51c60c53074b1fae4ab98aed85318337b5a2199f4837ae9f3fc0",
-    "gitlab_api/ontology/mappings/source.yaml": "5fc8629402243afe7223564e58233ab7273ba3b2286dc03aca20de617d5ca9fa",
+    "gitlab_api/ontology/mappings/source.yaml": "167206b5387f7ca97ce02e0f15164f8fe41f06b413b591d0008c29e9f0a95e7f",
     "gitlab_api/ontology/migrations/manifest.json": "442c3c53df0b42c866eef7255b1889b8ada6f9f9c5125cad65d6b50dc6362a3e",
     "gitlab_api/ontology/shapes/connector.shacl.ttl": "20d2bfc3827fd6327a3b6f25828b41d9de3f855867c46264a7e0aa7f951c76fa"
   },
@@ -19,19 +19,19 @@
     "synthetic_fixture_contract": "passed"
   },
   "compatibility": {
-    "agent_utilities": ">=1.27.1,<2",
+    "agent_utilities": ">=2.1.0,<3",
     "bundle_schema": "2",
-    "epistemic_graph": ">=2.23.1,<3"
+    "epistemic_graph": ">=2.23.0,<3"
   },
   "connector": "gitlab-api",
   "kind": "ConnectorSourceAttestation",
   "live_certified": false,
   "mode": "offline-source",
   "schema_version": "2",
-  "signature": "OT056oBz7h-O2BX29pZq-quN0J0yqx8c2NSYsVGz30yeovPFTzc3kOzRWJhx7dQU1Vd-yIfXVbudXVy0TqzYBQ",
+  "signature": "WoJ1zh3sCOCepOJtZoKwAF7BXa4B9aiHouPNA26KFnnzNjTd0IEwaFN55ycpczPL8OFi4COrJHyabm8VtmhgBA",
   "signature_algorithm": "ed25519",
   "signer": "ontology-manifest-generator",
-  "signing_public_key": "q0Cp7bmQMqJhbofGKKw8xXC6KbFzukBDDke0UYVi8y4",
+  "signing_public_key": "QkigdPNpcUU7x7NcSkwCsUXIQpaFncMQbYSoiSgI2SY",
   "status": "source-validated",
-  "validated_at": "2026-07-18T15:00:00Z"
+  "validated_at": "2026-07-31T04:00:00Z"
 }

gitlab_api/ontology/mappings/source.yaml

@@ -3,7 +3,7 @@ connector: gitlab-api
 ontology_source: gitlab
 sync:
 - preset: gitlab-projects
-  server: gitlab-api
+  server: gitlab-mcp
   tool: gitlab_projects
   action: get
   records_path: data