test: gate releases on enforced conformance and installed package checks

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0e747-8f27-7242-8df8-8bc44f88c929

tools/check_installed_package.py

@@ -0,0 +1,46 @@
+#!/usr/bin/env python3
+"""Check an installed wheel outside the checkout's import path (use python -I).
+
+Run via: uv run --no-project --with dist/<wheel> python -I tools/check_installed_package.py
+No startup, owner requests, credentials or database connection are needed.
+"""
+import json
+from importlib.resources import files
+from pathlib import Path
+
+import hub_core
+from hub_core.conformance import ConformanceHarness
+from hub_core.runtime.app import create_app
+from hub_core.runtime.config import RuntimeSettings
+from hub_core.runtime.inbox_projection import create_inbox_projection_router
+from hub_core.security.boundary import iter_routes, route_key
+from hub_core.security.browser import BROWSER_ROUTES, create_browser_router
+
+
+def main():
+    checkout = Path(__file__).resolve().parents[1]
+    installed = Path(hub_core.__file__).resolve()
+    if installed.is_relative_to(checkout):
+        raise RuntimeError('package smoke imported checkout instead of installed wheel')
+    catalog = json.loads(files('hub_core.security').joinpath('routes.json').read_text())['routes']
+    app = create_app(settings=RuntimeSettings(environment='test', access_mode='enforce'))
+    routes = [*iter_routes(app), *iter_routes(create_inbox_projection_router())]
+    missing = [route_key(route, method) for route in routes if hasattr(route, 'methods')
+               for method in route.methods if route.path != '/healthz' and route_key(route, method) not in catalog]
+    if missing:
+        raise RuntimeError('installed action catalog is incomplete: ' + ', '.join(missing))
+    browser = {(method, route.path) for route in iter_routes(create_browser_router())
+               for method in route.methods}
+    if browser != BROWSER_ROUTES:
+        raise RuntimeError('installed browser route coverage differs')
+    # Constructor loads packaged contract fixtures; these checks load schemas.
+    harness = ConformanceHarness(None)
+    harness._schema_validate()
+    harness._no_secrets()
+    if not files('hub_core.migrations').joinpath('script.py.mako').is_file():
+        raise RuntimeError('installed migration template missing')
+    print('Installed wheel: imports, action catalog, browser routes, contract resources and migration template pass')
+
+
+if __name__ == '__main__':
+    main()