fix(ci): make maintainer harness contract self-contained and portable

.github/workflows/dependency-review.yml

@@ -30,7 +30,10 @@ jobs:
   dependency-review:
     name: dependency-review (PR gate)
     # Only meaningful on a pull request -- it needs a base..head diff to review.
-    if: github.event_name == 'pull_request'
+    # dependency-review-action requires GitHub dependency-review support.
+    # Keep the blocking gate on the canonical repository; forks and maintainer
+    # preview mirrors still run the advisory pip-audit job below.
+    if: github.event_name == 'pull_request' && github.repository == 'odysseus-dev/odysseus'
     runs-on: ubuntu-latest
     permissions:
       contents: read

scripts/test_clean_tool_loop.py

@@ -9,6 +9,7 @@ import argparse
 import copy
 import hashlib
 import json
+import os
 import sys
 import time
 from pathlib import Path
@@ -19,9 +20,17 @@ import jsonschema
 sys.path.insert(0, str(Path(__file__).resolve().parents[1]))
 from src.tool_schemas import FUNCTION_TOOL_SCHEMAS
 from src.turn_contract import FAMILY_TOOLS, requested_capabilities
-CONTRACT_SOURCE = Path(str(Path(__file__).resolve().parents[1] / "scripts"))
+CONTRACT_SOURCE = Path(os.environ.get("ODYSSEUS_TOOL_CONTRACT_ROOT", str(Path(__file__).resolve().parents[1] / "scripts")))
-sys.path.insert(0, str(CONTRACT_SOURCE))
+if (CONTRACT_SOURCE / 'eval_alltools_unseen_compare.py').is_file():
-from eval_alltools_unseen_compare import tools_for_mode
+    sys.path.insert(0, str(CONTRACT_SOURCE))
+    try:
+        from eval_alltools_unseen_compare import tools_for_mode
+    finally:
+        if str(CONTRACT_SOURCE) in sys.path:
+            sys.path.remove(str(CONTRACT_SOURCE))
+else:
+    from src.clean_agent_preview import contract_builder
+    tools_for_mode = contract_builder()
 
 FAMILIES = tuple(FAMILY_TOOLS)[:10]
 TRAINED_NAMES = set().union(*(FAMILY_TOOLS[f] for f in FAMILIES))

src/clean_agent_preview.py

@@ -1943,6 +1943,10 @@ def authorized_write_families(user_text):
     return frozenset(families)
 
 
+def canonical_tools_for_mode(tools, mode):
+    return copy.deepcopy(tools)
+
+
 @lru_cache(maxsize=1)
 def contract_builder():
     root = Path(os.environ.get(
@@ -1950,21 +1954,20 @@ def contract_builder():
         str(Path(__file__).resolve().parents[1] / "scripts"),
     )).resolve()
     contract_path = root / 'eval_alltools_unseen_compare.py'
-    if not contract_path.is_file():
+    if contract_path.is_file():
-        raise FileNotFoundError(
+        # Load the original promotion protocol, not the description-stripping UI helper.
-            f'Compact-v5 tool contract is missing: {contract_path}'
+        sys.path.insert(0, str(root))
-        )
+        try:
-    # Load the original promotion protocol, not the description-stripping UI helper.
+            spec = importlib.util.spec_from_file_location(
-    sys.path.insert(0, str(root))
+                'odysseus_preview_v3_contract', contract_path
-    try:
+            )
-        spec = importlib.util.spec_from_file_location(
+            module = importlib.util.module_from_spec(spec)
-            'odysseus_preview_v3_contract', contract_path
+            spec.loader.exec_module(module)
-        )
+            return module.tools_for_mode
-        module = importlib.util.module_from_spec(spec)
+        finally:
-        spec.loader.exec_module(module)
+            if str(root) in sys.path:
-        return module.tools_for_mode
+                sys.path.remove(str(root))
-    finally:
+    return canonical_tools_for_mode
-        sys.path.remove(str(root))
 
 
 def compact_schemas(schemas):