Harden Python package release checks

Author: ithiria894

.github/workflows/package-smoke.yml

@@ -0,0 +1,61 @@
+name: Package smoke
+
+on:
+  push:
+    branches: ["main"]
+  pull_request:
+  workflow_dispatch:
+
+jobs:
+  python-package:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+
+      - name: Build and check Python distributions
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install build twine check-wheel-contents
+          python -m build --sdist --wheel
+          python -m twine check dist/*
+          check-wheel-contents dist/*.whl
+
+      - name: Verify wheel import and bundled probe artifact
+        run: |
+          python -m venv /tmp/intentprobe-wheel-smoke
+          /tmp/intentprobe-wheel-smoke/bin/python -m pip install --upgrade pip
+          /tmp/intentprobe-wheel-smoke/bin/python -m pip install --no-deps dist/*.whl
+          cd /tmp
+          /tmp/intentprobe-wheel-smoke/bin/python - <<'PY'
+          from importlib.resources import files
+          import intentprobe
+
+          artifact = files("intentprobe").joinpath(
+              "scanner",
+              "artifacts",
+              "qwen-pooled-curated-core-l13-15-v2",
+          )
+          assert intentprobe.__version__ == "0.1.0"
+          assert artifact.joinpath("metadata.json").is_file()
+          assert artifact.joinpath("probe_weights.npz").is_file()
+          print(f"intentprobe {intentprobe.__version__} artifact OK: {artifact}")
+          PY
+
+  npm-package:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+
+      - name: Check npm launcher package
+        run: |
+          npm --prefix npm run check
+          npm --prefix npm run pack:dry
+          npm publish ./npm --dry-run

docs/RELEASE_CHECKLIST.md

@@ -3,11 +3,19 @@
 This checklist is the local gate before telling strangers to download and try
 intentprobe.
 
+## CI package smoke
+
+The GitHub workflow `.github/workflows/package-smoke.yml` must pass on `main`.
+It builds/checks the Python wheel/sdist from a clean checkout and dry-runs the
+npm launcher package.
+
 ## Clean checkout
 
 ```bash
 git status --short --branch
-python -m pip install -e .
+python3 -m venv /tmp/intentprobe-editable-smoke
+/tmp/intentprobe-editable-smoke/bin/python -m pip install --upgrade pip
+/tmp/intentprobe-editable-smoke/bin/python -m pip install -e .
 ```
 
 ## CLI smoke tests
@@ -53,14 +61,37 @@ python -m research.activation_scanner_regression \
 ## Package build
 
 ```bash
-python -m pip install build
-python -m build --sdist --wheel
-python -m zipfile -l dist/intentprobe-0.1.0-py3-none-any.whl | \
+python3 -m venv /tmp/intentprobe-release-tools
+/tmp/intentprobe-release-tools/bin/python -m pip install --upgrade pip
+/tmp/intentprobe-release-tools/bin/python -m pip install build twine check-wheel-contents
+
+repo=/path/to/IntentProbe
+sdist_dist=$(mktemp -d /tmp/intentprobe-sdist-dist.XXXXXX)
+sdist_src=$(mktemp -d /tmp/intentprobe-sdist-src.XXXXXX)
+wheel_dist=$(mktemp -d /tmp/intentprobe-wheel-dist.XXXXXX)
+
+cd /tmp
+/tmp/intentprobe-release-tools/bin/python -m build --sdist \
+  --outdir "$sdist_dist" "$repo"
+tar -xzf "$sdist_dist"/intentprobe-0.1.0.tar.gz -C "$sdist_src"
+cd "$sdist_src"/intentprobe-0.1.0
+/tmp/intentprobe-release-tools/bin/python -m build --wheel --outdir "$wheel_dist"
+
+/tmp/intentprobe-release-tools/bin/python -m twine check \
+  "$sdist_dist"/intentprobe-0.1.0.tar.gz \
+  "$wheel_dist"/intentprobe-0.1.0-py3-none-any.whl
+/tmp/intentprobe-release-tools/bin/check-wheel-contents \
+  "$wheel_dist"/intentprobe-0.1.0-py3-none-any.whl
+python3 -m zipfile -l "$wheel_dist"/intentprobe-0.1.0-py3-none-any.whl | \
   rg 'probe_weights|metadata.json|targets.py|entry_points'
-python -m tarfile -l dist/intentprobe-0.1.0.tar.gz | \
+python3 -m tarfile -l "$sdist_dist"/intentprobe-0.1.0.tar.gz | \
   rg 'probe_weights|metadata.json|targets.py|SECURITY.md|SAMPLE_REPORTING|RELEASE_CHECKLIST|RUNTIME_HOOKS|runtime_toy_agent'
 ```
 
+Build the release wheel from the freshly extracted sdist. The repo can have an
+ignored `build/` directory from setuptools, and direct local wheel builds may
+reuse stale `build/lib` contents.
+
 ## Hygiene
 
 ```bash

pyproject.toml

@@ -29,15 +29,15 @@ intentprobe = "intentprobe.cli:main"
 intentprobe-hook = "intentprobe.hook:main"
 
 [project.urls]
-Homepage = "https://github.com/mcpware/intentprobe"
-Repository = "https://github.com/mcpware/intentprobe"
+Homepage = "https://github.com/mcpware/IntentProbe"
+Repository = "https://github.com/mcpware/IntentProbe"
+Issues = "https://github.com/mcpware/IntentProbe/issues"
 
 [tool.setuptools]
 include-package-data = true
 
 [tool.setuptools.packages.find]
-include = ["intentprobe*", "research*"]
+include = ["intentprobe*"]
 
 [tool.setuptools.package-data]
 intentprobe = ["scanner/artifacts/**/*.json", "scanner/artifacts/**/*.npz"]
-research = ["**/*.json", "**/*.md", "**/*.txt", "**/*.mjs", "**/*.ipynb"]