Repository review, self-contained sdist, and 0.1.4

[TheStreamCode]

Repository review, cleanup, documentation, and the 0.1.4 patch release.

What changed

Fixes

• CITATION.cff advertised version: 0.1.0 with date-released: 2026-07-26, a
  date matching no published release, while the project was at 0.1.3. It now
  tracks the real version and is covered by test_release_version_is_consistent
  so it cannot drift again. repository-code, abstract, and keywords were
  added.
• fetch_model_metadata read self.models_url and self.default_headers
  directly. Both exist on the pinned Hermes ProviderProfile, but a host that
  predates either field raises AttributeError inside the blanket try, which
  the probe reports as "no models" — a silent downgrade to the routing aliases
  with no diagnosable cause. Both are now read with getattr.
• fetch_models / fetch_model_metadata accept api_key=None, matching the
  upstream ProviderProfile signature. Behavior is unchanged: the
  Authorization header was already gated on a truthy key, and Hermes calls
  _p.fetch_models(api_key=..., base_url=...) with keyword arguments.
• The sdist shipped tests/ but not the files those tests read from the
  distribution root, so the suite could not run from an unpacked archive.
  MANIFEST.in adds the directory-plugin entry point, plugin.yaml,
  CHANGELOG.md, CITATION.cff, AGENTS.md, the governance documents, and the
  CI workflow. The wheel is unaffected.

Documentation

• New AGENTS.md: the two deliberate entry points, the frozen provider identity
  and environment variable names, why fallback_models holds only routing
  aliases, why the catalog probe swallows every exception, the version files
  that must move together, the protected-branch release procedure, and the fact
  that GitHub Releases — not PyPI — is the distribution channel.
• README: verified CI, release, license, and Python badges; an environment
  variable table; repository layout; the HERMES_SOURCE and wheel-build
  commands; a versioning section; links to the existing contributing, security,
  and conduct documents.
• The use_live_model_metadata comment claimed newer Hermes versions consume the
  flag. No revision of NousResearch/hermes-agent references it, so the comment
  now describes it accurately as a forward-compatible declaration that stays
  inert until a host adds support.

Housekeeping

• .gitignore: .pytest_cache/ and .ruff_cache/ were only ignored because
  both tools write a self-ignoring .gitignore into their own cache.
• .gitattributes: * text=auto, since the install docs invite contributors
  from both bash and PowerShell.

Validation

All commands were run; results are real.

• python -m unittest discover -s tests -v — 7 tests, OK (Python 3.12,
  offline; integration skipped)
• Same suite on Python 3.13 with HERMES_SOURCE pointing at
  NousResearch/hermes-agent @ 46e87b14 installed in a virtualenv —
  7 tests, OK, integration test passing, not skipped
• uv build — hermes_chutes_provider-0.1.4-py3-none-any.whl (7 830 B) and
  hermes_chutes_provider-0.1.4.tar.gz (17 034 B)
• Wheel contents verified: hermes_chutes_provider/__init__.py plus
  LICENSE, NOTICE, METADATA, WHEEL, entry_points.txt,
  top_level.txt, RECORD. No tests, caches, .env, or credentials.
• Suite re-run from the unpacked sdist — 7 tests, OK
• Wheel installed into a virtualenv with Hermes: entry point
  chutes = hermes_chutes_provider:register resolves, register() succeeds,
  get_provider_profile returns the profile for chutes, chutes-ai, and
  chutesai, and the catalog probe returns None against an unreachable
  host instead of raising
• Every URL in the README, NOTICE, and the issue-template config returns
  200
• Diff scanned for credentials — none

Risks

Low. No functional change to provider identity, aliases, environment variables,
model lists, or the transport. The getattr change can only turn a former
AttributeError into a working probe, and the api_key default widens the
accepted input.

Known issues, unchanged by this PR

• .github/dependabot.yml was removed in 6d287d0 and Dependabot automated
  security fixes are disabled on the repository, so
  .github/workflows/dependabot-auto-merge.yml cannot fire today. It is left in
  place because it becomes correct again the moment Dependabot is re-enabled;
  that is a maintainer decision, not a cleanup.
• The package is not published to PyPI and no PyPI credential or trusted
  publisher is configured, so no publishing step was attempted.

Follow-up after merge

main requires an approving review, so the tag and GitHub Release for v0.1.4
must be created from the merge commit once this lands.

🤖 Generated with Claude Code