published-probelisted

# Published Probe `identity-probe` reads a repository. This one reads the artifact. The two answer different questions, and the gap between them is a place bugs live for weeks: a source tree can be clean while everyone who runs `pip install` still gets the old identity, because the fix was merged and never released. A merged pull request changes nothing for users. Measured on 2026-07-30 across 33 published portfolio packages: **16 sent a version that disagreed with the version they were installed as. All 16 had the fix merged. None had it released.** Run: ```bash python scripts/published_probe.py lobbywatch-mcp python scripts/published_probe.py --format json bakom-mcp srgssr-mcp python scripts/published_probe.py --constraint 'mcp<2' swiss-statistics-mcp python scripts/published_probe.py --version 0.3.4 swiss-energy-mcp # after a release ``` Exit `0` clean, `1` a finding, `2` the distribution would not install (or `--version` was pinned and the venv came back holding something else). Each run creates a throwaway venv per distribution and removes it afterwards. Expect roughly a minute per package; this is not a fast check and is not meant to run on every commit. Its place is after a release, and in a periodic sweep. ## Portfolio-wide: take the target list from the manifest Never hand-assemble the list of distributions for a fleet-wide run. On 2026-07-31 such a run reported **"33 of 33 ok"** — true, and about the wrong set: `portfolio.json` listed 43 active servers, a