[welsbach]

What and why

The reference validator could only be run by cloning the repo and invoking python tools/okgf_validate.py. This packages it as an installable okgf command so anyone can validate OKGF bundles with a one-line install.

Install (after the first PyPI release)

curl -fsSL https://raw.githubusercontent.com/OneHillAI/okgf/main/install.sh | sh   # uv-based, no system Python
brew install OneHillAI/tap/okgf
pipx install okgf      # or: uv tool install okgf, or: pip install okgf

Changes

• okgf package (okgf/validate.py, __main__, okgf console entry point, --version). tools/okgf_validate.py becomes a thin back-compat shim that re-exports the package, so existing invocations and imports keep working.
• pyproject.toml (hatchling): PyYAML is the only runtime dependency; cryptography stays optional behind the verify extra, so the default install and the Homebrew formula are pure-Python. The wheel ships only the okgf package.
• One-line install: install.sh (curl | sh via uv; OKGF_VERIFY=1 adds signature verification) and a Homebrew formula under packaging/homebrew/okgf.rb.
• release.yml: on a vX.Y.Z tag, builds, smoke-tests the wheel, and publishes to PyPI via Trusted Publishing (OIDC) - no stored token.
• Conformance CI: installs the package and exercises the okgf command (and the shim) on Python 3.9 and 3.12. The matrix runs as the test job behind a single validate gate, so the required status context stays stable; the workflow's GITHUB_TOKEN is scoped read-only.
• Docs: one-line install at the top of the README, a new docs/INSTALL.md, and updated SPEC / CONFORMANCE / CONTRIBUTING / SECURITY / examples references.

Verification

• okgf, python -m okgf, and the tools/okgf_validate.py shim all validate the example bundles, including Ed25519 signature verification on examples/governed.
• Without cryptography, --pubkey degrades gracefully (exit 2, clear message) rather than crashing.
• Wheel + sdist build; the wheel contains only okgf/ plus the entry point; it installs and runs in a throwaway env.
• 40/40 tests pass, green on CI across 3.9 and 3.12.

Maintainer follow-ups (human-only, not blocking this PR)

1. PyPI: claim the okgf name and register this repo's release.yml (environment pypi) as its Trusted Publisher. Until then, a tag build will fail only at the publish step.
2. Homebrew: create OneHillAI/homebrew-tap with Formula/okgf.rb from packaging/homebrew/okgf.rb (the url/sha256 placeholders are filled from the PyPI release / brew bump-formula-pr).

The curl/brew/pipx one-liners above go live once v0.1.0 is published to PyPI.